Commit Graph
48826 Commits
Author SHA1 Message Date
Rahul Singh f9f6b22abf xen/arm: Map ITS doorbell register to IOMMU page tables
When ITS is enabled and PCI devices that are behind an SMMU generate an
MSI interrupt, SMMU fault will be observed as there is currently no
mapping in p2m table for the ITS translation register (GITS_TRANSLATER).

A mapping is required in the iommu page tables so that the device can
generate the MSI interrupt writing to the GITS_TRANSLATER register.

The GITS_TRANSLATER register is a 32-bit register, and there is nothing
else in a page containing it, so map that page.

Add new host_addr parameter to vgic_v3_its_init_virtual to prepare the
foundation for DomU MSI support where guest doorbell address can differ
for the host's. Note that the 1:1 check in arm_iommu_map_page remains
for now, as virtual ITSes are currently only created for hwdom where the
doorbell mapping is always 1:1.

Signed-off-by: Rahul Singh <rahul.singh@arm.com>
Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-07-03 14:45:45 -07:00
Rahul Singh 2fae94269e xen/arm: Fix mapping for PCI bridge mmio region
Current code skip the mapping for PCI bridge MMIO region to dom0 when
pci_passthrough_enabled flag is set. Mapping should be skip when
has_vpci(d) is enabled for the domain, as we need to skip the mapping
only when VPCI handler are registered for ECAM.

Signed-off-by: Rahul Singh <rahul.singh@arm.com>
Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2025-07-03 14:45:45 -07:00
Stewart Hildebrand 8d4d6abffe iommu/arm: iommu_add_dt_pci_sideband_ids phantom handling
Handle phantom functions in iommu_add_dt_pci_sideband_ids(). Each phantom
function will have a unique requestor ID (RID)/BDF. On ARM, we need to
map/translate the RID/BDF to an AXI stream ID for each phantom function
according to the pci-iommu device tree mapping [1]. The RID/BDF -> AXI stream ID
mapping in DT could allow phantom devices (i.e. devices with phantom functions)
to use different AXI stream IDs based on the (phantom) function.

[1] https://www.kernel.org/doc/Documentation/devicetree/bindings/pci/pci-iommu.txt

Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-07-03 14:45:45 -07:00
Oleksandr Tyshchenko 7f661b7b40 iommu/arm: Introduce iommu_add_dt_pci_sideband_ids API
The main purpose of this patch is to add a way to register PCI device
(which is behind the IOMMU) using the generic PCI-IOMMU DT bindings [1]
before assigning that device to a domain.

This behaves similarly to the existing iommu_add_dt_device API, except it
handles PCI devices, and it is to be invoked from the add_device hook in the
SMMU driver.

The function dt_map_id to translate an ID through a downstream mapping
(which is also suitable for mapping Requester ID) was borrowed from Linux
(v5.10-rc6) and updated according to the Xen code base.

[1] https://www.kernel.org/doc/Documentation/devicetree/bindings/pci/pci-iommu.txt

Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Signed-off-by: Mykyta Poturai <mykyta_poturai@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-07-03 14:45:45 -07:00
Stefano Stabellini 67b99a3691 automation/eclair: update configuration of D4.10
MISRA C Directive 4.10 states that "Precautions shall be taken in order
to prevent the contents of a header file being included more than
once".

Add a SAF tag and update the comment on top of cpufeatures.h.
Add a header inclusion guard to compile.h.
Generate header guards for hypercall-defs.h

Update ECLAIR configuration to:
- extend existing deviation to other comments explicitly saying a file
  is intended for multiple inclusion;
- extend existing deviation to other autogenerated files;
- tag the guidelines as clean.

Update deviations.rst accordingly.

Signed-off-by: Federico Serafini <federico.serafini@bugseng.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-07-03 14:45:45 -07:00
Federico Serafini 047a94b3fe misra: deviate violations of Rule 21.6
MISRA C Rule 21.6 states that "The Standard Library input/output
functions shall not be used".

Xen does not use the functions provided by the Standard Library,
uses -nostdlib to ensure this.
Xen implements a set of functions that share the same names as their
Standard Library equivalent. The implementation of these functions is
available in source form: if some undefined or unspecified behavior
does arise in the implementation, it falls under the jurisdiction of
other MISRA guidelines.

Update ECLAIR configuration to deviate violations of the rule,
tag it as clean and add it to the monitored set.

Updated docs/misra/deviations.rst accordingly.

Signed-off-by: Federico Serafini <federico.serafini@bugseng.com>
Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-07-03 14:45:45 -07:00
Andrew Cooper 10dc35c516 x86/cpu-policy: Fix handling of leaf 0x80000021
When support was originally introduced, ebx, ecx and edx were reserved and
should have been zeroed in recalculate_misc() to avoid leaking into guests.

Since then, fields have been added into ebx.  Guests can't load microcode, so
shouldn't see ucode_size, and while in principle we do want to support larger
RAP sizes in guests, virtualising this for guests depends on AMD procuding any
official documentation for ERAPS, which is long overdue and with no ETA.

This patch will cause a difference in guests on Zen5 CPUs, but as the main
ERAPS feature is hidden, guests should be ignoring the rap_size field too.

Fixes: e9b4fe2636 ("x86/cpuid: support LFENCE always serialising CPUID bit")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-07-02 18:25:03 +01:00
Roger Pau Monne fd06f87007 tools/golang: update auto-generated libxl based types
As a result of the addition of a new field in libxl domain build info
structure the golang types need to be regnerated, this was missing as part
of 22650d6054.

Regenerate the headers now.

Reported-by: Juergen Gross <jgross@suse.com>
Fixes: 22650d6054 ('x86/hvmloader: select xen platform pci MMIO BAR UC or WB MTRR cache attribute')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Nick Rosbrook <enr0n@ubuntu.com>
2025-07-02 16:10:16 +02:00
Andrew Cooper b9f8311975 x86/emul: Fix extable registration in invoke_stub()
For exception recovery in the stubs, the registered address for fixup is the
return address of the CALL entering the stub.

In invoke_stub(), the '.Lret%=:' label is the wrong side of the 'post'
parameter.  The 'post' parameter is non-empty in cases where the arithmetic
flags of the operation need recovering.

Split the line to separate 'pre' and 'post', making it more obvious that the
return address label was in the wrong position.

However, in the case that an exception did occur, we want to skip 'post' as
it's logically part of the operation which had already failed.  Therefore, add
a new skip label and use that for the exception recovery path.

This is XSA-470 / CVE-2025-27465

Fixes: 79903e50db ("x86emul: catch exceptions occurring in stubs")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-07-01 12:56:59 +01:00
Dmytro Prokopchuk 64be4fecd7 scripts/add_maintainers.pl: set double dashes for long options
Current script shows message:
 Don't forget to add the subject and message to ...
 Then perform:
 git send-email -to xen-devel@lists.xenproject.org ...
which has wrong option '-to'.
It may be confused for user.

Set double dashes for longer options to avoid that.

Fixes: e1f912cbf7 ("scripts/add_maintainers.pl: New script")
Signed-off-by: Dmytro Prokopchuk <dmytro_prokopchuk1@epam.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
2025-07-01 11:25:17 +02:00
Jan Beulich 6960bf546e x86/EFI: restrict use of --dynamicbase
At least GNU ld 2.35 takes this option to (also) mean what newer
versions have controllable by --enable-reloc-section. From there being
no relocations in check.efi (as we don't pass the option there) we infer
that we need to involve mkreloc, we'd end up with two sets of
relocations, which clearly isn't going to work. Furthermore the
relocations ld emits in this case also aren't usable: For bsp_idt[] we
end up with PE_BASE_RELOC_LOW ones, which efi_arch_relocate_image()
(deliberately) doesn't know how to deal with. (Related to that is also
why we check the number of relocations produced: The linker simply
didn't get this right there, yet.)

We also can't add the option to what we use when linking check.efi: That
ld version then would produce relocations, but 4 of them (instead of the
expected two). That would make us pass --disable-reloc-section, which
however only ld 2.36 and newer understand.

For such older binutils versions we therefore need to accept the slight
inconsistency in DLL characteristics that the earlier commit meant to
eliminate.

Fixes: f2148773b8 ("x86/EFI: sanitize DLL characteristics in binary")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-07-01 11:24:47 +02:00
Jan Beulich 86da14178d xen/build: pass -fzero-init-padding-bits=all to gcc15
See the respective bullet point in the Caveats section of
https://gcc.gnu.org/gcc-15/changes.html.

While I'm unaware of us currently relying on the pre-gcc15 behavior,
let's still play safe and retain what unknowingly we may have been
relying upon.

According to my observations, on x86 generated code changes
- somewhere deep in modify_bars(), presumably from the struct map_data
  initializer in apply_map() (a new MOVQ),
- in vpci_process_pending(), apparently again from the struct map_data
  initializer (and again a new MOVQ),
- near the top of find_cpio_data(), presumably from the struct cpio_data
  initializer (a MOVW changing to a MOVQ).

Requested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-07-01 11:23:59 +02:00
Andrew Cooper 30f8fed68f x86/cpu-policy: Simplify logic in guest_common_default_feature_adjustments()
For features which are unconditionally set in the max policies, making the
default policy to match the host can be done with a conditional clear.

This is simpler than the unconditional clear, conditional set currently
performed.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-30 12:41:33 +01:00
Michal Orzel fe6a12a083 xen/arm: Drop frametable_virt_end
It has never been used since the introduction and is technically a dead
code violating MISRA C.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 11:50:50 +02:00
Michal Orzel 71880d7ca4 docs: cmdline: Update serial_tx_buffer default value
After commit 4df2e99d73 ("console/serial: set the default transmit
buffer size in Kconfig"), the default value is set by Kconfig option
CONFIG_SERIAL_TX_BUFSIZE. Moreover it was bumped to 32KB by commit
d09e44e5d8 ("console/serial: bump buffer from 16K to 32K").

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-06-30 11:50:35 +02:00
Nicola Vetrini 09a338ae72 xen: fix unspecified behavior in tr invocation
The result of the command is undefined according to the specification if
the "string2" argument in tr is shorter than "string1". GNU tr behaves
correctly by extending "string2" to repeat the last character.

Fixes: eb61a4fb14 ("xen: fix header guard generation for asm-generic headers")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-30 10:06:54 +02:00
Juergen Gross 448826d95d tools/libxenguest: fix build in stubdom environment
With introduction of the new byteswap infrastructure the build of
libxenguest for stubdoms was broken. Fix that again.

Fixes: 60dcff871e ("xen/decompressors: Remove use of *_to_cpup() helpers")
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
2025-06-30 10:05:42 +02:00
Oleksii Kurochko 04289eca9e xen: move __ro_after_init section symbols to xen/sections.h
Instead of declaring __ro_after_init_{start,end} in each architecture's
asm/setup.h, move these declarations to the common header xen/sections.h.

This centralizes the declarations and reduces duplication across
architectures.

No functional change intended.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2025-06-30 10:05:04 +02:00
Penny Zheng 31aca815c7 xen/sysctl: make CONFIG_LIVEPATCH depend on CONFIG_SYSCTL
LIVEPATCH mechanism relies on LIVEPATCH_SYSCTL hypercall, so CONFIG_LIVEPATCH
shall depend on CONFIG_SYSCTL

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 10:04:37 +02:00
Penny Zheng a31a59beca xen/sysctl: make CONFIG_COVERAGE depend on CONFIG_SYSCTL
Users rely on SYSCTL_coverage_op hypercall to interact with the coverage data,
that is, according operations shall be wrapped around with CONFIG_SYSCTL.
Right now, it is compiled under CONFIG_COVERAGE, so we shall make
CONFIG_COVERAGE depend on CONFIG_SYSCTL.

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 10:04:20 +02:00
Penny Zheng 6363d0172f xen/sysctl: wrap around XEN_SYSCTL_physinfo
The following functions are only used to deal with XEN_SYSCTL_physinfo,
then they shall be wrapped:
- arch_do_physinfo()
- get_outstanding_claims()

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-06-30 10:03:16 +02:00
Penny Zheng 8597f8552e xen/sysctl: wrap around XEN_SYSCTL_lockprof_op
The following function is only to serve spinlock profiling via
XEN_SYSCTL_lockprof_op, so it shall be wrapped:
- spinlock_profile_control()

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 10:02:55 +02:00
Penny Zheng dbe929a220 xen/sysctl: wrap around XEN_SYSCTL_perfc_op
perfc_control() and perfc_copy_info() are responsible for providing control
of perf counters via XEN_SYSCTL_perfc_op in DOM0, so they both shall
be wrapped.

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 10:02:35 +02:00
Penny Zheng 1d62a36aaa xen/sysctl: make CONFIG_TRACEBUFFER depend on CONFIG_SYSCTL
Users could only access trace buffers via hypercall XEN_SYSCTL_tbuf_op,
so we shall make CONFIG_TRACEBUFFER depend on CONFIG_SYSCTL

Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 10:02:12 +02:00
Stefano Stabellini 36d07d40ca xen: introduce CONFIG_SYSCTL
We introduce a new Kconfig CONFIG_SYSCTL, which shall only be disabled
on some dom0less systems or PV shim on x86, to reduce Xen footprint.

Making SYSCTL without prompt is transient and it will be adjusted in the final
patch. And the consequence of introducing "CONFIG_SYSCTL=y" in .config file
generated from pvshim_defconfig is transient too, which will also be adjusted
in the final patch.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-30 09:58:58 +02:00
Jan Beulich afbb876f1f x86/boot: move l<N>_bootmap
Having them in the general .init.data section is somewhat wasteful, due
to involved padding. Move them into .init.data.page_aligned, and place
that right after .init.bss.stack_aligned.

Overall .init.data* shrinks by slightly over 2 pages in the build I'm
looking at.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-06-26 14:59:05 +02:00
Frediano Ziglio 196cdc097f xen/efi: Handle cases where file didn't come from ESP
A boot loader can load files from outside ESP.
In these cases device could be not provided or path could
be something not supported.
In these cases allows to boot anyway, all information
could be provided using UKI or using other boot loader
features.

Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2025-06-26 14:58:10 +02:00
Mykola Kvach 3e5f9674c0 xen/char: wrap suspend/resume console callbacks with CONFIG_SYSTEM_SUSPEND
This patch wraps the suspend/resume console callbacks and related code within
CONFIG_SYSTEM_SUSPEND blocks. This ensures that these functions and their
calls are only included in the build when CONFIG_SYSTEM_SUSPEND is enabled.

This addresses Misra Rule 2.1 violations.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Mykola Kvach <mykola_kvach@epam.com>
2025-06-26 14:57:22 +02:00
Roger Pau Monne a2602f3a63 x86/pdx: simplify calculation of domain struct allocation boundary
When not using CONFIG_BIGMEM there are some restrictions in the address
width for allocations of the domain structure, as it's PDX truncated to 32
bits it's stashed into page_info structure for domain allocated pages.

The current logic to calculate this limit is based on the internals of the
PDX compression used, which is not strictly required.  Instead simplify the
logic to rely on the existing PDX to PFN conversion helpers used elsewhere.

This has the added benefit of allowing alternative PDX compression
algorithms to be implemented without requiring to change the calculation of
the domain structure allocation boundary.

As a side effect introduce pdx_to_paddr() conversion macro and use it.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-26 10:37:13 +02:00
Andrew Cooper 2654ff974a x86/boot: Improve paging mode diagnostics in create_dom0()
I was presented with this:

  (XEN) NX (Execute Disable) protection active
  (XEN) d0 has maximum 416 PIRQs
  (XEN)
  (XEN) ****************************************
  (XEN) Panic on CPU 0:
  (XEN) Error creating d0: -95
  (XEN) ****************************************

which is less than helpful.  It turns out to be the -EOPNOTSUPP from
shadow_domain_init().

The real bug here is create_dom0() unconditionally assuming the presence of
SHADOW_PAGING.  Rework it to panic() rather than choosing a dom0_cfg which is
guaranteed to fail.  This results in:

  (XEN) NX (Execute Disable) protection active
  (XEN)
  (XEN) ****************************************
  (XEN) Panic on CPU 0:
  (XEN) Neither HAP nor Shadow available for PVH domain
  (XEN) ****************************************

which is rather more helpful.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Andrew Cooper da21488aed x86/idle: Misc cleanup
Sort includes, and drop trailing whitespace.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Andrew Cooper 07d7163334 Revert part of "x86/mwait-idle: disable IBRS during long idle"
Most of the patch (handling of CPUIDLE_FLAG_IBRS) is fine, but the
adjustements to mwait_idle() are not; spec_ctrl_enter_idle() does more than
just alter MSR_SPEC_CTRL.IBRS.

The only reason this doesn't need an XSA is because the unconditional
spec_ctrl_{enter,exit}_idle() in mwait_idle_with_hints() were left unaltered,
and thus the MWAIT remained properly protected.

There (would have been) two problems.  In the ibrs_disable (== deep C) case:

 * On entry, VERW and RSB-stuffing are architecturally skipped.
 * On exit, there's a branch crossing the WRMSR which reinstates the
   speculative safety for indirect branches.

All this change did was double up the expensive operations in the deep C case,
and fail to optimise the intended case.

I have an idea of how to plumb this more nicely, but it requires larger
changes to legacy IBRS handling to not make spec_ctrl_enter_idle() vulnerable
in other ways.  In the short term, simply take out the perf hit.

Fixes: 08acdf9a26 ("x86/mwait-idle: disable IBRS during long idle")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Andrew Cooper f77ef34435 x86/idle: Remove MFENCEs for CLFLUSH_MONITOR
Commit 48d32458bc ("x86, idle: add barriers to CLFLUSH workaround") was
inherited from Linux and added MFENCEs around the AAI65 errata fix.

The SDM now states:

  Executions of the CLFLUSH instruction are ordered with respect to each
  other and with respect to writes, locked read-modify-write instructions,
  and fence instructions[1].

with footnote 1 reading:

  Earlier versions of this manual specified that executions of the CLFLUSH
  instruction were ordered only by the MFENCE instruction.  All processors
  implementing the CLFLUSH instruction also order it relative to the other
  operations enumerated above.

I.e. the MFENCEs came about because of an incorrect statement in the SDM.

The Spec Update (no longer available on Intel's website) simply says "issue a
CLFLUSH", with no mention of MFENCEs.

As this erratum is specific to Intel, it's fine to remove the the MFENCEs; AMD
CPUs of a similar vintage do sport otherwise-unordered CLFLUSHs.

Move the feature bit into the BUG range (rather than FEATURE), and move the
workaround into monitor() itself.

The erratum check itself must use setup_force_cpu_cap().  It needs activating
if any CPU needs it, not if all of them need it.

Fixes: 48d32458bc ("x86, idle: add barriers to CLFLUSH workaround")
Fixes: 96d1b237ae ("x86/Intel: work around Xeon 7400 series erratum AAI65")
Link: https://web.archive.org/web/20090219054841/http://download.intel.com/design/xeon/specupdt/32033601.pdf
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Andrew Cooper 61e10fc28c x86/idle: Move monitor()/mwait() wrappers into cpu-idle.c
They're not used by any other translation unit, so shouldn't live in
asm/processor.h, which is included almost everywhere.

Our new toolchain baseline knows the MONITOR/MWAIT instructions, so use them
directly rather than using raw hex.

Change the hint/extention parameters from long to int.  They're specified to
remain 32bit operands even 64-bit mode.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Andrew Cooper 5ede8c9261 x86/svm: Revert 1->true conversion in svm_asid_handle_vmrun()
This is literally ASID 1 (of 2^16), not a boolean.

Fixes: 2f09f797ba ("x86/svm: Drop the suffix _guest from vmcb bit")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-25 17:54:41 +01:00
Frediano Ziglio 136387f70f xen/efi: Drop stale #undef buffer
The "buffer" macro was removed when keyhandler_scratch was removed.

Fixes: 59e087bf6a ("xen/keyhandler: Drop keyhandler_scratch")
Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2025-06-24 14:56:58 +02:00
Mykola Kvach bee20891d3 xen/common: Guard freeze/thaw_domains functions with CONFIG_SYSTEM_SUSPEND
This patch adds CONFIG_SYSTEM_SUSPEND guards around freeze_domains
and thaw_domains functions.

This ensures they are only compiled into the hypervisor when the system
suspend functionality is enabled, aligning their inclusion with their
specific use case.

This addresses two Misra Rule 2.1 violations.

Signed-off-by: Mykola Kvach <mykola_kvach@epam.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2025-06-24 14:56:02 +02:00
Frediano Ziglio e83364bc51 xen/efi: Show error message for EFI_INVALID_PARAMETER error
Show string message instead of code.
This happened trying some different ways to boot Xen, specifically
trying loading xen.efi using GRUB2 "linux" command.

Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2025-06-24 14:55:29 +02:00
Alejandro Vallejo 1671619181 xen: Rename bootmodule{,s} to boot_module{,s}
... in alignment with the new coding style on word splitting for type
names.

This aligns its name with the largely duplicate boot_module struct
in x86. While there's no equivalent to "struct bootmodules" in x86,
changing one and not the other is just confusing. Same with various
comments and function names.

Rather than making a long subfield name even longer, remove the
_bootmodule suffix in the kernel, initrd and dtb subfields.

Not a functional change.

Signed-off-by: Alejandro Vallejo <agarciav@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-By: Daniel P. Smith <dpsmith@apertussolutions.com>
2025-06-24 14:54:58 +02:00
Alejandro Vallejo eea7d98d1c CODING_STYLE: Custom type names must be snake-cased by word
There's the unwritten convention of splitting type names using
underscores. Add such convention to the CODINNG_STYLE to make it
common and less unwritten.

Signed-off-by: Alejandro Vallejo <agarciav@amd.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-24 14:54:34 +02:00
Andrew Cooper cc73941646 docs: Introduce a default .readthedocs.yaml
Read The Docs now requires a configuration file, which is awkward when using
RTD to render proposed changes on the list.

Provide the minimal configuration file possible, sacrificing all
reproducibility in order to hopefully not need to touch it moving forwards.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-23 10:35:57 +01:00
Denis Mukhin 3491e85a15 xen/domain: fix memory leak in domain_create()
Fix potential memory leak in domain_create() in late hardware domain case.

Fixes: b959f3b820 ("xen: introduce hardware domain create flag")
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
2025-06-23 10:50:33 +02:00
Frediano Ziglio 623c365951 xen/efi: Do not check kernel signature if it was embedded
Using UKI it's possible to embed Linux kernel into xen.efi file.
In this case the signature for Secure Boot is applied to the
whole xen.efi, including the kernel.
So checking for specific signature for the kernel is not
needed.

Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>
Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2025-06-23 10:50:13 +02:00
Jan Beulich e98ec009cd x86/pmstat: restore changes lost by "consolidation"
Both c6e0a55396 ("cpufreq: use existing local var in
cpufreq_statistic_init()") and a1ce987411 ("cpufreq: don't leave stale
statistics pointer") were lost in the course of "moving" the code,
presumably due to overly lax re-basing.

Fixes: bf0cd071db ("xen/pmstat: consolidate code into pmstat.c")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2025-06-23 10:49:26 +02:00
Nicola Vetrini eb61a4fb14 xen: fix header guard generation for asm-generic headers
Dashes were wrongly not translated into underscores, thus generating
an unexpected guard identifier.

Fixes: ee79f37831 ("xen: add header guards to generated asm generic headers")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-21 10:54:54 -07:00
Stefano Stabellini ee79f37831 xen: add header guards to generated asm generic headers
MISRA D4.10 requires to have proper header guards in place in all header
files. Add header guards for generated asm generic headers as well.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
2025-06-20 19:20:05 -07:00
Alejandro Vallejo c65ff27d71 xen/dt: Remove loop in dt_read_number()
The DT spec declares only two number types for a property: u32 and u64,
as per Table 2.3 in Section 2.2.4. Remove unbounded loop and replace
with a switch statement. Default to a size of 1 cell in the nonsensical
size case, with a warning printed on the Xen console.

Suggested-by: Daniel P. Smith" <dpsmith@apertussolutions.com>
Signed-off-by: Alejandro Vallejo <agarciav@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-06-20 17:47:31 -07:00
Ayan Kumar Halder 12d72d032e arm/mpu: Enable read/write to protection regions for arm32
Define prepare_selector(), read_protection_region() and
write_protection_region() for arm32. Also, define
GENERATE_{READ/WRITE}_PR_REG_OTHERS to access MPU regions from 32 to 254.

Enable pr_{get/set}_{base/limit}(), region_is_valid() for arm32.
Enable pr_of_addr() for arm32.

The maximum number of regions supported is 255 (which corresponds to the
maximum value in HMPUIR).

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Tested-by: Hari Limaye <hari.limaye@arm.com>
Acked-by: Julien Grall <jgrall@amazon.com>
2025-06-19 12:23:48 +01:00
Ayan Kumar Halder 419a1c5e96 arm/mpu: Define arm32 system registers
Fix the definition for HPRLAR.
Define the base/limit address registers to access the first 32 protection
regions.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
2025-06-19 12:06:31 +01:00
Ayan Kumar Halder 78afa06cf8 arm/mpu: Move the functions to arm64 specific files
prepare_selector(), read_protection_region() and write_protection_region()
differ significantly between arm32 and arm64. Thus, move these functions
to their sub-arch specific folder.

Also the macro GENERATE_{WRITE/READ}_PR_REG_CASE are moved, in order to
keep them in the same file of their usage and improve readability.

Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Michal Orzel <michal.orzel@amd.com>
2025-06-19 11:59:42 +01:00