Re: [PATCH RFC] evtchn: introduce EVTCHNOP_fifo_destroy hypercall

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 18/07/14 16:42, Vitaly Kuznetsov wrote:
> New hypercall is required to allow guest to perform kexec when FIFO-based
> event channel ABI is being used. This hypercall simply exposes evtchn_fifo_destroy()
> function which cleans up all control blocks for all vcpus and frees event array
> for the domain.
>
> With this hypercall guest can do something like:
>        struct evtchn_destroy_fifo destroy;
>
>        destroy.dom = DOMID_SELF;
>        HYPERVISOR_event_channel_op(EVTCHNOP_destroy_fifo, &destroy);
>
> before doing
>        HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
> for the first vcpu on init.
>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

In principle, this is a good idea.  However, I would opt for making
EVTCHNOP_reset which is subsystem agnostic.

Xen is perfectly capable of working out which evtchn subsystem a domain
is using, and to call the appropriate cleanup function.  It will prevent
the next evtchn subsystem needing to create EVTCHNOP_destroy_$FOO.

> ---
>  xen/common/event_channel.c         | 30 ++++++++++++++++++++++++++++++
>  xen/common/event_fifo.c            |  1 +
>  xen/include/public/event_channel.h |  7 +++++++
>  3 files changed, 38 insertions(+)
>
> diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
> index db952af..9bc18b2 100644
> --- a/xen/common/event_channel.c
> +++ b/xen/common/event_channel.c
> @@ -939,6 +939,26 @@ int evtchn_unmask(unsigned int port)
>      return 0;
>  }
>  
> +static long evtchn_fifo_destroy_all(domid_t dom)
> +{
> +	struct domain *d;
> +	int rc;
> +
> +	d = rcu_lock_domain_by_any_id(dom);
> +	if ( d == NULL )
> +		return -ESRCH;
> +
> +	rc = xsm_evtchn_reset(XSM_TARGET, current->domain, d);
> +	if ( rc )
> +		goto out;
> +
> +	evtchn_fifo_destroy(d);
> +
> +out:
> +	rcu_unlock_domain(d);
> +
> +	return rc;
> +}
>  
>  static long evtchn_reset(evtchn_reset_t *r)
>  {
> @@ -1121,6 +1141,16 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
>          break;
>      }
>  
> +	case EVTCHNOP_fifo_destroy: {

Style - braces on new lines.

> +		struct evtchn_fifo_destroy destroy;

Style - newline after parameter declarations.

> +		if ( copy_from_guest(&destroy, arg, 1) != 0 )
> +			return -EFAULT;
> +		if ( destroy.dom != DOMID_SELF )
> +			return -EPERM;
> +		rc = evtchn_fifo_destroy_all(destroy.dom);
> +		break;
> +	}
> +
>      default:
>          rc = -ENOSYS;
>          break;
> diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
> index 1fce3f1..51b4ff6 100644
> --- a/xen/common/event_fifo.c
> +++ b/xen/common/event_fifo.c
> @@ -451,6 +451,7 @@ static void cleanup_event_array(struct domain *d)
>      for ( i = 0; i < EVTCHN_FIFO_MAX_EVENT_ARRAY_PAGES; i++ )
>          unmap_guest_page(d->evtchn_fifo->event_array[i]);
>      xfree(d->evtchn_fifo);
> +    d->evtchn_fifo = NULL;
>  }
>  
>  static void setup_ports(struct domain *d)
> diff --git a/xen/include/public/event_channel.h b/xen/include/public/event_channel.h
> index 49ac8cc..79b6e86 100644
> --- a/xen/include/public/event_channel.h
> +++ b/xen/include/public/event_channel.h
> @@ -74,6 +74,7 @@
>  #define EVTCHNOP_init_control    11
>  #define EVTCHNOP_expand_array    12
>  #define EVTCHNOP_set_priority    13
> +#define EVTCHNOP_fifo_destroy    14
>  /* ` } */
>  
>  typedef uint32_t evtchn_port_t;
> @@ -308,6 +309,12 @@ struct evtchn_set_priority {
>  };
>  typedef struct evtchn_set_priority evtchn_set_priority_t;
>  
> +struct evtchn_fifo_destroy {
> +	/* IN parameters. */
> +	domid_t dom;
> +};
> +typedef struct evtchn_fifo_destroy evtchn_fifo_destroy_t;
> +

DOMID_SELF is the only sensible parameter for this.  I would suggest a
parameterless hypercall which unconditionally operates on the current
domain in context.

~Andrew

>  /*
>   * ` enum neg_errnoval
>   * ` HYPERVISOR_event_channel_op_compat(struct evtchn_op *op)