* Cleanly define a scratch area for temporary storage
* Raise Etherboot ROM out of the way of larger VGA BIOSes
Also detect virtual VGA adaptors more cleanly.
Signed-off-by: Jean Guyader <jean.guyader@eu.citrix.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Implement statistic interface for cx via sysctl & libxc. Provide a
easy way to collect processor cx info within dom0.
Signed-off-by: Wei Gang <gang.wei@intel.com>
- add S3 package in ACPI DSDT table. Guest OS will get S3 value from
this package and write the value to PM1A control register to
trigger S3 suspend.
- Add S3 resume logic in rombios post code. the CMOS shutdown register
is used to indicate if this is a S3 resume.
- if it is s3 resume, rombios will get wakeup vector from ACPI FACS
table and jump to wakeup vector. Per ACPI spec, the wakeup vector
jumping must be the forms CS:IP, in which CS=3D(wakeup vector>>4)
IP=3D(wakeup vector)&0xF, for example, for vector=3D0x12345,
CS:IP=3D0x1234:0x5
Note: clobber_entry_point will clobber the post entry, which make S3
resume not work. We will directly jmp to POST Entry if it in S3
Resume path.
Signed-off-by: Yu Ke <ke.yu@intel.com>
Signed-off-by: Ke Liping <liping.ke@intel.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
- add S3 suspend logic in PM1A control register. when guest write
specific value to this register,
QEMU will trigger S3 sleep by
* reset all qemu device
* set CMOS shutdown status as S3 resume, so that rombios will do
S3 resume later
* request Xen to S3-suspend the guest
Signed-off-by: Yu Ke <ke.yu@intel.com>
Signed-off-by: Liping Ke <liping.ke@intel.com?
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Changeset 17289:d97e61001d81: introduced vfb configuration parameter
videoram, defaulting to zero. Value zero was interpreted as
unlimited. Changeset 17630:53195719f762 accidentally dropped the
special case for zero, which broke guests that don't specify videoram,
or specify videoram=0. Restore the old behavior.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Sampling and collecting dynamic Px statistic data, including
Px state value, Px count, Px residency time, Px transition
matrix, etc. Provide Px statistic data to user through libxc.
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
This patch fixes several bugs in serial.c
(1) A typo in serial_save() where qemu_get_8s is called (should be
qemu_put_8s)
(2) No support provided in serial_load() for version_id == 1 (should
unmarshal a 1 byte s->divider and should provide a default value
for s->fcr)
(3) Call serial_ioport_write() to initialize s->fcr. It is not
sufficient to load its value; other hidden values (such as
s->recv_fifo.itl) must be re-initialized.
Signed-off-by: Ben Guthro <bguthro@virtualiron.com>
Signed-off-by: Robert Phillips <rphillips@virtualiron.com>
The device configurations of suspended virtual machines are
inaccessible even though for example the UUIDs of the VIFs and VBDs
are known and returned when VM.get_VIFs()/get_VBDs() is called, though
when trying to access their records for example, then handle is
reported as being invalid. This patch fixes this.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
The recent fix to validate the frontend's frame buffer description
neglected to limit the frame buffer size correctly. This lets a
malicious frontend make the backend attempt to map an arbitrary amount
of guest memory, which could be useful for a denial of service attack
against dom0.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
A domain fails to restore on IA64 since cset 17524:18727843db60.
This patch fixes it temporarily. Guest CPUID configuration for IA64
might be implemented in the future.
Signed-off-by: Kouya Shimura <kouya@jp.fujitsu.com>
The protocol field of the blkif interface is correct at startup for a
guest of a different mode from dom0 (eg. 32-bit dom0, 64-bit guest).
However, this property is not persisted on save, so a later restore
(or migrate) will setup the block interface with the wrong mode.
Signed-off-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
This patch is related to Changeset 15635:7bdc9f6407d3
<http://xenbits.xensource.com/staging/xen-unstable.hg?rev/7bdc9f6407d3>
[PVFB] Fix shift key for graphical vnc display.
With above patch, if a user presses shift-insert, qemu sends shift
down, shift up, insert down and then another shift key down (see trace
below). This makes it impossible to do shift insert pasting or use
guest hot shifted-Fkeys.
Shift Insert trace:
do_key_event():1135 keycode:2a shift down
kbd_put_keycode():539 keycode:2a send shift down
do_key_event():1135 keycode:d2 insert down
kbd_put_keycode():539 keycode:aa send shift up
kbd_put_keycode():539 keycode:e0 send insert down
kbd_put_keycode():539 keycode:52
do_key_event():1135 keycode:d2 insert up
kbd_put_keycode():539 keycode:e0 send insert up
kbd_put_keycode():539 keycode:d2
kbd_put_keycode():539 keycode:2a send shift down
do_key_event():1135 keycode:2a shift up
kbd_put_keycode():539 keycode:aa send shift up
This patch adds a check for the keycode being shiftable, something
other than a keypad key, f1-12 , insert, del , etc. before allowing
the press_shift_up() operation.
Signed-off-by: Pat Campbell <plc@novell.com>
Patch sends a UNIT_ATTENTION(6), MEDIUM_MAY_HAVE_CHANGED(0x28) sense
when cdrom transitions from not ready to ready.
ATA Packet interface for CD-ROMS, SFF8020i.pdf. See state diagram
Figure 12, page 82 and Table 44 -recommended Sense Key, ASC
With patch in place HVM win2008 server guest sees the CD/DVD contents
have changed when the media is switched.
Signed-off-by: Pat Campbell <plc@novell.com>
Patch puts 0xe0 prefix before putting right alt or right cntrl
keycodes. Also adds keysm definition for ISO_Left_Tab.
Signed-off-by: Pat Campbell <plc@novell.com>
A buggy or malicious frontend can describe its shared framebuffer to
the backend in a way that makes the backend map an arbitrary amount of
guest memory, malloc an arbitrarily large internal buffer, copy
arbitrary memory to that buffer, even beyond its end. A domU running
a malicious frontend can abuse the former two for denial of service
attacks against dom0. It can abuse the third to write arbitrary
backend memory. It can abuse all three to terminate or crash the
backend. Arbitrary code execution looks quite feasible.
In more detail (ignoring #ifdef CONFIG_STUBDOM code):
The frame buffer is described by the following parameters:
* fb_len (size of shared framebuffer)
* width, height, depth
* row_stride, offset
fb_len is fixed on startup. The frontend can modify the other
parameters by sending a XENFB_TYPE_RESIZE event.
xenfb_read_frontend_fb_config() limits fb_len according to backend
configuration parameter videoram (from xenstore), if present. I
believe videoram is not present by default.
xenfb_map_fb() uses fb_len to map the frontend's framebuffer.
The frontend can make it map arbitrarily much, unless limited by the
videoram configuration parameter. This flaw always existed.
xenfb_register_console() and xenfb_on_fb_event() pass width, height,
depth and rowstride to QEMU's DisplayState object. The object sets
itself up to work directly on the framebuffer (shared_buf true) if
parameters allow that. Else it allocates an internal buffer of size
height * width * depth / 8 (shared_buf false).
The frontend can make it allocate arbitrarily much. This flaw always
existed.
xenfb_register_console() and xenfb_on_fb_event() pass width, height,
depth and rowstride to QEMU's DisplayState object. The object sets
itself up to work directly on the framebuffer (shared_buf true) if
parameters allow that. Else it allocates an internal buffer of size
height * width * depth / 8 (shared_buf false).
The frontend can make it allocate arbitrarily much. This flaw was
introduced by the move of PVFB into QEMU (xen-unstable cset 16220
ff).
xenfb_on_fb_event() uses width and height to clip the area of an
update event. It then passes that area to xenfb_guest_copy().
xenfb_invalidate() passes the complete screen area to
xenfb_guest_copy(). xenfb_guest_copy() copies the argument area (x,
y, w, h) into the internal buffer, unless shared_buf is true. This
copies h blocks of memory. The i-th copy (counting from zero) copies
w * depth / 8 bytes
from
shared framebuffer + offset + (y + i) * row_stride + x * depth / 8
to
internal buffer + (y + i) * ds->linesize + x * ds->depth / 8
where ds->linesize and ds->depth are parameters of the internal buffer
chosen by the backend.
This copy can be made to read from the shared framebuffer and write to
the internal buffer out of bounds. I believe the frontend can abuse
this to write arbitrary backend memory.
The flaw in its current form was introduced by the move of PVFB into
QEMU (xen-unstable cset 16220 ff). Before, the framebuffer was always
shared.
From: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
This is because function "uname = config.get('uname', '')" returns '',
rather than None, if uname is not in config variable.
Signed-off-by: Xu Dongxiao <dongxiao.xu@intel.com>
If we define wrong values to a disk parameter in domain configuration
files, we get an error message or a guest OS panic.
1. If we define a wrong disk type, xm create command error occurs
about 100 seconds later.
e.g. disk=['xyz:/xen/root-vm1.img,hda1,w']
2. If we forget a disk type, a guest OS panic occurs.
e.g. disk=['/xen/root-vm1.img,hda1,w']
Signed-off-by: Masaki Kanno <kanno.masaki@jp.fujitsu.com>
* make the xenstore reader in qemu-dm's startup determine which
of qemu's block drivers to use according to the xenstore
backend `type' field. This `type' field typically comes from
the front of the drive mapping string in ioemu. The
supported cases are:
xm config file string `type' image format qemu driver
phy:[/dev/]<device> phy raw image bdrv_raw
file:<filename> file raw image bdrv_raw
tap:aio:<filename> tap raw image bdrv_raw
tap:qcow:<image> tap not raw autoprobe
tap:<cow-fmt>:<image> tap named format bdrv_<cow-fmt>
It is still necessary to autoprobe when the image is specified as
`tap:qcow:<image>', because qemu distinguishes `qcow' and `qcow2'
whereas blktap doesn't; `qcow' in xenstore typically means what
qemu calls qcow2. This is OK because qemu can safely distinguish
the different cow formats provided we know it's not a raw image.
* Make the format autoprobing machinery never return `raw'. This has
two purposes: firstly, it arranges that the `tap:qcow:...' case
above can be handled without accidentally falling back to raw
format. Secondly it prevents accidents in case the code changes in
future: autoprobing will now always fail on supposed cow files which
actually contain junk, rather than giving the guest access to the
underlying file.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
This has been broken since cset 16964:5d84464dc1fc
Also deal better with very early errors (close sender side socket)
Signed-off-by: Steven Hand <steven.hand@cl.cam.ac.uk>
If we define the form of list of string to "cpus" parameter,
different CPU affinities are set for each VCPU as follows.
# grep cpus /etc/xen/vm1
cpus = ["2", "3"]
vcpus = 2
# xm create vm1
Using config file "/etc/xen/vm1".
Started domain vm1
# xm vcpu-list vm1
Name ID VCPU CPU State Time(s)
CPU Affinity
vm1 1 0 2 r-- 3.5 2
vm1 1 1 3 -b- 3.2 3
If we define the form of string to "cpus" parameter as before,
a same CPU affinity is set for each VCPU as follows.
# grep cpus /etc/xen/vm2
cpus = "2,3"
vcpus = 2
# xm create vm2
Using config file "/etc/xen/vm2".
Started domain vm2
# xm vcpu-list vm2
Name ID VCPU CPU State Time(s)
CPU Affinity
vm2 2 0 3 -b- 3.0
2-3
vm2 2 1 2 r-- 2.6
2-3
Signed-off-by: Masaki Kanno <kanno.masaki@jp.fujitsu.com>
I am refactoring the security.on() call to return the actual type of
the security module that is found to be enabled rather than just
returning True or False.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Keir Fraser