From mboxrd@z Thu Jan  1 00:00:00 1970
From: =?ISO-8859-1?Q?J=FCrgen_Gro=DF?= <jgross@suse.com>
Subject: Re: Xen-unstable: Xen panic when shutting down HVM
 guest with PCI passthrough: RIP: e008:[<ffff82d0801099b1>]
 evtchn_move_pirqs+0x90/0xbf
Date: Fri, 06 Jun 2014 06:43:28 +0200
Message-ID: <539146F0.7040902@suse.com>
References: <495141585.20140605165458@eikelenboom.it>
	<539086BC.7070200@citrix.com>
	<1617474467.20140605180343@eikelenboom.it>
	<53909933.5020109@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta14.messagelabs.com ([193.109.254.103])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <jgross@suse.com>) id 1Wsm05-0004GY-09
	for xen-devel@lists.xenproject.org; Fri, 06 Jun 2014 04:43:33 +0000
In-Reply-To: <53909933.5020109@citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Andrew Cooper <andrew.cooper3@citrix.com>, Sander Eikelenboom <linux@eikelenboom.it>
Cc: George Dunlap <george.dunlap@eu.citrix.com>, xen-devel@lists.xenproject.org, Jan Beulich <jbeulich@suse.com>
List-Id: xen-devel@lists.xenproject.org

On 06/05/2014 06:22 PM, Andrew Cooper wrote:
> On 05/06/14 17:03, Sander Eikelenboom wrote:
>> Thursday, June 5, 2014, 5:03:24 PM, you wrote:
>>
>>> On 05/06/14 15:54, Sander Eikelenboom       wrote:
>>>
>>> Hi,
>>> When shutting down a HVM guest with PCI passthrough Xen panics with the panic
>>> below (complete xl-dmesg attached).
>>> # addr2line -e xen-syms ffff82d0801099b1
>>> /usr/src/new/xen-unstable/xen/common/event_channel.c:1326
>>> which is:
>>>          pirq_set_affinity(d, chn->u.pirq.irq, mask);
>>>
>>>
>>>       This is presumably an ordering issue on destroy.
>>>
>>>       Does reverting bac6334b5 fix the problem?
>>>
>>>       ~Andrew
>> Hi Andrew,
>>
>> That seems to have been a good hunch, after reverting that commit i have been
>> able to repeatedly create and shutdown the guest with passthrough, without a crash.
>>
>> --
>> Sander
>>
>
> CC'ing George and Juergen as the authors of the identified patch
>
> c/s bac6334b5 "move domain to cpupool0 before destroying it" appears to
> cause the crash identified the root of this thread.
>
> It appears to now move event channels after having torn parts of the
> event channel infrastructure.

Hmm, does the following patch fix it?


Juergen

diff --git a/xen/common/schedule.c b/xen/common/schedule.c
index c174c41..3ea9fc8 100644
--- a/xen/common/schedule.c
+++ b/xen/common/schedule.c
@@ -297,7 +297,8 @@ int sched_move_domain(struct domain *d, struct 
cpupool *c)
          spin_unlock_irq(lock);

          v->sched_priv = vcpu_priv[v->vcpu_id];
-        evtchn_move_pirqs(v);
+        if ( !d->is_dying )
+            evtchn_move_pirqs(v);

          new_p = cpumask_cycle(new_p, c->cpu_valid);