Xen devel - Feb 2009 - transferring ownership of domheap pages

I''d like to have routines to transfer ownership
of a page both from domain D1 to anonymous and
from anonymous to domain D2, without the necessity
of doing a free_domheap_pages followed by an
alloc_domheap_pages (primarily because I don''t
want to scrub the page as I know it will be
immediately overwritten by the new owner).
The anon-to-D2 would fail (return NULL) if
D2 is fully allocated.

Any problems to watch out for?

Thanks,
Dan

P.S. Only has to work on 64-bit Xen if that matters.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

>From: Dan Magenheimer
>Sent: Friday, February 13, 2009 8:59 AM
>
>I''d like to have routines to transfer ownership
>of a page both from domain D1 to anonymous and
>from anonymous to domain D2, without the necessity
>of doing a free_domheap_pages followed by an
>alloc_domheap_pages (primarily because I don''t
>want to scrub the page as I know it will be
>immediately overwritten by the new owner).
>The anon-to-D2 would fail (return NULL) if
>D2 is fully allocated.
>
>Any problems to watch out for?
>
>Thanks,
>Dan
>
It''s doable. I guess gnttab_transfer could be referenced
similar to your purpose, but I didn''t look into detail. :-)

Thanks,
Kevin
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Here''s a first cut.  Works only from anon to non-anon
or non-anon to anon (not non-anon1 to non-anon2).
> -----Original Message-----
> From: Dan Magenheimer 
> Sent: Thursday, February 12, 2009 5:59 PM
> To: Xen-Devel (E-mail)
> Subject: transferring ownership of domheap pages
> 
> 
> I''d like to have routines to transfer ownership
> of a page both from domain D1 to anonymous and
> from anonymous to domain D2, without the necessity
> of doing a free_domheap_pages followed by an
> alloc_domheap_pages (primarily because I don''t
> want to scrub the page as I know it will be
> immediately overwritten by the new owner).
> The anon-to-D2 would fail (return NULL) if
> D2 is fully allocated.
> 
> Any problems to watch out for?
> 
> Thanks,
> Dan
> 
> P.S. Only has to work on 64-bit Xen if that matters.
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On 13/02/2009 00:59, "Dan Magenheimer"
<dan.magenheimer@oracle.com> wrote:
> I''d like to have routines to transfer ownership
> of a page both from domain D1 to anonymous and
> from anonymous to domain D2, without the necessity
> of doing a free_domheap_pages followed by an
> alloc_domheap_pages (primarily because I don''t
> want to scrub the page as I know it will be
> immediately overwritten by the new owner).
> The anon-to-D2 would fail (return NULL) if
> D2 is fully allocated.
> 
> Any problems to watch out for?
See (and use) mm.c:steal_page(). Only works of course if D1 has no mappings
of the page.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Yeah, that''s pretty... optimistic. ;-) Use steal_page() plus whatever
bits
of gnttab_transfer() you think you might need. If you can cleanly abstract
that into a common function all the better, but you probably won''t need
much
code in addition to steal_page() anyway.

 -- Keir

On 13/02/2009 03:37, "Dan Magenheimer"
<dan.magenheimer@oracle.com> wrote:
> Here''s a first cut.  Works only from anon to non-anon
> or non-anon to anon (not non-anon1 to non-anon2).
> 
>> -----Original Message-----
>> From: Dan Magenheimer
>> Sent: Thursday, February 12, 2009 5:59 PM
>> To: Xen-Devel (E-mail)
>> Subject: transferring ownership of domheap pages
>> 
>> 
>> I''d like to have routines to transfer ownership
>> of a page both from domain D1 to anonymous and
>> from anonymous to domain D2, without the necessity
>> of doing a free_domheap_pages followed by an
>> alloc_domheap_pages (primarily because I don''t
>> want to scrub the page as I know it will be
>> immediately overwritten by the new owner).
>> The anon-to-D2 would fail (return NULL) if
>> D2 is fully allocated.
>> 
>> Any problems to watch out for?
>> 
>> Thanks,
>> Dan
>> 
>> P.S. Only has to work on 64-bit Xen if that matters.
>> 


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Hmm... it looks like steal_page() only works one way,
from owned-by-d to anonymous, true?  I need the
other direction as well.  Other than that, the
only difference I see is that page->count_info
is being cleared/set in a cmpxchg loop; I assume
this is because multiple domains might be contending
to use/unuse the page?  I wonder if I need that
given that in my case the page is never addressed by
any domain, just used inside the hypervisor, and
the owned-by-d is mostly for accounting purposes.
> Yeah, that''s pretty... optimistic. ;-) 
What else do you see that is missing in my first cut?
Do you see any other code there that''s just wrong?

Thanks,
Dan
> -----Original Message-----
> From: Keir Fraser [mailto:keir.fraser@eu.citrix.com]
> Sent: Friday, February 13, 2009 1:54 AM
> To: Dan Magenheimer; Xen-Devel (E-mail)
> Subject: Re: [Xen-devel] RE: transferring ownership of domheap pages
> 
> 
> Yeah, that''s pretty... optimistic. ;-) Use steal_page() plus 
> whatever bits
> of gnttab_transfer() you think you might need. If you can 
> cleanly abstract
> that into a common function all the better, but you probably 
> won''t need much
> code in addition to steal_page() anyway.
> 
>  -- Keir
> 
> On 13/02/2009 03:37, "Dan Magenheimer" 
> <dan.magenheimer@oracle.com> wrote:
> 
> > Here''s a first cut.  Works only from anon to non-anon
> > or non-anon to anon (not non-anon1 to non-anon2).
> > 
> >> -----Original Message-----
> >> From: Dan Magenheimer
> >> Sent: Thursday, February 12, 2009 5:59 PM
> >> To: Xen-Devel (E-mail)
> >> Subject: transferring ownership of domheap pages
> >> 
> >> 
> >> I''d like to have routines to transfer ownership
> >> of a page both from domain D1 to anonymous and
> >> from anonymous to domain D2, without the necessity
> >> of doing a free_domheap_pages followed by an
> >> alloc_domheap_pages (primarily because I don''t
> >> want to scrub the page as I know it will be
> >> immediately overwritten by the new owner).
> >> The anon-to-D2 would fail (return NULL) if
> >> D2 is fully allocated.
> >> 
> >> Any problems to watch out for?
> >> 
> >> Thanks,
> >> Dan
> >> 
> >> P.S. Only has to work on 64-bit Xen if that matters.
> >> 
> 
> 
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On 13/02/2009 15:14, "Dan Magenheimer"
<dan.magenheimer@oracle.com> wrote:
>> Yeah, that''s pretty... optimistic. ;-)
> 
> What else do you see that is missing in my first cut?
> Do you see any other code there that''s just wrong?
You can''t just assert that count_info == PGC_allocated|1, for example.
You
need to be careful that mappings aren''t created or destroyed while you
are
changing the ownership. Steal_page() does that. Once a page is anonymous,
transferring it to a domain is easier, since mappings can''t be
created/destroyed while it is anonymous. So steal_page() just does the hard
transition for you (non-anon -> anon). A benefit of using steal_page() is
that we will maintain that for other callers -- a private implementation in
tmem risks getting subtly unsafely broken every now and then.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

> A benefit of using steal_page() is
> that we will maintain that for other callers
OK, I''ll use steal_page(), though I think it is
overkill as the pages I am dealing with are not
addressable outside of the hypervisor, so there
aren''t any mappings being created and destroyed.

I still need code for the other direction though:
I have an anonymous page (on my own private "free"
page_list) and I want it to be owned by a domain,
but I don''t want to free it and then alloc it
(because I might not get the same page back).

Does the attached patch look good?  Are there
any races that I am missing?  Is the name
("donate_page" opposite of "steal_page") OK?

Thanks,
Dan

> -----Original Message-----
> From: Keir Fraser [mailto:keir.fraser@eu.citrix.com]
> Sent: Friday, February 13, 2009 8:23 AM
> To: Dan Magenheimer; Xen-Devel (E-mail)
> Subject: Re: [Xen-devel] RE: transferring ownership of domheap pages
> 
> 
> On 13/02/2009 15:14, "Dan Magenheimer" 
> <dan.magenheimer@oracle.com> wrote:
> 
> >> Yeah, that''s pretty... optimistic. ;-)
> > 
> > What else do you see that is missing in my first cut?
> > Do you see any other code there that''s just wrong?
> 
> You can''t just assert that count_info == PGC_allocated|1, for 
> example. You
> need to be careful that mappings aren''t created or destroyed 
> while you are
> changing the ownership. Steal_page() does that. Once a page 
> is anonymous,
> transferring it to a domain is easier, since mappings can''t be
> created/destroyed while it is anonymous. So steal_page() just 
> does the hard
> transition for you (non-anon -> anon). A benefit of using 
> steal_page() is
> that we will maintain that for other callers -- a private 
> implementation in
> tmem risks getting subtly unsafely broken every now and then.
> 
>  -- Keir
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On 13/02/2009 17:02, "Dan Magenheimer"
<dan.magenheimer@oracle.com> wrote:
>> A benefit of using steal_page() is
>> that we will maintain that for other callers
> 
> OK, I''ll use steal_page(), though I think it is
> overkill as the pages I am dealing with are not
> addressable outside of the hypervisor, so there
> aren''t any mappings being created and destroyed.
If you''re sure of that then indeed you don''t need
steal_page(). But usually
you could not be sure of that if the page owner is non-NULL -- the whole
point of that is to allow the owner to make mappings as it likes. If
you''ve
got extra mechanism to ensure your extra restrictions hold then you will
know better than me whether your previous patch is correct or not.
> I still need code for the other direction though:
> I have an anonymous page (on my own private "free"
> page_list) and I want it to be owned by a domain,
> but I don''t want to free it and then alloc it
> (because I might not get the same page back).
> 
> Does the attached patch look good?  Are there
> any races that I am missing?  Is the name
> ("donate_page" opposite of "steal_page") OK?
Roughly. You do need to check d->is_dying so you don''t race domain
destruction. Look at share_xen_page_with_guest() -- your function is sort of
a subset of that.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel