common/sysctl: Don't leak status in SYSCTL_page_offline_op

In addition, 'copyback' should be cleared even in the error case.

Also fix the indentation of the arguments to copy_to_guest() to help clarify
that the 'ret = -EFAULT' is not part of the condition.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
common/memory: Fix ABI breakage for XENMEM_add_to_physmap

caused by c/s 4be86bb194e25e46b6cbee900601bfee76e8090a

In public/memory.h, struct xen_add_to_physmap has 'space' as an unsigned int,
but struct xen_add_to_physmap_batch has 'space' as a uint16_t.

By defining xenmem_add_to_physmap_one() with space defined as uint16_t, the
now-common xenmem_add_to_physmap() implicitly truncates xatp->space from
unsigned int to uint16_t, which changes the space switch()'d upon.

This wouldn't be noticed with any upstream code (of which I am aware), but was
discovered because of the XenServer support for legacy Windows PV drivers,
which make XENMEM_add_to_physmap hypercalls using spaces with the top bit set.
The current Windows PV drivers don't do this any more, but we 'fix' Xen to
support running VMs with out-of-date tools.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Release-Ack: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
compat/memory: fix build with old gcc

struct xen_add_to_physmap_batch's size field being uint16_t causes old
compiler versions to warn about the pointless range check done inside
compat_handle_okay().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Nested VMX: prohibit virtual vmentry/vmexit during IO emulation

Sometimes, L0 needs to decode L2's instruction to handle IO access directly.
And L0 may get X86EMUL_RETRY when handling this IO request. At same time, if
there is a virtual vmexit pending (for example, an interrupt pending to inject
to L1) and hypervisor will switch the VCPU context from L2 to L1. Now we
already are in L1's context, but since we got a X86EMUL_RETRY just now and
this means hypervisor will retry to handle the IO request later and
unfortunately, the retry will happen in L1's context. And it will cause the
problem. The fixing is that if there is a pending IO request, no virtual
vmexit/vmentry is allowed.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Acked-by: Jun Nakajima <jun.nakajima@intel.com>
unmodified_drivers: make usbfront build conditional

Commit 0dcfb88fb8 ("unmodified_drivers: enable build of usbfront
driver") results in the PV drivers to no longer build against older
(pre-2.6.35) Linux versions. That's because usbfront.h includes
headers from drivers/usb/core/, which is generally unavailable when
building out-of-tree modules.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
x86: don't drop guest visible state updates when 64-bit PV guest is in user mode

Since 64-bit PV uses separate kernel and user mode page tables, kernel
addresses (as usually provided via VCPUOP_register_runstate_memory_area
and possibly via VCPUOP_register_vcpu_time_memory_area) aren't
necessarily accessible when the respective updating occurs. Add logic
for toggle_guest_mode() to take care of this (if necessary) the next
time the vCPU switches to kernel mode.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
x86/irq: avoid use-after-free on error path in pirq_guest_bind()

This is XSA-83.

Coverity-ID: 1146952

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Revert "x86/viridian: Time Reference Count MSR"

This mostly reverts commit e36cd2cdc9674a7a4855d21fb7b3e6e17c4bb33b.
hvm_get_guest_time() is not a suitable time source for this MSR, as
is resets across migration.

Conflicts:
	xen/arch/x86/hvm/viridian.c
	xen/include/asm-x86/perfc_defn.h
x86: PHYSDEVOP_{prepare,release}_msix are privileged

Yet this wasn't being enforced.

This is XSA-87.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
mini-os: Fix stubdom build failures on gcc 4.8

This is a fix for bug 35:
http://bugs.xenproject.org/xen/bug/35

This bug report describes several format string mismatches which prevent
building the stubdom target in Xen 4.3 and Xen 4.4-rc2 on gcc 4.8.  This is a
copy of Alex Sharp's original patch with the following modifications:

* Andrew Cooper's recommendation applied to extras/mini-os/xenbus/xenbus.c to
  avoid stack corruption
* Samuel Thibault's recommendation to make "fun" an unsigned int rather than an
  unsigned long in pcifront_physical_to_virtual and related functions
  (extras/mini-os/include/pcifront.h and extras/mini-os/pcifront.c)

Tested on x86_64 gcc Ubuntu/Linaro 4.8.1-10ubuntu9.

Coverity-IDs: 1055807 1055808 1055809 1055810
Signed-off-by: Mike Neilsen <mneilsen@acm.org>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxc/unlz4: always set an error return code on failures

"ret", being set to -1 early on, gets cleared by the first invocation
of lz4_decompress()/lz4_decompress_unknownoutputsize(), and hence
subsequent failures wouldn't be noticed by the caller without setting
it back to -1 right after those calls.

Linux commit: 2a1d689c9ba42a6066540fb221b6ecbd6298b728

Reported-by: Matthew Daley <mattjd@gmail.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen: arm: platforms: Adding reset support for xgene arm64 platform.

This patch adds a reset support for xgene arm64 platform.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Anup Patel <anup.patel@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/hotplug: fix bug on xendomains using xl

Make rdname function work with xl.

The rdname function not support json output of xl commands and this cause
problems using xl, for example the check if domUs are already running (because
they have been restored) on domUs autostart does not succeed and the domain is
created in any case, causing xl create to fail.

Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxl: events: Pass correct nfds to poll

libxl_event.c:eventloop_iteration would pass the allocated pollfds
array size, rather than the used size, to poll (and to
afterpoll_internal).

The effect is that if the number of fds to poll on reduces, libxl will
poll on stale entries.  Because of the way the return value from poll
is processed these stale entries are often harmless because any events
coming back from poll ignored by libxl.  However, it could cause
malfunctions:

It could result in unwanted SIGTTIN/SIGTTOU/SIGPIPE, for example, if
the fd has been reused to refer to an object which can generate those
signals.  Alternatively, it could result in libxl spinning if the
stale entry refers to an fd which happens now to be ready for the
previously-requested operation.

I have tested this with a localhost migration and inspected the strace
output.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Jim Fehlig <jfehlig@suse.com>
Cc: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
xl: Free optdata_begin when saving domain config

This makes valgrind a bit happier.

It is also
Coverity-CID: 1055903

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
xenstore: xs_suspend_evtchn_port: always free portstr

If portstr!=NULL but plen==0 this function would leak portstr.

Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
minios: Correct HYPERVISOR_physdev_op()

A physdev_op is a two argument hypercall, taking a command parameter and an
optional pointer to a structure.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/unlz4: always set an error return code on failures

"ret", being set to -1 early on, gets cleared by the first invocation
of lz4_decompress()/lz4_decompress_unknownoutputsize(), and hence
subsequent failures wouldn't be noticed by the caller without setting
it back to -1 right after those calls.

Linux commit: 2a1d689c9ba42a6066540fb221b6ecbd6298b728

Reported-by: Matthew Daley <mattjd@gmail.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
blkif.h: enhance comments related to the discard feature

Also fix the name of the discard-alignment property, add the missing 'n'.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Keir Fraser <keir@xen.org>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Update QEMU_UPSTREAM_REVISION

Switch back to master.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>