x86/mm: Improve ring management for memory events. Do not lose guest events

This patch is an amalgamation of the work done by Olaf Hering <olaf@aepfle.de>
and our work.

It combines logic changes to simplify the memory event API, as well as
leveraging wait queues to deal with extreme conditions in which too many
events are generated by a guest vcpu.

In order to generate a new event, a slot in the ring is claimed. If a
guest vcpu is generating the event and there is no space, it is put on a
wait queue. If a foreign vcpu is generating the event and there is no
space, the vcpu is expected to retry its operation. If an error happens
later, the function returns the claimed slot via a cancel operation.

Thus, the API has only four calls: claim slot, cancel claimed slot, put
request in the ring, consume the response.

With all these mechanisms, no guest events are lost.
Our testing includes 1. ballooning down 512 MiBs; 2. using mem access n2rwx, in
which every page access in a four-vCPU guest results in an event, with no vCPU
pausing, and the four vCPUs touching all RAM. No guest events were lost in
either case, and qemu-dm had no mapping problems.

Signed-off-by: Adin Scannell <adin@scannell.ca>
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
index cea95b27f8..313a459be3 100644
--- a/xen/include/xen/mm.h
+++ b/xen/include/xen/mm.h
@@ -317,6 +317,8 @@ page_list_splice(struct page_list_head *list, struct page_list_head *head)
 
 void scrub_one_page(struct page_info *);
 
+/* Returns 1 on success, 0 on error, negative if the ring
+ * for event propagation is full in the presence of paging */
 int guest_remove_page(struct domain *d, unsigned long gmfn);
 
 #define RAM_TYPE_CONVENTIONAL 0x00000001