Re: [PATCH] libxc: Expose the pdpe1gb cpuid flag to guest

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 17/11/14 17:00, Tim Deegan wrote:
> At 16:40 +0000 on 17 Nov (1416238835), Andrew Cooper wrote:
>> On 17/11/14 16:30, Tim Deegan wrote:
>>> At 16:24 +0000 on 17 Nov (1416237888), Jan Beulich wrote:
>>>>>>> On 17.11.14 at 16:39, <Ian.Jackson@eu.citrix.com> wrote:
>>>>> Liang Li writes ("[PATCH] libxc: Expose the pdpe1gb cpuid flag to guest"):
>>>>>> If hardware support the pdpe1gb flag, expose it to guest by default.
>>>>>> Users don't have to use a 'cpuid= ' option in config file to turn
>>>>>> it on.
>>>>> I don't understand what this flag does.  I guess from the name it
>>>>> turns on 1G pages.  I guess these are supported ?
>>>>>
>>>>> I would like to see comment from an x86 hypervisor maintainer.
>>>> Yes, we support 1Gb pages. The purpose of the patch is to not
>>>> unconditionally hide the flag from guests. (I had commented on
>>>> v1, but sadly this one wasn't tagged as v2, nor was I included on
>>>> the Cc list, hence I didn't spot the new version.)
>>>>
>>>> The one thing I'm not certain about is shadow mode: Only 2Mb
>>>> pages may be supported there. Tim?
>>> Indeed, only 2MiB pages are supported in shadow mode.  See, e.g.
>>> guest_supports_1G_superpages()->hvm_pse1gb_supported()->paging_mode_hap()
>> This is yet another case which proves that libxc is the wrong place to
>> be choosing the cpuid flags exposed to a domain.
>>
>> Furthermore, guest_supports_1G_superpages() is insufficient as it only
>> checks whether the host is capable of providing 1G superpages, not
>> whether the guest has been permitted to use it.
>>
>> This causes a problem when migrating between hap-capable and
>> hap-incapable systems.
> There's no notion of 'permitted' to use 1G pages, AFAICS, much like
> other CPU features.  But of course a _well-behaved_ guest that has
> been told in cpuid not to use 1G superpages will have no problems. :)

That is my point.

If 1GB pages are not supported (i.e. not present in cpuid), then the PS
bit in an L3 is reserved, must be 0, and cause a pagefault if used.

Nothing in Xen currently enforces this because
guest_supports_1G_superpages() doesn't check domain_cpuid().

It does however make me wonder how VMX/SVM non-root mode would enforce
this as it would see the host cpuid, not guest cpuid when performing
paging internally.

~Andrew