Switch the log line to argo_dprintk() so it is enabled only in debug
environments, as it can spam the logs when a dom0 service using the Argo
hypercall tries to communicate with a domain that is still starting up.
Note that this also lowers the log level to debug when the argo_dprintk()
facility is enabled.
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Mykola Kvach <mykola_kvach@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
Construct all of the headers together in one block, rather than a field at a
time. Initialise as many of the fields as possible at declaration time.
Start filling in iov[] earlier, to allow for future simplifications.
No practical change.
Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
For reasons which escape me, rec_pfns are allocated separately to the rest of
the batch allocations.
Allocate them all together. This will allow for future simplifications to be
performed in an incremental mannor.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Construct xc_sr_rhdr directly rather than in two halves.
Use size_t for combined_len, which allows the later size check to spot a few
more cases which might have truncated.
Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Currently, during ARM Xen's SMP initialization, if there is
a Device Tree error (such as an invalid 'enable-method'),
cpu_possible_map can end up being sparse.
The issue here is that nr_cpu_ids is calculated in a way that
doesn't properly account for the maximum CPU ID when the map is
sparse, causing a mismatch. For example, if cpu_possible_map is
0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID
is 15. Xen's common code is built on the assumption that
'CPU ID < nr_cpu_ids', so this mismatch can break things.
To fix this, modify dt_smp_init_cpus() so that if the
arch_cpu_init() call fails, we don't consume the CPU ID slot.
Fixes: 4557c22928 ("xen: arm: rewrite start of day page table and cpu bring up")
Signed-off-by: Hirokazu Takahashi <taka@valinux.co.jp>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code.
lstar_enter() and cstar_enter() do not need CLD. The SYSCALL instruction
sanitises flags based on MSR_SYSCALL_MASK. For all other cases, place the CLD
instruction next to STAC/CLAC so the flag handling is together.
Get rid of the compat=1 special case for PV32. It's not obviously a win, and
PV32 is getting increasingly rare these days.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
POP_GPRS is shorter than RESTORE_ALL in terms of emitted code.
By separating the popping of entry_vector/error_code off the stack,
SPEC_CTRL_COND_VERW doesn't need custom displacements.
Get rid of the compat=1 special case for PV32. It's not obviously a win, and
PV32 is getting increasingly rare these days.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code.
SAVE_ALL hides a CLD instruction which is not needed anywhere here.
* VMX VMExit always clears flags. VMX VMentry failure never switched away
from the host flags, so they're still good.
* SVM VMRUN always saves and restores the host flags.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
This is slightly stale mentioning SWAPGS and not LKGS. However, take the
opportunity to make the comment more general and less likely to bitrot.
It would be a serious vulnerability for operating systems generally if CPL3
could modify GS_SHADOW at all.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Teddy Astie <teddy.astie@vates.tech>
arch_domain_create() and arch_sanitise_domain_config() are prerequisites for
domain_create().
arch_sanitise_domain_config() currently returns 0, as there is no specific
work required at this stage.
arch_domain_create() performs basic initialization, such as setting up the P2M
and initializing of next unused phandle.
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Introduce HAS_STATIC_MEMORY so that STATIC_MEMORY can be enabled or
disabled on a per-architecture basis. ARM selects the new flag; RISC-V
does not, so CONFIG_STATIC_MEMORY is unavailable on RISC-V and
randconfig builds no longer require an explicit STATIC_MEMORY=n override
to avoid a compilation error.
Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
As map_device_irqs_to_domain() is used unconditionally by common part of
dom0less code, move the prototype to a common header.
fdt-domain-build.h is chosen as map_device_irqs_to_domain() could be
also called indirectly in Arm's DOM0-related code and DT overlay feature.
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
C-stubdom was meant as a base for building new Mini-OS based stubdoms.
It hasn't seen any work for many years now and creating new stubdoms
should use UNIKRAFT instead of Mini-OS.
So remove c-stubdom.
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Teddy Astie <teddy.astie@vates.tech>
Given the need to calculate the base anyway, it's easier to do so entirely on
the stack.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
It can be used as-is for VMX. For SVM the special treatment of %rax needs
accounting for.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
... rather than papering over guest flaws: Strings passed ought to be nul-
terminated (yet sadly libxc hasn't been doing so thus far). This way we
also avoid order-1 allocations, seeing that all present callers pass
PAGE_SIZE for max_size.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> # Changelog
Nul-terminated strings are passed in all cases, so the strlen() can very
well be invoked by the function itself. In preparation for a hypervisor
change also include the nul terminator in the size calculation.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Use a single pci_sbdf_t instead of each of its part as individual parameters.
Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
More similar to other implementation.
posix_memalign was adde in NetBSD 8.0, released on July 17, 2018
and went out of support on May 4, 2024.
Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
This was reported to the security team, demonstrating that code execution
could be achieved, but without a demonstration of a priviliege boundary being
bypassed.
Still, it's a high risk path with no obvious evidence of having been used even
for debugging, so remove the environment variable and use the build time
$(libdir)/xenfsimage path only.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Due to unresponsiveness of the current maintainer. In particular, the
committers have been trying to get in touch with Christopher for 2 weeks to
have a chat about disputes around recent commits and pending changes to the
ARGO component without getting any response.
Signed-of-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
%4.4x and alike format specifiers can be expressed shorter as %04x or, as
e.g. dump_ioapic() has it, %.4x.
In dump_fpu()'s XMM register dumping, also move away from showing bogus
xmm03 and alike. The proper register name is xmm3 for that particular
example.
Also strip trailing whitespace from lines touched.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Add a PCI device table entry and matching parameter for the ASIX
AX99100 PCIe to Multi-I/O controller [125b:9910]. Each port on the
chip is a standalone PCI function, with UART registers on its I/O
BAR0.
Signed-off-by: Jiaqing Zhao <Zhao.Jiaqing@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Add support for the WCH (Nanjing Qinheng Microelectronics Co., Ltd.)
CH382 PCIe dual port serial adapter. The CH382 is available in two
variants:
- CH382 2S [1c00:3253]: 2 serial ports
- CH382 2S1P [1c00:3250]: 2 serial ports + 1 parallel port
This chip uses IO BAR0, base baud rate 115200, ports starting at offset
0xc0 and spaced 8 bytes apart, and a 256-byte FIFO. [1]
[1] https://www.wch-ic.com/downloads/CH382DS1_PDF.html
Signed-off-by: Jiaqing Zhao <Zhao.Jiaqing@amd.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
.bar0 and .mmio in struct ns16550_config_param are booleans, hence they
should be initialized with "true", not "1". No functional change.
Signed-off-by: Jiaqing Zhao <Zhao.Jiaqing@amd.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
In a !PV configuration the functions aren't built. Hence we're better off
also not declaring them.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
From its introduction it has been used solely to add and remove pools.
No list traversal or alike did ever occur. Drop all of this as being dead
code.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
For a long time (if not forever) this lock has been referenced only from a
single CU. Misra C:2012 rule 8.7 (which we didn't accept yet) wants us to
have such identifiers non-external.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Rename the enum to intc_variant and the structure member from hw_version
to hw_variant to better reflect that these values select between
different controller variants, not versions of the same one.
Requested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
In preparation for a hypervisor change also include the nul terminator in
the size calculations. (Note that xc_flask_getbool_byid() doesn't support
FLASK_GETBOOL's "ID being -1" variant of operation, and hence doesn't need
fiddling with.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Teddy Astie <teddy.astie@vates.tech>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
These existed to work around a bug in older GCC when using struct-casting for
variable initialisation. However, our baseline toolchain is new enough to not
suffer this bug.
Removing these resolves two MISRA Rule 9.2 violations which exist in release
builds of Xen only, where "= { ... }" is disallowed for simple scalar
initialisation.
The BUILD_BUG_ON() in xenmem_add_to_physmap() cannot stay as it is, because
INVALID_GFN is not an Integer Constant Expression. Replace it BUILD_ERROR()
which is the nearest available alternative.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Simply define shadow_audit_enable to be false for the !SHADOW_AUDIT case.
Change the variable to be a bool, and __read_mostly as it's only enabled by
debugkey.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Adjust kexec and kimage to more closely adhere to Xen style.
Sort the includes, dropping duplicates (kexec.h) and unused (ctype.h and
kernel.h).
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
The v1 interface was declared obsolete in Xen 4.4 (2013) when kexec in Xen was
overhauled.
The only known user of the v1 interface was the classic-xen fork of Linux.
Linux PVOps does not interact with Xen kexec directly, delegating it entirely
to userspace (i.e. kexec-tools). Xen support in kexec-tools was part of this
work, and uses the "new" interface.
As such, there's no sensible way to test changes to the old interface any
more.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
It is mostly sorted, but there are anomalies. Eliminating them gives
people fewer excuses to (blindly) add to the end of the list.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
IRQ_PER_CPU and IRQ_GUEST_EOI_PENDING are entirely unused. x86 uses
IRQ_REPLAY, but only ever to clear the bit. Drop all three constants.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Several files in xen/common/sched still reference schedule.c in
their comments, which was the original name of xen/common/sched/core.c
before commit 6cb4b01c03 ("xen/sched: move schedulers and cpupool
coding to dedicated directory") renamed and moved it. Some comments
also reference functions that no longer exist.
Rework the comments to remove stale file and function references.
Suggested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Furkan Caliskan <frn1furkan10@gmail.com>
Acked-by: Juergen Gross <jgross@suse.com>
Unmapping the virtual VMCB is performed near the end of the domain
destroy procedure but the mapped guest frame prevents domain destroy
from getting to that point. This means guests that call VMRUN cannot
be fully destroyed.
Move the unmap of the virtual VMCB earlier to fix the issue.
Fixes: bcf557675d ("x86: properly use map_domain_page() in nested HVM code")
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
There's no need to open-code these. No functional change intended, even if
the | changes to + in to_bcd().
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
... outside of __get_cmos_time()'s locked region. There's no need to hold
the lock for these computations.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Denis Mukhin