All of lore.kernel.org
 help / color / mirror / Atom feed
* possible grant table issue
@ 2005-07-12 22:14 Stefan Berger
  2005-07-13  9:16 ` Christopher Clark
  0 siblings, 1 reply; 6+ messages in thread
From: Stefan Berger @ 2005-07-12 22:14 UTC (permalink / raw)
  To: xen-devel

[-- Attachment #1: Type: text/plain, Size: 2736 bytes --]

Hello!

Attached is a patch that dumps some debugging output for the block 
interface backend. The reason why I am posting this patch is due to the 
somewhat strange assignments of the handles that are returned from the 
HYPERVISOR_grant_table_op. I am stopping short of saying it's a bug, 
because I don't know the code well enough, but when looking at the 
hypervisor code I see some place where I doubt that this is right. 
Particularly one should try the following:

Create user domains that use the block interfaces.

1st user domain witll be assigned handle 0x0. - should be ok
2nd user domain will be assigned handle 0x1. - should be ok
3rd user domain will be assigned handle 0x2. - should be ok

(handle numbers have obviously been increasing so far)

bring down 3rd user domain - free'ed handle will be 0x2 - should be ok

create 3rd user domain again - will be assigned handle 0x0 - this is not 
what I would expect.

(the code that's causing this is called when handle 0x2 was free'ed
static inline void
put_maptrack_handle(
            grant_table_t *t, int handle)
        {
            t->maptrack[handle].ref_and_flags = t->maptrack_head << 
MAPTRACK_REF_SHIFT;
            t->maptrack_head = handle;
                             ^^^^^^
            t->map_count--;
        }
)



Now when I look  at xen/common/grant_tables.c I see how the handles are 
used in :


static int
__gnttab_map_grant_ref(
    gnttab_map_grant_ref_t *uop,
    unsigned long *va)
{
        [...] // much omitted

    if ( 0 <= ( rc = __gnttab_activate_grant_ref( ld, led, rd, ref,
                                                  dev_hst_ro_flags,
                                                  host_virt_addr, 
&frame)))
    {
        /*
         * Only make the maptrack live _after_ writing the pte, in case we 

         * overwrite the same frame number, causing a maptrack walk to 
find it
         */
        ld->grant_table->maptrack[handle].domid = dom;
                                  ^^^^^^
        ld->grant_table->maptrack[handle].ref_and_flags
                                  ^^^^^^
            = (ref << MAPTRACK_REF_SHIFT) |
              (dev_hst_ro_flags & MAPTRACK_GNTMAP_MASK);

        (void)__put_user(frame, &uop->dev_bus_addr);

        if ( dev_hst_ro_flags & GNTMAP_host_map )
            *va = host_virt_addr;

        (void)__put_user(handle, &uop->handle);


I think this newly assigned handle of '0' (for the re-created 3rd user 
domain) is overwriting some previously assign array entry for the first 
user domain. Please someone who knows have a look at this. All this is 
happening in the domain where the blockdevice backend is located.

   Stefan


Signed-off-by : Stefan Berger <stefanb@us.ibm.com>


[-- Attachment #2: blkif_debug.patch --]
[-- Type: application/octet-stream, Size: 1206 bytes --]

diff -uprN xen-unstable.hg.orig/linux-2.6-xen-sparse/drivers/xen/blkback/interface.c xen-unstable.hg/linux-2.6-xen-sparse/drivers/xen/blkback/interface.c
--- xen-unstable.hg.orig/linux-2.6-xen-sparse/drivers/xen/blkback/interface.c	2005-07-11 14:48:18.000000000 -0400
+++ xen-unstable.hg/linux-2.6-xen-sparse/drivers/xen/blkback/interface.c	2005-07-12 17:33:17.000000000 -0400
@@ -51,6 +51,11 @@ static void __blkif_disconnect_complete(
         op.handle         = blkif->shmem_handle;
         op.dev_bus_addr   = 0;
 
+        printk("Unmapping reference 0x%x, handle 0x%x, vaddr=0x%lx\n",
+               blkif->shmem_ref,
+               blkif->shmem_handle,
+               blkif->shmem_vaddr);
+
         if(unlikely(HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref, &op, 1))) {
             BUG();
         }
@@ -233,6 +238,11 @@ void blkif_connect(blkif_be_connect_t *c
         blkif->shmem_ref = ref;
         blkif->shmem_handle = handle;
         blkif->shmem_vaddr = VMALLOC_VMADDR(vma->addr);
+
+        printk("Mapped reference 0x%x, handle 0x%x, vaddr=0x%lx\n",
+               blkif->shmem_ref,
+               blkif->shmem_handle,
+               blkif->shmem_vaddr);
     }
 #endif
 

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2005-07-15 19:26 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-07-12 22:14 possible grant table issue Stefan Berger
2005-07-13  9:16 ` Christopher Clark
2005-07-15 18:23   ` Stefan Berger
2005-07-15 18:58     ` Christopher Clark
2005-07-15 19:17       ` Keir Fraser
2005-07-15 19:26         ` Christopher Clark

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.