Re: [Xen-devel] Re: [PATCH 3/5] x86/pvclock: add vsyscall implementation

[Avi Kivity <avi@redhat.com>]

On 10/07/2009 11:19 PM, Jeremy Fitzhardinge wrote:
>
>> When do you copy?
>>
>> I'd rather have a single copy for guest and host.
>>      
> When Xen updates the parameters normally.  The interface never really
> needed to share the memory between hypervisor and guest, and I think
> avoiding it is a bit more robust.
>
> But for KVM, you already use the MSR to place the pvclock_vcpu_time_info
> structure, so you could just place it in the page and use the same
> memory for kernel and usermode.
>    

Yes.

>> If the hypervisor does a pvclock->version = somethingelse->version++
>> then the guest may get confused.  But I understand you have a
>> guest-private ->version?
>>      
> The guest should never get confused by the version being changed by the
> hypervisor.  It's already part of the ABI.  Or did you mean something else?
>    

If the guest does a RMW on the version, but the host does not (copying 
it from somewhere else), then the guest RMW can be lost.

Looking at the code, that's what kvm does:

     vcpu->hv_clock.version += 2;

     shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);

     memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
            sizeof(vcpu->hv_clock));

so a guest-side ++version can be lost.

> I'm not sure what you mean by "guest-private version"; the versions are
> always guest-private:  te version is part of the pvclock structure,
> which is per-vcpu, which is private to each guest.   The guest nevern
> maintains a separate long-term copy of the structure, only a transient
> snapshot while computing time from the tsc (that's the current pvclock.c
> code).
>    

Same for kvm.  I'm not worried about cross-guest corruption, just the 
guest and host working together to confuse the guest.

>> No need to read them atomically.
>>
>> cpu1 = vgetcpu()
>> hver1 = pvclock[cpu1].hver
>> kver1 = pvclock[cpu1].kver
>> tsc = rdtsc
>> /* multipication magic with pvclock[cpu1]*/
>> cpu2 = vgetcpu()
>> hver2 = pvclock[cpu2].hver
>> kver2 = pvclock[cpu2].kver
>> valid = cpu1 == cpu2&&  hver1 == hver2&&  kver1 == kver2
>>      
> I don't think that's necessary, but I can certainly live with it if it
> makes you happier.
>    

I think the version issue requires it.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.