[Xen-devel] [PATCH] Fix panic in mcheck_mca_logout

["SUZUKI, Kazuhiro" <kaz@xxxxxxxxxxxxxx>]

Hi, 

I met the following panic message in mcheck_mca_logout().
MSR_IA32_MCi_ADDR might take the values other than the machine address.
FATAL PAGE FAULT occured when the non-existent address is passed to
maddr_get_owner().
The attached patch fixes it.

Thanks,
KAZ

Signed-off-by: Kazuhiro Suzuki <kaz@xxxxxxxxxxxxxx>


(XEN) ----[ Xen-3.5-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    10
(XEN) RIP:    e008:[<ffff828c8018ab0e>] mcheck_mca_logout+0x3fa/0x6eb
(XEN) RFLAGS: 0000000000010082   CONTEXT: hypervisor
(XEN) rax: ffff828919003080   rbx: 0000000000000005   rcx: 0000000000000001
(XEN) rdx: 000000000000000a   rsi: 000000000000000a   rdi: ffff828c8021e408
(XEN) rbp: ffff83123fee1ed8   rsp: ffff83123fee1db8   r8:  0000000000000004
(XEN) r9:  0000000000000004   r10: 000000000000000b   r11: 000000000000000b
(XEN) r12: 0000000000000005   r13: 0000000000000415   r14: 0000000000000005
(XEN) r15: 0000000000000415   cr0: 000000008005003b   cr4: 00000000000026f0
(XEN) cr3: 00000010dc07d000   cr2: ffff828919003098
(XEN) ds: 002b   es: 002b   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83123fee1db8:
(XEN)    0000000000000000 0000000000000000 ffff83123fee1e58 ffff83123fee1e38
(XEN)    ffff83123fee1ee8 ffff83123fee1ef8 ffff828c802c9ed0 0000000400000000
(XEN)    0000000000000416 ffff83123fff1ca0 0000002000000020 0000000000000000
(XEN)    ffff83123ff71c10 0000000000000000 0000000200000000 ffff83123fee7f28
(XEN)    0000000500300001 be00000000800400 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 000a7fff00200000 0001000200000000
(XEN)    0000004000000005 0000000000000004 0000000000000000 0000028c801848a5
(XEN)    be00000000800400 0000000000000004 0000000000000000 ffff83123fee7f28
(XEN)    ffff8312029d55a0 ffff8312029d5660 0000000000000002 00000000009fe610
(XEN)    ffff83123fee1f28 ffff828c8018d9f4 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000000
(XEN)    0000000000000000 ffff83123fee7f28 ffff83123fee1f38 ffff828c8018a167
(XEN)    ffff83123fee1f48 ffff828c8016ac71 00007cedc011e087 ffff828c801df943
(XEN)    00000000009fe610 0000000000000002 ffff8312029d5660 ffff8312029d55a0
(XEN)    ffff83123fee7e50 ffff83123fee7f28 00ff00ff00ff00ff ffff83123ff7c778
(XEN)    0000000000000004 00000000000012e6 0000000000000001 0000000000000001
(XEN)    0000000000001008 ffff83123fee7ec8 ffff8312029d5660 0000001200000000
(XEN)    ffff828c801848a5 000000000000e008 0000000000010046 ffff83123fee7e50
(XEN)    000000000000e010 0000000000000000 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff828c8018ab0e>] mcheck_mca_logout+0x3fa/0x6eb
(XEN)    [<ffff828c8018d9f4>] intel_machine_check+0x43/0x206
(XEN)    [<ffff828c8018a167>] machine_check_vector+0xa/0xc
(XEN)    [<ffff828c8016ac71>] do_machine_check+0xc/0xe
(XEN)    [<ffff828c801df943>] handle_ist_exception+0x58/0x65
(XEN)    [<ffff828c801848a5>] acpi_idle_do_entry+0x31/0x3c
(XEN)    [<ffff828c80185804>] acpi_processor_idle+0x415/0x651
(XEN)    [<ffff828c80146cce>] idle_loop+0x75/0x7c
(XEN)    
(XEN) Pagetable walk from ffff828919003098:
(XEN)  L4[0x105] = 00000000bf4a2027 5555555555555555
(XEN)  L3[0x024] = 0000000000000000 ffffffffffffffff
(XEN) 
(XEN) ****************************************
(XEN) Panic on CPU 10:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: ffff828919003098
(XEN) ****************************************
(XEN) 
(XEN) Reboot in five seconds...

diff -r d2a32e24fe50 xen/arch/x86/cpu/mcheck/mce.c
--- a/xen/arch/x86/cpu/mcheck/mce.c     Wed Sep 09 16:39:41 2009 +0100
+++ b/xen/arch/x86/cpu/mcheck/mce.c     Tue Sep 15 00:44:51 2009 +0900
@@ -237,10 +237,12 @@
 
                if (status & MCi_STATUS_ADDRV) {
                        mca_rdmsrl(MSR_IA32_MC0_ADDR + 4 * i, addr);
-                       d = maddr_get_owner(addr);
-                       if (d != NULL && (who == MCA_POLLER ||
-                           who == MCA_CMCI_HANDLER))
-                               mcb.mc_domid = d->domain_id;
+                       if (mfn_valid(paddr_to_pfn(addr))) {
+                               d = maddr_get_owner(addr);
+                               if (d != NULL && (who == MCA_POLLER ||
+                                   who == MCA_CMCI_HANDLER))
+                                       mcb.mc_domid = d->domain_id;
+                       }
                }
 
                if (status & MCi_STATUS_MISCV)

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel