Re: [PATCH v3 02/23] libxc: Implementation of XEN_XSPLICE_op in libxc (v5).

[Wei Liu <wei.liu2@citrix.com>]

On Fri, Feb 12, 2016 at 01:05:40PM -0500, Konrad Rzeszutek Wilk wrote:
> The underlaying toolstack code to do the basic
> operations when using the XEN_XSPLICE_op syscalls:
>  - upload the payload,
>  - get status of an payload,
>  - list all the payloads,
>  - apply, check, replace, and revert the payload.
> 
> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
> ---
> v2: Actually set zero for the _pad entries.
> v3: Split status into state and error code.
>     Add REPLACE action.
> v4: Use timeout and utilize pads.
> v5: Update per Wei's review.
> ---
>  tools/libxc/include/xenctrl.h |  19 ++-
>  tools/libxc/xc_misc.c         | 332 ++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 350 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/libxc/include/xenctrl.h b/tools/libxc/include/xenctrl.h
> index 1a5f4ec..7c666b7 100644
> --- a/tools/libxc/include/xenctrl.h
> +++ b/tools/libxc/include/xenctrl.h
> @@ -2573,9 +2573,26 @@ int xc_psr_cat_get_l3_info(xc_interface *xch, uint32_t socket,
>                             bool *cdp_enabled);
>  #endif
>  
> +int xc_xsplice_upload(xc_interface *xch,
> +                      char *name, unsigned char *payload, uint32_t size);
> +
> +int xc_xsplice_get(xc_interface *xch,
> +                   char *name,
> +                   xen_xsplice_status_t *status);
> +
> +int xc_xsplice_list(xc_interface *xch, unsigned int max, unsigned int start,
> +                    xen_xsplice_status_t *info, char *name,
> +                    uint32_t *len, unsigned int *done,
> +                    unsigned int *left);
> +
> +int xc_xsplice_apply(xc_interface *xch, char *name, uint32_t timeout);
> +int xc_xsplice_revert(xc_interface *xch, char *name, uint32_t timeout);
> +int xc_xsplice_unload(xc_interface *xch, char *name, uint32_t timeout);
> +int xc_xsplice_check(xc_interface *xch, char *name, uint32_t timeout);
> +int xc_xsplice_replace(xc_interface *xch, char *name, uint32_t timeout);
> +

What's the meaning of "timeout"? What can the caller expect from setting
that value? I think it either needs better name or better document.

>  /* Compat shims */
>  #include "xenctrl_compat.h"
> -

Stray blank line change.

>  #endif /* XENCTRL_H */
>  
>  /*
> diff --git a/tools/libxc/xc_misc.c b/tools/libxc/xc_misc.c
> index 124537b..b0f7068 100644
> --- a/tools/libxc/xc_misc.c
> +++ b/tools/libxc/xc_misc.c
> @@ -693,6 +693,338 @@ int xc_hvm_inject_trap(
>      return rc;
>  }
[...]
> +/*
> + * The heart of this function is to get an array of xen_xsplice_status_t.
> + *
> + * However it is complex because it has to deal with the hypervisor
> + * returning -EAGAIN or the data that is being returned becomes stale
> + * (another hypercall might alter the list).
> + *

I don't see EAGAIN handled in the following function. Is that expected?

> + * The parameters that the function expects to contain data from
> + * the hypervisor are: 'info', 'name', and 'len'. The 'done' and
> + * 'left' are also updated with the number of entries filled out
> + * and respectively the number of entries left to get from hypervisor.
> + *
> + * It is expected that the caller of this function will take the
> + * 'left' and use the value for 'start'. This way we have an
> + * cursor in the array. Note that the 'info','name', and 'len' will
> + * be updated at the subsequent calls.
> + *
> + * The 'max' is to be provided by the caller with the maximum
> + * number of entries that 'info', 'name', and 'len' arrays can
> + * be filled up with.
> + *
> + * Each entry in the 'name' array is expected to be of XEN_XSPLICE_NAME_SIZE
> + * length.
> + *
> + * Each entry in the 'info' array is expected to be of xen_xsplice_status_t
> + * structure size.
> + *
> + * Each entry in the 'len' array is expected to be of uint32_t size.
> + *
> + * The return value is zero if the hypercall completed successfully.
> + * Note that the return value is _not_ the amount of entries filled
> + * out - that is saved in 'done'.
> + *
> + * If there was an error performing the operation, the return value
> + * will contain an negative -EXX type value. The 'done' and 'left'
> + * will contain the number of entries that had been succesfully
> + * retrieved (if any).
> + */
> +int xc_xsplice_list(xc_interface *xch, unsigned int max, unsigned int start,
> +                    xen_xsplice_status_t *info,
> +                    char *name, uint32_t *len,
> +                    unsigned int *done,
> +                    unsigned int *left)
> +{
> +    int rc;
> +    DECLARE_SYSCTL;
> +    /* The sizes are adjusted later - hence zero. */
> +    DECLARE_HYPERCALL_BOUNCE(info, 0, XC_HYPERCALL_BUFFER_BOUNCE_OUT);
> +    DECLARE_HYPERCALL_BOUNCE(name, 0, XC_HYPERCALL_BUFFER_BOUNCE_OUT);
> +    DECLARE_HYPERCALL_BOUNCE(len, 0, XC_HYPERCALL_BUFFER_BOUNCE_OUT);
> +    uint32_t max_batch_sz, nr;
> +    uint32_t version = 0, retries = 0;
> +    uint32_t adjust = 0;
> +    ssize_t sz;
> +
> +    if ( !max || !info || !name || !len )
> +        return -1;
> +
> +    sysctl.cmd = XEN_SYSCTL_xsplice_op;
> +    sysctl.u.xsplice.cmd = XEN_SYSCTL_XSPLICE_LIST;
> +    sysctl.u.xsplice.pad = 0;
> +    sysctl.u.xsplice.u.list.version = 0;
> +    sysctl.u.xsplice.u.list.idx = start;
> +    sysctl.u.xsplice.u.list.pad = 0;
> +
> +    max_batch_sz = max;
> +    /* Convience value. */
> +    sz = sizeof(*name) * XEN_XSPLICE_NAME_SIZE;
> +    *done = 0;
> +    *left = 0;
> +    do {
> +        /*
> +         * The first time we go in this loop our 'max' may be bigger
> +         * than what the hypervisor is comfortable with - hence the first
> +         * couple of loops may adjust the number of entries we will
> +         * want filled (tracked by 'nr').
> +         */
> +        if ( adjust )
> +            adjust = 0; /* Used when adjusting the 'max_batch_sz' or 'retries'. */
> +

This is equivalent to always setting adjust to 0.

> +        nr = min(max - *done, max_batch_sz);
> +
> +        sysctl.u.xsplice.u.list.nr = nr;
> +        /* Fix the size (may vary between hypercalls). */
> +        HYPERCALL_BOUNCE_SET_SIZE(info, nr * sizeof(*info));
> +        HYPERCALL_BOUNCE_SET_SIZE(name, nr * nr);
> +        HYPERCALL_BOUNCE_SET_SIZE(len, nr * sizeof(*len));
> +        /* Move the pointer to proper offset into 'info'. */
> +        (HYPERCALL_BUFFER(info))->ubuf = info + *done;
> +        (HYPERCALL_BUFFER(name))->ubuf = name + (sz * *done);
> +        (HYPERCALL_BUFFER(len))->ubuf = len + *done;
> +        /* Allocate memory. */
> +        rc = xc_hypercall_bounce_pre(xch, info);
> +        if ( rc )
> +            break;
> +
> +        rc = xc_hypercall_bounce_pre(xch, name);
> +        if ( rc )
> +            break;
> +
> +        rc = xc_hypercall_bounce_pre(xch, len);
> +        if ( rc )
> +            break;
> +
> +        set_xen_guest_handle(sysctl.u.xsplice.u.list.status, info);
> +        set_xen_guest_handle(sysctl.u.xsplice.u.list.name, name);
> +        set_xen_guest_handle(sysctl.u.xsplice.u.list.len, len);
> +
> +        rc = do_sysctl(xch, &sysctl);
> +        /*
> +         * From here on we MUST call xc_hypercall_bounce. If rc < 0 we
> +         * end up doing it (outside the loop), so using a break is OK.
> +         */
> +        if ( rc < 0 && errno == E2BIG )
> +        {
> +            if ( max_batch_sz <= 1 )
> +                break;
> +            max_batch_sz >>= 1;
> +            adjust = 1; /* For the loop conditional to let us loop again. */
> +            /* No memory leaks! */
> +            xc_hypercall_bounce_post(xch, info);
> +            xc_hypercall_bounce_post(xch, name);
> +            xc_hypercall_bounce_post(xch, len);
> +            continue;
> +        }
> +        else if ( rc < 0 ) /* For all other errors we bail out. */
> +            break;
> +
> +        if ( !version )
> +            version = sysctl.u.xsplice.u.list.version;
> +
> +        if ( sysctl.u.xsplice.u.list.version != version )
> +        {
> +            /* We could make this configurable as parameter? */
> +            if ( retries++ > 3 )
> +            {
> +                rc = -1;
> +                errno = EBUSY;
> +                break;
> +            }
> +            *done = 0; /* Retry from scratch. */
> +            version = sysctl.u.xsplice.u.list.version;
> +            adjust = 1; /* And make sure we continue in the loop. */

Actually this "adjust" variable looks useless to me because you always
use "continue" afterwards. It won't ever get used in "while".

> +            /* No memory leaks. */
> +            xc_hypercall_bounce_post(xch, info);
> +            xc_hypercall_bounce_post(xch, name);
> +            xc_hypercall_bounce_post(xch, len);
> +            continue;
> +        }
> +
> +        /* We should never hit this, but just in case. */
> +        if ( rc > nr )
> +        {
> +            errno = EINVAL; /* Overflow! */

Use EOVERFLOW?

> +            rc = -1;
> +            break;
> +        }
> +        *left = sysctl.u.xsplice.u.list.nr; /* Total remaining count. */
> +        /* Copy only up 'rc' of data' - we could add 'min(rc,nr) if desired. */
> +        HYPERCALL_BOUNCE_SET_SIZE(info, (rc * sizeof(*info)));
> +        HYPERCALL_BOUNCE_SET_SIZE(name, (rc * sz));
> +        HYPERCALL_BOUNCE_SET_SIZE(len, (rc * sizeof(*len)));
> +        /* Bounce the data and free the bounce buffer. */
> +        xc_hypercall_bounce_post(xch, info);
> +        xc_hypercall_bounce_post(xch, name);
> +        xc_hypercall_bounce_post(xch, len);
> +        /* And update how many elements of info we have copied into. */
> +        *done += rc;
> +        /* Update idx. */
> +        sysctl.u.xsplice.u.list.idx = *done;
> +    } while ( adjust || (*done < max && *left != 0) );
> +
> +    if ( rc < 0 )
> +    {
> +        xc_hypercall_bounce_post(xch, len);
> +        xc_hypercall_bounce_post(xch, name);
> +        xc_hypercall_bounce_post(xch, info);
> +    }
> +
> +    return rc > 0 ? 0 : rc;
> +}
> +

Wei.