Fix a bug of xen-mceinj tool which used to test mce by software way.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
Actions requiring IS_PRIV should also require some XSM access control
in order for XSM to be useful in confining multiple privileged
domains. Add XSM hooks for new hypercalls and sub-commands that are
under IS_PRIV but not currently under any access checks.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
The mmu_update hypercall can be used to manipulate the page tables of
a remote domain. Add a check for this in the XSM hook in addition to
the existing check on mapping pages of a remote domain.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
oxenstored is an ocaml implementation of the xenstore daemon. It is faster,
more scalable and more reliable than the C xenstored.
In particular the transaction model in oxenstored does not involve taking a
complete copy of the database and aborting on any (even non-conflicting) other
change.
There is a paper on the design and implementation of oxenstored at
http://gazagnaire.org/pub/GH09.pdf which includes a performance evaluation and
comparison with the C daemon etc.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
The only cases where we might end up emulating fsincos (as any other
x87 operations without memory operands) are
- when a HVM guest is in real mode (not applicable on AMD)
- between two half page table updates in PAE mode (unlikely, and not
doing the emulation here does affect only performance, not
correctness)
- when a guest maliciously (or erroneously) modifies an (MMIO or page
table update) instruction under emulation (unspecified behavior)
Hence, in order to avoid the erratum to cause harm to the entire host,
don't emulate fsincos on the affected AMD CPU families.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
/var/lib/xen/qemu-save.<domid> is created when the stub domain is started
(connected to a stubdom console) and is used to save the device model state on
suspend/migrate but never cleaned up.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Otherwise at the default level we rarely log anything at all.
A completely empty log file is a good sign, but only if you know you are
looking in the right place...
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
First though:
- Move it to /etc/xen/oxenstored.conf.
- Use /var/run/xenstored.pid as default pid file
- Disable test-eagain "Randomly failed a transaction with EAGAIN. Used for
testing Xs user". Doesn't sound fun by default...
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Previous an unknown operation would be decoded as a Not_found exception which
would bubble all the way up to the try ... with surrounding the call to
main_loop where it would be logged and ignored.
This would leave the guest hanging waiting for a response to the invalid
request.
Instead introduce a specific "Invalid" operation. Higher level functionality,
such as Process.process_packet, already handles operations which are not
understood with an error reply due to the final wildcard entry in
Process.function_of_type but explicitly handle Invalid this way to make it
clear what is going on.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
It is unused.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Since 23565:72eafe80ebc1 the xenstore entries for the stubdomain's PCI were
never created and therefore the stubdom ends up waiting forever for the devices
which it has been asked to insert to show up.
Since the stubdomain is already running when we call the libxl_device_pci_add
loop in do_domain_create we should treat it as if "starting == 0".
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
When user wants to change entry in grub2 menu in pygrub, there's no
response in case of appending command line arguments ('a' key).
Append malfunction is caused by change of keyword used for kernel
record. Grub uses 'kernel' for line with linux kernel but grub2 uses
'linux' instead. This patch adds checking for both grub 1 and 2 keywords.
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
When user wants to change entry in grub2 menu in pygrub, there
may be crash of pygrub in case of editing item ('e' key).
Crash on editing is caused longer entry list in case of grub2. As entry
window is 10 lines high, it can hold only 8 entries (2 lines for border).
Adding line outside of windows high causes crash. Patch add handling
for longer lists and scrolling through them.
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
It has been hiding actual mistakes, and there are not too many changes
necessary to make things build without suppressing this warning.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Replace
libxl__gc gc = LIBXL_INIT_GC(ctx);
...
libxl__free_all(&gc);
with
GC_INIT(ctx);
...
GC_FREE;
throughout with a couple of perl runes.
We must then adjust uses of the resulting gc for pointerness, which is
mostly just replacing all occurrences of "&gc" with "gc". Also a
couple of unusual uses of LIBXL_INIT_GC needed to be fixed up by hand.
Here are those runes:
perl -i -pe 's/\Q libxl__gc gc = LIBXL_INIT_GC(ctx);/ GC_INIT(ctx);/' tools/libxl/*.c
perl -i -pe 's/\Q libxl__free_all(&gc);/ GC_FREE;/' tools/libxl/*.c
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
libxl_internal.h now #includes libxl.h and various system headers.
This
1. makes the order of header inclusion more predictable
2. explicitly allows libxl_internal.h to use objects defined in libxl.h
3. removes the need for individual files to include these headers
Also
- remove some unnecessary #includes of libxl_utils.h,
flexarray.h, etc. in some libxl*.c files,
- include libxl_osdeps.h at the top of libxl_internal.h
- add missing includes of libxl_osdeps.h to a couple of files
- change libxl.h to libxl_internal.h in a couple of files
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Provide some macros which are useful shorthands for use within libxl:
* GC_INIT to initialise a gc from a ctx and GC_FREE to free it
* CTX(gc) to give you back the ctx
* LIBXL_TAILQ_INSERT_SORTED for inserting things into sorted lists
These will be used by later patches.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
GCC and C99 allow declarations to be mixed with code. This is a good
idea because:
* It allows variables to be more often initialised as they are
declared, thus reducing the occurrence of uninitialised variable
errors.
* Certain alloca-like constructs (arrays allocated at runtime on the
stack) can more often be written without a spurious { } block.
Such blocks are confusing to read.
* It makes it easier to write and use macros which declare and
initialise formulaic variables and do other function setup code,
because there is no need to worry that such macros might be
incompatible with each other or have strict ordering constraints.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Instead of generating:
typedef struct {
...
} libxl_foo;
Produce:
typedef struct libxl_foo {
...
} libxl_foo;
This makes it possible to refer to libxl idl-generated structs and
unions, as incomplete types, before they have been defined.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
This provides for fields in libxl datatypes which are only present in
the C version of structures and are used only by libxl itself. This
is useful when a libxl datatype wants to contain fields which are used
by libxl internally and which are only present in the structure to
avoid additional memory allocation inconvenience.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
We would like some linked list macros which are (a) well known to be
sane and (b) typesafe. BSD's queue.h meets these criteria.
We also provide some simple perlery to arrange to add the libxl_
namespace prefix to the macros. This will allow us to #include
_libxl_list.h in our public header file without clashing with anyone
else who is also using another version of queue.h.
(A note on copyright: The FreeBSD files we are adding have an
[L]GPL-compatible licence, so there is no need to change our COPYING.
Although FreeBSD's queue.3 still contains the advertising clause, this
has been withdrawn by UCB as recorded in the FreeBSD COPYRIGHT file,
which is included in tools/libxl/external/ for reference.)
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <Ian.campbell@citrix.com>
Tested-by: Roger Pau Monne <roger.pau@entel.upc.edu>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Event-driven programs want to wait until the xs_fileno triggers for
reading, and then repeatedly call xs_check_watch.
Also xs_read_watch exposes a useless "num" out parameter, which should
always (if things aren't going hideously wrong) be at least 2 and
which the caller shouldn't be interested in. So xs_check_watch
doesn't have one of those.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
either GCC 4.6.1 or Ubuntu add -Werror=format-security to the -Wall set,
so libxl compilation breaks:
libxl_create.c: In function 'store_libxl_entry':
libxl_create.c:454:9: error: format not a string literal and no
format arguments [-Werror=format-security]
cc1: all warnings being treated as errors
Attached patch fixes this and another occurrence.
Patch from: Uwe Dannowski
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Fix insufficient quoting between "tap-ctl list" and
xend/server/BlktapController.py
The "line.split(None, 4)" needs to be a "3", because 3 splits needs to
be done to get the 4 parts. Sorry for the mixup.
[ fix to 24335:3915bd95ade5. -iwj ]
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
This patch is used to prepare exposing PCID/INVPCID features to hvm
guest.
The specific exposure result depend on hvm paging mode (hap/shadow),
which would be handled at next patch.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
Do not expose the ACPI power management "_PS0/3" Method to guest
firmware. According to section 3.4 of the APCI specification 4.0, PCI
device control the device power through its own specification but not
through APCI.
Qemu pushes "_PS0/3" to guest will cause a mess between ACPI PM and
PCI PM as a result of incorrect ACPI table shipped with the guest
BIOS, it may cause a failure of PCI device PM state transition(from
PCI_UNKNOWN to PCI_D0).
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
Signed-off-by: Haitao Shan <haitao.shan@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
The 32-bit tools need to support 64-bit addresses, so use the correct
printf/scanf formats. Also, some systems declare fscanf with attribute
warn_unused_result, so check the result instead of relying on the
value of start being unmodified across a failed call.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Unfortunately a HID of PNP0A06 will not work for an existing client
driver so this patch aims to choose something that's pretty certain
not to class with anything else.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
This allows a PCI device and its associated resources to be labeled
without hardcoding addresses (which may change from system to system)
in the security policy.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
The domU SID is never used before a policy load, and so does not
belong in the initial_sids list.
The PIRQ SID is now incorrectly named; it should simply be called IRQ.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
The PHYSDEVOP_alloc_irq_vector hypercall is a noop, so its XSM check
is not useful. Remove it and the "event vector" FLASK permission.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Version 26 of checkpolicy (shipped with Fedora 16) now requires that
roles be declared prior to setting types for a role. Add a declaration
of the system_r role to fix the build of default XSM/FLASK policy.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Pushing stuff onto the stack on x86-64 when we do not specify
-mno-red-zone is unsafe. Since the complicated asm is due to register
pressure on i386, we simply implement an all-new simpler alternative
for x86-64.
Signed-off-by: Keir Fraser <keir@xen.org>
Acked-by: Jan Beulich <jbeulich@novell.com>
It's not really any more useful than explicitly setting new M2P
entries to the invalid value.
Signed-off-by: Tim Deegan <tim@xen.org>
Committed-by: Keir Fraser <keir@xen.org>
Supports the xl subcommand sched-sedf.
The man page is only a minimal version (copy from xm man page without
examples). BTW: the xm man page seems not to be in sync with xm sched-sedf -h
regarding the time units. I used milliseconds in the xl implementation.
Only minimal semantical checks of parameters.
Signed-off-by: juergen.gross@ts.fujitsu.com
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Just a typo...
Signed-off-by: juergen.gross@ts.fujitsu.com
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Supports the xl subcommand sched-credit2.
Signed-off-by: juergen.gross@ts.fujitsu.com
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Adds cpupool awareness to output of xl sched-credit. Output can now be
restricted to a specific cpupool. The domains are printed for each cpupool
seperately.
The loop over cpupools and domains is seperated from the main command
implementation to be able to support other schedulers as well.
Signed-off-by: juergen.gross@ts.fujitsu.com
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
The help text of xl sched-credit supported long options. Neither the man page
nor the implementation did.
Signed-off-by: juergen.gross@ts.fujitsu.com
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Liu, Jinsong
Daniel De Graaf
Ian Campbell
Jan Beulich
Miroslav Rezanina
Ian Jackson
Andre Przywara
Philipp Hahn
Xudong Hao
Paul Durrant
Keir Fraser
Tim Deegan
Juergen Gross