xen: arm: introduce assembly helper to call smc

Commit 063188f4b3 "xen: arm: Add support for the Exynos secure firmware"
introduced code assuming that exynos_smc() would get called with arguments in
certain registers. While the "noinline" attribute guarantees the function to
not get inlined, it does not guarantee that all arguments arrive in the assumed
registers: gcc's interprocedural analysis can result in clone functions to be
created where some of the incoming arguments (commonly when they have constant
values) get replaced by putting in place the respective values inside the
clone.

Xen contains in multiple place of this SMC function: consolidate the function
in a single place and write it in assembly.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- reworded commit message as discussed ]
README: point to correct location of README.remus

The said file was moved in 20857ac ("remus: move remus README to docs
directory").

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Yang Hongyang <yanghy@cn.fujitsu.com>
Cc: Shriram Rajagopalan <rshriram@cs.ubc.ca>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Yang Hongyang <yanghy@cn.fujitsu.com>
docs/man: xl.pod.1: Fix build issue after commit 7471879

The commit 7471879 "tools: CMDs and APIs for Cache Monitoring Technology"
has introduced a new section but forgot to add '=back'. This will result
a build issue with newer podman:

man/xl.pod.1 around line 1443: You forgot a '=back' before '=head1'

or creating a section "POD ERRORS" with older one.

At the same time, capitalize the title of the section to match the coding
style used within the files.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: p2m: Fix crash when p2m_lookup is used with an invalid IPA

Since the commit 58f0fd8 "xen: arm: handle variable p2m levels in p2m_lookup",
Xen checks that the root_table offset is valid. If not, its unlock the p2m
spinlock before returning an error. But, at this time, the lock has not been
taken.

On Xen built with debug=y, we can get the following stack trace if the guest
use an invalid IPA in hypercall or mess-up the grant-table:

(XEN) Assertion '_raw_spin_is_locked(lock)' failed at xen/include/asm/arm32/spinlock.h:22
...
(XEN)    [<0022d1bc>] _spin_unlock+0x2c/0x50 (PC)
(XEN)    [<00253264>] p2m_lookup+0x20c/0x230 (LR)
(XEN)    [<7ffdfd54>] 7ffdfd54
(XEN)    [<002539f4>] gmfn_to_mfn+0x24/0x3c
(XEN)    [<0020e4d4>] __get_paged_frame+0x30/0x12c
(XEN)    [<00210680>] __acquire_grant_for_copy+0x4e0/0x768
(XEN)    [<00212030>] do_grant_table_op+0x13a0/0x2534
(XEN)    [<00257b10>] do_trap_hypervisor+0xe10/0x1148
(XEN)    [<0025b330>] return_from_trap+0/0x4

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: flush_tlb_domain: Disable IRQ when flushing TLB of another domain

When Xen is flushing the TLB for another domain than current, it has to
switch temporarily to the P2M of this domain. If IRQs are enabled, it may
be possible to receive an interrupt that requires the use the P2M of the current
domain, or even temporarily switch to another P2M.
For the former case, the translation would be wrong. For the latter one,
as the handler would restore the current P2M, Xen would flush the wrong domain
TLB.

Thankfully we don't have such interrupt handler, but it may be necessary
in the future to do that during when the user asks to dump domain stack via
a keystroke.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- spelling in the commit log ]
libxl: Fix a couple of log messages to print correct errnos

xc_domain_create and xc_cpupool_movedomain do not return errno values;
they return -1 and set errno.  Fix the logging accordingly.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Don Slutz <dslutz@verizon.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl: Avoid fd leak of qemu state fd during migration

In a long-running process (such as virt-manager) this might eventually
run the process out of fds.

That qemu argument construction might generate an fd that needs to be
fed to qemu is a bit odd, but we just run with it and provide a
parameter to the qemu argument construction code for this purpose.

There is no need to use the carefd machinery, because leaking the odd
copy of this descriptor into a child unexpectedly forked out of
another thread, is fine.  We just don't want to leak it back to the
main process.

Reported-by: ustermann.max@web.de
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
README: remove references to unneeded python helpers

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl: replace memset() with libxl__device_console_init

The current implementation of libxl__device_console_init does the same
memset() so this is identical for now.

If libxl__device_console_init changes in future (e.g. to prefer a non-zero
default value for some field) then this will continue to work.

Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
libxl: add support for 'channels'

A 'channel':
  - is a low-bandwidth private communication channel that resembles
    a physical serial port.
  - is implemented as a PV console with a well-known string name
    which is used to hook the channel to the appropriate software
    in the guest (i.e. some kind of guest agent).
  - has a backend 'connection' which describes what should happen
    to the data.

The following 'connection' types are defined:

 * PTY: the I/O surfaces as a pty in the backend domain
 * SOCKET: a listening Unix domain socket accepts a connection in
   the backend domain and proxies

Channels may be listed but don't currently support hotplug/unplug.

Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
xl: add 'xstrdup' next to 'xrealloc'

Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
xl: move 'replace_string' further up the file

This allows the function to be reused more easily.

Signed-off-by: David Scott <dave.scott@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
xl: 'replace_string' now uses xstrdup

This catches the out-of-memory exception and exits the program.

Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
xl: add 'trim' and 'split_string_into_pair' functions

Signed-off-by: David Scott <dave.scott@citrix.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
xl: add support for 'channels'

This adds support for channel declarations of the form:

 channel = [ "name=...,connection=...[,path=...][,backend=...]" ]

where 'name' is a label to identify the channel to the frontend.

If 'connection = pty' then the channel is connected to a pty in the
 backend domain
If 'connection = socket' then the channel is connected to a Unix domain
 socket given by 'path = ...' in the backend domain.

This patch also adds the command:

 xl channel-list <domain>

which allows the state of channels to be queried. In particular if
'connection=pty' this will show the path of the pty slave device.

Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
tools/mceinject: Fix build after 31d2d1e08a

xen-mceinj is another utility which incorrectly makes use of xg_private.h  Fix
up its include path.

While fixing this Makefile, remove some trailing whitespace.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Stefano Stabellini <stefano.stabellini@citrix.com>
CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/build: Fix root build target

The root Makefile 'build' rule recurses into the tools directory and invokes
the 'build' rule.  However, the tools Makefile doesn't contain a 'build' rule,
resulting in failure.

Introduce a 'build' rule identical to the existing 'all' rule.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/misc: Delete more obsolete utilities

* nsplitd has been orphaned from the build since its introduction in c/s
  dc44ed4764 (in 2004), and never been developed since.  While it does appear
  to compile, it is full of pointer width mismatch, pointer sign mismatch, and
  uninitialised variable warnings, which makes it unlikely to function
  correctly when compiled for a 64bit environment.

* xen-python-path was declared obsolete in c/s 11e1149fe (in 2009) and can't
  actually be used correctly by out-of-tree components.  5 years is long enough
  for out-of-tree callers to catch up.

There are no subdirectories any more, so drop the notion from the Makefile.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
docs: Introduce specification for x86 pv bootloader chainloading paths/formats.

In order to support pvgrub (or other bootloader) from dom0 chainloading a
pvgrub (or other) from within the domU filesystem we need a standard for where
the stage 1 bootloader should look and what it should expect to find there.

Add a document along those lines.

This is currently x86-specific since it is expected that other new architecures
(including ARM) will either not need to implement this due to the existence of
more generic specifications for that arch (e.g. the ARM VM spec) or will update
this document in due course.

Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Colin Watson <cjwatson@debian.org>
Cc: 759018@bugs.debian.org
xen/arm64: Use __flush_dcache_area instead of __flush_dcache_all

When booting with EFI, __flush_dcache_all does not correctly flush data.
According to Mark Rutland, __flush_dcache_all is not guaranteed to push
data to the PoC if there is a system-level cache as it uses Set/Way
operations.  Therefore, this patch switchs to use the "__flush_dcache_area"
mechanism, which is coppied from Linux.
Add flushing of FDT in addition to Xen text/data.
Remove now unused __flush_dcache_all and related helper functions.
Invalidate the instruction tlb before turning on paging
later on when starting Xen in EL2.

Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Signed-off-by: Roy Franz <roy.franz@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>