Commit Graph
37166 Commits
Author SHA1 Message Date
Andre Przywara fd2df4340a ARM: VGIC: change to level-IRQ compatible IRQ injection interface
At the moment vgic_vcpu_inject_irq() is the interface for Xen internal
code and virtual devices to inject IRQs into a guest. This interface has
two shortcomings:
1) It requires a VCPU pointer, which we may not know (and don't need!)
for shared interrupts. A second function (vgic_vcpu_inject_spi()), was
there to work around this issue.
2) This interface only really supports edge triggered IRQs, which is
what the Xen VGIC emulates only anyway. However this needs to and will
change, so we need to add the desired level (high or low) to the
interface.
This replaces the existing injection call (taking a VCPU and an IRQ
parameter) with a new one, taking domain, VCPU, IRQ and level parameters.
The VCPU can be NULL in case we don't know and don't care.
We change all call sites to use this new interface. This still doesn't
give us the missing level IRQ handling, but at least prepares the callers
to do the right thing later automatically.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:45:01 +00:00
Andre Przywara 3bb81108e9 ARM: VGIC: Adjust domain_max_vcpus() to be VGIC specific
domain_max_vcpus(), which is used by generic Xen code, returns the
maximum number of VCPUs for a domain, which on ARM is mostly limited by
the VGIC model emulated (a (v)GICv2 can only handle 8 CPUs).
Our current implementation lives in arch/arm/domain.c, but reaches into
VGIC internal data structures.
Move the actual functionality into vgic.c, and provide a shim in
domain.h, to keep this VGIC internal.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:42:40 +00:00
Andre Przywara 37db0cc6e3 ARM: VGIC: Move gic_remove_from_lr_pending() prototype
The prototype for gic_remove_from_lr_pending() is the last function in
gic.h which references a VGIC data structure.
Move it over to vgic.h, so that we can remove the inclusion of vgic.h
from gic.h. We add it to asm/domain.h instead, where it is actually
needed.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:42:18 +00:00
Andre Przywara 0de80d62a4 ARM: VGIC: rename gic_inject() and gic_clear_lrs()
The two central functions to synchronise our emulated VGIC state with
the GIC hardware (the LRs, really), are named somewhat confusingly.
Rename them from gic_inject() to vgic_sync_to_lrs() and from
gic_clear_lrs() to vgic_sync_from_lrs(), to make the code more readable.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Acked-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:42:18 +00:00
Andre Przywara 569a2f735f ARM: vGICv3: remove rdist_stride from VGIC structure
The last patch removed the usage of the hardware's redistributor-stride
value from our (Dom0) GICv3 emulation. This means we no longer need to
store this value in the VGIC data structure.
Remove that variable and every code snippet that handled that, instead
simply always use the architected value.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Acked-by: Julien Grall <julien.grall@linaro.org>
2018-03-12 11:42:18 +00:00
Andre Przywara faae7a7f3a ARM: vGICv3: always use architected redist stride
The redistributor-stride property in a GICv3 DT node is only there to
cover broken platforms where this value deviates from the architected one.
Since we emulate the GICv3 distributor even for Dom0, we don't need to
copy the broken behaviour. All the special handling for Dom0s using
GICv3 is just for using the hardware's memory map, which is unaffected
by the redistributor stride - it can never be smaller than the
architected two pages.
Remove the redistributor-stride property from Dom0's DT node and also
remove the code that tried to reuse the hardware value for Dom0's GICv3
emulation.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Acked-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:41:58 +00:00
Andre Przywara d99e4f6042 ARM: GICv3: use hardware GICv3 redistributor values for Dom0
The code to generate the DT node or MADT table for Dom0 reaches into the
domain's vGIC structure to learn the number of redistributor regions and
their base addresses.
Since those values are copied from the hardware, we can as well use
those hardware values directly when setting up the hardware domain.

This avoids the hardware GIC code to reference vGIC data structures.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:14:18 +00:00
Andre Przywara 2bb950b8d9 ARM: vGICv3: clarify on GUEST_GICV3_RDIST_REGIONS symbol
Normally there is only one GICv3 redistributor region, and we use
that for DomU guests using a GICv3.
Explain the background in a comment and why we need to keep the number
of hardware regions for Dom0.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Acked-by: Julien Grall <julien.grall@arm.com>
2018-03-12 11:14:18 +00:00
Jan Beulich 185413355f cpufreq/ondemand: fix race while offlining CPU
Offlining a CPU involves stopping the cpufreq governor. The on-demand
governor will kill the timer before letting generic code proceed, but
since that generally isn't happening on the subject CPU,
cpufreq_dbs_timer_resume() may run in parallel. If that managed to
invoke the timer handler, that handler needs to run to completion before
dbs_timer_exit() may safely exit.

Make the "stoppable" field a tristate, changing it from +1 to -1 around
the timer function invocation, and make dbs_timer_exit() wait for it to
become non-negative (still writing zero if it's +1).

Also adjust coding style in cpufreq_dbs_timer_resume().

Reported-by: Martin Cerveny <martin@c-home.cz>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Martin Cerveny <martin@c-home.cz>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
2018-03-09 17:30:49 +01:00
Jan Beulich b78a43d60a x86: improve MSR_SHADOW_GS accesses
Instead of using RDMSR/WRMSR, on fsgsbase-capable systems use a double
SWAPGS combined with RDGSBASE/WRGSBASE. This halves execution time for
a shadow GS update alone on my Haswell (and we have indications of
good performance improvements by this on Skylake too), while the win is
even higher when e.g. updating more than one base (as may and commonly
will happen in load_segments()).

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
2018-03-09 17:29:45 +01:00
Andrew Cooper 044fedfaa2 x86/traps: Put idt_table[] back into .bss
c/s d1d6fc97d "x86/xpti: really hide almost all of Xen image" accidentially
moved idt_table[] from .bss to .data by virtue of using the page_aligned
section.  We also have .bss.page_aligned, so use that.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
2018-03-09 15:42:24 +00:00
Jan Beulich 715bdd0e47 x86emul/test: wrap libc functions with FPU save/restore code
Currently with the native tool chain on Debian Jessie ./test_x86_emulator
yields:

  Testing AVX2 256bit single native execution...okay
  Testing AVX2 256bit single 64-bit code sequence...[line 933] failed!

The bug is that libc's memcpy() in read() uses %xmm8 (specifically, in
__memcpy_sse2_unaligned()), which corrupts %ymm8 behind the back of the AVX2
test code.

Introduce wrappers (and machinery to forward calls to those wrappers)
saving/restoring FPU state around certain library calls.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-and-tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-09 15:42:23 +00:00
Andrew Cooper 1a81958928 tests/x86emul: Helpers to save and restore FPU state
Introduce common helpers for saving and restoring FPU state.  During
emul_test_init(), calculate whether to use xsave or fxsave, and tweak the
existing mxcsr_mask logic to avoid using another large static buffer.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 15:42:23 +00:00
Andrew Cooper 2c85e86f0b x86/alt: Drop explicit padding of origin sites
Now that the alternatives infrastructure can calculate the required padding
automatically, there is no need to hard code it.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 14:44:16 +00:00
Andrew Cooper 4008c71d7a x86/alt: Support for automatic padding calculations
The correct amount of padding in an origin patch site can be calculated
automatically, based on the relative lengths of the replacements.

This requires a bit of trickery to calculate correctly, especially in the
ALTENRATIVE_2 case where a branchless max() calculation in needed.  The
calculation is further complicated because GAS's idea of true is -1 rather
than 1, which is why the extra negations are required.

Additionally, have apply_alternatives() attempt to optimise the padding nops.
This is complicated by the fact that we must not attempt to optimise nops over
an origin site which has already been modified.

To keep track of this, add a priv field to struct alt_instr, which gets
modified by apply_alternatives().  This method is used in preference to a
local variable in case we make multiple passes.  One extra requirement is that
alt_instr's referring to the same origin site must now be consecutive, but we
already have this property.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 14:44:16 +00:00
Andrew Cooper f54999f614 x86/asm: Remove opencoded uses of altinstruction_entry
With future changes, altinstruction_entry is going to become more complicated
to use.  Furthermore, there are already ALTERNATIVE* macros which can be used
to avoid opencoding the creation of replacement information.

For ASM_STAC, ASM_CLAC and CR4_PV32_RESTORE, this means the removal of all
hardocded label numbers.  For the cr4_pv32 alternatives, this means hardcoding
the extra space required in the original patch site, but the hardcoding will
be removed by a later patch.

No change to any functionality, but the handling of nops inside the original
patch sites are a bit different.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 14:44:16 +00:00
Andrew Cooper e95125108e x86/alt: Clean up the assembly used to generate alternatives
* On the C side, switch to using local lables rather than hardcoded numbers.
 * Rename parameters and lables to be consistent with alt_instr names, and
   consistent between the the C and asm versions.
 * On the asm side, factor some expressions out into macros to aid clarity.
 * Consistently declare section attributes.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
2018-03-09 14:44:16 +00:00
Andrew Cooper 4faa8fdd87 x86/alt: Clean up struct alt_instr and its users
* Rename some fields for consistency and clarity, and use standard types.
 * Don't opencode the use of ALT_{ORIG,REPL}_PTR().

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2018-03-09 14:44:16 +00:00
Andrew Cooper 2ad245b467 x86/alt: Drop unused alternative infrastructure
ALTERNATIVE_3 is more complicated than ALTERNATIVE_2 when it comes to
calculating extra padding length, and we have no need for the complexity.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 14:44:15 +00:00
Andrew Cooper ca8c67629a xen/domain: Added debug safety in the domain_create() failure path
Hitting the fail path with err = 0 causes callers to dereference a NULL
pointer, as 0 fails an IS_ERR() check.

All of the paths appear to be fine, but leave some logic to help catch stray
misuses.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-09 13:05:57 +00:00
Andrew Cooper 5175ce39d8 sched/rt: Fix build after c/s c3715dd8fb
Travis reports:

  sched_rt.c:241:30: error: unused function 'rt_dom' [-Werror,-Wunused-function]
  static inline struct rt_dom *rt_dom(const struct domain *dom)
                               ^
  1 error generated.

when compiling with Clang.  Drop the function.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Reviewed-by: Meng Xu <mengxu@cis.upenn.edu>
2018-03-08 18:41:09 +00:00
Andrew Cooper 9893f4e8c2 common/sched: Fix ARM build following c/s 340edc3902
The OSSTest smoke tests reports:

  sched_credit2.c: In function 'csched2_alloc_domdata':
  sched_credit2.c:3015:9: error: implicit declaration of function 'ERR_PTR' [-Werror=implicit-function-declaration]
           return ERR_PTR(-ENOMEM);
           ^
  sched_credit2.c:3015:9: error: nested extern declaration of 'ERR_PTR' [-Werror=nested-externs]

As the ERR infrastructure is part of the main scheduler interface now, include it from xen/sched-if.h

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>
2018-03-08 10:43:25 +00:00
Juergen Gross c9bd8a7365 tools/xenstore: add libdl dependency to libxenstore
Commit 448c03b3cb ("tools/xenstore: try to get minimum thread
stack size for watch thread") added a dependency to libdl to
libxenstore.

Add the needed flags to LDLIBS_libxenstore and the pkg-config file of
libxenstore.

Fixes: 448c03b3cb
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2018-03-07 16:33:40 +00:00
Andrew Cooper c77ec3478a xen/domain: Call sched_destroy_domain() in the domain_create() error path
If domain_create() fails, complete_domain_destroy() doesn't get called,
meaning that sched_destroy_domain() is missed.  In practice, this can only
fail because of exceptional late_hwdom_init() issues at the moment.

Make sched_destroy_domain() idempotent, and call it in the fail path.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
2018-03-07 16:00:37 +00:00
Andrew Cooper c3715dd8fb xen/sched: Remove {init,destroy}_domain() interfaces
These hooks have one single caller (sched_{init,destroy}_domain()
respectively) and are all identical (when implemented).

Previous changes have ensured that only real domains reach these functions, so
ASSERT() that system domains are not seen. Call sched_{alloc,free}_domdata()
directly, and handle d->sched_priv directly.

The net diffstat is:
  add/remove: 0/8 grow/shrink: 1/7 up/down: 7/-335 (-328)
  function                                     old     new   delta
  sched_destroy_domain                         130     137      +7
  sched_init_domain                            138     137      -1
  rt_dom_destroy                                 6       -      -6
  null_dom_destroy                               6       -      -6
  csched_dom_destroy                             9       -      -9
  csched2_dom_destroy                            9       -      -9
  sched_rtds_def                               264     248     -16
  sched_null_def                               264     248     -16
  sched_credit_def                             264     248     -16
  sched_credit2_def                            264     248     -16
  sched_arinc653_def                           264     248     -16
  ops                                          264     248     -16
  rt_dom_init                                   52       -     -52
  null_dom_init                                 52       -     -52
  csched_dom_init                               52       -     -52
  csched2_dom_init                              52       -     -52

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Meng Xu <mengxu@cis.upenn.edu>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
2018-03-07 16:00:37 +00:00
Andrew Cooper 340edc3902 xen/sched: Improvements to the {alloc,free}_domdata() interfaces
The main purpose of this change is for the subsequent cleanup it enables, but
it stands on its own merits.

In principle, these hooks are optional, but the SCHED_OP() default aliases a
memory allocation failure, which causes arinc653 to play the dangerous game of
passing its priv pointer back, and remembering not to actually free it.

Redefine alloc_domdata to use ERR_PTR() for errors, NULL for nothing, and
non-NULL for a real allocation, which allows the hook to become properly
optional.  Redefine free_domdata to be idempotent.

For arinc653, this means the dummy hooks can be dropped entirely.  For the
other schedulers, this means returning ERR_PTR(-ENOMEM) instead of NULL for
memory allocation failures, and modifying the free hooks to cope with a NULL
pointer.  While making the alterations, drop some spurious casts to void *.

Introduce and use proper wrappers for sched_{alloc,free}_domdata().  These are
strictly better than SCHED_OP(), as the source code is visible to
grep/cscope/tags, the generated code is better, and there can be proper
per-hook defaults and checks.

Callers of the alloc hooks are switched to using IS_ERR(), rather than
checking for NULL.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Meng Xu <mengxu@cis.upenn.edu>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
2018-03-07 16:00:37 +00:00
Andrew Cooper 27254e45b1 xen/credit2: Move repl_timer into struct csched2_dom
For exactly the same reason as 418ae6021d.  Having a separate allocation is
unnecessary and wasteful.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
2018-03-07 16:00:37 +00:00
Andrew Cooper cfc5214844 xen/domain: Reduce the quantity of initialisation for system domains
* System domains don't need watchdog initialisation or iomem/irq rangesets,
   and will not plausibly be a xenstore or hardware domain.
 * The idle domain doesn't need scheduler initialisation (and in particular,
   removing this path allows for substantial scheduler cleanup), and isn't
   liable to ever need late_hwdom_init().

Move all of these initialisations pass the DOMCRF_dummy early exit, and into
non-idle paths.  rangeset_domain_initialise() remains because it makes no
allocations, but does initialise a linked list and spinlock.  The poolid
parameter can be dropped as sched_init_domain()'s parameter is now
unconditionally 0.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
Reviewed-by: Dario Faggioli <dfaggioli@suse.com>
2018-03-07 16:00:37 +00:00
Andrew Cooper 47a46b9a6b tools/libxc: Correct comment for normalise_pagetable()
This is most likely a copy/paste mistake.

Reported-by: Bruno Alvisio <bruno.alvisio@gmail.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2018-03-07 16:00:37 +00:00
Roger Pau Monne 8b022d0005 vvmx: fixes after CR4 trapping optimizations
Commit 4068173550 doesn't update nested VMX code in order to
take into account L1 CR4 host mask when nested guest (L2) writes
to CR4, and thus the mask written to CR4_GUEST_HOST_MASK is
likely not as restrictive as it should be.

Also the VVMCS GUEST_CR4 value should be updated to match the
underlying value when syncing the VVMCS state.

Fixes: 4068173550 ("vmx/hap: optimize CR4 trapping")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Sergey Dyasli <sergey.dyasli@citrix.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
2018-03-07 11:20:28 +00:00
Andrew Cooper 2b0f746d7f tools/xenstore: Don't link libxenstore against systemd
It is only xenstored which uses libsystemd.  Avoid having libxenstore pull
libsystemd into the address space of all of its users.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2018-03-07 11:17:04 +00:00
Stefano Stabellini 457c86ff39 xen/arm: disable CPUs with different dcache line sizes
Even different cpus in big.LITTLE systems are expected to have the same
dcache line size. Unless the minimum of all dcache line sizes is used
across all cpu cores, cache coherency protocols can go wrong. Instead,
for now, just disable any cpu with a different dcache line size.

This check is not covered by the hmp-unsafe option, because even with
the correct scheduling and vcpu pinning in place, the system breaks if
dcache line sizes differ across cores. We don't believe it is a problem
for most big.LITTLE systems.

This patch moves the implementation of setup_cache to a static inline,
still setting dcache_line_bytes at the beginning of start_xen as
before.

In start_secondary we check that the dcache level 1 line sizes match,
otherwise we disable the cpu.

Suggested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-06 11:32:51 -08:00
Stefano Stabellini 9782e13b10 xen/arm: update the docs about heterogeneous computing
Introduce a new document about big.LITTLE and update the documentation
of hmp-unsafe.

Also update the warning messages to point users to the docs.

Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Julien Grall <julien.grall@arm.com>
CC: jbeulich@suse.com
CC: konrad.wilk@oracle.com
CC: tim@xen.org
CC: wei.liu2@citrix.com
CC: andrew.cooper3@citrix.com
CC: George.Dunlap@eu.citrix.com
CC: ian.jackson@eu.citrix.com
2018-03-06 11:32:51 -08:00
Stefano Stabellini 5abe1baea1 xen/arm: set VPIDR based on the MIDR value of the underlying pCPU
On big.LITTLE systems not all cores have the same MIDR. Instead of
storing only one VPIDR per domain, initialize it to the value of the
MIDR of the pCPU where the vCPU will run.

This way, assuming that the vCPU has been created with the right pCPU
affinity, the guest will be able to read the right VPIDR value, matching
the one of the physical cpu.

Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-06 11:32:51 -08:00
Stefano Stabellini 5622172378 xen/arm: read ACTLR on the pcpu where the vcpu will run
On big.LITTLE systems not all cores have the same ACTLR. Instead of
reading ACTLR and setting v->arch.actlr in vcpu_initialise, do it later
on the same pcpu where the vcpu will run.

This way, assuming that the vcpu has been created with the right pcpu
affinity, the guest will be able to read the right ACTLR value, matching
the one of the physical cpu.

Also move processor_vcpu_initialise(v) to continue_new_vcpu as it
can modify v->arch.actlr.

Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-06 11:32:51 -08:00
Stefano Stabellini f22f8bc41d xen/arm: make processor a per cpu variable
There can be processors of different kinds on a single system. Make
processor a per_cpu variable pointing to the right processor type for
each core.

Suggested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-06 11:32:51 -08:00
Julien Grall c8f62a0bb2 xen/arm: Park CPUs with a MIDR different from the boot CPU.
Xen does not properly support big.LITTLE platform. All vCPUs of a guest
will always have the MIDR of the boot CPU (see arch_domain_create).
At best the guest may see unreliable performance (vCPU switching between
big and LITTLE), at worst the guest will become unreliable or insecure.

This is becoming more apparent with branch predictor hardening in Linux
because they target a specific kind of CPUs and may not work on other
CPUs.

For the time being, park any CPUs with a MDIR different from the boot
CPU. This will be revisited in the future once Xen gains understanding
of big.LITTLE.

[1] https://lists.xenproject.org/archives/html/xen-devel/2016-12/msg00826.html

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Oleksandr Tyshchenkko <oleksandr_tyshchenko@epam.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
2018-03-06 11:32:51 -08:00
Stefano Stabellini 797ef5091d xen/arm: Read the dcache line size from CTR register
See the corresponding Linux commit as reference:

  commit f91e2c3bd427239c198351f44814dd39db91afe0
  Author: Catalin Marinas <catalin.marinas@arm.com>
  Date:   Tue Dec 7 16:52:04 2010 +0100

      ARM: 6527/1: Use CTR instead of CCSIDR for the D-cache line size on ARMv7

      The current implementation of the dcache_line_size macro reads the L1
      cache size from the CCSIDR register. This, however, is not guaranteed to
      be the smallest cache line in the cache hierarchy. The patch changes to
      the macro to use the more architecturally correct CTR register.

      Reported-by: Kevin Sapp <ksapp@quicinc.com>
      Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Also rename cacheline_bytes to dcache_line_bytes to clarify that it is
the minimum D-Cache line size.

Suggested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
2018-03-06 11:32:51 -08:00
Jan Beulich 31bf55cb5f x86: remove CR reads from exit-to-guest path
CR3 is - during normal operation - only ever loaded from v->arch.cr3,
so there's no need to read the actual control register. For CR4 we can
generally use the cached value on all synchronous entry end exit paths.
Drop the write_cr3 macro, as the two use sites are probably easier to
follow without its use.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:49:36 +01:00
Jan Beulich 9d1d31ad94 x86: slightly reduce Meltdown band-aid overhead
I'm not sure why I didn't do this right away: By avoiding the use of
global PTEs in the cloned directmap, there's no need to fiddle with
CR4.PGE on any of the entry paths. Only the exit paths need to flush
global mappings.

The reduced flushing, however, requires that we now have interrupts off
on all entry paths until after the page table switch, so that flush IPIs
can't be serviced while on the restricted pagetables, leaving a window
where a potentially stale guest global mapping can be brought into the
TLB. Along those lines the "sync" IPI after L4 entry updates now needs
to become a real (and global) flush IPI, so that inside Xen we'll also
pick up such changes.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:48:44 +01:00
Sergey Dyasli 0d9acbdd8d pv_console: remove unnecessary #ifdefs
The header for PV console contains empty function definitions in case of
!CONFIG_XEN_GUEST specially to avoid #ifdefs in a code that uses them
to make the code look cleaner.

Unfortunately, during the release of shim-comet, PV console functions
were enclosed into unnecessary #ifdefs CONFIG_X86. Remove them.

Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2018-03-06 16:47:34 +01:00
Jan Beulich d303784b68 x86/xpti: don't map stack guard pages
Other than for the main mappings, don't even do this in release builds,
as there are no huge page shattering concerns here.

Note that since we don't run on the restructed page tables while HVM
guests execute, the non-present mappings won't trigger the triple fault
issue AMD SVM is susceptible to with our current placement of STGI vs
TR loading.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:46:57 +01:00
Jan Beulich d1d6fc97d6 x86/xpti: really hide almost all of Xen image
Commit 422588e885 ("x86/xpti: Hide almost all of .text and all
.data/.rodata/.bss mappings") carefully limited the Xen image cloning to
just entry code, but then overwrote the just allocated and populated L3
entry with the normal one again covering both Xen image and stubs.

Drop the respective code in favor of an explicit clone_mapping()
invocation. This in turn now requires setup_cpu_root_pgt() to run after
stub setup in all cases. Additionally, with (almost) no unintended
mappings left, the BSP's IDT now also needs to be page aligned.

The moving ahead of cleanup_cpu_root_pgt() is not strictly necessary
for functionality, but things are more logical this way, and we retain
cleanup being done in the inverse order of setup.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:46:27 +01:00
Jan Beulich efe55d070b x86: move and rename XSTATE_*
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:45:43 +01:00
Jan Beulich 6eb43fcf8a x86emul: support SWAPGS
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
2018-03-06 16:44:03 +01:00
Andre Przywara 58be9af4f1 tools: ARM: vGICv3: Avoid inserting optional DT properties
When creating a GICv3 devicetree node, we currently insert the
redistributor-stride and #redistributor-regions properties, with fixed
values which are actually the architected ones. Since those properties are
optional, and in the case of the stride only needed to cover for broken
platforms, we don't need to describe them if they don't differ from the
default values. This will always be the case for our constructed
DomU memory map.
So we drop those properties altogether and provide a clean and architected
GICv3 DT node for DomUs.

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Reviewed-by: Julien Grall <julien.grall@arm.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
2018-03-06 11:10:41 +00:00
Stefano Stabellini f0b51c80fd Please Welcome Julien, our new Committer
In recognition of his expertise and commitment to Xen Project, please
join me in welcoming Julien among the Committers and REST Maintainers.

Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Julien Grall <julien.grall@arm.com>
2018-03-05 13:29:32 -08:00
Andrew Cooper f75b1a5247 x86/pv: Drop int80_bounce from struct pv_vcpu
The int80_bounce field of struct pv_vcpu is a bit of an odd special case,
because it is a simple derivation of trap_ctxt[0x80], which is also stored.

It is also the only use of {compat_,}create_bounce_frame() which isn't
referencing the plain trap_bounce field of struct pv_vcpu.  (And altering this
property the purpose of this patch.)

Remove the int80_bounce field entirely, along with init_int80_direct_trap(),
which in turn requires that the int80_direct_trap() path gain logic previously
contained in init_int80_direct_trap().

This does admittedly make the int80 fastpath slightly longer, but these few
instructions are in the noise compared to the architectural context switch
overhead, and it now matches the syscall/sysenter paths (which have far less
architectural overhead already).

No behavioural change from the guests point of view.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-05 17:36:31 +00:00
Andrew Cooper 344c552298 x86/entry: Correct comparisons against boolean variables
The correct way to check a boolean is `cmpb $0` or `testb $0xff`, whereas a
lot of our entry code uses `testb $1`.  This will work in principle for values
which are really C _Bool types, but won't work for other integer types which
are intended to have boolean properties.

cmp is the more logical way of thinking about the operation, so adjust all
outstanding uses of `testb $1` against boolean values.  Changing test to cmp
changes the logical mnemonic of the following condition from 'zero' to
'equal', but the actual encoding remains the same.

No functional change, as all uses are real C _Bool types, and confirmed by
diffing the disassembly.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
2018-03-05 17:36:31 +00:00
Andrew Cooper 9fd181540c x86/boot: Annotate the multiboot headers with size and type information
This causes objdump not to try and disassemble the data.

While altering this area, switch to using .balign, and fill with 0xc2 to help
highlight the embedded padding (rather than having it filled with 0f 1f 40 00
which is a long nop).  Also, shorten the labels by stripping off the _start
suffix.

The end result is now:
  ffff82d080200000 <_start>:
  ffff82d080200000:       e9 af c1 1c 00          jmpq   ffff82d0803cc1b4 <__start>
  ffff82d080200005:       0f 1f 00                nopl   (%rax)

  ffff82d080200008 <multiboot1_header>:
  ffff82d080200008:       02 b0 ad 1b 03 00 00 00 fb 4f 52 e4 c2 c2 c2 c2     .........OR.....

  ffff82d080200018 <multiboot2_header>:
  ffff82d080200018:       d6 50 52 e8 00 00 00 00 88 00 00 00 a2 ae ad 17     .PR.............
  ffff82d080200028:       01 00 00 00 10 00 00 00 04 00 00 00 06 00 00 00     ................
  ffff82d080200038:       06 00 00 00 08 00 00 00 0a 00 01 00 18 00 00 00     ................
  ffff82d080200048:       00 00 20 00 ff ff ff ff 00 00 20 00 02 00 00 00     .. ....... .....
  ffff82d080200058:       04 00 01 00 0c 00 00 00 02 00 00 00 c2 c2 c2 c2     ................
  ffff82d080200068:       05 00 01 00 14 00 00 00 00 00 00 00 00 00 00 00     ................
  ffff82d080200078:       00 00 00 00 c2 c2 c2 c2 07 00 01 00 08 00 00 00     ................
  ffff82d080200088:       09 00 01 00 0c 00 00 00 5e c0 3c 00 c2 c2 c2 c2     ........^.<.....
  ffff82d080200098:       00 00 00 00 08 00 00 00                             ........

  ffff82d0802000a0 <__high_start>:
  ffff82d0802000a0:       0f 01 15 5f 8f 25 00    lgdt   0x258f5f(%rip)        # ffff82d080459006 <gdt_descr>

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
2018-03-05 17:36:31 +00:00