This limits the ability of the guest to play around with its own rings, and DoS
itself.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
This solves a long-standing issue in which the pages backing these rings were
pages belonging to dom0 user-space processes. Thus, if the process would die
unexpectedly, Xen would keep posting events to a page now belonging to some
other process.
We update all API-consumers in tree (xenpaging and xen-access).
This is an API/ABI change, so please speak up if it breaks your accumptions.
The patch touches tools, hypervisor x86/hvm bits, and hypervisor x86/mm bits.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
Don't use the superfluous shared page, return the event channel directly as
part of the domctl struct, instead.
In-tree consumers (xenpaging, xen-access) updated. This is an ABI/API change,
so please voice any concerns.
Known pending issues:
- pager could die and its ring page could be used by some other process, yet
Xen retains the mapping to it.
- use a saner interface for the paging_load buffer.
This change also affects the x86/mm bits in the hypervisor that process the
mem_event setup domctl.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
Remove costly mem_sharing audits from the inline path, and instead make them
callable as a memop.
Have the audit function return the number of errors detected.
Update memshrtool to be able to trigger audits.
Set sharing audits as enabled by default.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Signed-off-by: Adin Scannell <adin@scannell.ca>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
Per page operations in the paging, sharing, and access tracking subsystems are
all implemented with domctls (e.g. a domctl to evict one page, or to share one
page).
Under heavy load, the domctl path reveals a lack of scalability. The domctl
lock serializes dom0's vcpus in the hypervisor. When performing thousands of
per-page operations on dozens of domains, these vcpus will spin in the
hypervisor. Beyond the aggressive locking, an added inefficiency of blocking
vcpus in the domctl lock is that dom0 is prevented from re-scheduling any of
its other work-starved processes.
We retain the domctl interface for setting up and tearing down
paging/sharing/mem access for a domain. But we migrate all the per page
operations to use the memory_op hypercalls (e.g XENMEM_*).
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla>
Signed-off-by: Adin Scannell <adin@scannell.ca>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
Build tests as part of the tools build.
It is enabled with CONFIG_TESTS in Config.mk
Currently disabled build of tests/regressions and tests/xen-access (in
32-bit mode) as they fail.
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
This is demo code meant to showcase how to perform sharing
operations. It is useful for testing.
[ Added appropriate lines to .hgignore and .gitignore -iwj ]
Signed-off-by: Adin Scannell <adin@scannell.ca>
Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Fix a bug of xen-mceinj tool which used to test mce by software way.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
Committed-by: Keir Fraser <keir@xen.org>
The only cases where we might end up emulating fsincos (as any other
x87 operations without memory operands) are
- when a HVM guest is in real mode (not applicable on AMD)
- between two half page table updates in PAE mode (unlikely, and not
doing the emulation here does affect only performance, not
correctness)
- when a guest maliciously (or erroneously) modifies an (MMIO or page
table update) instruction under emulation (unspecified behavior)
Hence, in order to avoid the erratum to cause harm to the entire host,
don't emulate fsincos on the affected AMD CPU families.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Clone the existing movq emulation to also support the most fundamental
SIMD FP moves.
Extend the testing code to also exercise these instructions.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Extend the existing movq emulation to also support its SSE2 and AVX
variants, the latter implying the addition of VEX decoding. Fold the
read and write cases (as most of the logic is identical), and add
movntq and variants (as they're very similar).
Extend the testing code to also exercise these instructions.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Incorrect register usage in the _start() wrapper caused the 64-bit
execution emulation to fail.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Committed-by: Keir Fraser <keir@xen.org>
Up to now a single ring buffer was used for mem_share, xenpaging and
xen-access. Each helper would have to cooperate and pull only its own
requests from the ring. Unfortunately this was not implemented. And
even if it was, it would make the whole concept fragile because a crash
or early exit of one helper would stall the others.
What happend up to now is that active xenpaging + memory_sharing would
push memsharing requests in the buffer. xenpaging is not prepared for
such requests.
This patch creates an independet ring buffer for mem_share, xenpaging
and xen-access and adds also new functions to enable xenpaging and
xen-access. The xc_mem_event_enable/xc_mem_event_disable functions will
be removed. The various XEN_DOMCTL_MEM_EVENT_* macros were cleaned up.
Due to the removal the API changed, so the SONAME will be changed too.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Tim Deegan <tim@xen.org>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Tim Deegan <tim@xen.org>
Fix a couple of minor bugs in xen-access test program:
* Fix -m option handling.
* Fix a segfault that was occurring during program exit.
Signed-off-by: Aravindh Puthiyaparambil <aravindh@virtuata.com>
Several places include it in CFLAGS even though it is never defined. A
few others use it as nothing more than a gathering point for
CFLAGS. Get rid of it.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Otherwise make can search the path relative to certain standard paths
such as /usr/include (e.g., the line '-include $(XEN_ROOT)/.config' in
Config.mk suffers from this).
Signed-off-by: Keir Fraser <keir@xen.org>
Added a test tool to let the memory access APIs be tested. This tool
logs to stdout the memory accesses that the domain given is performing.
Signed-off-by: Joe Epstein <jepstein98@gmail.com>
Signed-off-by: Keir Fraser <keir@xen.org>
Implement the test cases. Each of cases will call the common function,
then call mce inject tool. README for Xen MCE test suite, include the
framwork and test instruction.
Signed-off-by: Yunhong Jiang <yunhong.jiang@intel.com>
Signed-off-by: Haicheng Li<haicheng.li@intel.com>
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
Implement some common shell functions and variable definitions are
defined to be used by test cases Verify fuctions include domain0 user
space tool mcelog, Xen dmesg and guest kernel log verification.
Signed-off-by: Yunhong Jiang <yunhong.jiang@intel.com>
Signed-off-by: Haicheng Li<haicheng.li@intel.com>
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
A software MCE injection tool, which is based on Xen MCE injection
mechanism. It fake MCE error and inject this error to a assigned
Domain Physical Address. Makefile make sure the tool can be built on
Xen. A README explain the usage for this tool.
Signed-off-by: Yunhong Jiang <yunhong.jiang@intel.com>
Signed-off-by: Haicheng Li<haicheng.li@intel.com>
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
and PV/ramdisk
Add support for 'file:' and 'data:' URI schemes for the parameters
'PV/kernel' and 'PV/ramdisk' in the VM.create() call. The 'data:'
scheme handling enables using a file which is stored inside the
management system (from where the XenAPI call is send) as kernel or
ramdisk.
Notes:
o all included: a detailed description can be found in the xenapi
documentation
o bumped up the version of the API document to 1.0.8 (because of
(minimal) interface extension)
o Future enhancements (like http:, ftp: schemes) fit seamlessly into
the current design / classes
o Unittest cases and xm-test case included
Signed-off-by: Andreas Florath <xen@flonatel.org>
Defer fail_if()-s as much as possible (in favor of possibly generating
exceptions), and avoid generating exceptions when not strictly
necessary.
Avoid fail_if()-s for simple return code checks (making the code that
used them consistent with other, longer existing code).
Eliminate redundant generate_exception_if()-s checking lock_prefix
(which is already covered by the general check prior to decoding
operands).
Also fix the testing code to add PROT_EXEC for the mapping that is
intended to have instruction executed from.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
o scripts and Makefile are mostly location independent now
(exception XEN_ROOT in Makefile)
o use of $() instead of ${} in Makefile
From: Andreas Florath <xen@flonatel.org>
Signed-off-by: Keir Fraser <Keir.Fraser@eu.citrix.com>
without deferring the test execution of CC. This avoids extra
executions of CC every time CFLAGS is expanded.
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Also clean up cmpxchg() callback handling so we can get rid of teh
specific cmpxchg8b handler.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
the caller. This is used in cases where the writeback may be to an
MMIO region with side effects (the APIC EOI register is the main
example of this).
Also fix up build of the x86_emulate user-space test harness.
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Tim Deegan
Andres Lagar-Cavilla
Liu, Jinsong
Jan Beulich
Keir Fraser
Olaf Hering
Aravindh Puthiyaparambil
Ian Campbell
Joe Epstein
Keir Fraser
Keir Fraser
kfraser@localhost.localdomain
kaf24@localhost.localdomain