All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 00 of 25] libxc: Hypercall buffers
@ 2010-10-22 14:15 Ian Campbell
  2010-10-22 14:15 ` [PATCH 01 of 25] libxc: infrastructure for hypercall safe data buffers Ian Campbell
                   ` (25 more replies)
  0 siblings, 26 replies; 41+ messages in thread
From: Ian Campbell @ 2010-10-22 14:15 UTC (permalink / raw)
  To: xen-devel; +Cc: Ian Campbell

libxc currently locks various on-stack data structures present on the
stack using mlock(2) in order to try and make them safe for passing to
hypercalls (which requires the memory to be mapped)

There are several issues with this approach:

1) mlock/munlock do not nest, therefore mlocking multiple pieces of
   data on the stack which happen to share a page causes everything to
   be unlocked on the first munlock not the last. This is likely to be
   currently OK for the uses in libxc taken in isolation but could
   impact any caller of libxc which uses mlock itself.
2) mlocking only parts of the stack is considered by many to be a
   dubious, if strictly speaking allowed by the relevant
   specifications, use of mlock.
3) mlock may not provide the required semantics needed for hypercall
   safe memory. mlock simply ensures that there can be no major
   faults (page faults requiring I/O to satisfy) but does not
   necessarily rule out minor faults (e.g. due to page migration)

The following introduces an explicit hypercall-safe memory pool API
which includes support for bouncing user-supplied memory buffers into
suitable memory.

This series addresses (1) and (2) but does not directly address (3)
other than by encapsulating the code which acquires hypercall safe
memory into one place where it can be more easily fixed.

There is also the slightly separate issue of code which forgets to
lock buffers as necessary and therefor this series overrides the Xen
guest-handle interfaces to attempt to improve compile-time checking
for the correct use of the memory pool. This scheme works for the
pointers contained within hypercall argument structures but doesn't
catch the actual hypercall arguments themselves. I'm open to
suggestions on how to extend it cleanly to catch those cases.

The bits which touch ia64 are not even compile tested since I do not
have access to a suitable userspace-capable cross compiler.

Changes since last time:
  - rebased on top of recent cpupool changes, conflicts in
    xc_cpupool_getinfo and xc_cpupool_freeinfo.

^ permalink raw reply	[flat|nested] 41+ messages in thread
* [PATCH 00 of 25] libxc: Hypercall buffers
@ 2010-10-21 10:58 Ian Campbell
  2010-10-22 12:06 ` Ian Campbell
  0 siblings, 1 reply; 41+ messages in thread
From: Ian Campbell @ 2010-10-21 10:58 UTC (permalink / raw)
  To: xen-devel; +Cc: Ian Campbell

libxc currently locks various on-stack data structures present on the
stack using mlock(2) in order to try and make them safe for passing to
hypercalls (which requires the memory to be mapped)

There are several issues with this approach:

1) mlock/munlock do not nest, therefore mlocking multiple pieces of
   data on the stack which happen to share a page causes everything to
   be unlocked on the first munlock not the last. This is likely to be
   currently OK for the uses in libxc taken in isolation but could
   impact any caller of libxc which uses mlock itself.
2) mlocking only parts of the stack is considered by many to be a
   dubious, if strictly speaking allowed by the relevant
   specifications, use of mlock.
3) mlock may not provide the required semantics needed for hypercall
   safe memory. mlock simply ensures that there can be no major
   faults (page faults requiring I/O to satisfy) but does not
   necessarily rule out minor faults (e.g. due to page migration)

The following introduces an explicit hypercall-safe memory pool API
which includes support for bouncing user-supplied memory buffers into
suitable memory.

This series addresses (1) and (2) but does not directly address (3)
other than by encapsulating the code which acquires hypercall safe
memory into one place where it can be more easily fixed.

There is also the slightly separate issue of code which forgets to
lock buffers as necessary and therefor this series overrides the Xen
guest-handle interfaces to attempt to improve compile-time checking
for the correct use of the memory pool. This scheme works for the
pointers contained within hypercall argument structures but doesn't
catch the actual hypercall arguments themselves. I'm open to
suggestions on how to extend it cleanly to catch those cases.

The bits which touch ia64 are not even compile tested since I do not
have access to a suitable userspace-capable cross compiler.

^ permalink raw reply	[flat|nested] 41+ messages in thread

end of thread, other threads:[~2010-10-27 15:45 UTC | newest]

Thread overview: 41+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-22 14:15 [PATCH 00 of 25] libxc: Hypercall buffers Ian Campbell
2010-10-22 14:15 ` [PATCH 01 of 25] libxc: infrastructure for hypercall safe data buffers Ian Campbell
2010-10-25 16:04   ` Ian Campbell
2010-10-26 11:23     ` Ian Jackson
2010-10-26 15:17       ` Olaf Hering
2010-10-26 15:24         ` Ian Campbell
2010-10-26 16:38           ` Ian Campbell
2010-10-26 18:47             ` Ian Campbell
2010-10-27  6:30               ` Olaf Hering
2010-10-27 11:25               ` Ian Jackson
2010-10-25 16:05   ` Ian Campbell
2010-10-22 14:15 ` [PATCH 02 of 25] libxc: convert xc_version over to hypercall buffers Ian Campbell
2010-10-22 14:15 ` [PATCH 03 of 25] libxc: convert domctl interfaces " Ian Campbell
2010-10-22 14:15 ` [PATCH 04 of 25] libxc: convert shadow domctl interfaces and save/restore " Ian Campbell
2010-10-22 14:15 ` [PATCH 05 of 25] libxc: convert sysctl interfaces " Ian Campbell
2010-10-22 14:15 ` [PATCH 06 of 25] libxc: convert watchdog interface " Ian Campbell
2010-10-22 14:15 ` [PATCH 07 of 25] libxc: convert acm interfaces " Ian Campbell
2010-10-22 14:15 ` [PATCH 08 of 25] libxc: convert evtchn " Ian Campbell
2010-10-22 14:15 ` [PATCH 09 of 25] libxc: convert schedop " Ian Campbell
2010-10-22 14:15 ` [PATCH 10 of 25] libxc: convert physdevop interface " Ian Campbell
2010-10-22 14:15 ` [PATCH 11 of 25] libxc: convert flask interfaces " Ian Campbell
2010-10-22 14:15 ` [PATCH 12 of 25] libxc: convert hvmop " Ian Campbell
2010-10-22 14:15 ` [PATCH 13 of 25] libxc: convert mca interface " Ian Campbell
2010-10-22 14:15 ` [PATCH 14 of 25] libxc: convert tmem " Ian Campbell
2010-10-22 14:15 ` [PATCH 15 of 25] libxc: convert gnttab interfaces " Ian Campbell
2010-10-22 14:15 ` [PATCH 16 of 25] libxc: convert memory op interface " Ian Campbell
2010-10-22 14:15 ` [PATCH 17 of 25] libxc: convert mmuext " Ian Campbell
2010-10-22 14:16 ` [PATCH 18 of 25] libxc: switch page offlining interfaces " Ian Campbell
2010-10-22 14:16 ` [PATCH 19 of 25] libxc: convert ia64 dom0vp interface " Ian Campbell
2010-10-22 14:16 ` [PATCH 20 of 25] python acm: use hypercall buffer interface Ian Campbell
2010-10-22 14:16 ` [PATCH 21 of 25] python xc: " Ian Campbell
2010-10-22 14:16 ` [PATCH 22 of 25] xenpm: use hypercall buffers Ian Campbell
2010-10-22 14:16 ` [PATCH 23 of 25] secpol: " Ian Campbell
2010-10-22 14:16 ` [PATCH 24 of 25] libxc: do not align/lock buffers which do not need it Ian Campbell
2010-10-22 14:16 ` [PATCH 25 of 25] libxc: finalise transition to hypercall buffers Ian Campbell
2010-10-26 15:37 ` [PATCH 00 of 25] libxc: Hypercall buffers Olaf Hering
2010-10-26 16:25   ` Ian Campbell
2010-10-27 14:53     ` Olaf Hering
2010-10-27 15:45       ` Ian Campbell
  -- strict thread matches above, loose matches on Subject: below --
2010-10-21 10:58 Ian Campbell
2010-10-22 12:06 ` Ian Campbell

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.