From: George Dunlap <gwd@xenproject.org>
This is the second batch of the x86 Address Space Isolation (ASI)
series, run as a rolling series as laid out in part 1 [3]: patches are
posted from the front as they are ready, dropped once committed, and
appended as they mature. None of part 1 has been committed yet, so
this posting contains v2 of those seven patches, revised per review,
followed by seven new ones. The original work was posted by Roger as
"x86: adventures in Address Space Isolation" (v1 [1], v2 [2]).
The map of the entire series -- grouped into logical chunks, with the
dependencies between patches -- is maintained here:
https://xenbits.xenproject.org/people/gdunlap/asi-series-deps.html
Patches 1-14 of this posting are d03-d16 on that map. (d01 is Jan's
independently posted "x86: always park offline CPUs", which nothing in
this posting depends on; d02 is the design document, which isn't ready
for publication yet.)
What this batch does:
- Patches 1-7 are the part 1 content: give the per-domain area a
single central writer for installing caller-owned pages
(populate_perdomain_mapping()), convert the PV GDT/LDT paths to it,
and remove the stashed L1 aliases that bypassed the interface. The
headline change since part 1, following Jan's review of the xenheap
allocation patch: the per-domain page-tables stay in the domheap,
and the contexts that must walk them with interrupts disabled get
dedicated IRQs-off mapping variants (patch 1) rather than an
always-mapped alias. Per-patch changes are noted below each
patch's "---".
- Patches 8-11 prepare the perdomain interfaces
({create,destroy}_perdomain_mapping() and their callers) to work
with either a single domain-wide perdomain area or a per-vCPU one.
- Patch 12 introduces the asi= command line option ahead of the
functionality it enables, so the newly added code can be keyed on
it from the start. All knobs default to off, and enabling any of
them warns at boot that the feature is not functional and intended
for development only.
- Patch 13 pairs the maintenance of the XPTI per-domain slot in the
per-CPU root page-table: installed on switch-in, now cleared on
switch-out.
- Patch 14 is the core of this phase: an optional per-vCPU L3 for
the per-domain area, so that what a vCPU can reach through the
per-domain slot is its own state rather than every vCPU's. With
this patch HVM guests can run with per-vCPU page-tables; for PV
guests the rest of the machinery (per-vCPU mapcache, root
page-table handling, and a per-vCPU L4) follows in the next batch.
Testing:
- Applies cleanly to staging at the base commit below; each patch
builds (x86_64, CONFIG_DEBUG=y).
- arm64 build and tier-1 qemu boot at the tip (patch 1 touches the
common domain_page.h).
- x86 tier-1 qemu boots at the tip: default; asi=1 with a 1-vCPU
dom0 (SMP PV vCPU-PT arrives later in the series); and xpti=1
forced, exercising the new switch-out clear on every context
switch.
- The series passes the Xen GitLab CI pipeline, including the
hardware runners:
https://gitlab.com/xen-project/hardware/xen-staging/-/pipelines/2809749496
- On an Intel NUC (debug build), three configurations -- default,
xpti=1 forced, and asi=1 with a 1-vCPU dom0 and UP guests: XTF
pv64 + pv32pae suites (29 pass / 2 skip in each; pv32pae via
cet=no-shstk,no-ibt pv=32), plus an LDT exerciser in a PV Linux
guest, sequential, parallel, and under vcpu-pin churn -- no
assertions, crashes, or "unable to map" reports. The xpti=1 run
exercises patch 13's switch-out clear on every context switch;
SMP PV guests were excluded from the asi=1 run (not expected to
work until the per-vCPU L4 patch).
[1] https://lore.kernel.org/xen-devel/20240726152206.28411-1-roger.pau@citrix.com/
[2] https://lore.kernel.org/xen-devel/20250108142659.99490-1-roger.pau@citrix.com/
[3] https://lore.kernel.org/xen-devel/20260820-asi-part1-0-f2dbd92b8459@xenproject.org/
George Dunlap (2):
x86/domain_page: introduce IRQs-off variants of {,un}map_domain_page()
x86/pv: clear the XPTI root_pgt per-domain slot on context-switch out
Roger Pau Monné (12):
x86/mm: introduce populate_perdomain_mapping()
x86/pv: use populate_perdomain_mapping() to map the Xen GDT
x86/pv: set/clear guest GDT mappings using
populate_perdomain_mapping()
x86/pv: update guest LDT mappings using
{populate,destroy}_perdomain_mapping()
x86/pv: remove stashing of GDT/LDT L1 page-tables
x86/mm: simplify create_perdomain_mapping() interface
x86/mm: purge unneeded destroy_perdomain_mapping()
x86/mm: prepare destroy_perdomain_mapping() for per-vCPU perdomain
areas
x86/domain_page: drop redundant create_perdomain_mapping() call
x86/mm: prepare create_perdomain_mapping() for per-vCPU perdomain
areas
x86/spec-ctrl: introduce Address Space Isolation command line option
x86/mm: introduce per-vCPU L3 page-table
docs/misc/xen-command-line.pandoc | 24 +++
xen/arch/x86/domain.c | 53 ++++-
xen/arch/x86/domain_page.c | 72 +++++--
xen/arch/x86/hvm/hvm.c | 6 -
xen/arch/x86/include/asm/desc.h | 2 -
xen/arch/x86/include/asm/domain.h | 28 ++-
xen/arch/x86/include/asm/mm.h | 16 +-
xen/arch/x86/include/asm/spec_ctrl.h | 2 +
xen/arch/x86/mm.c | 296 +++++++++++++++++++++------
xen/arch/x86/mm/hap/hap.c | 2 +-
xen/arch/x86/mm/paging.c | 14 ++
xen/arch/x86/mm/shadow/common.c | 11 +
xen/arch/x86/mm/shadow/hvm.c | 2 +-
xen/arch/x86/mm/shadow/multi.c | 2 +-
xen/arch/x86/pv/descriptor-tables.c | 57 +++---
xen/arch/x86/pv/dom0_build.c | 8 +-
xen/arch/x86/pv/domain.c | 26 +--
xen/arch/x86/pv/mm.c | 16 +-
xen/arch/x86/smpboot.c | 15 --
xen/arch/x86/spec_ctrl.c | 107 +++++++++-
xen/arch/x86/traps.c | 2 -
xen/arch/x86/x86_64/mm.c | 7 +-
xen/include/xen/domain_page.h | 14 ++
23 files changed, 594 insertions(+), 188 deletions(-)
base-commit: 2565341135f88081535f6830a6256277e2834403
--
2.55.0