* [BUG] 'o' debug key panics the hypervisor
@ 2015-08-27 11:29 Roger Pau Monné
2015-08-27 12:02 ` Andrew Cooper
2015-08-27 14:01 ` Jan Beulich
0 siblings, 2 replies; 8+ messages in thread
From: Roger Pau Monné @ 2015-08-27 11:29 UTC (permalink / raw)
To: xen-devel; +Cc: yang.z.zhang, Andrew Cooper, Kevin Tian, Jan Beulich
Hello,
When using Intel hardware without shared page tables between the IOMMU
and EPT (I have not tried if the same happens when sharing the page
tables), the following crash happens if I press the 'o' debug key with
a HVM guest running. The guest doesn't have any device passed-through.
(XEN) domain1 IOMMU p2m table:
(XEN) p2m table has 4 levels
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
(XEN) ----[ Xen-4.6.0-rc x86_64 debug=y Tainted: C ]----
(XEN) CPU: 0
(XEN) RIP: e008:[<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
(XEN) RFLAGS: 0000000000010216 CONTEXT: hypervisor
(XEN) rax: 0000000a8bcf000e rbx: 0000a8bcf000e000 rcx: 0000000000000000
(XEN) rdx: 00000007c7ffffff rsi: 00000000dfaa0000 rdi: 0000000a8bcf000e
(XEN) rbp: ffff8300dfaf7d60 rsp: ffff8300dfaf7d20 r8: ffff83019d2f48a8
(XEN) r9: 00000018c2c65cec r10: ffff83019d2f4890 r11: 0100100100100100
(XEN) r12: ffff83019d263000 r13: 0000000000000003 r14: ffff8300dfb3b000
(XEN) r15: 000ffffffffff000 cr0: 000000008005003b cr4: 00000000000026e0
(XEN) cr3: 00000000dfaa0000 cr2: 0000000000000000
(XEN) ds: 0000 es: 0000 fs: 0000 gs: 0000 ss: e010 cs: e008
(XEN) Xen stack trace from rsp=ffff8300dfaf7d20:
(XEN) ffff82d08012cf27 ffff82d0802a2bc0 ffff8300dfaf7d40 0000a8bcf000e000
(XEN) ffff830000000000 0000000000000003 0000008000000000 000ffffffffff000
(XEN) ffff8300dfaf7d70 ffff82d080152849 ffff8300dfaf7dc0 ffff82d08014c2d6
(XEN) 00000001dfaf7db0 ffff82d08012c667 0000000000000000 0000000000000001
(XEN) ffff830000000000 0000000000000003 0000000000000000 000ffffffffff000
(XEN) ffff8300dfaf7e10 ffff82d08014c34f 00000000dfaf7e20 0000002700000001
(XEN) ffff8300dfb3b000 ffff83019fd65000 ffff82d0802922c0 ffff82d0802698f9
(XEN) ffff82d080339488 ffffffffffffffff ffff8300dfaf7e30 ffff82d08014c3f3
(XEN) 0000000000000000 ffff83019fd65000 ffff8300dfaf7e60 ffff82d0801477b7
(XEN) 0000000000000000 ffff82d0802a2d60 000000000000006f 0000000000000000
(XEN) ffff8300dfaf7e90 ffff82d080114853 ffff8300dfaf7e90 ffff82d0802a25c0
(XEN) 0000000000000000 ffff82d080339560 ffff8300dfaf7ea0 ffff82d08011488d
(XEN) ffff8300dfaf7ec0 ffff82d08012f3ca ffff8300dfaf7ec0 ffff82d080339570
(XEN) ffff8300dfaf7ef0 ffff82d08012f700 00000018c2222afe ffff8300dfaf0000
(XEN) 00000018c2222afe ffff8300dfb3b000 ffff8300dfaf7f10 ffff82d0801607c3
(XEN) ffff82d08012c711 ffff8300dfb3b000 ffff8300dfaf7e10 0000000000000000
(XEN) 0000000000000000 ffffffffffffffff ffff88001faa7e80 ffffffff8168f160
(XEN) ffffffff81600000 0000000000000246 ffffffff8160003e ffff88001f60da80
(XEN) 0000000000000000 0000000000000000 ffffffff810013aa 0000000000000000
(XEN) 00000000deadbeef 00000000deadbeef 0000010000000000 ffffffff810013aa
(XEN) Xen call trace:
(XEN) [<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
(XEN) [<ffff82d080152849>] map_vtd_domain_page+0xd/0xf
(XEN) [<ffff82d08014c2d6>] vtd_dump_p2m_table_level+0x2a/0xf6
(XEN) [<ffff82d08014c34f>] vtd_dump_p2m_table_level+0xa3/0xf6
(XEN) [<ffff82d08014c3f3>] vtd_dump_p2m_table+0x51/0x59
(XEN) [<ffff82d0801477b7>] iommu_dump_p2m_table+0xaa/0xbe
(XEN) [<ffff82d080114853>] handle_keypress+0x68/0x8d
(XEN) [<ffff82d08011488d>] keypress_action+0x15/0x17
(XEN) [<ffff82d08012f3ca>] do_tasklet_work+0x78/0xab
(XEN) [<ffff82d08012f700>] do_tasklet+0x5e/0x8a
(XEN) [<ffff82d0801607c3>] idle_loop+0x56/0x6b
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 11:29 [BUG] 'o' debug key panics the hypervisor Roger Pau Monné
@ 2015-08-27 12:02 ` Andrew Cooper
2015-08-27 13:49 ` Roger Pau Monné
2015-08-27 14:01 ` Jan Beulich
1 sibling, 1 reply; 8+ messages in thread
From: Andrew Cooper @ 2015-08-27 12:02 UTC (permalink / raw)
To: Roger Pau Monné, xen-devel; +Cc: yang.z.zhang, Kevin Tian, Jan Beulich
On 27/08/15 12:29, Roger Pau Monné wrote:
> Hello,
>
> When using Intel hardware without shared page tables between the IOMMU
> and EPT (I have not tried if the same happens when sharing the page
> tables), the following crash happens if I press the 'o' debug key with
> a HVM guest running. The guest doesn't have any device passed-through.
>
> (XEN) domain1 IOMMU p2m table:
> (XEN) p2m table has 4 levels
> (XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
> (XEN) ----[ Xen-4.6.0-rc x86_64 debug=y Tainted: C ]----
> (XEN) CPU: 0
> (XEN) RIP: e008:[<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
> (XEN) RFLAGS: 0000000000010216 CONTEXT: hypervisor
The use of paddr_to_pfn() in map_vtd_domain_page() is incorrect.
Does this fix the issue?
diff --git a/xen/drivers/passthrough/vtd/x86/vtd.c
b/xen/drivers/passthrough/vtd/x86/vtd.c
index c0d6aab..35cfd89 100644
--- a/xen/drivers/passthrough/vtd/x86/vtd.c
+++ b/xen/drivers/passthrough/vtd/x86/vtd.c
@@ -40,7 +40,7 @@
void *map_vtd_domain_page(u64 maddr)
{
- return map_domain_page(_mfn(paddr_to_pfn(maddr)));
+ return __map_domain_page(maddr_to_page(maddr));
}
void unmap_vtd_domain_page(void *va)
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 12:02 ` Andrew Cooper
@ 2015-08-27 13:49 ` Roger Pau Monné
0 siblings, 0 replies; 8+ messages in thread
From: Roger Pau Monné @ 2015-08-27 13:49 UTC (permalink / raw)
To: Andrew Cooper, xen-devel; +Cc: yang.z.zhang, Kevin Tian, Jan Beulich
El 27/08/15 a les 14.02, Andrew Cooper ha escrit:
> On 27/08/15 12:29, Roger Pau Monné wrote:
>> Hello,
>>
>> When using Intel hardware without shared page tables between the IOMMU
>> and EPT (I have not tried if the same happens when sharing the page
>> tables), the following crash happens if I press the 'o' debug key with
>> a HVM guest running. The guest doesn't have any device passed-through.
>>
>> (XEN) domain1 IOMMU p2m table:
>> (XEN) p2m table has 4 levels
>> (XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
>> (XEN) ----[ Xen-4.6.0-rc x86_64 debug=y Tainted: C ]----
>> (XEN) CPU: 0
>> (XEN) RIP: e008:[<ffff82d080165f20>] map_domain_page+0x1ef/0x5e6
>> (XEN) RFLAGS: 0000000000010216 CONTEXT: hypervisor
>
> The use of paddr_to_pfn() in map_vtd_domain_page() is incorrect.
>
> Does this fix the issue?
Sadly no. Here is the panic trace with your patch applied:
(XEN) domain1 IOMMU p2m table:
(XEN) p2m table has 4 levels
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h:80
(XEN) ----[ Xen-4.6.0-rc x86_64 debug=y Tainted: C ]----
(XEN) CPU: 0
(XEN) RIP: e008:[<ffff82d080165815>] map_domain_page+0x1ef/0x5e6
(XEN) RFLAGS: 0000000000010216 CONTEXT: hypervisor
(XEN) rax: 0000000a8bcf000e rbx: 0000a8bcf000e000 rcx: 0000000000000000
(XEN) rdx: 00000007c7ffffff rsi: 00000000dfa9f000 rdi: 0000000a8bcf000e
(XEN) rbp: ffff8300dfaf7d60 rsp: ffff8300dfaf7d20 r8: 0000000000000000
(XEN) r9: 0000000000000001 r10: 0000000000000004 r11: 0000000000000001
(XEN) r12: ffff83019d263000 r13: 0000000000000003 r14: ffff8300dfdf2000
(XEN) r15: 000ffffffffff000 cr0: 000000008005003b cr4: 00000000000026e0
(XEN) cr3: 00000000dfa9f000 cr2: ffff880012b18c90
(XEN) ds: 0000 es: 0000 fs: 0000 gs: 0000 ss: e010 cs: e008
(XEN) Xen stack trace from rsp=ffff8300dfaf7d20:
(XEN) ffff82d08012cfda ffff82d0802a1bc0 ffff8300dfaf7d40 0000a8bcf000e000
(XEN) ffff830000000000 0000000000000003 0000008000000000 000ffffffffff000
(XEN) ffff8300dfaf7d70 ffff82d080152998 ffff8300dfaf7dc0 ffff82d08014c389
(XEN) 00000001dfaf7db0 ffff82d08012c71a 0000000000000000 0000000000000001
(XEN) ffff830000000000 0000000000000003 0000000000000000 000ffffffffff000
(XEN) ffff8300dfaf7e10 ffff82d08014c402 00000000dfaf7e20 0000002700000001
(XEN) ffff8300dfdf2000 ffff83019ff11000 ffff82d080291240 ffff82d0802688f8
(XEN) ffff82d080339488 ffffffffffffffff ffff8300dfaf7e30 ffff82d08014c4a6
(XEN) 0000000000000000 ffff83019ff11000 ffff8300dfaf7e60 ffff82d08014786a
(XEN) 0000000000000000 ffff82d0802a1d60 000000000000006f 0000000000000000
(XEN) ffff8300dfaf7e90 ffff82d080114906 ffff8300dfaf7e90 ffff82d0802a15c0
(XEN) 0000000000000000 ffff82d080339560 ffff8300dfaf7ea0 ffff82d080114940
(XEN) ffff8300dfaf7ec0 ffff82d08012f47d ffff8300dfaf7ec0 ffff82d080339570
(XEN) ffff8300dfaf7ef0 ffff82d08012f7b3 0000054782099709 ffff8300dfaf0000
(XEN) 0000054782099709 ffff8300dfdf2000 ffff8300dfaf7f10 ffff82d0801607c3
(XEN) ffff82d08012c7c4 ffff8300dfdf2000 ffff8300dfaf7e10 0000000000000000
(XEN) 0000000000000000 ffffffffffffffff ffff88001faa7e80 ffffffff8168f160
(XEN) ffffffff81600000 0000000000000246 0000000000000020 ffff88001f60da80
(XEN) 0000000000000000 0000000000000000 ffffffff810013aa 0000000000000000
(XEN) 00000000deadbeef 00000000deadbeef 0000010000000000 ffffffff810013aa
(XEN) Xen call trace:
(XEN) [<ffff82d080165815>] map_domain_page+0x1ef/0x5e6
(XEN) [<ffff82d080152998>] map_vtd_domain_page+0x4a/0x4c
(XEN) [<ffff82d08014c389>] vtd_dump_p2m_table_level+0x2a/0xf6
(XEN) [<ffff82d08014c402>] vtd_dump_p2m_table_level+0xa3/0xf6
(XEN) [<ffff82d08014c4a6>] vtd_dump_p2m_table+0x51/0x59
(XEN) [<ffff82d08014786a>] iommu_dump_p2m_table+0xaa/0xbe
(XEN) [<ffff82d080114906>] handle_keypress+0x68/0x8d
(XEN) [<ffff82d080114940>] keypress_action+0x15/0x17
(XEN) [<ffff82d08012f47d>] do_tasklet_work+0x78/0xab
(XEN) [<ffff82d08012f7b3>] do_tasklet+0x5e/0x8a
(XEN) [<ffff82d0801607c3>] idle_loop+0x56/0x6b
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) Assertion 'pfn_to_pdx(ma >> PAGE_SHIFT) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at /root/src/xen/xen/include/asm/x86_64/page.h
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 11:29 [BUG] 'o' debug key panics the hypervisor Roger Pau Monné
2015-08-27 12:02 ` Andrew Cooper
@ 2015-08-27 14:01 ` Jan Beulich
2015-08-27 14:07 ` Roger Pau Monné
1 sibling, 1 reply; 8+ messages in thread
From: Jan Beulich @ 2015-08-27 14:01 UTC (permalink / raw)
To: Roger Pau Monné; +Cc: yang.z.zhang, Andrew Cooper, Kevin Tian, xen-devel
>>> On 27.08.15 at 13:29, <roger.pau@citrix.com> wrote:
> When using Intel hardware without shared page tables between the IOMMU
> and EPT (I have not tried if the same happens when sharing the page
> tables), the following crash happens if I press the 'o' debug key with
> a HVM guest running. The guest doesn't have any device passed-through.
This last thing is the relevant one: No-one ever cared to use 'o' without
also passing through a device.
Jan
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 14:01 ` Jan Beulich
@ 2015-08-27 14:07 ` Roger Pau Monné
2015-08-27 18:33 ` Konrad Rzeszutek Wilk
2015-08-28 2:06 ` Tian, Kevin
0 siblings, 2 replies; 8+ messages in thread
From: Roger Pau Monné @ 2015-08-27 14:07 UTC (permalink / raw)
To: Jan Beulich; +Cc: yang.z.zhang, Andrew Cooper, Kevin Tian, xen-devel
El 27/08/15 a les 16.01, Jan Beulich ha escrit:
>>>> On 27.08.15 at 13:29, <roger.pau@citrix.com> wrote:
>> When using Intel hardware without shared page tables between the IOMMU
>> and EPT (I have not tried if the same happens when sharing the page
>> tables), the following crash happens if I press the 'o' debug key with
>> a HVM guest running. The guest doesn't have any device passed-through.
>
> This last thing is the relevant one: No-one ever cared to use 'o' without
> also passing through a device.
I have to admit I discovered this when I thought I was typing at the
Dom0 console but it turns out I had it switched to the Xen console...
Anyway, it shouldn't crash Xen.
Roger.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 14:07 ` Roger Pau Monné
@ 2015-08-27 18:33 ` Konrad Rzeszutek Wilk
2015-08-28 8:28 ` Jan Beulich
2015-08-28 2:06 ` Tian, Kevin
1 sibling, 1 reply; 8+ messages in thread
From: Konrad Rzeszutek Wilk @ 2015-08-27 18:33 UTC (permalink / raw)
To: Roger Pau Monné
Cc: yang.z.zhang, Andrew Cooper, Kevin Tian, Jan Beulich, xen-devel
On Thu, Aug 27, 2015 at 04:07:36PM +0200, Roger Pau Monné wrote:
> El 27/08/15 a les 16.01, Jan Beulich ha escrit:
> >>>> On 27.08.15 at 13:29, <roger.pau@citrix.com> wrote:
> >> When using Intel hardware without shared page tables between the IOMMU
> >> and EPT (I have not tried if the same happens when sharing the page
> >> tables), the following crash happens if I press the 'o' debug key with
> >> a HVM guest running. The guest doesn't have any device passed-through.
> >
> > This last thing is the relevant one: No-one ever cared to use 'o' without
> > also passing through a device.
>
> I have to admit I discovered this when I thought I was typing at the
> Dom0 console but it turns out I had it switched to the Xen console...
> Anyway, it shouldn't crash Xen.
And it would be called by '*' which is often used in the field to
collect data.
I concur on the not-crashing Xen part.
>
> Roger.
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 14:07 ` Roger Pau Monné
2015-08-27 18:33 ` Konrad Rzeszutek Wilk
@ 2015-08-28 2:06 ` Tian, Kevin
1 sibling, 0 replies; 8+ messages in thread
From: Tian, Kevin @ 2015-08-28 2:06 UTC (permalink / raw)
To: Roger Pau Monné, Jan Beulich; +Cc: Zhang, Yang Z, Andrew Cooper, xen-devel
> From: Roger Pau Monné [mailto:roger.pau@citrix.com]
> Sent: Thursday, August 27, 2015 10:08 PM
>
> El 27/08/15 a les 16.01, Jan Beulich ha escrit:
> >>>> On 27.08.15 at 13:29, <roger.pau@citrix.com> wrote:
> >> When using Intel hardware without shared page tables between the IOMMU
> >> and EPT (I have not tried if the same happens when sharing the page
> >> tables), the following crash happens if I press the 'o' debug key with
> >> a HVM guest running. The guest doesn't have any device passed-through.
> >
> > This last thing is the relevant one: No-one ever cared to use 'o' without
> > also passing through a device.
>
> I have to admit I discovered this when I thought I was typing at the
> Dom0 console but it turns out I had it switched to the Xen console...
> Anyway, it shouldn't crash Xen.
>
> Roger.
yes, it should be fixed anyway.
Thanks
Kevin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] 'o' debug key panics the hypervisor
2015-08-27 18:33 ` Konrad Rzeszutek Wilk
@ 2015-08-28 8:28 ` Jan Beulich
0 siblings, 0 replies; 8+ messages in thread
From: Jan Beulich @ 2015-08-28 8:28 UTC (permalink / raw)
To: Konrad Rzeszutek Wilk
Cc: yang.z.zhang, Andrew Cooper, Kevin Tian, xen-devel, roger.pau
>>> On 27.08.15 at 20:33, <konrad.wilk@oracle.com> wrote:
> On Thu, Aug 27, 2015 at 04:07:36PM +0200, Roger Pau Monné wrote:
>> El 27/08/15 a les 16.01, Jan Beulich ha escrit:
>> >>>> On 27.08.15 at 13:29, <roger.pau@citrix.com> wrote:
>> >> When using Intel hardware without shared page tables between the IOMMU
>> >> and EPT (I have not tried if the same happens when sharing the page
>> >> tables), the following crash happens if I press the 'o' debug key with
>> >> a HVM guest running. The guest doesn't have any device passed-through.
>> >
>> > This last thing is the relevant one: No-one ever cared to use 'o' without
>> > also passing through a device.
>>
>> I have to admit I discovered this when I thought I was typing at the
>> Dom0 console but it turns out I had it switched to the Xen console...
>> Anyway, it shouldn't crash Xen.
>
> And it would be called by '*' which is often used in the field to
> collect data.
No, it (intentionally due to the huge amount of output it can
generate) is excluded from '*' processing by having its "diagnostic"
field set to false.
> I concur on the not-crashing Xen part.
Sure, that's why it got fixed.
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2015-08-28 8:28 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-08-27 11:29 [BUG] 'o' debug key panics the hypervisor Roger Pau Monné
2015-08-27 12:02 ` Andrew Cooper
2015-08-27 13:49 ` Roger Pau Monné
2015-08-27 14:01 ` Jan Beulich
2015-08-27 14:07 ` Roger Pau Monné
2015-08-27 18:33 ` Konrad Rzeszutek Wilk
2015-08-28 8:28 ` Jan Beulich
2015-08-28 2:06 ` Tian, Kevin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).