On Fri, May 29, 2020 at 09:18:42AM +0000, Bertrand Marquis wrote: > Hi Jan, > > > On 29 May 2020, at 09:45, Jan Beulich <jbeul...@suse.com> wrote: > > > > On 29.05.2020 10:13, Bertrand Marquis wrote: > >>> On 28 May 2020, at 19:54, Julien Grall <jul...@xen.org> wrote: > >>> AFAICT, there is no restriction on when the runstate hypercall can be > >>> called. So this can even be called before the vCPU is brought up. > >> > >> I understand the remark but it still feels very weird to allow an invalid > >> address in an hypercall. > >> Wouldn’t we have a lot of potential issues accepting an address that we > >> cannot check ? > > > > I don't think so: The hypervisor uses copy_to_guest() to protect > > itself from the addresses to be invalid at the time of copying. > > If the guest doesn't make sure they're valid at that time, it > > simply won't get the information (perhaps until Xen's next > > attempt to copy it out). > > > > You may want to take a look at the x86 side of this (also the > > vCPU time updating): Due to the way x86-64 PV guests work, the > > address may legitimately be unmapped at the time Xen wants to > > copy it, when the vCPU is currently executing guest user mode > > code. In such a case the copy gets retried the next time the > > guest transitions from user to kernel mode (which involves a > > page table change). > > If I understand everything correctly runstate is updated only if there is > a context switch in xen while the guest is running in kernel mode and > if the address is mapped at that time. > > So this is a best effort in Xen and the guest cannot really rely on the > runstate information (as it might not be up to date). > Could this have impacts somehow if this is used for scheduling ? > > In the end the only accepted trade off would be to: > - reduce error verbosity and just ignore it > - introduce a new system call using a physical address > -> Using a virtual address with restrictions sounds very complex > to document (current core, no remapping). > > But it feels like having only one hypercall using guest physical addresses > would not really be logic and this kind of change should be made across > all hypercalls if it is done.
FRT, there are other hypercalls using a physical address instead of a linear one, see VCPUOP_register_vcpu_info for example. It's just a mixed bag right now, with some hypercalls using a linear address and some using a physical one. I think introducing a new hypercall that uses a physical address would be fine, and then you can add a set of restrictions similar to the ones listed by VCPUOP_register_vcpu_info. Changing the current hypercall as proposed is risky, but I think the current behavior is broken by design specially on auto translated guests, even more with XPTI. Thanks, Roger.
