Re: [PATCH 10 of 24] libxc: infrastructure for hypercall safe data buffers

[Jeremy Fitzhardinge <jeremy@goop.org>]

 On 09/06/2010 11:38 PM, Ian Campbell wrote:
> # HG changeset patch
> # User Ian Campbell <ian.campbell@citrix.com>
> # Date 1283779691 -3600
> # Node ID bf7fb64762eb7decea9a6804460f0f966496ba07
> # Parent  7b45202f78cd82d320fb32fea67c0a618697baec
> libxc: infrastructure for hypercall safe data buffers.
>
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
>
> diff -r 7b45202f78cd -r bf7fb64762eb tools/libxc/Makefile
> --- a/tools/libxc/Makefile	Mon Sep 06 14:28:11 2010 +0100
> +++ b/tools/libxc/Makefile	Mon Sep 06 14:28:11 2010 +0100
> @@ -27,6 +27,7 @@ CTRL_SRCS-y       += xc_mem_event.c
>  CTRL_SRCS-y       += xc_mem_event.c
>  CTRL_SRCS-y       += xc_mem_paging.c
>  CTRL_SRCS-y       += xc_memshr.c
> +CTRL_SRCS-y       += xc_hcall_buf.c
>  CTRL_SRCS-y       += xtl_core.c
>  CTRL_SRCS-y       += xtl_logger_stdio.c
>  CTRL_SRCS-$(CONFIG_X86) += xc_pagetab.c
> diff -r 7b45202f78cd -r bf7fb64762eb tools/libxc/xc_hcall_buf.c
> --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
> +++ b/tools/libxc/xc_hcall_buf.c	Mon Sep 06 14:28:11 2010 +0100
> @@ -0,0 +1,147 @@
> +/*
> + * Copyright (c) 2010, Citrix Systems, Inc.
> + *
> + * This library is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Lesser General Public
> + * License as published by the Free Software Foundation;
> + * version 2.1 of the License.
> + *
> + * This library is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> + * Lesser General Public License for more details.
> + *
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with this library; if not, write to the Free Software
> + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
> + */
> +
> +#include <inttypes.h>
> +#include "xc_private.h"
> +#include "xg_private.h"
> +
> +DECLARE_NAMED_HYPERCALL_BUFFER(HYPERCALL_BUFFER_NULL);
> +
> +void *xc__hypercall_buffer_alloc_pages(xc_interface *xch, xc_hypercall_buffer_t *b, int nr_pages)
> +{
> +    size_t size = nr_pages * PAGE_SIZE;
> +    void *p;
> +#if defined(_POSIX_C_SOURCE) && !defined(__sun__)
> +    int ret;
> +    ret = posix_memalign(&p, PAGE_SIZE, size);
> +    if (ret != 0)
> +        return NULL;
> +#elif defined(__NetBSD__) || defined(__OpenBSD__)
> +    p = valloc(size);
> +#else
> +    p = memalign(PAGE_SIZE, size);
> +#endif
> +
> +    if (!p)
> +        return NULL;
> +
> +#ifndef __sun__
> +    if ( mlock(p, size) < 0 )
> +    {
> +        free(p);
> +        return NULL;
> +    }
> +#endif
> +
> +    b->hbuf = p;
> +
> +    memset(p, 0, size);
> +    return b->hbuf;
> +}
> +
> +void xc__hypercall_buffer_free_pages(xc_interface *xch, xc_hypercall_buffer_t *b, int nr_pages)
> +{
> +    if ( b->hbuf == NULL )
> +        return;
> +
> +#ifndef __sun__
> +    (void) munlock(b->hbuf, nr_pages * PAGE_SIZE);
> +#endif
> +
> +    free(b->hbuf);
> +}

How does this end up making the memory suitable for passing to Xen? 
Where does it get locked down in the non-__sun__ case?  And why just
__sun__ here?

Is there any way to make memory hypercall-safe with existing syscalls,
or does/will it end up copying from this memory into the kernel before
issuing the hypercall?  Or adding some other mechanism for pinning down
the pages?

    J