argo: init, destroy and soft-reset, with enable command line opt

Initialises basic data structures and performs teardown of argo state
for domain shutdown.

Inclusion of the Argo implementation is dependent on CONFIG_ARGO.

Introduces a new Xen command line parameter 'argo': bool to enable/disable
the argo hypercall. Defaults to disabled.

New headers:
  public/argo.h: with definions of addresses and ring structure, including
  indexes for atomic update for communication between domain and hypervisor.

  xen/argo.h: to expose the hooks for integration into domain lifecycle:
    argo_init: per-domain init of argo data structures for domain_create.
    argo_destroy: teardown for domain_destroy and the error exit
                  path of domain_create.
    argo_soft_reset: reset of domain state for domain_soft_reset.

Adds two new fields to struct domain:
    rwlock_t argo_lock;
    struct argo_domain *argo;

In accordance with recent work on _domain_destroy, argo_destroy is
idempotent. It will tear down: all rings registered by this domain, all
rings where this domain is the single sender (ie. specified partner,
non-wildcard rings), and all pending notifications where this domain is
awaiting signal about available space in the rings of other domains.

A count will be maintained of the number of rings that a domain has
registered in order to limit it below the fixed maximum limit defined here.

Macros are defined to verify the internal locking state within the argo
implementation. The macros are ASSERTed on entry to functions to validate
and document the required lock state prior to calling.

The software license on the public header is the BSD license, standard
procedure for the public Xen headers. The public header was originally
posted under a GPL license at: [1]:
https://lists.xenproject.org/archives/html/xen-devel/2013-05/msg02710.html

The following ACK by Lars Kurth is to confirm that only people being
employees of Citrix contributed to the header files in the series posted at
[1] and that thus the copyright of the files in question is fully owned by
Citrix. The ACK also confirms that Citrix is happy for the header files to
be published under a BSD license in this series (which is based on [1]).

Signed-off-by: Christopher Clark <[email protected]>
Acked-by: Lars Kurth <[email protected]>
Reviewed-by: Ross Philipson <[email protected]>

This version contains FIXMEs for 4.12:
 * Replace the hash function to get better distribution across buckets.
     - Don't use casts in the replacement function.
     - Drop the use of array_index_nospec.
 * since argo_destroy is in _domain_destroy, remove it from domain_kill

v3 xen-project#4 Andrew: use xzalloc for struct argo_domain in argo_init
v3 xen-project#4 Andrew: reference CONFIG_ARGO in the command line documentation
v3 xen-project#7 Jan: rename ring_find_info to find_ring_info
v3 xen-project#4 Andrew: don't truncate args do_argo_op printk
v3 xen-project#7 Jan: fix numeric entries in printk format strings
v3 #10 Roger: move find functions to top of file and drop prototypes
v3 xen-project#4 Jan: meld compat check for hypercall arg types
v3 xen-project#4 Roger/Jan: make lock names clearer and assert their state
v3 xen-project#4 Jan: port -> aport with type; distinguish argo port from evtchn
v3 xen-project#4 Jan: reorder call to argo_init_domain in argo_init
v3 xen-project#4 Jan: ring_remove_mfns: zero count before freeing arrays
v3 xen-project#4 Jason/Roger: soft_reset: can assume reinit is ok if d->argo set
v3 xen-project#4 Roger: remove unused and confusing d->argo_lock
v3 xen-project#4 Roger: add simple inlines in xen/argo.h, drop ifdef CONFIG_ARGO
v3 xen-project#4 Roger: simpler return -EOPNOTSUPP in do_argo_op
v3 xen-project#4 Roger: add const to domain arg to ring_remove_info
v3 xen-project#4 Roger: use XFREE
v3 xen-project#4 Roger: newline fix in wildcard_pending_list_remove
v3 xen-project#4 Roger: mfn_mapping: void* instead of uint8_t*
v3 xen-project#4 Roger: drop npages struct member in argo_ring_info; use len
v3 xen-project#4 Roger/Jan: drop many fixed width types in internal structs
v3 xen-project#4 Jason/Jan: drop pad and fixed width type in pending_ent struct
v3 xen-project#4 Eric: moved ring_find_info from register op into this commit
v3 moved hash_index function, nospec include from register op to this commit
v3 moved XEN_ARGO_DOMID_ANY defn from register op into this commit
v3 added #include <xen/sched.h> to <xen/argo.h> for domain struct defn
v3 feedback xen-project#4 Roger: reorder #includes to alphabetical order
v3 Added Ross's Reviewed-by.

v2 rewrite locking explanation comment
v2 header copyright line now includes 2019
v2 self: use ring_info backpointer in pending_ent to maintain npending
v2 self: rename all_rings_remove_info to domain_rings_remove_all
v2 feedback Jan: drop cookie, implement teardown
v2 self: add npending to track number of pending entries per ring
v2 self: amend comment on locking; drop section comments
v2 cookie_eq: test low bits first and use likely on high bits
v2 self: OVERHAUL
v2 self: s/argo_pending_ent/pending_ent/g
v2 self: drop pending_remove_ent, inline at single call site
v1 feedback Roger, Jan: drop argo prefix on static functions
v2 xen-project#4 Lars: add Acked-by and details to commit message.
v2 feedback #9 Jan: document argo boot opt in xen-command-line.markdown
v2 bugfix: xsm use in soft-reset prior to introduction
v2 feedback #9 Jan: drop 'message' from do_argo_message_op
v1 xen-project#5 feedback Paul: init/destroy unsigned, brackets and whitespace fixes
v1 xen-project#5 feedback Paul: Use mfn_eq for comparing mfns.
v1 xen-project#5 feedback Paul: init/destroy : use currd
v1 xen-project#6 (xen-project#5) feedback Jan: init/destroy: s/ENOSYS/EOPNOTSUPP/
v1 xen-project#6 feedback Paul: Folded patch 6 into patch 5.
v1 xen-project#6 feedback Jan: drop opt_argo_enabled initializer
v1 $6 feedback Jan: s/ENOSYS/EOPNOTSUPP/g and drop useless dprintk
v1. xen-project#5 feedback Paul: change the license on public header to BSD
- ack from Lars at Citrix.
v1. self, Jan: drop unnecessary xen include from sched.h
v1. self, Jan: drop inclusion of public argo.h in private one
v1. self, Jan: add include of public argo.h to argo.c
v1. self, Jan: drop fwd decl of argo_domain in priv header
v1. Paul/self/Jan: add data structures to xlat.lst and compat/argo.h to Makefile
v1. self: removed allocation of event channel since switching to VIRQ
v1. self: drop types.h include from private argo.h
v1: reorder public argo include position
v1: #13 feedback Jan: public namespace: prefix with xen
v1: self: rename pending ent "id" to "domain_id"
v1: self: add domain_cookie to ent struct
v1. #15 feedback Jan: make cmd unsigned
v1. #15 feedback Jan: make i loop variable unsigned
v1: self: adjust dprintks in init, destroy
v1: #18 feedback Jan: meld max ring count limit
v1: self: use type not struct in public defn, affects compat gen header
v1: feedback #15 Jan: handle upper-halves of hypercall args
v1: add comment explaining the 'magic' field
v1: self + Jan feedback: implement soft reset
v1: feedback #13 Roger: use ASSERT_UNREACHABLE

Author: dozylynx

docs/misc/xen-command-line.pandoc

@@ -182,6 +182,19 @@ Permit Xen to use "Always Running APIC Timer" support on compatible hardware
 in combination with cpuidle.  This option is only expected to be useful for
 developers wishing Xen to fall back to older timing methods on newer hardware.
 
+### argo
+> `= <boolean>`
+
+> Default: `false`
+
+Enable the Argo hypervisor-mediated interdomain communication mechanism.
+
+Only available if Xen is compiled with `CONFIG_ARGO` enabled.
+
+This allows domains access to the Argo hypercall, which supports registration
+of memory rings with the hypervisor to receive messages, sending messages to
+other domains by hypercall and querying the ring status of other domains.
+
 ### asid (x86)
 > `= <boolean>`
 

xen/common/Makefile

@@ -70,7 +70,7 @@ obj-y += xmalloc_tlsf.o
 obj-bin-$(CONFIG_X86) += $(foreach n,decompress bunzip2 unxz unlzma unlzo unlz4 earlycpio,$(n).init.o)
 
 
-obj-$(CONFIG_COMPAT) += $(addprefix compat/,domain.o kernel.o memory.o multicall.o xlat.o)
+obj-$(CONFIG_COMPAT) += $(addprefix compat/,argo.o domain.o kernel.o memory.o multicall.o xlat.o)
 
 tmem-y := tmem.o tmem_xen.o tmem_control.o
 tmem-$(CONFIG_COMPAT) += compat/tmem_xen.o