In the absence of VT-d interrupt remapping support, a device can send
arbitrary APIC messages to host CPUs. One class of attack that results
is to confuse the hypervisor by delivering asynchronous interrupts to
vectors that are expected to handle only synchronous
traps/exceptions.
We block this class of attack by:
(1) setting APIC.TPR=0x10, to block all interrupts below vector
0x20. This blocks delivery to all architectural exception vectors.
(2) checking APIC.ISR[vec] for vectors 0x80 (fast syscall) and 0x82
(hypercall). In these cases we BUG if we detect we are handling a
hardware interrupt -- turning a potentially more severe infiltration
into a straightforward system crash (i.e, DoS).
Thanks to Invisible Things Lab <http://www.invisiblethingslab.com>
for discovery and detailed investigation of this attack.
Signed-off-by: Keir Fraser <keir@xen.org>
The checks in assert_irq and deassert_irq to distinguish interrupts
that have been remapped onto event channels from the others that have
to be injected using the emulated lapic are wrong.
Fix the condition checks using the convenient hvm_domain_use_pirq
function.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
HVM VPMU support can be enabled for AMD Family 12h and 14h processors
by taking the same code path as 10h.
Signed-off-by: Jacob Shin <jacob.shin@amd.com>
On 64-bit Xen, hypercalls from 32-bit HVM guests are handled as
a special case, but not all the hypercalls are corrently redirected
to their compat-mode wrappers. Use compat_* for xen_version,
sched_op and set_timer_op for consistency.
Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
Nested SVM was unaware of the HVM direct vector eventchn mechanism.
Attached patch fixes a host crash when starting a KVM L2 guest on a
pv-on-hvm L1 Linux guest (e.g., HVM Debian Squeeze domU).
Signed-off-by: Uwe Dannowski <Uwe.Dannowski@amd.com>
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
Acked-by: Tim Deegan <Tim.Deegan@citrix.com>
1). Add explicitly uc=pcc=1 fatal error detect, since under such case
the s/ar/over bits status is undefined and hence may be
mis-cleaned. Explicit fatal detect return 0 indicate stick MSR bank
will have chance to be handled after reboot by polling;
2). Fix a little bug for case SRAR, over bit should be 0 when need
clear bank, otherwise it would reset system;
3). When clear bank, add clear MCi_ADDR/MISC if it's valid, according
to Intel SDM;
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
This patch fix a minor bug, when in xen context and cannot safely
return the mce break point, reset system;
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Bank addr maybe invalid, or Bank addr maybe physical/memory/linear
address or segment offset. This patch add mca
MCi_STATUS_MISCV/MCi_STATUS_ADDRV check, and add physical address
verify, so that it work safe when calculate domain.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Start to make a clearer distinction between generic p2m functions and
the implementation of the datastructure as an x86 pagetable.
Also move the EPT datastructure implementation into x86/mm/ to match,
and split the PoD admin code into its own file.
This is just code motion, except for splitting the p2m_initialise
function into a pt-specific part and a common part.
Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
The functions which interpret the kernel image supplied for a
paravirtualised guest, and decompress it into memory when booting the
domain, are incautious. Specifically:
(i) Integer overflow in the decompression loop memory allocator might
result in overrunning the buffer used for the decompressed image;
(ii) Integer overflows and lack of checking of certain length fields
can result in the loader reading its own address space beyond the
size of the supplied kernel image file.
(iii) Lack of error checking in the decompression loop can lead to an
infinite loop.
This patch fixes these problems.
CVE-2011-1583.
Signed-off-by: Ian Campbell <Ian.Campbell@eu.citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Add intel_srao_check for future SRAR extension;
Add a wrapper to SRAO handler to make it more extensible for future
SRAO error-code types;
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
1) A little cleanup for mce_action(), remove redundant input param;
2) result should be MCA_NEED_RESET instead of MCA_RESET, otherwise
system cannot reset when fatal;
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Current mca_summay use uint32_t as bitmask of bank uc/pcc/recoverable.
It's not extensible, support no more than 32 mca banks, while
according to Intel SDM, bank number could be as much as 256.
This patch use bool_t flag since it only need to record and indicate
the most severity case.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
This patch enables SVM to handle LWP related MSRs and CPUID. It
intercepts guests read/write to LWP_CFG. It also save/restore LWP_CFG
when guests touch this MSR. The LWP_CBADDR MSR is not intercepted
because this MSR is handled by xsave/xrstor.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Currently Xen relies on #NM (via CR0.TS) to trigger FPU context
restore. But not all FPU state is tracked by TS bit. This function
creates two FPU restore functions: vcpu_restore_fpu_lazy() and
vcpu_restore_fpu_eager(). vcpu_restore_fpu_lazy() is still used when
#NM is triggered. vcpu_restore_fpu_eager(), as a comparision, is
called for vcpu which is being scheduled in on every context
switch. To minimize restore overhead, it creates a flag,
nonlazy_xstate_used, to control non-lazy restore.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Xen currently sets mask bits of xsave() and xrstor() to all 1's. This
patch adds a mask option to xsave() and xrstor().
Signed-off-by: Wei Huang <wei.huang2@amd.com>
This patch cleans up context restore function. It renames the function
name to vcpu_restore_fpu(). It also extracts FPU restore code (frstor,
fxrstor, xrstor) out into seperate functions. vcpu_restor_fpu() will
dispatch to these functions depending on CPU's capability.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
This patch cleans up context save function. It renames the save
function to vcpu_save_fpu() because existing function name is
confusion. It also extracts FPU context save code (fsave, fxsave,
xsave) into seperate functions. vcpu_save_fpu() will call
corresponding sub-function depending on CPU's capability.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Extract FPU initialization and destroy code into two functions. These
functions handle memory allocation/deallocation for FPU context.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Current extended code is mixing with FPU code in i387.c. As part of
FPU code cleanup, this patch moves all extended state code into
independent files. Not much semantic are changed and most function
names are kept untouched, except for xsave() and xsaveopt(). These two
functions are combined into a single function.
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Remove unneeded cast when assigning pointer value to dst.
Both arrays are uint32_t and memcpy takes a void pointer.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Move the global variable t_info_first_offset into
calculate_tbuf_size() because it is only used there. Change the type
from u32 to uint32_t to match type in other places.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Fix a couple of minor bugs in xen-access test program:
* Fix -m option handling.
* Fix a segfault that was occurring during program exit.
Signed-off-by: Aravindh Puthiyaparambil <aravindh@virtuata.com>
AMD Family 15h CPU mirrors legacy K7 performance monitor counters to
a new location, and adds 2 new counters. This patch updates HVM VPMU
to take advantage of the new counters.
Signed-off-by: Jacob Shin <jacob.shin@amd.com>
AMD Family 15h CPU mirrors legacy K7 performance monitor counters to
a new location, and adds 2 new counters. This patch updates xenoprof
to take advantage of the new counters.
Signed-off-by: Jacob Shin <jacob.shin@amd.com>
Rename fam15h -> amd_fam15h in a few places, as suggested by Jan
Beulich.
Signed-off-by: Keir Fraser <keir@xen.org>
Update xenoprof's cpu_type to match upstream oprofile. Currently AMD
Family 11h ~ Family 15h are broken due to string mismatches.
Signed-off-by: Jacob Shin <jacob.shin@amd.com>
- proper handling of governor command line options when using the
default governor
- warning message for unrecognized command line options
- replacing a NR_CPUS sized array with per-CPU data
- a couple of __read_mostly annotations
Signed-off-by: Jan Beulich <jbeulich@novell.com>
It would seem possible to fold the two trees into one (making e.g. the
emuirq bits stored in the upper half of the pointer), but I'm not
certain that's worth it as it would make deletion of entries more
cumbersome. Unless pirq-s and emuirq-s were mutually exclusive...
v2: Split setup/teardown into two stages - (de-)allocation (tree node
(de-)population) is done with just d->event_lock held (and hence
interrupts enabled), while actual insertion/removal of translation
data gets done with irq_desc's lock held (and interrupts disabled).
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Fix up for new radix-tree implementation. In particular, we should
never insert NULL into a radix tree, as that means empty slot (which
can be reclaimed during a deletion). Make use of
radix_tree_int_to_ptr() (and its inverse) to hide some of these
details.
Signed-off-by: Keir Fraser <keir@xen.org>
We still leave behind features we don't need such as tagged nodes.
Other changes:
- Allow callers to define their own node alloc routines.
- Only allocate per-node rcu_head when using the default RCU-safe
alloc routines.
- Keep our own radix_tree_destroy().
In future it may also be worth getting rid of the complex and
pointless special-casing of radix-tree height==0, in which a single
data item can be stored directly in radix_tree_root. It introduces a
whole lot of special cases and complicates RCU handling. If we get rid
of it we can reclaim the 'indirect pointer' tag in bit 0 of every slot
entry.
Signed-off-by: Keir Fraser <keir@xen.org>
The AMD IOMMU pagetable-sharing code switched p2m type 0 to be
r/w RAM rather than invalid. Be more careful when translating
from PTEs to p2m types that we don't treat all-zeros as a
RAM mapping of frame zero.
Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
xl command options are currently handled in each command's sub function,
leading to a lot of duplicate code.
This patch moves the common part of it into a separate function,
which handles the help switch, unknown options and an insufficient
number of parameters. This removes a lot of redundant code.
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
The balloon driver in the guest frees guest pages and marks them as
mmio. When the kernel crashes and the crash kernel attempts to read the
oldmem via /proc/vmcore a read from ballooned pages will generate 100%
load in dom0 because Xen asks qemu-dm for the page content. Since the
reads come in as 8byte requests each ballooned page is tried 512 times.
Add a new hvmop HVMOP_get_mem_type to return the hvmmem_type_t for the
given pfn. Pages which are neither ram or mmio will be HVMMEM_mmio_dm.
This interface enables the crash kernel to skip ballooned pages.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Tim Deegan <Tim.Deegan@citrix.com>
Committed-by: Tim Deegan <Tim.Deegan@citrix.com>
With this it is questionable whether retaining struct domain's
nr_pirqs is actually necessary - the value now only serves for bounds
checking, and this boundary could easily be nr_irqs.
Another thing to consider is whether it's worth storing the pirq
number in struct pirq, to avoid passing the number and a pointer to
quite a number of functions.
Note that ia64, the build of which is broken currently anyway, is only
partially fixed up.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
It would seem possible to fold the two trees into one (making e.g. the
emuirq bits stored in the upper half of the pointer), but I'm not
certain that's worth it as it would make deletion of entries more
cumbersome. Unless pirq-s and emuirq-s were mutually exclusive...
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Building 4-level guest walks is unnecessary for x86-32, and with this
no longer being built the fallback code used here isn't necessary
anymore either.
Additonally the mechanism to determine the value of
GUEST_PAGING_LEVELS to be passed to the compiler can be much
simplified given that we're using a pattern rule here.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Update the Linux stdio functions prototypes, and move them to a
separate header, licenced under GPL2+. Import FreeBSD8 string
functions prototypes, update licence. Drop kvec, of unsure source and
useless anyway.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Import lib/math.c functions (and thus licence) from FreeBSD 8,
and re-apply a few of our changes. Whitespaces left aside, this
leads to almost no source change except s/int64_t/quad_t/ and
s/uint64_t/u_quad_t/.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Keir Fraser
Stefano Stabellini
Jacob Shin
Tim Deegan
Christoph Egger
Liu, Jinsong
Ian Jackson
Wei Huang
Olaf Hering
Aravindh Puthiyaparambil
Jan Beulich
Andre Przywara
Samuel Thibault