From patchwork Mon Sep 30 13:32:32 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 11166729 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5433C1902 for ; Mon, 30 Sep 2019 13:34:43 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 24FF0215EA for ; Mon, 30 Sep 2019 13:34:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=citrix.com header.i=@citrix.com header.b="hJpyaeQw" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 24FF0215EA Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=citrix.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iEvnj-0005Q8-8J; Mon, 30 Sep 2019 13:33:19 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iEvni-0005Px-6h for xen-devel@lists.xenproject.org; Mon, 30 Sep 2019 13:33:18 +0000 X-Inumbo-ID: db3b0bf6-e386-11e9-bf31-bc764e2007e4 Received: from esa3.hc3370-68.iphmx.com (unknown [216.71.145.155]) by localhost (Halon) with ESMTPS id db3b0bf6-e386-11e9-bf31-bc764e2007e4; Mon, 30 Sep 2019 13:33:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1569850396; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9Blv00RFTQvzGYHBzr0vl7Y+GF0UID2L5jPkblmPtck=; b=hJpyaeQwYp1GA392OpRSNg/1Ha6kEaHPV6eLYuh47Nn9AqTWaRkYMNO2 BDkow3hDvIMoG5nv3cstX2a5g+LVHGbsKUOKAf2SWeR+1dSI1w5WxMqCe 522ymJT9uptIRGOzvJJ1xqmomehCYZjkC/JuHaFOoWTQ8NfY435U8irfd c=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none; spf=None smtp.pra=roger.pau@citrix.com; spf=Pass smtp.mailfrom=roger.pau@citrix.com; spf=None smtp.helo=postmaster@mail.citrix.com Received-SPF: None (esa3.hc3370-68.iphmx.com: no sender authenticity information available from domain of roger.pau@citrix.com) identity=pra; client-ip=162.221.158.21; receiver=esa3.hc3370-68.iphmx.com; envelope-from="roger.pau@citrix.com"; x-sender="roger.pau@citrix.com"; x-conformance=sidf_compatible Received-SPF: Pass (esa3.hc3370-68.iphmx.com: domain of roger.pau@citrix.com designates 162.221.158.21 as permitted sender) identity=mailfrom; client-ip=162.221.158.21; receiver=esa3.hc3370-68.iphmx.com; envelope-from="roger.pau@citrix.com"; x-sender="roger.pau@citrix.com"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:209.167.231.154 ip4:178.63.86.133 ip4:195.66.111.40/30 ip4:85.115.9.32/28 ip4:199.102.83.4 ip4:192.28.146.160 ip4:192.28.146.107 ip4:216.52.6.88 ip4:216.52.6.188 ip4:162.221.158.21 ip4:162.221.156.83 ~all" Received-SPF: None (esa3.hc3370-68.iphmx.com: no sender authenticity information available from domain of postmaster@mail.citrix.com) identity=helo; client-ip=162.221.158.21; receiver=esa3.hc3370-68.iphmx.com; envelope-from="roger.pau@citrix.com"; x-sender="postmaster@mail.citrix.com"; x-conformance=sidf_compatible IronPort-SDR: QxLVRtxr/fZKnqYWwdKUl1EiSI+thFKDHJBMAb6ogSusr6s8mzli6G7/cQ5W1NMB8hIq4Y84cr kOYf+rpw/ppNJalxdHgxYXDVfgZl4ik+y1HSv8v5DmQMvfr+sb4/0y3b652I6IvintQ015lg5Y LIqufaqrEeICZe2BZ9vY9MS2ynSv5fiqcXm34yONvowqVPdMiXE40MRoLmOXiYD6jve/Ranzws qRJ1G0atToZ9bK3HW/dF4ofXHT2bxUUnsOO8Aqod/v1jwJjDLj2K6jQ0kkMP5Qh0EiLeNUVfRk LOI= X-SBRS: 2.7 X-MesageID: 6256429 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.64,567,1559534400"; d="scan'208";a="6256429" From: Roger Pau Monne To: Date: Mon, 30 Sep 2019 15:32:32 +0200 Message-ID: <20190930133238.49868-5-roger.pau@citrix.com> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190930133238.49868-1-roger.pau@citrix.com> References: <20190930133238.49868-1-roger.pau@citrix.com> MIME-Version: 1.0 Subject: [Xen-devel] [PATCH v3 04/10] ioreq: add internal ioreq initialization support X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Paul Durrant , Wei Liu , Jan Beulich , Roger Pau Monne Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Add support for internal ioreq servers to initialization and deinitialization routines, prevent some functions from being executed against internal ioreq servers and add guards to only allow internal callers to modify internal ioreq servers. External callers (ie: from hypercalls) are only allowed to deal with external ioreq servers. Signed-off-by: Roger Pau Monné --- Changes since v2: - Return early from hvm_ioreq_server_init and hvm_ioreq_server_deinit if server is internal. - hvm_destroy_ioreq_server, hvm_get_ioreq_server_info and hvm_map_mem_type_to_ioreq_server can only be used against external servers, hence add an assert to that effect. - Simplify ASSERT in hvm_create_ioreq_server. Changes since v1: - Do not pass an 'internal' parameter to most functions, and instead use the id to key whether an ioreq server is internal or external. - Prevent enabling an internal server without a handler. --- xen/arch/x86/hvm/dm.c | 17 ++++- xen/arch/x86/hvm/ioreq.c | 119 ++++++++++++++++++++----------- xen/include/asm-x86/hvm/domain.h | 5 +- xen/include/asm-x86/hvm/ioreq.h | 8 ++- 4 files changed, 105 insertions(+), 44 deletions(-) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index c2fca9f729..6a3682e58c 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -417,7 +417,7 @@ static int dm_op(const struct dmop_args *op_args) break; rc = hvm_create_ioreq_server(d, data->handle_bufioreq, - &data->id); + &data->id, false); break; } @@ -450,6 +450,9 @@ static int dm_op(const struct dmop_args *op_args) rc = -EINVAL; if ( data->pad ) break; + rc = -EPERM; + if ( hvm_ioreq_is_internal(data->id) ) + break; rc = hvm_map_io_range_to_ioreq_server(d, data->id, data->type, data->start, data->end); @@ -464,6 +467,9 @@ static int dm_op(const struct dmop_args *op_args) rc = -EINVAL; if ( data->pad ) break; + rc = -EPERM; + if ( hvm_ioreq_is_internal(data->id) ) + break; rc = hvm_unmap_io_range_from_ioreq_server(d, data->id, data->type, data->start, data->end); @@ -481,6 +487,9 @@ static int dm_op(const struct dmop_args *op_args) rc = -EOPNOTSUPP; if ( !hap_enabled(d) ) break; + rc = -EPERM; + if ( hvm_ioreq_is_internal(data->id) ) + break; if ( first_gfn == 0 ) rc = hvm_map_mem_type_to_ioreq_server(d, data->id, @@ -528,6 +537,9 @@ static int dm_op(const struct dmop_args *op_args) rc = -EINVAL; if ( data->pad ) break; + rc = -EPERM; + if ( hvm_ioreq_is_internal(data->id) ) + break; rc = hvm_set_ioreq_server_state(d, data->id, !!data->enabled); break; @@ -541,6 +553,9 @@ static int dm_op(const struct dmop_args *op_args) rc = -EINVAL; if ( data->pad ) break; + rc = -EPERM; + if ( hvm_ioreq_is_internal(data->id) ) + break; rc = hvm_destroy_ioreq_server(d, data->id); break; diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c index ed0142c4e1..cdbd4244a4 100644 --- a/xen/arch/x86/hvm/ioreq.c +++ b/xen/arch/x86/hvm/ioreq.c @@ -59,10 +59,11 @@ static struct hvm_ioreq_server *get_ioreq_server(const struct domain *d, /* * Iterate over all possible ioreq servers. * - * NOTE: The iteration is backwards such that more recently created - * ioreq servers are favoured in hvm_select_ioreq_server(). - * This is a semantic that previously existed when ioreq servers - * were held in a linked list. + * NOTE: The iteration is backwards such that internal and more recently + * created external ioreq servers are favoured in + * hvm_select_ioreq_server(). + * This is a semantic that previously existed for external servers when + * ioreq servers were held in a linked list. */ #define FOR_EACH_IOREQ_SERVER(d, id, s) \ for ( (id) = MAX_NR_IOREQ_SERVERS; (id) != 0; ) \ @@ -70,6 +71,12 @@ static struct hvm_ioreq_server *get_ioreq_server(const struct domain *d, continue; \ else +#define FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) \ + for ( (id) = MAX_NR_EXTERNAL_IOREQ_SERVERS; (id) != 0; ) \ + if ( !(s = GET_IOREQ_SERVER(d, --(id))) ) \ + continue; \ + else + static ioreq_t *get_ioreq(struct hvm_ioreq_server *s, struct vcpu *v) { shared_iopage_t *p = s->ioreq.va; @@ -86,7 +93,7 @@ bool hvm_io_pending(struct vcpu *v) struct hvm_ioreq_server *s; unsigned int id; - FOR_EACH_IOREQ_SERVER(d, id, s) + FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) { struct hvm_ioreq_vcpu *sv; @@ -190,7 +197,7 @@ bool handle_hvm_io_completion(struct vcpu *v) return false; } - FOR_EACH_IOREQ_SERVER(d, id, s) + FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) { struct hvm_ioreq_vcpu *sv; @@ -430,7 +437,7 @@ bool is_ioreq_server_page(struct domain *d, const struct page_info *page) spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); - FOR_EACH_IOREQ_SERVER(d, id, s) + FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) { if ( (s->ioreq.page == page) || (s->bufioreq.page == page) ) { @@ -688,7 +695,7 @@ static int hvm_ioreq_server_alloc_rangesets(struct hvm_ioreq_server *s, return rc; } -static void hvm_ioreq_server_enable(struct hvm_ioreq_server *s) +static void hvm_ioreq_server_enable(struct hvm_ioreq_server *s, bool internal) { struct hvm_ioreq_vcpu *sv; @@ -697,29 +704,40 @@ static void hvm_ioreq_server_enable(struct hvm_ioreq_server *s) if ( s->enabled ) goto done; - hvm_remove_ioreq_gfn(s, false); - hvm_remove_ioreq_gfn(s, true); + if ( !internal ) + { + hvm_remove_ioreq_gfn(s, false); + hvm_remove_ioreq_gfn(s, true); - s->enabled = true; + list_for_each_entry ( sv, + &s->ioreq_vcpu_list, + list_entry ) + hvm_update_ioreq_evtchn(s, sv); + } + else if ( !s->handler ) + { + ASSERT_UNREACHABLE(); + goto done; + } - list_for_each_entry ( sv, - &s->ioreq_vcpu_list, - list_entry ) - hvm_update_ioreq_evtchn(s, sv); + s->enabled = true; done: spin_unlock(&s->lock); } -static void hvm_ioreq_server_disable(struct hvm_ioreq_server *s) +static void hvm_ioreq_server_disable(struct hvm_ioreq_server *s, bool internal) { spin_lock(&s->lock); if ( !s->enabled ) goto done; - hvm_add_ioreq_gfn(s, true); - hvm_add_ioreq_gfn(s, false); + if ( !internal ) + { + hvm_add_ioreq_gfn(s, true); + hvm_add_ioreq_gfn(s, false); + } s->enabled = false; @@ -736,21 +754,21 @@ static int hvm_ioreq_server_init(struct hvm_ioreq_server *s, int rc; s->target = d; + spin_lock_init(&s->lock); + + rc = hvm_ioreq_server_alloc_rangesets(s, id); + if ( hvm_ioreq_is_internal(id) || rc ) + return rc; get_knownalive_domain(currd); - s->emulator = currd; - spin_lock_init(&s->lock); + s->emulator = currd; INIT_LIST_HEAD(&s->ioreq_vcpu_list); spin_lock_init(&s->bufioreq_lock); s->ioreq.gfn = INVALID_GFN; s->bufioreq.gfn = INVALID_GFN; - rc = hvm_ioreq_server_alloc_rangesets(s, id); - if ( rc ) - return rc; - s->bufioreq_handling = bufioreq_handling; for_each_vcpu ( d, v ) @@ -763,6 +781,7 @@ static int hvm_ioreq_server_init(struct hvm_ioreq_server *s, return 0; fail_add: + ASSERT(!hvm_ioreq_is_internal(id)); hvm_ioreq_server_remove_all_vcpus(s); hvm_ioreq_server_unmap_pages(s); @@ -772,9 +791,15 @@ static int hvm_ioreq_server_init(struct hvm_ioreq_server *s, return rc; } -static void hvm_ioreq_server_deinit(struct hvm_ioreq_server *s) +static void hvm_ioreq_server_deinit(struct hvm_ioreq_server *s, bool internal) { ASSERT(!s->enabled); + + hvm_ioreq_server_free_rangesets(s); + + if ( internal ) + return; + hvm_ioreq_server_remove_all_vcpus(s); /* @@ -789,13 +814,11 @@ static void hvm_ioreq_server_deinit(struct hvm_ioreq_server *s) hvm_ioreq_server_unmap_pages(s); hvm_ioreq_server_free_pages(s); - hvm_ioreq_server_free_rangesets(s); - put_domain(s->emulator); } int hvm_create_ioreq_server(struct domain *d, int bufioreq_handling, - ioservid_t *id) + ioservid_t *id, bool internal) { struct hvm_ioreq_server *s; unsigned int i; @@ -811,7 +834,9 @@ int hvm_create_ioreq_server(struct domain *d, int bufioreq_handling, domain_pause(d); spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); - for ( i = 0; i < MAX_NR_IOREQ_SERVERS; i++ ) + for ( i = (internal ? MAX_NR_EXTERNAL_IOREQ_SERVERS : 0); + i < (internal ? MAX_NR_IOREQ_SERVERS : MAX_NR_EXTERNAL_IOREQ_SERVERS); + i++ ) { if ( !GET_IOREQ_SERVER(d, i) ) break; @@ -821,6 +846,10 @@ int hvm_create_ioreq_server(struct domain *d, int bufioreq_handling, if ( i >= MAX_NR_IOREQ_SERVERS ) goto fail; + ASSERT(i < MAX_NR_EXTERNAL_IOREQ_SERVERS + ? !internal + : internal && i < MAX_NR_IOREQ_SERVERS); + /* * It is safe to call set_ioreq_server() prior to * hvm_ioreq_server_init() since the target domain is paused. @@ -855,6 +884,8 @@ int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id) struct hvm_ioreq_server *s; int rc; + ASSERT(!hvm_ioreq_is_internal(id)); + spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); s = get_ioreq_server(d, id); @@ -864,6 +895,7 @@ int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id) goto out; rc = -EPERM; + /* NB: internal servers cannot be destroyed. */ if ( s->emulator != current->domain ) goto out; @@ -871,13 +903,13 @@ int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id) p2m_set_ioreq_server(d, 0, id); - hvm_ioreq_server_disable(s); + hvm_ioreq_server_disable(s, hvm_ioreq_is_internal(id)); /* * It is safe to call hvm_ioreq_server_deinit() prior to * set_ioreq_server() since the target domain is paused. */ - hvm_ioreq_server_deinit(s); + hvm_ioreq_server_deinit(s, false); set_ioreq_server(d, id, NULL); domain_unpause(d); @@ -900,6 +932,8 @@ int hvm_get_ioreq_server_info(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + ASSERT(!hvm_ioreq_is_internal(id)); + spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); s = get_ioreq_server(d, id); @@ -909,6 +943,7 @@ int hvm_get_ioreq_server_info(struct domain *d, ioservid_t id, goto out; rc = -EPERM; + /* NB: don't allow fetching information from internal ioreq servers. */ if ( s->emulator != current->domain ) goto out; @@ -956,7 +991,7 @@ int hvm_get_ioreq_server_frame(struct domain *d, ioservid_t id, goto out; rc = -EPERM; - if ( s->emulator != current->domain ) + if ( hvm_ioreq_is_internal(id) || s->emulator != current->domain ) goto out; rc = hvm_ioreq_server_alloc_pages(s); @@ -1010,7 +1045,7 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, ioservid_t id, goto out; rc = -EPERM; - if ( s->emulator != current->domain ) + if ( !hvm_ioreq_is_internal(id) && s->emulator != current->domain ) goto out; switch ( type ) @@ -1062,7 +1097,7 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, ioservid_t id, goto out; rc = -EPERM; - if ( s->emulator != current->domain ) + if ( !hvm_ioreq_is_internal(id) && s->emulator != current->domain ) goto out; switch ( type ) @@ -1108,6 +1143,8 @@ int hvm_map_mem_type_to_ioreq_server(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + ASSERT(!hvm_ioreq_is_internal(id)); + if ( type != HVMMEM_ioreq_server ) return -EINVAL; @@ -1157,15 +1194,15 @@ int hvm_set_ioreq_server_state(struct domain *d, ioservid_t id, goto out; rc = -EPERM; - if ( s->emulator != current->domain ) + if ( !hvm_ioreq_is_internal(id) && s->emulator != current->domain ) goto out; domain_pause(d); if ( enabled ) - hvm_ioreq_server_enable(s); + hvm_ioreq_server_enable(s, hvm_ioreq_is_internal(id)); else - hvm_ioreq_server_disable(s); + hvm_ioreq_server_disable(s, hvm_ioreq_is_internal(id)); domain_unpause(d); @@ -1184,7 +1221,7 @@ int hvm_all_ioreq_servers_add_vcpu(struct domain *d, struct vcpu *v) spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); - FOR_EACH_IOREQ_SERVER(d, id, s) + FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) { rc = hvm_ioreq_server_add_vcpu(s, v); if ( rc ) @@ -1218,7 +1255,7 @@ void hvm_all_ioreq_servers_remove_vcpu(struct domain *d, struct vcpu *v) spin_lock_recursive(&d->arch.hvm.ioreq_server.lock); - FOR_EACH_IOREQ_SERVER(d, id, s) + FOR_EACH_EXTERNAL_IOREQ_SERVER(d, id, s) hvm_ioreq_server_remove_vcpu(s, v); spin_unlock_recursive(&d->arch.hvm.ioreq_server.lock); @@ -1235,13 +1272,13 @@ void hvm_destroy_all_ioreq_servers(struct domain *d) FOR_EACH_IOREQ_SERVER(d, id, s) { - hvm_ioreq_server_disable(s); + hvm_ioreq_server_disable(s, hvm_ioreq_is_internal(id)); /* * It is safe to call hvm_ioreq_server_deinit() prior to * set_ioreq_server() since the target domain is being destroyed. */ - hvm_ioreq_server_deinit(s); + hvm_ioreq_server_deinit(s, hvm_ioreq_is_internal(id)); set_ioreq_server(d, id, NULL); xfree(s); diff --git a/xen/include/asm-x86/hvm/domain.h b/xen/include/asm-x86/hvm/domain.h index 56a32e3e35..f09ce9b417 100644 --- a/xen/include/asm-x86/hvm/domain.h +++ b/xen/include/asm-x86/hvm/domain.h @@ -97,7 +97,10 @@ struct hvm_pi_ops { void (*vcpu_block)(struct vcpu *); }; -#define MAX_NR_IOREQ_SERVERS 8 +#define MAX_NR_EXTERNAL_IOREQ_SERVERS 8 +#define MAX_NR_INTERNAL_IOREQ_SERVERS 1 +#define MAX_NR_IOREQ_SERVERS \ + (MAX_NR_EXTERNAL_IOREQ_SERVERS + MAX_NR_INTERNAL_IOREQ_SERVERS) struct hvm_domain { /* Guest page range used for non-default ioreq servers */ diff --git a/xen/include/asm-x86/hvm/ioreq.h b/xen/include/asm-x86/hvm/ioreq.h index 65491c48d2..c3917aa74d 100644 --- a/xen/include/asm-x86/hvm/ioreq.h +++ b/xen/include/asm-x86/hvm/ioreq.h @@ -24,7 +24,7 @@ bool handle_hvm_io_completion(struct vcpu *v); bool is_ioreq_server_page(struct domain *d, const struct page_info *page); int hvm_create_ioreq_server(struct domain *d, int bufioreq_handling, - ioservid_t *id); + ioservid_t *id, bool internal); int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id); int hvm_get_ioreq_server_info(struct domain *d, ioservid_t id, unsigned long *ioreq_gfn, @@ -54,6 +54,12 @@ unsigned int hvm_broadcast_ioreq(ioreq_t *p, bool buffered); void hvm_ioreq_init(struct domain *d); +static inline bool hvm_ioreq_is_internal(unsigned int id) +{ + ASSERT(id < MAX_NR_IOREQ_SERVERS); + return id >= MAX_NR_EXTERNAL_IOREQ_SERVERS; +} + #endif /* __ASM_X86_HVM_IOREQ_H__ */ /*