Re: [RFC PATCH 1/1] xen: Use a global mapping for runstate

[Bertrand Marquis <Bertrand.Marquis@xxxxxxx>]

> On 29 May 2020, at 10:27, Roger Pau Monné <roger@xxxxxxx> wrote:
> 
> On Fri, May 29, 2020 at 09:18:42AM +0000, Bertrand Marquis wrote:
>> Hi Jan,
>> 
>>> On 29 May 2020, at 09:45, Jan Beulich <jbeulich@xxxxxxxx> wrote:
>>> 
>>> On 29.05.2020 10:13, Bertrand Marquis wrote:
>>>>> On 28 May 2020, at 19:54, Julien Grall <julien@xxxxxxx> wrote:
>>>>> AFAICT, there is no restriction on when the runstate hypercall can be 
>>>>> called. So this can even be called before the vCPU is brought up.
>>>> 
>>>> I understand the remark but it still feels very weird to allow an invalid 
>>>> address in an hypercall.
>>>> Wouldn’t we have a lot of potential issues accepting an address that we 
>>>> cannot check ?
>>> 
>>> I don't think so: The hypervisor uses copy_to_guest() to protect
>>> itself from the addresses to be invalid at the time of copying.
>>> If the guest doesn't make sure they're valid at that time, it
>>> simply won't get the information (perhaps until Xen's next
>>> attempt to copy it out).
>>> 
>>> You may want to take a look at the x86 side of this (also the
>>> vCPU time updating): Due to the way x86-64 PV guests work, the
>>> address may legitimately be unmapped at the time Xen wants to
>>> copy it, when the vCPU is currently executing guest user mode
>>> code. In such a case the copy gets retried the next time the
>>> guest transitions from user to kernel mode (which involves a
>>> page table change).
>> 
>> If I understand everything correctly runstate is updated only if there is
>> a context switch in xen while the guest is running in kernel mode and
>> if the address is mapped at that time.
>> 
>> So this is a best effort in Xen and the guest cannot really rely on the
>> runstate information (as it might not be up to date).
>> Could this have impacts somehow if this is used for scheduling ?
>> 
>> In the end the only accepted trade off would be to:
>> - reduce error verbosity and just ignore it
>> - introduce a new system call using a physical address
>>  -> Using a virtual address with restrictions sounds very complex
>>  to document (current core, no remapping).
>> 
>> But it feels like having only one hypercall using guest physical addresses
>> would not really be logic and this kind of change should be made across
>> all hypercalls if it is done.
> 
> FRT, there are other hypercalls using a physical address instead of a
> linear one, see VCPUOP_register_vcpu_info for example. It's just a
> mixed bag right now, with some hypercalls using a linear address and
> some using a physical one.
> 
> I think introducing a new hypercall that uses a physical address would
> be fine, and then you can add a set of restrictions similar to the
> ones listed by VCPUOP_register_vcpu_info.

Yes I found that and I also wondered why runstate was not included in the 
vcpu_info in fact.

> 
> Changing the current hypercall as proposed is risky, but I think the
> current behavior is broken by design specially on auto translated
> guests, even more with XPTI.
> 
> Thanks, Roger.