On Fri, Oct 29, 2021, Maciej S. Szmigiero wrote:
> On 28.10.2021 19:53, Sean Christopherson wrote:
> > Hmm, no, this is trivial to handle, though admittedly a bit unpleasant.
> >
> > /*
> > * Note, kvm_memslot_iter_start() finds the first memslot that _may_ overlap
> > * the range, it does not verify that there is actual overlap. The check in
> > * the loop body filters out the case where the highest memslot with a base_gfn
> > * below start doesn't actually overlap.
> > */
> > #define kvm_for_each_memslot_in_gfn_range(iter, node, slots, start, end) \
> > for (kvm_memslot_iter_start(iter, node, slots, start, end); \
> > kvm_memslot_iter_is_valid(iter); \
> > kvm_memslot_iter_next(node)) \
> > if (iter->slot->base_gfn + iter->slot->npages < start) { \
> > } else
>
> As you say, that's rather unpleasant, since we know that the first
> returned memslot is the only one that's possibly *not* overlapping
> (and then it only happens sometimes).
> Yet with the above change we'll pay the price of this check for every
> loop iteration (for every returned memslot).
I'm definitely not saying that it's the best/right/only way to handle this,
merely pointing out that it's not _that_ complex, modulo off-by-one bugs :-)
> That's definitely not optimizing for the most common case.
Meh, it's a nop for kvm_check_memslot_overlap() and completely in the noise for
kvm_zap_gfn_range(). Not saying I disagree that's a flawed way to handle this
just saying that even the quick-and-dirty solution is extremely unlikely to be
relevant to performance.
> Also, the above code has a bug - using a [start, end) notation compatible
> with what kvm_for_each_memslot_in_gfn_range() expects, where [1, 4)
> means a range consisting of { 1, 2, 3 }, consider a tree consisting of the
> following two memslots: [1, 2), [3, 5)
>
> When kvm_for_each_memslot_in_gfn_range() is then called to "return"
> memslots overlapping range [2, 4) it will "return" the [1, 2) memslot, too -
> even though it does *not* actually overlap the requested range.
>
> While this bug is easy to fix (just use "<=" instead of "<") it serves to
> underline that one has to be very careful with working with this type of
> code as it is very easy to introduce subtle mistakes here.
Yes, and that's exactly why I want to write this _once_.
> > Two _existing_ callers. Odds are very, very high that future usage of
> > kvm_for_each_memslot_in_gfn_range() will overlook the detail about the helper
> > not actually doing what it says it does. That could be addressed to some extent
> > by renaming it kvm_for_each_memslot_in_gfn_range_approx() or whatever, but as
> > above this isn't difficult to handle, just gross.
>
> What kind of future users of this API do you envision?
>
> I've pointed out above that adding this extra check means essentially
> optimizing for an uncommon case.
Usage similar to kvm_zap_gfn_range() where KVM wants to take action on a specific
gfn range. I'm actually somewhat surprised that none of the other architectures
have a use case in their MMUs, though I don't know the story for things like
shadow paging that "necessitate" x86's behavior.
> One of the callers of this function already has the necessary code to
> reject non-overlapping memslots and have to keep it to calculate the
> effective overlapping range for each memslot.
> For the second caller (which, by the way, is called much less often than
> kvm_zap_gfn_range()) it's a matter of one extra condition.
>
> > > In case of kvm_zap_gfn_range() the necessary checking is already
> > > there and has to be kept due to the above range merging.
> > >
> > > Also, a code that is simpler is easier to understand, maintain and
> > > so less prone to subtle bugs.
> >
> > Heh, and IMO that's an argument for putting all the complexity into a single
> > location. :-)
> >
>
> If you absolutely insist then obviously I can change the code to return
> only memslots strictly overlapping the requested range in the next
> patchset version.
I feel pretty strongly that the risk vs. reward is heavily in favor of returning
only strictly overlapping memslots. The risk being that a few years down the road
someone runs afoul of this and we end up with a bug in production. The reward is
avoiding writing moderately complex code and at best shave a few uops in an x86
slooow path. It's entirely possible there's never a third user, but IMO there
isn't enough reward to justify even the smallest amount of risk.
Paolo, any opinion?
