commit aea924f606c309feead37ab5c43f410a08ff3826
author Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Sat Jul 10 17:37:56 2010 +0800
committer Avi Kivity <avi@redhat.com> Mon Aug 02 06:40:35 2010 +0300
tree 6d409eb035985ebcec3d16b0410706d3e8fcf184
parent a6f177efaa5856e22ed0d3c1e81e65b41654d083

KVM: PIT: stop vpit before freeing irq_routing

Fix:
general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
......
Call Trace:
 [<ffffffffa0159bd1>] ? kvm_set_irq+0xdd/0x24b [kvm]
 [<ffffffff8106ea8b>] ? trace_hardirqs_off_caller+0x1f/0x10e
 [<ffffffff813ad17f>] ? sub_preempt_count+0xe/0xb6
 [<ffffffff8106d273>] ? put_lock_stats+0xe/0x27
...
RIP  [<ffffffffa0159c72>] kvm_set_irq+0x17e/0x24b [kvm]

This bug is triggered when guest is shutdown, is because we freed
irq_routing before pit thread stopped

Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

arch/x86/kvm/x86.c

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d51eed2..d721e2d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5523,12 +5523,12 @@
 void kvm_arch_sync_events(struct kvm *kvm)
 {
 	kvm_free_all_assigned_devices(kvm);
+	kvm_free_pit(kvm);
 }
 
 void kvm_arch_destroy_vm(struct kvm *kvm)
 {
 	kvm_iommu_unmap_guest(kvm);
-	kvm_free_pit(kvm);
 	kfree(kvm->arch.vpic);
 	kfree(kvm->arch.vioapic);
 	kvm_free_vcpus(kvm);