There seems to be some sort of a bug when qemu interacts with the balloon driver. Stefano is trying to repro it, but I thought I''d share it for people to look at. Host: + Debian 4.0 host installation + Vanilla -unstable xen dom0 kernel, hypervisor, and qemu-dm (all pulled this morning) + 4G of ram VM: + Debian 4.0 Linux HVM, 2.6.18-6-i686 package + unmodified_drivers/ modules compiled for xen-platform-pci, and xen-balloon + 512M of RAM assigned + Disk and network are still emulated, using qemu To repro: * Boot the VM * modprobe xen_balloon * In one VM shell: # while true ; do rm -f zero ; dd if=/dev/zero of=zero ; done * In another VM shell, use ''free'' to see when the amount of free memory is near zero * In dom0: # xm mem-set debian-hvm 256 * In the VM shell, use ''free'' to see when the amount of total memory reaches 256 (this may take awhile, as the guest OS has to write data out to disk.) * In dom0: # xm mem-set debian-hvm 512 qemu will crash shortly. When I install xen-vbd in the initrd, the problem goes away. So it seems almost certain that there''s some mapping in qemu not getting flushed when the balloon driver hands pages back to Xen, so that when it asks Xen for pages again, and then tries to DMA into the same gpfn space, something gets lost in the translation. Any ideas? Peace, -George _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Stefano Stabellini
2008-Dec-15 11:51 UTC
[Xen-devel] [PATCH] Linux-HVM, qemu, and xen-balloon.ko
George Dunlap wrote:> There seems to be some sort of a bug when qemu interacts with the > balloon driver. Stefano is trying to repro it, but I thought I''d > share it for people to look at.There is a bug in qemu_map_cache: if address_index == last_address_index we don''t check that there is a valid_mapping for address_offset in the bucket. The following patch fixes it. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> --- diff -r 0ea6bd53cfb6 hw/xen_machine_fv.c --- a/hw/xen_machine_fv.c Thu Oct 23 10:26:02 2008 +0100 +++ b/hw/xen_machine_fv.c Mon Dec 15 11:43:52 2008 +0000 @@ -135,10 +135,11 @@ unsigned long address_index = phys_addr >> MCACHE_BUCKET_SHIFT; unsigned long address_offset = phys_addr & (MCACHE_BUCKET_SIZE-1); - if (address_index == last_address_index) + entry = &mapcache_entry[address_index % nr_buckets]; + + if (address_index == last_address_index && + test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) return last_address_vaddr + address_offset; - - entry = &mapcache_entry[address_index % nr_buckets]; if (entry->vaddr_base == NULL || entry->paddr_index != address_index || !test_bit(address_offset>>XC_PAGE_SHIFT, entry->valid_mapping)) _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel