Since 28d386fc43 (XSA-57), libxl writes an empty value for the
console tty node, with read-only permission for the guest, when
setting up pv console "frontends". (The actual tty value is later set
by xenconsoled.) Writing an empty node is not strictly necessary to
stop the frontend from writing dangerous values here, but it is a good
belt-and-braces approach.
Unfortunately this confuses xenconsole. It reads the empty value, and
tries to open it as the tty. xenconsole then exits.
Fix this by having xenconsole treat an empty value the same way as no
value at all.
Also, make the error opening the tty be nonfatal: we just print a
warning, but do not exit. I think this is helpful in theoretical
situations where xenconsole is racing with libxl and/or xenconsoled.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
CC: George Dunlap <george.dunlap@eu.citrix.com>
---
v2: Combine two conditions and move the free
If xenconsole (the client program) fails, it calls err. This would
previously neglect to reset the user's terminal to sanity. Use atexit
to do so.
This routinely happens in Xen 4.4 RC5 with pygrub because libxl
writes the value "" to the tty xenstore key when using xenconsole.
After this patch this just results in a harmless error message.
Reported-by: M A Young <m.a.young@durham.ac.uk>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: M A Young <m.a.young@durham.ac.uk>
CC: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
v2: Fix whitespace error (reintroduce hard tab)
Fix commit message not to claim ignorance about root cause
Currently we check the pty path received from xenstore with access(); if
it indicates that the pty is not accessible, we loop around and wait for
a new path to appear in xenstore.
This has several issues:
* If a path has been written to xenstore, it can be assumed that that
pty should already be accessible to xenconsole, and hence any error
that occurs while trying to open it should be fatal and not ignored
* If access() indicates no access to the pty, the memory allocated for
the path is leaked when going around the loop again
* The accessibility of the pty could change between the access() and
open() calls, leading to a TOCTOU race (this is what Coverity is
complaining about).
By removing the explicit access() check and just erroring out whenever
open() fails, we fix all these issues.
Coverity-ID: 1056047
Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
This is a regression introduced by
"Switch from select() to poll() in xenconsoled's IO loop."
hg c/s 26405:7359c3122c5d
git cc5434c933
which results in reliable segfaults during VM power operations.
Switch to calloc(3) in an effort to avoid similar problems with changes in the
future.
Signed-off-by: Marcus Granado <marcus.granado@citrix.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Grant references for the xenstore and xenconsole shared pages exist, but
currently only xenstore uses these references. Change the xenconsole
daemon to prefer using the grant reference over map_foreign_range when
mapping the shared console ring.
This allows xenconsoled to be run in a domain other than dom0 if set up
correctly - for libxl, the xenstore path /tool/xenconsoled/domid
specifies the domain containing xenconsoled.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
In Linux select() typically supports up to 1024 file descriptors. This can be
a problem when user tries to boot up many guests. Switching to poll() has
minimum impact on existing code and has better scalibility.
pollfd array is dynamically allocated / reallocated. If the array fails to
expand, we just ignore the incoming fd.
Updated: reset *_pollfd after use.
This fixes regression 14869.
Also remove unused slave_pollfd in strcut domain.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
In Linux select() typically supports up to 1024 file descriptors. This can be
a problem when user tries to boot up many guests. Switching to poll() has
minimum impact on existing code and has better scalibility.
pollfd array is dynamically allocated / reallocated. If the array fails to
expand, we just ignore the incoming fd.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
xenconsoled expected domains that are being shutdown to end up in the
the DYING state and would only clean-up such domains. HVM domains
either didn't enter the DYING state or weren't in long enough for
xenconsoled to notice.
For every shutdown HVM domain, xenconsoled would leak memory, grow its
list of domains and (if guest console logging was enabled) leak the
log file descriptor. If the file descriptors were leaked and enough
HVM domains were shutdown, no more console connections would work as
the evtchn device could not be opened. Guests would then block
waiting to send console output.
Fix this by tagging domains that exist in enum_domains(). Afterwards,
all untagged domains are assumed to be dead and are shutdown and
cleaned up.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
The xenstore header xs.h is producing conflicts with other software[1].
xs is a too short identifier and does not matche the library. Renaming
the headers to xenstore.h and xenstore_lib.h is the easiest way to make
them easy recognizable and prevent furthe problems.
[1]: http://bugs.debian.org/668550
[ Also update QEMU_TAG, to bring in corresponding change to
qemu-xen-traditional. -iwj ]
Signed-off-by: Bastian Blank <waldi@debian.org>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
--HG--
rename : tools/xenstore/xs.h => tools/xenstore/xenstore.h
rename : tools/xenstore/xs_lib.h => tools/xenstore/xenstore_lib.h
Create two new variables called APPEND_ and PREPEND_ to add compile
flags at the beginning or at the end of the search path.
Added a new semantic for user defined compile flags, here is the list
of possible options:
PREPEND_LIB: add libraries to the search path before xen
(before xen installation folders).
PREPEND_INCLUDES: add headers to the search path before xen
(before xen installation folders).
APPEND_LIB: add libraries to the search path at the end
(after all xen installation folders have been added).
APPEND_INCLUDES: add libraries to the search path at the end
(after all xen installation folders have been added).
EXTRA_INCLUDES and EXTRA_LIB can still be used, and they will have the
same effect as PREPEND_INCLUDES and PREPEND_LIB.
Signed-off-by: Roger Pau Monne <roger.pau@entel.upc.edu>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
A fair few things under tools link against libraries which they don't
even use.
Most of this appears to come from copy-and-pasting previous Makefile
snippets and cargo-culting plus the tendency to define global $(LIBS)
even for Makefiles which build multiple separate utilities or
libraries.
Identified by comparing a build with --as-needed to one without by
looking at the NEEDED header of all ELF objects.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Otherwise make can search the path relative to certain standard paths
such as /usr/include (e.g., the line '-include $(XEN_ROOT)/.config' in
Config.mk suffers from this).
Signed-off-by: Keir Fraser <keir@xen.org>
This makes the interface consistent with the changes made to the main
interface in 21483:779c0ef9682c.
Also fix some references to "struct xc_interface" which should have
been simply "xc_interface" in tools/xenpaging, and update QEMU_TAG to
pull in the corresponding qemu change.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
The double indirection has been unnecessary since 9867:ec61a8c25429,
there is no possibility of the buffer being reallocated now.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
This patch implements the new protocol for handling pv consoles and
emulated serials as described in the document docs/misc/console.txt.
The changes are:
- xenconsoled: do not write the pty under serial in xenstore if
xenconsoled is handling a consolepath;
- xenconsole: implement support for an explicit console type parameter;
the parameter can be "pv", to specify that the user wants to
connect to a pv console, or "serial", to specify that the user wants to
connect to an emulated serial. If the type parameter hasn't been
specified be the user, xenconsole tries to guess which type of console
it has to connect to, defaulting to pv console for pv guests and
emulated serial for hvm guests.
- xenconsole: use the new xenstore paths;
- libxl: rename libxl_console_constype to libxl_console_consback:
constype is used to to specify whether qemu or xenconsoled provides the
backend, so I renamed it to libxl_console_consback to make it more
obvious that we are talking about backends;
- libxl: add a new libxl_console_constype to specify if the console is
an emulated serial or a pv console;
- libxl: support the new xenconsole "type" command line parameter;
- libxl: use the "output" node under console in xenstore to tell qemu
where do we want the output of this pv console to go;
- remove the legacy "serialpath" from xenconsoled altogether
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Also: update the QEMU_TAG to pull in the qemu part of these changes.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
It has been unused since 21732:eb34666befcc.
Removing the include of sys/ptrace.h and threaddb.h exposed a few
places which were using time(2) or gettimeofday(2) without including
time.h or sys/time.h respectively and were relying on an include.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Linker command lines are order-sensitive.
Move linker options -Lfoo -lfoo from LDFLAGS to LDLIBS and place this new
variable after the objects to link. This resolves build errors in xenpagin
and blktap with recent toolchains.
rename SHLIB_CFLAGS to SHLIB_LDFLAGS
rename LDFLAGS_* to LDLIBS_*
move LDFLAGS usage after CFLAGS in CC calls
remove stale comments in xenpaging Makefile
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
out of file descriptors meaning new the console of new domains are not
logged.
Seems to have been accidentally removed in 16638:28921e83000b.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
LOG_WARNING (or precisely LOG_DEBUG if -v) would be logged.
xenconsoled only actually logs using LOG_ERR and LOG_DEBUG so for the
most part we would have been logging absolutely nothing up until now.
Linux provides a LOG_UPTO macro but I'm not sure how portable that is
so I have opencoded the list of levels.
Do I get some sort of prize for fixing a bug introduced in 2005?
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
This can just mean we have raced with the bootloader exiting and if we
continue we will likely see the real domain console show up.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
This patch eliminate the global variables in libxenctrl (used for
logging and error reporting).
Instead the information which was in the global variables is now in a
new xc_interface* opaque structure, which xc_interface open returns
instead of the raw file descriptor; furthermore, logging is done via
xentoollog.
There are three new parameters to xc_interface_open to control the
logging, but existing callers can just pass "0" for all three to get
the old behaviour.
All libxc callers have been adjusted accordingly.
Also update QEMU_TAG for corresponding qemu change.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Discard guest console data in bigger chunks so that there are fewer
discontinuities in the console data. Also avoid discarding data if
space is available at the front of the buffer by reclaiming that
space.
Patch from: Christian Limpach <Christian.Limpach@citrix.com>
Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
Segmentation fault occurs if DOMID isn't specified.
Some check be added to output error message in this situation.
Signed-off-by: Yu Zhiguo <yuzg@cn.fujitsu.com>
This patch adds a new command line argument to xenconsole to specify
to which console to connect to in case a domain has more than one.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Event-channel setup: Re-bind if the connection becomes unbound (e.g.,
due to 'slow' domain suspend cancellation), even if the remote port
identifier has not changed.
Domain logging: Only open log file once (don't leak fds) and fix a
small memory leak.
Evtchn changes based on a patch by Jiri Denemark <jdenemar@redhat.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Make sure that tty semantics are active for Solaris ptys, or if they
aren't (and not needed) to not do tcget/setattr on the filedescriptor
in Python code.
Also work around a bug in the Solaris ptm streams driver, which will
cause a write error on the master side of a pty (because of e.g. a
missing slave) to persist forever.
Signed-off-by: Frank van der Linden <frank.vanderlinden@sun.com>
I printed the terminal attributes after openpty() and they were
garbage on the first console, valid on the second etc.
openpty() gets garbage in (uninitialized attributes MODIFIED by
cfmakeraw()). It sets the slave to the attributes requested. Using
uninitialized data for cfmakeraw->openpty results in pty attributes
that may even have the receiver disabled. Closing the slave just hides
the bug as these attributes disappear and hope the slave will be
reopened and initialized.
From: Juergen Hannken-Illjes <hannken@netbsd.org>
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
After openpty(), slave_fd must be closed or guest console output goes
to the slave while select() in xen console client listens on the
master.
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
If you use -MMD -MF then the correct .o filename is written to the
.*.d file as the compiler driver arranges everything. This was done
in 19010:275abe1c5d24 for the hypervisor.
In this patch we do the same elsewhere in the xen-unstable tree,
particularly tools/. Specifically:
* Change tools/Rules.mk to add -MMD -MF ... to CFLAGS and set DEPS.
* Remove -Wp,-MD... from every other Makefile
* Remove setting of DEPS from every other Makefile
* Ensure that every Makefile says -include $(DEPS)
* Ensure that every Makefile's clean target removes $(DEPS)
Some Makefiles were already halfway there, but often for a different
variable name eg PROG_DEP. The variable name is now standardised in
Rules.mk as DEPS.
I have done a test build with this change, on Debian etch.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Currently if someone changes the date on the host, xenconsoled may
behave incorrectly due to the use of gettimeofday for the rate control
algorithm. For example I was able to hang the console connected to a
guest just setting the date forward 20 years. To solve the problem we
need to use a time source that doesn't change start point, that is
clock_gettime with CLOCK_MONOTONIC. The only bad side effect is that
it introduces a dependency to librt, but I think is well worth it.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
than discard characters in the console daemon buffers.
New option: -o, --overflow-data=discard|keep
This option changes the behaviour when dealing with data that overflow
the max capacity of the buffer. If overflow-data is set to discard
(the default), the current behaviour is used: we discard some data in
the middle of the buffer.
If overflow-data is set to keep, we stop listening to the ring until
we free some space in the buffer. This can cause the ring to fill up
and the guest kernel internal buffer to fill up as well. When this
happens the guest kernel stops reading characters from the console
device so the application generating data hangs. When xenconsoled
resumes reading from the ring, the guest kernel will be able to resume
reading from the console device as well. At that point the guest
application will be allowed to continue.
The risk of making this behaviour the default is that existing kernel
drivers may assume they can rely on timely ring updates by the console
daemon and thus themselves block on the ring being emptied.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Previously a newline was forced after every call to
write_with_timestamp. This could result in some ugly logs when a
single console line stretched over multiple calls. This change carries
some extra state to determine if we ended the last call to
write_with_timestamp on a newline, and prints the timestamp as
appropriate.
This also fixes a bug where logging hv messages was dependent on the
guest timestamp flag.
Signed-off-by: Cole Robinson <crobinso@redhat.com>
mb/rmb/wmb. Instead add a xen_ prefix. Modify Xen's public headers to
expect the prefixed names instead of bare mb/rmb/wmb, but gate this
expectation on a bump of __XEN_INTERFACE_VERSION__.
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Roger Pau Monne
Ian Jackson
Matthew Daley
Andrew Cooper
Wei Liu
Daniel De Graaf
Ian Campbell
David Vrabel
Ian Campbell
Roger Pau Monne
Keir Fraser
Stefano Stabellini
Stefano Stabellini
Keir Fraser