xen/gnttab: Pass max_{grant,maptrack}_frames into grant_table_create()

... rather than setting the limits up after domain_create() has completed.

This removes the common gnttab infrastructure for calculating the number of
dom0 grant frames (as the common grant table code is not an appropriate place
for it to live), opting instead to require the dom0 construction code to pass
a sane value in via the configuration.

In practice, this now means that there is never a partially constructed grant
table for a reference-able domain.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Julien Grall <julien.grall@arm.com>

xen/arch/arm/setup.c

@@ -20,6 +20,7 @@
 #include <xen/compile.h>
 #include <xen/device_tree.h>
 #include <xen/domain_page.h>
+#include <xen/grant_table.h>
 #include <xen/types.h>
 #include <xen/string.h>
 #include <xen/serial.h>
@@ -693,6 +694,8 @@ void __init start_xen(unsigned long boot_phys_offset,
     struct domain *dom0;
     struct xen_domctl_createdomain dom0_cfg = {
         .max_evtchn_port = -1,
+        .max_grant_frames = gnttab_dom0_frames(),
+        .max_maptrack_frames = opt_max_maptrack_frames,
     };
 
     dcache_line_bytes = read_dcache_line_bytes();

xen/arch/x86/setup.c

@@ -1,6 +1,7 @@
 #include <xen/init.h>
 #include <xen/lib.h>
 #include <xen/err.h>
+#include <xen/grant_table.h>
 #include <xen/sched.h>
 #include <xen/sched-if.h>
 #include <xen/domain.h>
@@ -682,6 +683,8 @@ void __init noreturn __start_xen(unsigned long mbi_p)
     struct xen_domctl_createdomain dom0_cfg = {
         .flags = XEN_DOMCTL_CDF_s3_integrity,
         .max_evtchn_port = -1,
+        .max_grant_frames = opt_max_grant_frames,
+        .max_maptrack_frames = opt_max_maptrack_frames,
     };
 
     /* Critical region without IDT or TSS.  Any fault is deadly! */

xen/common/domain.c

@@ -366,7 +366,8 @@ struct domain *domain_create(domid_t domid,
             goto fail;
         init_status |= INIT_evtchn;
 
-        if ( (err = grant_table_create(d)) != 0 )
+        if ( (err = grant_table_create(d, config->max_grant_frames,
+                                       config->max_maptrack_frames)) != 0 )
             goto fail;
         init_status |= INIT_gnttab;
 

xen/common/grant_table.c

@@ -3567,9 +3567,8 @@ do_grant_table_op(
 #include "compat/grant_table.c"
 #endif
 
-int
-grant_table_create(
-    struct domain *d)
+int grant_table_create(struct domain *d, unsigned int max_grant_frames,
+                       unsigned int max_maptrack_frames)
 {
     struct grant_table *t;
     int ret = 0;
@@ -3587,11 +3586,7 @@ grant_table_create(
     t->domain = d;
     d->grant_table = t;
 
-    if ( d->domain_id == 0 )
-    {
-        ret = grant_table_init(d, t, gnttab_dom0_frames(),
-                               opt_max_maptrack_frames);
-    }
+    ret = grant_table_set_limits(d, max_maptrack_frames, max_maptrack_frames);
 
     return ret;
 }
@@ -4049,11 +4044,6 @@ static int __init gnttab_usage_init(void)
 }
 __initcall(gnttab_usage_init);
 
-unsigned int __init gnttab_dom0_frames(void)
-{
-    return min(opt_max_grant_frames, gnttab_dom0_max());
-}
-
 /*
  * Local variables:
  * mode: C

xen/include/asm-arm/grant_table.h

@@ -30,10 +30,8 @@ void gnttab_mark_dirty(struct domain *d, mfn_t mfn);
  * Only use the text section as it's always present and will contain
  * enough space for a large grant table
  */
-static inline unsigned int gnttab_dom0_max(void)
-{
-    return PFN_DOWN(_etext - _stext);
-}
+#define gnttab_dom0_frames()                                             \
+    min_t(unsigned int, opt_max_grant_frames, PFN_DOWN(_etext - _stext))
 
 #define gnttab_init_arch(gt)                                             \
 ({                                                                       \

xen/include/asm-x86/grant_table.h

@@ -39,11 +39,6 @@ static inline int replace_grant_host_mapping(uint64_t addr, mfn_t frame,
     return replace_grant_pv_mapping(addr, frame, new_addr, flags);
 }
 
-static inline unsigned int gnttab_dom0_max(void)
-{
-    return UINT_MAX;
-}
-
 #define gnttab_init_arch(gt) 0
 #define gnttab_destroy_arch(gt) do {} while ( 0 )
 #define gnttab_set_frame_gfn(gt, st, idx, gfn) do {} while ( 0 )

xen/include/xen/grant_table.h

@@ -35,8 +35,8 @@ extern unsigned int opt_max_grant_frames;
 extern unsigned int opt_max_maptrack_frames;
 
 /* Create/destroy per-domain grant table context. */
-int grant_table_create(
-    struct domain *d);
+int grant_table_create(struct domain *d, unsigned int max_grant_frames,
+                       unsigned int max_maptrack_frames);
 void grant_table_destroy(
     struct domain *d);
 void grant_table_init_vcpu(struct vcpu *v);
@@ -63,6 +63,4 @@ int gnttab_get_shared_frame(struct domain *d, unsigned long idx,
 int gnttab_get_status_frame(struct domain *d, unsigned long idx,
                             mfn_t *mfn);
 
-unsigned int gnttab_dom0_frames(void);
-
 #endif /* __XEN_GRANT_TABLE_H__ */