This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-ia64-devel] stack corruption creating idle domain

To: "Tian, Kevin" <kevin.tian@xxxxxxxxx>
Subject: RE: [Xen-ia64-devel] stack corruption creating idle domain
From: Alex Williamson <alex.williamson@xxxxxx>
Date: Tue, 24 Jan 2006 19:43:53 -0700
Cc: xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Wed, 25 Jan 2006 02:52:29 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <571ACEFD467F7749BC50E0A98C17CDD802C06CE6@pdsmsx403>
List-help: <mailto:xen-ia64-devel-request@lists.xensource.com?subject=help>
List-id: Discussion of the ia64 port of Xen <xen-ia64-devel.lists.xensource.com>
List-post: <mailto:xen-ia64-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-ia64-devel>, <mailto:xen-ia64-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-ia64-devel>, <mailto:xen-ia64-devel-request@lists.xensource.com?subject=unsubscribe>
Organization: OSLO R&D
References: <571ACEFD467F7749BC50E0A98C17CDD802C06CE6@pdsmsx403>
Sender: xen-ia64-devel-bounces@xxxxxxxxxxxxxxxxxxx
On Wed, 2006-01-25 at 09:54 +0800, Tian, Kevin wrote:

>       I don't quite catch you in above sentence. What's the problematic
> value for r13 in your case? Ideally r13 is initialized to init_task in
> very early setup in head.S. Then later it's referred further as
> idle_vcpu[0]. It's harmless to clear switch stack and pt_regs area for
> idle vcpu0 at that point. So you may need to figure out where r13 is
> getting changed before that point.

Hi Kevin,

   I don't have the actual values right now, but if this doesn't make
sense I'll do a better job of documenting the exact values tomorrow.  As
an example, lets say r13 is 0x1000 and r12 is 0x2000.  The memset in
init_switch_stacks would be something like memset(0x1d00, 0, 0x400),
therefore clearing anything on the stack.  When we get back from the
memset, we pull a pointer off the stack (which is now zero) and page
fault storing to an offset from the zero'd pointer.  So it seems like
maybe the size of the structure used to setup r13 doesn't match what
we're using later.  Does that make more sense?  Thanks,


Xen-ia64-devel mailing list