1 /****************************************************************************** 2 * grant_table.h 3 * 4 * Interface for granting foreign access to page frames, and receiving 5 * page-ownership transfers. 6 * 7 * Permission is hereby granted, free of charge, to any person obtaining a copy 8 * of this software and associated documentation files (the "Software"), to 9 * deal in the Software without restriction, including without limitation the 10 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or 11 * sell copies of the Software, and to permit persons to whom the Software is 12 * furnished to do so, subject to the following conditions: 13 * 14 * The above copyright notice and this permission notice shall be included in 15 * all copies or substantial portions of the Software. 16 * 17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 22 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 23 * DEALINGS IN THE SOFTWARE. 24 * 25 * Copyright (c) 2004, K A Fraser 26 */ 27 28 #ifndef __XEN_PUBLIC_GRANT_TABLE_H__ 29 #define __XEN_PUBLIC_GRANT_TABLE_H__ 30 31 #include "xen.h" 32 33 /* 34 * `incontents 150 gnttab Grant Tables 35 * 36 * Xen's grant tables provide a generic mechanism to memory sharing 37 * between domains. This shared memory interface underpins the split 38 * device drivers for block and network IO. 39 * 40 * Each domain has its own grant table. This is a data structure that 41 * is shared with Xen; it allows the domain to tell Xen what kind of 42 * permissions other domains have on its pages. Entries in the grant 43 * table are identified by grant references. A grant reference is an 44 * integer, which indexes into the grant table. It acts as a 45 * capability which the grantee can use to perform operations on the 46 * granter's memory. 47 * 48 * This capability-based system allows shared-memory communications 49 * between unprivileged domains. A grant reference also encapsulates 50 * the details of a shared page, removing the need for a domain to 51 * know the real machine address of a page it is sharing. This makes 52 * it possible to share memory correctly with domains running in 53 * fully virtualised memory. 54 */ 55 56 /*********************************** 57 * GRANT TABLE REPRESENTATION 58 */ 59 60 /* Some rough guidelines on accessing and updating grant-table entries 61 * in a concurrency-safe manner. For more information, Linux contains a 62 * reference implementation for guest OSes (drivers/xen/grant_table.c, see 63 * http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=blob;f=drivers/xen/grant-table.c;hb=HEAD 64 * 65 * NB. WMB is a no-op on current-generation x86 processors. However, a 66 * compiler barrier will still be required. 67 * 68 * Introducing a valid entry into the grant table: 69 * 1. Write ent->domid. 70 * 2. Write ent->frame: 71 * GTF_permit_access: Frame to which access is permitted. 72 * GTF_accept_transfer: Pseudo-phys frame slot being filled by new 73 * frame, or zero if none. 74 * 3. Write memory barrier (WMB). 75 * 4. Write ent->flags, inc. valid type. 76 * 77 * Invalidating an unused GTF_permit_access entry: 78 * 1. flags = ent->flags. 79 * 2. Observe that !(flags & (GTF_reading|GTF_writing)). 80 * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0). 81 * NB. No need for WMB as reuse of entry is control-dependent on success of 82 * step 3, and all architectures guarantee ordering of ctrl-dep writes. 83 * 84 * Invalidating an in-use GTF_permit_access entry: 85 * This cannot be done directly. Request assistance from the domain controller 86 * which can set a timeout on the use of a grant entry and take necessary 87 * action. (NB. This is not yet implemented!). 88 * 89 * Invalidating an unused GTF_accept_transfer entry: 90 * 1. flags = ent->flags. 91 * 2. Observe that !(flags & GTF_transfer_committed). [*] 92 * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0). 93 * NB. No need for WMB as reuse of entry is control-dependent on success of 94 * step 3, and all architectures guarantee ordering of ctrl-dep writes. 95 * [*] If GTF_transfer_committed is set then the grant entry is 'committed'. 96 * The guest must /not/ modify the grant entry until the address of the 97 * transferred frame is written. It is safe for the guest to spin waiting 98 * for this to occur (detect by observing GTF_transfer_completed in 99 * ent->flags). 100 * 101 * Invalidating a committed GTF_accept_transfer entry: 102 * 1. Wait for (ent->flags & GTF_transfer_completed). 103 * 104 * Changing a GTF_permit_access from writable to read-only: 105 * Use SMP-safe CMPXCHG to set GTF_readonly, while checking !GTF_writing. 106 * 107 * Changing a GTF_permit_access from read-only to writable: 108 * Use SMP-safe bit-setting instruction. 109 */ 110 111 /* 112 * Reference to a grant entry in a specified domain's grant table. 113 */ 114 typedef uint32_t grant_ref_t; 115 116 /* 117 * A grant table comprises a packed array of grant entries in one or more 118 * page frames shared between Xen and a guest. 119 * [XEN]: This field is written by Xen and read by the sharing guest. 120 * [GST]: This field is written by the guest and read by Xen. 121 */ 122 123 /* 124 * Version 1 of the grant table entry structure is maintained largely for 125 * backwards compatibility. New guests are recommended to support using 126 * version 2 to overcome version 1 limitations, but to default to version 1. 127 */ 128 #if __XEN_INTERFACE_VERSION__ < 0x0003020a 129 #define grant_entry_v1 grant_entry 130 #define grant_entry_v1_t grant_entry_t 131 #endif 132 struct grant_entry_v1 { 133 /* GTF_xxx: various type and flag information. [XEN,GST] */ 134 uint16_t flags; 135 /* The domain being granted foreign privileges. [GST] */ 136 domid_t domid; 137 /* 138 * GTF_permit_access: GFN that @domid is allowed to map and access. [GST] 139 * GTF_accept_transfer: GFN that @domid is allowed to transfer into. [GST] 140 * GTF_transfer_completed: MFN whose ownership transferred by @domid 141 * (non-translated guests only). [XEN] 142 */ 143 uint32_t frame; 144 }; 145 typedef struct grant_entry_v1 grant_entry_v1_t; 146 147 /* The first few grant table entries will be preserved across grant table 148 * version changes and may be pre-populated at domain creation by tools. 149 */ 150 #define GNTTAB_NR_RESERVED_ENTRIES 8 151 #define GNTTAB_RESERVED_CONSOLE 0 152 #define GNTTAB_RESERVED_XENSTORE 1 153 154 /* 155 * Type of grant entry. 156 * GTF_invalid: This grant entry grants no privileges. 157 * GTF_permit_access: Allow @domid to map/access @frame. 158 * GTF_accept_transfer: Allow @domid to transfer ownership of one page frame 159 * to this guest. Xen writes the page number to @frame. 160 * GTF_transitive: Allow @domid to transitively access a subrange of 161 * @trans_grant in @trans_domid. No mappings are allowed. 162 */ 163 #define GTF_invalid (0U<<0) 164 #define GTF_permit_access (1U<<0) 165 #define GTF_accept_transfer (2U<<0) 166 #define GTF_transitive (3U<<0) 167 #define GTF_type_mask (3U<<0) 168 169 /* 170 * Subflags for GTF_permit_access and GTF_transitive. 171 * GTF_readonly: Restrict @domid to read-only mappings and accesses. [GST] 172 * GTF_reading: Grant entry is currently mapped for reading by @domid. [XEN] 173 * GTF_writing: Grant entry is currently mapped for writing by @domid. [XEN] 174 * Further subflags for GTF_permit_access only. 175 * GTF_PAT, GTF_PWT, GTF_PCD: (x86) cache attribute flags to be used for 176 * mappings of the grant [GST] 177 * GTF_sub_page: Grant access to only a subrange of the page. @domid 178 * will only be allowed to copy from the grant, and not 179 * map it. [GST] 180 */ 181 #define _GTF_readonly (2) 182 #define GTF_readonly (1U<<_GTF_readonly) 183 #define _GTF_reading (3) 184 #define GTF_reading (1U<<_GTF_reading) 185 #define _GTF_writing (4) 186 #define GTF_writing (1U<<_GTF_writing) 187 #define _GTF_PWT (5) 188 #define GTF_PWT (1U<<_GTF_PWT) 189 #define _GTF_PCD (6) 190 #define GTF_PCD (1U<<_GTF_PCD) 191 #define _GTF_PAT (7) 192 #define GTF_PAT (1U<<_GTF_PAT) 193 #define _GTF_sub_page (8) 194 #define GTF_sub_page (1U<<_GTF_sub_page) 195 196 /* 197 * Subflags for GTF_accept_transfer: 198 * GTF_transfer_committed: Xen sets this flag to indicate that it is committed 199 * to transferring ownership of a page frame. When a guest sees this flag 200 * it must /not/ modify the grant entry until GTF_transfer_completed is 201 * set by Xen. 202 * GTF_transfer_completed: It is safe for the guest to spin-wait on this flag 203 * after reading GTF_transfer_committed. Xen will always write the frame 204 * address, followed by ORing this flag, in a timely manner. 205 */ 206 #define _GTF_transfer_committed (2) 207 #define GTF_transfer_committed (1U<<_GTF_transfer_committed) 208 #define _GTF_transfer_completed (3) 209 #define GTF_transfer_completed (1U<<_GTF_transfer_completed) 210 211 /* 212 * Version 2 grant table entries. These fulfil the same role as 213 * version 1 entries, but can represent more complicated operations. 214 * Any given domain will have either a version 1 or a version 2 table, 215 * and every entry in the table will be the same version. 216 * 217 * The interface by which domains use grant references does not depend 218 * on the grant table version in use by the other domain. 219 */ 220 #if __XEN_INTERFACE_VERSION__ >= 0x0003020a 221 /* 222 * Version 1 and version 2 grant entries share a common prefix. The 223 * fields of the prefix are documented as part of struct 224 * grant_entry_v1. 225 */ 226 struct grant_entry_header { 227 uint16_t flags; 228 domid_t domid; 229 }; 230 typedef struct grant_entry_header grant_entry_header_t; 231 232 /* 233 * Version 2 of the grant entry structure. 234 */ 235 union grant_entry_v2 { 236 grant_entry_header_t hdr; 237 238 /* 239 * This member is used for V1-style full page grants, where either: 240 * 241 * -- hdr.type is GTF_accept_transfer, or 242 * -- hdr.type is GTF_permit_access and GTF_sub_page is not set. 243 * 244 * In that case, the frame field has the same semantics as the 245 * field of the same name in the V1 entry structure. 246 */ 247 struct { 248 grant_entry_header_t hdr; 249 uint32_t pad0; 250 uint64_t frame; 251 } full_page; 252 253 /* 254 * If the grant type is GTF_grant_access and GTF_sub_page is set, 255 * @domid is allowed to access bytes [@page_off,@page_off+@length) 256 * in frame @frame. 257 */ 258 struct { 259 grant_entry_header_t hdr; 260 uint16_t page_off; 261 uint16_t length; 262 uint64_t frame; 263 } sub_page; 264 265 /* 266 * If the grant is GTF_transitive, @domid is allowed to use the 267 * grant @gref in domain @trans_domid, as if it was the local 268 * domain. Obviously, the transitive access must be compatible 269 * with the original grant. 270 * 271 * The current version of Xen does not allow transitive grants 272 * to be mapped. 273 */ 274 struct { 275 grant_entry_header_t hdr; 276 domid_t trans_domid; 277 uint16_t pad0; 278 grant_ref_t gref; 279 } transitive; 280 281 uint32_t __spacer[4]; /* Pad to a power of two */ 282 }; 283 typedef union grant_entry_v2 grant_entry_v2_t; 284 285 typedef uint16_t grant_status_t; 286 287 #endif /* __XEN_INTERFACE_VERSION__ */ 288 289 /*********************************** 290 * GRANT TABLE QUERIES AND USES 291 */ 292 293 /* ` enum neg_errnoval 294 * ` HYPERVISOR_grant_table_op(enum grant_table_op cmd, 295 * ` void *args, 296 * ` unsigned int count) 297 * ` 298 * 299 * @args points to an array of a per-command data structure. The array 300 * has @count members 301 */ 302 303 /* ` enum grant_table_op { // GNTTABOP_* => struct gnttab_* */ 304 #define GNTTABOP_map_grant_ref 0 305 #define GNTTABOP_unmap_grant_ref 1 306 #define GNTTABOP_setup_table 2 307 #define GNTTABOP_dump_table 3 308 #define GNTTABOP_transfer 4 309 #define GNTTABOP_copy 5 310 #define GNTTABOP_query_size 6 311 #define GNTTABOP_unmap_and_replace 7 312 #if __XEN_INTERFACE_VERSION__ >= 0x0003020a 313 #define GNTTABOP_set_version 8 314 #define GNTTABOP_get_status_frames 9 315 #define GNTTABOP_get_version 10 316 #define GNTTABOP_swap_grant_ref 11 317 #define GNTTABOP_cache_flush 12 318 #endif /* __XEN_INTERFACE_VERSION__ */ 319 /* ` } */ 320 321 /* 322 * Handle to track a mapping created via a grant reference. 323 */ 324 typedef uint32_t grant_handle_t; 325 326 /* 327 * GNTTABOP_map_grant_ref: Map the grant entry (<dom>,<ref>) for access 328 * by devices and/or host CPUs. If successful, <handle> is a tracking number 329 * that must be presented later to destroy the mapping(s). On error, <status> 330 * is a negative status code. 331 * NOTES: 332 * 1. If GNTMAP_device_map is specified then <dev_bus_addr> is the address 333 * via which I/O devices may access the granted frame. 334 * 2. If GNTMAP_host_map is specified then a mapping will be added at 335 * either a host virtual address in the current address space, or at 336 * a PTE at the specified machine address. The type of mapping to 337 * perform is selected through the GNTMAP_contains_pte flag, and the 338 * address is specified in <host_addr>. 339 * 3. Mappings should only be destroyed via GNTTABOP_unmap_grant_ref. If a 340 * host mapping is destroyed by other means then it is *NOT* guaranteed 341 * to be accounted to the correct grant reference! 342 */ 343 struct gnttab_map_grant_ref { 344 /* IN parameters. */ 345 uint64_t host_addr; 346 uint32_t flags; /* GNTMAP_* */ 347 grant_ref_t ref; 348 domid_t dom; 349 /* OUT parameters. */ 350 int16_t status; /* => enum grant_status */ 351 grant_handle_t handle; 352 uint64_t dev_bus_addr; 353 }; 354 typedef struct gnttab_map_grant_ref gnttab_map_grant_ref_t; 355 DEFINE_XEN_GUEST_HANDLE(gnttab_map_grant_ref_t); 356 357 /* 358 * GNTTABOP_unmap_grant_ref: Destroy one or more grant-reference mappings 359 * tracked by <handle>. If <host_addr> or <dev_bus_addr> is zero, that 360 * field is ignored. If non-zero, they must refer to a device/host mapping 361 * that is tracked by <handle> 362 * NOTES: 363 * 1. The call may fail in an undefined manner if either mapping is not 364 * tracked by <handle>. 365 * 3. After executing a batch of unmaps, it is guaranteed that no stale 366 * mappings will remain in the device or host TLBs. 367 */ 368 struct gnttab_unmap_grant_ref { 369 /* IN parameters. */ 370 uint64_t host_addr; 371 uint64_t dev_bus_addr; 372 grant_handle_t handle; 373 /* OUT parameters. */ 374 int16_t status; /* => enum grant_status */ 375 }; 376 typedef struct gnttab_unmap_grant_ref gnttab_unmap_grant_ref_t; 377 DEFINE_XEN_GUEST_HANDLE(gnttab_unmap_grant_ref_t); 378 379 /* 380 * GNTTABOP_setup_table: Set up a grant table for <dom> comprising at least 381 * <nr_frames> pages. The frame addresses are written to the <frame_list>. 382 * Only <nr_frames> addresses are written, even if the table is larger. 383 * NOTES: 384 * 1. <dom> may be specified as DOMID_SELF. 385 * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 386 * 3. Xen may not support more than a single grant-table page per domain. 387 */ 388 struct gnttab_setup_table { 389 /* IN parameters. */ 390 domid_t dom; 391 uint32_t nr_frames; 392 /* OUT parameters. */ 393 int16_t status; /* => enum grant_status */ 394 #if __XEN_INTERFACE_VERSION__ < 0x00040300 395 XEN_GUEST_HANDLE(ulong) frame_list; 396 #else 397 XEN_GUEST_HANDLE(xen_pfn_t) frame_list; 398 #endif 399 }; 400 typedef struct gnttab_setup_table gnttab_setup_table_t; 401 DEFINE_XEN_GUEST_HANDLE(gnttab_setup_table_t); 402 403 /* 404 * GNTTABOP_dump_table: Dump the contents of the grant table to the 405 * xen console. Debugging use only. 406 */ 407 struct gnttab_dump_table { 408 /* IN parameters. */ 409 domid_t dom; 410 /* OUT parameters. */ 411 int16_t status; /* => enum grant_status */ 412 }; 413 typedef struct gnttab_dump_table gnttab_dump_table_t; 414 DEFINE_XEN_GUEST_HANDLE(gnttab_dump_table_t); 415 416 /* 417 * GNTTABOP_transfer: Transfer <frame> to a foreign domain. The foreign domain 418 * has previously registered its interest in the transfer via <domid, ref>. 419 * 420 * Note that, even if the transfer fails, the specified page no longer belongs 421 * to the calling domain *unless* the error is GNTST_bad_page. 422 * 423 * Note further that only PV guests can use this operation. 424 */ 425 struct gnttab_transfer { 426 /* IN parameters. */ 427 xen_pfn_t mfn; 428 domid_t domid; 429 grant_ref_t ref; 430 /* OUT parameters. */ 431 int16_t status; 432 }; 433 typedef struct gnttab_transfer gnttab_transfer_t; 434 DEFINE_XEN_GUEST_HANDLE(gnttab_transfer_t); 435 436 437 /* 438 * GNTTABOP_copy: Hypervisor based copy 439 * source and destinations can be eithers MFNs or, for foreign domains, 440 * grant references. the foreign domain has to grant read/write access 441 * in its grant table. 442 * 443 * The flags specify what type source and destinations are (either MFN 444 * or grant reference). 445 * 446 * Note that this can also be used to copy data between two domains 447 * via a third party if the source and destination domains had previously 448 * grant appropriate access to their pages to the third party. 449 * 450 * source_offset specifies an offset in the source frame, dest_offset 451 * the offset in the target frame and len specifies the number of 452 * bytes to be copied. 453 */ 454 455 #define _GNTCOPY_source_gref (0) 456 #define GNTCOPY_source_gref (1<<_GNTCOPY_source_gref) 457 #define _GNTCOPY_dest_gref (1) 458 #define GNTCOPY_dest_gref (1<<_GNTCOPY_dest_gref) 459 460 struct gnttab_copy { 461 /* IN parameters. */ 462 struct gnttab_copy_ptr { 463 union { 464 grant_ref_t ref; 465 xen_pfn_t gmfn; 466 } u; 467 domid_t domid; 468 uint16_t offset; 469 } source, dest; 470 uint16_t len; 471 uint16_t flags; /* GNTCOPY_* */ 472 /* OUT parameters. */ 473 int16_t status; 474 }; 475 typedef struct gnttab_copy gnttab_copy_t; 476 DEFINE_XEN_GUEST_HANDLE(gnttab_copy_t); 477 478 /* 479 * GNTTABOP_query_size: Query the current and maximum sizes of the shared 480 * grant table. 481 * NOTES: 482 * 1. <dom> may be specified as DOMID_SELF. 483 * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 484 */ 485 struct gnttab_query_size { 486 /* IN parameters. */ 487 domid_t dom; 488 /* OUT parameters. */ 489 uint32_t nr_frames; 490 uint32_t max_nr_frames; 491 int16_t status; /* => enum grant_status */ 492 }; 493 typedef struct gnttab_query_size gnttab_query_size_t; 494 DEFINE_XEN_GUEST_HANDLE(gnttab_query_size_t); 495 496 /* 497 * GNTTABOP_unmap_and_replace: Destroy one or more grant-reference mappings 498 * tracked by <handle> but atomically replace the page table entry with one 499 * pointing to the machine address under <new_addr>. <new_addr> will be 500 * redirected to the null entry. 501 * NOTES: 502 * 1. The call may fail in an undefined manner if either mapping is not 503 * tracked by <handle>. 504 * 2. After executing a batch of unmaps, it is guaranteed that no stale 505 * mappings will remain in the device or host TLBs. 506 */ 507 struct gnttab_unmap_and_replace { 508 /* IN parameters. */ 509 uint64_t host_addr; 510 uint64_t new_addr; 511 grant_handle_t handle; 512 /* OUT parameters. */ 513 int16_t status; /* => enum grant_status */ 514 }; 515 typedef struct gnttab_unmap_and_replace gnttab_unmap_and_replace_t; 516 DEFINE_XEN_GUEST_HANDLE(gnttab_unmap_and_replace_t); 517 518 #if __XEN_INTERFACE_VERSION__ >= 0x0003020a 519 /* 520 * GNTTABOP_set_version: Request a particular version of the grant 521 * table shared table structure. This operation may be used to toggle 522 * between different versions, but must be performed while no grants 523 * are active. The only defined versions are 1 and 2. 524 */ 525 struct gnttab_set_version { 526 /* IN/OUT parameters */ 527 uint32_t version; 528 }; 529 typedef struct gnttab_set_version gnttab_set_version_t; 530 DEFINE_XEN_GUEST_HANDLE(gnttab_set_version_t); 531 532 533 /* 534 * GNTTABOP_get_status_frames: Get the list of frames used to store grant 535 * status for <dom>. In grant format version 2, the status is separated 536 * from the other shared grant fields to allow more efficient synchronization 537 * using barriers instead of atomic cmpexch operations. 538 * <nr_frames> specify the size of vector <frame_list>. 539 * The frame addresses are returned in the <frame_list>. 540 * Only <nr_frames> addresses are returned, even if the table is larger. 541 * NOTES: 542 * 1. <dom> may be specified as DOMID_SELF. 543 * 2. Only a sufficiently-privileged domain may specify <dom> != DOMID_SELF. 544 */ 545 struct gnttab_get_status_frames { 546 /* IN parameters. */ 547 uint32_t nr_frames; 548 domid_t dom; 549 /* OUT parameters. */ 550 int16_t status; /* => enum grant_status */ 551 XEN_GUEST_HANDLE(uint64_t) frame_list; 552 }; 553 typedef struct gnttab_get_status_frames gnttab_get_status_frames_t; 554 DEFINE_XEN_GUEST_HANDLE(gnttab_get_status_frames_t); 555 556 /* 557 * GNTTABOP_get_version: Get the grant table version which is in 558 * effect for domain <dom>. 559 */ 560 struct gnttab_get_version { 561 /* IN parameters */ 562 domid_t dom; 563 uint16_t pad; 564 /* OUT parameters */ 565 uint32_t version; 566 }; 567 typedef struct gnttab_get_version gnttab_get_version_t; 568 DEFINE_XEN_GUEST_HANDLE(gnttab_get_version_t); 569 570 /* 571 * GNTTABOP_swap_grant_ref: Swap the contents of two grant entries. 572 */ 573 struct gnttab_swap_grant_ref { 574 /* IN parameters */ 575 grant_ref_t ref_a; 576 grant_ref_t ref_b; 577 /* OUT parameters */ 578 int16_t status; /* => enum grant_status */ 579 }; 580 typedef struct gnttab_swap_grant_ref gnttab_swap_grant_ref_t; 581 DEFINE_XEN_GUEST_HANDLE(gnttab_swap_grant_ref_t); 582 583 /* 584 * Issue one or more cache maintenance operations on a portion of a 585 * page granted to the calling domain by a foreign domain. 586 */ 587 struct gnttab_cache_flush { 588 union { 589 uint64_t dev_bus_addr; 590 grant_ref_t ref; 591 } a; 592 uint16_t offset; /* offset from start of grant */ 593 uint16_t length; /* size within the grant */ 594 #define GNTTAB_CACHE_CLEAN (1u<<0) 595 #define GNTTAB_CACHE_INVAL (1u<<1) 596 #define GNTTAB_CACHE_SOURCE_GREF (1u<<31) 597 uint32_t op; 598 }; 599 typedef struct gnttab_cache_flush gnttab_cache_flush_t; 600 DEFINE_XEN_GUEST_HANDLE(gnttab_cache_flush_t); 601 602 #endif /* __XEN_INTERFACE_VERSION__ */ 603 604 /* 605 * Bitfield values for gnttab_map_grant_ref.flags. 606 */ 607 /* Map the grant entry for access by I/O devices. */ 608 #define _GNTMAP_device_map (0) 609 #define GNTMAP_device_map (1<<_GNTMAP_device_map) 610 /* Map the grant entry for access by host CPUs. */ 611 #define _GNTMAP_host_map (1) 612 #define GNTMAP_host_map (1<<_GNTMAP_host_map) 613 /* Accesses to the granted frame will be restricted to read-only access. */ 614 #define _GNTMAP_readonly (2) 615 #define GNTMAP_readonly (1<<_GNTMAP_readonly) 616 /* 617 * GNTMAP_host_map subflag: 618 * 0 => The host mapping is usable only by the guest OS. 619 * 1 => The host mapping is usable by guest OS + current application. 620 */ 621 #define _GNTMAP_application_map (3) 622 #define GNTMAP_application_map (1<<_GNTMAP_application_map) 623 624 /* 625 * GNTMAP_contains_pte subflag: 626 * 0 => This map request contains a host virtual address. 627 * 1 => This map request contains the machine addess of the PTE to update. 628 */ 629 #define _GNTMAP_contains_pte (4) 630 #define GNTMAP_contains_pte (1<<_GNTMAP_contains_pte) 631 632 /* 633 * Bits to be placed in guest kernel available PTE bits (architecture 634 * dependent; only supported when XENFEAT_gnttab_map_avail_bits is set). 635 */ 636 #define _GNTMAP_guest_avail0 (16) 637 #define GNTMAP_guest_avail_mask ((uint32_t)~0 << _GNTMAP_guest_avail0) 638 639 /* 640 * Values for error status returns. All errors are -ve. 641 */ 642 /* ` enum grant_status { */ 643 #define GNTST_okay (0) /* Normal return. */ 644 #define GNTST_general_error (-1) /* General undefined error. */ 645 #define GNTST_bad_domain (-2) /* Unrecognsed domain id. */ 646 #define GNTST_bad_gntref (-3) /* Unrecognised or inappropriate gntref. */ 647 #define GNTST_bad_handle (-4) /* Unrecognised or inappropriate handle. */ 648 #define GNTST_bad_virt_addr (-5) /* Inappropriate virtual address to map. */ 649 #define GNTST_bad_dev_addr (-6) /* Inappropriate device address to unmap.*/ 650 #define GNTST_no_device_space (-7) /* Out of space in I/O MMU. */ 651 #define GNTST_permission_denied (-8) /* Not enough privilege for operation. */ 652 #define GNTST_bad_page (-9) /* Specified page was invalid for op. */ 653 #define GNTST_bad_copy_arg (-10) /* copy arguments cross page boundary. */ 654 #define GNTST_address_too_big (-11) /* transfer page address too large. */ 655 #define GNTST_eagain (-12) /* Operation not done; try again. */ 656 #define GNTST_no_space (-13) /* Out of space (handles etc). */ 657 /* ` } */ 658 659 #define GNTTABOP_error_msgs { \ 660 "okay", \ 661 "undefined error", \ 662 "unrecognised domain id", \ 663 "invalid grant reference", \ 664 "invalid mapping handle", \ 665 "invalid virtual address", \ 666 "invalid device address", \ 667 "no spare translation slot in the I/O MMU", \ 668 "permission denied", \ 669 "bad page", \ 670 "copy arguments cross page boundary", \ 671 "page address size too large", \ 672 "operation not done; try again", \ 673 "out of space", \ 674 } 675 676 #endif /* __XEN_PUBLIC_GRANT_TABLE_H__ */ 677 678 /* 679 * Local variables: 680 * mode: C 681 * c-file-style: "BSD" 682 * c-basic-offset: 4 683 * tab-width: 4 684 * indent-tabs-mode: nil 685 * End: 686 */ 687