x86/viridian: make logging less verbose

The use of gdprintk() adds uninteresting prefixes to the log lines, and
there's really too many lines. This patch reduces the verbosity.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
pass-through: fix unbinding of MSI interrupts

Commit 568da4f8 ("pt-irq fixes and improvements") went a little too far
in its cleaning up of pt_irq_destroy_bind(): While neither of the two
lists need any maintenance, the actual unbinding still needs to be
done. Fix this and at once
- move all variables applying only to the PCI/MSI-translate cases into
  scopes where they can't be used in error,
- limit the final (optional) log message to the cases it actually
  applies and enhance it to make clear how much cleaning up was
  actually done.

Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
x86_emulate: properly do IP updates and other side effects on success

The two MMX/SSE/AVX code blocks failed to update IP properly, and these
as well as get_reg_refix(), which "manually" updated IP so far, failed
to do the TF and RF processing needed at the end of successfully
emulated instructions.

Fix the test utility at once to check IP is properly getting updated,
and while at it macroize the respective code quite a bit, hopefully
making it easier to add further tests when the need arises.

Reported-by: Andrei LUTAS <vlutas@bitdefender.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Razvan Cojocaru <rcojocaru@bitdefender.com>
Reviewed-by: Andrew Cooper <andrew.cooper@citrix.com>
amd-iommu: disable iommu_hap_pt_share with AMD IOMMUs

According to the comment in p2m.h, AMD IOMMUs don't work correctly
with page types different than p2m_ram_rw when the p2m is shared
between HAP and IOMMU, so disable this sharing when using AMD IOMMUs.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
x86/HVM: expose that grant table mappings update the IOMMU

Add a new CPUID flag for leaf 4 that indicates that grant/foreign
mappings update the IOMMU accordingly.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
x86/vHPET: use rwlock instead of simple one

This namely benefits guests heavily reading the main counter, but not
touching the HPET much otherwise. Note that due to the way
hpet_get_comparator() works hpet_read() has to special cases reads from
the comparator registers and use a write lock there instead of the read
one used for all other registers.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
x86: make struct e820map's nr_map unsigned

nr_map is used to represent the amount of e820entry in e820 so this is
never negative.

Signed-off-by: Tiejun Chen <tiejun.chen@intel.com>
domain_update_node_affinity: bail out early if no VCPUs are allocated

The commit "move domain to cpupool0 before destroying it" make Xen crashes
when a domain is destroyed with d->vcpus allocated but no VCPU initialized.

Assertion '!cpumask_empty(dom_cpumask)' failed at domain.c:452
Xen call trace:
    [<00207bd8>] domain_update_node_affinity+0x10c/0x238 (PC)
    [<00000004>] 00000004 (LR)
    [<00226870>] sched_move_domain+0x3cc/0x42c
    [<0020925c>] domain_kill+0xc8/0x178
    [<00206a0c>] do_domctl+0xaac/0x15e4
    [<002529c0>] do_trap_hypervisor+0xc5c/0xf94
    [<002559f0>] return_from_trap+0/0x4

Bail out early if there is d->VCPU is not allocated or VCPU 0 has not been
initialized.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
x86/hap: initialise HAP logdirty function pointers once in hap_domain_init()

rather than repeatedly initialising them each time logdirty is enabled or the
vram tracking area changes.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EFI: Add newline to the end of graphics mode error message

Error message related to graphics mode does not have new line.
So, let's fix it.

Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
x86/paging: make log-dirty operations preemptible

Both the freeing and the inspection of the bitmap get done in (nested)
loops which - besides having a rather high iteration count in general,
albeit that would be covered by XSA-77 - have the number of non-trivial
iterations they need to perform (indirectly) controllable by both the
guest they are for and any domain controlling the guest (including the
one running qemu for it).

This is CVE-2014-5146 / XSA-97.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
xen: arm: handle AArch32 userspace when dumping 64-bit guest state.

A 64-bit guest can still be in 32-bit mode when running userspace,
handle this case by dumping the correct 32-bit state.

Note that on ARM it is not possible to change mode without the help
of the next exception level, hence there is no way a 64-bit guest can
be running in 32-bit kernel modes.

This is part of CVE-2014-5147 / XSA-102.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
xen: arm: Correctly handle exception injection from userspace on 64-bit.

Firstly we must be prepared to propagate traps from 32-bit userspace even for
64-bit guests, so wrap the existing inject_undef??_exception into
inject_undef_exception and use that when injecting an undef exception. The
various other exception cases (aborts etc) already do this.

Secondly when injecting the trap we must pick the correct exception vector
depending on whether the source of the trap was 32-bit EL0, 64-bit EL0 or EL1.

This is part of CVE-2014-5147 / XSA-102.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
xen: arm: Handle traps from 32-bit userspace on 64-bit kernel as undef

We are not setup to handle these properly. This turns a host crash
into a trap to the guest kernel which will likely result in killing
the offending process.

This is part of CVE-2014-5147 / XSA-102.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
xen: arm: Correctly handle do_sysreg exception injection from 64-bit userspace

The do_sysreg case was missing a return, so it would increment PC and
inject the trap to the second instruction of the handler.

This is CVE-2014-5148 / XSA-103.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
copy the correct page to memory

apply_batch() only handles MAX_BATCH_SIZE pages at one time. If
there is some bogus/unmapped/allocate-only/broken page, we will
skip it. So when we call apply_batch() again, the first page's
index is curbatch - invalid_pages. invalid_pages stores the number
of bogus/unmapped/allocate-only/broken pages we have found.

In many cases, invalid_pages is 0, so we don't catch this error.

Signed-off-by: Hong Tao <bobby.hong@huawei.com>
Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
csum the correct page

In verify mode, we map the guest memory, and the guest page is
region_base + i * PAGE_SIZE. So we should csum page (region_base
+ i * PAGE_SIZE), not (region_base + (i+curbatch) * PAGE_SIZE)

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
don't zero out ioreq page

ioreq page may contain some pending I/O requests, and we need to
handle the pending I/O req after migration.

TODO:
1. update qemu to handle the pending I/O req

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Cc: Paul Durrant <paul.durrant@citrix.com>
blktap2: dynamic allocate aio_requests to avoid -EBUSY error

In normal case, there are at most TAPDISK_DATA_REQUESTS request
at the same time. But in remus mode, the write requests are
forwarded from the master side, and cached in block-remus. All
cached requests will be forwarded to aio driver when syncing
primary vm and backup vm. In this case, The number of requests
may be more than TAPDISK_DATA_REQUESTS. So aio driver can't hanlde
these requests at the same time, it will cause tapdisk2 exit.

We don't know how many requests will be handled, so dynamic allocate
aio_requests to avoid this error.

Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Jiang Yunhong <yunhong.jiang@intel.com>
Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Cc: Shriram Rajagopalan <rshriram@cs.ubc.ca>
block-remus: fix memory leak

Fix the following two memory leak:
1. If s->ramdisk.prev is not NULL, we merge the write requests in
   s->ramdisk.h into s->ramdisk.prev, and then destroy s->ramdisk.h.
   But we forget to free hash value when destroying s->ramdisk.h.
2. When write requests is finished, replicated_write_callback() will
   be called. We forget free the buff in this function.

Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Jiang Yunhong <yunhong.jiang@intel.com>
Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Cc: Shriram Rajagopalan <rshriram@cs.ubc.ca>