thr3ads.net - Xen devel - [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash [Nov 2010]

If this information is useful, please help other people find it:
Share via:

Wei Wang2

2010-Nov-29 14:34 UTC

[Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Hi,
I got the following crash with latest unstable on my testing machine when 
destroying a hvm guest with passthru devices.

(XEN) ----[ Xen-4.1-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    1
(XEN) RIP:    e008:[<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
(XEN) RFLAGS: 0000000000010283   CONTEXT: hypervisor
(XEN) rax: 0000000000100000   rbx: 0000000000001000   rcx: 0000000000065d10
(XEN) rdx: ffff82f601600008   rsi: 0000000000000014   rdi: ffff82f600945e00
(XEN) rbp: ffff83014feefe10   rsp: ffff83014feefe10   r8:  bfffffffffffffff
(XEN) r9:  ffffffffffffffff   r10: 0000000000000004   r11: 0000000000000004
(XEN) r12: ffff83014a396000   r13: ffff83014a396000   r14: ffffffffffffffff
(XEN) r15: ffff83014feeff18   cr0: 000000008005003b   cr4: 00000000000006f0
(XEN) cr3: 0000000249201000   cr2: ffff82f601600008
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83014feefe10:
(XEN)    ffff83014feefe20 ffff82c4801283c7 ffff83014feefe40 ffff82c480155044
(XEN)    ffff8300afe58000 00000000ffffffff ffff83014feefe70 ffff82c4801050b8
(XEN)    ffff83014feefea0 0000000000000000 ffff83014ffa81a0 0000000000000000
(XEN)    ffff83014feefea0 ffff82c480128e43 0000000000000001 0000000000000001
(XEN)    0000000000000001 ffff82c4802af080 ffff83014feefee0 ffff82c480121243
(XEN)    ffff83014feeff18 ffff83014feeff18 ffff8300afe6a000 ffff83014feefdf8
(XEN)    ffff8300afcdc000 ffff83014ffa8040 ffff83014feefef0 ffff82c480121397
(XEN)    ffff83014feeff10 ffff82c480151e06 ffff82c480121397 0000000000000001
(XEN)    ffff83014feefd28 0000000000000000 0000000000000000 0000000000000000
(XEN)    ffffffff807dc004 ffffffff8079bf48 0000000000000000 0000000000000246
(XEN)    0000000000000060 0000000000000000 0000000000000000 0000000000000000
(XEN)    ffffffff802053aa 0000000000000001 00000000deadbeef 00000000deadbeef
(XEN)    0000010000000000 ffffffff802053aa 000000000000e033 0000000000000246
(XEN)    ffffffff8079bf10 000000000000e02b 000000000000beef 000000000000beef
(XEN)    000000000000beef 000000000000beef 0000000000000001 ffff8300afe6a000
(XEN)    0000003ccfcd5d80 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
(XEN)    [<ffff82c4801283c7>] xfree+0x9d/0xad
(XEN)    [<ffff82c480155044>] arch_domain_destroy+0x2de/0x2e3
(XEN)    [<ffff82c4801050b8>] complete_domain_destroy+0x71/0x12c
(XEN)    [<ffff82c480128e43>] rcu_process_callbacks+0x173/0x1df
(XEN)    [<ffff82c480121243>] __do_softirq+0x86/0x97
(XEN)    [<ffff82c480121397>] do_softirq+0x64/0x69
(XEN)    [<ffff82c480151e06>] idle_loop+0x57/0x59
(XEN)
(XEN) Pagetable walk from ffff82f601600008:
(XEN)  L4[0x105] = 00000000afca2027 5555555555555555
(XEN)  L3[0x1d8] = 000000024ede2063 5555555555555555
(XEN)  L2[0x00b] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 1:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0002]
(XEN) Faulting linear address: ffff82f601600008
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...

It looks like, in function unmap_domain_pirq_emuirq(),  emuirq = 
domain_pirq_to_emuirq(d, pirq) returns a negative array subscript(-2). 
Attached patch could fix this issue.

Thanks,
Wei

Signed-off-by: Wei Wang <wei.wang2@amd.com>

Legal Information:
Advanced Micro Devices GmbH
Sitz: Dornach, Gemeinde Aschheim, 
Landkreis München Registergericht München, 
HRB Nr. 43632
Geschäftsführer:
Alberto Bozzo, Andrew Bowd


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Keir Fraser

2010-Nov-29 14:48 UTC

head link

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Stefano,

Can you ack/nack this patch please.

 -- Keir

On 29/11/2010 14:34, "Wei Wang2" <wei.wang2@amd.com> wrote:
> Hi,
> I got the following crash with latest unstable on my testing machine when
> destroying a hvm guest with passthru devices.
> 
> (XEN) ----[ Xen-4.1-unstable  x86_64  debug=y  Tainted:    C ]----
> (XEN) CPU:    1
> (XEN) RIP:    e008:[<ffff82c480115cb5>]
free_xenheap_pages+0x10d/0x122
> (XEN) RFLAGS: 0000000000010283   CONTEXT: hypervisor
> (XEN) rax: 0000000000100000   rbx: 0000000000001000   rcx: 0000000000065d10
> (XEN) rdx: ffff82f601600008   rsi: 0000000000000014   rdi: ffff82f600945e00
> (XEN) rbp: ffff83014feefe10   rsp: ffff83014feefe10   r8:  bfffffffffffffff
> (XEN) r9:  ffffffffffffffff   r10: 0000000000000004   r11: 0000000000000004
> (XEN) r12: ffff83014a396000   r13: ffff83014a396000   r14: ffffffffffffffff
> (XEN) r15: ffff83014feeff18   cr0: 000000008005003b   cr4: 00000000000006f0
> (XEN) cr3: 0000000249201000   cr2: ffff82f601600008
> (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
> (XEN) Xen stack trace from rsp=ffff83014feefe10:
> (XEN)    ffff83014feefe20 ffff82c4801283c7 ffff83014feefe40
ffff82c480155044
> (XEN)    ffff8300afe58000 00000000ffffffff ffff83014feefe70
ffff82c4801050b8
> (XEN)    ffff83014feefea0 0000000000000000 ffff83014ffa81a0
0000000000000000
> (XEN)    ffff83014feefea0 ffff82c480128e43 0000000000000001
0000000000000001
> (XEN)    0000000000000001 ffff82c4802af080 ffff83014feefee0
ffff82c480121243
> (XEN)    ffff83014feeff18 ffff83014feeff18 ffff8300afe6a000
ffff83014feefdf8
> (XEN)    ffff8300afcdc000 ffff83014ffa8040 ffff83014feefef0
ffff82c480121397
> (XEN)    ffff83014feeff10 ffff82c480151e06 ffff82c480121397
0000000000000001
> (XEN)    ffff83014feefd28 0000000000000000 0000000000000000
0000000000000000
> (XEN)    ffffffff807dc004 ffffffff8079bf48 0000000000000000
0000000000000246
> (XEN)    0000000000000060 0000000000000000 0000000000000000
0000000000000000
> (XEN)    ffffffff802053aa 0000000000000001 00000000deadbeef
00000000deadbeef
> (XEN)    0000010000000000 ffffffff802053aa 000000000000e033
0000000000000246
> (XEN)    ffffffff8079bf10 000000000000e02b 000000000000beef
000000000000beef
> (XEN)    000000000000beef 000000000000beef 0000000000000001
ffff8300afe6a000
> (XEN)    0000003ccfcd5d80 0000000000000000
> (XEN) Xen call trace:
> (XEN)    [<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
> (XEN)    [<ffff82c4801283c7>] xfree+0x9d/0xad
> (XEN)    [<ffff82c480155044>] arch_domain_destroy+0x2de/0x2e3
> (XEN)    [<ffff82c4801050b8>] complete_domain_destroy+0x71/0x12c
> (XEN)    [<ffff82c480128e43>] rcu_process_callbacks+0x173/0x1df
> (XEN)    [<ffff82c480121243>] __do_softirq+0x86/0x97
> (XEN)    [<ffff82c480121397>] do_softirq+0x64/0x69
> (XEN)    [<ffff82c480151e06>] idle_loop+0x57/0x59
> (XEN)
> (XEN) Pagetable walk from ffff82f601600008:
> (XEN)  L4[0x105] = 00000000afca2027 5555555555555555
> (XEN)  L3[0x1d8] = 000000024ede2063 5555555555555555
> (XEN)  L2[0x00b] = 0000000000000000 ffffffffffffffff
> (XEN)
> (XEN) ****************************************
> (XEN) Panic on CPU 1:
> (XEN) FATAL PAGE FAULT
> (XEN) [error_code=0002]
> (XEN) Faulting linear address: ffff82f601600008
> (XEN) ****************************************
> (XEN)
> (XEN) Reboot in five seconds...
> 
> It looks like, in function unmap_domain_pirq_emuirq(),  emuirq >
domain_pirq_to_emuirq(d, pirq) returns a negative array subscript(-2).
> Attached patch could fix this issue.
> 
> Thanks,
> Wei
> 
> Signed-off-by: Wei Wang <wei.wang2@amd.com>
> 
> Legal Information:
> Advanced Micro Devices GmbH
> Sitz: Dornach, Gemeinde Aschheim,
> Landkreis München Registergericht München,
> HRB Nr. 43632
> Geschäftsführer:
> Alberto Bozzo, Andrew Bowd
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Stefano Stabellini

2010-Nov-29 15:49 UTC

head link

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

On Mon, 29 Nov 2010, Keir Fraser wrote:> Stefano,
> 
> Can you ack/nack this patch please.
> 
ack.

I think we also need this:


diff -r 79b71c77907b xen/arch/x86/physdev.c
--- a/xen/arch/x86/physdev.c	Wed Nov 24 10:20:03 2010 +0000
+++ b/xen/arch/x86/physdev.c	Mon Nov 29 15:26:03 2010 +0000
@@ -236,7 +236,8 @@ static int physdev_unmap_pirq(struct phy
         spin_lock(&d->event_lock);
         ret = unmap_domain_pirq_emuirq(d, unmap->pirq);
         spin_unlock(&d->event_lock);
-        goto free_domain;
+        if ( unmap->domid == DOMID_SELF || ret )
+            goto free_domain;
     }
 
     ret = -EPERM;


Wei, could you give it a try, in addition to your patch?

Thanks,

Stefano

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Wei Wang2

2010-Nov-29 16:47 UTC

head link

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

On Monday 29 November 2010 16:49:05 Stefano Stabellini
wrote:> On Mon, 29 Nov 2010, Keir Fraser wrote:
> > Stefano,
> >
> > Can you ack/nack this patch please.
>
> ack.
>
> I think we also need this:
>
>
> diff -r 79b71c77907b xen/arch/x86/physdev.c
> --- a/xen/arch/x86/physdev.c	Wed Nov 24 10:20:03 2010 +0000
> +++ b/xen/arch/x86/physdev.c	Mon Nov 29 15:26:03 2010 +0000
> @@ -236,7 +236,8 @@ static int physdev_unmap_pirq(struct phy
>          spin_lock(&d->event_lock);
>          ret = unmap_domain_pirq_emuirq(d, unmap->pirq);
>          spin_unlock(&d->event_lock);
> -        goto free_domain;
> +        if ( unmap->domid == DOMID_SELF || ret )
> +            goto free_domain;
>      }
>
>      ret = -EPERM;
>
>
> Wei, could you give it a try, in addition to your patch?
>
> Thanks,
>
> Stefano
Hi Stefano,
This patch works well together with my patch on our testing system. No more 
crashes.
Thanks,
Wei 


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Stefano Stabellini

2010-Nov-29 17:32 UTC

head link

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

On Mon, 29 Nov 2010, Wei Wang2 wrote:> On Monday 29 November 2010 16:49:05 Stefano Stabellini wrote:
> > On Mon, 29 Nov 2010, Keir Fraser wrote:
> > > Stefano,
> > >
> > > Can you ack/nack this patch please.
> >
> > ack.
> >
> > I think we also need this:
> >
> >
> > diff -r 79b71c77907b xen/arch/x86/physdev.c
> > --- a/xen/arch/x86/physdev.c	Wed Nov 24 10:20:03 2010 +0000
> > +++ b/xen/arch/x86/physdev.c	Mon Nov 29 15:26:03 2010 +0000
> > @@ -236,7 +236,8 @@ static int physdev_unmap_pirq(struct phy
> >          spin_lock(&d->event_lock);
> >          ret = unmap_domain_pirq_emuirq(d, unmap->pirq);
> >          spin_unlock(&d->event_lock);
> > -        goto free_domain;
> > +        if ( unmap->domid == DOMID_SELF || ret )
> > +            goto free_domain;
> >      }
> >
> >      ret = -EPERM;
> >
> >
> > Wei, could you give it a try, in addition to your patch?
> >
> > Thanks,
> >
> > Stefano
> 
> Hi Stefano,
> This patch works well together with my patch on our testing system. No more
> crashes.
Thanks!
Keir, can you please apply both patches?

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Xen devel - Nov 2010 - [PATCH] hvm passthru: Fix a xen-unstable crash

[Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash

Re: [Xen-devel] [PATCH] hvm passthru: Fix a xen-unstable crash