aboutsummaryrefslogtreecommitdiffstats
path: root/tools
Commit message (Collapse)AuthorAgeFilesLines
* oxenstored: Fix process.ml build after 070ab4c50593Ian Jackson2013-09-091-2/+2
| | | | | | | | | | | | | | | | | This change: 070ab4c505934951f86f42dd8403cf62bc5822f0 "oxenstored: Protect oxenstored from malicious domains" broke the build because it had an unresolved semantic (but not textual) conflict with c69fddbd5dfa3004aaf2d0f2dde00c9ec3dd6d5d "tools/ocaml: Remove log library from tools/ocaml/libs" (which is in 4.2 but not 4.1) Fix this by using the 4.1.x idiom in the new error handling introduced in 070ab4c50593. Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com> Acked-by: David Scott <dave.scott@eu.citrix.com>
* pygrub: add Debian extlinux.conf pathIan Jackson2013-09-031-0/+1
| | | | | | | | | | | | | | This is Debian bug #697407. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697407 Signed-off-by: Ian Campbell <ijc@hellion.org.uk> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 258d27a1d9fb33a490bef1381f52d522225c3dca) Conflicts: tools/pygrub/src/pygrub Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* oxenstored: Protect oxenstored from malicious domains.Ian Jackson2013-09-035-6/+31
| | | | | | | | | | | | | | | | | | | | | | | add check logic when read from IO ring, and if error happens, then mark the reading connection as "bad", Unless vm reboot, oxenstored will not handle message from this connection any more. xs_ring_stubs.c: add a more strict check on ring reading connection.ml, domain.ml: add getter and setter for bad flag process.ml: if exception raised when reading from domain's ring, mark this domain as "bad" xenstored.ml: if a domain is marked as "bad", do not handle it. Signed-off-by: John Liu <john.liuqiming@huawei.com> Acked-by: David Scott <dave.scott@eu.citrix.com> (cherry picked from commit 704302ce9404c73cfb687d31adcf67094ab5bb53) (cherry picked from commit a978634bee4db6c5e0ceeb66adcc5114f3f9bc48) Conflicts: tools/ocaml/xenstored/domain.ml Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 9f93027afd796a98d7b92898f4ccc772796a4874)
* tools/debugger/kdd: Remove dependencies files during make cleanDaniel Kiper2013-07-171-1/+1
| | | | | | | | Remove dependencies files during make clean. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> (cherry picked from commit 38bdfb9197b93262248ff489eed336d80db52b54)
* tools/libfsimage: Fix clean and distclean make targetsDaniel Kiper2013-07-172-3/+3
| | | | | | | | | | | | | | | | | If there is a single colon for a given target and the target is redefined in another place (e.g. in included file) then make executes only new target and displays following warning: Makefile:35: warning: overriding commands for target `clean' tools/libfsimage/common/../../../tools/libfsimage/Rules.mk:25: warning: ignoring old commands for target `clean' To cope with that issue define all required targets as double-colon rules. Additionally, remove some redundant stuff. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> (cherry picked from commit 667d8a84b244d02e9c6a2d02d6a02fc90c2efb4e)
* pygrub/GrubConf: fix boot problem for fedora 19 grub.cfg (2nd attempt)Marcel J.E. Mol2013-07-171-0/+2
| | | | | | | | | | | | | | | | Booting a fedora 19 domU failed because a it could not properly parse the grub.cfg file. This was cased by set default="${next_entry}" This statement actually is within an 'if' statement, so maybe it would be better to skip code within if/fi blocks... But this patch seems to work fine. Signed-off-by: Marcel Mol <marcel@mesa.nl> Acked-by: Ian Campbell <ian.campbell@citix.com> Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> (cherry picked from commit d513814db6af2b298b8776d7ffc5fb1261e176f4)
* libxl: suppress device assignment to HVM guest when there is no IOMMUJan Beulich2013-07-091-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | This in effect copies similar logic from xend: While there's no way to check whether a device is assigned to a particular guest, XEN_DOMCTL_test_assign_device at least allows checking whether an IOMMU is there and whether a device has been assign to _some_ guest. For the time being, this should be enough to cover for the missing error checking/recovery in other parts of libxl's device assignment paths. There remains a (functionality-, but not security-related) race in that the iommu should be set up earlier, but this is too risky a change for this stage of the 4.3 release. This is a security issue, XSA-61. Signed-off-by: Jan Beulich <jbeulich@suse.com> Tested-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> master commit: 826eb17271d3c647516d9944c47b0779afedea25 master date: 2013-07-01 15:20:28 +0100 master commit: 826eb17271d3c647516d9944c47b0779afedea25 master date: 2013-07-01 15:20:28 +0100
* libxl: Restrict permissions on PV console device xenstore nodesIan Jackson2013-06-275-37/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matthew Daley has observed that the PV console protocol places sensitive host state into a guest writeable xenstore locations, this includes: - The pty used to communicate between the console backend daemon and its client, allowing the guest administrator to read and write arbitrary host files. - The output file, allowing the guest administrator to write arbitrary host files or to target arbitrary qemu chardevs which include sockets, udp, ptr, pipes etc (see -chardev in qemu(1) for a more complete list). - The maximum buffer size, allowing the guest administrator to consume more resources than the host administrator has configured. - The backend to use (qemu vs xenconsoled), potentially allowing the guest administrator to confuse host software. So we arrange to make the sensitive keys in the xenstore frontend directory read only for the guest. This is safe since the xenstore permissions model, unlike POSIX directory permissions, does not allow the guest to remove and recreate a node if it has write access to the containing directory. There are a few associated wrinkles: - The primary PV console is "special". It's xenstore node is not under the usual /devices/ subtree and it does not use the customary xenstore state machine protocol. Unfortunately its directory is used for other things, including the vnc-port node, which we do not want the guest to be able to write to. Rather than trying to track down all the possible secondary uses of this directory just make it r/o to the guest. All newly created subdirectories inherit these permissions and so are now safe by default. - The other serial consoles do use the customary xenstore state machine and therefore need write access to at least the "protocol" and "state" nodes, however they may also want to use arbitrary "feature-foo" nodes (although I'm not aware of any) and therefore we cannot simply lock down the entire frontend directory. Instead we add support to libxl__device_generic_add for frontend keys which are explicitly read only and use that to lock down the sensitive keys. - Minios' console frontend wants to write the "type" node, which it has no business doing since this is a host/toolstack level decision. This fails now that the node has become read only to the PV guest. Since the toolstack already writes this node just remove the attempt to set it. This is CVE-2013-2211 / XSA-57 Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Conflicts (4.2 backport): tools/libxl/libxl.c (no vtpm, free front_ro on error in libxl__device_console_add) Conflicts (4.1 backport): extras/mini-os/console/xenbus.c tools/libxl/libxl.c tools/libxl/libxl_device.c tools/libxl/libxl_internal.h tools/libxl/libxl_pci.c tools/libxl/libxl_xshelp.c - minios code was in xencons_ring.c - many places need &gc not just gc - libxl__xs_writev path is not const - varios minor context fixups
* libxc: check blob size before proceeding in xc_dom_check_gzipMatthew Daley2013-06-141-0/+5
| | | | | | This is part of the fix to a security issue, XSA-55. Signed-off-by: Matthew Daley <mattjd@gmail.com>
* libxc: range checks in xc_dom_p2m_host and _guestIan Jackson2013-06-141-0/+4
| | | | | | | | | | | | | | | | These functions take guest pfns and look them up in the p2m. They did no range checking. However, some callers, notably xc_dom_boot.c:setup_hypercall_page want to pass untrusted guest-supplied value(s). It is most convenient to detect this here and return INVALID_MFN. This is part of the fix to a security issue, XSA-55. Changes from Xen 4.2 version of this patch: * 4.2 lacks dom->rambase_pfn, so don't add/subtract/check it. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxc: check return values from mallocIan Jackson2013-06-1410-3/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A sufficiently malformed input to libxc (such as a malformed input ELF or other guest-controlled data) might cause one of libxc's malloc() to fail. In this case we need to make sure we don't dereference or do pointer arithmetic on the result. Search for all occurrences of \b(m|c|re)alloc in libxc, and all functions which call them, and add appropriate error checking where missing. This includes the functions xc_dom_malloc*, which now print a message when they fail so that callers don't have to do so. The function xc_cpuid_to_str wasn't provided with a sane return value and has a pretty strange API, which now becomes a little stranger. There are no in-tree callers. Changes in the Xen 4.2 version of this series: * No need to fix code relating to ARM. * No need to fix code relating to superpage support. * Additionally fix `dom->p2m_host = xc_dom_malloc...' in xc_dom_ia64.c. Changes in the Xen 4.1 version of this series: * An additional check is needed in xc_flask.c:xc_flask_access. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxc: check failure of xc_dom_*_to_ptr, xc_map_foreign_rangeIan Jackson2013-06-148-0/+113
| | | | | | | | | | | | | | | | | | | | | The return values from xc_dom_*_to_ptr and xc_map_foreign_range are sometimes dereferenced, or subjected to pointer arithmetic, without checking whether the relevant function failed and returned NULL. Add an appropriate error check at every call site. Changes in the 4.2 backport of this series: * Fix tools/libxc/xc_dom_x86.c:setup_pgtables_x86_32. * Fix tools/libxc/xc_dom_ia64.c:start_info_ia64. * Fix tools/libxc/ia64/xc_ia64_dom_fwloader.c:xc_dom_load_fw_kernel. Conflicts in the 4.1 backport of this series: * xc_dom_load_elf_kernel has less error handling in 4.1. * the VM generation ID code is not in 4.1. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxc: Add range checking to xc_dom_binloaderIan Jackson2013-06-141-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | This is a simple binary image loader with its own metadata format. However, it is too careless with image-supplied values. Add the following checks: * That the image is bigger than the metadata table; otherwise the pointer arithmetic to calculate the metadata table location may yield undefined and dangerous values. * When clamping the end of the region to search, that we do not calculate pointers beyond the end of the image. The C specification does not permit this and compilers are becoming ever more determined to miscompile code when they can "prove" various falsehoods based on assertions from the C spec. * That the supplied image is big enough for the text we are allegedly copying from it. Otherwise we might have a read overrun and copy the results (perhaps a lot of secret data) into the guest. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: abolish obsolete macrosIan Jackson2013-06-142-5/+5
| | | | | | | | | | | | | | | | | Abolish ELF_PTRVAL_[CONST_]{CHAR,VOID}; change uses to elf_ptrval. Abolish ELF_HANDLE_DECL_NONCONST; change uses to ELF_HANDLE_DECL. Abolish ELF_OBSOLETE_VOIDP_CAST; simply remove all uses. No functional change. (Verified by diffing assembler output.) This is part of the fix to a security issue, XSA-55. Conflicts in the 4.1 backport: * elf_load_image is not in 4.1. * elf_note_numeric_array is not in 4.1. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
* libelf: check loops for running awayIan Jackson2013-06-141-9/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that libelf does not have any loops which can run away indefinitely even if the input is bogus. (Grepped for \bfor, \bwhile and \bgoto in libelf and xc_dom_*loader*.c.) Changes needed: * elf_note_next uses the note's unchecked alleged length, which might wrap round. If it does, return ELF_MAX_PTRVAL (0xfff..fff) instead, which will be beyond the end of the section and so terminate the caller's loop. * In various loops over section and program headers, check that the calculated header pointer is still within the image, and quit the loop if it isn't. We have not changed loops which might, in principle, iterate over the whole image - even if they might do so one byte at a time with a nontrivial access check function in the middle. This is part of the fix to a security issue, XSA-55. Conflicts in Xen 4.1 version of the series: * Trivial conflict due to elf_note_numeric_array not existing. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxc: Introduce xc_bitops.hIan Jackson2013-06-141-0/+63
| | | | | | | | | | | | | | | | | Copy the one file tools/libxc/xc_bitops.h from xen.git#aa1355f9. We will need this for the next patch, which calls for a bitmap in libxc. xc_bitops.h was introduced to unify various existing sets of bitmap operations. In this patch we backport only the introduction, not the replacement of the other instances. So we introduce another instance Sorry :-/. This is part of the fix to a security issue, XSA-55. This patch is unique to the Xen 4.1 version of the XSA-55 series. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: use only unsigned integersIan Jackson2013-06-144-30/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed integers have undesirable undefined behaviours on overflow. Malicious compilers can turn apparently-correct code into code with security vulnerabilities etc. So use only unsigned integers. Exceptions are booleans (which we have already changed) and error codes. We _do_ change all the chars which aren't fixed constants from our own text segment, but not the char*s. This is because it is safe to access an arbitrary byte through a char*, but not necessarily safe to convert an arbitrary value to a char. As a consequence we need to compile libelf with -Wno-pointer-sign. It is OK to change all the signed integers to unsigned because all the inequalities in libelf are in contexts where we don't "expect" negative numbers. In libelf-dominfo.c:elf_xen_parse we rename a variable "rc" to "more_notes" as it actually contains a note count derived from the input image. The "error" return value from elf_xen_parse_notes is changed from -1 to ~0U. grepping shows only one occurrence of "PRId" or "%d" or "%ld" in libelf and xc_dom_elfloader.c (a "%d" which becomes "%u"). This is part of the fix to a security issue, XSA-55. Conflicts in 4.1 series: * xc_dom_load_elf_kernel has no rc variable to change. * elf_load_image doesn't exist. For those concerned about unintentional functional changes, the following rune produces a version of the patch which is much smaller and eliminates only non-functional changes: GIT_EXTERNAL_DIFF=.../unsigned-differ git-diff <before>..<after> where <before> and <after> are git refs for the code before and after this patch, and unsigned-differ is this shell script: #!/bin/bash set -e seddery () { perl -pe 's/\b(?:elf_errorstatus|elf_negerrnoval)\b/int/g' } path="$1" in="$2" out="$5" set +e diff -pu --label "$path~" <(seddery <"$in") --label "$path" <(seddery <"$out") rc=$? set -e if [ $rc = 1 ]; then rc=0; fi exit $rc Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: use C99 bool for booleansIan Jackson2013-06-141-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We want to remove uses of "int" because signed integers have undesirable undefined behaviours on overflow. Malicious compilers can turn apparently-correct code into code with security vulnerabilities etc. In this patch we change all the booleans in libelf to C99 bool, from <stdbool.h>. For the one visible libelf boolean in libxc's public interface we retain the use of int to avoid changing the ABI; libxc converts it to a bool for consumption by libelf. It is OK to change all values only ever used as booleans to _Bool (bool) because conversion from any scalar type to a _Bool works the same as the boolean test in if() or ?: and is always defined (C99 6.3.1.2). But we do need to check that all these variables really are only ever used that way. (It is theoretically possible that the old code truncated some 64-bit values to 32-bit ints which might become zero depending on the value, which would mean a behavioural change in this patch, but it seems implausible that treating 0x????????00000000 as false could have been intended.) This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: Make all callers call elf_check_brokenIan Jackson2013-06-143-3/+27
| | | | | | | | | | | | | | | | | | | | | | | This arranges that if the new pointer reference error checking tripped, we actually get a message about it. In this patch these messages do not change the actual return values from the various functions: so pointer reference errors do not prevent loading. This is for fear that some existing kernels might cause the code to make these wild references, which would then break, which is not a good thing in a security patch. In xen/arch/x86/domain_build.c we have to introduce an "out" label and change all of the "return rc" beyond the relevant point into "goto out". This is part of the fix to a security issue, XSA-55. Differences in 4.1 backport: * No xen/arch/arm. * There was less error handling in xen/arch/x86/domain_build.c so less need to change it. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: Check pointer references in elf_is_elfbinaryIan Jackson2013-06-141-1/+1
| | | | | | | | | | | | | | | | | | | elf_is_elfbinary didn't take a length parameter and could potentially access out of range when provided with a very short image. We only need to check the size is enough for the actual dereference in elf_is_elfbinary; callers are just using it to check the magic number and do their own checks (usually via the new elf_ptrval system) before dereferencing other parts of the header. This is part of the fix to a security issue, XSA-55. Conflicts in 4.1 backport: * xen/arch/x86/bzimage.c in 4.1 doesn't use elf_is_elfbinary. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
* libelf: check all pointer accessesIan Jackson2013-06-142-11/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We change the ELF_PTRVAL and ELF_HANDLE types and associated macros: * PTRVAL becomes a uintptr_t, for which we provide a typedef elf_ptrval. This means no arithmetic done on it can overflow so the compiler cannot do any malicious invalid pointer arithmetic "optimisations". It also means that any places where we dereference one of these pointers without using the appropriate macros or functions become a compilation error. So we can be sure that we won't miss any memory accesses. All the PTRVAL variables were previously void* or char*, so the actual address calculations are unchanged. * ELF_HANDLE becomes a union, one half of which keeps the pointer value and the other half of which is just there to record the type. The new type is not a pointer type so there can be no address calculations on it whose meaning would change. Every assignment or access has to go through one of our macros. * The distinction between const and non-const pointers and char*s and void*s in libelf goes away. This was not important (and anyway libelf tended to cast away const in various places). * The fields elf->image and elf->dest are renamed. That proves that we haven't missed any unchecked uses of these actual pointer values. * The caller may fill in elf->caller_xdest_base and _size to specify another range of memory which is safe for libelf to access, besides the input and output images. * When accesses fail due to being out of range, we mark the elf "broken". This will be checked and used for diagnostics in a following patch. We do not check for write accesses to the input image. This is because libelf actually does this in a number of places. So we simply permit that. * Each caller of libelf which used to set dest now sets dest_base and dest_size. * In xc_dom_load_elf_symtab we provide a new actual-pointer value hdr_ptr which we get from mapping the guest's kernel area and use (checking carefully) as the caller_xdest area. * The STAR(h) macro in libelf-dominfo.c now uses elf_access_unsigned. * elf-init uses the new elf_uval_3264 accessor to access the 32-bit fields, rather than an unchecked field access (ie, unchecked pointer access). * elf_uval has been reworked to use elf_uval_3264. Both of these macros are essentially new in this patch (although they are derived from the old elf_uval) and need careful review. * ELF_ADVANCE_DEST is now safe in the sense that you can use it to chop parts off the front of the dest area but if you chop more than is available, the dest area is simply set to be empty, preventing future accesses. * We introduce some #defines for memcpy, memset, memmove and strcpy: - We provide elf_memcpy_safe and elf_memset_safe which take PTRVALs and do checking on the supplied pointers. - Users inside libelf must all be changed to either elf_mem*_unchecked (which are just like mem*), or elf_mem*_safe (which take PTRVALs) and are checked. Any unchanged call sites become compilation errors. * We do _not_ at this time fix elf_access_unsigned so that it doesn't make unaligned accesses. We hope that unaligned accesses are OK on every supported architecture. But it does check the supplied pointer for validity. This is part of the fix to a security issue, XSA-55. Additional change in 4.1 backport: * ELF_PRPTRVAL needs to be defined oddly on 4.1 and earlier because Xen's headers provide no definitions of uintptr_t or PRIuPTR. Conflicts: * Callers of elf_load_binary don't check its return value in 4.1. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libelf: check nul-terminated strings properlyIan Jackson2013-06-141-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not safe to simply take pointers into the ELF and use them as C pointers. They might not be properly nul-terminated (and the pointers might be wild). So we are going to introduce a new function elf_strval for safely getting strings. This will check that the addresses are in range and that there is a proper nul-terminated string. Of course it might discover that there isn't. In that case, it will be made to fail. This means that elf_note_name might fail, too. For the benefit of call sites which are just going to pass the value to a printf-like function, we provide elf_strfmt which returns "(invalid)" on failure rather than NULL. In this patch we introduce dummy definitions of these functions. We introduce calls to elf_strval and elf_strfmt everywhere, and update all the call sites with appropriate error checking. There is not yet any semantic change, since before this patch all the places where we introduce elf_strval dereferenced the value anyway, so it mustn't have been NULL. In future patches, when elf_strval is made able return NULL, when it does so it will mark the elf "broken" so that an appropriate diagnostic can be printed. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
* tools/xcutils/readnotes: adjust print_l1_mfn_valid_noteIan Jackson2013-06-141-5/+6
| | | | | | | | | | | | | | | | Use the new PTRVAL macros and elf_access_unsigned in print_l1_mfn_valid_note. No functional change unless the input is wrong, or we are reading a file for a different endianness. Separated out from the previous patch because this change does produce a difference in the generated code. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
* libelf: introduce macros for memory access and pointer handlingIan Jackson2013-06-142-28/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We introduce a collection of macros which abstract away all the pointer arithmetic and dereferences used for accessing the input ELF and the output area(s). We use the new macros everywhere. For now, these macros are semantically identical to the code they replace, so this patch has no functional change. elf_is_elfbinary is an exception: since it doesn't take an elf*, we need to handle it differently. In a future patch we will change it to take, and check, a length parameter. For now we just mark it with a fixme. Nontrivial differences in the 4.1 backport: * We need to provide our own elf_uintptr_t since Xen doesn't. * We see some additional differences in our verification diff. * The "function-filter" needs to massage additional symbol names. Conflicts: * In xc_dom_load_elf_symtab the old code used *(Elf64_Word*)(&shdr->e64.sh_name) and the new Elf32_Word but in fact the type in the struct has changed too so the new code using elf_store_field is still correct. * loadelfimage, elf_load_image etc. don't exist and are done directly with memcpy/memset; patch adjusted appropriately. * elf_note_numeric_array doesn't exist in 4.1. That this patch has no functional change can be verified as follows: 0. Copy the scripts "comparison-generate" and "function-filter" out of this commit message. 1. Check out the tree before this patch. 2. Run the script ../comparison-generate .... ../before 3. Check out the tree after this patch. 4. Run the script ../comparison-generate .... ../after 5. diff --exclude=\*.[soi] -ruN before/ after/ |less Expect these differences: * stubdom/zlib-x86_64/ztest*.s2 The filename of this test file apparently contains the pid. * stubdom/grub/kexec.s2: Large differences following ".section .debug_info" (which the 4.1 build system erroneously fails to suppress). * tools/libxc/xc_domain_restore.s2 (64-bit build): One trivial code gen difference with no semantic import. * xen/common/version.s2 The xen build timestamp appears in two diff hunks. Verification that this is all that's needed: In a completely built xen.git, find * -name .*.d -type f | xargs grep -l libelf\.h Expect results in: xen/arch/x86: Checked above. tools/libxc: Checked above. tools/xcutils/readnotes: Checked above. tools/xenstore: Checked above. xen/common/libelf: This is the build for the hypervisor; checked in B above. stubdom: We have one stubdom which reads ELFs using our libelf, pvgrub, which is checked above. I have not done this verification for ARM. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -8<- comparison-generate -8<- #!/bin/bash # usage: # cd xen.git # .../comparison-generate OUR-CONFIG BUILD-RUNE-PREFIX ../before|../after # eg: # .../comparison-generate ~/work/.config 'schroot -pc64 --' ../before set -ex test $# = 3 || need-exactly-three-arguments our_config=$1 build_rune_prefix=$2 result_dir=$3 git clean -x -d -f cp "$our_config" . cat <<END >>.config debug_symbols=n CFLAGS += -save-temps END perl -i~ -pe 's/ -g / -g0 / if m/^CFLAGS/' xen/Rules.mk if [ -f ./configure ]; then $build_rune_prefix ./configure fi $build_rune_prefix make -C xen $build_rune_prefix make -C tools/include $build_rune_prefix make -C stubdom grub $build_rune_prefix make -C tools/libxc $build_rune_prefix make -C tools/xenstore $build_rune_prefix make -C tools/xcutils rm -rf "$result_dir" mkdir "$result_dir" set +x for f in `find xen tools stubdom -name \*.[soi]`; do mkdir -p "$result_dir"/`dirname $f` cp $f "$result_dir"/${f} case $f in *.s) ../function-filter <$f >"$result_dir"/${f}2 ;; esac done echo ok. -8<- -8<- function-filter -8<- #!/usr/bin/perl -w # function-filter # script for massaging gcc-generated labels to be consistent use strict; our @lines; my $sedderybody = "sub seddery () {\n"; while (<>) { push @lines, $_; if (m/^(__FUNCTION__|__func__|_ctx|note_desc|types|last_order|memflags|mutex|d\d_cpu_last|write_count|wall_last|__PRETTY_FUNCTION__)\.(\d+)\:/ || m/^\s+\.local\s+(_ctx|write_count|d\d_cpu_last|wall_last|mutex)\.(\d+)\s*$/) { $sedderybody .= " s/\\b$1\\.$2\\b/__XSA55MANGLED__$1.$./g;\n"; } } $sedderybody .= "}\n1;\n"; eval $sedderybody or die $@; foreach (@lines) { seddery(); print or die $!; } -8<-
* libelf/xc_dom_load_elf_symtab: Do not use "syms" uninitialisedIan Jackson2013-06-141-1/+1
| | | | | | | | | | | | | | | | | | | xc_dom_load_elf_symtab (with load==0) calls elf_round_up, but it mistakenly used the uninitialised variable "syms" when calculating dom->bsd_symtab_start. This should be a reference to "elf". This change might have the effect of rounding the value differently. Previously if the uninitialised value (a single byte on the stack) was ELFCLASS64 (ie, 2), the alignment would be to 8 bytes, otherwise to 4. However, the value is calculated from dom->kernel_seg.vend so this could only make a difference if that value wasn't already aligned to 8 bytes. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
* libxc: Fix range checking in xc_dom_pfn_to_ptr etc.Ian Jackson2013-06-144-5/+38
| | | | | | | | | | | | | | | | | | | | * Ensure that xc_dom_pfn_to_ptr (when called with count==0) does not return a previously-allocated block which is entirely before the requested pfn (!) * Provide a version of xc_dom_pfn_to_ptr, xc_dom_pfn_to_ptr_retcount, which provides the length of the mapped region via an out parameter. * Change xc_dom_vaddr_to_ptr to always provide the length of the mapped region and change the call site in xc_dom_binloader.c to check it. The call site in xc_dom_load_elf_symtab will be corrected in a forthcoming patch, and for now ignores the returned length. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> v5: This patch is new in v5 of the series.
* libxc: introduce xc_dom_seg_to_ptr_pagesIan Jackson2013-06-141-3/+16
| | | | | | | | | | | | Provide a version of xc_dom_seg_to_ptr which returns the number of guest pages it has actually mapped. This is useful for callers who want to do range checking; we will use this later in this series. This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
* libelf: abolish libelf-relocate.cIan Jackson2013-06-141-1/+1
| | | | | | | | | | | | | | | This file is not actually used. It's not built in Xen's instance of libelf; in libxc's it's built but nothing in it is called. Do not compile it in libxc, and delete it. This reduces the amount of work we need to do in forthcoming patches to libelf (particularly since as libelf-relocate.c is not used it is probably full of bugs). This is part of the fix to a security issue, XSA-55. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
* libxc: limit cpu values when setting vcpu affinityPetr Matousek2013-05-311-0/+12
| | | | | | | | | | | | | | | When support for pinning more than 64 cpus was added, check for cpu out-of-range values was removed. This can lead to subsequent out-of-bounds cpumap array accesses in case the cpu number is higher than the actual count. This patch returns the check. This is CVE-2013-2072 / XSA-56 Signed-off-by: Petr Matousek <pmatouse@redhat.com> master commit: 41abbadef60e5fccdfd688579dd458f7f7887cf5 master date: 2013-05-29 15:49:22 +0100
* tools: fix dependency file generationJan Beulich2013-05-231-1/+1
| | | | | | | | | | | | | | | | | There is a small set of places where files in subdirectories get compiled from the parent directory. Dependency file wise this is no problem as long as the files use names distinct without regard to the directories they sit in, and tools/console/ violates this (in having two main.c files). Hence we need to avoid losing the directory name, both to ensure the two compiler instances don't simultaneously write to the same file (happening of which is what triggered me looking into this) and to guarantee dependencies for all files will be seen by make on an incremental rebuild. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> master commit: 4d788e164d6556d931bc3e0a69e36b8cf7280794 master date: 2013-05-21 10:16:30 +0200
* fix XSA-46 regression with xend/xmJan Beulich2013-05-232-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The hypervisor side changes for XSA-46 require the tool stack to now always map the guest pIRQ before granting access permission to the underlying host IRQ (GSI). This in particular requires that pciif.py no longer can skip this step (assuming qemu would do it) for HVM guests. This in turn exposes, however, an inconsistency between xend and qemu: The former wants to always establish 1:1 mappings between pIRQ and host IRQ (for non-MSI only of course), while the latter always wants to allocate an arbitrary mapping. Since the whole tool stack obviously should always agree on the mapping model, make libxc enforce the 1:1 mapping as the more natural one (as well as being the one that allows for easier debugging, since there no need to find out the extra mapping). Users of libxc that want to establish a particular (rather than an allocated) mapping are still free to do so, as well as tool stacks not based on libxc wanting to implement an allocation based model (which is why it's not the hypervisor that's being changed to enforce either model). Since libxl, like xend, already uses a 1:1 model, it's unaffected by the libxc change (and it being unaffected by the original hypervisor side changes is - afaict - simply due to qemu getting spawned at a later point in time compared to the xend event flow). Signed-off-by: Jan Beulich <jbeulich@suse.com> Tested-by: Andreas Falck <falck.andreas.lists@gmail.com> (on 4.1) Tested-by: Gordan Bobic <gordan@bobich.net> (on 4.2) Acked-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> master commit: 934a5253d932b6f67fe40fc48975a2b0117e4cce master date: 2013-05-21 11:32:34 +0200
* libxl: fix build error after 21c31a81Jan Beulich2013-04-191-1/+1
| | | | | | "libxl: Fix SEGV in network-attach" dropped a necessary &. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* libxl: Fix SEGV in network-attachIan Jackson2013-04-181-1/+2
| | | | | | | | | | | | | | When "device/vif" directory exists but is empty l!=NULL, but nb==0, so l[nb-1] is invalid. Add missing check. Signed-off-by: Marek Marczykowski <marmarek@invisiblethingslab.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com> (cherry picked from commit 9f1a6ff38b8e7bb97a016794115de28553a6559f) Conflicts: tools/libxl/libxl.c Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86: fix various issues with handling guest IRQsJan Beulich2013-04-181-6/+6
| | | | | | | | | | | | | | | - properly revoke IRQ access in map_domain_pirq() error path - don't permit replacing an in use IRQ - don't accept inputs in the GSI range for MAP_PIRQ_TYPE_MSI - track IRQ access permission in host IRQ terms, not guest IRQ ones (and with that, also disallow Dom0 access to IRQ0) This is CVE-2013-1919 / XSA-46. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> master commit: 545607eb3cfeb2abf5742d1bb869734f317fcfe5 master date: 2013-04-18 16:11:23 +0200
* Add DomU xz kernel decompressionIan Jackson2013-03-151-26/+64
| | | | | | | | | | | | Signed-off-by: Jan Beulich <jbeulich@novell.com> xen-unstable changeset: 4afea3d65321c40bb8afec833c860f92176bfb42 xen-unstable date: Wed Mar 9 16:19:36 2011 +0000 Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> [ This is byte-for-byte identical to Bastian Blank's backport of the same changeset to xen-4.1, as found in Debian xen_4.1.4-2.* patch debian/patches/upstream-23002:eb64b8f8eebb -iwj ]
* tools: Fix memset(&p,0,sizeof(p)) idiom in several places.Michael Young2013-02-285-5/+5
| | | | | | | | | | gcc 4.8 identifies several places where code of the form memset(x, 0, sizeof(x)); is used incorrectly, meaning that less memory is set to zero than required. Signed-off-by: Michael Young <m.a.young@durham.ac.uk> Committed-by: Keir Fraser <keir@xen.org> (cherry picked from commit d119301b5816b39b5ba722a2f8b301b37e8e34bd)
* libxl: Fix uninitialized variable in libxl_create_stubdomMarek Marczykowski2013-02-261-1/+1
| | | | | | | | | | | | It is used for result domid from libxl__domain_make, but actually this function have assert on an initial value. This patch is intended for xen-4.1 only - 4.2 and later have reworked this part of code already containing the fix. Signed-off-by: Marek Marczykowski <marmarek@invisiblethingslab.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools/ocaml: oxenstored: correctly handle a full ring.Ian Campbell2013-02-151-2/+2
| | | | | | | | | | | | | | | Change 26521:2c0fd406f02c (part of XSA-38 / CVE-2013-0215) incorrectly caused us to ignore rather than process a completely full ring. Check if producer and consumer are equal before masking to avoid this, since prod == cons + PAGE_SIZE after masking becomes prod == cons. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26539:759574df84a6 Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* oxenstored: Enforce a maximum message size of 4096 bytesIan Jackson2013-02-071-0/+8
| | | | | | | | | | | | | | | | | | | | | | The maximum size of a message is part of the protocol spec in xen/include/public/io/xs_wire.h Before this patch a client which sends an overly large message can cause a buffer read overrun. Note if a badly-behaved client sends a very large message then it will be difficult for them to make their connection work again-- they will probably need to reboot. This is a security issue, part of XSA-38 / CVE-2013-0215. Signed-off-by: David Scott <dave.scott@eu.citrix.com> Acked-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26522:ffd30e7388ad Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools/ocaml: oxenstored: Be more paranoid about ring readingIan Jackson2013-02-071-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | oxenstored makes use of the OCaml Xenbus bindings, in which the function xs_ring_read in tools/ocaml/libs/xb/xs_ring_stubs.c is used to read from the shared memory Xenstore ring. This function does not correctly handle all possible (prod, cons) states when MASK_XENSTORE_IDX(prod) > MASK_XENSTORE_IDX(cons). The root cause is the use of the unmasked values of prod and cons to calculate to_read. If prod is set to an out-of-range value, the ring peer can cause to_read to be too large or even negative. This allows the ring peer to force oxenstored to read and write out of range for the buffers leading to a crash or possibly to privilege escalation. Correct this by masking the values of cons and prod at the start, so we only deal with masked values. This makes the logic simpler, as semantically inappropriate values of the upper bits of the ring pointers are simply ignored. The same vulnerability does not exist in the ring writer because the only use made of the unmasked value is the check which prevents the prod pointer overtaking the cons pointer. A ring peer which defeats this check will suffer only lost data. However, additionally, precautions need to be taken to ensure that req_cons and req_prod are only read once in each function. Without the use of volatile or some asm construct, the compiler can "prove" that req_cons and req_prod do not change unexpectedly and is permitted to "amplify" the read of (say) req_cons into two reads at different times, giving two different values for use as cons, and then use the two sources of cons interchangeably. (The use of xen_mb() does not forbid this.) Therefore do the reads of req_cons and req_prod through a volatile pointer in both xs_ring_read and xs_ring_write. This is currently believed to be a theoretical vulnerability as we are not aware of any compilers which amplify reads in this way. This is a security issue, part of XSA-38 / CVE-2013-0215. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Tested-by: Matthew Daley <mattjd@gmail.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 26521:2c0fd406f02c Backport-requested-by: security@xen.org Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxl: revert 23428:93e17b0cd035 "avoid blktap2 deadlock"Ian Jackson2012-12-172-7/+1
| | | | | | | This results in additional leakage in xenstore according to the automated tests. Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxl: avoid blktap2 deadlock on cleanupGreg Wettstein2012-12-132-1/+7
| | | | | | | | | | | | | | | | | Establishes correct cleanup behavior for blktap devices. This patch implements the release of the backend device before calling for the destruction of the userspace component of the blktap device. Without this patch the kernel xen-blkback driver deadlocks with the blktap2 user control plane until the IPC channel is terminated by the timeout on the select() call. This results in a noticeable delay in the termination of the guest and causes the blktap minor number which had been allocated to be orphaned. Signed-off-by: Greg Wettstein <greg@enjellic.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* From: Ian Campbell <ian.campbell@citrix.com>Ian Jackson2012-12-126-11/+51
| | | | | | | | | | | | | | | | libxl: attempt to cleanup tapdisk processes on disk backend destroy. This patch properly terminates the tapdisk2 process(es) started to service a virtual block device. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-unstable changeset: 23883:7998217630e2 xen-unstable date: Wed Sep 28 16:42:11 2011 +0100 Signed-off-by: Greg Wettstein <greg@enjellic.com> Backport-requested-by: Greg Wettstein <greg@enjellic.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: update sysfs parser for Linux 3.0Olaf Hering2012-11-131-6/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sysfs parser for /sys/bus/scsi/devices understands only the layout of kernel version 2.6.16. This looks as follows: /sys/bus/scsi/devices/1:0:0:0/block:sda is a symlink to /sys/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic:sg1 is a symlink to /sys/class/scsi_generic/sg1 Both directories contain a 'dev' file with the major:minor information. This patch updates the used regex strings to match also the colon to make it more robust against possible future changes. In kernel version 3.0 the layout changed: /sys/bus/scsi/devices/ contains now additional symlinks to directories such as host1 and target1:0:0. This patch ignores these as they do not point to the desired scsi devices. They just clutter the devices array. The directory layout in '1:0:0:0' changed as well, the 'type:name' notation was replaced with 'type/name' directories: /sys/bus/scsi/devices/1:0:0:0/block/sda/ /sys/bus/scsi/devices/1:0:0:0/scsi_generic/sg1/ Both directories contain a 'dev' file with the major:minor information. This patch adds additional code to walk the subdir to find the 'dev' file to make sure the given subdirectory is really the kernel name. In addition this patch makes sure devname is not None. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26010:cff10030c6ea Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25915:839e5d95d483 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix usage of persistant device names for SCSI devicesOlaf Hering2012-11-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the callers of vscsi_get_scsidevices() do not pass a mask string. This will call "lsscsi -g '[]'", which causes a lsscsi syntax error. As a result the sysfs parser _vscsi_get_scsidevices() is used. But this parser is broken and the specified names in the config file are not found. Using a mask '*' if no mask was given will call lsscsi correctly and the following config is parsed correctly: vscsi=[ '/dev/sg3, 0:0:0:0', '/dev/disk/by-id/wwn-0x600508b4000cf1c30000800000410000, 0:0:0:1' ] Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26009:2dbfa4d2e107 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25914:b8916af165b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xend/pvscsi: fix passing of SCSI control LUNsOlaf Hering2012-11-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently pvscsi can not pass SCSI devices that have just a scsi_generic node. In the following example sg3 is a control LUN for the disk sdd. But vscsi=['4:0:2:0,0:0:0:0'] does not work because the internal 'devname' variable remains None. Later writing p-devname to xenstore fails because None is not a valid string variable. Since devname is used for just informational purpose use sg also as devname. carron:~ $ lsscsi -g [0:0:0:0] disk ATA FK0032CAAZP HPF2 /dev/sda /dev/sg0 [4:0:0:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdb /dev/sg1 [4:0:1:0] disk HP P2000G3 FC/iSCSI T100 /dev/sdc /dev/sg2 [4:0:2:0] storage HP HSV400 0950 - /dev/sg3 [4:0:2:1] disk HP HSV400 0950 /dev/sdd /dev/sg4 [4:0:3:0] storage HP HSV400 0950 - /dev/sg5 [4:0:3:1] disk HP HSV400 0950 /dev/sde /dev/sg6 Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26008:eecb528583d7 Backport-requested-by: Olaf Hering <olaf@aepfle.de> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25913:16ced2f387b9 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: xend: fix wrong condition check for xml fileJoe Jin2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | In commit e8d40584, it intended to check xml file size and when empty will return, the condition should be "if os.path.getsize(xml_path) == 0" rather then "if not os.path.getsize(xml_path) == 0". Signed-off-by: Chuang Cao <chuang.cao@oracle.com> Signed-off-by: Joe Jin <joe.jin@oracle.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26088:dd64a1bdbe3a Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25905:82b61b99d15d Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* pygrub: correct typo in --args assignmentOlaf Hering2012-11-131-3/+3
| | | | | | | | | | | | | | | | | | | | | If pygrub was called with --args="some thing", then this string should be append to the kernel command line. But the last changeset 25941:795c493fe561 contained a typo, it assigns 'args' instead of 'arg'. Rename the local variable which holds the string from the domain config file to avoid further confusion. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26018:ecc7627ca6d7 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25899:dbb1872bbb97 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* xenballoond.init: remove 4 from default runlevelOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | | | | | | | | Remove 4 from default runlevel in xenballoond.init. Similar to what changeset 24847:0900b1c905f1 does in xencommons, remove runlevel 4 from the other runlevel scripts. LSB defines runlevel 4 as reserved for local use, the local sysadmin is responsible for symlink creation in rc4.d. Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26007:fe756682cc7f Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25897:dcd4bf824284 Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* hotplug/Linux: Remove tracing (bash -x) from network-nat scriptOlaf Hering2012-11-131-1/+1
| | | | | | | | | | | | | | Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com> xen-unstable changeset: 26006:8b6870d686d6 Backport-requested-by: Ian Campbell <Ian.Campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> xen-4.2-testing changeset: 25896:6adf0c7937bf Backport-requested-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-18 11:38:34 +0000