summaryrefslogtreecommitdiff
path: root/xen/arch/x86/include
Commit message (Collapse)AuthorAgeFilesLines
* x86: Add support for CpuidUserDisAlejandro Vallejo2023-05-161-0/+1
| | | | | | | | Because CpuIdUserDis is reported in CPUID itself, the extended leaf containing that bit must be retrieved before calling c_early_init() Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Add AMD's CpuidUserDis bit definitionsAlejandro Vallejo2023-05-111-0/+1
| | | | | | | | | | AMD reports support for CpuidUserDis in CPUID and provides the toggle in HWCR. This patch adds the positions of both of those bits to both xen and tools. No functional change. Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/ucode: Refresh raw CPU policy after microcode loadAndrew Cooper2023-05-101-0/+6
| | | | | | | | | | | | | | | | | | Loading microcode can cause new features to appear. This has happened routinely since Spectre/Meltdown, and even the presence of new status bits can sometimes mean the administrator has no further actions to perform. Conversely, loading microcode can occasionally cause features to disappear. As with livepatching, it is very much the administrators responsibility to confirm that a late microcode load is safe on the intended system before rolling it out in production. Refresh the raw CPU policy after late microcode load appears to have done something, so xen-cpuid can reflect the updated state of the system. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Roger Pau Monné <roger.pau@citrix.com>
* x86/mm: drop log-dirty-enable's log_global parameterJan Beulich2023-05-021-1/+1
| | | | | | | | | As of XSA-397 the only caller passes true for it. Simplify things by getting rid of the parameter for both the internal paging function and the involved hook. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86: detect CMOS aliasing on ports other than 0x70/0x71Jan Beulich2023-04-251-0/+4
| | | | | | | | | | | | | | | | | ... in order to also intercept Dom0 accesses through the alias ports. Also stop intercepting accesses to the CMOS ports if we won't ourselves use the CMOS RTC, because of there being none. This doesn't go as far as covering port 0x70, as that also has the NMI disable bit, which we don't want to permit Dom0 to set. Note that rtc_init() deliberately uses 16 as the upper loop bound, despite probe_cmos_alias() using 8: The higher bound is benign now, but would save us touching the code (or, worse, missing to touch it) in case the lower one was doubled. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
* x86: cpu{id,}_policy_updated() can be staticJan Beulich2023-04-191-2/+0
| | | | | | | | | The function merely needs moving earlier in the file to avoid the need for a forward declaration. While moving it, also rename it following the recent folding of CPUID and MSR policies. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Roger Pau Monné <roger.pau@citrix.com>
* x86emul: support AVX-NE-CONVERT insnsJan Beulich2023-04-171-0/+1
| | | | | | | | Matching what was done earlier, explicit tests are added only for irregular insn / memory access patterns. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86emul: support AVX-VNNI-INT8Jan Beulich2023-04-171-0/+3
| | | | | | | | | | | | | | | These are close relatives of the AVX-VNNI ISA extension. Since the insns here and in particular their memory access patterns follow the usual scheme (and especially the byte variants of AVX-VNNI), I didn't think it was necessary to add a contrived test specifically for them. While making the addition also re-wire AVX-VNNI's handling to simd_0f_ymm: There's no reason to check the AVX feature alongside the one actually of interest (there are a few features where two checks are actually necessary, e.g. GFNI+AVX, but this isn't the case here). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86emul: support AVX-IFMA insnsJan Beulich2023-04-171-0/+1
| | | | | | | | | | As in a few cases before (in particular: AVX512_IFMA), since the insns here and in particular their memory access patterns follow the usual scheme, I didn't think it was necessary to add a contrived test specifically for them. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
* xen/x86: Replace GPL v2.0+ license boilerplate with an SPDX tag in *.hJulien Grall2023-04-1113-169/+13
| | | | | | | | | | | | | | | | | | | | | | | | It is easier to understand the license of a file when using SPDX. This is replacing the below pattern with the SPDX tag GPL-2.0-or-later in xen/arch/x86/*.h: * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; If not, see <http://www.gnu.org/licenses/>. Signed-off-by: Julien Grall <jgrall@amazon.com> Acked-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Jan Beulich <jbeulich@suse.com>
* xen/x86: Replace GPL v2.0 license boilerplate with an SPDX tag in *.h (part 3)Julien Grall2023-04-1113-156/+13
| | | | | | | | | | | | | | | | | | | | | | | It is easier to understand the license of a file when using SPDX. This is replacing the below pattern with the SPDX tag GPL-2.0-only in xen/arch/x86/*.h: * This program is free software; you can redistribute it and/or * modify it under the terms and conditions of the GNU General Public * License, version 2, as published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public * License along with this program; If not, see <http://www.gnu.org/licenses/>. Signed-off-by: Julien Grall <jgrall@amazon.com> Acked-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Jan Beulich <jbeulich@suse.com>
* xen/x86: Replace GPL v2.0 license boilerplate with an SPDX tag in *.hJulien Grall2023-04-1126-313/+26
| | | | | | | | | | | | | | | | | | | | | | | It is easier to understand the license of a file when using SPDX. This is replacing the below pattern with the SPDX tag GPL-2.0-only in xen/arch/x86/*.h: * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, * version 2, as published by the Free Software Foundation. * * This program is distributed in the hope it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for * more details. * * You should have received a copy of the GNU General Public License along with * this program; If not, see <http://www.gnu.org/licenses/>. Signed-off-by: Julien Grall <jgrall@amazon.com> Acked-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Jan Beulich <jbeulich@suse.com>
* x86/svm: Provide EXITINFO decodes for Exceptions/NPF interceptsAndrew Cooper2023-04-061-0/+10
| | | | | | | | | | | | | | | | | | Exceptions and NPF intercepts almost have the same layout, but NPF has bits above 31 in the error code, and the name for exitinfo2 really does want distinguishing between cr2 and gpa. In nsvm_vcpu_vmexit_inject() rearrange VMEXIT_NPF to fall through instead of repeating the exitinfo1 write. Use the fallthrough pseudo keyword instead of a comment. In VMEXIT_NPF, as we're editing the printk() anyway, switch to using the newer domain_crash() form. No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/svm: Provide EXITINFO decodes for MOV CR interceptsAndrew Cooper2023-04-061-0/+5
| | | | | | | | | This removes raw number manipulation, and makes the logic easier to follow. No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/treewide: Drop the TRAP_* legacy namesAndrew Cooper2023-04-054-41/+15
| | | | | | | | | | | | We have two naming schemes for exceptions; X86_EXC_?? which use the archtiectural abbreviations, and TRAP_* which is a mix of terminology and nonstandard abbrevations. Switch to X86_EXC_* uniformly. No funcational change, confirmed by diffing the disassembly. Only 7 binary changes, and they're all __LINE__ being passed into printk(). Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Remove temporary {cpuid,msr}_policy definesAndrew Cooper2023-04-051-1/+1
| | | | | | | | | | With all code areas updated, drop the temporary defines and adjust all remaining users. No practical change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com>
* x86/boot: Merge CPUID policy initialisation logic into cpu-policy.cAndrew Cooper2023-04-052-10/+7
| | | | | | | | | | Switch to the newer cpu_policy nomenclature. Do some easy cleanup of includes. No practical change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com>
* x86/boot: Move MSR policy initialisation logic into cpu-policy.cAndrew Cooper2023-04-052-1/+3
| | | | | | | | | Switch to the newer cpu_policy nomenclature. No practical change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com>
* x86: Merge a domain's {cpuid,msr} policy objectsAndrew Cooper2023-04-054-7/+14
| | | | | | | | | | | | | | | | Right now, they're the same underlying type, containing disjoint information. Drop the d->arch.msr pointer, and union d->arch.cpuid to give it a second name of cpu_policy in the interim. Merge init_domain_{cpuid,msr}_policy() into a single init_domain_cpu_policy(), moving the implementation into cpu-policy.c No practical change. This undoes the transient doubling of storage space from earlier patches. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Merge the system {cpuid,msr} policy objectsAndrew Cooper2023-04-053-13/+14
| | | | | | | | | | | | | | | | | | | | Right now, they're the same underlying type, containing disjoint information. Introduce a new cpu-policy.{h,c} to be the new location for all policy handling logic. Place the combined objects in __ro_after_init, which is new since the original logic was written. As we're trying to phase out the use of struct old_cpu_policy entirely, rework update_domain_cpu_policy() to not pointer-chase through system_policies[]. This in turn allows system_policies[] in sysctl.c to become static and reduced in scope to XEN_SYSCTL_get_cpu_policy. No practical change. This undoes the transient doubling of storage space from earlier patches. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Merge struct msr_policy into struct cpu_policyAndrew Cooper2023-04-051-1/+2
| | | | | | | | | | | | | As with the cpuid side, use a temporary define to make struct msr_policy still work. Note, this means that domains now have two separate struct cpu_policy allocations with disjoint information, and system policies are in a similar position, as well as xc_cpu_policy objects in libxenguest. All of these duplications will be addressed in the following patches. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Rename struct cpuid_policy to struct cpu_policyAndrew Cooper2023-04-051-1/+0
| | | | | | | | | | | | | | | Also merge lib/x86/cpuid.h entirely into lib/x86/cpu-policy.h Use a temporary define to make struct cpuid_policy still work. There's one forward declaration of struct cpuid_policy in tools/tests/x86_emulator/x86-emulate.h that isn't covered by the define, and it's easier to rename that now than to rearrange the includes. No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86: Rename struct cpu_policy to struct old_cpuid_policyAndrew Cooper2023-04-051-1/+1
| | | | | | | | | | | | | | We want to merge struct cpuid_policy and struct msr_policy together, and the result wants to be called struct cpu_policy. The current struct cpu_policy, being a pair of pointers, isn't terribly useful. Rename the type to struct old_cpu_policy, but it will disappear entirely once the merge is complete. No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* xen/x86: switch to use generic implemetation of bug.hOleksii Kurochko2023-04-031-66/+21
| | | | | | | | | | | | The following changes were made: * Make GENERIC_BUG_FRAME mandatory for X86 * Update asm/bug.h using generic implementation in <xen/bug.h> * Update do_invalid_op using generic do_bug_frame() * Define BUG_DEBUGGER_TRAP_FATAL to debugger_trap_fatal(X86_EXC_GP,regs) * type of eip variable was changed to 'const void *' Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* xen: change <asm/bug.h> to <xen/bug.h>Oleksii Kurochko2023-04-032-18/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The idea of the patch is to change all <asm/bug.h> to <xen/bug.h> and keep Xen compilable with adding only minimal amount of changes: 1. It was added "#include <xen/types.h>" to ARM's "<asm/bug.h>" as it uses uint_{16,32}t in 'struct bug_frame'. 2. It was added '#define BUG_FRAME_STRUCT' which means that ARM hasn't been switched to generic implementation yet. 3. It was added '#define BUG_FRAME_STRUCT' which means that x86 hasn't been switched to generic implementation yet. 4. BUGFRAME_* and _start_bug_frame[], _stop_bug_frame_*[] were removed for ARM & x86 to deal with compilation errors such as: redundant redeclaration of ... 5. Remove BUG_DISP_WIDTH, BUG_LINE_LO_WIDTH, BUG_LINE_HI_WIDTH from x86's <asm.bug.h> to not to produce #undef for them and #define again with the same values as in <xen/bug.h>. These #undef and #define will be anyway removed in the patch [2] 6. Remove <asm/bug.h> from <x86/acpi/cpufreq/cpufreq.c> and <drivers/cpufreq/cpufreq.c> as nothing from <xen/bug.h> are used in <*/cpufreq.c> In the following two patches x86 and ARM archictectures will be switched fully: [1] xen/arm: switch ARM to use generic implementation of bug.h [2] xen/x86: switch x86 to use generic implemetation of bug.h Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Julien Grall <jgrall@amazon.com>
* x86/monitor: add new monitor event to catch I/O instructionsDmitry Isaykin2023-03-283-1/+6
| | | | | | | | | | | Adds monitor support for I/O instructions. Signed-off-by: Dmitry Isaykin <isaikin-dmitry@yandex.ru> Signed-off-by: Anton Belousov <abelousov@ptsecurity.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Acked-by: Tamas K Lengyel <tamas@tklengyel.com>
* xen/trace: Minor code cleanupAndrew Cooper2023-03-241-1/+1
| | | | | | | | | * Delete trailing whitespace * Replace an opencoded DIV_ROUND_UP() * Drop bogus smp_rmb() - spin_lock_irqsave() has full smp_mb() semantics. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/shadow: Fix build with no PG_log_dirtyAndrew Cooper2023-03-241-4/+4
| | | | | | | | | | | | | | | | | | | Gitlab Randconfig found: arch/x86/mm/shadow/common.c: In function 'shadow_prealloc': arch/x86/mm/shadow/common.c:1023:18: error: implicit declaration of function 'paging_logdirty_levels'; did you mean 'paging_log_dirty_init'? [-Werror=implicit-function-declaration] 1023 | count += paging_logdirty_levels(); | ^~~~~~~~~~~~~~~~~~~~~~ | paging_log_dirty_init arch/x86/mm/shadow/common.c:1023:18: error: nested extern declaration of 'paging_logdirty_levels' [-Werror=nested-externs] The '#if PG_log_dirty' expression is currently SHADOW_PAGING && !HVM && PV_SHIM_EXCLUSIVE. Move the declaration outside. Fixes: 33fb3a661223 ("x86/shadow: account for log-dirty mode when pre-allocating") Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/nospec: Fix evaluate_nospec() code generation under ClangAndrew Cooper2023-03-241-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turns out that evaluate_nospec() code generation is not safe under Clang. Given: void eval_nospec_test(int x) { if ( evaluate_nospec(x) ) asm volatile ("nop #true" ::: "memory"); else asm volatile ("nop #false" ::: "memory"); } Clang emits: <eval_nospec_test>: 0f ae e8 lfence 85 ff test %edi,%edi 74 02 je <eval_nospec_test+0x9> 90 nop c3 ret 90 nop c3 ret which is not safe because the lfence has been hoisted above the conditional jump. Clang concludes that both barrier_nospec_true()'s have identical side effects and can safely be merged. Clang can be persuaded that the side effects are different if there are different comments in the asm blocks. This is fragile, but no more fragile that other aspects of this construct. Introduce barrier_nospec_false() with a separate internal comment to prevent Clang merging it with barrier_nospec_true() despite the otherwise-identical content. The generated code now becomes: <eval_nospec_test>: 85 ff test %edi,%edi 74 05 je <eval_nospec_test+0x9> 0f ae e8 lfence 90 nop c3 ret 0f ae e8 lfence 90 nop c3 ret which has the correct number of lfence's, and in the correct place. Link: https://github.com/llvm/llvm-project/issues/55084 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/shadow: OOS mode is HVM-onlyJan Beulich2023-03-241-3/+1
| | | | | | | | | | | XEN_DOMCTL_CDF_oos_off is forced set for PV domains, so the logic can't ever be engaged for them. Conditionalize respective fields and remove the respective bit from SHADOW_OPTIMIZATIONS when !HVM. As a result the SH_type_oos_snapshot constant can disappear altogether in that case, and a couple of #ifdef-s can also be dropped/combined. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/shadow: purge {write,cmpxchg}_guest_entry() hooksJan Beulich2023-03-242-45/+6
| | | | | | | | | | | | | | | | | | | | | These aren't mode dependent (see 06f04f54ba97 ["x86/shadow: sh_{write,cmpxchg}_guest_entry() are PV-only"], where they were moved out of multi.c) and hence there's no need to have pointers to the functions in struct shadow_paging_mode. Due to include dependencies, however, the "paging" wrappers need to move out of paging.h; they're needed from PV memory management code only anyway, so by moving them their exposure is reduced at the same time. By carefully placing the (moved and renamed) shadow function declarations, #ifdef can also be dropped from the "paging" wrappers (paging_mode_shadow() is constant false when !SHADOW_PAGING). While moving the code, drop the (largely wrong) comment from paging_write_guest_entry() and reduce that of paging_cmpxchg_guest_entry(). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
* move {,vcpu_}show_execution_state() declarations to common headerJan Beulich2023-03-222-3/+0
| | | | | | | | | | These are used from common code, so their signatures should be consistent across architectures. This is achieved / guaranteed easiest when their declarations are in a common header. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Julien Grall <jgrall@amazon.com>
* x86/shadow: account for log-dirty mode when pre-allocatingJan Beulich2023-03-211-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pre-allocation is intended to ensure that in the course of constructing or updating shadows there won't be any risk of just made shadows or shadows being acted upon can disappear under our feet. The amount of pages pre-allocated then, however, needs to account for all possible subsequent allocations. While the use in sh_page_fault() accounts for all shadows which may need making, so far it didn't account for allocations coming from log-dirty tracking (which piggybacks onto the P2M allocation functions). Since shadow_prealloc() takes a count of shadows (or other data structures) rather than a count of pages, putting the adjustment at the call site of this function won't work very well: We simply can't express the correct count that way in all cases. Instead take care of this in the function itself, by "snooping" for L1 type requests. (While not applicable right now, future new request sites of L1 tables would then also be covered right away.) It is relevant to note here that pre-allocations like the one done from shadow_alloc_p2m_page() are benign when they fall in the "scope" of an earlier pre-alloc which already included that count: The inner call will simply find enough pages available then; it'll bail right away. This is CVE-2022-42332 / XSA-427. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org>
* x86/svm: Provide EXITINFO decodes for IO intercetpsAndrew Cooper2023-03-171-0/+14
| | | | | | | | | This removes raw number manipulation, and makes the logic easier to follow. No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/paging: move and conditionalize flush_tlb() hookJan Beulich2023-03-162-7/+11
| | | | | | | | | | | | | | | | | | | The hook isn't mode dependent, hence it's misplaced in struct paging_mode. (Or alternatively I see no reason why the alloc_page() and free_page() hooks don't also live there.) Move it to struct paging_domain. The hook also is used for HVM guests only, so make respective pieces conditional upon CONFIG_HVM. While there also add __must_check to the hook declaration, as it's imperative that callers deal with getting back "false". While moving the shadow implementation, introduce a "curr" local variable. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/paging: move update_paging_modes() hookJan Beulich2023-03-162-2/+3
| | | | | | | | | | The hook isn't mode dependent, hence it's misplaced in struct paging_mode. (Or alternatively I see no reason why the alloc_page() and free_page() hooks don't also live there.) Move it to struct paging_domain. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
* x86/paging: fold most HAP and shadow final teardownJan Beulich2023-03-161-3/+0
| | | | | | | | | | | | | | | HAP does a few things beyond what's common, which are left there at least for now. Common operations, however, are moved to paging_final_teardown(), allowing shadow_final_teardown() to go away. While moving (and hence generalizing) the respective SHADOW_PRINTK() drop the logging of total_pages from the 2nd instance - the value is necessarily zero after {hap,shadow}_set_allocation() - and shorten the messages, in part accounting for PAGING_PRINTK() logging __func__ already. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
* x86: don't include processor.h from system.hJan Beulich2023-03-163-29/+26
| | | | | | | | | | | | processor.h in particular pulls in xen/smp.h, which is overly heavy for a supposedly pretty fundamental header like system.h. To keep things building, move the declarations of struct cpuinfo_x86 and boot_cpu_data to asm/cpufeature.h (which arguably also is where they belong). In the course of the move switch away from using fixed-width types and convert plain "int" to "unsigned int" for the two x86_cache_* fields. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/altp2m: help gcc13 to avoid it emitting a warningJan Beulich2023-03-131-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switches of altp2m-s always expect a valid altp2m to be in place (and indeed altp2m_vcpu_initialise() sets the active one to be at index 0). The compiler, however, cannot know that, and hence it cannot eliminate p2m_get_altp2m()'s case of returnin (literal) NULL. If then the compiler decides to special case that code path in the caller, the dereference in instances of atomic_dec(&p2m_get_altp2m(v)->active_vcpus); can, to the code generator, appear to be NULL dereferences, leading to In function 'atomic_dec', inlined from '...' at ...: ./arch/x86/include/asm/atomic.h:182:5: error: array subscript 0 is outside array bounds of 'int[0]' [-Werror=array-bounds=] Aid the compiler by adding a BUG_ON() checking the return value of the problematic p2m_get_altp2m(). Since with the use of the local variable the 2nd p2m_get_altp2m() each will look questionable at the first glance (Why is the local variable not used here?), open-code the only relevant piece of p2m_get_altp2m() there. To avoid repeatedly doing these transformations, and also to limit how "bad" the open-coding really is, convert the entire operation to an inline helper, used by all three instances (and accepting the redundant BUG_ON(idx >= MAX_ALTP2M) in two of the three cases). Reported-by: Charles Arnold <carnold@suse.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/spec-ctrl: Enumerations for DDP controlsAndrew Cooper2023-03-131-0/+1
| | | | | | | | | | | | https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/data-dependent-prefetcher.html We should offer DDP-CTRL to guests, but I'm not sure when it is appearing in hardware, and it's not massively urgent - the DDP behaviour is mostly sane (having been designed in a post-spectre world) and this is a just-in-case control. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/vmx: move vmx_update_debug_state() in vmcs.c and declare it staticXenia Ragiadakou2023-02-271-1/+0
| | | | | | | | | | | Move vmx_update_debug_state() in vmcs.c because it is used only in this file and limit its scope to this file by declaring it static and removing its declaration from vmx.h. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/svm: Decouple types in struct nestedsvmAndrew Cooper2023-02-271-5/+0
| | | | | | | | | | | struct nestedvm uses mostly plain integer types, except for virt_ext_t which is a union wrapping two bitfield names. However, it turns out that this is a write-only variable. Delete it, allowing us to drop the include of vmcb.h Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/svm: move nestedsvm declarations used only by svm code to private headerXenia Ragiadakou2023-02-241-49/+4
| | | | | | | | | | | Create a new private header in arch/x86/hvm/svm called nestedsvm.h and move there all definitions and declarations that are used only by svm code and don't need to reside in an external header. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/svm: Remove the asm/hvm/svm/emulate.h headerAndrew Cooper2023-02-241-66/+0
| | | | | | | | | These days, this is just two length helpers. Move into the private svm.h No functional change intended. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Xenia Ragiadakou <burzalodowa@gmail.com>
* x86/svm: Remove the asm/hvm/svm/asid.h headerAndrew Cooper2023-02-241-49/+0
| | | | | | | | | | | | | | Fold svm_asid_g_invlpg() into its single caller, deleting the #if 0 which has been present for the entire 16 years this helper has existed: c/s 322a078ab140 "[HVM][SVM] Reintroduce ASIDs." Move the two remaining prototypes into the private svm.h, forward declaring cpuinfo_x86 in preference to including asm/processor.h No functional change. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Xenia Ragiadakou <burzalodowa@gmail.com>
* x86/svm: delete header asm/hvm/svm/intr.hXenia Ragiadakou2023-02-241-25/+0
| | | | | | | | | | Delete asm/hvm/svm/intr.h because it contains only the declaration of svm_intr_assist() which is referenced only by assembly. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/svm: move declarations used only by svm code from svm.h to private headerXenia Ragiadakou2023-02-241-41/+0
| | | | | | | | | | | | | | | | | Create a new private header in arch/x86/hvm/svm called svm.h and move there all definitions and declarations that are used solely by svm code. Take the opportunity to remove the forward declaration of struct vcpu, that is a leftover since the removal of svm_update_guest_cr()'s declaration. Take the opportunity to re-arrange the header as follows, all structures first, then all variable decalarations, all function delarations, and finally all inline functions. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
* x86/vmx: Correct the declaration of vmx_asm_vmexit_handler()Andrew Cooper2023-02-241-1/+0
| | | | | | | | | | | | | | | | | Taking struct cpu_user_regs as a full object is bogus, and while what was probably meant was to take a struct cpu_user_regs pointer, that's still wrong. This isn't a function; its an address stored in the VMCS that the CPU resumes from on VMExit, meaning that it doesn't conform to a normal C API/ABI. Annotate it with `nocall`, and move the declaration into vmcs.c next to its sole user. Fixes: 9c3118a82523 ("bitkeeper revision 1.1159.1.483 (41c0c417XYObowWqbfqU0cdLx30C9w)") `-> "Initial Intel VMX support" Reported-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* xen: Work around Clang-IAS macro \@ expansion bugAndrew Cooper2023-02-242-9/+14
| | | | | | | | | | | | | | | | | | | https://github.com/llvm/llvm-project/issues/60792 It turns out that Clang-IAS does not expand \@ uniquely in a translaition unit, and the XSA-426 change tickles this bug: <instantiation>:4:1: error: invalid symbol redefinition .L1_fill_rsb_loop: ^ make[3]: *** [Rules.mk:247: arch/x86/acpi/cpu_idle.o] Error 1 Extend DO_OVERWRITE_RSB with an optional parameter so C callers can mix %= in too, which Clang does seem to expand properly. Fixes: 63305e5392ec ("x86/spec-ctrl: Mitigate Cross-Thread Return Address Predictions") Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
* x86/svm: opencode SVM_PAUSE{FILTER,THRESH}_INITXenia Ragiadakou2023-02-231-3/+0
| | | | | | | | | | Delete the macros SVM_PAUSE{FILTER,THRESH}_INIT from svm.h and opencode their values, since they are used in a single place and using macros is just unnecessary obfuscation. Suggested-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Acked-by: Jan Beulich <jbeulich@suse.com>
View Lorry Controller Status