aboutsummaryrefslogtreecommitdiffstats
path: root/xen/common/event_channel.c
Commit message (Collapse)AuthorAgeFilesLines
* Add DOMCTL to limit the number of event channels a domain may useDavid Vrabel2013-10-141-1/+6
| | | | | | | | | | | | | | | Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to set the maximum event channel port a domain may use. This may be used to limit the amount of Xen resources (global mapping space and xenheap) that a domain may use for event channels. A domain that does not have a limit set may use all the event channels supported by the event channel ABI in use. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: add FIFO-based event channel hypercalls and port opsDavid Vrabel2013-10-141-0/+21
| | | | | | | | | | Add the implementation for the FIFO-based event channel ABI. The new hypercall sub-ops (EVTCHNOP_init_control, EVTCHNOP_expand_array) and the required evtchn_ops (set_pending, unmask, etc.). Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: implement EVTCHNOP_set_priority and add the set_priority hookDavid Vrabel2013-10-141-0/+29
| | | | | | | | | | | | Implement EVTCHNOP_set_priority. A new set_priority hook added to struct evtchn_port_ops will do the ABI specific validation and setup. If an ABI does not provide a set_priority hook (as is the case of the 2-level ABI), the sub-op will return -ENOSYS. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: allow many more evtchn objects to be allocated per domainDavid Vrabel2013-10-141-18/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the number of event channels that can be supported internally by altering now struct evtchn's are allocated. The objects are indexed using a two level scheme of groups and buckets (instead of only buckets). Each group is a page of bucket pointers. Each bucket is a page-sized array of struct evtchn's. The optimal number of evtchns per bucket is calculated at compile time. If XSM is not enabled, struct evtchn is 16 bytes and each bucket contains 256, requiring only 1 group of 512 pointers for 2^17 (131,072) event channels. With XSM enabled, struct evtchn is 24 bytes, each bucket contains 128 and 2 groups are required. For the common case of a domain with only a few event channels, instead of requiring an additional allocation for the group page, the first bucket is indexed directly. As a consequence of this, struct domain shrinks by at least 232 bytes as 32 bucket pointers are replaced with 1 bucket pointer and (at most) 2 group pointers. [ Based on a patch from Wei Liu with improvements from Malcolm Crossley. ] Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: use a per-domain variable for the max number of event channelsDavid Vrabel2013-10-141-2/+2
| | | | | | | | | Instead of the MAX_EVTCHNS(d) macro, use d->max_evtchns instead. This avoids having to repeatedly check the ABI type. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: print ABI specific state with the 'e' debug keyDavid Vrabel2013-10-141-3/+5
| | | | | | | | | | | | | | | | In the output of the 'e' debug key, print some ABI specific state in addition to the (p)ending and (m)asked bits. For the 2-level ABI, print the state of that event's selector bit. e.g., (XEN) port [p/m/s] (XEN) 1 [0/0/1]: s=3 n=0 x=0 d=0 p=74 (XEN) 2 [0/0/1]: s=3 n=0 x=0 d=0 p=75 Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* evtchn: refactor low-level event channel port opsDavid Vrabel2013-10-141-54/+33
| | | | | | | | | | | | | Use functions for the low-level event channel port operations (set/clear pending, unmask, is_pending and is_masked). Group these functions into a struct evtchn_port_op so they can be replaced by alternate implementations (for different ABIs) on a per-domain basis. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: fix various issues with handling guest IRQsJan Beulich2013-04-181-1/+1
| | | | | | | | | | | | | - properly revoke IRQ access in map_domain_pirq() error path - don't permit replacing an in use IRQ - don't accept inputs in the GSI range for MAP_PIRQ_TYPE_MSI - track IRQ access permission in host IRQ terms, not guest IRQ ones (and with that, also disallow Dom0 access to IRQ0) This is CVE-2013-1919 / XSA-46. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* defer event channel bucket pointer store until after XSM checksJan Beulich2013-04-051-1/+2
| | | | | | | | | | | | Otherwise a dangling pointer can be left, which would cause subsequent memory corruption as soon as the space got re-allocated for some other purpose. This is CVE-2013-1920 / XSA-47. Reported-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org>
* Fix emacs local variable block to use correct C style variable.David Vrabel2013-02-211-1/+1
| | | | | | | The emacs variable to set the C style from a local variable block is c-file-style, not c-set-style. Signed-off-by: David Vrabel <david.vrabel@citrix.com
* xen/xsm: Add xsm_default parameter to XSM hooksDaniel De Graaf2013-01-111-6/+6
| | | | | | | | | | | | | | Include the default XSM hook action as the first argument of the hook to facilitate quick understanding of how the call site is expected to be used (dom0-only, arbitrary guest, or device model). This argument does not solely define how a given hook is interpreted, since any changes to the hook's default action need to be made identically to all callers of a hook (if there are multiple callers; most hooks only have one), and may also require changing the arguments of the hook. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* xen: avoid calling rcu_lock_*target_domain when an XSM hook existsDaniel De Graaf2013-01-111-9/+9
| | | | | | | | | | | | | | | | | | | The rcu_lock_{,remote_}target_domain_by_id functions are wrappers around an IS_PRIV_FOR check for the current domain. This is now redundant with XSM hooks, so replace these calls with rcu_lock_domain_by_any_id or rcu_lock_remote_domain_by_id to remove the duplicate permission checks. When XSM_ENABLE is not defined or when the dummy XSM module is used, this patch should not change any functionality. Because the locations of privilege checks have sometimes moved below argument validation, error returns of some functions may change from EPERM to EINVAL when called with invalid arguments and from a domain without permission to perform the operation. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* streamline guest copy operationsJan Beulich2012-12-101-6/+6
| | | | | | | | | | | | - use the variants not validating the VA range when writing back structures/fields to the same space that they were previously read from - when only a single field of a structure actually changed, copy back just that field where possible - consolidate copying back results in a few places Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriateStefano Stabellini2012-10-171-1/+1
| | | | | | | | | | | | Note: these changes don't make any difference on x86. Replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when it is used as an hypercall argument. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* Remove bool return code from evtchn_set_pending() and callers.Keir Fraser2012-05-101-11/+7
| | | | Signed-off-by: Keir Fraser <keir@xen.org>
* xsm: expose context of event channel peersDaniel De Graaf2012-02-291-8/+0
| | | | | | | | | | This hypercall allows a domain to identify the security context of a domain that it is communicating with using the interdomain event channel that it is using for the communication. This can be used to augment Xen's security permissions with intra-domain security checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: label xen-consumer event channelsDaniel De Graaf2012-02-291-2/+4
| | | | | | | | | | Event channels created during the domain build process for HVM domains did not call the XSM creation hook. Since these channels are used internally by Xen, redirect them to DOMAIN_INVAID instead of failing to create if the XSM hook fails the permissions check. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add security labels to event-channel dumpDaniel De Graaf2012-02-021-4/+15
| | | | | | | | | | | | | | In FLASK, event channel labels are distinct from the labels of the domain using them. When debugging policy issues, it is useful to be able to view the current label of event channels; add this label to the event channel dump. This patch also adds the IRQ associated with a PIRQ for event channels bound to a PIRQ, and moves the xen_consumer flag to the front to create more consistent alignment in the output. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: change virq parameters from int to uint32_tDaniel De Graaf2012-01-281-5/+5
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: allow global VIRQ handlers to be delegated to other domainsDaniel De Graaf2012-01-281-1/+65
| | | | | | | | | | | | | | | | | This patch sends global VIRQs to a domain designated as the VIRQ handler instead of sending all global VIRQ events to dom0. This is required in order to run xenstored in a stubdom, because VIRQ_DOM_EXC must be sent to xenstored for domain destruction to work properly. This patch was inspired by the xenstored stubdomain patch series sent to xen-devel by Alex Zeffertt in 2009. Signed-off-by: Diego Ongaro <diego.ongaro@citrix.com> Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* Create a generic callback mechanism for Xen-bound event channelsAndres Lagar-Cavilla2011-12-061-17/+58
| | | | | | | | | | | | For event channels for which Xen is the consumer, there currently is a single action. With this patch, we allow event channel creators to specify a generic callback (or no callback). Because the expectation is that there will be few callbacks, they are stored in a small table. Signed-off-by: Adin Scannell <adin@scannell.ca> Signed-off-by: Keir Fraser <keir@xen.org> Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org> Committed-by: Tim Deegan <tim@xen.org>
* ia64: fix the buildJan Beulich2011-11-151-0/+4
| | | | | | | This addresses all remaining build problems introduced over the last several months. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* use xzalloc in common codeJan Beulich2011-10-041-2/+1
| | | | | Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xen: fix hvm_domain_use_pirq's behaviorStefano Stabellini2011-08-311-0/+5
| | | | | | | | | | | hvm_domain_use_pirq should return true when the guest is using a certain pirq, no matter if the corresponding event channel is currently enabled or disabled. As an additional complication, qemu is going to request pirqs for passthrough devices even for Xen unaware HVM guests, so we need to wait for an event channel to be connected before considering the pirq of a passthrough device as "in use". Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* replace d->nr_pirqs sized arrays with radix treeJan Beulich2011-06-231-17/+25
| | | | | | | | | | | | | | | With this it is questionable whether retaining struct domain's nr_pirqs is actually necessary - the value now only serves for bounds checking, and this boundary could easily be nr_irqs. Note that ia64, the build of which is broken currently anyway, is only being partially fixed up. v2: adjustments for split setup/teardown of translation data v3: re-sync with radix tree implementation changes Signed-off-by: Jan Beulich <jbeulich@novell.com>
* Revert 23295:4891f1f41ba5 and 23296:24346f749826Keir Fraser2011-05-021-25/+17
| | | | | | Fails current lock checking mechanism in spinlock.c in debug=y builds. Signed-off-by: Keir Fraser <keir@xen.org>
* replace d->nr_pirqs sized arrays with radix treeJan Beulich2011-05-011-17/+25
| | | | | | | | | | | | | | | With this it is questionable whether retaining struct domain's nr_pirqs is actually necessary - the value now only serves for bounds checking, and this boundary could easily be nr_irqs. Another thing to consider is whether it's worth storing the pirq number in struct pirq, to avoid passing the number and a pointer to quite a number of functions. Note that ia64, the build of which is broken currently anyway, is only partially fixed up. Signed-off-by: Jan Beulich <jbeulich@novell.com>
* Remove spin_barrier_irq(). It is pointless.Keir Fraser2011-03-261-1/+1
| | | | | | | | Add a barrier-appropriate consistency check to spinlock.c, and add code comments to explain why barrier operations are more relaxed than lock-acquisition operations. Signed-off-by: Keir Fraser <keir@xen.org>
* event_channel: Fix uninitialised variable build error.Keir Fraser2010-11-221-8/+7
| | | | | Signed-off-by: Yang Zhang <yang.z.zhang@intel.com> Signed-off-by: Keir Fraser <keir@xen.org>
* Interrupt remapping to PIRQs in HVM guestsKeir Fraser2010-11-191-10/+20
| | | | | | | | | | This patch allows HVM guests to remap interrupts and MSIs into pirqs; once the mapping is in place the guest will receive the interrupt (or the MSI) as an event. The interrupt to be remapped can either be an interrupt of an emulated device or an interrupt of a passthrough device and we keep track of that. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* notify_via_xen_event_channel() should check for dying domain.Keir Fraser2010-09-151-0/+6
| | | | | | | Else we can fail on either ASSERTion in that function. From: Olaf Hering <olaf@aepfle.de> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Clean up event-channel debug-key output, and use spin_lock().Keir Fraser2010-08-131-7/+4
| | | | Signed-off-by: Jan Beulich <jbeulich@novell.com>
* x86: IRQ affinity should track vCPU affinityKeir Fraser2010-06-171-6/+59
| | | | | | | | | | | | | | With IRQs getting bound to the CPU the binding vCPU currently runs on there can result quite a bit of extra cross CPU traffic as soon as that vCPU moves to a different pCPU. Likewise, when a domain re-binds an event channel associated with a pIRQ, that IRQ's affinity should also be adjusted. The open issue is how to break ties for interrupts shared by multiple domains - currently, the last request (at any point in time) is being honored. Signed-off-by: Jan Beulich <jbeulich@novell.com>
* notify_via_xen_event_channel() takes explicit domain parameter.Keir Fraser2010-06-041-2/+2
| | | | | | Also remove pointless tasklet from mem_event notify path. Signed-off-by: John Byrne <john.l.byrne@hp.com>
* Dump full vCPU polling mask from 'e' key handlerKeir Fraser2010-02-111-1/+4
| | | | | Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* evtchn: Do not free d->poll_mask until domain is being deallocated.Keir Fraser2009-12-241-0/+5
| | | | | | Avoids crash on dereference of poll_mask after domain_kill(). Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Point per-vcpu vcpu_info at a dummy structure by default, avoidingKeir Fraser2009-10-291-12/+0
| | | | | | need for scattered NULL-pointer checks. Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Tidy evtchn keyhandler a littleKeir Fraser2009-09-071-5/+5
| | | | | | Get rid of all the -1s and label the pending and masked columns. Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
* Add a single trigger for all diagnostic keyhandlersKeir Fraser2009-08-021-1/+7
| | | | | | | | | | Add a new keyhandler that triggers all the side-effect-free keyhandlers. This lets automated tests (and users) log the full set of keyhandlers without having to be aware of which ones might reboot the host. Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* x86_64: allow more vCPU-s per guestKeir Fraser2009-06-181-8/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | Since the shared info layout is fixed, guests are required to use VCPUOP_register_vcpu_info prior to booting any vCPU beyond the traditional limit of 32. MAX_VIRT_CPUS, being an implemetation detail of the hypervisor, is no longer being exposed in the public headers. The tools changes are clearly incomplete (and done only so things would build again), and the current state of the tools (using scalar variables all over the place to represent vCPU bitmaps) very likely doesn't permit booting DomU-s with more than the traditional number of vCPU-s. Testing of the extended functionality was done with Dom0 (96 vCPU-s, as well as 128 vCPU-s out of which the kernel elected - by way of a simple kernel side patch - to use only some, resulting in a sparse bitmap). ia64 changes only to make things build, and build-tested only (and the tools part only as far as the build would go without encountering unrelated problems in the blktap code). Signed-off-by: Jan Beulich <jbeulich@novell.com>
* Revert 19661:326b24bfa9f9 "Free pirq_to_evtchn/pirq_mask..."Keir Fraser2009-05-291-23/+1
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* evtchn: Free pirq_to_evtchn/pirq_mask arrays on domain destruction.Keir Fraser2009-05-271-1/+23
| | | | | | At the same time, move this into evtchn_init/destroy(). Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* x86: eliminate hard-coded NR_IRQSKeir Fraser2009-05-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... splitting it into global nr_irqs (determined at boot time) and per- domain nr_pirqs (derived from nr_irqs and a possibly command line specified value, which probably should later become a per-domain config setting). This has the (desirable imo) side effect of reducing the size of struct hvm_irq_dpci from requiring an order-3 page to order-2 (on x86-64), which nevertheless still is too large. However, there is now a variable size bit array on the stack in pt_irq_time_out() - while for the moment this probably is okay, it certainly doesn't look nice. However, replacing this with a static (pre-)allocation also seems less than ideal, because that would require at least min(d->nr_pirqs, NR_VECTORS) bit arrays of d->nr_pirqs bits, since this bit array is used outside of the serialized code region in that function, and keeping the domain's event lock acquired across pirq_guest_eoi() doesn't look like a good idea either. The IRQ- and vector-indexed arrays hanging off struct hvm_irq_dpci could in fact be changed further to dynamically use the smaller of the two ranges for indexing, since there are other assumptions about a one-to-one relationship between IRQs and vectors here and elsewhere. Additionally, it seems to me that struct hvm_mirq_dpci_mapping's digl_list and gmsi fields could really be overlayed, which would yield significant savings since this structure gets always instanciated in form of d->nr_pirqs (as per the above could also be the smaller of this and NR_VECTORS) dimensioned arrays. Signed-off-by: Jan Beulich <jbeulich@novell.com>
* x86: Fix event-channel access for 32-bit HVM guests.Keir Fraser2009-03-031-2/+2
| | | | | | Based on a patch by Joe Jin <joe.jin@oracle.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* x86: add a shared page indicating the need for an EOI notificationKeir Fraser2008-11-281-3/+2
| | | | | | | | | | To simplify the interface for the guest, when a guest uses this new (sub-)hypercall, PHYSDEVOP_eoi behavior changes to unmask the corresponding event channel at once, avoiding the eventual need for a second hypercall from the guest. Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Define spin_barrier_irq() for IRQ-safe spinlocks, and use it for virq_lock.Keir Fraser2008-10-221-1/+1
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Rename evtchn_lock to event_lock, since it protects more than justKeir Fraser2008-10-091-44/+44
| | | | | | event-channel state now. Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* Eliminate code duplication with rcu_lock_domain_by_id().Keir Fraser2008-10-021-42/+9
| | | | Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
* x86: Clean up and fix 18539:31f09a5e24cf8Keir Fraser2008-09-251-2/+1
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* x86: Properly synchronise updates to pirq-to-vector mapping.Keir Fraser2008-09-241-1/+2
| | | | | | | | Per-domain irq mappings are now protected by d->evtchn_lock and by the per-vector irq_desc lock. Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 09:12:34 +0000