There are some use cases where the toolstack needs to know the guest
memory map. For example, the toolstack helper application
"init-dom0less" needs to know the guest magic page regions for 1:1
direct-mapped dom0less DomUs to allocate magic pages.
To address such needs, add XEN_DOMCTL_get_mem_map hypercall and
related data structures to query the hypervisor for the guest memory
map. The guest memory map is recorded in the domain structure and
currently only guest magic page region is recorded in the guest
memory map. The guest magic page region is initialized at the domain
creation time as the layout in the public header, and it is updated
for 1:1 dom0less DomUs (see the following commit) to avoid conflict
with RAM.
Take the opportunity to drop an unnecessary empty line to keep the
coding style consistent in the file.
Reported-by: Alec Kwapis <alec.kwapis@medtronic.com>
Signed-off-by: Henry Wang <xin.wang2@amd.com>
---
RFC: I think the newly introduced "struct xen_domctl_mem_map" is
quite duplicated with "struct xen_memory_map", any comment on reuse
the "struct xen_memory_map" for simplicity?
v3:
- Init the return rc for XEN_DOMCTL_get_mem_map.
- Copy the nr_mem_regions back as it should be both IN & OUT.
- Check if mem_map->nr_mem_regions exceeds the XEN_MAX_MEM_REGIONS
when adding a new entry.
- Allow XEN_MAX_MEM_REGIONS to be different between different archs.
- Add explicit padding and check to the domctl structures.
v2:
- New patch
---
tools/include/xenctrl.h | 4 ++++
tools/libs/ctrl/xc_domain.c | 33 +++++++++++++++++++++++++++++++
xen/arch/arm/domain.c | 15 ++++++++++++++
xen/arch/arm/domctl.c | 32 +++++++++++++++++++++++++++++-
xen/arch/arm/include/asm/domain.h | 8 ++++++++
xen/include/public/arch-arm.h | 11 +++++++++++
xen/include/public/domctl.h | 27 +++++++++++++++++++++++++
7 files changed, 129 insertions(+), 1 deletion(-)
diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h
index 2ef8b4e054..b25e9772a2 100644
--- a/tools/include/xenctrl.h
+++ b/tools/include/xenctrl.h
@@ -1195,6 +1195,10 @@ int xc_domain_setmaxmem(xc_interface *xch,
uint32_t domid,
uint64_t max_memkb);
+int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid,
+ struct xen_mem_region mem_regions[],
+ uint32_t *nr_regions);
+
int xc_domain_set_memmap_limit(xc_interface *xch,
uint32_t domid,
unsigned long map_limitkb);
diff --git a/tools/libs/ctrl/xc_domain.c b/tools/libs/ctrl/xc_domain.c
index f2d9d14b4d..8363657dae 100644
--- a/tools/libs/ctrl/xc_domain.c
+++ b/tools/libs/ctrl/xc_domain.c
@@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch,
return do_domctl(xch, &domctl);
}
+int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid,
+ struct xen_mem_region mem_regions[],
+ uint32_t *nr_regions)
+{
+ int rc;
+ struct xen_domctl domctl = {
+ .cmd = XEN_DOMCTL_get_mem_map,
+ .domain = domid,
+ .u.mem_map = {
+ .nr_mem_regions = *nr_regions,
+ .pad = 0,
+ },
+ };
+
+ DECLARE_HYPERCALL_BOUNCE(mem_regions,
+ sizeof(xen_mem_region_t) * (*nr_regions),
+ XC_HYPERCALL_BUFFER_BOUNCE_OUT);
+
+ if ( !mem_regions || xc_hypercall_bounce_pre(xch, mem_regions) ||
+ (*nr_regions) < 1 )
+ return -1;
+
+ set_xen_guest_handle(domctl.u.mem_map.buffer, mem_regions);
+
+ rc = do_domctl(xch, &domctl);
+
+ xc_hypercall_bounce_post(xch, mem_regions);
+
+ *nr_regions = domctl.u.mem_map.nr_mem_regions;
+
+ return rc;
+}
+
#if defined(__i386__) || defined(__x86_64__)
int xc_domain_set_memory_map(xc_interface *xch,
uint32_t domid,
diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index f38cb5e04c..e77d157626 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d,
{
unsigned int count = 0;
int rc;
+ struct mem_map_domain *mem_map = &d->arch.mem_map;
BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS);
@@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d,
d->arch.sve_vl = config->arch.sve_vl;
#endif
+ if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS )
+ {
+ mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE;
+ mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE;
+ mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC;
+ mem_map->nr_mem_regions++;
+ }
+ else
+ {
+ printk("Exceed max number of supported memory map regions\n");
+ rc = -ENOSPC;
+ goto fail;
+ }
+
return 0;
fail:
diff --git a/xen/arch/arm/domctl.c b/xen/arch/arm/domctl.c
index ad56efb0f5..ede19d80a3 100644
--- a/xen/arch/arm/domctl.c
+++ b/xen/arch/arm/domctl.c
@@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
return 0;
}
-
case XEN_DOMCTL_vuart_op:
{
int rc;
@@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
return rc;
}
+ case XEN_DOMCTL_get_mem_map:
+ {
+ int rc = 0;
+ uint32_t nr_regions, i;
+
+ if ( domctl->u.mem_map.pad )
+ return -EINVAL;
+
+ /*
+ * Cap the number of regions to the minimum value between toolstack and
+ * hypervisor to avoid overflowing the buffer.
+ */
+ nr_regions = min(d->arch.mem_map.nr_mem_regions,
+ domctl->u.mem_map.nr_mem_regions);
+
+ domctl->u.mem_map.nr_mem_regions = nr_regions;
+
+ for ( i = 0; i < nr_regions; i++ )
+ {
+ if ( d->arch.mem_map.regions[i].pad )
+ return -EINVAL;
+ }
+
+ if ( copy_to_guest(domctl->u.mem_map.buffer,
+ d->arch.mem_map.regions,
+ nr_regions) ||
+ __copy_to_guest(u_domctl, domctl, 1) )
+ rc = -EFAULT;
+
+ return rc;
+ }
default:
return subarch_do_domctl(domctl, d, u_domctl);
}
diff --git a/xen/arch/arm/include/asm/domain.h b/xen/arch/arm/include/asm/domain.h
index f1d72c6e48..a559a9e499 100644
--- a/xen/arch/arm/include/asm/domain.h
+++ b/xen/arch/arm/include/asm/domain.h
@@ -10,6 +10,7 @@
#include <asm/gic.h>
#include <asm/vgic.h>
#include <asm/vpl011.h>
+#include <public/domctl.h>
#include <public/hvm/params.h>
struct hvm_domain
@@ -59,6 +60,11 @@ struct paging_domain {
unsigned long p2m_total_pages;
};
+struct mem_map_domain {
+ unsigned int nr_mem_regions;
+ struct xen_mem_region regions[XEN_MAX_MEM_REGIONS];
+};
+
struct arch_domain
{
#ifdef CONFIG_ARM_64
@@ -77,6 +83,8 @@ struct arch_domain
struct paging_domain paging;
+ struct mem_map_domain mem_map;
+
struct vmmio vmmio;
/* Continuable domain_relinquish_resources(). */
diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
index a25e87dbda..cd47ae9d74 100644
--- a/xen/include/public/arch-arm.h
+++ b/xen/include/public/arch-arm.h
@@ -223,6 +223,13 @@ typedef uint64_t xen_pfn_t;
*/
#define XEN_LEGACY_MAX_VCPUS 1
+/*
+ * Maximum number of memory map regions for guest memory layout.
+ * Used by XEN_DOMCTL_get_mem_map, currently there is only one region
+ * for the guest magic pages.
+ */
+#define XEN_MAX_MEM_REGIONS 1
+
typedef uint64_t xen_ulong_t;
#define PRI_xen_ulong PRIx64
@@ -420,6 +427,10 @@ typedef uint64_t xen_callback_t;
* should instead use the FDT.
*/
+/* Guest memory region types */
+#define GUEST_MEM_REGION_DEFAULT 0
+#define GUEST_MEM_REGION_MAGIC 1
+
/* Physical Address Space */
/* Virtio MMIO mappings */
diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
index a33f9ec32b..f0a0a9b58f 100644
--- a/xen/include/public/domctl.h
+++ b/xen/include/public/domctl.h
@@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool {
uint64_aligned_t size; /* Size in bytes. */
};
+#ifndef XEN_MAX_MEM_REGIONS
+#define XEN_MAX_MEM_REGIONS 1
+#endif
+
+struct xen_mem_region {
+ uint64_aligned_t start;
+ uint64_aligned_t size;
+ uint32_t type;
+ /* Must be zero */
+ uint32_t pad;
+};
+typedef struct xen_mem_region xen_mem_region_t;
+DEFINE_XEN_GUEST_HANDLE(xen_mem_region_t);
+
+struct xen_domctl_mem_map {
+ /* IN & OUT */
+ uint32_t nr_mem_regions;
+ /* Must be zero */
+ uint32_t pad;
+ /* OUT */
+ XEN_GUEST_HANDLE_64(xen_mem_region_t) buffer;
+};
+typedef struct xen_domctl_mem_map xen_domctl_mem_map_t;
+DEFINE_XEN_GUEST_HANDLE(xen_domctl_mem_map_t);
+
#if defined(__i386__) || defined(__x86_64__)
struct xen_domctl_vcpu_msr {
uint32_t index;
@@ -1277,6 +1302,7 @@ struct xen_domctl {
#define XEN_DOMCTL_vmtrace_op 84
#define XEN_DOMCTL_get_paging_mempool_size 85
#define XEN_DOMCTL_set_paging_mempool_size 86
+#define XEN_DOMCTL_get_mem_map 87
#define XEN_DOMCTL_gdbsx_guestmemio 1000
#define XEN_DOMCTL_gdbsx_pausevcpu 1001
#define XEN_DOMCTL_gdbsx_unpausevcpu 1002
@@ -1339,6 +1365,7 @@ struct xen_domctl {
struct xen_domctl_vuart_op vuart_op;
struct xen_domctl_vmtrace_op vmtrace_op;
struct xen_domctl_paging_mempool paging_mempool;
+ struct xen_domctl_mem_map mem_map;
uint8_t pad[128];
} u;
};
--
2.34.1On 03.04.2024 10:16, Henry Wang wrote:
> --- a/tools/libs/ctrl/xc_domain.c
> +++ b/tools/libs/ctrl/xc_domain.c
> @@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch,
> return do_domctl(xch, &domctl);
> }
>
> +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid,
> + struct xen_mem_region mem_regions[],
> + uint32_t *nr_regions)
> +{
> + int rc;
> + struct xen_domctl domctl = {
> + .cmd = XEN_DOMCTL_get_mem_map,
> + .domain = domid,
> + .u.mem_map = {
> + .nr_mem_regions = *nr_regions,
> + .pad = 0,
This isn't needed: By there being an initializer for the struct, all
unmentioned fields will be set to 0 anyway.
> --- a/xen/arch/arm/domain.c
> +++ b/xen/arch/arm/domain.c
> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d,
> {
> unsigned int count = 0;
> int rc;
> + struct mem_map_domain *mem_map = &d->arch.mem_map;
>
> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS);
>
> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d,
> d->arch.sve_vl = config->arch.sve_vl;
> #endif
>
> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS )
> + {
> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE;
> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE;
> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC;
> + mem_map->nr_mem_regions++;
> + }
> + else
> + {
> + printk("Exceed max number of supported memory map regions\n");
Debugging leftover?
> --- a/xen/arch/arm/domctl.c
> +++ b/xen/arch/arm/domctl.c
> @@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>
> return 0;
> }
> -
> case XEN_DOMCTL_vuart_op:
> {
> int rc;
Why? Instead you want ...
> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>
> return rc;
> }
> + case XEN_DOMCTL_get_mem_map:
... separating blank line above this line and ...
> + {
> + int rc = 0;
> + uint32_t nr_regions, i;
> +
> + if ( domctl->u.mem_map.pad )
> + return -EINVAL;
> +
> + /*
> + * Cap the number of regions to the minimum value between toolstack and
> + * hypervisor to avoid overflowing the buffer.
> + */
> + nr_regions = min(d->arch.mem_map.nr_mem_regions,
> + domctl->u.mem_map.nr_mem_regions);
> +
> + domctl->u.mem_map.nr_mem_regions = nr_regions;
> +
> + for ( i = 0; i < nr_regions; i++ )
> + {
> + if ( d->arch.mem_map.regions[i].pad )
> + return -EINVAL;
> + }
> +
> + if ( copy_to_guest(domctl->u.mem_map.buffer,
> + d->arch.mem_map.regions,
> + nr_regions) ||
> + __copy_to_guest(u_domctl, domctl, 1) )
> + rc = -EFAULT;
> +
> + return rc;
> + }
> default:
... this one.
Further with the way you use min() above, how is the caller going to know
whether it simply specified too small an array?
And then you check d->arch.mem_map.regions[i].pad. Why's that? And even
if needed here for some reason, that's surely not EINVAL, but an internal
error in Xen.
Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(),
for just nr_regions?
> --- a/xen/include/public/domctl.h
> +++ b/xen/include/public/domctl.h
> @@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool {
> uint64_aligned_t size; /* Size in bytes. */
> };
>
> +#ifndef XEN_MAX_MEM_REGIONS
> +#define XEN_MAX_MEM_REGIONS 1
> +#endif
> +
> +struct xen_mem_region {
> + uint64_aligned_t start;
> + uint64_aligned_t size;
> + uint32_t type;
What is this field set to? I see no #define(s) in this header. If it's
the GUEST_MEM_REGION_* in the Arm header, a connection needs to be made.
Also note that GUEST_MEM_REGION_* violate name space requirements: New
additions should have XEN_ / xen_ prefixes on their names.
> + /* Must be zero */
> + uint32_t pad;
This, being OUT only, should not be required to be set by the caller. As
long as no use appears, Xen merely ought to guarantee that it'll be 0 upon
return.
Jan
Hi Jan,
On 4/4/2024 5:28 PM, Jan Beulich wrote:
> On 03.04.2024 10:16, Henry Wang wrote:
>> --- a/tools/libs/ctrl/xc_domain.c
>> +++ b/tools/libs/ctrl/xc_domain.c
>> @@ -697,6 +697,39 @@ int xc_domain_setmaxmem(xc_interface *xch,
>> return do_domctl(xch, &domctl);
>> }
>>
>> +int xc_get_domain_mem_map(xc_interface *xch, uint32_t domid,
>> + struct xen_mem_region mem_regions[],
>> + uint32_t *nr_regions)
>> +{
>> + int rc;
>> + struct xen_domctl domctl = {
>> + .cmd = XEN_DOMCTL_get_mem_map,
>> + .domain = domid,
>> + .u.mem_map = {
>> + .nr_mem_regions = *nr_regions,
>> + .pad = 0,
> This isn't needed: By there being an initializer for the struct, all
> unmentioned fields will be set to 0 anyway.
Ok, I can drop the initialization of the .pad field.
>> --- a/xen/arch/arm/domain.c
>> +++ b/xen/arch/arm/domain.c
>> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d,
>> {
>> unsigned int count = 0;
>> int rc;
>> + struct mem_map_domain *mem_map = &d->arch.mem_map;
>>
>> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS);
>>
>> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d,
>> d->arch.sve_vl = config->arch.sve_vl;
>> #endif
>>
>> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS )
>> + {
>> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE;
>> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE;
>> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC;
>> + mem_map->nr_mem_regions++;
>> + }
>> + else
>> + {
>> + printk("Exceed max number of supported memory map regions\n");
> Debugging leftover?
Well, not really, I did this on purpose to print some info before exit.
But now I realize other error paths in arch_domain_create() do not do
that. I will drop this printk in v4.
>> --- a/xen/arch/arm/domctl.c
>> +++ b/xen/arch/arm/domctl.c
>> @@ -148,7 +148,6 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>>
>> return 0;
>> }
>> -
>> case XEN_DOMCTL_vuart_op:
>> {
>> int rc;
> Why? Instead you want ...
Because there are no empty line between the other sub-ops in the arm
version of arch_do_domctl(). Since there is no explicit guideline in
CODING_STYLE, I was trying to take the opportunity to keep the coding
style consistent within the file. However since you are asking, I
realized that the x86 arch_do_domctl() is using the other way, i.e
adding an empty line between the sub-ops, so...
>> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>>
>> return rc;
>> }
>> + case XEN_DOMCTL_get_mem_map:
> ... separating blank line above this line and ...
>
>> + {
>> + int rc = 0;
>> + uint32_t nr_regions, i;
>> +
>> + if ( domctl->u.mem_map.pad )
>> + return -EINVAL;
>> +
>> + /*
>> + * Cap the number of regions to the minimum value between toolstack and
>> + * hypervisor to avoid overflowing the buffer.
>> + */
>> + nr_regions = min(d->arch.mem_map.nr_mem_regions,
>> + domctl->u.mem_map.nr_mem_regions);
>> +
>> + domctl->u.mem_map.nr_mem_regions = nr_regions;
>> +
>> + for ( i = 0; i < nr_regions; i++ )
>> + {
>> + if ( d->arch.mem_map.regions[i].pad )
>> + return -EINVAL;
>> + }
>> +
>> + if ( copy_to_guest(domctl->u.mem_map.buffer,
>> + d->arch.mem_map.regions,
>> + nr_regions) ||
>> + __copy_to_guest(u_domctl, domctl, 1) )
>> + rc = -EFAULT;
>> +
>> + return rc;
>> + }
>> default:
> ... this one.
...personally I don't have strong opinions on the style as long as we
keep consistent. I can switch the Arm one following the x86 style or
just leave it as is.
> Further with the way you use min() above, how is the caller going to know
> whether it simply specified too small an array?
I am a bit unsure if we need to forbid caller to specify a smaller value
than the max number of regions supported by the hypervisor, technically
it is legal, although I agree it will lead to some issues in the
toolstack side. It looks like the similar hypercall of e820 also does
not forbid this (see get_mem_mapping_layout() and related
XENMEM_memory_map). Do you have any suggestions?
> And then you check d->arch.mem_map.regions[i].pad. Why's that? And even
> if needed here for some reason, that's surely not EINVAL, but an internal
> error in Xen.
I did that under the impression that we need to check the value of
padding field being 0. Also you mentioned in one of the comments below
that Xen should guarantee that the padding field should be 0 before
return. Apologize if I misunderstand your comment. The -EINVAL is taken
from the same way of checking the padding field in XEN_DOMCTL_vuart_op
above. Personally I would keep some consistency, but I am open to
suggestions to make it better.
> Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(),
> for just nr_regions?
You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the
__copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I
can do that in v4.
>> --- a/xen/include/public/domctl.h
>> +++ b/xen/include/public/domctl.h
>> @@ -946,6 +946,31 @@ struct xen_domctl_paging_mempool {
>> uint64_aligned_t size; /* Size in bytes. */
>> };
>>
>> +#ifndef XEN_MAX_MEM_REGIONS
>> +#define XEN_MAX_MEM_REGIONS 1
>> +#endif
>> +
>> +struct xen_mem_region {
>> + uint64_aligned_t start;
>> + uint64_aligned_t size;
>> + uint32_t type;
> What is this field set to? I see no #define(s) in this header. If it's
> the GUEST_MEM_REGION_* in the Arm header, a connection needs to be made.
> Also note that GUEST_MEM_REGION_* violate name space requirements: New
> additions should have XEN_ / xen_ prefixes on their names.
Yeah it is the GUEST_MEM_REGION_* in the Arm header. The default value
will be set to 0 when struct domain is created. I will switch to the
XEN_* prefix in v4.
>> + /* Must be zero */
>> + uint32_t pad;
> This, being OUT only, should not be required to be set by the caller. As
> long as no use appears, Xen merely ought to guarantee that it'll be 0 upon
> return.
See above.
Kind regards,
Henry
> Jan
On 08.04.2024 05:08, Henry Wang wrote:
> On 4/4/2024 5:28 PM, Jan Beulich wrote:
>> On 03.04.2024 10:16, Henry Wang wrote:
>>> --- a/xen/arch/arm/domain.c
>>> +++ b/xen/arch/arm/domain.c
>>> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d,
>>> {
>>> unsigned int count = 0;
>>> int rc;
>>> + struct mem_map_domain *mem_map = &d->arch.mem_map;
>>>
>>> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS);
>>>
>>> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d,
>>> d->arch.sve_vl = config->arch.sve_vl;
>>> #endif
>>>
>>> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS )
>>> + {
>>> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE;
>>> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE;
>>> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC;
>>> + mem_map->nr_mem_regions++;
>>> + }
>>> + else
>>> + {
>>> + printk("Exceed max number of supported memory map regions\n");
>> Debugging leftover?
>
> Well, not really, I did this on purpose to print some info before exit.
> But now I realize other error paths in arch_domain_create() do not do
> that. I will drop this printk in v4.
>
>>> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>>>
>>> return rc;
>>> }
>>> + case XEN_DOMCTL_get_mem_map:
>> ... separating blank line above this line and ...
>>
>>> + {
>>> + int rc = 0;
>>> + uint32_t nr_regions, i;
>>> +
>>> + if ( domctl->u.mem_map.pad )
>>> + return -EINVAL;
>>> +
>>> + /*
>>> + * Cap the number of regions to the minimum value between toolstack and
>>> + * hypervisor to avoid overflowing the buffer.
>>> + */
>>> + nr_regions = min(d->arch.mem_map.nr_mem_regions,
>>> + domctl->u.mem_map.nr_mem_regions);
>>> +
>>> + domctl->u.mem_map.nr_mem_regions = nr_regions;
>>> +
>>> + for ( i = 0; i < nr_regions; i++ )
>>> + {
>>> + if ( d->arch.mem_map.regions[i].pad )
>>> + return -EINVAL;
>>> + }
>>> +
>>> + if ( copy_to_guest(domctl->u.mem_map.buffer,
>>> + d->arch.mem_map.regions,
>>> + nr_regions) ||
>>> + __copy_to_guest(u_domctl, domctl, 1) )
>>> + rc = -EFAULT;
>>> +
>>> + return rc;
>>> + }
>>> default:
>> ... this one.
>
> ...personally I don't have strong opinions on the style as long as we
> keep consistent. I can switch the Arm one following the x86 style or
> just leave it as is.
>
>> Further with the way you use min() above, how is the caller going to know
>> whether it simply specified too small an array?
>
> I am a bit unsure if we need to forbid caller to specify a smaller value
> than the max number of regions supported by the hypervisor, technically
> it is legal, although I agree it will lead to some issues in the
> toolstack side. It looks like the similar hypercall of e820 also does
> not forbid this (see get_mem_mapping_layout() and related
> XENMEM_memory_map). Do you have any suggestions?
Fill only as much of the array as there is space for, but return the full
count to the caller. Another option (less desirable imo) would be to return
-ENOBUFS. If to be written anew now, I'd likely code XENMEM_memory_map
handling that way, too. But that's too late now.
>> And then you check d->arch.mem_map.regions[i].pad. Why's that? And even
>> if needed here for some reason, that's surely not EINVAL, but an internal
>> error in Xen.
>
> I did that under the impression that we need to check the value of
> padding field being 0. Also you mentioned in one of the comments below
> that Xen should guarantee that the padding field should be 0 before
> return. Apologize if I misunderstand your comment. The -EINVAL is taken
> from the same way of checking the padding field in XEN_DOMCTL_vuart_op
> above. Personally I would keep some consistency, but I am open to
> suggestions to make it better.
In XEN_DOMCTL_vuart_op it is caller input which is being checked (and
needs checking). You're checking internal Xen state here instead.
Considering the nature of the issue arising if the assumption was broken,
ASSERT() would seem to be the construct to use for the internal state
check.
>> Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(),
>> for just nr_regions?
>
> You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the
> __copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I
> can do that in v4.
Yes (unless there are technical reasons not to, of course).
Jan
Hi Jan,
On 4/8/2024 2:19 PM, Jan Beulich wrote:
> On 08.04.2024 05:08, Henry Wang wrote:
>> On 4/4/2024 5:28 PM, Jan Beulich wrote:
>>> On 03.04.2024 10:16, Henry Wang wrote:
>>>> --- a/xen/arch/arm/domain.c
>>>> +++ b/xen/arch/arm/domain.c
>>>> @@ -696,6 +696,7 @@ int arch_domain_create(struct domain *d,
>>>> {
>>>> unsigned int count = 0;
>>>> int rc;
>>>> + struct mem_map_domain *mem_map = &d->arch.mem_map;
>>>>
>>>> BUILD_BUG_ON(GUEST_MAX_VCPUS < MAX_VIRT_CPUS);
>>>>
>>>> @@ -785,6 +786,20 @@ int arch_domain_create(struct domain *d,
>>>> d->arch.sve_vl = config->arch.sve_vl;
>>>> #endif
>>>>
>>>> + if ( mem_map->nr_mem_regions < XEN_MAX_MEM_REGIONS )
>>>> + {
>>>> + mem_map->regions[mem_map->nr_mem_regions].start = GUEST_MAGIC_BASE;
>>>> + mem_map->regions[mem_map->nr_mem_regions].size = GUEST_MAGIC_SIZE;
>>>> + mem_map->regions[mem_map->nr_mem_regions].type = GUEST_MEM_REGION_MAGIC;
>>>> + mem_map->nr_mem_regions++;
>>>> + }
>>>> + else
>>>> + {
>>>> + printk("Exceed max number of supported memory map regions\n");
>>> Debugging leftover?
>> Well, not really, I did this on purpose to print some info before exit.
>> But now I realize other error paths in arch_domain_create() do not do
>> that. I will drop this printk in v4.
>>
>>>> @@ -176,6 +175,37 @@ long arch_do_domctl(struct xen_domctl *domctl, struct domain *d,
>>>>
>>>> return rc;
>>>> }
>>>> + case XEN_DOMCTL_get_mem_map:
>>> ... separating blank line above this line and ...
>>>
>>>> + {
>>>> + int rc = 0;
>>>> + uint32_t nr_regions, i;
>>>> +
>>>> + if ( domctl->u.mem_map.pad )
>>>> + return -EINVAL;
>>>> +
>>>> + /*
>>>> + * Cap the number of regions to the minimum value between toolstack and
>>>> + * hypervisor to avoid overflowing the buffer.
>>>> + */
>>>> + nr_regions = min(d->arch.mem_map.nr_mem_regions,
>>>> + domctl->u.mem_map.nr_mem_regions);
>>>> +
>>>> + domctl->u.mem_map.nr_mem_regions = nr_regions;
>>>> +
>>>> + for ( i = 0; i < nr_regions; i++ )
>>>> + {
>>>> + if ( d->arch.mem_map.regions[i].pad )
>>>> + return -EINVAL;
>>>> + }
>>>> +
>>>> + if ( copy_to_guest(domctl->u.mem_map.buffer,
>>>> + d->arch.mem_map.regions,
>>>> + nr_regions) ||
>>>> + __copy_to_guest(u_domctl, domctl, 1) )
>>>> + rc = -EFAULT;
>>>> +
>>>> + return rc;
>>>> + }
>>>> default:
>>> ... this one.
>> ...personally I don't have strong opinions on the style as long as we
>> keep consistent. I can switch the Arm one following the x86 style or
>> just leave it as is.
>>
>>> Further with the way you use min() above, how is the caller going to know
>>> whether it simply specified too small an array?
>> I am a bit unsure if we need to forbid caller to specify a smaller value
>> than the max number of regions supported by the hypervisor, technically
>> it is legal, although I agree it will lead to some issues in the
>> toolstack side. It looks like the similar hypercall of e820 also does
>> not forbid this (see get_mem_mapping_layout() and related
>> XENMEM_memory_map). Do you have any suggestions?
> Fill only as much of the array as there is space for, but return the full
> count to the caller. Another option (less desirable imo) would be to return
> -ENOBUFS. If to be written anew now, I'd likely code XENMEM_memory_map
> handling that way, too. But that's too late now.
Thanks for the input! Sure I will follow the suggestion in v4.
>>> And then you check d->arch.mem_map.regions[i].pad. Why's that? And even
>>> if needed here for some reason, that's surely not EINVAL, but an internal
>>> error in Xen.
>> I did that under the impression that we need to check the value of
>> padding field being 0. Also you mentioned in one of the comments below
>> that Xen should guarantee that the padding field should be 0 before
>> return. Apologize if I misunderstand your comment. The -EINVAL is taken
>> from the same way of checking the padding field in XEN_DOMCTL_vuart_op
>> above. Personally I would keep some consistency, but I am open to
>> suggestions to make it better.
> In XEN_DOMCTL_vuart_op it is caller input which is being checked (and
> needs checking). You're checking internal Xen state here instead.
> Considering the nature of the issue arising if the assumption was broken,
> ASSERT() would seem to be the construct to use for the internal state
> check.
You are right, I will drop the Xen internal state check here.
>>> Finally instead of __copy_to_guest() can't you use __copy_field_to_guest(),
>>> for just nr_regions?
>> You mean replacing __copy_to_guest(u_domctl, domctl, 1) with only the
>> __copy_field_to_guest(u_domctl, domctl, u.mem_map.nr_mem_regions)? Ok I
>> can do that in v4.
> Yes (unless there are technical reasons not to, of course).
Thanks for confirming, I will do this way.
Kind regards,
Henry
> Jan
© 2016 - 2026 Red Hat, Inc.