[Xen-ia64-devel] VNIF bug with PV-on-HVM on IA64

["Kasai Takanori" <kasai.takanori@xxxxxxxxxxxxxx>]

Hi All,

We were testing VNIF with PV-on-HVM. 
When VNIF is used on the IA64 architecture, the kernel panic occurs.
It happens when the ping command is executed from other machines. 

It is generated in the following environment. 
Architecture : only IA64
Xen     : Xen-3.1
GuestOS : RHEL4U4(2.6.9-42), RHEL4U5(2.6.9-55)
   
GuestOS is not generated in RHEL5GA(2.6.18-8).
Moreover, it is not generated in the x86 architecture. 

When having confirmed it before, xen-unstable.hg was generated. 
It seems that the problem remains now. 

We investigated this problem a little. 
The kernel panic occurs by the following __skb_dequeue(). 

drivers/xen/netfront/netfront.c
1300  static int netif_poll(struct net_device *dev, int *pbudget)
1301  {
....
1449          while ((skb = __skb_dequeue(&rxq)) != NULL) {
1450                  struct page *page = NETFRONT_SKB_CB(skb)->page;
1451                  void *vaddr = page_address(page);
1452                  unsigned offset = NETFRONT_SKB_CB(skb)->offset;
1453
1454                  memcpy(skb->data, vaddr + offset, skb_headlen(skb));

An illegal address returns by __skb_dequeue(). 
It seems to relate the sk_buff structure different. 
(As for generated RHEL4U4/U5 and RHELGA not generated, 
the sk_buff structure is different.) 

The problem didn't occur if the NETFRONT_SKB_CB macro is not used 
like the previous changeset. 
The difference is for your information appended. (netfront.diff)
We do not understand the cause still generated well. 
Why does this problem occur?
Please give advice to us some.

Best Regards,

--
Takanori Kasai

netfront.diff
Description: Binary data

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel