Re: BUG during vgic3 ITS mapping

[Stewart Hildebrand <stewart.hildebrand@xxxxxxx>]

On 7/9/25 11:16, Jason Andryuk wrote:
> Hi,
> 
> I'm running Xen in QEMU with vgic3 and started hitting:
> 
> (XEN) Xen BUG at drivers/passthrough/arm/iommu_helpers.c:49
> 
>     BUG_ON(!is_domain_direct_mapped(d));
> 
> I'm using dmo0less to create a split hardware and control domains.  That 
> means hwdom is not direct mapped, but is_iommu_enabled() is true.  It looks 
> to be caused by the new call to iommu_map() in:
> 
> commit f9f6b22abf1d8d88c97fbc9925b274c0bb4ac881
> Author: Rahul Singh <rahul.singh@xxxxxxx>
> Date:   Wed Jul 2 07:10:03 2025 +0000
> 
>     xen/arm: Map ITS doorbell register to IOMMU page tables
> 
> Thoughts on how to address this?

I think the BUG_ON in question wants changing to:

-    BUG_ON(!is_domain_direct_mapped(d));
+    BUG_ON(!domain_use_host_layout(d));

... along with an appropriate update of the comment prior to this line.

I suspect a cache colored hwdom/dom0 would also stumble here.

In the future when we will support vITS for domUs, we may want to remove
the BUG_ON entirely [1], but for now the ITS doorbell mapping is still
expected to be DFN == MFN.

[1] 
https://github.com/Xilinx/xen/commit/d814f9d13a51625bdaca9299d36272ee393e7ddc

> Thanks,
> Jason
> 
> (XEN) Loading d1 initrd from 0000000045800000 to 
> 0x0000000048200000-0x000000004bdcd615
> (XEN) Loading d1 DTB to 0x0000000048000000-0x00000000480005c4
> (XEN) Xen BUG at drivers/passthrough/arm/iommu_helpers.c:49
> (XEN) ----[ Xen-4.21-unstable  arm64  debug=y  Tainted: I      ]----
> (XEN) CPU:    0
> (XEN) PC:     00000a000024c758 arm_iommu_map_page+0x80/0x90
> (XEN) LR:     00000a000024c750
> (XEN) SP:     00000a000032fb70
> (XEN) CPSR:   0000000080000249 MODE:64-bit EL2h (Hypervisor, handler)
> ...
> (XEN) Xen call trace:
> (XEN)    [<00000a000024c758>] arm_iommu_map_page+0x80/0x90 (PC)
> (XEN)    [<00000a000024c750>] arm_iommu_map_page+0x78/0x90 (LR)
> (XEN)    [<00000a0000250884>] iommu_map+0xcc/0x29c
> (XEN)    [<00000a0000288024>] vgic_v3_its_init_domain+0x18c/0x1e8
> (XEN)    [<00000a0000285228>] vgic-v3.c#vgic_v3_domain_init+0x168/0x21c
> (XEN)    [<00000a0000281dcc>] domain_vgic_init+0x14c/0x210
> (XEN)    [<00000a00002705a4>] arch_domain_create+0x150/0x1f0
> (XEN)    [<00000a00002055e8>] domain_create+0x47c/0x6c0
> (XEN)    [<00000a00002cf090>] create_domUs+0x7f8/0x8cc
> (XEN)    [<00000a00002eb588>] start_xen+0x8f4/0x998
> (XEN)    [<00000a000020018c>] head.o#primary_switched+0x4/0x10
> (XEN)
> (XEN)
> (XEN) ****************************************
> (XEN) Panic on CPU 0:
> (XEN) Xen BUG at drivers/passthrough/arm/iommu_helpers.c:49
> (XEN) ****************************************
> (XEN)
> (XEN) Reboot in five seconds...