When an external agent (e.g. a monitoring daemon) happens to access the
memory of a PoD guest prior to setting the PoD target, that access must
fail for there not being any page in the PoD cache, and only the space
above the low 2Mb gets scanned for victim pages (while only the low 2Mb
got real pages populated so far).
To accomodate for this
- set the PoD target first
- do all physmap population in PoD mode (i.e. not just large [2Mb or
1Gb] pages)
- slightly lift the restrictions enforced by p2m_pod_set_mem_target()
to accomodate for the changed tools behavior
Tested-by: Jürgen Groß <juergen.gross@ts.fujitsu.com>
(in a 4.0.x based incarnation)
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
xen-unstable changeset: 25754:be8ae5439a88
xen-unstable date: Thu Aug 16 08:14:11 UTC 2012
Passing invalid CPU value to do_pm_op() will cause assertion
in cpu_online().
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
Such checks would, at a first glance, then also be missing at the top
of various helper functions, but these check really were already
redundant with the check in do_pm_op(). Remove the redundant checks
for clarity and brevity.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
xen-unstable changeset: 25752:1df4fdbaade0
xen-unstable date: Wed Aug 15 07:43:25 UTC 2012
device allocation and deallocation to a domain.
A toolstack, when dealing with a domain using PCIPassthrough, could
reasonably be expected to issue DOMCTL_deassign_device hypercalls to
remove all passed through devices before issuing a
DOMCTL_destroydomain hypercall to kill the domain. In the case where
a toolstack is perhaps less sensible in this regard, the hypervisor
should not fall over.
In domain_kill(), pci_release_devices() searches the alldevs_list list
looking for PCI devices still assigned to the domain. If the
toolstack has correctly deassigned all devices before killing the
domain, this loop does nothing.
However, if there are still devices attached to the domain, the loop
will call pci_cleanup_msi() without unbinding the pirq from the
domain. This eventually calls destroy_irq() which xfree()'s the
action.
However, as the irq_desc->action pointer is abused in an unsafe
matter, without unbinding first (which at least correctly cleans up),
the action is actually an irq_guest_action_t* rather than an
irqaction*, meaning that the cpu_eoi_map is leaked, and eoi_timer is
free()'d while still being on a pcpu's inactive_timer list. As a
result, when this free()'d memory gets reused, the inactive_timer list
becomes corrupt, and list_*** operations will corrupt hypervisor
memory.
If the above were not bad enough, the loop in pci_release_devices()
still leaves references to the irq it destroyed in
domain->arch.pirq_irq and irq_pirq, meaning that a later loop,
free_domain_pirqs(), which happens as a result of
complete_domain_destroy() will unbind and destroy all irqs which were
still bound to the domain, resulting in a double destroy of any irq
which was still bound to the domain at the point at which the
DOMCTL_destroydomain hypercall happened.
Because of the allocation of irqs from find_unassigned_irq(), the
lowest free irq number is going to be handed back from create_irq().
There is a further race condition between the original (incorrect)
call to destroy_irq() from pci_release_devices(), and the later call
to free_domain_pirqs() (which happens in a softirq context at some
point after the domain has officially died) during which the same irq
number (which is still referenced in a stale way in
domain->arch.pirq_irq and irq_pirq) has been allocated to a new domain
via a PHYSDEVOP_map_pirq hypercall (Say perhaps in the case of
rebooting a domain).
In this case, the cleanup for the dead domain will free the recently
bound irq under the feet of the new domain. Furthermore, after the
irq has been incorrectly destroyed, the same domain with another
PHYSDEVOP_map_pirq hypercall can be allocated the same irq number as
before, leading to an error along the lines of:
../physdev.c:188: dom54: -1:-1 already mapped to 74
In this case, the pirq_irq and irq_pirq mappings get updated to the
new PCI device from the latter PHYSDEVOP_map_pirq hypercall, and the
IOMMU interrupt remapping registers get updated, leading to IOMMU
Primary Pending Fault due to source-id verification failure for
incoming interrupts from the passed through device.
The easy fix is to simply deassign the device in pci_release_devices()
and leave all the real cleanup to the free_domain_pirqs() which
correctly unbinds and destroys the irq without leaving stale
references around.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25883:4fdaebea82d7
xen-unstable date: Wed Sep 12 19:31:16 2012 +0100
This is being used as a array index, and hence must be validated before
use.
This is XSA-16 / CVE-2012-3498.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
The upper 32 bits of this register are reserved and should be written as
zero.
This is XSA-12 / CVE-2012-3494
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
for common and x86 ones at least, to address the problem of storing
zero-extended values into the multicall result field otherwise.
Reported-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25744:47080c965937
xen-unstable date: Fri Aug 10 07:51:01 UTC 2012
Rather than deferring the detection of these to the point where they
get actually used (the fix for XSA-7, 25480:76eaf5966c05, causing a #GP
to be raised by IRET, which invokes the guest's [fragile] fail-safe
callback), don't even allow such to be set.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25485:5b6a857411ba
xen-unstable date: Mon Jun 18 15:02:01 UTC 2012
Other than in __list_splice(), the first element's prev pointer
doesn't need adjustment here - it already is PAGE_LIST_NULL. Rather
than fixing the assignment (to formally match __list_splice()), simply
assert that this assignment is really unnecessary.
Reported-by: Jisoo Yang <jisooy@gmail.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Also assert that the prev pointers are both PAGE_LIST_NULL.
Signed-off-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25459:f6bfaf9daa50
xen-unstable date: Wed Jun 6 15:37:05 UTC 2012
Likely through copy'n'paste, all three instances of guest MCE
processing jumped to the wrong place (where NMI processing code
correctly jumps to) when MCE-s are temporarily masked (due to one
currently being processed by the guest). A nested, unmasked NMI should
get delivered immediately, however.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25382:6dc80df50fa8
xen-unstable date: Tue May 22 14:30:11 UTC 2012
HAP paging mode guests use direct MSR read/write into the VMCS/VMCB
for the guest PAT table, while the current save/restore code was
accessing only the pat_cr field in hvm_vcpu, used when intercepting
the MSR mostly in shadow mode (the Intel scenario is a bit more
complicated). This patch fixes this issue creating a new couple of
hvm_funcs, get/set_guest_pat, that access the right PAT table based on
the paging mode and guest configuration.
Signed-off-by: Gianluca Guida <gianluca.guida@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
xen-unstable changeset: 25196:375fa55c7a6c
xen-unstable date: Tue Apr 17 07:29:26 UTC 2012
PCID (Process-context identifier) is a facility by which a logical
processor may cache information for multiple linear-address spaces.
INVPCID is an new instruction to invalidate TLB. Refer latest Intel SDM
http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html
We disable PCID/INVPCID for dom0 and pv. Exposing them into dom0 and pv
may result in performance regression, and it would trigger GP or UD
depending on whether platform suppport INVPCID or not.
This patch disables PCID/INVPCID for dom0.
Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
xen-unstable changeset: 24278:d9cb04ed5539
xen-unstable date: Thu Dec 1 11:22:43 UTC 2011
As per the specification, the base address reported by ACPI is the one
that would be used if the region started at bus 0. Hence the
start_bus_number offset needs to be added not only to the virtual
address, but also the physical one when establishing the mapping, and
it then needs to be subtracted when obtaining the virtual address for
doing accesses.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
xen-unstable changeset: 23747:b07b6fa76656
xen-unstable date: Mon Jul 25 15:42:19 UTC 2011
If there is no cpufreq driver (e.g., with an AMD Opteron 8212) then
reading the P state statistics causes a deadlock as an uninitialized
spinlock is locked in do_get_pm_info(). The spinlock is initialized in
cpufreq_statistic_init() which is not called if cpufreq_driver ==
NULL.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Committed-by: Jan Beulich <jbeulich@suse.com>
xen-unstable changeset: 25706:7fd5facb6084
xen-unstable date: Fri Aug 03 09:50:28 2012 +0200
cc1: warnings being treated as errors
hvm.c: In function ‘hvm_hap_nested_page_fault’:
hvm.c:1282: error: passing argument 2 of
‘nestedhvm_hap_nested_page_fault’ from incompatible pointer type
/local/scratch/ianc/devel/xen-unstable.hg/xen/include/asm/hvm/nestedhvm.h:55:
note: expected ‘paddr_t *’ but argument is of type ‘long unsigned
int *’
hvm_hap_nested_page_fault takes an unsigned long gpa and passes &gpa
to nestedhvm_hap_nested_page_fault which takes a paddr_t *. Since both
of the callers of hvm_hap_nested_page_fault (svm_do_nested_pgfault and
ept_handle_violation) actually have the gpa which they pass to
hvm_hap_nested_page_fault as a paddr_t I think it makes sense to
change the argument to hvm_hap_nested_page_fault.
The other user of gpa in hvm_hap_nested_page_fault is a call to
p2m_mem_access_check, which currently also takes a paddr_t gpa but I
think a paddr_t is appropriate there too.
Jan points out that this is also an issue for >4GB guests on the 32
bit hypervisor.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
xen-unstable changeset: 25724:612898732e66
xen-unstable date: Fri Aug 03 09:54:17 2012 +0100
Backported-by: Keir Fraser <keir@xen.org>
highest_gsi() returns the last valid GSI, not a count.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Joe Jin <joe.jin@oracle.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25688:e6266fc76d08
xen-unstable date: Fri Jul 27 12:22:13 2012 +0200
According to vt-d specs, the addr in IOTLB invalidation descriptor
should be 4K page aligned.
Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25617:75eb78d6cf54
xen-unstable date: Thu Jul 19 15:46:02 2012 +0100
The fact that handle_mmio(), and thus the instruction emulator, is
being run through twice for emulations that require involvement of the
device model, allows for the second run to see a different guest state
than the first one. Since only the MMIO-specific emulation routines
update the vCPU's io_state, if they get invoked on the second pass,
internal state (and particularly this variable) can be left in a state
making successful emulation of a subsequent MMIO operation impossible.
Consequently, whenever the emulator invocation returns without
requesting a retry of the guest instruction, reset io_state.
[ This is a security issue. XSA#10. -iwj ]
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
xen-unstable changeset: 25682:ffcb24876b4f
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Presumably a copy-and-paste mistake, which I also didn't notice while
unifying x86's and ia64's respective domctl implementations.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25432:d7318231cfe3
xen-unstable date: Thu May 31 10:18:52 2012 +0200
For a multi-byte aligned read, this so far resulted in 0x00ff to be
put in the guest's register rather than 0xffff or 0xffffffff, which in
turn could confuse bus scanning functions (which, when reading vendor
and/or device IDs, expect to get back all zeroes or all ones).
As the value gets masked to the read width when merging back into the
full result, setting the initial value to all ones should not harm any
or the other cases.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25489:cc46bd403bc4
xen-unstable date: Fri Jun 22 10:04:30 2012 +0200
While putting together the workaround announced in
http://lists.xen.org/archives/html/xen-devel/2012-06/msg00709.html, I
found that mod_l1_entry(), upon encountering a set bit in
mmio_ro_ranges, would return 1 instead of 0 (the removal of the write
permission is supposed to be entirely transparent to the caller, even
more so to the calling guest).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25487:baa85434d0ec
xen-unstable date: Thu Jun 21 11:30:59 2012 +0200
Do not clear asid cleanbit unconditionally. This shaves off 100 cycles
from the VMRUN instruction.
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
Committed-by: Jan Beulich <jbeulich@suse.com>
xen-unstable changeset: 25482:34c725807d21
xen-unstable date: Wed Jun 13 11:51:26 2012 +0200
Because the location of the lock can change between the time you read
it and the time you grab it, the per-cpu schedule locks need to check
after lock acquisition that the lock location hasn't changed, and
release and re-try if so. This change was effected throughout the
source code, but one very important place was apparently missed: in
schedule() itself.
Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25162:478bec603d3d
xen-unstable date: Tue Apr 10 10:41:30 2012 +0100
Nothing, not even Dom0, should fiddle with this.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 24970:33980e36597b
xen-unstable date: Tue Mar 06 16:41:41 2012 +0100
On some systems, requests devices behind a PCIe-to-PCI bridge all
appear to the IOMMU as though they come from from slot 0, function 0
on that device; so the mapping code much punch a hole for X:0.0 in the
IOMMU for such devices. When punching the hole, if that device has
already been mapped once, we simply need to check ownership to make
sure it's legal. To do so, domain_context_mapping_one() will look up
the device for the mapping with pci_get_pdev() and look for the owner.
However, if there is no device in X:0.0, this look up will fail.
Rather than returning -ENODEV in this situation (causing a failure in
mapping the device), try to get the domain ownership from the iommu
context mapping itself.
Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
xen-unstable changeset: 23813:5535d7ce2673
xen-unstable date: Mon Sep 05 15:00:46 2011 +0100
This is just another adjustment to allow systems with very many CPUs
(or unusual ACPI IDs) to be properly power-managed.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
xen-unstable changeset: 23781:0849b0e59e24
xen-unstable date: Mon Aug 22 10:10:39 2011 +0100
..., which adds masking of the xsave feature leaf.
Also add back (and fix to actually make it do what it was supposed to
do from the beginning) the printing of what specific masking couldn't
be done in case the user requested something the hardware doesn't
support.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
xen-unstable changeset: 23726:fd97ca086df6
xen-unstable date: Tue Jul 19 14:14:51 2011 +0100
x86: add change missing in c/s 23726:fd97ca086df6
The early "do we need to do anything" check needs adjustment, too.
Thanks to Haitao Shan for pointing this out.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
xen-unstable changeset: 23731:48f72b389b04
xen-unstable date: Thu Jul 21 14:34:51 2011 +0100
Solaris 11 build 163+ removes '/platform/i86xpv/kernel/unix' and only
the
64-bit PV kernel file '/platform/i86xpv/kernel/amd64/unix' exists.
This patch fixes the detection.
Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
Signed-off-by: Frank Che <frank.che@oracle.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
xen-unstable changeset: 23686:7c39a2c0d870
xen-unstable date: Thu Jul 14 18:09:58 2011 +0100
As Xen currently stands, it will attempt to interpret the first few
bytes of the initcall section as a struct kernel_param.
The reason that this not caused problems is because in the overflow
case, param->name is actually a function pointer to the first
initcall, and intepreting it as string is very unlikely to match an
ASCII command line parameter name.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25587:2cffb7bf6e57
xen-unstable date: Tue Jul 03 13:38:19 2012 +0100
Additionally, correct the text description to reflect what is being
done, and make use of fatal_trap() in preference to kexec_crash() in
case an unknown NMI occurs before a kdump kernel has been loaded.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25478:6d1a30dc47e8
xen-unstable date: Mon Jun 11 15:12:50 2012 +0100
The Interrupt Stack Table entries in a 64bit TSS are a 1 based data
structure as far as hardware is concerned. As a result, the code
setting up stacks in subarch_percpu_traps_init() fills in the wrong
IST entries.
The result is that the MCE handler executes on the stack set up for
NMIs; the NMI handler executes on a stack set up for Double Faults,
and Double Faults are executed with a stack pointer set to 0.
Once the #DF handler starts to execute, it will usually take a page
fault looking up the address at 0xfffffffffffffff8, which will cause a
triple fault. If a guest has mapped a page in that location, then it
will have some state overwritten, but as the #DF handler always calls
panic(), this is not a problem the guest will have time to care about.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>
xen-unstable changeset: 25271:54da0329e259
xen-unstable date: Thu May 10 11:04:32 2012 +0100
Jan Beulich
Boris Ostrovsky
Andrew Cooper
Ian Jackson
Wei Wang
Gianluca Guida
Liu, Jinsong
Laszlo Ersek
Jan Beulich
Jan Beulich
Keir Fraser
David Vrabel
Ian Campbell
Santosh Jodh
Yang Zhang
Christoph Egger
George Dunlap
Zhigang Wang