Re: [RFC PATCH 1/1] xen: Use a global mapping for runstate

[Jan Beulich <jbeulich@xxxxxxxx>]

On 29.05.2020 10:13, Bertrand Marquis wrote:
>> On 28 May 2020, at 19:54, Julien Grall <julien@xxxxxxx> wrote:
>> AFAICT, there is no restriction on when the runstate hypercall can be 
>> called. So this can even be called before the vCPU is brought up.
> 
> I understand the remark but it still feels very weird to allow an invalid 
> address in an hypercall.
> Wouldn’t we have a lot of potential issues accepting an address that we 
> cannot check ?

I don't think so: The hypervisor uses copy_to_guest() to protect
itself from the addresses to be invalid at the time of copying.
If the guest doesn't make sure they're valid at that time, it
simply won't get the information (perhaps until Xen's next
attempt to copy it out).

You may want to take a look at the x86 side of this (also the
vCPU time updating): Due to the way x86-64 PV guests work, the
address may legitimately be unmapped at the time Xen wants to
copy it, when the vCPU is currently executing guest user mode
code. In such a case the copy gets retried the next time the
guest transitions from user to kernel mode (which involves a
page table change).

Jan