[Xen-devel] [BUG] 'o' debug key panics the hypervisor

[Roger Pau Monnà <roger.pau@xxxxxxxxxx>]

Hello,

When using Intel hardware without shared page tables between the IOMMU 
and EPT (I have not tried if the same happens when sharing the page 
tables), the following crash happens if I press the 'o' debug key with 
a HVM guest running. The guest doesn't have any device passed-through.

(XEN) domain1 IOMMU p2m table:
(XEN) p2m table has 4 levels
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' 
failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
(XEN) ----[ Xen-4.6.0-rc  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
(XEN) RFLAGS: 0000000000010216   CONTEXT: hypervisor
(XEN) rax: 0000000a8bcf000e   rbx: 0000a8bcf000e000   rcx: 0000000000000000
(XEN) rdx: 00000007c7ffffff   rsi: 00000000dfaa0000   rdi: 0000000a8bcf000e
(XEN) rbp: ffff8300dfaf7d60   rsp: ffff8300dfaf7d20   r8:  ffff83019d2f48a8
(XEN) r9:  00000018c2c65cec   r10: ffff83019d2f4890   r11: 0100100100100100
(XEN) r12: ffff83019d263000   r13: 0000000000000003   r14: ffff8300dfb3b000
(XEN) r15: 000ffffffffff000   cr0: 000000008005003b   cr4: 00000000000026e0
(XEN) cr3: 00000000dfaa0000   cr2: 0000000000000000
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff8300dfaf7d20:
(XEN)    ffff82d08012cf27 ffff82d0802a2bc0 ffff8300dfaf7d40 0000a8bcf000e000
(XEN)    ffff830000000000 0000000000000003 0000008000000000 000ffffffffff000
(XEN)    ffff8300dfaf7d70 ffff82d080152849 ffff8300dfaf7dc0 ffff82d08014c2d6
(XEN)    00000001dfaf7db0 ffff82d08012c667 0000000000000000 0000000000000001
(XEN)    ffff830000000000 0000000000000003 0000000000000000 000ffffffffff000
(XEN)    ffff8300dfaf7e10 ffff82d08014c34f 00000000dfaf7e20 0000002700000001
(XEN)    ffff8300dfb3b000 ffff83019fd65000 ffff82d0802922c0 ffff82d0802698f9
(XEN)    ffff82d080339488 ffffffffffffffff ffff8300dfaf7e30 ffff82d08014c3f3
(XEN)    0000000000000000 ffff83019fd65000 ffff8300dfaf7e60 ffff82d0801477b7
(XEN)    0000000000000000 ffff82d0802a2d60 000000000000006f 0000000000000000
(XEN)    ffff8300dfaf7e90 ffff82d080114853 ffff8300dfaf7e90 ffff82d0802a25c0
(XEN)    0000000000000000 ffff82d080339560 ffff8300dfaf7ea0 ffff82d08011488d
(XEN)    ffff8300dfaf7ec0 ffff82d08012f3ca ffff8300dfaf7ec0 ffff82d080339570
(XEN)    ffff8300dfaf7ef0 ffff82d08012f700 00000018c2222afe ffff8300dfaf0000
(XEN)    00000018c2222afe ffff8300dfb3b000 ffff8300dfaf7f10 ffff82d0801607c3
(XEN)    ffff82d08012c711 ffff8300dfb3b000 ffff8300dfaf7e10 0000000000000000
(XEN)    0000000000000000 ffffffffffffffff ffff88001faa7e80 ffffffff8168f160
(XEN)    ffffffff81600000 0000000000000246 ffffffff8160003e ffff88001f60da80
(XEN)    0000000000000000 0000000000000000 ffffffff810013aa 0000000000000000
(XEN)    00000000deadbeef 00000000deadbeef 0000010000000000 ffffffff810013aa
(XEN) Xen call trace:
(XEN)    [<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
(XEN)    [<ffff82d080152849>] map_vtd_domain_page+0xd/0xf
(XEN)    [<ffff82d08014c2d6>] vtd_dump_p2m_table_level+0x2a/0xf6
(XEN)    [<ffff82d08014c34f>] vtd_dump_p2m_table_level+0xa3/0xf6
(XEN)    [<ffff82d08014c3f3>] vtd_dump_p2m_table+0x51/0x59
(XEN)    [<ffff82d0801477b7>] iommu_dump_p2m_table+0xaa/0xbe
(XEN)    [<ffff82d080114853>] handle_keypress+0x68/0x8d
(XEN)    [<ffff82d08011488d>] keypress_action+0x15/0x17
(XEN)    [<ffff82d08012f3ca>] do_tasklet_work+0x78/0xab
(XEN)    [<ffff82d08012f700>] do_tasklet+0x5e/0x8a
(XEN)    [<ffff82d0801607c3>] idle_loop+0x56/0x6b
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' 
failed at /root/src/xen/xen/include/asm/x86_64/page.h
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel