x86/shim: Short circuit control/hardware checks in PV_SHIM_EXCLUSIVE builds
diff mbox series

Message ID 20200103200742.23917-1-andrew.cooper3@citrix.com
State New
Headers show
Series
  • x86/shim: Short circuit control/hardware checks in PV_SHIM_EXCLUSIVE builds
Related show

Commit Message

Andrew Cooper Jan. 3, 2020, 8:07 p.m. UTC
The net diffstat is:
  add/remove: 0/13 grow/shrink: 25/129 up/down: 6297/-20469 (-14172)

With the following objects/functions removed entirely:
  iommu_hwdom_none                               1       -      -1
  hwdom_max_order                                4       -      -4
  extra_hwdom_irqs                               4       -      -4
  ctldom_max_order                               4       -      -4
  acpi_c1e_quirk                                43       -     -43
  hvm_pirq_eoi                                  62       -     -62
  max_order                                     94       -     -94
  conring_puts                                 104       -    -104
  propagate_node                               119       -    -119
  mmio_ro_emulate_ops                          224       -    -224
  mmcfg_intercept_ops                          224       -    -224
  pci_cfg_ok                                   295       -    -295
  p2m_lock                                     546       -    -546

And the following reduced to stubs:
  arch_iommu_hwdom_init                        852       2    -850
  p2m_add_foreign                              880      16    -864

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wl@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Sergey Dyasli <sergey.dyasli@citrix.com>
---
 xen/include/xen/sched.h | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

Comments

Wei Liu Jan. 5, 2020, 4:30 p.m. UTC | #1
On Fri, Jan 03, 2020 at 08:07:42PM +0000, Andrew Cooper wrote:
> The net diffstat is:
>   add/remove: 0/13 grow/shrink: 25/129 up/down: 6297/-20469 (-14172)
> 
> With the following objects/functions removed entirely:
>   iommu_hwdom_none                               1       -      -1
>   hwdom_max_order                                4       -      -4
>   extra_hwdom_irqs                               4       -      -4
>   ctldom_max_order                               4       -      -4
>   acpi_c1e_quirk                                43       -     -43
>   hvm_pirq_eoi                                  62       -     -62
>   max_order                                     94       -     -94
>   conring_puts                                 104       -    -104
>   propagate_node                               119       -    -119
>   mmio_ro_emulate_ops                          224       -    -224
>   mmcfg_intercept_ops                          224       -    -224
>   pci_cfg_ok                                   295       -    -295
>   p2m_lock                                     546       -    -546
> 
> And the following reduced to stubs:
>   arch_iommu_hwdom_init                        852       2    -850
>   p2m_add_foreign                              880      16    -864
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Wei Liu <wl@xen.org>
Jan Beulich Jan. 6, 2020, 10:13 a.m. UTC | #2
On 03.01.2020 21:07, Andrew Cooper wrote:
> --- a/xen/include/xen/sched.h
> +++ b/xen/include/xen/sched.h
> @@ -963,10 +963,22 @@ void watchdog_domain_destroy(struct domain *d);
>   *    (that is, this would not be suitable for a driver domain)
>   *  - There is never a reason to deny the hardware domain access to this
>   */
> -#define is_hardware_domain(_d) evaluate_nospec((_d) == hardware_domain)
> +static always_inline bool is_hardware_domain(const struct domain *d)
> +{
> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
> +        return false;
> +
> +    return evaluate_nospec(d == hardware_domain);
> +}
>  
>  /* This check is for functionality specific to a control domain */
> -#define is_control_domain(_d) evaluate_nospec((_d)->is_privileged)
> +static always_inline bool is_control_domain(const struct domain *d)
> +{
> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
> +        return false;
> +
> +    return evaluate_nospec(d->is_privileged);
> +}

Besides its intended purpose this also fixes (but only for the
shim-exclusive case) an interaction issue with LATE_HWDOM: If in
shim mode the "hardware_dom=1" command line option was used,
misbehavior would result afaict. Therefore I think this wants
amending with adjustments to also make the !PV_SHIM_EXCLUSIVE
case work correctly (read: ignore that command line option). I
guess additionally LATE_HWDOM should also depend on
!PV_SHIM_EXCLUSIVE (and/or vice versa).

Jan
Andrew Cooper Jan. 6, 2020, 5:16 p.m. UTC | #3
On 06/01/2020 10:13, Jan Beulich wrote:
> On 03.01.2020 21:07, Andrew Cooper wrote:
>> --- a/xen/include/xen/sched.h
>> +++ b/xen/include/xen/sched.h
>> @@ -963,10 +963,22 @@ void watchdog_domain_destroy(struct domain *d);
>>   *    (that is, this would not be suitable for a driver domain)
>>   *  - There is never a reason to deny the hardware domain access to this
>>   */
>> -#define is_hardware_domain(_d) evaluate_nospec((_d) == hardware_domain)
>> +static always_inline bool is_hardware_domain(const struct domain *d)
>> +{
>> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
>> +        return false;
>> +
>> +    return evaluate_nospec(d == hardware_domain);
>> +}
>>  
>>  /* This check is for functionality specific to a control domain */
>> -#define is_control_domain(_d) evaluate_nospec((_d)->is_privileged)
>> +static always_inline bool is_control_domain(const struct domain *d)
>> +{
>> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
>> +        return false;
>> +
>> +    return evaluate_nospec(d->is_privileged);
>> +}
> Besides its intended purpose this also fixes (but only for the
> shim-exclusive case) an interaction issue with LATE_HWDOM: If in
> shim mode the "hardware_dom=1" command line option was used,
> misbehavior would result afaict.

Perhaps, but there are plenty of other ways to break things using the
shims command line.

Remember that the shim command line is not under user control at all.

> Therefore I think this wants
> amending with adjustments to also make the !PV_SHIM_EXCLUSIVE
> case work correctly (read: ignore that command line option). I
> guess additionally LATE_HWDOM should also depend on
> !PV_SHIM_EXCLUSIVE (and/or vice versa).

No - such a bugfix should be a separate change, because it is not
related to this patch.

Fixing it would require extra x86 #ifdef-ary in common code.  While this
is doable, there is also work in progress from the OpenXT folk to
completely overhaul how that mechanism works (which will in practice
remove the command line parameter).

Given both of these aspects, I'm tempted to leave it as-is for now.

~Andrew
Jan Beulich Jan. 7, 2020, 9:05 a.m. UTC | #4
On 06.01.2020 18:16, Andrew Cooper wrote:
> On 06/01/2020 10:13, Jan Beulich wrote:
>> On 03.01.2020 21:07, Andrew Cooper wrote:
>>> --- a/xen/include/xen/sched.h
>>> +++ b/xen/include/xen/sched.h
>>> @@ -963,10 +963,22 @@ void watchdog_domain_destroy(struct domain *d);
>>>   *    (that is, this would not be suitable for a driver domain)
>>>   *  - There is never a reason to deny the hardware domain access to this
>>>   */
>>> -#define is_hardware_domain(_d) evaluate_nospec((_d) == hardware_domain)
>>> +static always_inline bool is_hardware_domain(const struct domain *d)
>>> +{
>>> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
>>> +        return false;
>>> +
>>> +    return evaluate_nospec(d == hardware_domain);
>>> +}
>>>  
>>>  /* This check is for functionality specific to a control domain */
>>> -#define is_control_domain(_d) evaluate_nospec((_d)->is_privileged)
>>> +static always_inline bool is_control_domain(const struct domain *d)
>>> +{
>>> +    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
>>> +        return false;
>>> +
>>> +    return evaluate_nospec(d->is_privileged);
>>> +}
>> Besides its intended purpose this also fixes (but only for the
>> shim-exclusive case) an interaction issue with LATE_HWDOM: If in
>> shim mode the "hardware_dom=1" command line option was used,
>> misbehavior would result afaict.
> 
> Perhaps, but there are plenty of other ways to break things using the
> shims command line.
> 
> Remember that the shim command line is not under user control at all.
> 
>> Therefore I think this wants
>> amending with adjustments to also make the !PV_SHIM_EXCLUSIVE
>> case work correctly (read: ignore that command line option). I
>> guess additionally LATE_HWDOM should also depend on
>> !PV_SHIM_EXCLUSIVE (and/or vice versa).
> 
> No - such a bugfix should be a separate change, because it is not
> related to this patch.
> 
> Fixing it would require extra x86 #ifdef-ary in common code.  While this
> is doable, there is also work in progress from the OpenXT folk to
> completely overhaul how that mechanism works (which will in practice
> remove the command line parameter).
> 
> Given both of these aspects, I'm tempted to leave it as-is for now.

Okay, yet may I ask that you mention the partial bug fix in the
description?

Jan
Sergey Dyasli Jan. 7, 2020, 9:08 a.m. UTC | #5
On 03/01/2020 20:07, Andrew Cooper wrote:
> The net diffstat is:
>   add/remove: 0/13 grow/shrink: 25/129 up/down: 6297/-20469 (-14172)
> 
> With the following objects/functions removed entirely:
>   iommu_hwdom_none                               1       -      -1
>   hwdom_max_order                                4       -      -4
>   extra_hwdom_irqs                               4       -      -4
>   ctldom_max_order                               4       -      -4
>   acpi_c1e_quirk                                43       -     -43
>   hvm_pirq_eoi                                  62       -     -62
>   max_order                                     94       -     -94
>   conring_puts                                 104       -    -104
>   propagate_node                               119       -    -119
>   mmio_ro_emulate_ops                          224       -    -224
>   mmcfg_intercept_ops                          224       -    -224
>   pci_cfg_ok                                   295       -    -295
>   p2m_lock                                     546       -    -546
> 
> And the following reduced to stubs:
>   arch_iommu_hwdom_init                        852       2    -850
>   p2m_add_foreign                              880      16    -864
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

I tested this patch some time ago on a private branch, so

	Tested-by: Sergey Dyasli <sergey.dyasli@citrix.com>

Thanks,
Sergey

Patch
diff mbox series

diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index a2accd90f6..cc942a3621 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -963,10 +963,22 @@  void watchdog_domain_destroy(struct domain *d);
  *    (that is, this would not be suitable for a driver domain)
  *  - There is never a reason to deny the hardware domain access to this
  */
-#define is_hardware_domain(_d) evaluate_nospec((_d) == hardware_domain)
+static always_inline bool is_hardware_domain(const struct domain *d)
+{
+    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
+        return false;
+
+    return evaluate_nospec(d == hardware_domain);
+}
 
 /* This check is for functionality specific to a control domain */
-#define is_control_domain(_d) evaluate_nospec((_d)->is_privileged)
+static always_inline bool is_control_domain(const struct domain *d)
+{
+    if ( IS_ENABLED(CONFIG_PV_SHIM_EXCLUSIVE) )
+        return false;
+
+    return evaluate_nospec(d->is_privileged);
+}
 
 #define VM_ASSIST(d, t) (test_bit(VMASST_TYPE_ ## t, &(d)->vm_assist))