C Xenstored was seen failing to map a domU's event channel. Enhancing
Xen's error messages shows:
common/event_channel.c:427:d0v0 EVTCHNOP failure: d1, port 3267543746 error -22
Port 3267543746 is 0xc2c2c2c2 - SCRUB_PATTERN.
Xenstore expects a non-zero evtchn_port to be valid. Explicitly zero
the page to avoid this.
Fixes: df2c03e2eb ("xen/arm: Alloc XenStore page for Dom0less DomUs from hypervisor")
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
In case of ARM_32, all of the RAM will be covered by a permanent contiguous
mapping (where VA == PA) and there will be a single heap. Thus, the memory
allocated from Xen heap uses PGC_xen_heap.
This is similar to the scenario described for
"CONFIG_SEPARATE_XENHEAP=n W/ DIRECT MAP OF ALL RAM" in common/page_alloc.c.
Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Tested-by: Hari Limaye <hari.limaye@arm.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
With PCI disabled the build fails due to undefined struct
pci_host_bridge.
Add ifdef guard to pci-host-rcar4.h to not require the stuct being
defined when PCI support is disabled. All call sites are already covered
by HAS_PCI check, so no dummy implementations are needed.
Also move includes under the header guard to not break MISRA rules.
Fixes: 08b52c30be ("iommu/ipmmu-vmsa: Implement basic PCIE-IPMMU OSID support")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Avoid dereferencing NULL in introduce_domain() when called during
live update.
Coverity ID: 1665111
Fixes: f78895ad78 ("tools/xenstored: Read event channel from xenstored page")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
Otherwise the PCI accesses to segments different than the first one done by
the IOMMU initialization code would silently fail by returning all ones.
Introduce a new helper, called pci_setup(), and move both the creation of
PCI segment 0 internal data structures, plus the parsing of ACPI MMCFG
table to it. This moves acpi_mmcfg_init() slightly earlier from
acpi_boot_init() into pci_setup().
Note that further work will be needed to support systems where access
methods to segments different than 0 is not discoverable by Xen.
Fixes: 3950f2485b ('x86/x2APIC: defer probe until after IOMMU ACPI table parsing')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Program PCIE BDF-OSID assignment according to the S4_PCIe_IPMMU-OSID
when adding PCI device to the IOMMU in ipmmu_add_device callback.
This is needed for being able to assign PCI devices to different
domains at the same time. Programmed OSID is emmited as sideband data on
the AXI bus during PCI DMA transactions and then used by IPMMU to match
the transaction to the corresponding uTLB.
Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
For IPMMU to be able to associate a specific PCI device with it's TLB
the BDF to OSID mapping needs to be set up in the host bridge. The
configured OSID is then emmited as a sideband data on the AXI bus during
PCI DMA transactions. OSID configuration registers are located in the
"app" region of the host bridge.
Map the "app" region on init and implement methods for setting up
BDF->OSID mappings
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Introduce an additional private data field in `dw_pcie_priv` to allow
vendors to store custom data without interfering with bridge->priv.
Also add get/set pair to make accesing that private data less
cumbersome.
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
We're about to turn the rdmsr() macro into a real function, at which point
Eclair complains that we're now shadowing an identifer.
Rename rdmsr to is_read.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Now that content has been split out, minimise the header files as msr.h is
included by many translation units. A few more TUs were pulling dependencies
in transitively, so fix them up.
Give asm/time.h an SPDX tag, update it's guards, and drop the unused rdpmc().
If we do re-gain uses, the helper will want a proper API.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
With asm/tsc.h split out, asm/time.h shouldn't be including asm/msr.h, but it
turns out that an outrageous number of files (even some headers) are pulling
their dependentices transitively through asm/time.h -> asm/msr.h
Most are asm/msr{,-index}.h, but in some cases it's printk(), va_args, and
even PRIxxx macros.
Give asm/time.h an SPDX tag, update it's guards, and strip trailing
whitespace.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Now there is a local header, asm/cpu-user-regs.h is a far better place for
these to live.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
The TSC functionality is only related to MSRs by write_tsc(), and this really
does not want to be available as widely as is currently is.
asm/time.h shouldn't be including asm/msr.h, but this turns out to be
sufficiently tangled that I've chosen to break it out into it's own patch.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
It is a large and complex API, but only a handful of translation units need
access.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
struct vcpu_msrs has a very different purpose to everything else in msr.h
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Update get_implicit_path to return the correct value for a non-dom0
xenstored domain.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
posix.c and minios.c implement the same named functions serving slightly
different purposes.
For xenbus_map()
posix.c maps the local /dev/xen/xsd_kva
minios.c maps dom0 via grant and there is open coding for stub_domid in
map_interface.
Change xenbus_map() to map the local domain's interface. The default
grant table mapping is performed otherwise.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
The dom0_domid variable is misnamed and conflates purposes. If we have
xenstored running in a Linux domain that is not dom0, this variable
controls the lookup of /proc/xen/xsd_kva and the event channel.
Rename to store_domid to better show its purpose.
One implication of this change is that the xenstore domain is not
privileged by virtue of considering store_domid as privileged.
domain_is_unprivileged() removes the dom0_domid/store_domid check, so
xenstore domain is no longer considered privileged.
onearg_domain() is updated to return EINVAL for store_domid or priv_domid
to maintain the ability to call XS_RESUME.
xenbus_master_domid() is removed with store_domid being used instead.
Add a description of the -m/--master-domid options while
doing this.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Usually, priv_domid == dom0_domid == 0, and that is what is expected.
If we rename s/dom0_domid/store_domid/, it seems more likely we want to
actually have the priv_domid as the owner.
That leads to follow on changes to ensure that the priv_domid is created
first.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
With separate control and xenstore domains, the xenstore domain itself
is no longer privileged. Local socket connections do not have
conn->domain assigned, but domain_chk_quota() will go ahead and
dereference it. The !domid_is_unprivileged(conn->id) check usually
means the function would have already returned.
Bail out on !conn->domain to avoid faulting. This adds a similar check
to that in domain_max_chk()
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Replace dom0_init() with init_domains() which uses libxenmanage to
iterate through all existing domains, storing them in a list. The xenstore
domain is introduced first, and then all the other domains are
introduced. The xenstore domain needs to be introduced first to setup
structures needed for firing watches.
dom0_domid is updated with the xenstore domain, since it really
indicates the local domain.
priv_domid is set to the control domain. This makes it limited to a
single domain.
These features let xenstore automatically connect any existing domains,
which means it doesn't need to be done manually from init-dom0less.
For a legacy dom0, the result should be unchanged.
For a late xenstore stubdom it should also be the same, but priv_domid
would be set automatically to control domain (which default to 0
normally).
Always signal the event channel for initial domains. This gets dom0 (a
local xenstored domain) to connect.
Also always write XENSTORE_CONNECTED since we know we are connected at
this point.
To support ARM dom0less domains with xen,enhanced = "no-xenstore" a
failed introduce_domain() becomes non-fatal. Normally,
HVM_PARAM_STORE_EVTCHN is used to identify .
priv_domid from the command line is used, or the first control domain is
used.
dom0_domid will set to the last xenstore found. This will handle dom0
or dom0less, where only 1 xenstore domain can exist, or stubdom, where
dom0 and dom1 exist, and we want to take the stubdom.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Add helpers to lookup the event channel for a domid. This hides some
of the differences between dom0 and stubdom xenstored. Each version
defines its own.
It highlights the different meanings between get_xenbus_evtchn() in a
stubdom, where it looks up dom0's event channel, and dom0, where it
looks up the local event channel.
get_domain_evtchn() replaces get_xenbus_evtchn(), and
get_xenbus_evtchn() is removed from minios.c as it is inlined in the new
function.
The default return 0 will be fine as any other auto-introduced domain
will needs the event channel populated in the grant.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Make introduce_domain() use an event channel from the the xenstore page.
It is only used if non-zero. Otherwise the passed in event channel port
is used.
The is useful for a xenstored stubdom to configure domains autonomously.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
The unmapping part would have wanted to cover UNUSABLE regions as well,
and it would now have been necessary for space outside the low 16Mb
(wherever Xen is placed). However, with everything up to the next 2Mb
boundary now properly backed by RAM, we don't need to unmap anything
anymore: Space up to __2M_rwdata_end[] is properly reserved, whereas
space past that mark (up to the next 2Mb boundary) is ordinary RAM.
While there, limit the scopes of involved variables.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
With the appearance of Intel Sierra Forest and Granite Rapids it's now
possible to get a production x86 host with the following memory map:
SRAT: Node 0 PXM 0 [0000000000000000, 000000007fffffff]
SRAT: Node 0 PXM 0 [0000000100000000, 000000807fffffff]
SRAT: Node 1 PXM 1 [0000063e80000000, 000006be7fffffff]
SRAT: Node 2 PXM 2 [00000c7e80000000, 00000cfe7fffffff]
SRAT: Node 3 PXM 3 [000012be80000000, 0000133e7fffffff]
This is from a four socket Granite Rapids system, with each node having
512GB of memory. The total amount of RAM on the system is 2TB, but without
enabling CONFIG_BIGMEM the last range is not accessible, as it's above the
16TB boundary covered by the frame table. Sierra Forest and Granite Rapids
are socket compatible, however Sierra Forest only supports 2 socket
configurations, while Granite Rapids can go up to 8 sockets.
Note that while the memory map is very sparse, it couldn't be compressed
using the current PDX_MASK compression algorithm, which relies on all
ranges having a shared zeroed region of bits that can be removed.
The memory map presented above has the property of all regions being
similarly spaced between each other, and all having also a similar size.
Use a lookup table to store the offsets to translate from/to PFN and PDX
spaces. Such table is indexed based on the input PFN or PDX to translated.
The example PFN layout about would get compressed using the following:
PFN compression using PFN lookup table shift 29 and PDX region size 0x10000000
range 0 [0000000000000, 0x0000807ffff] PFN IDX 0 : 0000000000000
range 1 [0x00063e80000, 0x0006be7ffff] PFN IDX 3 : 0x00053e80000
range 2 [0x000c7e80000, 0x000cfe7ffff] PFN IDX 6 : 0x000a7e80000
range 3 [0x0012be80000, 0x00133e7ffff] PFN IDX 9 : 0x000fbe80000
Note how the tow ranges belonging to node 0 get merged into a single PDX
region by the compression algorithm.
The default size of lookup tables currently set in Kconfig is 64 entries,
and the example memory map consumes 10 entries. Such memory map is from a
4 socket Granite Rapids host, which in theory supports up to 8 sockets
according to Intel documentation. Assuming the layout of a 8 socket system
is similar to the 4 socket one, it would require 21 lookup table entries to
support it, way below the current default of 64 entries.
The valid range of lookup table size is currently restricted from 1 to 512
elements in Kconfig.
An extra array is used to keep track of the base PFN for each translated
range. Non used slots are set to ~0UL, so that in mfn_valid() the mfn <
base check always fails, thus reporting the mfn as invalid.
Introduce __init_or_pdx_mask and use it on some shared functions between
PDX mask and offset compression, as otherwise some code becomes unreachable
after boot if PDX offset compression is used. Mark the code as __init in
that case, so it's pruned after boot.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
This was almost certainly copy&paste from x86. ARM does not us these nor
selects HAS_EX_TABLE, so drop the sections and their boundary markers.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Julien Grall <jgrall@amazon.com>
Fix the incorrect condition that causes hvm_alloc_legacy_ioreq_gfn()
to return INVALID_GFN even if the HVM param was installed properly by
the toolstack.
Fixes: 3486f398a3 (' x86/hvm/ioreq: allow ioreq servers to use HVM_PARAM_[BUF]IOREQ_PFN')
Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
The unmapping part also wants to cover UNUSABLE regions, and it will now
be necessary for space outside the low 16Mb (wherever Xen is placed).
While there, limit the scopes of involved variables.
Fixes: e4dd91ea85 ("x86: Ensure RAM holes really are not mapped in Xen's ongoing 1:1 physmap")
Fixes: 7cd7f2f5e1 ("x86/boot: Remove the preconstructed low 16M superpage mappings")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
In order to legitimately set up initial mappings past _end[], we need
to make sure that the entire mapped range is inside a RAM region.
Therefore we need to inform the bootloader (or alike) that our allocated
size is larger than just the next SECTION_ALIGN-ed boundary past _end[].
This allows dropping a command line option from the tool, which was
introduced to work around a supposed linker bug, when the problem was
really Xen's.
While adjusting adjacent code, correct the argc check to also cover the
case correctly when --notes was passed.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
MISRA C Rule 5.5 states: "Identifiers shall be distinct from macro names".
Update ECLAIR configuration to deviate clashes: specify the macros that
should be ignored. Update deviations.rst and rules.rst accordingly.
Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
The __div0() function never returns to its caller, causing a violation
of MISRA C Rule 2.1: "A project shall not contain unreachable code".
Add the `noreturn` attribute to fix this.
Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
These can become static now the two traps.c have been merged.
No fucntional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
It's now just the double fault handler and various state dumping functions.
Swap u64 for uint64_t, and fix a few other minor style issues.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
... along with the supporting functions. Switch to Xen coding style, and make
static as there are no external callers.
Rename to legacy_syscall_init() as a more accurate name.
Swap wrmsr{,l}() for wrmsrns(). No serialisation is needed at this point.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Switch it to Xen coding style and fix MISRA violations (ul -> UL). Make it
static as there are no external caller now.
Since commit a35816b5ca ("x86/traps: Introduce early_traps_init() and
simplify setup"), load_system_tables() is called later on the BSP, so the
SYS_STATE_early_boot check can be dropped from the safety BUG_ON().
Move the BUILD_BUG_ON() into build_assertions(), and introduce an
endof_field() helper to make the expression clearer.
Swap wrmsrl(MSR_ISST, ...) for wrmsrns(). No serialisation is needed at this
point.
Drop the comment about Clang 3.5. It's no longer a supported toolchain, and
while the comment is true, the code should have been written with a local
pointer anyway.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
As things stand, we set up AP/S3 exception handling marginally after the
fragile activity of setting up shadow stacks. Shadow stack setup is going to
get more complicated under FRED.
Introduce percpu_early_traps_init() and call it ahead of setting up shadow
stacks. To start with, call load_system_tables() which is sufficient to set
up full exception handling.
In order to handle exceptions, current and the speculation controls needs to
work. cpu_smpboot_alloc() already constructs some of the AP's top-of-stack
block, so have it set up a little more. Zero the whole structure to subsume
other misc setup.
This gets us complete exception coverage of setting up shadow stacks, rather
than dying with a triple fault.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
We're going to want to reuse it for a remote stack shortly.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
The result of this calculation will always be identical, even across context
switch in x86. Tell the compiler.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
... to abstract away updating the refereces to the old BSP stack.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
We're going to want to introduce a percpu version shortly.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
This was added erroneously by me.
Hardware task switching does demand a TSS of at least 0x67 bytes, but that's
not relevant in 64bit, and not relevant for Xen since commit
5d1181a5ea ("xen: Remove x86_32 build target.") in 2012.
We already load a 0-length TSS in early_traps_init() demonstrating that it's
possible.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Otherwise Coverity complains about possibly shifting an integer more than
31 bits.
This also reverts the previous attempt to fix this Coverity reported
issue, commit 4dd3230290.
Suggested-by: Jan Beulich <jbeulich@suse.com>
Coverity ID: 1662707
Fixes: cb50e40337 ('test/pdx: add PDX compression unit tests')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
The toolchain baseline for GCC is 5.1, which supports _Static_assert
in c99 mode
No functional change.
Signed-off-by: Nicola Vetrini <nicola.vetrini@gmail.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The GCC baseline version is 5.1, which supports __builtin_unreachable(),
therefore the alternative definition can be dropped
Signed-off-by: Nicola Vetrini <nicola.vetrini@gmail.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The symbols declared with DECLARE_IMPORT are meant to be
used by the 32 bit code.
The __base_relocs_{start,end} symbols were not used by the
code.
No functional changes.
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Jason Andryuk
Ayan Kumar Halder
Mykyta Poturai
Juergen Gross
Roger Pau Monne
Oleksandr Tyshchenko
Andrew Cooper
Jan Beulich
Dmytro Prokopchuk1
Nicola Vetrini
Frediano Ziglio