aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* update Xen version to 4.1.4-rc14.1.4-rc1Jan Beulich2012-11-152-2/+2
|
* compat/gnttab: Prevent infinite loop in compat codeIan Jackson2012-11-141-0/+2
| | | | | | | | | | | | | | | | | | | c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall into an infinite loop. If the watchdog is enabled, Xen will die after the timeout. This is a security problem, XSA-24 / CVE-2012-4539. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26151:b64a7d868f06 Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xen/mm/shadow: check toplevel pagetables are present before unhooking them.Ian Jackson2012-11-141-2/+6
| | | | | | | | | | | | | | | If the guest has not fully populated its top-level PAE entries when it calls HVMOP_pagetable_dying, the shadow code could try to unhook entries from MFN 0. Add a check to avoid that case. This issue was introduced by c/s 21239:b9d2db109cf5. This is a security problem, XSA-23 / CVE-2012-4538. Signed-off-by: Tim Deegan <tim@xen.org> Tested-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/physmap: Prevent incorrect updates of m2p mappingsIan Jackson2012-11-141-0/+4
| | | | | | | | | | | | | | | | | | | In certain conditions, such as low memory, set_p2m_entry() can fail. Currently, the p2m and m2p tables will get out of sync because we still update the m2p table after the p2m update has failed. If that happens, subsequent guest-invoked memory operations can cause BUG()s and ASSERT()s to kill Xen. This is fixed by only updating the m2p table iff the p2m was successfully updated. This is a security problem, XSA-22 / CVE-2012-4537. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/physdev: Range check pirq parameter from guestsIan Jackson2012-11-141-0/+4
| | | | | | | | | | | | | | | | | | Otherwise Xen will read beyond either end of the struct domain.arch.pirq_emuirq array, usually resulting in a fatal page fault. This vulnerability was introduced by c/s 23241:d21100f1d00e, which adds a call to domain_pirq_to_emuirq() which uses the guest provided pirq value before range checking it, and was fixed by c/s 23573:584c2e5e03d9 which changed the behaviour of the domain_pirq_to_emuirq() macro to use radix trees instead of a flat array. This is XSA-21 / CVE-2012-4536. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerabilityIan Jackson2012-11-142-0/+5
| | | | | | | | | | | | | | | | | | The timer action for a vcpu periodic timer is to calculate the next expiry time, and to reinsert itself into the timer queue. If the deadline ends up in the past, Xen never leaves __do_softirq(). The affected PCPU will stay in an infinite loop until Xen is killed by the watchdog (if enabled). This is a security problem, XSA-20 / CVE-2012-4535. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26148:bf58b94b3cef Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/mm x86 shadow: Fix typo in sh_invlpg sl3 page presence checkMatthew Daley2012-11-141-1/+1
| | | | | | | Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Tim Deegan <tim@xen.org> xen-unstable changeset: 26134:279bbf2a0b48 xen-unstable date: Mon Nov 12 10:17:00 UTC 2012
* tmem: Prevent NULL dereference on error caseMatthew Daley2012-11-141-1/+3
| | | | | | | | | | | If the client / pool IDs given to tmemc_save_get_next_page are invalid, the calculation of pagesize will dereference NULL. Fix this by moving the calculation below the appropriate NULL check. Signed-off-by: Matthew Daley <mattjd@gmail.com> xen-unstable changeset: 26132:286ef4ced216 xen-unstable date: Mon Nov 12 08:34:57 UTC 2012
* QEMU_TAG updateIan Jackson2012-11-131-3/+3
|
* xend/pvscsi: update sysfs parser for Linux 3.0Olaf Hering2012-11-131-6/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sysfs parser for /sys/bus/scsi/devices understands only the layout of kernel version 2.6.16. This looks as follows: /sys/bus/scsi/devices/1:0:0:0/block:sda is a symlink to /sys/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic:sg1 is a symlink to /sys/class/scsi_generic/sg1 Both directories contain a 'dev' file with the major:minor information. This patch updates the used regex strings to match also the colon to make it more robust against possible future changes. In kernel version 3.0 the layout changed: /sys/bus/scsi/devices/ contains now additional symlinks to directories such as host1 and target1:0:0. This patch ignores these as they do not point to the desired scsi devices. They just clutter the devices array. The directory layout in '1:0:0:0' changed as well, the 'type:name' notation was replaced with 'type/name' directories: /sys/bus/scsi/devices/1:0:0:0/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic/sg1/ Both directories contain a 'dev' file with the major:minor information. This patch adds additional code to walk the subdir to find the 'dev' file to make sure the given subdirectory is really the kernel name. In addition this patch makes sure devname is not None. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26010:cff10030c6ea Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25915:839e5d95d483 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix usage of persistant device names for SCSI devicesOlaf Hering2012-11-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the callers of vscsi_get_scsidevices() do not pass a mask string. This will call "lsscsi -g '[]'", which causes a lsscsi syntax error. As a result the sysfs parser _vscsi_get_scsidevices() is used. But this parser is broken and the specified names in the config file are not found. Using a mask '*' if no mask was given will call lsscsi correctly and the following config is parsed correctly: vscsi=[ '/dev/sg3, 0:0:0:0', '/dev/disk/by-id/wwn-0x600508b4000cf1c30000800000410000, 0:0:0:1' ] Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26009:2dbfa4d2e107 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25914:b8916af165b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix passing of SCSI control LUNsOlaf Hering2012-11-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently pvscsi can not pass SCSI devices that have just a scsi_generic node. In the following example sg3 is a control LUN for the disk sdd. But vscsi=['4:0:2:0,0:0:0:0'] does not work because the internal 'devname' variable remains None. Later writing p-devname to xenstore fails because None is not a valid string variable. Since devname is used for just informational purpose use sg also as devname. carron:~ $ lsscsi -g [0:0:0:0] disk ATA FK0032CAAZP HPF2 /dev/sda /dev/sg0 [4:0:0:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdb /dev/sg1 [4:0:1:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdc /dev/sg2 [4:0:2:0] storage HP HSV400 0950 - /dev/sg3 [4:0:2:1] disk HP HSV400 0950 /dev/sdd /dev/sg4 [4:0:3:0] storage HP HSV400 0950 - /dev/sg5 [4:0:3:1] disk HP HSV400 0950 /dev/sde /dev/sg6 Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26008:eecb528583d7 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25913:16ced2f387b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: xend: fix wrong condition check for xml fileJoe Jin2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | In commit e8d40584, it intended to check xml file size and when empty will return, the condition should be "if os.path.getsize(xml_path) == 0" rather then "if not os.path.getsize(xml_path) == 0". Signed-off-by: Chuang Cao <chuang.cao@oracle.com> Signed-off-by: Joe Jin <joe.jin@oracle.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26088:dd64a1bdbe3a Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25905:82b61b99d15d Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* pygrub: correct typo in --args assignmentOlaf Hering2012-11-131-3/+3
| | | | | | | | | | | | | | | | | | | | | If pygrub was called with --args="some thing", then this string should be append to the kernel command line. But the last changeset 25941:795c493fe561 contained a typo, it assigns 'args' instead of 'arg'. Rename the local variable which holds the string from the domain config file to avoid further confusion. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26018:ecc7627ca6d7 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25899:dbb1872bbb97 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xenballoond.init: remove 4 from default runlevelOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | | | Remove 4 from default runlevel in xenballoond.init. Similar to what changeset 24847:0900b1c905f1 does in xencommons, remove runlevel 4 from the other runlevel scripts. LSB defines runlevel 4 as reserved for local use, the local sysadmin is responsible for symlink creation in rc4.d. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26007:fe756682cc7f Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25897:dcd4bf824284 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* hotplug/Linux: Remove tracing (bash -x) from network-nat scriptOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26006:8b6870d686d6 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25896:6adf0c7937bf Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* pygrub: always append --argsOlaf Hering2012-11-131-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | If a bootloader entry in menu.lst has no additional kernel command line options listed and the domU.cfg has 'bootargs="--args=something"' the additional arguments from the config file are not passed to the kernel. The reason for that incorrect behaviour is that run_grub appends arg only if the parsed config file has arguments listed. Fix this by appending args from image section and the config file separatly. To avoid adding to a NoneType initialize grubcfg['args'] to an empty string. This does not change behaviour but simplifies the code which appends the string. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25941:795c493fe561 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25891:7e91c668bae2 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* docs: correct formatting errors in xmdomain.cfgMatt Wilson2012-11-131-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch corrects the following errors produced by pod2man: Hey! The above document had some coding errors, which are explained below: Around line 301: You can't have =items (as at line 305) unless the first thing after the =over is an =item Around line 311: '=item' outside of any '=over' Signed-off-by: Matt Wilson <msw@amazon.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25840:c7e4b7e64303 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25885:c23d938e3e64 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86: don't special case first IO-APICJan Beulich2012-10-291-17/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has always been puzzling me why the first IO-APIC gets special cased in two places, and finally Xen got run on a system where this breaks: (XEN) ACPI: IOAPIC (id[0x10] address[0xfecff000] gsi_base[0]) (XEN) IOAPIC[0]: apic_id 16, version 17, address 0xfecff000, GSI 0-2 (XEN) ACPI: IOAPIC (id[0x0f] address[0xfec00000] gsi_base[3]) (XEN) IOAPIC[1]: apic_id 15, version 17, address 0xfec00000, GSI 3-38 (XEN) ACPI: IOAPIC (id[0x0e] address[0xfec01000] gsi_base[39]) (XEN) IOAPIC[2]: apic_id 14, version 17, address 0xfec01000, GSI 39-74 (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 1 global_irq 4 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 5 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 3 global_irq 6 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 4 global_irq 7 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 6 global_irq 9 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 7 global_irq 10 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 8 global_irq 11 low edge) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 12 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 12 global_irq 15 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 13 global_irq 16 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 14 global_irq 17 low edge) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 15 global_irq 18 dfl dfl) i.e. all legacy IRQs (apart from the timer one, but the firmware passed data doesn't look right for that case anyway, as both Xen and native Linux are falling back to use the virtual wire setup for IRQ0, apparently rather using pin 2 of the first IO-APIC) are being handled by the second IO-APIC. This at once eliminates the possibility of an unmasked RTE getting written without having got a vector put in place (in setup_IO_APIC_irqs()). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26102:22e08c9ac770 xen-unstable date: Wed Oct 24 15:51:48 UTC 2012
* hvm: handle PoD and grant pages in HVMOP_get_mem_typeOlaf Hering2012-10-291-0/+4
| | | | | | | | | | | | | During kexec in a ballooned PVonHVM guest the new kernel needs to check each pfn if its backed by a mfn to find ballooned pages. Currently all PoD and grant pages will appear as HVMMEM_mmio_dm, so the new kernel has to assume they are ballooned. This is wrong: PoD pages may turn into real RAM at runtime, grant pages are also RAM. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Tim Deegan <tim@xen.org> xen-unstable changeset: 26093:4ae08ca5500f xen-unstable date: Fri Oct 19 14:09:05 UTC 2012
* x86/HPET: obtain proper lock for changing IRQ affinityJan Beulich2012-10-291-6/+12
| | | | | | | | | | | The IRQ descriptor lock should be held while adjusting the affinity of any IRQ; the HPET channel lock isn't sufficient to protect namely against races with moving the IRQ to a different CPU. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26063:1f4be6ee4619 xen-unstable date: Wed Oct 17 12:13:20 UTC 2012
* x86/oprof: adjust off-by-one counter range checksJan Beulich2012-10-291-2/+2
| | | | | | | Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26061:4b4c0c7a6031 xen-unstable date: Wed Oct 17 09:23:10 UTC 2012
* More efficient TLB-flush filtering in alloc_heap_pages().Keir Fraser2012-10-291-11/+16
| | | | | | | | | | | | | | | | | | | Rather than per-cpu filtering for every page in a super-page allocation, simply remember the most recent TLB timestamp across all allocated pages, and filter on that, just once, at the end of the function. For large-CPU systems, doing 2MB allocations during domain creation, this cuts down the domain creation time *massively*. TODO: It may make sense to move the filtering out into some callers, such as memory.c:populate_physmap() and memory.c:increase_reservation(), so that the filtering can be moved outside their loops, too. Signed-off-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26056:177fdda0be56 xen-unstable date: Mon Oct 15 15:38:11 UTC 2012
* x86/xenoprof: fix kernel/user mode detection for HVMJacob Shin2012-10-291-4/+15
| | | | | | | | | | | | | | | | While trying oprofile under Xen, I noticed that HVM passive domain's kernel addresses were showing up as user application. It turns out under HVM get_cpu_user_regs()->cs contains 0x0000beef. Signed-off-by: Jacob Shin <jacob.shin@amd.com> Don't cast away const-ness. Use SS instead of CS to determine ring. Special-case real and protected mode. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26055:14e32621dbaf xen-unstable date: Mon Oct 15 13:04:51 UTC 2012
* x86/amd: Fix xen_apic_write warnings in Dom0Wei Wang2012-10-291-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ 0.020294] ------------[ cut here ]------------ [ 0.020311] WARNING: at arch/x86/xen/enlighten.c:730 xen_apic_write+0x15/0x17() [ 0.020318] Hardware name: empty [ 0.020323] Modules linked in: [ 0.020334] Pid: 1, comm: swapper/0 Not tainted 3.3.8 #7 [ 0.020340] Call Trace: [ 0.020354] [<ffffffff81050379>] warn_slowpath_common+0x80/0x98 [ 0.020369] [<ffffffff810503a6>] warn_slowpath_null+0x15/0x17 [ 0.020378] [<ffffffff810034df>] xen_apic_write+0x15/0x17 [ 0.020392] [<ffffffff8101cb2b>] perf_events_lapic_init+0x2e/0x30 [ 0.020410] [<ffffffff81ee4dd0>] init_hw_perf_events+0x250/0x407 [ 0.020419] [<ffffffff81ee4b80>] ? check_bugs+0x2d/0x2d [ 0.020430] [<ffffffff81002181>] do_one_initcall+0x7a/0x131 [ 0.020444] [<ffffffff81edbbf9>] kernel_init+0x91/0x15d [ 0.020456] [<ffffffff817caaa4>] kernel_thread_helper+0x4/0x10 [ 0.020471] [<ffffffff817c347c>] ? retint_restore_args+0x5/0x6 [ 0.020481] [<ffffffff817caaa0>] ? gs_change+0x13/0x13 [ 0.020500] ---[ end trace a7919e7f17c0a725 ]--- Kernel function check_hw_exists() writes 0xabcd to msr 0xc0010201 (Performance Event Counter 0) and read it again to check if it is running as dom0. Early amd cpus does not reset perf counters during warm reboot. If the kernel is booted with bare metal and then as a dom0, the content of msr 0xc0010201 will stay and the checking will pass and PMU will be enabled unexpectedly. Signed-off-by: Wei Wang <wei.wang2@amd.com> Don't reset the counters when used for the NMI watchdog. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26054:983108e1b56b xen-unstable date: Mon Oct 15 13:03:36 UTC 2012
* hvmloader: Do not zero the wallclock fields in shared-info.Keir Fraser2012-10-291-1/+5
| | | | | | | | | | | | | | | These fields need to be valid at all times. Hypervisor ensures this even across 32/64-bit guest transitions. This fixes a bug where wallclock time is incorrect for booting 32-bit HVM guests. This should be backported to Xen 4.1 and 4.2. Signed-off-by: Keir Fraser <keir@xen.org> Tested-and-Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> xen-unstable changeset: 25908:12fa949b9060 xen-unstable date: Fri Sep 14 18:47:57 UTC 2012
* libxc: builder: limit maximum size of kernel/ramdisk.Ian Jackson2012-10-265-26/+198
| | | | | | | | | | | | | | | | | | | | | | | Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address space exhaustion in the builder process or allocation failures/OOM killing of both toolstack and unrelated processes. We disable these checks when building in a stub domain for pvgrub since this uses the guest's own memory and is isolated. Decompression of gzip compressed kernels and ramdisks has been safe since 14954:58205257517d (Xen 3.1.0 onwards). This is XSA-25 / CVE-2012-4544. Also make explicit checks for buffer overflows in various decompression routines. These were already ruled out due to other properties of the code but check them as a belt-and-braces measure. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> [ Includes 25589:60f09d1ab1fe for CVE-2012-2625 ]
* x86: check remote MMIO remap permissionsDaniel De Graaf2012-10-041-0/+10
| | | | | | | | | | | | | | | | When a domain is mapping pages from a different pg_owner domain, the iomem_access checks are currently only applied to the pg_owner domain, potentially allowing a domain with a more restrictive iomem_access policy to have the pages mapped into its page tables. To catch this, also check the owner of the page tables. The current domain does not need to be checked because the ability to manipulate a domain's page tables implies full access to the target domain, so checking that domain's permission is sufficient. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25952:8278d7d8fa48 xen-unstable date: Wed Sep 26 09:56:07 UTC 2012
* x86: tighten checks in XEN_DOMCTL_memory_mapping handlerJan Beulich2012-10-046-47/+71
| | | | | | | | | | | | | | | | | | | | | | | | Properly checking the MFN implies knowing the physical address width supported by the platform, so to obtain this consistently the respective code gets moved out of the MTRR subdir. Btw., the model specific workaround in that code is likely unnecessary - I believe those CPU models don't support 64-bit mode. But I wasn't able to formally verify this, so I preferred to retain that code for now. But domctl code here also was lacking other error checks (as was, looking at it again from that angle) the XEN_DOMCTL_ioport_mapping one. Besides adding the missing checks, printing is also added for the case where revoking access permissions didn't work (as that may have implications for the host operator, e.g. wanting to not pass through affected devices to another guest until the one previously using them did actually die). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25931:149805919569 xen-unstable date: Thu Sep 20 07:21:53 UTC 2012
* x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid rangeJan Beulich2012-10-041-1/+1
| | | | | | | | | | | | | | In particular, the case of "np" being a very large value wasn't handled correctly. The range start checks also were off by one (except that in practice, when "np" is properly range checked, this would still have been caught by the range end checks). Also, is a GFN wrap in XEN_DOMCTL_memory_mapping really okay? Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25927:3e3959413b2f xen-unstable date: Wed Sep 19 07:27:55 UTC 2012
* VT-d: split .ack and .disable DMA-MSI actorsJan Beulich2012-10-041-4/+10
| | | | | | | | | | | | | | | Calling irq_complete_move() from .disable is wrong, breaking S3 resume. Comparing with all other .ack actors, it was also missing a call to move_{native,masked}_irq(). As the actor is masking its interrupt anyway (albeit it's not immediately obvious why), the latter is the better choice. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Acked-by Xiantao Zhang <xiantao.zhang@intel.com> xen-unstable changeset: 25836:7d216f026f71 xen-unstable date: Mon Sep 10 07:45:30 UTC 2012
* adjust a few RCU domain locking callsJan Beulich2012-10-043-93/+50
| | | | | | | | | | | | | | | | | | | | x86's do_physdev_op() had a case where the locking was entirely superfluous. Its physdev_map_pirq() further had a case where the lock was being obtained too early, needlessly complicating early exit paths. Grant table code had two open coded instances of rcu_lock_target_domain_by_id(), and a third code section could be consolidated by using the newly introduced helper function. The memory hypercall code had two more instances of open coding rcu_lock_target_domain_by_id(), but note that here this is not just cleanup, but also fixes an error return path in memory_exchange() to actually return an error. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25835:c70d70d85306 xen-unstable date: Fri Sep 7 15:58:12 UTC 2012
* x86/MSI: fix 2nd S3 resume with interrupt remapping enabledJan Beulich2012-10-041-1/+6
| | | | | | | | | | | | | The first resume from S3 was corrupting internal data structures (in that pci_restore_msi_state() updated the globally stored MSI message from traditional to interrupt remapped format, which would then be translated a second time during the second resume, breaking interrupt delivery). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25834:0376c85caaf3 xen-unstable date: Fri Sep 7 15:57:10 UTC 2012
* make domain_create() return a proper error codeJan Beulich2012-10-047-25/+92
| | | | | | | | | | | | | | | | While triggered by the XSA-9 fix, this really is of more general use; that fix just pointed out very sharply that the current situation with all domain creation failures reported to user (tools) space as -ENOMEM is very unfortunate (actively misleading users _and_ support personnel). Pull over the pointer <-> error code conversion infrastructure from Linux, and use it in domain_create() and all it callers. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25808:4746414def65 xen-unstable date: Mon Sep 3 07:40:38 UTC 2012
* tmem: bump pool version to 1 to fix restore issue when tmem enabledZhenzhong Duan2012-09-251-1/+2
| | | | | | | | | | Restore fails when tmem is enabled both in hypervisor and guest. This is due to spec version mismatch when restoring a pool. Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25929:fee83ac77d8c xen-unstable date: Wed Sep 19 15:38:47 UTC 2012
* tmem: cleanupJan Beulich2012-09-252-4/+4
| | | | | | | | | | - one more case of checking for a specific rather than any error - drop redundant casts Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25860:e4cb84111610 xen-unstable date: Tue Sep 11 12:19:29 UTC 2012
* tmem: fixup 2010 cleanup patch that breaks tmem save/restoreDan Magenheimer2012-09-251-0/+2
| | | | | | | | | | | | | | | | | | | 20918:a3fa6d444b25 "Fix domain reference leaks" (in Feb 2010, by Jan) does some cleanup in addition to the leak fixes. Unfortunately, that cleanup inadvertently resulted in an incorrect fallthrough in a switch statement which breaks tmem save/restore. That broken patch was apparently applied to 4.0-testing and 4.1-testing so those are broken as well. What is the process now for requesting back-patches to 4.0 and 4.1? (Side note: This does not by itself entirely fix save/restore in 4.2.) Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25859:16e0392c6594 xen-unstable date: Tue Sep 11 12:19:03 UTC 2012
* tmem: reduce severity of log messagesJan Beulich2012-09-252-41/+50
| | | | | | | | | | Otherwise they can be used by a guest to spam the hypervisor log with all settings at their defaults. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> xen-unstable changeset: 25858:0520982a602a xen-unstable date: Tue Sep 11 12:18:36 UTC 2012
* tmem: properly drop lock on error path in do_tmem_op()Jan Beulich2012-09-251-1/+7
| | | | | | | | Reported-by: Tim Deegan <tim@xen.org> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25857:109ea6a0c23a xen-unstable date: Tue Sep 11 12:18:26 UTC 2012
* tmem: properly drop lock on error path in do_tmem_get()Jan Beulich2012-09-251-1/+2
| | | | | | | | | | Also remove a bogus assertion. Reported-by: Tim Deegan <tim@xen.org> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25856:83b97a59888b xen-unstable date: Tue Sep 11 12:18:08 UTC 2012
* tmem: detect arithmetic overflow in tmh_copy_{from,to}_client()Jan Beulich2012-09-252-16/+19
| | | | | | | | | | | This implies adjusting callers to deal with errors other than -EFAULT and removing some comments which would otherwise become stale. Reported-by: Tim Deegan <tim@xen.org> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25855:33b8c42a87ec xen-unstable date: Tue Sep 11 12:17:59 UTC 2012
* tmem: don't access guest memory without using the accessors intended for thisJan Beulich2012-09-253-75/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is not permitted, not even for buffers coming from Dom0 (and it would also break the moment Dom0 runs in HVM mode). An implication from the changes here is that tmh_copy_page() can't be used anymore for control operations calling tmh_copy_{from,to}_client() (as those pass the buffer by virtual address rather than MFN). Note that tmemc_save_get_next_page() previously didn't set the returned handle's pool_id field, while the new code does. It need to be confirmed that this is not a problem (otherwise the copy-out operation will require further tmh_...() abstractions to be added). Further note that the patch removes (rather than adjusts) an invalid call to unmap_domain_page() (no matching map_domain_page()) from tmh_compress_from_client() and adds a missing one to an error return path in tmh_copy_from_client(). Finally note that the patch adds a previously missing return statement to cli_get_page() (without which that function could de-reference a NULL pointer, triggerable from guest mode). This is part of XSA-15 / CVE-2012-3497. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25854:ccd60ed6c555 xen-unstable date: Tue Sep 11 12:17:49 UTC 2012
* tmem: check for a valid client ("domain") in the save subopsIan Campbell2012-09-251-0/+8
| | | | | | | | | | This is part of XSA-15 / CVE-2012-3497. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25853:f53c5aadbba9 xen-unstable date: Tue Sep 11 12:17:27 UTC 2012
* tmem: check the pool_id is valid when destroying a tmem poolIan Campbell2012-09-251-0/+2
| | | | | | | | | | This is part of XSA-15 / CVE-2012-3497. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Acked-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25852:d189d99ef00c xen-unstable date: Tue Sep 11 12:06:54 UTC 2012
* tmem: consistently make pool_id a uint32_tIan Campbell2012-09-251-3/+3
| | | | | | | | | | | | | | Treating it as an int could allow a malicious guest to provide a negative pool_Id, by passing the MAX_POOLS_PER_DOMAIN limit check and allowing access to the negative offsets of the pool array. This is part of XSA-15 / CVE-2012-3497. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Acked-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25851:fcf567acc92a xen-unstable date: Tue Sep 11 12:06:43 UTC 2012
* tmem: only allow tmem control operations from privileged domainsIan Campbell2012-09-251-4/+2
| | | | | | | | | | This is part of XSA-15 / CVE-2012-3497. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Acked-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25850:0dba5a888655 xen-unstable date: Tue Sep 11 12:06:30 UTC 2012
* x86: Prefer multiboot-provided e820 over bios-provided e801 memory info.Keir Fraser2012-09-201-11/+11
| | | | | | | | | | | | | Some UEFI systems do not provide e820 information. In this case we should take the detailed memory map provided by a multiboot-capable loader, rather than rely on very conservative values from the e801 bios call. Using the latter on any modern system really hardly makes good sense. Signed-off-by: Keir Fraser <keir@xen.org> Tested-by: Jonathan Tripathy <jonnyt@abpni.co.uk> xen-unstable changeset: 25786:a0b5f8102a00 xen-unstable date: Tue Aug 28 21:40:45 UTC 2012
* x86,cmdline: Fix setting skip_realmode boolean on no-real-mode and tboot optionsKeir Fraser2012-09-201-2/+4
| | | | | | | | ...effect should be cumulative. Signed-off-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25773:b7e66cabb70f xen-unstable date: Thu Aug 23 14:02:04 UTC 2012
* Fix shared entry status for grant copy operation on paged-out gfnAndres Lagar-Cavilla2012-09-201-11/+22
| | | | | | | | | | | | | The unwind path was not clearing the shared entry status bits. This was BSOD-ing guests on network activity under certain configurations. Also: * sed the fixup method name to signal it's related to grant copy. * use atomic clear flag ops during fixup. Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org> xen-unstable changeset: 25771:1636cc4886f6 xen-unstable date: Wed Aug 22 21:27:50 UTC 2012
* x86-64: refine the XSA-9 fixJan Beulich2012-09-203-2/+31
| | | | | | | | | | | | | | | | Our product management wasn't happy with the "solution" for XSA-9, and demanded that customer systems must continue to boot. Rather than having our and perhaps other distros carry non-trivial patches, allow for more fine grained control (panic on boot, deny guest creation, or merely warn) by means of a single line change. Also, as this was found to be a problem with remotely managed systems, don't default to boot denial (just deny guest creation). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25765:e6ca45ca03c2 xen-unstable date: Mon Aug 20 06:46:47 UTC 2012
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 23:18:14 +0000