Subject: Re: Bug inkvm_set_irq

From: "Michael S. Tsirkin" <[email-masked]>
Date: Tue, 8 Mar 2011 13:13:20 +0200

On Fri, Mar 04, 2011 at 10:39:05AM +0100, Jean-Philippe Menil wrote:
> Yes, it's a 2.6.37.2 kernel.

OK, here's a debugging patch.
Please run with slab debugging as previously until you see
'eventfd bug detected!' in dmesg or until there is a crash.
It might be also useful to enable timestampts on printk with
 Symbol: PRINTK_TIME [=y]
  │ Type  : boolean
  │ Prompt: Show timing information on printks
 
once you see the error, please upload the
full dmesg output somewhere to we can track what
goes on.

Hopefully there won't be an oops this time which
should make it easier for you to test (no need to
reboot).

diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index c1f1e3c..3cb679b 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -32,6 +32,7 @@
 #include <linux/eventfd.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/nmi.h>
 
 #include "iodev.h"
 
@@ -43,6 +44,8 @@
  * --------------------------------------------------------------------
  */
 
+#define KVM_BAD_PTR ((void*)(long)(0x6b6b6b6b6b6b6b6bull))
+
 struct _irqfd {
 	struct kvm               *kvm;
 	struct eventfd_ctx       *eventfd;
@@ -61,6 +64,13 @@ irqfd_inject(struct work_struct *work)
 {
 	struct _irqfd *irqfd = container_of(work, struct _irqfd, inject);
 	struct kvm *kvm = irqfd->kvm;
+	if (kvm == KVM_BAD_PTR) {
+		printk(KERN_ERR "Eventfd bug detected!\n");
+		printk(KERN_ERR "%s(work=%p,irqfd=%p,kvm=%p,gsi=%d)\n", __func__,
+			work, irqfd, kvm, irqfd->gsi);
+		trigger_all_cpu_backtrace();
+		return;
+	}
 
 	kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID, irqfd->gsi, 1);
 	kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID, irqfd->gsi, 0);
@@ -75,6 +85,8 @@ irqfd_shutdown(struct work_struct *work)
 	struct _irqfd *irqfd = container_of(work, struct _irqfd, shutdown);
 	u64 cnt;
 
+	printk(KERN_ERR "%s(work=%p,irqfd=%p,kvm=%p, gsi=%d)\n", __func__,
+	       work, irqfd, irqfd->kvm, irqfd->gsi);
 	/*
 	 * Synchronize with the wait-queue and unhook ourselves to prevent
 	 * further events.
@@ -91,6 +103,8 @@ irqfd_shutdown(struct work_struct *work)
 	 * It is now safe to release the object's resources
 	 */
 	eventfd_ctx_put(irqfd->eventfd);
+	printk(KERN_ERR "kfree at %s(work=%p,irqfd=%p)\n", __func__,
+	       work, irqfd);
 	kfree(irqfd);
 }
 
@@ -111,6 +125,8 @@ static void
 irqfd_deactivate(struct _irqfd *irqfd)
 {
 	BUG_ON(!irqfd_is_active(irqfd));
+	printk(KERN_ERR "%s(irqfd=%p,kvm=%p, gsi=%d)\n", __func__,
+	       irqfd, irqfd->kvm, irqfd->gsi);
 
 	list_del_init(&irqfd->list);
 
@@ -178,6 +194,8 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
 
 	irqfd->kvm = kvm;
 	irqfd->gsi = gsi;
+	printk(KERN_ERR "%s(irqfd=%p,kvm=%p, gsi=%d)\n", __func__,
+	       irqfd, kvm, gsi);
 	INIT_LIST_HEAD(&irqfd->list);
 	INIT_WORK(&irqfd->inject, irqfd_inject);
 	INIT_WORK(&irqfd->shutdown, irqfd_shutdown);
@@ -264,6 +282,8 @@ kvm_irqfd_deassign(struct kvm *kvm, int fd, int gsi)
 	struct _irqfd *irqfd, *tmp;
 	struct eventfd_ctx *eventfd;
 
+	printk(KERN_ERR "%s(kvm=%p, gsi=%d)\n", __func__,
+	       kvm, gsi);
 	eventfd = eventfd_ctx_fdget(fd);
 	if (IS_ERR(eventfd))
 		return PTR_ERR(eventfd);
@@ -305,6 +325,7 @@ void
 kvm_irqfd_release(struct kvm *kvm)
 {
 	struct _irqfd *irqfd, *tmp;
+	printk(KERN_ERR "%s(kvm=%p)\n", __func__, kvm);
 
 	spin_lock_irq(&kvm->irqfds.lock);