All of lore.kernel.org
 help / color / mirror / Atom feed
* Problem with gntdev : Bad page map
@ 2013-03-26 16:32 Sébastien Frémal
  2013-03-26 19:46 ` Konrad Rzeszutek Wilk
  0 siblings, 1 reply; 5+ messages in thread
From: Sébastien Frémal @ 2013-03-26 16:32 UTC (permalink / raw)
  To: xen-devel


[-- Attachment #1.1: Type: text/plain, Size: 6470 bytes --]

Hello,

I'm using xen 4.1.2 and I try to shared memory pages between the dom0 and
domU's. For that purpose, I looked at gntalloc and gntdev. To test these
modules, I created two programs :

   - gntalloc_test : a program running in dom0 and granting some pages to a
   domU and putting random values in it.
   - gntdev_test : a program running in the domU, mapping the granted pages
   and reading the values contained in it.

I succeeded in transferring values from dom0 to domU, but I have a Bad page
map error when the program in domU exits :

[  123.903755] BUG: Bad page map in process test  pte:80000000107ff167
pmd:0c7e3067
[  123.903765] page:ffffea000041ffc0 count:0 mapcount:-1 mapping:
 (null) index:0xffff88000e56b500
[  123.903899] page flags:
0x100000000000c14(referenced|dirty|reserved|private)
[  123.903910] addr:00007f9845c3d000 vm_flags:000e00fb anon_vma:
 (null) mapping:ffff88000d637668 index:0
[  123.903920] vma->vm_ops->fault: 0x0
[  123.903924] vma->vm_file->f_op->mmap: gntdev_mmap+0x0/0x290 [xen_gntdev]

If I run several times gntdev_test, the count and the mapcount keeps
decreasing :

[  125.144693] page:ffffea000041ffc0 count:-1 mapcount:-2 mapping:
 (null) index:0xffff88000e56b720
[  126.072717] page:ffffea000041ffc0 count:-2 mapcount:-3 mapping:
 (null) index:0xffff88000e56b7c0

The error message coming from dmesg is :

[  126.072703] BUG: Bad page map in process test  pte:80000000107ff167
pmd:0e6a2067
[  126.072717] page:ffffea000041ffc0 count:-2 mapcount:-3 mapping:
 (null) index:0xffff88000e56b7c0
[  126.072724] page flags:
0x100000000000c14(referenced|dirty|reserved|private)
[  126.072739] addr:00007ff931aec000 vm_flags:000e00fb anon_vma:
 (null) mapping:ffff88000d637668 index:0
[  126.072749] vma->vm_ops->fault: 0x0
[  126.072754] vma->vm_file->f_op->mmap: gntdev_mmap+0x0/0x290 [xen_gntdev]
[  126.072761] Pid: 1268, comm: test Tainted: G    B   W
 3.2.0-34-generic #53-Ubuntu
[  126.072764] Call Trace:
[  126.072769]  [<ffffffff81139c99>] print_bad_pte+0x1d9/0x270
[  126.072772]  [<ffffffff8113c799>] zap_pte_range+0x369/0x3d0
[  126.072775]  [<ffffffff81005339>] ?
__raw_callee_save_xen_pmd_val+0x11/0x1e
[  126.072779]  [<ffffffff8113c9aa>] unmap_page_range+0x1aa/0x300
[  126.072782]  [<ffffffff8113d08a>] unmap_vmas+0xca/0x1a0
[  126.072785]  [<ffffffff81144607>] exit_mmap+0x97/0x140
[  126.072788]  [<ffffffff8113dde8>] ? handle_mm_fault+0x1f8/0x350
[  126.072792]  [<ffffffff8165bfde>] ? _raw_spin_unlock_irqrestore+0x1e/0x30
[  126.072795]  [<ffffffff81064b92>] mmput.part.16+0x42/0x130
[  126.072798]  [<ffffffff81064ca9>] mmput+0x29/0x30
[  126.072802]  [<ffffffff8106b603>] exit_mm+0x113/0x130
[  126.072806]  [<ffffffff810e41c5>] ? taskstats_exit+0x45/0x240
[  126.072809]  [<ffffffff8165c0b5>] ? _raw_spin_lock_irq+0x15/0x20
[  126.072812]  [<ffffffff8106b78e>] do_exit+0x16e/0x450
[  126.072817]  [<ffffffff811783e0>] ? vfs_write+0x110/0x180
[  126.072820]  [<ffffffff8106bc14>] do_group_exit+0x44/0xa0
[  126.072823]  [<ffffffff8106bc87>] sys_exit_group+0x17/0x20
[  126.072826]  [<ffffffff816643c2>] system_call_fastpath+0x16/0x1b

Here are the codes of the two programs :

gntalloc_test.c :

#include <stdio.h>
#include <stdint.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <xen/gntalloc.h>
#include <linux/ioctl.h>

int main(){
        int fd = open("/dev/xen/gntalloc", O_RDWR);
        if(fd == -1){
                perror("Open : ");
                return -1;
        }
        struct ioctl_gntalloc_alloc_gref arg;
        arg.domid = 5;
        arg.flags = GNTALLOC_FLAG_WRITABLE;
        arg.count = 4;
        ioctl(fd, IOCTL_GNTALLOC_ALLOC_GREF, &arg);
        int i;
        for(i=0; i<4;++i)
            printf("Gref : %d\n", arg.gref_ids[i]);
        struct ioctl_gntalloc_dealloc_gref dearg;
        dearg.index = arg.index;
        dearg.count = arg.count;
        int * vadr = mmap(0, getpagesize(), PROT_READ | PROT_WRITE,
MAP_SHARED, fd, 0);
        vadr[0]=1337;
        vadr[1]=20057;
        vadr[2]=9000;
        int wait;
        printf("vadr : %d %d %d\nEn attente ...\n", vadr[0], vadr[1],
vadr[2]);
        scanf("%d", &wait);
        ioctl(fd, IOCTL_GNTALLOC_DEALLOC_GREF, &dearg);
}

gntdev_test.c :

#include <stdio.h>
#include <stdint.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <xen/gntdev.h>
#include <linux/ioctl.h>

int main(){
        int fd;
        if((fd = open("/dev/xen/gntdev2", O_RDWR))==-1){
                perror("open");
                return;
        }
        struct ioctl_gntdev_map_grant_ref arg;
        struct ioctl_gntdev_unmap_grant_ref dearg[2];
        arg.count = 1;
        arg.refs[0].ref=32;
        arg.refs[0].domid=0;
        ioctl(fd, IOCTL_GNTDEV_MAP_GRANT_REF, &arg);
        dearg[0].index = arg.index;
        dearg[0].count = arg.count;
        arg.refs[0].ref=33;
        ioctl(fd, IOCTL_GNTDEV_MAP_GRANT_REF, &arg);
        printf("Index in the file : %ld\n", arg.index);
        int * vaddr;
        if((vaddr = mmap(0, getpagesize(), PROT_READ | PROT_WRITE,
MAP_SHARED, f
d, 0))==NULL)
                return;
        printf("Vaddr : %d %d %d\n", vaddr[0], vaddr[1], vaddr[2]);

        dearg[1].index = arg.index;
        dearg[1].count = arg.count;
        printf("First grant\n");
        ioctl(fd, IOCTL_GNTDEV_UNMAP_GRANT_REF, &dearg[0]);
        printf("Second grant\n");
        ioctl(fd, IOCTL_GNTDEV_UNMAP_GRANT_REF, &dearg[1]);
        printf("The end\n");
}

I tried to track where the error comes from. When I execute gntdev_test,
the error message is displayed after the final message (The end) ; if I
look dmesg I can see than :
- The first page is "unmapped"
- The second page is "unmapped"
- The second page is freed
- The error happens
- gntdev_vma_close is called
- The first page is freed
I used a modified version of the module to track these steps, but the
original module
(/lib/modules/3.2.0-34-generic/kernel/drivers/xen/xen-gntdev.ko) gives the
same error.

I suppose that something is missing in gntdev_test.c to manage the mapping
of pages but I don't know what. I tried to call the unmap function, but
it's worst as it adds other errors.

Does someone know what's missing please ?

Best regards,

Frémal Sébastien

[-- Attachment #1.2: Type: text/html, Size: 8561 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-04-04 12:08 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-03-26 16:32 Problem with gntdev : Bad page map Sébastien Frémal
2013-03-26 19:46 ` Konrad Rzeszutek Wilk
2013-03-28 14:43   ` Sébastien Frémal
2013-03-29 14:05     ` Sébastien Frémal
     [not found]     ` <CAOV6k-AmbwcOCDSE7-VQp9F4zPqnU3eC757ZjSe3G_vD6wncCw@mail.gmail.com>
     [not found]       ` <20130329191603.GA22120@phenom.dumpdata.com>
2013-04-04 12:08         ` Sébastien Frémal

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.