From patchwork Wed May 8 11:23:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 13658592 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 59336C25B5F for ; Wed, 8 May 2024 11:27:13 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.718734.1121222 (Exim 4.92) (envelope-from ) id 1s4fRr-0004aW-RV; Wed, 08 May 2024 11:26:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 718734.1121222; Wed, 08 May 2024 11:26:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRr-0004aP-OO; Wed, 08 May 2024 11:26:59 +0000 Received: by outflank-mailman (input) for mailman id 718734; Wed, 08 May 2024 11:26:58 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRq-0004Lt-4U for xen-devel@lists.xenproject.org; Wed, 08 May 2024 11:26:58 +0000 Received: from mail-ed1-x52a.google.com (mail-ed1-x52a.google.com [2a00:1450:4864:20::52a]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e14a2c93-0d2d-11ef-909c-e314d9c70b13; Wed, 08 May 2024 13:26:57 +0200 (CEST) Received: by mail-ed1-x52a.google.com with SMTP id 4fb4d7f45d1cf-573137ba8d7so1323641a12.0 for ; Wed, 08 May 2024 04:26:57 -0700 (PDT) Received: from localhost ([213.195.114.223]) by smtp.gmail.com with ESMTPSA id ds9-20020a0564021cc900b005705bfeeb27sm7483983edb.66.2024.05.08.04.26.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 May 2024 04:26:56 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e14a2c93-0d2d-11ef-909c-e314d9c70b13 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1715167617; x=1715772417; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=m3tygfqqTA1tpknR6/VpOTguLDppE0Q8yESUk/lbUEQ=; b=PeDhNHJc/G5PctJ0aQSeKah54LSD8i9qXqHBBRbbKldzm94S4iqdOR1ZiEOA7w6nNM K8evlx9UWTCCTzg/M9DMl2vW8HHhY+0Y4tTwk/jWlYhOakUVBzfmTXWHZSGDSIO6wxxi AlA5N1yW7/+ncFrIFlt1csNdBNbJRZZxAVZSU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715167617; x=1715772417; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=m3tygfqqTA1tpknR6/VpOTguLDppE0Q8yESUk/lbUEQ=; b=im1uBoAIkxQZpcJ/pnTy1hwPZINb98kkJmMlHSJKCynqkffVzEmflO41s/swAJb25b YxQPmOthc1B2Za8gbiYUE7cfFY3D6V+x7q3f9mQc2BfLs+77toQlbvawR6++4hivCick +rTVDJNq/kRQ5BQtqlh9HPjb1m+Bx/nvyGGciPbJE1WQYjG4XEWGXMDJYODQAJr8d7bd JPjz0MOtsYAc3KEHiS8Xt3nCcXYPpljMZQEjIfOhuoT5VHp8rHnH3rec+FzsNmd88ML2 vDHQ+wepZiycaHzAycurTe0vw1m2Zf42Uz8nMBLRjg+wnQBo1a+50XJcmVSh1UUJxtV9 GDrw== X-Gm-Message-State: AOJu0YyGfKt9uJQzO9+BK1eLK1OTHDYgzQtivGEKOciQ3y+ldenHXdLT qb+xGecrMHBbyBqFi7PMY/ojC9GFDhkl57Kqw1BkH8bWQf4iwPwJlxGV7/PgcjPdOUBhw1A7eus 8 X-Google-Smtp-Source: AGHT+IH/1U2J21bD3IY1H/G66eCkgtvsFEgF8vyRrrhwjx+EZKl3CjCkyvOuUWbjDz7v0WRnQtmQjw== X-Received: by 2002:a05:6402:7d0:b0:572:e81d:6e70 with SMTP id 4fb4d7f45d1cf-57311084911mr4703148a12.15.1715167616786; Wed, 08 May 2024 04:26:56 -0700 (PDT) From: Roger Pau Monne To: xen-devel@lists.xenproject.org Cc: Roger Pau Monne , Jan Beulich , Andrew Cooper Subject: [PATCH for-4.19 v2 1/3] xen/x86: account number of foreign mappings in the p2m Date: Wed, 8 May 2024 13:23:21 +0200 Message-ID: <20240508112323.38946-2-roger.pau@citrix.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240508112323.38946-1-roger.pau@citrix.com> References: <20240508112323.38946-1-roger.pau@citrix.com> MIME-Version: 1.0 Such information will be needed in order to remove foreign mappings during teardown for HVM guests. Right now the introduced counter is not consumed. Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- Changes since v1: - Drop max_gfn accounting. --- xen/arch/x86/include/asm/p2m.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/arch/x86/include/asm/p2m.h b/xen/arch/x86/include/asm/p2m.h index 111badf89a6e..107b9f260848 100644 --- a/xen/arch/x86/include/asm/p2m.h +++ b/xen/arch/x86/include/asm/p2m.h @@ -380,6 +380,9 @@ struct p2m_domain { unsigned int flags; unsigned long entry_count; } ioreq; + + /* Number of foreign mappings. */ + unsigned long nr_foreign; #endif /* CONFIG_HVM */ }; @@ -1049,6 +1052,8 @@ static inline int p2m_entry_modify(struct p2m_domain *p2m, p2m_type_t nt, if ( !page_get_owner_and_reference(mfn_to_page(nfn)) ) return -EBUSY; + p2m->nr_foreign++; + break; default: @@ -1069,6 +1074,7 @@ static inline int p2m_entry_modify(struct p2m_domain *p2m, p2m_type_t nt, return -EINVAL; } put_page(mfn_to_page(ofn)); + p2m->nr_foreign--; break; default: From patchwork Wed May 8 11:23:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 13658594 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 295BAC25B75 for ; Wed, 8 May 2024 11:27:14 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.718736.1121242 (Exim 4.92) (envelope-from ) id 1s4fRv-00054q-Bd; Wed, 08 May 2024 11:27:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 718736.1121242; Wed, 08 May 2024 11:27:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRv-00054h-7Z; Wed, 08 May 2024 11:27:03 +0000 Received: by outflank-mailman (input) for mailman id 718736; Wed, 08 May 2024 11:27:01 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRt-0004oy-EX for xen-devel@lists.xenproject.org; Wed, 08 May 2024 11:27:01 +0000 Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [2a00:1450:4864:20::62e]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id e238001f-0d2d-11ef-b4bb-af5377834399; Wed, 08 May 2024 13:26:59 +0200 (CEST) Received: by mail-ej1-x62e.google.com with SMTP id a640c23a62f3a-a59c04839caso957236066b.2 for ; Wed, 08 May 2024 04:26:59 -0700 (PDT) Received: from localhost ([213.195.114.223]) by smtp.gmail.com with ESMTPSA id g13-20020a1709063b0d00b00a59a17eb5d2sm5787521ejf.222.2024.05.08.04.26.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 May 2024 04:26:57 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e238001f-0d2d-11ef-b4bb-af5377834399 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1715167618; x=1715772418; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+9za8P4EPzVB+2QpoWeyBB/3pcjYoli4eAelV6qAoOM=; b=qhnKDssikiMPAbClzmJF0xaAbBBhToVoBGTVaTz87+0kg8G/0CRpwP7h6jLXoVQwaP nDzjZwWZETgqTEbONM18j6IHb7ncGwqHsfYDHuMlwPWYX8lEAPeo7PaypxdF2hxpoIkI YpMKIGMdTlh3gKr0tMYc0Kird6poGUoB8jmC8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715167618; x=1715772418; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+9za8P4EPzVB+2QpoWeyBB/3pcjYoli4eAelV6qAoOM=; b=l862eFv6rKCTcJNkclWffhWCuH16A7crw/uM7zJY/0jdb6x0aUoK+WHIgF6Ovwoow+ MxowC5fA0OnxQ5X+5Z8bgMuDg+aS16uoldiCKdfugJ2lbG1Ixtzn2N0XPkVc7pa87kjZ F+rIvMqHA053pj50N0jZ1teCqxJtQEY6138fP72AuGw76CLyG7Mn7H12/pPJo4AxoRb1 qZQ48EUUoF6wvbnEvgrcA9LEFHzOMkJngmGtnrEyobBPyiAMCriFHMewr/DAQOS8n7ro M7B3G//GD4cOA6LYrIRytnfRuTLF2PsXABmFhTB2GfMIa5bEV1BbAtjyDe7vxoddyFmC VEsQ== X-Gm-Message-State: AOJu0YwVFrsOaJ4ZGr/ZoQQcVE9M3yILTDb2wf1ackaGXH3IAaz0acqt pSbfngWAqqX02J1K24cu+NXxkkcLbpP2rE9wgwohBvVbPIwZu/kXzseWzzb+d0FoJytgMTrmFMZ l X-Google-Smtp-Source: AGHT+IECJsbn5pM4hjExb+nFNlRr5lvugFFZyFGIDU8Jd4fM7lAesXbatc8NcLMBMlYb2Pr8VUOoCw== X-Received: by 2002:a17:906:f28c:b0:a59:a0eb:aeb0 with SMTP id a640c23a62f3a-a59fb952bb0mr153520466b.36.1715167617901; Wed, 08 May 2024 04:26:57 -0700 (PDT) From: Roger Pau Monne To: xen-devel@lists.xenproject.org Cc: Roger Pau Monne , Anthony PERARD , Juergen Gross , Andrew Cooper , George Dunlap , Jan Beulich , Julien Grall , Stefano Stabellini , "Daniel P. Smith" Subject: [PATCH for-4.19 v2 2/3] xen/x86: enable altp2m at create domain domctl Date: Wed, 8 May 2024 13:23:22 +0200 Message-ID: <20240508112323.38946-3-roger.pau@citrix.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240508112323.38946-1-roger.pau@citrix.com> References: <20240508112323.38946-1-roger.pau@citrix.com> MIME-Version: 1.0 Enabling it using an HVM param is fragile, and complicates the logic when deciding whether options that interact with altp2m can also be enabled. Leave the HVM param value for consumption by the guest, but prevent it from being set. Enabling is now done using the misc_flags field in xen_arch_domainconfig. Signed-off-by: Roger Pau Monné --- Changes since v1: - New in this version. --- tools/libs/light/libxl_x86.c | 43 +++++++++++++++++++++---------- xen/arch/x86/domain.c | 25 +++++++++++++++++- xen/arch/x86/hvm/hvm.c | 15 ++++++++++- xen/include/public/arch-x86/xen.h | 18 +++++++++++++ xen/include/public/hvm/params.h | 9 ++----- 5 files changed, 87 insertions(+), 23 deletions(-) diff --git a/tools/libs/light/libxl_x86.c b/tools/libs/light/libxl_x86.c index a50ec37eb3eb..86ee8132536c 100644 --- a/tools/libs/light/libxl_x86.c +++ b/tools/libs/light/libxl_x86.c @@ -6,8 +6,21 @@ int libxl__arch_domain_prepare_config(libxl__gc *gc, libxl_domain_config *d_config, struct xen_domctl_createdomain *config) { + unsigned int altp2m = d_config->b_info.altp2m; + switch(d_config->c_info.type) { case LIBXL_DOMAIN_TYPE_HVM: + /* + * The config parameter "altp2m" replaces the parameter "altp2mhvm". + * For legacy reasons, both parameters are accepted on x86 HVM guests. + * + * If the legacy field info->u.hvm.altp2m is set, activate altp2m. + * Otherwise set altp2m based on the field info->altp2m. + */ + if (altp2m == LIBXL_ALTP2M_MODE_DISABLED && + libxl_defbool_val(d_config->b_info.u.hvm.altp2m)) + altp2m = libxl_defbool_val(d_config->b_info.u.hvm.altp2m); + config->arch.emulation_flags = (XEN_X86_EMU_ALL & ~XEN_X86_EMU_VPCI); if (!libxl_defbool_val(d_config->b_info.u.hvm.pirq)) config->arch.emulation_flags &= ~XEN_X86_EMU_USE_PIRQ; @@ -26,6 +39,22 @@ int libxl__arch_domain_prepare_config(libxl__gc *gc, if (libxl_defbool_val(d_config->b_info.arch_x86.msr_relaxed)) config->arch.misc_flags |= XEN_X86_MSR_RELAXED; + if (d_config->c_info.type != LIBXL_DOMAIN_TYPE_PV) { + switch (altp2m) { + case LIBXL_ALTP2M_MODE_MIXED: + config->arch.misc_flags |= XEN_X86_ALTP2M_MIXED; + break; + + case LIBXL_ALTP2M_MODE_EXTERNAL: + config->arch.misc_flags |= XEN_X86_ALTP2M_EXT; + break; + + case LIBXL_ALTP2M_MODE_LIMITED: + config->arch.misc_flags |= XEN_X86_ALTP2M_LIMITED; + break; + } + } + return 0; } @@ -407,19 +436,9 @@ static int hvm_set_conf_params(libxl__gc *gc, uint32_t domid, libxl_ctx *ctx = libxl__gc_owner(gc); xc_interface *xch = ctx->xch; int ret = ERROR_FAIL; - unsigned int altp2m = info->altp2m; switch(info->type) { case LIBXL_DOMAIN_TYPE_HVM: - /* The config parameter "altp2m" replaces the parameter "altp2mhvm". For - * legacy reasons, both parameters are accepted on x86 HVM guests. - * - * If the legacy field info->u.hvm.altp2m is set, activate altp2m. - * Otherwise set altp2m based on the field info->altp2m. */ - if (info->altp2m == LIBXL_ALTP2M_MODE_DISABLED && - libxl_defbool_val(info->u.hvm.altp2m)) - altp2m = libxl_defbool_val(info->u.hvm.altp2m); - if (xc_hvm_param_set(xch, domid, HVM_PARAM_HPET_ENABLED, libxl_defbool_val(info->u.hvm.hpet))) { LOG(ERROR, "Couldn't set HVM_PARAM_HPET_ENABLED"); @@ -444,10 +463,6 @@ static int hvm_set_conf_params(libxl__gc *gc, uint32_t domid, LOG(ERROR, "Couldn't set HVM_PARAM_TIMER_MODE"); goto out; } - if (xc_hvm_param_set(xch, domid, HVM_PARAM_ALTP2M, altp2m)) { - LOG(ERROR, "Couldn't set HVM_PARAM_ALTP2M"); - goto out; - } break; default: diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 20e83cf38bbd..dff790060605 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -637,6 +637,9 @@ int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) bool hap = config->flags & XEN_DOMCTL_CDF_hap; bool nested_virt = config->flags & XEN_DOMCTL_CDF_nested_virt; unsigned int max_vcpus; + unsigned int altp2m = config->arch.misc_flags & (XEN_X86_ALTP2M_MIXED | + XEN_X86_ALTP2M_EXT | + XEN_X86_ALTP2M_LIMITED); if ( hvm ? !hvm_enabled : !IS_ENABLED(CONFIG_PV) ) { @@ -708,13 +711,33 @@ int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) } } - if ( config->arch.misc_flags & ~XEN_X86_MSR_RELAXED ) + if ( config->arch.misc_flags & ~XEN_X86_MISC_FLAGS_ALL ) { dprintk(XENLOG_INFO, "Invalid arch misc flags %#x\n", config->arch.misc_flags); return -EINVAL; } + if ( altp2m && (altp2m & (altp2m - 1)) ) + { + dprintk(XENLOG_INFO, "Multiple altp2m options selected in flags: %#x\n", + config->flags); + return -EINVAL; + } + + if ( altp2m && nested_virt ) + { + dprintk(XENLOG_INFO, + "Nested virt and altp2m are mutually incompatible\n"); + return -EINVAL; + } + + if ( altp2m && !hap ) + { + dprintk(XENLOG_INFO, "altp2m requires HAP\n"); + return -EINVAL; + } + return 0; } diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 0ce45b177cf4..f3e1b9364588 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -659,6 +659,14 @@ int hvm_domain_initialise(struct domain *d, d->arch.hvm.params[HVM_PARAM_TRIPLE_FAULT_REASON] = SHUTDOWN_reboot; + /* Set altp2m based on domctl flags. */ + if ( config->arch.misc_flags & XEN_X86_ALTP2M_MIXED ) + d->arch.hvm.params[HVM_PARAM_ALTP2M] = XEN_ALTP2M_mixed; + else if ( config->arch.misc_flags & XEN_X86_ALTP2M_EXT ) + d->arch.hvm.params[HVM_PARAM_ALTP2M] = XEN_ALTP2M_external; + else if ( config->arch.misc_flags & XEN_X86_ALTP2M_LIMITED ) + d->arch.hvm.params[HVM_PARAM_ALTP2M] = XEN_ALTP2M_limited; + vpic_init(d); rc = vioapic_init(d); @@ -4163,6 +4171,12 @@ static int hvm_allow_set_param(struct domain *d, case HVM_PARAM_CONSOLE_EVTCHN: case HVM_PARAM_X87_FIP_WIDTH: break; + + /* The following parameters are read-only. */ + case HVM_PARAM_ALTP2M: + rc = -EEXIST; + break; + /* The following parameters are deprecated. */ case HVM_PARAM_PAE_ENABLED: case HVM_PARAM_DM_DOMAIN: @@ -4204,7 +4218,6 @@ static int hvm_allow_set_param(struct domain *d, case HVM_PARAM_BUFIOREQ_PFN: case HVM_PARAM_IOREQ_SERVER_PFN: case HVM_PARAM_NR_IOREQ_SERVER_PAGES: - case HVM_PARAM_ALTP2M: case HVM_PARAM_MCA_CAP: if ( value != 0 && new_value != value ) rc = -EEXIST; diff --git a/xen/include/public/arch-x86/xen.h b/xen/include/public/arch-x86/xen.h index a9a87d9b50de..bc444e7744a5 100644 --- a/xen/include/public/arch-x86/xen.h +++ b/xen/include/public/arch-x86/xen.h @@ -300,6 +300,24 @@ struct xen_arch_domainconfig { * doesn't allow the guest to read or write to the underlying MSR. */ #define XEN_X86_MSR_RELAXED (1u << 0) + +/* altp2m options. Only one can be set. + * + * Note that 'mixed' mode has not been evaluated for safety from a + * security perspective. Before using this mode in a + * security-critical environment, each subop should be evaluated for + * safety, with unsafe subops blacklisted in XSM. + * + * Enable altp2m mixed mode. + */ +#define XEN_X86_ALTP2M_MIXED (1U << 1) +/* Enable altp2m external mode. */ +#define XEN_X86_ALTP2M_EXT (1U << 2) +/* Enable altp2m limited mode. */ +#define XEN_X86_ALTP2M_LIMITED (1U << 3) + +#define XEN_X86_MISC_FLAGS_ALL (XEN_X86_MSR_RELAXED | XEN_X86_ALTP2M_MIXED | \ + XEN_X86_ALTP2M_EXT | XEN_X86_ALTP2M_LIMITED) uint32_t misc_flags; }; diff --git a/xen/include/public/hvm/params.h b/xen/include/public/hvm/params.h index a22b4ed45d2e..99c40b4287f1 100644 --- a/xen/include/public/hvm/params.h +++ b/xen/include/public/hvm/params.h @@ -246,16 +246,11 @@ #define HVM_PARAM_VM_GENERATION_ID_ADDR 34 /* - * Set mode for altp2m: - * disabled: don't activate altp2m (default) + * Get mode for altp2m: + * disabled: altp2m not active (default) * mixed: allow access to all altp2m ops for both in-guest and external tools * external: allow access to external privileged tools only * limited: guest only has limited access (ie. control VMFUNC and #VE) - * - * Note that 'mixed' mode has not been evaluated for safety from a - * security perspective. Before using this mode in a - * security-critical environment, each subop should be evaluated for - * safety, with unsafe subops blacklisted in XSM. */ #define HVM_PARAM_ALTP2M 35 #define XEN_ALTP2M_disabled 0 From patchwork Wed May 8 11:23:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 13658591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D5886C04FFE for ; Wed, 8 May 2024 11:27:12 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.718735.1121232 (Exim 4.92) (envelope-from ) id 1s4fRu-0004pZ-2u; Wed, 08 May 2024 11:27:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 718735.1121232; Wed, 08 May 2024 11:27:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRu-0004pS-00; Wed, 08 May 2024 11:27:02 +0000 Received: by outflank-mailman (input) for mailman id 718735; Wed, 08 May 2024 11:27:00 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1s4fRs-0004Lt-Oi for xen-devel@lists.xenproject.org; Wed, 08 May 2024 11:27:00 +0000 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [2a00:1450:4864:20::631]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e2b2ec57-0d2d-11ef-909c-e314d9c70b13; Wed, 08 May 2024 13:27:00 +0200 (CEST) Received: by mail-ej1-x631.google.com with SMTP id a640c23a62f3a-a59b178b75bso779042666b.0 for ; Wed, 08 May 2024 04:27:00 -0700 (PDT) Received: from localhost ([213.195.114.223]) by smtp.gmail.com with ESMTPSA id b3-20020a170906d10300b00a59edf10304sm1858562ejz.76.2024.05.08.04.26.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 May 2024 04:26:58 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e2b2ec57-0d2d-11ef-909c-e314d9c70b13 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1715167619; x=1715772419; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=PfaLi13cq6Jp00njiG3Oj5QQBnM03VocbDPA5xG0o9g=; b=WRPzU5RgQkevL0cFdnFNTcngzUsBZ3tfNratpyaKdpvZQdc2cgedCRyVrOknXcnG/M gejuU+NDIsNexFfo9CqEA+9LoanVKPtXFDEEDHGYUpNlsPaMpK6iW5ZiQ43cfWl2mt5O DjxxzZvmkIrzo7S5a0jv3tZPSDmpZxn3UHVcQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715167619; x=1715772419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=PfaLi13cq6Jp00njiG3Oj5QQBnM03VocbDPA5xG0o9g=; b=UjbAB6WfJwEh+xuHjlLmw6Iy83jouPLGn1v3sKFTLVKf7TSigFObgkL3+OQJWE2Dpa atH/yQdAaxKxTRSiDeqXCQVPytB6aLwD7bTJjwInxWzcjcdhlJJkkNb7JPwXslGNmott b3V8s6+HlZTu7qXIKge1h3j6FrIV1qUAaJCwKeG7cx61qS4vFVsqm+eBkOEoqHr3rRQk XZ7jv0oCwq4Ee3mUywNgxNNpoTfnqMWuW+2VjFnZ1icMdSVL1LNnk5SYSXAunXlBy1FB iriw5E9vLVwHnk6J2xT3CX+beomMH6EFlV3I74vAny7qJruIW8prXroPQSuNs9EvNPps EfWA== X-Gm-Message-State: AOJu0Yw7DH1iXprdKVcfAFXAuBS3lqDXjY14pXk4ajuTjhp7xedKda7X KK0GzeVmtz5ot2GGAPzo/NXYn/p7gKKxErp/tblFToixc1JUbXX3JtE+v6aBqHEE8u60fTmcM6F d X-Google-Smtp-Source: AGHT+IFu7vidAerhk41EYCSsbv5K0vQLhkaZwr+s2zbmNY5pScb1HCc3PxhVMj0gScVnH3E6/JOiGA== X-Received: by 2002:a17:906:fb85:b0:a59:c577:c5cb with SMTP id a640c23a62f3a-a59fb94a413mr171281266b.10.1715167619317; Wed, 08 May 2024 04:26:59 -0700 (PDT) From: Roger Pau Monne To: xen-devel@lists.xenproject.org Cc: Roger Pau Monne , Oleksii Kurochko , Community Manager , Jan Beulich , Andrew Cooper , George Dunlap Subject: [PATCH for-4.19 v2 3/3] xen/x86: remove foreign mappings from the p2m on teardown Date: Wed, 8 May 2024 13:23:23 +0200 Message-ID: <20240508112323.38946-4-roger.pau@citrix.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240508112323.38946-1-roger.pau@citrix.com> References: <20240508112323.38946-1-roger.pau@citrix.com> MIME-Version: 1.0 Iterate over the p2m up to the maximum recorded gfn and remove any foreign mappings, in order to drop the underlying page references and thus don't keep extra page references if a domain is destroyed while still having foreign mappings on it's p2m. The logic is similar to the one used on Arm. Note that foreign mappings cannot be created by guests that have altp2m or nested HVM enabled, as p2ms different than the host one are not currently scrubbed when destroyed in order to drop references to any foreign maps. It's unclear whether the right solution is to take an extra reference when foreign maps are added to p2ms different than the host one, or just rely on the host p2m already having a reference. The mapping being removed from the host p2m should cause it to be dropped on all domain p2ms. Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- Changes since v1: - Use existing p2m max_mapped_pfn field. - Prevent creating foreign mappings by guests that have altp2m or nestedhvm enabled. --- CHANGELOG.md | 1 + xen/arch/x86/domain.c | 8 +++- xen/arch/x86/include/asm/p2m.h | 26 +++++++------ xen/arch/x86/mm/p2m-basic.c | 17 +++++++++ xen/arch/x86/mm/p2m.c | 68 ++++++++++++++++++++++++++++++++-- 5 files changed, 103 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8041cfb7d243..09bdb9b97578 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - HVM PIRQs are disabled by default. - Reduce IOMMU setup time for hardware domain. - xl/libxl configures vkb=[] for HVM domains with priority over vkb_device. + - Allow HVM/PVH domains to map foreign pages. ### Added - On x86: diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index dff790060605..1cb3ccddab00 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -718,7 +718,7 @@ int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) return -EINVAL; } - if ( altp2m && (altp2m & (altp2m - 1)) ) + if ( altp2m & (altp2m - 1) ) { dprintk(XENLOG_INFO, "Multiple altp2m options selected in flags: %#x\n", config->flags); @@ -2387,6 +2387,7 @@ int domain_relinquish_resources(struct domain *d) enum { PROG_iommu_pagetables = 1, PROG_shared, + PROG_mappings, PROG_paging, PROG_vcpu_pagetables, PROG_xen, @@ -2435,6 +2436,11 @@ int domain_relinquish_resources(struct domain *d) } #endif + PROGRESS(mappings): + ret = relinquish_p2m_mapping(d); + if ( ret ) + return ret; + PROGRESS(paging): /* Tear down paging-assistance stuff. */ diff --git a/xen/arch/x86/include/asm/p2m.h b/xen/arch/x86/include/asm/p2m.h index 107b9f260848..c1478ffc3647 100644 --- a/xen/arch/x86/include/asm/p2m.h +++ b/xen/arch/x86/include/asm/p2m.h @@ -383,6 +383,8 @@ struct p2m_domain { /* Number of foreign mappings. */ unsigned long nr_foreign; + /* Cursor for iterating over the p2m on teardown. */ + unsigned long teardown_gfn; #endif /* CONFIG_HVM */ }; @@ -395,16 +397,7 @@ struct p2m_domain { #endif #include -static inline bool arch_acquire_resource_check(struct domain *d) -{ - /* - * FIXME: Until foreign pages inserted into the P2M are properly - * reference counted, it is unsafe to allow mapping of - * resource pages unless the caller is the hardware domain - * (see set_foreign_p2m_entry()). - */ - return !paging_mode_translate(d) || is_hardware_domain(d); -} +bool arch_acquire_resource_check(const struct domain *d); /* * Updates vCPU's n2pm to match its np2m_base in VMCx12 and returns that np2m. @@ -720,6 +713,10 @@ p2m_pod_offline_or_broken_hit(struct page_info *p); void p2m_pod_offline_or_broken_replace(struct page_info *p); +/* Perform cleanup of p2m mappings ahead of teardown. */ +int +relinquish_p2m_mapping(struct domain *d); + #else static inline bool @@ -748,6 +745,11 @@ static inline void p2m_pod_offline_or_broken_replace(struct page_info *p) ASSERT_UNREACHABLE(); } +static inline int relinquish_p2m_mapping(struct domain *d) +{ + return 0; +} + #endif @@ -1043,7 +1045,7 @@ static inline int p2m_entry_modify(struct p2m_domain *p2m, p2m_type_t nt, break; case p2m_map_foreign: - if ( !mfn_valid(nfn) ) + if ( !mfn_valid(nfn) || p2m != p2m_get_hostp2m(p2m->domain) ) { ASSERT_UNREACHABLE(); return -EINVAL; @@ -1068,7 +1070,7 @@ static inline int p2m_entry_modify(struct p2m_domain *p2m, p2m_type_t nt, break; case p2m_map_foreign: - if ( !mfn_valid(ofn) ) + if ( !mfn_valid(ofn) || p2m != p2m_get_hostp2m(p2m->domain) ) { ASSERT_UNREACHABLE(); return -EINVAL; diff --git a/xen/arch/x86/mm/p2m-basic.c b/xen/arch/x86/mm/p2m-basic.c index 8599bd15c61a..d374e1e824f1 100644 --- a/xen/arch/x86/mm/p2m-basic.c +++ b/xen/arch/x86/mm/p2m-basic.c @@ -13,6 +13,8 @@ #include #include +#include +#include #include #include "mm-locks.h" #include "p2m.h" @@ -207,6 +209,21 @@ void p2m_final_teardown(struct domain *d) p2m_teardown_hostp2m(d); } +bool arch_acquire_resource_check(const struct domain *d) +{ + /* + * altp2m is not supported as we would otherwise also need to walk the + * altp2m tables and drop any foreign map entries in order to drop the page + * reference. + * + * The same applies to nestedhvm nested p2m tables, as the type from the L0 + * p2m is replicated into the L1 p2m, and there's no filtering that + * prevents foreign mappings from being created in nestedp2m. + */ + return d->arch.hvm.params[HVM_PARAM_ALTP2M] == XEN_ALTP2M_disabled && + !nestedhvm_enabled(d); +} + /* * Local variables: * mode: C diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c index ce742c12e0de..23c6c42af275 100644 --- a/xen/arch/x86/mm/p2m.c +++ b/xen/arch/x86/mm/p2m.c @@ -2333,10 +2333,6 @@ static int p2m_add_foreign(struct domain *tdom, unsigned long fgfn, int rc; struct domain *fdom; - /* - * hvm fixme: until support is added to p2m teardown code to cleanup any - * foreign entries, limit this to hardware domain only. - */ if ( !arch_acquire_resource_check(tdom) ) return -EPERM; @@ -2693,6 +2689,70 @@ int p2m_set_altp2m_view_visibility(struct domain *d, unsigned int altp2m_idx, return rc; } +/* + * Remove foreign mappings from the p2m, as that drops the page reference taken + * when mapped. + */ +int relinquish_p2m_mapping(struct domain *d) +{ + struct p2m_domain *p2m = p2m_get_hostp2m(d); + unsigned long gfn, count = 0; + int rc = 0; + + if ( !paging_mode_translate(d) ) + return 0; + + BUG_ON(!d->is_dying); + + p2m_lock(p2m); + + gfn = p2m->teardown_gfn; + + /* Iterate over the whole p2m on debug builds to ensure correctness. */ + while ( gfn <= p2m->max_mapped_pfn && + (IS_ENABLED(CONFIG_DEBUG) || p2m->nr_foreign) ) + { + unsigned int order; + p2m_type_t t; + p2m_access_t a; + + _get_gfn_type_access(p2m, _gfn(gfn), &t, &a, 0, &order, 0); + ASSERT(IS_ALIGNED(gfn, 1UL << order)); + + if ( t == p2m_map_foreign ) + { + ASSERT(p2m->nr_foreign); + ASSERT(order == 0); + + rc = p2m_set_entry(p2m, _gfn(gfn), INVALID_MFN, order, p2m_invalid, + p2m->default_access); + if ( rc ) + { + printk(XENLOG_ERR + "%pd: failed to unmap foreign page %" PRI_gfn " order %u error %d\n", + d, gfn, order, rc); + ASSERT_UNREACHABLE(); + break; + } + } + + gfn += 1UL << order; + + if ( !(++count & 0xff) && hypercall_preempt_check() ) + { + rc = -ERESTART; + break; + } + } + + ASSERT(gfn <= p2m->max_mapped_pfn || !p2m->nr_foreign); + p2m->teardown_gfn = gfn; + + p2m_unlock(p2m); + + return rc; +} + /* * Local variables: * mode: C