aboutsummaryrefslogtreecommitdiffstats
path: root/xen/arch/x86/domctl.c
Commit message (Collapse)AuthorAgeFilesLines
* x86/xsave: fix migration from xsave-capable to xsave-incapable hostJan Beulich2013-09-091-21/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CPUID features suitably masked this is supposed to work, but was completely broken (i.e. the case wasn't even considered when the original xsave save/restore code was written). First of all, xsave_enabled() wrongly returned the value of cpu_has_xsave, i.e. not even taking into consideration attributes of the vCPU in question. Instead this function ought to check whether the guest ever enabled xsave support (by writing a [non-zero] value to XCR0). As a result of this, a vCPU's xcr0 and xcr0_accum must no longer be initialized to XSTATE_FP_SSE (since that's a valid value a guest could write to XCR0), and the xsave/xrstor as well as the context switch code need to suitably account for this (by always enforcing at least this part of the state to be saved/loaded). This involves undoing large parts of c/s 22945:13a7d1f7f62c ("x86: add strictly sanity check for XSAVE/XRSTOR") - we need to cleanly distinguish between hardware capabilities and vCPU used features. Next both HVM and PV save code needed tweaking to not always save the full state supported by the underlying hardware, but just the parts that the guest actually used. Similarly the restore code should bail not just on state being restored that the hardware cannot handle, but also on inconsistent save state (inconsistent XCR0 settings or size of saved state not in line with XCR0). And finally the PV extended context get/set code needs to use slightly different logic than the HVM one, as here we can't just key off of xsave_enabled() (i.e. avoid doing anything if a guest doesn't use xsave) because the tools use this function to determine host capabilities as well as read/write vCPU state. The set operation in particular needs to be capable of cleanly dealing with input that consists of only the xcr0 and xcr0_accum values (if they're both zero then no further data is required). While for things to work correctly both sides (saving _and_ restoring host) need to run with the fixed code, afaict no breakage should occur if either side isn't up to date (other than the breakage that this patch attempts to fix). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Yang Zhang <yang.z.zhang@intel.com> Acked-by: Keir Fraser <keir@xen.org>
* rename IS_PRIV to is_hardware_domainDaniel De Graaf2013-05-071-3/+3
| | | | | | | | | | | Since the remaining uses of IS_PRIV are actually concerned with the domain having control of the hardware (i.e. being the initial domain), clarify this by renaming IS_PRIV to is_hardware_domain. This also removes IS_PRIV_FOR since the only remaining user was xsm/dummy.h. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Keir Fraser <keir@xen.org>
* x86: remove IS_PRIV bypass on IRQ checkDaniel De Graaf2013-04-191-20/+9
| | | | | | | | | | This prevents a process in dom0 from granting a domU access to an IRQ without adding the IRQ to the domU's list of permitted IRQs. This operation currently succeeds in dom0 but would fail if the device model were running in a stubdom, so making the failure consistent should ease debugging of the device-model stubdoms. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* x86: remove IS_PRIV access check bypassesDaniel De Graaf2013-04-181-4/+2
| | | | | | | | | | | Several domctl functions dealing with rangesets contain a short-circuit bypass if the domain is privileged. Since the construction of domain 0 permits access to all I/O ranges, the call to irq_access_permitted will normally return true even without the IS_PRIV check, and the presence of the IS_PRIV check prevents the creation of a privileged domain without access to specific devices or IO memory ranges. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* x86: fix various issues with handling guest IRQsJan Beulich2013-04-181-6/+14
| | | | | | | | | | | | | - properly revoke IRQ access in map_domain_pirq() error path - don't permit replacing an in use IRQ - don't accept inputs in the GSI range for MAP_PIRQ_TYPE_MSI - track IRQ access permission in host IRQ terms, not guest IRQ ones (and with that, also disallow Dom0 access to IRQ0) This is CVE-2013-1919 / XSA-46. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* Fix emacs local variable block to use correct C style variable.David Vrabel2013-02-211-1/+1
| | | | | | | The emacs variable to set the C style from a local variable block is c-file-style, not c-set-style. Signed-off-by: David Vrabel <david.vrabel@citrix.com
* x86: properly use map_domain_page() in miscellaneous placesJan Beulich2013-01-231-3/+8
| | | | | Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xen/xsm: Add xsm_default parameter to XSM hooksDaniel De Graaf2013-01-111-5/+5
| | | | | | | | | | | | | | Include the default XSM hook action as the first argument of the hook to facilitate quick understanding of how the call site is expected to be used (dom0-only, arbitrary guest, or device model). This argument does not solely define how a given hook is interpreted, since any changes to the hook's default action need to be made identically to all callers of a hook (if there are multiple callers; most hooks only have one), and may also require changing the arguments of the hook. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* xen: domctl XSM hook removalDaniel De Graaf2013-01-111-72/+4
| | | | | | | | | | | | | | A number of the domctl XSM hooks do nothing except pass the domain and operation ID, making them redundant with the xsm_domctl hook. Remove these redundant hooks. The remaining domctls all use individual hooks because they pass extra details of the call to the XSM module in order to allow a more fine-grained access decision to be made - for example, considering the exact device or memory range being set up for guest access. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: Add missing mem_sharing XSM hooksDaniel De Graaf2013-01-111-5/+3
| | | | | | | | | | | | This patch adds splits up the mem_sharing and mem_event XSM hooks to better cover what the code is doing. It also changes the utility function get_mem_event_op_target to rcu_lock_live_remote_domain_by_id because there is no mm-specific logic in there. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: add distinct XSM hooks for map/unmapDaniel De Graaf2013-01-101-2/+6
| | | | | | | | | | | | | | The xsm_iomem_permission and xsm_ioport_permission hooks are intended to be called by the domain builder, while the calls in arch/x86/domctl.c which control mapping are also performed by the device model. Because these operations require distinct access control policies, they cannot use the same XSM hooks. This also adds a missing XSM hook in the unbind IRQ domctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xen/arch/*: add struct domain parameter to arch_do_domctlDaniel De Graaf2012-12-181-380/+75
| | | | | | | | | | | | | | | Since the arch-independent do_domctl function now RCU locks the domain specified by op->domain, pass the struct domain to the arch-specific domctl function and remove the duplicate per-subfunction locking. This also removes two get_domain/put_domain call pairs (in XEN_DOMCTL_assign_device and XEN_DOMCTL_deassign_device), replacing them with RCU locking. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* streamline guest copy operationsJan Beulich2012-12-101-32/+23
| | | | | | | | | | | | - use the variants not validating the VA range when writing back structures/fields to the same space that they were previously read from - when only a single field of a structure actually changed, copy back just that field where possible - consolidate copying back results in a few places Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* X86/vMCE: handle broken page with regard to migrationLiu Jinsong2012-12-061-2/+34
| | | | | | | | | | | | | | | | | | | | | | | At the sender xc_domain_save has a key point: 'to query the types of all the pages with xc_get_pfn_type_batch' 1) if broken page occur before the key point, migration will be fine since proper pfn_type and pfn number will be transferred to the target and then take appropriate action; 2) if broken page occur after the key point, whole system will crash and no need care migration any more; At the target Target will populates pages for guest. As for the case of broken page, we prefer to keep the type of the page for the sake of seamless migration. Target will set p2m as p2m_ram_broken for broken page. If guest access the broken page again it will kill itself as expected. Suggested-by: George Dunlap <george.dunlap@eu.citrix.com> Signed-off-by: Liu Jinsong <jinsong.liu@intel.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriateStefano Stabellini2012-10-171-1/+1
| | | | | | | | | | | | Note: these changes don't make any difference on x86. Replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when it is used as an hypercall argument. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* IOMMU: remove vendor specific bits from generic codeJan Beulich2012-10-151-2/+2
| | | | | | | | | | - names of functions used independent of vendor should not have vendor specific names - vendor specific declarations should not live inn generic headers - other vendor specific items should not be used in generic code Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: vMCE save and restoreLiu, Jinsong2012-09-261-5/+19
| | | | | | | | | | | | | | | | | | | This patch provides vMCE save/restore when migration. 1. MCG_CAP is well-defined. However, considering future cap extension, we keep save/restore logic that Jan implement at c/s 24887; 2. MCi_CTL2 initialized by guestos when booting, so need save/restore otherwise guest would surprise; 3. Other MSRs do not need save/restore since they are either error- related and pointless to save/restore, or, unified among all vMCE platform; Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com> - fix handling of partial data in XEN_DOMCTL_set_ext_vcpucontext - fix adjustment of xen_domctl_ext_vcpucontext Signed-off-by: Jan Beulich <jbeulich@suse.com> Committed-by: Jan Beulich <jbeulich@suse.com>
* x86: vMCE emulationLiu, Jinsong2012-09-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch provides virtual MCE support to guest. It emulates a simple and clean MCE MSRs interface to guest by faking caps to guest if needed and masking caps if unnecessary: 1. Providing a well-defined MCG_CAP to guest, filter out un-necessary caps and provide only guest needed caps; 2. Disabling MCG_CTL to avoid model specific; 3. Sticking all 1's to MCi_CTL to guest to avoid model specific; 4. Enabling CMCI cap but never really inject to guest to prevent polling periodically; 5. Masking MSCOD field of MCi_STATUS to avoid model specific; 6. Keeping natural semantics by per-vcpu instead of per-domain variables; 7. Using bank1 and reserving bank0 to work around 'bank0 quirk' of some very old processors; 8. Cleaning some vMCE# injection logic which shared by Intel and AMD but useless under new vMCE implement; 9. Keeping compatilbe w/ old xen version which has been backported to SLES11 SP2, so that old vMCE would not blocked when migrate to new vMCE; Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com> - make printing consistent (and non-exploitable) - fix return values of intel_mce_{rd,wr}msr() for out of range banks - miscellaneous cleanup Signed-off-by: Jan Beulich <jbeulich@suse.com> Committed-by: Jan Beulich <jbeulich@suse.com>
* x86: tighten checks in XEN_DOMCTL_memory_mapping handlerJan Beulich2012-09-201-7/+49
| | | | | | | | | | | | | | | | | | | | | | Properly checking the MFN implies knowing the physical address width supported by the platform, so to obtain this consistently the respective code gets moved out of the MTRR subdir. Btw., the model specific workaround in that code is likely unnecessary - I believe those CPU models don't support 64-bit mode. But I wasn't able to formally verify this, so I preferred to retain that code for now. But domctl code here also was lacking other error checks (as was, looking at it again from that angle) the XEN_DOMCTL_ioport_mapping one. Besides adding the missing checks, printing is also added for the case where revoking access permissions didn't work (as that may have implications for the host operator, e.g. wanting to not pass through affected devices to another guest until the one previously using them did actually die). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid rangeJan Beulich2012-09-191-1/+1
| | | | | | | | | | | | In particular, the case of "np" being a very large value wasn't handled correctly. The range start checks also were off by one (except that in practice, when "np" is properly range checked, this would still have been caught by the range end checks). Also, is a GFN wrap in XEN_DOMCTL_memory_mapping really okay? Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: Remove CONFIG_COMPAT ifdef'ery from arch/x86 -- it is always defined.Keir Fraser2012-09-121-14/+0
| | | | Signed-off-by: Keir Fraser <keir@xen.org>
* xen: Remove x86_32 build target.Keir Fraser2012-09-121-16/+0
| | | | Signed-off-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove page-to-domain lookups from XSM hooksDaniel De Graaf2012-08-221-8/+15
| | | | | | | | | | | | | | | | | Doing a reverse lookup from MFN to its owning domain is redundant with the internal checks Xen does on pages. Change the checks to operate directly on the domain owning the pages for normal memory; MMIO areas are still checked with security_iomem_sid. This fixes a hypervisor crash when a domU attempts to map an MFN that is free in Xen's heap: the XSM hook is called before the validity check, and page_get_owner returns garbage when called on these pages. While explicitly checking for such pages using page_get_owner_and_reference is a possible solution, this ends up duplicating parts of get_page_from_l1e. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* x86-64: don't allow non-canonical addresses to be set for any callbackJan Beulich2012-06-181-0/+3
| | | | | | | | | | Rather than deferring the detection of these to the point where they get actually used (the fix for XSA-7, 25480:76eaf5966c05, causing a #GP to be raised by IRET, which invokes the guest's [fragile] fail-safe callback), don't even allow such to be set. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: Use get_page_from_gfn() instead of get_gfn()/put_gfn.Tim Deegan2012-05-171-28/+22
| | | | Signed-off-by: Tim Deegan <tim@xen.org>
* x86: Add FS and GS base to HVM VCPU contextAravindh Puthiyaparambil2012-04-271-0/+15
| | | | | | | | Add FS and GS base to the HVM VCPU context returned by xc_vcpu_getcontext(). Signed-off-by: Aravindh Puthiyaparambil <aravindh@virtuata.com> Committed-by: Jan Beulich <jbeulich@suse.com>
* x86: Fix put_gfn in XEN_DOMCTL_getpageframeinfo3.Tim Deegan2012-03-221-1/+1
| | | | | Reported by Christian Limpach. Signed-off-by: Tim Deegan <tim@xen.org>
* x86/vMCE: save/restore MCA capabilitiesJan Beulich2012-02-241-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows migration to a host with less MCA banks than the source host had, while without this patch accesses to the excess banks' MSRs caused #GP-s in the guest after migration (and it depended on the guest kernel whether this would be fatal). A fundamental question is whether we should also save/restore MCG_CTL and MCi_CTL, as the HVM save record would better be defined to the complete state that needs saving from the beginning (I'm unsure whether the save/restore logic allows for future extension of an existing record). Of course, this change is expected to make migration from new to older Xen impossible (again I'm unsure what the save/restore logic does with records it doesn't even know about). The (trivial) tools side change may seem unrelated, but the code should have been that way from the beginning to allow the hypervisor to look at currently unused ext_vcpucontext fields without risking to read garbage when those fields get a meaning assigned in the future. This isn't being enforced here - should it be? (Obviously, for backwards compatibility, the hypervisor must assume these fields to be clear only when the extended context's size exceeds the old original one.) A future addition to this change might be to allow configuration of the number of banks and other MCA capabilities for a guest before it starts (i.e. to not inherits the values seen on the first host it runs on). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* replace bogus gdprintk() uses with {,d}printk()Jan Beulich2012-02-161-17/+19
| | | | | | | | | | | When the subject domain is not the current one (e.g. during domctl or HVM save/restore handling), use of gdprintk() is questionable at best, as it won't give the intended information on what domain is affected. Use plain printk() or dprintk() instead, but keep things (mostly) as guest messages by using XENLOG_G_*. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* Use memops for mem paging, sharing, and access, instead of domctlsAndres Lagar-Cavilla2012-02-101-1/+0
| | | | | | | | | | | | | | | | | | | | | | | Per page operations in the paging, sharing, and access tracking subsystems are all implemented with domctls (e.g. a domctl to evict one page, or to share one page). Under heavy load, the domctl path reveals a lack of scalability. The domctl lock serializes dom0's vcpus in the hypervisor. When performing thousands of per-page operations on dozens of domains, these vcpus will spin in the hypervisor. Beyond the aggressive locking, an added inefficiency of blocking vcpus in the domctl lock is that dom0 is prevented from re-scheduling any of its other work-starved processes. We retain the domctl interface for setting up and tearing down paging/sharing/mem access for a domain. But we migrate all the per page operations to use the memory_op hypercalls (e.g XENMEM_*). Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla> Signed-off-by: Adin Scannell <adin@scannell.ca> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Tim Deegan <tim@xen.org>
* xen/xsm: fix incorrect handling of XSM hook returnDaniel De Graaf2012-02-021-1/+1
| | | | | | | | | If the XSM hook denied access, the execution incorrectly continued on after an extra unlock domain. Reported-by: John McDermott <john.mcdermott@nrl.navy.mil> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add missing access checksDaniel De Graaf2011-12-181-5/+12
| | | | | | | | | Actions requiring IS_PRIV should also require some XSM access control in order for XSM to be useful in confining multiple privileged domains. Add XSM hooks for new hypercalls and sub-commands that are under IS_PRIV but not currently under any access checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: Expand I/O resource hooksDaniel De Graaf2011-12-021-4/+20
| | | | | | | | | | | | | | | | | | The XSM hooks inside rangeset are not useful in capturing the PIRQ mappings in HVM domains. They can also be called from softirq context where current->domain is invalid, causing spurious AVC denials from unrelated domains on such calls. Within FLASK code, the rangeset hooks were already divided between IRQs, I/O memory, and x86 IO ports; propagate this division back through the XSM hooks and call the XSM functions directly when needed. This removes XSM checks for the initial rangeset population for dom0 and the removal checks on domain destruction; denying either of these actions does not make sense. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* x86/mm: remove 0x55 debug pattern from M2P tableTim Deegan2011-12-021-2/+1
| | | | | | | | It's not really any more useful than explicitly setting new M2P entries to the invalid value. Signed-off-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* x86/mm: Rework stale p2m auditingAndres Lagar-Cavilla2011-12-011-0/+21
| | | | | | | | | | | | | | | | The p2m audit code doesn't even compile, let alone work. It also partially supports ept. Make it: - compile - lay groundwork for eventual ept support - move out of the way of all calls and turn it into a domctl. It's obviously not being used by anybody presently. - enable it via said domctl Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org> Signed-off-by: Tim Deegan <tim@xen.org> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Tim Deegan <tim@xen.org>
* ia64: fix the buildJan Beulich2011-11-151-1/+1
| | | | | | | This addresses all remaining build problems introduced over the last several months. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* Modify naming of queries into the p2mAndres Lagar-Cavilla2011-11-111-4/+11
| | | | | | | | | | | | | | | | | | | | | | Callers of lookups into the p2m code are now variants of get_gfn. All callers need to call put_gfn. The code behind it is a no-op at the moment, but will change to proper locking in a later patch. This patch does not change functionality. Only naming, and adds put_gfn's. set_p2m_entry retains its name because it is always called with p2m_lock held. This patch is humongous, unfortunately, given the dozens of call sites involved. After this patch, anyone using old style gfn_to_mfn will not succeed in compiling their code. This is on purpose: adapt to the new API. Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* PCI multi-seg: adjust domctl interfaceJan Beulich2011-09-221-139/+1
| | | | | | | Again, a couple of directly related functions at once get adjusted to account for the segment number. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* x86/mm/p2m: Make p2m interfaces take struct domain arguments.Tim Deegan2011-06-021-2/+2
| | | | | | | | | | | | | | | | | As part of the nested HVM patch series, many p2m functions were changed to take pointers to p2m tables rather than to domains. This patch reverses that for almost all of them, which: - gets rid of a lot of "p2m_get_hostp2m(d)" in code which really shouldn't have to know anything about how gfns become mfns. - ties sharing and paging interfaces to a domain, which is what they actually act on, rather than a particular p2m table. In developing this patch it became clear that memory-sharing and nested HVM are unlikely to work well together. I haven't tried to fix that here beyond adding some assertions around suspect paths (as this patch is big enough with just the interface changes) Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
* xen: remove extern function declarations from C files.Tim Deegan2011-05-261-12/+2
| | | | | | | | Move all extern declarations into appropriate header files. This also fixes up a few places where the caller and the definition had different signatures. Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
* x86/fpu: extract extended related code into xstate.h and xstate.cWei Huang2011-05-091-1/+1
| | | | | | | | | | Current extended code is mixing with FPU code in i387.c. As part of FPU code cleanup, this patch moves all extended state code into independent files. Not much semantic are changed and most function names are kept untouched, except for xsave() and xsaveopt(). These two functions are combined into a single function. Signed-off-by: Wei Huang <wei.huang2@amd.com>
* x86: split struct domainJan Beulich2011-04-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is accomplished by converting a couple of embedded arrays (in one case a structure containing an array) into separately allocated pointers, and (just as for struct arch_vcpu in a prior patch) overlaying some PV-only fields with HVM-only ones. One particularly noteworthy change in the opposite direction is that of PITState - this field so far lived in the HVM-only portion, but is being used by PV guests too, and hence needed to be moved out of struct hvm_domain. The change to XENMEM_set_memory_map (and hence libxl__build_pre() and the movement of the E820 related pieces to struct pv_domain) are subject to a positive response to a query sent to xen-devel regarding the need for this to happen for HVM guests (see http://lists.xensource.com/archives/html/xen-devel/2011-03/msg01848.html). The protection of arch.hvm_domain.irq.dpci accesses by is_hvm_domain() is subject to confirmation that the field is used for HVM guests only (see http://lists.xensource.com/archives/html/xen-devel/2011-03/msg02004.html). In the absence of any reply to these queries, and given the early state of 4.2 development, I think it should be acceptable to take the risk of having to later undo/redo some of this. Signed-off-by: Jan Beulich <jbeulich@novell.com>
* x86: move pv-only members of struct vcpu to struct pv_vcpuJan Beulich2011-04-051-24/+44
| | | | | | | | | | | ... thus further shrinking overall size of struct arch_vcpu. This has a minor effect on XEN_DOMCTL_{get,set}_ext_vcpucontext - for HVM guests, some meaningless fields will no longer get stored or retrieved: reads will now return zero, and writes are required to be (mostly) zero (the same as was already done on x86-32). Signed-off-by: Jan Beulich <jbeulich@novell.com>
* x86: split struct vcpuJan Beulich2011-04-051-17/+70
| | | | | | | | | | | | | | | | | | | | | | | | | This is accomplished by splitting the guest_context member, which by itself is larger than a page on x86-64. Quite a number of fields of this structure is completely meaningless for HVM guests, and thus a new struct pv_vcpu gets introduced, which is being overlaid with struct hvm_vcpu in struct arch_vcpu. The one member that is mostly responsible for the large size is trap_ctxt, which now gets allocated separately (unless fitting on the same page as struct arch_vcpu, as is currently the case for x86-32), and only for non-hvm, non-idle domains. This change pointed out a latent problem in arch_set_info_guest(), which is permitted to be called on already initialized vCPU-s, but so far copied the new state into struct arch_vcpu without (in this case) actually going through all the necessary accounting/validation steps. The logic gets changed so that the pieces that bypass accounting will at least be verified to be no different from the currently active bits, and the whole change will fail in case they are. The logic does *not* get adjusted here to do full error recovery, that is, partially modified state continues to not get unrolled in case of failure. Signed-off-by: Jan Beulich <jbeulich@novell.com>
* x86: add strictly sanity check for XSAVE/XRSTORWei Gang2011-02-211-1/+1
| | | | | | | | Replace most checks on cpu_has_xsave with checks on new fn xsave_enabled(), do additional sanity checks in the new fn. Signed-off-by: Wei Gang <gang.wei@intel.com> Signed-off-by: Keir Fraser <keir.xen@gmail.com>
* xen: fix XEN_DOMCTL_memory_mapping to not return with domain RCU lock heldKeir Fraser2011-01-181-4/+4
| | | | | | Broken in 20358:ecc649ec3675 Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
* mem_access: access listener can be requiredJoe Epstein2011-01-071-0/+20
| | | | | | | | * Adds the ability to set that a domain that an access listener; that is, it pauses the VCPU if there is no memory event listener. Signed-off-by: Joe Epstein <jepstein98@gmail.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: xsave save/restore support for both PV and HVM guests (version 2)Keir Fraser2010-11-081-0/+132
| | | | | | | | | | | | | | I have tested the patch in the following senarios: 1> Non-xsave platform 2> Xsave-capable platform, guest does not support xsave, xen support xsave 3> Xsave-capable platform, guest does support xsave, xen supports xsave 4> Guest (non-xsave) saved on platform without xsave, restored on a Xsave-capable system. All passed. Signed-off-by: Shan Haitao <haitao.shan@intel.com> Signed-off-by: Han Weidong <weidong.han@intel.com>
* Revert 22347:16093532f384 "x86: xsave save/restore support"Keir Fraser2010-11-041-135/+0
| | | | | | Completely broken when xsave is not enabled or supported on the host. Signed-off-by: Keir Fraser <keir@xen.org>
* x86: xsave save/restore support for both PV and HVM guests.Keir Fraser2010-11-031-0/+135
| | | | | Signed-off-by: Shan Haitao <haitao.shan@intel.com> Signed-off-by: Han Weidong <weidong.han@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 23:57:12 +0000