Wei Liu [Thu, 4 Sep 2014 22:43:08 +0000 (23:43 +0100)]
libxl: functions to lock / unlock libxl userdata store
This lock is used to protect all userdata files related to a particular
domain, which include but are not limited to domain configuration. A
new "domain-userdata-lock" entry is introduced in libxl registry.
This lock works among different processes and different threads within
the same process.
Locking protocol inspired by Ian Jackson's chiark-utils with-lock-ex. A
file lock is taken with flock(2). If that succeeds that thread fstat the
fd and stat the lock file path. If the device and inode match then the
lock has been successfully acquired. This lock remains acquired until
the lock file gets deleted or released by flock(2). If device and inode
don't match then another thread acquired the lock and deleted the file
in the meantime; lock procedure should restart.
Portability note: this lock utilises flock(2) so a proper implementation
of flock(2) is required -- that is, it should not be implemented with
fcntl(2).
Signed-off-by: Wei Liu <wei.liu2@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
The flag specifies that the hypervisor maps a grant page to guest
physical address == machine address of the page in addition to the
normal grant mapping address.
Frontends are allowed to map the same page multiple times using multiple
grant references. On the backend side it can be difficult to find out
the physical address corresponding to a particular machine address,
especially at the completion of a dma operation. To simplify address
translations, we introduce a second mapping of the grant at physical
address == machine address so that dom0 can issue cache maintenance
operations without having to find the pfn.
Call arch_grant_map_page_identity and arch_grant_unmap_page_identity
from __gnttab_map_grant_ref and __gnttab_unmap_common to introduce the
second mapping if the domain is directly mapped. To do so we also need
to change gnttab_need_iommu_mapping to just be defined as
is_domain_direct_mapped on arm.
Remove arm_smmu_map_page and arm_smmu_unmap_page as they have become
unused.
Introduce two arch specific functions to create a new p2m mapping of
granted pages at pfn == mfn.
We don't an x86 implementation as these functions should never be
compiled on x86 (they are called from an if (0) statement).
Base the implementation of arm_smmu_(un)map_page on
arch_grant_(un)map_page_identity.
xen/arm: domain_vgic_init: Avoid double free on shared_irqs
When the function domain_vgic_init is failing to initialize pending_irqs,
it will free shared_irqs. Few call later, domain_vgic_free will be called
an try to free a second time the same variable. This will result to a double
free.
Remove the free in domain_vgic_init and rely on domain_vgic_free to correctly
release the memory.
Signed-off-by: Julien Grall <julien.grall@linaro.org> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Karim Raslan [Fri, 8 Aug 2014 15:47:37 +0000 (16:47 +0100)]
mini-os: arm: events
Signed-off-by: Karim Allah Ahmed <karim.allah.ahmed@gmail.com> Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Thomas Leonard [Fri, 8 Aug 2014 15:47:36 +0000 (16:47 +0100)]
mini-os: arm: scheduling
Based on an initial patch by Karim Raslan.
Signed-off-by: Karim Allah Ahmed <karim.allah.ahmed@gmail.com> Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Thomas Leonard [Fri, 8 Aug 2014 15:47:35 +0000 (16:47 +0100)]
mini-os: arm: memory management
Based on an initial patch by Karim Raslan.
Signed-off-by: Karim Allah Ahmed <karim.allah.ahmed@gmail.com> Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Thomas Leonard [Fri, 8 Aug 2014 15:47:34 +0000 (16:47 +0100)]
mini-os: arm: boot code
Based on an initial patch by Karim Raslan.
Signed-off-by: Karim Allah Ahmed <karim.allah.ahmed@gmail.com> Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Karim Raslan [Fri, 8 Aug 2014 15:47:33 +0000 (16:47 +0100)]
mini-os: arm: add header files
Adds header files for future ARM support.
Based on work by Karim Allah Ahmed.
Signed-off-by: Karim Allah Ahmed <karim.allah.ahmed@gmail.com> Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Julien Grall <julien.grall@linaro.org> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Thomas Leonard [Fri, 8 Aug 2014 15:47:30 +0000 (16:47 +0100)]
mini-os: don't include lib.h from mm.h
This breaks the include cycle hypervisor.h -> hypercall-x86_32.h -> mm.h
-> lib.h -> gntmap.h -> os.h -> hypervisor.h.
Signed-off-by: Thomas Leonard <talex5@gmail.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Andrew Cooper [Fri, 15 Aug 2014 14:32:57 +0000 (15:32 +0100)]
tools/libxl: Fix build of libxl with ./configure --disable-blktap2
Autoconf already has appropriate Linux/non-Linux logic for CONFIG_BLKTAP2.
Let LIBXL_BLKTAP inherit directly from CONFIG_BLKTAP2, rather than requiring a
further LIBXL_BLKTAP=n in addition to ./configure --disable-blktap2 to get
libxl to successfully link under Linux.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> CC: Ian Campbell <Ian.Campbell@citrix.com> CC: Ian Jackson <Ian.Jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
M A Young [Sun, 7 Sep 2014 19:10:33 +0000 (20:10 +0100)]
tools/ocaml: remove uint32 use
OCaml is replacing its own uint32 type with the ISO C99 uint32_t type
in 4.03.0+dev. Ths patch replaces the remaining uses of uint32 with
uint32_t in the ocaml C code for xen.
Signed-off-by: Michael Young <m.a.young@durham.ac.uk> Acked-by: David Scott <dave.scott@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Tested-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Elena Ufimtseva [Fri, 5 Sep 2014 09:02:22 +0000 (11:02 +0200)]
libxc: Introduce xc_domain_setvnuma to set vNUMA
With the introduction of the XEN_DOMCTL_setvnumainfo
in patch titled: "xen: vnuma topology and subop hypercalls"
we put in the plumbing here to use from the toolstack. The user
is allowed to call this multiple times if they wish so.
It will error out if the nr_vnodes or nr_vcpus is zero.
Signed-off-by: Elena Ufimtseva <ufimtseva@gmail.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Elena Ufimtseva [Fri, 5 Sep 2014 09:01:45 +0000 (11:01 +0200)]
xsm bits for vNUMA hypercalls
Define xsm_get_vnumainfo hypercall used for domain which
wish to receive vnuma topology. Add xsm hook for
XEN_DOMCTL_setvnumainfo. Also adds basic policies.
Signed-off-by: Elena Ufimtseva <ufimtseva@gmail.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Elena Ufimtseva [Fri, 5 Sep 2014 09:00:57 +0000 (11:00 +0200)]
xen: vnuma topology and subop hypercalls
Define interface, structures and hypercalls for toolstack to
build vnuma topology and for guests that wish to retrieve it.
Two subop hypercalls introduced by patch:
XEN_DOMCTL_setvnumainfo to define vNUMA domain topology per domain
and XENMEM_get_vnumainfo to retrieve that topology by guest.
Signed-off-by: Elena Ufimtseva <ufimtseva@gmail.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arm: make accesses to desc->status flags atomic
This way we don't need to take the desc->lock in order to access
desc->status in many of the gic and vgic functions.
Using *_bit manipulation functions on desc->status is safe on arm64:
status is an unsigned int but is the first field of a struct that
contains pointers, therefore the alignement of the struct is at least 8
bytes.
xen/arm: take the rank lock before accessing ipriority
Currently we read ipriority from vgic_vcpu_inject_irq without taking the
rank lock. Fix that by taking the rank lock and reading ipriority at the
beginning of the function.
As vgic_vcpu_inject_irq is called from the irq.c upon receiving an
interrupt, we need to change the implementation of vgic_lock/unlock_rank
to spin_lock_irqsave to make it safe in irq context.
xen: remove workaround to inject evtchn_irq on irq enable
evtchn_upcall_pending is already set by common code at vcpu creation,
therefore on ARM we also need to call vgic_vcpu_inject_irq for it.
Currently we do that from vgic_enable_irqs as a workaround.
Do this properly by introducing an appropriate arch specific hook:
arch_evtchn_inject. arch_evtchn_inject is called by map_vcpu_info to
inject the evtchn irq into the guest. On ARM is implemented by calling
vgic_vcpu_inject_irq.
On x86 guests typically don't call VCPUOP_register_vcpu_info on vcpu0,
therefore avoiding the issue. However theoretically they could call
VCPUOP_register_vcpu_info on vcpu0 and in that case Xen would need to
inject the event channel notification into the guest if the guest is
HVM. So implement arch_evtchn_inject on x86 by calling
hvm_assert_evtchn_irq.
Migrate physical irqs to the same physical cpu that is running the vcpu
expected to receive the irqs. That is done when enabling irqs, when the
guest writes to GICD_ITARGETSR and when Xen migrates a vcpu to a
different pcpu.
In case of virq migration, if the virq is inflight and in a GICH_LR
register already, delay migrating the corresponding physical irq until
the virq is EOIed by the guest and the MIGRATING flag has been cleared.
This way we make sure that the pcpu running the old vcpu gets
interrupted with a new irq of the same kind, clearing the GICH_LR sooner.
Introduce a new arch specific function, arch_move_irqs, that is empty on
x86 and implements the vgic irq migration code on ARM.
arch_move_irqs is going to be called by from sched.c.
Use vgic_get_target_vcpu to retrieve the target vcpu from do_IRQ.
Remove in-code comments about missing implementation of SGI delivery to
vcpus other than 0.
We need to take special care when migrating irqs that are already
inflight from one vcpu to another. See "The effect of changes to an
GICD_ITARGETSR", part of chapter 4.3.12 of the ARM Generic Interrupt
Controller Architecture Specification, IHI 0048B.
The main issue from the Xen point of view is that the lr_pending and
inflight lists are per-vcpu. The lock we take to protect them is also
per-vcpu.
In order to avoid issues, if the irq is still lr_pending, we can
immediately move it to the new vcpu for injection.
Otherwise if it is in a GICH_LR register, set a new flag
GIC_IRQ_GUEST_MIGRATING. If GIC_IRQ_GUEST_MIGRATING is set we'll change
the affinity of the physical irq when clearing the LR (in a following
commit). Therefore if the irq is inflight in an LR when the guest writes
to itarget, we wait until the LR is cleared before changing physical
irq affinity. This guarantees that the old vcpu is going to be
interrupted and clear the LR, either because it has been descheduled
after EOIing the interrupt or because it is interrupted by the second
physical irq coming.
xen/arm: observe itargets setting in vgic_enable_irqs and vgic_disable_irqs
vgic_enable_irqs should enable irq delivery to the vcpu specified by
GICD_ITARGETSR, rather than the vcpu that wrote to GICD_ISENABLER.
Similarly vgic_disable_irqs should use the target vcpu specified by
itarget to disable irqs.
itargets can be set to a mask but vgic_get_target_vcpu always returns
the lower vcpu in the mask.
Correctly initialize itargets for SPIs.
Ignore bits in GICD_ITARGETSR corresponding to invalid vcpus.
Jan Beulich [Wed, 3 Sep 2014 13:09:59 +0000 (15:09 +0200)]
x86/NMI: allow passing just "watchdog" again
This capability got inadvertently lost in commit 3ea2ba980a ("x86/NMI:
allow processing unknown NMIs when watchdog is enabled") due to an
oversight of mine.
Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Andrew Cooper [Wed, 3 Sep 2014 13:09:06 +0000 (15:09 +0200)]
x86/current: provide additional information to optimise get_cpu_info()
Exactly as with c/s d55c5eefe "x86: use compiler visible "add" instead of
inline assembly "or" in get_cpu_info()", this is achieved by providing more
information to the compiler.
This causes a net drop of almost 4K of .text
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Andrew Cooper [Wed, 3 Sep 2014 13:06:06 +0000 (15:06 +0200)]
x86/hvm: fix operator precedence bug introduced by 3d4d4f9336
Bitwise or has greater precedence than the ternary operator, making the result
of the expression a constant P2M_UNSHARE.
Coverity-ID: 1234633 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Don Slutz <dslutz@verizon.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:44 +0000 (18:29 +0200)]
tools/libxl: handle the iomem parameter with the memory_mapping hcall
Currently, the configuration-parsing code concerning the handling of the
iomem parameter only invokes the XEN_DOMCTL_iomem_permission hypercall.
This commit lets the XEN_DOMCTL_memory_mapping hypercall be invoked
after XEN_DOMCTL_iomem_permission when the iomem parameter is parsed
from a domU configuration file, so that the address range can be mapped
to the address space of the domU. The hypercall is invoked only in case
of domains using an auto-translated physmap.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com> Acked-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Jan Beulich <JBeulich@suse.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:43 +0000 (18:29 +0200)]
tools/libxl: parse optional start gfn from the iomem config option
Currently, the "iomem" domU config option allows to specify a machine
address range to be mapped to the domU. However, there is no way to
specify the guest address range used for the mapping. This commit
extends the iomem option handling code to parse an additional, optional
parameter: this parameter, if given, specifies the start guest address
used for the mapping; if no start guest address is given, a 1:1 mapping
is performed as default.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com> Acked-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Jan Beulich <JBeulich@suse.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:42 +0000 (18:29 +0200)]
xen/common: move the memory_mapping DOMCTL hypercall to common code
This commit moves to common code the implementation of the memory_mapping
DOMCTL, currently available only for the x86 architecture. It also adds
a definition for the PADDR_BITS constant for ARM, that is to be used in
common code and currently not available for the ARM architecture.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Jan Beulich <JBeulich@suse.com> Acked-by: Julien Grall <julien.grall@citrix.com> Tested-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:41 +0000 (18:29 +0200)]
xen/x86: factor out map and unmap from the memory_mapping DOMCTL
This commit factors out from the XEN_DOMCTL_memory_mapping hypercall
implementation, currently available only for x86, the operations
related to memory ranges map and unmap. The code is factored out
into two {map|unmap}_mmio_regions() functions for x86, that will match
the corresponding pair of ARM functions when the DOMCTL will be moved
to common code in the following commit. This commit also adds an
unmap_mmio_regions() function for ARM so that the following transition
to common code is cleaner.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com> Acked-by: Jan Beulich <JBeulich@suse.com> Acked-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:40 +0000 (18:29 +0200)]
xen/common: add ARM stub for the function memory_type_changed()
MTRR-related code is not available for the ARM architecture. Given
that the memory_type_changed() function would be called also from
common code, its invocation is currently ifdef'd out to be only
compiled in on an x86 machine. This commit adds an empty stub for ARM.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com> Acked-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Jan Beulich <JBeulich@suse.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:39 +0000 (18:29 +0200)]
arch/x86: cleanup memory_mapping DOMCTL
This commit lets the end mfn be computed only once while handling a
XEN_DOMCTL_memory_mapping hypercall. Also, the name of the tmp_rc
local variable is changed to rc.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Jan Beulich <JBeulich@suse.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Julien Grall <julien.grall@citrix.com> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:38 +0000 (18:29 +0200)]
arch/x86: warn if to-be-removed mapping does not exist
Currently, when a memory mapping is removed with the memory_mapping
DOMCTL, no check is performed on the existence of such a mapping.
This commit adds such a consistency check to the code performing the
unmap, emitting a warning message if the check fails.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Julien Grall <julien.grall@citrix.com> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
This commit modifies the function apply_p2m_changes() so that it
destroys changes performed while mapping a memory region, if errors are
seen during the operation. The implemented behaviour includes destroying
only mappings created during the latest invocation of apply_p2m_changes().
This is useful to avoid that memory areas remain partially accessible
to guests.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Julien Grall <julien.grall@citrix.com> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com> Cc: Jan Beulich <jbeulich@suse.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Arianna Avanzini [Sat, 30 Aug 2014 16:29:36 +0000 (18:29 +0200)]
arch/arm: add consistency check to REMOVE p2m changes
Currently, the REMOVE case of the switch in apply_p2m_changes()
does not perform any consistency check on the mapping to be removed.
More in detail, the code does not check if the guest address to be
unmapped is actually mapped to the machine address given as a
parameter.
This commit adds the above-described consistency check to the REMOVE
path of apply_p2m_changes() and lets a warning be emitted when trying
to remove a non-existent mapping. This is instrumental to one of the
following commits, which implements the possibility to trigger the
removal of p2m ranges via the memory_mapping DOMCTL for ARM.
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Julien Grall <julien.grall@citrix.com> Cc: Dario Faggioli <dario.faggioli@citrix.com> Cc: Paolo Valente <paolo.valente@unimore.it> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com> Cc: Jan Beulich <JBeulich@suse.com> Cc: Keir Fraser <keir@xen.org> Cc: Tim Deegan <tim@xen.org> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Eric Trudeau <etrudeau@broadcom.com> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com> Cc: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Stringify the register name in sysreg read write macros
The register name parameter in {READ,WRITE}_SYSREG{32,64}
macros is replaced as register name in mrs and msr assembly
instruction.
If this register name is macro indirection, the register
name is not replaced with designated macro. So replace the register
name with __stringify macro, which replaces register name
if it is macro
Signed-off-by: Vijaya Kumar K <Vijaya.Kumar@caviumnetworks.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Julien Grall <julien.grall@linaro.org>
Jan Beulich [Fri, 29 Aug 2014 10:22:42 +0000 (12:22 +0200)]
EPT: utilize GLA->GPA translation known for certain faults
Rather than doing the translation ourselves in __hvmemul_{read,write}()
leverage that we know the association for faults other than such having
occurred when translating addresses of page tables.
There is one intentional but not necessarily obvious (and possibly
subtle) adjustment to behavior: __hvmemul_read() no longer blindly
bails on instruction fetches matching the MMIO GVA (the callers of
handle_mmio_with_translation() now control the behavior via the struct
npfec they pass, and it didn't seem right to bail here rather than just
falling through to the unaccelerated path)
Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org>
Ian Campbell [Thu, 28 Aug 2014 20:25:21 +0000 (21:25 +0100)]
tools: (lib)xl: remove stray uses of build_info->u.pv.{kernel, ramdisk, cmdline}
The commit 11dffa2359e8 "xen: pass kernel initrd to qemu" deprecated these in
favour of build_info->{kernel,ramdisk,cmdline} but missed a couple of uses.
The ARM case breaks guest boot by omitting the command line from the DTB while
the xl SXP one is mostly cosmetic.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Cc: Chunyan Liu <cyliu@suse.com> Reviewed-by: Julien Grall <julien.grall@linaro.org>
Ross Lagerwall [Thu, 28 Aug 2014 14:11:37 +0000 (16:11 +0200)]
x86/NMI: allow processing unknown NMIs when watchdog is enabled
Change NMI processing so that if watchdog=force is passed on the
command-line and the NMI is not caused by a perf counter overflow (i.e.
likely not a watchdog "tick"), the NMI is handled by the unknown NMI
handler.
This allows injection of NMIs from IPMI controllers that don't set the
IOCK/SERR bits to trigger the unknown NMI handler rather than be
ignored.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Fix command line parsing (don't enable the watchdog on e.g.
"watchdog=xyz").
Juergen Gross [Thu, 28 Aug 2014 14:05:44 +0000 (16:05 +0200)]
update pvSCSI protocol description
Update the protocol description of the pvSCSI framework used to pass through
SCSI devices to a guest (pv or hvm).
The main changes are:
- added comments
- add support for larger SG-lists by putting them in an own granted page
- deprecate VSCSIIF_ACT_SCSI_SG_PRESET action with related structures
- add ref_rqid for action VSCSIIF_ACT_SCSI_ABORT to be able to specify the
request to abort
- deprecate timeout_per_command as this really should be handled by the
backend in case of default settings or by the guest domain by aborting a
long running command
This update is related to the rework of the pvSCSI backend and frontend drivers
in the Linux kernel. This interface version is included in that rework, too.
Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Andrew Cooper [Thu, 28 Aug 2014 14:05:10 +0000 (16:05 +0200)]
x86/ats: Disable Address Translation Services by default
Xen cannot safely use any ATS functionality until it gains asynchronous queued
invalidation support, because of the current synchronous wait for completion.
Do not turn ATS on by default.
While editing the default in the command line documentation, correct the
statement regarding PCI Passthrough. ATS is purely a performance
optimisation, and is certainly not required for PCI Passthrough to function.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Tamas K Lengyel [Thu, 28 Aug 2014 14:04:05 +0000 (16:04 +0200)]
x86/mem_event: deliver gla fault EPT violation information
On Intel EPT the exit qualification generated by a violation also
includes a bit (EPT_GLA_FAULT) which describes the following
information: Set if the access causing the EPT violation is to a
guest-physical address that is the translation of a linear address.
Clear if the access causing the EPT violation is to a paging-structure
entry as part of a page walk or the update of an accessed or dirty bit.
For more information see Table 27-7 in the Intel SDM.
This patch extends the mem_event system to deliver this extra
information, which could be useful for determining the cause of a
violation.
Signed-off-by: Tamas K Lengyel <tamas.lengyel@zentific.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Kevin Tian <kevin.tian@intel.com> Acked-by: Tim Deegan <tim@xen.org>
Tamas K Lengyel [Thu, 28 Aug 2014 14:03:26 +0000 (16:03 +0200)]
x86/hvm: treat non-instruction fetch nested page faults also as read violations
As pointed out by Jan Beulich in
http://lists.xen.org/archives/html/xen-devel/2014-08/msg01269.html:
"Read-modify-write instructions absolutely need to be treated as read
accesses, yet hardware doesn't guarantee to tell us so (they may
surface as just write accesses)." This patch addresses the issue in
both the VMX and the SVM side.
VMX: Treat all write data access violations also as read violations (in
addition to those that were already reported as read violations).
SVM: Refine the meaning of read data access violations to distinguish
between read/write and instruction fetch access violations.
With this patch both VMX and SVM specific nested page fault handling code reports violations the same way, thus abstracting the hardware specific behaviour from the layers above.
Suggested-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: Tamas K Lengyel <tamas.lengyel@zentific.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Reviewed-by: Tim Deegan <tim@xen.org>
Tamas K Lengyel [Thu, 28 Aug 2014 14:02:01 +0000 (16:02 +0200)]
x86: consolidate boolean inputs in hvm and p2m into a shared bitmap
This patch consolidates the boolean input parameters of
hvm_hap_nested_page_fault and p2m_mem_access_check into a common bitmap
and defines the bitmap members accordingly.
Signed-off-by: Tamas K Lengyel <tamas.lengyel@zentific.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Tim Deegan <tim@xen.org>
Andrew Cooper [Mon, 18 Aug 2014 13:02:37 +0000 (14:02 +0100)]
tools/libxl: Initialise both parts of ctx->sigchld_selfpipe[] to -1
Otherwise, if it is not used, libxl_ctx_free() will close fd 0.
Reported-by: Alex Bligh <alex@alex.org.uk> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> CC: Ian Campbell <Ian.Campbell@citrix.com> CC: Ian Jackson <Ian.Jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Boris Ostrovsky [Wed, 13 Aug 2014 16:40:38 +0000 (12:40 -0400)]
tools/libxc: Set max_elem to zero in xc_lockprof_query_number()
If max_elem is not zero then hypervisor's spinlock_profile_ucopy_elem()
will attempt to copy profile data into user's data buffer. Since this
buffer is explicitly set to (the equivalent of) NULL the copy will fail,
causing xenlockprof to fail as well.
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Anup Patel [Mon, 25 Aug 2014 10:18:40 +0000 (15:48 +0530)]
xen arm/arm64: minor improvement in smp_send_call_function_mask()
Currently, smp_send_call_function_mask() function implemented
by xen arm/arm64 will use IPI to call function on current CPU.
This means that current smp_send_call_function_mask() will do
the following on current CPU:
Trigger SGI for current CPU => Xen takes interrupt on current CPU
=> IPI interrupt handler will call smp_call_function_interrupt()
This patch improves the above by straight away calling
smp_call_function_interrupt() for current CPU. This is very
similar to smp_send_call_function_mask() implemented by Xen x86.
Chunyan Liu [Mon, 7 Jul 2014 06:34:34 +0000 (14:34 +0800)]
xl.cfg: add 'cmdline' in config file
Currently in xl.cfg, use 'root' and 'extra' to generate the command
line. 'cmdline' could be a more generic equivalent. So, add 'cmdline'
in xl.cfg and let it be preferred. 'root' and 'extra' still works.
But when 'cmdline' is specified, 'root' and 'extra' will be ignored.
Chunyan Liu [Mon, 7 Jul 2014 06:34:33 +0000 (14:34 +0800)]
xen: pass kernel initrd to qemu
xen side patch to support xen HVM direct kernel boot:
support 'kernel', 'ramdisk', 'cmdline' (and 'root', 'extra' as well
which would be deprecated later) in HVM config file, parse config file,
pass -kernel, -initrd, -append parameters to qemu.
It's working with qemu-xen when using the default BIOS (seabios).
White, Edmund H [Wed, 13 Aug 2014 19:08:18 +0000 (19:08 +0000)]
libxl: Allow multiple serial ports on HVM domain creation
This patch allows an HVM domain to be created with multiple serial
ports.
Since the previous interface only allowed the passing of a single
device, this requires us to add a new element to the hvm struct of
libxl_domain_build_info -- serial_list. For API compatibility, the
old element, serial, remains.
If hvm.serial_list is set, each device listed will cause an extra
"-serial [foo]" to be appended to the qemu command line.
Callers may set either hvm.serial or hvm.serial_list, but not
both; libxl will throw an error if both are set.
In order to allow users of libxl to write software compatible with
older versions of libxl, also define LIBXL_HAVE_BUILDINFO_SERIAL_LIST.
If this is defined, callers may use either hvm.serial or
hvm.serial_list; otherwise, only hvm.serial will be available.
Jan Beulich [Tue, 26 Aug 2014 15:56:52 +0000 (17:56 +0200)]
x86/IO-APIC: don't process softirqs during early boot
Commit e13b320399 ("x86/irq: process softirqs in irq keyhandlers")
made this unconditional, but the boot time use of __print_IO_APIC()
(when "apic_verbosity=debug" was given) can't tolerate that.
Reported-by: Sander Eikelenboom <linux@eikelenboom.it> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
Razvan Cojocaru [Tue, 26 Aug 2014 15:54:34 +0000 (17:54 +0200)]
VMX: use #defines instead of magic constants
Now using a combination of INTR_INFO_VECTOR_MASK,
INTR_INFO_INTR_TYPE_MASK and MASK_EXTR() to replace the old
"(ev >> 8) & 7, ev & 0xff" magic constant code in vmx.c.
Changes since V1:
- Fixed indentation.
Changes since V2:
- Fixed vmx_idtv_reinject() also.
Sugested-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com>
Li Liang [Fri, 22 Aug 2014 12:34:01 +0000 (14:34 +0200)]
x86/HVM: drop memory_type_changed() call from hvm_set_guest_pat()
The commit aa9114edd added the needless function call memory_type_changed,
it is unnessary because the PAT content does not influence the result of
epte_get_entry_emt(). If it is called, the cache will be flushed excessively
and make the nested guest very slowly, just like blocked.
No need to print these messages for each vCPU, even more, no need to
print them for each domain - they all depend on CPU features that are
either there or not.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Kevin Tian <kevin.tian@intel.com>
Jan Beulich [Fri, 22 Aug 2014 12:30:27 +0000 (14:30 +0200)]
VMX/vPMU: fix DebugCtl MSR handling
- writes with one of the vPMU-supported flags and some unsupported one
set got accepted, leading to a VM entry failure
- writes with one of the vPMU-supported flags set but the Debug Store
feature unavailable produced a #GP (other than other writes to this
MSR with unsupported bits set)
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Kevin Tian <kevin.tian@intel.com>
Jan Beulich [Fri, 22 Aug 2014 12:29:37 +0000 (14:29 +0200)]
VMX: fix DebugCtl MSR clearing
The previous shortcut was wrong, as it bypassed the necessary vmwrite:
All we really want to avoid if the guest writes zero is to add the MSR
to the host-load list.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Kevin Tian <kevin.tian@intel.com>
Andrew Cooper [Fri, 22 Aug 2014 12:28:12 +0000 (14:28 +0200)]
x86/intel: protect set_cpuidmask() against #GP faults
Virtual environments such as Xen HVM containers and VirtualBox do not
necessarily provide support for feature masking MSRs.
As their presence is detected by model numbers alone, and their use predicated
on command line parameters, use the safe() variants of {wr,rd}msr() to avoid
dying with an early #GP fault.
While playing in this function, make some further improvements.
* Rename the masking MSR names for consistency, and name the CPU models for
the benefit of humans reading the code.
* Correct the CPU selection as specified in the flexmigration document. All
steppings of 0x17 and 0x1a are stated to have masking MSRs.
* Provide log messages indicating the masks applied, or lack of masking
capabilities.
* In the case of faulting support being available and masking command line
options specified, provide a log message indicating the lack of masking.
Fabio Fantoni [Fri, 8 Aug 2014 10:46:35 +0000 (12:46 +0200)]
tools/hotplug/Linux/init.d: fix wrong path in xendomains init
Fixed wrong path in xendomains init that make it not working, introduced
in commit d8bad9df2544291a0fdc8e4d826b16f9f5394462 (tools/xendomains:
move to libexec and use a smaller init helper).
Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz> Reviewed-by: Wei Liu <wei.liu2@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Yang Hongyang [Mon, 28 Jul 2014 04:03:27 +0000 (12:03 +0800)]
tools: libxc: fix Remus failover regression
commit: c2ba706c "tools/libxc: goto correct label on error paths" by Andrew
Cooper broke Remus in Xen 4.4 or earlier versions that has this commit
backported.
With Remus, this jump essentially discards the current incomplete checkpoint
received by the backup and restore backup from the last complete checkpoint.
This is required for Remus to work and this does not break live migration. It
has been around since Xen 4.0.
CC: Ian Jackson <ian.jackson@eu.citrix.com> CC: Ian Campbell <ian.campbell@citrix.com> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Shriram Rajagopalan <rshriram@cs.ubc.ca> Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com> Acked-by: Shriram Rajagopalan <rshriram@cs.ubc.ca> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Wei Liu [Fri, 1 Aug 2014 11:36:41 +0000 (12:36 +0100)]
libxl: don't print out function name in log twice
The LOG macro already prints out function names. No need to explictly
use "__func__" in log message.
Signed-off-by: Wei Liu <wei.liu2@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Cc: Ian Jackson <ian.jackson@eu.citrix.com> Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
Parth Dixit [Thu, 14 Aug 2014 07:23:00 +0000 (12:53 +0530)]
xen/arm : emulation of arm's PSCI v0.2 standard
Arm based virtual machines dom0/guest will request power related functionality
from xen through PSCI interface. This patch implements version 0.2 of
PSCI standard specified by arm for 64bit and 32 bit arm machines.
Signed-off-by: Parth Dixit <parth.dixit@linaro.org> Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- switch include n vpsci.c from asm-arm/event.h to asm/event.h ]
Ian Campbell [Tue, 12 Aug 2014 13:38:01 +0000 (15:38 +0200)]
xen: arm: Correctly handle do_sysreg exception injection from 64-bit userspace
The do_sysreg case was missing a return, so it would increment PC and
inject the trap to the second instruction of the handler.
This is CVE-2014-5148 / XSA-103.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Julien Grall <julien.grall@linaro.org>
Ian Campbell [Tue, 12 Aug 2014 13:37:25 +0000 (15:37 +0200)]
xen: arm: Handle traps from 32-bit userspace on 64-bit kernel as undef
We are not setup to handle these properly. This turns a host crash
into a trap to the guest kernel which will likely result in killing
the offending process.
This is part of CVE-2014-5147 / XSA-102.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Julien Grall <julien.grall@linaro.org>
Ian Campbell [Tue, 12 Aug 2014 13:36:15 +0000 (15:36 +0200)]
xen: arm: Correctly handle exception injection from userspace on 64-bit.
Firstly we must be prepared to propagate traps from 32-bit userspace even for
64-bit guests, so wrap the existing inject_undef??_exception into
inject_undef_exception and use that when injecting an undef exception. The
various other exception cases (aborts etc) already do this.
Secondly when injecting the trap we must pick the correct exception vector
depending on whether the source of the trap was 32-bit EL0, 64-bit EL0 or EL1.
This is part of CVE-2014-5147 / XSA-102.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Julien Grall <julien.grall@linaro.org>
Ian Campbell [Tue, 12 Aug 2014 13:32:27 +0000 (15:32 +0200)]
xen: arm: handle AArch32 userspace when dumping 64-bit guest state.
A 64-bit guest can still be in 32-bit mode when running userspace,
handle this case by dumping the correct 32-bit state.
Note that on ARM it is not possible to change mode without the help
of the next exception level, hence there is no way a 64-bit guest can
be running in 32-bit kernel modes.
This is part of CVE-2014-5147 / XSA-102.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Julien Grall <julien.grall@linaro.org>
Jan Beulich [Tue, 12 Aug 2014 13:30:11 +0000 (15:30 +0200)]
x86/paging: make log-dirty operations preemptible
Both the freeing and the inspection of the bitmap get done in (nested)
loops which - besides having a rather high iteration count in general,
albeit that would be covered by XSA-77 - have the number of non-trivial
iterations they need to perform (indirectly) controllable by both the
guest they are for and any domain controlling the guest (including the
one running qemu for it).
This is CVE-2014-5146 / XSA-97.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org>
Jan Beulich [Mon, 11 Aug 2014 13:00:15 +0000 (15:00 +0200)]
x86/vHPET: use rwlock instead of simple one
This namely benefits guests heavily reading the main counter, but not
touching the HPET much otherwise. Note that due to the way
hpet_get_comparator() works hpet_read() has to special cases reads from
the comparator registers and use a write lock there instead of the read
one used for all other registers.
projects / xen.git / log