Re: [Xen-devel] [PATCH 5/7] x86/traps: Lift all non-entrypoint logic in entry_int82() up into C

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 03/05/17 13:37, Jan Beulich wrote:
>>>> On 03.05.17 at 14:18, <andrew.cooper3@xxxxxxxxxx> wrote:
>> On 03/05/17 13:02, Jan Beulich wrote:
>>>>>> On 03.05.17 at 13:38, <andrew.cooper3@xxxxxxxxxx> wrote:
>>>> On 03/05/17 12:26, Wei Liu wrote:
>>>>> On Wed, May 03, 2017 at 03:02:25AM -0600, Jan Beulich wrote:
>>>>>>>>> On 02.05.17 at 20:05, <andrew.cooper3@xxxxxxxxxx> wrote:
>>>>>>> --- /dev/null
>>>>>>> +++ b/xen/arch/x86/pv/traps.c
>>>>>>> @@ -0,0 +1,44 @@
>>>>>>>
>> +/***************************************************************************
>>>> ***
>>>>>>> + * arch/x86/pv/traps.c
>>>>>>> + *
>>>>>>> + * PV low level entry points.
>>>>>>> + *
>>>>>>> + * This program is free software; you can redistribute it and/or modify
>>>>>>> + * it under the terms of the GNU General Public License as published by
>>>>>>> + * the Free Software Foundation; either version 2 of the License, or
>>>>>>> + * (at your option) any later version.
>>>>>>> + *
>>>>>>> + * This program is distributed in the hope that it will be useful,
>>>>>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>>>>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>>>>>>> + * GNU General Public License for more details.
>>>>>>> + *
>>>>>>> + * You should have received a copy of the GNU General Public License
>>>>>>> + * along with this program; If not, see <http://www.gnu.org/licenses/>.
>>>>>>> + *
>>>>>>> + * Copyright (c) 2017 Citrix Systems Ltd.
>>>>>>> + */
>>>>>>> +
>>>>>>> +#include <xen/hypercall.h>
>>>>>>> +
>>>>>>> +#include <asm/apic.h>
>>>>>>> +
>>>>>>> +#ifdef CONFIG_COMPAT
>>>>>> As expressed before, I disagree to the re-introduction of such
>>>>>> conditionals in x86 code.
>>>>>>
>>>>> I'm curious to know how the COMPAT interface is treated long term.
>>>>>
>>>>> I guess you're of the opinion that we should always have them enabled?
>>>> There is a valid usecase to disable CONFIG_COMPAT, seeing as sufficient
>>>> PVH interfaces exist to start APs straight in 64bit mode, as it provides
>>>> a meaningful reduction in hypervisor attack surface.
>>> What does PVH have to do with 32-bit PV compat guest support?
>> Nothing.  I am unsure as to why do you think it does?
>>
>> The CONFIG_COMPAT infrastructure by HVM guests as well. 
> A rather small part of it, if at all. And if HVM guests really use parts
> of it, we can't disable it without breaking such guests running
> (perhaps just temporarily) in 32-bit mode.
>
>>>> As it is a configurable option, I intend to work in a direction which
>>>> eventually makes it usable under x86.
>>>>
>>>> If there is a wish to move in an opposite direction, that should be a
>>>> separate discussion made over a patch removing its entry from
>>>> common/Kconfig.
>>> Once again - from common code perspective this is a valid config
>>> option to have. X86, however, unconditionally selects it, so there's
>>> no point having such conditionals in x86 code.
>> I don't agree with this reasoning.  If it is a reasonable configuration
>> for common code to use, it is a reasonable configuration for x86 code to
>> use.
> Depends: It's there in common code to skip the respective pieces of
> code for architectures not needing it. It used to be a meaningful
> option in x86 as long as there was a 32-bit hypervisor.
>
>> Or do you disagree with my argument for why it should be a configurable
>> option which can be turned off in an x86 build?
> Well, I'd first of all have to check again how much of this really is
> being used by HVM code. Hmm, looks like it's more than I did
> remember. But with all CONFIG_COMPAT uses gone from x86
> code (minus the ones you introduced not very long ago), I don't
> see why you want to re-introduce a few more now. If we really
> want the option of disabling that code, a concerted effort should
> be made to re-add the conditionals wherever needed. Otherwise
> we'll end up with code where readers would legitimately ask why
> the conditionals are there in some places, but missing in many
> others. And no, I wouldn't view a patch like the one here as the
> beginning of a transitional period (as expressed before, I should
> have noticed and objected to the re-introduction of such #ifdef-s
> in your PV hypercall changes).

The reason c/s de82feebf2c uses CONFIG_COMPAT is because of

struct mc_state {
    unsigned long flags;
    union {
        struct multicall_entry call;
#ifdef CONFIG_COMPAT
        struct compat_multicall_entry compat_call;
#endif
    };
};

being defined using CONFIG_COMPAT.  It didn't even cross my mind that it
might have been ok to allow the code to fail to compile if CONFIG_COMPAT
was not selected.  I therefore wrote code which matched the structure
definition it was using.


Irrespective of the history which lead to this point, the important
question is whether we want to allow compiling x86 without CONFIG_COMPAT.

If the eventual decision is yes, then new code should specifically be
introduced as being CONFIG_COMPAT-clean, because decisions like that
affect how to structure the code in the first place, and therefore be
far cleaner changes than trying to retrofit CONFIG_COMPAT in the future.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel