Re: [Xen-devel] Xen 4.3 + tmem = Xen BUG at domain_page.c:143

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 11.06.13 at 15:45, konrad wilk <konrad.wilk@xxxxxxxxxx> wrote:
> This is a fairly simple test and it does work with Xen 4.2.
> [...]
> (XEN) ----[ Xen-4.3-unstable  x86_64  debug=y  Not tainted ]----
> (XEN) CPU:    0
> (XEN) RIP:    e008:[<ffff82c4c0160461>] map_domain_page+0x450/0x514
> (XEN) RFLAGS: 0000000000010046   CONTEXT: hypervisor
> (XEN) rax: 0000000000000020   rbx: ffff8300c68f9000   rcx: 0000000000000000
> (XEN) rdx: 0000000000000020   rsi: 0000000000000020   rdi: 0000000000000000
> (XEN) rbp: ffff82c4c02c7cc8   rsp: ffff82c4c02c7c88   r8: ffff820060001000
> (XEN) r9:  00000000ffffffff   r10: ffff820060006000   r11: 0000000000000000
> (XEN) r12: ffff83022e1bb000   r13: 00000000001ebcdc   r14: 0000000000000020
> (XEN) r15: 0000000000000004   cr0: 0000000080050033   cr4: 00000000000426f0
> (XEN) cr3: 0000000209541000   cr2: ffff88002b683fd0
> (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
> (XEN) Xen stack trace from rsp=ffff82c4c02c7c88:
> (XEN)    ffff83022e1bb2d8 0000000000000286 ffff82c4c012760a ffff83022e1bb000
> (XEN)    ffff82e003d79b80 ffff82c4c02c7d60 00000000001ebcdc 0000000000000000
> (XEN)    ffff82c4c02c7d38 ffff82c4c01373de ffff82c4c0127b6b ffffffffffffffff
> (XEN)    00000000c02c7d38 ffff82c4c02c7d58 ffff83022e1bb2d8 0000000000000286
> (XEN)    0000000000000027 0000000000000000 0000000000001000 0000000000000000
> (XEN)    0000000000000000 00000000001ebcdc ffff82c4c02c7d98 ffff82c4c01377c4
> (XEN)    0000000000000000 ffff820040014000 ffff82e003d79b80 00000000001ebcdc
> (XEN)    ffff82c4c02c7d98 ffff830210ecf390 00000000fffffff4 ffff820040010010
> (XEN)    ffff82004001cf50 ffff83022e1bcc90 ffff82c4c02c7e18 ffff82c4c0135929
> (XEN)    ffff82c4c02c7db8 ffff82004001cf50 0000000000000000 00000000001ebcdc
> (XEN)    0000000000000000 0000000000000000 0000e8a200000000 ffff82c4c02c7e00
> (XEN)    ffff82c4c02c7e18 ffff83022e1bcc90 ffff830210ecf390 0000000000000000
> (XEN)    0000000000000001 000000000000009a ffff82c4c02c7ef8 ffff82c4c0136510
> (XEN)    0000002700001000 0000000000000000 ffff82c4c02c7e90 97c4284effffffc2
> (XEN)    ffff82c4c02c7e68 ffff82c4c015719d ffff82c4c0127b09 0000000000000000
> (XEN)    ffff82c4c02c7e88 ffff82c4c018c13c ffff82c4c0319100 ffff82c4c02c7f18
> (XEN)    0000000000000004 0000000000000001 0000000000000000 0000000000000000
> (XEN)    000000000000e8a2 0000000000000000 00000000001ebcdc 000000000000e030
> (XEN)    0000000000000246 ffff8300c68f9000 0000000000000000 0000000000000000
> (XEN)    0000000000000001 0000000000000000 00007d3b3fd380c7 ffff82c4c02236db
> (XEN) Xen call trace:
> (XEN)    [<ffff82c4c0160461>] map_domain_page+0x450/0x514
> (XEN)    [<ffff82c4c01373de>] cli_get_page+0x15e/0x17b
> (XEN)    [<ffff82c4c01377c4>] tmh_copy_from_client+0x150/0x284
> (XEN)    [<ffff82c4c0135929>] do_tmem_put+0x323/0x5c4
> (XEN)    [<ffff82c4c0136510>] do_tmem_op+0x5a0/0xbd0
> (XEN)    [<ffff82c4c02236db>] syscall_enter+0xeb/0x145
> (XEN)
> (XEN)
> (XEN) ****************************************
> (XEN) Panic on CPU 0:
> (XEN) Xen BUG at domain_page.c:143
> (XEN) ****************************************

For one, you won't see this with debug=n.

And then it seems quite likely that tmem shows behavior that I'm
unaware of, and hence I may have broken it with the 16Tb
support patches - I suspect it simply drives the hypervisor out of
domain page mapping resources. After all, x86-64 didn't do any
such mapping yet in 4.2.

But tmem being unsupported due to the still pending security
audit makes this a low priority issue anyway. And as you may
or may not recall, it is being disabled for systems with more
than 5Tb too. So quite a bit of work on the tmem side...

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel