x86/HVM: simplify do_hvm_op()

- boundary checks in HVMOP_modified_memory, HVMOP_set_mem_type, and
  HVMOP_set_mem_access: all of these already check for overflow, so
  there's no need to range check the first _and_ last PFN (checking
  the last one suffices)
- copying back interface structures that were previously copied from
  guest memory can use __copy_to_...(), since copy_from_...() already
  did the address range validation

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: fix preemption handling in do_hvm_op()

Just like previously done for some mem-op hypercalls, undo preemption
using the interface structures (altering it in ways the caller may not
expect) and replace it by storing the continuation point in the high
bits of sub-operation argument.

This also changes the "nr" fields of struct xen_hvm_track_dirty_vram
(operation already limited to 1Gb worth of pages) and struct
xen_hvm_modified_memory to be only 32 bits wide, consistent with those
of struct xen_set_mem{type,access}. If that's not acceptable for some
reason, we'd need to shrink the HVMOP_op_bits (while still enforcing
the [then higher] limit resulting from the need to be able to encode
the continuation).

Whether (and if so how) to adjust xc_hvm_track_dirty_vram(),
xc_hvm_modified_memory(), xc_hvm_set_mem_type(), and
xc_hvm_set_mem_access() to reflect the 32-bit restriction on "nr" is
unclear: If the APIs need to remain stable, all four functions should
probably check that there was no truncation. Preferably their
parameters would be changed to uint32_t or unsigned int, though.

As a minor cleanup, along with introducing the switch-wide "pfn" the
redundant "d" is also being converted to a switch-wide one.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: correct CPUID leaf 80000008 handling

CPUID[80000008].EAX[23:16] have been given the meaning of the guest
physical address restriction (in case it needs to be smaller than the
host's), hence we need to mirror that into vCPUID[80000008].EAX[7:0].

Enforce a lower limit at the same time, as well as a fixed value for
the virtual address bits, and zero for the guest physical address ones.

In order for the vMTRR code to see these overrides we need to make it
call hvm_cpuid() instead of domain_cpuid(), which in turn requires
special casing (and relaxing) the controlling domain.

This additionally should hide an ordering problem in the tools: Both
xend and xl appear to be restoring a guest from its image before
setting up the CPUID policy in the hypervisor, resulting in
domain_cpuid() returning all zeros and hence the check in
mtrr_var_range_msr_set() failing if the guest previously had more than
the minimum 36 physical address bits.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/p2m: make p2m_change_type() behavior match p2m_change_entry_type_global()'s

- don't reset access permissions
- don't shatter super pages

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: simplification and cleanup

- drop rsvd*_ prefixes from fields not really reserved anymore
- replace odd uses of <expr> ? 1 : 0
- drop pointless variables from ept_set_entry()
- streamline IOMMU mirroring code in ept_set_entry()
- don't open code is_epte_valid() (and properly use it when dumping)
- streamline entry cloning in ept_split_super_page()
- compact dumping code and output

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: also dump permissions and memory types

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: relax treatment of APIC MFN

There's no point in this being mapped UC by the guest due to using a
respective PAT index - set the ignore-PAT flag to true.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/vMTRR: pass domain to mtrr_*_msr_set()

This is in preparation for the next patch, and mtrr_def_type_msr_set()
and mtrr_fix_range_msr_set() in sync with mtrr_var_range_msr_set() in
this regard.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
public/platform.h: replace unsigned long with xen_ulong_t

Replace unsigned long with xen_ulong_t in public/platform.h.
Also replace unsigned int with uint32_t for clarity. It is safe because
unsigned int are 4 byte sized and 4 byte aligned an all the supported
architectures.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Revert "x86/HVM: fix preemption handling in do_hvm_op()"

This reverts commit 8bad6c5626129ffba04dbab3a38115b6f3669596
(clearly broken for 32-bit callers, reportedly broken also
for 64-bit Dom0 with qemu-trad).
MAINTAINERS: Add ARM UART drivers to "ARM ARCHITECTURE" part

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Keir Fraser <keir@xen.org>
tools/libxl: Correct libxl__zalloc() to take an unsigned number of bytes

Convert 'int bytes' to 'size_t size' to mirror malloc(3) which it is
imitating, and calloc(3) which it is actually using.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
tools/libxl: Introduce libxl__malloc()

For those large allocations which are going to be filled immediately, where
redundantly clearing the memory would just be a waste of time.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
docs: Honour --{en, dis}able-xend when building docs

If a user has specified --disable-xend, they wont want the manpages either.

Propagating this parameters requires reorganising the way in which the
makefile chooses which documents to build.

There is now a split of {MAN1,MAN5,MARKDOWN,TXT}SRC-y to select which
documentation to build, which is separate from the patsubst section which
generates appropriate paths to trigger the later rules.

The manpages are quite easy to split between xend, xl and xenstore, and have
been.  Items from misc/ are much harder and been left.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
[ ijc -- reran autogen.sh as requested. ]
docs/Makefile: Split the install target

Split the current install target into two subtargets, install-man-pages and
install-html, with the main install target depending on both.

This helps packagers who want the man pages to put in appropriate rpms/debs,
but don't want to build the html developer docs.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
xen/arm: Move p2m context save/restore in a separate function

Introduce p2m_{save,restore}_state to save/restore p2m context.

The both functions will take care of:
    - VTTBR: contains the pointer to the domain P2M
    - Update HCR_RW if the domain is 64 bit
    - SCTLR: contains bit to know if the MMU is enabled or not

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Use p2m_restore_state in construct_dom0

The address translation functions used while building dom0 rely on certain EL1
state being configured. In particular they are subject to the behaviour of
SCTLR_EL1.M (stage 1 MMU enabled).

The Xen (and Linux) boot protocol require that the kernel be entered with the
MMU disabled but they don't say anything explicitly about exception levels
other than the one which is active when entering the kernels. Arguably the
protocol could be said to apply to all exception levels but in any case we
should cope with this and setup the EL1 state as necessary.

Fu Wei discovered this when booting Xen from grub.efi over UEFI, it's not
clear whether grub or UEFI is responsible for leaving stage 1 MMU enabled.

Use directly the newly created function p2m_restore_state to retrieve a
correct EL1 state to translate an address.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Reported-by: Fu Wei <fu.wei@linaro.org>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Don't need to export p2m_load_VTTBR

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/serial: Don't leak memory mapping if the serial initialization has failed

The memory mapping leaked when the serial driver failed to retrieve
the IRQ. We can safely move the call to ioremap after.

Also use ioremap_cache instead of ioremap_attr in some serial drivers.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
xen/arm: earlyprintk: move early_flush in early_puts

early_puts function will be exported to be used in the console code. To
avoid loosing characters (see why in commit cafdceb "xen/arm: avoid lost
characters with early_printk), early_flush needs to be called in this
function.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>