546 Commits
Author SHA1 Message Date
Weiqi Wang c161c11875 xen/pdx: fix offset-compression merge of a contained range
When sorting and merging overlapping ranges in
pfn_pdx_compression_setup(), the merged range is set to end where the
second range ends.  If the second range is fully contained in the first,
this truncates the first range, and the tail of it is then neither
compressible nor translated correctly.

Keep the end of the merged range as the maximum of both ends.

On x86 the ranges come from the SRAT memory affinity entries, and
overlapping entries for the same node are tolerated with a warning by the
NUMA code.  The caller's subsequent coverage check catches the truncated
range, so the effect is that PDX compression is disabled with a "RAM
region ... not covered" message rather than memory being mistranslated.

Add a test case that fails without this change.

Found with the ESBMC bounded model checker, and confirmed by running the
failing case natively against the unmodified code.

Fixes: c5c45bcbd6 ("pdx: introduce a new compression algorithm based on region offsets")
Assisted-by: Claude Code:claude-opus-5-5 # finding the issue with ESBMC, patch creation
Signed-off-by: Weiqi Wang <weiqi.wang-2@postgrad.manchester.ac.uk>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2026-10-12 09:41:55 +02:00
Andrew Cooper 72b05c267e x86/emul: Rename the x86_seg_* system segments
These refer to the segments themsevles, not to the registers, even if there is
a tight coupling between the two.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2026-08-18 12:50:11 +01:00
Jan Beulich 0a249bcb02 x86: reduce dependencies on x86_emulate/x86_emulate.h
Split out struct x86_event to an entirely separate header, and move a few
other items describing the architecture to a new x86-types.h. With a few
forward decls of structures and with a fair number of new #include-s in
.c files, the inclusion of x86_emulate.h (and hence
x86_emulate/x86_emulate.h) can be dropped from all header files except
hvm/emulate.h; it needs additionally adding to hvm/ioreq.h though.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-08-13 15:12:51 +02:00
Jan Beulich 59b18eb757 x86emul: support non-SIMD MOVRS
As we ignore cachability aspects of insns, they're treated like simple
MOVs.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-07-28 10:07:13 +02:00
Jan Beulich cf90c8a48a x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion
AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD
handling can trigger for these insns. Indeed when the (relevant part of)
the controlling mask register is 0, no memory is accessed at all. Leave
op_bytes unaltered in this case, to engage the short-circuiting in common
SIMD handling when fault_suppression is true and op_bytes is 0.

While there also correct a related typo in the test harness.

Fixes: 65f82d4ce1 ("x86emul: support AVX512{F,_VBMI2} compress/expand insns")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-07-20 09:50:00 +02:00
Jan Beulich c5b4ba49a3 x86emul: drop wrapper C file
Move the little bit that's still left in x86/x86_emulate.c into a __XEN__
conditional in x86/x86_emulate/x86_emulate.c. Move what are roughly the
test/fuzzing harness counterparts from there into the corresponding #else.

Interestingly more recent gcc takes issue with three static const arrays
which are unused when HVM=n (noticeable in particular in the shim build).
Apparently such are diagnosed only when present in the top-level file, but
not when living in an #include-d one.

Requested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Teddy Astie <teddy.astie@vates.tech>
2026-07-16 09:17:23 +02:00
Roger Pau Monne edf942201d xen/pdx: fix off-by-one index in offset mask calculation
Adjust the mask calculation in case the last range is merged with the
previous one, as then the mask must be calculated from the previous range,
which the current one has been merged into.

Instead of fixing the off-by-one in place, move the calculation of the bit
change mask to the next loop, after the ranges have been merged.  This
simplifies the logic by consolidating mask calculation in a single place,
possibly making it less error prone in the future.

Also add a test case that triggers the bug being fixed by this commit.

Fixes: c5c45bcbd6 ("pdx: introduce a new compression algorithm based on region offsets")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
2026-06-09 11:43:24 +02:00
Roger Pau Monne 188d530529 xen/numa: fix setup of non-aligned memory affinity ranges
The logic to populate memnodemap in populate_memnodemap() assumes that all
ranges are aligned to the hash shift, this however is only true for the
first address in a memory affinity node.  Any subsequent ranges belonging
to the same node might not be aligned to the hash shift value.

Such lack of alignment causes issues to the logic in populate_memnodemap(),
as then the tail of the range might not be properly accounted for and setup
in memnodemap.  Fix this by forcing the start address of all regions to
be aligned to the hash shift; if such alignment causes a region overlap it
would always be between regions on the same node, and hence will never
cause setup issues of the memnodemap array.

Introduce two additional test cases to the user-space NUMA setup unit
testing, first test case is the native memory affinity and memory map of
the system where this issue was found, second test case is a simplification
to demonstrate the original problem more clearly.

Fixes: 1666086b00 ("x86/NUMA: improve memnode_shift calculation for multi node system")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
2026-06-05 19:13:47 +02:00
Roger Pau Monne 97e3837af3 tests/numa: add unit tests for NUMA setup logic
NUMA setup, like PDX, requires certain amount of logic to configure the
internal structures and parameters for NUMA operation.  Introduce some very
basic testing that allows building and testing NUMA setup logic in as a
user-space unit test.  This allows feeding synthetic memory affinity and
map to the logic, allowing to reproduce bugs that would otherwise need
access to real systems with such a configuration.

For the time being introduce a single test case, based on a known working
NUMA setup for an AMD Turin system.  Also the testing after setup is
currently limited to ensuring the start and end RAM region addresses fall
into a correctly setup memory block.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
2026-06-05 19:12:13 +02:00
Luca Fancellu 71f8fd5a64 tools/tests: Fix paging-mempool xen_pfn_t format strings
xen_pfn_t is not an unsigned long on all architectures. In particular,
Arm32 builds see it as a 64-bit type, so printing it with %lx triggers
a -Werror=format build failure.

Use PRI_xen_pfn for the GFN diagnostics instead.

Fixes: 66c982a5d3 ("tests/paging-mempool: Extend to test P2M relocation")
Signed-off-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-05-22 08:20:44 +02:00
Denis Mukhin 23e2479ff9 xen/domain: introduce DOMID_ANY
Add a new symbol DOMID_ANY to improve the readability of the code.

Update all relevant domid_alloc() call sites and harden the domid_alloc()
input value check.

Also, fix problem with passing invalid domain IDs in
XEN_DOMCTL_createdomain: turns out libxl__domain_make() (toolstack)
uses 0xffff as domain ID.

Fix failing tools tests too.

Amends: 2d50650607 ("xen/domain: unify domain ID allocation")
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2026-05-19 22:29:10 -05:00
Andrew Cooper 66c982a5d3 tests/paging-mempool: Extend to test P2M relocation
XENMAPSPACE_gmfn_range was found to be buggy with overlapping ranges, and the
fix is sufficiently far from clear that yours truly decided a test was in
order.

XENMAPSPACE_gmfn_range is exposed by xendevicemodel_relocate_memory() so take
the opportunity to create a better example for others to copy.

The test works as follows.  Populate 2M of RAM in the guest, marking the pages
so they can be identified later.  Then construct four relocation test
cases (overlapping vs non-overlapping, forwards vs backwards) using the marks
in the guest pages to confirm that the P2M was adjusted correctly.

The use of XEN_DOMCTL_CDF_iommu forces xenmem_add_to_physmap() to limit the
iteration count to a maximum of 16.  Use this to force a continuation and
exercise more of the logic.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-05-13 16:44:34 +01:00
Andrew Cooper d53ba690b0 tests/paging-mempool: Misc cleanup
... ahead of extending it with a second test.

Rename run_tests() to test_paging_mempool_size() and have it return int so the
new run_tests() can decide whether to run subsequent tests or not.

Comment the parameters to xc_domain_populate_physmap_exact() to make it
clearer what's going on, and remove the page added to the physmap when the
test is done.

No practical change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-05-13 16:44:34 +01:00
Jan Beulich a6b143e5a3 x86emul: support LKGS
Provide support for this insn, which is a prereq to FRED. CPUID-wise,
while its and FRED's enumerators were already introduced, their dependency
still needs adding.

While adding a testcase, also add a SWAPGS one. In order to not affect
the behavior of pre-existing tests, install write_{segment,msr} hooks
only transiently.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-05-12 08:31:59 +02:00
Jan Beulich ea3d4312f7 x86emul: support AVX512-BMM
EVEX.W meaning is unusual for VBMAC{,X}OR16x16x16, but that needs taking
care of only in the test harness.

Like already proposed in "x86emul: support AVX10.1", use just
vcpu_must_have(), not host_and_vcpu_must_have().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-04-09 08:25:25 +02:00
Alejandro Vallejo c520286a53 x86: Reject CPU policies with vendors other than the host's
While in principle it's possible to have a vendor virtualising another,
this is fairly tricky in practice and comes with the world's supply of
security issues.

Reject any CPU policy with vendors not matching the host's.

Signed-off-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> # CHANGELOG.md
2026-04-09 08:22:36 +02:00
Roger Pau Monne a3a1e61ce9 tests/pdx: allow more tests on 32bit build
The limitation of which tests can be build on 32bit is too strict.  Move
some tests out of the 64bit explicit region, as they can also be built on
32bits.

Fixes: cb50e40337 ("test/pdx: add PDX compression unit tests")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2026-03-12 11:16:31 +01:00
Roger Pau Monne 87774bbc39 tests/pdx: fix overflow from conversion from page index to address on 32bit
When building the PDX test harness as a 32bit executable the page shifts
done on unsigned long types can overflow.  Instead use pfn_to_paddr(),
which casts the values to paddr_t previous to doing the shift.

Fixes: cb50e40337 ("test/pdx: add PDX compression unit tests")
Reported-by: Edwin Török <edwin.torok@citrix.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2026-03-12 11:16:11 +01:00
Edwin Török 442f3481fe tools/tests/x86_emulator: avoid duplicate symbol error with clang: use -Og
clang would duplicate the loop body and end up with a double definition
of the symbol:
```
/tmp/test_x86_emulator-0f3576.s:27823: Error: symbol `vmovsh_to_mem' is already defined
/tmp/test_x86_emulator-0f3576.s:27825: Error: symbol `.Lvmovsh_to_mem_end' is already defined
```

Until a better solution is found: reduce optimizations in the test runner.

Using -Os might also work, but we can't rely on the size optimization
always avoiding the duplication of asm blocks.
This is test code, not performance critical code, and -O0 is more future
proof.
However for debugging -Og is recommended over -O0, and this still avoids
the duplicate label problem.

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-03-10 09:28:09 +01:00
Edwin Török bdd49cc2f6 tools/tests/x86_emulator: avoid passing NULL to memcpy
Fixes this `-fsanitize=undefined` error:
```
test_x86_emulator.c:614:12: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test_x86_emulator.c:614:12
```

Although this is more of a grey area: I don't see anything in the
standard that'd forbid calling `memcpy` with NULL and 0, but `glibc`
does specify it as non-null, which allows the compiler to make
optimizations assuming it never is NULL, so this is undefined behaviour
only on glibc.
Best to avoid the potential undefined behaviour though.

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-03-04 08:26:11 +01:00
Edwin Török c8ff52f876 tools/tests/x86_emulator: fix undefined behaviour in shift
Fixes this `-fsanitize=undefined` error:
```
test_x86_emulator.c:1103:32: runtime error: left shift of 573785183 by 2 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test_x86_emulator.c:1103:32
```

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-03-04 08:25:49 +01:00
Edwin Török 34e9c21514 tools/tests/x86_emulator: fix build on clang-21
clang-21's built-in assembler is enabled by default, but it doesn't
support some mnemonics:
```
test_x86_emulator.c:2636:36: error: invalid instruction mnemonic 'fsaves'
 2636 |                        "fidivs %1\n\t"
test_x86_emulator.c:2640:24: error: invalid instruction mnemonic 'frstors'
 2640 |         asm volatile ( "frstors %0" :: "m" (res[25]) : "memory" );
      |                        ^
test_x86_emulator.c:4251:24: error: invalid instruction mnemonic 'vpcmpestriq'
 4251 |                        put_insn(vpcmpestri,
      |                        ^
```

Use the external assembler with Clang for consistency with GCC.

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-03-04 08:25:19 +01:00
Jan Beulich c6f5590c93 vPCI: introduce private header
Before adding more private stuff to xen/vpci.h, split it up. In order to
be able to include the private header first in a CU, the per-arch struct
decls also need to move (to new asm/vpci.h files).

While adjusting the test harness'es Makefile, also switch the pre-existing
header symlink-ing rule to a pattern one.

Apart from in the test harness code, things only move; no functional
change intended.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2026-03-04 08:21:28 +01:00
Edwin Török 474e4f9264 tools/tests/vpci/main.c: drop unused variables
They may become build failures.

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2026-02-25 12:32:04 +01:00
Jan Beulich 7326c17254 x86/cpu-policy: move CPU policy library code
... to a dedicated subdir of x86's private lib/ sub-tree.

For the CPU policy harnesses and libxenguest use $(lib-y) as set by the
new Makefile.common, whereas for the emulator harnesses stick to building
just cpuid.o for the time being.

Requested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-02-25 12:31:08 +01:00
Edwin Török 5a37699956 tools/tests/x86_emulator: fix 'shifting a negative signed value is undefined'
clang-21 refuses to compile this:
```
test_x86_emulator.c:1164:24: error: shifting a negative signed value is undefined [-Werror,-Wshift-negative-value]
 1164 |     regs.r8     = (-1L << 40) + 1;
      |                    ~~~ ^
1 error generated.
```

The shift could also exceed the width of the type on some systems.
I confirmed that both the old and the new code would produce the same value
with GCC on x86-64: `0xffffff0000000001`.

Signed-off-by: Edwin Török <edwin.torok@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2026-02-24 10:30:05 +01:00
Jan Beulich 89e6f0540e x86emul/test: use vpath uniformly for access to code living elsewhere
Replace the remaining non-local symlink-ing (i.e. of core emulator files)
as well, to avoid mixing approaches. (The symlink-ing of test blob sources
needs to remain for the time being.)

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2026-01-06 09:38:55 +01:00
Andrew Cooper f34c965281 tools/tests: Memory Claims
Add some basic testing of the memory claims mechainsm.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2025-12-17 17:35:24 +00:00
Andrew Cooper 04ebc7b527 tools/tests: Sort Makefile
... and split the x86 group away from the common group.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2025-12-17 17:35:24 +00:00
Jan Beulich c482d1f59f x86emul/test: correct compiler checking and avoid it when merely cleaning
The error messages that the compiler may emit can be confusing.

The check was also the wrong way round in case multiple make targets are
specified: We want to do the check whenever targets other than the running
and cleaning ones are specified.

Fixes: 05f4cc2192 ("x86emul: suppress default test harness build with incapable compiler")
Fixes: d5997399b7 ("x86emul: suppress "not built" warning for test harness'es run targets")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-11-24 11:28:47 +01:00
Jan Beulich 774c382b28 x86emul/test: extend cleaning of generated files
Many *.c files are symlinked while building, so along with generated *.h
files they ought to be removed. Conversely $(TARGET) doesn't need removing
twice.

Fixes: cb4fcf70b2 ("x86emul: parallelize SIMD test code building")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-11-13 09:08:27 +01:00
Jan Beulich 3bc40a4404 tools/tests/domid: don't pass -E to sed
Even the 2018 edition of The Open Group Base Specifications Issue 7 [1]
doesn't name -E as a standard option; only Issue 8 [2] does. As we can
easily avoid anything "extended" about the expression used, drop the -E,
escape the parentheses, and replace the sole + by *.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/
[2] https://pubs.opengroup.org/onlinepubs/9799919799/

Fixes: b3d31533a0 ("tools/tests: introduce unit tests for domain ID allocator")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-Acked-by: Oleksii Kurochko<oleksii.kurochko@gmail.com>
2025-10-21 14:11:27 +02:00
Jan Beulich 8daabe4052 tools/tests: don't pass -E to sed
Even the 2018 edition of The Open Group Base Specifications Issue 7 [1]
doesn't name -E as a standard option; only Issue 8 [2] does. As there's
nothing "extended" about the expression used, simply drop the -E.

[1] https://pubs.opengroup.org/onlinepubs/9699919799/
[2] https://pubs.opengroup.org/onlinepubs/9799919799/

Fixes: cb50e40337 ("test/pdx: add PDX compression unit tests")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Oleksii Kurochko<oleksii.kurochko@gmail.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Release-Acked-by: Oleksii Kurochko<oleksii.kurochko@gmail.com>
2025-10-09 11:09:25 +02:00
Denis Mukhin b3d31533a0 tools/tests: introduce unit tests for domain ID allocator
Introduce some basic infrastructure for doing domain ID allocation unit tests,
and add a few tests that ensure correctness of the domain ID allocator.

Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness code.

Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
2025-09-04 13:37:18 -07:00
Jiqian Chen 8623318157 vpci: Refactor vpci_remove_register to remove matched registers
vpci_remove_register() only supports removing a register in a time,
but the follow-on changes need to remove all registers within a range.
So, refactor it to support removing all registers in a given region.

And it is no issue to remove a non exist register, so remove the
__must_check prefix.

Note: two test cases don't math the new logic of
vpci_remove_registers(), then modify them.

Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2025-09-01 13:07:01 +02:00
Roger Pau Monne c5c45bcbd6 pdx: introduce a new compression algorithm based on region offsets
With the appearance of Intel Sierra Forest and Granite Rapids it's now
possible to get a production x86 host with the following memory map:

SRAT: Node 0 PXM 0 [0000000000000000, 000000007fffffff]
SRAT: Node 0 PXM 0 [0000000100000000, 000000807fffffff]
SRAT: Node 1 PXM 1 [0000063e80000000, 000006be7fffffff]
SRAT: Node 2 PXM 2 [00000c7e80000000, 00000cfe7fffffff]
SRAT: Node 3 PXM 3 [000012be80000000, 0000133e7fffffff]

This is from a four socket Granite Rapids system, with each node having
512GB of memory.  The total amount of RAM on the system is 2TB, but without
enabling CONFIG_BIGMEM the last range is not accessible, as it's above the
16TB boundary covered by the frame table. Sierra Forest and Granite Rapids
are socket compatible, however Sierra Forest only supports 2 socket
configurations, while Granite Rapids can go up to 8 sockets.

Note that while the memory map is very sparse, it couldn't be compressed
using the current PDX_MASK compression algorithm, which relies on all
ranges having a shared zeroed region of bits that can be removed.

The memory map presented above has the property of all regions being
similarly spaced between each other, and all having also a similar size.
Use a lookup table to store the offsets to translate from/to PFN and PDX
spaces.  Such table is indexed based on the input PFN or PDX to translated.
The example PFN layout about would get compressed using the following:

PFN compression using PFN lookup table shift 29 and PDX region size 0x10000000
 range 0 [0000000000000, 0x0000807ffff] PFN IDX  0 : 0000000000000
 range 1 [0x00063e80000, 0x0006be7ffff] PFN IDX  3 : 0x00053e80000
 range 2 [0x000c7e80000, 0x000cfe7ffff] PFN IDX  6 : 0x000a7e80000
 range 3 [0x0012be80000, 0x00133e7ffff] PFN IDX  9 : 0x000fbe80000

Note how the tow ranges belonging to node 0 get merged into a single PDX
region by the compression algorithm.

The default size of lookup tables currently set in Kconfig is 64 entries,
and the example memory map consumes 10 entries.  Such memory map is from a
4 socket Granite Rapids host, which in theory supports up to 8 sockets
according to Intel documentation.  Assuming the layout of a 8 socket system
is similar to the 4 socket one, it would require 21 lookup table entries to
support it, way below the current default of 64 entries.

The valid range of lookup table size is currently restricted from 1 to 512
elements in Kconfig.

An extra array is used to keep track of the base PFN for each translated
range.  Non used slots are set to ~0UL, so that in mfn_valid() the mfn <
base check always fails, thus reporting the mfn as invalid.

Introduce __init_or_pdx_mask and use it on some shared functions between
PDX mask and offset compression, as otherwise some code becomes unreachable
after boot if PDX offset compression is used.  Mark the code as __init in
that case, so it's pruned after boot.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-18 13:01:10 +01:00
Roger Pau Monne 477c664241 tests/pdx: define PAGE_SIZE as long
Otherwise Coverity complains about possibly shifting an integer more than
31 bits.

This also reverts the previous attempt to fix this Coverity reported
issue, commit 4dd3230290.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Coverity ID: 1662707
Fixes: cb50e40337 ('test/pdx: add PDX compression unit tests')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-14 17:51:13 +02:00
Roger Pau Monne cb50e40337 test/pdx: add PDX compression unit tests
Introduce a set of unit tests for PDX compression.  The unit tests contains
both real and crafted memory maps that are then compressed using the
selected PDX algorithm.  Note the build system for the unit tests has been
done in a way to support adding new compression algorithms easily.  That
requires generating a new test-pdx-<compress> executable that's build with
the selected PDX compression enabled.

Currently the only generated executable is test-pdx-mask that tests PDX
mask compression.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
2025-08-11 18:45:52 +02:00
Michal Orzel 86a12671c5 tests/vpci: Use $(CC) instead of $(HOSTCC)
Depending on the build environment, HOSTCC can be different than CC. With
the recent `install` rule addition, this would put a binary of a wrong
format in the destdir (e.g. building tests on x86 host for Arm target).

Take the opportunity to adjust the `run` rule to only run the test if
HOSTCC is CC, else print a warning message.

Fixes: 96a587a057 ("tools/tests: Add install target for vPCI")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2025-06-09 12:12:43 +02:00
Anthony PERARD ddf34d4bb8 tools/tests: Fix return value of test-rangeset
Otherwise, failed tests are ignored by automated test.

Fixes: 7bf777b42c ("tootls/tests: introduce unit tests for rangesets")
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-06-06 12:00:40 +02:00
Andrew Cooper 96a587a057 tools/tests: Add install target for vPCI
This lets it run automagically in CI.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2025-05-30 15:18:47 +01:00
Alejandro Vallejo e773c257af tools: Add install/uninstall targets to tests/x86_emulator
Bring test_x86_emulator in line with other tests by adding
install/uninstall rules.

Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-05-30 15:18:46 +01:00
Andrew Cooper 2d497e97e2 tools/tests: Install tests into $(LIBEXEC)/tests
$(LIBEXEC_BIN) is a dumping ground of many things.  Separate the "clearly
tests" from everything else so we can clean up how they're run in CI.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
2025-05-28 12:29:33 +01:00
Andrew Cooper 6c2833d904 tools/tests: Drop depriv-fd-checker
Unlike the other tests, this is not standalone.  It requires poking at a live
system, making it unweildly to use.

It also hasn't been touched in 7 years, despite changes in libraries and
kernel devices using the deprivilege infrastructure.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
2025-05-28 12:29:33 +01:00
Andrew Cooper 2eb1132f79 x86/stubs: Introduce place_ret() to abstract away raw 0xc3's
The Indirect Target Selection speculative vulnerability means that indirect
branches (including RETs) are unsafe when in the first half of a cacheline.
This means it's not safe for logic using the stubs to write raw 0xc3's.

Introduce place_ret() which, for now, writes a raw 0xc3 but will contain
additional logic when return thunks are in use.

stub_selftest() doesn't strictly need to be converted as they only run on
boot, but doing so gets us a partial test of place_ret() too.

No functional change.

This is part of XSA-469 / CVE-2024-28956

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2025-05-12 17:17:38 +01:00
Oleksandr Andrushchenko ad3ac58a9d vpci: translate virtual PCI bus topology for guests
There are two originators for the PCI configuration space access:
1. The domain that owns physical host bridge: MMIO handlers are
there so we can update vPCI register handlers with the values
written by the hardware domain, e.g. physical view of the registers
vs guest's view on the configuration space.
2. Guest access to the passed through PCI devices: we need to properly
map virtual bus topology to the physical one, e.g. pass the configuration
space access to the corresponding physical devices.

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-05-09 13:58:43 -07:00
Anthony PERARD a5d0e9c901 tools/tests: Fix newly introduced Makefile
Fix few issue with this new directory:
- clean generated files
- and ignore those generated files
- include the dependency files generated by `gcc`.
- rework prerequisites:
  "test-rangeset.o" also needs the generated files "list.h" and
  "rangeset.h". Technically, both only needs "harness.h" which needs
  the generated headers, but that's a bit simpler and the previous
  point will add the dependency on "harness.h" automatically.

This last point fix an issue where `make` might decide to build
"test-rangeset.o" before the other files are ready.

Fixes: 7bf777b42c ("tootls/tests: introduce unit tests for rangesets")
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
2025-04-25 11:44:03 +02:00
Roger Pau Monne 7bf777b42c tootls/tests: introduce unit tests for rangesets
Introduce some basic infrastructure for doing rangeset unit tests, and add
a few tests that ensure correctness of rangeset subtraction.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-04-11 12:20:10 +02:00
Jan Beulich 4bb846f32c x86emul/test: drop check for AVX512-4FMAPS
Use of Xeon Phi features was dropped earlier on; this one was overlooked.

Fixes: 85191cf321 ("x86: drop Xeon Phi support")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-04-09 15:30:51 +02:00
Andrew Cooper 15341fcac7 x86emul: Fix blowfish build in 64bit-clean environments
In a 64bit-clean environment, blowfish fails:

  make[6]: Leaving directory
  '/builddir/build/BUILD/xen-4.19.1/tools/tests/x86_emulator'
  In file included from /usr/include/features.h:535,
                   from /usr/include/bits/libc-header-start.h:33,
                   from /usr/include/stdint.h:26,
                   from
  /usr/lib/gcc/x86_64-xenserver-linux/12/include/stdint.h:9,
                   from blowfish.c:18:
  /usr/include/gnu/stubs.h:7:11: fatal error: gnu/stubs-32.h: No such
  file or directory
      7 | # include <gnu/stubs-32.h>
        |           ^~~~~~~~~~~~~~~~
  compilation terminated.
  make[6]: *** [testcase.mk:15: blowfish.bin] Error 1

because of lack of glibc-i386-devel or equivelent.  It's non-fatal, but
reduces the content in test_x86_emulator, which we do care about running.

Instead, convert all emulator testcases to being freestanding builds, resuing
the tools/firmware/include/ headers.

This in turn requires making firmware's stdint.h compatible with 64bit builds.
We now have compiler types for every standard type we use.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-03-31 14:38:56 +01:00