diff --git a/.gitignore b/.gitignore index 5d9b74e..0581cca 100644 --- a/.gitignore +++ b/.gitignore @@ -6,5 +6,5 @@ lwip-1.3.0.tar.gz pciutils-2.2.9.tar.bz2 zlib-1.2.3.tar.gz polarssl-1.1.4-gpl.tgz -/xen-4.20.1.tar.gz /mini-os-4.20.0.tar.xz +/xen-4.20.4.tar.gz diff --git a/sources b/sources index 0aa5da3..4e6a885 100644 --- a/sources +++ b/sources @@ -4,5 +4,5 @@ SHA512 (newlib-1.16.0.tar.gz) = 40eb96bbc6736a16b6399e0cdb73e853d0d90b685c967e77 SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5 -SHA512 (xen-4.20.1.tar.gz) = e4502ddaeb66de4c30d59e90af198586683c28b56bf0eb03ca5508f663fef5e6582c009861ff5b66b7f0df6e5f6bc12337eff0ec775d72e7cb189fd2079dbd9d SHA512 (mini-os-4.20.0.tar.xz) = 52d5d0985e1b4c26b761c94a3f7ca543bc388a96f69710524ebf34dd5b01d8f774fd5a3f6a50739c8b7c7edfdf07b594f5d44de8f389ea4138a62f9c5884c4e6 +SHA512 (xen-4.20.4.tar.gz) = a4d92677f8dff486ae094bf9d74d15606217945012482fd43323c9b86891169be367b80aef2d711d686df478046649fa003ebc038b82ecaffdeff505195179af diff --git a/xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch b/xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch deleted file mode 100644 index c072120..0000000 --- a/xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 7cda6b65098f790e6573f555c5ef170d3f373c6e Mon Sep 17 00:00:00 2001 -From: =?utf8?q?Marek=20Marczykowski-G=C3=B3recki?= - -Date: Mon, 4 Aug 2025 15:22:13 +0200 -Subject: [PATCH] tools/xl: don't crash on NULL command line -MIME-Version: 1.0 -Content-Type: text/plain; charset=utf8 -Content-Transfer-Encoding: 8bit - -When running xl in a domU, it doesn't have access to the Xen command -line. Before the non-truncating xc_xenver_cmdline(), it was always set -with strdup, possibly of an empty string. Now it's NULL. Treat it the -same as empty cmdline, as it was before. Autoballoon isn't relevant for -xl devd in a domU anyway. - -Fixes: 75f91607621c ("tools: Introduce a non-truncating xc_xenver_cmdline()") -Signed-off-by: Marek Marczykowski-Górecki -Acked-by: Anthony PERARD -master commit: a4988c4177be81f225af1516e1bbb9ec14f76388 -master date: 2025-07-31 14:44:02 +0200 ---- - tools/xl/xl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tools/xl/xl.c b/tools/xl/xl.c -index ec72ca60c3..b3abc91b60 100644 ---- a/tools/xl/xl.c -+++ b/tools/xl/xl.c -@@ -79,7 +79,7 @@ static int auto_autoballoon(void) - int ret; - - info = libxl_get_version_info(ctx); -- if (!info) -+ if (!info || !info->commandline) - return 1; /* default to on */ - - #define SIZE_PATTERN "-?[0-9]+[bBkKmMgGtT]?" --- -2.39.5 - diff --git a/xen.git-c403cf9e742a20e0aadbe04c1ab0ce9621184037.patch b/xen.git-c403cf9e742a20e0aadbe04c1ab0ce9621184037.patch new file mode 100644 index 0000000..ab1ac2c --- /dev/null +++ b/xen.git-c403cf9e742a20e0aadbe04c1ab0ce9621184037.patch @@ -0,0 +1,88 @@ +From c403cf9e742a20e0aadbe04c1ab0ce9621184037 Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Fri, 10 Apr 2026 21:55:46 +0100 +Subject: [PATCH] x86/amd: Mitigate AMD-SN-7053 / FP-DSS +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf8 +Content-Transfer-Encoding: 8bit + +This is XSA-488 / CVE-2025-54505 + +Signed-off-by: Andrew Cooper +Reviewed-by: Roger Pau Monné +(cherry picked from commit 99912d346009fda1e7fb1510c9501fbab17e92a0) +--- + xen/arch/x86/cpu/amd.c | 37 ++++++++++++++++++++++++++++ + xen/arch/x86/include/asm/msr-index.h | 1 + + 2 files changed, 38 insertions(+) + +diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c +index d5069a7ec1..43883e04db 100644 +--- a/xen/arch/x86/cpu/amd.c ++++ b/xen/arch/x86/cpu/amd.c +@@ -982,6 +982,42 @@ void amd_init_de_cfg(const struct cpuinfo_x86 *c) + wrmsrl(MSR_AMD64_DE_CFG, val | new); + } + ++static void amd_init_fp_cfg(const struct cpuinfo_x86 *c) ++{ ++ uint64_t val, new = 0; ++ ++ /* If virtualised, we won't have mutable access even if we can read it. */ ++ if ( cpu_has_hypervisor ) ++ return; ++ ++ /* ++ * On Zen1, mitigate SB-7053 / FP-DSS Floating Point Divider State ++ * Sampling by setting bit 9 as instructed. ++ */ ++ if ( c->x86 == 0x17 && is_zen1_uarch() ) ++ new |= 1 << 9; ++ ++ /* ++ * Avoid reading FP_CFG if we don't intend to change anything. The ++ * register doesn't exist on all families. ++ */ ++ if ( !new ) ++ return; ++ ++ rdmsrl(MSR_AMD64_FP_CFG, val); ++ ++ if ( (val & new) == new ) ++ return; ++ ++ /* ++ * FP_CFG is a Core-scoped MSR, and this write is racy. However, both ++ * threads calculate the new value from state which expected to be ++ * consistent across CPUs and unrelated to the old value, so the result ++ * should be consistent. ++ */ ++ wrmsrl(MSR_AMD64_FP_CFG, val | new); ++} ++ + void __init amd_init_lfence_dispatch(void) + { + struct cpuinfo_x86 *c = &boot_cpu_data; +@@ -1055,6 +1091,7 @@ static void cf_check init_amd(struct cpuinfo_x86 *c) + unsigned long long value; + + amd_init_de_cfg(c); ++ amd_init_fp_cfg(c); + + if (c == &boot_cpu_data) + amd_init_lfence_dispatch(); /* Needs amd_init_de_cfg() */ +diff --git a/xen/arch/x86/include/asm/msr-index.h b/xen/arch/x86/include/asm/msr-index.h +index 6f2c3147e3..70e5f09a2d 100644 +--- a/xen/arch/x86/include/asm/msr-index.h ++++ b/xen/arch/x86/include/asm/msr-index.h +@@ -411,6 +411,7 @@ + #define MSR_AMD64_LS_CFG 0xc0011020U + #define MSR_AMD64_IC_CFG 0xc0011021U + #define MSR_AMD64_DC_CFG 0xc0011022U ++#define MSR_AMD64_FP_CFG 0xc0011028U + #define MSR_AMD64_DE_CFG 0xc0011029U + #define AMD64_DE_CFG_LFENCE_SERIALISE (_AC(1, ULL) << 1) + #define MSR_AMD64_EX_CFG 0xc001102cU +-- +2.39.5 + diff --git a/xen.spec b/xen.spec index a16cd27..eef64c5 100644 --- a/xen.spec +++ b/xen.spec @@ -50,8 +50,8 @@ Summary: Xen is a virtual machine monitor Name: xen -Version: 4.20.1 -Release: 6%{?dist} +Version: 4.20.4 +Release: 1%{?dist} # Automatically converted from old format: GPLv2+ and LGPLv2+ and BSD - review is highly recommended. License: GPL-2.0-or-later AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-BSD URL: http://xen.org/ @@ -78,12 +78,6 @@ Patch43: xen.gcc11.fixes.patch Patch45: xen.gcc12.fixes.patch Patch46: xen.efi.build.patch Patch49: xen.python3.12.patch -Patch50: xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch -Patch51: xsa472-1.patch -Patch52: xsa472-2.patch -Patch53: xsa472-3.patch -Patch54: xsa473-1.patch -Patch55: xsa473-2.patch # build using Fedora seabios and ipxe packages for roms @@ -262,13 +256,6 @@ manage Xen virtual machines. %patch 43 -p1 %patch 45 -p1 %patch 46 -p1 -%patch 49 -p1 -%patch 50 -p1 -%patch 51 -p1 -%patch 52 -p1 -%patch 53 -p1 -%patch 54 -p1 -%patch 55 -p1 # stubdom sources cp -v %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} stubdom @@ -818,6 +805,70 @@ fi %endif %changelog +* Thu Jul 30 2026 Michael Young - 4.20.4-1 +- update to xen 4.20.4 +- includes security fixes + x86 shadow paging is deprecated [XSA-495, CVE-2026-42493] + vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492] + buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494, + CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425] + sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426, + CVE-2026-62427] + grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428] + grant-table: version change racing with other operations [XSA-501, + CVE-2026-62435, CVE-2026-62436] + vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429] + x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430] + Viridian STIMER division by zero [XSA-504, CVE-2026-62431] + evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432] + correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433] + PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434] + pygrub is only supported in de-privileged mode [XSA-508] + +* Thu Jun 18 2026 Michael Young - 4.20.3-4 + [ never submitted as update ] +- x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487] +- domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490] +- Arm: Completion of memory accesses not guaranteed by completion of a TLBI + [XSA-493, CVE-2025-10263] +- x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488] + +* Tue May 12 2026 Michael Young - 4.20.3-3 +- x86: CPU Opcode Cache corruption [XSA-490,CVE-2025-54518] + +* Wed Apr 29 2026 Michael Young - 4.20.3-2 +- oxenstored keeps quota related use counts across domain destruction + [XSA-483, CVE-2026-23556] +- Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557] +- grant table v2 race in status page mapping [XSA-486, CVE-2026-23558] +- x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505] + +* Fri Mar 27 2026 Michael Young - 4.20.3-1 +- update to xen 4.20.3 + remove patches now included or superceded upstream + +* Wed Mar 18 2026 Michael Young - 4.20.2-4 +- Use after free of paging structures in EPT [XSA-480, CVE-2026-23554] +- Xenstored DoS by unprivileged domain [XSA-481, CVE-2026-23555] + +* Thu Jan 29 2026 Michael Young - 4.20.2-3 + x86: buffer overrun with shadow paging + tracing [XSA-477, CVE-2025-58150] + (#2434046) + x86: incomplete IBPB for vCPU isolation [XSA-479, CVE-2026-23553] + (#2434048) + +* Fri Nov 14 2025 Michael Young - 4.20.2-1.fc43 +- update to xen 4.20.2 + remove patches now included or superceded upstream + +* Fri Oct 24 2025 Michael Young - 4.20.1-8 +- Incorrect removal of permissions on PCI device unplug [XSA-476, + CVE-2025-58149] + +* Tue Oct 21 2025 Michael Young - 4.20.1-7 +- x86: Incorrect input sanitisation in Viridian hypercalls [XSA-475, + CVE-2025-58147, CVE-2025-58148] + * Fri Sep 19 2025 Python Maint - 4.20.1-6 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/xsa472-1.patch b/xsa472-1.patch deleted file mode 100644 index e69f3e7..0000000 --- a/xsa472-1.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 262114a440bf7c32fd6d215e243b3eaebdd6d7cd Mon Sep 17 00:00:00 2001 -From: Roger Pau Monne -Date: Thu, 10 Jul 2025 15:51:40 +0200 -Subject: [PATCH 1/3] x86/viridian: avoid NULL pointer dereference in - update_reference_tsc() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The function is only called when the MSR has the enabled bit set, but even -then the page might not be mapped because the guest provided gfn is not -suitable. - -Prevent a NULL pointer dereference in update_reference_tsc() by checking -whether the page is mapped. - -This is CVE-2025-27466 / part of XSA-472. - -Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page') -Signed-off-by: Roger Pau Monné -Reviewed-by: Jan Beulich ---- - xen/arch/x86/hvm/viridian/time.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c -index 137577384f1e..ca6d526f46b7 100644 ---- a/xen/arch/x86/hvm/viridian/time.c -+++ b/xen/arch/x86/hvm/viridian/time.c -@@ -26,6 +26,10 @@ static void update_reference_tsc(const struct domain *d, bool initialize) - HV_REFERENCE_TSC_PAGE *p = rt->ptr; - uint32_t seq; - -+ /* Reference TSC page might not be mapped even if the MSR is enabled. */ -+ if ( !p ) -+ return; -+ - if ( initialize ) - clear_page(p); - --- -2.49.0 - diff --git a/xsa472-2.patch b/xsa472-2.patch deleted file mode 100644 index 5b23b6d..0000000 --- a/xsa472-2.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 71c9568e290b51dfd7ab091ac98b272fd0aa0b90 Mon Sep 17 00:00:00 2001 -From: Roger Pau Monne -Date: Thu, 10 Jul 2025 15:58:51 +0200 -Subject: [PATCH 2/3] x86/viridian: avoid NULL pointer dereference in - viridian_synic_deliver_timer_msg() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The function is called unconditionally, regardless of whether the SIM page -is mapped. Avoid a NULL pointer dereference in -viridian_synic_deliver_timer_msg() by checking whether the SIM page is -mapped. - -This is CVE-2025-58142 / part of XSA-472. - -Fixes: 26fba3c85571 ('viridian: add implementation of synthetic timers') -Signed-off-by: Roger Pau Monné -Reviewed-by: Jan Beulich ---- - xen/arch/x86/hvm/viridian/synic.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/xen/arch/x86/hvm/viridian/synic.c b/xen/arch/x86/hvm/viridian/synic.c -index c3dc573b003d..e6cba7548f1b 100644 ---- a/xen/arch/x86/hvm/viridian/synic.c -+++ b/xen/arch/x86/hvm/viridian/synic.c -@@ -338,6 +338,10 @@ bool viridian_synic_deliver_timer_msg(struct vcpu *v, unsigned int sintx, - .DeliveryTime = delivery, - }; - -+ /* Don't assume SIM page to be mapped. */ -+ if ( !msg ) -+ return false; -+ - /* - * To avoid using an atomic test-and-set, and barrier before calling - * vlapic_set_irq(), this function must be called in context of the --- -2.49.0 - diff --git a/xsa472-3.patch b/xsa472-3.patch deleted file mode 100644 index 5dfdf48..0000000 --- a/xsa472-3.patch +++ /dev/null @@ -1,94 +0,0 @@ -From aed4cfd64d178aee677a8790440addda03678cd6 Mon Sep 17 00:00:00 2001 -From: Roger Pau Monne -Date: Thu, 3 Jul 2025 13:09:03 +0200 -Subject: [PATCH 3/3] x86/viridian: protect concurrent modification of the - reference TSC page -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The reference TSC page is shared between all vCPUs, and the data stored in -the domain struct. However the handlers to set and clear it are not safe -against concurrent accesses. It's possible for two (or more) vCPUs to call -HV_X64_MSR_REFERENCE_TSC at the same time and cause the in-use reference -TSC page to be freed, while still being on the p2m. This creates an -information leak, where the page can end up mapped in another domain while -still being part of the original domain p2m. - -It's also possible to underflow the reference counter, as multiple -concurrent writes to HV_X64_MSR_REFERENCE_TSC can create an imbalance on -the number of put_page_and_type() calls. - -Introduce a lock to protect the reference TSC domain field, thus -serializing concurrent vCPU accesses. - -This is CVE-2025-58143 / part of XSA-472. - -Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page') -Signed-off-by: Roger Pau Monné -Reviewed-by: Jan Beulich ---- - xen/arch/x86/hvm/viridian/time.c | 4 ++++ - xen/arch/x86/hvm/viridian/viridian.c | 2 ++ - xen/arch/x86/include/asm/hvm/viridian.h | 1 + - 3 files changed, 7 insertions(+) - -diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c -index ca6d526f46b7..9311858d63c0 100644 ---- a/xen/arch/x86/hvm/viridian/time.c -+++ b/xen/arch/x86/hvm/viridian/time.c -@@ -108,8 +108,10 @@ static void time_ref_count_thaw(const struct domain *d) - - trc->off = (int64_t)trc->val - trc_val(d, 0); - -+ spin_lock(&vd->lock); - if ( vd->reference_tsc.msr.enabled ) - update_reference_tsc(d, false); -+ spin_unlock(&vd->lock); - } - - static uint64_t time_ref_count(const struct domain *d) -@@ -331,6 +333,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) - if ( !(viridian_feature_mask(d) & HVMPV_reference_tsc) ) - return X86EMUL_EXCEPTION; - -+ spin_lock(&vd->lock); - viridian_unmap_guest_page(&vd->reference_tsc); - vd->reference_tsc.msr.raw = val; - viridian_dump_guest_page(v, "REFERENCE_TSC", &vd->reference_tsc); -@@ -339,6 +342,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) - viridian_map_guest_page(d, &vd->reference_tsc); - update_reference_tsc(d, true); - } -+ spin_unlock(&vd->lock); - break; - - case HV_X64_MSR_TIME_REF_COUNT: -diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c -index 7ea6c9016894..c0be24bd2210 100644 ---- a/xen/arch/x86/hvm/viridian/viridian.c -+++ b/xen/arch/x86/hvm/viridian/viridian.c -@@ -494,6 +494,8 @@ int viridian_domain_init(struct domain *d) - if ( !d->arch.hvm.viridian ) - return -ENOMEM; - -+ spin_lock_init(&d->arch.hvm.viridian->lock); -+ - rc = viridian_synic_domain_init(d); - if ( rc ) - goto fail; -diff --git a/xen/arch/x86/include/asm/hvm/viridian.h b/xen/arch/x86/include/asm/hvm/viridian.h -index 4c8ff6e80b6f..47c9d13841ac 100644 ---- a/xen/arch/x86/include/asm/hvm/viridian.h -+++ b/xen/arch/x86/include/asm/hvm/viridian.h -@@ -71,6 +71,7 @@ struct viridian_domain - DECLARE_BITMAP(hypercall_flags, _HCALL_nr); - struct viridian_time_ref_count time_ref_count; - struct viridian_page reference_tsc; -+ spinlock_t lock; - }; - - void cpuid_viridian_leaves(const struct vcpu *v, uint32_t leaf, --- -2.49.0 - diff --git a/xsa473-1.patch b/xsa473-1.patch deleted file mode 100644 index e8689b6..0000000 --- a/xsa473-1.patch +++ /dev/null @@ -1,43 +0,0 @@ -From: Jan Beulich -Subject: Arm: foreign page handling in p2m_get_page_from_gfn() - -I can't see what would make the 1st of the assertions safe: For example, -the P2M lock not being held, the foreign page may disappear before we -get to call page_get_owner_and_reference(), which hence may return NULL. - -Even the 2nd, which appears to be safe safe, is lacking proper release -build fallbacks. - -Drop the former in favor of an if(), and convert the latter to the -equivalent of what x86 uses: ASSERT_UNREACHABLE() plus putting of the -obtained page. - -This is CVE-2025-58144 / part of XSA-473. - -Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping") -Signed-off-by: Jan Beulich -Reviewed-by: Julien Grall - ---- a/xen/arch/arm/p2m.c -+++ b/xen/arch/arm/p2m.c -@@ -74,10 +74,16 @@ struct page_info *p2m_get_page_from_gfn( - */ - if ( p2m_is_foreign(p2mt) ) - { -- struct domain *fdom = page_get_owner_and_reference(page); -- ASSERT(fdom != NULL); -- ASSERT(fdom != d); -- return page; -+ const struct domain *fdom = page_get_owner_and_reference(page); -+ -+ if ( fdom ) -+ { -+ if ( fdom != d ) -+ return page; -+ ASSERT_UNREACHABLE(); -+ put_page(page); -+ } -+ return NULL; - } - - return get_page(page, d) ? page : NULL; diff --git a/xsa473-2.patch b/xsa473-2.patch deleted file mode 100644 index 7d66f79..0000000 --- a/xsa473-2.patch +++ /dev/null @@ -1,62 +0,0 @@ -From: Jan Beulich -Subject: Arm: adjust locking in p2m_get_page_from_gfn() - -In order to safely acquire a reference for a foreign page mapping, the -P2M lock needs to be held until we have the reference in hand (or -getting one failed). Otherwise the page can change P2M type and -ownership in between. - -This is CVE-2025-58145 / part of XSA-473. - -Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping") -Signed-off-by: Jan Beulich -Reviewed-by: Julien Grall - ---- a/xen/arch/arm/p2m.c -+++ b/xen/arch/arm/p2m.c -@@ -53,18 +53,22 @@ mfn_t p2m_lookup(struct domain *d, gfn_t - struct page_info *p2m_get_page_from_gfn(struct domain *d, gfn_t gfn, - p2m_type_t *t) - { -+ struct p2m_domain *p2m = p2m_get_hostp2m(d); - struct page_info *page; - p2m_type_t p2mt; -- mfn_t mfn = p2m_lookup(d, gfn, &p2mt); -+ mfn_t mfn; -+ -+ p2m_read_lock(p2m); -+ mfn = p2m_get_entry(p2m, gfn, &p2mt, NULL, NULL, NULL); - - if ( t ) - *t = p2mt; - -- if ( !p2m_is_any_ram(p2mt) ) -- return NULL; -- -- if ( !mfn_valid(mfn) ) -+ if ( !p2m_is_any_ram(p2mt) || !mfn_valid(mfn) ) -+ { -+ p2m_read_unlock(p2m); - return NULL; -+ } - - page = mfn_to_page(mfn); - -@@ -76,6 +80,8 @@ struct page_info *p2m_get_page_from_gfn( - { - const struct domain *fdom = page_get_owner_and_reference(page); - -+ p2m_read_unlock(p2m); -+ - if ( fdom ) - { - if ( fdom != d ) -@@ -86,6 +92,8 @@ struct page_info *p2m_get_page_from_gfn( - return NULL; - } - -+ p2m_read_unlock(p2m); -+ - return get_page(page, d) ? page : NULL; - } -