From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: Re: Re: PCI BAR register space written with garbage in HVM guest. Date: Tue, 16 Mar 2010 22:46:11 -0400 Message-ID: <20100317024611.GB2217@phenom.dumpdata.com> References: <4779de451003151809n6cec813dp32d77fee34b1bda2@mail.gmail.com> <4779de451003161714x45dbca6dh80a9eed56e4fb0c2@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <4779de451003161714x45dbca6dh80a9eed56e4fb0c2@mail.gmail.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Dan Gora Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org > open("/sys/bus/pci/devices/0000:08:00.0/config", O_RDWR) = 6 > 5904 21:35:47 [ 7f05d53fa3c8] pwrite(6, "\6\1", 2, 4) = 2 > 5904 21:35:47 [ 7f05d3b6eb77] ioctl(16, EVIOCGKEYCODE, 0x7fffdde98890) = 0 > 5904 21:35:47 [ 7f05d53f987b] read(4, 0x7fffdde98870, 16) = -1 > EAGAIN (Resource temporarily unavailable) > 5904 21:35:47 [ 7fffddf437dc] clock_gettime(CLOCK_MONOTONIC, > {1724, 868201462}) = 0 > 5904 21:35:47 [ 7fffddf437dc] clock_gettime(CLOCK_MONOTONIC, > {1724, 868259075}) = 0 There is a snippet of QEMU that has that (hw/pass-through.c), function pt_pci_write_config: .. snip .. ret = pci_write_block(pci_dev, address, (uint8_t *)&val, len); if (!ret) PT_LOG("Error: pci_write_block failed. return value[%d].\n", ret); } if (pm_state != NULL && pm_state->flags & PT_FLAG_TRANSITING) /* set QEMUTimer */ qemu_mod_timer(pm_state->pm_timer, (qemu_get_clock(rt_clock) + pm_state->pm_delay)); > > > > 5904 21:35:48 [ 7f05d53f987b] read(16, "o\0\0\0", 4) = 4 > 5904 21:35:48 [ 7f05d53f97fb] write(16, "o\0\0\0", 4) = 4 > 5904 21:35:48 [ 7f05d53f97fb] write(6, > "\377\377\377\377\377\377\0\26>2\325d\10\0E\0\2@\0\354\0\0@\21w\302\0\0\0\0\377\377"..., > 590) = 256 I would turn on all of those debug options and see if anything is happening. Actually I would instrument all of the 'pci_write_block' calls. > > Notice the length of 590 bytes! The EIP also matches what the kernel > thinks was the syscall which caused the write. > > Anyone have any idea where this could be happening in qemu? I'm Can you attach debug to it? Or maybe run 'objdump' on the qemu-dm and see if the address correspond to some code in it?