[PATCH v2 06/12] xen/gnttab: Pass max_{grant, maptrack}_frames into grant_table_create()

[Andrew Cooper <andrew.cooper3@citrix.com>]

... rather than setting the limits up after domain_create() has completed.

This removes all the gnttab infrastructure for calculating the number of dom0
grant frames, opting instead to require the dom0 construction code to pass a
sane value in via the configuration.

In practice, this now means that there is never a partially constructed grant
table for a reference-able domain.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Julien Grall <julien.grall@arm.com>
CC: Wei Liu <wei.liu2@citrix.com>

v2:
 * Split/rearrange to avoid the post-domain-create error path.
---
 xen/arch/arm/domain_build.c       |  3 ++-
 xen/arch/arm/setup.c              | 12 ++++++++++++
 xen/arch/x86/setup.c              |  3 +++
 xen/common/domain.c               |  3 ++-
 xen/common/grant_table.c          | 16 +++-------------
 xen/include/asm-arm/grant_table.h | 12 ------------
 xen/include/asm-x86/grant_table.h |  5 -----
 xen/include/xen/grant_table.h     |  6 ++----
 8 files changed, 24 insertions(+), 36 deletions(-)

diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c
index 1351572..737e0f3 100644
--- a/xen/arch/arm/domain_build.c
+++ b/xen/arch/arm/domain_build.c
@@ -2079,7 +2079,8 @@ static void __init find_gnttab_region(struct domain *d,
      * enough space for a large grant table
      */
     kinfo->gnttab_start = __pa(_stext);
-    kinfo->gnttab_size = gnttab_dom0_frames() << PAGE_SHIFT;
+    kinfo->gnttab_size = min_t(unsigned int, opt_max_grant_frames,
+                               PFN_DOWN(_etext - _stext)) << PAGE_SHIFT;
 
 #ifdef CONFIG_ARM_32
     /*
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index 45f3841..3d3b30c 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -20,6 +20,7 @@
 #include <xen/compile.h>
 #include <xen/device_tree.h>
 #include <xen/domain_page.h>
+#include <xen/grant_table.h>
 #include <xen/types.h>
 #include <xen/string.h>
 #include <xen/serial.h>
@@ -693,6 +694,17 @@ void __init start_xen(unsigned long boot_phys_offset,
     struct domain *dom0;
     struct xen_domctl_createdomain dom0_cfg = {
         .max_evtchn_port = -1,
+
+        /*
+         * The region used by Xen on the memory will never be mapped in DOM0
+         * memory layout. Therefore it can be used for the grant table.
+         *
+         * Only use the text section as it's always present and will contain
+         * enough space for a large grant table
+         */
+        .max_grant_frames = min_t(unsigned int, opt_max_grant_frames,
+                                  PFN_DOWN(_etext - _stext)),
+        .max_maptrack_frames = opt_max_maptrack_frames,
     };
 
     dcache_line_bytes = read_dcache_line_bytes();
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 015099f..2cfae89 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1,6 +1,7 @@
 #include <xen/init.h>
 #include <xen/lib.h>
 #include <xen/err.h>
+#include <xen/grant_table.h>
 #include <xen/sched.h>
 #include <xen/sched-if.h>
 #include <xen/domain.h>
@@ -682,6 +683,8 @@ void __init noreturn __start_xen(unsigned long mbi_p)
     struct xen_domctl_createdomain dom0_cfg = {
         .flags = XEN_DOMCTL_CDF_s3_integrity,
         .max_evtchn_port = -1,
+        .max_grant_frames = opt_max_grant_frames,
+        .max_maptrack_frames = opt_max_maptrack_frames,
     };
 
     /* Critical region without IDT or TSS.  Any fault is deadly! */
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 171d25e..1dcab8d 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -366,7 +366,8 @@ struct domain *domain_create(domid_t domid,
             goto fail;
         init_status |= INIT_evtchn;
 
-        if ( (err = grant_table_create(d)) != 0 )
+        if ( (err = grant_table_create(d, config->max_grant_frames,
+                                       config->max_maptrack_frames)) != 0 )
             goto fail;
         init_status |= INIT_gnttab;
 
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 8b843b1..3200542 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3563,9 +3563,8 @@ do_grant_table_op(
 #include "compat/grant_table.c"
 #endif
 
-int
-grant_table_create(
-    struct domain *d)
+int grant_table_create(struct domain *d, unsigned int max_grant_frames,
+                       unsigned int max_maptrack_frames)
 {
     struct grant_table *t;
     int ret = 0;
@@ -3583,11 +3582,7 @@ grant_table_create(
     t->domain = d;
     d->grant_table = t;
 
-    if ( d->domain_id == 0 )
-    {
-        ret = grant_table_init(d, t, gnttab_dom0_frames(),
-                               opt_max_maptrack_frames);
-    }
+    ret = grant_table_set_limits(d, max_maptrack_frames, max_maptrack_frames);
 
     return ret;
 }
@@ -4045,11 +4040,6 @@ static int __init gnttab_usage_init(void)
 }
 __initcall(gnttab_usage_init);
 
-unsigned int __init gnttab_dom0_frames(void)
-{
-    return min(opt_max_grant_frames, gnttab_dom0_max());
-}
-
 /*
  * Local variables:
  * mode: C
diff --git a/xen/include/asm-arm/grant_table.h b/xen/include/asm-arm/grant_table.h
index 9c2c815..ee11c38 100644
--- a/xen/include/asm-arm/grant_table.h
+++ b/xen/include/asm-arm/grant_table.h
@@ -23,18 +23,6 @@ void gnttab_mark_dirty(struct domain *d, mfn_t mfn);
 #define gnttab_create_status_page(d, t, i) do {} while (0)
 #define gnttab_release_host_mappings(domain) 1
 
-/*
- * The region used by Xen on the memory will never be mapped in DOM0
- * memory layout. Therefore it can be used for the grant table.
- *
- * Only use the text section as it's always present and will contain
- * enough space for a large grant table
- */
-static inline unsigned int gnttab_dom0_max(void)
-{
-    return PFN_DOWN(_etext - _stext);
-}
-
 #define gnttab_init_arch(gt)                                             \
 ({                                                                       \
     unsigned int ngf_ = (gt)->max_grant_frames;                          \
diff --git a/xen/include/asm-x86/grant_table.h b/xen/include/asm-x86/grant_table.h
index 76ec5dd..761a8c3 100644
--- a/xen/include/asm-x86/grant_table.h
+++ b/xen/include/asm-x86/grant_table.h
@@ -39,11 +39,6 @@ static inline int replace_grant_host_mapping(uint64_t addr, mfn_t frame,
     return replace_grant_pv_mapping(addr, frame, new_addr, flags);
 }
 
-static inline unsigned int gnttab_dom0_max(void)
-{
-    return UINT_MAX;
-}
-
 #define gnttab_init_arch(gt) 0
 #define gnttab_destroy_arch(gt) do {} while ( 0 )
 #define gnttab_set_frame_gfn(gt, st, idx, gfn) do {} while ( 0 )
diff --git a/xen/include/xen/grant_table.h b/xen/include/xen/grant_table.h
index c881414..b46bb0a 100644
--- a/xen/include/xen/grant_table.h
+++ b/xen/include/xen/grant_table.h
@@ -35,8 +35,8 @@ extern unsigned int opt_max_grant_frames;
 extern unsigned int opt_max_maptrack_frames;
 
 /* Create/destroy per-domain grant table context. */
-int grant_table_create(
-    struct domain *d);
+int grant_table_create(struct domain *d, unsigned int max_grant_frames,
+                       unsigned int max_maptrack_frames);
 void grant_table_destroy(
     struct domain *d);
 void grant_table_init_vcpu(struct vcpu *v);
@@ -63,6 +63,4 @@ int gnttab_get_shared_frame(struct domain *d, unsigned long idx,
 int gnttab_get_status_frame(struct domain *d, unsigned long idx,
                             mfn_t *mfn);
 
-unsigned int gnttab_dom0_frames(void);
-
 #endif /* __XEN_GRANT_TABLE_H__ */
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel