{"push_id":3159558080,"size":25,"distinct_size":25,"ref":"refs/heads/staging","head":"7f28661f6a7ce3d82f881b9afedfebca7f2cf116","before":"af80e1d9c79e3bcb392775f311d20eec54b3389b","commits":[{"sha":"9c2f7c0123d9221d375833275223c668f00cf651","author":{"name":"Julien Grall","email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@arm.com"},"message":"xen/arm: p2m: Introduce p2m_get_page_from_gfn\n\nIn a follow-up patch, we will need to handle get_page_from_gfn\ndifferently for DOMID_XEN. To keep the code simple move the current\ncontent in a new separate helper p2m_get_page_from_gfn.\n\nNote the new helper is not anymore a static inline function as the helper\nis quite complex.\n\nFinally, take the opportunity to use typesafe gfn as the change is\nminor.\n\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nReviewed-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/9c2f7c0123d9221d375833275223c668f00cf651"},{"sha":"833c9c5e6c3b97e2e918e9af8d17d152188ff151","author":{"name":"Julien Grall","email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@arm.com"},"message":"xen/arm: Rename p2m_map_foreign to p2m_map_foreign_rw\n\nA follow-up patch will introduce another type of foreign mapping. Rename\nthe type to make clear it is only used for read-write mapping.\n\nNo functional changes intended.\n\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nAcked-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/833c9c5e6c3b97e2e918e9af8d17d152188ff151"},{"sha":"e820583468513b799aafc1010977e71db27f8992","author":{"name":"Julien Grall","email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@arm.com"},"message":"xen/arm: Add support for read-only foreign mappings\n\nCurrently, foreign mappings can only be read-write. A follow-up patch will\nextend foreign mapping for Xen backend memory (via XEN_DOMID), some of\nthat memory should only be read accessible for the mapping domain.\n\nIntroduce a new p2m_type to cater read-only foreign mappings. For now,\nthe decision between the two foreign mapping type is based on the type\nof the guest page mapped.\n\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nAcked-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/e820583468513b799aafc1010977e71db27f8992"},{"sha":"0178f4416c61c4e87bfad5c5b41b537d165321fe","author":{"name":"Julien Grall","email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@arm.com"},"message":"xen/arm: Make get_page_from_gfn working with DOMID_XEN\n\nDOMID_XEN is used to share pages beloging to the hypervisor\n(e.g trace buffers). Unlike other domains, DOMID_XEN is a non-auto\ntranslated domain and therefore does not have a P2M.\n\nThis patch adds a special case for DOMID_XEN in get_page_from_gfn. We\nmay want to provide \"non-auto translated helpers\" in the future if we\nsee more case.\n\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nAcked-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/0178f4416c61c4e87bfad5c5b41b537d165321fe"},{"sha":"615897bc6c01c862a4136816f1354acbab2d40c2","author":{"name":"Julien Grall","email":"2fe41d4e32b0bb991f63b975f2bed08c1e666665@arm.com"},"message":"xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN\n\nFor auto-translated domain, the only way to map a page to itself is the\nusing the foreign map API. The current code does not allow mapping page from\nspecial page (such as DOMID_XEN).\n\nAs xentrace buffers are shared using DOMID_XEN, it is not possible to use\ntracing for Arm.\n\nThis could be solved by using the helper get_pg_owner(). This helper will\nbe able to get a reference on DOMID_XEN and therefore allow mapping for\nprivileged domain.\n\nThis patch replace the call to rcu_lock_domain_by_any_id() with\nget_pg_owner(). For consistency, all the call to rcu_unlock_domain are\nreplaced by put_pg_owner().\n\nSigned-off-by: Julien grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nReviewed-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/615897bc6c01c862a4136816f1354acbab2d40c2"},{"sha":"4e191a854dedfb9774bf6797a32266d333cb79f5","author":{"name":"Benjamin Sanda","email":"e32f88b0cef0050744d436f15319d08d9349abcb@dornerworks.com"},"message":"xen/arm: Initialize trace buffer\n\nNow that we allow a privileged domain to map tracing buffer, initialize\nthem so a user can effectively trace Xen.\n\nSigned-off-by: Benjamin Sanda <ben.sanda@dornerworks.com>\n[julien: rework commit message]\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nReviewed-by: Andrii Anisov <andrii_anisov@epam.com>\nAcked-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/4e191a854dedfb9774bf6797a32266d333cb79f5"},{"sha":"d3ce6380c1f71f9575115750e4ed707911529345","author":{"name":"Benjamin Sanda","email":"e32f88b0cef0050744d436f15319d08d9349abcb@dornerworks.com"},"message":"xenalyze: Build for Both ARM and x86 Platforms\n\nModified to provide building of the xenalyze binary for both ARM and\nx86 platforms. The xenalyze binary is now built as part of the BIN\nlist for both platforms.\n\nSigned-off-by: Benjamin Sanda <ben.sanda@dornerworks.com>\nSigned-off-by: Julien Grall <julien.grall@arm.com>\nAcked-by: Wei Liu <wei.liu2@citrix.com>\nAcked-by: Stefano Stabellini <sstabellini@kernel.org>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/d3ce6380c1f71f9575115750e4ed707911529345"},{"sha":"0fa6c9b34407f5d683c6f9bbec332d8102b451b5","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Move dm user determination logic into a helper function\n\nTo reliably kill an untrusted devicemodel, we need to know not only\nits pid, but its uid.  In preparation for this, move the userid\ndetermination logic into a helper function.\n\nCreate a new field, `dm_runas`, in libxl__domain_build_state to store\nthe value during domain creation.\n\nThis change also removes unnecessary duplication of the argument\nconstruction code.\n\nWhile here, clean up some minor CODING_STYLE infractions (space\nbetween * and variable name).\n\nNo functional change intended.\n\nWhile here, delete some trailing whitespace.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Wei Liu <wei.liu2@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/0fa6c9b34407f5d683c6f9bbec332d8102b451b5"},{"sha":"28b5856b02ca717951ee4a5eb9bc047b1fc9189c","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Get rid of support for QEMU_USER_BASE (xen-qemuuser-domidNN)\n\nQEMU_USER_BASE allows a user to specify the UID to use when running\nthe devicemodel for a specific domain number.  Unfortunately, this is\nnot really practical: It requires nearly 32,000 entries in\n/etc/passwd.  QEMU_USER_RANGE_BASE is much more practical.\n\nRemove support for QEMU_USER_BASE.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/28b5856b02ca717951ee4a5eb9bc047b1fc9189c"},{"sha":"6572b665782ff881bfdede09e07710824bb7a7be","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Clean up userlookup_helper_getpw* helper\n\nBring conventions more in line with libxl__xs_read_checked():\n- If found, return 0 and set pointer to non-NULL\n- If not found, return 0 and set pointer to NULL\n- On error, return libxl-style error number.\n\nUpdate documentation to match.\n\nUse CODING_STYLE compliant `r` rather than `ret`.\n\nOn error, log the error code before returning instead of discarding\nit.\n\nNow that it only returns 0 or errno, update caller error checks to be\n`if (ret)` rather than `if (ret < 0)`.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/6572b665782ff881bfdede09e07710824bb7a7be"},{"sha":"53bf85de47b6cb1f727c71bbcc533d0ed78efc64","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"dm_depriv: Describe expected usage of device_model_user parameter\n\nA number of subsequent patches rely on as-yet undefined behavior for\nwhat the `device_model_user` parameter does.  Rather than implement it\nincorrectly (or randomly), or remove the feature, describe an expected\nusage for the feature.  Further patches will make decisions based on\nthis expected usage.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/53bf85de47b6cb1f727c71bbcc533d0ed78efc64"},{"sha":"436bf83bf13c94eb68a34e8ae5d7fe3e4be2af33","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Do root checks once in libxl__domain_get_device_model_uid\n\nAt the moment, we check for equivalence to literal \"root\" before\ndeciding whether to add the `runas` command-line option to QEMU.  This\nis unsatisfactory for several reasons.\n\nFirst, just because the string doesn't match \"root\" doesn't mean the\nfinal uid won't end up being zero; in particular, the range_base\ncalculations may end up producing \"0:NNN\", which would be root in any\ncase.\n\nSecondly, it's almost certainly a configuration error if the resulting\nuid ends up to be zero; rather than silently do what was specified but\nprobably not intended, throw an error.\n\nTo fix this, check for root once in\nlibxl__domain_get_device_model_uid.  If the result is root, return an\nerror; if appropriate, set `runas`.\n\nAfter that, assume that the presence of state->dm_runas implies that a\n`runas` argument should be constructed.\n\nOne side effect of this is to check whether device_model_user exists\nbefore passing it to qemu, resulting in better error reporting.\n\nWhile we're here:\n- Refactor the function to use the \"goto out\" idiom\n- Use 'rc' rather than 'ret', in line with CODING_STYLE\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/436bf83bf13c94eb68a34e8ae5d7fe3e4be2af33"},{"sha":"a233781cd66258b40c7d997a1845ef626fcb425e","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Move qmp cleanup into devicemodel destroy function\n\nRemoving the qmp connection is logically part of the device model\ndestruction; having the caller destroy it is a mild layering\nviolation.\n\nMove libxl__qmp_cleanup() into libxl__destroy_device_model().  This\nwill make it easier when we make devicemodel destruction asynchronous.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/a233781cd66258b40c7d997a1845ef626fcb425e"},{"sha":"6a05c1a9b624f54b3687087829a25503088d1be5","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Make killing of device model asynchronous\n\nOr at least, give it an asynchronous interface so that we can make it\nactually asynchronous in subsequent patches.\n\nCreate state structures and callback function signatures.  Add the\nstate structure to libxl__destroy_domid_state.  Break\nlibxl__destroy_domid down into two functions.\n\nNo functional change intended.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/6a05c1a9b624f54b3687087829a25503088d1be5"},{"sha":"0c653574d39cb61c83a036c21cbd035c99c931e8","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Kill QEMU by uid when possible\n\nThe privcmd fd that a dm_restrict'ed QEMU has gives it permission to\none specific domain ID.  This domain ID will probably eventually be\nused again.  It is therefore necessary to make absolutely sure that a\nrogue QEMU process cannot hang around after its domain has exited.\n\nKilling QEMU by pid is insufficient in this situation, because QEMU\nmay be able to fork() to escape killing.  It is surprisingly tricky to\nkill a process which can call fork() without races; the only reliable\nway is to use kill(-1) to kill all processes with a given uid.\n\nWe can use this method only when we're sure that there's only one QEMU\ninstance per uid.  Add a dm_uid into the domain_build_state struct,\nand set it in libxl__domain_get_device_model_uid() when it's safe to\nkill by UID.  Store this in xenstore next to device-model-pid.\n\nOn domain destroy, check to see if device-model-uid is present in\nxenstore.  If so, fork off a reaper process, setuid to that uid, and\ndo kill(-9) to kill all uids of that type.  Otherwise, carry on\ndestroying by pid.\n\nWhile we're here, make libxl__destroy_device_model() consistently:\n 1. Return an error when anything fails\n 2. But continue to do as much clean-up as possible\n\nNOTE that this is not yet completely safe: with ruid == dm_uid, the\ndevice model may be able to kill(-9) the 'reaper' process before the\nreaper process can kill it.  Further patches will address this.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/0c653574d39cb61c83a036c21cbd035c99c931e8"},{"sha":"87f9458e3400b3fb2b9adeef5309653795fa52c0","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Kill QEMU with \"reaper\" ruid\n\nUsing kill(-1) to killing an untrusted dm process with the real uid\nequal to the dm_uid isn't guaranteed to succeed: the process in\nquestion may be able to kill the reaper process after the setresuid()\nand before the kill().\n\nInstead, set the real uid to the QEMU user for domain 0\n(QEMU_USER_RANGE_BASE + 0).  The reaper process will still be able to\nkill the dm process, but not vice versa.\n\nThis, in turn, requires locking to make sure that only one reaper\nprocess is using that uid at a time; otherwise one reaper process may\nkill the other reaper process.\n\nCreate a lockfile in RUNDIR/dm-reaper-lock, and grab the lock before\nexecuting kill.\n\nIn the event that we can't get the lock for some reason, go ahead with\nthe kill using dm_uid for both real and effective UIDs.  This isn't\nguaranteed to work, but it's no worse than not trying to kill the\nprocess at all.\n\nNB that this effectively requires admins using device_model_user to\nalso define xen_qemuuser_range_base; this will be addressed in\nsubsequent patches.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/87f9458e3400b3fb2b9adeef5309653795fa52c0"},{"sha":"f45e7d333fe6b1c578e020adce65269db204ade3","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl: Introduce specific username to be used as a reaper\n\nUntrusted device models must be killed by uid rather than by pid for\nsafety.  To do this reliably, we need another uid, not used for any\nother purpose, from which to make the kill system call.\n\nWhen using xen-qemuuser-range-base, we can repurpose\nxen-qemuuser-range-base itself as a UID from which to kill other\ndevicemodel uids (since domain ID 0 should never have a device model\nassociated with it).\n\nHowever, we'd like people to be able to use the device_model_user\nfeature without also defining xen-qemuuser-range-base (which requires\nthe ability to 'reserve' 32k+ user IDs).\n\nTo that end, introduce the xen-qemuuser-reaper id.  When killing by\nUID, first look for and use that ID if available; then fall back to\nxen-qemuuser-range-base.\n\nDocument the new call in docs/features/qemu-deprivilege.pandoc.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/f45e7d333fe6b1c578e020adce65269db204ade3"},{"sha":"c820787c6e8ce67e50e65ab42c444a6552e58ee9","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"dm_depriv: Mark `UID cleanup` as completed\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>\nAcked-by: Ian Jackson <ian.jackson@eu.citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/c820787c6e8ce67e50e65ab42c444a6552e58ee9"},{"sha":"9d357cbaf74f0c1dc85a16498dac6d819743ce38","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl/dm_depriv: Fix build\n\nBuild tests noticed a path where we weren't setting rc.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/9d357cbaf74f0c1dc85a16498dac6d819743ce38"},{"sha":"82c62c87347dd9b3acbc1ac94dc43663f52ac0aa","author":{"name":"George Dunlap","email":"5550238db901d11ffde71793169c04afba1d712c@citrix.com"},"message":"libxl/dm_depriv: Fix non-debug build\n\nApparently older versions of gcc, when building with debug=n, the\nuninitialized variable logic gets confused.  Distros on which a\nnon-debug build will fail include:\n- Centos 7\n- Debian Jessie\n- Ubuntu Trusty\n\nIt seems to be one particular path confusing the logic; so just set it\non that path to keep the compiler happy, while still catching other\npotential paths where it might be unset.\n\nSigned-off-by: George Dunlap <george.dunlap@citrix.com>","distinct":true,"url":"https://api.github.com/repos/andyhhp/xen/commits/82c62c87347dd9b3acbc1ac94dc43663f52ac0aa"}]}
{"actor":{"display_login":"andyhhp"}}