Re: port-xen/47057: Xen NetBSD DomU file system trash under Linux Dom0

[Roger Pau Monné <roger.pau%citrix.com@localhost>]

On 20/10/12 18:42, Manuel Bouyer wrote:
> So both cons and prod would be corrupted. As the domU is supposed to update
> rsp_cons only, I guess we're looking for something that is writing to
> random memory.
> 
> Maybe the atached patch will help; anything trying to write to the page
> outside of xb_read and xb_write should get a page fault.

I'm sorry to say that the patch didn't seem to help, here is another
output with your patch applied. It seems like prod and cons gets
overwritten with random data.

xenbus_xs (process_msg:763) xb_read hdr 0.
xb_read: cons: 3521 prod: 3523
Finished read of 2 bytes (0 to go)
xenbus_xs (process_msg:776) xb_read body 0.
xenbus_xs (process_msg:811) process_msg: type 6 body 4.
xenbus_xs (read_reply:134) read_reply: type 6 body 4.
xenbus_xs (xs_talkv:224) read done.
xenbus_xs (xs_talkv:202) write msg.
xenbus_xs (xs_talkv:204) write msg err 0.
xenbus_xs (xs_talkv:212) write iovect.
xenbus_xs (xs_talkv:214) write iovect err 0.
xenbus_xs (xs_talkv:222) read.
xb_read: cons: 3523 prod: 3546
Finished read of 16 bytes (0 to go)
xenbus_xs (process_msg:763) xb_read hdr 0.
xb_read: cons: 3539 prod: 3546
Finished read of 7 bytes (0 to go)
xenbus_xs (process_msg:776) xb_read body 0.
xenbus_xs (process_msg:811) process_msg: type 16 body ENOENT.
xenbus_xs (read_reply:134) read_reply: type 16 body ENOENT.
xenbus_xs (xs_talkv:224) read done.
xenbus_xs (xs_talkv:202) write msg.
xenbus_xs (xs_talkv:204) write msg err 0.
xenbus_xs (xs_talkv:212) write iovect.
xenbus_xs (xs_talkv:214) write iovect err 0.
xenbus_xs (xs_talkv:222) read.
xb_read: cons: 3546 prod: 3565
Finished read of 16 bytes (0 to go)
xenbus_xs (process_msg:763) xb_read hdr 0.
xb_read: cons: 3562 prod: 3565
Finished read of 3 bytes (0 to go)
xenbus_xs (process_msg:776) xb_read body 0.
xenbus_xs (process_msg:811) process_msg: type 7 body OK.
xenbus_xs (read_reply:134) read_reply: type 7 body OK.
xenbus_xs (xs_talkv:224) read done.
boot device: xbd0
root on xbd0a dumps on xbd0b
Your machine does not initialize mem_clusters; sparse_dumps disabled
/: replaying log to memory
root file system type: ffs
Sat Oct 20 17:01:27 UTC 2012
Starting root file system check:
/dev/rxbd0a: file system is journaled; not checking
/: replaying log to disk
swapctl: setting dump device to /dev/xbd0b
swapctl: adding /dev/xbd0b as swap device at priority 0
Starting file system checks:
Setting tty flags.
Setting sysctl variables:
ddb.onpanic: 1 -> 1
Starting network.
/etc/rc: WARNING: $hostname not set.
IPv6 mode: host
Configuring network interfaces: xennet0.
Adding interface aliases:.
Building databases: dev, utmp, utmpx.
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
Starting syslogd.
Mounting all filesystems...
Clearing temporary files.
Checking quotas: done.
swapctl: setting dump device to /dev/xbd0b
Starting virecover.
Checking for core dump...
savecore: no core dump
Starting local daemons:.
Updating motd.
Starting powerd.
Starting sshd.
postfix: rebuilding /etc/mail/aliases (missing /etc/mail/aliases.db)
newaliases: warning: valid_hostname: empty hostname
newaliases: fatal: unable to use my own hostname
/etc/rc.d/postfix exited with code 1
Oct 20 17:01:46  postfix/sendmail[494]: fatal: unable to use my own hostname
Starting inetd.
Starting cron.
The following components reported failures:
    /etc/rc.d/postfix
See /var/run/rc.log for more information.
Sat Oct 20 17:01:46 UTC 2012
Oct 20 17:01:48  getty[589]: /dev/ttyE2: Device not configured
Oct 20 17:01:48  getty[569]: /dev/ttyE3: Device not configured
Oct 20 17:01:48  getty[501]: /dev/ttyE1: Device not configured

NetBSD/amd64 (Amnesiac) (console)

login: root
Password:
Oct 20 17:02:51  login: ROOT LOGIN (root) on tty console
Last login: Sat Oct 20 16:06:11 2012 on console
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 6.99.14 (XEN3_DOMU) #2: Sat Oct 20 18:50:37 CEST 2012

Welcome to NetBSD!

Terminal type is vt100.
We recommend that you create a non-root account and use su(1) for root
access.
# cd src
# while [ 1 ]; do
> ./build.sh -j3 -m amd64 -O ../obj -T ../tools build >log
> done
xb_read: cons: 706764616 prod: 2607
xb_read EIO
xenbus_xs (process_msg:763) xb_read hdr 5.
panic: XENBUS error 5 while reading message

fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8012e655 cs e030 rflags 246 cr2
7f7ff780c390 ilevel 0 rsp ffffa0002e4c5b30
curlwp 0xffffa00002367980 pid 0 lid 32 lowest kstack 0xffffa0002e4c2000
Stopped in pid 0.32 (system) at netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x1f2
printf_nolog() at netbsd:printf_nolog
xenbus_thread() at netbsd:xenbus_thread+0x140
ds          7980
es          5b70
fs          100
gs          b880
rdi         0
rsi         d
rbp         ffffa0002e4c5b30
rbx         104
rdx         0
rcx         8
rax         1
r8          ffffffff8063d600    cpu_info_primary
r9          1
r10         0
r11         ffffa0000238c000
r12         ffffffff804adee8    copyright+0x3bae8
r13         ffffa0002e4c5b70
r14         ffffa00002367980
r15         c2c2c2c2c2c2c2c2
rip         ffffffff8012e655    breakpoint+0x5
cs          e030
rflags      246
rsp         ffffa0002e4c5b30
ss          e02b
netbsd:breakpoint+0x5:  leave
db{0}>