fix xen0 hang when start seconds vmx guest

PATCH In review Ling, Xiaofeng 1 participant 3 messages Nov 10, 2005

Share & tools

Ling, Xiaofeng

author

2005-11-10 06:39 UTC #0 lore raw

PATCH 1/1 fix xen0 hang when start seconds vmx guest

For vmx domain, because shadow_mode_reference is set later in
vmx_final_setup_guest, so in arch_set_info_guest, the phys_basetab
is not do get_page, while when destroying, put_page is called,
so there is one page, the count=-1, and when a new domain allocate
this page, it will take it as cpumask 0xffffffff, this cause flash_tlb_mask goes into dead loop.(How new bios/microcode can deal with it? maybe some differnet in sending IPI?)
The warning:
(XEN) Audit 1: type count went below zero mfn=1e03d t=f0000000 ot=3654b
is also caused by this, for vmx domain, the page is net get_type.

I think bug 128, 131, 351 are all caused by this issue.

xen/arch/x86/domain.c Thu Nov 10 14:05:11 2005 +0800 renamed from xen/arch/x86/domain.c Thu Nov 10 12:18:23 2005 +0800 +6 -1

diff -r 07070a351156 -r 833b086cc0e8 xen/arch/x86/domain.c
@@ -389,7 +389,12 @@
         if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
             return -EINVAL;
     }
-    else if ( !(c->flags & VGCF_VMX_GUEST) )
+    else if ( (c->flags & VGCF_VMX_GUEST) )
+    {
+        if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
+            return -EINVAL;
+    }
+    else
     {
         if ( !get_page_and_type(&frame_table[phys_basetab>>PAGE_SHIFT], d,
                                 PGT_base_page_table) )

Ling, Xiaofeng

author

2005-11-10 07:46 UTC #1 lore raw

Attach patch can satisfy the audit.
For vmx domain, we also call get_type.

Quoted 31 lines · Xiaofeng

For vmx domain, because shadow_mode_reference is set later in
vmx_final_setup_guest, so in arch_set_info_guest, the phys_basetab
is not do get_page, while when destroying, put_page is called,
so there is one page, the count=-1, and when a new domain allocate
this page, it will take it as cpumask 0xffffffff, this cause flash_tlb_mask goes into dead loop.(How new bios/microcode can deal with it? maybe some differnet in sending IPI?)
The warning:
(XEN) Audit 1: type count went below zero mfn=1e03d t=f0000000 ot=3654b
is also caused by this, for vmx domain, the page is net get_type.
I think bug 128, 131, 351 are all caused by this issue.
diff -r 07070a351156 -r 833b086cc0e8 xen/arch/x86/domain.c
xen/arch/x86/domain.c Thu Nov 10 14:05:11 2005 +0800 renamed from xen/arch/x86/domain.c Thu Nov 10 12:18:23 2005 +0800 +6 -1
@@ -389,7 +389,12 @@
         if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
             return -EINVAL;
     }
-    else if ( !(c->flags & VGCF_VMX_GUEST) )
+    else if ( (c->flags & VGCF_VMX_GUEST) )
+    {
+        if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
+            return -EINVAL;
+    }
+    else
     {
         if ( !get_page_and_type(&frame_table[phys_basetab>>PAGE_SHIFT], d,
                                 PGT_base_page_table) )

Quoted 4 lines

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

# HG changeset patch
# User Xiaofeng Ling <[email protected]>
# Node ID 833b086cc0e82af98fb5149cebfce08e5e65b4b1
# Parent 07070a3511560287314082abf5f3514d4bfdd0dd
For vmx domain, because shadow_mode_reference is set later in vmx_final_setup_guest, so in arch_set_info_guest, the phys_basetab is not do get_page, while when destroying, put_page is called, so there is one page, the count=-1, and when a new domain allocate this page, it will take it as cpumask 0xffffffff, this cause flash_tlb_mask goes into dead loop.
This patch also eliminate the warning when creating vmx guest:
(XEN) Audit 1: type count went below zero mfn=1e03d t=f0000000 ot=3654b

Signed-off-by Xiaofeng Ling <[email protected]>

xen/arch/x86/domain.c +2 -2

diff -r 07070a351156 xen/arch/x86/domain.c
@@ -389,7 +389,7 @@
         if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
             return -EINVAL;
     }
-    else if ( !(c->flags & VGCF_VMX_GUEST) )
+    else
     {
         if ( !get_page_and_type(&frame_table[phys_basetab>>PAGE_SHIFT], d,
                                 PGT_base_page_table) )

@@ -962,7 +962,7 @@
     {
         if ( (pfn = pagetable_get_pfn(v->arch.guest_table)) != 0 )
         {
-            if ( !shadow_mode_refcounts(d) )
+            if ( !shadow_mode_refcounts(d) || shadow_mode_external(d) )
                 put_page_type(pfn_to_page(pfn));
             put_page(pfn_to_page(pfn));

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

Ling, Xiaofeng

author

2005-11-10 09:54 UTC #2 lore raw

Please ignore the previous patch,
We got a better patch.(see attach)
1:1 page table doesn't need to assign
to v->arch.guest_table, there is no shadow page for it.

Quoted 74 lines · Xiaofeng

Attach patch can satisfy the audit.
For vmx domain, we also call get_type.
Quoted 32 lines · Xiaofeng
For vmx domain, because shadow_mode_reference is set later in
vmx_final_setup_guest, so in arch_set_info_guest, the phys_basetab
is not do get_page, while when destroying, put_page is called,
so there is one page, the count=-1, and when a new domain allocate
this page, it will take it as cpumask 0xffffffff, this cause flash_tlb_mask goes into dead loop.(How new bios/microcode can deal with it? maybe some differnet in sending IPI?)
The warning:
(XEN) Audit 1: type count went below zero mfn=1e03d t=f0000000 ot=3654b
is also caused by this, for vmx domain, the page is net get_type.
I think bug 128, 131, 351 are all caused by this issue.
diff -r 07070a351156 -r 833b086cc0e8 xen/arch/x86/domain.c
xen/arch/x86/domain.c Thu Nov 10 14:05:11 2005 +0800 renamed from xen/arch/x86/domain.c Thu Nov 10 12:18:23 2005 +0800 +6 -1
@@ -389,7 +389,12 @@
         if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
             return -EINVAL;
     }
-    else if ( !(c->flags & VGCF_VMX_GUEST) )
+    else if ( (c->flags & VGCF_VMX_GUEST) )
+    {
+        if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
+            return -EINVAL;
+    }
+    else
     {
         if ( 
 !get_page_and_type(&frame_table[phys_basetab>>PAGE_SHIFT], d,
PGT_base_page_table) )
Quoted 4 lines
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel
------------------------------------------------------------------------
# HG changeset patch
# User Xiaofeng Ling <[email protected]>
# Node ID 833b086cc0e82af98fb5149cebfce08e5e65b4b1
# Parent 07070a3511560287314082abf5f3514d4bfdd0dd
For vmx domain, because shadow_mode_reference is set later in vmx_final_setup_guest, so in arch_set_info_guest, the phys_basetab is not do get_page, while when destroying, put_page is called, so there is one page, the count=-1, and when a new domain allocate this page, it will take it as cpumask 0xffffffff, this cause flash_tlb_mask goes into dead loop.
This patch also eliminate the warning when creating vmx guest:
(XEN) Audit 1: type count went below zero mfn=1e03d t=f0000000 ot=3654b
Signed-off-by Xiaofeng Ling <[email protected]>
diff -r 07070a351156 xen/arch/x86/domain.c
xen/arch/x86/domain.c +1 -1
@@ -389,7 +389,7 @@
         if ( !get_page(&frame_table[phys_basetab>>PAGE_SHIFT], d) )
             return -EINVAL;
     }
-    else if ( !(c->flags & VGCF_VMX_GUEST) )
+    else
     {
         if ( !get_page_and_type(&frame_table[phys_basetab>>PAGE_SHIFT], d,
                                 PGT_base_page_table) )

xen/arch/x86/domain.c line 968

Quoted 8 lines

xen/arch/x86/domain.c +1 -1

@@ -962,7 +962,7 @@
     {
         if ( (pfn = pagetable_get_pfn(v->arch.guest_table)) != 0 )
         {
-            if ( !shadow_mode_refcounts(d) )
+            if ( !shadow_mode_refcounts(d) || shadow_mode_external(d) )
                 put_page_type(pfn_to_page(pfn));
             put_page(pfn_to_page(pfn));

Signed-off-by Xiaofeng Ling <[email protected]>

Signed-off-by Xin Li <[email protected]>

xen/arch/x86/domain.c +1 -0

diff -r 07070a351156 xen/arch/x86/domain.c
@@ -407,6 +407,7 @@
         /* VMX uses the initially provided page tables as the P2M map. */
         if ( !pagetable_get_paddr(d->arch.phys_table) )
             d->arch.phys_table = v->arch.guest_table;
+        v->arch.guest_table = mk_pagetable(0);
 
         /* Initialize monitor page table */
         v->arch.monitor_table = mk_pagetable(0);

xen/arch/x86/vmx.c +0 -0

diff -r 07070a351156 xen/arch/x86/vmx.c

xen/arch/x86/vmx_vmcs.c +1 -1

diff -r 07070a351156 xen/arch/x86/vmx_vmcs.c
@@ -332,7 +332,7 @@
     error |= __vmwrite(GUEST_TR_BASE, 0);
     error |= __vmwrite(GUEST_TR_LIMIT, 0xff);
 
-    __vmwrite(GUEST_CR3, pagetable_get_paddr(v->arch.guest_table));
+    __vmwrite(GUEST_CR3, pagetable_get_paddr(v->domain->arch.phys_table));
     __vmwrite(HOST_CR3, pagetable_get_paddr(v->arch.monitor_table));
     __vmwrite(HOST_RSP, (unsigned long)get_stack_bottom());

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel