ia64/xen-unstable

changeset 19215:6630f99dfc01

Merge with ext/ia64/xen-unstable.hg
author Keir Fraser <keir.fraser@citrix.com>
date Tue Feb 17 11:01:05 2009 +0000 (2009-02-17)
parents b432c632ebe8 09a6fa059b37
children cb8ece5d7647
files
line diff
     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/docs/misc/xsm-flask.txt	Tue Feb 17 11:01:05 2009 +0000
     1.3 @@ -0,0 +1,148 @@
     1.4 +These notes are compiled from xen-devel questions and postings that have occured
     1.5 +since the inclusion of XSM.  These notes are not intended to be definitive
     1.6 +documentation but should address many common problems that arrise when
     1.7 +experimenting with XSM:FLASK.
     1.8 +
     1.9 +Xen XSM:FLASK configuration
    1.10 +---------------------------
    1.11 +
    1.12 +1) cd xen-unstable.hg
    1.13 +2) edit Config.mk in the toplevel xen directory as follows:
    1.14 +
    1.15 +	XSM_ENABLE ?= y
    1.16 +	FLASK_ENABLE ?= y
    1.17 +	ACM_SECURITY ?= n
    1.18 +	
    1.19 +NB: Only one security module can be selected at a time.  If no module is
    1.20 +selected, then the default DUMMY module will be enforced.  The DUMMY module
    1.21 +only exercises the security framework and does not enforce any security
    1.22 +policies.  Changing the security module selection will require recompiling xen.
    1.23 +These settings will also configure the corresponding toolchain support.  
    1.24 +
    1.25 +3) make xen
    1.26 +4) make tools
    1.27 +
    1.28 +
    1.29 +Xen XSM:FLASK policy
    1.30 +--------------------
    1.31 +
    1.32 +These instructions will enable the configuration and build of the sample policy.
    1.33 +The sample policy provides the MINIMUM policy necessary to boot a
    1.34 +paravirtualized dom0 and create a paravirtualized domU.  Many of the 
    1.35 +default capabilities and usages supported by dom0/domU are disallowed by the
    1.36 +sample policy.  Further, the policy is comprised of a limited number of types and 
    1.37 +must be adjusted to meet the specific security goals of the installation. 
    1.38 +Modification of the policy is straightforward and is covered in a later section.
    1.39 +
    1.40 +NB: The policy is not automatically built as part of the tool support because 
    1.41 +of an external dependancy on the checkpolicy compiler.  The FLASK policy uses 
    1.42 +the same syntax and structure as SELinux and compiling the policy relies on 
    1.43 +the SELinux policy toolchain.  This toolchain is available under many 
    1.44 +distributions as well as the following URL,
    1.45 +
    1.46 +	http://userspace.selinuxproject.org/releases/20080909/stable/checkpolicy-1.34.7.tar.gz
    1.47 +
    1.48 +1) cd xen-unstable.hg/tools/flask/policy
    1.49 +2) make policy
    1.50 +3) cp policy.20 /boot/xenpolicy.20
    1.51 +4) edit /etc/grub.conf, add a module line to the xen entry,
    1.52 +
    1.53 +	module /xenpolicy.20
    1.54 +
    1.55 +5) reboot, and select the updated xen entry
    1.56 +
    1.57 +NB: The module entry can be inserted on any line after the xen kernel line.  Typical
    1.58 +configurations use the last module entry or the module entry that immediately 
    1.59 +follows the xen kernel entry.
    1.60 +
    1.61 +Xen configuration of xend
    1.62 +-------------------------
    1.63 +
    1.64 +1) cd /etc/xen
    1.65 +2) edit xend-config.sxp
    1.66 +3) uncomment the line containing the key:value pair entry, 
    1.67 +
    1.68 +	#(xsm_module_name dummy)
    1.69 +
    1.70 +4) change the value entry to 'flask'
    1.71 +
    1.72 +	(xsm_module_name flask)
    1.73 +
    1.74 +5) restart xend
    1.75 +
    1.76 +Creating policy controlled domains
    1.77 +----------------------------------
    1.78 +
    1.79 +2) Edit the domain config file and add the following entry,
    1.80 +
    1.81 +	access_control = ["policy=,label=system_u:object_r:domU_t"]
    1.82 +
    1.83 +NB: The 'policy' field is not used by XSM:FLASK.  The 'label' must exist in the 
    1.84 +loaded policy. 'system_u:object_r:domU_t' is one of the existing labels from 
    1.85 +the sample policy and shown for example purposes.
    1.86 +
    1.87 +2) Create the domain using the 'xm create' command.
    1.88 +3) Use the 'xm list -l' command to list the running domains and their labels.
    1.89 +
    1.90 +Updating the XSM:FLASK policy
    1.91 +-----------------------------
    1.92 +
    1.93 +It is recommended that the XSM:FLASK policy be tailored to meet the specific
    1.94 +security goals of the platform.  The policy is tailored by editing the xen.te 
    1.95 +file in the 'policy' subdirectory.
    1.96 +
    1.97 +1) cd xen-unstable.hg/tools/flask/policy
    1.98 +2) edit policy/modules/xen/xen.te - make changes to support platform security goals.
    1.99 +3) make policy
   1.100 +4) cp policy.20 /boot/xenpolicy.20
   1.101 +5) reboot
   1.102 +
   1.103 +Alternatively, one may reload the policy using the 'flask_loadpolicy' tool
   1.104 +installed by the xen tools.
   1.105 +
   1.106 +1) flask_loadpolicy policy.20
   1.107 +
   1.108 +NB: The sample policy permits policy reloads as well as general manipulation of
   1.109 +the Flask security server only from dom0.  The policy can be tailored further to
   1.110 +restrict policy reloads and other manipulations to boot-time only, by removing 
   1.111 +the corresponding statements from the policy.
   1.112 +
   1.113 +Enforcing the XSM:FLASK policy
   1.114 +------------------------------
   1.115 +
   1.116 +By default, XSM:FLASK is compiled and installed in permissive mode.  This
   1.117 +configuration will allow an XSM:FLASK system to start in enforcing mode.
   1.118 +
   1.119 +1) edit /etc/grub.conf
   1.120 +2) append the parameter 'flask_enforcing=1' to the xen kernel line.
   1.121 +3) reboot, and select the updated xen entry
   1.122 +
   1.123 +
   1.124 +Additional notes on XSM:FLASK
   1.125 +-----------------------------
   1.126 +
   1.127 +1) xen command line parameters
   1.128 +
   1.129 +	a) flask_enforcing
   1.130 +	
   1.131 +	The default value for flask_enforcing is '0'.  This parameter causes the 
   1.132 +	platform to boot in permissive mode which means that the policy is loaded 
   1.133 +	but not enforced.  This mode is often helpful for developing new systems 
   1.134 +	and policies as the policy violations are reported on the xen console and 
   1.135 +	may be viewed in dom0 through 'xm dmesg'.
   1.136 +	
   1.137 +	To boot the platform into enforcing mode, which means that the policy is
   1.138 +	loaded and enforced, append 'flask_enforcing=1' on the grub line.
   1.139 +	
   1.140 +	This parameter may also be changed through the flask hyercall.
   1.141 +	
   1.142 +	b) flask_enabled
   1.143 +	
   1.144 +	The default value for flask_enabled is '1'.  This parameter causes the
   1.145 +	platform to enable the FLASK security module under the XSM framework.
   1.146 +	The parameter may be enabled/disabled only once per boot.  If the parameter
   1.147 +	is set to '0', only a reboot can re-enable flask.  When flask_enabled is '0'
   1.148 +	the DUMMY module is enforced.
   1.149 +
   1.150 +	This parameter may also be changed through the flask hypercall.  But may
   1.151 +	only be performed once per boot.
     2.1 --- a/tools/hotplug/Linux/init.d/xendomains	Fri Feb 13 19:11:38 2009 +0900
     2.2 +++ b/tools/hotplug/Linux/init.d/xendomains	Tue Feb 17 11:01:05 2009 +0000
     2.3 @@ -213,7 +213,7 @@ is_running()
     2.4  start() 
     2.5  {
     2.6      if [ -f $LOCKFILE ]; then 
     2.7 -	echo -n "xendomains already running (lockfile exists)"
     2.8 +	echo -e "xendomains already running (lockfile exists)"
     2.9  	return; 
    2.10      fi
    2.11  
    2.12 @@ -230,10 +230,12 @@ start()
    2.13                  HEADER=`head -c 16 $dom | head -n 1 2> /dev/null`
    2.14                  if [ $HEADER = "LinuxGuestRecord" ]; then
    2.15                      echo -n " ${dom##*/}"
    2.16 -                    xm restore $dom
    2.17 +                    XMR=`xm restore $dom 2>&1 1>/dev/null`
    2.18 +                    #xm restore $dom
    2.19                      if [ $? -ne 0 ]; then
    2.20 +                	echo -e "\nAn error occured while restoring domain ${dom##*/}:\n$XMR"
    2.21                          rc_failed $?
    2.22 -                        echo -n '!'
    2.23 +                        echo -e '!'
    2.24                      else
    2.25                          # mv $dom ${dom%/*}/.${dom##*/}
    2.26                          rm $dom
    2.27 @@ -241,7 +243,7 @@ start()
    2.28                  fi
    2.29              fi
    2.30          done
    2.31 -	echo .
    2.32 +	echo -e
    2.33      fi
    2.34  
    2.35      if contains_something "$XENDOMAINS_AUTO"
    2.36 @@ -264,16 +266,17 @@ start()
    2.37  	    if [ $? -eq 0 ] || is_running $dom; then
    2.38  		echo -n "(skip)"
    2.39  	    else
    2.40 -		xm create --quiet --defconfig $dom
    2.41 -		if [ $? -ne 0 ]; then
    2.42 +		XMC=`xm create --quiet --defconfig $dom`
    2.43 +            	if [ $? -ne 0 ]; then
    2.44 +                    echo -e "\nAn error occured while creating domain ${dom##*/}: $XMC\n"
    2.45  		    rc_failed $?
    2.46 -		    echo -n '!'
    2.47 +		    echo -e '!'
    2.48  		else
    2.49  		    usleep $XENDOMAINS_CREATE_USLEEP
    2.50  		fi
    2.51  	    fi
    2.52  	done
    2.53 -    fi	
    2.54 +    fi
    2.55  }
    2.56  
    2.57  all_zombies()
    2.58 @@ -293,18 +296,21 @@ all_zombies()
    2.59  # if it has not exited by that time kill it, so the init script will
    2.60  # succeed within a finite amount of time; if $2 is nonnull, it will
    2.61  # kill the command as well as soon as no domain (except for zombies)
    2.62 -# are left (used for shutdown --all).
    2.63 +# are left (used for shutdown --all). Third parameter, if any, suppresses
    2.64 +# output of dots per working state (formatting issues)
    2.65  watchdog_xm()
    2.66  {
    2.67      if test -z "$XENDOMAINS_STOP_MAXWAIT" -o "$XENDOMAINS_STOP_MAXWAIT" = "0"; then
    2.68  	exit
    2.69      fi
    2.70 +
    2.71      usleep 20000
    2.72      for no in `seq 0 $XENDOMAINS_STOP_MAXWAIT`; do
    2.73  	# exit if xm save/migrate/shutdown is finished
    2.74  	PSAX=`ps axlw | grep "xm $1" | grep -v grep`
    2.75  	if test -z "$PSAX"; then exit; fi
    2.76 -	echo -n "."; sleep 1
    2.77 +	if ! test -n "$3"; then echo -n '.'; fi
    2.78 +	sleep 1
    2.79  	# go to kill immediately if there's only zombies left
    2.80  	if all_zombies && test -n "$2"; then break; fi
    2.81      done
    2.82 @@ -312,10 +318,14 @@ watchdog_xm()
    2.83      read PSF PSUID PSPID PSPPID < <(echo "$PSAX")
    2.84      # kill xm $1
    2.85      kill $PSPID >/dev/null 2>&1
    2.86 +    
    2.87 +    echo -e .
    2.88  }
    2.89  
    2.90  stop()
    2.91  {
    2.92 +    exec 3>&2 2> /dev/null
    2.93 +    
    2.94      # Collect list of domains to shut down
    2.95      if test "$XENDOMAINS_AUTO_ONLY" = "true"; then
    2.96  	rdnames
    2.97 @@ -333,7 +343,7 @@ stop()
    2.98  		    # nothing
    2.99  		    ;;
   2.100  		(*)
   2.101 -		    echo -n '(skip)'
   2.102 +		    echo -e '(skip)'
   2.103  		    continue
   2.104  		    ;;
   2.105  	    esac
   2.106 @@ -345,8 +355,9 @@ stop()
   2.107  	if test -n "$XENDOMAINS_SYSRQ"; then
   2.108  	    for sysrq in $XENDOMAINS_SYSRQ; do
   2.109  		echo -n "(SR-$sysrq)"
   2.110 -		xm sysrq $id $sysrq
   2.111 +		XMR=`xm sysrq $id $sysrq 2>&1 1>/dev/null`
   2.112  		if test $? -ne 0; then
   2.113 +                    echo -e "\nAn error occured while doing sysrq on domain:\n$XMR\n"
   2.114  		    rc_failed $?
   2.115  		    echo -n '!'
   2.116  		fi
   2.117 @@ -362,13 +373,18 @@ stop()
   2.118  	    echo -n "(migr)"
   2.119  	    watchdog_xm migrate &
   2.120  	    WDOG_PID=$!
   2.121 -	    xm migrate $id $XENDOMAINS_MIGRATE
   2.122 +	    XMR=`xm migrate $id $XENDOMAINS_MIGRATE 2>&1 1>/dev/null`
   2.123  	    if test $? -ne 0; then
   2.124 +                echo -e "\nAn error occured while migrating domain:\n$XMR\n"
   2.125  		rc_failed $?
   2.126 -		echo -n '!'
   2.127 +		echo -e '!'
   2.128 +
   2.129  		kill $WDOG_PID >/dev/null 2>&1
   2.130  	    else
   2.131  		kill $WDOG_PID >/dev/null 2>&1
   2.132 +		
   2.133 +		echo -e .
   2.134 +		usleep 1000
   2.135  		continue
   2.136  	    fi
   2.137  	fi
   2.138 @@ -377,13 +393,16 @@ stop()
   2.139  	    watchdog_xm save &
   2.140  	    WDOG_PID=$!
   2.141  	    mkdir -p "$XENDOMAINS_SAVE"
   2.142 -	    xm save $id $XENDOMAINS_SAVE/$name
   2.143 +	    XMR=`xm save $id $XENDOMAINS_SAVE/$name 2>&1 1>/dev/null`
   2.144  	    if test $? -ne 0; then
   2.145 +                echo -e "\nAn error occured while saving domain:\n$XMR\n"
   2.146  		rc_failed $?
   2.147 -		echo -n '!'
   2.148 +		echo -e '!'
   2.149  		kill $WDOG_PID >/dev/null 2>&1
   2.150  	    else
   2.151  		kill $WDOG_PID >/dev/null 2>&1
   2.152 +		echo -e .
   2.153 +		usleep 1000
   2.154  		continue
   2.155  	    fi
   2.156  	fi
   2.157 @@ -392,10 +411,11 @@ stop()
   2.158  	    echo -n "(shut)"
   2.159  	    watchdog_xm shutdown &
   2.160  	    WDOG_PID=$!
   2.161 -	    xm shutdown $id $XENDOMAINS_SHUTDOWN
   2.162 +	    XMR=`xm shutdown $id $XENDOMAINS_SHUTDOWN 2>&1 1>/dev/null`
   2.163  	    if test $? -ne 0; then
   2.164 +                echo -e "\nAn error occured while shutting down domain:\n$XMR\n"
   2.165  		rc_failed $?
   2.166 -		echo -n '!'
   2.167 +		echo -e '!'
   2.168  	    fi
   2.169  	    kill $WDOG_PID >/dev/null 2>&1
   2.170  	fi
   2.171 @@ -408,18 +428,21 @@ stop()
   2.172      if ! all_zombies && test -n "$XENDOMAINS_SHUTDOWN_ALL"; then
   2.173  	# XENDOMAINS_SHUTDOWN_ALL should be "--all --halt --wait"
   2.174  	echo -n " SHUTDOWN_ALL "
   2.175 -	watchdog_xm shutdown 1 &
   2.176 +	watchdog_xm shutdown 1 false &
   2.177  	WDOG_PID=$!
   2.178 -	xm shutdown $XENDOMAINS_SHUTDOWN_ALL
   2.179 +	XMR=`xm shutdown $XENDOMAINS_SHUTDOWN_ALL 2>&1 1>/dev/null`
   2.180  	if test $? -ne 0; then
   2.181 +            echo -e "\nAn error occured while shutting down all domains: $XMR\n"
   2.182  	    rc_failed $?
   2.183 -	    echo -n '!'
   2.184 +	    echo -e '!'
   2.185  	fi
   2.186  	kill $WDOG_PID >/dev/null 2>&1
   2.187      fi
   2.188  
   2.189      # Unconditionally delete lock file
   2.190      rm -f $LOCKFILE
   2.191 +    
   2.192 +    exec 2>&3
   2.193  }
   2.194  
   2.195  check_domain_up()
     3.1 --- a/tools/python/xen/xend/XendAPI.py	Fri Feb 13 19:11:38 2009 +0900
     3.2 +++ b/tools/python/xen/xend/XendAPI.py	Tue Feb 17 11:01:05 2009 +0000
     3.3 @@ -29,6 +29,7 @@ import xmlrpclib
     3.4  import XendDomain, XendDomainInfo, XendNode, XendDmesg
     3.5  import XendLogging, XendTaskManager, XendAPIStore
     3.6  
     3.7 +from xen.xend import uuid as genuuid
     3.8  from XendAPIVersion import *
     3.9  from XendAuthSessions import instance as auth_manager
    3.10  from XendError import *
    3.11 @@ -1867,7 +1868,7 @@ class XendAPI(object):
    3.12          dom = xendom.get_vm_by_uuid(vbd_struct['VM'])
    3.13          vdi = xennode.get_vdi_by_uuid(vbd_struct['VDI'])
    3.14          if not vdi:
    3.15 -            return xen_api_error(['HANDLE_INVALID', 'VDI', vdi_ref])
    3.16 +            return xen_api_error(['HANDLE_INVALID', 'VDI', vbd_struct['VDI']])
    3.17  
    3.18          # new VBD via VDI/SR
    3.19          vdi_image = vdi.get_location()
    3.20 @@ -2392,7 +2393,7 @@ class XendAPI(object):
    3.21              tpmif.destroy_vtpmstate(dom.getName())
    3.22              return xen_api_success_void()
    3.23          else:
    3.24 -            return xen_api_error(['HANDLE_INVALID', 'VM', vtpm_struct['VM']])
    3.25 +            return xen_api_error(['HANDLE_INVALID', 'VTPM', vtpm_ref])
    3.26  
    3.27      # class methods
    3.28      def VTPM_create(self, session, vtpm_struct):
    3.29 @@ -2614,7 +2615,7 @@ class XendAPI(object):
    3.30          return xen_api_success_void()
    3.31  
    3.32      def event_unregister(self, session, unreg_classes):
    3.33 -        event_unregister(session, reg_classes)
    3.34 +        event_unregister(session, unreg_classes)
    3.35          return xen_api_success_void()
    3.36  
    3.37      def event_next(self, session):
    3.38 @@ -2641,7 +2642,7 @@ class XendAPI(object):
    3.39          return xen_api_error(['DEBUG_FAIL', session])
    3.40  
    3.41      def debug_create(self, session):
    3.42 -        debug_uuid = uuid.createString()
    3.43 +        debug_uuid = genuuid.createString()
    3.44          self._debug[debug_uuid] = None
    3.45          return xen_api_success(debug_uuid)
    3.46  
     4.1 --- a/tools/python/xen/xend/XendConfig.py	Fri Feb 13 19:11:38 2009 +0900
     4.2 +++ b/tools/python/xen/xend/XendConfig.py	Tue Feb 17 11:01:05 2009 +0000
     4.3 @@ -158,6 +158,7 @@ XENAPI_PLATFORM_CFG_TYPES = {
     4.4      'vncdisplay': int,
     4.5      'vnclisten': str,
     4.6      'timer_mode': int,
     4.7 +    'vpt_align': int,
     4.8      'viridian': int,
     4.9      'vncpasswd': str,
    4.10      'vncunused': int,
    4.11 @@ -459,6 +460,8 @@ class XendConfig(dict):
    4.12                  self['platform']['rtc_timeoffset'] = 0
    4.13              if 'hpet' not in self['platform']:
    4.14                  self['platform']['hpet'] = 0
    4.15 +            if 'vpt_align' not in self['platform']:
    4.16 +                self['platform']['vpt_align'] = 1
    4.17              if 'loader' not in self['platform']:
    4.18                  # Old configs may have hvmloader set as PV_kernel param
    4.19                  if self.has_key('PV_kernel') and self['PV_kernel'] != '':
     5.1 --- a/tools/python/xen/xend/XendConstants.py	Fri Feb 13 19:11:38 2009 +0900
     5.2 +++ b/tools/python/xen/xend/XendConstants.py	Tue Feb 17 11:01:05 2009 +0000
     5.3 @@ -50,6 +50,7 @@ HVM_PARAM_VIRIDIAN     = 9 # x86
     5.4  HVM_PARAM_TIMER_MODE   = 10
     5.5  HVM_PARAM_HPET_ENABLED = 11
     5.6  HVM_PARAM_ACPI_S_STATE = 14
     5.7 +HVM_PARAM_VPT_ALIGN    = 16
     5.8  
     5.9  restart_modes = [
    5.10      "restart",
     6.1 --- a/tools/python/xen/xend/XendDomainInfo.py	Fri Feb 13 19:11:38 2009 +0900
     6.2 +++ b/tools/python/xen/xend/XendDomainInfo.py	Tue Feb 17 11:01:05 2009 +0000
     6.3 @@ -2237,6 +2237,12 @@ class XendDomainInfo:
     6.4              xc.hvm_set_param(self.domid, HVM_PARAM_HPET_ENABLED,
     6.5                               long(hpet))
     6.6  
     6.7 +        # Optionally enable periodic vpt aligning
     6.8 +        vpt_align = self.info["platform"].get("vpt_align")
     6.9 +        if hvm and vpt_align is not None:
    6.10 +            xc.hvm_set_param(self.domid, HVM_PARAM_VPT_ALIGN,
    6.11 +                             long(vpt_align))
    6.12 +
    6.13          # Set maximum number of vcpus in domain
    6.14          xc.domain_max_vcpus(self.domid, int(self.info['VCPUs_max']))
    6.15  
     7.1 --- a/tools/python/xen/xm/create.py	Fri Feb 13 19:11:38 2009 +0900
     7.2 +++ b/tools/python/xen/xm/create.py	Tue Feb 17 11:01:05 2009 +0000
     7.3 @@ -219,6 +219,10 @@ gopts.var('timer_mode', val='TIMER_MODE'
     7.4            use="""Timer mode (0=delay virtual time when ticks are missed;
     7.5            1=virtual time is always wallclock time.""")
     7.6  
     7.7 +gopts.var('vpt_align', val='VPT_ALIGN',
     7.8 +          fn=set_int, default=1,
     7.9 +          use="Enable aligning all periodic vpt to reduce timer interrupts.")
    7.10 +
    7.11  gopts.var('viridian', val='VIRIDIAN',
    7.12            fn=set_int, default=0,
    7.13            use="""Expose Viridian interface to x86 HVM guest?
    7.14 @@ -891,7 +895,8 @@ def configure_hvm(config_image, vals):
    7.15               'sdl', 'display', 'xauthority', 'rtc_timeoffset', 'monitor',
    7.16               'acpi', 'apic', 'usb', 'usbdevice', 'keymap', 'pci', 'hpet',
    7.17               'guest_os_type', 'hap', 'opengl', 'cpuid', 'cpuid_check',
    7.18 -             'viridian', 'xen_extended_power_mgmt', 'pci_msitranslate' ]
    7.19 +             'viridian', 'xen_extended_power_mgmt', 'pci_msitranslate',
    7.20 +             'vpt_align' ]
    7.21  
    7.22      for a in args:
    7.23          if a in vals.__dict__ and vals.__dict__[a] is not None:
     8.1 --- a/tools/python/xen/xm/xenapi_create.py	Fri Feb 13 19:11:38 2009 +0900
     8.2 +++ b/tools/python/xen/xm/xenapi_create.py	Tue Feb 17 11:01:05 2009 +0000
     8.3 @@ -1037,6 +1037,7 @@ class sxp2xml:
     8.4              'usbdevice',
     8.5              'hpet',
     8.6              'timer_mode',
     8.7 +            'vpt_align',
     8.8              'viridian',
     8.9              'vhpt',
    8.10              'guest_os_type',
     9.1 --- a/xen/arch/x86/hvm/hvm.c	Fri Feb 13 19:11:38 2009 +0900
     9.2 +++ b/xen/arch/x86/hvm/hvm.c	Tue Feb 17 11:01:05 2009 +0000
     9.3 @@ -542,6 +542,22 @@ static int hvm_load_cpu_ctxt(struct doma
     9.4          return -EINVAL;
     9.5      }
     9.6  
     9.7 +    /* Older Xen versions used to save the segment arbytes directly 
     9.8 +     * from the VMCS on Intel hosts.  Detect this and rearrange them
     9.9 +     * into the struct segment_register format. */
    9.10 +#define UNFOLD_ARBYTES(_r)                          \
    9.11 +    if ( (_r & 0xf000) && !(_r & 0x0f00) )          \
    9.12 +        _r = ((_r & 0xff) | ((_r >> 4) & 0xf00))
    9.13 +    UNFOLD_ARBYTES(ctxt.cs_arbytes);
    9.14 +    UNFOLD_ARBYTES(ctxt.ds_arbytes);
    9.15 +    UNFOLD_ARBYTES(ctxt.es_arbytes);
    9.16 +    UNFOLD_ARBYTES(ctxt.fs_arbytes);
    9.17 +    UNFOLD_ARBYTES(ctxt.gs_arbytes);
    9.18 +    UNFOLD_ARBYTES(ctxt.ss_arbytes);
    9.19 +    UNFOLD_ARBYTES(ctxt.tr_arbytes);
    9.20 +    UNFOLD_ARBYTES(ctxt.ldtr_arbytes);
    9.21 +#undef UNFOLD_ARBYTES
    9.22 +
    9.23      /* Architecture-specific vmcs/vmcb bits */
    9.24      if ( hvm_funcs.load_cpu_ctxt(v, &ctxt) < 0 )
    9.25          return -EINVAL;
    10.1 --- a/xen/arch/x86/hvm/vpt.c	Fri Feb 13 19:11:38 2009 +0900
    10.2 +++ b/xen/arch/x86/hvm/vpt.c	Tue Feb 17 11:01:05 2009 +0000
    10.3 @@ -384,13 +384,25 @@ void create_periodic_time(
    10.4      pt->period_cycles = (u64)period;
    10.5      pt->one_shot = !period;
    10.6      pt->scheduled = NOW() + delta;
    10.7 -    /*
    10.8 -     * Offset LAPIC ticks from other timer ticks. Otherwise guests which use
    10.9 -     * LAPIC ticks for process accounting can see long sequences of process
   10.10 -     * ticks incorrectly accounted to interrupt processing.
   10.11 -     */
   10.12 -    if ( !pt->one_shot && (pt->source == PTSRC_lapic) )
   10.13 -        pt->scheduled += delta >> 1;
   10.14 +
   10.15 +    if ( !pt->one_shot )
   10.16 +    {
   10.17 +        if ( v->domain->arch.hvm_domain.params[HVM_PARAM_VPT_ALIGN] )
   10.18 +        {
   10.19 +            pt->scheduled = align_timer(pt->scheduled, pt->period);
   10.20 +        }
   10.21 +        else if ( pt->source == PTSRC_lapic )
   10.22 +        {
   10.23 +            /*
   10.24 +             * Offset LAPIC ticks from other timer ticks. Otherwise guests
   10.25 +             * which use LAPIC ticks for process accounting can see long
   10.26 +             * sequences of process ticks incorrectly accounted to interrupt
   10.27 +             * processing (seen with RHEL3 guest).
   10.28 +             */
   10.29 +            pt->scheduled += delta >> 1;
   10.30 +        }
   10.31 +    }
   10.32 +
   10.33      pt->cb = cb;
   10.34      pt->priv = data;
   10.35  
    11.1 --- a/xen/common/timer.c	Fri Feb 13 19:11:38 2009 +0900
    11.2 +++ b/xen/common/timer.c	Tue Feb 17 11:01:05 2009 +0000
    11.3 @@ -473,6 +473,13 @@ void process_pending_timers(void)
    11.4          timer_softirq_action();
    11.5  }
    11.6  
    11.7 +s_time_t align_timer(s_time_t firsttick, uint64_t period)
    11.8 +{
    11.9 +    if ( !period )
   11.10 +        return firsttick;
   11.11 +
   11.12 +    return firsttick + (period - 1) - ((firsttick - 1) % period);
   11.13 +}
   11.14  
   11.15  static void dump_timerq(unsigned char key)
   11.16  {
    12.1 --- a/xen/drivers/passthrough/amd/iommu_init.c	Fri Feb 13 19:11:38 2009 +0900
    12.2 +++ b/xen/drivers/passthrough/amd/iommu_init.c	Tue Feb 17 11:01:05 2009 +0000
    12.3 @@ -487,11 +487,13 @@ static int set_iommu_interrupt_handler(s
    12.4      }
    12.5  
    12.6      irq_desc[vector].handler = &iommu_msi_type;
    12.7 +    vector_to_iommu[vector] = iommu;
    12.8      ret = request_irq_vector(vector, amd_iommu_page_fault, 0,
    12.9                               "amd_iommu", iommu);
   12.10      if ( ret )
   12.11      {
   12.12          irq_desc[vector].handler = &no_irq_type;
   12.13 +        vector_to_iommu[vector] = NULL;
   12.14          free_irq_vector(vector);
   12.15          amd_iov_error("can't request irq\n");
   12.16          return 0;
   12.17 @@ -499,7 +501,6 @@ static int set_iommu_interrupt_handler(s
   12.18  
   12.19      /* Make sure that vector is never re-used. */
   12.20      vector_irq[vector] = NEVER_ASSIGN_IRQ;
   12.21 -    vector_to_iommu[vector] = iommu;
   12.22      iommu->vector = vector;
   12.23      return vector;
   12.24  }
    13.1 --- a/xen/drivers/passthrough/vtd/iommu.c	Fri Feb 13 19:11:38 2009 +0900
    13.2 +++ b/xen/drivers/passthrough/vtd/iommu.c	Tue Feb 17 11:01:05 2009 +0000
    13.3 @@ -870,7 +870,7 @@ static struct hw_interrupt_type dma_msi_
    13.4      .set_affinity = dma_msi_set_affinity,
    13.5  };
    13.6  
    13.7 -int iommu_set_interrupt(struct iommu *iommu)
    13.8 +static int iommu_set_interrupt(struct iommu *iommu)
    13.9  {
   13.10      int vector, ret;
   13.11  
   13.12 @@ -882,10 +882,12 @@ int iommu_set_interrupt(struct iommu *io
   13.13      }
   13.14  
   13.15      irq_desc[vector].handler = &dma_msi_type;
   13.16 +    vector_to_iommu[vector] = iommu;
   13.17      ret = request_irq_vector(vector, iommu_page_fault, 0, "dmar", iommu);
   13.18      if ( ret )
   13.19      {
   13.20          irq_desc[vector].handler = &no_irq_type;
   13.21 +        vector_to_iommu[vector] = NULL;
   13.22          free_irq_vector(vector);
   13.23          gdprintk(XENLOG_ERR VTDPREFIX, "IOMMU: can't request irq\n");
   13.24          return ret;
   13.25 @@ -893,7 +895,6 @@ int iommu_set_interrupt(struct iommu *io
   13.26  
   13.27      /* Make sure that vector is never re-used. */
   13.28      vector_irq[vector] = NEVER_ASSIGN_IRQ;
   13.29 -    vector_to_iommu[vector] = iommu;
   13.30  
   13.31      return vector;
   13.32  }
    14.1 --- a/xen/include/public/hvm/params.h	Fri Feb 13 19:11:38 2009 +0900
    14.2 +++ b/xen/include/public/hvm/params.h	Tue Feb 17 11:01:05 2009 +0000
    14.3 @@ -103,6 +103,9 @@
    14.4  /* TSS used on Intel when CR0.PE=0. */
    14.5  #define HVM_PARAM_VM86_TSS     15
    14.6  
    14.7 -#define HVM_NR_PARAMS          16
    14.8 +/* Boolean: Enable aligning all periodic vpts to reduce interrupts */
    14.9 +#define HVM_PARAM_VPT_ALIGN    16
   14.10 +
   14.11 +#define HVM_NR_PARAMS          17
   14.12  
   14.13  #endif /* __XEN_PUBLIC_HVM_PARAMS_H__ */
    15.1 --- a/xen/include/xen/timer.h	Fri Feb 13 19:11:38 2009 +0900
    15.2 +++ b/xen/include/xen/timer.h	Tue Feb 17 11:01:05 2009 +0000
    15.3 @@ -122,6 +122,9 @@ DECLARE_PER_CPU(s_time_t, timer_deadline
    15.4  /* Arch-defined function to reprogram timer hardware for new deadline. */
    15.5  extern int reprogram_timer(s_time_t timeout);
    15.6  
    15.7 +/* calculate the aligned first tick time for a given periodic timer */ 
    15.8 +extern s_time_t align_timer(s_time_t firsttick, uint64_t period);
    15.9 +
   15.10  #endif /* _TIMER_H_ */
   15.11  
   15.12  /*
    16.1 --- a/xen/xsm/flask/ss/policydb.c	Fri Feb 13 19:11:38 2009 +0900
    16.2 +++ b/xen/xsm/flask/ss/policydb.c	Tue Feb 17 11:01:05 2009 +0000
    16.3 @@ -1515,8 +1515,8 @@ int policydb_read(struct policydb *p, vo
    16.4      if ( len != strlen(POLICYDB_STRING) )
    16.5      {
    16.6          printk(KERN_ERR "security:  policydb string length %d does not "
    16.7 -               "match expected length %Zu\n",
    16.8 -               len, (u32) strlen(POLICYDB_STRING));
    16.9 +               "match expected length %lu\n",
   16.10 +               len, strlen(POLICYDB_STRING));
   16.11          goto bad;
   16.12      }
   16.13      policydb_str = xmalloc_array(char, len + 1);