Re: [PATCH] Xen 4.4-rc3 regression with PVH compared to Xen 4.4-rc2.

[Mukesh Rathor <mukesh.rathor@oracle.com>]

On Mon, 3 Feb 2014 11:26:05 -0800
Mukesh Rathor <mukesh.rathor@oracle.com> wrote:

> On Mon,  3 Feb 2014 12:03:20 -0500
> Konrad Rzeszutek Wilk <konrad@kernel.org> wrote:
> 
> > I am hereby requesting an Xen 4.4 exemption for this bug-fix.
> > 
> > The PVH feature is considered experimental, but it would be good to
> > have it working out of the box without crashing the hypervisor.
> > 
> > Sadly that is not the case as
> > 09bb434748af9bfe3f7fca4b6eef721a7d5042a4 "Nested VMX: prohibit
> > virtual vmentry/vmexit during IO emulation" casues an NULL pointer
> > dereference when starting a guest with 'pvh=1' in the guest config.
> > 
> > There are two ways of fixing this:
> > a). Add an '!xen_pvh_domain()' or '!xen_pvh_vcpu(current)' in the
> > path, or b). Check for ioreq() being NULL. This is actually done in
> > other places in the hypervisor - so I choose to piggyback on that.
> > 
> 
> I was about to send this patch on friday:
> 
> diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
> index d2ba435..563b02f 100644
> --- a/xen/arch/x86/hvm/vmx/vvmx.c
> +++ b/xen/arch/x86/hvm/vmx/vvmx.c
> @@ -1394,13 +1394,14 @@ void nvmx_switch_guest(void)
>      struct vcpu *v = current;
>      struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
>      struct cpu_user_regs *regs = guest_cpu_user_regs();
> +    ioreq_t *ioreq = get_ioreq(v);
>  
>      /*
>       * a pending IO emualtion may still no finished. In this case,
>       * no virtual vmswith is allowed. Or else, the following IO
>       * emulation will handled in a wrong VCPU context.
>       */
> -    if ( get_ioreq(v)->state != STATE_IOREQ_NONE )
> +    if ( ioreq && ioreq->state != STATE_IOREQ_NONE )
>          return;
>      /*
>       * a softirq may interrupt us between a virtual vmentry is
> 
> 
> 
> when I realized even after the above fix it is still crashing  for
> me... debugging right now. JFYI.

Ok, the crash in nvmx_switch_guest() even after the above fix is a 
different issue for which I am making a patch. So, this patch should
be applied, however, rather than calling get_ioreq() twice as in 
Konrad's patch, I recommend my code above which calls it once. It's 
inlined now, and prob would be optimized, but the function could
change in many ways in future.

thanks
mukesh