Re: [Xen-devel] [BUG] 'o' debug key panics the hypervisor

[Roger Pau Monnà <roger.pau@xxxxxxxxxx>]

El 27/08/15 a les 14.02, Andrew Cooper ha escrit:
> On 27/08/15 12:29, Roger Pau Monnà wrote:
>> Hello,
>>
>> When using Intel hardware without shared page tables between the IOMMU 
>> and EPT (I have not tried if the same happens when sharing the page 
>> tables), the following crash happens if I press the 'o' debug key with 
>> a HVM guest running. The guest doesn't have any device passed-through.
>>
>> (XEN) domain1 IOMMU p2m table:
>> (XEN) p2m table has 4 levels
>> (XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> 
>> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
>> (XEN) ----[ Xen-4.6.0-rc  x86_64  debug=y  Tainted:    C ]----
>> (XEN) CPU:    0
>> (XEN) RIP:    e008:[<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
>> (XEN) RFLAGS: 0000000000010216   CONTEXT: hypervisor
> 
> The use of paddr_to_pfn() in map_vtd_domain_page() is incorrect.
> 
> Does this fix the issue?

Sadly no. Here is the panic trace with your patch applied:

(XEN) domain1 IOMMU p2m table:
(XEN) p2m table has 4 levels
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' 
failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
(XEN) ----[ Xen-4.6.0-rc  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff82d080165815>] map_domain_page+0x1ef/0x5e6
(XEN) RFLAGS: 0000000000010216   CONTEXT: hypervisor
(XEN) rax: 0000000a8bcf000e   rbx: 0000a8bcf000e000   rcx: 0000000000000000
(XEN) rdx: 00000007c7ffffff   rsi: 00000000dfa9f000   rdi: 0000000a8bcf000e
(XEN) rbp: ffff8300dfaf7d60   rsp: ffff8300dfaf7d20   r8:  0000000000000000
(XEN) r9:  0000000000000001   r10: 0000000000000004   r11: 0000000000000001
(XEN) r12: ffff83019d263000   r13: 0000000000000003   r14: ffff8300dfdf2000
(XEN) r15: 000ffffffffff000   cr0: 000000008005003b   cr4: 00000000000026e0
(XEN) cr3: 00000000dfa9f000   cr2: ffff880012b18c90
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff8300dfaf7d20:
(XEN)    ffff82d08012cfda ffff82d0802a1bc0 ffff8300dfaf7d40 0000a8bcf000e000
(XEN)    ffff830000000000 0000000000000003 0000008000000000 000ffffffffff000
(XEN)    ffff8300dfaf7d70 ffff82d080152998 ffff8300dfaf7dc0 ffff82d08014c389
(XEN)    00000001dfaf7db0 ffff82d08012c71a 0000000000000000 0000000000000001
(XEN)    ffff830000000000 0000000000000003 0000000000000000 000ffffffffff000
(XEN)    ffff8300dfaf7e10 ffff82d08014c402 00000000dfaf7e20 0000002700000001
(XEN)    ffff8300dfdf2000 ffff83019ff11000 ffff82d080291240 ffff82d0802688f8
(XEN)    ffff82d080339488 ffffffffffffffff ffff8300dfaf7e30 ffff82d08014c4a6
(XEN)    0000000000000000 ffff83019ff11000 ffff8300dfaf7e60 ffff82d08014786a
(XEN)    0000000000000000 ffff82d0802a1d60 000000000000006f 0000000000000000
(XEN)    ffff8300dfaf7e90 ffff82d080114906 ffff8300dfaf7e90 ffff82d0802a15c0
(XEN)    0000000000000000 ffff82d080339560 ffff8300dfaf7ea0 ffff82d080114940
(XEN)    ffff8300dfaf7ec0 ffff82d08012f47d ffff8300dfaf7ec0 ffff82d080339570
(XEN)    ffff8300dfaf7ef0 ffff82d08012f7b3 0000054782099709 ffff8300dfaf0000
(XEN)    0000054782099709 ffff8300dfdf2000 ffff8300dfaf7f10 ffff82d0801607c3
(XEN)    ffff82d08012c7c4 ffff8300dfdf2000 ffff8300dfaf7e10 0000000000000000
(XEN)    0000000000000000 ffffffffffffffff ffff88001faa7e80 ffffffff8168f160
(XEN)    ffffffff81600000 0000000000000246 0000000000000020 ffff88001f60da80
(XEN)    0000000000000000 0000000000000000 ffffffff810013aa 0000000000000000
(XEN)    00000000deadbeef 00000000deadbeef 0000010000000000 ffffffff810013aa
(XEN) Xen call trace:
(XEN)    [<ffff82d080165815>] map_domain_page+0x1ef/0x5e6
(XEN)    [<ffff82d080152998>] map_vtd_domain_page+0x4a/0x4c
(XEN)    [<ffff82d08014c389>] vtd_dump_p2m_table_level+0x2a/0xf6
(XEN)    [<ffff82d08014c402>] vtd_dump_p2m_table_level+0xa3/0xf6
(XEN)    [<ffff82d08014c4a6>] vtd_dump_p2m_table+0x51/0x59
(XEN)    [<ffff82d08014786a>] iommu_dump_p2m_table+0xaa/0xbe
(XEN)    [<ffff82d080114906>] handle_keypress+0x68/0x8d
(XEN)    [<ffff82d080114940>] keypress_action+0x15/0x17
(XEN)    [<ffff82d08012f47d>] do_tasklet_work+0x78/0xab
(XEN)    [<ffff82d08012f7b3>] do_tasklet+0x5e/0x8a
(XEN)    [<ffff82d0801607c3>] idle_loop+0x56/0x6b
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' 
failed at /root/src/xen/xen/include/asm/x86_64/page.h
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel