mp_xen.c revision f34a71784df3fbc5d1227a7b6201fd318ad1667e
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
* Virtual CPU management.
*
* VCPUs can be controlled in one of two ways; through the domain itself
* (psradm, p_online(), etc.), and via changes in xenstore (vcpu_config()).
* Unfortunately, the terminology is used in different ways; they work out as
* follows:
*
* P_ONLINE: the VCPU is up and running, taking interrupts and running threads
*
* P_OFFLINE: the VCPU is up and running, but quiesced (i.e. blocked in the
* hypervisor on the idle thread). It must be up since a downed VCPU cannot
* receive interrupts, and we require this for offline CPUs in Solaris.
*
* P_POWEROFF: the VCPU is down (we never called xen_vcpu_up(), or called
* xen_vcpu_down() for it). It can't take interrupts or run anything, though
* if it has run previously, its software state (cpu_t, machcpu structures, IPI
* event channels, etc.) will still exist.
*
* The hypervisor has two notions of CPU states as represented in the store:
*
* "offline": the VCPU is down. Corresponds to P_POWEROFF.
*
* "online": the VCPU is running. Corresponds to a CPU state other than
* P_POWEROFF.
*
* Currently, only a notification via xenstore can bring a CPU into a
* P_POWEROFF state, and only the domain can change between P_ONLINE, P_NOINTR,
* P_OFFLINE, etc. We need to be careful to treat xenstore notifications
* idempotently, as we'll get 'duplicate' entries when we resume a domain.
*
* Note that the xenstore configuration is strictly advisory, in that a domain
* can choose to ignore it and still power up a VCPU in the offline state. To
* ENOTSUP from within Solaris.
*
* Powering off a VCPU and suspending the domain use similar code. The
* difficulty here is that we must ensure that each VCPU is in a stable
* state: it must have a saved PCB, and not be responding to interrupts
* (since we are just about to remove its ability to run on a real CPU,
* possibly forever). However, an offline CPU in Solaris can take
* cross-call interrupts, as mentioned, so we must go through a
* two-stage process. First, we use the standard Solaris pause_cpus().
* This ensures that all CPUs are either in mach_cpu_pause() or
* mach_cpu_idle(), and nothing will cross-call them.
*
* Powered-off-CPUs are already safe, as we own the cpu_lock needed to
* bring them back up, and in state CPU_PHASE_POWERED_OFF.
*
* Running CPUs are spinning in mach_cpu_pause() waiting for either
* PAUSE_IDLE or CPU_PHASE_WAIT_SAFE.
*
* Offline CPUs are either running the idle thread and periodically
* checking for CPU_PHASE_WAIT_SAFE, or blocked in the hypervisor.
*
* Thus, we set CPU_PHASE_WAIT_SAFE for every powered-on CPU, as well as
* poking them to make sure they're not blocked[1]. When every CPU has
* responded by reaching a safe state and setting CPU_PHASE_SAFE, we
* know we can suspend, or power-off a CPU, without problems.
*
* [1] note that we have to repeatedly poke offline CPUs: it's the only
* way to ensure that the CPU doesn't miss the state change before
* dropping into HYPERVISOR_block().
*/
#include <sys/archsystm.h>
#include <sys/machsystm.h>
#include <sys/segments.h>
#include <sys/x86_archext.h>
#include <sys/controlregs.h>
#include <sys/hypervisor.h>
#include <sys/xpv_panic.h>
extern cpuset_t cpu_ready_set;
#define CPU_PHASE_NONE 0
#define CPU_PHASE_WAIT_SAFE 1
#define CPU_PHASE_SAFE 2
#define CPU_PHASE_POWERED_OFF 3
/*
* We can only poke CPUs during barrier enter 256 times a second at
* most.
*/
static taskq_t *cpu_config_tq;
/*
* Return whether or not the vcpu is actually running on a pcpu
*/
int
{
struct vcpu_runstate_info runstate;
int ret = VCPU_STATE_UNKNOWN;
/*
* Don't bother with hypercall if we are asking about ourself
*/
return (VCPU_ON_PCPU);
goto out;
case RUNSTATE_running:
ret = VCPU_ON_PCPU;
break;
case RUNSTATE_runnable:
case RUNSTATE_offline:
case RUNSTATE_blocked:
break;
default:
break;
}
out:
return (ret);
}
/*
* These routines allocate any global state that might be needed
* while starting cpus. For virtual cpus, there is no such state.
*/
int
mach_cpucontext_init(void)
{
return (0);
}
void
do_cpu_config_watch(int state)
{
static struct xenbus_watch cpu_config_watch;
if (state != XENSTORE_UP)
return;
if (register_xenbus_watch(&cpu_config_watch)) {
"failed to set vcpu config watch");
}
}
/*
* This routine is called after all the "normal" MP startup has
* been done; a good place to start watching xen store for virtual
* cpu hot plug events.
*/
void
mach_cpucontext_fini(void)
{
}
/*
* Fill in the remaining CPU context and initialize it.
*/
static int
{
/*
* fpu_ctx we leave as zero; on first fault we'll store
* sse_initial into it anyway.
*/
#if defined(__amd64)
#else
#endif
/*
* Allow I/O privilege level for Dom0 kernel.
*/
if (DOMAIN_IS_INITDOMAIN(xen_info))
else
iopl = 0;
#if defined(__amd64)
#endif
/*
* Initialize the trap_info_t from the IDT
*/
#if !defined(__lint)
#endif
if (xen_idt_to_trap_info(vec,
}
}
/*
* No LDT
*/
/*
* (We assert in various places that the GDT is (a) aligned on a
* page boundary and (b) one page long, so this really should fit..)
*/
#ifdef CRASH_XEN
#else
#endif
#if defined(__i386)
else
#endif
#if defined(__amd64)
/*
* XXPV should this be moved to init_cpu_syscall?
*/
#endif
}
/*
* Create a guest virtual cpu context so that the virtual cpu
* springs into life in the domain just about to call mp_startup()
*
* Virtual CPUs must be initialized once in the lifetime of the domain;
* after that subsequent attempts to start them will fail with X_EEXIST.
*
* Thus 'alloc' -really- creates and initializes the virtual
* CPU context just once. Once the initialisation succeeds, we never
* free it, nor the regular cpu_t to which it refers.
*/
void *
{
int err = 1;
/*
* First, augment the incoming cpu structure
* - vcpu pointer reference
* - pending event storage area
* - physical address of GDT
*/
sizeof (struct xen_evt_data), KM_SLEEP);
goto done;
/*
* Now set up the vcpu context so that we can start this vcpu
* in the kernel at tp->t_pc (mp_startup). Note that the
* thread will thread_exit() shortly after performing the
* initialization; in particular, we will *never* take a
* privilege transition on this thread.
*/
#ifdef __amd64
#else
#endif
/*
* XXPV Fix resume, if Russ didn't already fix it.
*
* Note that resume unconditionally puts t->t_stk + sizeof (regs)
* into kernel_sp via HYPERVISOR_stack_switch. This anticipates
* that only lwps take traps that switch to the kernel stack;
* part of creating an lwp adjusts the stack by subtracting
* sizeof (struct regs) off t_stk.
*
* The more interesting question is, why do we do all the work
* of a fully fledged lwp for a plain thread? In particular
* we don't have to call HYPERVISOR_stack_switch for lwp-less threads
* or futz with the LDT. This should probably all be done with
* an lwp context operator to keep pure thread context switch fast.
*/
done:
if (err) {
return (NULL);
}
return (cp);
}
/*
* By the time we are called either we have successfully started
* the cpu, or our attempt to start it has failed.
*/
/*ARGSUSED*/
void
{
switch (err) {
case 0:
break;
case ETIMEDOUT:
/*
* The vcpu context is loaded into the hypervisor, and
* we've tried to start it, but the vcpu has not been set
* running yet, for whatever reason. We arrange to -not-
* free any data structures it may be referencing. In
* particular, we've already told the hypervisor about
* the GDT, and so we can't map it read-write again.
*/
break;
default:
sizeof (struct xen_evt_data));
break;
}
}
/*
* Reset this CPU's context. Clear out any pending evtchn data, since event
* channel numbers will all change when we resume.
*/
void
{
/* mcpu_intr_pending ? */
}
static void
{
#ifdef __amd64
#else /* __amd64 */
#endif /* __amd64 */
}
/*
* Restore the context of a CPU during resume. This context is always
* inside enter_safe_phase(), below.
*/
void
{
int err;
/*
* We're emulating a longjmp() here: in particular, we need to bump the
* stack pointer to account for the pop of xIP that returning from
* longjmp() normally would do, and set the return value in xAX to 1.
*/
#ifdef __amd64
#else
#endif
}
/*
* Reach a point at which the CPU can be safely powered-off or
* suspended. Nothing can wake this CPU out of the loop.
*/
static void
enter_safe_phase(void)
{
SMT_PAUSE();
}
ASSERT(!interrupts_enabled());
}
/*
* Offline CPUs run this code even under a pause_cpus(), so we must
* check if we need to enter the safe phase.
*/
void
mach_cpu_idle(void)
{
if (IN_XPV_PANIC()) {
} else {
(void) HYPERVISOR_block();
}
}
/*
* Spin until either start_cpus() wakes us up, or we get a request to
* enter the safe phase (followed by a later start_cpus()).
*/
void
mach_cpu_pause(volatile char *safe)
{
*safe = PAUSE_WAIT;
membar_enter();
while (*safe != PAUSE_IDLE) {
SMT_PAUSE();
}
}
void
mach_cpu_halt(char *msg)
{
if (msg)
}
/*ARGSUSED*/
int
{
return (ENOTSUP);
}
/*ARGSUSED*/
int
{
return (ENOTSUP);
}
void
mp_enter_barrier(void)
{
hrtime_t last_poke_time = 0;
int poke_allowed = 0;
int done = 0;
int i;
while (!done) {
done = 1;
poke_allowed = 0;
poke_allowed = 1;
}
for (i = 0; i < NCPU; i++) {
continue;
switch (cpu_phase[i]) {
case CPU_PHASE_NONE:
cpu_phase[i] = CPU_PHASE_WAIT_SAFE;
poke_cpu(i);
done = 0;
break;
case CPU_PHASE_WAIT_SAFE:
if (poke_allowed)
poke_cpu(i);
done = 0;
break;
case CPU_PHASE_SAFE:
case CPU_PHASE_POWERED_OFF:
break;
}
}
SMT_PAUSE();
}
}
void
mp_leave_barrier(void)
{
int i;
for (i = 0; i < NCPU; i++) {
continue;
switch (cpu_phase[i]) {
/*
* If we see a CPU in one of these phases, something has
* gone badly wrong with the guarantees
* mp_enter_barrier() is supposed to provide. Rather
* than attempt to stumble along (and since we can't
* panic properly in this context), we tell the
* hypervisor we've crashed.
*/
case CPU_PHASE_NONE:
case CPU_PHASE_WAIT_SAFE:
(void) HYPERVISOR_shutdown(SHUTDOWN_crash);
break;
case CPU_PHASE_POWERED_OFF:
break;
case CPU_PHASE_SAFE:
cpu_phase[i] = CPU_PHASE_NONE;
}
}
start_cpus();
}
static int
{
int error;
}
return (error);
}
static int
{
int oldstate;
int error;
return (ESRCH);
}
return (0);
}
do {
&oldstate);
if (error != 0)
break;
/*
* So we just changed it to P_OFFLINE. But then we dropped
* cpu_lock, so now it is possible for another thread to change
* the cpu back to a different, non-quiesced state e.g.
* P_ONLINE.
*/
else {
else
}
return (error);
}
/*
* Add a new virtual cpu to the domain.
*/
static int
{
extern int start_cpu(processorid_t);
int error;
if (ncpus == 1) {
printf("cannot (yet) add cpus to a single-cpu domain\n");
return (ENOTSUP);
}
return (error);
}
static int
{
int error;
printf("poweron_vcpu: vcpu%d is not available!\n",
return (ENXIO);
}
/*
* There are some nasty races possible here.
* Tell the vcpu it's up one more time.
* XXPV Is this enough? Is this safe?
*/
}
return (error);
}
static int
{
int oldstate;
int error;
return (vcpu_config_new(id));
return (ESRCH);
}
return (0);
}
return (error);
}
}
#define REPORT_LEN 128
static void
{
char *ps;
switch (newstate) {
case P_ONLINE:
break;
case P_POWEROFF:
ps = PS_POWEROFF;
break;
default:
break;
}
if (!error) {
return;
}
" failed, error %d: ", error);
switch (error) {
case EEXIST:
break;
case ESRCH:
"cpu not found");
break;
case EINVAL:
case EALREADY:
break;
case EPERM:
"insufficient privilege (0x%x)", id);
break;
case EBUSY:
switch (newstate) {
case P_ONLINE:
/*
* This return comes from mp_cpu_start -
* we cannot 'start' the boot CPU.
*/
"already running");
break;
case P_POWEROFF:
"bound lwps?");
break;
default:
break;
}
default:
break;
}
}
static void
vcpu_config(void *arg)
{
int error;
char dir[16];
char *state;
"vcpu_config: cpu%d does not fit in this domain", id);
return;
}
} else {
}
} else
"cpu%d: unable to read target state from xenstore", id);
}
/*ARGSUSED*/
static void
{
char *s;
/*
* Run the virtual CPU configuration on a separate thread to
* avoid blocking on this event for too long (and for now,
* to ensure configuration requests are serialized.)
*/
(void) taskq_dispatch(cpu_config_tq,
}
}
static int
{
int err;
char *str;
switch (err) {
case -X_EINVAL:
/*
* This interface squashes multiple error sources
* to one error code. In particular, an X_EINVAL
* code can mean:
*
* - the vcpu id is out of range
* - cs or ss are in ring 0
* - cr3 is wrong
* - an entry in the new gdt is above the
* reserved entry
* - a frame underneath the new gdt is bad
*/
str = "something is wrong :(";
break;
case -X_ENOENT:
str = "no such cpu";
break;
case -X_ENOMEM:
str = "no mem to copy ctxt";
break;
case -X_EFAULT:
str = "bad address";
break;
case -X_EEXIST:
/*
* Hmm. This error is returned if the vcpu has already
* been initialized once before in the lifetime of this
* domain. This is a logic error in the kernel.
*/
str = "already initialized";
break;
default:
str = "<unexpected>";
break;
}
}
return (err);
}
long
{
long err;
char *str;
switch (err) {
case -X_ENOENT:
str = "no such cpu";
break;
case -X_EINVAL:
/*
* Perhaps this is diagnostic overkill.
*/
str = "bad cpuid";
else
str = "not initialized";
break;
default:
str = "<unexpected>";
break;
}
printf("vcpu%d: failed to start: error %d: %s\n",
return (EBFONT); /* deliberately silly */
}
return (err);
}
long
{
long err;
/*
* X_ENOENT: no such cpu
* X_EINVAL: bad cpuid
*/
}
return (err);
}