... to indicate counting from the end of the modules list.
Suggested by Tim Deegan.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Replace
libxl__gc gc = LIBXL_INIT_GC(ctx);
...
libxl__free_all(&gc);
with
GC_INIT(ctx);
...
GC_FREE;
throughout with a couple of perl runes.
We must then adjust uses of the resulting gc for pointerness, which is
mostly just replacing all occurrences of "&gc" with "gc". Also a
couple of unusual uses of LIBXL_INIT_GC needed to be fixed up by hand.
Here are those runes:
perl -i -pe 's/\Q libxl__gc gc = LIBXL_INIT_GC(ctx);/ GC_INIT(ctx);/' tools/libxl/*.c
perl -i -pe 's/\Q libxl__free_all(&gc);/ GC_FREE;/' tools/libxl/*.c
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
libxl_internal.h now #includes libxl.h and various system headers.
This
1. makes the order of header inclusion more predictable
2. explicitly allows libxl_internal.h to use objects defined in libxl.h
3. removes the need for individual files to include these headers
Also
- remove some unnecessary #includes of libxl_utils.h,
flexarray.h, etc. in some libxl*.c files,
- include libxl_osdeps.h at the top of libxl_internal.h
- add missing includes of libxl_osdeps.h to a couple of files
- change libxl.h to libxl_internal.h in a couple of files
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Provide some macros which are useful shorthands for use within libxl:
* GC_INIT to initialise a gc from a ctx and GC_FREE to free it
* CTX(gc) to give you back the ctx
* LIBXL_TAILQ_INSERT_SORTED for inserting things into sorted lists
These will be used by later patches.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
GCC and C99 allow declarations to be mixed with code. This is a good
idea because:
* It allows variables to be more often initialised as they are
declared, thus reducing the occurrence of uninitialised variable
errors.
* Certain alloca-like constructs (arrays allocated at runtime on the
stack) can more often be written without a spurious { } block.
Such blocks are confusing to read.
* It makes it easier to write and use macros which declare and
initialise formulaic variables and do other function setup code,
because there is no need to worry that such macros might be
incompatible with each other or have strict ordering constraints.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Instead of generating:
typedef struct {
...
} libxl_foo;
Produce:
typedef struct libxl_foo {
...
} libxl_foo;
This makes it possible to refer to libxl idl-generated structs and
unions, as incomplete types, before they have been defined.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
This provides for fields in libxl datatypes which are only present in
the C version of structures and are used only by libxl itself. This
is useful when a libxl datatype wants to contain fields which are used
by libxl internally and which are only present in the structure to
avoid additional memory allocation inconvenience.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
We would like some linked list macros which are (a) well known to be
sane and (b) typesafe. BSD's queue.h meets these criteria.
We also provide some simple perlery to arrange to add the libxl_
namespace prefix to the macros. This will allow us to #include
_libxl_list.h in our public header file without clashing with anyone
else who is also using another version of queue.h.
(A note on copyright: The FreeBSD files we are adding have an
[L]GPL-compatible licence, so there is no need to change our COPYING.
Although FreeBSD's queue.3 still contains the advertising clause, this
has been withdrawn by UCB as recorded in the FreeBSD COPYRIGHT file,
which is included in tools/libxl/external/ for reference.)
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <Ian.campbell@citrix.com>
Tested-by: Roger Pau Monne <roger.pau@entel.upc.edu>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Event-driven programs want to wait until the xs_fileno triggers for
reading, and then repeatedly call xs_check_watch.
Also xs_read_watch exposes a useless "num" out parameter, which should
always (if things aren't going hideously wrong) be at least 2 and
which the caller shouldn't be interested in. So xs_check_watch
doesn't have one of those.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
either GCC 4.6.1 or Ubuntu add -Werror=format-security to the -Wall set,
so libxl compilation breaks:
libxl_create.c: In function 'store_libxl_entry':
libxl_create.c:454:9: error: format not a string literal and no
format arguments [-Werror=format-security]
cc1: all warnings being treated as errors
Attached patch fixes this and another occurrence.
Patch from: Uwe Dannowski
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Print this only once, for the boot CPU, unless "cpuinfo" was specified.
I found this particularly annoying on a machine which also didn't have
it MTRRs consistently set up across cores, resulting in the printing of
those messages being awfully slow (and with a second per-CPU message
added for debugging purposes this even lead to timeouts during AP
bringup).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Fix insufficient quoting between "tap-ctl list" and
xend/server/BlktapController.py
The "line.split(None, 4)" needs to be a "3", because 3 splits needs to
be done to get the 4 parts. Sorry for the mixup.
[ fix to 24335:3915bd95ade5. -iwj ]
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
This patch adds a new p2m access type, n2rwx. It allows for implement a "log
access" mode in the hypervisor, akin to log dirty but for all types of
accesses. Faults caused by this access mode automatically promote the
access rights of the offending p2m entry, place the event in the ring, and
let the vcpu keep on executing.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Signed-off-by: Adin Scannell <adin@scannell.ca>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
The mem event fault handler in the p2m can automatically promote the access
rights of a p2m entry. In those scenarios, vcpu's are not paused and they will
immediately retry the faulting instructions. This will generate a second fault
if the underlying entry type requires so (paging, unsharing, pod, etc).
Collapse the two faults into a single one.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
Add checks for access type. Be less reliant on implicit semantics.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
Ring semantics require that for every request, a response be put. This
allows consumer to place a dummy response if need be.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Signed-off-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
Don't require a separate domctl to notify the memevent interface that an event
has occured. This domctl can be taxing, particularly when you are scaling
events and paging to many domains across a single system. Instead, we use the
existing event channel to signal when we place something in the ring (as per
normal ring operation).
Signed-off-by: Adin Scannell <adin@scannell.ca>
Signed-off-by: Keir Fraser <keir@xen.org>
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
For event channels for which Xen is the consumer, there currently is
a single action. With this patch, we allow event channel creators to
specify a generic callback (or no callback). Because the expectation
is that there will be few callbacks, they are stored in a small table.
Signed-off-by: Adin Scannell <adin@scannell.ca>
Signed-off-by: Keir Fraser <keir@xen.org>
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Committed-by: Tim Deegan <tim@xen.org>
Add a new flag for mem events, as consumers might need to discriminate
foreign domain-caused from guest-caused events. The vcpu field of an
event is bogus from a consumer p.o.v. for foreign domain-caused events.
Also assert that we shouldn't be pausing foreign vcpus.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>
This patch is used to prepare exposing PCID/INVPCID features to hvm
guest.
The specific exposure result depend on hvm paging mode (hap/shadow),
which would be handled at next patch.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
Fail with -ERANGE rather than silently truncating 64bit values (a
physical address and size) into 32bit integers for dom0 to consume.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Simplify the bitwise arithmetic a bit.
Signed-off-by: Keir Fraser <keir@xen.org>
Do not expose the ACPI power management "_PS0/3" Method to guest
firmware. According to section 3.4 of the APCI specification 4.0, PCI
device control the device power through its own specification but not
through APCI.
Qemu pushes "_PS0/3" to guest will cause a mess between ACPI PM and
PCI PM as a result of incorrect ACPI table shipped with the guest
BIOS, it may cause a failure of PCI device PM state transition(from
PCI_UNKNOWN to PCI_D0).
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
Signed-off-by: Haitao Shan <haitao.shan@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
The 32-bit tools need to support 64-bit addresses, so use the correct
printf/scanf formats. Also, some systems declare fscanf with attribute
warn_unused_result, so check the result instead of relying on the
value of start being unmodified across a failed call.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Unfortunately a HID of PNP0A06 will not work for an existing client
driver so this patch aims to choose something that's pretty certain
not to class with anything else.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
This allows a PCI device and its associated resources to be labeled
without hardcoding addresses (which may change from system to system)
in the security policy.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
The domU SID is never used before a policy load, and so does not
belong in the initial_sids list.
The PIRQ SID is now incorrectly named; it should simply be called IRQ.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Attempting to manage the PIRQ namespace is not useful as guests can
assign any mapping of IRQ to PIRQ (although the identity mapping is
the most common). Change the internal names to reflect this change.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
The XSM hooks inside rangeset are not useful in capturing the PIRQ
mappings in HVM domains. They can also be called from softirq context
where current->domain is invalid, causing spurious AVC denials from
unrelated domains on such calls.
Within FLASK code, the rangeset hooks were already divided between
IRQs, I/O memory, and x86 IO ports; propagate this division back
through the XSM hooks and call the XSM functions directly when needed.
This removes XSM checks for the initial rangeset population for dom0
and the removal checks on domain destruction; denying either of these
actions does not make sense.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
This reverts 23220:56a3b9c7367f, which removes all validation of the
target pages in the mapping. This crash was solved by properly marking
pages without known SIDs in 22207:20f139010445.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
The PHYSDEVOP_alloc_irq_vector hypercall is a noop, so its XSM check
is not useful. Remove it and the "event vector" FLASK permission.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Version 26 of checkpolicy (shipped with Fedora 16) now requires that
roles be declared prior to setting types for a role. Add a declaration
of the system_r role to fix the build of default XSM/FLASK policy.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Pushing stuff onto the stack on x86-64 when we do not specify
-mno-red-zone is unsafe. Since the complicated asm is due to register
pressure on i386, we simply implement an all-new simpler alternative
for x86-64.
Signed-off-by: Keir Fraser <keir@xen.org>
Acked-by: Jan Beulich <jbeulich@novell.com>
It's not really any more useful than explicitly setting new M2P
entries to the invalid value.
Signed-off-by: Tim Deegan <tim@xen.org>
Committed-by: Keir Fraser <keir@xen.org>
Despite this array living in an __init function, having such be an
automatic variable is rather inefficient in terms of generated code.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Wei Wang2 <wei.wang2@amd.com>
Jan Beulich
Ian Jackson
Andre Przywara
Philipp Hahn
Andres Lagar-Cavilla
Andres Lagar-Cavilla
Liu, Jinsong
Andrew Cooper
Xudong Hao
Daniel De Graaf
Paul Durrant
Keir Fraser
Tim Deegan