[Xen-devel] device-mmio emulation in Xen

[Abhinav Srivastava <abhinavs_iitkgp@xxxxxxxxxxx>]

Hi there,

I am trying to understand how does Xen handle device MMIO. More specifically, I 
am looking at the network behavior, however my understanding is that other 
devices such as disk will use the same logic.

I noticed that during a network copy operation Xen page faults a lot and 
control goes to sh_page_fault function. When I printed some debugging info, it 
showed me gmfn = -1. Then the execution goes through the regular path of the 
page fault handler code, which means it creates an entry using 
shadow_get_and_create_l1e, propagates it using l1e_propagate_from_guest, and 
finally updates the entry using shadow_set_l1e. It finally goes into the 
device-model mmio condition. In this condition, it extracts a guest physical 
address and calls "goto mmio", which in turn calls handle_mmio function that 
emulates the instruction.

However with the gmfn = -1 condition, the execution sometimes directly goto
to handle_mmio function using the fast_fault_path with going through the 
regular path. It seems like there are two possible execution paths, and I did 
not understand which one is chosen when?

I have some questions related to this behavior:

1. Why are there so many faults duing network copy operation?

2. What does gmfn = -1 signify? Is it reserved for mmio addresses?

3. How does Xen handle this gmfn = -1? It seems like on the regular path
it still creates, propagates, and updates entries for gmfn = -1. How does Xen 
handles this at the shadow page table level?

4. What are these two code execution paths, and when does Xen decide which
path to choose?

5. Finally, is there anyway these faults can be reduced?

I would very appreciate any help in this regard.

Thanks,
Abhinav



      The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. 
http://in.yahoo.com/

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel