On 06/30/2015 06:09 PM, Andrew Cooper wrote: > The call to iommu_pte_flush() between the two hunks uses &ept_entry->epte > which is a pointer into the mapped page. > > It is eventually passed to `clflush` instruction which will suffer a pagefault > if the virtual mapping has fallen out of the TLB. > > (XEN) ----[ Xen-4.5.0-xs102594-d x86_64 debug=y Not tainted ]---- > (XEN) CPU: 7 > (XEN) RIP: e008:[<ffff82d0801572f0>] cacheline_flush+0x4/0x9 > <snip> > (XEN) Xen call trace: > (XEN) [<ffff82d0801572f0>] cacheline_flush+0x4/0x9 > (XEN) [<ffff82d08014ffff>] __iommu_flush_cache+0x4a/0x6a > (XEN) [<ffff82d0801532e2>] iommu_pte_flush+0x2b/0xd5 > (XEN) [<ffff82d0801f909a>] ept_set_entry+0x4bc/0x61f > (XEN) [<ffff82d0801f0c25>] p2m_set_entry+0xd1/0x112 > (XEN) [<ffff82d0801f25b1>] clear_mmio_p2m_entry+0x1a0/0x200 > (XEN) [<ffff82d0801f4aac>] unmap_mmio_regions+0x49/0x73 > (XEN) [<ffff82d080106292>] do_domctl+0x15bd/0x1edb > (XEN) [<ffff82d080234fcb>] syscall_enter+0xeb/0x145 > (XEN) > (XEN) Pagetable walk from ffff820040004ae0: > (XEN) L4[0x104] = 00000008668a5063 ffffffffffffffff > (XEN) L3[0x001] = 00000008668a3063 ffffffffffffffff > (XEN) L2[0x000] = 000000086689c063 ffffffffffffffff > (XEN) L1[0x004] = 000000056f078063 000000000007f678 > (XEN) > (XEN) **************************************** > (XEN) Panic on CPU 7: > (XEN) FATAL PAGE FAULT > (XEN) [error_code=0000] > (XEN) Faulting linear address: ffff820040004ae0 > (XEN) **************************************** > > Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com> > CC: Jan Beulich <jbeul...@suse.com> > CC: George Dunlap <george.dun...@eu.citrix.com> > CC: Jun Nakajima <jun.nakaj...@intel.com> > CC: Eddie Dong <eddie.d...@intel.com> > CC: Kevin Tian <kevin.t...@intel.com>
Reviewed-by: George Dunlap <george.dun...@eu.citrix.com> -George _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel
