Keir Fraser [Sat, 24 May 2008 08:37:35 +0000 (09:37 +0100)]
Enable IOMMU for PV guests
Introduce 'iommu_pv' boot parameter (default off). Added a need_iommu
flag which is set if guest has PCI devices assigned. IOMMU page
tables are populated with current guest memory when IOMMU is first
enabled for the guest.
Keir Fraser [Sat, 24 May 2008 08:27:03 +0000 (09:27 +0100)]
hvm: Build guest timers on monotonic system time.
Move hvm platform timers from underlying physical CPU TSC to Xen
system time and ensure domain-wide monotonicity. TSC on many systems
may skew between processors leading to 'time going backwards' messages
from some guests.
Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Fri, 23 May 2008 10:58:08 +0000 (11:58 +0100)]
rombios: Remove annoying 3-second boot delay waiting for user to hit
F10 to select boot device. This will be rarely used, and it is
possible to hit F10 before the message is displayed and the keypress
will still register. So in practice it is quite possibel to use this
boot feature reliably without needing a multi-second delay.
Keir Fraser [Fri, 23 May 2008 10:15:19 +0000 (11:15 +0100)]
x86: Fix Xen boot on 8-node AMD machines
In xen/arch/x86/cpu/amd.c the function disable_c1_ramping iterates
over the northbridges using NR_CPUS as an upper bound for the number of
nodes. If there are no more northbridges found, it stops iterating.
Sadly it just adds the northbridge number to 0x18 and uses this as a
PCI device number, so probing the 9th northbridge on an 8 node system will
be caught by the newly inserted assertion in pci_conf_read in current
unstable. We fix this by first querying the number of nodes from the
first northbridge to avoid the overflow.
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Verified by Mark.Johnson@sun.com
Keir Fraser [Fri, 23 May 2008 09:41:44 +0000 (10:41 +0100)]
Make ssl relocation server listen on different port
This patch makes ssl relocation server listen on 8003 if enabled.
Whether to start ssl relocation server now controlled by
xend-relocation-ssl-server. So ssl and non-ssl relocation server can
run simultaneously. You can also only start ssl server or only start
non-ssl relocation server.
When mix deploy xen 3.2 server (has no ssl support) and 3.3 servers,
start ssl and non-ssl relocation server simultaneously can keep
backward compatibility.
It's also more reasonable to have separate ports for ssl and non-ssl.
In this patch, also renames xend-relocation-tls to xend-relocation-ssl.
Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
Keir Fraser [Fri, 23 May 2008 08:48:44 +0000 (09:48 +0100)]
tboot, s3: Fix S3 issue of Xen and tboot, since the structure
acpi_sleep_info is changed but some of the code in Xen is not
synchronized up with this change, which causes Xen S3 failure.
Keir Fraser [Thu, 22 May 2008 14:11:06 +0000 (15:11 +0100)]
xend: fix automatic vcpu NUMA placement
The automatic NUMA placement code (find_relaxed_node) in
XendDomainInfo.py contains several bugs:
1. The domain just created shall not be considered in the load
calculation.
2. Nodes with too less memory for the domain must be considered during
the load calculation phase and abandoned later, currently these nodes
win with a load of 0.
3. CPUs which are offline shall not be considered in load calculation.
4. (Integer-)Dividing the load value by the number of cores per node
may conceal subtle load differences resulting in a non-optimal node to
be chosen.
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Keir Fraser [Thu, 22 May 2008 09:40:40 +0000 (10:40 +0100)]
x86: Remove 32-bit non-PAE code from dom0 builder, and avoid use of
get_page_type() on pagetable pages (pending support for preemptive
get_page_type(), as dom0 builder would be an awkward place to deal
with preemption).
Keir Fraser [Wed, 21 May 2008 10:23:03 +0000 (11:23 +0100)]
hvmloader: Lay out memory a bit differently -
* Cleanly define a scratch area for temporary storage
* Raise Etherboot ROM out of the way of larger VGA BIOSes
Also detect virtual VGA adaptors more cleanly.
Signed-off-by: Jean Guyader <jean.guyader@eu.citrix.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Wed, 21 May 2008 10:07:23 +0000 (11:07 +0100)]
Handle IOMMU pagetable allocations when set_p2m_entry is called with
non-zero page order. Signed-off-by: Xin Xiaohui <xiaohui.xin@intel.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Wed, 21 May 2008 09:38:57 +0000 (10:38 +0100)]
x86: Fix lapic timer stop issue in deep C state
Local APIC timer may stop at deep C state (C3/C4...) entry/exit. this
patch add the logic that use platform timer (HPET) to reenable local
APIC timer at C state entry/exit.
Signed-off-by: Wei Gang <gang.wei@intel.com> Signed-off-by: Yu Ke <ke.yu@intel.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Tue, 20 May 2008 13:36:05 +0000 (14:36 +0100)]
hvm: rombios interface for HVM S3
- add S3 package in ACPI DSDT table. Guest OS will get S3 value from
this package and write the value to PM1A control register to
trigger S3 suspend.
- Add S3 resume logic in rombios post code. the CMOS shutdown register
is used to indicate if this is a S3 resume.
- if it is s3 resume, rombios will get wakeup vector from ACPI FACS
table and jump to wakeup vector. Per ACPI spec, the wakeup vector
jumping must be the forms CS:IP, in which CS=3D(wakeup vector>>4)
IP=3D(wakeup vector)&0xF, for example, for vector=3D0x12345,
CS:IP=3D0x1234:0x5
Note: clobber_entry_point will clobber the post entry, which make S3
resume not work. We will directly jmp to POST Entry if it in S3
Resume path.
Signed-off-by: Yu Ke <ke.yu@intel.com> Signed-off-by: Ke Liping <liping.ke@intel.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Tue, 20 May 2008 13:28:19 +0000 (14:28 +0100)]
ioemu: HVM virtual S3
- add S3 suspend logic in PM1A control register. when guest write
specific value to this register,
QEMU will trigger S3 sleep by
* reset all qemu device
* set CMOS shutdown status as S3 resume, so that rombios will do
S3 resume later
* request Xen to S3-suspend the guest
Signed-off-by: Yu Ke <ke.yu@intel.com> Signed-off-by: Liping Ke <liping.ke@intel.com? Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Tue, 20 May 2008 08:41:52 +0000 (09:41 +0100)]
ioemu: Fix interpretation of missing or zero vfb videoram
Changeset 17289:d97e61001d81: introduced vfb configuration parameter
videoram, defaulting to zero. Value zero was interpreted as
unlimited. Changeset 17630:53195719f762 accidentally dropped the
special case for zero, which broke guests that don't specify videoram,
or specify videoram=0. Restore the old behavior.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Keir Fraser [Mon, 19 May 2008 08:43:42 +0000 (09:43 +0100)]
x86: Fix kexec reservation
The reservation of space for the kexec area in
kexec_reserve_area is incorrect. It specifies the
start address and size to reserve_e820_mem when
the args should be start and end.
Keir Fraser [Mon, 19 May 2008 08:42:18 +0000 (09:42 +0100)]
ioemu: Fix load of PCI-device IRQ state after save/restore.
From: Ian Jackson <Ian.Jackson@eu.citrix.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Fri, 16 May 2008 08:37:19 +0000 (09:37 +0100)]
Provide Px statistic data to user through libxc
Sampling and collecting dynamic Px statistic data, including
Px state value, Px count, Px residency time, Px transition
matrix, etc. Provide Px statistic data to user through libxc.
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
Keir Fraser [Fri, 16 May 2008 08:30:10 +0000 (09:30 +0100)]
ioemu: serial save/load fix
This patch fixes several bugs in serial.c
(1) A typo in serial_save() where qemu_get_8s is called (should be
qemu_put_8s)
(2) No support provided in serial_load() for version_id == 1 (should
unmarshal a 1 byte s->divider and should provide a default value
for s->fcr)
(3) Call serial_ioport_write() to initialize s->fcr. It is not
sufficient to load its value; other hidden values (such as
s->recv_fifo.itl) must be re-initialized.
Signed-off-by: Ben Guthro <bguthro@virtualiron.com> Signed-off-by: Robert Phillips <rphillips@virtualiron.com>
Keir Fraser [Thu, 15 May 2008 15:40:51 +0000 (16:40 +0100)]
xend: Device configurations of suspended virtual machines are inaccessible
The device configurations of suspended virtual machines are
inaccessible even though for example the UUIDs of the VIFs and VBDs
are known and returned when VM.get_VIFs()/get_VBDs() is called, though
when trying to access their records for example, then handle is
reported as being invalid. This patch fixes this.
Keir Fraser [Thu, 15 May 2008 08:38:00 +0000 (09:38 +0100)]
x86: Fix an S3 bug caused by x_firmware_waking_vector
According to ACPI spec., x_firmware_waking_vector in FACS is for
waking up in protected mode and firmware_waking_vector is for in real
mode. Xen once use x_firmware_waking_vector which can make S3 failed
on some platform. This patch fixed the bug by using non-x one.
Keir Fraser [Thu, 15 May 2008 08:36:38 +0000 (09:36 +0100)]
ioemu: Fix PVFB backend to limit frame buffer size
The recent fix to validate the frontend's frame buffer description
neglected to limit the frame buffer size correctly. This lets a
malicious frontend make the backend attempt to map an arbitrary amount
of guest memory, which could be useful for a denial of service attack
against dom0.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Isaku Yamahata [Thu, 15 May 2008 05:53:48 +0000 (14:53 +0900)]
[IA64] Build new infrastructure for fast fault handling path.
1. use jump table to dispatch virtualization faults.
2. for virtualization faults, handler is executed with psr.i=0, psr.ic=0,
psr.bn=0. less context switch.
3. use register stack instead of memory stack to switch context.
4. Use C code to handle faults as possible, to reduce maintanance efforts,
remove assembly handlers for rsm , ssm, mov to psr, mov to rr.
5. add fast path C handler for rsm, ssm, mov to psr, rfi.
Isaku Yamahata [Thu, 15 May 2008 05:18:38 +0000 (14:18 +0900)]
[IA64] remove warnings in replace_grant_host_mapping()
This patch removes warnings in replace_grant_host_mapping().
> mm.c: In function 'replace_grant_host_mapping':
> mm.c:2194: warning: 'new_page_mfn' may be used uninitialized in this function
> mm.c:2190: warning: 'old_pte.pte' may be used uninitialized in this function
> mm.c:2188: warning: 'cur_pte.pte' may be used uninitialized in this function
Keir Fraser [Wed, 14 May 2008 13:12:53 +0000 (14:12 +0100)]
x86: Make MSI-X work with 64-bit BARs
The code for working out the base address of a 64-bit BAR currently
puts the two halves together in the wrong order and leaves the type
bits in the resulting value. It also treats
PCI_BASE_ADDRESS_MEM_TYPE_64 as a flag rather than an enumeration
value.
Signed-off-by: Neil Turton <nturton@solarflare.com>
Keir Fraser [Wed, 14 May 2008 12:55:26 +0000 (13:55 +0100)]
x86: Implement cpufreq ondemand policy
Based on initialized cpufreq infrustructure, setup a timer on
each PSD domain, periodicly sample cpu load and driver cpu to
some Px state according to cpu load and cpu coordination.
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
Keir Fraser [Wed, 14 May 2008 12:55:11 +0000 (13:55 +0100)]
x86: Setup cpufreq infrasturcture, driver and tools
Initializing basic Px data structure, setup cpufreq infrastructure:
* cpufreq data structure initializing, including freq table and policy;
* basic driver and tools, to measure freq or drive to Px target;
* setup _PSD domain to coordinately work;
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
Keir Fraser [Wed, 14 May 2008 12:25:19 +0000 (13:25 +0100)]
ia64: fix domain restore
A domain fails to restore on IA64 since cset 17524:18727843db60.
This patch fixes it temporarily. Guest CPUID configuration for IA64
might be implemented in the future.
Keir Fraser [Wed, 14 May 2008 08:52:25 +0000 (09:52 +0100)]
Fix XEN_SYSCTL_physinfo to handle NUMA info properly. Signed-off-by: Andre Przywara <andre.przywara@amd.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Wed, 14 May 2008 08:19:05 +0000 (09:19 +0100)]
xend: fix block protocol mismatch on save/restore
The protocol field of the blkif interface is correct at startup for a
guest of a different mode from dom0 (eg. 32-bit dom0, 64-bit guest).
However, this property is not persisted on save, so a later restore
(or migrate) will setup the block interface with the wrong mode.
Signed-off-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com> Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
Keir Fraser [Wed, 14 May 2008 08:16:40 +0000 (09:16 +0100)]
qemu: Fix shift-insert behavior
This patch is related to Changeset 15635:7bdc9f6407d3
<http://xenbits.xensource.com/staging/xen-unstable.hg?rev/7bdc9f6407d3>
[PVFB] Fix shift key for graphical vnc display.
With above patch, if a user presses shift-insert, qemu sends shift
down, shift up, insert down and then another shift key down (see trace
below). This makes it impossible to do shift insert pasting or use
guest hot shifted-Fkeys.
Shift Insert trace:
do_key_event():1135 keycode:2a shift down
kbd_put_keycode():539 keycode:2a send shift down
do_key_event():1135 keycode:d2 insert down
kbd_put_keycode():539 keycode:aa send shift up
kbd_put_keycode():539 keycode:e0 send insert down
kbd_put_keycode():539 keycode:52
do_key_event():1135 keycode:d2 insert up
kbd_put_keycode():539 keycode:e0 send insert up
kbd_put_keycode():539 keycode:d2
kbd_put_keycode():539 keycode:2a send shift down
do_key_event():1135 keycode:2a shift up
kbd_put_keycode():539 keycode:aa send shift up
This patch adds a check for the keycode being shiftable, something
other than a keypad key, f1-12 , insert, del , etc. before allowing
the press_shift_up() operation.
Keir Fraser [Tue, 13 May 2008 14:08:17 +0000 (15:08 +0100)]
ioemu: Fix PVFB backend to validate frontend's frame buffer description
A buggy or malicious frontend can describe its shared framebuffer to
the backend in a way that makes the backend map an arbitrary amount of
guest memory, malloc an arbitrarily large internal buffer, copy
arbitrary memory to that buffer, even beyond its end. A domU running
a malicious frontend can abuse the former two for denial of service
attacks against dom0. It can abuse the third to write arbitrary
backend memory. It can abuse all three to terminate or crash the
backend. Arbitrary code execution looks quite feasible.
In more detail (ignoring #ifdef CONFIG_STUBDOM code):
The frame buffer is described by the following parameters:
* fb_len (size of shared framebuffer)
* width, height, depth
* row_stride, offset
fb_len is fixed on startup. The frontend can modify the other
parameters by sending a XENFB_TYPE_RESIZE event.
xenfb_read_frontend_fb_config() limits fb_len according to backend
configuration parameter videoram (from xenstore), if present. I
believe videoram is not present by default.
xenfb_map_fb() uses fb_len to map the frontend's framebuffer.
The frontend can make it map arbitrarily much, unless limited by the
videoram configuration parameter. This flaw always existed.
xenfb_register_console() and xenfb_on_fb_event() pass width, height,
depth and rowstride to QEMU's DisplayState object. The object sets
itself up to work directly on the framebuffer (shared_buf true) if
parameters allow that. Else it allocates an internal buffer of size
height * width * depth / 8 (shared_buf false).
The frontend can make it allocate arbitrarily much. This flaw always
existed.
xenfb_register_console() and xenfb_on_fb_event() pass width, height,
depth and rowstride to QEMU's DisplayState object. The object sets
itself up to work directly on the framebuffer (shared_buf true) if
parameters allow that. Else it allocates an internal buffer of size
height * width * depth / 8 (shared_buf false).
The frontend can make it allocate arbitrarily much. This flaw was
introduced by the move of PVFB into QEMU (xen-unstable cset 16220
ff).
xenfb_on_fb_event() uses width and height to clip the area of an
update event. It then passes that area to xenfb_guest_copy().
xenfb_invalidate() passes the complete screen area to
xenfb_guest_copy(). xenfb_guest_copy() copies the argument area (x,
y, w, h) into the internal buffer, unless shared_buf is true. This
copies h blocks of memory. The i-th copy (counting from zero) copies
w * depth / 8 bytes
from
shared framebuffer + offset + (y + i) * row_stride + x * depth / 8
to
internal buffer + (y + i) * ds->linesize + x * ds->depth / 8
where ds->linesize and ds->depth are parameters of the internal buffer
chosen by the backend.
This copy can be made to read from the shared framebuffer and write to
the internal buffer out of bounds. I believe the frontend can abuse
this to write arbitrary backend memory.
The flaw in its current form was introduced by the move of PVFB into
QEMU (xen-unstable cset 16220 ff). Before, the framebuffer was always
shared.
From: Markus Armbruster <armbru@redhat.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser [Tue, 13 May 2008 09:40:49 +0000 (10:40 +0100)]
Intel vmx: To correctly detect default1 vmx features which may
actually be switched to 0, we must check VMX_BASIC_MSR[55] and
possibly check a set of 'true' feature MSRs.
Signed-off-by: Jun Nakajima <jun.nakajima@intel.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
projects / xen.git / log