This patch removes the implicit domain_crash() from iommu_map(), unmap_page() and iommu_iotlb_flush() and turns them into straightforward wrappers that check the existence of the relevant iommu_op and call through to it. This makes them usable by PV IOMMU code to be delivered in future patches. This patch adds a helper macro, domu_crash(), that will only invoke domain_crash() if the domain is not the hardware domain and modifies callers of iommu_map(), unmap_page() and iommu_iotlb_flush() to use this should an operation fail.
NOTE: This patch includes one bit of clean-up in set_identity_p2m_entry() replacing use of p2m->domain with the domain pointer passed into the function. Signed-off-by: Paul Durrant <paul.durr...@citrix.com> Reviewed-by: Jan Beulich <jbeul...@suse.com> --- Cc: Wei Liu <wei.l...@citrix.com> Cc: Stefano Stabellini <sstabell...@kernel.org> Cc: Julien Grall <julien.gr...@arm.com> Cc: Andrew Cooper <andrew.coop...@citrix.com> Cc: Ian Jackson <ian.jack...@eu.citrix.com> Cc: Konrad Rzeszutek Wilk <konrad.w...@oracle.com> Cc: Tim Deegan <t...@xen.org> Cc: Jun Nakajima <jun.nakaj...@intel.com> Cc: Kevin Tian <kevin.t...@intel.com> Cc: George Dunlap <george.dun...@eu.citrix.com> v7: - Re-base and re-name BFN -> DFN. - Move domu_crash() outside double locked region in grant_table.c. - Added Jan's R-b. v6: - Introduce domu_crash() (idea suggested by Kevin, name suggested by Jan) to crash non-hardware domains. - Dropped Wei's and George's R-b because of change. v2: - New in v2. --- xen/arch/arm/p2m.c | 4 ++++ xen/arch/x86/mm.c | 3 +++ xen/arch/x86/mm/p2m-ept.c | 3 +++ xen/arch/x86/mm/p2m-pt.c | 3 +++ xen/arch/x86/mm/p2m.c | 22 ++++++++++++++++++---- xen/common/grant_table.c | 4 ++++ xen/common/memory.c | 3 +++ xen/drivers/passthrough/iommu.c | 12 ------------ xen/drivers/passthrough/x86/iommu.c | 4 ++++ xen/include/xen/sched.h | 5 +++++ 10 files changed, 47 insertions(+), 16 deletions(-) diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c index 0db12b01f1..1c79ff7ade 100644 --- a/xen/arch/arm/p2m.c +++ b/xen/arch/arm/p2m.c @@ -957,8 +957,12 @@ static int __p2m_set_entry(struct p2m_domain *p2m, if ( need_iommu(p2m->domain) && (lpae_is_valid(orig_pte) || lpae_is_valid(*entry)) ) + { rc = iommu_iotlb_flush(p2m->domain, _dfn(gfn_x(sgfn)), 1UL << page_order); + if ( unlikely(rc) ) + domu_crash(p2m->domain); + } else rc = 0; diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index e503dedebe..57764e84fa 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -2765,6 +2765,9 @@ static int _get_page_type(struct page_info *page, unsigned long type, iommu_ret = iommu_map_page(d, _dfn(mfn_x(mfn)), mfn, IOMMUF_readable | IOMMUF_writable); + + if ( unlikely(iommu_ret) ) + domu_crash(d); } } diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c index 9a3a90e9e6..af7674f7e1 100644 --- a/xen/arch/x86/mm/p2m-ept.c +++ b/xen/arch/x86/mm/p2m-ept.c @@ -895,6 +895,9 @@ out: if ( !rc ) rc = ret; } + + if ( unlikely(rc) ) + domu_crash(d); } } diff --git a/xen/arch/x86/mm/p2m-pt.c b/xen/arch/x86/mm/p2m-pt.c index 881e9e87b8..607046f31b 100644 --- a/xen/arch/x86/mm/p2m-pt.c +++ b/xen/arch/x86/mm/p2m-pt.c @@ -717,6 +717,9 @@ p2m_pt_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn, rc = ret; } } + + if ( unlikely(rc) ) + domu_crash(p2m->domain); } /* diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c index 801b629b95..537add65bb 100644 --- a/xen/arch/x86/mm/p2m.c +++ b/xen/arch/x86/mm/p2m.c @@ -724,6 +724,9 @@ p2m_remove_page(struct p2m_domain *p2m, unsigned long gfn_l, unsigned long mfn, if ( !rc ) rc = ret; } + + if ( unlikely(rc) ) + domu_crash(p2m->domain); } return rc; @@ -789,6 +792,7 @@ guest_physmap_add_entry(struct domain *d, gfn_t gfn, mfn_t mfn, if ( iommu_unmap_page(d, dfn_add(dfn, i)) ) continue; + domu_crash(d); return rc; } } @@ -1157,12 +1161,17 @@ int set_identity_p2m_entry(struct domain *d, unsigned long gfn_l, struct p2m_domain *p2m = p2m_get_hostp2m(d); int ret; - if ( !paging_mode_translate(p2m->domain) ) + if ( !paging_mode_translate(d) ) { if ( !need_iommu(d) ) return 0; - return iommu_map_page(d, _dfn(gfn_l), _mfn(gfn_l), - IOMMUF_readable | IOMMUF_writable); + + ret = iommu_map_page(d, _dfn(gfn_l), _mfn(gfn_l), + IOMMUF_readable | IOMMUF_writable); + if ( unlikely(ret) ) + domu_crash(d); + + return ret; } gfn_lock(p2m, gfn, 0); @@ -1252,7 +1261,12 @@ int clear_identity_p2m_entry(struct domain *d, unsigned long gfn_l) { if ( !need_iommu(d) ) return 0; - return iommu_unmap_page(d, _dfn(gfn_l)); + + ret = iommu_unmap_page(d, _dfn(gfn_l)); + if ( unlikely(ret) ) + domu_crash(d); + + return ret; } gfn_lock(p2m, gfn, 0); diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 2d01cad176..0f0b7b1a49 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -1155,6 +1155,7 @@ map_grant_ref( if ( err ) { double_gt_unlock(lgt, rgt); + domu_crash(ld); rc = GNTST_general_error; goto undo_out; } @@ -1406,7 +1407,10 @@ unmap_common( double_gt_unlock(lgt, rgt); if ( err ) + { + domu_crash(ld); rc = GNTST_general_error; + } } /* If just unmapped a writable mapping, mark as dirtied */ diff --git a/xen/common/memory.c b/xen/common/memory.c index 89b211d6aa..85611ddae4 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -841,6 +841,9 @@ int xenmem_add_to_physmap(struct domain *d, struct xen_add_to_physmap *xatp, ret = iommu_iotlb_flush(d, _dfn(xatp->gpfn - done), done); if ( unlikely(ret) && rc >= 0 ) rc = ret; + + if ( unlikely(rc < 0) ) + domu_crash(d); } #endif diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c index 15ae66a06c..a16f1a0c66 100644 --- a/xen/drivers/passthrough/iommu.c +++ b/xen/drivers/passthrough/iommu.c @@ -271,9 +271,6 @@ int iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn, printk(XENLOG_ERR "d%d: IOMMU mapping dfn %"PRI_dfn" to mfn %"PRI_mfn" failed: %d\n", d->domain_id, dfn_x(dfn), mfn_x(mfn), rc); - - if ( !is_hardware_domain(d) ) - domain_crash(d); } return rc; @@ -294,9 +291,6 @@ int iommu_unmap_page(struct domain *d, dfn_t dfn) printk(XENLOG_ERR "d%d: IOMMU unmapping dfn %"PRI_dfn" failed: %d\n", d->domain_id, dfn_x(dfn), rc); - - if ( !is_hardware_domain(d) ) - domain_crash(d); } return rc; @@ -334,9 +328,6 @@ int iommu_iotlb_flush(struct domain *d, dfn_t dfn, unsigned int page_count) printk(XENLOG_ERR "d%d: IOMMU IOTLB flush failed: %d, dfn %"PRI_dfn", page count %u\n", d->domain_id, rc, dfn_x(dfn), page_count); - - if ( !is_hardware_domain(d) ) - domain_crash(d); } return rc; @@ -357,9 +348,6 @@ int iommu_iotlb_flush_all(struct domain *d) printk(XENLOG_ERR "d%d: IOMMU IOTLB flush all failed: %d\n", d->domain_id, rc); - - if ( !is_hardware_domain(d) ) - domain_crash(d); } return rc; diff --git a/xen/drivers/passthrough/x86/iommu.c b/xen/drivers/passthrough/x86/iommu.c index 21e6678f16..620bdc14c3 100644 --- a/xen/drivers/passthrough/x86/iommu.c +++ b/xen/drivers/passthrough/x86/iommu.c @@ -104,7 +104,11 @@ int arch_iommu_populate_page_table(struct domain *d) this_cpu(iommu_dont_flush_iotlb) = 0; if ( !rc ) + { rc = iommu_iotlb_flush_all(d); + if ( unlikely(rc) ) + domain_crash(d); + } if ( rc && rc != -ERESTART ) iommu_teardown(d); diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h index 0ba80cb1a8..f2c594d197 100644 --- a/xen/include/xen/sched.h +++ b/xen/include/xen/sched.h @@ -616,6 +616,11 @@ void __domain_crash(struct domain *d); __domain_crash(d); \ } while (0) +#define domu_crash(d) do { \ + if ( !is_hardware_domain(d) ) \ + domain_crash(d); \ +} while (false) + /* * Called from assembly code, with an optional address to help indicate why * the crash occured. If addr is 0, look up address from last extable -- 2.11.0 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel