Mailing List Archive

[PATCH v9 6/8] common/domain: add a domain context record for shared_info...
From: Paul Durrant <pdurrant@amazon.com>

... and update xen-domctx to dump some information describing the record.

NOTE: Processing of the content during restore is currently limited to
PV domains, and matches processing of the PV-only SHARED_INFO record
done by libxc. All content is, however, saved such that restore
processing can be modified in future without requiring a new record
format.

Signed-off-by: Paul Durrant <pdurrant@amazon.com>
---
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Wei Liu <wl@xen.org>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: George Dunlap <george.dunlap@citrix.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Julien Grall <julien@xen.org>
Cc: Stefano Stabellini <sstabellini@kernel.org>

v9:
- Use macros to make the code less verbose
- Add missing check for allocation failure

v8:
- Incorporate zero-ing out of shared info fields that would be done in
processing of SHARED_INFO from older stream versions

v7:
- Only restore vcpu_info and arch sub-structures for PV domains, to match
processing of SHARED_INFO in xc_sr_restore_x86_pv.c
- Use additional option to domain_load_end() to ignore the record for
HVM domains

v6:
- Only save compat_shared_info buffer if has_32bit_shinfo is set
- Validate flags field in load handler

v5:
- Addressed comments from Julien

v4:
- Addressed comments from Jan

v3:
- Actually dump some of the content of shared_info

v2:
- Drop the header change to define a 'Xen' page size and instead use a
variable length struct now that the framework makes this is feasible
- Guard use of 'has_32bit_shinfo' in common code with CONFIG_COMPAT
---
tools/misc/xen-domctx.c | 78 ++++++++++++++++++++++++++++
xen/common/domain.c | 105 ++++++++++++++++++++++++++++++++++++++
xen/include/public/save.h | 13 ++++-
3 files changed, 195 insertions(+), 1 deletion(-)

diff --git a/tools/misc/xen-domctx.c b/tools/misc/xen-domctx.c
index 243325dfce..6ead7ea89d 100644
--- a/tools/misc/xen-domctx.c
+++ b/tools/misc/xen-domctx.c
@@ -31,6 +31,7 @@
#include <errno.h>

#include <xenctrl.h>
+#include <xen-tools/libs.h>
#include <xen/xen.h>
#include <xen/domctl.h>
#include <xen/save.h>
@@ -61,6 +62,82 @@ static void dump_header(void)

}

+static void print_binary(const char *prefix, const void *val, size_t size,
+ const char *suffix)
+{
+ printf("%s", prefix);
+
+ while ( size-- )
+ {
+ uint8_t octet = *(const uint8_t *)val++;
+ unsigned int i;
+
+ for ( i = 0; i < 8; i++ )
+ {
+ printf("%u", octet & 1);
+ octet >>= 1;
+ }
+ }
+
+ printf("%s", suffix);
+}
+
+static void dump_shared_info(void)
+{
+ DOMAIN_SAVE_TYPE(SHARED_INFO) *s;
+ bool has_32bit_shinfo;
+ shared_info_any_t *info;
+ unsigned int i, n;
+
+ GET_PTR(s);
+ has_32bit_shinfo = s->flags & DOMAIN_SAVE_32BIT_SHINFO;
+
+ printf(" SHARED_INFO: has_32bit_shinfo: %s buffer_size: %u\n",
+ has_32bit_shinfo ? "true" : "false", s->buffer_size);
+
+ info = (shared_info_any_t *)s->buffer;
+
+#define GET_FIELD_PTR(_f) \
+ (has_32bit_shinfo ? \
+ (const void *)&(info->x32._f) : \
+ (const void *)&(info->x64._f))
+#define GET_FIELD_SIZE(_f) \
+ (has_32bit_shinfo ? sizeof(info->x32._f) : sizeof(info->x64._f))
+#define GET_FIELD(_f) \
+ (has_32bit_shinfo ? info->x32._f : info->x64._f)
+
+ n = has_32bit_shinfo ?
+ ARRAY_SIZE(info->x32.evtchn_pending) :
+ ARRAY_SIZE(info->x64.evtchn_pending);
+
+ for ( i = 0; i < n; i++ )
+ {
+ const char *prefix = !i ?
+ " evtchn_pending: " :
+ " ";
+
+ print_binary(prefix, GET_FIELD_PTR(evtchn_pending[0]),
+ GET_FIELD_SIZE(evtchn_pending[0]), "\n");
+ }
+
+ for ( i = 0; i < n; i++ )
+ {
+ const char *prefix = !i ?
+ " evtchn_mask: " :
+ " ";
+
+ print_binary(prefix, GET_FIELD_PTR(evtchn_mask[0]),
+ GET_FIELD_SIZE(evtchn_mask[0]), "\n");
+ }
+
+ printf(" wc: version: %u sec: %u nsec: %u\n",
+ GET_FIELD(wc_version), GET_FIELD(wc_sec), GET_FIELD(wc_nsec));
+
+#undef GET_FIELD
+#undef GET_FIELD_SIZE
+#undef GET_FIELD_PTR
+}
+
static void dump_end(void)
{
DOMAIN_SAVE_TYPE(END) *e;
@@ -173,6 +250,7 @@ int main(int argc, char **argv)
switch (desc->typecode)
{
case DOMAIN_SAVE_CODE(HEADER): dump_header(); break;
+ case DOMAIN_SAVE_CODE(SHARED_INFO): dump_shared_info(); break;
case DOMAIN_SAVE_CODE(END): dump_end(); break;
default:
printf("Unknown type %u: skipping\n", desc->typecode);
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 8cfa2e0b6b..6709f9c79e 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -33,6 +33,7 @@
#include <xen/xenoprof.h>
#include <xen/irq.h>
#include <xen/argo.h>
+#include <xen/save.h>
#include <asm/debugger.h>
#include <asm/p2m.h>
#include <asm/processor.h>
@@ -1657,6 +1658,110 @@ int continue_hypercall_on_cpu(
return 0;
}

+static int save_shared_info(const struct domain *d, struct domain_context *c,
+ bool dry_run)
+{
+ struct domain_shared_info_context ctxt = {
+#ifdef CONFIG_COMPAT
+ .flags = has_32bit_shinfo(d) ? DOMAIN_SAVE_32BIT_SHINFO : 0,
+ .buffer_size = has_32bit_shinfo(d) ?
+ sizeof(struct compat_shared_info) :
+ sizeof(struct shared_info),
+#else
+ .buffer_size = sizeof(struct shared_info),
+#endif
+ };
+ size_t hdr_size = offsetof(typeof(ctxt), buffer);
+ int rc;
+
+ rc = DOMAIN_SAVE_BEGIN(SHARED_INFO, c, 0);
+ if ( rc )
+ return rc;
+
+ rc = domain_save_data(c, &ctxt, hdr_size);
+ if ( rc )
+ return rc;
+
+ rc = domain_save_data(c, d->shared_info, ctxt.buffer_size);
+ if ( rc )
+ return rc;
+
+ return domain_save_end(c);
+}
+
+static int load_shared_info(struct domain *d, struct domain_context *c)
+{
+ struct domain_shared_info_context ctxt;
+ size_t hdr_size = offsetof(typeof(ctxt), buffer);
+ unsigned int i;
+ int rc;
+
+ rc = DOMAIN_LOAD_BEGIN(SHARED_INFO, c, &i);
+ if ( rc )
+ return rc;
+
+ if ( i ) /* expect only a single instance */
+ return -ENXIO;
+
+ rc = domain_load_data(c, &ctxt, hdr_size);
+ if ( rc )
+ return rc;
+
+ if ( ctxt.buffer_size > sizeof(shared_info_t) ||
+ (ctxt.flags & ~DOMAIN_SAVE_32BIT_SHINFO) )
+ return -EINVAL;
+
+ if ( ctxt.flags & DOMAIN_SAVE_32BIT_SHINFO )
+ {
+#ifdef CONFIG_COMPAT
+ has_32bit_shinfo(d) = true;
+#else
+ return -EINVAL;
+#endif
+ }
+
+ if ( is_pv_domain(d) )
+ {
+ shared_info_t *shinfo = xmalloc(shared_info_t);
+
+ if ( !shinfo )
+ return -ENOMEM;
+
+ rc = domain_load_data(c, shinfo, sizeof(*shinfo));
+ if ( rc )
+ goto out;
+
+ memcpy(&shared_info(d, vcpu_info), &__shared_info(d, shinfo, vcpu_info),
+ sizeof(shared_info(d, vcpu_info)));
+ memcpy(&shared_info(d, arch), &__shared_info(d, shinfo, arch),
+ sizeof(shared_info(d, arch)));
+
+ memset(&shared_info(d, evtchn_pending), 0,
+ sizeof(shared_info(d, evtchn_pending)));
+ memset(&shared_info(d, evtchn_mask), 0xff,
+ sizeof(shared_info(d, evtchn_mask)));
+
+ shared_info(d, arch.pfn_to_mfn_frame_list_list) = 0;
+ for ( i = 0; i < XEN_LEGACY_MAX_VCPUS; i++ )
+ shared_info(d, vcpu_info[i].evtchn_pending_sel) = 0;
+
+ rc = domain_load_end(c, false);
+
+ out:
+ xfree(shinfo);
+ }
+ else
+ /*
+ * No modifications to shared_info are required for restoring non-PV
+ * domains.
+ */
+ rc = domain_load_end(c, true);
+
+ return rc;
+}
+
+DOMAIN_REGISTER_SAVE_LOAD(SHARED_INFO, save_shared_info, load_shared_info);
+
/*
* Local variables:
* mode: C
diff --git a/xen/include/public/save.h b/xen/include/public/save.h
index 551dbbddb8..0e855a4b97 100644
--- a/xen/include/public/save.h
+++ b/xen/include/public/save.h
@@ -82,7 +82,18 @@ struct domain_save_header {
};
DECLARE_DOMAIN_SAVE_TYPE(HEADER, 1, struct domain_save_header);

-#define DOMAIN_SAVE_CODE_MAX 1
+struct domain_shared_info_context {
+ uint32_t flags;
+
+#define DOMAIN_SAVE_32BIT_SHINFO 0x00000001
+
+ uint32_t buffer_size;
+ uint8_t buffer[XEN_FLEX_ARRAY_DIM]; /* Implementation specific size */
+};
+
+DECLARE_DOMAIN_SAVE_TYPE(SHARED_INFO, 2, struct domain_shared_info_context);
+
+#define DOMAIN_SAVE_CODE_MAX 2

#endif /* defined(__XEN__) || defined(__XEN_TOOLS__) */

--
2.20.1
Re: [PATCH v9 6/8] common/domain: add a domain context record for shared_info... [ In reply to ]
On 24.09.2020 15:10, Paul Durrant wrote:
> From: Paul Durrant <pdurrant@amazon.com>
>
> ... and update xen-domctx to dump some information describing the record.
>
> NOTE: Processing of the content during restore is currently limited to
> PV domains, and matches processing of the PV-only SHARED_INFO record
> done by libxc. All content is, however, saved such that restore
> processing can be modified in future without requiring a new record
> format.
>
> Signed-off-by: Paul Durrant <pdurrant@amazon.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
Re: [PATCH v9 6/8] common/domain: add a domain context record for shared_info... [ In reply to ]
On Thu, Sep 24, 2020 at 02:10:28PM +0100, Paul Durrant wrote:
> From: Paul Durrant <pdurrant@amazon.com>
>
> ... and update xen-domctx to dump some information describing the record.
>
> NOTE: Processing of the content during restore is currently limited to
> PV domains, and matches processing of the PV-only SHARED_INFO record
> done by libxc. All content is, however, saved such that restore
> processing can be modified in future without requiring a new record
> format.
>
> Signed-off-by: Paul Durrant <pdurrant@amazon.com>

Acked-by: Wei Liu <wl@xen.org>
Re: [PATCH v9 6/8] common/domain: add a domain context record for shared_info... [ In reply to ]
On 24/09/2020 14:10, Paul Durrant wrote:
> diff --git a/tools/misc/xen-domctx.c b/tools/misc/xen-domctx.c
> index 243325dfce..6ead7ea89d 100644
> --- a/tools/misc/xen-domctx.c
> +++ b/tools/misc/xen-domctx.c
> @@ -31,6 +31,7 @@
> #include <errno.h>
>
> #include <xenctrl.h>
> +#include <xen-tools/libs.h>
> #include <xen/xen.h>
> #include <xen/domctl.h>
> #include <xen/save.h>
> @@ -61,6 +62,82 @@ static void dump_header(void)
>
> }
>
> +static void print_binary(const char *prefix, const void *val, size_t size,
> + const char *suffix)
> +{
> + printf("%s", prefix);
> +
> + while ( size-- )
> + {
> + uint8_t octet = *(const uint8_t *)val++;
> + unsigned int i;
> +
> + for ( i = 0; i < 8; i++ )
> + {
> + printf("%u", octet & 1);
> + octet >>= 1;
> + }
> + }
> +
> + printf("%s", suffix);
> +}
> +
> +static void dump_shared_info(void)
> +{
> + DOMAIN_SAVE_TYPE(SHARED_INFO) *s;
> + bool has_32bit_shinfo;
> + shared_info_any_t *info;
> + unsigned int i, n;
> +
> + GET_PTR(s);
> + has_32bit_shinfo = s->flags & DOMAIN_SAVE_32BIT_SHINFO;
> +
> + printf(" SHARED_INFO: has_32bit_shinfo: %s buffer_size: %u\n",
> + has_32bit_shinfo ? "true" : "false", s->buffer_size);
> +
> + info = (shared_info_any_t *)s->buffer;
> +
> +#define GET_FIELD_PTR(_f) \
> + (has_32bit_shinfo ? \
> + (const void *)&(info->x32._f) : \
> + (const void *)&(info->x64._f))
> +#define GET_FIELD_SIZE(_f) \
> + (has_32bit_shinfo ? sizeof(info->x32._f) : sizeof(info->x64._f))
> +#define GET_FIELD(_f) \
> + (has_32bit_shinfo ? info->x32._f : info->x64._f)
> +
> + n = has_32bit_shinfo ?
> + ARRAY_SIZE(info->x32.evtchn_pending) :
> + ARRAY_SIZE(info->x64.evtchn_pending);
> +
> + for ( i = 0; i < n; i++ )
> + {
> + const char *prefix = !i ?
> + " evtchn_pending: " :
> + " ";
> +
> + print_binary(prefix, GET_FIELD_PTR(evtchn_pending[0]),
> + GET_FIELD_SIZE(evtchn_pending[0]), "\n");
> + }
> +
> + for ( i = 0; i < n; i++ )
> + {
> + const char *prefix = !i ?
> + " evtchn_mask: " :
> + " ";
> +
> + print_binary(prefix, GET_FIELD_PTR(evtchn_mask[0]),
> + GET_FIELD_SIZE(evtchn_mask[0]), "\n");
> + }

What about domains using FIFO?  This is meaningless for them.

> +
> + printf(" wc: version: %u sec: %u nsec: %u\n",
> + GET_FIELD(wc_version), GET_FIELD(wc_sec), GET_FIELD(wc_nsec));

wc_sec_hi is also a rather critical field in this calculation.

> +
> +#undef GET_FIELD
> +#undef GET_FIELD_SIZE
> +#undef GET_FIELD_PTR
> +}
> +
> static void dump_end(void)
> {
> DOMAIN_SAVE_TYPE(END) *e;
> @@ -173,6 +250,7 @@ int main(int argc, char **argv)
> switch (desc->typecode)
> {
> case DOMAIN_SAVE_CODE(HEADER): dump_header(); break;
> + case DOMAIN_SAVE_CODE(SHARED_INFO): dump_shared_info(); break;
> case DOMAIN_SAVE_CODE(END): dump_end(); break;
> default:
> printf("Unknown type %u: skipping\n", desc->typecode);
> diff --git a/xen/common/domain.c b/xen/common/domain.c
> index 8cfa2e0b6b..6709f9c79e 100644
> --- a/xen/common/domain.c
> +++ b/xen/common/domain.c
> @@ -33,6 +33,7 @@
> #include <xen/xenoprof.h>
> #include <xen/irq.h>
> #include <xen/argo.h>
> +#include <xen/save.h>
> #include <asm/debugger.h>
> #include <asm/p2m.h>
> #include <asm/processor.h>
> @@ -1657,6 +1658,110 @@ int continue_hypercall_on_cpu(
> return 0;
> }
>
> +static int save_shared_info(const struct domain *d, struct domain_context *c,
> + bool dry_run)
> +{
> + struct domain_shared_info_context ctxt = {
> +#ifdef CONFIG_COMPAT
> + .flags = has_32bit_shinfo(d) ? DOMAIN_SAVE_32BIT_SHINFO : 0,
> + .buffer_size = has_32bit_shinfo(d) ?
> + sizeof(struct compat_shared_info) :
> + sizeof(struct shared_info),
> +#else
> + .buffer_size = sizeof(struct shared_info),
> +#endif
> + };
> + size_t hdr_size = offsetof(typeof(ctxt), buffer);
> + int rc;
> +
> + rc = DOMAIN_SAVE_BEGIN(SHARED_INFO, c, 0);
> + if ( rc )
> + return rc;
> +
> + rc = domain_save_data(c, &ctxt, hdr_size);
> + if ( rc )
> + return rc;
> +
> + rc = domain_save_data(c, d->shared_info, ctxt.buffer_size);
> + if ( rc )
> + return rc;
> +
> + return domain_save_end(c);
> +}
> +
> +static int load_shared_info(struct domain *d, struct domain_context *c)
> +{
> + struct domain_shared_info_context ctxt;
> + size_t hdr_size = offsetof(typeof(ctxt), buffer);
> + unsigned int i;
> + int rc;
> +
> + rc = DOMAIN_LOAD_BEGIN(SHARED_INFO, c, &i);
> + if ( rc )
> + return rc;
> +
> + if ( i ) /* expect only a single instance */
> + return -ENXIO;
> +
> + rc = domain_load_data(c, &ctxt, hdr_size);
> + if ( rc )
> + return rc;
> +
> + if ( ctxt.buffer_size > sizeof(shared_info_t) ||
> + (ctxt.flags & ~DOMAIN_SAVE_32BIT_SHINFO) )
> + return -EINVAL;
> +
> + if ( ctxt.flags & DOMAIN_SAVE_32BIT_SHINFO )
> + {
> +#ifdef CONFIG_COMPAT
> + has_32bit_shinfo(d) = true;

d->arch.has_32bit_shinfo

> +#else
> + return -EINVAL;
> +#endif
> + }
> +
> + if ( is_pv_domain(d) )
> + {
> + shared_info_t *shinfo = xmalloc(shared_info_t);
> +
> + if ( !shinfo )
> + return -ENOMEM;
> +
> + rc = domain_load_data(c, shinfo, sizeof(*shinfo));
> + if ( rc )
> + goto out;

There's no need for a memory allocation, or to double buffer this data. 
You can memcpy() straight out of the context record.

> +
> + memcpy(&shared_info(d, vcpu_info), &__shared_info(d, shinfo, vcpu_info),
> + sizeof(shared_info(d, vcpu_info)));
> + memcpy(&shared_info(d, arch), &__shared_info(d, shinfo, arch),
> + sizeof(shared_info(d, arch)));
> +
> + memset(&shared_info(d, evtchn_pending), 0,
> + sizeof(shared_info(d, evtchn_pending)));
> + memset(&shared_info(d, evtchn_mask), 0xff,
> + sizeof(shared_info(d, evtchn_mask)));
> +
> + shared_info(d, arch.pfn_to_mfn_frame_list_list) = 0;
> + for ( i = 0; i < XEN_LEGACY_MAX_VCPUS; i++ )
> + shared_info(d, vcpu_info[i].evtchn_pending_sel) = 0;

What is the plan for transparent migrate here?  While this is ok for
regular migrate, its definitely not for transparent.

> +
> + rc = domain_load_end(c, false);
> +
> + out:
> + xfree(shinfo);
> + }
> + else
> + /*
> + * No modifications to shared_info are required for restoring non-PV
> + * domains.
> + */
> + rc = domain_load_end(c, true);
> +
> + return rc;
> +}
> +
> +DOMAIN_REGISTER_SAVE_LOAD(SHARED_INFO, save_shared_info, load_shared_info);
> +
> /*
> * Local variables:
> * mode: C
> diff --git a/xen/include/public/save.h b/xen/include/public/save.h
> index 551dbbddb8..0e855a4b97 100644
> --- a/xen/include/public/save.h
> +++ b/xen/include/public/save.h
> @@ -82,7 +82,18 @@ struct domain_save_header {
> };
> DECLARE_DOMAIN_SAVE_TYPE(HEADER, 1, struct domain_save_header);
>
> -#define DOMAIN_SAVE_CODE_MAX 1
> +struct domain_shared_info_context {
> + uint32_t flags;
> +
> +#define DOMAIN_SAVE_32BIT_SHINFO 0x00000001
> +
> + uint32_t buffer_size;

This struct is already wrapped with a header including a size which
encompasses buffer.

Multiple overlapping size fields is an easy way to memory corruption,
because it causes ambiguity as to which one is right.

~Andrew
RE: [PATCH v9 6/8] common/domain: add a domain context record for shared_info... [ In reply to ]
> -----Original Message-----
> From: Andrew Cooper <andrew.cooper3@citrix.com>
> Sent: 05 October 2020 11:40
> To: Paul Durrant <paul@xen.org>; xen-devel@lists.xenproject.org
> Cc: Paul Durrant <pdurrant@amazon.com>; Ian Jackson <ian.jackson@eu.citrix.com>; Wei Liu <wl@xen.org>;
> George Dunlap <george.dunlap@citrix.com>; Jan Beulich <jbeulich@suse.com>; Julien Grall
> <julien@xen.org>; Stefano Stabellini <sstabellini@kernel.org>
> Subject: Re: [PATCH v9 6/8] common/domain: add a domain context record for shared_info...
>
> On 24/09/2020 14:10, Paul Durrant wrote:
> > diff --git a/tools/misc/xen-domctx.c b/tools/misc/xen-domctx.c
> > index 243325dfce..6ead7ea89d 100644
> > --- a/tools/misc/xen-domctx.c
> > +++ b/tools/misc/xen-domctx.c
> > @@ -31,6 +31,7 @@
> > #include <errno.h>
> >
> > #include <xenctrl.h>
> > +#include <xen-tools/libs.h>
> > #include <xen/xen.h>
> > #include <xen/domctl.h>
> > #include <xen/save.h>
> > @@ -61,6 +62,82 @@ static void dump_header(void)
> >
> > }
> >
> > +static void print_binary(const char *prefix, const void *val, size_t size,
> > + const char *suffix)
> > +{
> > + printf("%s", prefix);
> > +
> > + while ( size-- )
> > + {
> > + uint8_t octet = *(const uint8_t *)val++;
> > + unsigned int i;
> > +
> > + for ( i = 0; i < 8; i++ )
> > + {
> > + printf("%u", octet & 1);
> > + octet >>= 1;
> > + }
> > + }
> > +
> > + printf("%s", suffix);
> > +}
> > +
> > +static void dump_shared_info(void)
> > +{
> > + DOMAIN_SAVE_TYPE(SHARED_INFO) *s;
> > + bool has_32bit_shinfo;
> > + shared_info_any_t *info;
> > + unsigned int i, n;
> > +
> > + GET_PTR(s);
> > + has_32bit_shinfo = s->flags & DOMAIN_SAVE_32BIT_SHINFO;
> > +
> > + printf(" SHARED_INFO: has_32bit_shinfo: %s buffer_size: %u\n",
> > + has_32bit_shinfo ? "true" : "false", s->buffer_size);
> > +
> > + info = (shared_info_any_t *)s->buffer;
> > +
> > +#define GET_FIELD_PTR(_f) \
> > + (has_32bit_shinfo ? \
> > + (const void *)&(info->x32._f) : \
> > + (const void *)&(info->x64._f))
> > +#define GET_FIELD_SIZE(_f) \
> > + (has_32bit_shinfo ? sizeof(info->x32._f) : sizeof(info->x64._f))
> > +#define GET_FIELD(_f) \
> > + (has_32bit_shinfo ? info->x32._f : info->x64._f)
> > +
> > + n = has_32bit_shinfo ?
> > + ARRAY_SIZE(info->x32.evtchn_pending) :
> > + ARRAY_SIZE(info->x64.evtchn_pending);
> > +
> > + for ( i = 0; i < n; i++ )
> > + {
> > + const char *prefix = !i ?
> > + " evtchn_pending: " :
> > + " ";
> > +
> > + print_binary(prefix, GET_FIELD_PTR(evtchn_pending[0]),
> > + GET_FIELD_SIZE(evtchn_pending[0]), "\n");
> > + }
> > +
> > + for ( i = 0; i < n; i++ )
> > + {
> > + const char *prefix = !i ?
> > + " evtchn_mask: " :
> > + " ";
> > +
> > + print_binary(prefix, GET_FIELD_PTR(evtchn_mask[0]),
> > + GET_FIELD_SIZE(evtchn_mask[0]), "\n");
> > + }
>
> What about domains using FIFO? This is meaningless for them.
>

Indeed, but this is essentially a debug tool so I'd rather it just dumped everything that might be useful.

> > +
> > + printf(" wc: version: %u sec: %u nsec: %u\n",
> > + GET_FIELD(wc_version), GET_FIELD(wc_sec), GET_FIELD(wc_nsec));
>
> wc_sec_hi is also a rather critical field in this calculation.
>

Ok.

> > +
> > +#undef GET_FIELD
> > +#undef GET_FIELD_SIZE
> > +#undef GET_FIELD_PTR
> > +}
> > +
> > static void dump_end(void)
> > {
> > DOMAIN_SAVE_TYPE(END) *e;
> > @@ -173,6 +250,7 @@ int main(int argc, char **argv)
> > switch (desc->typecode)
> > {
> > case DOMAIN_SAVE_CODE(HEADER): dump_header(); break;
> > + case DOMAIN_SAVE_CODE(SHARED_INFO): dump_shared_info(); break;
> > case DOMAIN_SAVE_CODE(END): dump_end(); break;
> > default:
> > printf("Unknown type %u: skipping\n", desc->typecode);
> > diff --git a/xen/common/domain.c b/xen/common/domain.c
> > index 8cfa2e0b6b..6709f9c79e 100644
> > --- a/xen/common/domain.c
> > +++ b/xen/common/domain.c
> > @@ -33,6 +33,7 @@
> > #include <xen/xenoprof.h>
> > #include <xen/irq.h>
> > #include <xen/argo.h>
> > +#include <xen/save.h>
> > #include <asm/debugger.h>
> > #include <asm/p2m.h>
> > #include <asm/processor.h>
> > @@ -1657,6 +1658,110 @@ int continue_hypercall_on_cpu(
> > return 0;
> > }
> >
> > +static int save_shared_info(const struct domain *d, struct domain_context *c,
> > + bool dry_run)
> > +{
> > + struct domain_shared_info_context ctxt = {
> > +#ifdef CONFIG_COMPAT
> > + .flags = has_32bit_shinfo(d) ? DOMAIN_SAVE_32BIT_SHINFO : 0,
> > + .buffer_size = has_32bit_shinfo(d) ?
> > + sizeof(struct compat_shared_info) :
> > + sizeof(struct shared_info),
> > +#else
> > + .buffer_size = sizeof(struct shared_info),
> > +#endif
> > + };
> > + size_t hdr_size = offsetof(typeof(ctxt), buffer);
> > + int rc;
> > +
> > + rc = DOMAIN_SAVE_BEGIN(SHARED_INFO, c, 0);
> > + if ( rc )
> > + return rc;
> > +
> > + rc = domain_save_data(c, &ctxt, hdr_size);
> > + if ( rc )
> > + return rc;
> > +
> > + rc = domain_save_data(c, d->shared_info, ctxt.buffer_size);
> > + if ( rc )
> > + return rc;
> > +
> > + return domain_save_end(c);
> > +}
> > +
> > +static int load_shared_info(struct domain *d, struct domain_context *c)
> > +{
> > + struct domain_shared_info_context ctxt;
> > + size_t hdr_size = offsetof(typeof(ctxt), buffer);
> > + unsigned int i;
> > + int rc;
> > +
> > + rc = DOMAIN_LOAD_BEGIN(SHARED_INFO, c, &i);
> > + if ( rc )
> > + return rc;
> > +
> > + if ( i ) /* expect only a single instance */
> > + return -ENXIO;
> > +
> > + rc = domain_load_data(c, &ctxt, hdr_size);
> > + if ( rc )
> > + return rc;
> > +
> > + if ( ctxt.buffer_size > sizeof(shared_info_t) ||
> > + (ctxt.flags & ~DOMAIN_SAVE_32BIT_SHINFO) )
> > + return -EINVAL;
> > +
> > + if ( ctxt.flags & DOMAIN_SAVE_32BIT_SHINFO )
> > + {
> > +#ifdef CONFIG_COMPAT
> > + has_32bit_shinfo(d) = true;
>
> d->arch.has_32bit_shinfo
>

If you'd prefer, ok.

> > +#else
> > + return -EINVAL;
> > +#endif
> > + }
> > +
> > + if ( is_pv_domain(d) )
> > + {
> > + shared_info_t *shinfo = xmalloc(shared_info_t);
> > +
> > + if ( !shinfo )
> > + return -ENOMEM;
> > +
> > + rc = domain_load_data(c, shinfo, sizeof(*shinfo));
> > + if ( rc )
> > + goto out;
>
> There's no need for a memory allocation, or to double buffer this data.
> You can memcpy() straight out of the context record.
>

That would mean re-working the way that domain_load_data() works. I'd really rather not.

> > +
> > + memcpy(&shared_info(d, vcpu_info), &__shared_info(d, shinfo, vcpu_info),
> > + sizeof(shared_info(d, vcpu_info)));
> > + memcpy(&shared_info(d, arch), &__shared_info(d, shinfo, arch),
> > + sizeof(shared_info(d, arch)));
> > +
> > + memset(&shared_info(d, evtchn_pending), 0,
> > + sizeof(shared_info(d, evtchn_pending)));
> > + memset(&shared_info(d, evtchn_mask), 0xff,
> > + sizeof(shared_info(d, evtchn_mask)));
> > +
> > + shared_info(d, arch.pfn_to_mfn_frame_list_list) = 0;
> > + for ( i = 0; i < XEN_LEGACY_MAX_VCPUS; i++ )
> > + shared_info(d, vcpu_info[i].evtchn_pending_sel) = 0;
>
> What is the plan for transparent migrate here? While this is ok for
> regular migrate, its definitely not for transparent.
>

Quite true, as evidenced that this is inside 'if ( is_pv_domain(d) )'. It is not yet clear how much of the shared info we need for transparent migrate. It may be nothing.

> > +
> > + rc = domain_load_end(c, false);
> > +
> > + out:
> > + xfree(shinfo);
> > + }
> > + else
> > + /*
> > + * No modifications to shared_info are required for restoring non-PV
> > + * domains.
> > + */
> > + rc = domain_load_end(c, true);
> > +
> > + return rc;
> > +}
> > +
> > +DOMAIN_REGISTER_SAVE_LOAD(SHARED_INFO, save_shared_info, load_shared_info);
> > +
> > /*
> > * Local variables:
> > * mode: C
> > diff --git a/xen/include/public/save.h b/xen/include/public/save.h
> > index 551dbbddb8..0e855a4b97 100644
> > --- a/xen/include/public/save.h
> > +++ b/xen/include/public/save.h
> > @@ -82,7 +82,18 @@ struct domain_save_header {
> > };
> > DECLARE_DOMAIN_SAVE_TYPE(HEADER, 1, struct domain_save_header);
> >
> > -#define DOMAIN_SAVE_CODE_MAX 1
> > +struct domain_shared_info_context {
> > + uint32_t flags;
> > +
> > +#define DOMAIN_SAVE_32BIT_SHINFO 0x00000001
> > +
> > + uint32_t buffer_size;
>
> This struct is already wrapped with a header including a size which
> encompasses buffer.
>
> Multiple overlapping size fields is an easy way to memory corruption,
> because it causes ambiguity as to which one is right.
>

The record size currently includes padding. I'm re-working that in v10 and so this size can be dropped.

Paul
Re: [PATCH v9 6/8] common/domain: add a domain context record for shared_info... [ In reply to ]
On 05.10.2020 12:39, Andrew Cooper wrote:
> On 24/09/2020 14:10, Paul Durrant wrote:
>> +static int load_shared_info(struct domain *d, struct domain_context *c)
>> +{
>> + struct domain_shared_info_context ctxt;
>> + size_t hdr_size = offsetof(typeof(ctxt), buffer);
>> + unsigned int i;
>> + int rc;
>> +
>> + rc = DOMAIN_LOAD_BEGIN(SHARED_INFO, c, &i);
>> + if ( rc )
>> + return rc;
>> +
>> + if ( i ) /* expect only a single instance */
>> + return -ENXIO;
>> +
>> + rc = domain_load_data(c, &ctxt, hdr_size);
>> + if ( rc )
>> + return rc;
>> +
>> + if ( ctxt.buffer_size > sizeof(shared_info_t) ||
>> + (ctxt.flags & ~DOMAIN_SAVE_32BIT_SHINFO) )
>> + return -EINVAL;
>> +
>> + if ( ctxt.flags & DOMAIN_SAVE_32BIT_SHINFO )
>> + {
>> +#ifdef CONFIG_COMPAT
>> + has_32bit_shinfo(d) = true;
>
> d->arch.has_32bit_shinfo

But this is common code, i.e. using d->arch directly is a layering
violation. I know your dislike of lvalues disguised by function-
like macros, but what do you do?

Jan