| Message ID | 20240403081626.375313-2-xin.wang2@amd.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | DOMCTL-based guest magic region allocation for 11 domUs | expand |
On 03.04.2024 10:16, Henry Wang wrote: > --- a/tools/libs/ctrl/xc_domain.c > +++ b/tools/libs/ctrl/xc_domain.c > @@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch, > return do_domctl(xch, &domctl); > } > > +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid, > + struct xen_mem_region mem_regions[], > + uint32_t *nr_regions) > +{ > + int rc; > + struct xen_domctl domctl = { > + .cmd = XEN_DOMCTL_get_mem_map, > + .domain = domid, > + .u.mem_map = { > + .nr_mem_regions = *nr_regions, > + .pad = 0, This isn't needed: By there being an initializer for the struct, all unmentioned fields will be set to 0 anyway. > --- a/xen/arch/arm/domain.c > +++ b/xen/arch/arm/domain.c > @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d, > { > unsigned int count = 0; > int rc; > + struct mem_map_domain *mem_map = &d->arch.mem_map; > > BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS); > > @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d, > d->arch.sve_vl = config->arch.sve_vl; > #endif > > + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS ) > + { > + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE; > + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE; > + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC; > + mem_map->nr_mem_regions++; > + } > + else > + { > + printk("Exceed max number of supported memory map regions\n"); Debugging leftover? > --- a/xen/arch/arm/domctl.c > +++ b/xen/arch/arm/domctl.c > @@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, > > return 0; > } > - > case XEN_DOMCTL_vuart_op: > { > int rc; Why? Instead you want ... > @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, > > return rc; > } > + case XEN_DOMCTL_get_mem_map: ... separating blank line above this line and ... > + { > + int rc = 0; > + uint32_t nr_regions, i; > + > + if ( domctl->u.mem_map.pad ) > + return -EINVAL; > + > + /* > + * Cap the number of regions to the minimum value between toolstack and > + * hypervisor to avoid overflowing the buffer. > + */ > + nr_regions = min(d->arch.mem_map.nr_mem_regions, > + domctl->u.mem_map.nr_mem_regions); > + > + domctl->u.mem_map.nr_mem_regions = nr_regions; > + > + for ( i = 0; i < nr_regions; i++ ) > + { > + if ( d->arch.mem_map.regions[i].pad ) > + return -EINVAL; > + } > + > + if ( copy_to_guest(domctl->u.mem_map.buffer, > + d->arch.mem_map.regions, > + nr_regions) || > + __copy_to_guest(u_domctl, domctl, 1) ) > + rc = -EFAULT; > + > + return rc; > + } > default: ... this one. Further with the way you use min() above, how is the caller going to know whether it simply specified too small an array? And then you check d->arch.mem_map.regions[i].pad. Why's that? And even if needed here for some reason, that's surely not EINVAL, but an internal error in Xen. Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(), for just nr_regions? > --- a/xen/include/public/domctl.h > +++ b/xen/include/public/domctl.h > @@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool { > uint64_aligned_t size; /* Size in bytes. */ > }; > > +#ifndef XEN_MAX_MEM_REGIONS > +#define XEN_MAX_MEM_REGIONS 1 > +#endif > + > +struct xen_mem_region { > + uint64_aligned_t start; > + uint64_aligned_t size; > + uint32_t type; What is this field set to? I see no #define(s) in this header. If it's the GUEST_MEM_REGION_* in the Arm header, a connection needs to be made. Also note that GUEST_MEM_REGION_* violate name space requirements: New additions should have XEN_ / xen_ prefixes on their names. > + /* Must be zero */ > + uint32_t pad; This, being OUT only, should not be required to be set by the caller. As long as no use appears, Xen merely ought to guarantee that it'll be 0 upon return. Jan
Hi Jan, On 4/4/2024 5:28 PM, Jan Beulich wrote: > On 03.04.2024 10:16, Henry Wang wrote: >> --- a/tools/libs/ctrl/xc_domain.c >> +++ b/tools/libs/ctrl/xc_domain.c >> @@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch, >> return do_domctl(xch, &domctl); >> } >> >> +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid, >> + struct xen_mem_region mem_regions[], >> + uint32_t *nr_regions) >> +{ >> + int rc; >> + struct xen_domctl domctl = { >> + .cmd = XEN_DOMCTL_get_mem_map, >> + .domain = domid, >> + .u.mem_map = { >> + .nr_mem_regions = *nr_regions, >> + .pad = 0, > This isn't needed: By there being an initializer for the struct, all > unmentioned fields will be set to 0 anyway. Ok, I can drop the initialization of the .pad field. >> --- a/xen/arch/arm/domain.c >> +++ b/xen/arch/arm/domain.c >> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d, >> { >> unsigned int count = 0; >> int rc; >> + struct mem_map_domain *mem_map = &d->arch.mem_map; >> >> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS); >> >> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d, >> d->arch.sve_vl = config->arch.sve_vl; >> #endif >> >> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS ) >> + { >> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE; >> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE; >> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC; >> + mem_map->nr_mem_regions++; >> + } >> + else >> + { >> + printk("Exceed max number of supported memory map regions\n"); > Debugging leftover? Well, not really, I did this on purpose to print some info before exit. But now I realize other error paths in arch_domain_create() do not do that. I will drop this printk in v4. >> --- a/xen/arch/arm/domctl.c >> +++ b/xen/arch/arm/domctl.c >> @@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, >> >> return 0; >> } >> - >> case XEN_DOMCTL_vuart_op: >> { >> int rc; > Why? Instead you want ... Because there are no empty line between the other sub-ops in the arm version of arch_do_domctl(). Since there is no explicit guideline in CODING_STYLE, I was trying to take the opportunity to keep the coding style consistent within the file. However since you are asking, I realized that the x86 arch_do_domctl() is using the other way, i.e adding an empty line between the sub-ops, so... >> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, >> >> return rc; >> } >> + case XEN_DOMCTL_get_mem_map: > ... separating blank line above this line and ... > >> + { >> + int rc = 0; >> + uint32_t nr_regions, i; >> + >> + if ( domctl->u.mem_map.pad ) >> + return -EINVAL; >> + >> + /* >> + * Cap the number of regions to the minimum value between toolstack and >> + * hypervisor to avoid overflowing the buffer. >> + */ >> + nr_regions = min(d->arch.mem_map.nr_mem_regions, >> + domctl->u.mem_map.nr_mem_regions); >> + >> + domctl->u.mem_map.nr_mem_regions = nr_regions; >> + >> + for ( i = 0; i < nr_regions; i++ ) >> + { >> + if ( d->arch.mem_map.regions[i].pad ) >> + return -EINVAL; >> + } >> + >> + if ( copy_to_guest(domctl->u.mem_map.buffer, >> + d->arch.mem_map.regions, >> + nr_regions) || >> + __copy_to_guest(u_domctl, domctl, 1) ) >> + rc = -EFAULT; >> + >> + return rc; >> + } >> default: > ... this one. ...personally I don't have strong opinions on the style as long as we keep consistent. I can switch the Arm one following the x86 style or just leave it as is. > Further with the way you use min() above, how is the caller going to know > whether it simply specified too small an array? I am a bit unsure if we need to forbid caller to specify a smaller value than the max number of regions supported by the hypervisor, technically it is legal, although I agree it will lead to some issues in the toolstack side. It looks like the similar hypercall of e820 also does not forbid this (see get_mem_mapping_layout() and related XENMEM_memory_map). Do you have any suggestions? > And then you check d->arch.mem_map.regions[i].pad. Why's that? And even > if needed here for some reason, that's surely not EINVAL, but an internal > error in Xen. I did that under the impression that we need to check the value of padding field being 0. Also you mentioned in one of the comments below that Xen should guarantee that the padding field should be 0 before return. Apologize if I misunderstand your comment. The -EINVAL is taken from the same way of checking the padding field in XEN_DOMCTL_vuart_op above. Personally I would keep some consistency, but I am open to suggestions to make it better. > Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(), > for just nr_regions? You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the __copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I can do that in v4. >> --- a/xen/include/public/domctl.h >> +++ b/xen/include/public/domctl.h >> @@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool { >> uint64_aligned_t size; /* Size in bytes. */ >> }; >> >> +#ifndef XEN_MAX_MEM_REGIONS >> +#define XEN_MAX_MEM_REGIONS 1 >> +#endif >> + >> +struct xen_mem_region { >> + uint64_aligned_t start; >> + uint64_aligned_t size; >> + uint32_t type; > What is this field set to? I see no #define(s) in this header. If it's > the GUEST_MEM_REGION_* in the Arm header, a connection needs to be made. > Also note that GUEST_MEM_REGION_* violate name space requirements: New > additions should have XEN_ / xen_ prefixes on their names. Yeah it is the GUEST_MEM_REGION_* in the Arm header. The default value will be set to 0 when struct domain is created. I will switch to the XEN_* prefix in v4. >> + /* Must be zero */ >> + uint32_t pad; > This, being OUT only, should not be required to be set by the caller. As > long as no use appears, Xen merely ought to guarantee that it'll be 0 upon > return. See above. Kind regards, Henry > Jan
On 08.04.2024 05:08, Henry Wang wrote: > On 4/4/2024 5:28 PM, Jan Beulich wrote: >> On 03.04.2024 10:16, Henry Wang wrote: >>> --- a/xen/arch/arm/domain.c >>> +++ b/xen/arch/arm/domain.c >>> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d, >>> { >>> unsigned int count = 0; >>> int rc; >>> + struct mem_map_domain *mem_map = &d->arch.mem_map; >>> >>> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS); >>> >>> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d, >>> d->arch.sve_vl = config->arch.sve_vl; >>> #endif >>> >>> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS ) >>> + { >>> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE; >>> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE; >>> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC; >>> + mem_map->nr_mem_regions++; >>> + } >>> + else >>> + { >>> + printk("Exceed max number of supported memory map regions\n"); >> Debugging leftover? > > Well, not really, I did this on purpose to print some info before exit. > But now I realize other error paths in arch_domain_create() do not do > that. I will drop this printk in v4. > >>> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, >>> >>> return rc; >>> } >>> + case XEN_DOMCTL_get_mem_map: >> ... separating blank line above this line and ... >> >>> + { >>> + int rc = 0; >>> + uint32_t nr_regions, i; >>> + >>> + if ( domctl->u.mem_map.pad ) >>> + return -EINVAL; >>> + >>> + /* >>> + * Cap the number of regions to the minimum value between toolstack and >>> + * hypervisor to avoid overflowing the buffer. >>> + */ >>> + nr_regions = min(d->arch.mem_map.nr_mem_regions, >>> + domctl->u.mem_map.nr_mem_regions); >>> + >>> + domctl->u.mem_map.nr_mem_regions = nr_regions; >>> + >>> + for ( i = 0; i < nr_regions; i++ ) >>> + { >>> + if ( d->arch.mem_map.regions[i].pad ) >>> + return -EINVAL; >>> + } >>> + >>> + if ( copy_to_guest(domctl->u.mem_map.buffer, >>> + d->arch.mem_map.regions, >>> + nr_regions) || >>> + __copy_to_guest(u_domctl, domctl, 1) ) >>> + rc = -EFAULT; >>> + >>> + return rc; >>> + } >>> default: >> ... this one. > > ...personally I don't have strong opinions on the style as long as we > keep consistent. I can switch the Arm one following the x86 style or > just leave it as is. > >> Further with the way you use min() above, how is the caller going to know >> whether it simply specified too small an array? > > I am a bit unsure if we need to forbid caller to specify a smaller value > than the max number of regions supported by the hypervisor, technically > it is legal, although I agree it will lead to some issues in the > toolstack side. It looks like the similar hypercall of e820 also does > not forbid this (see get_mem_mapping_layout() and related > XENMEM_memory_map). Do you have any suggestions? Fill only as much of the array as there is space for, but return the full count to the caller. Another option (less desirable imo) would be to return -ENOBUFS. If to be written anew now, I'd likely code XENMEM_memory_map handling that way, too. But that's too late now. >> And then you check d->arch.mem_map.regions[i].pad. Why's that? And even >> if needed here for some reason, that's surely not EINVAL, but an internal >> error in Xen. > > I did that under the impression that we need to check the value of > padding field being 0. Also you mentioned in one of the comments below > that Xen should guarantee that the padding field should be 0 before > return. Apologize if I misunderstand your comment. The -EINVAL is taken > from the same way of checking the padding field in XEN_DOMCTL_vuart_op > above. Personally I would keep some consistency, but I am open to > suggestions to make it better. In XEN_DOMCTL_vuart_op it is caller input which is being checked (and needs checking). You're checking internal Xen state here instead. Considering the nature of the issue arising if the assumption was broken, ASSERT() would seem to be the construct to use for the internal state check. >> Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(), >> for just nr_regions? > > You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the > __copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I > can do that in v4. Yes (unless there are technical reasons not to, of course). Jan
Hi Jan, On 4/8/2024 2:19 PM, Jan Beulich wrote: > On 08.04.2024 05:08, Henry Wang wrote: >> On 4/4/2024 5:28 PM, Jan Beulich wrote: >>> On 03.04.2024 10:16, Henry Wang wrote: >>>> --- a/xen/arch/arm/domain.c >>>> +++ b/xen/arch/arm/domain.c >>>> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d, >>>> { >>>> unsigned int count = 0; >>>> int rc; >>>> + struct mem_map_domain *mem_map = &d->arch.mem_map; >>>> >>>> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS); >>>> >>>> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d, >>>> d->arch.sve_vl = config->arch.sve_vl; >>>> #endif >>>> >>>> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS ) >>>> + { >>>> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE; >>>> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE; >>>> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC; >>>> + mem_map->nr_mem_regions++; >>>> + } >>>> + else >>>> + { >>>> + printk("Exceed max number of supported memory map regions\n"); >>> Debugging leftover? >> Well, not really, I did this on purpose to print some info before exit. >> But now I realize other error paths in arch_domain_create() do not do >> that. I will drop this printk in v4. >> >>>> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, >>>> >>>> return rc; >>>> } >>>> + case XEN_DOMCTL_get_mem_map: >>> ... separating blank line above this line and ... >>> >>>> + { >>>> + int rc = 0; >>>> + uint32_t nr_regions, i; >>>> + >>>> + if ( domctl->u.mem_map.pad ) >>>> + return -EINVAL; >>>> + >>>> + /* >>>> + * Cap the number of regions to the minimum value between toolstack and >>>> + * hypervisor to avoid overflowing the buffer. >>>> + */ >>>> + nr_regions = min(d->arch.mem_map.nr_mem_regions, >>>> + domctl->u.mem_map.nr_mem_regions); >>>> + >>>> + domctl->u.mem_map.nr_mem_regions = nr_regions; >>>> + >>>> + for ( i = 0; i < nr_regions; i++ ) >>>> + { >>>> + if ( d->arch.mem_map.regions[i].pad ) >>>> + return -EINVAL; >>>> + } >>>> + >>>> + if ( copy_to_guest(domctl->u.mem_map.buffer, >>>> + d->arch.mem_map.regions, >>>> + nr_regions) || >>>> + __copy_to_guest(u_domctl, domctl, 1) ) >>>> + rc = -EFAULT; >>>> + >>>> + return rc; >>>> + } >>>> default: >>> ... this one. >> ...personally I don't have strong opinions on the style as long as we >> keep consistent. I can switch the Arm one following the x86 style or >> just leave it as is. >> >>> Further with the way you use min() above, how is the caller going to know >>> whether it simply specified too small an array? >> I am a bit unsure if we need to forbid caller to specify a smaller value >> than the max number of regions supported by the hypervisor, technically >> it is legal, although I agree it will lead to some issues in the >> toolstack side. It looks like the similar hypercall of e820 also does >> not forbid this (see get_mem_mapping_layout() and related >> XENMEM_memory_map). Do you have any suggestions? > Fill only as much of the array as there is space for, but return the full > count to the caller. Another option (less desirable imo) would be to return > -ENOBUFS. If to be written anew now, I'd likely code XENMEM_memory_map > handling that way, too. But that's too late now. Thanks for the input! Sure I will follow the suggestion in v4. >>> And then you check d->arch.mem_map.regions[i].pad. Why's that? And even >>> if needed here for some reason, that's surely not EINVAL, but an internal >>> error in Xen. >> I did that under the impression that we need to check the value of >> padding field being 0. Also you mentioned in one of the comments below >> that Xen should guarantee that the padding field should be 0 before >> return. Apologize if I misunderstand your comment. The -EINVAL is taken >> from the same way of checking the padding field in XEN_DOMCTL_vuart_op >> above. Personally I would keep some consistency, but I am open to >> suggestions to make it better. > In XEN_DOMCTL_vuart_op it is caller input which is being checked (and > needs checking). You're checking internal Xen state here instead. > Considering the nature of the issue arising if the assumption was broken, > ASSERT() would seem to be the construct to use for the internal state > check. You are right, I will drop the Xen internal state check here. >>> Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(), >>> for just nr_regions? >> You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the >> __copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I >> can do that in v4. > Yes (unless there are technical reasons not to, of course). Thanks for confirming, I will do this way. Kind regards, Henry > Jan
diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h index 2ef8b4e054..b25e9772a2 100644 --- a/tools/include/xenctrl.h +++ b/tools/include/xenctrl.h @@ -1195,6 +1195,10 @@ int xc_domain_setmaxmem(xc_interface *xch, uint32_t domid, uint64_t max_memkb); +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid, + struct xen_mem_region mem_regions[], + uint32_t *nr_regions); + int xc_domain_set_memmap_limit(xc_interface *xch, uint32_t domid, unsigned long map_limitkb); diff --git a/tools/libs/ctrl/xc_domain.c b/tools/libs/ctrl/xc_domain.c index f2d9d14b4d..8363657dae 100644 --- a/tools/libs/ctrl/xc_domain.c +++ b/tools/libs/ctrl/xc_domain.c @@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch, return do_domctl(xch, &domctl); } +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid, + struct xen_mem_region mem_regions[], + uint32_t *nr_regions) +{ + int rc; + struct xen_domctl domctl = { + .cmd = XEN_DOMCTL_get_mem_map, + .domain = domid, + .u.mem_map = { + .nr_mem_regions = *nr_regions, + .pad = 0, + }, + }; + + DECLARE_HYPERCALL_BOUNCE(mem_regions, + sizeof(xen_mem_region_t) * (*nr_regions), + XC_HYPERCALL_BUFFER_BOUNCE_OUT); + + if ( !mem_regions || xc_hypercall_bounce_pre(xch, mem_regions) || + (*nr_regions) < 1 ) + return -1; + + set_xen_guest_handle(domctl.u.mem_map.buffer, mem_regions); + + rc = do_domctl(xch, &domctl); + + xc_hypercall_bounce_post(xch, mem_regions); + + *nr_regions = domctl.u.mem_map.nr_mem_regions; + + return rc; +} + #if defined(__i386__) || defined(__x86_64__) int xc_domain_set_memory_map(xc_interface *xch, uint32_t domid, diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c index f38cb5e04c..e77d157626 100644 --- a/xen/arch/arm/domain.c +++ b/xen/arch/arm/domain.c @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d, { unsigned int count = 0; int rc; + struct mem_map_domain *mem_map = &d->arch.mem_map; BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS); @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d, d->arch.sve_vl = config->arch.sve_vl; #endif + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS ) + { + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE; + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE; + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC; + mem_map->nr_mem_regions++; + } + else + { + printk("Exceed max number of supported memory map regions\n"); + rc = -ENOSPC; + goto fail; + } + return 0; fail: diff --git a/xen/arch/arm/domctl.c b/xen/arch/arm/domctl.c index ad56efb0f5..ede19d80a3 100644 --- a/xen/arch/arm/domctl.c +++ b/xen/arch/arm/domctl.c @@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, return 0; } - case XEN_DOMCTL_vuart_op: { int rc; @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d, return rc; } + case XEN_DOMCTL_get_mem_map: + { + int rc = 0; + uint32_t nr_regions, i; + + if ( domctl->u.mem_map.pad ) + return -EINVAL; + + /* + * Cap the number of regions to the minimum value between toolstack and + * hypervisor to avoid overflowing the buffer. + */ + nr_regions = min(d->arch.mem_map.nr_mem_regions, + domctl->u.mem_map.nr_mem_regions); + + domctl->u.mem_map.nr_mem_regions = nr_regions; + + for ( i = 0; i < nr_regions; i++ ) + { + if ( d->arch.mem_map.regions[i].pad ) + return -EINVAL; + } + + if ( copy_to_guest(domctl->u.mem_map.buffer, + d->arch.mem_map.regions, + nr_regions) || + __copy_to_guest(u_domctl, domctl, 1) ) + rc = -EFAULT; + + return rc; + } default: return subarch_do_domctl(domctl, d, u_domctl); } diff --git a/xen/arch/arm/include/asm/domain.h b/xen/arch/arm/include/asm/domain.h index f1d72c6e48..a559a9e499 100644 --- a/xen/arch/arm/include/asm/domain.h +++ b/xen/arch/arm/include/asm/domain.h @@ -10,6 +10,7 @@ #include <asm/gic.h> #include <asm/vgic.h> #include <asm/vpl011.h> +#include <public/domctl.h> #include <public/hvm/params.h> struct hvm_domain @@ -59,6 +60,11 @@ struct paging_domain { unsigned long p2m_total_pages; }; +struct mem_map_domain { + unsigned int nr_mem_regions; + struct xen_mem_region regions[XEN_MAX_MEM_REGIONS]; +}; + struct arch_domain { #ifdef CONFIG_ARM_64 @@ -77,6 +83,8 @@ struct arch_domain struct paging_domain paging; + struct mem_map_domain mem_map; + struct vmmio vmmio; /* Continuable domain_relinquish_resources(). */ diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h index a25e87dbda..cd47ae9d74 100644 --- a/xen/include/public/arch-arm.h +++ b/xen/include/public/arch-arm.h @@ -223,6 +223,13 @@ typedef uint64_t xen_pfn_t; */ #define XEN_LEGACY_MAX_VCPUS 1 +/* + * Maximum number of memory map regions for guest memory layout. + * Used by XEN_DOMCTL_get_mem_map, currently there is only one region + * for the guest magic pages. + */ +#define XEN_MAX_MEM_REGIONS 1 + typedef uint64_t xen_ulong_t; #define PRI_xen_ulong PRIx64 @@ -420,6 +427,10 @@ typedef uint64_t xen_callback_t; * should instead use the FDT. */ +/* Guest memory region types */ +#define GUEST_MEM_REGION_DEFAULT 0 +#define GUEST_MEM_REGION_MAGIC 1 + /* Physical Address Space */ /* Virtio MMIO mappings */ diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h index a33f9ec32b..f0a0a9b58f 100644 --- a/xen/include/public/domctl.h +++ b/xen/include/public/domctl.h @@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool { uint64_aligned_t size; /* Size in bytes. */ }; +#ifndef XEN_MAX_MEM_REGIONS +#define XEN_MAX_MEM_REGIONS 1 +#endif + +struct xen_mem_region { + uint64_aligned_t start; + uint64_aligned_t size; + uint32_t type; + /* Must be zero */ + uint32_t pad; +}; +typedef struct xen_mem_region xen_mem_region_t; +DEFINE_XEN_GUEST_HANDLE(xen_mem_region_t); + +struct xen_domctl_mem_map { + /* IN & OUT */ + uint32_t nr_mem_regions; + /* Must be zero */ + uint32_t pad; + /* OUT */ + XEN_GUEST_HANDLE_64(xen_mem_region_t) buffer; +}; +typedef struct xen_domctl_mem_map xen_domctl_mem_map_t; +DEFINE_XEN_GUEST_HANDLE(xen_domctl_mem_map_t); + #if defined(__i386__) || defined(__x86_64__) struct xen_domctl_vcpu_msr { uint32_t index; @@ -1277,6 +1302,7 @@ struct xen_domctl { #define XEN_DOMCTL_vmtrace_op 84 #define XEN_DOMCTL_get_paging_mempool_size 85 #define XEN_DOMCTL_set_paging_mempool_size 86 +#define XEN_DOMCTL_get_mem_map 87 #define XEN_DOMCTL_gdbsx_guestmemio 1000 #define XEN_DOMCTL_gdbsx_pausevcpu 1001 #define XEN_DOMCTL_gdbsx_unpausevcpu 1002 @@ -1339,6 +1365,7 @@ struct xen_domctl { struct xen_domctl_vuart_op vuart_op; struct xen_domctl_vmtrace_op vmtrace_op; struct xen_domctl_paging_mempool paging_mempool; + struct xen_domctl_mem_map mem_map; uint8_t pad[128]; } u; };
There are some use cases where the toolstack needs to know the guest memory map. For example, the toolstack helper application "init-dom0less" needs to know the guest magic page regions for 1:1 direct-mapped dom0less DomUs to allocate magic pages. To address such needs, add XEN_DOMCTL_get_mem_map hypercall and related data structures to query the hypervisor for the guest memory map. The guest memory map is recorded in the domain structure and currently only guest magic page region is recorded in the guest memory map. The guest magic page region is initialized at the domain creation time as the layout in the public header, and it is updated for 1:1 dom0less DomUs (see the following commit) to avoid conflict with RAM. Take the opportunity to drop an unnecessary empty line to keep the coding style consistent in the file. Reported-by: Alec Kwapis <alec.kwapis@medtronic.com> Signed-off-by: Henry Wang <xin.wang2@amd.com> --- RFC: I think the newly introduced "struct xen_domctl_mem_map" is quite duplicated with "struct xen_memory_map", any comment on reuse the "struct xen_memory_map" for simplicity? v3: - Init the return rc for XEN_DOMCTL_get_mem_map. - Copy the nr_mem_regions back as it should be both IN & OUT. - Check if mem_map->nr_mem_regions exceeds the XEN_MAX_MEM_REGIONS when adding a new entry. - Allow XEN_MAX_MEM_REGIONS to be different between different archs. - Add explicit padding and check to the domctl structures. v2: - New patch --- tools/include/xenctrl.h | 4 ++++ tools/libs/ctrl/xc_domain.c | 33 +++++++++++++++++++++++++++++++ xen/arch/arm/domain.c | 15 ++++++++++++++ xen/arch/arm/domctl.c | 32 +++++++++++++++++++++++++++++- xen/arch/arm/include/asm/domain.h | 8 ++++++++ xen/include/public/arch-arm.h | 11 +++++++++++ xen/include/public/domctl.h | 27 +++++++++++++++++++++++++ 7 files changed, 129 insertions(+), 1 deletion(-)