Coverity ID 1055563
In the original function, mmap() could be called with a length of -1 if the
second lseek failed and the caller had not provided max_size.
While fixing up this error, improve the logging of other error paths. I know
from personal experience that debugging failures function is rather difficult
given only "xc_dom_malloc_filemap: failed (on file <somefile>)" in the logs.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
If the console or store mfn chunks are not present in the migration stream,
stack junk gets reported for the mfns.
XenServer had a very hard to track down VM corruption issue caused by exactly
this issue. Xenconsoled would connect to a junk mfn and incremented the ring
pointer if the junk happend to look like a valid gfn.
Coverity ID: 1056093 1056094
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
For pvh guests, epte_get_entry_emt() is incorrectly returning WB for
all mem types because of the following check:
if ( !v->domain->arch.hvm_domain.params[HVM_PARAM_IDENT_PT] )
Skip the check for pvh guests.
Also note, MTRR ranges are not maintained for pvh, and a solution is
being contrived using PAT.
Signed-off-by: Mukesh Rathor <mukesh.rathor@oracle.com>
Reviewed-off-by: Jan Beulich <jbeulich@suse.com>
Nonlazy xstates should be xsaved each time when vcpu_save_fpu.
Operation to nonlazy xstates will not trigger #NM exception, so
whenever vcpu scheduled in it got restored and whenever scheduled
out it should get saved.
Currently this bug affects AMD LWP feature, and later Intel MPX
feature. With the bugfix both LWP and MPX will work fine.
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
Furthermore, during restore we also need to set nonlazy_xstate_used
according to the incoming accumulated XCR0.
Also adjust the changes to i387.c such that there won't be a pointless
clts()/stts() pair.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
The aim of this patch is to define a stable way in which PVH is
going to do AP bringup.
Since we are running inside of a HVM container, PVH should only need
to set flags, cr3 and user_regs in order to bring up a vCPU, the rest
can be set once the vCPU is started using the bare metal methods.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
Setting a queue's READY bit for every event added to the queue
introduces a race.
If an event is added to the tail of a queue, the guest may consume the
newly added event and leave an empty queue before the READY is set.
The guest may then see a stale HEAD value and if the event at the
stale head became linked onto a different queue, the guest would
consume events from the wrong queue (corrupting it).
As noted in section 4.1.2 of the design document, only set READY if a
new HEAD is set. This ensures that if the guest sees a READY bit set
the corresponding HEAD is valid.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
In the case of the GIC, timer and write_properties the argument is the node,
not the parent. Rename the argument to "node" in this case.
I think this stems from the use of the name "np" in other places (confusing
"node parent" for "node pointer"). Therefore replace all uses of "np" with
"node".
In addition in write_properties now that np=>node the name pp makes no sense.
Rename it to "prop".
No semantic change.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
The intention of adding this node to contain the GIC, timer and memory nodes
(in 1c08d6004e) was to allow us to control the #address-cells and
However in the case of the memory node the #*-cells are always taken from the
root node (see ePAPR 3.1, "the following nodes shall be present at the root...
memory node"). This caused breakage on the arndale platform.
In addition it is not valid to just create sub-nodes like this. Unless they
declare themselves as a bus then they will not necessarily be enumerated
(although Linux currently does so in practice).
Therefore:
- Move the memory node back to the top level.
- Insert the timer and primary gic nodes in the same location as the host
DTB, replacing the originals. Note that the nodes here may be marked as in
use by Xen and therefore the check must be before we discard nodes used by
Xen.
- Drop any secondary gics.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Tested-by: Julien Grall <julien.grall@linaro.org>
nmi_shootdown_cpus() is called during a crash to park all the other
CPUs. This changes the NMI trap handlers which means there's no point
in having the watchdog still running.
This also disables the watchdog before executing any crash kexec image
and prevents the image from receiving unexpected NMIs.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
PVOps Linux as a kexec image shoots itself in the foot otherwise.
On a Core2 system, Linux declares a firmware bug and tries to invert some bits
in the performance counter register. It ends up setting the number of retired
instructions to generate another NMI to fewer instructions than the NMI
interrupt path itself, and ceases to make any useful progress.
The call to disable_lapic_nmi_watchdog() must be this late into the kexec path
to be sure that this cpu is the one which will execute the kexec image.
Otherwise there are race conditions where the NMIs might be disabled on the
wrong cpu, resulting in the kexec image still receiving NMIs.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Host S3 implicitly resets the host TSC to 0, but the tsc offset for hvm
domains is not recalculated when they resume, causing it to go into
negative values. In Linux guest using tsc clocksource, this results in
a hang after wrap back to positive values since the tsc clocksource
implementation expects it reset.
Signed-off-by: Tomasz Wroblewski <tomasz.wroblewski@citrix.com>
Pass a full set of cpu_user_regs, and defer the hand-coded stack printing to
_show_trace(), which will correctly use frame pointers if available.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Move the boundary into current.h along with the other stack manipulation code.
The boundary is now the word adjacent to a struct cpu_info on the stack.
This also fixes the somewhat spurious bounds for the case with frame pointers.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Before, show_trace() had two implementations depending on
CONFIG_FRAME_POINTER. Some parts were common, while the loops to wander up
the stack were different.
The version aided by frame pointers had a special case for function calls on
wild function pointers, but this doesn't need to be a special case.
After the refactoring, there are now two implementations of _show_trace()
which differ depending on CONFIG_FRAME_POINTER, and a single show_trace()
with the common bits, including the logic for wild function pointers.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
An application which uses libxl_osevent_register_hooks, and doesn't
use libxl_sigchld_owner_mainloop, would never properly experience the
deaths of its (libxl) children.
This is because the SIGCHLD self pipe would be handled using ad-hoc
code in beforepoll_internal and afterpoll_internal. However, this is
no good if application is using the fd registration system instead; in
that case these functions would not be called and nothing would deal
with readability of the self pipe.
Fix this as follows:
The SIGCHLD self pipe now is now dealt with by a standard libxl__ev_fd
handler, which is registered and deregistered along with the SIGCHLD
handler itself. The handler function subsumes the ad-hoc response
code removed from beforepoll_internal, and the functionality of
libxl__fork_selfpipe_woken.
This is also tidier as the SIGCHLD self pipe is no longer touched
outside libxl_fork.c other than in ctx initialisation and teardown.
(The ad-hoc arrangements for poller->wakeup_pipe in
beforepoll_internal and afterpoll_internal are OK because the
libxl__poller mechanism exists to wake up threads which are sitting
inside libxl's poll loop, so is not applicable to the application's
event loop.)
Reported-by: Bamvor Jian Zhang <bjzhang@suse.com>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Bamvor Jian Zhang <bjzhang@suse.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Jim Fehlig <jfehlig@suse.com>
Previously, libxl_sigchld_owner_libxl_always was mishandled. It would
result in libxl paying no attention to the sigchld self pipe.
Fix this by fixing chldmode_ours so that it returns true iff we are
supposed to be handling SIGCHLD.
Additionally, we arrange to use chldmode_ours everywhere where we are
installing/removing signal handlers and/or deciding whether to check
the self pipe, etc. This means it needs a new "creating" flag
argument for the benefit of libxl__ev_child_fork, which needs to
install the signal handler in libxl_sigchld_owner_libxl even if there
are not currently any children.
ctx->childproc_hooks->chldowner is now interpreted only by
chldmode_ours.
Reported-by: Bamvor Jian Zhang <bjzhang@suse.com>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Bamvor Jian Zhang <bjzhang@suse.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Jim Fehlig <jfehlig@suse.com>
---
v2: Get sense of chldmode test right in perhaps_removehandler (!)
We are going to want the gc for libxl__ev_fd_register.
No functional change in this patch. Simply change the argument types,
and the actual arguments from ctx to gc. Inside these functions, use
CTX (the macro which uses gc) rather than the old formal parameter
ctx.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
The current usage prevents naming a vif "dev". Although the current syntax is
documented in Squeeze's ip(8) it appears that this was a documentation bug.
Newer versions of the man page describe the new syntax used here and Squeeze's
implementation accepts it as well.
This is Debian bug #705659.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=705659
Mike provided the initial patch to tools/hotplug/Linux/xen-network-common.sh
and Ian extended it to catch some cases in vif-* too.
Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
Signed-off-by: Mike <debian@good-with-numbers.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Release-acked-by: George Dunlap <george.dunlap@eu.citrix.com>
On ARM, when an initrd is given to xen by U-boot, it will reserve the memory
in the device tree.
In this case, when xen decides to free unused memory, dt_unreserved_regions
will call init_domheap_pages with the start and the end of range equals. But
the latter assumes that (start > end), if not Xen will hang because the
number of pages is equals to (unsigned)-1.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Keir Fraser <keir@xen.org>
Acked-by: Ian Campbell <Ian.campbell@citrix.com>
CC: Jan Beulich <jbeulich@suse.com>
The commit 99bf30a "xen: arm: define guest virtual platform in API headers"
modifies gicv_setup to either use harcoded addresses for guest or hardware
addresses for dom0. In the latter case, the variable dom0 is not yet
initialized. dom0 receives assignment by the return of domain_create which
calls gicv_setup.
Use the ID to know whether the domain is dom0 or not.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Uses xc_dom_devicetree_mem which was just added. The call to this needs to be
carefully sequenced to be after xc_dom_parse_image (so we can tell which kind
of guest we are building, although we don't use this yet) and before
xc_dom_mem_init which tries to decide where to place the FDT in guest RAM.
Removes libxl_noarch which would only have been used by IA64 after this
change. Remove IA64 as part of this patch.
There is no attempt to expose this as a configuration setting for the user.
Includes a debug hook to dump the dtb to a file for inspection.
On v7 the CPU compat is currently hardcoded to cortex-a15. This likely wants
to change at some point.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Making room for a 64 bit implementation.
Also fix a typo and stop refering to it as a bzImage, which is an x86-ism.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
The tools and the hypervisor need to agree on various aspects of the guest
environment, such as interrupt numbers, memory layout, initial register values
for registers which are implementation defined etc. Therefore move the
associated defines into the public interface headers, or create them as
necessary.
This just exposes the current de-facto standard guest layout, which may be
subject to change in the future. This deliberately does not make the guest
layout dynamic since there is currently no need.
These values should not be exposed to guests, they should find these things
out via device tree or should not be relying on implementation defined
defaults.
Various bits of the hypervisor needed to change to configure dom0 with the real
platform values while using the virtual platform configuration for guests.
Arrange for this where appropriate and plumb through as needed.
We also need to expose some 64-bit values (e.g. PSR_GUEST64_INIT) for the
benefit of 32 bit toolstacks building 64 bit guests.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
This is subarch specific to plumb through to arm32 and arm64 versions.
The toolstack uses this to select 32- vs 64-bit guests (or rather it does on
x86 and soon will for arm too).
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Mixing these two together is a pain, it forces us to prepare the dtb before
processing the kernel which means we don't know whether the guest is 32- or
64-bit while we construct its DTB.
Instead split out the memory allocation (including 1:1 workaround handling)
and p2m setup into a separate phase and then create a memory node in the DTB
based on the result.
This allows us to move kernel parsing before DTB setup.
As part of this it was also necessary to rework where the decision regarding
the placement of the DTB and initrd in RAM was made. It is now made when
loading the kernel, which allows it to make use of the zImage/ELF specific
information and therefore to make decisions based on complete knowledge and do
it right rather than guessing in prepare_dtb and relying on a later check to
see if things worked.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Julien observed that we were relying on the provided host DTB supplying
suitable #address-cells and #size-cells values to allow us to represent these
addresses, which may not reliably be the case. Moving these under our own
known (somewhat analogous to the use of /soc/ or /motherboard/ on some
platforms) allows us to control these sizes.
Since the new node is created out of thin air it does not have a corresponding
struct dt_device_node and therefore we cannot use dt_n_addr_cells or
dt_n_size_cells, we can use hardcoded constants instead. For the same reason
we define and use set_xen_range instead of dt_set_range.
The hypervisor, cpus and psci node all either defined #foo-cells for their
children or do not contain reg properties and therefore can remain at the top
level.
The logging in make_gic_node was inconsistent. Fix it.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Julien Grall <julien.grall@linaro.org>
Actually, if an error occurs, Xen will silently ignore it and continue.
Convert platform_init to a void function and panic if we fail to
correctly initialize the platform.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Most of ioremap_* caller check if ioremap returns NULL. Actually, if the
physical address is non-aligned, Xen will return the pointer given by
__vmap plus the offset in the page. So if ioremap_* fails, the caller
will retrieve an non-NULL address and continue as if there was no error.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Commit 86781624 ("x86_emulate: PUSH <mem> must read source operand
just once") corrected the operands of those of the operations of opcode
extension group 5 that only read memory from SrcMem to DstMem, but
failed to also switch the use of "dst" here to "src".
Reported-by: Anthony Perard <anthony.perard@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Anthony Perard <anthony.perard@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Andrew Cooper