[PATCH 3/8] xen/domctl: Introduce and use XEN_DOMCTL_CDF_nested_virt

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

Like other major areas of functionality, nested virt (or not) needs to be
known at domain creation time for sensible CPUID handling, and wants to be
known this early for sensible infrastructure handling in Xen.

Introduce XEN_DOMCTL_CDF_nested_virt and modify libxl to set it appropriately
when creating domains.  There is no need to adjust the ARM logic to reject the
use of this new flag.

No functional change yet.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Roger Pau Monné <roger.pau@xxxxxxxxxx>
CC: Wei Liu <wl@xxxxxxx>
CC: Ian Jackson <iwj@xxxxxxxxxxxxxx>
CC: Wei Liu <wl@xxxxxxx>
CC: Christian Lindig <christian.lindig@xxxxxxxxxx>
CC: Edwin Török <edvin.torok@xxxxxxxxxx>
CC: Rob Hoes <Rob.Hoes@xxxxxxxxxx>
---
 tools/libxl/libxl_create.c      |  3 +++
 tools/ocaml/libs/xc/xenctrl.ml  |  1 +
 tools/ocaml/libs/xc/xenctrl.mli |  1 +
 xen/arch/x86/domain.c           |  7 +++++++
 xen/common/domain.c             | 11 +++++------
 xen/include/public/domctl.h     |  4 +++-
 6 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/tools/libxl/libxl_create.c b/tools/libxl/libxl_create.c
index ed671052d7..51e6809f3c 100644
--- a/tools/libxl/libxl_create.c
+++ b/tools/libxl/libxl_create.c
@@ -618,6 +618,9 @@ int libxl__domain_make(libxl__gc *gc, libxl_domain_config 
*d_config,
 
             if ( !libxl_defbool_val(info->oos) )
                 create.flags |= XEN_DOMCTL_CDF_oos_off;
+
+            if ( libxl_defbool_val(b_info->nested_hvm) )
+                create.flags |= XEN_DOMCTL_CDF_nested_virt;
         }
 
         assert(info->passthrough != LIBXL_PASSTHROUGH_DEFAULT);
diff --git a/tools/ocaml/libs/xc/xenctrl.ml b/tools/ocaml/libs/xc/xenctrl.ml
index 497ded7ce2..e878699b0a 100644
--- a/tools/ocaml/libs/xc/xenctrl.ml
+++ b/tools/ocaml/libs/xc/xenctrl.ml
@@ -64,6 +64,7 @@ type domain_create_flag =
        | CDF_OOS_OFF
        | CDF_XS_DOMAIN
        | CDF_IOMMU
+       | CDF_NESTED_VIRT
 
 type domain_create_iommu_opts =
        | IOMMU_NO_SHAREPT
diff --git a/tools/ocaml/libs/xc/xenctrl.mli b/tools/ocaml/libs/xc/xenctrl.mli
index f7f6ec570d..e64907df8e 100644
--- a/tools/ocaml/libs/xc/xenctrl.mli
+++ b/tools/ocaml/libs/xc/xenctrl.mli
@@ -57,6 +57,7 @@ type domain_create_flag =
   | CDF_OOS_OFF
   | CDF_XS_DOMAIN
   | CDF_IOMMU
+  | CDF_NESTED_VIRT
 
 type domain_create_iommu_opts =
   | IOMMU_NO_SHAREPT
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index d8f9be132c..5454f94d18 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -630,6 +630,7 @@ int arch_sanitise_domain_config(struct 
xen_domctl_createdomain *config)
 {
     bool hvm = config->flags & XEN_DOMCTL_CDF_hvm;
     bool hap = config->flags & XEN_DOMCTL_CDF_hap;
+    bool nested_virt = config->flags & XEN_DOMCTL_CDF_nested_virt;
     unsigned int max_vcpus;
 
     if ( hvm ? !hvm_enabled : !IS_ENABLED(CONFIG_PV) )
@@ -667,6 +668,12 @@ int arch_sanitise_domain_config(struct 
xen_domctl_createdomain *config)
          */
         config->flags |= XEN_DOMCTL_CDF_oos_off;
 
+    if ( nested_virt && !hap )
+    {
+        dprintk(XENLOG_INFO, "Nested virt not supported without HAP\n");
+        return -EINVAL;
+    }
+
     return 0;
 }
 
diff --git a/xen/common/domain.c b/xen/common/domain.c
index cb617dc5aa..58b62d2fe4 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -303,12 +303,11 @@ static int sanitise_domain_config(struct 
xen_domctl_createdomain *config)
     bool hap = config->flags & XEN_DOMCTL_CDF_hap;
     bool iommu = config->flags & XEN_DOMCTL_CDF_iommu;
 
-    if ( config->flags & ~(XEN_DOMCTL_CDF_hvm |
-                           XEN_DOMCTL_CDF_hap |
-                           XEN_DOMCTL_CDF_s3_integrity |
-                           XEN_DOMCTL_CDF_oos_off |
-                           XEN_DOMCTL_CDF_xs_domain |
-                           XEN_DOMCTL_CDF_iommu) )
+    if ( config->flags &
+         ~(XEN_DOMCTL_CDF_hvm | XEN_DOMCTL_CDF_hap |
+           XEN_DOMCTL_CDF_s3_integrity | XEN_DOMCTL_CDF_oos_off |
+           XEN_DOMCTL_CDF_xs_domain | XEN_DOMCTL_CDF_iommu |
+           XEN_DOMCTL_CDF_nested_virt) )
     {
         dprintk(XENLOG_INFO, "Unknown CDF flags %#x\n", config->flags);
         return -EINVAL;
diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
index 791f0a2592..666aeb71bf 100644
--- a/xen/include/public/domctl.h
+++ b/xen/include/public/domctl.h
@@ -68,9 +68,11 @@ struct xen_domctl_createdomain {
  /* Should this domain be permitted to use the IOMMU? */
 #define _XEN_DOMCTL_CDF_iommu         5
 #define XEN_DOMCTL_CDF_iommu          (1U<<_XEN_DOMCTL_CDF_iommu)
+#define _XEN_DOMCTL_CDF_nested_virt   6
+#define XEN_DOMCTL_CDF_nested_virt    (1U << _XEN_DOMCTL_CDF_nested_virt)
 
 /* Max XEN_DOMCTL_CDF_* constant.  Used for ABI checking. */
-#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_iommu
+#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_nested_virt
 
     uint32_t flags;
 
-- 
2.11.0