ba5dde9750
53a199d7-x86-EFI-allow-FPU-XMM-use-in-runtime-service-functions.patch - Upstream patches from Jan 538c338f-x86-amd_ucode-flip-revision-numbers-in-printk.patch 538ee637-ACPI-Prevent-acpi_table_entries-from-falling-into-a-infinite-loop.patch 5390917a-VT-d-honor-APEI-firmware-first-mode-in-XSA-59-workaround-code.patch 53909259-x86-domctl-two-functional-fixes-to-XEN_DOMCTL_-gs-etvcpuextstate.patch 5390927f-x86-fix-reboot-shutdown-with-running-HVM-guests.patch 5396d818-avoid-crash-on-HVM-domain-destroy-with-PCI-passthrough.patch 5396e805-x86-HVM-refine-SMEP-test-in-HVM_CR4_GUEST_RESERVED_BITS.patch 539ebe62-x86-EFI-improve-boot-time-diagnostics.patch 539ec004-x86-mce-don-t-spam-the-console-with-CPUx-Temperature-z.patch 53a040c6-page-alloc-scrub-pages-used-by-hypervisor-upon-freeing.patch (replaces xsa100.patch) 53a1990a-IOMMU-prevent-VT-d-device-IOTLB-operations-on-wrong-IOMMU.patch - Replace 'domUloader' with 'pygrub' when converting or importing Xen domains into libvirt with xen2libvirt. domUloader is no longer provided in xen-tools. Modified: xen2libvirt.py Thu Jun 13 15:50:19 MDT 2014 - cyliu@suse.com - fate#310956: Support Direct Kernel Boot for FV guests patches would go to upstream: qemu side: qemu-support-xen-hvm-direct-kernel-boot.patch xen side: xen-pass-kernel-initrd-to-qemu.patch - bnc#880751 - VUL-0: xen: Hypervisor heap contents leaked to guests xsa100.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=320
134 lines
5.0 KiB
Diff
134 lines
5.0 KiB
Diff
# Commit 090ca8c155b7321404ea7713a28aaedb7ac4fffd
|
|
# Date 2014-06-05 17:52:57 +0200
|
|
# Author Andrew Cooper <andrew.cooper3@citrix.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/domctl: two functional fixes to XEN_DOMCTL_[gs]etvcpuextstate
|
|
|
|
Interacting with the vcpu itself should be protected by vcpu_pause().
|
|
Buggy/naive toolstacks might encounter adverse interaction with a vcpu context
|
|
switch, or increase of xcr0_accum. There are no much problems with current
|
|
in-tree code.
|
|
|
|
Explicitly permit a NULL guest handle as being a request for size. It is the
|
|
prevailing Xen style, and without it, valgrind's ioctl handler is unable to
|
|
determine whether evc->buffer actually got written to.
|
|
|
|
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
Reviewed-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
# Commit 895661ae98f0249f50280b4acfb9dda70b76d7e9
|
|
# Date 2014-06-10 12:03:16 +0200
|
|
# Author Andrew Cooper <andrew.cooper3@citrix.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/domctl: further fix to XEN_DOMCTL_[gs]etvcpuextstate
|
|
|
|
Do not clobber errors from certain codepaths. Clobbering of -EINVAL from
|
|
failing "evc->size <= PV_XSAVE_SIZE(_xcr0_accum)" was a pre-existing bug.
|
|
|
|
However, clobbering -EINVAL/-EFAULT from the get codepath was a bug
|
|
unintentionally introduced by 090ca8c1 "x86/domctl: two functional fixes to
|
|
XEN_DOMCTL_[gs]etvcpuextstate".
|
|
|
|
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
Reviewed-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
--- a/xen/arch/x86/domctl.c
|
|
+++ b/xen/arch/x86/domctl.c
|
|
@@ -1089,45 +1089,48 @@ long arch_do_domctl(
|
|
((v = d->vcpu[evc->vcpu]) == NULL) )
|
|
goto vcpuextstate_out;
|
|
|
|
+ ret = -EINVAL;
|
|
+ if ( v == current ) /* no vcpu_pause() */
|
|
+ goto vcpuextstate_out;
|
|
+
|
|
if ( domctl->cmd == XEN_DOMCTL_getvcpuextstate )
|
|
{
|
|
- unsigned int size = PV_XSAVE_SIZE(v->arch.xcr0_accum);
|
|
+ unsigned int size;
|
|
+
|
|
+ ret = 0;
|
|
+ vcpu_pause(v);
|
|
|
|
- if ( !evc->size && !evc->xfeature_mask )
|
|
+ size = PV_XSAVE_SIZE(v->arch.xcr0_accum);
|
|
+ if ( (!evc->size && !evc->xfeature_mask) ||
|
|
+ guest_handle_is_null(evc->buffer) )
|
|
{
|
|
evc->xfeature_mask = xfeature_mask;
|
|
evc->size = size;
|
|
- ret = 0;
|
|
+ vcpu_unpause(v);
|
|
goto vcpuextstate_out;
|
|
}
|
|
+
|
|
if ( evc->size != size || evc->xfeature_mask != xfeature_mask )
|
|
- {
|
|
ret = -EINVAL;
|
|
- goto vcpuextstate_out;
|
|
- }
|
|
- if ( copy_to_guest_offset(domctl->u.vcpuextstate.buffer,
|
|
- offset, (void *)&v->arch.xcr0,
|
|
- sizeof(v->arch.xcr0)) )
|
|
- {
|
|
+
|
|
+ if ( !ret && copy_to_guest_offset(evc->buffer, offset,
|
|
+ (void *)&v->arch.xcr0,
|
|
+ sizeof(v->arch.xcr0)) )
|
|
ret = -EFAULT;
|
|
- goto vcpuextstate_out;
|
|
- }
|
|
+
|
|
offset += sizeof(v->arch.xcr0);
|
|
- if ( copy_to_guest_offset(domctl->u.vcpuextstate.buffer,
|
|
- offset, (void *)&v->arch.xcr0_accum,
|
|
- sizeof(v->arch.xcr0_accum)) )
|
|
- {
|
|
+ if ( !ret && copy_to_guest_offset(evc->buffer, offset,
|
|
+ (void *)&v->arch.xcr0_accum,
|
|
+ sizeof(v->arch.xcr0_accum)) )
|
|
ret = -EFAULT;
|
|
- goto vcpuextstate_out;
|
|
- }
|
|
+
|
|
offset += sizeof(v->arch.xcr0_accum);
|
|
- if ( copy_to_guest_offset(domctl->u.vcpuextstate.buffer,
|
|
- offset, (void *)v->arch.xsave_area,
|
|
- size - 2 * sizeof(uint64_t)) )
|
|
- {
|
|
+ if ( !ret && copy_to_guest_offset(evc->buffer, offset,
|
|
+ (void *)v->arch.xsave_area,
|
|
+ size - 2 * sizeof(uint64_t)) )
|
|
ret = -EFAULT;
|
|
- goto vcpuextstate_out;
|
|
- }
|
|
+
|
|
+ vcpu_unpause(v);
|
|
}
|
|
else
|
|
{
|
|
@@ -1176,12 +1179,14 @@ long arch_do_domctl(
|
|
|
|
if ( evc->size <= PV_XSAVE_SIZE(_xcr0_accum) )
|
|
{
|
|
+ vcpu_pause(v);
|
|
v->arch.xcr0 = _xcr0;
|
|
v->arch.xcr0_accum = _xcr0_accum;
|
|
if ( _xcr0_accum & XSTATE_NONLAZY )
|
|
v->arch.nonlazy_xstate_used = 1;
|
|
memcpy(v->arch.xsave_area, _xsave_area,
|
|
evc->size - 2 * sizeof(uint64_t));
|
|
+ vcpu_unpause(v);
|
|
}
|
|
else
|
|
ret = -EINVAL;
|
|
@@ -1189,8 +1194,6 @@ long arch_do_domctl(
|
|
xfree(receive_buf);
|
|
}
|
|
|
|
- ret = 0;
|
|
-
|
|
vcpuextstate_out:
|
|
if ( domctl->cmd == XEN_DOMCTL_getvcpuextstate )
|
|
copyback = 1;
|