Fix save/restore of guest PAT table in HAP paging mode.

HAP paging mode guests use direct MSR read/write into the VMCS/VMCB
for the guest PAT table, while the current save/restore code was
accessing only the pat_cr field in hvm_vcpu, used when intercepting
the MSR mostly in shadow mode (the Intel scenario is a bit more
complicated).  This patch fixes this issue creating a new couple of
hvm_funcs, get/set_guest_pat, that access the right PAT table based on
the paging mode and guest configuration.

Signed-off-by: Gianluca Guida <gianluca.guida@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Keir Fraser <keir@xen.org>
fix build error when enabling lock profile

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Committed-by: Keir Fraser <keir@xen.org>
xsm/flask: clean up auditing output

The audit data for normal MMU updates was incorrectly using the RANGE
type which presented the data badly in audit messages; add a MEMORY
type for this showing the correct names for the fields. This patch
also shows the target domain in event channel mapping checks to make
debugging those denials easier.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
gnttab: remove pointless NULL check

Domains in the domain hash (and hence locatable via the usual lookup
functions) can't have a NULL grant table pointer; no other function
performs such a check, so remove it from gnttab_prepare_for_transfer()
for consistency.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
x86-64: fix #GP generation in assembly code

When guest use of sysenter (64-bit PV guest) or syscall (32-bit PV
guest) gets converted into a GP fault (due to no callback having got
registered), we must
- honor the GP fault handler's request the keep enabled or mask event
  delivery
- not allow TBF_EXCEPTION to remain set past the generation of the
  (guest) exception in the vCPU's trap_bounce.flags, as that would
  otherwise allow for the next exception occurring in guest mode,
  should it happen to get handled in Xen itself, to nevertheless get
  bounced to the guest kernel.

Also, just like compat mode syscall handling already did, native mode
sysenter handling should, when converting to #GP, subtract 2 from the
RIP present in the frame so that the guest's GP fault handler would
see the fault pointing to the offending instruction instead of past it.

Finally, since those exception generating code blocks needed to be
modified anyway, convert them to make use of UNLIKELY_{START,END}().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
x86/ioapic: Add register level checks to detect bogus io-apic entries

With the recent changes to clear_IO_APIC_pin() which tries to
clear remoteIRR bit explicitly, some of the users started to see
"Unable to reset IRR for apic .." messages.

Close look shows that these are related to bogus IO-APIC entries
which returns all 1s for their io-apic registers. And the
above mentioned error messages are benign. But kernel should
have ignored such io-apic's in the first place.

Check if register 0, 1, 2 of the listed io-apic are all 1s and
ignore such io-apic.

[original Linux patch:]
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Committed-by: Jan Beulich <jbeulich@suse.com>
x86/IO-APIC: adjust an otherwise pretty useless message

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
x86: suppress warning messages on IO-APIC-less systems

Each call to mp_register_gsi() so far produced two warnings (about not
being able to find the corresponding IO-APIC pin).

However, we should use the provided information for setting the ELCR
correctly (we might want to even do this when there is an IO-APIC, if
was absolutely certain that all machines really have this register
[and specifically not some other device at the two I/O ports in
question]). It is in any case questionable that we allow Dom0 to set
this register - it could particularly be the interrupt of a plug-in
serial port card that might not work due to this. The problem is that
all Dom0 kernels to date do so, hence we can't simply #GP on such an
access (which would be the result if we disallowed access to the port
as we should have done from the beginning).

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
x86-64: fix updating of UREGS_rip when converting sysenter to #GP

(I spotted this copy-and-paste mistake only when backporting c/s
25200:80f4113be500 to 4.1 and 4.0.)

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
tools/libvchan: Remove unwanted debugging code

-O2 -Wall -Werror triggers these warnings:

io.c: In function 'do_send':
io.c:196: warning: ignoring return value of 'writev', declared with attribute warn_unused_result
io.c: In function 'do_recv':
io.c:287: warning: ignoring return value of 'writev', declared with attribute warn_unused_result

writev to -1 will always fail, silence the warning by removing the offending
(disabled) debug code.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Merge
libxl: Query VNC listening port through QMP

Currently `xl vncviewer $dom` does not work because the VNC port is not
registered in xenstore when using qemu-upstream. This patch attempted to fix
this.

Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
xl: cleanup indentation

Signed-off-by: Mathieu Gagne <mgagne@iweb.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
xl: xl network-attach -N (dry run) option

Add dryrun for testing and debugging purposes.

Signed-off-by: Mathieu Gagne <mgagne@iweb.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
x86/mem_event: Fix foreign domain flag in grab_slot

Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
x86/mm: Fix locking on hap enable failure

If enabling hap fails due to out of memory, the locking on the clean up path is
broken.

Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
mem_access: fix setting default mem_access type

When xc_hvm_set_mem_access(xch, domain_id, default_access, ~0ull, 0)
is called, first_pfn=~0ull is a hint to HVMOP_set_mem_access as to
what the default mem_access type is for the domain. This call was
failing because it was gated by the memory range check in the
HVMOP_set_mem_access case statement in do_hvm_op(). The following
patch fixes this issue.

Signed-off-by: Aravindh Puthiyaparambil <aravindh@virtuata.com>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>

---
 xen/arch/x86/hvm/hvm.c |  5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
x86/mm/sharing: Clean ups for relinquishing shared pages on destroy

When a domain is destroyed, its pages are freed in relinquish_resources in a
preemptible mode, in the context of a synchronous domctl.

P2m entries pointing to shared pages are, however, released during p2m cleanup
in an RCU callback, and in non-preemptible mode.

This is an O(n) operation for a very large n, which may include actually
freeing shared pages for which the domain is the last holder.

To improve responsiveness, move this operation to the preemtible portion of
domain destruction, during the synchronous domain_kill hypercall. And remove
the bulk of the work from the RCU callback.

Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
x86/mm/shadow: enclose an OOS function in the proper conditional ifdef

Otherwise compilation fails if the feature is disabled.

Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-By: Gianluca Guida <gianluca.guida@citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
x86/mm: BUG() rather than panic() on mm lock order violations

That gives us a backtrace showing where the bad lock happens.

Reported-by: Andres Lagar-Cavilla <andres@lagarcavilla.org
Signed-off-by: Tim Deegan <tim@xen.org>
Acked-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Committed-by: Tim Deegan <tim@xen.org>