xen: arm: refactor struct kernel_info

The kernel_order and kernel_image fields are ELF specific.

Also add a few comments about what things are.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
xen: arm: probe the kernel to determine the guest type earlier

We need to know if the kernel is 32- or 64- bit capable sooner so that we know
what sort of domain we are building when allocating memory to it (so we can
place appropriate limits when allocating RAM to the guest). At the moment
kernel_prepare() decides this but it needs the memory to have already been
allocated.

Therefore split the probing functionality of kernel_prepare() and call it much
earlier. The remainder of kernel_prepare() deals with where to place the
kernel in RAM which can be deferred until kernel_load() so do so.

Document the input and output of kernel_probe() and _load().

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
[ ijc -- whitespace fixes ]
Revert "xen/arm: Allocate memory for dom0 from the bottom with the 1:1 Workaround"

This reverts commit 6c21cb36e263de2db8716b477157a5b6cd531e1e.

The Linux = issue which this works around was fixed in v3.13 via f52bb722547f
"ARM: mm: Correct virt_to_phys patching for 64 bit physical addresses".

This is the second attempt to revert this. Now that we have fixed
allocate_memory_11 to allocate accessible memory on 32-bit this is safe to do.
This is not quite a straight revert since we need to ensure that for 32-bit
domain 0 we do not allocate dom0's memory above 4GB where the domain cannot
access it without paging (which is disabled at start of day) and LPAE (which
the kernel may not support) enabled.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
[ ijc -- dropped debug code ]
xen/arm64: Correctly align VFP regs

On arm64, VFP instructions requires vfpregs to be 128-byte aligned.

By chance, the field is already correctly aligned. In the case if someone
decides to add a new field before, Xen will receive a data abort as soon as
it saves/restores VFP.

We are safe on arm32 as the only constraint is to be 32-byte aligned.

Reported-by: Chen Baozi <baozich@gmail.com>
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl/gentypes.py: don't generate JSON for private type(s)

Private types are only useful inside libxl. They don't have a valid JSON
generation function by default.

Currently there's only one private type, that's libxl_ev_link. Not
skipping this field causes testidl to fail as the code generated for
this type is NULL.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl_json: fix JSON parser debug code

Two changes included:
1. implement DEBUG_GEN_ALLOC for YAJL2
2. use size_t for variable "len"

without these two fixes it fails to compile when DEBUG_ANSWER is
defined.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl/gentypes.py: generate empty map for None field in keyed-union

Without this the generated JSON is malformed.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl_types.idl: replace empty Struct with None for libxl_event

Now we generate empty map for None, the empty Struct trick is not
necessary anymore.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl/save-helper: Code motion of logging functions

... in preparation for a subsequent functional fix

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/libxl: Improvements to libxl-save-helper when using valgrind

Fix two unfree()'d allocations in libxl-save-helper, to get them out of the
way of other legitimate complaints from valgrind.

The first is easy; close the interface to libxc when done with it.

The second can be fixed by removing the complexity of creating the logging
instance.  Initialise the global 'logger' in place rather than as an
allocation, which requires changing the indirection of its use in 5 locations.

struct xentoollog_logger_tellparent and function createlogger_tellparent() are
now unused and removed.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/libxc: Remove valgrind conditional sections from libxc

The ifdef sections are not enabled at all in tree, and their justification is
out of date now that Xen hypercall support exists upstream in valgrind.

This also removes a commented-out tweak to CFLAGS in the libxc Makefile which
is not being used, and becomes stale given this patch.  In the unlikely event
that any developers were using the line, the results can be more easily
achieved by tweaking APPEND_CFLAGS in the environment.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Pass the timer "clock-frequency" to DOM0 in make_timer_node()

If the DT representing the ARM generic timer mentions a clock-frequency,
propragate it to the DT that is built for DOM0.

This is necessary as a workaround for boards (Odroid-XU) where CNTFRQ is not
set or returns a wrong value.

Ideally CNTFRQ should be set by the boot loader. The bootloader should respect
the ARM ARM (see B.8.1.1):
    "The CNTFRQ register is UNKNOWN at reset, and therefore the counter
    frequency must written to CNTFRQ as part of the system boot process."

For the Odroid-XU the SPL BL2 code is entered in NS HYP mode which prevents
the execution of the mcr call to set CNTFRQ.

Signed-off-by: Suriyan Ramasami <suriyan.r@gmail.com>
Reviewed-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
x86: fix instruction emulator test's xgetbv constraints

The "A" constraint, while documented up to gcc 4.5 as "The a and d
registers, as a pair (for instructions that return half the result in
one and half in the other)," never really behaved that (natural) way,
but always meant (and is now also documented so) %eax _or_ %edx (%rax
_or_ %rdx on x86-64) unless the operand was wide enough to require both
(i.e. more than 32 bits on ix86 and more than 64 bits on x86-64).

Interestingly something internal to the compiler changed between 4.4
and 4.5 to actually expose the difference - up to gcc 4.4 I was unable
to construct a case where, when only the low half of the result is
actually looked at, the result would be considered to be in %edx/%rdx
(and %eax/%rax would be treated as unmodified by the instruction).

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Tested-by: Don Slutz <dslutz@verizon.com>
Merge branch 'staging' of ssh://xenbits.xen.org/home/xen/git/xen into staging
pvh dom0: move some pv specific code to static functions

In this preparatory patch, some pv specific code is
carved out into static functions. No functionality change.

Signed-off-by: Mukesh Rathor <mukesh.rathor@oracle.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
pvh dom0: introduce p2m_map_foreign

In this patch, a new type p2m_map_foreign is introduced for pages
that toolstack on an auto translated dom0 or a control domain maps
from foreign domains that its creating or supporting during its
run time.

Signed-off-by: Mukesh Rathor <mukesh.rathor@oracle.com>
Acked-by: Tim Deegan <tim@xen.org>
pvh dom0: make xsm_map_gmfn_foreign available for x86

In this patch we make xsm_map_gmfn_foreign available for x86 also. This
is used in the next patch "pvh dom0: Add and remove foreign pages" in
function p2m_add_foreign.

Signed-off-by: Mukesh Rathor <mukesh.rathor@oracle.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
implement is_hardware_domain using hardware_domain global

This requires setting the hardware_domain variable earlier in
domain_create so that functions called from it (primarily in
arch_domain_create) observe the correct results when they call
is_hardware_domain.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
x86/MSI: drop workaround for insecure Dom0 kernels

Considering that
- the workaround is expensive (iterating through the entire P2M space
  of a domain),
- the planned elimination of the expensiveness (by propagating the type
  change step by step to the individual P2M leaves) wouldn't address
  the IOMMU side of things (as for it to obey to the changed
  permissions the adjustments must be pushed down immediately through
  the entire tree)
- the proper solution (PHYSDEVOP_msix_prepare) should by now be
  implemented by all security conscious Dom0 kernels
remove the workaround, killing eventual guests that would be known to
become a security risk instead.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
ACPI/ERST: fix signed/unsigned type conflicts

Error checks exist in the respective code path that expect negative
values to indicate errors, yet negative values can't be communicated
through size_t. Thus ssize_t needs to be introduced (also on ARM for
consistency, even if the code in question isn't currently being used
on there).

The bug is theoretical only in so far as all the involved code is
effectively dead. Reflect this by excluding that code from non-debug
builds.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Christoph Egger <chegger@amazon.de>