Re: [PATCH] x86/hvm: Allow the guest to permit the use of userspace hypercalls

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 11/01/16 14:44, Jan Beulich wrote:
>>>> On 11.01.16 at 14:59, <andrew.cooper3@citrix.com> wrote:
>> Currently, hypercalls issued from HVM userspace will unconditionally fail
>> with -EPERM.
>>
>> This is inflexible, and a guest may wish to allow userspace to make
>> hypercalls.
> I thought previous discussion had made clear that routing these
> through ioctls or alike is the right approach, and hence the patch
> isn't needed. The more that an all-or-nothing approach seems
> pretty bold.

All other issues fixed in v2, but to answer this one specifically.

In it inappropriate for Xen to presume that all guests want Linux-like
handing of situations like this.  It is simply not true.

As part of getting my test framework ready to publish, I attempted to
port my XSA-106 unit tests to PV guests.  I have shelved that work as I
don't have sufficient time to fix PV trap handing in Xen at this present
time, but do plan to fix them in due course.

The bugs I have identified so far are:
* "INT n" handling assumes the instruction was 2 bytes long
* In some circumstances, Xen crashes the domain rather than injecting
#NP[sel]
* In most circumstances, Xen delivers #GP[sel] where #NP[sel] would be
correct
* Not possible to have non-dpl3 descriptors for #BP and #OF
* Not possible to mark an existing descriptor as not-present

All of these bugs exist because Xen PV was co-developed against Linux
without considerations towards a clean API/ABI.  It also means that any
PV guest wanting to have a non-Linux setup won't function in expected ways.

So from one point of view, sufficient justification for this change is
"because the Linux way isn't the only valid way to do this".

~Andrew