From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 213C0C433E0 for ; Fri, 15 May 2020 21:39:04 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E705B20643 for ; Fri, 15 May 2020 21:39:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E705B20643 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=citrix.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jZi2A-0002wX-0b; Fri, 15 May 2020 21:38:22 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jZi28-0002wS-O7 for xen-devel@lists.xenproject.org; Fri, 15 May 2020 21:38:20 +0000 X-Inumbo-ID: 645ec3b6-96f4-11ea-9887-bc764e2007e4 Received: from esa3.hc3370-68.iphmx.com (unknown [216.71.145.155]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 645ec3b6-96f4-11ea-9887-bc764e2007e4; Fri, 15 May 2020 21:38:19 +0000 (UTC) Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 6sBbulZbKKT8BljoNnbmu89Zx+L6x6D1rpSEj8KKNMCiv8B/ReEmTvE0AoFmzas/hxnzmGZFfO WlZLQqiBd+t7j6O9wvDTJ1xQaR/7lOgUt36re8TLsAwkXUTfXpMFIaJbUbC20S/CbGjNBND/Hf GequjRboVj2z3YriWvksJqJ2jYZ6xbbwMLVkgQO1VTTp8HkpMS0F3YfLN/Hr6gIPwlQewKR2i+ h4XtNPWx8dpQ+9xKN+ztcP8jHX1huEfIGy9Po2YOFJDq3ahLF8hIput+sCHLXNSU8FNx+sO5it aYA= X-SBRS: 2.7 X-MesageID: 17670414 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.73,396,1583211600"; d="scan'208";a="17670414" Subject: Re: IOCTL_PRIVCMD_MMAPBATCH on Xen 4.13.0 To: Manuel Bouyer References: <20200515202912.GA11714@antioche.eu.org> <20200515210629.GA10976@antioche.eu.org> From: Andrew Cooper Message-ID: Date: Fri, 15 May 2020 22:38:13 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: <20200515210629.GA10976@antioche.eu.org> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Content-Language: en-GB X-ClientProxiedBy: AMSPEX02CAS02.citrite.net (10.69.22.113) To AMSPEX02CL02.citrite.net (10.69.22.126) X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: xen-devel@lists.xenproject.org Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" On 15/05/2020 22:06, Manuel Bouyer wrote: > [CAUTION - EXTERNAL EMAIL] DO NOT reply, click links, or open attachments unless you have verified the sender and know the content is safe. > > On Fri, May 15, 2020 at 10:00:07PM +0100, Andrew Cooper wrote: >> What is qemu doing at the time?  Is it by any chance trying to map the >> IOREQ server frame? > Here's what gdb says about it: > Core was generated by `qemu-dm'. > Program terminated with signal SIGSEGV, Segmentation fault. > #0 0x000000000046997d in cpu_x86_init ( > cpu_model=cpu_model@entry=0x4d622d "qemu32") > at /home/bouyer/pkgbuild/current/sysutils/xentools413/work/xen-4.13.0/tools/qemu-xen-traditional/i386-dm/helper2.c:156 > 156 rc = xenevtchn_bind_interdomain( > --Type for more, q to quit, c to continue without paging-- > [Current thread is 1 (process 1480)] > (gdb) where > #0 0x000000000046997d in cpu_x86_init ( > cpu_model=cpu_model@entry=0x4d622d "qemu32") > at /home/bouyer/pkgbuild/current/sysutils/xentools413/work/xen-4.13.0/tools/qemu-xen-traditional/i386-dm/helper2.c:156 > #1 0x000000000043628d in pc_init1 (ram_size=, > vga_ram_size=4194304, boot_device=0x7f7fff460397 "cda", pci_enabled=1, > cpu_model=0x4d622d "qemu32", initrd_filename=, > kernel_cmdline=, kernel_filename=) > at /home/bouyer/pkgbuild/current/sysutils/xentools413/work/xen-4.13.0/tools/qemu-xen-traditional/hw/pc.c:829 > #2 0x00000000004636e7 in xen_init_fv (ram_size=0, vga_ram_size=4194304, > boot_device=0x7f7fff460397 "cda", kernel_filename=0x0, > kernel_cmdline=0x4abff6 "", initrd_filename=0x0, cpu_model=0x0, > direct_pci=0x0) > at /home/bouyer/pkgbuild/current/sysutils/xentools413/work/xen-4.13.0/tools/qemu-xen-traditional/hw/xen_machine_fv.c:405 > #3 0x00000000004a975b in main (argc=23, argv=0x7f7fff45fc78, > envp=) > at /home/bouyer/pkgbuild/current/sysutils/xentools413/work/xen-4.13.0/tools/qemu-xen-traditional/vl.c:6014 > > Does it help ? Yes and no.  This is collateral damage of earlier bug. What failed was xen_init_fv()'s     shared_page = xc_map_foreign_range(xc_handle, domid, XC_PAGE_SIZE,                                        PROT_READ|PROT_WRITE, ioreq_pfn);     if (shared_page == NULL) {         fprintf(logfile, "map shared IO page returned error %d\n", errno);         exit(-1);     } because we've ended up with a non-NULL pointer with no mapping behind it, hence the SIGSEGV for the first time we try to use the pointer. Whatever logic is behind xc_map_foreign_range() should have returned NULL or a real mapping. ioreq_pfn ought to be something just below the 4G boundary, and the toolstack ought to put memory there in the first place.  Can you identify what value ioreq_pfn has, and whether it matches up with the magic gfn range as reported by `xl create -vvv` for the guest? ~Andrew