aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Update Xen version to 4.2.0RELEASE-4.2.0Keir Fraser2012-09-172-3/+3
|
* Added signature for changeset 14164c5f22c8Keir Fraser2012-09-131-0/+1
|
* Added tag 4.2.0-rc5 for changeset 14164c5f22c8Keir Fraser2012-09-131-0/+1
|
* Update Xen version to 4.2.0-rc54.2.0-rc5Keir Fraser2012-09-131-1/+1
|
* QEMU_TAG and QEMU_UPSTREAM_REVISION update for xen-4.2.0-rc5Ian Jackson2012-09-131-2/+2
|
* x86/passthrough: Fix corruption caused by race conditions betweenAndrew Cooper2012-09-121-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | device allocation and deallocation to a domain. A toolstack, when dealing with a domain using PCIPassthrough, could reasonably be expected to issue DOMCTL_deassign_device hypercalls to remove all passed through devices before issuing a DOMCTL_destroydomain hypercall to kill the domain. In the case where a toolstack is perhaps less sensible in this regard, the hypervisor should not fall over. In domain_kill(), pci_release_devices() searches the alldevs_list list looking for PCI devices still assigned to the domain. If the toolstack has correctly deassigned all devices before killing the domain, this loop does nothing. However, if there are still devices attached to the domain, the loop will call pci_cleanup_msi() without unbinding the pirq from the domain. This eventually calls destroy_irq() which xfree()'s the action. However, as the irq_desc->action pointer is abused in an unsafe matter, without unbinding first (which at least correctly cleans up), the action is actually an irq_guest_action_t* rather than an irqaction*, meaning that the cpu_eoi_map is leaked, and eoi_timer is free()'d while still being on a pcpu's inactive_timer list. As a result, when this free()'d memory gets reused, the inactive_timer list becomes corrupt, and list_*** operations will corrupt hypervisor memory. If the above were not bad enough, the loop in pci_release_devices() still leaves references to the irq it destroyed in domain->arch.pirq_irq and irq_pirq, meaning that a later loop, free_domain_pirqs(), which happens as a result of complete_domain_destroy() will unbind and destroy all irqs which were still bound to the domain, resulting in a double destroy of any irq which was still bound to the domain at the point at which the DOMCTL_destroydomain hypercall happened. Because of the allocation of irqs from find_unassigned_irq(), the lowest free irq number is going to be handed back from create_irq(). There is a further race condition between the original (incorrect) call to destroy_irq() from pci_release_devices(), and the later call to free_domain_pirqs() (which happens in a softirq context at some point after the domain has officially died) during which the same irq number (which is still referenced in a stale way in domain->arch.pirq_irq and irq_pirq) has been allocated to a new domain via a PHYSDEVOP_map_pirq hypercall (Say perhaps in the case of rebooting a domain). In this case, the cleanup for the dead domain will free the recently bound irq under the feet of the new domain. Furthermore, after the irq has been incorrectly destroyed, the same domain with another PHYSDEVOP_map_pirq hypercall can be allocated the same irq number as before, leading to an error along the lines of: ../physdev.c:188: dom54: -1:-1 already mapped to 74 In this case, the pirq_irq and irq_pirq mappings get updated to the new PCI device from the latter PHYSDEVOP_map_pirq hypercall, and the IOMMU interrupt remapping registers get updated, leading to IOMMU Primary Pending Fault due to source-id verification failure for incoming interrupts from the passed through device. The easy fix is to simply deassign the device in pci_release_devices() and leave all the real cleanup to the free_domain_pirqs() which correctly unbinds and destroys the irq without leaving stale references around. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Committed-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25883:4fdaebea82d7 xen-unstable date: Wed Sep 12 19:31:16 2012 +0100
* xl.cfg: gfx_passthru documentation improvementsPasi Kärkkäinen2012-09-121-1/+38
| | | | | | | | | | | | gfx_passthru: Document gfx_passthru makes the GPU become primary in the guest and other generic info about gfx_passthru. Signed-off-by: Pasi Kärkkäinen <pasik@iki.fi> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25839:2dfea3dff550 xen-unstable date: Mon Sep 10 11:13:54 2012 +0100
* unmodified_drivers: handle IRQF_SAMPLE_RANDOMOlaf Hering2012-09-121-1/+5
| | | | | | | | | | | | | The flag IRQF_SAMPLE_RANDOM was removed in 3.6-rc1. Add it only if it is defined. An additional call to add_interrupt_randomness is appearently not needed because its now called unconditionally in handle_irq_event_percpu(). Signed-off-by: Olaf Hering <olaf@aepfle.de> Committed-by: Jan Beulich <jbeulich@suse.com> xen-unstable changeset: 25837:87cb4b6f53d3 xen-unstable date: Mon Sep 10 10:54:13 2012 +0200
* docs: document "ucode=" hypervisor command line optionJan Beulich2012-09-111-0/+13
| | | | | | | Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 25841:7d770de90b7f xen-unstable date: Mon Sep 10 10:13:56 UTC 2012
* x86/MSI: fix 2nd S3 resume with interrupt remapping enabledJan Beulich2012-09-111-1/+6
| | | | | | | | | | | | | The first resume from S3 was corrupting internal data structures (in that pci_restore_msi_state() updated the globally stored MSI message from traditional to interrupt remapped format, which would then be translated a second time during the second resume, breaking interrupt delivery). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> xen-unstable changeset: 25834:0376c85caaf3 xen-unstable date: Fri Sep 7 15:57:10 UTC 2012
* Config.mk: Change qemu references to 4.2-testing treesIan Jackson2012-09-101-4/+4
| | | | | | | | | QEMU_REMOTE and QEMU_UPSTREAM_URL need to refer to git://xenbits.xen.org/qemu-{xen,upstream}-4.2-testing.git (or the corresponding http versions), not -unstable.git. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* Force test run by pushing net-empty commit-pairIan Jackson2012-09-101-0/+0
| | | | Remove file "dummy"
* Force test run by pushing net-empty commit-pairIan Jackson2012-09-101-0/+0
| | | | Add file "dummy"
* Empty commit to force test runIan Jackson2012-09-100-0/+0
|
* docs: remove WIP notice from command line docsIan Campbell2012-09-071-5/+0
| | | | | | | | | | | I'm sure they aren't perfect but various people have done a pass over them recently and they are much improved. I don't think we need to continue to describe them so pessimistically. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com> xen-unstable changeset: 25832:e3b51948114e xen-unstable date: Fri Sep 7 12:44:21 UTC 2012
* Added tag 4.2.0-branched for changeset 528f0708b6dbKeir Fraser2012-09-071-0/+1
|
* Added signature for changeset 68640a3c99ce4.2.0-branchedKeir Fraser2012-09-071-0/+1
|
* Added tag 4.2.0-rc4 for changeset 68640a3c99ceKeir Fraser2012-09-071-0/+1
|
* Update Xen version to 4.2.0-rc44.2.0-rc4Keir Fraser2012-09-072-4/+2
|
* Default to non-debug build.Keir Fraser2012-09-071-1/+1
| | | | Signed-off-by: Keir Fraser <keir@xen.org>
* QEMU_TAG update (security fix XSA-15)Ian Jackson2012-09-061-3/+3
|
* timer: remove stray local_irq_enable()David Vrabel2012-09-061-1/+0
| | | | | | | | | | | migrate_timers_from_cpu() has a stray local_irq_enable() that does nothing (it's immediately after a spin_unlock_irq()) and has no matching local_irq_disable(). Signed-off-by: David Vrabel <david.vrabel@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com>
* x86: fix RCU locking in PHYSDEVOP_get_free_pirqJan Beulich2012-09-051-3/+4
| | | | | | | | | | | | Apart from properly pairing locks with unlocks, also reduce the lock scope - no need to do the copy_{from,to}_guest()-s inside the protected region. I actually wonder whether the RCU locks are needed here at all. Reported-by: Tim Deegan <tim@xen.org> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: drop "index" parameter from get_free_pirq()Jan Beulich2012-09-053-5/+5
| | | | | | | It's unused. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* QEMU_TAG update (XSA-17 / CVE-2012-3515)Ian Jackson2012-09-051-3/+3
|
* xen/gnttab: Validate input to GNTTABOP_swap_grant_refIan Jackson2012-09-051-0/+6
| | | | | | | | | | | | | | | | | xen-unstable c/s 24548:d115844ebfbb introduces a new GNTTABOP to swap grant refs. However, it fails to validate the two refs passed from the guest. The result is that passing out-of-range refs can cause Xen to read past the end of the grant_table->active[] array, and deference whatever it finds. Typically, this results in Xen trying to deference a low pointer and fail with a page-fault. As this hypercall can be issued by an unprivileged guest, this is a Denial of Service against Xen. This is XSA-18 / CVE-2012-3516. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Paul Durrant <paul.durrant@citrix.com>
* x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSIIan Jackson2012-09-051-0/+7
| | | | | | | | | This is being used as a array index, and hence must be validated before use. This is XSA-16 / CVE-2012-3498. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* xen: Don't BUG_ON() PoD operations on a non-translated guest.Ian Jackson2012-09-051-1/+2
| | | | | | | | This is XSA-14 / CVE-2012-3496 Signed-off-by: Tim Deegan <tim@xen.org> Reviewed-by: Ian Campbell <ian.campbell@citrix.com> Tested-by: Ian Campbell <ian.campbell@citrix.com>
* xen: prevent a 64 bit guest setting reserved bits in DR7Ian Jackson2012-09-051-1/+1
| | | | | | | | | | The upper 32 bits of this register are reserved and should be written as zero. This is XSA-12 / CVE-2012-3494 Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
* xl.cfg: videoram and stdvga documentation improvementsPasi Kärkkäinen2012-09-031-4/+13
| | | | | | | | | | | | | | | - videoram: Document that only qemu-xen-traditional device-model currently supports changing the amount of video memory for stdvga graphics device. - videoram: Better document the default amount of videoram for both stdvga and Cirrus. - stdvga: Add a note that stdvga allows bigger amount of videoram and bigger resolutions. Signed-off-by: Pasi Kärkkäinen <pasik@iki.fi> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* libxl: fix api check MakefileIan Jackson2012-09-033-4/+8
| | | | | | | | | | | | | | | | | Touch the libxl.api-ok stamp file, and unconditionally put in place the new _libxl.api-for-check. This avoids needlessly rerunning the preprocessor on libxl.h each time we call "make". Ensure that _libxl.api-for-check gets the CFLAGS used for xl, so that if it is asked for in a standalone make run it can find xentoollog.h. Remove *.api-ok on clean. Also fix .gitignore. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* arm: correctly check for error on dom0 allocationIan Campbell2012-09-031-3/+1
| | | | | | | | Drop the redundant printk Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jan Beulich <JBeulich@suse.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* docs/command line: Clarify the behavior with invalid input.Andrew Cooper2012-09-031-2/+10
| | | | | | Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.de> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* libxl/xl: implement support for guest ioport and irq permissions.Ian Campbell2012-09-034-1/+148
| | | | | | | | | | | | | | | | | | | | This is useful for passing legacy ISA devices (e.g. com ports, parallel ports) to guests. Supported syntax is as described in http://cmrg.fifthhorseman.net/wiki/xen#grantingaccesstoserialhardwaretoadomU I tested this using Xen's 'q' key handler which prints out the I/O port and IRQ ranges allowed for each domain. e.g.: (XEN) Rangesets belonging to domain 31: (XEN) I/O Ports { 2e8-2ef, 2f8-2ff } (XEN) Interrupts { 3, 5-6 } Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Tested-by: Dieter Bloms <dieter@bloms.de> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* make domain_create() return a proper error codeJan Beulich2012-09-038-24/+92
| | | | | | | | | | | | | | While triggered by the XSA-9 fix, this really is of more general use; that fix just pointed out very sharply that the current situation with all domain creation failures reported to user (tools) space as -ENOMEM is very unfortunate (actively misleading users _and_ support personnel). Pull over the pointer <-> error code conversion infrastructure from Linux, and use it in domain_create() and all it callers. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86/HVM: RTC periodic timer emulation adjustmentsJan Beulich2012-09-031-4/+7
| | | | | | | | | | | - don't call rtc_timer_update() on REG_A writes when the value didn't change (doing the call always was reported to cause wall clock time lagging with the JVM running on Windows) - don't call rtc_timer_update() on REG_B writes when RTC_PIE didn't change Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* x86: comment opaque expression in __page_to_virt()Jan Beulich2012-09-031-0/+6
| | | | | | | | | mm.h's __page_to_virt() has a rather opaque expression. Comment it. Reported-By: Ian Campbell <ian.campbell@citrix.com> Suggested-by: Ian Jackson <ian.jackson@eu.citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* nestedsvm: fix interrupt handlingChristoph Egger2012-08-311-0/+10
| | | | | | | | | | Give the l2 guest a chance to finish the delivery of the last injected interrupt or exception before we emulate a VMEXIT. For example after a NPF handled by the host there can be an interrupt for the l1 guest. Signed-off-by: Christoph Egger <Christoph.Egger@amd.com> Committed-by: Keir Fraser <keir@xen.org>
* tmem: add matching unlock for an about-to-be-destroyed objectDan Magenheimer2012-08-311-0/+1
| | | | | | | | | | | | | | | | | | A 4.2 changeset forces a preempt_disable/enable with every lock/unlock. Tmem has dynamically allocated "objects" that contain a lock. The lock is held when the object is destroyed. No reason to unlock something that's about to be destroyed! But with the preempt_enable/disable in the generic locking code, and the fact that do_softirq ASSERTs that preempt_count must be zero, a crash occurs soon after any object is destroyed. So force lock to be released before destroying objects. Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com> Committed-by: Keir Fraser <keir@xen.org>
* libxl: fix double free on some config parser errorsIan Jackson2012-08-312-65/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | If libxlu_cfg_y.y encountered a config file error, the code generated by bison would sometimes _both_ run the %destructor _and_ call xlu__cfg_set_store for the same XLU_ConfigSetting* semantic value. The result would be a double free. This appears to be because of the use of a mid-rule action. There is some discussion of the problems with destructors and mid-rule action error handling in "(bison)Mid-Rule Actions". This area is complex and best avoided. So fix the bug by abolishing the use of a mid-rule action, which was in any case not necessary here. Also while we are there rename the nonterminal rule "setting" to "assignment", to avoid confusion with the token type "setting", which had an identically name in a different namespace. This was especially confusing because the nonterminal "setting" did not have "setting" as the type of its semantic value! (In fact the nonterminal, now called "assignment", does not have a value so it does not have a value type.) Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* tools: remove --disable-pythontools optionIan Campbell2012-08-314-114/+80
| | | | | | | | | | | This incorrectly removes the $(PYTHON) variable which is used at build time as well as by the tools. Remove and revisit for 4.3. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xencommons: Attempt to load blktap2 driverIan Campbell2012-08-311-0/+1
| | | | | | | | | | | | | | | | | | | | | Older kernels, such as those found in Debian Squeeze: * Have bugs in handling of AIO into foreign pages * Have blktap modules, which will cause qemu not to use AIO, but which are not loaded on boot. Attempt to load blktap in xencommons, to make sure modern qemu's which use AIO will work properly on those kernels. Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Prefer to load blktap2 if it exists. This is the name of the driver in classic-Xen ports, while in mainline kernels the driver is called just blktap. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jan Beulich <JBeulich@suse.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* tools: remove vestigial default_lib.m4 macros and adjust substitutionsMatt Wilson2012-08-314-48/+4
| | | | | | | | | | | | | | | | | | | LIB_PATH is no longer used, so the AX_DEFAULT_LIB macro is no longer needed. Additionally lower case make variables are now used as autoconf substitutions, which allows for more correct overrides at build time. I've checked the file layout in dist/install from the build made before this change versus after with ./configure values of: 1) ./configure (no flags provided) 2) ./configure --libdir=/usr/lib/x86_64-linux-gnu (Debian style) 3) ./configure --libdir='${exec_prefix}/lib' (late variable expansion) Signed-off-by: Matt Wilson <msw@amazon.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> [ ijc - reran autogen.sh ] Committed-by: Ian Campbell <ian.campbell@citrix.com>
* uninstall: push tools uninstall down into tools/MakefileIan Campbell2012-08-312-28/+33
| | | | | | | | | | Many of the rules here depend on having run configure and the variables which it defines in config/Tools.mk Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Looks-good: Jan Beulich <JBeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* uninstall: do not remove kernels or modules on uninstall.Ian Campbell2012-08-312-4/+18
| | | | | | | | | | | | | | | | | The pattern used is very broad and will delete any kernel with xen in its filename, likewise modules, including those which come packages from the distribution etc. I don't think this was ever the right thing to do but it is doubly wrong now that Xen does not even build or install a kernel by default. Push cleanup of the installed hypervisor down into xen/Makefile so that it can cleanup exactly what it actually installs. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Looks-good: Jan Beulich <JBeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* hotplug/NetBSD: check type of file to attach from paramsRoger Pau Monne2012-08-311-1/+10
| | | | | | | | | | | | xend used to set the xenbus backend entry "type" to either "phy" or "file", but now libxl sets it to "phy" for both file and block device. We have to manually check for the type of the "param" field in order to detect if we are trying to attach a file or a block device. Signed-off-by: Christoph Egger <Christoph.Egger@amd.com> Signed-off-by: Roger Pau Monne <roger.pau@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* hotplug/NetBSD: write error message to hotplug-errorRoger Pau Monne2012-08-311-1/+2
| | | | | | | | | As recommended by Ian Campbell, write the hotplug error to hotplug-error, just as the Linux hotplug script does. Signed-off-by: Roger Pau Monne <roger.pau@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* hotplug/NetBSD: fix xenstore_write usage in errorRoger Pau Monne2012-08-311-1/+1
| | | | | | | | | | xenstore_write doesn't exist, use xenstore-write instead. The error function is currently broken without this change. Signed-off-by: Roger Pau Monne <roger.pau@citrix.com> Signed-off-by: Christoph Egger <Christoph.Egger@amd.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xenconsoled: clean-up after all dead domainsDavid Vrabel2012-08-311-1/+11
| | | | | | | | | | | | | | | | | | | | | | | xenconsoled expected domains that are being shutdown to end up in the the DYING state and would only clean-up such domains. HVM domains either didn't enter the DYING state or weren't in long enough for xenconsoled to notice. For every shutdown HVM domain, xenconsoled would leak memory, grow its list of domains and (if guest console logging was enabled) leak the log file descriptor. If the file descriptors were leaked and enough HVM domains were shutdown, no more console connections would work as the evtchn device could not be opened. Guests would then block waiting to send console output. Fix this by tagging domains that exist in enum_domains(). Afterwards, all untagged domains are assumed to be dead and are shutdown and cleaned up. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* README: Update references to PyXML to lxmlIan Campbell2012-08-311-3/+3
| | | | | | Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-11 20:05:26 +0000