xen/xsm: Don't use multiboot by default to initialize XSM

Multiboot protocol is only used by x86. When XSM support for ARM will be
introduced, another way will be used to retrieve the policy blob.

Introduce CONFIG_MULTIBOOT to compile XSM specific multiboot code and
rename xsm_init into xsm_multiboot_init to avoid confusion.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Keir Fraser <keir@xen.org>
xen/xsm: Add xsm_core_init function

This function contains non-specific architecture code (mostly the tail of
xsm_multiboot_init). It will be used later to avoid code duplication.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
xen/xsm: Add support for device tree

This patch adds a new module "xen,xsm-policy" to allow the user to load the XSM
policy when Xen is booting.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Add support for XSM

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxc: domain restore: fold redundant variables

"vcpuextstate_size" being non-zero fully expresses "vcpuextstate" being
true - drop the latter.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Avoid said the /dev/xvd* is already defined after

open a vhd file failed

For example:
[root@dom0_134_103 ~]# xm block-attach 0
tap2:tapdisk:vhd:/root/liyi***.vhd /dev/xvdz  w
Error: ('create', '-avhd:/root/liyi***.vhd') failed (512  )
Usage: xm block-attach <Domain> <BackDev> <FrontDev> <Mode> [BackDomain]
Create a new virtual block device.

[root@dom0_134_103 ~]# xm block-attach 0
tap2:tapdisk:vhd:/root/liyi.vhd /dev/xvdz  w
Error: The device "/dev/xvdz" is already defined
Usage: xm block-attach <Domain> <BackDev> <FrontDev> <Mode> [BackDomain]

Create a new virtual block device.

Signed-off-by: Yi Li <peteryili@tencent.com>
Acked-by: Matt Wilson <msw@amazon.com>
tools/xend: move assert to exception block

The two assert in restore trigger sometimes after hundreds of
migrations. If they trigger the destination host will not destroy the
newly created, yet empty guest. After a second migration attempt to this
host there will be two guets with the same name and uuid. This situation
is poorly handled by the xm tools.
With this change the empty guest will be destroyed.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Matt Wilson <msw@amazon.com>
xend/pvscsi: recognize also SCSI CDROM devices

Attaching a CDROM device with 'xm scsi-attach domU /dev/sr0 0:0:0:0'
fails because for some reason the sr driver was not handled at all in
the match list. With the change the above command succeeds and the
device is attached.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Matt Wilson <msw@amazon.com>
x86/HVM: simplify do_hvm_op()

- boundary checks in HVMOP_modified_memory, HVMOP_set_mem_type, and
  HVMOP_set_mem_access: all of these already check for overflow, so
  there's no need to range check the first _and_ last PFN (checking
  the last one suffices)
- copying back interface structures that were previously copied from
  guest memory can use __copy_to_...(), since copy_from_...() already
  did the address range validation

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: fix preemption handling in do_hvm_op()

Just like previously done for some mem-op hypercalls, undo preemption
using the interface structures (altering it in ways the caller may not
expect) and replace it by storing the continuation point in the high
bits of sub-operation argument.

This also changes the "nr" fields of struct xen_hvm_track_dirty_vram
(operation already limited to 1Gb worth of pages) and struct
xen_hvm_modified_memory to be only 32 bits wide, consistent with those
of struct xen_set_mem{type,access}. If that's not acceptable for some
reason, we'd need to shrink the HVMOP_op_bits (while still enforcing
the [then higher] limit resulting from the need to be able to encode
the continuation).

Whether (and if so how) to adjust xc_hvm_track_dirty_vram(),
xc_hvm_modified_memory(), xc_hvm_set_mem_type(), and
xc_hvm_set_mem_access() to reflect the 32-bit restriction on "nr" is
unclear: If the APIs need to remain stable, all four functions should
probably check that there was no truncation. Preferably their
parameters would be changed to uint32_t or unsigned int, though.

As a minor cleanup, along with introducing the switch-wide "pfn" the
redundant "d" is also being converted to a switch-wide one.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: correct CPUID leaf 80000008 handling

CPUID[80000008].EAX[23:16] have been given the meaning of the guest
physical address restriction (in case it needs to be smaller than the
host's), hence we need to mirror that into vCPUID[80000008].EAX[7:0].

Enforce a lower limit at the same time, as well as a fixed value for
the virtual address bits, and zero for the guest physical address ones.

In order for the vMTRR code to see these overrides we need to make it
call hvm_cpuid() instead of domain_cpuid(), which in turn requires
special casing (and relaxing) the controlling domain.

This additionally should hide an ordering problem in the tools: Both
xend and xl appear to be restoring a guest from its image before
setting up the CPUID policy in the hypervisor, resulting in
domain_cpuid() returning all zeros and hence the check in
mtrr_var_range_msr_set() failing if the guest previously had more than
the minimum 36 physical address bits.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/p2m: make p2m_change_type() behavior match p2m_change_entry_type_global()'s

- don't reset access permissions
- don't shatter super pages

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: simplification and cleanup

- drop rsvd*_ prefixes from fields not really reserved anymore
- replace odd uses of <expr> ? 1 : 0
- drop pointless variables from ept_set_entry()
- streamline IOMMU mirroring code in ept_set_entry()
- don't open code is_epte_valid() (and properly use it when dumping)
- streamline entry cloning in ept_split_super_page()
- compact dumping code and output

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: also dump permissions and memory types

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: relax treatment of APIC MFN

There's no point in this being mapped UC by the guest due to using a
respective PAT index - set the ignore-PAT flag to true.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/vMTRR: pass domain to mtrr_*_msr_set()

This is in preparation for the next patch, and mtrr_def_type_msr_set()
and mtrr_fix_range_msr_set() in sync with mtrr_var_range_msr_set() in
this regard.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
public/platform.h: replace unsigned long with xen_ulong_t

Replace unsigned long with xen_ulong_t in public/platform.h.
Also replace unsigned int with uint32_t for clarity. It is safe because
unsigned int are 4 byte sized and 4 byte aligned an all the supported
architectures.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Revert "x86/HVM: fix preemption handling in do_hvm_op()"

This reverts commit 8bad6c5626129ffba04dbab3a38115b6f3669596
(clearly broken for 32-bit callers, reportedly broken also
for 64-bit Dom0 with qemu-trad).
MAINTAINERS: Add ARM UART drivers to "ARM ARCHITECTURE" part

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Keir Fraser <keir@xen.org>
tools/libxl: Correct libxl__zalloc() to take an unsigned number of bytes

Convert 'int bytes' to 'size_t size' to mirror malloc(3) which it is
imitating, and calloc(3) which it is actually using.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>