Re: [Xen-devel] [BUG] Emulation issues

[Paul Durrant <Paul.Durrant@xxxxxxxxxx>]

> -----Original Message-----
> From: Roger Pau Monnà [mailto:roger.pau@xxxxxxxxxx]
> Sent: 30 July 2015 14:06
> To: Paul Durrant; xen-devel; Andrew Cooper
> Subject: Re: [BUG] Emulation issues
> 
> El 30/07/15 a les 12.59, Paul Durrant ha escrit:
> >> -----Original Message-----
> > [big snip]
> >> Sorry, missed that in the noise. So, the problem is that there is no 
> >> in-flight
> I/O
> >> even though pio completion is being attempted. Something has got out of
> >> sync.
> >>
> >
> > I think I understand what may be happening... The code in
> hvmemul_do_io() basically expects to be called either to issue an I/O or to
> extract info from a completed one. However it is being called unconditionally
> (in the PIO case) out of hvm_do_resume, rather than only if the in-flight I/O
> state has been updated to STATE_IORESP_READY.
> >
> > Can you try this patch (also containing my previous debug patch)?
> >
> > diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
> > index 30acb78..1bc3cc9 100644
> > --- a/xen/arch/x86/hvm/emulate.c
> > +++ b/xen/arch/x86/hvm/emulate.c
> > @@ -145,6 +145,8 @@ static int hvmemul_do_io(
> >              return X86EMUL_UNHANDLEABLE;
> >          goto finish_access;
> >      default:
> > +        gprintk(XENLOG_ERR, "weird emulation state %u\n",
> > +                vio->io_req.state);
> >          return X86EMUL_UNHANDLEABLE;
> >      }
> >
> > diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
> > index ec1d797..a476271 100644
> > --- a/xen/arch/x86/hvm/hvm.c
> > +++ b/xen/arch/x86/hvm/hvm.c
> > @@ -472,7 +472,6 @@ void hvm_do_resume(struct vcpu *v)
> >      struct hvm_vcpu_io *vio = &v->arch.hvm_vcpu.hvm_io;
> >      struct domain *d = v->domain;
> >      struct hvm_ioreq_server *s;
> > -    enum hvm_io_completion io_completion;
> >
> >      check_wakeup_from_wait();
> >
> > @@ -499,33 +498,38 @@ void hvm_do_resume(struct vcpu *v)
> >          }
> >      }
> >
> > -    io_completion = vio->io_completion;
> > -    vio->io_completion = HVMIO_no_completion;
> > -
> > -    switch ( io_completion )
> > -    {
> > -    case HVMIO_no_completion:
> > -        break;
> > -    case HVMIO_mmio_completion:
> > -        handle_mmio();
> > -        break;
> > -    case HVMIO_pio_completion:
> > -        (void)handle_pio(vio->io_req.addr, vio->io_req.size,
> > -                         vio->io_req.dir);
> > -        break;
> > -    case HVMIO_realmode_completion:
> > +    if ( vio->io_req.state == STATE_IORESP_READY )
> >      {
> > -        struct hvm_emulate_ctxt ctxt;
> > +        enum hvm_io_completion io_completion;
> >
> > -        hvm_emulate_prepare(&ctxt, guest_cpu_user_regs());
> > -        vmx_realmode_emulate_one(&ctxt);
> > -        hvm_emulate_writeback(&ctxt);
> > +        io_completion = vio->io_completion;
> > +        vio->io_completion = HVMIO_no_completion;
> >
> > -        break;
> > -    }
> > -    default:
> > -        ASSERT_UNREACHABLE();
> > -        break;
> > +        switch ( io_completion )
> > +        {
> > +        case HVMIO_no_completion:
> > +            break;
> > +        case HVMIO_mmio_completion:
> > +            handle_mmio();
> > +            break;
> > +        case HVMIO_pio_completion:
> > +            (void)handle_pio(vio->io_req.addr, vio->io_req.size,
> > +                             vio->io_req.dir);
> > +            break;
> > +        case HVMIO_realmode_completion:meet
> > +        {
> > +            struct hvm_emulate_ctxt ctxt;
> > +
> > +            hvm_emulate_prepare(&ctxt, guest_cpu_user_regs());
> > +            vmx_realmode_emulate_one(&ctxt);
> > +            hvm_emulate_writeback(&ctxt);
> > +
> > +            break;
> > +        }
> > +        default:
> > +            ASSERT_UNREACHABLE();
> > +            break;
> > +        }
> >      }
> >
> >      if ( unlikely(d->arch.event_write_data) )
> > @@ -2747,6 +2751,7 @@ int hvm_send_ioreq(struct hvm_ioreq_server *s,
> ioreq_t *proto_p,
> >          }
> >      }
> >
> > +    gprintk(XENLOG_ERR, "unable to contact device model\n");
> >      return X86EMUL_UNHANDLEABLE;
> >  }
> 
> With this (and only this) patch applied I get the following output:
> 
> (XEN) irq.c:276: Dom18 PCI link 2 changed 11 -> 0
> (XEN) irq.c:276: Dom18 PCI link 3 changed 5 -> 0
> (XEN) irq.c:276: Dom19 PCI link 0 changed 5 -> 0
> (XEN) irq.c:276: Dom19 PCI link 1 changed 10 -> 0
> (XEN) irq.c:276: Dom19 PCI link 2 changed 11 -> 0
> (XEN) irq.c:276: Dom19 PCI link 3 changed 5 -> 0
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> (XEN) d19v0 weird emulation state 1
> (XEN) io.c:165:d19v0 Weird HVM ioemulation status 1.
> (XEN) domain_crash called from io.c:166
> 

Hmm. Can't understand how that's happening... handle_pio() shouldn't be called 
unless the state is STATE_IORESP_READY and yet the inner function is hitting 
the default case in the switch.

  Paul

> Roger.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel