From: Manuel Bouyer <bouyer@antioche.eu.org>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: xen-devel@lists.xenproject.org
Subject: Re: IOCTL_PRIVCMD_MMAPBATCH on Xen 4.13.0
Date: Fri, 15 May 2020 23:53:35 +0200 [thread overview]
Message-ID: <20200515215335.GA9991@antioche.eu.org> (raw)
In-Reply-To: <b1dfc07d-bf0f-da26-79f0-8cf93952689e@citrix.com>
[-- Attachment #1: Type: text/plain, Size: 1466 bytes --]
On Fri, May 15, 2020 at 10:38:13PM +0100, Andrew Cooper wrote:
> > [...]
> > Does it help ?
>
> Yes and no. This is collateral damage of earlier bug.
>
> What failed was xen_init_fv()'s
>
> shared_page = xc_map_foreign_range(xc_handle, domid, XC_PAGE_SIZE,
> PROT_READ|PROT_WRITE, ioreq_pfn);
> if (shared_page == NULL) {
> fprintf(logfile, "map shared IO page returned error %d\n", errno);
> exit(-1);
> }
>
> because we've ended up with a non-NULL pointer with no mapping behind
> it, hence the SIGSEGV for the first time we try to use the pointer.
>
> Whatever logic is behind xc_map_foreign_range() should have returned
> NULL or a real mapping.
What's strange is that the mapping is validated, by mapping it in
the dom0 kernel space. But when we try to remap in in the process's
space, it fails.
>
> ioreq_pfn ought to be something just below the 4G boundary, and the
> toolstack ought to put memory there in the first place. Can you
> identify what value ioreq_pfn has,
You mean, something like:
(gdb) print/x ioreq_pfn
$2 = 0xfeff0
> and whether it matches up with the
> magic gfn range as reported by `xl create -vvv` for the guest?
I guess you mean
xl -vvv create
the output is attached
The kernel says it tries to map 0xfeff0000 to virtual address 0x79656f951000.
--
Manuel Bouyer <bouyer@antioche.eu.org>
NetBSD: 26 ans d'experience feront toujours la difference
--
[-- Attachment #2: typescript --]
[-- Type: text/plain, Size: 13735 bytes --]
Script started on Fri May 15 23:47:25 2020
# xl -vvv create nb1=-\b \b\b \b-hbvm\b \b\b \b\b \bvm
Parsing config from nb1-hvm
libxl: debug: libxl_create.c:1819:do_domain_create: Domain 0:ao 0x75de79e9b000: create: how=0x0 callback=0x0 poller=0x75de79ec60a0
libxl: detail: libxl_create.c:584:libxl__domain_make: passthrough: disabled
libxl: debug: libxl_device.c:380:libxl__device_disk_set_backend: Disk vdev=hda spec.backend=unknown
libxl: debug: libxl_device.c:415:libxl__device_disk_set_backend: Disk vdev=hda, using backend phy
libxl: debug: libxl_create.c:1148:initiate_domain_create: Domain 5:running bootloader
libxl: debug: libxl_bootloader.c:328:libxl__bootloader_run: Domain 5:not a PV/PVH domain, skipping bootloader
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79e64cd0: deregister unregistered
domainbuilder: detail: xc_dom_allocate: cmdline="", features=""
domainbuilder: detail: xc_dom_kernel_file: filename="/usr/pkg/libexec/xen/boot/hvmloader"
domainbuilder: detail: xc_dom_malloc_filemap : 337 kB
domainbuilder: detail: xc_dom_boot_xen_init: ver 4.13, caps xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64
domainbuilder: detail: xc_dom_parse_image: called
domainbuilder: detail: xc_dom_find_loader: trying ELF-generic loader ...
domainbuilder: detail: loader probe failed
domainbuilder: detail: xc_dom_find_loader: trying Linux bzImage loader ...
domainbuilder: detail: xc_dom_probe_bzimage_kernel: kernel is not a bzImage
domainbuilder: detail: loader probe failed
domainbuilder: detail: xc_dom_find_loader: trying HVM-generic loader ...
domainbuilder: detail: loader probe OK
xc: detail: ELF: phdr: paddr=0x100000 memsz=0x5c844
xc: detail: ELF: memory: 0x100000 -> 0x15c844
domainbuilder: detail: xc_dom_mem_init: mem 1020 MB, pages 0x3fc00 pages, 4k each
domainbuilder: detail: xc_dom_mem_init: 0x3fc00 pages
domainbuilder: detail: xc_dom_boot_mem_init: called
domainbuilder: detail: range: start=0x0 end=0x3fc00000
domainbuilder: detail: xc_dom_malloc : 2040 kB
xc: detail: PHYSICAL MEMORY ALLOCATION:
xc: detail: 4KB PAGES: 0x0000000000000200
xc: detail: 2MB PAGES: 0x00000000000001fd
xc: detail: 1GB PAGES: 0x0000000000000000
domainbuilder: detail: xc_dom_build_image: called
domainbuilder: detail: xc_dom_pfn_to_ptr_retcount: domU mapping: pfn 0x100+0x5d at 0x75de79b31000
domainbuilder: detail: xc_dom_alloc_segment: kernel : 0x100000 -> 0x15d000 (pfn 0x100 + 0x5d pages)
xc: detail: ELF: phdr 0 at 0x75de79ad4000 -> 0x75de79b26ca0
domainbuilder: detail: xc_dom_pfn_to_ptr_retcount: domU mapping: pfn 0x15d+0x1 at 0x75de79e1d000
domainbuilder: detail: xc_dom_alloc_segment: HVM start info : 0x15d000 -> 0x15e000 (pfn 0x15d + 0x1 pages)
domainbuilder: detail: alloc_pgtables_hvm: doing nothing
domainbuilder: detail: xc_dom_build_image : virt_alloc_end : 0x15e000
domainbuilder: detail: xc_dom_build_image : virt_pgtab_end : 0x0
domainbuilder: detail: xc_dom_boot_image: called
domainbuilder: detail: xc_dom_compat_check: supported guest type: xen-3.0-x86_64
domainbuilder: detail: xc_dom_compat_check: supported guest type: xen-3.0-x86_32p
domainbuilder: detail: xc_dom_compat_check: supported guest type: hvm-3.0-x86_32 <= matches
domainbuilder: detail: xc_dom_compat_check: supported guest type: hvm-3.0-x86_32p
domainbuilder: detail: xc_dom_compat_check: supported guest type: hvm-3.0-x86_64
domainbuilder: detail: domain builder memory footprint
domainbuilder: detail: allocated
domainbuilder: detail: malloc : 2045 kB
domainbuilder: detail: anon mmap : 0 bytes
domainbuilder: detail: mapped
domainbuilder: detail: file mmap : 337 kB
domainbuilder: detail: domU mmap : 376 kB
domainbuilder: detail: vcpu_hvm: called
domainbuilder: detail: compat_gnttab_hvm_seed: d5: pfn=0xff000
domainbuilder: detail: xc_dom_set_gnttab_entry: d5 gnt[0] -> d0 0xfefff
domainbuilder: detail: xc_dom_set_gnttab_entry: d5 gnt[1] -> d0 0xfeffc
domainbuilder: detail: xc_dom_release: called
libxl: debug: libxl_device.c:380:libxl__device_disk_set_backend: Disk vdev=hda spec.backend=phy
libxl: debug: libxl_event.c:639:libxl__ev_xswatch_register: watch w=0x75de79bfd4d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/0: register slotnum=3
libxl: debug: libxl_create.c:1856:do_domain_create: Domain 0:ao 0x75de79e9b000: inprogress: poller=0x75de79ec60a0, flags=i
libxl: debug: libxl_event.c:576:watchfd_callback: watch w=0x75de79bfd4d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/0: event epath=/local/domain/0/backend/vbd/5/768/state
libxl: debug: libxl_event.c:881:devstate_callback: backend /local/domain/0/backend/vbd/5/768/state wanted state 2 still waiting state 1
libxl: debug: libxl_event.c:576:watchfd_callback: watch w=0x75de79bfd4d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/0: event epath=/local/domain/0/backend/vbd/5/768/state
libxl: debug: libxl_event.c:877:devstate_callback: backend /local/domain/0/backend/vbd/5/768/state wanted state 2 ok
libxl: debug: libxl_event.c:676:libxl__ev_xswatch_deregister: watch w=0x75de79bfd4d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/0: deregister slotnum=3
libxl: debug: libxl_device.c:1090:device_backend_callback: Domain 5:calling device_backend_cleanup
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfd4d0: deregister unregistered
libxl: debug: libxl_device.c:1191:device_hotplug: Domain 5:calling hotplug script: /usr/pkg/etc/xen/scripts/block /local/domain/0/backend/vbd/5/768
libxl: debug: libxl_device.c:1192:device_hotplug: Domain 5:extra args:
libxl: debug: libxl_device.c:1198:device_hotplug: Domain 5: 2
libxl: debug: libxl_device.c:1200:device_hotplug: Domain 5:env:
libxl: debug: libxl_aoutils.c:593:libxl__async_exec_start: forking to execute: /usr/pkg/etc/xen/scripts/block /local/domain/0/backend/vbd/5/768
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfd5d0: deregister unregistered
libxl: debug: libxl_netbsd.c:74:libxl__get_hotplug_script_info: Domain 5:num_exec 1, not running hotplug scripts
libxl: debug: libxl_device.c:1176:device_hotplug: Domain 5:No hotplug script to execute
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfd5d0: deregister unregistered
libxl: debug: libxl_dm.c:2626:libxl__spawn_local_dm: Domain 5:Spawning device-model /usr/pkg/libexec/xen/bin/qemu-dm with arguments:
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: /usr/pkg/libexec/xen/bin/qemu-dm
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -d
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: 5
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -domain-name
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: nb1
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -vnc
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: 132.227.103.47:1
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -videoram
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: 4
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -boot
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: cda
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -usb
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -usbdevice
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: tablet
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -acpi
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -vcpu_avail
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: 0x01
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -net
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: nic,vlan=0,macaddr=00:16:3e:00:10:54,model=e1000
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -net
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: tap,vlan=0,ifname=xvif5i0-emu,bridge=bridge0,script=/usr/pkg/etc/xen/scripts/qemu-ifup,downscript=/usr/pkg/etc/xen/scripts/qemu-ifup
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: -M
libxl: debug: libxl_dm.c:2628:libxl__spawn_local_dm: Domain 5: xenfv
libxl: debug: libxl_dm.c:2630:libxl__spawn_local_dm: Domain 5:Spawning device-model /usr/pkg/libexec/xen/bin/qemu-dm with additional environment:
libxl: debug: libxl_dm.c:2632:libxl__spawn_local_dm: Domain 5: XEN_QEMU_CONSOLE_LIMIT=1048576
libxl: debug: libxl_event.c:639:libxl__ev_xswatch_register: watch w=0x75de79e64fc8 wpath=/local/domain/0/device-model/5/state token=3/1: register slotnum=3
libxl: debug: libxl_event.c:576:watchfd_callback: watch w=0x75de79e64fc8 wpath=/local/domain/0/device-model/5/state token=3/1: event epath=/local/domain/0/device-model/5/state
libxl: debug: libxl_exec.c:407:spawn_watch_event: domain 5 device model: spawn watch p=(null)
libxl: debug: libxl_event.c:676:libxl__ev_xswatch_deregister: watch w=0x75de79e64fc8 wpath=/local/domain/0/device-model/5/state token=3/1: deregister slotnum=3
libxl: error: libxl_dm.c:2783:device_model_spawn_outcome: Domain 5:domain 5 device model: spawn failed (rc=-3)
libxl: error: libxl_dm.c:2999:device_model_postconfig_done: Domain 5:Post DM startup configs failed, rc=-3
libxl: debug: libxl_qmp.c:1896:libxl__ev_qmp_dispose: Domain 0: ev 0x75de79e64fe0
libxl: error: libxl_create.c:1676:domcreate_devmodel_started: Domain 5:device model did not start: -3
libxl: debug: libxl_dm.c:3237:libxl__destroy_device_model: Domain 5:Didn't find dm UID; destroying by pid
libxl: error: libxl_dm.c:3103:kill_device_model: Device Model already exited
libxl: debug: libxl_event.c:639:libxl__ev_xswatch_register: watch w=0x75de79bfe0d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/2: register slotnum=3
libxl: debug: libxl_event.c:576:watchfd_callback: watch w=0x75de79bfe0d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/2: event epath=/local/domain/0/backend/vbd/5/768/state
libxl: debug: libxl_event.c:881:devstate_callback: backend /local/domain/0/backend/vbd/5/768/state wanted state 6 still waiting state 5
libxl: debug: libxl_event.c:576:watchfd_callback: watch w=0x75de79bfe0d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/2: event epath=/local/domain/0/backend/vbd/5/768/state
libxl: debug: libxl_event.c:877:devstate_callback: backend /local/domain/0/backend/vbd/5/768/state wanted state 6 ok
libxl: debug: libxl_event.c:676:libxl__ev_xswatch_deregister: watch w=0x75de79bfe0d0 wpath=/local/domain/0/backend/vbd/5/768/state token=3/2: deregister slotnum=3
libxl: debug: libxl_device.c:1090:device_backend_callback: Domain 5:calling device_backend_cleanup
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfe0d0: deregister unregistered
libxl: debug: libxl_device.c:1191:device_hotplug: Domain 5:calling hotplug script: /usr/pkg/etc/xen/scripts/block /local/domain/0/backend/vbd/5/768
libxl: debug: libxl_device.c:1192:device_hotplug: Domain 5:extra args:
libxl: debug: libxl_device.c:1198:device_hotplug: Domain 5: 6
libxl: debug: libxl_device.c:1200:device_hotplug: Domain 5:env:
libxl: debug: libxl_aoutils.c:593:libxl__async_exec_start: forking to execute: /usr/pkg/etc/xen/scripts/block /local/domain/0/backend/vbd/5/768
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfe1d0: deregister unregistered
libxl: debug: libxl_netbsd.c:74:libxl__get_hotplug_script_info: Domain 5:num_exec 1, not running hotplug scripts
libxl: debug: libxl_device.c:1176:device_hotplug: Domain 5:No hotplug script to execute
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfe1d0: deregister unregistered
libxl: debug: libxl_device.c:1176:device_hotplug: Domain 5:No hotplug script to execute
libxl: debug: libxl_event.c:689:libxl__ev_xswatch_deregister: watch w=0x75de79bfe5d0: deregister unregistered
libxl: debug: libxl_domain.c:1355:devices_destroy_cb: Domain 5:Forked pid 2095 for destroy of domain
libxl: debug: libxl_event.c:1893:libxl__ao_complete: ao 0x75de79e9b000: complete, rc=-3
libxl: debug: libxl_event.c:1862:libxl__ao__destroy: ao 0x75de79e9b000: destroy
libxl: debug: libxl_domain.c:1040:libxl_domain_destroy: Domain 5:ao 0x75de79e9b000: create: how=0x0 callback=0x0 poller=0x75de79ec60a0
libxl: error: libxl_domain.c:1177:libxl__destroy_domid: Domain 5:Non-existant domain
libxl: error: libxl_domain.c:1131:domain_destroy_callback: Domain 5:Unable to destroy guest
libxl: error: libxl_domain.c:1058:domain_destroy_cb: Domain 5:Destruction of domain failed
libxl: debug: libxl_event.c:1893:libxl__ao_complete: ao 0x75de79e9b000: complete, rc=-21
libxl: debug: libxl_domain.c:1049:libxl_domain_destroy: Domain 5:ao 0x75de79e9b000: inprogress: poller=0x75de79ec60a0, flags=ic
libxl: debug: libxl_event.c:1862:libxl__ao__destroy: ao 0x75de79e9b000: destroy
xencall:buffer: debug: total allocations:400 total releases:400
xencall:buffer: debug: current allocations:0 maximum allocations:3
xencall:buffer: debug: cache current size:3
xencall:buffer: debug: cache hits:383 misses:3 toobig:14
xencall:buffer: debug: total allocations:0 total releases:0
xencall:buffer: debug: current allocations:0 maximum allocations:0
xencall:buffer: debug: cache current size:0
xencall:buffer: debug: cache hits:0 misses:0 toobig:0
#
Script done on Fri May 15 23:47:46 2020
next prev parent reply other threads:[~2020-05-15 21:54 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-15 20:29 IOCTL_PRIVCMD_MMAPBATCH on Xen 4.13.0 Manuel Bouyer
2020-05-15 21:00 ` Andrew Cooper
2020-05-15 21:06 ` Manuel Bouyer
2020-05-15 21:38 ` Andrew Cooper
2020-05-15 21:53 ` Manuel Bouyer [this message]
2020-05-16 16:18 ` Andrew Cooper
2020-05-17 9:30 ` Manuel Bouyer
2020-05-17 17:32 ` Manuel Bouyer
2020-05-17 17:56 ` Manuel Bouyer
2020-05-18 7:36 ` Paul Durrant
2020-05-18 17:31 ` Manuel Bouyer
2020-05-19 7:34 ` Jan Beulich
2020-05-19 8:46 ` Manuel Bouyer
2020-05-19 8:51 ` Jan Beulich
2020-05-19 9:54 ` Roger Pau Monné
2020-05-19 10:28 ` Manuel Bouyer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200515215335.GA9991@antioche.eu.org \
--to=bouyer@antioche.eu.org \
--cc=andrew.cooper3@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.