Jan Beulich [Tue, 30 Oct 2012 15:46:07 +0000 (16:46 +0100)]
x86: save/restore only partial register state where possible
... and make restore conditional not only upon having saved the state,
but also upon whether saved state was actually modified (and register
values are known to have been preserved).
Note that RBP is unconditionally considered a volatile register (i.e.
irrespective of CONFIG_FRAME_POINTER), since the RBP handling would
become overly complicated due to the need to save/restore it on the
compat mode hypercall path [6th argument].
Note further that for compat mode code paths, saving/restoring R8...R15
is entirely unnecessary - we don't allow those guests to enter 64-bit
mode, and hence they have no way of seeing these registers' contents
(and there consequently also is no information leak, except if the
context saving domctl would be considered such).
Finally, note that this may not properly deal with gdbstub's needs, yet
(but if so, I can't really suggest adjustments, as I don't know that
code).
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Roger Pau Monne [Tue, 30 Oct 2012 14:53:47 +0000 (14:53 +0000)]
docs: document persistent grants
Document the new persistent grants block-device feature.
Signed-off-by: Roger Pau Monne <roger.pau@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Jackson [Fri, 26 Oct 2012 15:09:29 +0000 (16:09 +0100)]
libxc: builder: limit maximum size of kernel/ramdisk.
Allowing user supplied kernels of arbitrary sizes, especially during
decompression, can swallow up dom0 memory leading to either virtual
address space exhaustion in the builder process or allocation
failures/OOM killing of both toolstack and unrelated processes.
We disable these checks when building in a stub domain for pvgrub
since this uses the guest's own memory and is isolated.
Decompression of gzip compressed kernels and ramdisks has been safe
since 14954:58205257517d (Xen 3.1.0 onwards).
This is XSA-25 / CVE-2012-4544.
Also make explicit checks for buffer overflows in various
decompression routines. These were already ruled out due to other
properties of the code but check them as a belt-and-braces measure.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Charles Arnold [Fri, 26 Oct 2012 11:05:08 +0000 (12:05 +0100)]
pygrub: Add option to list grub entries
The argument to "--entry" allows 2 syntaxes, either directly the entry
number in menu.lst, or the whole string behind the "title" key word.
This poses the following issue:
From Dom0 there is no way to guess the number and, or the complete
title string because this string contains the kernel version, which
will change with a kernel update.
This patch adds [-l|--list-entries] as an argument to pygrub.
Signed-off-by: Charles Arnold <carnold@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Campbell [Fri, 26 Oct 2012 11:03:12 +0000 (12:03 +0100)]
xl: Do not leak events when a domain exits.
The goto in both of these places misses the event free which would
normally clean up.
==8655== 80 bytes in 1 blocks are definitely lost in loss record 1 of 1
==8655== at 0x4024370: calloc (vg_replace_malloc.c:593)
==8655== by 0x406EAAE: libxl__zalloc (libxl_internal.c:83)
==8655== by 0x4078173: libxl__event_new (libxl_event.c:1167)
==8655== by 0x4056373: domain_death_occurred (libxl.c:958)
==8655== by 0x4058D06: domain_death_xswatch_callback (libxl.c:1038)
==8655== by 0x4078EB5: watchfd_callback (libxl_event.c:458)
==8655== by 0x407839E: afterpoll_internal (libxl_event.c:949)
==8655== by 0x4079142: eventloop_iteration (libxl_event.c:1371)
==8655== by 0x40799BB: libxl_event_wait (libxl_event.c:1396)
==8655== by 0x805CC67: create_domain (xl_cmdimpl.c:1698)
==8655== by 0x805E001: main_create (xl_cmdimpl.c:3986)
==8655== by 0x804D43D: main (xl.c:285)
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Campbell [Thu, 25 Oct 2012 16:05:29 +0000 (17:05 +0100)]
libxl: Use libxl__realloc in a couple of places in libxl_events.c
This avoids us having to think about the error handling on failure.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Campbell [Thu, 25 Oct 2012 16:04:37 +0000 (17:04 +0100)]
xl: Do not leak events when a domain exits.
The goto in both of these places misses the event free which would
normally clean up.
==8655== 80 bytes in 1 blocks are definitely lost in loss record 1 of 1
==8655== at 0x4024370: calloc (vg_replace_malloc.c:593)
==8655== by 0x406EAAE: libxl__zalloc (libxl_internal.c:83)
==8655== by 0x4078173: libxl__event_new (libxl_event.c:1167)
==8655== by 0x4056373: domain_death_occurred (libxl.c:958)
==8655== by 0x4058D06: domain_death_xswatch_callback (libxl.c:1038)
==8655== by 0x4078EB5: watchfd_callback (libxl_event.c:458)
==8655== by 0x407839E: afterpoll_internal (libxl_event.c:949)
==8655== by 0x4079142: eventloop_iteration (libxl_event.c:1371)
==8655== by 0x40799BB: libxl_event_wait (libxl_event.c:1396)
==8655== by 0x805CC67: create_domain (xl_cmdimpl.c:1698)
==8655== by 0x805E001: main_create (xl_cmdimpl.c:3986)
==8655== by 0x804D43D: main (xl.c:285)
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Keir Fraser [Thu, 25 Oct 2012 07:07:16 +0000 (00:07 -0700)]
hvmloader: Reserve FE700000-FE800000 in physical memory map for guest use.
Xen platform promises never to use this physical address region, and
will always mark it as reserved in the physical memory map presented
to the OS (preventing its use by generic OS services such as BAR
remapping).
Linux will use this region for mapping the shared-info page.
xl: Fix accidently waiting for domains to shutdown without --wait option
Introduced by changeset 26091: "xl: Add --wait and --all to xl reboot."
Signed-off-by: Sander Eikelenboom <linux@eikelenboom> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Christoph Egger [Thu, 25 Oct 2012 12:28:09 +0000 (14:28 +0200)]
x86/MCE: Implement clearbank callback for AMD
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
Move initialization of mce_clear_banks into common code (would not get
initialized on AMD CPUs otherwise). Mark per-CPU struct mce_bank
pointers read-mostly.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Committed-by: Jan Beulich <jbeulich@suse.com>
Jan Beulich [Thu, 25 Oct 2012 12:26:08 +0000 (14:26 +0200)]
x86/HPET: cache MSI message last written
Rather than spending measurable amounts of time reading back the most
recently written message, cache it in space previously unused, and thus
accelerate the CPU's entering of the intended C-state.
hpet_msi_read() ends up being unused after this change, but rather than
removing the function, it's being marked "unused" in order - that way
it can easily get used again should a new need for it arise.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Jan Beulich [Thu, 25 Oct 2012 12:24:55 +0000 (14:24 +0200)]
compiler.h adjustments
- replace __attribute_used__ with just __used
- add __maybe_unused and explain the difference between the two
- remove gcc 3.x specifics (as we don't support building with it
anymore; really for quite some time we didn't even support building
with the checked for minor versions)
- remove left over __setup() from init.h (rather than adjusting it)
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Christoph Egger [Thu, 25 Oct 2012 11:51:25 +0000 (12:51 +0100)]
xl: avoid shadowing reboot(2)
On NetBSD <unistd.h> mistakenly exposes reboot(2). Work around this.
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
i.e. all legacy IRQs (apart from the timer one, but the firmware passed
data doesn't look right for that case anyway, as both Xen and native
Linux are falling back to use the virtual wire setup for IRQ0,
apparently rather using pin 2 of the first IO-APIC) are being handled
by the second IO-APIC.
This at once eliminates the possibility of an unmasked RTE getting
written without having got a vector put in place (in
setup_IO_APIC_irqs()).
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Dario Faggioli [Tue, 23 Oct 2012 11:18:22 +0000 (04:18 -0700)]
xen: sched: introduce a couple of counters in credit2 and SEDF
Mainly for consistency with credit, at least for the events that are
general enough, like vCPU initialization/destruction and calls
to the specific scheduling function.
Dario Faggioli [Tue, 23 Oct 2012 11:17:16 +0000 (04:17 -0700)]
xen: sched: generalize scheduling related perfcounter macros
Moving some of them from sched_credit.c to generic scheduler code.
This also allows the other schedulers to use perf counters equally
easy.
This change is mainly preparatory work for what stated above. In fact,
it mostly does s/CSCHED_STAT/SCHED_STAT/, and, in general, it implies
no functional changes.
Dario Faggioli [Tue, 23 Oct 2012 11:12:22 +0000 (04:12 -0700)]
xen: fix build when 'perfc=y'
Which was failing with this:
viridian.c: In function ‘wrmsr_viridian_regs’:
viridian.c:254:1: error: ‘PERFC_mshv_wrmsr_apic_msr’ undeclared
(first use in this function)
viridian.c:254:1: note: each undeclared identifier is reported only
once for each function it appears in
viridian.c: In function ‘rdmsr_viridian_regs’:
viridian.c:305:1: error: ‘PERFC_mshv_rdmsr_apic_msr’ undeclared
(first use in this function)
as a consequence of 17b754cab7b0 using but not defining
the counters.
Olaf Hering [Fri, 19 Oct 2012 14:09:05 +0000 (16:09 +0200)]
hvm: handle PoD and grant pages in HVMOP_get_mem_type
During kexec in a ballooned PVonHVM guest the new kernel needs to check
each pfn if its backed by a mfn to find ballooned pages. Currently all
PoD and grant pages will appear as HVMMEM_mmio_dm, so the new kernel has
to assume they are ballooned. This is wrong: PoD pages may turn into
real RAM at runtime, grant pages are also RAM.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Tim Deegan <tim@xen.org>
Jan Beulich [Fri, 19 Oct 2012 14:51:24 +0000 (16:51 +0200)]
IOMMU: fail HPET MSI setup on AMD
While the MSI message format doesn't need adjustment for AMD IOMMUs,
the interrupt remapping tables still need updating. The respective code
has to be able to determine the IOMMU responsible, which currently
requires an associated PCI device. The absence of that device in the
HPET case causes the code to crash, and the code determining the source
ID to be used for HPETs (parse_ivhd_device_special() afaict) isn't even
looking at whether it's dealing with an IO-APIC or a HPET (i.e. ignores
the "variety" structure member). If I tried to fix that, I would have
no way to test that I did things right, so all I can do to fix the
crash is make the setup fail if the IOMMU did not provide a handler
(which, considering the above, is the right thing anyway).
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Wei Wang <wei.wang2@amd.com>
Ian Campbell [Thu, 18 Oct 2012 08:35:11 +0000 (09:35 +0100)]
xl: Add --wait and --all to xl reboot.
Inspired by a patch by Sander Eikelenboom.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Campbell [Thu, 18 Oct 2012 08:35:10 +0000 (09:35 +0100)]
xl: Introduce xl shutdown --all support for xm compatibility
Based on a patch by Sander Eikelenboom
Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
[ ijc -- fixed sizeof(foo) vs sizeof(*foo) issue pointed out by Ian J ] Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Campbell [Thu, 18 Oct 2012 08:35:09 +0000 (09:35 +0100)]
libxl: propagate user supplied values into event for_user field.
This was ommited in the majority of cases. Add as a parameter to
libxl__event_new and the NEW_EVENT wrapper to help prevent it being
forgotten in the future.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Joe Jin [Thu, 18 Oct 2012 08:35:08 +0000 (09:35 +0100)]
tools: xend: fix wrong condition check for xml file
In commit e8d40584, it intended to check xml file size and when empty will
return, the condition should be "if os.path.getsize(xml_path) == 0" rather
then "if not os.path.getsize(xml_path) == 0".
Signed-off-by: Chuang Cao <chuang.cao@oracle.com> Signed-off-by: Joe Jin <joe.jin@oracle.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:35:07 +0000 (09:35 +0100)]
hotplug/Linux: install sysconfig files as data files
rpmlint complains about wrong permissions of config files:
[ 455s] xen-tools.i586: W: script-without-shebang /var/adm/fillup-templates/sysconfig.xendomains
[ 455s] xen-tools.i586: W: script-without-shebang /var/adm/fillup-templates/sysconfig.xencommons
[ 455s] This text file has executable bits set or is located in a path dedicated for
[ 455s] executables, but lacks a shebang and cannot thus be executed. If the file is
[ 455s] meant to be an executable script, add the shebang, otherwise remove the
[ 455s] executable bits or move the file elsewhere.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:35:06 +0000 (09:35 +0100)]
stubdom: install stubdompath.sh as data file
rpmlint complains a script helper which is only sourced:
[ 1875s] xen-tools.i586: W: script-without-shebang /usr/lib/xen/bin/stubdompath.sh
[ 1875s] This text file has executable bits set or is located in a path dedicated for
[ 1875s] executables, but lacks a shebang and cannot thus be executed. If the file is
[ 1875s] meant to be an executable script, add the shebang, otherwise remove the
[ 1875s] executable bits or move the file elsewhere.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:35:05 +0000 (09:35 +0100)]
hotplug: install hotplugpath.sh as data file
rpmlint complains a script helper which is only sourced:
[ 1875s] xen-tools.i586: W: script-without-shebang /etc/xen/scripts/hotplugpath.sh
[ 1875s] This text file has executable bits set or is located in a path dedicated for
[ 1875s] executables, but lacks a shebang and cannot thus be executed. If the file is
[ 1875s] meant to be an executable script, add the shebang, otherwise remove the
[ 1875s] executable bits or move the file elsewhere.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
[ 1758s] xen-devel.x86_64: E: spurious-executable-perm (Badness: 50) /usr/lib64/libblktap.a
[ 1758s] The file is installed with executable permissions, but was identified as one
[ 1758s] that probably should not be executable. Verify if the executable bits are
[ 1758s] desired, and remove if not. NOTE: example scripts should be packaged under
[ 1758s] %docdir/examples, which will avoid this warning.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
[ 1758s] xen-devel.x86_64: E: spurious-executable-perm (Badness: 50) /usr/lib64/libvhd.a
[ 1758s] The file is installed with executable permissions, but was identified as one
[ 1758s] that probably should not be executable. Verify if the executable bits are
[ 1758s] desired, and remove if not. NOTE: example scripts should be packaged under
[ 1758s] %docdir/examples, which will avoid this warning.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
[ 1758s] xen-tools.x86_64: E: spurious-executable-perm (Badness: 50) /usr/lib/xen/boot/xenstore-stubdom.gz
[ 1758s] The file is installed with executable permissions, but was identified as one
[ 1758s] that probably should not be executable. Verify if the executable bits are
[ 1758s] desired, and remove if not. NOTE: example scripts should be packaged under
[ 1758s] %docdir/examples, which will avoid this warning.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Jackson [Thu, 18 Oct 2012 08:35:02 +0000 (09:35 +0100)]
libxl: ao: cope with fast ao completion with progess events
There are two egcs in an ao initiator: the one in the AO_CREATE
function, and the one in libxl__ao_inprogress. If synchronous ao
operation generates progress events and completes immediately, the
progress callbacks end up queued in the outer egc. These callbacks
are currently only called after libxl__ao_inprogress has returned, and
keep the ao alive until they happen. This is not good because the
principle is that a synchronous ao is not supposed to survive beyond
libxl__ao_inprogress's return.
The fix is to ensure that the callbacks queued in the outer egc are
called early enough that they don't preserve the ao. This is
straightforward in the AO_INPROGRESS macro because AO_CREATE's egc is
not used inside that macro other than to destroy it. All we have to
do is destroy it a bit sooner.
This involves unlocking and relocking the ctx since EGC_FREE expects
to be called with the lock released but libxl__ao_inprogress needs it
locked. This hole in our lock tenure is fine - libxl__ao_inprogress
has such holes already.
It is still possible to use the CTX_LOCK macros for this unlock/lock
because the gc we are using is destroyed only afterwards by
libxl__ao_inprogress.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:35:01 +0000 (09:35 +0100)]
hotplug/Linux: close lockfd after lock attempt
When a HVM guest is shutdown some of the 'remove' events can not claim
the lock for some reason. Instead they try to grab the lock in a busy
loop, until udev reaps the xen-hotplug-cleanup helper.
After analyzing the resulting logfile its not obvious what the cause is.
The only explanation is that bash (?) gets confused if the same lockfd
is opened again and again. Closing it in each iteration seem to fix the
issue.
This was observed with sles11sp2 (bash 3.2) and 4.2 xend.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <Ian.campbell@citrix.com>
[ ijc -- added the comment ] Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:35:00 +0000 (09:35 +0100)]
hotplug/Linux: remove hotplug support, rely on udev instead
Hotplug has been replaced by udev since several years. Remove the
hotplug related files and install udev unconditionally.
This makes it possible to remove udev from rpm BuildRequires which
reduces the buildtime dependency chain. For openSuSE:Factory it was
done just now:
http://lists.opensuse.org/opensuse-buildservice/2012-10/msg00085.html
The patch by itself will have no practical impact unless someone
attempts to build and run a Xen dom0 on a really old base system. e.g.
circa SLES9/2007 or earlier
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 18 Oct 2012 08:34:59 +0000 (09:34 +0100)]
stubdom: fix compile errors in grub
Building xen.rpm in SLES11 started to fail due to these compiler
warnings:
[ 1436s] ../grub-upstream/netboot/fsys_tftp.c:213: warning: operation on 'block' may be undefined
[ 1437s] ../grub-upstream/netboot/main.c:444: warning: operation on 'block' may be undefined
The reason for this is that the assignment is done twice:
tp.u.ack.block = ((uint16_t)( (((uint16_t)((block = prevblock)) & (uint16_t)0x00ffU) << 8) | (((uint16_t)((block = prevblock)) & (uint16_t)0xff00U) >> 8)));
Fix this package build error by adding another patch for grub, which
moves the assignment out of the macro usage.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Jan Beulich [Thu, 18 Oct 2012 08:10:02 +0000 (10:10 +0200)]
x86/HPET: allow use for broadcast when interrupt remapping is in effect
This requires some additions to the VT-d side; AMD IOMMUs use the
"normal" MSI message format even when interrupt remapping is enabled,
thus making adjustments here unnecessary.
Jan Beulich [Thu, 18 Oct 2012 08:07:48 +0000 (10:07 +0200)]
ACPI/APEI: accept validly sized ERST on Intel systems only for now
Various AMD systems (but [unfortunately] not mine) hang when the table
size check passes. Allow the check to pass on Intel systems only for
now (until someone can actually debug the problem).
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Ian Campbell [Wed, 17 Oct 2012 15:43:54 +0000 (16:43 +0100)]
xen: remove XEN_GUEST_HANDLE(ulong)
Having both this handle (always unsigned long) and
XEN_GUEST_HANDLE(xen_ulong_t) (unsigned long on x86 and explicit size
of ARM) is confusing and error prone.
Replace the two remaining uses of the ulong handle, in grant set and
x86 set_gdt hypercalls, with xen_ulong_t.
This correctly sizes the grant frame entry as 64 bit on ARM but
leaves it as unsigned long on x86 (therefore no intended change on
x86). Likewise in set_gdt there is no actual change.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
XEN_GUEST_HANDLE_PARAM is going to be used to distinguish guest pointers
stored in memory from guest pointers as hypercall parameters.
guest_handle_* macros default to XEN_GUEST_HANDLE_PARAM as return type.
Two new guest_handle_to_param and guest_handle_from_param macros are
introduced to do conversions.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
xen: change the limit of nr_extents to UINT_MAX >> MEMOP_EXTENT_SHIFT
Currently do_memory_op has a different maximum limit for nr_extents on
32 bit and 64 bit.
Change the limit to UINT_MAX >> MEMOP_EXTENT_SHIFT, so that it is the
same in both cases.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Implement XENMAPSPACE_grant_table and grant_table_op.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Tim Deegan <tim@xen.org>
[ ijc -- fixed reject in traps.c, grant table op is a 3 argument
hypercall, rebased over "xen: arm: implement
XENMEM_add_to_physmap_range"
] Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Jan Beulich [Wed, 17 Oct 2012 12:13:20 +0000 (14:13 +0200)]
x86/HPET: obtain proper lock for changing IRQ affinity
The IRQ descriptor lock should be held while adjusting the affinity of
any IRQ; the HPET channel lock isn't sufficient to protect namely
against races with moving the IRQ to a different CPU.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Huang Ying [Wed, 17 Oct 2012 12:12:06 +0000 (14:12 +0200)]
ACPI/APEI: fix ERST MOVE_DATA instruction implementation
The src_base and dst_base fields in apei_exec_context are physical
address, so they should be ioremaped before being used in ERST
MOVE_DATA instruction.
Reported-by: Javier Martinez Canillas <martinez.javier@gmail.com> Reported-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Huang Ying <ying.huang@intel.com>
Replace use of ioremap() by __acpi_map_table()/set_fixmap(). Fix error
handling.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com>
To make erst table size checking code works on all systems, both
testing are treated as PASS.
Same situation applies to einj_tab->header_length, so corresponding
table size checking is changed in similar way too.
Originally-by: Yinghai Lu <yinghai@kernel.org> Signed-off-by: Huang Ying <ying.huang@intel.com>
- use switch() for better readability
- add comment explaining why a formally invalid size it also being
accepted
- check erst_tab->header.length before even looking at
erst_tab->header_length
- prefer sizeof(*erst_tab) over sizeof(struct acpi_table_erst)
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com>
Daniel De Graaf [Mon, 15 Oct 2012 15:51:44 +0000 (16:51 +0100)]
xen: Add versions of rcu_lock_*_domain without IS_PRIV
These functions will be used to avoid duplication of IS_PRIV calls
that will be introduced in XSM hooks. This also fixes a build error
with XSM enabled introduced by 25925:d1c3375c3f11 which depends on
this patch.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
Jan Beulich [Mon, 15 Oct 2012 15:41:39 +0000 (17:41 +0200)]
IOMMU: remove vendor specific bits from generic code
- names of functions used independent of vendor should not have vendor
specific names
- vendor specific declarations should not live inn generic headers
- other vendor specific items should not be used in generic code
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Jan Beulich [Mon, 15 Oct 2012 15:39:32 +0000 (17:39 +0200)]
VT-d: drop bogus checks
There were a number of cases where an "iommu" retrieved got passed to
another function before being NULL-checked. While this by itself was
not a problem as the called function did the checks, it is confusing to
the reader and redundant in several cases (particularly with NULL-
checking the return value of iommu_ir_ctrl()). Drop the redundant
checks (also ones where the sole caller of a function did the checking
already), and at once make the three similar functions proper inline
instead of extern ones (they were prototyped in the wrong header file
anyway, so would have needed touching sooner or later).
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
Keir Fraser [Mon, 15 Oct 2012 15:38:11 +0000 (16:38 +0100)]
More efficient TLB-flush filtering in alloc_heap_pages().
Rather than per-cpu filtering for every page in a super-page
allocation, simply remember the most recent TLB timestamp across all
allocated pages, and filter on that, just once, at the end of the
function.
For large-CPU systems, doing 2MB allocations during domain creation,
this cuts down the domain creation time *massively*.
TODO: It may make sense to move the filtering out into some callers,
such as memory.c:populate_physmap() and
memory.c:increase_reservation(), so that the filtering can be moved
outside their loops, too.
Jacob Shin [Mon, 15 Oct 2012 13:04:51 +0000 (15:04 +0200)]
x86/xenoprof: fix kernel/user mode detection for HVM
While trying oprofile under Xen, I noticed that HVM passive domain's
kernel addresses were showing up as user application. It turns out
under HVM get_cpu_user_regs()->cs contains 0x0000beef.
Signed-off-by: Jacob Shin <jacob.shin@amd.com>
Don't cast away const-ness. Use SS instead of CS to determine ring.
Special-case real and protected mode.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com>
Kernel function check_hw_exists() writes 0xabcd to msr 0xc0010201 (Performance Event
Counter 0) and read it again to check if it is running as dom0. Early amd cpus does
not reset perf counters during warm reboot. If the kernel is booted with bare metal
and then as a dom0, the content of msr 0xc0010201 will stay and the checking will
pass and PMU will be enabled unexpectedly.
Signed-off-by: Wei Wang <wei.wang2@amd.com>
Don't reset the counters when used for the NMI watchdog.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Jan Beulich <jbeulich@suse.com>
Jan Beulich [Mon, 15 Oct 2012 10:59:14 +0000 (12:59 +0200)]
AMD IOMMU: fix find_iommu_from_bdf_cap()
The arguments passed for the "cap_offset" parameter get read from 16-
bit fields, so the parameter should also have (at least) 16 bits.
While fixing this I also noticed that this was yet another case where
PCI segment information wasn't properly propagated, so a respective
first parameter gets added to the function at once.
Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Wei Wang <wei.wang2@amd.com>
Ian Campbell [Thu, 11 Oct 2012 14:56:59 +0000 (15:56 +0100)]
arm: really allocate boot frametable pages with 32M alignment
This argument to alloc_boot_pages is "pfn_align" and not an order.
We've been lucky until now that the area given to the boot allocator
happened to be properly aligned and this allocation was early enough
to benefit.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
init/sysconfig scripts: Remove --halt/-H option for shutdown command.
The --halt/-H option for the shutdown command is now pointless,
since linux in a guest treats "halt" and "poweroff" identically.
The option is not implemented in xl / libxl and if supplied causes the command
to fail , so remove it from the init and sysconfig scripts.
Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
init scripts: xendomains correct order of options for shutdown command
Options for the shutdown command that are supplied behind the domain id are
ignored. In case of the default xendomains init script this means that it will
not wait for the domains to be actually shutdown.
Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Olaf Hering [Thu, 11 Oct 2012 09:21:15 +0000 (10:21 +0100)]
stubdom: fix error assignment in grub:load_module
[ 1333s] mini-os.c: In function 'load_module':
[ 1333s] mini-os.c:244: warning: statement with no effect
Signed-off-by: Olaf Hering <olaf@aepfle.de> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Jackson [Tue, 9 Oct 2012 17:00:00 +0000 (18:00 +0100)]
docs, build: Do not ignore install-docs errors
In the toplevel Makefile "install-docs" (depended on by "install" and
hence "dist"), but not "build", ignores errors.
This was inherited from before 24563:4271634e4c86, prior to which the
||true seems intended to handle failures of check_pkgs. Nowadays we
handle docs tools individually in the docs makefiles so there is no
need for this ||true here.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Jackson [Tue, 9 Oct 2012 16:59:59 +0000 (17:59 +0100)]
docs, build: Tolerate missing pod2text
We gate the whole of the "txt" target on pod2text. I think this is
better than gating only the pod-generated outputs; it avoids a partial
output tree.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Jackson [Tue, 9 Oct 2012 16:59:58 +0000 (17:59 +0100)]
docs, build: Tolerate missing fig2dev
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Campbell [Tue, 9 Oct 2012 14:05:40 +0000 (15:05 +0100)]
arm: Use per-CPU irq_desc for PPIs and SGIs
The first 32 interrupts on a GIC are the Peripheral Private Interrupts
and Software-Generated Interrupts and are local to each processor.
The irq_desc cannot be shared since we use irq_desc->status to track
whether the IRQ is in-progress etc. Therefore give each processor its
own local irq_desc for each of these interupts.
We must also route them on each CPU, so do so.
This feels like a bit of a layering violation (since the core ARM
irq.c now knows about thinkgs wich are really gic.c business)
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Campbell [Tue, 9 Oct 2012 14:05:36 +0000 (15:05 +0100)]
arm: disable distributor delivery on boot CPU only
The secondary processors do not call enter_hyp_mode until the boot CPU
has brought most of the system up, including enabling delivery via the
distributor. This means that bringing up secondary CPUs unexpectedly
disables the GICD again, meaning we get no further interrupts on any
CPU.
For completeness also disable the GICC (CPU interface) on all CPUs
too.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Allocate two additional pages at the end of the guest physical memory
for xenstore and console.
Set HVM_PARAM_STORE_PFN and HVM_PARAM_CONSOLE_PFN to the corresponding
values.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- pass correct p2m array to populate physmap in
alloc_magic_pages
] Committed-by: Ian Campbell <ian.campbell@citrix.com>
Ian Campbell [Tue, 9 Oct 2012 14:05:34 +0000 (15:05 +0100)]
arm: kill a guest which uses hvc with an immediate operand != XEN_HYPERCALL_TAG
At best these guests are confused/broken and at worse they are malicious. In
any case we don't know that they are expecting to handle a -errno style error.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: create_p2m_entries should not call free_domheap_page
The guest is entitled to leak a page from its p2m (by overwriting it) if
it wants to. Since the memory is effectively lost to it (can't even be
recovered by XENMEM increase reservation etc).
In these cases we shouldn't call free_domheap_page to free the existing
page from create_p2m_entries, because it resets the reference counting
but the page is still allocated to the guest (even if not in the p2m
anymore) and common grant_table code is also going to call put_page on
it.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
Anthony PERARD [Tue, 9 Oct 2012 10:08:21 +0000 (11:08 +0100)]
libxl: Fix cd-insert with qemu-xen.
If qemu-xen is used as a device model, the command to insert, change or eject a
cdrom will go through QMP. XenStore is still updated even if QEMU will not read
from it.
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
projects / xen.git / log