aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* update Xen version to 4.2.3RELEASE-4.2.3Jan Beulich2013-09-092-3/+3
|
* AMD IOMMU: add missing checkJan Beulich2013-09-061-0/+7
| | | | | | | | | | | We shouldn't accept IVHD tables specifying IO-APIC IDs beyond the limit we support (MAX_IO_APICS, currently 128). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Suravee Suthikulpanit <suravee.suthikulapanit@amd.com> master commit: 3785d30efe8264b899499e0883b10cc434bd0959 master date: 2013-08-29 09:31:37 +0200
* Fix inactive timer list corruption on second S3 resumeTomasz Wroblewski2013-09-061-1/+3
| | | | | | | | | | | | | init_timer cannot be safely called multiple times on same timer since it does memset(0) on the structure, erasing the auxiliary member used by linked list code. This breaks inactive timer list in common/timer.c. Moved resume_timer initialisation to ns16550_init_postirq, so it's only done once. Signed-off-by: Tomasz Wroblewski <tomasz.wroblewski@citrix.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 9e2c5938246546a5b3f698b7421640d85602b994 master date: 2013-08-28 10:18:39 +0200
* x86/Intel: add support for Haswell CPU modelsJan Beulich2013-09-063-1/+7
| | | | | | | | | ... according to their most recent public documentation. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 3e787021fb2420851c7bdc3911ea53c728ba5ac0 master date: 2013-08-27 11:15:15 +0200
* x86/Intel: add further support for Ivy Bridge CPU modelsJan Beulich2013-09-063-3/+10
| | | | | | | And some initial Haswell ones at once. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: "Nakajima, Jun" <jun.nakajima@intel.com>
* VT-d: warn about Compatibility Format Interrupts being enabled by firmwareJan Beulich2013-09-061-6/+10
| | | | | | | | | | | ... as being insecure. Also drop the second (redundant) read DMAR_GSTS_REG from enable_intremap(). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by Xiantao Zhang <xiantao.zhang@intel.com> master commit: c9c6abab583d27fdca1d979a7f1d18ae30f54e9b master date: 2013-08-21 16:44:58 +0200
* pygrub: add Debian extlinux.conf pathIan Campbell2013-09-031-0/+1
| | | | | | | | | | This is Debian bug #697407. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697407 Signed-off-by: Ian Campbell <ijc@hellion.org.uk> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 258d27a1d9fb33a490bef1381f52d522225c3dca)
* oxenstored: Protect oxenstored from malicious domains.Ian Jackson2013-09-035-6/+31
| | | | | | | | | | | | | | | | | | | | | | add check logic when read from IO ring, and if error happens, then mark the reading connection as "bad", Unless vm reboot, oxenstored will not handle message from this connection any more. xs_ring_stubs.c: add a more strict check on ring reading connection.ml, domain.ml: add getter and setter for bad flag process.ml: if exception raised when reading from domain's ring, mark this domain as "bad" xenstored.ml: if a domain is marked as "bad", do not handle it. Signed-off-by: John Liu <john.liuqiming@huawei.com> Acked-by: David Scott <dave.scott@eu.citrix.com> (cherry picked from commit 704302ce9404c73cfb687d31adcf67094ab5bb53) (cherry picked from commit a978634bee4db6c5e0ceeb66adcc5114f3f9bc48) Conflicts: tools/ocaml/xenstored/domain.ml Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* update Xen version to 4.2.3-rc24.2.3-rc2Jan Beulich2013-08-272-2/+2
|
* x86: correct public header's documentation of PAT MSR settingsJan Beulich2013-08-261-9/+9
| | | | | | | | | | The first (PAT6) column was wrong across the board, and the column for PAT7 was missing altogether. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 3829655bd3ad2b1150bd94955fc6988dec6b98f2 master date: 2013-08-23 09:23:24 +0200
* Correct X2-APIC HVM emulationJuergen Gross2013-08-221-0/+1
| | | | | | | | | | commit 6859874b61d5ddaf5289e72ed2b2157739b72ca5 ("x86/HVM: fix x2APIC APIC_ID read emulation") introduced an error for the hvm emulation of x2apic. Any try to write to APIC_ICR MSR will result in a GP fault. Signed-off-by: Juergen Gross <juergen.gross@ts.fujitsu.com> master commit: 69962e19ed432570f6cdcfdb5f6f22d6e3c54e6c master date: 2013-08-22 11:24:00 +0200
* xen: Add stdbool.h workaround for BSD.Tim Deegan2013-08-202-2/+15
| | | | | | | | | | | | | | | | | | On *BSD, stdbool.h lives in /usr/include, but we don't want to have that on the search path in case we pick up any headers from the build host's C libraries. Copy the equivalent hack already in place for stdarg.h: on all supported compilers the contents of stdbool.h are trivial, so just supply the things we need in a xen/stdbool.h header. Signed-off-by: Tim Deegan <tim@xen.org> Reviewed-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Tested-by: Patrick Welche <prlw1@cam.ac.uk> master commit: 7b9685ca4ed2fd723600ce66eb20a6d0c115b6cb master date: 2013-08-15 22:00:45 +0100
* x86/time: fix check for negative time in __update_vcpu_system_time()Tim Deegan2013-08-201-1/+2
| | | | | | | | Clang points out that u64 stime variable is always >= 0. Signed-off-by: Tim Deegan <tim@xen.org> master commit: ab7f9a793c78dfea81c037b34b0dd2db7070d8f8 master date: 2013-08-15 13:17:10 +0200
* x86/MTRR: fix range check in mtrr_add_page()Jan Beulich2013-08-201-1/+1
| | | | | | | | | | | Extracted from Yinghai Lu's Linux commit d5c78673 ("x86: Fix /proc/mtrr with base/size more than 44bits"). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Keir Fraser <keir@xen.org> master commit: f67af6d5803b6a015e30cb490a94f9547cb0437c master date: 2013-08-14 11:20:26 +0200
* VT-d: protect against bogus information coming from BIOSJan Beulich2013-08-202-0/+6
| | | | | | | | | | | | | | | Add checks similar to those done by Linux: The DRHD address must not be all zeros or all ones (Linux only checks for zero), and capabilities as well as extended capabilities must not be all ones. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Ben Guthro <benjamin.guthro@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Tested-by: Ben Guthro <benjamin.guthro@citrix.com> Acked by: Yang Zhang <yang.z.zhang@intel.com> Acked-by: Xiantao Zhang <xiantao.zhang@intel.com> master commit: e8e8b030ecf916fea19639f0b6a446c1c9dbe174 master date: 2013-08-14 11:18:24 +0200
* x86/AMD: Inject #GP instead of #UD when unable to map vmcbSuravee Suthikulpanit2013-08-202-11/+15
| | | | | | | | | | | | According to AMD Programmer's Manual vol2, vmrun, vmsave and vmload should inject #GP instead of #UD when unable to access memory location for vmcb. Also, the code should make sure that L1 guest EFER.SVME is not zero. Otherwise, #UD should be injected. Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Reviewed-by: Tim Deegan <tim@xen.org> master commit: 910daaf5aaa837624099c0fc5c373bea7202ff43 master date: 2013-08-13 14:24:16 +0200
* x86/AMD: Fix nested svm crash due to assertion in __virt_to_maddrSuravee Suthikulpanit2013-08-202-13/+50
| | | | | | | | | | | Fix assertion in __virt_to_maddr when starting nested SVM guest in debug mode. Investigation has shown that svm_vmsave/svm_vmload make use of __pa() with invalid address. Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Reviewed-by: Tim Deegan <tim@xen.org> master commit: 85fc517ec3055e8e8d9c9e36e15a81e630237252 master date: 2013-08-13 14:22:14 +0200
* libelf: Fix typo in header guard macroPatrick Welche2013-08-201-2/+2
| | | | | | | | | | s/__LIBELF_PRIVATE_H_/__LIBELF_PRIVATE_H__/ Signed-off-by: Patrick Welche <prlw1@cam.ac.uk> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> master commit: 0aec8823501f8ee058c1ba673d2ac3e0f3f2e8db master date: 2013-08-08 12:47:38 +0100
* x86: explicit suffix in inline assembler (for clang).Tim Deegan2013-08-161-3/+3
| | | | | | | | | | | | | | | | This fixes the clang build, and has no effect on gcc's output. Signed-off-by: Tim Deegan <tim@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com> master commit: 59a28b5f045331641cbf0c1fc8d5d67afe328939 master date: 2013-02-14 14:20:06 +0100 Note that this isn't just a build fix - if the "delta" input in the 64-bit variant ends up in memory, gas would default to 32-bit operand size (and should really warn about the ambiguity). 32-bit portion contributed by NetBSD folks.
* VTD: Remove the check for reserved device scope typeYang Zhang2013-08-152-3/+8
| | | | | | | | | | | | | | | | Though we only have four valid types now, the new type may be added in future. It's better to remove the check and only deal with the type that we can recognize. Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com> Signed-off-by: Xiantao Zhang <xiantao.zhang@Intel.com> Acked-by: Keir Fraser <keir@xen.org> Add log message for this case. Signed-off-by: Jan Beulich <jbeulich@suse.com> master commit: 749bc93f7a1ad47640cc7876d27641e98a08bf61 master date: 2013-04-16 10:36:05 +0200
* Nested VMX: Flush TLBs and Caches if paging mode changedYang Zhang2013-08-081-0/+1
| | | | | | | | | | | According to SDM, if paging mode is changed, then whole TLBs and caches will be flushed. This is missed in nested handle logic. Also this fixed the issue that 64 bits windows cannot boot up on top of L1 kvm. Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com> Acked-by: Keir Fraser <keir@xen.org> master commit: e1ab5c77b44b7bd835a2c032fa4963b36545fdb3 master date: 2013-08-06 17:22:35 +0200
* x86: refine FPU selector handling code for XSAVEOPTJan Beulich2013-08-081-0/+25
| | | | | | | | | | | | Some extra tweaks are necessary to deal with the situation of XSAVEOPT not writing the FPU portion of the save image (due to it detecting that the register state did not get modified since the last XRSTOR). Signed-off-by: Jan Beulich <jbeulich@suse.com> Tested-by: Ben Guthro <ben.guthro@gmail.com> Acked-by: Keir Fraser <keir@xen.org> master commit: c58d9f2f4844c2ce8859a8d0f26a54cd058eb51f master date: 2013-08-05 18:42:37 +0200
* x86/time: Update wallclock in shared info when altering domain time offsetAndrew Cooper2013-08-081-0/+1
| | | | | | | | | | | | domain_set_time_offset() udpates d->time_offset_seconds, but does not correct the wallclock in the shared info, meaning that it is incorrect until the next XENPF_settime hypercall from dom0 which resynchronises the wallclock for all domains. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 915a59f25c5eddd86bc2cae6389d0ed2ab87e69e master date: 2013-07-18 09:16:15 +0200
* x86/cpuidle: Change logging for unknown APIC IDsAndrew Cooper2013-08-082-2/+5
| | | | | | | | | | | | | | | | | Dom0 uses this hypercall to pass ACPI information to Xen. It is not very uncommon for more cpus to be listed in the ACPI tables than are present on the system, particularly on systems with a common BIOS for a 2 and 4 socket server varients. As Dom0 does not control the number of entries in the ACPI tables, and is required to pass everything it finds to Xen, change the logging. There is now an single unconditional warning for the first unknown ID, and further warnings if "cpuinfo" is requested by the user on the command line. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> master commit: 85047d9e4f4afeb73bca1e98f705a2f4f1d51c03 master date: 2013-07-17 08:45:20 +0200
* adjust x86 EFI buildJan Beulich2013-08-081-1/+1
| | | | | | | | | | | | | | While the rule to generate .init.o files from .o ones already correctly included $(extra-y), the setting of the necessary compiler flag didn't have the same. With some yet to be posted patch this resulted in build breakage because of the compiler deciding not to inline a few functions (which then results in .text not being empty as required for these object files). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 5656b93d215d7c5160790ea87758625ba1de16b1 master date: 2013-07-10 10:03:40 +0200
* x86/mm: Ensure useful progress in alloc_l2_table()Andrew Cooper2013-08-081-1/+2
| | | | | | | | | | | | | | | | While debugging the issue which turned out to be XSA-58, a printk in this loop showed that it was quite easy to never make useful progress, because of consistently failing the preemption check. One single l2 entry is a reasonable amount of work to do, even if an action is pending, and also assures forwards progress across repeat continuations. Tweak the continuation criteria to fail on the first iteration of the loop. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Keir Fraser <keir@xen.org> master commit: d3a55d7d9bb518efe08143d050deff9f4ee80ec1 master date: 2013-07-04 10:33:18 +0200
* update Xen version to 4.2.3-rc14.2.3-rc1Ian Jackson2013-07-191-1/+1
|
* tools/debugger/kdd: Remove dependencies files during make cleanDaniel Kiper2013-07-171-1/+1
| | | | | | | | Remove dependencies files during make clean. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 38bdfb9197b93262248ff489eed336d80db52b54)
* tools/xenmon: Fix typo in MakefileDaniel Kiper2013-07-171-1/+1
| | | | | | Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit ea5e515ba19c423e15ca33023cd3c9d2c9aa807f)
* tools/xenstat/libxenstat: Remove src/libxenstat.a file during make cleanDaniel Kiper2013-07-171-1/+1
| | | | | | Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 03b90b005939416463c79a45d91729e8a00742fa)
* stubdom: Do not create dangling linksDaniel Kiper2013-07-171-5/+0
| | | | | | | | | There is not architecture dependent files in libxc hence do not create dangling links. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> (cherry picked from commit c2eea87c43d1617b2c15c57fce9a64a436679fca)
* docs: Remove tmp files during make cleanDaniel Kiper2013-07-171-1/+1
| | | | | | Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit e17295d050110bdbbe0ef19c6e977c8fef7557db)
* tools/libfsimage: Fix clean and distclean make targetsDaniel Kiper2013-07-172-3/+3
| | | | | | | | | | | | | | | | | If there is a single colon for a given target and the target is redefined in another place (e.g. in included file) then make executes only new target and displays following warning: Makefile:35: warning: overriding commands for target `clean' tools/libfsimage/common/../../../tools/libfsimage/Rules.mk:25: warning: ignoring old commands for target `clean' To cope with that issue define all required targets as double-colon rules. Additionally, remove some redundant stuff. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> (cherry picked from commit 667d8a84b244d02e9c6a2d02d6a02fc90c2efb4e)
* QEMU_TAG updateIan Jackson2013-07-171-3/+3
|
* pygrub/GrubConf: fix boot problem for fedora 19 grub.cfg (2nd attempt)Marcel J.E. Mol2013-07-171-0/+2
| | | | | | | | | | | | | | | | Booting a fedora 19 domU failed because a it could not properly parse the grub.cfg file. This was cased by set default="${next_entry}" This statement actually is within an 'if' statement, so maybe it would be better to skip code within if/fi blocks... But this patch seems to work fine. Signed-off-by: Marcel Mol <marcel@mesa.nl> Acked-by: Ian Campbell <ian.campbell@citix.com> Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> (cherry picked from commit d513814db6af2b298b8776d7ffc5fb1261e176f4)
* Fix issue with 'xl list -l' showing domids as -1 when using SXPIan Murray2013-07-121-1/+1
| | | | | | | | | | | | | | During investigation of other issues, it came to light that in at least 4.2.2, "xl list -l" displays domain ids as -1 when using SXP, irrespective of actual value. Ian C identified that this issue was likely fixed in the upcoming 4.3 release but the commit responsible for the fix (a73a7a0c647a9a5e30d8bc473c0a1e8648817183) was not likely a candidate for backporting in its entirety. Therefore, this patch is just an isolation of the hunk to fix the above issue. Original Commit Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Backport Created-by: Ian Murray <murrayie@yahoo.co.uk>
* libxl_json: Fix backport of JSON_BOOL to 4.2.2Don Slutz2013-07-121-0/+1
| | | | | | | | | | | | | | git commit 2b3072ed0cbeed8c0385f20e92ba0f1201db8a17 ('libxl_json: Replace JSON_TRUE/FALSE by JSON_BOOL.') has the setting of obj->u.b git commit 6a2aca9fdef0499e613715baf107f2296b9007cf ('libxl_json: Replace JSON_TRUE/FALSE by JSON_BOOL.') does not. This shows up by vnc-port and vnc-listen are missing in xenstore when they should not be. Signed-off-by: Don Slutz <dslutz@verizon.com> Acked-By: Alex Bligh <alex@alex.org.uk>
* iommu/amd: Workaround for erratum 787Suravee Suthikulpanit2013-07-111-0/+16
| | | | | | | | | | | | | | | | | | | | | | | The IOMMU interrupt handling in bottom half must clear the PPR log interrupt and event log interrupt bits to re-enable the interrupt. This is done by writing 1 to the memory mapped register to clear the bit. Due to hardware bug, if the driver tries to clear this bit while the IOMMU hardware also setting this bit, the conflict will result with the bit being set. If the interrupt handling code does not make sure to clear this bit, subsequent changes in the event/PPR logs will no longer generating interrupts, and would result if buffer overflow. After clearing the bits, the driver must read back the register to verify. Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Adjust to apply on top of heavily modified patch 1. Adjust flow to get away with a single readl() in each instance of the status register checks. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org> Acked-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> master commit: 9eabb0735400e2b6059dfa3f0b47a426f61f570a master date: 2013-07-02 08:50:41 +0200
* iommu/amd: Fix logic for clearing the IOMMU interrupt bitsSuravee Suthikulpanit2013-07-114-45/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IOMMU interrupt bits in the IOMMU status registers are "read-only, and write-1-to-clear (RW1C). Therefore, the existing logic which reads the register, set the bit, and then writing back the values could accidentally clear certain bits if it has been set. The correct logic would just be writing only the value which only set the interrupt bits, and leave the rest to zeros. This patch also, clean up #define masks as Jan has suggested. Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> With iommu_interrupt_handler() properly having got switched its readl() from status to control register, the subsequent writel() needed to be switched too (and the RW1C comment there was bogus). Some of the cleanup went too far - undone. Further, with iommu_interrupt_handler() now actually disabling the interrupt sources, they also need to get re-enabled by the tasklet once it finished processing the respective log. This also implies re-running the tasklet so that log entries added between reading the log and re- enabling the interrupt will get handled in a timely manner. Finally, guest write emulation to the status register needs to be done with the RW1C (and RO for all other bits) semantics in mind too. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org> Acked-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> master commit: 2823a0c7dfc979db316787e1dd42a8845e5825c0 master date: 2013-07-02 08:49:43 +0200
* x86: don't pass negative time to gtime_to_gtsc() (try 2)Jan Beulich2013-07-111-9/+6
| | | | | | | | | | | | | | | | | This mostly reverts commit eb60be3d ("x86: don't pass negative time to gtime_to_gtsc()") and instead corrects __update_vcpu_system_time()'s handling of this_cpu(cpu_time).stime_local_stamp dating back before the start of a HVM guest (which would otherwise lead to a negative value getting passed to gtime_to_gtsc(), causing scale_delta() to produce meaningless output). Flushing the value to zero was wrong, and printing a message for something that can validly happen wasn't very useful either. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 5ad914bc867c5a6a4957869c89918f4e1f9dd9c4 master date: 2013-07-02 08:48:03 +0200
* AMD/intremap: Prevent use of per-device vector maps until irq logic is fixedAndrew Cooper2013-07-111-2/+17
| | | | | | | | | | | | | | | | | | | | | | | XSA-36 changed the default vector map mode from global to per-device. This is because a global vector map does not prevent one PCI device from impersonating another and launching a DoS on the system. However, the per-device vector map logic is broken for devices with multiple MSI-X vectors, which can either result in a failed ASSERT() or misprogramming of a guests interrupt remapping tables. The core problem is not trivial to fix. In an effort to get AMD systems back to a non-regressed state, introduce a new type of vector map called per-device-global. This uses per-device vector maps in the IOMMU, but uses a single used_vector map for the core IRQ logic. This patch is intended to be removed as soon as the per-device logic is fixed correctly. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> master commit: f0fe8227624d5c02715ed086867d12cd24f6ff47 master date: 2013-06-27 14:01:18 +0200
* libelf: fix printing of pointersJan Beulich2013-07-111-4/+4
| | | | | | | | | Printing them as decimal number, the more with 0x prefix, is confusing and presumably relatively useless to most of us. Signed-off-by: Jan Beulich <jbeulich@suse.com> master commit: 59912eb06fda88af6c5ec16a2a382619d3829a7b master date: 2013-06-26 14:43:52 +0100
* libxl: suppress device assignment to HVM guest when there is no IOMMUJan Beulich2013-07-091-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | This in effect copies similar logic from xend: While there's no way to check whether a device is assigned to a particular guest, XEN_DOMCTL_test_assign_device at least allows checking whether an IOMMU is there and whether a device has been assign to _some_ guest. For the time being, this should be enough to cover for the missing error checking/recovery in other parts of libxl's device assignment paths. There remains a (functionality-, but not security-related) race in that the iommu should be set up earlier, but this is too risky a change for this stage of the 4.3 release. This is a security issue, XSA-61. Signed-off-by: Jan Beulich <jbeulich@suse.com> Tested-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> master commit: 826eb17271d3c647516d9944c47b0779afedea25 master date: 2013-07-01 15:20:28 +0100
* Revert "hvmloader: always include HPET table"Jan Beulich2013-07-081-5/+7
| | | | | | | | | | | | This reverts commit e4fd0475a08fda414da27c4e57b568f147cfc07e. Conflicts: tools/firmware/hvmloader/acpi/build.c Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir.xen@gmail.com> master commit: 4867685f7916bb594a67f2f64a28bbf5ecb4949c master date: 2013-07-08 13:20:20 +0200
* also override library path for hotplug scriptsJan Beulich2013-07-011-0/+1
| | | | | | | | | | | Overriding PATH but not LD_LIBRARY_PATH is bogus, as it may result in the use of mismatched binaries and libraries. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> master commit: d0f535e9af564642250badf1fa300725ef996616 master date: 2013-06-26 18:06:24 +0200
* x86/hvm: fix HVMOP_inject_trap return value on successTim Deegan2013-07-011-0/+1
| | | | | | | | | Reported-by: Antony Saba <Antony.Saba@mandiant.com> Signed-off-by: Tim Deegan <tim@xen.org> Acked-by: Keir Fraser <keir@xen.org> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> master commit: a12d15d8c1d512a4ed6498b39f9058f69a1c1f6c master date: 2013-06-21 17:01:50 +0200
* x86/HVM: fix initialization of wallclock time for PVHVM on migrationRoger Pau Monné2013-07-011-19/+14
| | | | | | | | | | | | | | | | | Call update_domain_wallclock_time on hvm_latch_shinfo_size even if the bitness of the guest has already been set, this fixes the problem with the wallclock not being set for PVHVM guests on resume from migration. Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Clean up the resulting code and retain the (slightly adjusted) original comment. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: f8e8fd56bd7d5675e8331b4ec74bae76c9dbf24e master date: 2013-06-12 10:05:39 +0200
* x86/HVM: fix x2APIC APIC_ID read emulationZhenguo Wang2013-07-011-3/+20
| | | | | | | | | | | | | | | | | | | | APIC and x2APIC have different format for APIC_ID register. Need translation. Signed-off-by: Zhenguo Wang <wangzhenguo@huawei.com> Signed-off-by: Xiaowei Yang <xiaowei.yang@huawei.com> Convert code to use switch(), fixing coding style issue at once, and use GET_xAPIC_ID() on the value read instead of VLAPIC_ID() (reading the field again). In the course of this also properly reject both read and writes on the non-existing MSR corresponding to APIC_ICR2. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> master commit: 6859874b61d5ddaf5289e72ed2b2157739b72ca5 master date: 2013-06-11 09:45:55 +0200
* Revert "irq: Add extra debugging to help track down why an assertion is failing"Jan Beulich2013-07-011-15/+1
| | | | | | | | | | | | | | | This reverts commits 2ae8b9173fb2388af6514c730d620ed5f450bc34 and 98e10364bde098e12104caa4f566b17d05f8b791. This was never reported to be hit, and we assume to have taken care of the problem by excluding legacy IRQs from the IRQ move cleanup logic. Suggested-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> master commit: ac9e298cb4bda0238f50da814b8af2b90dc758a1 master date: 2013-06-10 13:43:03 +0200
* libxl: Restrict permissions on PV console device xenstore nodesIan Jackson2013-06-276-40/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matthew Daley has observed that the PV console protocol places sensitive host state into a guest writeable xenstore locations, this includes: - The pty used to communicate between the console backend daemon and its client, allowing the guest administrator to read and write arbitrary host files. - The output file, allowing the guest administrator to write arbitrary host files or to target arbitrary qemu chardevs which include sockets, udp, ptr, pipes etc (see -chardev in qemu(1) for a more complete list). - The maximum buffer size, allowing the guest administrator to consume more resources than the host administrator has configured. - The backend to use (qemu vs xenconsoled), potentially allowing the guest administrator to confuse host software. So we arrange to make the sensitive keys in the xenstore frontend directory read only for the guest. This is safe since the xenstore permissions model, unlike POSIX directory permissions, does not allow the guest to remove and recreate a node if it has write access to the containing directory. There are a few associated wrinkles: - The primary PV console is "special". It's xenstore node is not under the usual /devices/ subtree and it does not use the customary xenstore state machine protocol. Unfortunately its directory is used for other things, including the vnc-port node, which we do not want the guest to be able to write to. Rather than trying to track down all the possible secondary uses of this directory just make it r/o to the guest. All newly created subdirectories inherit these permissions and so are now safe by default. - The other serial consoles do use the customary xenstore state machine and therefore need write access to at least the "protocol" and "state" nodes, however they may also want to use arbitrary "feature-foo" nodes (although I'm not aware of any) and therefore we cannot simply lock down the entire frontend directory. Instead we add support to libxl__device_generic_add for frontend keys which are explicitly read only and use that to lock down the sensitive keys. - Minios' console frontend wants to write the "type" node, which it has no business doing since this is a host/toolstack level decision. This fails now that the node has become read only to the PV guest. Since the toolstack already writes this node just remove the attempt to set it. This is CVE-2013-2211 / XSA-57 Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Conflicts: tools/libxl/libxl.c (no vtpm, free front_ro on error in libxl__device_console_add)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 10:55:26 +0000