|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v2 04/18] argo: init, destroy and soft-reset, with enable command line opt
Initialises basic data structures and performs teardown of argo state
for domain shutdown.
Adds a Xen command line parameter 'argo': bool to enable/disable.
=> defaults to disabled.
Introduces headers:
<public/argo.h> with definions of addresses and ring structure, including
indexes for atomic update for communication between domain and hypervisor,
and <xen/argo.h> to expose the hooks for integration into domain lifecycle
stages.
If CONFIG_ARGO is enabled:
Adds: per-domain init of argo data structures to domain_create by calling
argo_init; teardown via argo_destroy into domain_destroy and the error exit
path of domain_create; and reset of domain state in argo_soft_reset.
In accordance with recent work on _domain_destroy, argo_destroy is
idempotent.
Adds two new fields to struct domain:
rwlock_t argo_lock;
struct argo_domain *argo;
The software license on the public header is the BSD license, standard
procedure for the public Xen headers.
A count will be maintained of the number of rings that a domain has
registered in order to limit it below the fixed maximum limit defined here.
Signed-off-by: Christopher Clark <christopher.clark6@xxxxxxxxxxxxxx>
---
Changes since v1:
v1 #5 feedback Paul: init/destroy unsigned, brackets and whitespace fixes
v1 #5 feedback Paul: Use mfn_eq for comparing mfns.
v1 #5 feedback Paul: init/destroy : use currd
v1 #6 (#5) feedback Jan: init/destroy: s/ENOSYS/EOPNOTSUPP/
v1 #6 feedback Paul: Folded patch 6 into patch 5.
v1 #6 feedback Jan: drop opt_argo_enabled initializer
v1 $6 feedback Jan: s/ENOSYS/EOPNOTSUPP/g and drop useless dprintk
v1 #5 feedback Paul: change the license on public header to BSD
v1 drop unnecessary xen include from sched.h
v1 drop inclusion of public argo.h in private one
v1 add include of public argo.h to argo.c
v1 drop fwd decl of argo_domain in priv header
v1 Paul/Jan: add data structures to xlat.lst and compat/argo.h to Makefile
v1. removed allocation of event channel since switching to VIRQ
v1. drop types.h include from private argo.h
v1: reorder public argo include position
v1: #13 feedback Jan: public namespace: prefix with xen
v1: rename pending ent "id" to "domain_id"
v1: add domain_cookie to ent struct
v1. #15 feedback Jan: make cmd unsigned
v1. #15 feedback Jan: make i loop variable unsigned
v1: adjust dprintks in init, destroy
v1: #18 feedback Jan: meld max ring count limit
v1: use type not struct in public defn, affects compat gen header
v1: feedback #15 Jan: handle upper-halves of hypercall args
v1: add comment explaining the 'magic' field
v1: via Jan feedback: implement soft reset
v1: feedback #13 Roger: use ASSERT_UNREACHABLE
xen/common/argo.c | 331 +++++++++++++++++++++++++++++++++++++++++++++-
xen/common/domain.c | 20 +++
xen/include/Makefile | 1 +
xen/include/public/argo.h | 70 ++++++++++
xen/include/xen/argo.h | 23 ++++
xen/include/xen/sched.h | 6 +
xen/include/xlat.lst | 3 +
7 files changed, 453 insertions(+), 1 deletion(-)
create mode 100644 xen/include/public/argo.h
create mode 100644 xen/include/xen/argo.h
diff --git a/xen/common/argo.c b/xen/common/argo.c
index 98f40b5..2d2f8a8 100644
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -17,7 +17,110 @@
*/
#include <xen/errno.h>
+#include <xen/sched.h>
+#include <xen/domain.h>
+#include <xen/argo.h>
+#include <xen/event.h>
+#include <xen/domain_page.h>
#include <xen/guest_access.h>
+#include <xen/time.h>
+#include <public/argo.h>
+
+#define ARGO_MAX_RINGS_PER_DOMAIN 128U
+
+DEFINE_XEN_GUEST_HANDLE(xen_argo_addr_t);
+DEFINE_XEN_GUEST_HANDLE(xen_argo_ring_t);
+
+/* Xen command line option to enable argo */
+static bool __read_mostly opt_argo_enabled;
+boolean_param("argo", opt_argo_enabled);
+
+struct argo_pending_ent
+{
+ struct hlist_node node;
+ domid_t domain_id;
+ uint16_t pad;
+ uint32_t len;
+ uint64_t domain_cookie;
+};
+
+struct argo_ring_info
+{
+ /* next node in the hash, protected by L2 */
+ struct hlist_node node;
+ /* this ring's id, protected by L2 */
+ xen_argo_ring_id_t id;
+ /* used to confirm sender id, protected by L2 */
+ uint64_t partner_cookie;
+ /* L3 */
+ spinlock_t lock;
+ /* cached length of the ring (from ring->len), protected by L3 */
+ uint32_t len;
+ /* number of pages in the ring, protected by L3 */
+ uint32_t npage;
+ /* number of pages translated into mfns, protected by L3 */
+ uint32_t nmfns;
+ /* cached tx pointer location, protected by L3 */
+ uint32_t tx_ptr;
+ /* mapped ring pages protected by L3 */
+ uint8_t **mfn_mapping;
+ /* list of mfns of guest ring, protected by L3 */
+ mfn_t *mfns;
+ /* list of struct argo_pending_ent for this ring, protected by L3 */
+ struct hlist_head pending;
+};
+
+/*
+ * The value of the argo element in a struct domain is
+ * protected by the global lock argo_lock: L1
+ */
+#define ARGO_HTABLE_SIZE 32
+struct argo_domain
+{
+ /* L2 */
+ rwlock_t lock;
+ /* protected by L2 */
+ struct hlist_head ring_hash[ARGO_HTABLE_SIZE];
+ /* id cookie, written only at init, so readable with R(L1) */
+ uint64_t domain_cookie;
+ /* counter of rings registered by this domain, protected by L2 */
+ uint32_t ring_count;
+};
+
+/*
+ * locks
+ */
+
+/*
+ * locking is organized as follows:
+ *
+ * L1 : The global lock: argo_lock
+ * Protects the argo elements of all struct domain *d in the system.
+ * It does not protect any of the elements of d->argo, only their
+ * addresses.
+ * By extension since the destruction of a domain with a non-NULL
+ * d->argo will need to free the d->argo pointer, holding this lock
+ * guarantees that no domains pointers that argo is interested in
+ * become invalid whilst this lock is held.
+ */
+
+static DEFINE_RWLOCK(argo_lock); /* L1 */
+
+/*
+ * L2 : The per-domain lock: d->argo->lock
+ * Holding a read lock on L2 protects the hash table and
+ * the elements in the hash_table d->argo->ring_hash, and
+ * the node and id fields in struct argo_ring_info in the
+ * hash table.
+ * Holding a write lock on L2 protects all of the elements of
+ * struct argo_ring_info.
+ * To take L2 you must already have R(L1). W(L1) implies W(L2) and L3.
+ *
+ * L3 : The ringinfo lock: argo_ring_info *ringinfo; ringinfo->lock
+ * Protects len, tx_ptr, the guest ring, the guest ring_data and
+ * the pending list.
+ * To aquire L3 you must already have R(L2). W(L2) implies L3.
+ */
/*
* Debug
@@ -32,10 +135,236 @@
#define argo_dprintk(format, ... ) ((void)0)
#endif
+/*
+ * ring buffer
+ */
+
+/* caller must have L3 or W(L2) */
+static void
+argo_ring_unmap(struct argo_ring_info *ring_info)
+{
+ unsigned int i;
+
+ if ( !ring_info->mfn_mapping )
+ return;
+
+ for ( i = 0; i < ring_info->nmfns; i++ )
+ {
+ if ( !ring_info->mfn_mapping[i] )
+ continue;
+ if ( ring_info->mfns )
+ argo_dprintk(XENLOG_ERR "argo: unmapping page %"PRI_mfn" from
%p\n",
+ mfn_x(ring_info->mfns[i]),
+ ring_info->mfn_mapping[i]);
+ unmap_domain_page_global(ring_info->mfn_mapping[i]);
+ ring_info->mfn_mapping[i] = NULL;
+ }
+}
+
+/*
+ * pending
+ */
+static void
+argo_pending_remove_ent(struct argo_pending_ent *ent)
+{
+ hlist_del(&ent->node);
+ xfree(ent);
+}
+
+static void
+argo_pending_remove_all(struct argo_ring_info *ring_info)
+{
+ struct hlist_node *node, *next;
+ struct argo_pending_ent *pending_ent;
+
+ hlist_for_each_entry_safe(pending_ent, node, next, &ring_info->pending,
+ node)
+ argo_pending_remove_ent(pending_ent);
+}
+
+static void argo_ring_remove_mfns(const struct domain *d,
+ struct argo_ring_info *ring_info)
+{
+ unsigned int i;
+
+ ASSERT(rw_is_write_locked(&d->argo->lock));
+
+ if ( !ring_info->mfns )
+ return;
+
+ if ( !ring_info->mfn_mapping )
+ {
+ ASSERT_UNREACHABLE();
+ return;
+ }
+
+ argo_ring_unmap(ring_info);
+
+ for ( i = 0; i < ring_info->nmfns; i++ )
+ if ( !mfn_eq(ring_info->mfns[i], INVALID_MFN) )
+ put_page_and_type(mfn_to_page(ring_info->mfns[i]));
+
+ xfree(ring_info->mfns);
+ ring_info->mfns = NULL;
+ ring_info->npage = 0;
+ xfree(ring_info->mfn_mapping);
+ ring_info->mfn_mapping = NULL;
+ ring_info->nmfns = 0;
+}
+
+static void
+argo_ring_remove_info(struct domain *d, struct argo_ring_info *ring_info)
+{
+ ASSERT(rw_is_write_locked(&d->argo->lock));
+
+ /* Holding W(L2) so do not need to acquire L3 */
+ argo_pending_remove_all(ring_info);
+ hlist_del(&ring_info->node);
+ argo_ring_remove_mfns(d, ring_info);
+ xfree(ring_info);
+}
+
long
do_argo_message_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1,
XEN_GUEST_HANDLE_PARAM(void) arg2,
unsigned long arg3, unsigned long arg4)
{
- return -ENOSYS;
+ struct domain *currd = current->domain;
+ long rc = -EFAULT;
+
+ argo_dprintk("->do_argo_message_op(%u,%p,%p,%d,%d)\n", cmd,
+ (void *)arg1.p, (void *)arg2.p, (int) arg3, (int) arg4);
+
+ if ( unlikely(!opt_argo_enabled) )
+ {
+ rc = -EOPNOTSUPP;
+ return rc;
+ }
+
+ domain_lock(currd);
+
+ switch (cmd)
+ {
+ default:
+ rc = -EOPNOTSUPP;
+ break;
+ }
+
+ domain_unlock(currd);
+
+ argo_dprintk("<-do_argo_message_op(%u)=%ld\n", cmd, rc);
+
+ return rc;
+}
+
+void
+argo_init_domain_state(struct argo_domain *argo)
+{
+ unsigned int i;
+
+ rwlock_init(&argo->lock);
+ argo->ring_count = 0;
+
+ for ( i = 0; i < ARGO_HTABLE_SIZE; ++i )
+ INIT_HLIST_HEAD(&argo->ring_hash[i]);
+
+ argo->domain_cookie = (uint64_t)NOW();
+}
+
+int
+argo_init(struct domain *d)
+{
+ struct argo_domain *argo;
+
+ if ( !opt_argo_enabled )
+ {
+ argo_dprintk("argo disabled, domid: %d\n", d->domain_id);
+ return 0;
+ }
+
+ argo_dprintk("init: domid: %d\n", d->domain_id);
+
+ argo = xmalloc(struct argo_domain);
+ if ( !argo )
+ return -ENOMEM;
+
+ argo_init_domain_state(argo);
+
+ write_lock(&argo_lock);
+
+ d->argo = argo;
+
+ write_unlock(&argo_lock);
+
+ return 0;
+}
+
+void
+argo_unregister_all_rings(struct domain *d)
+{
+ unsigned int i;
+
+ for ( i = 0; i < ARGO_HTABLE_SIZE; ++i )
+ {
+ struct hlist_node *node, *next;
+ struct argo_ring_info *ring_info;
+
+ hlist_for_each_entry_safe(ring_info, node, next,
+ &d->argo->ring_hash[i], node)
+ argo_ring_remove_info(d, ring_info);
+ }
+}
+
+void
+argo_destroy(struct domain *d)
+{
+ BUG_ON(!d->is_dying);
+
+ write_lock(&argo_lock);
+
+ argo_dprintk("destroy: domid %d d->argo=%p\n", d->domain_id, d->argo);
+
+ if ( d->argo )
+ {
+ argo_unregister_all_rings(d);
+
+ d->argo->domain_cookie = 0;
+ xfree(d->argo);
+ d->argo = NULL;
+ }
+ write_unlock(&argo_lock);
+
+ /*
+ * This (dying) domain's domid may be recorded as the authorized sender
+ * to rings registered by other domains, and those rings are not
+ * unregistered here.
+ * If a later domain is created that has the same domid as this one, the
+ * domain_cookie will differ, which ensures that the new domain cannot
+ * use the inherited authorizations to transmit that were issued to this
+ * domain.
+ */
+}
+
+void
+argo_soft_reset(struct domain *d)
+{
+ write_lock(&argo_lock);
+
+ argo_dprintk("soft reset d=%d d->argo=%p\n", d->domain_id, d->argo);
+
+ if ( d->argo )
+ {
+ argo_unregister_all_rings(d);
+
+ if ( !opt_argo_enabled || xsm_argo_enable(d) )
+ {
+ d->argo->domain_cookie = 0;
+ xfree(d->argo);
+ d->argo = NULL;
+ }
+ else
+ argo_init_domain_state(d->argo);
+ }
+
+ write_unlock(&argo_lock);
}
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 78cc524..601c663 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -32,6 +32,7 @@
#include <xen/grant_table.h>
#include <xen/xenoprof.h>
#include <xen/irq.h>
+#include <xen/argo.h>
#include <asm/debugger.h>
#include <asm/p2m.h>
#include <asm/processor.h>
@@ -277,6 +278,10 @@ static void _domain_destroy(struct domain *d)
xfree(d->pbuf);
+#ifdef CONFIG_ARGO
+ argo_destroy(d);
+#endif
+
rangeset_domain_destroy(d);
free_cpumask_var(d->dirty_cpumask);
@@ -376,6 +381,9 @@ struct domain *domain_create(domid_t domid,
spin_lock_init(&d->hypercall_deadlock_mutex);
INIT_PAGE_LIST_HEAD(&d->page_list);
INIT_PAGE_LIST_HEAD(&d->xenpage_list);
+#ifdef CONFIG_ARGO
+ rwlock_init(&d->argo_lock);
+#endif
spin_lock_init(&d->node_affinity_lock);
d->node_affinity = NODE_MASK_ALL;
@@ -445,6 +453,11 @@ struct domain *domain_create(domid_t domid,
goto fail;
init_status |= INIT_gnttab;
+#ifdef CONFIG_ARGO
+ if ( (err = argo_init(d)) != 0 )
+ goto fail;
+#endif
+
err = -ENOMEM;
d->pbuf = xzalloc_array(char, DOMAIN_PBUF_SIZE);
@@ -717,6 +730,9 @@ int domain_kill(struct domain *d)
if ( d->is_dying != DOMDYING_alive )
return domain_kill(d);
d->is_dying = DOMDYING_dying;
+#ifdef CONFIG_ARGO
+ argo_destroy(d);
+#endif
evtchn_destroy(d);
gnttab_release_mappings(d);
tmem_destroy(d->tmem_client);
@@ -1172,6 +1188,10 @@ int domain_soft_reset(struct domain *d)
grant_table_warn_active_grants(d);
+#ifdef CONFIG_ARGO
+ argo_soft_reset(d);
+#endif
+
for_each_vcpu ( d, v )
{
set_xen_guest_handle(runstate_guest(v), NULL);
diff --git a/xen/include/Makefile b/xen/include/Makefile
index f7895e4..3d14532 100644
--- a/xen/include/Makefile
+++ b/xen/include/Makefile
@@ -5,6 +5,7 @@ ifneq ($(CONFIG_COMPAT),)
compat-arch-$(CONFIG_X86) := x86_32
headers-y := \
+ compat/argo.h \
compat/callback.h \
compat/elfnote.h \
compat/event_channel.h \
diff --git a/xen/include/public/argo.h b/xen/include/public/argo.h
new file mode 100644
index 0000000..a32fb2d
--- /dev/null
+++ b/xen/include/public/argo.h
@@ -0,0 +1,70 @@
+/******************************************************************************
+ * Argo : Hypervisor-Mediated data eXchange
+ *
+ * Derived from v4v, the version 2 of v2v.
+ *
+ * Copyright (c) 2010, Citrix Systems
+ * Copyright (c) 2018, BAE Systems
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __XEN_PUBLIC_ARGO_H__
+#define __XEN_PUBLIC_ARGO_H__
+
+#include "xen.h"
+
+typedef struct xen_argo_addr
+{
+ uint32_t port;
+ domid_t domain_id;
+ uint16_t pad;
+} xen_argo_addr_t;
+
+typedef struct xen_argo_ring_id
+{
+ xen_argo_addr_t addr;
+ domid_t partner;
+ uint16_t pad;
+} xen_argo_ring_id_t;
+
+typedef struct xen_argo_ring
+{
+ /*
+ * Contents of the 'magic' field are inspected to verify that they contain
+ * an expected value before the hypervisor will perform writes into this
+ * structure in guest-supplied memory.
+ */
+ uint64_t magic;
+ xen_argo_ring_id_t id;
+ uint32_t len;
+ /* Guests should use atomic operations to access rx_ptr */
+ uint32_t rx_ptr;
+ /* Guests should use atomic operations to access tx_ptr */
+ uint32_t tx_ptr;
+ uint8_t reserved[32];
+#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L
+ uint8_t ring[];
+#elif defined(__GNUC__)
+ uint8_t ring[0];
+#endif
+} xen_argo_ring_t;
+
+#endif
diff --git a/xen/include/xen/argo.h b/xen/include/xen/argo.h
new file mode 100644
index 0000000..29d32a9
--- /dev/null
+++ b/xen/include/xen/argo.h
@@ -0,0 +1,23 @@
+/******************************************************************************
+ * Argo : Hypervisor-Mediated data eXchange
+ *
+ * Copyright (c) 2018, BAE Systems
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef __XEN_ARGO_H__
+#define __XEN_ARGO_H__
+
+int argo_init(struct domain *d);
+void argo_destroy(struct domain *d);
+void argo_soft_reset(struct domain *d);
+
+#endif
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 0309c1f..f5ac0e8 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -490,6 +490,12 @@ struct domain
unsigned int guest_request_enabled : 1;
unsigned int guest_request_sync : 1;
} monitor;
+
+#ifdef CONFIG_ARGO
+ /* Argo interdomain communication support */
+ rwlock_t argo_lock;
+ struct argo_domain *argo;
+#endif
};
/* Protect updates/reads (resp.) of domain_list and domain_hash. */
diff --git a/xen/include/xlat.lst b/xen/include/xlat.lst
index 5273320..33e4fd1 100644
--- a/xen/include/xlat.lst
+++ b/xen/include/xlat.lst
@@ -148,3 +148,6 @@
? flask_setenforce xsm/flask_op.h
! flask_sid_context xsm/flask_op.h
? flask_transition xsm/flask_op.h
+? argo_addr argo.h
+? argo_ring_id argo.h
+? argo_ring argo.h
--
2.7.4
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |