The developers of the Xen project regarding the implementation of the possibility of using the Xen Hypervisor on Raspberry Pi 4 boards. The adaptation of Xen for operation on previous versions of Raspberry Pi boards was hindered by the use of a non-standard interrupt controller that did not support virtualization. The Raspberry Pi 4 used a standard GIC-400 interrupt controller, which is supported in Xen, and the developers expected there would be no issues in launching Xen. However, things turned out differently than anticipated, and significant code modifications were required to work with memory on the Raspberry Pi 4.
The first versions of the Raspberry Pi 4 boards limited access to only the address space of the first gigabyte of memory, which was insufficient for Dom0. Necessary changes were made in the Xen 4.14 release, but another issue arose immediately — in the Xen subsystem, the call to virt_to_phys was used to translate virtual addresses to physical addresses, which did not function for all virtual addresses, and attempts to translate certain virtual addresses resulted in errors. To resolve this issue, another address conversion function had to be added.
The problems did not end there, as a peculiar feature in DMA operation emerged — in all previously supported platforms in Xen (x86, ARM, and ARM64), DMA addresses and physical addresses always matched, but in the Raspberry Pi 4 they differed. Finding a solution to this problem proved to be the most challenging and required the development of patches for the Linux kernel to perform the translation between physical addresses and DMA addresses.
The prepared fixes were incorporated into the Linux kernel 5.9, and now Xen is recognized as ready for virtualization on Raspberry Pi 4 boards. In particular, on the Raspberry Pi 4, it is now possible to use (Edge Virtualization Engine), a framework for creating and running cloud-native applications that use Xen, and to build virtualization infrastructure on portable devices.
Additionally, it is noteworthy that in Xen have been addressed. The vulnerabilities ,
and
potentially allow a guest system to gain host environment privileges. The issues
, ,
,
,
,
and
are limited to denial of service.
Source: opennet.ru
