Re: [Xen-devel] Live migration with MMIO pages

[Kieran Mansley <kmansley@xxxxxxxxxxxxxx>]

On Wed, 2007-10-31 at 17:31 +0000, Tim Deegan wrote:
> Hmm.
> 
> The p2m_is_valid() check is OK because that always passes for PV guests.
> The check for mfn_valid() is failing because MMIO frames aren't "valid".
> 
> For HVM guests we let that pass if the GFN is known to be acceptable
> MMIO (by its p2m type).  There needs to be an equivalent get-out here
> for PV guests -- iomem_access_permitted(d, mfn_x(gmfn), mfn_x(gmfn))
> should do.
> 
> You'll need to add the same test in _sh_propagate(), where it checks again
> that the target MFN is sane:
> 
>     if ( !mfn_valid(target_mfn) && (p2mt != p2m_mmio_direct) )
>     {
>         ASSERT((ft == ft_prefetch));
>         *sp = shadow_l1e_empty();
>         goto done;
>     }

I'm a bit concerned about this one in _sh_propogate().  It seems it's
checking that the mfn is valid for a good reason, and so letting it
carry on in the case of MMIO frames will lead to a rather ungraceful
failure.  If I modify the above if to be:

    if ( !mfn_valid(target_mfn) && (p2mt != p2m_mmio_direct) 
         && !iomem_access_permitted(d, target_mfn, target_mfn))

so that PV iomem frames can continue rather than giving up at this
point, it gets a fatal page fault (see below).

I wonder if the comment above that if has the answer:

    /* N.B. For pass-through MMIO, either this test needs to be relaxed,
     * and shadow_set_l1e() trained to handle non-valid MFNs (ugh), or
the
     * MMIO areas need to be added to the frame-table to make them
"valid". */

i.e. relaxing the test is not sufficient.

(XEN) ----[ Xen-3.2-unstable  x86_32p  debug=n  Not tainted ]----
(XEN) CPU:    3
(XEN) EIP:    e008:[<ff179ed2>] l1e_propagate_from_guest+0x2e2/0x320
(XEN) EFLAGS: 00010246   CONTEXT: hypervisor
(XEN) eax: 00101000   ebx: 00000040   ecx: ff1a7080   edx: ff1a7080
(XEN) esi: 00000063   edi: 000d8fa0   ebp: ff1aa080   esp: ffbf7da0
(XEN) cr0: 8005003b   cr4: 000006f0   cr3: 001aaf40   cr2: fcb63e80
(XEN) ds: e010   es: e010   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from esp=ffbf7da0:
(XEN)    ff1a7c00 000d8fa0 000d8fa0 ff1a7080 00000000 00000000 ff1a7080
ff1a7080(XEN)    000d8fa0 137b4001 fe688260 ff17d0b4 000d8fa0 ffbf7ef8
00000001 00000001(XEN)    00000006 ff1a79dc 00dde090 fe7f3008 00000020
00000020 3eacc063 ff1be1e0(XEN)    ff1a7080 000160b3 0001379a 3e3fc063
00000002 ff1a79dc 00000000 fe7f3440(XEN)    00000020 00000003 160b3063
00000000 ffbf7ec0 fe688268 ff13b7e2 ff1aa080(XEN)    c1212080 ffbf7ec0
00000000 ff1a7080 ff1aafa0 ff1ae000 00000000 ff1be1e0(XEN)    00000004
ffbf7fb4 ff182b95 00000073 ffbf7e84 ffbf7e80 fe800034 00000005(XEN)
ff1ce900 ff1ce900 0000000f ff1ce900 00000005 ff115da7 ff1ce900 00000005
(XEN)    ff1ce900 ff1ce900 ff1aa0a4 ff1ce900 ff1c1104 000f5da7 0000000f
ff1c1104(XEN)    000f5da7 00000003 ff1aa0a4 ff1be100 d104955c ff1aaf78
fee09440 fee0d248(XEN)    160b3063 00000000 0003fa34 0003e8e7 0000000f
0000007b ffffffff ffffffff(XEN)    d8fa0073 00000000 160b3061 00000000
00000001 00000001 00000000 ff1aa080(XEN)    ff1a7080 ffbf7fb4 d104955c
ff13b7e2 ff1aa080 d104955c ffbf7fb4 00000001(XEN)    274038a1 68465ba4
00000084 00000000 ff1be1e0 ff10dec4 00000068 cfe89ff8(XEN)    00000000
cfe89ec0 c01186cf ff1c1024 cfe89e9c 00000020 ffbfcf0c ffbf7fb4(XEN)
ff1c1020 00000001 ff1aa080 0000007b 0000007b cfe89fb4 ff181f83 ff1aa080
(XEN)    0000007b 0000007b cfe89f04 ff182292 ffbf7fb4 cfe90bdc cfe89f0c
00e89f60(XEN)    d1049540 cfe90bc0 cfe89f04 cff80000 000e0000 c026724b
00000061 00010286(XEN)    cfe89ee4 00000069 0000007b 0000007b 00000000
00000000 00000003 ff1aa080(XEN) Xen call trace:
(XEN)    [<ff179ed2>] l1e_propagate_from_guest+0x2e2/0x320
(XEN)    [<ff1a7c00>] boot_edid_info+0x61/0x80
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff17d0b4>] sh_page_fault__shadow_3_guest_3+0x4b4/0xf80
(XEN)    [<ff1a79dc>] store_edid+0x5a/0x61
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff1a79dc>] store_edid+0x5a/0x61
(XEN)    [<ff13b7e2>] do_page_fault+0x122/0x630
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff1aafa0>] acpi_parse_memory_affinity+0x20/0x30
(XEN)    [<ff1ae000>] init_e820+0x80/0x6b0
(XEN)    [<ff182b95>] linearise_address+0x25/0x50
(XEN)    [<ff115da7>] add_entry+0x57/0x140
(XEN)    [<ff1aa0a4>] ns16550_init+0x114/0x2b0
(XEN)    [<ff1aa0a4>] ns16550_init+0x114/0x2b0
(XEN)    [<ff1aaf78>] acpi_table_print_srat_entry+0x28/0x30
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)    [<ff1a7080>] edd_check_ext+0x1b/0x1c
(XEN)    [<ff13b7e2>] do_page_fault+0x122/0x630
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)    [<ff10dec4>] do_multicall+0x124/0x350
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)    [<ff181f83>] tracing_off+0x7/0xe
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)    [<ff182292>] handle_exception+0x82/0xb6
(XEN)    [<ff1aa080>] ns16550_init+0xf0/0x2b0
(XEN)
(XEN) Pagetable walk from fcb63e80:
(XEN)  L3[0x003] = 00000000137b4001 55555555
(XEN)  L2[0x1e5] = 0000000000000000 ffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 3:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: fcb63e80
(XEN) ****************************************
(XEN)


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel