Commit Graph
39597 Commits
Author SHA1 Message Date
Stefano Stabellini e91c0d4f41 xen/arm: early_print_info print reserved_mem
Improve early_print_info to also print the banks saved in
bootinfo.reserved_mem. Print them right after RESVD, increasing the same
index.

Since we are at it, also switch the existing RESVD print to use unsigned
int.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
Reviewed-by: Volodymyr Babchuk <volodymyr.babchuk@epam.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-20 13:39:59 +01:00
Stefano Stabellini 3a54f089cf xen/arm: fix indentation in early_print_info
No functional changes.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-20 13:39:59 +01:00
Stefano Stabellini d96594eef3 xen/arm: keep track of reserved-memory regions
As we parse the device tree in Xen, keep track of the reserved-memory
regions as they need special treatment (follow-up patches will make use
of the stored information.)

Reuse process_memory_node to add reserved-memory regions to the
bootinfo.reserved_mem array.

Refuse to continue once we reach the max number of reserved memory
regions to avoid accidentally mapping any portions of them into a VM.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-20 13:39:59 +01:00
Stefano Stabellini d9f451d451 xen/arm: make process_memory_node a device_tree_node_func
Change the signature of process_memory_node to match
device_tree_node_func. Thanks to this change, the next patch will be
able to use device_tree_for_each_node to call process_memory_node on all
the children of a provided node.

Return error if there is no reg property or if nr_banks is reached. Let
the caller deal with the error.

Add a printk when device tree parsing fails.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-20 13:39:51 +01:00
Stefano Stabellini 40f2ea3df2 xen/arm: pass node to device_tree_for_each_node
Add a new parameter to device_tree_for_each_node: node, the node to
start the search from.

To avoid scanning device tree, and given that we only care about
relative increments of depth compared to the depth of the initial node,
we set the initial depth to 0. Then, we call func() for every node with
depth > 0.

Don't call func() on the parent node passed as an argument. Clarify the
change in the comment on top of the function. The current callers pass
the root node as argument: it is OK to skip the root node because no
relevant properties are in it, only subnodes.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
[julien: Remove min_depth variable]
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-20 13:39:36 +01:00
Pawel Wieczorkiewicz 4470efeae4 livepatch: always print XENLOG_ERR information
A lot of legitimate error messages were hidden behind debug printk
only. Most of these messages can be triggered by loading a malformed
hotpatch payload and are priceless for understanding issues with such
payloads.
Thus, always display all relevant XENLOG_ERR messages.

Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Amit Shah <aams@amazon.de>
Reviewed-by: Martin Mazein <amazein@amazon.de>
Reviewed-by: Bjoern Doebel <doebel@amazon.de>
Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>
[Fix indentation and double LIVEPATCH prefixes, drop gratuitous punctuation]
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-19 18:24:04 +01:00
Julien Grall 427b9c58f5 xen/x86: pv: Convert update_intpte() to use typesafe MFN
The third parameter of update_intpte() is a MFN, so it can be switched
to use the typesafe.

At the same time, the typesafe is propagated as far as possible without
major modifications.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-19 15:15:11 +01:00
Julien Grall 196dd56cf4 xen: Convert is_xen_fixed_mfn to use typesafe MFN
No functional changes.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
2019-08-19 15:09:19 +01:00
Julien Grall 97ed4a4c93 xen: Convert is_xen_heap_mfn to use typesafe MFN
No functional changes.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
2019-08-19 15:09:19 +01:00
Julien Grall 38b7c17100 xen: Convert hotplug page function to use typesafe MFN
Convert online_page, offline_page and query_page_offline to use
typesafe MFN.

At the same time, the typesafe is propagated as far as possible without
major modifications.

Note, for clarity, the words have been re-ordered in the error message
updated by this patch.

No functional changes.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-19 15:09:19 +01:00
Julien Grall 2a7a876fed xen/grant-table: Make arch specific macros typesafe
This patch rework all the arch specific macros in grant_table.h to use
the typesafe MFN/GFN.

At the same time, some functions are renamed s/gmfn/gfn/ to match the
current naming scheme (see include/mm.h).

No functional changes intended.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2019-08-19 15:09:19 +01:00
Julien Grall 87c12c7ec3 xen/x86: Use mfn_to_gfn rather than mfn_to_gmfn
mfn_to_gfn and mfn_to_gmfn are doing exactly the same except the former
is using mfn_t and gfn_t (return type).

Furthermore, the naming of the former is more consistent with the
current naming scheme (GFN/MFN). So replace mfn_to_gmfn with
mfn_to_gfn in x86 code.

Take the opportunity to convert some of the callers to use typesafe GFN and
format the message correctly.

No functional changes.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--
    Changes in v3:
        - The hunk in x86/mm.c is not necessary anymore
        - Update printk message to use GFN rather than frame when suitable
        - Update commit message with some NITs
        - Add Jan's reviewed-by

    Changes in v2:
        - mfn_to_gfn now returns a gfn_t
        - Use %pd and PRI_gfn when possible in the message
        - Don't split format string to help grep/ack.
2019-08-19 15:09:19 +01:00
Julien Grall 572bec0aad xen/x86: Make mfn_to_gfn typesafe
No functional changes intended.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>
2019-08-19 15:09:19 +01:00
Michał Kowalczyk c3cfa5b308 x86: Restore IA32_MISC_ENABLE on wakeup
Code in intel.c:early_init_intel() modifies IA32_MISC_ENABLE MSR. Those
modifications must be restored after resuming from S3 (see e.g. Linux wakeup
code), otherwise bad things may happen (e.g. wakeup code may cause #GP when
trying to set IA32_EFER.NXE [1]).

This bug was noticed on a ThinkPad x230 with NX disabled in the BIOS:
Xen could correctly boot, but crashed when resuming from suspend.
Applying this patch fixed the problem.

[1] Intel SDM vol 3: "If the execute-disable capability is not
available, a write to set IA32_EFER.NXE produces a #GP exception."

Signed-off-by: Michał Kowalczyk <mkow@invisiblethingslab.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-19 15:07:34 +01:00
Julien Grall f7efd9c792 xen/console: Simplify domU console handling in guest_console_write
2 paths in the domU console handling are now the same. So they can be
merged to make the code simpler.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2019-08-16 22:44:34 +01:00
Julien Grall 61f82e8dfd xen/public: Document HYPERCALL_console_io()
Currently, OS developpers will have to look at Xen code in order to know
the parameters of an hypercall and how it is meant to work.

This is not a trivial task as you may need to have a deep understanding
of Xen internal.

This patch attempts to document the behavior of HYPERCALL_console_io() to
help OS developer.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-16 22:44:31 +01:00
Julien Grall ea601ec999 xen/console: Rework HYPERCALL_console_io interface
At the moment, HYPERCALL_console_io is using signed int to describe the
command (@cmd) and the size of the buffer (@count).
    * @cmd does not need to be signed this used as a set of named value.
    None of them are negative. If new one are introduced they can be
    positive.
    * @count is used to know the size of the buffer. It makes little
    sense to have a negative value here.

So both variables are now switched to use unsigned int.

Changing @count to unsigned type will result in a change of behavior for
the existing commands:
    - write: Any buffer bigger than 2GB will now be printed rather than
      been ignored (the command return 0).
    - read: The return value is a signed 32-bit value for 32-bit Xen.
      To keep compatibility between 32-bit and 64-bit ABI, it
      effectively means the return value is 32-bit (despite been long
      on 64-bit). Negative value are used for error and positive value
      for the number of characters read. To avoid clash between the two
      sets, the buffer is still limited to 2GB. The only difference is
      an error is returned rather than claiming there are no characters.

The behavior is only affecting unlikely use of the current interface, so
this is not a big concern regarding backward compatibility.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-16 22:44:28 +01:00
Julien Grall b5e6e1ee8d xen/console: Don't treat NUL character as the end of the buffer
After upgrading Debian to Buster, I have began to notice console
mangling when using zsh in Dom0. This is happenning because output sent by
zsh to the console may contain NULs in the middle of the buffer.

The actual implementation of CONSOLEIO_write considers that a buffer
always terminate with a NUL and therefore will ignore anything after it.

In general, NULs are perfectly legitimate in terminal streams. For
instance, this could be used for padding slow terminals. See terminfo(5)
section `Delays and Padding`, or search for the pcre '\bpad'.

Other use cases includes using the console for dumping non-human
readable information (e.g debugger, file if no network...). With the
current behavior, the resulting stream will end up to be corrupted.

The documentation for CONSOLEIO_write is pretty limited (to not say
inexistent). From the declaration, the hypercall takes a buffer and size.
So this could lead to think the NUL character is allowed in the middle of
the buffer.

This patch updates the console API to pass the size along the buffer
down so we can remove the reliance on buffer terminating by a NUL
character.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-16 22:44:19 +01:00
Alexandru Stefan ISAILA 854a49a748 x86/mm: Clean IOMMU flags from p2m-pt code
At this moment IOMMU pt sharing is disabled by commit [1].

This patch aims to clear the IOMMU hap share support as it will not be
used in the future. By doing this the IOMMU bits used in pte[52:58] can
be used in other ways.

[1] c2ba3db31e

Suggested-by: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Alexandru Isaila <aisaila@bitdefender.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Brian Woods <brian.woods@amd.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
2019-08-14 15:41:23 +01:00
Julien Grall 48fb2a9deb xen/arm: setup: Add Xen as boot module before printing all boot modules
Since commit f60658c6ae "xen/arm: Stop relocating Xen", the position of
Xen in memory is not printed anymore. This can make difficult to debug
early code.

As Xen is not relocated anymore, we can add Xen as boot module before
calling boot_fdt_info(). With that, the function will print Xen module
information along with all the other modules.

Signed-off-by: Julien Grall <julien.grall@arm.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2019-08-14 13:40:41 +01:00
Michael Young e5368348d3 tools/pygrub: Failing to set value to 0 in Grub2ConfigFile
In Grub2ConfigFile the code to handle ${saved_entry} and ${next_entry}
sets arg = "0" but this now does nothing following c/s d1b93ea261
"tools/pygrub: Make pygrub understand default entry in string format"
which replaced arg.strip() with arg_strip in the following line.  This
patch restores the previous behaviour.

Signed-off-by: Michael Young <m.a.young@durham.ac.uk>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-14 12:15:17 +01:00
Andrew Cooper 435e985b10 tools/xenstat: Fix -Wformat-truncation= issue
Building with GCC 8.3 on Buster identifies:

  src/xenstat_linux.c: In function 'xenstat_collect_networks':
  src/xenstat_linux.c:307:32: warning: 'snprintf' output may be truncated before
  the last format character [-Wformat-truncation=]
    snprintf(devNoBridge, 16, "p%s", devBridge);
                                  ^
  src/xenstat_linux.c:307:2: note: 'snprintf' output between 2 and 17 bytes into
  a destination of size 16
    snprintf(devNoBridge, 16, "p%s", devBridge);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

devNoBridge[] needs one charater more than devBridge[], so allocate one byte
more.  Replace a raw 16 in the snprintf() call with a sizeof() expression
instead.

Finally, libxenstat, unlike most of the rest of the Xen, doesn't use -Werror
which is why this issue went unnoticed in CI.  Fix this.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wl@xen.org>
2019-08-14 12:04:20 +01:00
Andrew Cooper 02378ea85c tools/xenstat: Fix -Wunused-function issue
When compiling xenstat with -Werror, Clang complains:

  src/xenstat.c:134:34: error: unused function 'parse' [-Werror,-Wunused-function]
  static inline unsigned long long parse(char *s, char *match)
                                   ^
  1 error generated.

Drop the function.  It really is unused.

Spotted by Travis-CI.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wl@xen.org>
2019-08-14 12:04:20 +01:00
Andrew Cooper 1722da6c0c x86/tss: Fix clang build following c/s 7888440625
Clang-3.5 from Debian Jessie fails with:

  smpboot.c:829:29: error: statement expression not allowed at file scope
          BUILD_BUG_ON(sizeof(this_cpu(tss_page)) != PAGE_SIZE);
                              ^
  /local/xen.git/xen/include/asm/percpu.h:14:7: note: expanded from macro
          'this_cpu'
      (*RELOC_HIDE(&per_cpu__##var, get_cpu_info()->per_cpu_offset))
        ^
  /local/xen.git/xen/include/xen/compiler.h:98:3: note: expanded from macro
          'RELOC_HIDE'
    ({ unsigned long __ptr;                       \
    ^
  /local/xen.git/xen/include/xen/lib.h:26:53: note: expanded from macro
          'BUILD_BUG_ON'
  #define BUILD_BUG_ON(cond) ((void)BUILD_BUG_ON_ZERO(cond))
                                                      ^
  /local/xen.git/xen/include/xen/lib.h:25:57: note: expanded from macro
          'BUILD_BUG_ON_ZERO'
  #define BUILD_BUG_ON_ZERO(cond) sizeof(struct { int:-!!(cond); })
                                                          ^
  1 error generated.
  /local/xen.git/xen/Rules.mk:202: recipe for target 'smpboot.o' failed

This is obviously a compiler bug because the BUILD_BUG_ON() is not at file
scope.  However, it can be worked around by using a local variable.

Spotted by Gitlab CI.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wl@xen.org>
2019-08-14 12:04:20 +01:00
Andrew Cooper 5b68915350 x86/AMD-Vi: Fold exit paths of {enable,disable}_iommu()
... to avoid having multiple spin_unlock_irqrestore() calls.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Brian Woods <brian.woods@amd.com>
2019-08-14 12:04:20 +01:00
Andrew Cooper c463d0d5ab x86/boot: Simplify %fs setup in trampoline_setup
mov/shr is easier to follow than shld, and doesn't have a merge dependency on
the previous value of %edx.  Shorten the rest of the code by streamlining the
comments.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wl@xen.org>
2019-08-14 12:04:20 +01:00
Viktor Mitin 7ef3c2f298 xen/arm: domain_build: Consolidate make_timer_node() and make_timer_domU_node()
At the moment, the hwdom and domUs are creating the timer node
differently.

Technically the timer exposed the same way for any domain, the only
difference should be the interrupts used. The two current other
differences are:
    - compatible: The hwdom DT will use the same as the one provided
      by the host provided. The domUs DT will use "arm,armv7-timer" for
      32-bit domain and "arm,armv8-timer" for 64-bit domain. The latter
      matches the behavior of libxl when guests are created from
      userspace.

    - clock-frequency: The property is used on platform with
      broken firmware to indicate the clock frequency. This should
      be used by all the domains, however this is not yet the case
      for domUs created by Xen.

To avoid more discrepancy the two functions are now consolidated into
one place make_timer_node().

For simplicity, the compatible will now be based on the bitness even
for the hwdom. This means the compatible exposed for the hwdom may
differ. This should only have an impact on 32-bit hwdom booting on
Armv8 hardware.

Suggested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Viktor Mitin <viktor_mitin@epam.com>
[julien: Reword commit message]
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-14 11:07:00 +01:00
Viktor Mitin f94e42b2ea xen/arm: extend fdt_property_interrupts to support DomU
The domain and fdt can be found in the structure kinfo.
Rather than adding a an extra argument for the domain, pass directly
kinfo.
This also requires to adapt fdt_property_interrupts() prototype.
A follow-up patch will need to create the interrupts for either Dom0 or
DomU.

Suggested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Viktor Mitin <viktor_mitin@epam.com>
Reviewed-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-14 11:05:09 +01:00
Andrew Cooper 243cc95d48 x86/pv: Clean up cr3 handling in arch_set_info_guest()
All of this code lives inside CONFIG_PV which means gfn == mfn, and the
fill_ro_mpt() calls clearly show that the value is used untranslated.

Change cr3_gfn to a suitably typed cr3_mfn, and replace get_page_from_gfn()
with get_page_from_mfn().

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-13 19:03:42 +01:00
David Woodhouse 24575e2c1b x86/boot: Remove gratuitous call back into low-memory code
We appear to have implemented a memcpy() in the low-memory trampoline
which we then call into from __start_xen(), for no adequately defined
reason.

Kill it with fire.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-13 18:39:02 +01:00
Andrew Cooper 6a4a625348 x86/vvmx: Fix nested virt on VMCS-Shadow capable hardware
c/s e9986b0dd "x86/vvmx: Simplify per-CPU memory allocations" had the wrong
indirection on its pointer check in nvmx_cpu_up_prepare(), causing the
VMCS-shadowing buffer never be allocated.  Fix it.

This in turn results in a massive quantity of logspam, as every virtual
vmentry/exit hits both gdprintk()s in the *_bulk() functions.

Switch these to using printk_once(), but still only in debug builds.  The size
of the buffer is chosen at compile time, so complaining about it repeatedly is
of no benefit.

Finally, drop the runtime NULL pointer checks.  It is not terribly appropriate
to be repeatedly checking infrastructure which is set up from start-of-day,
and in this case, actually hid the above bug.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-12 15:50:10 +01:00
Andrew Cooper 3214c0220f x86/atomic: Improvements and simplifications to assembly constraints
* Constraints in the form "=r" (x) : "0" (x) can be folded to just "+r" (x)
 * Switch to using named parameters (mostly for legibility) which in
   particular helps with...
 * __xchg(), __cmpxchg() and __cmpxchg_user() modify their memory operand, so
   must list it as an output operand.  This only works because they each have
   a memory clobber to give the construct full compiler-barrier properties.
 * Every memory operand has an explicit known size.  Letting the compiler see
   the real size rather than obscuring it with __xg() allows for the removal
   of the instruction size suffixes without introducing ambiguity.
 * Drop semicolons after lock prefixes.
 * Other misc style changes.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-12 15:50:10 +01:00
Andrew Cooper 3fda2214f1 xen/percpu: Make DECLARE_PER_CPU() and __DEFINE_PER_CPU() common
These macros are identical across the architectures, and shouldn't be separate
from the DEFINE_PER_CPU*() infrastructure.

This converts the final asm/percpu.h includes, which were all using
DECLARE_PER_CPU(), to include xen/percpu.h instead.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
2019-08-12 14:37:13 +01:00
Jan Beulich 7888440625 x86/xpti: Don't leak TSS-adjacent percpu data via Meltdown
The XPTI work restricted the visibility of most of memory, but missed a few
aspects when it came to the TSS.

Given that the TSS is just an object in percpu data, the 4k mapping for it
created in setup_cpu_root_pgt() maps adjacent percpu data, making it all
leakable via Meltdown, even when XPTI is in use.

Furthermore, no care is taken to check that the TSS doesn't cross a page
boundary.  As it turns out, struct tss_struct is aligned on its size which
does prevent it straddling a page boundary.

Rework the TSS types while making this change.  Rename tss_struct to tss64, to
mirror the existing tss32 structure we have in HVM's Tast Switch logic.  Drop
tss64's alignment and __cacheline_filler[] field.

Introduce tss_page which contains a single tss64 and keeps the rest of the
page clear, so no adjacent data can be leaked.  Move the definition from
setup.c to traps.c, which is a more appropriate place for it to live.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
2019-08-12 14:10:09 +01:00
Andrew Cooper b6b5608b60 x86/desc: Drop __HYPERVISOR_CS32
Xen, being 64bit only these days, does not use a 32bit Ring 0 code segment.

Delete __HYPERVISOR_CS32 and remove it from the GDTs.  Also delete
__HYPERVISOR_CS64 and use __HYPERVISOR_CS uniformly.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-12 11:19:05 +01:00
Andrew Cooper 60685089cb x86/desc: Build boot_{,compat_}gdt[] in C
... where we can at least get the compiler to fill in the surrounding space
without having to do it manually.  This also results in the symbols having
proper type/size information in the debug symbols.

Reorder 'raw' in the seg_desc_t union to allow for easier initialisation.

Leave a comment explaining the various restrictions we have on altering the
GDT layout.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Introduce SEL2GDT(). Correct GDT indices in public header comments.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-12 09:17:01 +02:00
Julien Grall 762b9a2d99 xen/page_alloc: Keep away MFN 0 from the buddy allocator
Combining of buddies happens only such that the resulting larger buddy
is still order-aligned. To cross a zone boundary while merging, the
implication is that both the buddy [0, 2^n-1] and the buddy
[2^n, 2^(n+1)-1] are free.

Ideally we want to fix the allocator, but for now we can just prevent
adding the MFN 0 in the allocator to avoid merging across zone
boundaries.

On x86, the MFN 0 is already kept away from the buddy allocator. So the
bug can only happen on Arm platform where the first memory bank is
starting at 0.

As this is a specific to the allocator, the MFN 0 is removed in the common code
to cater all the architectures (current and future).

[Stefano: improve commit message]

Reported-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Tested-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
2019-08-09 11:12:55 -07:00
Andrew Cooper 6c9639a72f xen/link: Introduce .bss.percpu.page_aligned
Future changes are going to need to page align some percpu data.

Shuffle the exact link order of items within the BSS to give
.bss.percpu.page_aligned appropriate alignment, even on CPU0, which uses
.bss.percpu itself.

Insert explicit alignment such that there won't be a gap between
__per_cpu_start and the first actual per-CPU object.  The POINTER_ALIGN
for __bss_end is to cover the lack of SMP_CACHE_BYTES alignment, as the
loops which zero the BSS use pointer-sized stores on all architectures.

Rework __DEFINE_PER_CPU() so the caller passes in all attributes, and
adjust DEFINE_PER_CPU{,_READ_MOSTLY}() to match.  This has the added bonus
that it is now possible to grep for .bss.percpu and find all the users.

Finally, introduce DEFINE_PER_CPU_PAGE_ALIGNED() which specifies the
section attribute and verifies the type's alignment.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Make DEFINE_PER_CPU_PAGE_ALIGNED() verify the alignment rather than
specifying it. It is the underlying type which should be suitably aligned.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <julien.grall@arm.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-09 16:36:58 +02:00
Jan Beulich 943c598efd x86: define a few selector values
TSS, LDT, and per-CPU entries all can benefit a little from also having
their selector values defined.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-09 16:35:42 +02:00
Marek Marczykowski-Górecki 88d703a361 python: fix -Wsign-compare warnings
Specifically:
xen/lowlevel/xc/xc.c: In function ‘pyxc_domain_create’:
xen/lowlevel/xc/xc.c:147:24: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  147 |         for ( i = 0; i < sizeof(xen_domain_handle_t); i++ )
      |                        ^
xen/lowlevel/xc/xc.c: In function ‘pyxc_domain_sethandle’:
xen/lowlevel/xc/xc.c:312:20: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  312 |     for ( i = 0; i < sizeof(xen_domain_handle_t); i++ )
      |                    ^
xen/lowlevel/xc/xc.c: In function ‘pyxc_domain_getinfo’:
xen/lowlevel/xc/xc.c:391:24: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  391 |         for ( j = 0; j < sizeof(xen_domain_handle_t); j++ )
      |                        ^
xen/lowlevel/xc/xc.c: In function ‘pyxc_get_device_group’:
xen/lowlevel/xc/xc.c:677:20: error: comparison of integer expressions of different signedness: ‘int’ and ‘uint32_t’ {aka ‘unsigned int’} [-Werror=sign-compare]
  677 |     for ( i = 0; i < num_sdevs; i++ )
      |                    ^
xen/lowlevel/xc/xc.c: In function ‘pyxc_physinfo’:
xen/lowlevel/xc/xc.c:988:20: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  988 |     for ( i = 0; i < sizeof(pinfo.hw_cap)/4; i++ )
      |                    ^
xen/lowlevel/xc/xc.c:994:20: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  994 |     for ( i = 0; i < ARRAY_SIZE(virtcaps_bits); i++ )
      |                    ^
xen/lowlevel/xc/xc.c:998:24: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
  998 |         for ( i = 0; i < ARRAY_SIZE(virtcaps_bits); i++ )
      |                        ^
xen/lowlevel/xs/xs.c: In function ‘xspy_ls’:
xen/lowlevel/xs/xs.c:191:23: error: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Werror=sign-compare]
  191 |         for (i = 0; i < xsval_n; i++)
      |                       ^
xen/lowlevel/xs/xs.c: In function ‘xspy_get_permissions’:
xen/lowlevel/xs/xs.c:297:23: error: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Werror=sign-compare]
  297 |         for (i = 0; i < perms_n; i++) {
      |                       ^
cc1: all warnings being treated as errors

Use size_t for loop iterators where it's compared with sizeof() or
similar construct.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
2019-08-09 11:30:43 +01:00
Stefano Stabellini 2c19c7e8bb xen/arm: unbreak arm64 build for older toolchains
Commit 4941bfb "xen/arm64: macros: Introduce an assembly macro to alias
x30" moved

  lr      .req    x30

to macros.h. A later patch (1396dab "xen/arm64: head: Don't clobber
x30/lr in the macro PRINT") started to use "lr" in head.S, however, it
didn't add an #include macros.h to head.S. This commit fixes it.

The lack of alias breaks the build with
gcc-linaro-5.3.1-2016.05-x86_64_aarch64-linux-gnu. The alias was added
later to binutils 2.29 in 2017.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2019-08-07 09:55:51 -07:00
Juergen Gross 70f9dff51e xen/sched: fix memory leak in credit2
csched2_deinit() is leaking the run-queue memory.

Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Dario Faggioli <dfaggioli@suse.com>
2019-08-07 17:21:14 +01:00
Andrew Cooper 5b08072590 xen/percpu: Drop unused asm/percpu.h includes
These files either don't use any PER_CPU() infrastructure at all, or use
DEFINE_PER_CPU_*().  This is declared in xen/percpu.h, not asm/percpu.h, which
means that xen/percpu.h is included via a different path.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-07 14:06:28 +01:00
Andrew Cooper 0aad20566b xen/percpu: Drop unused xen/percpu.h includes
None of these headers use any PER_CPU() infrastructure.

xen/rwlock.h however does, and picked it up transitively via xen/spinlock.h,
so include it properly.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-07 14:06:28 +01:00
Andrew Cooper 8a3d7a3215 arm/percpu: Move {get,set}_processor_id() into current.h
For cleanup purposes, it is necessary for asm/percpu.h to not use
DECLARE_PER_CPU() itself.  asm/current.h is arguably a better place for this
functionality to live anyway.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2019-08-07 14:06:28 +01:00
Andrew Cooper 50feecdc09 x86/desc: Shorten boot_{,compat_}gdt[] variable names
The current names, boot_cpu_{,compat_}gdt_table, have a table suffix which is
redundant with the T of GDT, and the cpu infix doesn't provide any meaningful
context.  Drop them both.

Likewise, shorten the {,compat_}gdt{,_l1e} variables.

Finally, rename gdt_descr to boot_gdtr to more clearly identify its purpose.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-07 13:34:56 +01:00
Andrew Cooper af292b41e9 x86/boot: Set Accessed bits in boot_cpu_{,compat_}gdt_table[]
There is no point causing the CPU to performed a locked update of the
descriptors on first use.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2019-08-07 13:34:56 +01:00
Andrew Cooper ea131e2ed3 x86/asm: Include msr-index.h rather than msr.h
There is nothing interesting for assembly code in msr.h.  Include msr-index.h
instead, and drop the __ASSEMBLY__ guards in msr.h.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2019-08-07 13:34:56 +01:00
Stefano Stabellini 3889a84750 libxl: 9pfs has a QEMU backend
Add 9pfs to the kind of PV drivers that has a QEMU backend, specifically
to the macro QEMU_BACKEND.

This is needed otherwise upon domain destroy we get a timeout error:

libxl: error: libxl_device.c:1132:device_backend_callback: Domain 1:unable to remove device with path /local/domain/0/backend/9pfs/1/0
libxl: error: libxl_domain.c:1129:devices_destroy_cb: Domain 1:libxl__devices_destroy failed

This change should have been part of b53b4037ce "libxl/xl: add support
for Xen 9pfs".

Also add a comment in libxl_types_internal.idl to help remember changing
QEMU_BACKEND going forward.

Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
2019-08-07 11:42:44 +01:00
Jan Beulich 99e2326582 AMD/IOMMU: drop stray "else"
The blank line between it and the prior if() clearly indicates that this
was meant to be a standalone if().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2019-08-07 12:12:00 +02:00