Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161873AbdD0NWH (ORCPT ); Thu, 27 Apr 2017 09:22:07 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:23027 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934088AbdD0NWA (ORCPT ); Thu, 27 Apr 2017 09:22:00 -0400 Subject: Re: xen_exit_mmap() questions To: Andy Lutomirski References: Cc: "xen-devel@lists.xenproject.org" , Juergen Gross , X86 ML , Borislav Petkov , "linux-kernel@vger.kernel.org" From: Boris Ostrovsky Message-ID: <47640bc3-02e6-ceb1-44bd-2c21e64b4d37@oracle.com> Date: Thu, 27 Apr 2017 09:21:40 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2053 Lines: 54 >>>> >>>>> Also, this code in drop_other_mm_ref() looks dubious to me: >>>>> >>>>> /* If this cpu still has a stale cr3 reference, then make sure >>>>> it has been flushed. */ >>>>> if (this_cpu_read(xen_current_cr3) == __pa(mm->pgd)) >>>>> load_cr3(swapper_pg_dir); >>>>> >>>>> If cr3 hasn't been flushed to the hypervisor because we're in a lazy >>>>> mode, why would load_cr3() help? Shouldn't this be xen_mc_flush() >>>>> instead? >>>> >>>> load_cr3() actually ends with xen_mc_flush() by way of xen_write_cr3() >>>> -> xen_mc_issue(). >>> >>> xen_mc_issue() does: >>> >>> if ((paravirt_get_lazy_mode() & mode) == 0) >>> xen_mc_flush(); >>> >>> I assume the load_cr3() is intended to deal with the case where we're >>> in lazy mode, but we'll still be in lazy mode, right? Or does it >>> serve some other purpose? >> >> Of course. I can't read (I ignored the "== 0" part). >> >> Apparently the early version had an explicit flush but then it disappeared >> (commit 9f79991d4186089e228274196413572cc000143b). >> >> The point of CR3 loading here, I believe, is to make sure the hypervisor >> knows that the (v)CPU is no longer using the the mm's cr3 (we are loading >> swapper_pgdir here). > But that's what leave_mm() does. To be fair, the x86 lazy TLB > management is a big mess, and this came up because I'm trying to clean > it up without removing it. True. I don't know though if you can guarantee that leave_mm() (or load_cr3() inside it) is actually called if we are in lazy mode. > > I suppose I can try to keep xen_exit_mmap() working. Is there a > simple way to try to unpin but to not treat it as an error if the > hypervisor rejects it? Even if we managed to craft a call in Linux to do this (current xen_pgd_unpin() will result in a WARNing in xen_mc_flush()) this will still cause a bunch of warnings in the hypervisor (if it is built as DEBUG, but bad nevertheless). But even without that, it is an error for a reason so how are you planning to continue if you ignore it? -boris