From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ADEDC433DB for ; Wed, 23 Dec 2020 14:44:23 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 23489222B3 for ; Wed, 23 Dec 2020 14:44:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 23489222B3 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=xen.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from list by lists.xenproject.org with outflank-mailman.58404.102655 (Exim 4.92) (envelope-from ) id 1ks5N4-00051G-NA; Wed, 23 Dec 2020 14:44:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 58404.102655; Wed, 23 Dec 2020 14:44:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1ks5N4-000519-Jy; Wed, 23 Dec 2020 14:44:10 +0000 Received: by outflank-mailman (input) for mailman id 58404; Wed, 23 Dec 2020 14:44:09 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1ks5N3-000514-R5 for xen-devel@lists.xenproject.org; Wed, 23 Dec 2020 14:44:09 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1ks5N2-0008VW-6Y; Wed, 23 Dec 2020 14:44:08 +0000 Received: from [54.239.6.185] (helo=a483e7b01a66.ant.amazon.com) by xenbits.xenproject.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1ks5N1-00017O-Uq; Wed, 23 Dec 2020 14:44:08 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org; s=20200302mail; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject; bh=WJjkdlNdwkLx1Zcf3xRAV5oKtc6B48Kt5A71CejeDiA=; b=G0bvFQEt8NTKESQbKOAwPDTPK3 hsq90rqZIbXoKflFnHdY6RXJroK7gN8KPlZILYsswvs9vONfmsheMLJdk1GehRS8TYbxlUBiwxj02 OK6gWeH3k0ux8QTxgZmHTFX2QlZJS0K9lb72W+QWIhVYvNySgZYodkoXJSZ+AS7pHYp8=; Subject: Re: [PATCH v3 5/5] evtchn: don't call Xen consumer callback with per-channel lock held To: Jan Beulich , Tamas K Lengyel Cc: Andrew Cooper , George Dunlap , Ian Jackson , Wei Liu , Stefano Stabellini , Tamas K Lengyel , Petre Ovidiu PIRCALABU , Alexandru Isaila , "xen-devel@lists.xenproject.org" References: <9d7a052a-6222-80ff-cbf1-612d4ca50c2a@suse.com> <17c90493-b438-fbc1-ca10-3bc4d89c4e5e@xen.org> <7a768bcd-80c1-d193-8796-7fb6720fa22a@suse.com> <1a8250f5-ea49-ac3a-e992-be7ec40deba9@xen.org> <5862eb24-d894-455a-13ac-61af54f949e7@xen.org> <9ee6016a-d3b3-c847-4775-0e05c8578110@xen.org> <3b339f30-57db-caf6-fd7e-84199f98546f@suse.com> From: Julien Grall Message-ID: <9c214bc1-61db-5b33-f610-40c2a59edb75@xen.org> Date: Wed, 23 Dec 2020 14:44:05 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 MIME-Version: 1.0 In-Reply-To: <3b339f30-57db-caf6-fd7e-84199f98546f@suse.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit On 23/12/2020 13:41, Jan Beulich wrote: > On 23.12.2020 14:33, Julien Grall wrote: >> On 23/12/2020 13:12, Jan Beulich wrote: >>> From the input by both of you I still can't >>> conclude whether this patch should remain as is in v4, or revert >>> back to its v2 version. Please can we get this settled so I can get >>> v4 out? >> >> I haven't had time to investigate the rest of the VM event code to find >> other cases where this may happen. I still think there is a bigger >> problem in the VM event code, but the maintainer disagrees here. >> >> At which point, I see limited reason to try to paper over in the common >> code. So I would rather ack/merge v2 rather than v3. > > Since I expect Tamas and/or the Bitdefender folks to be of the > opposite opinion, there's still no way out, at least if "rather > ack" implies a nak for v3. The only way out here is for someone to justify why this patch is sufficient for the VM event race. I am not convinced it is (see more below). > Personally, if this expectation of > mine is correct, I'd prefer to keep the accounting but make it > optional (as suggested in a post-commit-message remark). > That'll eliminate the overhead you appear to be concerned of, > but of course it'll further complicate the logic (albeit just > slightly). I am more concerned about adding over complex code that would just papering over a bigger problem. I also can't see use of it outside of the VM event discussion. I had another look at the code. As I mentioned in the past, vm_put_event_request() is able to deal with d != current->domain (it will set VM_EVENT_FLAG_FOREIGN). There are 4 callers for the function: 1) p2m_mem_paging_drop_page() 2) p2m_mem_paging_populate() 3) mem_sharing_notify_enomem() 4) monitor_traps() 1) and 2) belongs to the mem paging subsystem. Tamas suggested that it was abandoned. 4) can only be called with the current domain. This leave us 3) in the mem sharing subsystem. As this is call the memory hypercalls, it looks possible to me that d != current->domain. The code also seems to be maintained (there were recent non-trivial changes). Can one of the VM event developper come up with a justification why this patch enough to make the VM event subsystem safe? FAOD, the justification should be solely based on the hypervisor code (IOW not external trusted software). Cheers, -- Julien Grall