RE: refcount errors then crash on XenoLinux with the latest source

[Rolf Neugebauer <rolf.neugebauer@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 4002 bytes --]

On Tue, 2004-02-24 at 00:21, Kip Macy wrote:
> >
> > If it helps, I also have some more debug code which allows a domain to
> > get the pfn_info from Xen for a given page. I could send you a patch
> > against unstable again tomorrow.
> 
> That would be great. Although I'm hoping to figure out why I'm getting a
> FAULT10 in my domain before I spend too much time on Xen.
> 

attached. A new hypercall allows a domain to get info on a given pfn if
it belongs to the domain. dom0 should be able to access all memory.

I haven't tested this patch! It compiles against the latest tree. Let me
know if you have problems with it or if you find it useful.

Rolf
			-Kip
> 
> >
> > Rolf
> >
> > > refcount error: pfn=00036f cf=40000002 refcount=1
> > > audit page: pfn=36f info: cf=40000002 tf=f0000002 ts=0 dom=fc648be0
> > >   pte_pfn=002207 cf=10000026 tf=30000024 dom=fc648be0
> > >     pte_idx=3f9 *pte_idx=0036f063
> > >
> > > refcount error: pfn=000371 cf=40000002 refcount=1
> > > audit page: pfn=371 info: cf=40000002 tf=f0000002 ts=0 dom=fc648be0
> > >   pte_pfn=002207 cf=10000026 tf=30000024 dom=fc648be0
> > >     pte_idx=3fe *pte_idx=00371063
> > >
> > > refcount error: pfn=000372 cf=40000002 refcount=1
> > > audit page: pfn=372 info: cf=40000002 tf=f0000002 ts=0 dom=fc648be0
> > >   pte_pfn=002207 cf=10000026 tf=30000024 dom=fc648be0
> > >     pte_idx=3fd *pte_idx=00372063
> > >
> > > refcount error: pfn=000390 cf=00000001 refcount=0
> > > audit page: pfn=390 info: cf=1 tf=f0000001 ts=4ddca dom=fc649780
> > >
> > > refcount error: pfn=000392 cf=00000001 refcount=0
> > > audit page: pfn=392 info: cf=1 tf=f0000001 ts=4ddca dom=fc649780
> > >
> > > refcount error: pfn=000393 cf=00000001 refcount=0
> > > audit page: pfn=393 info: cf=1 tf=f0000001 ts=4ae4c dom=fc64a320
> > >
> > > refcount error: pfn=000395 cf=00000001 refcount=0
> > > audit page: pfn=395 info: cf=1 tf=f0000001 ts=0 dom=fc64a320
> > >
> > > refcount error: pfn=00039f cf=00000001 refcount=0
> > > audit page: pfn=39f info: cf=1 tf=f0000001 ts=0 dom=fc64aec0
> > >
> > > refcount error: pfn=0003a1 cf=00000001 refcount=0
> > > audit page: pfn=3a1 info: cf=1 tf=f0000001 ts=0 dom=fc64aec0
> > >
> > > refcount error: pfn=0003a2 cf=00000001 refcount=0
> > > audit page: pfn=3a2 info: cf=1 tf=f0000001 ts=0 dom=fc7a4060
> > >
> > > refcount error: pfn=0003a8 cf=00000001 refcount=0
> > > audit page: pfn=3a8 info: cf=1 tf=f0000001 ts=0 dom=fc7a4060
> > >
> > > refcount error: pfn=0003a9 cf=00000001 refcount=0
> > > audit page: pfn=3a9 info: cf=1 tf=f0000001 ts=0 dom=fc7a4c00
> > >
> > > refcount error: pfn=0003ab cf=00000001 refcount=0
> > > audit page: pfn=3ab info: cf=1 tf=f0000001 ts=0 dom=fc7a4c00
> > >
> > > refcount error: pfn=0003ac cf=00000001 refcount=0
> > > audit page: pfn=3ac info: cf=1 tf=f0000001 ts=191ab3 dom=fc7a57a0
> > >
> > > refcount error: pfn=0003ae cf=00000001 refcount=0
> > > audit page: pfn=3ae info: cf=1 tf=f0000001 ts=191ab3 dom=fc7a57a0
> > >
> > > refcount error: pfn=0003af cf=00000001 refcount=0
> > > audit page: pfn=3af info: cf=1 tf=f0000001 ts=191ab2 dom=fc7a6340
> > >
> > > refcount error: pfn=0003b1 cf=00000001 refcount=0
> > > audit page: pfn=3b1 info: cf=1 tf=f0000001 ts=0 dom=fc7a6340
> > >
> > > refcount error: pfn=0003b2 cf=00000001 refcount=0
> > > audit page: pfn=3b2 info: cf=1 tf=f0000001 ts=0 dom=fc7a6ee0
> > >
> > > refcount error: pfn=0003b4 cf=00000001 refcount=0
> > > audit page: pfn=3b4 info: cf=1 tf=f0000001 ts=0 dom=fc7a6ee0
> > >
> > >
> > >
> > >
> > >
> > >
> > > -------------------------------------------------------
> > > SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> > > Build and deploy apps & Web services for Linux with
> > > a free DVD software kit from IBM. Click Now!
> > > http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> > > _______________________________________________
> > > Xen-devel mailing list
> > > Xen-devel@lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/xen-devel
> >
> >
> >

[-- Attachment #2: get_page_info.patch --]
[-- Type: text/x-patch, Size: 4705 bytes --]

diff -Nur --exclude=RCS --exclude=CVS --exclude=SCCS --exclude=BitKeeper --exclude=ChangeSet xeno.bk/xen/arch/i386/entry.S xeno.foo/xen/arch/i386/entry.S
--- xeno.bk/xen/arch/i386/entry.S	Mon Feb 23 17:49:50 2004
+++ xeno.foo/xen/arch/i386/entry.S	Tue Feb 24 17:58:04 2004
@@ -727,6 +727,7 @@
         .long SYMBOL_NAME(do_set_timer_op)       /* 20 */
         .long SYMBOL_NAME(do_event_channel_op)
         .long SYMBOL_NAME(do_xen_version)
+        .long SYMBOL_NAME(do_get_page_info)
         .rept NR_syscalls-((.-hypervisor_call_table)/4)
         .long SYMBOL_NAME(do_ni_syscall)
         .endr
diff -Nur --exclude=RCS --exclude=CVS --exclude=SCCS --exclude=BitKeeper --exclude=ChangeSet xeno.bk/xen/common/memory.c xeno.foo/xen/common/memory.c
--- xeno.bk/xen/common/memory.c	Mon Feb 23 14:32:33 2004
+++ xeno.foo/xen/common/memory.c	Tue Feb 24 17:58:54 2004
@@ -1102,6 +1102,54 @@
 }
 
 
+/*
+ * allows a domain to get query some information on a page
+ * this is primarily for debugging purposes
+ * a normal domain is only allowed to query its own pages.
+ * privileged domains can query any page.
+ */
+long do_get_page_info(get_page_info_t *u_page_info)
+{
+    long             ret = 0;
+    get_page_info_t *pi;
+
+    if ( (pi = kmalloc(sizeof(*pi), GFP_KERNEL)) == NULL )
+        return -ENOMEM;
+
+
+    /* sanity checks */
+    if ( copy_from_user(pi, u_page_info, sizeof(*pi)) )
+    {
+        ret = -EFAULT;
+        goto out;
+    }
+
+    if ( unlikely(pi->pfn >= max_page) )
+    {
+        ret = -EINVAL;
+        goto out;
+    }
+
+    if ( (frame_table[pi->pfn].u.domain != current) && 
+         !IS_PRIV(current) )
+    {
+        ret = -EPERM;
+        goto out;
+    }
+
+    /* copy the info */
+    pi->owner = (unsigned long) frame_table[pi->pfn].u.domain;
+    pi->count_and_flags = frame_table[pi->pfn].count_and_flags;
+    pi->type_and_flags = frame_table[pi->pfn].type_and_flags;
+    pi->tlbflush_timestamp = frame_table[pi->pfn].tlbflush_timestamp;
+
+    copy_to_user(u_page_info, pi, sizeof(*pi));
+ out:
+    kfree(pi);
+    return 0;
+}
+
+
 #ifndef NDEBUG
 /*
  * below are various memory debugging functions: 
diff -Nur --exclude=RCS --exclude=CVS --exclude=SCCS --exclude=BitKeeper --exclude=ChangeSet xeno.bk/xen/include/hypervisor-ifs/hypervisor-if.h xeno.foo/xen/include/hypervisor-ifs/hypervisor-if.h
--- xeno.bk/xen/include/hypervisor-ifs/hypervisor-if.h	Mon Feb 23 17:49:51 2004
+++ xeno.foo/xen/include/hypervisor-ifs/hypervisor-if.h	Tue Feb 24 17:57:17 2004
@@ -63,6 +63,7 @@
 #define __HYPERVISOR_set_timer_op         20
 #define __HYPERVISOR_event_channel_op     21
 #define __HYPERVISOR_xen_version          22
+#define __HYPERVISOR_get_page_info        23
 
 /* And the trap vector is... */
 #define TRAP_INSTR "int $0x82"
@@ -245,6 +246,21 @@
     unsigned long esp;
     unsigned long ss;
 } execution_context_t;
+
+/*
+ * returned by get_page_info hypercall
+ * usefull for debugging. allows a dom to find out info xen keeps about a page
+ */
+typedef struct
+{
+    unsigned long   pfn;
+    unsigned long   owner;
+    unsigned long   count_and_flags;
+    unsigned long   type_and_flags;
+    unsigned long   tlbflush_timestamp;
+} get_page_info_t;
+
+
 
 /*
  * Xen/guestos shared data -- pointer provided in start_info.
diff -Nur --exclude=RCS --exclude=CVS --exclude=SCCS --exclude=BitKeeper --exclude=ChangeSet xeno.bk/xenolinux-2.4.25-sparse/include/asm-xeno/hypervisor.h xeno.foo/xenolinux-2.4.25-sparse/include/asm-xeno/hypervisor.h
--- xeno.bk/xenolinux-2.4.25-sparse/include/asm-xeno/hypervisor.h	Mon Feb 23 17:49:51 2004
+++ xeno.foo/xenolinux-2.4.25-sparse/include/asm-xeno/hypervisor.h	Tue Feb 24 18:13:37 2004
@@ -446,4 +446,16 @@
     return ret;
 }
 
+static inline int HYPERVISOR_get_page_info(get_page_info_t *pi)
+{
+    int ret;
+    __asm__ __volatile__ (
+        TRAP_INSTR
+        : "=a" (ret) : "0" (__HYPERVISOR_get_page_info),
+        "b" (pi) : "memory" );
+
+    return ret;
+}
+
+
 #endif /* __HYPERVISOR_H__ */
diff -Nur --exclude=RCS --exclude=CVS --exclude=SCCS --exclude=BitKeeper --exclude=ChangeSet xeno.bk/xenolinux-sparse/include/asm-xeno/hypervisor.h xeno.foo/xenolinux-sparse/include/asm-xeno/hypervisor.h
--- xeno.bk/xenolinux-sparse/include/asm-xeno/hypervisor.h	Mon Feb 23 17:49:51 2004
+++ xeno.foo/xenolinux-sparse/include/asm-xeno/hypervisor.h	Tue Feb 24 18:13:37 2004
@@ -446,4 +446,16 @@
     return ret;
 }
 
+static inline int HYPERVISOR_get_page_info(get_page_info_t *pi)
+{
+    int ret;
+    __asm__ __volatile__ (
+        TRAP_INSTR
+        : "=a" (ret) : "0" (__HYPERVISOR_get_page_info),
+        "b" (pi) : "memory" );
+
+    return ret;
+}
+
+
 #endif /* __HYPERVISOR_H__ */