From patchwork Mon Apr 7 12:48:45 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Campbell X-Patchwork-Id: 27894 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ob0-f198.google.com (mail-ob0-f198.google.com [209.85.214.198]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 9456820553 for ; Mon, 7 Apr 2014 12:50:37 +0000 (UTC) Received: by mail-ob0-f198.google.com with SMTP id wn1sf27001892obc.9 for ; Mon, 07 Apr 2014 05:50:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:from:to:date:message-id :mime-version:cc:subject:precedence:list-id:list-unsubscribe :list-post:list-help:list-subscribe:sender:errors-to :x-original-sender:x-original-authentication-results:mailing-list :list-archive:content-type:content-transfer-encoding; bh=vA3jnY2GdsKGjb1yys+z7AbyK3ddq7V7slSdeZL9xzM=; b=IMdxDH3mPyVjoevjGO5gpzlxhTv+PWJqXVNYgEgVCKrVQdRojR7r+4pgW92/BgmkJw 445TCHhfCJE218OtYVFq/79kkWtGJAnvTq2M1+26ySbcnh8hE/81RGKazl+wpW+LWBuj 1NmakhtGsb85yLy5yqWV/yWBK+9USAuy6ekovsCXUzwmoiwG2IFjXsDGMwaGCKC2aR9e uCteX4M/XIpyglLv4GljAv6+Tm9hzNmKdfNWG+iB4Lc0Tq35CMMXcMz0UanrMmpTj/JN xIRrwlV9By+KRyfNG23ePf4ivOH/mhS7FPXA1kdQ6bNb/MrWVqa1b8Xk1vacyxaymaAJ weFQ== X-Gm-Message-State: ALoCoQkKuyT2UzZjRmA9+YIyYVfZRZufQ6kgK6hgKTl97yq0IpmMeI5vThm4b6QxLgKy2IXqoN5y X-Received: by 10.182.153.68 with SMTP id ve4mr8102815obb.39.1396875037154; Mon, 07 Apr 2014 05:50:37 -0700 (PDT) X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.102.203 with SMTP id w69ls1699883qge.3.gmail; Mon, 07 Apr 2014 05:50:37 -0700 (PDT) X-Received: by 10.52.173.165 with SMTP id bl5mr24554688vdc.13.1396875037022; Mon, 07 Apr 2014 05:50:37 -0700 (PDT) Received: from mail-vc0-f172.google.com (mail-vc0-f172.google.com [209.85.220.172]) by mx.google.com with ESMTPS id at8si2094650vec.37.2014.04.07.05.50.37 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 07 Apr 2014 05:50:37 -0700 (PDT) Received-SPF: neutral (google.com: 209.85.220.172 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=209.85.220.172; Received: by mail-vc0-f172.google.com with SMTP id la4so5165736vcb.17 for ; Mon, 07 Apr 2014 05:50:36 -0700 (PDT) X-Received: by 10.58.185.145 with SMTP id fc17mr13691395vec.14.1396875036931; Mon, 07 Apr 2014 05:50:36 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.220.12.8 with SMTP id v8csp159328vcv; Mon, 7 Apr 2014 05:50:36 -0700 (PDT) X-Received: by 10.224.36.129 with SMTP id t1mr3236869qad.88.1396875034879; Mon, 07 Apr 2014 05:50:34 -0700 (PDT) Received: from lists.xen.org (lists.xen.org. [50.57.142.19]) by mx.google.com with ESMTPS id 50si6637669qgz.74.2014.04.07.05.50.34 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 07 Apr 2014 05:50:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of xen-devel-bounces@lists.xen.org designates 50.57.142.19 as permitted sender) client-ip=50.57.142.19; Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WX8yp-00087M-7k; Mon, 07 Apr 2014 12:48:51 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WX8yn-000876-82 for xen-devel@lists.xen.org; Mon, 07 Apr 2014 12:48:49 +0000 Received: from [85.158.143.35:40084] by server-1.bemta-4.messagelabs.com id 86/D9-09853-0BE92435; Mon, 07 Apr 2014 12:48:48 +0000 X-Env-Sender: Ian.Campbell@citrix.com X-Msg-Ref: server-7.tower-21.messagelabs.com!1396874926!7517395!1 X-Originating-IP: [66.165.176.89] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni44OSA9PiAyMDMwMDc=\n X-StarScan-Received: X-StarScan-Version: 6.11.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 17306 invoked from network); 7 Apr 2014 12:48:47 -0000 Received: from smtp.citrix.com (HELO SMTP.CITRIX.COM) (66.165.176.89) by server-7.tower-21.messagelabs.com with RC4-SHA encrypted SMTP; 7 Apr 2014 12:48:47 -0000 X-IronPort-AV: E=Sophos;i="4.97,810,1389744000"; d="scan'208";a="118659420" Received: from accessns.citrite.net (HELO FTLPEX01CL03.citrite.net) ([10.9.154.239]) by FTLPIPO01.CITRIX.COM with ESMTP; 07 Apr 2014 12:48:47 +0000 Received: from norwich.cam.xci-test.com (10.80.248.129) by smtprelay.citrix.com (10.13.107.80) with Microsoft SMTP Server id 14.2.342.4; Mon, 7 Apr 2014 08:48:45 -0400 Received: from drall.uk.xensource.com ([10.80.16.71] helo=drall.uk.xensource.com.) by norwich.cam.xci-test.com with esmtp (Exim 4.72) (envelope-from ) id 1WX8yj-0006GL-AO; Mon, 07 Apr 2014 12:48:45 +0000 From: Ian Campbell To: Date: Mon, 7 Apr 2014 13:48:45 +0100 Message-ID: <1396874925-751-1-git-send-email-ian.campbell@citrix.com> X-Mailer: git-send-email 1.7.10.4 MIME-Version: 1.0 X-DLP: MIA1 Cc: keir@xen.org, Ian Campbell , stefano.stabellini@eu.citrix.com, George Dunlap , julien.grall@linaro.org, tim@xen.org, jbeulich@suse.com Subject: [Xen-devel] [PATCH xen v2] xen: arm: fully implement multicall interface. X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Post: , List-Help: , List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: ian.campbell@citrix.com X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.220.172 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Archive: I'm not sure what I was smoking at the time of 5d74ad1a082e "xen: arm: implement do_multicall_call for both 32 and 64-bit" but it is obviously insufficient since it doesn't actually wire up the hypercall. Before doing so we need to make the usual adjustments for ARM and turn the unsigned longs into xen_ulong_t. There is no difference in the resulting structure for x86. There are knock on changes to the trace interface, but again they are nops on x86. For 32-bit ARM guests we require that the arguments which they pass to a hypercall via a multicall do not use the upper bits of xen_ulong_t and kill them if they violate this. This should ensure that no ABI surprises can be silently lurking when running on a 32-bit hypervisor waiting to pounce when the same kernel is run on a 64-bit hypervisor. Killing the guest is harsh but it will be far easier to relax the restriction if it turns out to cause problems than to tighten it up if we were lax to begin with. In the interests of clarity and always using explicitly sized types change the unsigned int in the hypercall arguments to a uint32_t. There is no actual change here on any platform. We should consider backporting this to 4.4.1 in case a guest decides they want to use a multicall in common code e.g. I suggested such a thing while reviewing a netback change recently. Signed-off-by: Ian Campbell Cc: keir@xen.org Cc: jbeulich@suse.com Cc: George Dunlap Reviewed-by: Jan Beulich Acked-by: George Dunlap --- This depends on "xen: make sure that likely and unlikely convert the expression to a boolean" v2: - update compat version of __trace_multicall_call too - update xen.h on requirements when sizeof(xen_ulong_t) > sizeof(a register) - kill 32-bit guests which do not follow those requirements. After the conversation on v1 I decided that starting out harsh and relaxing if it becomes a problem was easier than discovering a mistake later. --- xen/arch/arm/traps.c | 23 +++++++++++++++++++++-- xen/common/compat/multicall.c | 2 +- xen/common/multicall.c | 4 ++-- xen/common/trace.c | 2 +- xen/include/public/xen.h | 10 ++++++---- xen/include/xen/trace.h | 2 +- 6 files changed, 32 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index a7edc4e..062c4b5 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -1012,6 +1012,7 @@ static arm_hypercall_t arm_hypercall_table[] = { HYPERCALL(sysctl, 2), HYPERCALL(hvm_op, 2), HYPERCALL(grant_table_op, 3), + HYPERCALL(multicall, 2), HYPERCALL_ARM(vcpu_op, 3), }; @@ -1159,6 +1160,21 @@ static void do_trap_hypercall(struct cpu_user_regs *regs, register_t *nr, #endif } +static void check_multicall_32bit_clean(struct multicall_entry *multi) +{ + int i; + + for ( i = 0; i < arm_hypercall_table[multi->op].nr_args; i++ ) + { + if ( unlikely(multi->args[i] & 0xffffffff00000000ULL) ) + { + printk("%pv: multicall argument %d is not 32-bit clean %"PRIx64"\n", + current, i, multi->args[i]); + domain_crash_synchronous(); + } + } +} + void do_multicall_call(struct multicall_entry *multi) { arm_hypercall_fn_t call = NULL; @@ -1176,9 +1192,12 @@ void do_multicall_call(struct multicall_entry *multi) return; } + if ( is_32bit_domain(current->domain) ) + check_multicall_32bit_clean(multi); + multi->result = call(multi->args[0], multi->args[1], - multi->args[2], multi->args[3], - multi->args[4]); + multi->args[2], multi->args[3], + multi->args[4]); } /* diff --git a/xen/common/compat/multicall.c b/xen/common/compat/multicall.c index 95c047a..2af8aef 100644 --- a/xen/common/compat/multicall.c +++ b/xen/common/compat/multicall.c @@ -29,7 +29,7 @@ DEFINE_XEN_GUEST_HANDLE(multicall_entry_compat_t); static void __trace_multicall_call(multicall_entry_t *call) { - unsigned long args[6]; + xen_ulong_t args[6]; int i; for ( i = 0; i < ARRAY_SIZE(args); i++ ) diff --git a/xen/common/multicall.c b/xen/common/multicall.c index e66c798..fa9d910 100644 --- a/xen/common/multicall.c +++ b/xen/common/multicall.c @@ -35,10 +35,10 @@ static void trace_multicall_call(multicall_entry_t *call) ret_t do_multicall( - XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list, unsigned int nr_calls) + XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list, uint32_t nr_calls) { struct mc_state *mcs = ¤t->mc_state; - unsigned int i; + uint32_t i; int rc = 0; if ( unlikely(__test_and_set_bit(_MCSF_in_multicall, &mcs->flags)) ) diff --git a/xen/common/trace.c b/xen/common/trace.c index 1814165..f651cf3 100644 --- a/xen/common/trace.c +++ b/xen/common/trace.c @@ -817,7 +817,7 @@ unlock: } void __trace_hypercall(uint32_t event, unsigned long op, - const unsigned long *args) + const xen_ulong_t *args) { struct __packed { uint32_t op; diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h index 8c5697e..a6a2092 100644 --- a/xen/include/public/xen.h +++ b/xen/include/public/xen.h @@ -541,13 +541,15 @@ DEFINE_XEN_GUEST_HANDLE(mmu_update_t); /* * ` enum neg_errnoval * ` HYPERVISOR_multicall(multicall_entry_t call_list[], - * ` unsigned int nr_calls); + * ` uint32_t nr_calls); * - * NB. The fields are natural register size for this architecture. + * NB. The fields are logically the natural register size for this + * architecture. In cases where xen_ulong_t is larger than this then + * any unused bits in the upper portion must be zero. */ struct multicall_entry { - unsigned long op, result; - unsigned long args[6]; + xen_ulong_t op, result; + xen_ulong_t args[6]; }; typedef struct multicall_entry multicall_entry_t; DEFINE_XEN_GUEST_HANDLE(multicall_entry_t); diff --git a/xen/include/xen/trace.h b/xen/include/xen/trace.h index 3b8a7b3..12966ea 100644 --- a/xen/include/xen/trace.h +++ b/xen/include/xen/trace.h @@ -45,7 +45,7 @@ static inline void trace_var(u32 event, int cycles, int extra, } void __trace_hypercall(uint32_t event, unsigned long op, - const unsigned long *args); + const xen_ulong_t *args); /* Convenience macros for calling the trace function. */ #define TRACE_0D(_e) \