Errors on MMIO read access on VM suspend / resume operations

Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

Hi!

   I am currently doing some long-term testing of a device model using 
memory mapped IO (TPM TIS) and am seeing some strange errors when the 
suspend occurs in the middle of a read operation in the Linux TPM TIS 
device driver where the driver reads the result packet from the mmio 
location.

  Short background: The TPM response packet is read in 2 chunks. First 
the first 10 bytes are read containing the response's header. 
Subsequently the rest of the packet is read using knowledge of the total 
size of the response packet from the header (bytes 2-5 in big endian 
format). The corresponding code reading the data from the hardware 
interface is here:


http://lxr.linux.no/#linux+v2.6.37/drivers/char/tpm/tpm_tis.c#L228


The test I am running is setup as follows:

- inside the VM keys are permanently generated by sending commands to 
the TPM; packets read from the interface are dumped to the screen

- on the host a script suspends the VM every 6 seconds and resumes it 
immediately afterwards (using libvirt)


As it happens, sometimes the VM is suspended in the middle of a read 
operation on the TPM TIS interface -- see above code reference. I see 
that because I do dump the state of the TPM TIS when suspending and see 
that the read offset is pointing to a location somewhere in the middle 
of the packet - so the TPM TIS Linux driver is in the above loop 
currently reading the data. I am observing two types of results if this 
happens:


- either the result read by the Linux TPM TIS driver is ok, so no 
problem here

- or the problematic case where the TPM TIS driver reads a packet with a 
byte missing and then at the end gets a zero byte from the TPM TIS 
interface indicating that it read beyond the available data. If the 
suspend happened while reading the first chunk of data (header), the TPM 
TIS driver will also complain that the available data for the 2nd  chunk 
(burst size) is less than what's expected  -- it's an off-by-one error


So, I then modified the TPM TIS device model to decrement the read 
offset pointer by '1' in case it was detected that the suspend happened 
in the middle of the read operation -- in Qemu I do this in the 
post-load 'method'. This then leads to the following types of results:


- the problematic(!) case where the read packet was ok

- the expected case where the TPM TIS driver reads the packet and ends 
up having two same bytes in the result in consecutive array locations; 
besides that the TPM TIS driver will in this case complain that it has 
left-over data


So my conclusion from the above tests are:

- for some reason the memory read to the MMIO location happens as the 
last instruction executed on suspend and again as the very first on 
executed on resume. This explains to me that the TPM TIS model internal 
pointer into the packet was advanced by '1' (the packet is read by 
subsequently reading from the same memory location) and the above 
problematic cases make sense

- the other instruction in the Linux TPM TIS drivers that for example 
advance the buffer location do not execute twice, i.e., size++ in the 
buf[size++] = ... in the Linux driver.


What puzzles me is that the read operation may be run twice but others 
don't.


If you have insights as why the above may be occurring, please let me 
know. A simple solution to work around this may be to introduce a 
register holding the index into the result packet where to read the next 
byte from (rather than advancing an internal pointer to the next byte), 
though this would deviate the driver from the standard interface the 
model currently implements.


   Regards,

      Stefan

Re: Errors on MMIO read access on VM suspend / resume operations

[Avi Kivity]

On 01/11/2011 06:19 PM, Stefan Berger wrote:
> Hi!
>
>   I am currently doing some long-term testing of a device model using 
> memory mapped IO (TPM TIS) and am seeing some strange errors when the 
> suspend occurs in the middle of a read operation in the Linux TPM TIS 
> device driver where the driver reads the result packet from the mmio 
> location.
>
>  Short background: The TPM response packet is read in 2 chunks. First 
> the first 10 bytes are read containing the response's header. 
> Subsequently the rest of the packet is read using knowledge of the 
> total size of the response packet from the header (bytes 2-5 in big 
> endian format). The corresponding code reading the data from the 
> hardware interface is here:
>
>
> http://lxr.linux.no/#linux+v2.6.37/drivers/char/tpm/tpm_tis.c#L228
>
>
> The test I am running is setup as follows:
>
> - inside the VM keys are permanently generated by sending commands to 
> the TPM; packets read from the interface are dumped to the screen
>
> - on the host a script suspends the VM every 6 seconds and resumes it 
> immediately afterwards (using libvirt)
>
>
> As it happens, sometimes the VM is suspended in the middle of a read 
> operation on the TPM TIS interface -- see above code reference. I see 
> that because I do dump the state of the TPM TIS when suspending and 
> see that the read offset is pointing to a location somewhere in the 
> middle of the packet - so the TPM TIS Linux driver is in the above 
> loop currently reading the data. I am observing two types of results 
> if this happens:
>
>
> - either the result read by the Linux TPM TIS driver is ok, so no 
> problem here
>
> - or the problematic case where the TPM TIS driver reads a packet with 
> a byte missing and then at the end gets a zero byte from the TPM TIS 
> interface indicating that it read beyond the available data. If the 
> suspend happened while reading the first chunk of data (header), the 
> TPM TIS driver will also complain that the available data for the 2nd  
> chunk (burst size) is less than what's expected  -- it's an off-by-one 
> error
>
>
> So, I then modified the TPM TIS device model to decrement the read 
> offset pointer by '1' in case it was detected that the suspend 
> happened in the middle of the read operation -- in Qemu I do this in 
> the post-load 'method'. This then leads to the following types of 
> results:
>
>
> - the problematic(!) case where the read packet was ok
>
> - the expected case where the TPM TIS driver reads the packet and ends 
> up having two same bytes in the result in consecutive array locations; 
> besides that the TPM TIS driver will in this case complain that it has 
> left-over data
>
>
> So my conclusion from the above tests are:
>
> - for some reason the memory read to the MMIO location happens as the 
> last instruction executed on suspend and again as the very first on 
> executed on resume. This explains to me that the TPM TIS model 
> internal pointer into the packet was advanced by '1' (the packet is 
> read by subsequently reading from the same memory location) and the 
> above problematic cases make sense


Most likely this is qemu-kvm failing to obey this snippet from 
Documentation/kvm/api.txt:

> NOTE: For KVM_EXIT_IO, KVM_EXIT_MMIO and KVM_EXIT_OSI, the corresponding
> operations are complete (and guest state is consistent) only after 
> userspace
> has re-entered the kernel with KVM_RUN.  The kernel side will first finish
> incomplete operations and then check for pending signals.  Userspace
> can re-enter the guest with an unmasked signal pending to complete
> pending operations.


However, the code appears to be correct.  kvm_run() calls handle_mmio(), 
which returns 0.  The following bit

     if (!r) {
         goto again;
     }

at the end of kvm_run() makes it enter the kernel again (delivering a 
signal to itself in case we want to stop).

>
> - the other instruction in the Linux TPM TIS drivers that for example 
> advance the buffer location do not execute twice, i.e., size++ in the 
> buf[size++] = ... in the Linux driver.
>
>
> What puzzles me is that the read operation may be run twice but others 
> don't.
>

Reads have split execution: kvm emulates the mmio instruction, notices 
that it cannot satisfy the read request, exits to qemu, then restarts 
the instruction.  If the last step is omitted due to savevm, then kvm 
will exit back to qemu again and your device will see the read duplicated.

> If you have insights as why the above may be occurring, please let me 
> know. A simple solution to work around this may be to introduce a 
> register holding the index into the result packet where to read the 
> next byte from (rather than advancing an internal pointer to the next 
> byte), though this would deviate the driver from the standard 
> interface the model currently implements.

Most undesirable, I'd like to fix the bug.

Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to verify 
this?

Good pattern:

   ioctl(KVM_RUN)
   -> KVM_EXIT_MMIO
   ioctl(KVM_RUN)
   -> ENTR
   no further KVM_RUNs

or

    ioctl(KVM_RUN)
    -> something other than KVM_EXIT_MMIO
    no further KVM_RUNs

Bad pattern:

    ioctl(KVM_RUN)
    -> KVM_EXIT_MMIO
    no further KVM_RUNs

(in the save portion of your test)

-- 
error compiling committee.c: too many arguments to function

Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/13/2011 05:22 AM, Avi Kivity wrote:
> On 01/11/2011 06:19 PM, Stefan Berger wrote:
>>
>> What puzzles me is that the read operation may be run twice but 
>> others don't.
>>
>
> Reads have split execution: kvm emulates the mmio instruction, notices 
> that it cannot satisfy the read request, exits to qemu, then restarts 
> the instruction.  If the last step is omitted due to savevm, then kvm 
> will exit back to qemu again and your device will see the read 
> duplicated.

That would then explain it on the read-side. MMIO writes seem to be ok.
>
>> If you have insights as why the above may be occurring, please let me 
>> know. A simple solution to work around this may be to introduce a 
>> register holding the index into the result packet where to read the 
>> next byte from (rather than advancing an internal pointer to the next 
>> byte), though this would deviate the driver from the standard 
>> interface the model currently implements.
>
> Most undesirable, I'd like to fix the bug.
In the meantime I modified the tpm_tis driver making use of the fact 
that the packet can be re-read. I reread the packet when I recognize 
that the TIS is running out of bytes early (due to double-read). That 
makes it work. Debugging output of the driver shows the retrying, 
implying that the double-reads do occur. This work-around is just 
'masking' the problem.
>
> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to 
> verify this?
>
Here's what I did:

diff --git a/kvm-all.c b/kvm-all.c
index cae24bb..7ba222a 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -31,7 +31,7 @@
  /* KVM uses PAGE_SIZE in it's definition of COALESCED_MMIO_MAX */
  #define PAGE_SIZE TARGET_PAGE_SIZE

-//#define DEBUG_KVM
+#define DEBUG_KVM

  #ifdef DEBUG_KVM
  #define DPRINTF(fmt, ...) \
@@ -874,6 +874,9 @@ int kvm_cpu_exec(CPUState *env)
          kvm_arch_pre_run(env, run);
          cpu_single_env = NULL;
          qemu_mutex_unlock_iothread();
+#ifdef DEBUG_KVM
+        fprintf(stderr,"ioctl(KVM_RUN)\n");
+#endif
          ret = kvm_vcpu_ioctl(env, KVM_RUN, 0);
          qemu_mutex_lock_iothread();
          cpu_single_env = env;



> Good pattern:
>
>   ioctl(KVM_RUN)
>   -> KVM_EXIT_MMIO
>   ioctl(KVM_RUN)
>   -> ENTR
>   no further KVM_RUNs
>
> or
>
>    ioctl(KVM_RUN)
>    -> something other than KVM_EXIT_MMIO
>    no further KVM_RUNs
>
> Bad pattern:
>
>    ioctl(KVM_RUN)
>    -> KVM_EXIT_MMIO
>    no further KVM_RUNs
>
Here's what I see in the failure case:

ioctl(KVM_RUN)
handle_mmio
ioctl(KVM_RUN)
handle_mmio
ioctl(KVM_RUN)
handle_mmio
ioctl(KVM_RUN)
handle_mmio
interrupt exit requested
0+0 records in
0+0 records out
0 bytes (0 B) copied, 9.18e-06 s, 0.0 kB/s
tpm_tis: suspend: locty 0 : r_offset = 61, w_offset = 0
tpm_tis: active locality     : 0
tpm_tis: state of locality 0 : 0x2
tpm_tis: register dump:
tpm_tis: 0x0000 : 000000a0
tpm_tis: 0x0008 : 0x8000008d
tpm_tis: 0x000c : 0x00000003
tpm_tis: 0x0010 : 0x00000000
tpm_tis: 0x0014 : 0x00000095
tpm_tis: 0x0018 : 0x00011290
tpm_tis: 0x0f00 : 0x00010001
tpm_tis: 0x0f04 : 0x00000001
tpm_tis: read offset   : 61
tpm_tis: result buffer :  00 c5 00 00 01 4f 00 00 00 00 00 00 00 01 00 03
tpm_tis:                  00 01 00 00 00 0c 00 00 08 00 00 00 00 02 00 00
tpm_tis:                  00 00 00 00 01 00 ca 47 12 16 3b e9 14 25 f7 f4
tpm_tis:                  b1 5e 69 c7 da 2d 5e f8 a3 82 04 bc e6>17 9e c5
tpm_tis:                  fd 2a f0 c0 01 13 c9 f2 c7 fb 5d e6 63 a7 db 48
tpm_tis:                  f2 85 bb 93 f1 b3 40 00 5b 27 70 5d 8c 28 79 89
tpm_tis:                  36 49 7d 2f 56 b8 28 d5 61 74 4d ff 1c cf 4b a9
tpm_tis:                  a1 a8 b1 9e 6f 89 02 a3 21 02 86 8b ab 73 14 9b
tpm_tis:                  79 6e 86 27 da a8 2d 2c 0f 9c 28 ae 8d b7 b8 66
tpm_tis:                  6a 20 92 3d 48 d0 c9 42 84 f6 2a ad e2 bd d3 11
tpm_tis:                  2b e9 90 8e 1f 64 e4 de 9d 12 75 4a db 3f de d7
tpm_tis:                  70 06 b0 95 47 56 9f a7 32 b6 20 1a 12 ea 8a ed
tpm_tis:                  24 b1 17 6b ad 4a 64 4b 64 b7 2c 1f 44 02 fe 2c
tpm_tis:                  d8 72 1b bb 9c 42 8c 64 46 f4 29 ad 9c ff ea 37
tpm_tis:                  48 77 26 4c 75 53 52 5a cb 6a 58 d5 d6 81 17 17
tpm_tis:                  27 97 44 bf d7 0d 46 3c 9f b3 70 3f 5c 5c b1 ba
tpm_tis:                  86 5e 9c 78 bc 4c 40 41 90 ed 79 b2 06 64 73 6e
tpm_tis:                  64 18 e7 d0 9f 4d 7d d6 bb 2d 39 18 e1 41 3f 34
tpm_tis:                  2b 9e a4 8e 70 a1 fa 35 1d f3 cf be 5a 73 4d dd
tpm_tis:                  49 dd 57 79 5b be 48 c6 44 3c 00 01 68 07 b3 2d
tpm_tis:                  42 08 2e 51 93 1a cf db 34 de 10 1d 94 fe 9a
tpm_tis: write offset  : 0
tpm_tis: request buffer:>00 c2 00 00 00 3b 00 00 00 81 40 00 00 06 78 e8
tpm_tis:                  a5 47 c3 e9 67 27 ac 27 5a a7 9c 53 19 f9 f0 cd
tpm_tis:                  8b 93 4a 82 85 af 00 e9 b8 c6 80 92 42 fb c6 55
tpm_tis:                  06 00 f2 62 52 7b 8b cd 64 65 95
48+11535 records in
48+11535 records out
500881189 bytes (501 MB) copied, 14.282 s, 35.1 MB/s
2011-01-14 13:55:57.871: shutting down

Immediately following is the restore part:

2011-01-14 13:55:59.575: starting up
LC_ALL=C PATH=/usr/lib64/qt-3.3/bin:/usr/lib64/ccache:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin HOME=/root USER=root LOGNAME=root QEMU_AUDIO_DRV=none [...]
kvm_init_vcpu
tpm_tis: resume : locty 0 : r_offset = 61, w_offset = 0
kvm_cpu_exec()
interrupt exit requested
kvm_cpu_exec()
ioctl(KVM_RUN)
irq_window_open
kvm_cpu_exec()
ioctl(KVM_RUN)
handle_mmio
ioctl(KVM_RUN)
handle_mmio


Cheers!
    Stefan

Re: Errors on MMIO read access on VM suspend / resume operations

[Avi Kivity]

On 01/14/2011 09:27 PM, Stefan Berger wrote:
>
>>
>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to 
>> verify this?
>>
> Here's what I did:
>
>
> interrupt exit requested

It appears from this you're using qemu.git.  Please try qemu-kvm.git, 
where the code appears to be correct.

-- 
error compiling committee.c: too many arguments to function

Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/16/2011 09:43 AM, Avi Kivity wrote:
> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>
>>>
>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to 
>>> verify this?
>>>
>> Here's what I did:
>>
>>
>> interrupt exit requested
>
> It appears from this you're using qemu.git.  Please try qemu-kvm.git, 
> where the code appears to be correct.
>
Cc'ing qemu-devel now. For reference, here the initial problem description:

http://www.spinics.net/lists/kvm/msg48274.html

I didn't know there was another tree...

I have seen now a couple of suspends-while-reading with patches applied 
to the qemu-kvm.git tree and indeed, when run with the same host kernel 
and VM I do not see the debugging dumps due to double-reads that I would 
have anticipated seeing by now. Now what? Can this be easily fixed in 
the other Qemu tree as well?

One thing I'd like to mention is that I have seen what I think are 
interrupt stalls when running my tests inside the qemu-kvm.git tree 
version and not suspending at all. A some point the interrupt counter in 
the guest kernel does not increase anymore even though I see the device 
model raising the IRQ and lowering it. The same tests run literally 
forever in the qemu.git tree version of Qemu.

Regards,
    Stefan

[Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/16/2011 09:43 AM, Avi Kivity wrote:
> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>
>>>
>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to 
>>> verify this?
>>>
>> Here's what I did:
>>
>>
>> interrupt exit requested
>
> It appears from this you're using qemu.git.  Please try qemu-kvm.git, 
> where the code appears to be correct.
>
Cc'ing qemu-devel now. For reference, here the initial problem description:

http://www.spinics.net/lists/kvm/msg48274.html

I didn't know there was another tree...

I have seen now a couple of suspends-while-reading with patches applied 
to the qemu-kvm.git tree and indeed, when run with the same host kernel 
and VM I do not see the debugging dumps due to double-reads that I would 
have anticipated seeing by now. Now what? Can this be easily fixed in 
the other Qemu tree as well?

One thing I'd like to mention is that I have seen what I think are 
interrupt stalls when running my tests inside the qemu-kvm.git tree 
version and not suspending at all. A some point the interrupt counter in 
the guest kernel does not increase anymore even though I see the device 
model raising the IRQ and lowering it. The same tests run literally 
forever in the qemu.git tree version of Qemu.

Regards,
    Stefan

Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

On 2011-01-18 04:03, Stefan Berger wrote:
> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>
>>>>
>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>> verify this?
>>>>
>>> Here's what I did:
>>>
>>>
>>> interrupt exit requested
>>
>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>> where the code appears to be correct.
>>
> Cc'ing qemu-devel now. For reference, here the initial problem description:
> 
> http://www.spinics.net/lists/kvm/msg48274.html
> 
> I didn't know there was another tree...
> 
> I have seen now a couple of suspends-while-reading with patches applied
> to the qemu-kvm.git tree and indeed, when run with the same host kernel
> and VM I do not see the debugging dumps due to double-reads that I would
> have anticipated seeing by now. Now what? Can this be easily fixed in
> the other Qemu tree as well?

Please give this a try:

git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream

I bet (& hope) "kvm: Unconditionally reenter kernel after IO exits"
fixes the issue for you. If other problems pop up with that tree, also
try resetting to that particular commit.

I'm currently trying to shake all those hidden or forgotten bug fixes
out of qemu-kvm and port them upstream. Most of those subtle differences
should hopefully soon be history.

> 
> One thing I'd like to mention is that I have seen what I think are
> interrupt stalls when running my tests inside the qemu-kvm.git tree
> version and not suspending at all. A some point the interrupt counter in
> the guest kernel does not increase anymore even though I see the device
> model raising the IRQ and lowering it. The same tests run literally
> forever in the qemu.git tree version of Qemu.

What about qemu-kmv and -no-kvm-irqchip?

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

[Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

On 2011-01-18 04:03, Stefan Berger wrote:
> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>
>>>>
>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>> verify this?
>>>>
>>> Here's what I did:
>>>
>>>
>>> interrupt exit requested
>>
>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>> where the code appears to be correct.
>>
> Cc'ing qemu-devel now. For reference, here the initial problem description:
> 
> http://www.spinics.net/lists/kvm/msg48274.html
> 
> I didn't know there was another tree...
> 
> I have seen now a couple of suspends-while-reading with patches applied
> to the qemu-kvm.git tree and indeed, when run with the same host kernel
> and VM I do not see the debugging dumps due to double-reads that I would
> have anticipated seeing by now. Now what? Can this be easily fixed in
> the other Qemu tree as well?

Please give this a try:

git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream

I bet (& hope) "kvm: Unconditionally reenter kernel after IO exits"
fixes the issue for you. If other problems pop up with that tree, also
try resetting to that particular commit.

I'm currently trying to shake all those hidden or forgotten bug fixes
out of qemu-kvm and port them upstream. Most of those subtle differences
should hopefully soon be history.

> 
> One thing I'd like to mention is that I have seen what I think are
> interrupt stalls when running my tests inside the qemu-kvm.git tree
> version and not suspending at all. A some point the interrupt counter in
> the guest kernel does not increase anymore even though I see the device
> model raising the IRQ and lowering it. The same tests run literally
> forever in the qemu.git tree version of Qemu.

What about qemu-kmv and -no-kvm-irqchip?

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/18/2011 03:53 AM, Jan Kiszka wrote:
> On 2011-01-18 04:03, Stefan Berger wrote:
>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>> verify this?
>>>>>
>>>> Here's what I did:
>>>>
>>>>
>>>> interrupt exit requested
>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>> where the code appears to be correct.
>>>
>> Cc'ing qemu-devel now. For reference, here the initial problem description:
>>
>> http://www.spinics.net/lists/kvm/msg48274.html
>>
>> I didn't know there was another tree...
>>
>> I have seen now a couple of suspends-while-reading with patches applied
>> to the qemu-kvm.git tree and indeed, when run with the same host kernel
>> and VM I do not see the debugging dumps due to double-reads that I would
>> have anticipated seeing by now. Now what? Can this be easily fixed in
>> the other Qemu tree as well?
> Please give this a try:
>
> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>
> I bet (&  hope) "kvm: Unconditionally reenter kernel after IO exits"
> fixes the issue for you. If other problems pop up with that tree, also
> try resetting to that particular commit.
>
> I'm currently trying to shake all those hidden or forgotten bug fixes
> out of qemu-kvm and port them upstream. Most of those subtle differences
> should hopefully soon be history.
>
I did the same test as I did with Avi's tree and haven't seen the 
consequences of possible double-reads. So, I would say that you should 
upstream those patches...

I searched for the text you mention above using 'gitk' but couldn't find 
a patch with that headline in your tree. There were others that seem to 
be related:

Gleb Natapov: "do not enter vcpu again if it was stopped during IO"
>> One thing I'd like to mention is that I have seen what I think are
>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>> version and not suspending at all. A some point the interrupt counter in
>> the guest kernel does not increase anymore even though I see the device
>> model raising the IRQ and lowering it. The same tests run literally
>> forever in the qemu.git tree version of Qemu.
> What about qemu-kmv and -no-kvm-irqchip?
That seems to be necessary for both trees, yours and the one Avi pointed 
me to. If applied, then I did not see the interrupt problem.

     Stefan
> Jan
>

[Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/18/2011 03:53 AM, Jan Kiszka wrote:
> On 2011-01-18 04:03, Stefan Berger wrote:
>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>> verify this?
>>>>>
>>>> Here's what I did:
>>>>
>>>>
>>>> interrupt exit requested
>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>> where the code appears to be correct.
>>>
>> Cc'ing qemu-devel now. For reference, here the initial problem description:
>>
>> http://www.spinics.net/lists/kvm/msg48274.html
>>
>> I didn't know there was another tree...
>>
>> I have seen now a couple of suspends-while-reading with patches applied
>> to the qemu-kvm.git tree and indeed, when run with the same host kernel
>> and VM I do not see the debugging dumps due to double-reads that I would
>> have anticipated seeing by now. Now what? Can this be easily fixed in
>> the other Qemu tree as well?
> Please give this a try:
>
> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>
> I bet (&  hope) "kvm: Unconditionally reenter kernel after IO exits"
> fixes the issue for you. If other problems pop up with that tree, also
> try resetting to that particular commit.
>
> I'm currently trying to shake all those hidden or forgotten bug fixes
> out of qemu-kvm and port them upstream. Most of those subtle differences
> should hopefully soon be history.
>
I did the same test as I did with Avi's tree and haven't seen the 
consequences of possible double-reads. So, I would say that you should 
upstream those patches...

I searched for the text you mention above using 'gitk' but couldn't find 
a patch with that headline in your tree. There were others that seem to 
be related:

Gleb Natapov: "do not enter vcpu again if it was stopped during IO"
>> One thing I'd like to mention is that I have seen what I think are
>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>> version and not suspending at all. A some point the interrupt counter in
>> the guest kernel does not increase anymore even though I see the device
>> model raising the IRQ and lowering it. The same tests run literally
>> forever in the qemu.git tree version of Qemu.
> What about qemu-kmv and -no-kvm-irqchip?
That seems to be necessary for both trees, yours and the one Avi pointed 
me to. If applied, then I did not see the interrupt problem.

     Stefan
> Jan
>

Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 3043 bytes --]

On 2011-01-24 19:27, Stefan Berger wrote:
> On 01/18/2011 03:53 AM, Jan Kiszka wrote:
>> On 2011-01-18 04:03, Stefan Berger wrote:
>>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>>> verify this?
>>>>>>
>>>>> Here's what I did:
>>>>>
>>>>>
>>>>> interrupt exit requested
>>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>>> where the code appears to be correct.
>>>>
>>> Cc'ing qemu-devel now. For reference, here the initial problem
>>> description:
>>>
>>> http://www.spinics.net/lists/kvm/msg48274.html
>>>
>>> I didn't know there was another tree...
>>>
>>> I have seen now a couple of suspends-while-reading with patches applied
>>> to the qemu-kvm.git tree and indeed, when run with the same host kernel
>>> and VM I do not see the debugging dumps due to double-reads that I would
>>> have anticipated seeing by now. Now what? Can this be easily fixed in
>>> the other Qemu tree as well?
>> Please give this a try:
>>
>> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>>
>> I bet (&  hope) "kvm: Unconditionally reenter kernel after IO exits"
>> fixes the issue for you. If other problems pop up with that tree, also
>> try resetting to that particular commit.
>>
>> I'm currently trying to shake all those hidden or forgotten bug fixes
>> out of qemu-kvm and port them upstream. Most of those subtle differences
>> should hopefully soon be history.
>>
> I did the same test as I did with Avi's tree and haven't seen the
> consequences of possible double-reads. So, I would say that you should
> upstream those patches...
> 
> I searched for the text you mention above using 'gitk' but couldn't find
> a patch with that headline in your tree. There were others that seem to
> be related:
> 
> Gleb Natapov: "do not enter vcpu again if it was stopped during IO"

Err, I don't think you checked out queues/kvm-upstream. I bet you just
ran my master branch which is a version of qemu-kvm's master. Am I right? :)

>>> One thing I'd like to mention is that I have seen what I think are
>>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>>> version and not suspending at all. A some point the interrupt counter in
>>> the guest kernel does not increase anymore even though I see the device
>>> model raising the IRQ and lowering it. The same tests run literally
>>> forever in the qemu.git tree version of Qemu.
>> What about qemu-kmv and -no-kvm-irqchip?
> That seems to be necessary for both trees, yours and the one Avi pointed
> me to. If applied, then I did not see the interrupt problem.

And the fact that you were able to call qemu from my tree with
-no-kvm-irqchip just underlines my assumption: that switch is refused by
upstream. Please retry with the latest kvm-upstream queue.

Besides that, this other bug you may see in the in-kernel IRQ path - how
can we reproduce it?

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

[Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 3043 bytes --]

On 2011-01-24 19:27, Stefan Berger wrote:
> On 01/18/2011 03:53 AM, Jan Kiszka wrote:
>> On 2011-01-18 04:03, Stefan Berger wrote:
>>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>>> verify this?
>>>>>>
>>>>> Here's what I did:
>>>>>
>>>>>
>>>>> interrupt exit requested
>>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>>> where the code appears to be correct.
>>>>
>>> Cc'ing qemu-devel now. For reference, here the initial problem
>>> description:
>>>
>>> http://www.spinics.net/lists/kvm/msg48274.html
>>>
>>> I didn't know there was another tree...
>>>
>>> I have seen now a couple of suspends-while-reading with patches applied
>>> to the qemu-kvm.git tree and indeed, when run with the same host kernel
>>> and VM I do not see the debugging dumps due to double-reads that I would
>>> have anticipated seeing by now. Now what? Can this be easily fixed in
>>> the other Qemu tree as well?
>> Please give this a try:
>>
>> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>>
>> I bet (&  hope) "kvm: Unconditionally reenter kernel after IO exits"
>> fixes the issue for you. If other problems pop up with that tree, also
>> try resetting to that particular commit.
>>
>> I'm currently trying to shake all those hidden or forgotten bug fixes
>> out of qemu-kvm and port them upstream. Most of those subtle differences
>> should hopefully soon be history.
>>
> I did the same test as I did with Avi's tree and haven't seen the
> consequences of possible double-reads. So, I would say that you should
> upstream those patches...
> 
> I searched for the text you mention above using 'gitk' but couldn't find
> a patch with that headline in your tree. There were others that seem to
> be related:
> 
> Gleb Natapov: "do not enter vcpu again if it was stopped during IO"

Err, I don't think you checked out queues/kvm-upstream. I bet you just
ran my master branch which is a version of qemu-kvm's master. Am I right? :)

>>> One thing I'd like to mention is that I have seen what I think are
>>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>>> version and not suspending at all. A some point the interrupt counter in
>>> the guest kernel does not increase anymore even though I see the device
>>> model raising the IRQ and lowering it. The same tests run literally
>>> forever in the qemu.git tree version of Qemu.
>> What about qemu-kmv and -no-kvm-irqchip?
> That seems to be necessary for both trees, yours and the one Avi pointed
> me to. If applied, then I did not see the interrupt problem.

And the fact that you were able to call qemu from my tree with
-no-kvm-irqchip just underlines my assumption: that switch is refused by
upstream. Please retry with the latest kvm-upstream queue.

Besides that, this other bug you may see in the in-kernel IRQ path - how
can we reproduce it?

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/24/2011 05:34 PM, Jan Kiszka wrote:
> On 2011-01-24 19:27, Stefan Berger wrote:
>> On 01/18/2011 03:53 AM, Jan Kiszka wrote:
>>> On 2011-01-18 04:03, Stefan Berger wrote:
>>>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>>>> verify this?
>>>>>>>
>>>>>> Here's what I did:
>>>>>>
>>>>>>
>>>>>> interrupt exit requested
>>>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>>>> where the code appears to be correct.
>>>>>
>>>> Cc'ing qemu-devel now. For reference, here the initial problem
>>>> description:
>>>>
>>>> http://www.spinics.net/lists/kvm/msg48274.html
>>>>
>>>> I didn't know there was another tree...
>>>>
>>>> I have seen now a couple of suspends-while-reading with patches applied
>>>> to the qemu-kvm.git tree and indeed, when run with the same host kernel
>>>> and VM I do not see the debugging dumps due to double-reads that I would
>>>> have anticipated seeing by now. Now what? Can this be easily fixed in
>>>> the other Qemu tree as well?
>>> Please give this a try:
>>>
>>> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>>>
>>> I bet (&   hope) "kvm: Unconditionally reenter kernel after IO exits"
>>> fixes the issue for you. If other problems pop up with that tree, also
>>> try resetting to that particular commit.
>>>
>>> I'm currently trying to shake all those hidden or forgotten bug fixes
>>> out of qemu-kvm and port them upstream. Most of those subtle differences
>>> should hopefully soon be history.
>>>
>> I did the same test as I did with Avi's tree and haven't seen the
>> consequences of possible double-reads. So, I would say that you should
>> upstream those patches...
>>
>> I searched for the text you mention above using 'gitk' but couldn't find
>> a patch with that headline in your tree. There were others that seem to
>> be related:
>>
>> Gleb Natapov: "do not enter vcpu again if it was stopped during IO"
> Err, I don't think you checked out queues/kvm-upstream. I bet you just
> ran my master branch which is a version of qemu-kvm's master. Am I right? :)
>

You're right. :-) my lack of git knowledge -  checked out the branch now.

I redid the testing and it passed. No double-reads and lost bytes from 
what I could see.

>>>> One thing I'd like to mention is that I have seen what I think are
>>>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>>>> version and not suspending at all. A some point the interrupt counter in
>>>> the guest kernel does not increase anymore even though I see the device
>>>> model raising the IRQ and lowering it. The same tests run literally
>>>> forever in the qemu.git tree version of Qemu.
>>> What about qemu-kmv and -no-kvm-irqchip?
>> That seems to be necessary for both trees, yours and the one Avi pointed
>> me to. If applied, then I did not see the interrupt problem.
> And the fact that you were able to call qemu from my tree with
> -no-kvm-irqchip just underlines my assumption: that switch is refused by
> upstream. Please retry with the latest kvm-upstream queue.
>
> Besides that, this other bug you may see in the in-kernel IRQ path - how
> can we reproduce it?
Unfortunately I don't know. Some things have to come together for the 
code I am working on to become available and useful for everyone. It's 
going to be a while.

Thanks!
    Stefan
> Jan
>

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 3841 bytes --]

On 2011-01-25 04:13, Stefan Berger wrote:
> On 01/24/2011 05:34 PM, Jan Kiszka wrote:
>> On 2011-01-24 19:27, Stefan Berger wrote:
>>> On 01/18/2011 03:53 AM, Jan Kiszka wrote:
>>>> On 2011-01-18 04:03, Stefan Berger wrote:
>>>>> On 01/16/2011 09:43 AM, Avi Kivity wrote:
>>>>>> On 01/14/2011 09:27 PM, Stefan Berger wrote:
>>>>>>>> Can you sprinkle some printfs() arount kvm_run (in qemu-kvm.c) to
>>>>>>>> verify this?
>>>>>>>>
>>>>>>> Here's what I did:
>>>>>>>
>>>>>>>
>>>>>>> interrupt exit requested
>>>>>> It appears from this you're using qemu.git.  Please try qemu-kvm.git,
>>>>>> where the code appears to be correct.
>>>>>>
>>>>> Cc'ing qemu-devel now. For reference, here the initial problem
>>>>> description:
>>>>>
>>>>> http://www.spinics.net/lists/kvm/msg48274.html
>>>>>
>>>>> I didn't know there was another tree...
>>>>>
>>>>> I have seen now a couple of suspends-while-reading with patches
>>>>> applied
>>>>> to the qemu-kvm.git tree and indeed, when run with the same host
>>>>> kernel
>>>>> and VM I do not see the debugging dumps due to double-reads that I
>>>>> would
>>>>> have anticipated seeing by now. Now what? Can this be easily fixed in
>>>>> the other Qemu tree as well?
>>>> Please give this a try:
>>>>
>>>> git://git.kiszka.org/qemu-kvm.git queues/kvm-upstream
>>>>
>>>> I bet (&   hope) "kvm: Unconditionally reenter kernel after IO exits"
>>>> fixes the issue for you. If other problems pop up with that tree, also
>>>> try resetting to that particular commit.
>>>>
>>>> I'm currently trying to shake all those hidden or forgotten bug fixes
>>>> out of qemu-kvm and port them upstream. Most of those subtle
>>>> differences
>>>> should hopefully soon be history.
>>>>
>>> I did the same test as I did with Avi's tree and haven't seen the
>>> consequences of possible double-reads. So, I would say that you should
>>> upstream those patches...
>>>
>>> I searched for the text you mention above using 'gitk' but couldn't find
>>> a patch with that headline in your tree. There were others that seem to
>>> be related:
>>>
>>> Gleb Natapov: "do not enter vcpu again if it was stopped during IO"
>> Err, I don't think you checked out queues/kvm-upstream. I bet you just
>> ran my master branch which is a version of qemu-kvm's master. Am I
>> right? :)
>>
> 
> You're right. :-) my lack of git knowledge -  checked out the branch now.
> 
> I redid the testing and it passed. No double-reads and lost bytes from
> what I could see.

Great, thanks.

> 
>>>>> One thing I'd like to mention is that I have seen what I think are
>>>>> interrupt stalls when running my tests inside the qemu-kvm.git tree
>>>>> version and not suspending at all. A some point the interrupt
>>>>> counter in
>>>>> the guest kernel does not increase anymore even though I see the
>>>>> device
>>>>> model raising the IRQ and lowering it. The same tests run literally
>>>>> forever in the qemu.git tree version of Qemu.
>>>> What about qemu-kmv and -no-kvm-irqchip?
>>> That seems to be necessary for both trees, yours and the one Avi pointed
>>> me to. If applied, then I did not see the interrupt problem.
>> And the fact that you were able to call qemu from my tree with
>> -no-kvm-irqchip just underlines my assumption: that switch is refused by
>> upstream. Please retry with the latest kvm-upstream queue.
>>
>> Besides that, this other bug you may see in the in-kernel IRQ path - how
>> can we reproduce it?
> Unfortunately I don't know. Some things have to come together for the
> code I am working on to become available and useful for everyone. It's
> going to be a while.

Do you see a chance to look closer at the issue yourself? E.g.
instrument the kernel's irqchip models and dump their states once your
guest is stuck?

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>
> Do you see a chance to look closer at the issue yourself? E.g.
> instrument the kernel's irqchip models and dump their states once your
> guest is stuck?
The device runs on iRQ 3. So I applied this patch here.

diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 3cece05..8f4f94c 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct kvm_kpic_state *s, int irq, int level)
  {
  	int mask, ret = 1;
  	mask = 1<<  irq;
-	if (s->elcr&  mask)	/* level triggered */
+	if (s->elcr&  mask)	/* level triggered */ {
  		if (level) {
  			ret = !(s->irr&  mask);
  			s->irr |= mask;
@@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct kvm_kpic_state *s, int irq, int level)
  			s->irr&= ~mask;
  			s->last_irr&= ~mask;
  		}
-	else	/* edge triggered */
+if (irq == 3)
+    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level, s->irr);
+        }
+	else	/* edge triggered */ {
  		if (level) {
  			if ((s->last_irr&  mask) == 0) {
  				ret = !(s->irr&  mask);
@@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct kvm_kpic_state *s, int irq, int level)
  			s->last_irr |= mask;
  		} else
  			s->last_irr&= ~mask;
-
+if (irq == 3)
+    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level, s->irr);
+        }
  	return (s->imr&  mask) ? -1 : ret;
  }

@@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int level)

  	pic_lock(s);
  	if (irq>= 0&&  irq<  PIC_NUM_PINS) {
+if (irq == 3)
+printk("%s\n", __FUNCTION__);
  		ret = pic_set_irq1(&s->pics[irq>>  3], irq&  7, level);
  		pic_update_irq(s);
  		trace_kvm_pic_set_irq(irq>>  3, irq&  7, s->pics[irq>>  3].elcr,



While it's still working I see this here with the levels changing 0-1-0. 
Though then it stops and levels are only at '1'.

[ 1773.833824] kvm_pic_set_irq
[ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
[ 1773.834161] kvm_pic_set_irq
[ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
[ 1773.834193] kvm_pic_set_irq
[ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
[ 1773.835028] kvm_pic_set_irq
[ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
[ 1773.835542] kvm_pic_set_irq
[ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
[ 1773.889892] kvm_pic_set_irq
[ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
[ 1791.258793] pic_set_irq1 119: level=1, irr = d9
[ 1791.258824] pic_set_irq1 119: level=0, irr = d1
[ 1791.402476] pic_set_irq1 119: level=1, irr = d9
[ 1791.402534] pic_set_irq1 119: level=0, irr = d1
[ 1791.402538] pic_set_irq1 119: level=1, irr = d9
[...]


I believe the last 5 shown calls can be ignored. After that the 
interrupts don't go through anymore.

In the device model I see interrupts being raised and cleared. After the 
last one was cleared in 'my' device model, only interrupts are raised. 
This looks like as if the interrupt handler in the guest Linux was never 
run, thus the IRQ is never cleared and we're stuck.



Regards,
     Stefan

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 3746 bytes --]

On 2011-01-25 17:49, Stefan Berger wrote:
> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>
>> Do you see a chance to look closer at the issue yourself? E.g.
>> instrument the kernel's irqchip models and dump their states once your
>> guest is stuck?
> The device runs on iRQ 3. So I applied this patch here.
> 
> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
> index 3cece05..8f4f94c 100644
> --- a/arch/x86/kvm/i8259.c
> +++ b/arch/x86/kvm/i8259.c
> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct kvm_kpic_state
> *s, int irq, int level)
>  {
>      int mask, ret = 1;
>      mask = 1<<  irq;
> -    if (s->elcr&  mask)    /* level triggered */
> +    if (s->elcr&  mask)    /* level triggered */ {
>          if (level) {
>              ret = !(s->irr&  mask);
>              s->irr |= mask;
> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
> kvm_kpic_state *s, int irq, int level)
>              s->irr&= ~mask;
>              s->last_irr&= ~mask;
>          }
> -    else    /* edge triggered */
> +if (irq == 3)
> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
> s->irr);
> +        }
> +    else    /* edge triggered */ {
>          if (level) {
>              if ((s->last_irr&  mask) == 0) {
>                  ret = !(s->irr&  mask);
> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct kvm_kpic_state
> *s, int irq, int level)
>              s->last_irr |= mask;
>          } else
>              s->last_irr&= ~mask;
> -
> +if (irq == 3)
> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
> s->irr);
> +        }
>      return (s->imr&  mask) ? -1 : ret;
>  }
> 
> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int level)
> 
>      pic_lock(s);
>      if (irq>= 0&&  irq<  PIC_NUM_PINS) {
> +if (irq == 3)
> +printk("%s\n", __FUNCTION__);
>          ret = pic_set_irq1(&s->pics[irq>>  3], irq&  7, level);
>          pic_update_irq(s);
>          trace_kvm_pic_set_irq(irq>>  3, irq&  7, s->pics[irq>>  3].elcr,
> 
> 
> 
> While it's still working I see this here with the levels changing 0-1-0.
> Though then it stops and levels are only at '1'.
> 
> [ 1773.833824] kvm_pic_set_irq
> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
> [ 1773.834161] kvm_pic_set_irq
> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
> [ 1773.834193] kvm_pic_set_irq
> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
> [ 1773.835028] kvm_pic_set_irq
> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
> [ 1773.835542] kvm_pic_set_irq
> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
> [ 1773.889892] kvm_pic_set_irq
> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
> [...]
> 
> 
> I believe the last 5 shown calls can be ignored. After that the
> interrupts don't go through anymore.
> 
> In the device model I see interrupts being raised and cleared. After the
> last one was cleared in 'my' device model, only interrupts are raised.
> This looks like as if the interrupt handler in the guest Linux was never
> run, thus the IRQ is never cleared and we're stuck.
> 

User space is responsible for both setting and clearing that line. IRQ3
means you are using some serial device model? Then you should check what
its state is.

Moreover, a complete picture of the kernel/user space interaction should
be obtainable by using fstrace for capturing kvm events.

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/26/2011 03:14 AM, Jan Kiszka wrote:
> On 2011-01-25 17:49, Stefan Berger wrote:
>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>> Do you see a chance to look closer at the issue yourself? E.g.
>>> instrument the kernel's irqchip models and dump their states once your
>>> guest is stuck?
>> The device runs on iRQ 3. So I applied this patch here.
>>
>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>> index 3cece05..8f4f94c 100644
>> --- a/arch/x86/kvm/i8259.c
>> +++ b/arch/x86/kvm/i8259.c
>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>> *s, int irq, int level)
>>   {
>>       int mask, ret = 1;
>>       mask = 1<<   irq;
>> -    if (s->elcr&   mask)    /* level triggered */
>> +    if (s->elcr&   mask)    /* level triggered */ {
>>           if (level) {
>>               ret = !(s->irr&   mask);
>>               s->irr |= mask;
>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>> kvm_kpic_state *s, int irq, int level)
>>               s->irr&= ~mask;
>>               s->last_irr&= ~mask;
>>           }
>> -    else    /* edge triggered */
>> +if (irq == 3)
>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>> s->irr);
>> +        }
>> +    else    /* edge triggered */ {
>>           if (level) {
>>               if ((s->last_irr&   mask) == 0) {
>>                   ret = !(s->irr&   mask);
>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>> *s, int irq, int level)
>>               s->last_irr |= mask;
>>           } else
>>               s->last_irr&= ~mask;
>> -
>> +if (irq == 3)
>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>> s->irr);
>> +        }
>>       return (s->imr&   mask) ? -1 : ret;
>>   }
>>
>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int level)
>>
>>       pic_lock(s);
>>       if (irq>= 0&&   irq<   PIC_NUM_PINS) {
>> +if (irq == 3)
>> +printk("%s\n", __FUNCTION__);
>>           ret = pic_set_irq1(&s->pics[irq>>   3], irq&   7, level);
>>           pic_update_irq(s);
>>           trace_kvm_pic_set_irq(irq>>   3, irq&   7, s->pics[irq>>   3].elcr,
>>
>>
>>
>> While it's still working I see this here with the levels changing 0-1-0.
>> Though then it stops and levels are only at '1'.
>>
>> [ 1773.833824] kvm_pic_set_irq
>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>> [ 1773.834161] kvm_pic_set_irq
>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>> [ 1773.834193] kvm_pic_set_irq
>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>> [ 1773.835028] kvm_pic_set_irq
>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>> [ 1773.835542] kvm_pic_set_irq
>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>> [ 1773.889892] kvm_pic_set_irq
>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>> [...]
>>
>>
>> I believe the last 5 shown calls can be ignored. After that the
>> interrupts don't go through anymore.
>>
>> In the device model I see interrupts being raised and cleared. After the
>> last one was cleared in 'my' device model, only interrupts are raised.
>> This looks like as if the interrupt handler in the guest Linux was never
>> run, thus the IRQ is never cleared and we're stuck.
>>
> User space is responsible for both setting and clearing that line. IRQ3
> means you are using some serial device model? Then you should check what
> its state is.
Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git) 
from what I can see. There was no UART on IRQ3 before, though, but 
certainly it was the wrong IRQ for it.
> Moreover, a complete picture of the kernel/user space interaction should
> be obtainable by using fstrace for capturing kvm events.
>
Should it be working on IRQ3? If so, I'd look into it when I get a chance...
    Stefan

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 4538 bytes --]

On 2011-01-26 13:05, Stefan Berger wrote:
> On 01/26/2011 03:14 AM, Jan Kiszka wrote:
>> On 2011-01-25 17:49, Stefan Berger wrote:
>>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>>> Do you see a chance to look closer at the issue yourself? E.g.
>>>> instrument the kernel's irqchip models and dump their states once your
>>>> guest is stuck?
>>> The device runs on iRQ 3. So I applied this patch here.
>>>
>>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>>> index 3cece05..8f4f94c 100644
>>> --- a/arch/x86/kvm/i8259.c
>>> +++ b/arch/x86/kvm/i8259.c
>>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>>> *s, int irq, int level)
>>>   {
>>>       int mask, ret = 1;
>>>       mask = 1<<   irq;
>>> -    if (s->elcr&   mask)    /* level triggered */
>>> +    if (s->elcr&   mask)    /* level triggered */ {
>>>           if (level) {
>>>               ret = !(s->irr&   mask);
>>>               s->irr |= mask;
>>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>>> kvm_kpic_state *s, int irq, int level)
>>>               s->irr&= ~mask;
>>>               s->last_irr&= ~mask;
>>>           }
>>> -    else    /* edge triggered */
>>> +if (irq == 3)
>>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>>> s->irr);
>>> +        }
>>> +    else    /* edge triggered */ {
>>>           if (level) {
>>>               if ((s->last_irr&   mask) == 0) {
>>>                   ret = !(s->irr&   mask);
>>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>>> *s, int irq, int level)
>>>               s->last_irr |= mask;
>>>           } else
>>>               s->last_irr&= ~mask;
>>> -
>>> +if (irq == 3)
>>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>>> s->irr);
>>> +        }
>>>       return (s->imr&   mask) ? -1 : ret;
>>>   }
>>>
>>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int
>>> level)
>>>
>>>       pic_lock(s);
>>>       if (irq>= 0&&   irq<   PIC_NUM_PINS) {
>>> +if (irq == 3)
>>> +printk("%s\n", __FUNCTION__);
>>>           ret = pic_set_irq1(&s->pics[irq>>   3], irq&   7, level);
>>>           pic_update_irq(s);
>>>           trace_kvm_pic_set_irq(irq>>   3, irq&   7, s->pics[irq>>  
>>> 3].elcr,
>>>
>>>
>>>
>>> While it's still working I see this here with the levels changing 0-1-0.
>>> Though then it stops and levels are only at '1'.
>>>
>>> [ 1773.833824] kvm_pic_set_irq
>>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>>> [ 1773.834161] kvm_pic_set_irq
>>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>>> [ 1773.834193] kvm_pic_set_irq
>>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>>> [ 1773.835028] kvm_pic_set_irq
>>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>>> [ 1773.835542] kvm_pic_set_irq
>>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>>> [ 1773.889892] kvm_pic_set_irq
>>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>>> [...]
>>>
>>>
>>> I believe the last 5 shown calls can be ignored. After that the
>>> interrupts don't go through anymore.
>>>
>>> In the device model I see interrupts being raised and cleared. After the
>>> last one was cleared in 'my' device model, only interrupts are raised.
>>> This looks like as if the interrupt handler in the guest Linux was never
>>> run, thus the IRQ is never cleared and we're stuck.
>>>
>> User space is responsible for both setting and clearing that line. IRQ3
>> means you are using some serial device model? Then you should check what
>> its state is.
> Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git)
> from what I can see. There was no UART on IRQ3 before, though, but
> certainly it was the wrong IRQ for it.
>> Moreover, a complete picture of the kernel/user space interaction should
>> be obtainable by using fstrace for capturing kvm events.
>>
> Should it be working on IRQ3? If so, I'd look into it when I get a
> chance...

I don't know your customizations, so it's hard to tell if that should
work or not. IRQ3 is intended to be used by ISA devices on the PC
machine. Are you adding an ISA model, or what is your use case?

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/26/2011 07:09 AM, Jan Kiszka wrote:
> On 2011-01-26 13:05, Stefan Berger wrote:
>> On 01/26/2011 03:14 AM, Jan Kiszka wrote:
>>> On 2011-01-25 17:49, Stefan Berger wrote:
>>>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>>>> Do you see a chance to look closer at the issue yourself? E.g.
>>>>> instrument the kernel's irqchip models and dump their states once your
>>>>> guest is stuck?
>>>> The device runs on iRQ 3. So I applied this patch here.
>>>>
>>>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>>>> index 3cece05..8f4f94c 100644
>>>> --- a/arch/x86/kvm/i8259.c
>>>> +++ b/arch/x86/kvm/i8259.c
>>>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>>>> *s, int irq, int level)
>>>>    {
>>>>        int mask, ret = 1;
>>>>        mask = 1<<    irq;
>>>> -    if (s->elcr&    mask)    /* level triggered */
>>>> +    if (s->elcr&    mask)    /* level triggered */ {
>>>>            if (level) {
>>>>                ret = !(s->irr&    mask);
>>>>                s->irr |= mask;
>>>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>>>> kvm_kpic_state *s, int irq, int level)
>>>>                s->irr&= ~mask;
>>>>                s->last_irr&= ~mask;
>>>>            }
>>>> -    else    /* edge triggered */
>>>> +if (irq == 3)
>>>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>>>> s->irr);
>>>> +        }
>>>> +    else    /* edge triggered */ {
>>>>            if (level) {
>>>>                if ((s->last_irr&    mask) == 0) {
>>>>                    ret = !(s->irr&    mask);
>>>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct kvm_kpic_state
>>>> *s, int irq, int level)
>>>>                s->last_irr |= mask;
>>>>            } else
>>>>                s->last_irr&= ~mask;
>>>> -
>>>> +if (irq == 3)
>>>> +    printk("%s %d: level=%d, irr = %x\n", __FUNCTION__,__LINE__,level,
>>>> s->irr);
>>>> +        }
>>>>        return (s->imr&    mask) ? -1 : ret;
>>>>    }
>>>>
>>>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int
>>>> level)
>>>>
>>>>        pic_lock(s);
>>>>        if (irq>= 0&&    irq<    PIC_NUM_PINS) {
>>>> +if (irq == 3)
>>>> +printk("%s\n", __FUNCTION__);
>>>>            ret = pic_set_irq1(&s->pics[irq>>    3], irq&    7, level);
>>>>            pic_update_irq(s);
>>>>            trace_kvm_pic_set_irq(irq>>    3, irq&    7, s->pics[irq>>
>>>> 3].elcr,
>>>>
>>>>
>>>>
>>>> While it's still working I see this here with the levels changing 0-1-0.
>>>> Though then it stops and levels are only at '1'.
>>>>
>>>> [ 1773.833824] kvm_pic_set_irq
>>>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>>>> [ 1773.834161] kvm_pic_set_irq
>>>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>>>> [ 1773.834193] kvm_pic_set_irq
>>>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>>>> [ 1773.835028] kvm_pic_set_irq
>>>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>>>> [ 1773.835542] kvm_pic_set_irq
>>>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>>>> [ 1773.889892] kvm_pic_set_irq
>>>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>>>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>>>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>>>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>>>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>>>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>>>> [...]
>>>>
>>>>
>>>> I believe the last 5 shown calls can be ignored. After that the
>>>> interrupts don't go through anymore.
>>>>
>>>> In the device model I see interrupts being raised and cleared. After the
>>>> last one was cleared in 'my' device model, only interrupts are raised.
>>>> This looks like as if the interrupt handler in the guest Linux was never
>>>> run, thus the IRQ is never cleared and we're stuck.
>>>>
>>> User space is responsible for both setting and clearing that line. IRQ3
>>> means you are using some serial device model? Then you should check what
>>> its state is.
>> Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git)
>> from what I can see. There was no UART on IRQ3 before, though, but
>> certainly it was the wrong IRQ for it.
>>> Moreover, a complete picture of the kernel/user space interaction should
>>> be obtainable by using fstrace for capturing kvm events.
>>>
>> Should it be working on IRQ3? If so, I'd look into it when I get a
>> chance...
> I don't know your customizations, so it's hard to tell if that should
> work or not. IRQ3 is intended to be used by ISA devices on the PC
> machine. Are you adding an ISA model, or what is your use case?
>
The use case is to add a TPM device interface.

http://xenbits.xensource.com/xen-unstable.hg?file/1e56ac73b9b9/tools/ioemu/hw/tpm_tis.c

This one typically is connected to the LPC bus.

    Stefan

> Jan
>

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 5275 bytes --]

On 2011-01-26 14:08, Stefan Berger wrote:
> On 01/26/2011 07:09 AM, Jan Kiszka wrote:
>> On 2011-01-26 13:05, Stefan Berger wrote:
>>> On 01/26/2011 03:14 AM, Jan Kiszka wrote:
>>>> On 2011-01-25 17:49, Stefan Berger wrote:
>>>>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>>>>> Do you see a chance to look closer at the issue yourself? E.g.
>>>>>> instrument the kernel's irqchip models and dump their states once
>>>>>> your
>>>>>> guest is stuck?
>>>>> The device runs on iRQ 3. So I applied this patch here.
>>>>>
>>>>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>>>>> index 3cece05..8f4f94c 100644
>>>>> --- a/arch/x86/kvm/i8259.c
>>>>> +++ b/arch/x86/kvm/i8259.c
>>>>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct
>>>>> kvm_kpic_state
>>>>> *s, int irq, int level)
>>>>>    {
>>>>>        int mask, ret = 1;
>>>>>        mask = 1<<    irq;
>>>>> -    if (s->elcr&    mask)    /* level triggered */
>>>>> +    if (s->elcr&    mask)    /* level triggered */ {
>>>>>            if (level) {
>>>>>                ret = !(s->irr&    mask);
>>>>>                s->irr |= mask;
>>>>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>>>>> kvm_kpic_state *s, int irq, int level)
>>>>>                s->irr&= ~mask;
>>>>>                s->last_irr&= ~mask;
>>>>>            }
>>>>> -    else    /* edge triggered */
>>>>> +if (irq == 3)
>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>> __FUNCTION__,__LINE__,level,
>>>>> s->irr);
>>>>> +        }
>>>>> +    else    /* edge triggered */ {
>>>>>            if (level) {
>>>>>                if ((s->last_irr&    mask) == 0) {
>>>>>                    ret = !(s->irr&    mask);
>>>>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct
>>>>> kvm_kpic_state
>>>>> *s, int irq, int level)
>>>>>                s->last_irr |= mask;
>>>>>            } else
>>>>>                s->last_irr&= ~mask;
>>>>> -
>>>>> +if (irq == 3)
>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>> __FUNCTION__,__LINE__,level,
>>>>> s->irr);
>>>>> +        }
>>>>>        return (s->imr&    mask) ? -1 : ret;
>>>>>    }
>>>>>
>>>>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int
>>>>> level)
>>>>>
>>>>>        pic_lock(s);
>>>>>        if (irq>= 0&&    irq<    PIC_NUM_PINS) {
>>>>> +if (irq == 3)
>>>>> +printk("%s\n", __FUNCTION__);
>>>>>            ret = pic_set_irq1(&s->pics[irq>>    3], irq&    7, level);
>>>>>            pic_update_irq(s);
>>>>>            trace_kvm_pic_set_irq(irq>>    3, irq&    7, s->pics[irq>>
>>>>> 3].elcr,
>>>>>
>>>>>
>>>>>
>>>>> While it's still working I see this here with the levels changing
>>>>> 0-1-0.
>>>>> Though then it stops and levels are only at '1'.
>>>>>
>>>>> [ 1773.833824] kvm_pic_set_irq
>>>>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>>>>> [ 1773.834161] kvm_pic_set_irq
>>>>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>>>>> [ 1773.834193] kvm_pic_set_irq
>>>>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>>>>> [ 1773.835028] kvm_pic_set_irq
>>>>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>>>>> [ 1773.835542] kvm_pic_set_irq
>>>>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>>>>> [ 1773.889892] kvm_pic_set_irq
>>>>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>>>>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>>>>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>>>>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>>>>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>>>>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>>>>> [...]
>>>>>
>>>>>
>>>>> I believe the last 5 shown calls can be ignored. After that the
>>>>> interrupts don't go through anymore.
>>>>>
>>>>> In the device model I see interrupts being raised and cleared.
>>>>> After the
>>>>> last one was cleared in 'my' device model, only interrupts are raised.
>>>>> This looks like as if the interrupt handler in the guest Linux was
>>>>> never
>>>>> run, thus the IRQ is never cleared and we're stuck.
>>>>>
>>>> User space is responsible for both setting and clearing that line. IRQ3
>>>> means you are using some serial device model? Then you should check
>>>> what
>>>> its state is.
>>> Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git)
>>> from what I can see. There was no UART on IRQ3 before, though, but
>>> certainly it was the wrong IRQ for it.
>>>> Moreover, a complete picture of the kernel/user space interaction
>>>> should
>>>> be obtainable by using fstrace for capturing kvm events.
>>>>
>>> Should it be working on IRQ3? If so, I'd look into it when I get a
>>> chance...
>> I don't know your customizations, so it's hard to tell if that should
>> work or not. IRQ3 is intended to be used by ISA devices on the PC
>> machine. Are you adding an ISA model, or what is your use case?
>>
> The use case is to add a TPM device interface.
> 
> http://xenbits.xensource.com/xen-unstable.hg?file/1e56ac73b9b9/tools/ioemu/hw/tpm_tis.c
> 
> 
> This one typically is connected to the LPC bus.

I see. Do you also have the xen-free version of it? Maybe there are
still issues with proper qdev integration etc.

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 6159 bytes --]

On 2011-01-26 14:15, Jan Kiszka wrote:
> On 2011-01-26 14:08, Stefan Berger wrote:
>> On 01/26/2011 07:09 AM, Jan Kiszka wrote:
>>> On 2011-01-26 13:05, Stefan Berger wrote:
>>>> On 01/26/2011 03:14 AM, Jan Kiszka wrote:
>>>>> On 2011-01-25 17:49, Stefan Berger wrote:
>>>>>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>>>>>> Do you see a chance to look closer at the issue yourself? E.g.
>>>>>>> instrument the kernel's irqchip models and dump their states once
>>>>>>> your
>>>>>>> guest is stuck?
>>>>>> The device runs on iRQ 3. So I applied this patch here.
>>>>>>
>>>>>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>>>>>> index 3cece05..8f4f94c 100644
>>>>>> --- a/arch/x86/kvm/i8259.c
>>>>>> +++ b/arch/x86/kvm/i8259.c
>>>>>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct
>>>>>> kvm_kpic_state
>>>>>> *s, int irq, int level)
>>>>>>    {
>>>>>>        int mask, ret = 1;
>>>>>>        mask = 1<<    irq;
>>>>>> -    if (s->elcr&    mask)    /* level triggered */
>>>>>> +    if (s->elcr&    mask)    /* level triggered */ {
>>>>>>            if (level) {
>>>>>>                ret = !(s->irr&    mask);
>>>>>>                s->irr |= mask;
>>>>>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>>>>>> kvm_kpic_state *s, int irq, int level)
>>>>>>                s->irr&= ~mask;
>>>>>>                s->last_irr&= ~mask;
>>>>>>            }
>>>>>> -    else    /* edge triggered */
>>>>>> +if (irq == 3)
>>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>>> __FUNCTION__,__LINE__,level,
>>>>>> s->irr);
>>>>>> +        }
>>>>>> +    else    /* edge triggered */ {
>>>>>>            if (level) {
>>>>>>                if ((s->last_irr&    mask) == 0) {
>>>>>>                    ret = !(s->irr&    mask);
>>>>>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct
>>>>>> kvm_kpic_state
>>>>>> *s, int irq, int level)
>>>>>>                s->last_irr |= mask;
>>>>>>            } else
>>>>>>                s->last_irr&= ~mask;
>>>>>> -
>>>>>> +if (irq == 3)
>>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>>> __FUNCTION__,__LINE__,level,
>>>>>> s->irr);
>>>>>> +        }
>>>>>>        return (s->imr&    mask) ? -1 : ret;
>>>>>>    }
>>>>>>
>>>>>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int
>>>>>> level)
>>>>>>
>>>>>>        pic_lock(s);
>>>>>>        if (irq>= 0&&    irq<    PIC_NUM_PINS) {
>>>>>> +if (irq == 3)
>>>>>> +printk("%s\n", __FUNCTION__);
>>>>>>            ret = pic_set_irq1(&s->pics[irq>>    3], irq&    7, level);
>>>>>>            pic_update_irq(s);
>>>>>>            trace_kvm_pic_set_irq(irq>>    3, irq&    7, s->pics[irq>>
>>>>>> 3].elcr,
>>>>>>
>>>>>>
>>>>>>
>>>>>> While it's still working I see this here with the levels changing
>>>>>> 0-1-0.
>>>>>> Though then it stops and levels are only at '1'.
>>>>>>
>>>>>> [ 1773.833824] kvm_pic_set_irq
>>>>>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>>>>>> [ 1773.834161] kvm_pic_set_irq
>>>>>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>>>>>> [ 1773.834193] kvm_pic_set_irq
>>>>>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>>>>>> [ 1773.835028] kvm_pic_set_irq
>>>>>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>>>>>> [ 1773.835542] kvm_pic_set_irq
>>>>>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>>>>>> [ 1773.889892] kvm_pic_set_irq
>>>>>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>>>>>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>>>>>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>>>>>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>>>>>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>>>>>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>>>>>> [...]
>>>>>>
>>>>>>
>>>>>> I believe the last 5 shown calls can be ignored. After that the
>>>>>> interrupts don't go through anymore.
>>>>>>
>>>>>> In the device model I see interrupts being raised and cleared.
>>>>>> After the
>>>>>> last one was cleared in 'my' device model, only interrupts are raised.
>>>>>> This looks like as if the interrupt handler in the guest Linux was
>>>>>> never
>>>>>> run, thus the IRQ is never cleared and we're stuck.
>>>>>>
>>>>> User space is responsible for both setting and clearing that line. IRQ3
>>>>> means you are using some serial device model? Then you should check
>>>>> what
>>>>> its state is.
>>>> Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git)
>>>> from what I can see. There was no UART on IRQ3 before, though, but
>>>> certainly it was the wrong IRQ for it.
>>>>> Moreover, a complete picture of the kernel/user space interaction
>>>>> should
>>>>> be obtainable by using fstrace for capturing kvm events.
>>>>>
>>>> Should it be working on IRQ3? If so, I'd look into it when I get a
>>>> chance...
>>> I don't know your customizations, so it's hard to tell if that should
>>> work or not. IRQ3 is intended to be used by ISA devices on the PC
>>> machine. Are you adding an ISA model, or what is your use case?
>>>
>> The use case is to add a TPM device interface.
>>
>> http://xenbits.xensource.com/xen-unstable.hg?file/1e56ac73b9b9/tools/ioemu/hw/tpm_tis.c
>>
>>
>> This one typically is connected to the LPC bus.
> 
> I see. Do you also have the xen-free version of it? Maybe there are
> still issues with proper qdev integration etc.
> 

Without knowing the hardware spec or what is actually behind set_irq,
this looks at least suspicious:

[...]
if (off == TPM_REG_INT_STATUS) {
    /* clearing of interrupt flags */
    if ((val & INTERRUPTS_SUPPORTED) &&
        (s->loc[locty].ints & INTERRUPTS_SUPPORTED)) {
        s->set_irq(s->irq_opaque, s->irq, 0);
        s->irq_pending = 0;
    }
    s->loc[locty].ints &= ~(val & INTERRUPTS_SUPPORTED);
} else
[...]

The code does no
t check if there are ints left after masking out those provided in val.
Does that device already de-asserts the line if you only clear a single
interrupt reason?

BTW, irq_pending looks redundant, at least when using the qemu irq
subsystem.

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [Qemu-devel] Re: Errors on MMIO read access on VM suspend / resume operations

[Stefan Berger]

On 01/26/2011 08:31 AM, Jan Kiszka wrote:
> On 2011-01-26 14:15, Jan Kiszka wrote:
>> On 2011-01-26 14:08, Stefan Berger wrote:
>>> On 01/26/2011 07:09 AM, Jan Kiszka wrote:
>>>> On 2011-01-26 13:05, Stefan Berger wrote:
>>>>> On 01/26/2011 03:14 AM, Jan Kiszka wrote:
>>>>>> On 2011-01-25 17:49, Stefan Berger wrote:
>>>>>>> On 01/25/2011 02:26 AM, Jan Kiszka wrote:
>>>>>>>> Do you see a chance to look closer at the issue yourself? E.g.
>>>>>>>> instrument the kernel's irqchip models and dump their states once
>>>>>>>> your
>>>>>>>> guest is stuck?
>>>>>>> The device runs on iRQ 3. So I applied this patch here.
>>>>>>>
>>>>>>> diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
>>>>>>> index 3cece05..8f4f94c 100644
>>>>>>> --- a/arch/x86/kvm/i8259.c
>>>>>>> +++ b/arch/x86/kvm/i8259.c
>>>>>>> @@ -106,7 +106,7 @@ static inline int pic_set_irq1(struct
>>>>>>> kvm_kpic_state
>>>>>>> *s, int irq, int level)
>>>>>>>     {
>>>>>>>         int mask, ret = 1;
>>>>>>>         mask = 1<<     irq;
>>>>>>> -    if (s->elcr&     mask)    /* level triggered */
>>>>>>> +    if (s->elcr&     mask)    /* level triggered */ {
>>>>>>>             if (level) {
>>>>>>>                 ret = !(s->irr&     mask);
>>>>>>>                 s->irr |= mask;
>>>>>>> @@ -115,7 +115,10 @@ static inline int pic_set_irq1(struct
>>>>>>> kvm_kpic_state *s, int irq, int level)
>>>>>>>                 s->irr&= ~mask;
>>>>>>>                 s->last_irr&= ~mask;
>>>>>>>             }
>>>>>>> -    else    /* edge triggered */
>>>>>>> +if (irq == 3)
>>>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>>>> __FUNCTION__,__LINE__,level,
>>>>>>> s->irr);
>>>>>>> +        }
>>>>>>> +    else    /* edge triggered */ {
>>>>>>>             if (level) {
>>>>>>>                 if ((s->last_irr&     mask) == 0) {
>>>>>>>                     ret = !(s->irr&     mask);
>>>>>>> @@ -124,7 +127,9 @@ static inline int pic_set_irq1(struct
>>>>>>> kvm_kpic_state
>>>>>>> *s, int irq, int level)
>>>>>>>                 s->last_irr |= mask;
>>>>>>>             } else
>>>>>>>                 s->last_irr&= ~mask;
>>>>>>> -
>>>>>>> +if (irq == 3)
>>>>>>> +    printk("%s %d: level=%d, irr = %x\n",
>>>>>>> __FUNCTION__,__LINE__,level,
>>>>>>> s->irr);
>>>>>>> +        }
>>>>>>>         return (s->imr&     mask) ? -1 : ret;
>>>>>>>     }
>>>>>>>
>>>>>>> @@ -206,6 +211,8 @@ int kvm_pic_set_irq(void *opaque, int irq, int
>>>>>>> level)
>>>>>>>
>>>>>>>         pic_lock(s);
>>>>>>>         if (irq>= 0&&     irq<     PIC_NUM_PINS) {
>>>>>>> +if (irq == 3)
>>>>>>> +printk("%s\n", __FUNCTION__);
>>>>>>>             ret = pic_set_irq1(&s->pics[irq>>     3], irq&     7, level);
>>>>>>>             pic_update_irq(s);
>>>>>>>             trace_kvm_pic_set_irq(irq>>     3, irq&     7, s->pics[irq>>
>>>>>>> 3].elcr,
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> While it's still working I see this here with the levels changing
>>>>>>> 0-1-0.
>>>>>>> Though then it stops and levels are only at '1'.
>>>>>>>
>>>>>>> [ 1773.833824] kvm_pic_set_irq
>>>>>>> [ 1773.833827] pic_set_irq1 131: level=0, irr = 5b
>>>>>>> [ 1773.834161] kvm_pic_set_irq
>>>>>>> [ 1773.834163] pic_set_irq1 131: level=1, irr = 5b
>>>>>>> [ 1773.834193] kvm_pic_set_irq
>>>>>>> [ 1773.834195] pic_set_irq1 131: level=0, irr = 5b
>>>>>>> [ 1773.835028] kvm_pic_set_irq
>>>>>>> [ 1773.835031] pic_set_irq1 131: level=1, irr = 5b
>>>>>>> [ 1773.835542] kvm_pic_set_irq
>>>>>>> [ 1773.835545] pic_set_irq1 131: level=1, irr = 5b
>>>>>>> [ 1773.889892] kvm_pic_set_irq
>>>>>>> [ 1773.889894] pic_set_irq1 131: level=1, irr = 5b
>>>>>>> [ 1791.258793] pic_set_irq1 119: level=1, irr = d9
>>>>>>> [ 1791.258824] pic_set_irq1 119: level=0, irr = d1
>>>>>>> [ 1791.402476] pic_set_irq1 119: level=1, irr = d9
>>>>>>> [ 1791.402534] pic_set_irq1 119: level=0, irr = d1
>>>>>>> [ 1791.402538] pic_set_irq1 119: level=1, irr = d9
>>>>>>> [...]
>>>>>>>
>>>>>>>
>>>>>>> I believe the last 5 shown calls can be ignored. After that the
>>>>>>> interrupts don't go through anymore.
>>>>>>>
>>>>>>> In the device model I see interrupts being raised and cleared.
>>>>>>> After the
>>>>>>> last one was cleared in 'my' device model, only interrupts are raised.
>>>>>>> This looks like as if the interrupt handler in the guest Linux was
>>>>>>> never
>>>>>>> run, thus the IRQ is never cleared and we're stuck.
>>>>>>>
>>>>>> User space is responsible for both setting and clearing that line. IRQ3
>>>>>> means you are using some serial device model? Then you should check
>>>>>> what
>>>>>> its state is.
>>>>> Good hint. I moved it now to IRQ11 and it works fine now (with kvm-git)
>>>>> from what I can see. There was no UART on IRQ3 before, though, but
>>>>> certainly it was the wrong IRQ for it.
>>>>>> Moreover, a complete picture of the kernel/user space interaction
>>>>>> should
>>>>>> be obtainable by using fstrace for capturing kvm events.
>>>>>>
>>>>> Should it be working on IRQ3? If so, I'd look into it when I get a
>>>>> chance...
>>>> I don't know your customizations, so it's hard to tell if that should
>>>> work or not. IRQ3 is intended to be used by ISA devices on the PC
>>>> machine. Are you adding an ISA model, or what is your use case?
>>>>
>>> The use case is to add a TPM device interface.
>>>
>>> http://xenbits.xensource.com/xen-unstable.hg?file/1e56ac73b9b9/tools/ioemu/hw/tpm_tis.c
>>>
>>>
>>> This one typically is connected to the LPC bus.
>> I see. Do you also have the xen-free version of it? Maybe there are
>> still issues with proper qdev integration etc.
>>
> Without knowing the hardware spec or what is actually behind set_irq,
> this looks at least suspicious:
>
> [...]
> if (off == TPM_REG_INT_STATUS) {
>      /* clearing of interrupt flags */
>      if ((val&  INTERRUPTS_SUPPORTED)&&
>          (s->loc[locty].ints&  INTERRUPTS_SUPPORTED)) {
>          s->set_irq(s->irq_opaque, s->irq, 0);
>          s->irq_pending = 0;
>      }
>      s->loc[locty].ints&= ~(val&  INTERRUPTS_SUPPORTED);
> } else
> [...]
>
> The code does no
> t check if there are ints left after masking out those provided in val.
> Does that device already de-asserts the line if you only clear a single
> interrupt reason?
>
> BTW, irq_pending looks redundant, at least when using the qemu irq
> subsystem.
The code has substantially changed in the meantime -- the Xen repository 
code is from > 3 years ago - I had to go backwards in the xen unstable 
repository to find it. The link was merely meant to show what type of 
device is being added.  As said, some other things need to come together 
first before this will become available.

    Stefan