linux-kernel - Re: 2.6.25-rc1 xen pvops regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 17 Feb 2008 18:49:21 +0000
From:	Ian Campbell <ijc@...lion.org.uk>
To:	Joel Becker <Joel.Becker@...cle.com>
Cc:	Jeremy Fitzhardinge <jeremy@...p.org>,
	Jody Belka <lists-lkml@...b.org>, linux-kernel@...r.kernel.org,
	Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Andi Kleen <andi@...stfloor.org>,
	Mika Penttila <mika.penttila@...umbus.fi>
Subject: Re: 2.6.25-rc1 xen pvops regression


On Fri, 2008-02-15 at 12:23 -0800, Joel Becker wrote:
> On Thu, Feb 14, 2008 at 06:50:52PM +1100, Jeremy Fitzhardinge wrote:
> >> 	I'm seeing the same problem, with no messages at all from xen
> >> other than "domain crashed, restart disabled" in xend.log.  I got a
> >> different commit in my bisect, 0947b2f31ca1ea1211d3cde2dbd8fcec579ef395
> >> (i386 boot: replace boot_io    remap with enhanced bt_ioremap - enhance
> >> bt_ioremap).  I started from yesterday's
> >> 96b5a46e2a72dc1829370c87053e0cd558d58bc0 (WMI: initialize
> >> wmi_blocks.list even if ACPI is disabled) and a known good
> >> 9b73e76f3cf63379dcf45fcd4f112f5812418d0a (Merge
> >> git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6).
> >
> > Is the domain ending up in the crashed state?  Do you get a register  
> > dump with xm dmesg?  That would be very useful in determining what went  
> > wrong.  You may need to compile Xen with debug=y in Config.mk.
> 
> 	I didn't know xm dmesg existed :-)  Regarding debug=y, I'm using
> a prepackaged dom0 set.  Here's what I find in xm dmesg:
> 
> Joel
> 
> (XEN) mm.c:1825:d109 Bad type (saw 0000000028000001 != exp 00000000e0000000) for mfn 3a2f0f (pfn f0)
> (XEN) mm.c:649:d109 Error getting mfn 3a2f0f (pfn f0) from L1 entry 00000003a2f0f063 for dom109
> (XEN) mm.c:1825:d109 Bad type (saw 0000000028000001 != exp 00000000e0000000) for mfn 3a2f0f (pfn f0)
> (XEN) mm.c:649:d109 Error getting mfn 3a2f0f (pfn f0) from L1 entry 00000003a2f0f063 for dom109
> (XEN) mm.c:3331:d109 ptwr_emulate: could not get_page_from_l1e()

I've been seeing similar attempts to map 0xf0 but so far I was the only
one (although that made no sense to me). Does the patch below help at
all? The problem seems to be that the kernel is trying to map pages at
0xf0000 but these are not reserved in the guest E820 map so they could
contain a page table page etc.

A useful tip for getting a backtrace out of a crashed Xen guest is to
set "on_crash=preserve" in your domain config. Then once the crash has
happened you can use "/usr/lib/xen/bin/xenctx -s System.map <domid>"
where System.map is the guest kernel System.map.

Ian.

--- 

x86/xen: Do not scan for DMI unless the DMI region is reserved by e820.

Signed-off-by: Ian Campbell <ijc@...lion.org.uk>
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 9008ed5..79525f5 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -7,6 +7,7 @@
 #include <linux/bootmem.h>
 #include <linux/slab.h>
 #include <asm/dmi.h>
+#include <asm/e820.h>
 
 static char dmi_empty_string[] = "        ";
 
@@ -336,6 +337,10 @@ void __init dmi_scan_machine(void)
 		}
 	}
 	else {
+
+		if (!e820_all_mapped(0xF0000, 0xF0000+0x10000, E820_RESERVED))
+			goto out;
+
 		/*
 		 * no iounmap() for that ioremap(); it would be a no-op, but
 		 * it's so early in setup that sucker gets confused into doing

-- 
Ian Campbell

The profession of book writing makes horse racing seem like a solid,
stable business.
		-- John Steinbeck
	[Horse racing *is* a stable business ...]

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)