This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] pvops dom0 work roadmap

On Thu, 20 Aug 2009, Jeremy Fitzhardinge wrote:

On i386, if %gs hasn't been loaded properly then using it as a base for
a memory access will GP.

Try this:

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 2e58099..3ebcbb2 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -51,6 +51,7 @@
#include <asm/pgtable.h>
#include <asm/tlbflush.h>
#include <asm/reboot.h>
+#include <asm/stackprotector.h>

#include "xen-ops.h"
#include "mmu.h"
@@ -1013,13 +1014,8 @@ asmlinkage void __init xen_start_kernel(void)
        pv_apic_ops = xen_apic_ops;
        pv_mmu_ops = xen_mmu_ops;

-#ifdef CONFIG_X86_64
-       /*
-        * Setup percpu state.  We only need to do this for 64-bit
-        * because 32-bit already has %fs set properly.
-        */
-       load_percpu_segment(0);
+       setup_stack_canary_segment(0);
+       switch_to_new_gdt(0);


It crashes with this patch (x86_64 also crashes) as follows

(XEN) *** Serial input -> DOM0 (type 'CTRL-a' three times to switch input to Xen)
(XEN) Freed 116kB init memory.
(XEN) d0:v0: unhandled page fault (ec=0000)
(XEN) Pagetable walk from 00000014:
(XEN)  L3[0x000] = 000000003a032001 00002032
(XEN)  L2[0x000] = 0000000000000000 ffffffff
(XEN) domain_crash_sync called from entry.S (ff1b221e)
(XEN) Domain 0 (vcpu#0) crashed on cpu#0:
(XEN) ----[ Xen-3.4.1  x86_32p  debug=n  Not tainted ]----
(XEN) CPU:    0
(XEN) EIP:    e019:[<c04064cc>]
(XEN) EFLAGS: 00000282   EM: 1   CONTEXT: pv guest
(XEN) eax: c0b1c0e0   ebx: c0b1c0e0   ecx: 00000010   edx: 0000001c
(XEN) esi: c0aa3fd8   edi: c0a1592c   ebp: c0aa3fb8   esp: c0aa3f94
(XEN) cr0: 8005003b   cr4: 000006f0   cr3: 3a031000   cr2: 00000014
(XEN) ds: e021   es: e021   fs: e021   gs: e021   ss: e021   cs: e019
(XEN) Guest stack trace from esp=c0aa3f94:
(XEN) 00000000 c04064cc 0001e019 00010082 00000000 00000000 00000010 c0aa3fd8

(XEN) c0a1592c c0aa3fcc c0403e3f 00000010 c0ae93f4 c0a1592c c0aa3ffc c0aab798

(XEN) 00000010 e0f00018 c04090b1 00000000 00000000 00000000 00000000 00000000

(XEN)    c2030000 00000000 00000000
(XEN) Domain 0 crashed: rebooting machine in 5 seconds.

The instruction and context is
(gdb) x/i 0xc04064cc
0xc04064cc <arbitrary_virt_to_machine+16>:        mov    %gs:0x14,%eax
(gdb) x/15i arbitrary_virt_to_machine
0xc04064bc <arbitrary_virt_to_machine>:   push   %ebp
0xc04064bd <arbitrary_virt_to_machine+1>: mov    %esp,%ebp
0xc04064bf <arbitrary_virt_to_machine+3>: push   %edi
0xc04064c0 <arbitrary_virt_to_machine+4>: push   %esi
0xc04064c1 <arbitrary_virt_to_machine+5>: push   %ebx
0xc04064c2 <arbitrary_virt_to_machine+6>: sub    $0x8,%esp
0xc04064c5 <arbitrary_virt_to_machine+9>: call   0xc040bc14 <mcount>
0xc04064ca <arbitrary_virt_to_machine+14>:        mov    %eax,%ebx
0xc04064cc <arbitrary_virt_to_machine+16>:        mov    %gs:0x14,%eax
0xc04064d2 <arbitrary_virt_to_machine+22>:        mov    %eax,-0x10(%ebp)
0xc04064d5 <arbitrary_virt_to_machine+25>:        xor    %eax,%eax
0xc04064d7 <arbitrary_virt_to_machine+27>:        mov    %ebx,%eax
0xc04064d9 <arbitrary_virt_to_machine+29>:
    call   0xc042f95c <__virt_addr_valid>
0xc04064de <arbitrary_virt_to_machine+34>:        test   %al,%al
0xc04064e0 <arbitrary_virt_to_machine+36>:
    je     0xc040650e <arbitrary_virt_to_machine+82>

        Michael Young

Xen-devel mailing list