Re: IOCTL_PRIVCMD_MMAPBATCH on Xen 4.13.0

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 15/05/2020 21:29, Manuel Bouyer wrote:
> Hello,
> NetBSD works as dom0 up to Xen 4.11. I'm trying to get it working
> on 4.13.0. I added the support for gntdev operations,  but I'm stuck with
> privcmd IOCTL_PRIVCMD_MMAPBATCH. It seems to work fine for PV and PVH domUs,
> but with HVM domUs, MMU_NORMAL_PT_UPDATE returns -22 (EINVAL) and
> qemu-dm dumps core (as expected; the page is not mapped).
> Of course this works fine in 4.11
>
> In the Xen kernel, I tracked it down to arch/x86/mm.c near line 2229,
> in mod_l1_entry():
>         /* Translate foreign guest address. */
>         if ( cmd != MMU_PT_UPDATE_NO_TRANSLATE &&
>              paging_mode_translate(pg_dom) )
>         {
>             p2m_type_t p2mt;
>             p2m_query_t q = l1e_get_flags(nl1e) & _PAGE_RW ?
>                             P2M_ALLOC | P2M_UNSHARE : P2M_ALLOC;
>
>             page = get_page_from_gfn(pg_dom, l1e_get_pfn(nl1e), &p2mt, q);
>
>             if ( p2m_is_paged(p2mt) )
>             {
>                 if ( page )
>                     put_page(page);
>                 p2m_mem_paging_populate(pg_dom, l1e_get_pfn(nl1e));
>                 return -ENOENT;
>             }
>
>             if ( p2mt == p2m_ram_paging_in && !page )
>                 return -ENOENT;
>
>             /* Did our attempt to unshare fail? */
>             if ( (q & P2M_UNSHARE) && p2m_is_shared(p2mt) )
>             {
>                 /* We could not have obtained a page ref. */
>                 ASSERT(!page);
>                 /* And mem_sharing_notify has already been called. */
>                 return -ENOMEM;
>             }
>
>             if ( !page ) {
>                 gdprintk(XENLOG_WARNING, "translate but no page\n");
>                 return -EINVAL;
>             }                        
>             nl1e = l1e_from_page(page, l1e_get_flags(nl1e));
>         }
>
> the gdprintk() I added in the ( !page) case fires, so this is the
> cause of the EINVAL.
> Is it expected for a HVM domU ? If so, how should the dom0 code be
> changed to get it working ? I failed to see where our code is different
> from linux ...

What is qemu doing at the time?  Is it by any chance trying to map the
IOREQ server frame?

~Andrew