aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* update Xen version to 4.1.4-rc24.1.4-rc2Jan Beulich2012-12-121-1/+1
|
* x86/hap: Fix memory leak of domain->arch.hvm_domain.dirty_vramKouya Shimura2012-12-061-0/+3
| | | | | | | Signed-off-by: Kouya Shimura <kouya@jp.fujitsu.com> Signed-off-by: Tim Deegan <tim@xen.org> xen-unstable changeset: 26203:b5cb6cccc32c xen-unstable date: Thu Nov 29 11:01:00 UTC 2012
* MAINTAINERS: Reference stable maintenance policyIan Campbell2012-12-061-1/+28
| | | | | | | | | | | | I also couldn't resist fixing a typo and adding a reference to http://wiki.xen.org/wiki/Submitting_Xen_Patches for the normal case as well. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 26238:53805e238cca xen-unstable date: Thu Dec 6 09:56:53 UTC 2012
* memop: limit guest specified extent orderJan Beulich2012-12-041-2/+7
| | | | | | | | | | | | | | | | | Allowing unbounded order values here causes almost unbounded loops and/or partially incomplete requests, particularly in PoD code. The added range checks in populate_physmap(), decrease_reservation(), and the "in" one in memory_exchange() architecturally all could use PADDR_BITS - PAGE_SHIFT, and are being artificially constrained to MAX_ORDER. This is XSA-31 / CVE-2012-5515. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* xen: fix error handling of guest_physmap_mark_populate_on_demand()Jan Beulich2012-12-041-3/+5
| | | | | | | | | | | | | | | | | | | | | | | The only user of the "out" label bypasses a necessary unlock, thus enabling the caller to lock up Xen. Also, the function was never meant to be called by a guest for itself, so rather than inspecting the code paths in depth for potential other problems this might cause, and adjusting e.g. the non-guest printk() in the above error path, just disallow the guest access to it. Finally, the printk() (considering its potential of spamming the log, the more that it's not using XENLOG_GUEST), is being converted to P2M_DEBUG(), as debugging is what it apparently was added for in the first place. This is XSA-30 / CVE-2012-5514. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* xen: add missing guest address range checks to XENMEM_exchange handlersJan Beulich2012-12-042-0/+13
| | | | | | | | | | | | | | | Ever since its existence (3.0.3 iirc) the handler for this has been using non address range checking guest memory accessors (i.e. the ones prefixed with two underscores) without first range checking the accessed space (via guest_handle_okay()), allowing a guest to access and overwrite hypervisor memory. This is XSA-29 / CVE-2012-5513. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* x86/HVM: range check xen_hvm_set_mem_access.hvmmem_access before useJan Beulich2012-12-041-4/+1
| | | | | | | | | | | | | | Otherwise an out of bounds array access can happen if changing the default access is being requested, which - if it doesn't crash Xen - would subsequently allow reading arbitrary memory through HVMOP_get_mem_access (again, unless that operation crashes Xen). This is XSA-28 / CVE-2012-5512. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* hvm: Limit the size of large HVM op batchesTim Deegan2012-12-043-11/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Doing large p2m updates for HVMOP_track_dirty_vram without preemption ties up the physical processor. Integrating preemption into the p2m updates is hard so simply limit to 1GB which is sufficient for a 15000 * 15000 * 32bpp framebuffer. For HVMOP_modified_memory and HVMOP_set_mem_type preemptible add the necessary machinery to handle preemption. This is CVE-2012-5511 / XSA-27. Signed-off-by: Tim Deegan <tim@xen.org> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com> x86/paging: Don't allocate user-controlled amounts of stack memory. This is XSA-27 / CVE-2012-5511. Signed-off-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> v2: Provide definition of GB to fix x86-32 compile. Signed-off-by: Jan Beulich <JBeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
* gnttab: fix releasing of memory upon switches between versionsJan Beulich2012-12-041-14/+20
| | | | | | | | | | | | | | | | | | gnttab_unpopulate_status_frames() incompletely freed the pages previously used as status frame in that they did not get removed from the domain's xenpage_list, thus causing subsequent list corruption when those pages did get allocated again for the same or another purpose. Similarly, grant_table_create() and gnttab_grow_table() both improperly clean up in the event of an error - pages already shared with the guest can't be freed by just passing them to free_xenheap_page(). Fix this by sharing the pages only after all allocations succeeded. This is CVE-2012-5510 / XSA-26. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* x86/time: fix scale_delta() inline assemblyJan Beulich2012-11-271-2/+3
| | | | | | | | | | | | | | | | | The way it was coded, it clobbered %rdx without telling the compiler. This generally didn't cause any problems except when there are two back to back invocations (as in plt_overflow()), as in that case the compiler may validly assume that it can re-use for the second instance the value loaded into %rdx before the first one. Once at it, also properly relax the second operand of "mul" (there's no need for it to be in %rdx, or a register at all), and switch away from using explicit register names in the instruction operands. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26188:16bf7f3069a7 xen-unstable date: Mon Nov 26 16:20:39 UTC 2012
* fix backport oversight in 23383:addf106cc90fJan Beulich2012-11-191-1/+1
| | | | | | | | | | This fixes an omission in said backport (of -unstable 25931:149805919569): While the XEN_DOMCTL_memory_mapping code pointlessly sets "ret" to zero, the XEN_DOMCTL_ioport_mapping code needs to because of an XSM call (leaving ret set to zero when reaching the code in question) present in -unstable, but absent in 4.1-testing. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* Added signature for changeset 500194a883bdKeir Fraser2012-11-151-0/+1
|
* Added tag 4.1.4-rc1 for changeset 500194a883bdJan Beulich2012-11-151-0/+1
|
* update Xen version to 4.1.4-rc14.1.4-rc1Jan Beulich2012-11-152-2/+2
|
* compat/gnttab: Prevent infinite loop in compat codeIan Jackson2012-11-141-0/+2
| | | | | | | | | | | | | | | | | | | c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall into an infinite loop. If the watchdog is enabled, Xen will die after the timeout. This is a security problem, XSA-24 / CVE-2012-4539. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26151:b64a7d868f06 Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xen/mm/shadow: check toplevel pagetables are present before unhooking them.Ian Jackson2012-11-141-2/+6
| | | | | | | | | | | | | | | If the guest has not fully populated its top-level PAE entries when it calls HVMOP_pagetable_dying, the shadow code could try to unhook entries from MFN 0. Add a check to avoid that case. This issue was introduced by c/s 21239:b9d2db109cf5. This is a security problem, XSA-23 / CVE-2012-4538. Signed-off-by: Tim Deegan <tim@xen.org> Tested-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/physmap: Prevent incorrect updates of m2p mappingsIan Jackson2012-11-141-0/+4
| | | | | | | | | | | | | | | | | | | In certain conditions, such as low memory, set_p2m_entry() can fail. Currently, the p2m and m2p tables will get out of sync because we still update the m2p table after the p2m update has failed. If that happens, subsequent guest-invoked memory operations can cause BUG()s and ASSERT()s to kill Xen. This is fixed by only updating the m2p table iff the p2m was successfully updated. This is a security problem, XSA-22 / CVE-2012-4537. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/physdev: Range check pirq parameter from guestsIan Jackson2012-11-141-0/+4
| | | | | | | | | | | | | | | | | | Otherwise Xen will read beyond either end of the struct domain.arch.pirq_emuirq array, usually resulting in a fatal page fault. This vulnerability was introduced by c/s 23241:d21100f1d00e, which adds a call to domain_pirq_to_emuirq() which uses the guest provided pirq value before range checking it, and was fixed by c/s 23573:584c2e5e03d9 which changed the behaviour of the domain_pirq_to_emuirq() macro to use radix trees instead of a flat array. This is XSA-21 / CVE-2012-4536. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerabilityIan Jackson2012-11-142-0/+5
| | | | | | | | | | | | | | | | | | The timer action for a vcpu periodic timer is to calculate the next expiry time, and to reinsert itself into the timer queue. If the deadline ends up in the past, Xen never leaves __do_softirq(). The affected PCPU will stay in an infinite loop until Xen is killed by the watchdog (if enabled). This is a security problem, XSA-20 / CVE-2012-4535. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26148:bf58b94b3cef Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86/mm x86 shadow: Fix typo in sh_invlpg sl3 page presence checkMatthew Daley2012-11-141-1/+1
| | | | | | | Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Tim Deegan <tim@xen.org> xen-unstable changeset: 26134:279bbf2a0b48 xen-unstable date: Mon Nov 12 10:17:00 UTC 2012
* tmem: Prevent NULL dereference on error caseMatthew Daley2012-11-141-1/+3
| | | | | | | | | | | If the client / pool IDs given to tmemc_save_get_next_page are invalid, the calculation of pagesize will dereference NULL. Fix this by moving the calculation below the appropriate NULL check. Signed-off-by: Matthew Daley <mattjd@gmail.com> xen-unstable changeset: 26132:286ef4ced216 xen-unstable date: Mon Nov 12 08:34:57 UTC 2012
* QEMU_TAG updateIan Jackson2012-11-131-3/+3
|
* xend/pvscsi: update sysfs parser for Linux 3.0Olaf Hering2012-11-131-6/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sysfs parser for /sys/bus/scsi/devices understands only the layout of kernel version 2.6.16. This looks as follows: /sys/bus/scsi/devices/1:0:0:0/block:sda is a symlink to /sys/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic:sg1 is a symlink to /sys/class/scsi_generic/sg1 Both directories contain a 'dev' file with the major:minor information. This patch updates the used regex strings to match also the colon to make it more robust against possible future changes. In kernel version 3.0 the layout changed: /sys/bus/scsi/devices/ contains now additional symlinks to directories such as host1 and target1:0:0. This patch ignores these as they do not point to the desired scsi devices. They just clutter the devices array. The directory layout in '1:0:0:0' changed as well, the 'type:name' notation was replaced with 'type/name' directories: /sys/bus/scsi/devices/1:0:0:0/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic/sg1/ Both directories contain a 'dev' file with the major:minor information. This patch adds additional code to walk the subdir to find the 'dev' file to make sure the given subdirectory is really the kernel name. In addition this patch makes sure devname is not None. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26010:cff10030c6ea Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25915:839e5d95d483 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix usage of persistant device names for SCSI devicesOlaf Hering2012-11-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the callers of vscsi_get_scsidevices() do not pass a mask string. This will call "lsscsi -g '[]'", which causes a lsscsi syntax error. As a result the sysfs parser _vscsi_get_scsidevices() is used. But this parser is broken and the specified names in the config file are not found. Using a mask '*' if no mask was given will call lsscsi correctly and the following config is parsed correctly: vscsi=[ '/dev/sg3, 0:0:0:0', '/dev/disk/by-id/wwn-0x600508b4000cf1c30000800000410000, 0:0:0:1' ] Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26009:2dbfa4d2e107 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25914:b8916af165b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix passing of SCSI control LUNsOlaf Hering2012-11-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently pvscsi can not pass SCSI devices that have just a scsi_generic node. In the following example sg3 is a control LUN for the disk sdd. But vscsi=['4:0:2:0,0:0:0:0'] does not work because the internal 'devname' variable remains None. Later writing p-devname to xenstore fails because None is not a valid string variable. Since devname is used for just informational purpose use sg also as devname. carron:~ $ lsscsi -g [0:0:0:0] disk ATA FK0032CAAZP HPF2 /dev/sda /dev/sg0 [4:0:0:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdb /dev/sg1 [4:0:1:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdc /dev/sg2 [4:0:2:0] storage HP HSV400 0950 - /dev/sg3 [4:0:2:1] disk HP HSV400 0950 /dev/sdd /dev/sg4 [4:0:3:0] storage HP HSV400 0950 - /dev/sg5 [4:0:3:1] disk HP HSV400 0950 /dev/sde /dev/sg6 Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26008:eecb528583d7 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25913:16ced2f387b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: xend: fix wrong condition check for xml fileJoe Jin2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | In commit e8d40584, it intended to check xml file size and when empty will return, the condition should be "if os.path.getsize(xml_path) == 0" rather then "if not os.path.getsize(xml_path) == 0". Signed-off-by: Chuang Cao <chuang.cao@oracle.com> Signed-off-by: Joe Jin <joe.jin@oracle.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26088:dd64a1bdbe3a Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25905:82b61b99d15d Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* pygrub: correct typo in --args assignmentOlaf Hering2012-11-131-3/+3
| | | | | | | | | | | | | | | | | | | | | If pygrub was called with --args="some thing", then this string should be append to the kernel command line. But the last changeset 25941:795c493fe561 contained a typo, it assigns 'args' instead of 'arg'. Rename the local variable which holds the string from the domain config file to avoid further confusion. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26018:ecc7627ca6d7 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25899:dbb1872bbb97 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xenballoond.init: remove 4 from default runlevelOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | | | Remove 4 from default runlevel in xenballoond.init. Similar to what changeset 24847:0900b1c905f1 does in xencommons, remove runlevel 4 from the other runlevel scripts. LSB defines runlevel 4 as reserved for local use, the local sysadmin is responsible for symlink creation in rc4.d. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26007:fe756682cc7f Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25897:dcd4bf824284 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* hotplug/Linux: Remove tracing (bash -x) from network-nat scriptOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26006:8b6870d686d6 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25896:6adf0c7937bf Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* pygrub: always append --argsOlaf Hering2012-11-131-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | If a bootloader entry in menu.lst has no additional kernel command line options listed and the domU.cfg has 'bootargs="--args=something"' the additional arguments from the config file are not passed to the kernel. The reason for that incorrect behaviour is that run_grub appends arg only if the parsed config file has arguments listed. Fix this by appending args from image section and the config file separatly. To avoid adding to a NoneType initialize grubcfg['args'] to an empty string. This does not change behaviour but simplifies the code which appends the string. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25941:795c493fe561 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25891:7e91c668bae2 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* docs: correct formatting errors in xmdomain.cfgMatt Wilson2012-11-131-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch corrects the following errors produced by pod2man: Hey! The above document had some coding errors, which are explained below: Around line 301: You can't have =items (as at line 305) unless the first thing after the =over is an =item Around line 311: '=item' outside of any '=over' Signed-off-by: Matt Wilson <msw@amazon.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25840:c7e4b7e64303 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25885:c23d938e3e64 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86: don't special case first IO-APICJan Beulich2012-10-291-17/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has always been puzzling me why the first IO-APIC gets special cased in two places, and finally Xen got run on a system where this breaks: (XEN) ACPI: IOAPIC (id[0x10] address[0xfecff000] gsi_base[0]) (XEN) IOAPIC[0]: apic_id 16, version 17, address 0xfecff000, GSI 0-2 (XEN) ACPI: IOAPIC (id[0x0f] address[0xfec00000] gsi_base[3]) (XEN) IOAPIC[1]: apic_id 15, version 17, address 0xfec00000, GSI 3-38 (XEN) ACPI: IOAPIC (id[0x0e] address[0xfec01000] gsi_base[39]) (XEN) IOAPIC[2]: apic_id 14, version 17, address 0xfec01000, GSI 39-74 (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 1 global_irq 4 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 5 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 3 global_irq 6 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 4 global_irq 7 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 6 global_irq 9 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 7 global_irq 10 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 8 global_irq 11 low edge) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 12 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 12 global_irq 15 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 13 global_irq 16 dfl dfl) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 14 global_irq 17 low edge) (XEN) ACPI: INT_SRC_OVR (bus 0 bus_irq 15 global_irq 18 dfl dfl) i.e. all legacy IRQs (apart from the timer one, but the firmware passed data doesn't look right for that case anyway, as both Xen and native Linux are falling back to use the virtual wire setup for IRQ0, apparently rather using pin 2 of the first IO-APIC) are being handled by the second IO-APIC. This at once eliminates the possibility of an unmasked RTE getting written without having got a vector put in place (in setup_IO_APIC_irqs()). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26102:22e08c9ac770 xen-unstable date: Wed Oct 24 15:51:48 UTC 2012
* hvm: handle PoD and grant pages in HVMOP_get_mem_typeOlaf Hering2012-10-291-0/+4
| | | | | | | | | | | | | During kexec in a ballooned PVonHVM guest the new kernel needs to check each pfn if its backed by a mfn to find ballooned pages. Currently all PoD and grant pages will appear as HVMMEM_mmio_dm, so the new kernel has to assume they are ballooned. This is wrong: PoD pages may turn into real RAM at runtime, grant pages are also RAM. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Tim Deegan <tim@xen.org> xen-unstable changeset: 26093:4ae08ca5500f xen-unstable date: Fri Oct 19 14:09:05 UTC 2012
* x86/HPET: obtain proper lock for changing IRQ affinityJan Beulich2012-10-291-6/+12
| | | | | | | | | | | The IRQ descriptor lock should be held while adjusting the affinity of any IRQ; the HPET channel lock isn't sufficient to protect namely against races with moving the IRQ to a different CPU. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26063:1f4be6ee4619 xen-unstable date: Wed Oct 17 12:13:20 UTC 2012
* x86/oprof: adjust off-by-one counter range checksJan Beulich2012-10-291-2/+2
| | | | | | | Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26061:4b4c0c7a6031 xen-unstable date: Wed Oct 17 09:23:10 UTC 2012
* More efficient TLB-flush filtering in alloc_heap_pages().Keir Fraser2012-10-291-11/+16
| | | | | | | | | | | | | | | | | | | Rather than per-cpu filtering for every page in a super-page allocation, simply remember the most recent TLB timestamp across all allocated pages, and filter on that, just once, at the end of the function. For large-CPU systems, doing 2MB allocations during domain creation, this cuts down the domain creation time *massively*. TODO: It may make sense to move the filtering out into some callers, such as memory.c:populate_physmap() and memory.c:increase_reservation(), so that the filtering can be moved outside their loops, too. Signed-off-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26056:177fdda0be56 xen-unstable date: Mon Oct 15 15:38:11 UTC 2012
* x86/xenoprof: fix kernel/user mode detection for HVMJacob Shin2012-10-291-4/+15
| | | | | | | | | | | | | | | | While trying oprofile under Xen, I noticed that HVM passive domain's kernel addresses were showing up as user application. It turns out under HVM get_cpu_user_regs()->cs contains 0x0000beef. Signed-off-by: Jacob Shin <jacob.shin@amd.com> Don't cast away const-ness. Use SS instead of CS to determine ring. Special-case real and protected mode. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26055:14e32621dbaf xen-unstable date: Mon Oct 15 13:04:51 UTC 2012
* x86/amd: Fix xen_apic_write warnings in Dom0Wei Wang2012-10-291-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ 0.020294] ------------[ cut here ]------------ [ 0.020311] WARNING: at arch/x86/xen/enlighten.c:730 xen_apic_write+0x15/0x17() [ 0.020318] Hardware name: empty [ 0.020323] Modules linked in: [ 0.020334] Pid: 1, comm: swapper/0 Not tainted 3.3.8 #7 [ 0.020340] Call Trace: [ 0.020354] [<ffffffff81050379>] warn_slowpath_common+0x80/0x98 [ 0.020369] [<ffffffff810503a6>] warn_slowpath_null+0x15/0x17 [ 0.020378] [<ffffffff810034df>] xen_apic_write+0x15/0x17 [ 0.020392] [<ffffffff8101cb2b>] perf_events_lapic_init+0x2e/0x30 [ 0.020410] [<ffffffff81ee4dd0>] init_hw_perf_events+0x250/0x407 [ 0.020419] [<ffffffff81ee4b80>] ? check_bugs+0x2d/0x2d [ 0.020430] [<ffffffff81002181>] do_one_initcall+0x7a/0x131 [ 0.020444] [<ffffffff81edbbf9>] kernel_init+0x91/0x15d [ 0.020456] [<ffffffff817caaa4>] kernel_thread_helper+0x4/0x10 [ 0.020471] [<ffffffff817c347c>] ? retint_restore_args+0x5/0x6 [ 0.020481] [<ffffffff817caaa0>] ? gs_change+0x13/0x13 [ 0.020500] ---[ end trace a7919e7f17c0a725 ]--- Kernel function check_hw_exists() writes 0xabcd to msr 0xc0010201 (Performance Event Counter 0) and read it again to check if it is running as dom0. Early amd cpus does not reset perf counters during warm reboot. If the kernel is booted with bare metal and then as a dom0, the content of msr 0xc0010201 will stay and the checking will pass and PMU will be enabled unexpectedly. Signed-off-by: Wei Wang <wei.wang2@amd.com> Don't reset the counters when used for the NMI watchdog. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 26054:983108e1b56b xen-unstable date: Mon Oct 15 13:03:36 UTC 2012
* hvmloader: Do not zero the wallclock fields in shared-info.Keir Fraser2012-10-291-1/+5
| | | | | | | | | | | | | | | These fields need to be valid at all times. Hypervisor ensures this even across 32/64-bit guest transitions. This fixes a bug where wallclock time is incorrect for booting 32-bit HVM guests. This should be backported to Xen 4.1 and 4.2. Signed-off-by: Keir Fraser <keir@xen.org> Tested-and-Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> xen-unstable changeset: 25908:12fa949b9060 xen-unstable date: Fri Sep 14 18:47:57 UTC 2012
* libxc: builder: limit maximum size of kernel/ramdisk.Ian Jackson2012-10-265-26/+198
| | | | | | | | | | | | | | | | | | | | | | | Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address space exhaustion in the builder process or allocation failures/OOM killing of both toolstack and unrelated processes. We disable these checks when building in a stub domain for pvgrub since this uses the guest's own memory and is isolated. Decompression of gzip compressed kernels and ramdisks has been safe since 14954:58205257517d (Xen 3.1.0 onwards). This is XSA-25 / CVE-2012-4544. Also make explicit checks for buffer overflows in various decompression routines. These were already ruled out due to other properties of the code but check them as a belt-and-braces measure. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> [ Includes 25589:60f09d1ab1fe for CVE-2012-2625 ]
* x86: check remote MMIO remap permissionsDaniel De Graaf2012-10-041-0/+10
| | | | | | | | | | | | | | | | When a domain is mapping pages from a different pg_owner domain, the iomem_access checks are currently only applied to the pg_owner domain, potentially allowing a domain with a more restrictive iomem_access policy to have the pages mapped into its page tables. To catch this, also check the owner of the page tables. The current domain does not need to be checked because the ability to manipulate a domain's page tables implies full access to the target domain, so checking that domain's permission is sufficient. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25952:8278d7d8fa48 xen-unstable date: Wed Sep 26 09:56:07 UTC 2012
* x86: tighten checks in XEN_DOMCTL_memory_mapping handlerJan Beulich2012-10-046-47/+71
| | | | | | | | | | | | | | | | | | | | | | | | Properly checking the MFN implies knowing the physical address width supported by the platform, so to obtain this consistently the respective code gets moved out of the MTRR subdir. Btw., the model specific workaround in that code is likely unnecessary - I believe those CPU models don't support 64-bit mode. But I wasn't able to formally verify this, so I preferred to retain that code for now. But domctl code here also was lacking other error checks (as was, looking at it again from that angle) the XEN_DOMCTL_ioport_mapping one. Besides adding the missing checks, printing is also added for the case where revoking access permissions didn't work (as that may have implications for the host operator, e.g. wanting to not pass through affected devices to another guest until the one previously using them did actually die). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25931:149805919569 xen-unstable date: Thu Sep 20 07:21:53 UTC 2012
* x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid rangeJan Beulich2012-10-041-1/+1
| | | | | | | | | | | | | | In particular, the case of "np" being a very large value wasn't handled correctly. The range start checks also were off by one (except that in practice, when "np" is properly range checked, this would still have been caught by the range end checks). Also, is a GFN wrap in XEN_DOMCTL_memory_mapping really okay? Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25927:3e3959413b2f xen-unstable date: Wed Sep 19 07:27:55 UTC 2012
* VT-d: split .ack and .disable DMA-MSI actorsJan Beulich2012-10-041-4/+10
| | | | | | | | | | | | | | | Calling irq_complete_move() from .disable is wrong, breaking S3 resume. Comparing with all other .ack actors, it was also missing a call to move_{native,masked}_irq(). As the actor is masking its interrupt anyway (albeit it's not immediately obvious why), the latter is the better choice. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Acked-by Xiantao Zhang <xiantao.zhang@intel.com> xen-unstable changeset: 25836:7d216f026f71 xen-unstable date: Mon Sep 10 07:45:30 UTC 2012
* adjust a few RCU domain locking callsJan Beulich2012-10-043-93/+50
| | | | | | | | | | | | | | | | | | | | x86's do_physdev_op() had a case where the locking was entirely superfluous. Its physdev_map_pirq() further had a case where the lock was being obtained too early, needlessly complicating early exit paths. Grant table code had two open coded instances of rcu_lock_target_domain_by_id(), and a third code section could be consolidated by using the newly introduced helper function. The memory hypercall code had two more instances of open coding rcu_lock_target_domain_by_id(), but note that here this is not just cleanup, but also fixes an error return path in memory_exchange() to actually return an error. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25835:c70d70d85306 xen-unstable date: Fri Sep 7 15:58:12 UTC 2012
* x86/MSI: fix 2nd S3 resume with interrupt remapping enabledJan Beulich2012-10-041-1/+6
| | | | | | | | | | | | | The first resume from S3 was corrupting internal data structures (in that pci_restore_msi_state() updated the globally stored MSI message from traditional to interrupt remapped format, which would then be translated a second time during the second resume, breaking interrupt delivery). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25834:0376c85caaf3 xen-unstable date: Fri Sep 7 15:57:10 UTC 2012
* make domain_create() return a proper error codeJan Beulich2012-10-047-25/+92
| | | | | | | | | | | | | | | | While triggered by the XSA-9 fix, this really is of more general use; that fix just pointed out very sharply that the current situation with all domain creation failures reported to user (tools) space as -ENOMEM is very unfortunate (actively misleading users _and_ support personnel). Pull over the pointer <-> error code conversion infrastructure from Linux, and use it in domain_create() and all it callers. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25808:4746414def65 xen-unstable date: Mon Sep 3 07:40:38 UTC 2012
* tmem: bump pool version to 1 to fix restore issue when tmem enabledZhenzhong Duan2012-09-251-1/+2
| | | | | | | | | | Restore fails when tmem is enabled both in hypervisor and guest. This is due to spec version mismatch when restoring a pool. Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25929:fee83ac77d8c xen-unstable date: Wed Sep 19 15:38:47 UTC 2012
* tmem: cleanupJan Beulich2012-09-252-4/+4
| | | | | | | | | | - one more case of checking for a specific rather than any error - drop redundant casts Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> xen-unstable changeset: 25860:e4cb84111610 xen-unstable date: Tue Sep 11 12:19:29 UTC 2012
* tmem: fixup 2010 cleanup patch that breaks tmem save/restoreDan Magenheimer2012-09-251-0/+2
| | | | | | | | | | | | | | | | | | | 20918:a3fa6d444b25 "Fix domain reference leaks" (in Feb 2010, by Jan) does some cleanup in addition to the leak fixes. Unfortunately, that cleanup inadvertently resulted in an incorrect fallthrough in a switch statement which breaks tmem save/restore. That broken patch was apparently applied to 4.0-testing and 4.1-testing so those are broken as well. What is the process now for requesting back-patches to 4.0 and 4.1? (Side note: This does not by itself entirely fix save/restore in 4.2.) Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25859:16e0392c6594 xen-unstable date: Tue Sep 11 12:19:03 UTC 2012
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-12 12:43:30 +0000