Re: [PATCH for-4.19? 1/2] xen/x86: account for max guest gfn and number of foreign mappings in the p2m

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Mon, May 06, 2024 at 12:07:33PM +0200, Jan Beulich wrote:
> On 30.04.2024 18:58, Roger Pau Monne wrote:
> > Keep track of the maximum gfn that has ever been populated into the p2m, and
> > also account for the number of foreign mappings.  Such information will be
> > needed in order to remove foreign mappings during teardown for HVM guests.
> 
> Is "needed" the right term? We could e.g. traverse the P2M tree (didn't look
> at patch 2 yet as to how exactly you use these two new fields there), at which
> point we might get away without either or both of these extra statistics,
> while at the same time also not needing to iterate over a gigantic range of
> GFNs. Going from populated page tables would roughly match "max_gfn", with the
> benefit of certain removals of P2M entries then also shrinking the upper 
> bound.

The nr_foreign field is also used as a way to signal whether iteration
over the p2m is needed in the first place.  If there are no foreign
entries the iteration can be avoided (which is likely the case for a
lot of domains).

Note that in 2/2 max_gfn is also used as the cursor for the teardown
iteration, and points to the last processed p2m entry.  So even if the
maximum gfn is obtained from the p2m page-tables directly, we would
still need some kind of cursor to signal the position during teardown.
Or alternatively remove all entries from the p2m, regardless of their
type, so that the p2m shrinks.

> > --- a/xen/arch/x86/mm/p2m.c
> > +++ b/xen/arch/x86/mm/p2m.c
> > @@ -413,6 +413,8 @@ int p2m_set_entry(struct p2m_domain *p2m, gfn_t gfn, 
> > mfn_t mfn,
> >          set_rc = p2m->set_entry(p2m, gfn, mfn, order, p2mt, p2ma, -1);
> >          if ( set_rc )
> >              rc = set_rc;
> > +        else
> > +            p2m->max_gfn = gfn_max(gfn_add(gfn, 1u << order), 
> > p2m->max_gfn);
> 
> For one a (new) field named "max_..." wants to record the maximum value, not
> one above. And then you want to use 1UL, to match ...

So gfn + (1UL << order) - 1.

> >          gfn = gfn_add(gfn, 1UL << order);
> >          if ( !mfn_eq(mfn, INVALID_MFN) )
> 
> ... surrounding code (more just out of context).

Oh, indeed.

> Further I can't really convince myself that doing the update just here is
> enough, or whether alternatively the update wouldn't want to be further
> constrained to happen just on newly set foreign entries. In that latter
> case it would be far easier to reason whether doing the update just here is
> sufficient. Plus iirc foreign entries are also necessarily order-0 (else
> p2m_entry_modify() wouldn't be correct as is), which would allow to store
> just the gfn we have in hands, thus resulting in the field then being
> properly named (as to its prefix; it would likely want to become
> "max_foreign_gfn" then).

I didn't want to limit this to foreign entries exclusively, as it
could be useful for other purposes.  My initial intention was to do it
in p2m_entry_modify() so that nr_foreign and max_gfn where set in the
same function, but that requires passing yet another parameter to the
function.

Thanks, Roger.