[Xen-devel] Fail to boot Dom0 on Xen Arm64 after "dma-mapping: bypass indirect calls for dma-direct"

[Julien Grall <julien.grall@xxxxxxx>]

Hi,

I made an attempt to boot Linux 5.0-rc2 as Dom0 on Xen
Arm64 and got the following splat:

[    4.074264] Unable to handle kernel NULL pointer dereference at virtual 
address 0000000000000000
[    4.083074] Mem abort info:
[    4.085870]   ESR = 0x96000004
[    4.089050]   Exception class = DABT (current EL), IL = 32 bits
[    4.095065]   SET = 0, FnV = 0
[    4.098138]   EA = 0, S1PTW = 0
[    4.101405] Data abort info:
[    4.104362]   ISV = 0, ISS = 0x00000004
[    4.108289]   CM = 0, WnR = 0
[    4.111328] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[    4.118025] [0000000000000000] pgd=0000000000000000
[    4.123058] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[    4.128590] Modules linked in:
[    4.131727] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 
5.0.0-rc2-00154-gc5dbed6dcf60 #1191
[    4.139997] Hardware name: ARM Juno development board (r2) (DT)
[    4.145995] pstate: 20000005 (nzCv daif -PAN -UAO)
[    4.150876] pc : xen_swiotlb_alloc_coherent+0x64/0x1e8
[    4.156092] lr : dma_alloc_attrs+0xf4/0x110
[    4.160359] sp : ffff00001003b960
[    4.163743] x29: ffff00001003b960 x28: ffff0000112cfbb4
[    4.169137] x27: ffff0000116ed000 x26: ffff00001003ba90
[    4.174533] x25: ffff000010d6c350 x24: 0000000000000005
[    4.179937] x23: 0000000000020000 x22: 000000000001f000
[    4.185323] x21: 0000000000000000 x20: ffff8008b904b0b0
[    4.190727] x19: ffff0000114d4000 x18: ffff000014033fff
[    4.196113] x17: 0000000000000000 x16: 0000000000000000
[    4.201509] x15: 0000000000004000 x14: ffff0000110fc000
[    4.206903] x13: ffff0000114dd000 x12: 0000000000000068
[    4.212299] x11: 0000000000000001 x10: 0000000000000000
[    4.217693] x9 : 0000000000000000 x8 : ffff8008b9b05b00
[    4.223089] x7 : 0000000000000000 x6 : 0000000000000000
[    4.228483] x5 : ffff0000106d4c38 x4 : 0000000000000000
[    4.233879] x3 : 00000000006000c0 x2 : ffff00001003ba90
[    4.239274] x1 : 0000000000020000 x0 : 0000000000000000
[    4.244671] Process swapper/0 (pid: 1, stack limit = 0x(____ptrval____))
[    4.251456] Call trace:
[    4.253985]  xen_swiotlb_alloc_coherent+0x64/0x1e8
[    4.258857]  dma_alloc_attrs+0xf4/0x110
[    4.262774]  dmam_alloc_attrs+0x64/0xb8
[    4.266691]  sil24_port_start+0x6c/0x100
[    4.270704]  ata_host_start.part.10+0x104/0x210
[    4.275304]  ata_host_activate+0x64/0x148
[    4.279392]  sil24_init_one+0x1ac/0x2b0
[    4.283312]  pci_device_probe+0xdc/0x168
[    4.287313]  really_probe+0x1f0/0x298
[    4.291054]  driver_probe_device+0x58/0x100
[    4.295316]  __driver_attach+0xdc/0xe0
[    4.299145]  bus_for_each_dev+0x74/0xc8
[    4.303061]  driver_attach+0x20/0x28
[    4.306716]  bus_add_driver+0x1b0/0x220
[    4.310641]  driver_register+0x60/0x110
[    4.314549]  __pci_register_driver+0x58/0x68
[    4.318902]  sil24_pci_driver_init+0x20/0x28
[    4.323251]  do_one_initcall+0xb8/0x348
[    4.327166]  kernel_init_freeable+0x3cc/0x474
[    4.331606]  kernel_init+0x10/0x100
[    4.335171]  ret_from_fork+0x10/0x1c
[    4.338829] Code: f941fa80 aa1503e4 aa1a03e2 aa1703e1 (f9400005)
[    4.345028] ---[ end trace 277757f27697a72b ]---

The bisector fingered the following commit:

commit 356da6d0cde3323236977fce54c1f9612a742036
Author: Christoph Hellwig <hch@xxxxxx>
Date:   Thu Dec 6 13:39:32 2018 -0800

    dma-mapping: bypass indirect calls for dma-direct
    
    Avoid expensive indirect calls in the fast path DMA mapping
    operations by directly calling the dma_direct_* ops if we are using
    the directly mapped DMA operations.
    
    Signed-off-by: Christoph Hellwig <hch@xxxxxx>
    Acked-by: Jesper Dangaard Brouer <brouer@xxxxxxxxxx>
    Tested-by: Jesper Dangaard Brouer <brouer@xxxxxxxxxx>
    Tested-by: Tony Luck <tony.luck@xxxxxxxxx>

Discussing with Robin, it looks like that the current wrappers in for Xen
(see include/xen/arm/page-coherent.h) are not able to cope with direct
calls. Those wrappers are used by swiotlb to call the underlying DMA ops
of the device. They are unable to cope with NULL (aka direct-mapping), hence
the NULL dereference crash.

Do you have any suggestion how this should be fixed?

Best regards,

-- 
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel