[xen staging-4.12] xen/arm: Create dom0less domUs earlier

[patchbot@xxxxxxx]

commit 2c395704e6fedcb1d2dee71c59ce37259aaad3b9
Author:     Julien Grall <jgrall@xxxxxxxxxx>
AuthorDate: Mon May 17 17:47:13 2021 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jun 8 19:14:03 2021 +0100

    xen/arm: Create dom0less domUs earlier
    
    In a follow-up patch we will need to unallocate the boot modules
    before heap_init_late() is called.
    
    The modules will contain the domUs kernel and initramfs. Therefore Xen
    will need to create extra domUs (used by dom0less) before heap_init_late().
    
    This has two consequences on dom0less:
        1) Domains will not be unpaused as soon as they are created but
        once all have been created. However, Xen doesn't guarantee an order
        to unpause, so this is not something one could rely on.
    
        2) The memory allocated for a domU will not be scrubbed anymore when an
        admin select bootscrub=on. This is not something we advertised, but if
        this is a concern we can introduce either force scrub for all domUs or
        a per-domain flag in the DT. The behavior for bootscrub=off and
        bootscrub=idle (default) has not changed.
    
    This is part of XSA-372 / CVE-2021-28693.
    
    Signed-off-by: Julien Grall <jgrall@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    Tested-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    (cherry picked from commit 371347c5b64da699d9f5a0edda5dc496fd2b7a5c)
---
 xen/arch/arm/domain_build.c | 2 --
 xen/arch/arm/setup.c        | 9 +++++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c
index d9836779d1..6c5a6db144 100644
--- a/xen/arch/arm/domain_build.c
+++ b/xen/arch/arm/domain_build.c
@@ -2092,8 +2092,6 @@ void __init create_domUs(void)
 
         if ( construct_domU(d, node) != 0 )
             panic("Could not set up domain %s\n", dt_node_name(node));
-
-        domain_unpause_by_systemcontroller(d);
     }
 }
 
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index d986f84f8d..0e54e9c73e 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -736,7 +736,7 @@ void __init start_xen(unsigned long boot_phys_offset,
     int cpus, i;
     const char *cmdline;
     struct bootmodule *xen_bootmodule;
-    struct domain *dom0;
+    struct domain *dom0, *d;
     struct xen_domctl_createdomain dom0_cfg = {
         .flags = XEN_DOMCTL_CDF_hvm_guest | XEN_DOMCTL_CDF_hap,
         .max_evtchn_port = -1,
@@ -902,6 +902,8 @@ void __init start_xen(unsigned long boot_phys_offset,
     if ( construct_dom0(dom0) != 0)
         panic("Could not set up DOM0 guest OS\n");
 
+    create_domUs();
+
     heap_init_late();
 
     init_trace_bufs();
@@ -915,9 +917,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     system_state = SYS_STATE_active;
 
-    create_domUs();
-
-    domain_unpause_by_systemcontroller(dom0);
+    for_each_domain( d )
+        domain_unpause_by_systemcontroller(d);
 
     /* Switch on to the dynamically allocated stack for the idle vcpu
      * since the static one we're running on is about to be freed. */
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.12