linux-stable.git/drivers/xen, branch v3.12.41

xen-pciback: limit guest control of command register

2015-04-09T11:14:14+00:00

commit af6fc858a35b90e89ea7a7ee58e66628c55c776b upstream.

Otherwise the guest can abuse that control to cause e.g. PCIe
Unsupported Request responses by disabling memory and/or I/O decoding
and subsequently causing (CPU side) accesses to the respective address
ranges, which (depending on system configuration) may be fatal to the
host.

Note that to alter any of the bits collected together as
PCI_COMMAND_GUEST permissive mode is now required to be enabled
globally or on the specific device.

This is CVE-2015-2150 / XSA-120.

Signed-off-by: Jan Beulich 
Reviewed-by: Konrad Rzeszutek Wilk 
Signed-off-by: David Vrabel 
Signed-off-by: Jiri Slaby

xen/manage: Fix USB interaction issues when resuming

2015-03-01T22:34:15+00:00

commit 72978b2fe2f2cdf9f319c6c6dcdbe92b38de2be2 upstream.

Commit 61a734d305e1 ("xen/manage: Always freeze/thaw processes when
suspend/resuming") ensured that userspace processes were always frozen
before suspending to reduce interaction issues when resuming devices.
However, freeze_processes() does not freeze kernel threads.  Freeze
kernel threads as well to prevent deadlocks with the khubd thread when
resuming devices.

This is what native suspend and resume does.

Example deadlock:
[ 7279.648010]  [] ? xen_poll_irq_timeout+0x3e/0x50
[ 7279.648010]  [] xen_poll_irq+0x10/0x20
[ 7279.648010]  [] xen_lock_spinning+0xb3/0x120
[ 7279.648010]  [] __raw_callee_save_xen_lock_spinning+0x11/0x20
[ 7279.648010]  [] ? usb_control_msg+0xe6/0x120
[ 7279.648010]  [] ? _raw_spin_lock_irq+0x50/0x60
[ 7279.648010]  [] wait_for_completion+0xac/0x160
[ 7279.648010]  [] ? try_to_wake_up+0x2c0/0x2c0
[ 7279.648010]  [] dpm_wait+0x32/0x40
[ 7279.648010]  [] device_resume+0x90/0x210
[ 7279.648010]  [] dpm_resume+0x121/0x250
[ 7279.648010]  [] ? xenbus_dev_request_and_reply+0xc0/0xc0
[ 7279.648010]  [] dpm_resume_end+0x15/0x30
[ 7279.648010]  [] do_suspend+0x10a/0x200
[ 7279.648010]  [] ? xen_pre_suspend+0x20/0x20
[ 7279.648010]  [] shutdown_handler+0x120/0x150
[ 7279.648010]  [] xenwatch_thread+0x9f/0x160
[ 7279.648010]  [] ? finish_wait+0x80/0x80
[ 7279.648010]  [] kthread+0xc9/0xe0
[ 7279.648010]  [] ? flush_kthread_worker+0x80/0x80
[ 7279.648010]  [] ret_from_fork+0x7c/0xb0
[ 7279.648010]  [] ? flush_kthread_worker+0x80/0x80

[ 7441.216287] INFO: task khubd:89 blocked for more than 120 seconds.
[ 7441.219457]       Tainted: G            X 3.13.11-ckt12.kz #1
[ 7441.222176] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 7441.225827] khubd           D ffff88003f433440     0    89      2 0x00000000
[ 7441.229258]  ffff88003ceb9b98 0000000000000046 ffff88003ce83000 0000000000013440
[ 7441.232959]  ffff88003ceb9fd8 0000000000013440 ffff88003cd13000 ffff88003ce83000
[ 7441.236658]  0000000000000286 ffff88003d3e0000 ffff88003ceb9bd0 00000001001aa01e
[ 7441.240415] Call Trace:
[ 7441.241614]  [] schedule+0x29/0x70
[ 7441.243930]  [] schedule_timeout+0x166/0x2c0
[ 7441.246681]  [] ? call_timer_fn+0x110/0x110
[ 7441.249339]  [] schedule_timeout_uninterruptible+0x1e/0x20
[ 7441.252644]  [] msleep+0x20/0x30
[ 7441.254812]  [] hub_port_reset+0xf0/0x580
[ 7441.257400]  [] hub_port_init+0x75/0xb40
[ 7441.259981]  [] ? update_autosuspend+0x39/0x60
[ 7441.262817]  [] ? pm_runtime_set_autosuspend_delay+0x50/0xa0
[ 7441.266212]  [] hub_thread+0x71a/0x1750
[ 7441.268728]  [] ? finish_wait+0x80/0x80
[ 7441.271272]  [] ? usb_port_resume+0x670/0x670
[ 7441.274067]  [] kthread+0xc9/0xe0
[ 7441.276305]  [] ? flush_kthread_worker+0x80/0x80
[ 7441.279131]  [] ret_from_fork+0x7c/0xb0
[ 7441.281659]  [] ? flush_kthread_worker+0x80/0x80

Signed-off-by: Ross Lagerwall 
Signed-off-by: David Vrabel 
Signed-off-by: Jiri Slaby

xen/manage: Always freeze/thaw processes when suspend/resuming

2014-10-13T13:41:10+00:00

commit 61a734d305e16944b42730ef582a7171dc733321 upstream.

Always freeze processes when suspending and thaw processes when resuming
to prevent a race noticeable with HVM guests.

This prevents a deadlock where the khubd kthread (which is designed to
be freezable) acquires a usb device lock and then tries to allocate
memory which requires the disk which hasn't been resumed yet.
Meanwhile, the xenwatch thread deadlocks waiting for the usb device
lock.

Freezing processes fixes this because the khubd thread is only thawed
after the xenwatch thread finishes resuming all the devices.

Signed-off-by: Ross Lagerwall 
Signed-off-by: David Vrabel 
Signed-off-by: Jiri Slaby

xen/balloon: flush persistent kmaps in correct position

2014-04-03T08:32:25+00:00

commit 09ed3d5ba06137913960f9c9385f71fc384193ab upstream.

Xen balloon driver will update ballooned out pages' P2M entries to point
to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc
page while non-preemptible", kmap_flush_unused was moved after updating
P2M table. In that case for 32 bit PV guest we might end up with

  P2M    X -----> S  (S is mfn of balloon scratch page)
  M2P    Y -----> X  (Y is mfn in persistent kmap entry)

kmap_flush_unused() iterates through all the PTEs in the kmap address
space, using pte_to_page() to obtain the page. If the p2m and the m2p
are inconsistent the incorrect page is returned.  This will clear
page->address on the wrong page which may cause subsequent oopses if
that page is currently kmap'ed.

Move the flush back between get_page and __set_phys_to_machine to fix
this.

Signed-off-by: Wei Liu 
Signed-off-by: David Vrabel 
Signed-off-by: Jiri Slaby

xen/pvhvm: If xen_platform_pci=0 is set don't blow up (v4).

2014-02-13T21:50:10+00:00

commit 51c71a3bbaca868043cc45b3ad3786dd48a90235 upstream.

The user has the option of disabling the platform driver:
00:02.0 Unassigned class [ff80]: XenSource, Inc. Xen Platform Device (rev 01)

which is used to unplug the emulated drivers (IDE, Realtek 8169, etc)
and allow the PV drivers to take over. If the user wishes
to disable that they can set:

  xen_platform_pci=0
  (in the guest config file)

or
  xen_emul_unplug=never
  (on the Linux command line)

except it does not work properly. The PV drivers still try to
load and since the Xen platform driver is not run - and it
has not initialized the grant tables, most of the PV drivers
stumble upon:

input: Xen Virtual Keyboard as /devices/virtual/input/input5
input: Xen Virtual Pointer as /devices/virtual/input/input6M
------------[ cut here ]------------
kernel BUG at /home/konrad/ssd/konrad/linux/drivers/xen/grant-table.c:1206!
invalid opcode: 0000 [#1] SMP
Modules linked in: xen_kbdfront(+) xenfs xen_privcmd
CPU: 6 PID: 1389 Comm: modprobe Not tainted 3.13.0-rc1upstream-00021-ga6c892b-dirty #1
Hardware name: Xen HVM domU, BIOS 4.4-unstable 11/26/2013
RIP: 0010:[]  [] get_free_entries+0x2e0/0x300
Call Trace:
 [] ? evdev_connect+0x1e3/0x240
 [] gnttab_grant_foreign_access+0x2e/0x70
 [] xenkbd_connect_backend+0x41/0x290 [xen_kbdfront]
 [] xenkbd_probe+0x2f2/0x324 [xen_kbdfront]
 [] xenbus_dev_probe+0x77/0x130
 [] xenbus_frontend_dev_probe+0x47/0x50
 [] driver_probe_device+0x89/0x230
 [] __driver_attach+0x9b/0xa0
 [] ? driver_probe_device+0x230/0x230
 [] ? driver_probe_device+0x230/0x230
 [] bus_for_each_dev+0x8c/0xb0
 [] driver_attach+0x19/0x20
 [] bus_add_driver+0x1a0/0x220
 [] driver_register+0x5f/0xf0
 [] xenbus_register_driver_common+0x15/0x20
 [] xenbus_register_frontend+0x23/0x40
 [] ? 0xffffffffa0014fff
 [] xenkbd_init+0x2b/0x1000 [xen_kbdfront]
 [] do_one_initcall+0x49/0x170

.. snip..

which is hardly nice. This patch fixes this by having each
PV driver check for:
 - if running in PV, then it is fine to execute (as that is their
   native environment).
 - if running in HVM, check if user wanted 'xen_emul_unplug=never',
   in which case bail out and don't load any PV drivers.
 - if running in HVM, and if PCI device 5853:0001 (xen_platform_pci)
   does not exist, then bail out and not load PV drivers.
 - (v2) if running in HVM, and if the user wanted 'xen_emul_unplug=ide-disks',
   then bail out for all PV devices _except_ the block one.
   Ditto for the network one ('nics').
 - (v2) if running in HVM, and if the user wanted 'xen_emul_unplug=unnecessary'
   then load block PV driver, and also setup the legacy IDE paths.
   In (v3) make it actually load PV drivers.

Reported-by: Sander Eikelenboom 
Reported-and-Tested-by: Fabio Fantoni 
Signed-off-by: Konrad Rzeszutek Wilk 
[v2: Add extra logic to handle the myrid ways 'xen_emul_unplug'
can be used per Ian and Stefano suggestion]
[v3: Make the unnecessary case work properly]
[v4: s/disks/ide-disks/ spotted by Fabio]
Reviewed-by: Stefano Stabellini 
Acked-by: Bjorn Helgaas  [for PCI parts]
Signed-off-by: Greg Kroah-Hartman

xen/gnttab: leave lazy MMU mode in the case of a m2p override failure

2013-12-12T06:37:54+00:00

commit 14883a75ec76b44759385fb12629f4a0f1aef4e3 upstream.

Commit f62805f1 introduced a bug where lazy MMU mode isn't exited if a
m2p_add/remove_override call fails.

Acked-by: Stefano Stabellini 
Cc: Boris Ostrovsky 
Reviewed-by: David Vrabel 
Reviewed-by: Anthony Liguori 
Signed-off-by: Matt Wilson 
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'stable/for-linus-3.12-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

2013-09-25T22:50:53+00:00

Pull Xen fixes from Konrad Rzeszutek Wilk:
 "Bug-fixes and one update to the kernel-paramters.txt documentation.

   - Fix PV spinlocks triggering jump_label code bug
   - Remove extraneous code in the tpm front driver
   - Fix ballooning out of pages when non-preemptible
   - Fix deadlock when using a 32-bit initial domain with large amount
     of memory
   - Add xen_nopvpsin parameter to the documentation"

* tag 'stable/for-linus-3.12-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/spinlock: Document the xen_nopvspin parameter.
  xen/p2m: check MFN is in range before using the m2p table
  xen/balloon: don't alloc page while non-preemptible
  xen: Do not enable spinlocks before jump_label_init() has executed
  tpm: xen-tpmfront: Remove the locality sysfs attribute
  tpm: xen-tpmfront: Fix default durations

xen/balloon: don't alloc page while non-preemptible

2013-09-24T20:22:27+00:00

get_balloon_scratch_page() disables preemption so we cannot call
alloc_page() in between get/put_balloon_scratch_page().  Shuffle bits
around in decrease_reservation() to avoid this.

Signed-off-by: David Vrabel 
Signed-off-by: Konrad Rzeszutek Wilk

Merge tag 'stable/for-linus-3.12-rc0-tag-three' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

2013-09-12T18:28:24+00:00

Pull Xen balloon driver bug-fixes from Stefano Stabellini:
 - fix a preemption bug in xen/balloon.c;
 - remove an harmful BUG_ON in xen/balloon.c that can trigger in
   non-erroneous situations.

* tag 'stable/for-linus-3.12-rc0-tag-three' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/balloon: remove BUG_ON in increase_reservation
  xen/balloon: ensure preemption is disabled when using a scratch page

xen/balloon: remove BUG_ON in increase_reservation

2013-09-11T17:54:02+00:00

The BUG_ON in increase_reservation is wrong as we have P2M entry
ballooned out page set to balloon scratch page, so it might have a valid
P2M entry at that point.

Signed-off-by: Wei Liu 
Signed-off-by: Stefano Stabellini