From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: memaccess: skipping mem_access_send_req Date: Fri, 17 Apr 2015 11:31:27 +0100 Message-ID: <1429266687.25195.257.camel@citrix.com> References: <1429090012.15516.155.camel@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Gareth Stockwell Cc: "stefano.stabellini@citrix.com" , "tklengyel@sec.in.tum.de" , "xen-devel (xen-devel@lists.xen.org)" List-Id: xen-devel@lists.xenproject.org On Fri, 2015-04-17 at 10:35 +0100, Gareth Stockwell wrote: > On Wed, Apr 15, 2015 at 10:26:52, Ian Campbell wrote: > > > We would like to use memaccess to perform (1) - but rather than > > Is the guest expected to be aware of this, i.e. to be somewhat > > paravirtualised? I suppose it must have to be in order to accept > > seemingly spurious page faults. > > > > Which leads me to wonder whether an extra shared ring between the > > hypervisor and target VCPU would be desirable, i.e. to allow more fine > > grained semantics than just "computer says no". Specifically if you > > need to care about the reason for the fault being the actions of an > > external arbiter rather than some other guest-internal thing. > > > > If your application is just to allow the guest OS to kill a process > > which has tried to touch memory in a way which the external controller > > has disallowed then a page fault seems like a simple and effective way though. > > The guest will be aware of the permission changes - in fact in our > system permission changes are only enacted following a request from > the guest itself. So, a data abort is sufficient - the guest should > then be able to work that this was due to it violating its stage-2 > permissions, and kill the appropriate process. Great, in which case this does seem to be a good approach. [...] > It seems to be the simplest approach, and based on some quick prototyping appears to work - at least on ARM. Excellent! Ian