Revert "xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent"

This reverts commit ddcf804ba7f4856849323145e348d75180d40406.

The dom0 panic would not panic if commit 7fc30809bfa8 ("xen-swiotlb: fix
the check condition for xen_swiotlb_free_coherent") is reverted. It is not
clear if the issue is due to this commit or the issue is just revealed by
this commit. This patch is temporarily reverted and will be merged again
once the root cause is identified.

The dom0 panic always because the page table entry is not set correctly,
e.g., the pte write bit is not set, or the pte is 0. This might be
directly/indirectly related to the patch.

There are usually warnings as below before the panic:

[10998.691856] 6 multicall(s) failed: cpu 10
[10998.692048] CPU: 10 PID: 2078 Comm: sort Tainted: G        W        4.1.12-124.16.1.el6uek.bug28258102debug4.x86_64 #2
[10998.692049] Hardware name: Oracle Corporation ORACLE SERVER X5-2/ASM,MOTHERBOARD,1U, BIOS 30130400 02/08/2018
[10998.692050]  0000000000000000 ffff880401a9bcb8 ffffffff816e5253 ffff8804a6c8d2c0
[10998.692052]  0000000000000006 ffff880401a9bd18 ffffffff810055d9 ffffffff81007220
[10998.692053]  ffff880497137080 00000000000000ff 0000000000000000 0000000000000030
[10998.692055] Call Trace:
[10998.692057]  [<ffffffff816e5253>] dump_stack+0x63/0x81
[10998.692059]  [<ffffffff810055d9>] xen_mc_flush+0x209/0x2d0
[10998.692061]  [<ffffffff81007220>] ? xen_pin_page+0x150/0x150
[10998.692063]  [<ffffffff81007bf9>] __xen_pgd_unpin+0x109/0x250
[10998.692065]  [<ffffffff81007eb7>] xen_exit_mmap+0x177/0x2a0
[10998.692067]  [<ffffffff811c3628>] exit_mmap+0x48/0x160
[10998.692068]  [<ffffffff81105da2>] ? exit_robust_list+0x62/0x130
[10998.692070]  [<ffffffff81081cf3>] mmput+0x63/0x100
[10998.692072]  [<ffffffff81087263>] do_exit+0x343/0xa90
[10998.692074]  [<ffffffff8112c794>] ? __audit_syscall_entry+0xb4/0x110
[10998.692075]  [<ffffffff81025a2c>] ? do_audit_syscall_entry+0x6c/0x70
[10998.692077]  [<ffffffff81087a45>] do_group_exit+0x45/0xb0
[10998.692079]  [<ffffffff81087ac4>] SyS_exit_group+0x14/0x20
[10998.692081]  [<ffffffff816edc1c>] system_call_fastpath+0x18/0xd6
[10998.692083]   call  1/8: op=14 arg=[ffff8804595ba000] result=-16	xen_unpin_page+0x155/0x160
[10998.692466]   call  2/8: op=26 arg=[ffff8804a6c8e3d0] result=0	xen_extend_mmuext_op+0x62/0x100
[10998.692871]   call  3/8: op=14 arg=[ffff880468f6c000] result=-16	xen_unpin_page+0x155/0x160
[10998.693255]   call  4/8: op=14 arg=[ffff88048342a000] result=-16	xen_unpin_page+0x60/0x160
[10998.693657]   call  5/8: op=14 arg=[ffff88043effc000] result=-16	xen_unpin_page+0x60/0x160
[10998.694038]   call  6/8: op=26 arg=[ffff8804a6c8e3e8] result=0	xen_extend_mmuext_op+0x62/0x100
[10998.694422]   call  7/8: op=14 arg=[ffff88043effd000] result=-16	xen_unpin_page+0x155/0x160
[10998.694804]   call  8/8: op=14 arg=[ffff8804466d7000] result=-16	xen_unpin_page+0x60/0x160

There are error logs in xen hypervisor as well:

(XEN) mm.c:2560:d0 Bad type (saw 2400000000000001 != exp 7000000000000000) for mfn 447f42a (pfn 407a72)
(XEN) mm.c:986:d0 Could not get page type PGT_writable_page
(XEN) mm.c:1038:d0 Error getting mfn 447f42a (pfn 407a72) from L1 entry 800000447f42a063 for l1e_owner=0, pg_owner=0
(XEN) mm.c:2560:d0 Bad type (saw 1400000000000001 != exp 7000000000000000) for mfn 447f42b (pfn 407a73)
(XEN) mm.c:986:d0 Could not get page type PGT_writable_page
(XEN) mm.c:1038:d0 Error getting mfn 447f42b (pfn 407a73) from L1 entry 800000447f42b063 for l1e_owner=0, pg_owner=0

Orabug: 28441054

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Joe Jin <joe.jin@oracle.com>
Reviewed-by: John Sobecki <john.sobecki@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 49ec555df3822d132408f146e50daf42e3c40019..63ddeb6a9c9db79f3672040d06f94d8a752ae507 100644 (file)
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -365,7 +365,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
         * physical address */
        phys = xen_bus_to_phys(dev_addr);
 
-       if (((dev_addr + size - 1 <= dma_mask)) ||
+       if (((dev_addr + size - 1 > dma_mask)) ||
            range_straddles_page_boundary(phys, size))
                xen_destroy_contiguous_region(phys, order);