Re: memaccess: skipping mem_access_send_req

[Ian Campbell <ian.campbell@citrix.com>]

On Fri, 2015-04-10 at 16:04 +0100, Gareth Stockwell wrote:

> We would like to use memaccess to perform (1) - but rather than
> pausing the VCPU in (2), instead simply directly inject the exception
> into the VCPU.

That is, into the VCPUs whose permissions have been modified behind its
back and not into some controlling domain?

Is the guest expected to be aware of this, i.e. to be somewhat
paravirtualised? I suppose it must have to be in order to accept
seemingly spurious page faults.

Which leads me to wonder whether an extra shared ring between the
hypervisor and target VCPU would be desirable, i.e. to allow more fine
grained semantics than just "computer says no". Specifically if you need
to care about the reason for the fault being the actions of an external
arbiter rather than some other guest-internal thing.

If your application is just to allow the guest OS to kill a process
which has tried to touch memory in a way which the external controller
has disallowed then a page fault seems like a simple and effective way
though.

> b) Define new xenmem_access_t values which cause the exception handler
> to reinject rather than adding a message to the ring buffer.

I'm no xenaccess guru but that's the option I'd be inclined to take.

My only concern would be limitations on the number of xenaccess types.
On ARM we couldn't fit the type into the spare P2M PTE bits so we will
already have a separate lookup and therefore not much limitation, but I
don't know about on x86.

Ian.