Commit Graph
47447 Commits
Author SHA1 Message Date
Stefano Stabellini aa80a04df4 automation: restore CR filtering
After commit c36efb7fce ("automation: use expect to run QEMU") we lost
the \r filtering introduced by b576497e3b ("automation: remove CR
characters from serial output"). This patch reintroduced it.

Fixes: c36efb7fce ("automation: use expect to run QEMU")
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-22 13:07:39 -07:00
Michal Orzel 394c9d8885 xen/arm: head: Do not pass physical offset to start_xen
Given no further use in C world of boot_phys_offset, drop it from the
argument list of start_xen() and do the necessary changes in the startup
code head.S (most notably modifying launch not to expect 2 arguments to
pass to C entry point).

Both on arm64 and arm32, phys offset (stored in x20 or r10 respectively)
is still needed, so that it can be used in e.g. create_table_entry,
therefore keep it on the list of common register usage.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2024-08-22 11:35:05 +01:00
Michal Orzel 0cc09bdfaf xen/arm: Drop {boot_}phys_offset usage
boot_phys_offset stores the physical offset (PA-VA), is calculated in
the startup head.S code and passed to start_xen() as a first argument.
There is no point in using it given that we can ask MMU to translate
a VA for us using e.g. virt_to_{mfn,maddr}. Drop usage of these
variables from the C world.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2024-08-22 11:35:05 +01:00
Julien Grall 98060fc4a3 xen/arm64: Hide FEAT_SME
Newer hardware may support FEAT_SME. Xen doesn't have any knowledge but
it will still expose the feature to the VM. If the OS is trying to use
SME, then it will crash.

Solve by hiding FEAT_SME.

Signed-off-by: Julien Grall <julien@xen.org>
Acked-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
2024-08-22 11:09:42 +01:00
Ayan Kumar Halder 405c2b4b99 xen: arm: Enclose access to EL2 MMU specific registers under CONFIG_MMU
All the EL2 MMU specific registers are enclosed within CONFIG_MMU.
Also, protect vttbr_el2 field of struct reg_ctxt and accesses to it.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-22 11:06:33 +01:00
Ayan Kumar Halder 576459a06a xen: arm: Move domain_page.c to MMU specific
domain_page.c is moved to mmu/domain_page.c. The reason
being this file implements MMU specific logic for mapping,
unmapping, etc domain page.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-22 11:06:33 +01:00
Ayan Kumar Halder 6df7c21b63 xen: arm: Add a new helper update_boot_mapping()
update_boot_mapping() invokes update_identity_mapping() for the MMU specific
code.
Later when the MPU code is added, update_boot_mapping() will invoke the
equivalent.

The common code now invokes update_boot_mapping() instead of
update_identity_mapping(). So, that there is clear abstraction between the
common and MMU/MPU specific logic.

This is in continuation to commit
f661a20aa8: "Extract MMU-specific MM code".

update_identity_mapping() is now marked as static as it is called from
xen/arch/arm/arm64/mmu/mm.c only. Also, amend the prototype to
update_boot_mapping() which is now invoked from other files.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-22 11:06:33 +01:00
Amneesh Singh be9b405aef drivers: char: omap-uart: provide a default clock frequency
Quite a few TI K3 devices do not have clock-frequency specified in their
respective UART nodes. However hard-coding the frequency is not a
solution as the function clock input can differ between SoCs. So, use a
default frequency of 48MHz, which is the same as the linux default (see
8250_omap.c), if the device tree does not specify it.

Signed-off-by: Amneesh Singh <a-singh21@ti.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-22 10:59:52 +01:00
Andrew Cooper 6d41a9d8a1 x86/pv: Address Coverity complaint in check_guest_io_breakpoint()
Commit 08aacc392d ("x86/emul: Fix misaligned IO breakpoint behaviour in PV
guests") caused a Coverity INTEGER_OVERFLOW complaint based on the reasoning
that width could be 0.

It can't, but digging into the code generation, GCC 8 and later (bisected on
godbolt) choose to emit a CSWITCH lookup table, and because the range (bottom
2 bits clear), it's a 16-entry lookup table.

So Coverity is understandable, given that GCC did emit a (dead) logic path
where width stayed 0.

Rewrite the logic.  Introduce x86_bp_width() which compiles to a single basic
block, which replaces the switch() statement.  Take the opportunity to also
make start and width be loop-scope variables.

No practical change, but it should compile better and placate Coverity.

Fixes: 08aacc392d ("x86/emul: Fix misaligned IO breakpoint behaviour in PV guests")
Coverity-ID: 1616152
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-21 23:59:19 +01:00
Andrew Cooper db39fa4b27 x86/pv: Fix merging of new status bits into %dr6
All #DB exceptions result in an update of %dr6, but this isn't captured in
Xen's handling, and is buggy just about everywhere.

To begin resolving this issue, add a new pending_dbg field to x86_event
(unioned with cr2 to avoid taking any extra space, adjusting users to avoid
old-GCC bugs with anonymous unions), and introduce pv_inject_DB() to replace
the current callers using pv_inject_hw_exception().

Push the adjustment of v->arch.dr6 into pv_inject_event(), and use the new
x86_merge_dr6() rather than the current incorrect logic.

A key property is that pending_dbg is taken with positive polarity to deal
with RTM/BLD sensibly.  Most callers pass in a constant, but callers passing
in a hardware %dr6 value need to XOR the value with X86_DR6_DEFAULT to flip to
positive polarity.

This fixes the behaviour of the breakpoint status bits; that any left pending
are generally discarded when a new #DB is raised.  In principle it would fix
RTM/BLD too, except PV guests can't turn these capabilities on to start with.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-21 23:59:19 +01:00
Andrew Cooper 54ef601a66 x86/pv: Introduce x86_merge_dr6() and fix do_debug()
Pretty much everywhere in Xen the logic to update %dr6 when injecting #DB is
buggy.  Introduce a new x86_merge_dr6() helper, and start fixing the mess by
adjusting the dr6 merge in do_debug().  Also correct the comment.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-21 23:59:19 +01:00
Jan Beulich a30d438ce5 x86emul: correct #UD check for AVX512-FP16 complex multiplications
avx512_vlen_check()'s argument was inverted, while the surrounding
conditional wrongly forced the EVEX.L'L check for the scalar forms when
embedded rounding was in effect.

Fixes: d14c52cba0 ("x86emul: handle AVX512-FP16 complex multiplication insns")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2024-08-19 15:32:31 +02:00
Stefano Stabellini 1e2a5f991f automation: add default QEMU_TIMEOUT value if not already set
The expectation is that QEMU_TIMEOUT should be set as a Gitlab CI/CD
variable but if not we should be able to run the pipeline anyway.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-16 16:50:19 -07:00
Jan Beulich cbe73b8482 xvmalloc: please Misra C:2012 Rule 8.2
The cloning from xmalloc.h happened long before Misra work started in
earnest, leading to the missing parameter name having been overlooked
later on.

Fixes: 9102fcd957 ("mm: introduce xvmalloc() et al and use for grant table allocations")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2024-08-14 15:40:30 +02:00
Jan Beulich 5ed317c45d x86emul: don't call ->read_segment() with x86_seg_none
LAR, LSL, VERR, and VERW emulation involve calling protmode_load_seg()
with x86_seg_none. The fuzzer's read_segment() hook function has an
assertion which triggers in this case. Calling the hook function,
however, makes little sense for those insns, as there's no data to
retrieve. Instead zero-filling the output structure is what properly
corresponds to those insns being invoked with a NUL selector.

While there also add a related comment at the VERR/VERW call site.

Fixes: 06a3b8cd7a ("x86emul: support LAR/LSL/VERR/VERW")
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70918
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2024-08-14 15:40:06 +02:00
Roger Pau Monné d18f8153be x86/spec-ctrl: initialize per-domain XPTI in spec_ctrl_init_domain()
XPTI being a speculation mitigation feels better to be initialized in
spec_ctrl_init_domain().

No functional change intended, although the call to spec_ctrl_init_domain() in
arch_domain_create() needs to be moved ahead of pv_domain_initialise() for
d->->arch.pv.xpti to be correctly set.

Move it ahead of most of the initialization functions, since
spec_ctrl_init_domain() doesn't depend on any member in the struct domain being
set.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-14 15:39:26 +02:00
Jan Beulich b12da0cc86 x86/xstate: use xvzalloc() for save area allocation
This is in preparation for the area size exceeding a page's worth of
space, as will happen with AMX as well as Architectural LBR.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
2024-08-14 15:38:14 +02:00
Jan Beulich a73f8d1944 libxl/disk: avoid aliasing of abs()
Tool chains with -Wshadow enabled by default won't like the function
parameter name "abs", for aliasing stdlib.h's abs(). Rename the
parameter to what other similar functions use.

Fixes: a18b50614d ("libxl: Enable stubdom cdrom changing")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
2024-08-14 08:50:14 +02:00
John E. Krokes 09226d165b xl: fix incorrect output in "help" command
In "xl help", the output includes this line:

 vsnd-list           List virtual display devices for a domain

This should obviously say "sound devices" instead of "display devices".

Signed-off-by: John E. Krokes <mag@netherworld.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
2024-08-14 08:49:44 +02:00
Jan Beulich 9102fcd957 mm: introduce xvmalloc() et al and use for grant table allocations
All of the array allocations in grant_table_init() can exceed a page's
worth of memory, which xmalloc()-based interfaces aren't really suitable
for after boot. We also don't need any of these allocations to be
physically contiguous. Introduce interfaces dynamically switching
between xmalloc() et al and vmalloc() et al, based on requested size,
and use them instead.

All the wrappers in the new header are cloned mostly verbatim from
xmalloc.h, with the sole adjustment to switch unsigned long to size_t
for sizes and to unsigned int for alignments, and with the cloning of
x[mz]alloc_bytes() avoided. The exception is xvmemdup(), where the
const related comment on xmemdup() is actually addressed and hence
dropped.

While adjusting grant_table_destroy() also move ahead the clearing of
the struct domain field.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
2024-08-14 08:47:58 +02:00
Juergen Gross e4d19a2dad tools/xenstored: switch stubdom live update to use file for state
With the introduction of 9pfs for Xenstore-stubdom it is now possible
to use a file for saving the state when doing live update.

This allows to move some environment specific actions back to the
common source file lu.c.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
2024-08-14 08:46:54 +02:00
Stefano Stabellini c36efb7fce automation: use expect to run QEMU
Use expect to invoke QEMU so that we can terminate the test as soon as
we get the right string in the output instead of waiting until the
final timeout.

For timeout, instead of an hardcoding the value, use a Gitlab CI
variable "QEMU_TIMEOUT" that can be changed depending on the latest
status of the Gitlab CI runners.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-13 16:05:05 -07:00
Julien Grall 35c64c3dce xen/arm64: entry: Actually skip do_trap_*() when an SError is triggered
For SErrors, we support two configurations:
  * Every SErrors will result to a panic in Xen
  * We will forward SErrors triggered by a VM back to itself

For the latter case, we want to skip the call to do_trap_*() because the PC
was already adjusted.

However, the alternative used to decide between the two configurations
is inverted. This would result to the VM corrupting itself if:
  * x19 is non-zero in the panic case
  * advance PC too much in the second case

Solve the issue by switch from alternative_if to alternative_if_not.

Fixes: a458d3bd0d ("xen/arm: entry: Ensure the guest state is synced when receiving a vSError")
Signed-off-by: Julien Grall <jgrall@amazon.com>
2024-08-13 21:58:24 +01:00
Edgar E. Iglesias 8fc1b356af xen/arm: smmuv3: Mark more init-only functions with __init
Move more functions that are only called at init to
the .init.text section.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Acked-by: Rahul Singh <rahul.singh@arm.com>
Tested-by: Rahul Singh <rahul.singh@arm.com>
2024-08-13 21:53:41 +01:00
Jan Beulich fe3412ab83 Arm: correct FIXADDR_TOP
While reviewing a RISC-V patch cloning the Arm code, I noticed an
off-by-1 here: FIX_PMAP_{BEGIN,END} being an inclusive range and
FIX_LAST being the same as FIX_PMAP_END, FIXADDR_TOP cannot derive from
FIX_LAST alone, or else the BUG_ON() in virt_to_fix() would trigger if
FIX_PMAP_END ended up being used.

While touching this area also add a check for fixmap and boot FDT area
to not only not overlap, but to have at least one (unmapped) page in
between.

Fixes: 4f17357b52 ("xen/arm: add Persistent Map (PMAP) infrastructure")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-13 21:50:55 +01:00
Jan Beulich 69e99b5d4b x86emul: fix UB multiplications in S/G handling
The conversion of the shifts to multiplications by the commits tagged
below still wasn't quite right: The multiplications (of signed values)
can overflow, too. As of 298556c7b5 ("x86emul: correct 32-bit address
handling for AVX2 gathers") signed multiplication wasn't necessary
anymore, though: The necessary sign-extension (if any) will happen as
well when using intermediate variables of unsigned long types, and
excess address bits are chopped off by truncate_ea().

Fixes: b6a907f8c8 ("x86emul: replace UB shifts")
Fixes: 21de9680eb ("x86emul: replace further UB shifts")
Oss-fuzz: 71138
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2024-08-13 16:41:25 +02:00
Oleksii Kurochko 8fb49f2697 xen/riscv: enable CONFIG_HAS_DEVICE_TREE
Enable build of generic functionality for working with device
tree for RISC-V.
Also, a collection of functions for parsing memory map and other
boot information from a device tree are available now.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2024-08-13 16:39:43 +02:00
Alejandro Vallejo cc47813c4a tools/hvmloader: Fix non-deterministic cpuid()
hvmloader's cpuid() implementation deviates from Xen's in that the value
passed on ecx is unspecified. This means that when used on leaves that
implement subleaves it's unspecified which one you get; though it's more
than likely an invalid one.

Import Xen's implementation so there are no surprises.

Fixes: 318ac791f9 ("Add utilities needed for SMBIOS generation to hvmloader")
Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-13 16:39:10 +02:00
Sergiy Kibrik b2e8c8f420 x86/vmx: guard access to cpu_has_vmx_* in common code
There're several places in common code, outside of arch/x86/hvm/vmx,
where cpu_has_vmx_* get accessed without checking whether VMX supported first.
These macros rely on global variables defined in vmx code, so when VMX support
is disabled accesses to these variables turn into build failures.

To overcome these failures, build-time check is done before accessing global
variables, so that DCE would remove these variables.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Acked-by: Paul Durrant <paul@xen.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
2024-08-13 16:38:40 +02:00
Oleksii Kurochko a8d9b75045 xen/riscv: enable GENERIC_BUG_FRAME
Enable GENERIC_BUG_FRAME to support BUG(), WARN(), ASSERT,
and run_in_exception_handler().

"UNIMP" is used for BUG_INSTR, which, when macros from <xen/bug.h>
are used, triggers an exception with the ILLEGAL_INSTRUCTION cause.
This instruction is encoded as a 2-byte instruction when
CONFIG_RISCV_ISA_C is enabled:
  ffffffffc0046ba0:       0000                    unimp
and is encoded as a 4-byte instruction when CONFIG_RISCV_ISA_C
ins't enabled:
  ffffffffc005a460:       c0001073                unimp

Using 'ebreak' as BUG_INSTR does not guarantee proper handling of macros
from <xen/bug.h>. If a debugger inserts a breakpoint (using the 'ebreak'
instruction) at a location where Xen already uses 'ebreak', it
creates ambiguity. Xen cannot distinguish whether the 'ebreak'
instruction is inserted by the debugger or is part of Xen's own code.

Remove BUG_INSN_32 and BUG_INSN_16 macros as they encode the ebreak
instruction, which is no longer used for BUG_INSN.

Update the comment above the definition of INS_LENGTH_MASK as instead of
'ebreak' instruction 'unimp' instruction is used.

<xen/lib.h> is included for the reason that panic() and printk() are
used in common/bug.c and RISC-V fails if it is not included.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2024-08-13 16:38:15 +02:00
Jan Beulich 9c94eda1e3 x86/pass-through: documents as security-unsupported when sharing resources
When multiple devices share resources and one of them is to be passed
through to a guest, security of the entire system and of respective
guests individually cannot really be guaranteed without knowing
internals of any of the involved guests.  Therefore such a configuration
cannot really be security-supported, yet making that explicit was so far
missing.

This is XSA-461 / CVE-2024-31146.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
2024-08-13 16:37:25 +02:00
Teddy Astie beadd68b54 x86/IOMMU: move tracking in iommu_identity_mapping()
If for some reason xmalloc() fails after having mapped the reserved
regions, an error is reported, but the regions remain mapped in the P2M.

Similarly if an error occurs during set_identity_p2m_entry() (except on
the first call), the partial mappings of the region would be retained
without being tracked anywhere, and hence without there being a way to
remove them again from the domain's P2M.

Move the setting up of the list entry ahead of trying to map the region.
In cases other than the first mapping failing, keep record of the full
region, such that a subsequent unmapping request can be properly torn
down.

To compensate for the potentially excess unmapping requests, don't log a
warning from p2m_remove_identity_entry() when there really was nothing
mapped at a given GFN.

This is XSA-460 / CVE-2024-31145.

Fixes: 2201b67b91 ("VT-d: improve RMRR region handling")
Fixes: c0e19d7c6c ("IOMMU: generalize VT-d's tracking of mapped RMRR regions")
Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2024-08-13 16:36:40 +02:00
Stefano Stabellini 98a462f8b1 automation: add "expect" to containers used to run QEMU tests
It will be used for QEMU tests.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-12 15:20:30 -07:00
Stefano Stabellini 1c24bca387 automation: disable Yocto jobs
The Yocto jobs take a long time to run. We are changing Gitlab ARM64
runners and the new runners might not be able to finish the Yocto jobs
in a reasonable time.

For now, disable the Yocto jobs by turning them into "manual" trigger
(they need to be manually executed.)

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
2024-08-12 15:20:16 -07:00
Ayan Kumar Halder d61248b0fa docs: fusa: reqs: Added a requirements writing style guide
Added a guide to help write and review requirements. The requirements
are written to enable safety certification of Xen hypervisor.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Acked-by: Bertrand Marquis <bertrand.marquis@arm.com>
2024-08-09 16:58:04 -07:00
Ayan Kumar Halder 878974a33f docs: Introduce Fusa Requirement and define maintainers
The FUSA folder is expected to contain requirements and other documents
to enable safety certification of Xen hypervisor.
Added a intro to explain how the requirements are categorized, written
and their supported status.
Also, added index.rst for inclusion in build docs.

Added maintainers for the same.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Acked-by: Bertrand Marquis <bertrand.marquis@arm.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-09 16:58:04 -07:00
Matthew Barnes 08aacc392d x86/emul: Fix misaligned IO breakpoint behaviour in PV guests
When hardware breakpoints are configured on misaligned IO ports, the
hardware will mask the addresses based on the breakpoint width during
comparison.

For PV guests, misaligned IO breakpoints do not behave the same way, and
therefore yield different results.

This patch tweaks the emulation of IO breakpoints for PV guests such
that they reproduce the same behaviour as hardware.

Fixes: bec9e32050 ("x86: emulate I/O port access breakpoints")
Signed-off-by: Matthew Barnes <matthew.barnes@cloud.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-08 13:27:50 +02:00
Jan Beulich ef31716a57 x86emul: adjust 2nd param of idiv_dbl()
-LONG_MIN cannot be represented in a long and hence is UB, for being one
larger than LONG_MAX.

The caller passing an unsigned long and the 1st param also being (array
of) unsigned long, change the 2nd param accordingly while adding the
sole necessary cast. This was the original form of the function anyway.

Fixes: 5644ce0142 ("x86emul: relax asm() constraints")
Oss-fuzz: 70923
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-08 13:27:25 +02:00
Jan Beulich c246155000 x86emul: avoid UB shift in AVX512 VPMOV* handling
For widening and narrowing moves, operand (vector) size is calculated
from a table. This calculation, for the AVX512 cases, lives ahead of
validation of EVEX.L'L (which cannot be 3 without raising #UD). Account
for the later checking by adjusting the constants in the expression such
that even EVEX.L'L == 3 will yield a non-UB shift (read: shift count
reliably >= 0).

Fixes: 3988beb08 ("x86emul: support AVX512{F,BW} zero- and sign-extending moves")
Oss-fuzz: 70914
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-08 13:26:38 +02:00
Federico Serafini 6b9b96ddeb automation/eclair: tag more guidelines as clean
Tag more of the accepted guidelines as clean to avoid regressions.

Signed-off-by: Federico Serafini <federico.serafini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-06 12:30:17 -07:00
Federico Serafini e03cea171a automation/eclair: sort monitored guidelines with -V
To improve readability, sort guidelines with -V.

No functional change.

Signed-off-by: Federico Serafini <federico.serafini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-06 12:30:17 -07:00
Stefano Stabellini 449caecbdf automation: fix eclair gitlab jobs for merge requests
The "eclair" script calls action_push.sh even for merge request, while
instead action_pull_request.sh should be called, resulting in a job
failure with this error:

Unexpected event pull_request

Fix the script to call action_pull_request.sh appropriately.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Simone Ballarin <simone.ballarin@bugseng.com>
2024-08-06 12:29:05 -07:00
Stewart Hildebrand 2dbb61001b xen/arm: vITS: add #msi-cells property
Non-PCI platform devices may use the ITS. Dom0 Linux drivers for such
devices are failing to register IRQs due to a missing #msi-cells
property. Add the missing #msi-cells property.

Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Rahul Singh <rahul.singh@arm.com>
2024-08-06 19:11:50 +01:00
Shawn Anastasio f06fbfe54d xen/common: Move Arm's bootfdt.c to common
Move Arm's bootfdt.c to xen/common so that it can be used by other
device tree architectures like PPC and RISCV.

Remove stubs for process_shm_node() and early_print_info_shmem()
from $xen/arch/arm/include/asm/static-shmem.h.
These stubs are removed to avoid introducing them for architectures
that do not support CONFIG_STATIC_SHM.
The process_shm_node() stub is now implemented in common code to
maintain the current behavior of early_scan_code() on ARM.
The early_print_info_shmem() stub is only used in early_print_info(),
so it's now guarded with #ifdef CONFIG_STATIC_SHM ... #endif.

Suggested-by: Julien Grall <julien@xen.org>
Signed-off-by: Shawn Anastasio <sanastasio@raptorengineering.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2024-08-06 19:10:56 +01:00
Shawn Anastasio d6c57aa085 xen/device-tree: Move Arm's setup.c bootinfo functions to common
Arm's setup.c contains a collection of functions for parsing memory map
and other boot information from a device tree. Since these routines are
generally useful on any architecture that supports device tree booting,
move them into xen/common/device-tree.

Also, common/device_tree.c has been moved to the device-tree folder with
the corresponding updates to common/Makefile and common/device-tree/Makefile.

Mentioning of arm32 is changed to CONFIG_SEPARATE_XENHEAP in comparison with
original ARM's code as now it is moved in common code.

Suggested-by: Julien Grall <julien@xen.org>
Signed-off-by: Shawn Anastasio <sanastasio@raptorengineering.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2024-08-06 19:10:56 +01:00
Michal Orzel 47d4d3cdc5 xen/arm: bootfdt: Fix device tree memory node probing
Memory node probing is done as part of early_scan_node() that is called
for each node with depth >= 1 (root node is at depth 0). According to
Devicetree Specification v0.4, chapter 3.4, /memory node can only exists
as a top level node. However, Xen incorrectly considers all the nodes with
unit node name "memory" as RAM. This buggy behavior can result in a
failure if there are other nodes in the device tree (at depth >= 2) with
"memory" as unit node name. An example can be a "memory@xxx" node under
/reserved-memory. Fix it by introducing device_tree_is_memory_node() to
perform all the required checks to assess if a node is a proper /memory
node.

Fixes: 3e99c95ba1 ("arm, device tree: parse the DTB for RAM location and size")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Tested-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Julien Grall <julien@xen.org>
2024-08-06 19:09:46 +01:00
Michal Orzel 3679ed232e xen/arm: dom0less: Add #redistributor-regions property to GICv3 node
Dom0less domain using host memory layout may use more than one
re-distributor region (d->arch.vgic.nr_regions > 1). In that case Xen
will add them in a "reg" property of a GICv3 domU node. Guest needs to
know how many regions to search for, and therefore the GICv3 dt binding
[1] specifies that "#redistributor-regions" property is required if more
than one redistributor region is present. However, Xen does not add this
property which makes guest believe, there is just one such region. This
can lead to guest boot failure when doing GIC SMP initialization. Fix it
by adding this property, which matches what we do for hwdom.

[1] Linux: Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.yaml

Fixes: 4809f9ec7d ("xen/arm: if direct-map domain use native addresses for GICv3")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2024-08-06 19:08:50 +01:00
Jan Beulich 44a37c7832 x86/shutdown: use DMI_MATCH2()
... to please Misra C:2012 Rule 9.3 (Arrays shall not be partially
initialized).

Fixes: d81dd31303 ("x86/shutdown: change default reboot method preference")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-08-06 08:37:10 +02:00
Oleksii Kurochko 10eccbb821 xen/riscv: refactor decode_trap_cause()
Use array_access_nospec() to prevent guest speculation.

Avoid double access of trap_causes[cause].

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-06 08:36:29 +02:00
Sergiy Kibrik cddbee85d0 x86/vpmu: guard calls to vmx/svm functions
If VMX/SVM disabled in the build, we may still want to have vPMU drivers for
PV guests. Yet in such case before using VMX/SVM features and functions we have
to explicitly check if they're available in the build. For this purpose
(and also not to complicate conditionals) two helpers introduced --
is_{vmx,svm}_vcpu(v) that check both HVM & VMX/SVM conditions at the same time,
and they replace is_hvm_vcpu(v) macro in Intel/AMD PMU drivers.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2024-08-06 08:35:09 +02:00