asm-offsets: encode magic asm-offset runes as strings.

Newer versions of clang attempt to parse inline assembler even when
not asked to assemble it.  Wrap our not-for-assembly runes as strings
of the form ``.ascii "==>MAGIC RUNES<=="'' so clang doesn't choke on
them.

While we're at it, assemble more of the final output line in the C
file, to make the sed expression shorter.

Reported-by: Julien Grall <julien.grall@linaro.org>
Suggested-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
x86/mem_access: Make the mem_access ops generic

This patch does the following:
1. Add mem_access ops under XENMEM_access_ops.
2. Add enums and structs whose names are generic.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
tools/libxc: Make the mem_access APIs generic

Add new xc_[sg]et_mem_access() APIs.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/xen-access: Use the new mem_access APIs

Modify the xen-access test program to use the new mem_access APIs.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/libxc: Remove xc_hvm_[sg]et_mem_access() APIs

Remove xc_hvm_[sg]et_mem_access() APIs which have been replaced by
xc_[sg]_mem_access() APIs.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
x86/mem_access: Deprecate the HVM mem_access ops

This patch does the following:
1. Deprecate the HVMOP_[sg]et_mem_access HVM ops.
2. Remove the enums and structs associated with the HVM ops.

Signed-off-by: Aravindh Puthiyaparambil <aravindp@cisco.com>
Acked-by: Tim Deegan <tim@xen.org>
x86/p2m: also clear defer_nested_flush on error

While presumably benign (domain creation ought to fail when P2M setup
fails) let's be on the safe side and clear the flag as intended. And
actually, the code can be streamlined quite a bit by recognizing that
the only difference between the success and error cases is the message
printed in each case. With that, a stray spin_unlock() also goes away.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Christoph Egger <chegger@amazon.de>
Acked-by: Tim Deegan <tim@xen.org>
xen/shadow: Clean up use of assertions in multi.c

Use BUILD_BUG_ON()s in preference to ASSERT(sizeof(foo) == sizeof (bar)).

sh_map_domain_page() is just a thin wrapper around map_domain_page(), which
cannot fail.  Asserting its success is redundant.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/HAP: drop pointless assertions

Just like for shadow code, hap_map_domain_page() is just a thin
wrapper around map_domain_page(), which cannot fail. Asserting its
success is redundant.

hap_unmap_domain_page() should also not be used for something not
mapped through hap_map_domain_page().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
xen: arm: fully implement multicall interface.

I'm not sure what I was smoking at the time of 5d74ad1a082e "xen: arm:
implement do_multicall_call for both 32 and 64-bit" but it is obviously
insufficient since it doesn't actually wire up the hypercall.

Before doing so we need to make the usual adjustments for ARM and turn the
unsigned longs into xen_ulong_t. There is no difference in the resulting
structure for x86.

There are knock on changes to the trace interface, but again they are nops on
x86.

For 32-bit ARM guests we require that the arguments which they pass to a
hypercall via a multicall do not use the upper bits of xen_ulong_t and kill
them if they violate this. This should ensure that no ABI surprises can be
silently lurking when running on a 32-bit hypervisor waiting to pounce when the
same kernel is run on a 64-bit hypervisor. Killing the guest is harsh but it
will be far easier to relax the restriction if it turns out to cause problems
than to tighten it up if we were lax to begin with.

In the interests of clarity and always using explicitly sized types change the
unsigned int in the hypercall arguments to a uint32_t. There is no actual
change here on any platform.

We should consider backporting this to 4.4.1 in case a guest decides they want
to use a multicall in common code e.g. I suggested such a thing while
reviewing a netback change recently.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: keir@xen.org
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Merge branch 'staging' of ssh://xenbits.xen.org/home/xen/git/xen into staging
docs: Give advice on dealing with quoting special characters

The man page mentions passing config snippets key=val in xl create.
Unfortunately, the config syntax contain characters which are
interpreted (and often discarded) by the shell before getting passed
in, resulting in a parsing error.

For example:

xl create hvm.cfg cpus="0-3"

The shell will eat the quotes and pass 'cpus=0-3' to xl, which won't
parse properly without the quotes.

Mention this in the man page, and recommend the use of single quotes, as well
as separating multiple arguments with a semicolon, thus:

xl create hvm.cfg 'cpus="0-3"; pci=["1.0","1.1"]'

Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
docs: Mention the semicolon as a valid statement end

Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
x86/EPT: fix super page splitting when resolving EPT_MISCONFIG VM exits

Reported-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
vtpmmgr: fix 32-bit compilation

The internal MPI word size matches the word size of the platform rather
than using uint32_t/uint64_t, so constant MPI objects need to be
initialized with that in mind.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
x86/P2M: simplify write_p2m_entry()

The "table_mfn" parameter really isn't needed anywhere, so it gets
dropped.

The "struct vcpu *" one was always bogus (as was being made up by
paging_write_p2m_entry()), and is not commonly used. It can be easily
enough made up in the one place (sh_unshadow_for_p2m_change()) it is
needed, and we can otherwise pass "struct domain *" instead, properly
reflecting that P2M operations are per-domain.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>
x86/P2M: cleanup

- don't abuse __PAGE_HYPERVISOR
- don't use bogus constructs like mfn_x(_mfn())

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper<andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>
VT-d: suppress UR signaling for server chipsets

Unsupported Requests can be signaled for malformed writes to the MSI
address region, e.g. due to buggy or malicious DMA set up to that
region. These should normally result in IOMMU faults, but don't on
the server chipsets dealt with here.

IDs 0xe00, 0xe01, and 0xe04 ... 0xe0b (Ivytown) aren't needed here -
Intel confirmed the issue to be fixed in hardware there.

This is CVE-2013-3495 / XSA-59.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Don Dugger <donald.d.dugger@intel.com>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>
VT-d: suppress UR signaling for desktop chipsets

Unsupported Requests can be signaled for malformed writes to the MSI
address region, e.g. due to buggy or malicious DMA set up to that
region. These should normally result in IOMMU faults, but don't on
the desktop chipsets dealt with here.

This is CVE-2013-3495 / XSA-59.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Don Dugger <donald.d.dugger@intel.com>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>
passthrough: allow to suppress SERR and PERR signaling altogether

This is just to have a workaround at hand in case other chipsets (not
covered by the previous two patches) also have similar issues.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Don Dugger <donald.d.dugger@intel.com>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>