- The patch includes a policy for xen that can be booted into
enforcing mode and supports creation and management of
paravirtualized guests. The policy follows the dom0/domU usage
model, extension to other models or the addition of management or IO
permissions should be much more straightforward now. The option
flask_enforcing=1 can be passed on the xen line in grub to boot
into enforcing mode.
- The policy provides a basic policy for booting the platform and
creating a domU with the label system_u:object_r:domU_t. The policy
can be easily extended to support new types by modifying the xen.te
source file.
- The policy includes some basic macros which may be helpful in
extending the policy.
- The policy is compatible with and requires the most recent XSM
patch, xsm-flask-io-sysctl-hooks-090308.diff.
- The policy is not built as part of the make all as it requires the
SELinux policy compiler which may/may not be installed on all
systems. Users must go into the tools/flask/policy directory and
explicitly compile the policy.
Signed-off-by: George Coker <gscoker@alpha.ncsc.mil>
- The patch refactors the IO resource checks into the rangeset add/del
code. This produces a much more architecture friendly implementation and
ensures that HVM and paravirtualized guests are checked consistently.
- The patch removes the following hooks in support of the refactoring
of the IO resource checks:
- xsm_irq_permission
- xsm_iomem_permission
- xsm_ioport_permission
- The patch adds the following hooks in support of the refactoring of
the IO resource checks:
- xsm_add_range
- xsm_remove_range
- These IO refactoring changes are transparent to any pre-existing
Flask policies.
- The patch adds also adds hooks for sysctl functionality that was
added since the last major XSM patch. The following hooks were added:
- xsm_set_target
- xsm_debug_keys
- xsm_getcpuinfo
- xsm_availheap
- xsm_firmware_info
- xsm_acpi_sleep
- xsm_change_freq
- xsm_getidletime
- xsm_sendtrigger
- xsm_test_assign_device
- xsm_assign_device
- xsm_deassign_device
- xsm_bind_pt_irq
- xsm_pin_mem_cacheattr
- xsm_ext_vcpucontext
Signed-off-by: George Coker <gscoker@alpha.ncsc.mil>
- The patch does away with the autogenerated xsm.py file and
introduces a config parameter in xend-config.sxp to determine the
security module. The parameter is (xsm_module_name {acm, dummy,
flask}). The default setting/option is dummy. .hgignore is also
updated to stop ignoring xsm.py on commits.
- The patch has created an xsconstant for XS_POLICY_FLASK and updated
the toolchain to check the instance of XS_POLICY_USE. XS_POLICY_USE
evalauates to XS_POLICY_FLASK or XS_POLICY_ACM or XS_POLICY_DUMMY
depending on configuration.
- Flask relies on the current value of ssidref returned by dominfo to
ensure that the label to sid mapping is consistent. ssidref had
been pop'ed from the dominfo object. The patch addresses this
issue.
- Flask python module style cleanups.
Signed-off-by: George Coker <gscoker@alpha.ncsc.mil>
By protecting entry/exit with a spinlock we can safely determine
precisely when it is required that we assert/deassert ARB_DISABLE.
Signed-off-by: Wei Gang <gang.wei@intel.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
The guest handle checks should use paging_* predicates, not shadow_*.
Also tidy up a few places where p2m definitions were being imported
via asm/guest_access.h -> asm/shadow.h -> asm/p2m.h
Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
Idle vcpu periodic timer is useless. It increased the lapic timer
interrupt number, which decreased the cpu idle residency. This patch
disables idle vcpu periodic timer via keeping v->periodic_period = 0.
The vcpu periodic timer may be expired 50us before expected time
because there is a 50us TIMER_SLOP used for soft timer (xen/common/timer.c,
timer_softirq_action()). This will cause vcpu_periodic_timer_work() be
continuously called tens of times in a single call of
timer_softirq_action() until (now > periodic_next_event). It brings
unnecessary overhead. This patch adds a similar time slop in vcpu
periodic timer to eliminate this overhead.
Signed-off-by: Wei Gang <gang.wei@intel.com>
This patch moves the call to XendDevices.destroy_device_state() to the
function _remove_domain. Previously only Xen-API calls were calling
the destroy_device_state() function.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Linux 2.6.27 adds code to enable extended config space accesses in the
Northbridge Configuration MSR; Xen should allow Dom0 to control the
respective bit.
Likewise, 2.6.26 added support to enable the MMIO config space access
method for certain Sun systems, so similarly Xen should allow Dom0 to
control the respective fields of the MMIO Configuration Base Address
Register.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
This is only a first step - more call sites need to be hooked up.
Most of this is really Keir's work, I just took what he handed me and
fixed a few remaining issues.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
For HVM guest, we can't do pci-attach/pci-detach for >64 times due to
the meaningless checking in pci_register_device(). I made a test of
300 times of attach/detach and everything now works well.
Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>
Now if VT-d is enabled, when Dom0 does S3, Xen doesn't suspend/resume
the IOMMU states.
The patch adds the missing invocations of
iommu_suspend()/iommu_resume() and makes some nesessary fixes:
1) In iommu_set_root_entry(), we should not re-allocate the root-entry
when Xen returns from S3;
2) Define the array iommu_state correctly (u8 -> u32);
3) Only save/restore the necessary IOMMU registers.
The patch was tested on Weybridge.
NOTE: if we have some HVM guests which have assigned devices, and we
want to do Dom S3, we MUST do HVM S3 for each HVM guest first.
Namely, the steps are:
1) Use HVM S3 in guest to suspend the guest (for example, in Linux HVM
guest, this is "echo mem > /sys/power/state");
2) Use Dom0 S3 to suspend Dom0: "echo mem > /sys/power/state";
3) At some point, Dom0 resumes from S3 (for example, by pressing the
power button or using the acpi alarm);
4) Use "xm trigger HVM_DOM_ID s3resume" to resume every HVM guest
which were suspended previously.
Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>
Linux 2.6.27 marks the data pointer in its firmware struct 'const',
and hence, to avoid a compiler warning, Xen's microcode update
interface should be properly properly constified too.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
This patch adds support for AMD's extended migration, aka CPUID
features and extended features masking.
Signed-off-by: Travis Betak <travis.betak@amd.com>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Apparently 64MB is too short for the domain builder.
No kernel option should be passed, as they are provided by menu.lst,
and would only confuse grub.
Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
When domains are destroyed, _prepare_phantom_paths() method
and _cleanup_phantom_devs() method are called twice as follows.
destroy()@XendDomainInfo.py
_prepare_phantom_paths() --------------- 1
_cleanupVm()
destroyDomain()
_prepare_phantom_paths() ----------- 2
xc.domain_destroy_hook()
xc.domain_pause()
do_FLR()
xc.domain_destroy()
XendDomain.remove_domain()
cleanupDomain()
_cleanup_phantom_devs() ------------ 1
_cleanup_phantom_devs() ---------------- 2
XendDomain.domain_delete_by_dominfo()
This is a cleanup patch. It combines destroyDomain() method
into destroy() method, then _prepare_phantom_paths() method and
_cleanup_phantom_devs() method are called only once.
Signed-off-by: Masaki Kanno <kanno.masaki@jp.fujitsu.com>
gcc expects libraries needed for object files to be specified after
the object. Linking usually does not fail, unless it is optimized (for
instance, using -Wl,-as-needed).
The related Gentoo bug is 135145 [ https://bugs.gentoo.org/135145 ].
From: Robert Buchholz <rbu@gentoo.org>
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
since our seek times are virtually 0. Although this flag is
deprecated by newer ATA standards, Linux at least checks it for CD
drives, and would timeout in some cases if we do not set it.
Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
When creating an HVM domain, if e.g. another domain is created before
qemu allocates video memory, the extra 8MB memory ballooning is not
available any more, because it got consumed by the other domain.
This fixes it by taking video memory from the main memory:
- make hvmloader use e820_malloc to reserve some of the main memory
and notify ioemu of its address through the Xen platform PCI card.
- add XENMAPSPACE_mfn to the xen_add_to_physmap memory op, to allow
ioemu to move the MFNs between the original position and the PCI
mapping, when LFB acceleration is disabled/enabled
- add a remove_from_physmap memory op, to allow ioemu to unmap it
completely for the case of old guests with acceleration disabled.
- add xc_domain_memory_translate_gpfn_list to libxc to allow ioemu to
get the MFNs of the video memory.
- have xend save the PCI memory space instead of ioemu: if a memory
page is there, the guest can access it like usual memory, so xend
can safely be responsible to save it. The extra benefit is that
live migration will apply the logdirty optimization there too.
- handle old saved images, populating the video memory from ioemu if
really needed.
Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
softirq handle rather than kludging it with set_timer().
Should be faster and is definitely clearer. Also avoids us using
set_timer() in IRQ context (which is currently broken but soon won't
be).
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Actually a fair amount of infrastructure is onvolved these days, and
we'd like subsystems we call into know that we're in IRQ context so
they can handle that or BUG/ASSERT if appropriate.
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
Keir Fraser
Isaku Yamahata