x86: fix ioreq-server event channel vulnerability

The code in hvm_send_assist_req_to_ioreq_server() and hvm_do_resume() uses
an event channel port number taken from the page of memory shared with the
emulator. This allows an emulator to corrupt values that are then blindly
used by Xen, leading to assertion failures in some cases. Moreover, in the
case of the default ioreq server the page remains in the guest p2m so a
malicious guest could similarly corrupt those values.

This patch changes the afforementioned functions to get the event channel
port number from an internal structure and also adds an extra check to
hvm_send_assist_req_to_ioreq_server() which will crash the domain should the
guest or an emulator corrupt the port number in the shared page.

Reported-by: Wen Congyang <wency@cn.fujitsu.com>
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
x86/gdbsx: invert preconditions for XEN_DOMCTL_gdbsx_{,un}pausevcpu hypercalls

c/s 3eb1c708ab "properly reference count DOMCTL_{,un}pausedomain hypercalls"
accidentally inverted the use of d->controller_pause_count.

Revert back to how it was originally, i.e. the XEN_DOMCTL_gdbsx_{,un}pausevcpu
hypercalls are only valid for a domain already paused by the system controller.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
common: introduce vcpu_{,un}pause_by_systemcontroller() helpers

Which will be used by following patches.  Reorder the function declarations
for vcpu/domain pause/unpause to group by vcpu/domain and visually separate
them slightly.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
x86/gdbsx: security audit of {,un}pausevcpu and domstatus hypercalls

XEN_DOMCTL_gdbsx_domstatus is already safe.  It loops at most over every vcpu
in a domain and breaks at the first vcpu with an event pending, marking it as
not-pending.

XEN_DOMCTL_gdbsx_pausevcpu had an incorrect bounds check against the vcpu id,
allowing an overflow of d->vcpu[] with an id between d->max_vcpus and
MAX_VIRT_CPUS.  It was also able to overflow a vcpus pause count by many
repeated hypercalls.

The bounds check is fixed, and vcpu_pause() has been replaced with
vcpu_pause_by_systemcontroller() which cuts out at 255 uses.

XEN_DOMCTL_gdbsx_unpausevcpu suffered from the same bounds problems as its
pause counterpart, and is fixed in exactly the same way.  Despite the
atomic_read(&v->pause_count), this code didn't successfully prevent against an
underflow of the vcpu pause count.

The vcpu_unpause() has been replaced with vcpu_pause_by_systemcontroller()
which correctly prevents against underflow.  The printk() is updated to have a
proper guest logging level, and provide more useful information in the XSM
case of one domain having debugger privileges over another.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
tools/mkrpm: allow different rpm package name

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Config.mk: move directory list into BUILD_MAKE_VARS

To maintain the list of directories in a single place, move the existing
list into its own variable and use it in buildmakevars2file.
Required for upcoming changes.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Config.mk: replace dependency to genpath with actual target

genpath is a detail of buildmakevars2file. Replace the dependency to
genpath with the actual buildmakevars2file target. This change by itself
does not fix any bug. Upcoming changes will add dependencies to
$(target), but no rule exist to create $(target).

With this change a rule for $(target) is added, which in turn depends on
genpath. No change in behaviour is expected by this patch.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Config.mk: add new macro buildmakevars2header

This macro is similar to buildmakevars2file, it just creates a C header
file instead of shell style syntax. Upcoming changes will use this macro
in libxl and libxc.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/libxl: use buildmakevars2header to create _paths.h

Replace usage of buildmakevars2file with buildmakevars2header. The macro
generates a C header file, so remove code which converts shell variables
into C defines. Also update the dependency, the macro itself creates a
dependency to genpath for _paths.h. A temporary file is not needed
anymore.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/libxc: provide variable paths to libxc

In preparation to remove hardcoded /var/run/xen paths, provide
XEN_RUN_DIR and related directories to xc_private.h. Similar code exists
already for libxl, stubdom and other parts.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/libxc: use XEN_RUN_DIR for SUSPEND_LOCK_FILE

Remove hardcoded /var/run/xen directory path, use XEN_RUN_DIR instead.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/pygrub: store kernels in /var/run/xen/pygrub

Move location of temporary bootfiles from /var/run/xend/boot to
/var/run/xen/pygrub. Create the subdirectory if does not exist, unless
--output-directory=<dir> was specified.

The reason for this change is that all entrys below /var/run have to be
created at runtime in case /var/run is cleared on every boot.

v4:
 update mkdir exception handling
v3:
 use /var/run/xen/pygrub instead of /var/run/pygrub
v2:
 update exception handling for python 2.4

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/hotplug: use XEN_SCRIPT_DIR instead of hardcoded path

Helper scripts get installed into XEN_SCRIPT_DIR, but initscripts,
helper scripts and udev rules still refer to the hardcoded location
/etc/xen/scripts/. Update scripts, rules and Makefile to refer to
@@XEN_SCRIPT_DIR@@ instead.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/hotplug: create XEN_RUN_DIR at runtime

Create XEN_RUN_DIR instead of hardcoded path at runtime.
/var/run might be empty on startup.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/hotplug: create XEN_LOCK_DIR at runtime

XEN_LOCK_DIR is a compile-time setting and may not exist on the target
host.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
tools/examples: remove obsolete install targets

install-hotplug and install-udev are obsolete since commit 57bcfa11
("tools/hotplug: Separate OS-specific scripts.")

Signed-off-by: Olaf Hering <olaf@aepfle.de>
remove obsolete SUBSYS_DIR variable

/var/run is a runtime directory. It is not supposed to be packaged. The
xendomains runlevel script checks at runtime if /var/run/subsys or
/var/run has to be used. Remove the unused SUBSYS_DIR variable from
Config.mk and distro_mapping.txt.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
libbxl: add support for pvscsi, iteration 1

Add support for vscsi= in domU.cfg, add new xl commands scsi-attach,
scsi-list, scsi-detach. The syntax follows what xend understood.

pvscsi provides a dom0 SCSI device as-is to a domU. The backend and
frontend drivers can be found in xen-linux, or its forward-ported
variants. This patch was tested with an openSUSE dom0 and a SLES12
guest. Any openSUSE/SLE11/SLE12 dom0/domU combination will work.

The domU.cfg syntax is "vscsi=[ 'pdev,vdev[,option]' ]". pdev is the
dom0 device in either /dev/$device or HOST:CHANNEL:TARGET:LUN notation.
vdev is the domU device in HOST:CHANNEL:TARGET:LUN notation.

xl scsi-attach will attach a SCSI device at runtime.
xl scsi-detach will remove a SCSI drivce at runtime.
xl scsi-list lists SCSI devices for a list of domains.

The backend driver uses a single_host:many_devices notation to manage
domU devices. The xenstore layout looks like this:

/local/domain/0/backend/vscsi/<domid>/<vhost>/feature-host = "0"
/local/domain/0/backend/vscsi/<domid>/<vhost>/frontend = "/local/domain/<domid>/device/vscsi/0"
/local/domain/0/backend/vscsi/<domid>/<vhost>/frontend-id = "<domid>"
/local/domain/0/backend/vscsi/<domid>/<vhost>/online = "1"
/local/domain/0/backend/vscsi/<domid>/<vhost>/state = "4"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-0/p-dev = "8:0:2:1"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-0/state = "4"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-0/v-dev = "0:0:0:0"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-1/p-dev = "8:0:2:2"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-1/state = "4"
/local/domain/0/backend/vscsi/<domid>/<vhost>/vscsi-devs/dev-1/v-dev = "0:0:1:0"

/local/domain/<domid>/device/vscsi/<vhost>/backend = "/local/domain/0/backend/vscsi/<domid>/<vhost>"
/local/domain/<domid>/device/vscsi/<vhost>/backend-id = "0"
/local/domain/<domid>/device/vscsi/<vhost>/event-channel = "20"
/local/domain/<domid>/device/vscsi/<vhost>/ring-ref = "43"
/local/domain/<domid>/device/vscsi/<vhost>/state = "4"
/local/domain/<domid>/device/vscsi/<vhost>/vscsi-devs/dev-0/state = "4"
/local/domain/<domid>/device/vscsi/<vhost>/vscsi-devs/dev-1/state = "4"

This is a challenge for libxl because libxl currently handles only
single_host:single_device in its device helper functions.  Due to this
limitation in libxl, scsi-detach will remove the whole virtual scsi host
with all its virtual devices, instead of just the requested single
virtual device.  scsi-attach can cope with this limitation because it
could write the required files directly into xenstore to attach yet
another virtual scsi device to an existing virtual scsi host. However,
this functionality is currently not implemented.

To support the pdev notation '/dev/$device' it is required to parse
sysfs to translate the path to HST:CHN:TGT:LUN notation. In its current
variant /sys/dev/ is used, which is available since at least Linux 3.0.
Support for dom0 kernels which lack this interface will be added later.

This is a draft patch to get it out of the door, to get help with
solving the libxl limitation above, and of course for public code review.
In this first iteration:
 - the domU.cfg parser for vscsi=[] is functional.
 - xl scsi-list will print output similar to its xm counter part.
 - xl scsi-detach will remove entire scsi hosts, unlike its xm counter part.
 - xl scsi-attach is not yet implemented.
 - coding style may be way off in some parts of the new code.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Cc: Ian Campbell <Ian.Campbell@citrix.com>
Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Ondrej Holecek <oholecek@suse.com>
pvscsi: scsi-detach, scsi-attach

Signed-off-by: Olaf Hering <olaf@aepfle.de>