[PATCH RFC] evtchn: introduce EVTCHNOP_fifo_destroy hypercall

[PATCH RFC] evtchn: introduce EVTCHNOP_fifo_destroy hypercall

[Vitaly Kuznetsov]

New hypercall is required to allow guest to perform kexec when FIFO-based
event channel ABI is being used. This hypercall simply exposes evtchn_fifo_destroy()
function which cleans up all control blocks for all vcpus and frees event array
for the domain.

With this hypercall guest can do something like:
       struct evtchn_destroy_fifo destroy;

       destroy.dom = DOMID_SELF;
       HYPERVISOR_event_channel_op(EVTCHNOP_destroy_fifo, &destroy);

before doing
       HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
for the first vcpu on init.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 xen/common/event_channel.c         | 30 ++++++++++++++++++++++++++++++
 xen/common/event_fifo.c            |  1 +
 xen/include/public/event_channel.h |  7 +++++++
 3 files changed, 38 insertions(+)

diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index db952af..9bc18b2 100644
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -939,6 +939,26 @@ int evtchn_unmask(unsigned int port)
     return 0;
 }
 
+static long evtchn_fifo_destroy_all(domid_t dom)
+{
+	struct domain *d;
+	int rc;
+
+	d = rcu_lock_domain_by_any_id(dom);
+	if ( d == NULL )
+		return -ESRCH;
+
+	rc = xsm_evtchn_reset(XSM_TARGET, current->domain, d);
+	if ( rc )
+		goto out;
+
+	evtchn_fifo_destroy(d);
+
+out:
+	rcu_unlock_domain(d);
+
+	return rc;
+}
 
 static long evtchn_reset(evtchn_reset_t *r)
 {
@@ -1121,6 +1141,16 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
         break;
     }
 
+	case EVTCHNOP_fifo_destroy: {
+		struct evtchn_fifo_destroy destroy;
+		if ( copy_from_guest(&destroy, arg, 1) != 0 )
+			return -EFAULT;
+		if ( destroy.dom != DOMID_SELF )
+			return -EPERM;
+		rc = evtchn_fifo_destroy_all(destroy.dom);
+		break;
+	}
+
     default:
         rc = -ENOSYS;
         break;
diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
index 1fce3f1..51b4ff6 100644
--- a/xen/common/event_fifo.c
+++ b/xen/common/event_fifo.c
@@ -451,6 +451,7 @@ static void cleanup_event_array(struct domain *d)
     for ( i = 0; i < EVTCHN_FIFO_MAX_EVENT_ARRAY_PAGES; i++ )
         unmap_guest_page(d->evtchn_fifo->event_array[i]);
     xfree(d->evtchn_fifo);
+    d->evtchn_fifo = NULL;
 }
 
 static void setup_ports(struct domain *d)
diff --git a/xen/include/public/event_channel.h b/xen/include/public/event_channel.h
index 49ac8cc..79b6e86 100644
--- a/xen/include/public/event_channel.h
+++ b/xen/include/public/event_channel.h
@@ -74,6 +74,7 @@
 #define EVTCHNOP_init_control    11
 #define EVTCHNOP_expand_array    12
 #define EVTCHNOP_set_priority    13
+#define EVTCHNOP_fifo_destroy    14
 /* ` } */
 
 typedef uint32_t evtchn_port_t;
@@ -308,6 +309,12 @@ struct evtchn_set_priority {
 };
 typedef struct evtchn_set_priority evtchn_set_priority_t;
 
+struct evtchn_fifo_destroy {
+	/* IN parameters. */
+	domid_t dom;
+};
+typedef struct evtchn_fifo_destroy evtchn_fifo_destroy_t;
+
 /*
  * ` enum neg_errnoval
  * ` HYPERVISOR_event_channel_op_compat(struct evtchn_op *op)
-- 
1.9.3

Re: [PATCH RFC] evtchn: introduce EVTCHNOP_fifo_destroy hypercall

[Ian Campbell]

On Fri, 2014-07-18 at 17:42 +0200, Vitaly Kuznetsov wrote:
> New hypercall is required to allow guest to perform kexec when FIFO-based
> event channel ABI is being used. This hypercall simply exposes evtchn_fifo_destroy()
> function which cleans up all control blocks for all vcpus and frees event array
> for the domain.

Should this not just be the behaviour of the existing EVTCHNOP_reset
when FIFO evtchns are enabled for a guest?

Ian.

Re: [PATCH RFC] evtchn: introduce EVTCHNOP_fifo_destroy hypercall

[Andrew Cooper]

On 18/07/14 16:42, Vitaly Kuznetsov wrote:
> New hypercall is required to allow guest to perform kexec when FIFO-based
> event channel ABI is being used. This hypercall simply exposes evtchn_fifo_destroy()
> function which cleans up all control blocks for all vcpus and frees event array
> for the domain.
>
> With this hypercall guest can do something like:
>        struct evtchn_destroy_fifo destroy;
>
>        destroy.dom = DOMID_SELF;
>        HYPERVISOR_event_channel_op(EVTCHNOP_destroy_fifo, &destroy);
>
> before doing
>        HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
> for the first vcpu on init.
>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

In principle, this is a good idea.  However, I would opt for making
EVTCHNOP_reset which is subsystem agnostic.

Xen is perfectly capable of working out which evtchn subsystem a domain
is using, and to call the appropriate cleanup function.  It will prevent
the next evtchn subsystem needing to create EVTCHNOP_destroy_$FOO.

> ---
>  xen/common/event_channel.c         | 30 ++++++++++++++++++++++++++++++
>  xen/common/event_fifo.c            |  1 +
>  xen/include/public/event_channel.h |  7 +++++++
>  3 files changed, 38 insertions(+)
>
> diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
> index db952af..9bc18b2 100644
> --- a/xen/common/event_channel.c
> +++ b/xen/common/event_channel.c
> @@ -939,6 +939,26 @@ int evtchn_unmask(unsigned int port)
>      return 0;
>  }
>  
> +static long evtchn_fifo_destroy_all(domid_t dom)
> +{
> +	struct domain *d;
> +	int rc;
> +
> +	d = rcu_lock_domain_by_any_id(dom);
> +	if ( d == NULL )
> +		return -ESRCH;
> +
> +	rc = xsm_evtchn_reset(XSM_TARGET, current->domain, d);
> +	if ( rc )
> +		goto out;
> +
> +	evtchn_fifo_destroy(d);
> +
> +out:
> +	rcu_unlock_domain(d);
> +
> +	return rc;
> +}
>  
>  static long evtchn_reset(evtchn_reset_t *r)
>  {
> @@ -1121,6 +1141,16 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
>          break;
>      }
>  
> +	case EVTCHNOP_fifo_destroy: {

Style - braces on new lines.

> +		struct evtchn_fifo_destroy destroy;

Style - newline after parameter declarations.

> +		if ( copy_from_guest(&destroy, arg, 1) != 0 )
> +			return -EFAULT;
> +		if ( destroy.dom != DOMID_SELF )
> +			return -EPERM;
> +		rc = evtchn_fifo_destroy_all(destroy.dom);
> +		break;
> +	}
> +
>      default:
>          rc = -ENOSYS;
>          break;
> diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
> index 1fce3f1..51b4ff6 100644
> --- a/xen/common/event_fifo.c
> +++ b/xen/common/event_fifo.c
> @@ -451,6 +451,7 @@ static void cleanup_event_array(struct domain *d)
>      for ( i = 0; i < EVTCHN_FIFO_MAX_EVENT_ARRAY_PAGES; i++ )
>          unmap_guest_page(d->evtchn_fifo->event_array[i]);
>      xfree(d->evtchn_fifo);
> +    d->evtchn_fifo = NULL;
>  }
>  
>  static void setup_ports(struct domain *d)
> diff --git a/xen/include/public/event_channel.h b/xen/include/public/event_channel.h
> index 49ac8cc..79b6e86 100644
> --- a/xen/include/public/event_channel.h
> +++ b/xen/include/public/event_channel.h
> @@ -74,6 +74,7 @@
>  #define EVTCHNOP_init_control    11
>  #define EVTCHNOP_expand_array    12
>  #define EVTCHNOP_set_priority    13
> +#define EVTCHNOP_fifo_destroy    14
>  /* ` } */
>  
>  typedef uint32_t evtchn_port_t;
> @@ -308,6 +309,12 @@ struct evtchn_set_priority {
>  };
>  typedef struct evtchn_set_priority evtchn_set_priority_t;
>  
> +struct evtchn_fifo_destroy {
> +	/* IN parameters. */
> +	domid_t dom;
> +};
> +typedef struct evtchn_fifo_destroy evtchn_fifo_destroy_t;
> +

DOMID_SELF is the only sensible parameter for this.  I would suggest a
parameterless hypercall which unconditionally operates on the current
domain in context.

~Andrew

>  /*
>   * ` enum neg_errnoval
>   * ` HYPERVISOR_event_channel_op_compat(struct evtchn_op *op)