The current RTDS code has several problems:
- the scheduler, although the algorithm is event driven by
nature, follows a time driven model (is invoked periodically!),
making the code look unnatural;
- budget replenishment logic, budget enforcement logic and scheduling
decisions are mixed and entangled, making the code hard to understand;
- the various queues of vcpus are scanned various times, making the
code inefficient;
This patch separates budget replenishment and enforcement. It does that
by handling the former with a dedicated timer, and a queue of pending
replenishment events.
A replenishment queue has been added to keep track of all vcpus that
are runnable.
We also make sure that the main scheduling function is called when a
scheduling decision is necessary, such as when the currently running
vcpu runs out of budget.
Finally, when waking up a vcpu, it is now enough to tickle the various
CPUs appropriately, like all other schedulers also do.
Signed-off-by: Tianyang Chen <tiche@seas.upenn.edu>
Signed-off-by: Meng Xu <mengxu@cis.upenn.edu>
Signed-off-by: Dagaen Golomb <dgolomb@seas.upenn.edu>
Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com>
These features are soon to be exposed in the Xen public API. Rename them to
better match the vendor definitions.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
None of these features are interesting for Xen to use, or to be advertised to
guests. Doing so identifies further areas of code which can be removed now
that 32bit support has been dropped.
IA64 has a sole user in microcode_intel.c. While it is plausible for a 32bit
x86 hypervisor to get there via IA64's x86 emulation, a 64bit x86 hypervisor
most certainly won't.
MP proves to be more complicated. It is only advertised on some K7
processors, not on K8 or newer, and now listed as reserved in the AMD manual.
Cleaning this up reveals two chunks of common SMP code which was only
applicable to K7 processors, which are 32bit only.
While cleaning this area up, remove the inconsistent use of newlines in the
cpu_has_* definition block.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Add pvusb commands: usbctrl-attach, usbctrl-detach, usb-list,
usbdev-attach and usbdev-detach.
To attach a usb device to guest through pvusb, one could follow
following example:
#xl usbctrl-attach test_vm version=1 ports=8
#xl usb-list test_vm
will show the usb controllers and port usage under the domain.
#xl usbdev-attach test_vm hostbus=1 hostaddr=2
will find the first usable controller:port, and attach usb
device whose busnum is 1 and devnum is 6.
One could also specify which <controller> and which <port>.
#xl usbdev-detach test_vm 0 1
will detach USB device under controller 0 port 1.
#xl usbctrl-detach test_vm dev_id
will destroy the controller with specified dev_id. Dev_id
can be traced in usb-list info.
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Simon Cao <caobosimon@gmail.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Add code to support pvusb in domain config file. One could specify
usbctrl and usb in domain's configuration file and create domain,
then usb controllers will be created and usb device would be attached
to guest automatically.
One could specify usb controllers and usb devices in config file
like this:
usbctrl=['version=2,ports=4', 'version=1, ports=4', ]
usbdev=['hostbus=2, hostaddr=1, controller=0,port=1', ]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Simon Cao <caobosimon@gmail.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Add pvusb APIs, including:
- attach/detach (create/destroy) virtual usb controller.
- attach/detach usb device
- list usb controller and usb devices
- some other helper functions
Signed-off-by: Simon Cao <caobosimon@gmail.com>
Signed-off-by: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
For some device type, device removal operation needs to be
handled specially, like usbctrl, it needs to remove all usb
devices under it first, then remove usbctrl. Extend
DEFINE_DEVICE_REMOVE to support generic and custom way
For those need to be handled specially, call
DEFINE_DEVICE_REMOVE_CUSTOM, it requires user defined
libxl__initiate_device_##type##_remove. Otherwise, just
call DEFINE_DEVICE_REMOVE as before.
Signed-off-by: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Add a new function libxl_read_sysfs_file_contents to handle sysfs file
specially. It would be used in later pvusb work.
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Since it wants to be page aligned, this alignment would force pointless
alignment of .text in the intermediate built_in.o file(s), needlessly
growing the overall text and binary size.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: David Vrabel <david.vrabel@citrix.com>
This not only eases using the cached value in assembly code, but also
improves the generated code resulting from such reads in C.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The hardware may not write the FIP/FDP fields with a XSAVE*
instruction. e.g., with XSAVEOPT/XSAVES if the state hasn't changed
or on AMD CPUs when a floating point exception is not pending. We
need to identify this case so we can correctly apply the check for
whether to save/restore FCS/FDS.
By poisoning FIP in the saved state we can check if the hardware
writes to this field. The poison value is both: a) non-canonical; and
b) random with a vanishingly small probability of matching a value
written by the hardware (1 / (2^63) = 10^-19).
The poison value is fixed and thus knowable by a guest (or guest
userspace). This could allow the guest to cause Xen to incorrectly
detect that the field has not been written. But: a) this requires the
FIP register to be a full 64 bits internally which is not the case for
all current AMD and Intel CPUs; and b) this only allows the guest (or
a guest userspace process) to corrupt its own state (i.e., it cannot
affect the state of another guest or another user space process).
This results in smaller code with fewer branches and is more
understandable.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Intel confirmed that 64-bit {F,}XRSTOR sign-extend FIP from bit 47.
While leaving the description above intact, modify the code comment
accordingly.
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xc_domain_save() and xc_domain_restore's parameter will use this type,
so it should be public.
Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
... for the lifetime of the domain.
If Xen is to make use of the APIC assist enlightenment then a persistent
mapping needs to be kept, rather than the temporary one which is currently
used only to initialize the page content.
This patch also adds a comment block at the top of the source with
information on the latest version of the spec. from Microsoft and the
current URL where it may be found.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The commit bcfaea685d
"arm/config: Declare ELFSIZE_64" was not correct.
For 32-bit ARM, ELFCLASS32 (i.e. 32-bit data types) will always
be used so we need to set ELFSIZE to 32.
Reported-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Julien Grall <julien.grall@arm.com>
TRAPBOUNCE_flags are always available via a displacement from %rdx. This
allows all of %rcx to be used as a scratch register.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <JBeulich@suse.com>
Commit b38d426a "flush remote tlbs by hypercall" add support to allow
Windows to request flush of remote TLB via hypercall rather than IPI.
Unfortunately it seems that this code was broken in a couple of ways:
1) The allocation of the per-vcpu ipi mask is gated on whether the
domain has viridian features enabled but the call to allocate is
made before the toolstack has enabled those features. This results
in a NULL pointer dereference.
2) One of the flush hypercall variants is a rep op, but the code
does not update the output data with the reps completed. Hence the
guest will spin repeatedly making the hypercall because it believes
it has uncompleted reps.
This patch fixes both of these issues as follows:
1) The ipi mask need only be per-pcpu so it is made a per-pcpu static
to avoid the need for allocation.
2) The rep complete count is updated to the rep count since the single
flush that Xen does covers all reps anyway.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The vmap_to_page macro (three levels deep!) can come up with
a NULL pointer. Lets add the proper ASSERT to catch this errant
behavior.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
The maximum and minimum values for TxSZ depend on level of
translation as per AArch64 Virtual Memory System Architecture.
According to ARM specification DDI0487A_h (sec D4.2.2, page 1752),
the minimum TxSZ value is 16. If TxSZ is programmed to a value
smaller than 16 then it is IMPLEMENTATION DEFINED.
This patch sets T0SZ to (64-48)bits since XEN uses all 4 levels
to cover 48bit (256TB) virtual address instead of value zero.
Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Acked-by: Julien Grall <julien.grall@arm.com>
Wrap the various tmem functions with the Kconfig generated CONFIG_TMEM
option allowing users to build Xen without tmem support.
Note that you have to use XEN_CONFIG_EXPERT to see this option.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Most callers of tmem_freeable_pages() checked to see if by checking
opt_tmem before calling tmem_freeable_pages() but not all of them did. This
seemed like an oversight and to avoid similar situations like that,
stick the check of tmem into tmem_freeable_pages(). Similarly other
places should not directly check opt_tmem but instead use the
tmem_enabled() helper function.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Instead of manipulating the opt_tmem variable directly utilize a wrapper
function.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Re-add the Xilinx ZynqMP platform. This time include a
blacklisted zynqmp-pm (Power Management) device that does
not yet play nicely with Xen.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
GCC generates R_X86_64_64, R_X86_64_PC32, and R_X86_64_PLT32
relocations so those are the ones we need initially
to support xSplice.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
If the MMIO hole is large and hvmloader needs to relocate memory to
immediately above the 4 GiB boundary, the e820 presented to the guest
will not have a RAM region above 4 GiB.
e.g., a guest with 3 GiB of memory and a 2 GiB MMIO hole will only see
2 GiB.
The required e820 memory region above 4 GiB needs to be added, and not
just filled in.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
While they are being written during early boot (when sorting them),
that writing takes place before we actually start fiddling with page
table permissions, so these tables can benefit from getting write
protected just like ordinary r/o data does (for now only when using
2M mappings).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
As explained by Andrew in
http://lists.xenproject.org/archives/html/xen-devel/2016-03/msg01380.html
that change makes the uncompressed xen.gz image too large for certain
boot environments. As a result this change makes some of the effects of
commits cf393624ee ("x86: use 2M superpages for text/data/bss
mappings") and 53aa3dde17 ("x86: unilaterally remove .init mappings")
conditional, restoring alternative previous code where necessary. This
is so that xen.efi can still benefit from the new mechanisms, as it is
unaffected by said limitations.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
such as deadline and budget. Packing is necessary to make
it possible for xentrace_format to properly interpreet the
records.
Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com>
Reviewed-by: Meng Xu <mengxu@cis.upenn.edu>
Commit a929bee0e6 ("x86/vmx: Fix injection of #DB traps following
XSA-156") prevents an infinite loop in certain #DB traps. However, it
changed the behavior to not call hvm_hw_inject_trap() for #DB and #AC
traps which which means that the debug registers are not restored
correctly and nullified commit b56ae5b48c ("VMX: fix/adjust trap
injection").
To fix this, restore the original code path through hvm_inject_trap(),
but ensure that the struct hvm_trap is populated with all the required
data.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
Nested hap code assumed implict bitmask semantics of the p2m_access_t
enum prior to C/S 4c63692d7c
The change to the enum ordering broke this assumption and caused functional
problems for the nested hap code. As it may be error prone to audit and find
all other p2m_access users assuming bitmask semantics, instead restore the
previous enum order and make it explict that bitmask semantics are to be
preserved for the read, write and execute access types.
Signed-off-by: Malcolm Crossley <malcolm.crossley@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Coverity points out that using LOG macro dereferences gc which is NULL
at that point. Use LIBXL__LOG instead.
CID: 1343291
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Commit 5644ce0142 ("x86emul: relax asm() constraints") introduced a
64-bit only instruction suffix, which breaks running the emulator test
on a 32-bit system. Mirror __OS (and _OP for completeness) to the test
wrapper source file.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The latter are their canonical names, used already in the instruction
emulator.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The pcidevs_lock is going to be recursively taken for hiding ATS
device, when VT-d Device-TLB flush timed out.
Signed-off-by: Quan Xu <quan.xu@intel.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com>
pcidevs_is_locked() -> pcidevs_locked(). Add __must_check to
pcidevs_locked() and pcidevs_trylock() declarations.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
pcidevs_lock doesn't require interrupts to be disabled while being acquired.
However there remains an exception in AMD IOMMU code, where the lock is
acquired with interrupt disabled. This inconsistency might lead to deadlock.
The fix is straightforward to use spin_lock instead. Also interrupt has been
enabled when this function is invoked, so we're sure consistency around
pcidevs_lock can be guaranteed after this fix.
Signed-off-by: Quan Xu <quan.xu@intel.com>
Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Some versions of GCC complain that the 'firmware' variable can be used
uninitialized. It looks like the switch inside of the else case is just
confusing GCC.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
The hunk that prints out error message can only be reached from the loop
that allocates memory. Move that hunk into the loop to avoid confusing
gcc.
Reported-by: Doug Goldstein <cardoe@cardoe.com>
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
Acked-by: Roger Pau Monne <roger.pau@citrix.com>
Meng Xu is one of the maintainers of the RT-Xen project,
which is from where the RTDS scheduler comes. He also
is the main author of the version of RTDS that we currently
have here upstream.
Since the upstreaming effort, he's continued looking after
the code, engaging with the community, coming and presenting
at XenSummits and, last but not least, doing development
himself as well as directing the work of others, with the
aim of improving the scheduler.
In summary, he has reached the point, both from thechnical
and community engagement point of views, where he can
effectively serve as a maintainer of RTDS code.
Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com>
Acked-by: Meng Xu <mengxu@cis.upenn.edu>
Acked-by: George Dunlap <george.dunlap@citrix.com>
Introduce the FLUSH_VA_VALID flag to flush_area_mask() and friends to
say that it is safe to use CLFLUSH (i.e., the virtual address is still
valid).
Use this when changing the cachability of the Xen direct mappings (in
response to the guest changing the cachability of its mappings). This
significantly improves performance by avoiding an expensive WBINVD.
This fixes a performance regression introduced by
c61a6f74f8 (x86: enforce consistent
cachability of MMIO mappings), the fix for XSA-154.
e.g., A set_memory_wc() call in Linux:
before: 4097 us
after: 47 us
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
mfns[2] was there just because struct sh_emulate_ctxt's two MFN values
can't be used to hand to vmap(). Making the structure fields an array
avoids the extra copying.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
No need to compile all of this code three times, as most of it really
is guest mode independent. The savings are between 3k and 4k of binary
code in my builds. For this to fully work out, the sh_gva_to_gfn()
calls are being replaced by indirect ones through the paging mode
table.
No functional change (i.e. only formatting and naming changes) except
for
- sh_emulate_map_dest()'s user mode check corrected for the PV case
(affecting debugging mode only, this isn't being split out)
- simplifying the vaddr argument to emulate_gva_to_mfn() for the second
part in the cross page write case
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Currently REP emulations optimizations remain disabled even if
the emulation does not happen as a result of a vm_event reply
requestion emulation (i.e. even for regular IO). This patch takes
emulate_each_rep into account only if emulation has been requested
by a vm_event-capable application, and is a noticeable speed
optimization for monitored guests.
Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tamas K Lengyel <tamas@tklengyel.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
This reverts an unintended change in commit 879b44b041 ("x86/fpu: add
a per-domain field to set the width of FIP/FDP"), which I had done
intermediately while fixing the build issue: After having reverted that
adjustment I must have forgotten to "git add" the adjustment.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The foreign header generation blindly replaces 'uint64_t' with '__align8__
uint64_t', to get correct alignment when built as 32bit. This is correct in
most circumstances, but Clang objects to two specific uses.
* Inside a sizeof() expression
* As part of a typecast
An example error looks like:
/local/xen.git/tools/libxc/../../tools/include/xen/foreign/x86_64.h:204:44:
error: 'aligned' attribute ignored when parsing type [-Werror,-Wignored-attributes]
__align8__ uint64_t evtchn_mask[sizeof(__align8__ uint64_t) * 8];
^~~~~~~~~~
/local/xen.git/tools/libxc/../../tools/include/xen/foreign/x86_64.h:13:36:
note: expanded from macro '__align8__'
^~~~~~~~~~~
This sedary is sufficient to fix all the bad examples without touching any of
the legitimate uses, and is more simple than teaching mkheader.py how to parse
C.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
I would like to propose Julien Grall (julien.grall@arm.com) as
co-maintainer for Xen on ARM. His track record of contributions to the
project is outstanding and I think speaks for itself.
Julien made multiple public presentations about Xen on ARM at Xen
Developer Summit and Linaro Connect conferences. He led the development
of several key features, such as SMMU support and non-PCI passthrough
and participated in the design and the review of large code
contributions from others.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Tianyang Chen
Andrew Cooper
Chunyan Liu
Jan Beulich
David Vrabel
Konrad Rzeszutek Wilk
Wen Congyang
Paul Durrant
Shanker Donthineni
Doug Goldstein
Razvan Cojocaru
Edgar E. Iglesias
Ross Lagerwall
Dario Faggioli
Malcolm Crossley
Wei Liu
Quan Xu
Stefano Stabellini