In hypervisor fuzzing test, hypervisor will hang
if issuing HV_VM_SET_MEMORY_REGIONS hypercall after
target VM is destroyed.
this patch is to fix above vulnerability.
Tracked-On: #2849
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
The init page tables installed in either cpu_primary.S or trampoline.S
are 1:1 mapping and won't be changed in the future.
The 'actual' hypervisor page table installed in enable_paging() is 1:1
mapping currently but it could be changed in the future. Both hva2hpa() and
hpa2hva() are implemented based on these page tables and can't be used
when the init page tables take effect.
This patch does the following cleanup:
- remove all hva2hpa()/hpa2hva() before calling enable_paging()
- get_hv_image_base() returns HVA, not HPA. So add hva2hpa() for all cases
that are called afte enable_paging().
Tracked-On: #2700
Signed-off-by: Zide Chen <zide.chen@intel.com>
Acked-by: Eddie Dong <Eddie.dong@intel.com>
to validate the ID and state of vCPU in below functions:
- hcall_set_vcpu_regs()
- hcall_notify_ioreq_finish()
- shell_vcpu_dumpreq()
Tracked-On: #861
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
it removes hypervisor.h and just includes needed header files.
Tracked-On: #1842
Signed-off-by: Minggui Cao <minggui.cao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This patch is a modified one. It removes the usage
of acrn_vm struct from inside vtd.c.
It also puts struct iommu_domain inside vtd.h,
from vtd.c.
It modifies the signature of init_iommu_domain
in order to remove dependency on acrn_vm from
inside vtd.c.
Incorporated comments from Jason and Eddie.
Changed the name of sos_vm_domain to
fallback_iommu_domain
Removed any reference of sos_vm from vtd.[c|h]
files, including comments.
Tracked-On: #2496
Signed-off-by: Arindam Roy <arindam.roy@intel.com>
Reviewed-by: Jason Chen CJ <jason.cj.chen@intel.com>
Rename vlapic_deliver_intr to vlapic_receive_intr: ioapic/msi device
deliver an interrupt to lapic.
Rename vlapic_pending_intr to vlapic_find_deliverable_intr: find a
deliverable interrupt which pending in irr and its priority large than ppr.
Rename vlapic_intr_accepted to vlapic_get_deliverable_intr: get the deliverable
interrupt from irr and set it in isr (which also raise ppr update)
Tracked-On: #1842
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
For VM with local apic pt for realtime scenatios, we support virtio device with PMD backend.
But we still need to inject MSI to notify the front-end, to avoid changing the front-end drivers.
Since the lapic is passed through, irq injection to vlapic won't work.
This commit fix it by sending IPI with vector need to inject.
Tracked-On: #2351
Signed-off-by: Yan, Like <like.yan@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
This is the following patch after removing pending_pre_work, it make sure
all io emulation is done on its own cpu.
For hv emulated request, it follows the steps:
hv_emulate_pio->emulate_pio_complete
hv_emulate_mmio->emulate_mmio_complete
For dm emulated request, it follows the steps:
acrn_insert_request->dm_emulate_io_complete
while in acrn_insert_request, it could trigger scheduling out then resume by
hcall_notify_ioreq_finish, or busy wait for ioreq completion if polling mode
is enabled.
Tracked-On: #2394
Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
Acked-by: Xu, Anthony <anthony.xu@intel.com>
We will use guest_flags of SECURE_WORLD_ENABLED to check wthether
sworld is supported.
Tracked-On: #2291
Signed-off-by: Victor Sun <victor.sun@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
When pcpu enter guest mode, it will call launch_vms() function to launch
VMs in global vm_configs array.
In launch_vms() function, current pcpu will go through vm_config array list
and check whether it is a bsp of configured VM, if yes then it will prepare
corresponding VM and start it. The index of vm_config array will be specified
to VM id.
The first least significant bit in pcpu_bitmap means the bsp of the VM.
Tracked-On: #2291
Signed-off-by: Victor Sun <victor.sun@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Under sharing mode, VM0 is identical with SOS VM. But the coupling of
SOS VM and VM 0 is not friendly for partition mode.
This patch is a pure term change of vm0 to sos VM, it does not change
any code logic or senmantic.
Tracked-On: #2291
Signed-off-by: Victor Sun <victor.sun@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This patch is a pure term change of vm_description to vm_config,
the struct name of vm_description is changed to acrn_vm_config.
The patch does not change any code logic or senmantic.
Tracked-On: #2291
Signed-off-by: Victor Sun <victor.sun@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Currently the SOS kernel will call hcall_set_callback_vector to config
the expected up-notification vector(0xF3) and then hypervisor uses the
passed vector to raise the interrupt to SOS when needed.
As sos kernel already switches to 0xF3 notification vector, the default
notification vector can be changed from 0xF7 to 0xF3. In such case it still
can work well even when the SOS kernel doesn't reconfigure the notification
vector.
Tracked-On: projectacrn/acrn-hypervisor#2355
Acked-by: Eddie Dong <eddie.dong@intel.com>
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
-- Change acrn_vhm_vector to static, only used in io_request.c
-- Add set_vhm_vector() api, it will call this api instead of
acrn_vhm_vector except io_request.c
Tracked-On: #1842
Signed-off-by: Mingqiang Chi <mingqiang.chi@intel.com>
Reviewed-by: Anthony Xu <anthony.xu@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Fix "Procedure has more than one exit point" by split the function into
two parts.
V1->V2:
compact the multiple lines into one.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Fix the complicated violations by methods list below:
1.if ... else ... fmt.
2.add status in proper position.
example:
bool bdf_valid;(could find this variable in this patch).
V1->V2:
merge branches.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This patch fix the violations by the "if ... else ..." fmt.
V1->V2:
merge branches.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Fix the violations list below:
1.Procedure has more than one exit point.
2.Use of sizeof on an array parameter.
3.Expression needs brackets.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Misra C requires Function must have only 1 return entry.
Fixed it by use "if ... else ..." format.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
-- fix MISRA-C violation "procedure has more than one exit point"
for this api
-- change start_vm to void type since it is always return 0
Tracked-On: #861
Signed-off-by: Mingqiang Chi <mingqiang.chi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Misra C requires Function must have only 1 return entry.
Fixed it by use "if ... else ..." format.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
With SMAP enabled, hypervisor can't access pages that
owned by guest(either SOS or UOS), and an override is
is provided: stac()/clac() to enable/disable access to
guest's memory pages.
Pre-conditon:
Mark hypervisor owned pages as supervisor mode (U/S = 0),
and set all othter memory pages as user mode (U/S = 1).
Tracked-On: #2056
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
Identifier reuse may arise confusion. So should minimize the case of it
as much as possible. This patch is try to do this except the PCI related
module.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
replace CPU_PAGE_SIZE with PAGE_SIZE
These two MACROs are duplicated and PAGE_SIZE is a more reasonable name.
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
The previous would reserve memory for trusty in SOS kernel. Howerer,
there would no available 16 MB continue memory any more after a long time.
This result in allocating memory for trusty failed. This patch will reserve
memory for trusty in ACRN hypervisor in which case the memory allocation
for trusty will never fail.
Tracked-On: #1942
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
v1-v2:
Bypass this case:
When binary arithmetic operators of different precedence (e.g. '+'
and '*') are mixed in an expression, parentheses are added to the
sub-expressions using the operator with a higher precedence.
v1:
The operator precedence rules are complicated and it is easy to make a mistake.
So add brackets to make operator expression more readable.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
IEC 61508,ISO 26262 standards highly recommend single-exit rule.
Reduce the count of the "return entries".
Fix the violations which is comply with the cases list below:
1.Function has 2 return entries.
2.The first return entry is used to return the error code of
checking variable whether is valid.
Fix the violations in "if else" format.
V1->V2:
update the git comment to describe why comply with the
single-exit rule.
V2->V3:
update the git comment title to give a scope declaration of this
patch.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Reviewed-by: Li, Fei1 <fei1.li@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
IEC 61508,ISO 26262 standards highly recommend single-exit rule.
Reduce the count of the "return entries".
Fix the violations which is comply with the cases list below:
1.Function has 2 return entries.
2.The first return entry is used to return the error code of
checking variable whether is valid.
Fix the violations in "if else" format.
V1->V2:
update the git comment to describe why comply with the
rule(function's return entry should be only one).
V2->V3:
update the git comment title to give a scope declaration of this
patch.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Reviewed-by: Li, Fei1 <fei1.li@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
to avoid passing guest's memory block into hypervisor internal
process for security.
Tracked-On: #861
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
remove the usage of HV_DEBUG in hypercall.c and vmcall.c
TO-DO:
Enhance Makefile to compile debug/release into 2 libraries
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
fix the following integer violations:
1. Signed/unsigned conversion without cast
2. Literal value requires a U suffix
3. Implicit conversion of underlying type
v3 -> v4:
* change the type of npk_loglevel/mem_loglevel/console_loglevel
from uint32_t to uint16_t
v2 -> v3:
* discard the return value of update_ept
* discard changes related to npk loglevel
v1 -> v2:
* remove the unnecessary changes related to the false positive
issues caused by scanning tool
* change the type of the local variable 'vlapic_id' from uint8_t
to uint32_t in function 'vlapic_build_id'
* change the type of the struct member 'flags' in shared_buf from
uint64_t to uint32_t
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
The the bdf(bus/dev/func) is used to determine which pass-through device should
be assigned/released. Now the hypervisor parses the corresponding bdf from the guest
physical address when hcall_assign_ptdev/hcall_deassign_ptdev is called.
As it is only uint16_t, it is unnecessary to use the GPA to pass the bdf parameter.
Instead the parameter can be used as the bdf directly.
In order to keep the compatibility, it still can get the bdf by using
copy_from_gpa when SOS passes the parameter based on the buffer. But this will
be depreciated.
This is based on the assumption that the GPA in SOS is greater than 0x10000
when one buffer is allocated to pass the corresponding hypercall parameter.
After the SOS uses the bdf to pass the hypercall paremeter, we can remove the code
that gets the bdf by using copy_from_gpa.
V1->V2: Add some comments for hcall_assign_ptdev/hcall_deassign_ptdev.
Tracked-on: #1751
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
The old doc update commit changed the code by accident and broke
release version build. This patch fix the release build issue.
Tracked-On: #1595
Signed-off-by: Yin Fengwei <fengwei.yin@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
- Fix the integer violations related to the following rules:
1. The operands to shift operations (<<, >>) shall be unsigned
integers.
2. The operands to bit operations (&, |, ~) shall be unsigned
integers.
- Replace 12U with CPU_PAGE_SHIFT when it is address shift case.
v1 -> v2:
* use existed MACRO to get bus/slot/func values
* update PCI_SLOT MACRO to make it more straightforward
* remove the incorrect replacement of 12U with CPU_PAGE_SHIFT
dmar_fault_msi_write
Tracked-On: #861
Signed-off-by: Shiqing Gao <shiqing.gao@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
For all the hypercalls, we sync the comments from .h to .c as
comments in .h file are used in architectural design and the
comments in .c are used in module design.
Tracked-On: #1595
Signed-off-by: Yin Fengwei <fengwei.yin@intel.com>
For data structure types "struct vm", its name is identical
with variable name in the same scope. This is a MISRA C violation.
Naming convention rule:If the data structure type is used by multi
modules, its corresponding logic resource is exposed to external
components (such as SOS, UOS), and its name meaning is simplistic
(such as vcpu, vm), its name needs prefix "acrn_".
The following udpates are made:
struct vm *vm-->struct acrn_vm *vm
Tracked-On: #861
Signed-off-by: Xiangyang Wu <xiangyang.wu@linux.intel.com>
For data structure types "struct vcpu", its name is identical
with variable name in the same scope. This is a MISRA C violation.
Naming convention rule:If the data structure type is used by multi
modules, its corresponding logic resource is exposed to external
components (such as SOS, UOS), and its name meaning is simplistic
(such as vcpu, vm), its name needs prefix "acrn_".
The following udpates are made:
struct vcpu *vcpu-->struct acrn_vcpu *vcpu
Tracked-On: #861
Signed-off-by: Xiangyang Wu <xiangyang.wu@linux.intel.com>
Replace dynamic memory allocation in memory management with static memory allocation.
Since the static memory allocation can guarantee the allocation never failed, so
split_large_page and construct_pgentry don't need to return a errno any more.
Besides, the destroy_ept don't need to free page any more. Instead, it would memset
the eptp to 0 to make sure we can't walk this paging table again.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
Add static paging table allocation API for hypervisor.
Note: must configure PLATFORM_RAM_SIZE and PLATFORM_MMIO_SIZE exactly as the platform.
Rename RAM_START/RAM_SIZE to HV_RAM_START/HV_RAM_SIZE for HV.
Tracked-On: #861
Signed-off-by: Li, Fei1 <fei1.li@intel.com>
After enabling vPCI in hypervisor for vm0, UOS may not able be launched
successfully. Consider this scenario (take MSI-X for example):
- DM makes hypercall to hypervisor to do MSI-X remapping on behalf of
UOS guests.
- After the hypercall, VHM module in SOS kernel updates the physical
MSI-X table with the physical Message Data/Addr.
- These MMIO write requests are intercepted by hypervisor, which will
call ptdev_msix_remap() to do MSI-S remapping.
It may fail due to 2 possible reasons:
1) wrong target VM because:
hypervisor thinks it's a VM0 MSI-X device but they have been registered
as UOS guests through HC_SET_PTDEV_INTR_INFO hypercall.
2) wrong ptdev_msi_info->vmsi_data because:
The virtual MSI-X table is supposed to hold virtual Message data/addr
but the SOS VHM writes the physical ones to it.
This patch resolves these problems by ignoring the HC_VM_PCI_MSIX_REMAP
hypercall, so virtual and physical Message Data are the same from SOS'
perspective and it won't mess up the virtual PCI device in HV.
Also in HC_SET_PTDEV_INTR_INFO handler, vpci updates the target VM
when the PCI devices are assigned to different VMs.
The UOS' MSI/MSI-X remapping is triggered by hypervisor when SOS (either
DM or VHM) updates the Message Data/Addr.
Tracked-On: #1568
Signed-off-by: dongshen <dongsheng.x.zhang@intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
Fix violations for function whose parameter can be read-only.
Tracked-On: #861
Signed-off-by: Huihuang Shi <huihuang.shi@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
route GSI number#2 to PIC IRQ#0, as by default IRQ for
8254 timer is connected to I/O APIC Pin #2 and PIC Pin #0
Tracked-On: #861
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Reviewed-by: Eddie Dong <eddie.dong@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
