[Xen-changelog] [xen-unstable] x86: Detect shadow-emulate write to stack from inside the write

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1172157736 0
# Node ID 9e35371a3caa3fa3be2af51f48c88c99932d6141
# Parent  644e9e18d2efbf4ad8f56f78e21a438e83302c79
x86: Detect shadow-emulate write to stack from inside the write
handler, where we can quite conveniently check whether the access
segment is SS. This will only give a false positive for non-stack
writes that override the destination segment to SS, which it is
probably safe to assume will never happen when the destination is a
legitimate page table!

For now, instead of bailing and unshadowing just increment a perfctr
and we'll see if that increases fast under any reasonable workload.

Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
---
 xen/arch/x86/mm/shadow/common.c  |    4 ++++
 xen/arch/x86/mm/shadow/multi.c   |   17 -----------------
 xen/include/asm-x86/perfc_defn.h |    1 +
 3 files changed, 5 insertions(+), 17 deletions(-)

diff -r 644e9e18d2ef -r 9e35371a3caa xen/arch/x86/mm/shadow/common.c
--- a/xen/arch/x86/mm/shadow/common.c   Thu Feb 22 14:58:26 2007 +0000
+++ b/xen/arch/x86/mm/shadow/common.c   Thu Feb 22 15:22:16 2007 +0000
@@ -274,6 +274,10 @@ hvm_emulate_write(enum x86_segment seg,
     struct vcpu *v = current;
     unsigned long addr;
     int rc;
+
+    /* How many emulations could we save if we unshadowed on stack writes? */
+    if ( seg == x86_seg_ss )
+        perfc_incrc(shadow_fault_emulate_stack);
 
     rc = hvm_translate_linear_addr(
         seg, offset, bytes, hvm_access_write, sh_ctxt, &addr);
diff -r 644e9e18d2ef -r 9e35371a3caa xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c    Thu Feb 22 14:58:26 2007 +0000
+++ b/xen/arch/x86/mm/shadow/multi.c    Thu Feb 22 15:22:16 2007 +0000
@@ -2924,23 +2924,6 @@ static int sh_page_fault(struct vcpu *v,
     SHADOW_PRINTK("emulate: eip=%#lx esp=%#lx\n", 
                   (unsigned long)regs->eip, (unsigned long)regs->esp);
 
-    /*
-     * Check whether this looks like a stack operation. If so, unshadow the
-     * faulting page. We can allow this to fail: if it does fail then we
-     * carry on and emulate, otherwise we bail immediately. Failure is
-     * tolerated because this is only a heuristic (e.g., stack segment base
-     * address is ignored).
-     */
-    if ( unlikely((va & PAGE_MASK) == (regs->esp & PAGE_MASK)) )
-    {
-        gdprintk(XENLOG_DEBUG, "guest stack is on a shadowed frame: "
-                 "%%esp=%#lx, cr2=%#lx, mfn=%#lx\n", 
-                 (unsigned long)regs->esp, va, mfn_x(gmfn));
-        sh_remove_shadows(v, gmfn, 0 /* thorough */, 0 /* can fail */);
-        if ( !(mfn_to_page(gmfn)->count_info & PGC_page_table) )
-            goto done;
-    }
-
     emul_ops = shadow_init_emulation(&emul_ctxt, regs);
 
     /*
diff -r 644e9e18d2ef -r 9e35371a3caa xen/include/asm-x86/perfc_defn.h
--- a/xen/include/asm-x86/perfc_defn.h  Thu Feb 22 14:58:26 2007 +0000
+++ b/xen/include/asm-x86/perfc_defn.h  Thu Feb 22 15:22:16 2007 +0000
@@ -56,6 +56,7 @@ PERFCOUNTER_CPU(shadow_fault_emulate_rea
 PERFCOUNTER_CPU(shadow_fault_emulate_read, "shadow_fault emulates a read")
 PERFCOUNTER_CPU(shadow_fault_emulate_write, "shadow_fault emulates a write")
 PERFCOUNTER_CPU(shadow_fault_emulate_failed, "shadow_fault emulator fails")
+PERFCOUNTER_CPU(shadow_fault_emulate_stack, "shadow_fault emulate stack write")
 PERFCOUNTER_CPU(shadow_fault_mmio,     "shadow_fault handled as mmio")
 PERFCOUNTER_CPU(shadow_fault_fixed,    "shadow_fault fixed fault")
 PERFCOUNTER_CPU(shadow_ptwr_emulate,   "shadow causes ptwr to emulate")

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog