Commit Graph
49163 Commits
Author SHA1 Message Date
Dmytro Prokopchuk 9e5a9b53f6 common/efi: fix Rule 2.1 violation in read_file()
MISRA C Rule 2.1 states: "A project shall not contain unreachable code."

The final return statement in the 'read_file()' function is unreachable
due to function 'PrintErrMesg()' which has 'noreturn' attribute:
        PrintErrMesg(name, ret);
        /* not reached */
        return false;
    }

No explicit return statement is needed here because 'PrintErrMesg()' is
marked as 'noreturn', which guarantees that it never returns control to
the caller. If the 'noreturn' attribute of 'PrintErrMesg()' is removed
in the future, compiler will emit an error about the missing return
statement (build-time safeguard).
No functional changes.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2025-08-25 12:52:03 +02:00
Penny Zheng e28d97d598 tools: drop "has_num" condition check for cppc mode
In `xenpm get-cpufreq-para <cpuid>`, ->freq_num and ->cpu_num checking are
tied together via variable "has_num", while ->freq_num only has non-zero value
when cpufreq driver in legacy P-states mode.

So we drop the "has_num" condition check, and mirror the ->gov_num check for
both ->freq_num and ->cpu_num in xc_get_cpufreq_para().

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
2025-08-25 12:51:50 +02:00
Petr Beneš 5699554de9 tools/ocaml: Add altp2m_count parameter
Allow developers using the OCaml bindings to set the altp2m_count parameter.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Acked-by: Christian Lindig <christian.lindig@cloud.com>
2025-08-25 12:51:35 +02:00
Petr Beneš ae81cfa4d4 xen/x86: Disallow creating domains with altp2m enabled and altp2m.nr == 0
Since libxl finally sends the altp2m.nr value, we can remove the previously
introduced temporary workaround.

Creating domain with enabled altp2m while setting altp2m.nr == 0 doesn't
make sense and it's probably not what user wants.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-25 12:51:10 +02:00
Petr Beneš 445253c853 tools/libxl: Activate the altp2m_count feature
This commit activates the previously introduced altp2m_count parameter,
establishing the connection between libxl and Xen.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
2025-08-25 12:50:55 +02:00
Petr Beneš 06cf6cdab4 xen: Make the maximum number of altp2m views configurable for x86
This commit introduces the ability to configure the maximum number of altp2m
views for the domain during its creation. Previously, the limits were hardcoded
to a maximum of 10. This change allows for greater flexibility in environments
that require more or fewer altp2m views.

The maximum configurable limit for nr_altp2m on x86 is now set to
MAX_NR_ALTP2M (which currently holds the MAX_EPTP value - 512). This cap is
linked to the architectural limit of the EPTP-switching VMFUNC, which supports
up to 512 entries. Despite there being no inherent need for limiting nr_altp2m
in scenarios not utilizing VMFUNC, decoupling these components would necessitate
substantial code changes.

xen_domctl_createdomain::altp2m is extended for a new field `nr`, that will
configure this limit for a domain. Additionally, previous altp2m.opts value
has been reduced from uint32_t to uint16_t so that both of these fields occupy
as little space as possible.

Accesses to the altp2m_p2m array are modified to respect the new nr_altp2m
value. Accesses to the altp2m_(visible_)eptp arrays are unmodified, since
these arrays always have fixed size of MAX_EPTP.

Additional sanitization is introduced in the x86/arch_sanitise_domain_config
to fix the altp2m.nr value to 10 if it is previously set to 0. This behavior
is only temporary and immediately removed in the upcoming commit (which will
disallow creating a domain with enabled altp2m with zero nr_altp2m).

The reason for this temporary workaround is to retain the legacy behavior
until the feature is fully activated in libxl.

Also, arm/arch_sanitise_domain_config is extended to not allow requesting
non-zero altp2ms.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tamas K Lengyel <tamas@tklengyel.com> # mem_access/mem_sharing
Acked-by: Julien Grall <jgrall@amazon.com>
2025-08-25 12:50:20 +02:00
Petr Beneš 8f694f789e x86/altp2m: Wrap altp2m-specific code in #ifdef CONFIG_ALTP2M
This change consistently guards all altp2m-related functionality
behind #ifdef CONFIG_ALTP2M, so that code and data structures related
to alternate p2m views are only included when the feature is enabled.

Apart from that:
- hvmemul_vmfunc() returns X86EMUL_UNHANDLEABLE when altp2m is disabled.
- do_altp2m_op() returns EOPNOTSUPP when altp2m is disabled.
- struct hvm_vcpu, arch_domain, and hvm_function_table only define altp2m
  fields when the feature is enabled.
- Moved several declarations under #ifdef CONFIG_ALTP2M in p2m.h to avoid
  polluting builds that don't require the feature.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tamas K Lengyel <tamas@tklengyel.com> # mem_access
2025-08-25 12:49:23 +02:00
Petr Beneš 5fe316e479 altp2m: Drop p2m_altp2m_check() stubs on non-x86, move prototype, and guard uses
Remove the no-op stubs from the ARM, PPC, and RISC‑V p2m headers and stop
providing a stub in arch/x86/include/asm/p2m.h.

Declare p2m_altp2m_check() in xen/include/xen/p2m-common.h and gate all
call sites with CONFIG_ALTP2M:
 - wrap the fast_single_step block in hvm/monitor.c with #ifdef CONFIG_ALTP2M
   (IS_ENABLED(CONFIG_ALTP2M) is not used here, because in the subsequent commit
   hvm_vcpu::fast_single_step will be guarded by CONFIG_ALTP2M)
 - make the vm_event.c path conditional via IS_ENABLED(CONFIG_ALTP2M)

No functional change intended: on builds without ALTP2M the calls are
compiled out; on builds with ALTP2M behavior is unchanged.

Signed-off-by: Petr Beneš <w1benny@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com> # arm
Acked-by: Tamas K Lengyel <tamas@tklengyel.com> # vm_event/monitor
2025-08-25 12:44:58 +02:00
Juergen Gross 4efc1da300 tools/xl: hide xenstore-features behind option
In order to be able to use "xl info" before Xenstore has been started
or after it has crashed, hide obtaining the available Xenstore features
behind the new option "-x".

Fixes: ecce7970cf ("tools/xl: add available Xenstore features to xl info output")
Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
2025-08-22 23:34:07 +01:00
Andrew Cooper 011a9e2566 CI: Use 'watchdog' for x86 hardware
This detects various hangs and turns them into a crash with backtrace.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-22 23:34:07 +01:00
Andrew Cooper 16de294bed x86/msr: Rework rdmsr_safe() using asm goto()
... on capable toolchains.

This avoids needing to hold rc in a register across the RDMSR, and in most
cases removes direct testing and branching based on rc, as the fault label can
be rearranged to directly land on the out-of-line block.

There is a subtle difference in behaviour.  The old behaviour would, on fault,
still produce 0's and write to val.

The new behaviour only writes val on success, and write_msr() is the only
place where this matters.  Move temp out of switch() scope and initialise it
to 0.

While it is possible to retain the old behaviour, it's not great to do so
because the compiler cannot optimise out the dead store when it's not to a
local function variable, and Xen has a lot of msr infrastructure which passes
a val pointer through the call-tree.  We have compilers with ASM_GOTO_OUTPUT
in CI, and they do notice.

Resolves: https://gitlab.com/xen-project/xen/-/work_items/217
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-22 23:34:07 +01:00
Andrew Cooper d7c9d05cd1 x86/msr: Implement rdmsr_safe() in C
... in preparation to be able to use asm goto.

Notably this mean that the value parameter must be taken by pointer rather
than by value.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-22 23:34:07 +01:00
Andrew Cooper abeb2fe8b5 x86/setup: Trim includes
None of these are used by setup.c today.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2025-08-22 23:34:07 +01:00
Jason Andryuk 76f9dbf9a2 xen/dom0less: Clear xenstore page
C Xenstored was seen failing to map a domU's event channel.  Enhancing
Xen's error messages shows:
common/event_channel.c:427:d0v0 EVTCHNOP failure: d1, port 3267543746 error -22

Port 3267543746 is 0xc2c2c2c2 - SCRUB_PATTERN.

Xenstore expects a non-zero evtchn_port to be valid.  Explicitly zero
the page to avoid this.

Fixes: df2c03e2eb ("xen/arm: Alloc XenStore page for Dom0less DomUs from hypervisor")
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
2025-08-22 09:56:51 +02:00
Ayan Kumar Halder 72042ea63b arm/mpu: Disable map_domain_page for MPU
There is no domheap for ARM_32. All of the RAM is mapped and VA == PA.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Tested-by: Hari Limaye <hari.limaye@arm.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2025-08-22 09:55:45 +02:00
Ayan Kumar Halder 120747f84a arm/mpu: Enable is_xen_heap_page and is_xen_heap_mfn for ARM_32
In case of ARM_32, all of the RAM will be covered by a permanent contiguous
mapping (where VA == PA) and there will be a single heap. Thus, the memory
allocated from Xen heap uses PGC_xen_heap.
This is similar to the scenario described for
"CONFIG_SEPARATE_XENHEAP=n W/ DIRECT MAP OF ALL RAM" in common/page_alloc.c.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Tested-by: Hari Limaye <hari.limaye@arm.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2025-08-22 09:55:45 +02:00
Mykyta Poturai 3cf47a1e16 iommu/ipmmu-vmsa: Fix build with HAS_PCI=n
With PCI disabled the build fails due to undefined struct
pci_host_bridge.

Add ifdef guard to pci-host-rcar4.h to not require the stuct being
defined when PCI support is disabled. All call sites are already covered
by HAS_PCI check, so no dummy implementations are needed.

Also move includes under the header guard to not break MISRA rules.

Fixes: 08b52c30be ("iommu/ipmmu-vmsa: Implement basic PCIE-IPMMU OSID support")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-21 14:47:01 -07:00
Juergen Gross f3365a6bfd tools/xenstored: fix possible NULL deref
Avoid dereferencing NULL in introduce_domain() when called during
live update.

Coverity ID: 1665111
Fixes: f78895ad78 ("tools/xenstored: Read event channel from xenstored page")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
2025-08-21 12:49:25 +02:00
Juergen Gross 723e057192 CHANGELOG.md: add xenstorepvh-stubdom live update
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Oleksii Kurochko<oleksii.kurochko@gmail.com>
2025-08-21 12:49:02 +02:00
Roger Pau Monne c292772b49 x86/iommu: setup MMCFG ahead of IOMMU
Otherwise the PCI accesses to segments different than the first one done by
the IOMMU initialization code would silently fail by returning all ones.

Introduce a new helper, called pci_setup(), and move both the creation of
PCI segment 0 internal data structures, plus the parsing of ACPI MMCFG
table to it.  This moves acpi_mmcfg_init() slightly earlier from
acpi_boot_init() into pci_setup().

Note that further work will be needed to support systems where access
methods to segments different than 0 is not discoverable by Xen.

Fixes: 3950f2485b ('x86/x2APIC: defer probe until after IOMMU ACPI table parsing')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-08-21 11:57:25 +02:00
Oleksandr Tyshchenko 08b52c30be iommu/ipmmu-vmsa: Implement basic PCIE-IPMMU OSID support
Program PCIE BDF-OSID assignment according to the S4_PCIe_IPMMU-OSID
when adding PCI device to the IOMMU in ipmmu_add_device callback.
This is needed for being able to assign PCI devices to different
domains at the same time. Programmed OSID is emmited as sideband data on
the AXI bus during PCI DMA transactions and then used by IPMMU to match
the transaction to the corresponding uTLB.

Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-20 18:12:20 -07:00
Mykyta Poturai 114c01ebf3 pci/rcar: implement OSID configuration for Renesas RCar Gen4 PCIe host
For IPMMU to be able to associate a specific PCI device with it's TLB
the BDF to OSID mapping needs to be set up in the host bridge. The
configured OSID is then emmited as a sideband data on the AXI bus during
PCI DMA transactions. OSID configuration registers are located in the
"app" region of the host bridge.

Map the "app" region on init and implement methods for setting up
BDF->OSID mappings

Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-20 18:11:12 -07:00
Mykyta Poturai 3ac97971f7 arm/pci: allow designware-based hosts to have private data
Introduce an additional private data field in `dw_pcie_priv` to allow
vendors to store custom data without interfering with bridge->priv.
Also add get/set pair to make accesing that private data less
cumbersome.

Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-20 18:11:08 -07:00
Andrew Cooper 97f9db488a x86/svm: Rename variable in svm_msr_write_intercept()
We're about to turn the rdmsr() macro into a real function, at which point
Eclair complains that we're now shadowing an identifer.

Rename rdmsr to is_read.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper 5ea2d0952e x86: Clean up asm/msr.h
Now that content has been split out, minimise the header files as msr.h is
included by many translation units.  A few more TUs were pulling dependencies
in transitively, so fix them up.

Give asm/time.h an SPDX tag, update it's guards, and drop the unused rdpmc().
If we do re-gain uses, the helper will want a proper API.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper 1373eca837 x86: Clean up asm/time.h
With asm/tsc.h split out, asm/time.h shouldn't be including asm/msr.h, but it
turns out that an outrageous number of files (even some headers) are pulling
their dependentices transitively through asm/time.h -> asm/msr.h

Most are asm/msr{,-index}.h, but in some cases it's printk(), va_args, and
even PRIxxx macros.

Give asm/time.h an SPDX tag, update it's guards, and strip trailing
whitespace.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper f1e4325f59 x86/msr: Move msr_{split,fold}() into asm/cpu-user-regs.h
Now there is a local header, asm/cpu-user-regs.h is a far better place for
these to live.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper 2b3d1c8a30 x86/msr: Split out tsc.h
The TSC functionality is only related to MSRs by write_tsc(), and this really
does not want to be available as widely as is currently is.

asm/time.h shouldn't be including asm/msr.h, but this turns out to be
sufficiently tangled that I've chosen to break it out into it's own patch.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper 9e54444371 x86/msr: Split out fsgsbase.h
It is a large and complex API, but only a handful of translation units need
access.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper ef745a2d01 x86/msr: Split out guest-msr.h
struct vcpu_msrs has a very different purpose to everything else in msr.h

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Andrew Cooper 90226b8b1a x86: Sort headers
No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-19 19:52:48 +01:00
Jason Andryuk 2e8067a773 tools/xenstored: Remove hardcoded implicit path
Update get_implicit_path to return the correct value for a non-dom0
xenstored domain.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:04:13 +02:00
Jason Andryuk 671e80d990 tools/xenstored: Remove stubdom special casing
posix.c and minios.c implement the same named functions serving slightly
different purposes.

For xenbus_map()
posix.c maps the local /dev/xen/xsd_kva
minios.c maps dom0 via grant and there is open coding for stub_domid in
map_interface.

Change xenbus_map() to map the local domain's interface.  The default
grant table mapping is performed otherwise.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:04:08 +02:00
Jason Andryuk 9947e2ad88 tools/xenstored: Rename dom0_domid to store_domid
The dom0_domid variable is misnamed and conflates purposes.  If we have
xenstored running in a Linux domain that is not dom0, this variable
controls the lookup of /proc/xen/xsd_kva and the event channel.

Rename to store_domid to better show its purpose.

One implication of this change is that the xenstore domain is not
privileged by virtue of considering store_domid as privileged.

domain_is_unprivileged() removes the dom0_domid/store_domid check, so
xenstore domain is no longer considered privileged.

onearg_domain() is updated to return EINVAL for store_domid or priv_domid
to maintain the ability to call XS_RESUME.

xenbus_master_domid() is removed with store_domid being used instead.

Add a description of the -m/--master-domid options while
doing this.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:04:02 +02:00
Jason Andryuk c67def341a tools/xenstored: Use priv_domid for manual nodes and permission
Usually, priv_domid == dom0_domid == 0, and that is what is expected.
If we rename s/dom0_domid/store_domid/, it seems more likely we want to
actually have the priv_domid as the owner.

That leads to follow on changes to ensure that the priv_domid is created
first.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:03:57 +02:00
Jason Andryuk 1b4e935f45 tools/xenstored: Check NULL domain in domain_chk_quota()
With separate control and xenstore domains, the xenstore domain itself
is no longer privileged.  Local socket connections do not have
conn->domain assigned, but domain_chk_quota() will go ahead and
dereference it.  The !domid_is_unprivileged(conn->id) check usually
means the function would have already returned.

Bail out on !conn->domain to avoid faulting.  This adds a similar check
to that in domain_max_chk()

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:03:52 +02:00
Jason Andryuk e5b0a94055 tools/xenstored: Auto-introduce domains
Replace dom0_init() with init_domains() which uses libxenmanage to
iterate through all existing domains, storing them in a list.  The xenstore
domain is introduced first, and then all the other domains are
introduced.  The xenstore domain needs to be introduced first to setup
structures needed for firing watches.

dom0_domid is updated with the xenstore domain, since it really
indicates the local domain.

priv_domid is set to the control domain.  This makes it limited to a
single domain.

These features let xenstore automatically connect any existing domains,
which means it doesn't need to be done manually from init-dom0less.

For a legacy dom0, the result should be unchanged.

For a late xenstore stubdom it should also be the same, but priv_domid
would be set automatically to control domain (which default to 0
normally).

Always signal the event channel for initial domains.  This gets dom0 (a
local xenstored domain) to connect.

Also always write XENSTORE_CONNECTED since we know we are connected at
this point.

To support ARM dom0less domains with xen,enhanced = "no-xenstore" a
failed introduce_domain() becomes non-fatal.  Normally,
HVM_PARAM_STORE_EVTCHN is used to identify .

priv_domid from the command line is used, or the first control domain is
used.

dom0_domid will set to the last xenstore found.  This will handle dom0
or dom0less, where only 1 xenstore domain can exist, or stubdom, where
dom0 and dom1 exist, and we want to take the stubdom.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:03:48 +02:00
Jason Andryuk cec885de7f tools/xenstored: Add get_domain_evtchn() to find evtchn
Add helpers to lookup the event channel for a domid.  This hides some
of the differences between dom0 and stubdom xenstored.  Each version
defines its own.

It highlights the different meanings between get_xenbus_evtchn() in a
stubdom, where it looks up dom0's event channel, and dom0, where it
looks up the local event channel.

get_domain_evtchn() replaces get_xenbus_evtchn(), and
get_xenbus_evtchn() is removed from minios.c as it is inlined in the new
function.

The default return 0 will be fine as any other auto-introduced domain
will needs the event channel populated in the grant.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:03:43 +02:00
Jason Andryuk f78895ad78 tools/xenstored: Read event channel from xenstored page
Make introduce_domain() use an event channel from the the xenstore page.
It is only used if non-zero.  Otherwise the passed in event channel port
is used.

The is useful for a xenstored stubdom to configure domains autonomously.

Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2025-08-19 11:03:37 +02:00
Jan Beulich 3101c46a06 x86/mm: drop unmapping from marking-as-I/O in arch_init_memory()
The unmapping part would have wanted to cover UNUSABLE regions as well,
and it would now have been necessary for space outside the low 16Mb
(wherever Xen is placed). However, with everything up to the next 2Mb
boundary now properly backed by RAM, we don't need to unmap anything
anymore: Space up to __2M_rwdata_end[] is properly reserved, whereas
space past that mark (up to the next 2Mb boundary) is ordinary RAM.

While there, limit the scopes of involved variables.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2025-08-19 11:02:57 +02:00
Jan Beulich 22c2cca552 Revert "x86/mm: split unmapping and marking-as-I/O in arch_init_memory()"
This reverts commit 248096b113. This was a
stale version of the patch, and thus also not what was ack-ed.
2025-08-19 11:00:26 +02:00
Roger Pau Monne c5c45bcbd6 pdx: introduce a new compression algorithm based on region offsets
With the appearance of Intel Sierra Forest and Granite Rapids it's now
possible to get a production x86 host with the following memory map:

SRAT: Node 0 PXM 0 [0000000000000000, 000000007fffffff]
SRAT: Node 0 PXM 0 [0000000100000000, 000000807fffffff]
SRAT: Node 1 PXM 1 [0000063e80000000, 000006be7fffffff]
SRAT: Node 2 PXM 2 [00000c7e80000000, 00000cfe7fffffff]
SRAT: Node 3 PXM 3 [000012be80000000, 0000133e7fffffff]

This is from a four socket Granite Rapids system, with each node having
512GB of memory.  The total amount of RAM on the system is 2TB, but without
enabling CONFIG_BIGMEM the last range is not accessible, as it's above the
16TB boundary covered by the frame table. Sierra Forest and Granite Rapids
are socket compatible, however Sierra Forest only supports 2 socket
configurations, while Granite Rapids can go up to 8 sockets.

Note that while the memory map is very sparse, it couldn't be compressed
using the current PDX_MASK compression algorithm, which relies on all
ranges having a shared zeroed region of bits that can be removed.

The memory map presented above has the property of all regions being
similarly spaced between each other, and all having also a similar size.
Use a lookup table to store the offsets to translate from/to PFN and PDX
spaces.  Such table is indexed based on the input PFN or PDX to translated.
The example PFN layout about would get compressed using the following:

PFN compression using PFN lookup table shift 29 and PDX region size 0x10000000
 range 0 [0000000000000, 0x0000807ffff] PFN IDX  0 : 0000000000000
 range 1 [0x00063e80000, 0x0006be7ffff] PFN IDX  3 : 0x00053e80000
 range 2 [0x000c7e80000, 0x000cfe7ffff] PFN IDX  6 : 0x000a7e80000
 range 3 [0x0012be80000, 0x00133e7ffff] PFN IDX  9 : 0x000fbe80000

Note how the tow ranges belonging to node 0 get merged into a single PDX
region by the compression algorithm.

The default size of lookup tables currently set in Kconfig is 64 entries,
and the example memory map consumes 10 entries.  Such memory map is from a
4 socket Granite Rapids host, which in theory supports up to 8 sockets
according to Intel documentation.  Assuming the layout of a 8 socket system
is similar to the 4 socket one, it would require 21 lookup table entries to
support it, way below the current default of 64 entries.

The valid range of lookup table size is currently restricted from 1 to 512
elements in Kconfig.

An extra array is used to keep track of the base PFN for each translated
range.  Non used slots are set to ~0UL, so that in mfn_valid() the mfn <
base check always fails, thus reporting the mfn as invalid.

Introduce __init_or_pdx_mask and use it on some shared functions between
PDX mask and offset compression, as otherwise some code becomes unreachable
after boot if PDX offset compression is used.  Mark the code as __init in
that case, so it's pruned after boot.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-18 13:01:10 +01:00
Andrew Cooper b3d6651df0 arm/link: Remove exception table sections
This was almost certainly copy&paste from x86.  ARM does not us these nor
selects HAS_EX_TABLE, so drop the sections and their boundary markers.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2025-08-18 13:01:10 +01:00
Oleksandr Tyshchenko 282ed258a5 x86/hvm/ioreq: Fix condition in hvm_alloc_legacy_ioreq_gfn()
Fix the incorrect condition that causes hvm_alloc_legacy_ioreq_gfn()
to return INVALID_GFN even if the HVM param was installed properly by
the toolstack.

Fixes: 3486f398a3 (' x86/hvm/ioreq: allow ioreq servers to use HVM_PARAM_[BUF]IOREQ_PFN')
Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-18 10:43:52 +02:00
Jan Beulich 248096b113 x86/mm: split unmapping and marking-as-I/O in arch_init_memory()
The unmapping part also wants to cover UNUSABLE regions, and it will now
be necessary for space outside the low 16Mb (wherever Xen is placed).

While there, limit the scopes of involved variables.

Fixes: e4dd91ea85 ("x86: Ensure RAM holes really are not mapped in Xen's ongoing 1:1 physmap")
Fixes: 7cd7f2f5e1 ("x86/boot: Remove the preconstructed low 16M superpage mappings")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
2025-08-18 10:43:28 +02:00
Jan Beulich 4fb075201f x86/mkelf32: pad load segment to 2Mb boundary
In order to legitimately set up initial mappings past _end[], we need
to make sure that the entire mapped range is inside a RAM region.
Therefore we need to inform the bootloader (or alike) that our allocated
size is larger than just the next SECTION_ALIGN-ed boundary past _end[].

This allows dropping a command line option from the tool, which was
introduced to work around a supposed linker bug, when the problem was
really Xen's.

While adjusting adjacent code, correct the argc check to also cover the
case correctly when --notes was passed.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2025-08-18 10:42:24 +02:00
Dmytro Prokopchuk1 212f690aee misra: add deviations of MISRA C Rule 5.5
MISRA C Rule 5.5 states: "Identifiers shall be distinct from macro names".

Update ECLAIR configuration to deviate clashes: specify the macros that
should be ignored. Update deviations.rst and rules.rst accordingly.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-15 12:44:22 -07:00
Dmytro Prokopchuk1 268e818bf1 misra: add missing noreturn attribute for __div0()
The __div0() function never returns to its caller, causing a violation
of MISRA C Rule 2.1: "A project shall not contain unreachable code".
Add the `noreturn` attribute to fix this.

Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-08-15 12:37:18 -07:00
Andrew Cooper 528efc7b6a x86/traps: Unexport show_code() and show_stack_overflow()
These can become static now the two traps.c have been merged.

No fucntional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-08-15 11:13:42 +01:00
Andrew Cooper 16376dece8 x86/traps: Fold x86_64/traps.c into traps.c
It's now just the double fault handler and various state dumping functions.

Swap u64 for uint64_t, and fix a few other minor style issues.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-08-15 11:13:42 +01:00