1181624Skmacy/****************************************************************************** 2181624Skmacy * grant_table.h 3251767Sgibbs * 4181624Skmacy * Interface for granting foreign access to page frames, and receiving 5181624Skmacy * page-ownership transfers. 6251767Sgibbs * 7181624Skmacy * Permission is hereby granted, free of charge, to any person obtaining a copy 8181624Skmacy * of this software and associated documentation files (the "Software"), to 9181624Skmacy * deal in the Software without restriction, including without limitation the 10181624Skmacy * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or 11181624Skmacy * sell copies of the Software, and to permit persons to whom the Software is 12181624Skmacy * furnished to do so, subject to the following conditions: 13181624Skmacy * 14181624Skmacy * The above copyright notice and this permission notice shall be included in 15181624Skmacy * all copies or substantial portions of the Software. 16181624Skmacy * 17181624Skmacy * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18181624Skmacy * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19181624Skmacy * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 20181624Skmacy * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21181624Skmacy * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 22181624Skmacy * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 23181624Skmacy * DEALINGS IN THE SOFTWARE. 24181624Skmacy * 25181624Skmacy * Copyright (c) 2004, K A Fraser 26181624Skmacy */ 27181624Skmacy 28181624Skmacy#ifndef __XEN_PUBLIC_GRANT_TABLE_H__ 29181624Skmacy#define __XEN_PUBLIC_GRANT_TABLE_H__ 30181624Skmacy 31251767Sgibbs#include "xen.h" 32181624Skmacy 33251767Sgibbs/* 34251767Sgibbs * `incontents 150 gnttab Grant Tables 35251767Sgibbs * 36251767Sgibbs * Xen's grant tables provide a generic mechanism to memory sharing 37251767Sgibbs * between domains. This shared memory interface underpins the split 38251767Sgibbs * device drivers for block and network IO. 39251767Sgibbs * 40251767Sgibbs * Each domain has its own grant table. This is a data structure that 41251767Sgibbs * is shared with Xen; it allows the domain to tell Xen what kind of 42251767Sgibbs * permissions other domains have on its pages. Entries in the grant 43251767Sgibbs * table are identified by grant references. A grant reference is an 44251767Sgibbs * integer, which indexes into the grant table. It acts as a 45251767Sgibbs * capability which the grantee can use to perform operations on the 46251767Sgibbs * granter���s memory. 47251767Sgibbs * 48251767Sgibbs * This capability-based system allows shared-memory communications 49251767Sgibbs * between unprivileged domains. A grant reference also encapsulates 50251767Sgibbs * the details of a shared page, removing the need for a domain to 51251767Sgibbs * know the real machine address of a page it is sharing. This makes 52251767Sgibbs * it possible to share memory correctly with domains running in 53251767Sgibbs * fully virtualised memory. 54251767Sgibbs */ 55251767Sgibbs 56181624Skmacy/*********************************** 57181624Skmacy * GRANT TABLE REPRESENTATION 58181624Skmacy */ 59181624Skmacy 60181624Skmacy/* Some rough guidelines on accessing and updating grant-table entries 61181624Skmacy * in a concurrency-safe manner. For more information, Linux contains a 62251767Sgibbs * reference implementation for guest OSes (drivers/xen/grant_table.c, see 63251767Sgibbs * http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=blob;f=drivers/xen/grant-table.c;hb=HEAD 64251767Sgibbs * 65181624Skmacy * NB. WMB is a no-op on current-generation x86 processors. However, a 66181624Skmacy * compiler barrier will still be required. 67251767Sgibbs * 68181624Skmacy * Introducing a valid entry into the grant table: 69181624Skmacy * 1. Write ent->domid. 70181624Skmacy * 2. Write ent->frame: 71181624Skmacy * GTF_permit_access: Frame to which access is permitted. 72181624Skmacy * GTF_accept_transfer: Pseudo-phys frame slot being filled by new 73181624Skmacy * frame, or zero if none. 74181624Skmacy * 3. Write memory barrier (WMB). 75181624Skmacy * 4. Write ent->flags, inc. valid type. 76251767Sgibbs * 77181624Skmacy * Invalidating an unused GTF_permit_access entry: 78181624Skmacy * 1. flags = ent->flags. 79181624Skmacy * 2. Observe that !(flags & (GTF_reading|GTF_writing)). 80181624Skmacy * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0). 81181624Skmacy * NB. No need for WMB as reuse of entry is control-dependent on success of 82181624Skmacy * step 3, and all architectures guarantee ordering of ctrl-dep writes. 83181624Skmacy * 84181624Skmacy * Invalidating an in-use GTF_permit_access entry: 85181624Skmacy * This cannot be done directly. Request assistance from the domain controller 86181624Skmacy * which can set a timeout on the use of a grant entry and take necessary 87181624Skmacy * action. (NB. This is not yet implemented!). 88251767Sgibbs * 89181624Skmacy * Invalidating an unused GTF_accept_transfer entry: 90181624Skmacy * 1. flags = ent->flags. 91181624Skmacy * 2. Observe that !(flags & GTF_transfer_committed). [*] 92181624Skmacy * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0). 93181624Skmacy * NB. No need for WMB as reuse of entry is control-dependent on success of 94181624Skmacy * step 3, and all architectures guarantee ordering of ctrl-dep writes. 95181624Skmacy * [*] If GTF_transfer_committed is set then the grant entry is 'committed'. 96181624Skmacy * The guest must /not/ modify the grant entry until the address of the 97181624Skmacy * transferred frame is written. It is safe for the guest to spin waiting 98181624Skmacy * for this to occur (detect by observing GTF_transfer_completed in 99181624Skmacy * ent->flags). 100181624Skmacy * 101181624Skmacy * Invalidating a committed GTF_accept_transfer entry: 102181624Skmacy * 1. Wait for (ent->flags & GTF_transfer_completed). 103181624Skmacy * 104181624Skmacy * Changing a GTF_permit_access from writable to read-only: 105181624Skmacy * Use SMP-safe CMPXCHG to set GTF_readonly, while checking !GTF_writing. 106251767Sgibbs * 107181624Skmacy * Changing a GTF_permit_access from read-only to writable: 108181624Skmacy * Use SMP-safe bit-setting instruction. 109181624Skmacy */ 110181624Skmacy 111181624Skmacy/* 112251767Sgibbs * Reference to a grant entry in a specified domain's grant table. 113251767Sgibbs */ 114251767Sgibbstypedef uint32_t grant_ref_t; 115251767Sgibbs 116251767Sgibbs/* 117181624Skmacy * A grant table comprises a packed array of grant entries in one or more 118181624Skmacy * page frames shared between Xen and a guest. 119181624Skmacy * [XEN]: This field is written by Xen and read by the sharing guest. 120181624Skmacy * [GST]: This field is written by the guest and read by Xen. 121181624Skmacy */ 122251767Sgibbs 123251767Sgibbs/* 124251767Sgibbs * Version 1 of the grant table entry structure is maintained purely 125251767Sgibbs * for backwards compatibility. New guests should use version 2. 126251767Sgibbs */ 127251767Sgibbs#if __XEN_INTERFACE_VERSION__ < 0x0003020a 128251767Sgibbs#define grant_entry_v1 grant_entry 129251767Sgibbs#define grant_entry_v1_t grant_entry_t 130251767Sgibbs#endif 131251767Sgibbsstruct grant_entry_v1 { 132181624Skmacy /* GTF_xxx: various type and flag information. [XEN,GST] */ 133181624Skmacy uint16_t flags; 134181624Skmacy /* The domain being granted foreign privileges. [GST] */ 135181624Skmacy domid_t domid; 136181624Skmacy /* 137288917Sroyger * GTF_permit_access: GFN that @domid is allowed to map and access. [GST] 138288917Sroyger * GTF_accept_transfer: GFN that @domid is allowed to transfer into. [GST] 139288917Sroyger * GTF_transfer_completed: MFN whose ownership transferred by @domid 140288917Sroyger * (non-translated guests only). [XEN] 141181624Skmacy */ 142181624Skmacy uint32_t frame; 143181624Skmacy}; 144251767Sgibbstypedef struct grant_entry_v1 grant_entry_v1_t; 145181624Skmacy 146251767Sgibbs/* The first few grant table entries will be preserved across grant table 147251767Sgibbs * version changes and may be pre-populated at domain creation by tools. 148251767Sgibbs */ 149251767Sgibbs#define GNTTAB_NR_RESERVED_ENTRIES 8 150251767Sgibbs#define GNTTAB_RESERVED_CONSOLE 0 151251767Sgibbs#define GNTTAB_RESERVED_XENSTORE 1 152251767Sgibbs 153181624Skmacy/* 154181624Skmacy * Type of grant entry. 155181624Skmacy * GTF_invalid: This grant entry grants no privileges. 156181624Skmacy * GTF_permit_access: Allow @domid to map/access @frame. 157181624Skmacy * GTF_accept_transfer: Allow @domid to transfer ownership of one page frame 158181624Skmacy * to this guest. Xen writes the page number to @frame. 159251767Sgibbs * GTF_transitive: Allow @domid to transitively access a subrange of 160251767Sgibbs * @trans_grant in @trans_domid. No mappings are allowed. 161181624Skmacy */ 162181624Skmacy#define GTF_invalid (0U<<0) 163181624Skmacy#define GTF_permit_access (1U<<0) 164181624Skmacy#define GTF_accept_transfer (2U<<0) 165251767Sgibbs#define GTF_transitive (3U<<0) 166181624Skmacy#define GTF_type_mask (3U<<0) 167181624Skmacy 168181624Skmacy/* 169181624Skmacy * Subflags for GTF_permit_access. 170181624Skmacy * GTF_readonly: Restrict @domid to read-only mappings and accesses. [GST] 171181624Skmacy * GTF_reading: Grant entry is currently mapped for reading by @domid. [XEN] 172181624Skmacy * GTF_writing: Grant entry is currently mapped for writing by @domid. [XEN] 173183340Skmacy * GTF_PAT, GTF_PWT, GTF_PCD: (x86) cache attribute flags for the grant [GST] 174251767Sgibbs * GTF_sub_page: Grant access to only a subrange of the page. @domid 175251767Sgibbs * will only be allowed to copy from the grant, and not 176251767Sgibbs * map it. [GST] 177181624Skmacy */ 178181624Skmacy#define _GTF_readonly (2) 179181624Skmacy#define GTF_readonly (1U<<_GTF_readonly) 180181624Skmacy#define _GTF_reading (3) 181181624Skmacy#define GTF_reading (1U<<_GTF_reading) 182181624Skmacy#define _GTF_writing (4) 183181624Skmacy#define GTF_writing (1U<<_GTF_writing) 184183340Skmacy#define _GTF_PWT (5) 185183340Skmacy#define GTF_PWT (1U<<_GTF_PWT) 186183340Skmacy#define _GTF_PCD (6) 187183340Skmacy#define GTF_PCD (1U<<_GTF_PCD) 188183340Skmacy#define _GTF_PAT (7) 189183340Skmacy#define GTF_PAT (1U<<_GTF_PAT) 190251767Sgibbs#define _GTF_sub_page (8) 191251767Sgibbs#define GTF_sub_page (1U<<_GTF_sub_page) 192181624Skmacy 193181624Skmacy/* 194181624Skmacy * Subflags for GTF_accept_transfer: 195181624Skmacy * GTF_transfer_committed: Xen sets this flag to indicate that it is committed 196181624Skmacy * to transferring ownership of a page frame. When a guest sees this flag 197181624Skmacy * it must /not/ modify the grant entry until GTF_transfer_completed is 198181624Skmacy * set by Xen. 199181624Skmacy * GTF_transfer_completed: It is safe for the guest to spin-wait on this flag 200181624Skmacy * after reading GTF_transfer_committed. Xen will always write the frame 201181624Skmacy * address, followed by ORing this flag, in a timely manner. 202181624Skmacy */ 203181624Skmacy#define _GTF_transfer_committed (2) 204181624Skmacy#define GTF_transfer_committed (1U<<_GTF_transfer_committed) 205181624Skmacy#define _GTF_transfer_completed (3) 206181624Skmacy#define GTF_transfer_completed (1U<<_GTF_transfer_completed) 207181624Skmacy 208251767Sgibbs/* 209251767Sgibbs * Version 2 grant table entries. These fulfil the same role as 210251767Sgibbs * version 1 entries, but can represent more complicated operations. 211251767Sgibbs * Any given domain will have either a version 1 or a version 2 table, 212251767Sgibbs * and every entry in the table will be the same version. 213251767Sgibbs * 214251767Sgibbs * The interface by which domains use grant references does not depend 215251767Sgibbs * on the grant table version in use by the other domain. 216251767Sgibbs */ 217251767Sgibbs#if __XEN_INTERFACE_VERSION__ >= 0x0003020a 218251767Sgibbs/* 219251767Sgibbs * Version 1 and version 2 grant entries share a common prefix. The 220251767Sgibbs * fields of the prefix are documented as part of struct 221251767Sgibbs * grant_entry_v1. 222251767Sgibbs */ 223251767Sgibbsstruct grant_entry_header { 224251767Sgibbs uint16_t flags; 225251767Sgibbs domid_t domid; 226251767Sgibbs}; 227251767Sgibbstypedef struct grant_entry_header grant_entry_header_t; 228181624Skmacy 229251767Sgibbs/* 230251767Sgibbs * Version 2 of the grant entry structure. 231251767Sgibbs */ 232251767Sgibbsunion grant_entry_v2 { 233251767Sgibbs grant_entry_header_t hdr; 234251767Sgibbs 235251767Sgibbs /* 236251767Sgibbs * This member is used for V1-style full page grants, where either: 237251767Sgibbs * 238251767Sgibbs * -- hdr.type is GTF_accept_transfer, or 239251767Sgibbs * -- hdr.type is GTF_permit_access and GTF_sub_page is not set. 240251767Sgibbs * 241251767Sgibbs * In that case, the frame field has the same semantics as the 242251767Sgibbs * field of the same name in the V1 entry structure. 243251767Sgibbs */ 244251767Sgibbs struct { 245251767Sgibbs grant_entry_header_t hdr; 246251767Sgibbs uint32_t pad0; 247251767Sgibbs uint64_t frame; 248251767Sgibbs } full_page; 249251767Sgibbs 250251767Sgibbs /* 251251767Sgibbs * If the grant type is GTF_grant_access and GTF_sub_page is set, 252251767Sgibbs * @domid is allowed to access bytes [@page_off,@page_off+@length) 253251767Sgibbs * in frame @frame. 254251767Sgibbs */ 255251767Sgibbs struct { 256251767Sgibbs grant_entry_header_t hdr; 257251767Sgibbs uint16_t page_off; 258251767Sgibbs uint16_t length; 259251767Sgibbs uint64_t frame; 260251767Sgibbs } sub_page; 261251767Sgibbs 262251767Sgibbs /* 263251767Sgibbs * If the grant is GTF_transitive, @domid is allowed to use the 264251767Sgibbs * grant @gref in domain @trans_domid, as if it was the local 265251767Sgibbs * domain. Obviously, the transitive access must be compatible 266251767Sgibbs * with the original grant. 267251767Sgibbs * 268251767Sgibbs * The current version of Xen does not allow transitive grants 269251767Sgibbs * to be mapped. 270251767Sgibbs */ 271251767Sgibbs struct { 272251767Sgibbs grant_entry_header_t hdr; 273251767Sgibbs domid_t trans_domid; 274251767Sgibbs uint16_t pad0; 275251767Sgibbs grant_ref_t gref; 276251767Sgibbs } transitive; 277251767Sgibbs 278251767Sgibbs uint32_t __spacer[4]; /* Pad to a power of two */ 279251767Sgibbs}; 280251767Sgibbstypedef union grant_entry_v2 grant_entry_v2_t; 281251767Sgibbs 282251767Sgibbstypedef uint16_t grant_status_t; 283251767Sgibbs 284251767Sgibbs#endif /* __XEN_INTERFACE_VERSION__ */ 285251767Sgibbs 286181624Skmacy/*********************************** 287181624Skmacy * GRANT TABLE QUERIES AND USES 288181624Skmacy */ 289181624Skmacy 290251767Sgibbs/* ` enum neg_errnoval 291251767Sgibbs * ` HYPERVISOR_grant_table_op(enum grant_table_op cmd, 292251767Sgibbs * ` void *args, 293251767Sgibbs * ` unsigned int count) 294251767Sgibbs * ` 295251767Sgibbs * 296251767Sgibbs * @args points to an array of a per-command data structure. The array 297251767Sgibbs * has @count members 298181624Skmacy */ 299181624Skmacy 300251767Sgibbs/* ` enum grant_table_op { // GNTTABOP_* => struct gnttab_* */ 301251767Sgibbs#define GNTTABOP_map_grant_ref 0 302251767Sgibbs#define GNTTABOP_unmap_grant_ref 1 303251767Sgibbs#define GNTTABOP_setup_table 2 304251767Sgibbs#define GNTTABOP_dump_table 3 305251767Sgibbs#define GNTTABOP_transfer 4 306251767Sgibbs#define GNTTABOP_copy 5 307251767Sgibbs#define GNTTABOP_query_size 6 308251767Sgibbs#define GNTTABOP_unmap_and_replace 7 309251767Sgibbs#if __XEN_INTERFACE_VERSION__ >= 0x0003020a 310251767Sgibbs#define GNTTABOP_set_version 8 311251767Sgibbs#define GNTTABOP_get_status_frames 9 312251767Sgibbs#define GNTTABOP_get_version 10 313251767Sgibbs#define GNTTABOP_swap_grant_ref 11 314288917Sroyger#define GNTTABOP_cache_flush 12 315251767Sgibbs#endif /* __XEN_INTERFACE_VERSION__ */ 316251767Sgibbs/* ` } */ 317214077Sgibbs 318181624Skmacy/* 319181624Skmacy * Handle to track a mapping created via a grant reference. 320181624Skmacy */ 321181624Skmacytypedef uint32_t grant_handle_t; 322181624Skmacy 323181624Skmacy/* 324181624Skmacy * GNTTABOP_map_grant_ref: Map the grant entry (<dom>,<ref>) for access 325181624Skmacy * by devices and/or host CPUs. If successful, <handle> is a tracking number 326288917Sroyger * that must be presented later to destroy the mapping(s). On error, <status> 327181624Skmacy * is a negative status code. 328181624Skmacy * NOTES: 329181624Skmacy * 1. If GNTMAP_device_map is specified then <dev_bus_addr> is the address 330181624Skmacy * via which I/O devices may access the granted frame. 331181624Skmacy * 2. If GNTMAP_host_map is specified then a mapping will be added at 332181624Skmacy * either a host virtual address in the current address space, or at 333181624Skmacy * a PTE at the specified machine address. The type of mapping to 334251767Sgibbs * perform is selected through the GNTMAP_contains_pte flag, and the 335181624Skmacy * address is specified in <host_addr>. 336181624Skmacy * 3. Mappings should only be destroyed via GNTTABOP_unmap_grant_ref. If a 337181624Skmacy * host mapping is destroyed by other means then it is *NOT* guaranteed 338181624Skmacy * to be accounted to the correct grant reference! 339181624Skmacy */ 340181624Skmacystruct gnttab_map_grant_ref { 341181624Skmacy /* IN parameters. */ 342181624Skmacy uint64_t host_addr; 343181624Skmacy uint32_t flags; /* GNTMAP_* */ 344181624Skmacy grant_ref_t ref; 345181624Skmacy domid_t dom; 346181624Skmacy /* OUT parameters. */ 347251767Sgibbs int16_t status; /* => enum grant_status */ 348181624Skmacy grant_handle_t handle; 349181624Skmacy uint64_t dev_bus_addr; 350181624Skmacy}; 351181624Skmacytypedef struct gnttab_map_grant_ref gnttab_map_grant_ref_t; 352181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_map_grant_ref_t); 353181624Skmacy 354181624Skmacy/* 355181624Skmacy * GNTTABOP_unmap_grant_ref: Destroy one or more grant-reference mappings 356181624Skmacy * tracked by <handle>. If <host_addr> or <dev_bus_addr> is zero, that 357181624Skmacy * field is ignored. If non-zero, they must refer to a device/host mapping 358181624Skmacy * that is tracked by <handle> 359181624Skmacy * NOTES: 360181624Skmacy * 1. The call may fail in an undefined manner if either mapping is not 361181624Skmacy * tracked by <handle>. 362181624Skmacy * 3. After executing a batch of unmaps, it is guaranteed that no stale 363181624Skmacy * mappings will remain in the device or host TLBs. 364181624Skmacy */ 365181624Skmacystruct gnttab_unmap_grant_ref { 366181624Skmacy /* IN parameters. */ 367181624Skmacy uint64_t host_addr; 368181624Skmacy uint64_t dev_bus_addr; 369181624Skmacy grant_handle_t handle; 370181624Skmacy /* OUT parameters. */ 371251767Sgibbs int16_t status; /* => enum grant_status */ 372181624Skmacy}; 373181624Skmacytypedef struct gnttab_unmap_grant_ref gnttab_unmap_grant_ref_t; 374181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_unmap_grant_ref_t); 375181624Skmacy 376181624Skmacy/* 377181624Skmacy * GNTTABOP_setup_table: Set up a grant table for <dom> comprising at least 378181624Skmacy * <nr_frames> pages. The frame addresses are written to the <frame_list>. 379181624Skmacy * Only <nr_frames> addresses are written, even if the table is larger. 380181624Skmacy * NOTES: 381181624Skmacy * 1. <dom> may be specified as DOMID_SELF. 382181624Skmacy * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 383181624Skmacy * 3. Xen may not support more than a single grant-table page per domain. 384181624Skmacy */ 385181624Skmacystruct gnttab_setup_table { 386181624Skmacy /* IN parameters. */ 387181624Skmacy domid_t dom; 388181624Skmacy uint32_t nr_frames; 389181624Skmacy /* OUT parameters. */ 390251767Sgibbs int16_t status; /* => enum grant_status */ 391288917Sroyger#if __XEN_INTERFACE_VERSION__ < 0x00040300 392183375Skmacy XEN_GUEST_HANDLE(ulong) frame_list; 393288917Sroyger#else 394288917Sroyger XEN_GUEST_HANDLE(xen_pfn_t) frame_list; 395288917Sroyger#endif 396181624Skmacy}; 397181624Skmacytypedef struct gnttab_setup_table gnttab_setup_table_t; 398181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_setup_table_t); 399181624Skmacy 400181624Skmacy/* 401181624Skmacy * GNTTABOP_dump_table: Dump the contents of the grant table to the 402181624Skmacy * xen console. Debugging use only. 403181624Skmacy */ 404181624Skmacystruct gnttab_dump_table { 405181624Skmacy /* IN parameters. */ 406181624Skmacy domid_t dom; 407181624Skmacy /* OUT parameters. */ 408251767Sgibbs int16_t status; /* => enum grant_status */ 409181624Skmacy}; 410181624Skmacytypedef struct gnttab_dump_table gnttab_dump_table_t; 411181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_dump_table_t); 412181624Skmacy 413181624Skmacy/* 414181624Skmacy * GNTTABOP_transfer_grant_ref: Transfer <frame> to a foreign domain. The 415181624Skmacy * foreign domain has previously registered its interest in the transfer via 416181624Skmacy * <domid, ref>. 417251767Sgibbs * 418181624Skmacy * Note that, even if the transfer fails, the specified page no longer belongs 419181624Skmacy * to the calling domain *unless* the error is GNTST_bad_page. 420181624Skmacy */ 421181624Skmacystruct gnttab_transfer { 422181624Skmacy /* IN parameters. */ 423181624Skmacy xen_pfn_t mfn; 424181624Skmacy domid_t domid; 425181624Skmacy grant_ref_t ref; 426181624Skmacy /* OUT parameters. */ 427181624Skmacy int16_t status; 428181624Skmacy}; 429181624Skmacytypedef struct gnttab_transfer gnttab_transfer_t; 430181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_transfer_t); 431181624Skmacy 432181624Skmacy 433181624Skmacy/* 434181624Skmacy * GNTTABOP_copy: Hypervisor based copy 435181624Skmacy * source and destinations can be eithers MFNs or, for foreign domains, 436181624Skmacy * grant references. the foreign domain has to grant read/write access 437181624Skmacy * in its grant table. 438181624Skmacy * 439181624Skmacy * The flags specify what type source and destinations are (either MFN 440181624Skmacy * or grant reference). 441181624Skmacy * 442181624Skmacy * Note that this can also be used to copy data between two domains 443181624Skmacy * via a third party if the source and destination domains had previously 444181624Skmacy * grant appropriate access to their pages to the third party. 445181624Skmacy * 446181624Skmacy * source_offset specifies an offset in the source frame, dest_offset 447181624Skmacy * the offset in the target frame and len specifies the number of 448181624Skmacy * bytes to be copied. 449181624Skmacy */ 450181624Skmacy 451181624Skmacy#define _GNTCOPY_source_gref (0) 452181624Skmacy#define GNTCOPY_source_gref (1<<_GNTCOPY_source_gref) 453181624Skmacy#define _GNTCOPY_dest_gref (1) 454181624Skmacy#define GNTCOPY_dest_gref (1<<_GNTCOPY_dest_gref) 455181624Skmacy 456251767Sgibbsstruct gnttab_copy { 457181624Skmacy /* IN parameters. */ 458288917Sroyger struct gnttab_copy_ptr { 459181624Skmacy union { 460181624Skmacy grant_ref_t ref; 461181624Skmacy xen_pfn_t gmfn; 462181624Skmacy } u; 463181624Skmacy domid_t domid; 464181624Skmacy uint16_t offset; 465181624Skmacy } source, dest; 466181624Skmacy uint16_t len; 467181624Skmacy uint16_t flags; /* GNTCOPY_* */ 468181624Skmacy /* OUT parameters. */ 469181624Skmacy int16_t status; 470251767Sgibbs}; 471251767Sgibbstypedef struct gnttab_copy gnttab_copy_t; 472181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_copy_t); 473181624Skmacy 474181624Skmacy/* 475181624Skmacy * GNTTABOP_query_size: Query the current and maximum sizes of the shared 476181624Skmacy * grant table. 477181624Skmacy * NOTES: 478181624Skmacy * 1. <dom> may be specified as DOMID_SELF. 479181624Skmacy * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 480181624Skmacy */ 481181624Skmacystruct gnttab_query_size { 482181624Skmacy /* IN parameters. */ 483181624Skmacy domid_t dom; 484181624Skmacy /* OUT parameters. */ 485181624Skmacy uint32_t nr_frames; 486181624Skmacy uint32_t max_nr_frames; 487251767Sgibbs int16_t status; /* => enum grant_status */ 488181624Skmacy}; 489181624Skmacytypedef struct gnttab_query_size gnttab_query_size_t; 490181624SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_query_size_t); 491181624Skmacy 492183340Skmacy/* 493183340Skmacy * GNTTABOP_unmap_and_replace: Destroy one or more grant-reference mappings 494183340Skmacy * tracked by <handle> but atomically replace the page table entry with one 495183340Skmacy * pointing to the machine address under <new_addr>. <new_addr> will be 496183340Skmacy * redirected to the null entry. 497183340Skmacy * NOTES: 498183340Skmacy * 1. The call may fail in an undefined manner if either mapping is not 499183340Skmacy * tracked by <handle>. 500183340Skmacy * 2. After executing a batch of unmaps, it is guaranteed that no stale 501183340Skmacy * mappings will remain in the device or host TLBs. 502183340Skmacy */ 503183340Skmacystruct gnttab_unmap_and_replace { 504183340Skmacy /* IN parameters. */ 505183340Skmacy uint64_t host_addr; 506183340Skmacy uint64_t new_addr; 507183340Skmacy grant_handle_t handle; 508183340Skmacy /* OUT parameters. */ 509251767Sgibbs int16_t status; /* => enum grant_status */ 510183340Skmacy}; 511183340Skmacytypedef struct gnttab_unmap_and_replace gnttab_unmap_and_replace_t; 512183340SkmacyDEFINE_XEN_GUEST_HANDLE(gnttab_unmap_and_replace_t); 513181624Skmacy 514251767Sgibbs#if __XEN_INTERFACE_VERSION__ >= 0x0003020a 515251767Sgibbs/* 516251767Sgibbs * GNTTABOP_set_version: Request a particular version of the grant 517251767Sgibbs * table shared table structure. This operation can only be performed 518251767Sgibbs * once in any given domain. It must be performed before any grants 519251767Sgibbs * are activated; otherwise, the domain will be stuck with version 1. 520251767Sgibbs * The only defined versions are 1 and 2. 521251767Sgibbs */ 522251767Sgibbsstruct gnttab_set_version { 523251767Sgibbs /* IN/OUT parameters */ 524251767Sgibbs uint32_t version; 525251767Sgibbs}; 526251767Sgibbstypedef struct gnttab_set_version gnttab_set_version_t; 527251767SgibbsDEFINE_XEN_GUEST_HANDLE(gnttab_set_version_t); 528183340Skmacy 529251767Sgibbs 530181624Skmacy/* 531251767Sgibbs * GNTTABOP_get_status_frames: Get the list of frames used to store grant 532251767Sgibbs * status for <dom>. In grant format version 2, the status is separated 533251767Sgibbs * from the other shared grant fields to allow more efficient synchronization 534251767Sgibbs * using barriers instead of atomic cmpexch operations. 535251767Sgibbs * <nr_frames> specify the size of vector <frame_list>. 536251767Sgibbs * The frame addresses are returned in the <frame_list>. 537251767Sgibbs * Only <nr_frames> addresses are returned, even if the table is larger. 538251767Sgibbs * NOTES: 539251767Sgibbs * 1. <dom> may be specified as DOMID_SELF. 540251767Sgibbs * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 541181624Skmacy */ 542251767Sgibbsstruct gnttab_get_status_frames { 543251767Sgibbs /* IN parameters. */ 544251767Sgibbs uint32_t nr_frames; 545251767Sgibbs domid_t dom; 546251767Sgibbs /* OUT parameters. */ 547251767Sgibbs int16_t status; /* => enum grant_status */ 548251767Sgibbs XEN_GUEST_HANDLE(uint64_t) frame_list; 549251767Sgibbs}; 550251767Sgibbstypedef struct gnttab_get_status_frames gnttab_get_status_frames_t; 551251767SgibbsDEFINE_XEN_GUEST_HANDLE(gnttab_get_status_frames_t); 552251767Sgibbs 553251767Sgibbs/* 554251767Sgibbs * GNTTABOP_get_version: Get the grant table version which is in 555251767Sgibbs * effect for domain <dom>. 556251767Sgibbs */ 557251767Sgibbsstruct gnttab_get_version { 558251767Sgibbs /* IN parameters */ 559251767Sgibbs domid_t dom; 560251767Sgibbs uint16_t pad; 561251767Sgibbs /* OUT parameters */ 562251767Sgibbs uint32_t version; 563251767Sgibbs}; 564251767Sgibbstypedef struct gnttab_get_version gnttab_get_version_t; 565251767SgibbsDEFINE_XEN_GUEST_HANDLE(gnttab_get_version_t); 566251767Sgibbs 567251767Sgibbs/* 568251767Sgibbs * GNTTABOP_swap_grant_ref: Swap the contents of two grant entries. 569251767Sgibbs */ 570251767Sgibbsstruct gnttab_swap_grant_ref { 571251767Sgibbs /* IN parameters */ 572251767Sgibbs grant_ref_t ref_a; 573251767Sgibbs grant_ref_t ref_b; 574251767Sgibbs /* OUT parameters */ 575251767Sgibbs int16_t status; /* => enum grant_status */ 576251767Sgibbs}; 577251767Sgibbstypedef struct gnttab_swap_grant_ref gnttab_swap_grant_ref_t; 578251767SgibbsDEFINE_XEN_GUEST_HANDLE(gnttab_swap_grant_ref_t); 579251767Sgibbs 580288917Sroyger/* 581288917Sroyger * Issue one or more cache maintenance operations on a portion of a 582288917Sroyger * page granted to the calling domain by a foreign domain. 583288917Sroyger */ 584288917Sroygerstruct gnttab_cache_flush { 585288917Sroyger union { 586288917Sroyger uint64_t dev_bus_addr; 587288917Sroyger grant_ref_t ref; 588288917Sroyger } a; 589288917Sroyger uint16_t offset; /* offset from start of grant */ 590288917Sroyger uint16_t length; /* size within the grant */ 591288917Sroyger#define GNTTAB_CACHE_CLEAN (1<<0) 592288917Sroyger#define GNTTAB_CACHE_INVAL (1<<1) 593288917Sroyger#define GNTTAB_CACHE_SOURCE_GREF (1<<31) 594288917Sroyger uint32_t op; 595288917Sroyger}; 596288917Sroygertypedef struct gnttab_cache_flush gnttab_cache_flush_t; 597288917SroygerDEFINE_XEN_GUEST_HANDLE(gnttab_cache_flush_t); 598288917Sroyger 599251767Sgibbs#endif /* __XEN_INTERFACE_VERSION__ */ 600251767Sgibbs 601251767Sgibbs/* 602251767Sgibbs * Bitfield values for gnttab_map_grant_ref.flags. 603251767Sgibbs */ 604181624Skmacy /* Map the grant entry for access by I/O devices. */ 605181624Skmacy#define _GNTMAP_device_map (0) 606181624Skmacy#define GNTMAP_device_map (1<<_GNTMAP_device_map) 607181624Skmacy /* Map the grant entry for access by host CPUs. */ 608181624Skmacy#define _GNTMAP_host_map (1) 609181624Skmacy#define GNTMAP_host_map (1<<_GNTMAP_host_map) 610181624Skmacy /* Accesses to the granted frame will be restricted to read-only access. */ 611181624Skmacy#define _GNTMAP_readonly (2) 612181624Skmacy#define GNTMAP_readonly (1<<_GNTMAP_readonly) 613181624Skmacy /* 614181624Skmacy * GNTMAP_host_map subflag: 615181624Skmacy * 0 => The host mapping is usable only by the guest OS. 616181624Skmacy * 1 => The host mapping is usable by guest OS + current application. 617181624Skmacy */ 618181624Skmacy#define _GNTMAP_application_map (3) 619181624Skmacy#define GNTMAP_application_map (1<<_GNTMAP_application_map) 620181624Skmacy 621181624Skmacy /* 622181624Skmacy * GNTMAP_contains_pte subflag: 623181624Skmacy * 0 => This map request contains a host virtual address. 624181624Skmacy * 1 => This map request contains the machine addess of the PTE to update. 625181624Skmacy */ 626181624Skmacy#define _GNTMAP_contains_pte (4) 627181624Skmacy#define GNTMAP_contains_pte (1<<_GNTMAP_contains_pte) 628181624Skmacy 629251767Sgibbs#define _GNTMAP_can_fail (5) 630251767Sgibbs#define GNTMAP_can_fail (1<<_GNTMAP_can_fail) 631251767Sgibbs 632181624Skmacy/* 633251767Sgibbs * Bits to be placed in guest kernel available PTE bits (architecture 634251767Sgibbs * dependent; only supported when XENFEAT_gnttab_map_avail_bits is set). 635251767Sgibbs */ 636251767Sgibbs#define _GNTMAP_guest_avail0 (16) 637251767Sgibbs#define GNTMAP_guest_avail_mask ((uint32_t)~0 << _GNTMAP_guest_avail0) 638251767Sgibbs 639251767Sgibbs/* 640181624Skmacy * Values for error status returns. All errors are -ve. 641181624Skmacy */ 642251767Sgibbs/* ` enum grant_status { */ 643181624Skmacy#define GNTST_okay (0) /* Normal return. */ 644181624Skmacy#define GNTST_general_error (-1) /* General undefined error. */ 645181624Skmacy#define GNTST_bad_domain (-2) /* Unrecognsed domain id. */ 646181624Skmacy#define GNTST_bad_gntref (-3) /* Unrecognised or inappropriate gntref. */ 647181624Skmacy#define GNTST_bad_handle (-4) /* Unrecognised or inappropriate handle. */ 648181624Skmacy#define GNTST_bad_virt_addr (-5) /* Inappropriate virtual address to map. */ 649181624Skmacy#define GNTST_bad_dev_addr (-6) /* Inappropriate device address to unmap.*/ 650181624Skmacy#define GNTST_no_device_space (-7) /* Out of space in I/O MMU. */ 651181624Skmacy#define GNTST_permission_denied (-8) /* Not enough privilege for operation. */ 652181624Skmacy#define GNTST_bad_page (-9) /* Specified page was invalid for op. */ 653181624Skmacy#define GNTST_bad_copy_arg (-10) /* copy arguments cross page boundary. */ 654181624Skmacy#define GNTST_address_too_big (-11) /* transfer page address too large. */ 655251767Sgibbs#define GNTST_eagain (-12) /* Operation not done; try again. */ 656251767Sgibbs/* ` } */ 657181624Skmacy 658181624Skmacy#define GNTTABOP_error_msgs { \ 659181624Skmacy "okay", \ 660181624Skmacy "undefined error", \ 661181624Skmacy "unrecognised domain id", \ 662181624Skmacy "invalid grant reference", \ 663181624Skmacy "invalid mapping handle", \ 664181624Skmacy "invalid virtual address", \ 665181624Skmacy "invalid device address", \ 666181624Skmacy "no spare translation slot in the I/O MMU", \ 667181624Skmacy "permission denied", \ 668181624Skmacy "bad page", \ 669181624Skmacy "copy arguments cross page boundary", \ 670251767Sgibbs "page address size too large", \ 671251767Sgibbs "operation not done; try again" \ 672181624Skmacy} 673181624Skmacy 674181624Skmacy#endif /* __XEN_PUBLIC_GRANT_TABLE_H__ */ 675181624Skmacy 676181624Skmacy/* 677181624Skmacy * Local variables: 678181624Skmacy * mode: C 679288917Sroyger * c-file-style: "BSD" 680181624Skmacy * c-basic-offset: 4 681181624Skmacy * tab-width: 4 682181624Skmacy * indent-tabs-mode: nil 683181624Skmacy * End: 684181624Skmacy */ 685