Re: [Xen-devel] 4.11.0 RC1 panic

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 12.06.18 at 22:55, <bouyer@xxxxxxxxxxxxxxx> wrote:
> On Tue, Jun 12, 2018 at 05:38:45PM +0200, Manuel Bouyer wrote:
>> On Tue, Jun 12, 2018 at 01:39:05PM +0200, Manuel Bouyer wrote:
>> > I applied this patch to 4.11rc4 (let's not change too much things at the
>> > same time) and rebooted my test host. Hopefully I'll have some data to 
>> > report
>> > soon
>> 
>> Got the first panic (still from a i386 domU):
> 
> I got another panic, possibly at domain shutdown.

Hmm, I can't identify the source of

(XEN) Assertion '!page->linear_pt_count' failed at mm.c:596

In fact, there's no assertion with that expression anywhere I could
see. Do you have any local patches in place? In any event, to take
care of the other assertion you've hit below an updated debugging
patch. I hope I didn't overlook any further (cascade) ones.

Jan

--- unstable.orig/xen/arch/x86/domain.c
+++ unstable/xen/arch/x86/domain.c
@@ -1872,6 +1872,7 @@ static int relinquish_memory(
 
     while ( (page = page_list_remove_head(list)) )
     {
+bool log = false;//temp
         /* Grab a reference to the page so it won't disappear from under us. */
         if ( unlikely(!get_page(page, d)) )
         {
@@ -1880,6 +1881,10 @@ static int relinquish_memory(
             continue;
         }
 
+if(is_pv_32bit_domain(d) && PGT_type_equal(page->u.inuse.type_info, 
PGT_l2_page_table)) {//temp
+ printk("d%d:%"PRI_mfn": %lx:%d\n", d->domain_id, mfn_x(page_to_mfn(page)), 
page->u.inuse.type_info, page->linear_pt_count);
+ log = true;
+}
         if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) )
             ret = put_page_and_type_preemptible(page);
         switch ( ret )
@@ -1921,7 +1926,13 @@ static int relinquish_memory(
             if ( likely(y == x) )
             {
                 /* No need for atomic update of type_info here: noone else 
updates it. */
-                switch ( ret = free_page_type(page, x, 1) )
+//temp                switch ( ret = free_page_type(page, x, 1) )
+ret = free_page_type(page, x, 1);//temp
+if(log) {//temp
+ printk("%"PRI_mfn" -> %lx:%d (%d,%d,%d)\n", mfn_x(page_to_mfn(page)), 
page->u.inuse.type_info,
+        page->linear_pt_count, ret, page->nr_validated_ptes, 
page->partial_pte);
+}
+switch(ret)//temp
                 {
                 case 0:
                     break;
--- unstable.orig/xen/arch/x86/mm.c
+++ unstable/xen/arch/x86/mm.c
@@ -705,12 +705,19 @@ static bool inc_linear_entries(struct pa
     return true;
 }
 
-static void dec_linear_entries(struct page_info *pg)
+//temp static void dec_linear_entries(struct page_info *pg)
+static struct domain*dec_linear_entries(struct page_info*pg)//temp
 {
     typeof(pg->linear_pt_count) oc;
 
     oc = arch_fetch_and_add(&pg->linear_pt_count, -1);
+{//temp
+ struct domain*owner = page_get_owner(pg);
+ if(oc <= 0 && is_pv_32bit_domain(owner))
+  return owner;
+}
     ASSERT(oc > 0);
+return NULL;//temp
 }
 
 static bool inc_linear_uses(struct page_info *pg)
@@ -2615,11 +2622,25 @@ static int _put_final_page_type(struct p
     /* No need for atomic update of type_info here: noone else updates it. */
     if ( rc == 0 )
     {
+struct domain*d;//temp
         if ( ptpg && PGT_type_equal(type, ptpg->u.inuse.type_info) )
         {
             dec_linear_uses(page);
+if((d = ({//temp
             dec_linear_entries(ptpg);
+})) != NULL) {//temp
+ printk("d%d: %"PRI_mfn":%lx:%d -> %"PRI_mfn":%lx:%d\n", d->domain_id,
+        mfn_x(page_to_mfn(ptpg)), ptpg->u.inuse.type_info, 
ptpg->linear_pt_count,
+        mfn_x(page_to_mfn(page)), page->u.inuse.type_info, 
page->linear_pt_count);
+ domain_crash(d);
+}
         }
+if(is_pv_32bit_domain(d = page_get_owner(page))) {//temp
+ if(page->linear_pt_count && !d->is_dying) {
+  printk("d%d:%"PRI_mfn": %lx:%d (%p)\n", d->domain_id, 
mfn_x(page_to_mfn(page)), page->u.inuse.type_info, page->linear_pt_count, ptpg);
+  domain_crash(d);
+ }
+} else
         ASSERT(!page->linear_pt_count || page_get_owner(page)->is_dying);
         set_tlbflush_timestamp(page);
         smp_wmb();
@@ -2704,8 +2725,16 @@ static int _put_page_type(struct page_in
 
             if ( ptpg && PGT_type_equal(x, ptpg->u.inuse.type_info) )
             {
+struct domain*d;//temp
                 dec_linear_uses(page);
+if((d = ({//temp
                 dec_linear_entries(ptpg);
+})) != NULL) {//temp
+ printk("d%d: %"PRI_mfn":%lx:%d => %"PRI_mfn":%lx:%d\n", d->domain_id,
+        mfn_x(page_to_mfn(ptpg)), ptpg->u.inuse.type_info, 
ptpg->linear_pt_count,
+        mfn_x(page_to_mfn(page)), page->u.inuse.type_info, 
page->linear_pt_count);
+ domain_crash(d);
+}
             }
 
             return 0;



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel