Jan Kiszka [Sun, 8 Mar 2015 19:51:25 +0000 (20:51 +0100)]
hypervisor: Fix cleaning of generated files for latest kernels
Recent kernels seem to add their own prefix to clean-files, thus won't
remove our files as the paths gets wrong. We can simply remove $(obj),
that works both for current and older kernels.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 8 Mar 2015 19:35:46 +0000 (20:35 +0100)]
driver: Move to separate directory
The top-level directory is starting to fill up, and the driver requires
some split-up into multiple modules. This should better be done in a
dedicated directory.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 8 Mar 2015 19:10:51 +0000 (20:10 +0100)]
build: Let inmates depend on hypervisor build unconditionally
$(clean) is no longer set only for clean runs with recent kernels. Thus
the dependency is now never set. At the same time, setting it also for
clean runs causes no unwanted side effects anymore. So remove the test.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 9 Mar 2015 14:04:21 +0000 (15:04 +0100)]
x86: Fix hypercall dispatching assembly
The macro reads jailhouse_use_vmcall, a bool variable that is mapped on
a byte on x86. Specify the width to avoid that we test more than we
should.
This bug was revealed by adding further global bool variables that
happen to line up after jailhouse_use_vmcall. The current memory layout
may make the issue harmless in practice.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 22 Feb 2015 09:26:06 +0000 (10:26 +0100)]
arm: Power off non-root CPUs before shutting down the hypervisor
When handing back a CPU previously used by a non-root cell directly to
Linux during hypervisor shutdown, we have to power it off when Linux is
using PSCI. Otherwise, the CPU_ON command issued by Linux later on to
gain control over the CPU again may not work as expected.
All our supported boards except for the Versatile Express come with PSCI
support. Try both v0.2 and the v0.1 encoding of U-Boot for CPU_OFF. At
least one of them must work.
The GICC is not reset by the power-down, thus we have to reset it shut
it down explicitly.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 16 Feb 2015 19:16:23 +0000 (20:16 +0100)]
arm: Add support for Jetson TK1 board
The Jetson TK1 board uses the NVIDIA K1 processor, namely the Tegra124.
The CPU has 4 Cortex-A15 cores and a low-power companion core which we
do not support, though. This SoC apparently contains all virtualization
features we need, specifically full SMMU coverage of I/O devices.
For now, board support is similar to the Banana Pi: We replicate UART
and SMP/PSCI features and add some configs (only one for both demos as
only one UART is accessible).
Open issues, besides adding SMMU support, are managing the access to the
so-called legacy Interrupt controller of the K1 (an additional stage
between devices and GIC) and sub-page access control to various devices
(same issue as with the Allwinner A20). Also, it becomes clearer than
ever that we urgently need to refactor the UART layer as well as
SMP/PSCI support to reduce duplications.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 23 Feb 2015 10:22:32 +0000 (11:22 +0100)]
driver: Update CR4 on x86 after hypervisor enabling/disabling
Linux gained CR4 shadowing in 4.0: it now keeps a software copy of the
mm's CR4 state and only write updates on changes. But this also means it
will miss changes to this register when enabling or disabling Jailhouse.
That will cause sporadic access violations or false reporting of
virtualization-busy CPUs on Jailhouse enable.
Fix it by re-initializing the shadow on x86 after returning from the
hypervisor entry or the disable command. We are still protected from
interrupts at that point, so nothing can leak to other tasks.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Wed, 18 Feb 2015 08:41:58 +0000 (09:41 +0100)]
driver: Account for removal of cpumask_scnprintf
4.0 provides cpumask formatting via the %*pb format specifier.
cpumask_scnprintf was removed. So we need to implement both variants
for staying compatible with older kernels.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Thu, 12 Feb 2015 10:02:42 +0000 (11:02 +0100)]
arm: Add PSCI v0.1 support as provided by U-Boot
Upstream U-Boot will continue to offer only a PSCI v0.1 interface. To
make us independent of patches, add the IDs for CPU_OFF and CPU_ON to
the dispatcher. Those functions are practically compatible between 0.1
and 0.2.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Thu, 12 Feb 2015 09:15:48 +0000 (10:15 +0100)]
arm: Rename CONFIG_ARCH_* to CONFIG_MACH_*
Based on proposal by Benedikt Spranger: CONFIG_ARCH_SUN7I and
CONFIG_ARCH_VEXPRESS select a machine type, not an architecture. Rename
them to clarify this.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sat, 7 Feb 2015 10:33:58 +0000 (11:33 +0100)]
arm: Fix spi_in_cell for SPIs 32..63
The cell configuration format restricts us to 64 SPIs this far. Make
sure that we properly test the range of 32 to 63 and avoid overflows due
to 32-bit word width. As Jailhouse provides no __aeabi_llsr, extract
high and low words first, then scan within 32 bits.
This addresses Coverity finding CID 21110.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 6 Feb 2015 14:19:30 +0000 (15:19 +0100)]
Add Coverity scan to README and contribution process
Integrate the code scan via Coverity in our documentation and the also
the contribution process.
Not all patches may require a scan prior to posting, thus only recommend
this step for contributors for now. A scan will now always be performed
for code changes before accepting them into master.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 6 Feb 2015 20:08:48 +0000 (21:08 +0100)]
ci: Select single configuration for Coverity scan via branch name
As scan results of generic files are overwritten with the last
configuration build, allow to pick a specific config for stand-alone
analysis. This comes at the price of overwriting results on the project
page but is still better than missing something subtle.
To differentiate the snapshot in Coverity, patch the description that is
attached to the upload.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 6 Feb 2015 13:08:56 +0000 (14:08 +0100)]
ci: Include all configurations in Coverity scan
Coverity only provides us as OSS project a single "stream", thus a
single configuration for our project. But we already have 3. However,
we can accumulate results to a certain degree with some tricks: We have
to ensure that the intermediate "make clean" runs are not tracked by
cov-build, the build tracker of Coverity.
That's why we overload the default scan-build script of Travis CI and
Coverity, obtain the original one from our script, patch that version
to run our build script in a way that we have control over what gets
tracked and what not. Nasty, but seems to work sufficiently for now.
In addition, we need to register the ARM cross-compiler via
cov-configure.
At this chance: "description" is no longer used by Coverity - drop it.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 2 Feb 2015 12:41:29 +0000 (13:41 +0100)]
x86: Clean up and document cpu_suspended setting in arch_panic_stop
Document why we manipulate cpu_suspended outside of the per-cpu lock and
drop the superfluous memory barrier. Nothing has to be ordered here, we
just do a full stop and try to avoid that some other CPU will wait
infinitely on us to finish "suspension".
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 2 Feb 2015 12:27:43 +0000 (13:27 +0100)]
x86: Avoid theoretical race between CPU suspension and arch_resume_cpu
Conceptually, we avoid this race by synchronizing on cpu_suspended in
arch_suspend_cpu. However, to ease the analysis by both humans and code
scanners, let's apply the lock around the manipulation. Lock acquisition
also includes the required memory barrier so that we can drop the
explicit one.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 2 Feb 2015 09:15:28 +0000 (10:15 +0100)]
ci: Add Coverity scan
This only processes x86 code so far as Coverity also relies on binary
outputs to at least trigger the scan. We will have to decide to develop
a workaround or switch to a matrix build (including redundant
environment setups).
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 1 Feb 2015 10:38:18 +0000 (11:38 +0100)]
inmates: Power-up PHY on E1000 takeover
Clear the power-down bit in the PHY control register in case the
previous user turned it off. Linux does so since about 3.15.
Note that we do not try to reset the PHY. Getting it running again with
the proper link speed turned out to be too complicated (too many PHY
variants) for this little demo.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Wed, 28 Jan 2015 09:58:58 +0000 (10:58 +0100)]
tools: Close files after use in config generator
Just to be clean and to avoid piling up unused resources. In some cases
we already did so, in one we were using the with statement. Now the
remaining perform the close as well.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Henning Schild [Tue, 27 Jan 2015 14:05:30 +0000 (15:05 +0100)]
tools: config create: do not use the class file of pci devs anymore
The class file just contains the classcode. Since we started also using
the file containing the whole PCI config space we might as well get the
class information from there and copy/access less input files.
Signed-off-by: Henning Schild <henning.schild@siemens.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Tue, 27 Jan 2015 10:09:21 +0000 (11:09 +0100)]
x86: Switch to ticket spinlocks
ARM already has it, x86 should gain it as well: To avoid the risk of
unfair lock assignment or even starvation in excessive contention
scenarios, switch to the ticket-based spinlock algorithm that also Linux
uses. Our implementation is a condensed version of the kernel as we do
not have to take para-virtual optimizations and instrumentations into
account.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 26 Jan 2015 12:25:48 +0000 (13:25 +0100)]
x86: Account for multiple IOAPICs per cell
Finally overcome the limitation of only one IOAPIC per cell, thus also
per system. We either look up the IOAPIC from the cell array based on
its physical address or we iterate over all IOAPICs of a cell when
needed - that's all. A good sign that we achieved this is the removal of
the IOAPIC_BASE_ADDR constant.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 26 Jan 2015 10:02:36 +0000 (11:02 +0100)]
x86: Introduce per-cell IOAPIC state
This introduces per-cell IOAPIC static and dynamic information. It
replaces related cell fields with a reference to an array of cell_ioapic
structures. As we do not want to keep a large array for every cell, even
for those that do not use the IOAPIC (typically all non-root cells), the
array is stored in a page allocated on demand during cell creation.
Using this abstraction obsoletes ioapic_find_config and moves us a bit
further away from the assumption that there is only a single IOAPIC.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 26 Jan 2015 09:07:58 +0000 (10:07 +0100)]
x86: Set up physical IOAPIC on cell creation
In preparation to support multiple IOAPICs, instantiate their physical
state phys_ioapic only on demand during cell creation. For simplicity
reasons, those instances will not be released on cell destruction again.
That means, once created, physical IOAPIC states and mappings stay with
the hypervisor until it is disabled again.
Note: Parts of the code keep their single-IOAPIC restrictions for now.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 25 Jan 2015 20:57:19 +0000 (21:57 +0100)]
x86: Introduce phys_ioapic abstraction
This structure will keep static and dynamic information about a physical
IOAPIC in a system. The three global variables ioapic_lock, ioapic and
shadow_redir_table are moved over, and an array of phys_ioapic
structures takes over their place. There is still only a single instance
supported, but once we have more, the physical base address will be used
to differentiate between them and also look them up from the array.
Internal functions of the IOAPIC subsystem are converted to make use of
the abstraction.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sat, 24 Jan 2015 07:54:48 +0000 (08:54 +0100)]
x86: Filter out unsupported numbers of irqchips
So far we only support a single IOAPIC per cell on x86. Soon this number
will be increased significantly, but a limit will remain. Filter out any
unsupported configurations during cell-specific IOAPIC setup.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sat, 24 Jan 2015 06:41:25 +0000 (07:41 +0100)]
tools: Extend config generator to process multiple IOAPICs
As a first step towards full support of more than one IOAPIC, extend the
config generator to process multiple IOAPIC entries in the DMAR table.
It used the MADT ("APIC") table to collect further information about the
found IOAPICs and lists them all in the irqchips array.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 25 Jan 2015 09:28:31 +0000 (10:28 +0100)]
x86: Only hand over IOAPICs pins to the root cell that are in use
Use the bitmap of currently assigned IOAPIC pins to hand them over to
the root cell, not those that are initially assigned. That makes a
difference when shutting down the hypervisor while some pins are still
owned by a non-root cell. During startup, both bitmaps are identical.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Wed, 28 Jan 2015 07:01:04 +0000 (08:01 +0100)]
x86: Fix error roll-back for vtd
If we fail the hypervisor setup before vtd_init_unit was run, we must
not try to restore anything during iommu_shutdown. This happened to far
and caused Linux crashes as well as spurious NMI injections.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Another way of dealing with 32-bit PM timers is to just pretend they
where 24-bit long. That is what an earlier patch does for jailhouse, so
this one is not required anymore.
Henning Schild [Wed, 26 Nov 2014 10:12:07 +0000 (11:12 +0100)]
inmates: x86: mask pm_timer to 24bits
Operate any pm_timer in 24bit mode, even if it is 32bit capable. Linux
also just looks at the lower 24.
That simplyfies the code and we can deal with 24bit timers where the
ACPI tables claim they where 32bit wide.
Signed-off-by: Henning Schild <henning.schild@siemens.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 9 Jan 2015 19:15:21 +0000 (20:15 +0100)]
docs: Add CONTRIBUTING.md
Specify the contribution cycle in form of a checklist and a sketched
integration process. Also list people with specific responsibility areas
that should be involved on their topics.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 9 Jan 2015 17:59:42 +0000 (18:59 +0100)]
tooling: Detect too old make version
Massaged version of Hans' original patch: Since d0ca500b we depend on
make >= 3.82. That can be a problem for oldish distributions. Better
catch it early.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 2 Jan 2015 13:37:43 +0000 (14:37 +0100)]
README: Adjust to markdown format
Perform some reformatting so that we can present the README as markdown
file for nicer visualization on github. Also prepare for ARM addition
and adjust the kernel version requirement of x86 at this chance.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Thu, 1 Jan 2015 12:58:08 +0000 (13:58 +0100)]
ci: Add Travis CI infrastructure
Based on Roger Meier's proposal, this adds support for testing Jailhouse
builds on Travis CI (travis-ci.org). The major differences to Roger's
approach are:
- Linux kernels are pre-built and pushed as archive to a webserver
- all target variants (x86, Banana Pi, Versatile Express) are built in
a single run to limit archive downloads
- required kernel and Jailhouse configs become part of our tree
The kernel archive can be generated via ci/gen-kernel-build.sh in an
environment comparable to the Travis CI VMs. See ci/README.md for more
information.
CC: Roger Meier <r.meier@siemens.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 26 Dec 2014 10:52:04 +0000 (11:52 +0100)]
arm: Clear virtual GICs before handing them over to Linux during setup
Previous users of the virtual GICs may have left them with pending
interrupts or raised priority levels. Fix this up before starting Linux
under Jailhouse control. Otherwise we risk to inject spurious interrupts
or stall interrupt delivery to Linux.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sat, 20 Dec 2014 11:11:44 +0000 (12:11 +0100)]
arm: Implement PSCI_AFFINITY_INFO_32
Linux uses it to check if a CPU is really dead and at least dumps
warnings on the console if this function fails. It is mandatory to
implement according to the spec.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 19 Dec 2014 15:25:42 +0000 (16:25 +0100)]
arm: Wait for CPU to stop in arch_suspend_cpu
The semantic of arch_suspend_cpu is synchronous, i.e. it has to wait
until the target CPU was actually suspended. Extend the ARM
implementation accordingly.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 15 Dec 2014 17:02:49 +0000 (18:02 +0100)]
inmates: arm: Enhance gic-demo with latency statistics
Original version by Johann Pfefferl: This transfers the apic-demo to
ARM by letting the timer tick at 10 Hz and print jitter statistics on
each event. In addition, this also lets the green LED on the Banana Pi
blink.
CC: Johann Pfefferl <johann.pfefferl@siemens.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 14 Dec 2014 17:28:34 +0000 (18:28 +0100)]
arm: Open clock gate on UART setup
Add the infrastructure to open a clock gate on UART configuration. This
is particularly helpful if Linux drivers close the gate when releasing
the device.
For now the assumption is that a clock gate can be described by a single
bit in a specific register.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Wed, 12 Nov 2014 12:01:43 +0000 (13:01 +0100)]
arm: Add support for Banana Pi board
The Banana Pi is a cheap ARMv7 board with a dual-core Cortex-A7, thus
with virtualization support. Upstream U-boot and kernel work fine -
ideal conditions. We just lack some IOMMU on that board, but it remains
handy for testing purposes.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Tue, 25 Nov 2014 08:06:42 +0000 (09:06 +0100)]
arm: Rework return to EL1 path
Refactor cpu_return_el1 to cpu_prepare_return_el1, moving the differing
parts depending on the return mode to the caller site. Ensure that we
return to Linux passing the proper error code - it's now available to
arch_cpu_restore.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Tue, 25 Nov 2014 08:02:45 +0000 (09:02 +0100)]
core: Pass return code to arch_cpu_restore
Some architectures, so far ARM, may prefer to jump directly to the
target Linux context from arch_cpu_restore. In this case we need to have
the return code at hand as well. Extend the parameter list accordingly
and document the possibility that arch_cpu_restore does not return to
the caller.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Fri, 21 Nov 2014 20:00:28 +0000 (21:00 +0100)]
arm: Account for irqchip_cell_exit being called before irqchip_init
If the hypervisor setup procedures fails before irqchip_init was called,
arch_shutdown will still invoke irqchip_cell_exit. If we run this
function, we'll crash latest when trying to access the not yet mapped
GIC. Leave irqchip_cell_exit early in this case.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 12 Oct 2014 15:50:12 +0000 (17:50 +0200)]
arm: Switch to generic UART mapping
Start using the generic UART mapping by the Linux driver. For this the
VExpress config has to gain physical base and size information of the
debug UART.
This removed the tedious need to adjust UART_BASE_VIRT in platform.h
according to the Linux configuration.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 12 Oct 2014 14:52:31 +0000 (16:52 +0200)]
core/driver: Add support for mapping the debug UART from the driver
If the debug UART is memory-mapped, we can only access prior to
switching to hypervisor mappings if the driver supports us in this. By
adding a debug_uart memory region to the system configuration, we tell
the driver about the mapping need. In turn, the driver reports the
virtual address via an additional header field. The mapping can be
released on Linux side right after enabling the hypervisor
Provided the virtual address of the UART mapping as chosen by Linux does
not conflict with our remapping region, this mapping can safely be
replicated into the hypervisor address space so that we don't need to
adjust the UART access after enabling our own mapping.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 12 Oct 2014 14:13:49 +0000 (16:13 +0200)]
core: Redefine PAGE_FLAG_UNCACHED to PAGE_FLAG_DEVICE
All (x86) users of this page flag map devices into the hypervisor
address space. We will do the same for ARM when mapping the debug UART.
For this we need a generic flag with the same semantics. As uncached is
different from device mappings, redefine the semantic of UNCACHED flag
for this purpose.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 29 Sep 2014 10:49:34 +0000 (12:49 +0200)]
arm: Adjust UART_BASE_VIRT according to local test configuration
It's almost pointless to tune this constant as it is highly dependent on
the local kernel config. However, this one helps local testing until we
have a better solution for getting the UART mapped for the hypervisor
during early setup.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Mon, 29 Sep 2014 10:37:29 +0000 (12:37 +0200)]
inmates: arm: Fix and improve build
Introduce and use DECLARE_TARGETS just like x86 does. This prevents
unconditional rebuilding of the inmates on every make. Also move the
filtering of "-include asm/unified.h" into reusable Makefile.lib.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Jan Kiszka [Sun, 28 Sep 2014 19:43:54 +0000 (21:43 +0200)]
configs: Adjust VExpress configs for smaller reservations
Move the hypervisor at the top of 2G memory. The gic and uart demo cells
are placed below, each given much less space than before - they don't
need more.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
These config files are used to run the root cell (vexpress.c) and the
inmates examples (vexpress-*-demo) on the vexpress platform.
vexpress-linux-demo can be used to create a cell for an SMP linux on CPUs
2 and 3, by assigning it the UART3 IRQ.
This patch adds the necessary libraries for writing simple inmates on arm,
and provides two demos.
It attempts to use the same layout as x86, and allows to set the devices
base addresses with platform-specific includes, in order to avoid
including kconfig.h
Only the vexpress platform with GICv2 and GICv3 is supported for the
moment.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: Use config.mk instead of kbuild, use mmio accessors,
avoid integer overflow, add copyright headers] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This patch implements the counters that report the number VM exits,
accessible by the driver. It also adds three statistics for the ARM
side: the number of IRQs injected, the number of IPIs injected, and the
number of GIC maintenance IRQs received.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
GICv2 is limited to 8 CPUs and uses independent routing bits, whereas
GICv3 (with ARE enabled) uses the MPIDR encoding (aff3.aff2.aff1.aff0)
for routing SPIs.
Before handling SPIs, the GICv2 backend has to probe its banked view of
the distributor to know which CPU interface it is accessing. After that,
the implementation is roughly the same as for GICv3, but GICD_ITARGETSR
are used instead of IROUTER.
Because the guest isn't supposed to rely on the CPU interface number
being coherent with the CPU logical ID, we don't have to translate it to
a virtual ID before handling route accesses inside SMP cells.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: switch to mmio accessor] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This patch implements the following GICv2 features:
- Remap GICC to GICV in the cells to provide a virtual interface
- Guest SGI filtering and hyp SGI handling
- IRQ injection
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: switch to mmio accessor] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This patch implements two cases:
- When an error occurs before setting up EL2, there is nothing much
to do except restore the linux registers stored in the per_cpu
datas.
- When it happens after EL2 setup, arch_cpu_restore copies the saved
registers on the stack, and continues into arch_shutdown_self
When it happens during the MMU setup, chances of recovering a clean
state are pretty thin anyway. The bootstrap vectors could be used to
catch and dump a minimal context (which would require a raw_printk
implementation), but we cowardly ignore this case for the moment.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: fix memcpy size in cpu_return_el1] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
When an HV_DISABLE hypercall is issued on all root CPUs by the driver,
the core `shutdown' function executes the following operations:
- Suspend all non-root cells (all the CPUs are taken to hyp idle mode),
- call arch_shutdown_cpu for all those CPUs,
- call arch_shutdown.
Once the master CPU (the first to take the shutdown lock) did this, the
other root CPUs don't actually perform any operation.
This patch lets the arch_shutdown and arch_shutdown_cpu set a boolean
that is considered by the cores right before returning to EL1: for the
cells' CPUs, arch_shutdown_cpu will trigger a return to arch_reset_self,
that will clean up EL1 and EL2. On the root cpus, the exit handler
checks this boolean and calls the shutdown function.
Once inside arch_shutdown_self, the principle is the same as with the
hypervisor initialisation:
- Create identity mappings of the trampoline page and the stack,
- Jump to the physical address of the shutdown function,
- Disable the MMU,
- Reset the vectors,
- Return to EL1
This patch does not handle hosts using PSCI yet: they will need to issue
a final SMC on secondary CPUs in order to park themselves at EL3, since
the hypervisor won't exist anymore to emulate the wakeup call.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: moved arch_shutdown_cpu & arch_shutdown to control.c] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This patch stores the hypervisor stub vectors before installing EL2, in
order to reset them on shutdown. It assumes that they are the same on all
CPUs.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
The Auxiliary Control Register may be used on some platforms to disable
memory coherency between the cores, for instance when unplugging a CPU.
This patch ensures that ACTLR is never modified, by trapping its accesses
with the HCR.TAC bit.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Hotplugging CPUs on ARM is quite difficult, as each platform uses its
own system. The use of PSCI emulation will greatly simplify this, but
on many platforms, we still have to define a series of specific SMP
operations wrapped around the kernel hotplug implementation.
This patch adds support for the vexpress hotplug system:
- When the root cell attempts to unplug a CPU, to give it to a new
cell, it is put in a WFI loop, which is left when Jailhouse sends
a synchronising IPI to all CPUs that need to be parked.
- When re-assigning a CPU to the root cell, the simplest return path
is through the kernel's secondary entry, whose address is stored in
the system flags register.
Because the kernel only writes the flag register once, plugging CPUs in
the host cannot be accomplished by waiting for a trapped MMIO. Moreover,
such a trap would be missed on hypervisor shutdown, since CPU0 may
return to bare EL1 before secondary CPUs. On some platforms, it may be
necessary to park secondary CPUs outside of the hypervisor on shutdown,
by copying a minimal spin code in a reserved location...
This patch also attempts to combine both classical and PSCI boot methods
in SMP guests: secondary CPUs are held in the psci_emulate_spin handler,
and can be woken up by both a PSCI call and a trapped access to the
vexpress mbox.
The same applies for hotplugging secondary CPUs in the guests, but the
mailbox method only waits for an IPI.
PSCI in the host is not currently supported: it would require a call to
the actual CPU_OFF handler when shutting down the whole hypervisor.
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
[Jan: switch to mmio accessor] Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>