x86: enforce preemption in HVM_set_mem_access / p2m_set_mem_access()

Processing up to 4G PFNs may take almost arbitrarily long, so
preemption is needed here.

This is XSA-89.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
xsm: flask: Remove unused function avc_sidcmp

Fix compilation with Clang 3.5:

avc.c:657:19: error: unused function 'avc_sidcmp' [-Werror,-Wunused-function]
static inline int avc_sidcmp(u32 x, u32 y)
                      ^

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
xsm: flask: ss: remove unused function determine_oocontext

This function is not used neither exported.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
xsm: flask: flask_disable is only used internally

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
common: sched_sedf: Remove unused functions

Clang 3.5 will fail to compile xen/common/sched_sedf.c because some function
are not used:

sched_sedf.c:141:20: error: unused function 'extraq_add_head' [-Werror,-Wunused-function]
static inline void extraq_add_head(struct vcpu *d, int i)
                       ^
sched_sedf.c:147:20: error: unused function 'extraq_add_tail' [-Werror,-Wunused-function]
static inline void extraq_add_tail(struct vcpu *d, int i)

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
credit2: Some functions are only used internally

The list of function above are only used internally in common/sched_credit2.c
    - migrate
    - update_max_weight

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
x86: identify which vcpu's CR4 is being badly modified

When the toolstack is setting vcpu state on behalf of a migrating guest, the
domain/vcpu reference from gdprintk() identifies the toolstack, not the
affected domain.

After this change, the error looks more like:

  (XEN) d0 attempted to change d6v0's CR4 flags 00002660 -> 01876000

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
xen/xsm: Don't use multiboot by default to initialize XSM

Multiboot protocol is only used by x86. When XSM support for ARM will be
introduced, another way will be used to retrieve the policy blob.

Introduce CONFIG_MULTIBOOT to compile XSM specific multiboot code and
rename xsm_init into xsm_multiboot_init to avoid confusion.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Keir Fraser <keir@xen.org>
xen/xsm: Add xsm_core_init function

This function contains non-specific architecture code (mostly the tail of
xsm_multiboot_init). It will be used later to avoid code duplication.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
xen/xsm: Add support for device tree

This patch adds a new module "xen,xsm-policy" to allow the user to load the XSM
policy when Xen is booting.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Add support for XSM

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
libxc: domain restore: fold redundant variables

"vcpuextstate_size" being non-zero fully expresses "vcpuextstate" being
true - drop the latter.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Avoid said the /dev/xvd* is already defined after

open a vhd file failed

For example:
[root@dom0_134_103 ~]# xm block-attach 0
tap2:tapdisk:vhd:/root/liyi***.vhd /dev/xvdz  w
Error: ('create', '-avhd:/root/liyi***.vhd') failed (512  )
Usage: xm block-attach <Domain> <BackDev> <FrontDev> <Mode> [BackDomain]
Create a new virtual block device.

[root@dom0_134_103 ~]# xm block-attach 0
tap2:tapdisk:vhd:/root/liyi.vhd /dev/xvdz  w
Error: The device "/dev/xvdz" is already defined
Usage: xm block-attach <Domain> <BackDev> <FrontDev> <Mode> [BackDomain]

Create a new virtual block device.

Signed-off-by: Yi Li <peteryili@tencent.com>
Acked-by: Matt Wilson <msw@amazon.com>
tools/xend: move assert to exception block

The two assert in restore trigger sometimes after hundreds of
migrations. If they trigger the destination host will not destroy the
newly created, yet empty guest. After a second migration attempt to this
host there will be two guets with the same name and uuid. This situation
is poorly handled by the xm tools.
With this change the empty guest will be destroyed.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Matt Wilson <msw@amazon.com>
xend/pvscsi: recognize also SCSI CDROM devices

Attaching a CDROM device with 'xm scsi-attach domU /dev/sr0 0:0:0:0'
fails because for some reason the sr driver was not handled at all in
the match list. With the change the above command succeeds and the
device is attached.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Matt Wilson <msw@amazon.com>
x86/HVM: simplify do_hvm_op()

- boundary checks in HVMOP_modified_memory, HVMOP_set_mem_type, and
  HVMOP_set_mem_access: all of these already check for overflow, so
  there's no need to range check the first _and_ last PFN (checking
  the last one suffices)
- copying back interface structures that were previously copied from
  guest memory can use __copy_to_...(), since copy_from_...() already
  did the address range validation

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: fix preemption handling in do_hvm_op()

Just like previously done for some mem-op hypercalls, undo preemption
using the interface structures (altering it in ways the caller may not
expect) and replace it by storing the continuation point in the high
bits of sub-operation argument.

This also changes the "nr" fields of struct xen_hvm_track_dirty_vram
(operation already limited to 1Gb worth of pages) and struct
xen_hvm_modified_memory to be only 32 bits wide, consistent with those
of struct xen_set_mem{type,access}. If that's not acceptable for some
reason, we'd need to shrink the HVMOP_op_bits (while still enforcing
the [then higher] limit resulting from the need to be able to encode
the continuation).

Whether (and if so how) to adjust xc_hvm_track_dirty_vram(),
xc_hvm_modified_memory(), xc_hvm_set_mem_type(), and
xc_hvm_set_mem_access() to reflect the 32-bit restriction on "nr" is
unclear: If the APIs need to remain stable, all four functions should
probably check that there was no truncation. Preferably their
parameters would be changed to uint32_t or unsigned int, though.

As a minor cleanup, along with introducing the switch-wide "pfn" the
redundant "d" is also being converted to a switch-wide one.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HVM: correct CPUID leaf 80000008 handling

CPUID[80000008].EAX[23:16] have been given the meaning of the guest
physical address restriction (in case it needs to be smaller than the
host's), hence we need to mirror that into vCPUID[80000008].EAX[7:0].

Enforce a lower limit at the same time, as well as a fixed value for
the virtual address bits, and zero for the guest physical address ones.

In order for the vMTRR code to see these overrides we need to make it
call hvm_cpuid() instead of domain_cpuid(), which in turn requires
special casing (and relaxing) the controlling domain.

This additionally should hide an ordering problem in the tools: Both
xend and xl appear to be restoring a guest from its image before
setting up the CPUID policy in the hypervisor, resulting in
domain_cpuid() returning all zeros and hence the check in
mtrr_var_range_msr_set() failing if the guest previously had more than
the minimum 36 physical address bits.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/p2m: make p2m_change_type() behavior match p2m_change_entry_type_global()'s

- don't reset access permissions
- don't shatter super pages

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/EPT: simplification and cleanup

- drop rsvd*_ prefixes from fields not really reserved anymore
- replace odd uses of <expr> ? 1 : 0
- drop pointless variables from ept_set_entry()
- streamline IOMMU mirroring code in ept_set_entry()
- don't open code is_epte_valid() (and properly use it when dumping)
- streamline entry cloning in ept_split_super_page()
- compact dumping code and output

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>