Rebuilt for Python 3.15.0b4 ABI change

x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487]
domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490]
Arm: Completion of memory accesses not guaranteed by completion of a TLBI
	 [XSA-493, CVE-2025-10263]
x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488]

.gitignore

@@ -6,4 +6,5 @@ lwip-1.3.0.tar.gz
 pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
-/xen-4.12.1.tar.gz
+/mini-os-4.21.0.tar.xz
+/xen-4.21.1.tar.xz

CVE-2014-0150.patch

@@ -1,11 +0,0 @@
---- xen-4.4.1/tools/qemu-xen-traditional/hw/virtio-net.c.orig	2014-07-02 15:54:37.000000000 +0100
-+++ xen-4.4.1/tools/qemu-xen-traditional/hw/virtio-net.c	2014-11-18 20:50:13.593122915 +0000
-@@ -192,7 +192,7 @@
-         return VIRTIO_NET_ERR;
- 
-     if (mac_data.entries) {
--        if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
-+        if (n->mac_table.in_use <= MAC_TABLE_ENTRIES - mac_data.entries) {
-             memcpy(n->mac_table.macs + (n->mac_table.in_use * ETH_ALEN),
-                    elem->out_sg[2].iov_base + sizeof(mac_data),
-                    mac_data.entries * ETH_ALEN);

qemu.trad.CVE-2015-5278.patch

@@ -1,11 +0,0 @@
---- xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c.orig	2015-09-26 17:27:49.494334726 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c	2015-09-26 17:31:53.107474932 +0100
-@@ -331,7 +331,7 @@
-         if (index <= s->stop)
-             avail = s->stop - index;
-         else
--            avail = 0;
-+            break;
-         len = size;
-         if (len > avail)
-             len = avail;

qemu.trad.CVE-2015-5279.patch

@@ -1,48 +0,0 @@
---- xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c.orig	2015-06-09 16:32:24.000000000 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/ne2000.c	2015-09-26 17:27:49.494334726 +0100
-@@ -304,6 +304,9 @@
-     }
- 
-     index = s->curpag << 8;
-+    if (index >= NE2000_PMEM_END) {
-+        index = s->start;
-+    }
-     /* 4 bytes for header */
-     total_len = size + 4;
-     /* address for next packet (4 bytes for CRC) */
-@@ -387,15 +390,21 @@
-         offset = addr | (page << 4);
-         switch(offset) {
-         case EN0_STARTPG:
--            s->start = val << 8;
-+            if (val << 8 <= NE2000_PMEM_END) {
-+                s->start = val << 8;
-+            }
-             s->tainted = 1;
-             break;
-         case EN0_STOPPG:
--            s->stop = val << 8;
-+            if (val << 8 <= NE2000_PMEM_END) {
-+                s->stop = val << 8;
-+            }
-             s->tainted = 1;
-             break;
-         case EN0_BOUNDARY:
--            s->boundary = val;
-+            if (val << 8 < NE2000_PMEM_END) {
-+                s->boundary = val;
-+            }
-             break;
-         case EN0_IMR:
-             s->imr = val;
-@@ -436,7 +445,9 @@
-             s->phys[offset - EN1_PHYS] = val;
-             break;
-         case EN1_CURPAG:
--            s->curpag = val;
-+            if (val << 8 < NE2000_PMEM_END) {
-+                s->curpag = val;
-+            }
-             s->tainted = 1;
-             break;
-         case EN1_MULT ... EN1_MULT + 7:

qemu.trad.CVE-2015-6815.patch

@@ -1,12 +0,0 @@
---- xen-4.5.1/tools/qemu-xen-traditional/hw/e1000.c.orig	2015-06-09 16:32:24.000000000 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/e1000.c	2015-09-26 17:16:36.406544380 +0100
-@@ -461,7 +461,8 @@
-                 memmove(tp->data, tp->header, hdr);
-                 tp->size = hdr;
-             }
--        } while (split_size -= bytes);
-+            split_size -= bytes;
-+        } while (bytes && split_size);
-     } else if (!tp->tse && tp->cptse) {
-         // context descriptor TSE is not set, while data descriptor TSE is set
-         DBGOUT(TXERR, "TCP segmentaion Error\n");

qemu.trad.CVE-2015-7295.patch

@@ -1,63 +0,0 @@
---- xen-4.5.1/tools/qemu-xen-traditional/hw/virtio.c.orig	2015-06-09 16:32:24.000000000 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/virtio.c	2015-10-10 16:57:01.806370020 +0100
-@@ -268,8 +268,8 @@
-     return vring_avail_idx(vq) == vq->last_avail_idx;
- }
- 
--void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
--                    unsigned int len, unsigned int idx)
-+static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
-+			       unsigned int len)
- {
-     unsigned int offset;
-     int i;
-@@ -302,7 +302,19 @@
-         
-         offset += size;
-     }
-+}
- 
-+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
-+                       unsigned int len)
-+{
-+    vq->last_avail_idx--;
-+    virtqueue_unmap_sg(vq, elem, len);
-+}
-+
-+void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
-+                    unsigned int len, unsigned int idx)
-+{
-+    virtqueue_unmap_sg(vq, elem, len);
-     idx = (idx + vring_used_idx(vq)) % vq->vring.num;
- 
-     /* Get a pointer to the next entry in the used ring. */
---- xen-4.5.1/tools/qemu-xen-traditional/hw/virtio.h.orig	2015-06-09 16:32:24.000000000 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/virtio.h	2015-10-10 16:57:53.146216039 +0100
-@@ -105,6 +105,8 @@
- void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
-                     unsigned int len);
- void virtqueue_flush(VirtQueue *vq, unsigned int count);
-+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
-+                       unsigned int len);
- void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
-                     unsigned int len, unsigned int idx);
- 
---- xen-4.5.1/tools/qemu-xen-traditional/hw/virtio-net.c.orig	2015-10-10 16:10:05.071786348 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/hw/virtio-net.c	2015-10-10 19:05:34.510029916 +0100
-@@ -424,11 +424,15 @@
-         len = iov_fill(sg, elem.in_num,
-                        buf + offset, size - offset);
-         total += len;
-+        offset += len;
-+        if (!n->mergeable_rx_bufs && offset < size) {
-+            virtqueue_discard(n->rx_vq, &elem, total);
-+            return;
-+        }
- 
-         /* signal other side */
-         virtqueue_fill(n->rx_vq, &elem, total, i++);
- 
--        offset += len;
-     }
- 
-     if (mhdr)

qemu.trad.CVE-2015-7512.patch

@@ -1,37 +0,0 @@
-From 8b98a2f07175d46c3f7217639bd5e03f2ec56343 Mon Sep 17 00:00:00 2001
-From: Jason Wang <jasowang@redhat.com>
-Date: Mon, 30 Nov 2015 15:00:06 +0800
-Subject: [PATCH] pcnet: fix rx buffer overflow(CVE-2015-7512)
-
-Backends could provide a packet whose length is greater than buffer
-size. Check for this and truncate the packet to avoid rx buffer
-overflow in this case.
-
-Cc: Prasad J Pandit <pjp@fedoraproject.org>
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- tools/qemu-xen-traditional/hw/pcnet.c |    6 ++++++
- 1 files changed, 6 insertions(+), 0 deletions(-)
-
-diff --git a/tools/qemu-xen-traditional/hw/pcnet.c b/tools/qemu-xen-traditional/hw/pcnet.c
-index 309c40b..1f4a3db 100644
---- a/tools/qemu-xen-traditional/hw/pcnet.c
-+++ b/tools/qemu-xen-traditional/hw/pcnet.c
-@@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
-             int pktcount = 0;
- 
-             if (!s->looptest) {
-+                if (size > 4092) {
-+#ifdef PCNET_DEBUG_RMD
-+                    fprintf(stderr, "pcnet: truncates rx packet.\n");
-+#endif
-+                    size = 4092;
-+                }
-                 memcpy(src, buf, size);
-                 /* no need to compute the CRC */
-                 src[size] = 0;
--- 
-1.7.0.4
-

qemu.trad.CVE-2015-8345.patch

@@ -1,38 +0,0 @@
-From 00837731d254908a841d69298a4f9f077babaf24 Mon Sep 17 00:00:00 2001
-From: Stefan Weil <sw@weilnetz.de>
-Date: Fri, 20 Nov 2015 08:42:33 +0100
-Subject: [PATCH] eepro100: Prevent two endless loops
-
-http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html
-shows an example how an endless loop in function action_command can
-be achieved.
-
-During my code review, I noticed a 2nd case which can result in an
-endless loop.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- tools/qemu-xen-traditional/hw/eepro100.c |   16 ++++++++++++++++
- 1 files changed, 16 insertions(+), 0 deletions(-)
-
-diff --git a/tools/qemu-xen-traditional/hw/eepro100.c b/tools/qemu-xen-traditional/hw/eepro100.c
-index 60333b7..685a478 100644
---- a/tools/qemu-xen-traditional/hw/eepro100.c
-+++ b/tools/qemu-xen-traditional/hw/eepro100.c
-@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
-                 uint32_t tx_buffer_address = ldl_phys(tbd_address);
-                 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
-                 //~ uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
-+                if (tx_buffer_size == 0) {
-+                    /* Prevent an endless loop. */
-+                    logout("loop in %s:%u\n", __FILE__, __LINE__);
-+                    break;
-+                }
-                 tbd_address += 8;
-                 logout
-                     ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
--- 
-1.7.0.4
-

qemu.trad.CVE-2015-8504.patch

@@ -1,44 +0,0 @@
-From 4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 3 Dec 2015 18:54:17 +0530
-Subject: [PATCH] ui: vnc: avoid floating point exception
-
-While sending 'SetPixelFormat' messages to a VNC server,
-the client could set the 'red-max', 'green-max' and 'blue-max'
-values to be zero. This leads to a floating point exception in
-write_png_palette while doing frame buffer updates.
-
-Reported-by: Lian Yihan <lianyihan@360.cn>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tools/qemu-xen-traditional/vnc.c |    6 +++---
- 1 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/tools/qemu-xen-traditional/vnc.c b/tools/qemu-xen-traditional/vnc.c
-index 7538405..cbe4d33 100644
---- a/tools/qemu-xen-traditional/vnc.c
-+++ b/tools/qemu-xen-traditional/vnc.c
-@@ -2198,15 +2198,15 @@ static void set_pixel_format(VncState *vs,
-     }
- 
-     vs->clientds = vs->serverds;
--    vs->clientds.pf.rmax = red_max;
-+    vs->clientds.pf.rmax = red_max ? red_max : 0xFF;
-     count_bits(vs->clientds.pf.rbits, red_max);
-     vs->clientds.pf.rshift = red_shift;
-     vs->clientds.pf.rmask = red_max << red_shift;
--    vs->clientds.pf.gmax = green_max;
-+    vs->clientds.pf.gmax = green_max ? green_max : 0xFF;
-     count_bits(vs->clientds.pf.gbits, green_max);
-     vs->clientds.pf.gshift = green_shift;
-     vs->clientds.pf.gmask = green_max << green_shift;
--    vs->clientds.pf.bmax = blue_max;
-+    vs->clientds.pf.bmax = blue_max ? blue_max : 0xFF;
-     count_bits(vs->clientds.pf.bbits, blue_max);
-     vs->clientds.pf.bshift = blue_shift;
-     vs->clientds.pf.bmask = blue_max << blue_shift;
--- 
-1.7.0.4
-

qemu.trad.CVE-2016-1714.patch

@@ -1,30 +0,0 @@
---- xen-4.6.1/tools/qemu-xen-traditional/hw/fw_cfg.c.orig	2016-01-04 15:35:42.000000000 +0000
-+++ xen-4.6.1/tools/qemu-xen-traditional/hw/fw_cfg.c	2016-03-06 16:42:33.464296362 +0000
-@@ -54,11 +54,15 @@
- static void fw_cfg_write(FWCfgState *s, uint8_t value)
- {
-     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
--    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
-+    FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
-+                     &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
- 
-     FW_CFG_DPRINTF("write %d\n", value);
- 
--    if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
-+    if (s->cur_entry & FW_CFG_WRITE_CHANNEL
-+        && e != NULL
-+        && e->callback
-+        && s->cur_offset < e->len) {
-         e->data[s->cur_offset++] = value;
-         if (s->cur_offset == e->len) {
-             e->callback(e->callback_opaque, e->data);
-@@ -88,7 +92,8 @@
- static uint8_t fw_cfg_read(FWCfgState *s)
- {
-     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
--    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
-+    FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
-+                    &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
-     uint8_t ret;
- 
-     if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)

qemu.trad.CVE-2016-1981.patch

@@ -1,104 +0,0 @@
-------------------------------------------------------------------------
-*From*: 	Laszlo Ersek
-*Subject*: 	[Qemu-devel] [PATCH] e1000: eliminate infinite loops on
-out-of-bounds transfer start
-*Date*: 	Tue, 19 Jan 2016 14:17:20 +0100
-
-------------------------------------------------------------------------
-
-The start_xmit() and e1000_receive_iov() functions implement DMA transfers
-iterating over a set of descriptors that the guest's e1000 driver
-prepares:
-
-- the TDLEN and RDLEN registers store the total size of the descriptor
-  area,
-
-- while the TDH and RDH registers store the offset (in whole tx / rx
-  descriptors) into the area where the transfer is supposed to start.
-
-Each time a descriptor is processed, the TDH and RDH register is bumped
-(as appropriate for the transfer direction).
-
-QEMU already contains logic to deal with bogus transfers submitted by the
-guest:
-
-- Normally, the transmit case wants to increase TDH from its initial value
-  to TDT. (TDT is allowed to be numerically smaller than the initial TDH
-  value; wrapping at or above TDLEN bytes to zero is normal.) The failsafe
-  that QEMU currently has here is a check against reaching the original
-  TDH value again -- a complete wraparound, which should never happen.
-
-- In the receive case RDH is increased from its initial value until
-  "total_size" bytes have been received; preferably in a single step, or
-  in "s->rxbuf_size" byte steps, if the latter is smaller. However, null
-  RX descriptors are skipped without receiving data, while RDH is
-  incremented just the same. QEMU tries to prevent an infinite loop
-  (processing only null RX descriptors) by detecting whether RDH assumes
-  its original value during the loop. (Again, wrapping from RDLEN to 0 is
-  normal.)
-
-What both directions miss is that the guest could program TDLEN and RDLEN
-so low, and the initial TDH and RDH so high, that these registers will
-immediately be truncated to zero, and then never reassume their initial
-values in the loop -- a full wraparound will never occur.
-
-The condition that expresses this is:
-
-  xdh_start >= s->mac_reg[XDLEN] / sizeof(desc)
-
-i.e., TDH or RDH start out after the last whole rx or tx descriptor that
-fits into the TDLEN or RDLEN sized area.
-
-This condition could be checked before we enter the loops, but
-pci_dma_read() / pci_dma_write() knows how to fill in buffers safely for
-bogus DMA addresses, so we just extend the existing failsafes with the
-above condition.
-
-Cc: "Michael S. Tsirkin" <address@hidden>
-Cc: Petr Matousek <address@hidden>
-Cc: Stefano Stabellini <address@hidden>
-Cc: Prasad Pandit <address@hidden>
-Cc: Michael Roth <address@hidden>
-Cc: Jason Wang <address@hidden>
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1296044
-Signed-off-by: Laszlo Ersek <address@hidden>
-Reviewed-by: Jason Wang <address@hidden>
----
-
-Notes:
-    Regarding the public posting: we made an honest effort to vet this
-    vulnerability, and the impact seems low -- no host side reads/writes,
-    "just" a DoS (infinite loop). We decided the patch could be posted
-    publicly, for the usual review process. Jason and Prasad checked the
-    patch in the internal discussion already, but comments, improvements
-    etc. are clearly welcome. The CVE request is underway. Thanks.
-
- hw/net/e1000.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index bec06e9..34d0823 100644
---- a/tools/qemu-xen-traditional/hw/e1000.c
-+++ b/tools/qemu-xen-traditional/hw/e1000.c
-@@ -908,7 +908,8 @@ start_xmit(E1000State *s)
-          * bogus values to TDT/TDLEN.
-          * there's nothing too intelligent we could do about this.
-          */
--        if (s->mac_reg[TDH] == tdh_start) {
-+        if (s->mac_reg[TDH] == tdh_start ||
-+            tdh_start >= s->mac_reg[TDLEN] / sizeof(desc)) {
-             DBGOUT(TXERR, "TDH wraparound @%x, TDT %x, TDLEN %x\n",
-                    tdh_start, s->mac_reg[TDT], s->mac_reg[TDLEN]);
-             break;
-@@ -1165,7 +1166,8 @@ e1000_receive_iov(NetClientState *nc, const struct iovec *iov, int iovcnt)
-             s->mac_reg[RDH] = 0;
-         s->check_rxov = 1;
-         /* see comment in start_xmit; same here */
--        if (s->mac_reg[RDH] == rdh_start) {
-+        if (s->mac_reg[RDH] == rdh_start ||
-+            rdh_start >= s->mac_reg[RDLEN] / sizeof(desc)) {
-             DBGOUT(RXERR, "RDH wraparound @%x, RDT %x, RDLEN %x\n",
-                    rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]);
-             set_ics(s, 0, E1000_ICS_RXO);
--- 
-1.8.3.1

qemu.trad.CVE-2016-2538.patch

@@ -1,56 +0,0 @@
-From: Prasad J Pandit <address@hidden>
-
-When processing remote NDIS control message packets,
-the USB Net device emulator uses a fixed length(4096) data buffer.
-The incoming informationBufferOffset & Length combination could
-overflow and cross that range. Check control message buffer
-offsets and length to avoid it.
-
-Reported-by: Qinghao Tang <address@hidden>
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/usb/dev-network.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-Update as per review
-  -> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03475.html
-
-diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
-index 8a4ff49..180adce 100644
---- a/tools/qemu-xen-traditional/hw/usb-net.c
-+++ b/tools/qemu-xen-traditional/hw/usb-net.c
-@@ -915,8 +915,9 @@ static int rndis_query_response(USBNetState *s,
- 
-     bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
-     buflen = le32_to_cpu(buf->InformationBufferLength);
--    if (bufoffs + buflen > length)
-+    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
-         return USB_RET_STALL;
-+    }
- 
-     infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
-                             bufoffs + (uint8_t *) buf, buflen, infobuf,
-@@ -961,8 +962,9 @@ static int rndis_set_response(USBNetState *s,
- 
-     bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
-     buflen = le32_to_cpu(buf->InformationBufferLength);
--    if (bufoffs + buflen > length)
-+    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
-         return USB_RET_STALL;
-+    }
- 
-     ret = ndis_set(s, le32_to_cpu(buf->OID),
-                     bufoffs + (uint8_t *) buf, buflen);
-@@ -1212,8 +1214,9 @@ static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)
-     if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {
-         uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
-         uint32_t size = le32_to_cpu(msg->DataLength);
--        if (offs + size <= len)
-+        if (offs < len && size < len && offs + size <= len) {
-             qemu_send_packet(s->vc, s->out_buf + offs, size);
-+        }
-     }
-     s->out_ptr -= len;
-     memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
--- 
-2.5.0

qemu.trad.CVE-2016-2841.patch

@@ -1,34 +0,0 @@
-From: Prasad J Pandit <address@hidden>
-
-Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
-bytes to process network packets. Registers PSTART & PSTOP
-define ring buffer size & location. Setting these registers
-to invalid values could lead to infinite loop or OOB r/w
-access issues. Add check to avoid it.
-
-Reported-by: Yang Hongke <address@hidden>
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/net/ne2000.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-Update per review:
-  -> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg05522.html
-
-diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
-index b032212..ced4666 100644
---- a/tools/qemu-xen-traditional/hw/ne2000.c
-+++ b/tools/qemu-xen-traditional/hw/ne2000.c
-@@ -154,6 +154,10 @@ static int ne2000_buffer_full(NE2000State *s)
- {
-     int avail, index, boundary;
- 
-+    if (s->stop <= s->start) {
-+        return 1;
-+    }
-+
-     index = s->curpag << 8;
-     boundary = s->boundary << 8;
-     if (index < boundary)
--- 
-2.5.0

qemu.trad.CVE-2016-2857.patch

@@ -1,45 +0,0 @@
-From: Prasad J Pandit <address@hidden>
-
-While computing IP checksum, 'net_checksum_calculate' reads
-payload length from the packet. It could exceed the given 'data'
-buffer size. Add a check to avoid it.
-
-Reported-by: Liu Ling <address@hidden>
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- net/checksum.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-Update as per review:
-  -> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg06121.html
-
-diff --git a/net/checksum.c b/net/checksum.c
-index 14c0855..0942437 100644
---- a/tools/qemu-xen-traditional/net-checksum.c
-+++ b/tools/qemu-xen-traditional/net-checksum.c
-@@ -59,6 +59,11 @@ void net_checksum_calculate(uint8_t *data, int length)
-     int hlen, plen, proto, csum_offset;
-     uint16_t csum;
- 
-+    /* Ensure data has complete L2 & L3 headers. */
-+    if (length < 14 + 20) {
-+        return;
-+    }
-+
-     if ((data[14] & 0xf0) != 0x40)
- 	return; /* not IPv4 */
-     hlen  = (data[14] & 0x0f) * 4;
-@@ -76,8 +81,9 @@ void net_checksum_calculate(uint8_t *data, int length)
- 	return;
-     }
- 
--    if (plen < csum_offset+2)
--	return;
-+    if (plen < csum_offset + 2 || 14 + hlen + plen > length) {
-+        return;
-+    }
- 
-     data[14+hlen+csum_offset]   = 0;
-     data[14+hlen+csum_offset+1] = 0;
--- 
-2.5.0

qemu.trad.CVE-2016-4001.patch

@@ -1,46 +0,0 @@
-From 3a15cc0e1ee7168db0782133d2607a6bfa422d66 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Fri, 8 Apr 2016 11:33:48 +0530
-Subject: [PATCH] net: stellaris_enet: check packet length against receive buffer
-
-When receiving packets over Stellaris ethernet controller, it
-uses receive buffer of size 2048 bytes. In case the controller
-accepts large(MTU) packets, it could lead to memory corruption.
-Add check to avoid it.
-
-Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tools/qemu-xen-traditional/hw/stellaris_enet.c |   12 +++++++++++-
- 1 files changed, 11 insertions(+), 1 deletions(-)
-
-diff --git a/tools/qemu-xen-traditional/hw/stellaris_enet.c b/tools/qemu-xen-traditional/hw/stellaris_enet.c
-index 84cf60b..6880894 100644
---- a/tools/qemu-xen-traditional/hw/stellaris_enet.c
-+++ b/tools/qemu-xen-traditional/hw/stellaris_enet.c
-@@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si
-     n = s->next_packet + s->np;
-     if (n >= 31)
-         n -= 31;
--    s->np++;
- 
-+    if (size >= sizeof(s->rx[n].data) - 6) {
-+        /* If the packet won't fit into the
-+         * emulated 2K RAM, this is reported
-+         * as a FIFO overrun error.
-+         */
-+        s->ris |= SE_INT_FOV;
-+        stellaris_enet_update(s);
-+        return -1;
-+    }
-+
-+    s->np++;
-     s->rx[n].len = size + 6;
-     p = s->rx[n].data;
-     *(p++) = (size + 6);
--- 
-1.7.0.4
-

qemu.trad.CVE-2016-4002.patch

@@ -1,31 +0,0 @@
-From: Prasad J Pandit <address@hidden>
-
-When receiving packets over MIPSnet network device, it uses
- receive buffer of size 1514 bytes. In case the controller
-accepts large(MTU) packets, it could lead to memory corruption.
-Add check to avoid it.
-
-Reported by: Oleksandr Bazhaniuk <address@hidden>
-
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- tools/qemu-xen-traditional/hw/mipsnet.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tools/qemu-xen-traditional/hw/mipsnet.c b/tools/qemu-xen-traditional/hw/mipsnet.c
-index f261011..e134b31 100644
---- a/tools/qemu-xen-traditional/hw/mipsnet.c
-+++ b/tools/qemu-xen-traditional/hw/mipsnet.c
-@@ -82,6 +82,9 @@ static ssize_t mipsnet_receive(NetClientState *nc, const uint8_t *buf, size_t si
-     if (!mipsnet_can_receive(opaque))
-         return;
- 
-+    if (size >= sizeof(s->rx_buffer)) {
-+        return;
-+    }
-     s->busy = 1;
- 
-     /* Just accept everything. */
--- 
-2.5.5
-

qemu.trad.CVE-2016-4439.patch

@@ -1,44 +0,0 @@
-------------------------------------------------------------------------
-*From*: 	P J P
-*Subject*: 	[Qemu-devel] [PATCH 1/2] scsi: check command buffer length
-before write(CVE-2016-4439)
-*Date*: 	Thu, 19 May 2016 16:09:30 +0530
-
-------------------------------------------------------------------------
-
-From: Prasad J Pandit <address@hidden>
-
-The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
-FIFO buffer. It is used to handle command and data transfer. While
-writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
-was missing to validate input length. Add check to avoid OOB write
-access.
-
-Fixes CVE-2016-4439
-Reported-by: Li Qiang <address@hidden>
-
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/scsi/esp.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/tools/qemu-xen-traditional/hw/esp.c b/tools/qemu-xen-traditional/hw/esp.c
-index 8961be2..01497e6 100644
---- a/tools/qemu-xen-traditional/hw/esp.c
-+++ b/tools/qemu-xen-traditional/hw/esp.c
-@@ -448,7 +448,11 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
-         break;
-     case ESP_FIFO:
-         if (s->do_cmd) {
--            s->cmdbuf[s->cmdlen++] = val & 0xff;
-+            if (s->cmdlen < TI_BUFSZ) {
-+                s->cmdbuf[s->cmdlen++] = val & 0xff;
-+            } else {
-+                ESP_ERROR("fifo overrun\n");
-+            }
-         } else if (s->ti_size == TI_BUFSZ - 1) {
-             ESP_ERROR("fifo overrun\n");
-         } else {
--- 
-2.5.5
-

qemu.trad.CVE-2016-4441.patch

@@ -1,68 +0,0 @@
-------------------------------------------------------------------------
-*From*: 	P J P
-*Subject*: 	[Qemu-devel] [PATCH 2/2] scsi: check dma length before
-reading scsi command(CVE-2016-4441)
-*Date*: 	Thu, 19 May 2016 16:09:31 +0530
-
-------------------------------------------------------------------------
-
-From: Prasad J Pandit <address@hidden>
-
-The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
-FIFO buffer. It is used to handle command and data transfer.
-Routine get_cmd() uses DMA to read scsi commands into this buffer.
-Add check to validate DMA length against buffer size to avoid any
-overrun.
-
-Fixes CVE-2016-4441
-Reported-by: Li Qiang <address@hidden>
-
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/scsi/esp.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/tools/qemu-xen-traditional/hw/esp.c b/tools/qemu-xen-traditional/hw/esp.c
-index 01497e6..591c817 100644
---- a/tools/qemu-xen-traditional/hw/esp.c
-+++ b/tools/qemu-xen-traditional/hw/esp.c
-@@ -82,7 +82,7 @@ void esp_request_cancelled(SCSIRequest *req)
-     }
- }
- 
--static uint32_t get_cmd(ESPState *s, uint8_t *buf)
-+static uint32_t get_cmd(ESPState *s, uint8_t *buf, uint8_t buflen)
- {
-     uint32_t dmalen;
-     int target;
-@@ -92,6 +92,9 @@ static uint32_t get_cmd(ESPState *s, uint8_t *buf)
-     target = s->wregs[ESP_WBUSID] & BUSID_DID;
-     if (s->dma) {
-         dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);
-+        if (dmalen > buflen) {
-+            return 0;
-+        }
-         s->dma_memory_read(s->dma_opaque, buf, dmalen);
-     } else {
-         dmalen = s->ti_size;
-@@ -166,7 +169,7 @@ static void handle_satn(ESPState *s)
-     uint8_t buf[32];
-     int len;
- 
--    len = get_cmd(s, buf);
-+    len = get_cmd(s, buf, sizeof(buf));
-     if (len)
-         do_cmd(s, buf);
- }
-@@ -192,7 +195,7 @@ static void handle_satn_stop(ESPState *s)
- 
- static void handle_satn_stop(ESPState *s)
- {
--    s->cmdlen = get_cmd(s, s->cmdbuf);
-+    s->cmdlen = get_cmd(s, s->cmdbuf, sizeof(s->cmdbuf));
-     if (s->cmdlen) {
-         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
-         s->do_cmd = 1;
--- 
-2.5.5
-

qemu.trad.CVE-2016-5238.patch

@@ -1,65 +0,0 @@
-------------------------------------------------------------------------
-*From*: 	Paolo Bonzini
-*Subject*: 	Re: [Qemu-devel] [PATCH] scsi: check buffer length before
-reading scsi command
-*Date*: 	Wed, 1 Jun 2016 15:10:16 +0200
-*User-agent*: 	Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
-Thunderbird/45.1.0
-
-------------------------------------------------------------------------
-
-
-On 31/05/2016 19:53, P J P wrote:
->/ From: Prasad J Pandit <address@hidden>/
->/ /
->/ The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte/
->/ FIFO buffer. It is used to handle command and data transfer./
->/ Routine get_cmd() in non-DMA mode, uses 'ti_size' to read scsi/
->/ command into a buffer. Add check to validate command length against/
->/ buffer size to avoid any overrun./
->/ /
->/ Reported-by: Li Qiang <address@hidden>/
->/ Signed-off-by: Prasad J Pandit <address@hidden>/
->/ ---/
->/  hw/scsi/esp.c | 3 +++/
->/  1 file changed, 3 insertions(+)/
->/ /
->/ diff --git a/tools/qemu-xen-traditional/hw/esp.c b/tools/qemu-xen-traditional/hw/esp.c/
->/ index 60c1b28..953027a 100644/
->/ --- a/tools/qemu-xen-traditional/hw/esp.c/
->/ +++ b/tools/qemu-xen-traditional/hw/esp.c/
->/ @@ -98,6 +98,9 @@ static uint32_t get_cmd(ESPState *s, uint8_t *buf, uint8_t /
->/ buflen)/
->/          s->dma_memory_read(s->dma_opaque, buf, dmalen);/
->/      } else {/
->/          dmalen = s->ti_size;/
->/ +        if (dmalen > TI_BUFSZ) {/
->/ +            return 0;/
->/ +        }/
->/          memcpy(buf, s->ti_buf, dmalen);/
->/          buf[0] = buf[2] >> 5;/
->/      }/
->/ /
-
-In theory this shouldn't happen, but I agree that it is better to be
-defensive.  I'm queuing this patch.
-
-At least the following patch is needed to ensure that ti_size always
-matches ti_rptr/ti_wptr (Hervé, what do you think about it? should I
-resubmit it formally?).  Also, things are more complicated than
-necessary due to ti_size being used for both DMA and FIFO transfers.
-
-diff --git a/tools/qemu-xen-traditional/hw/esp.c b/tools/qemu-xen-traditional/hw/esp.c
-index c2f6f8f..6407844 100644
---- a/tools/qemu-xen-traditional/hw/esp.c
-+++ b/tools/qemu-xen-traditional/hw/esp.c
-@@ -222,7 +222,7 @@ static void write_response(ESPState *s)
-     } else {
-         s->ti_size = 2;
-         s->ti_rptr = 0;
--        s->ti_wptr = 0;
-+        s->ti_wptr = 2;
-         s->rregs[ESP_RFLAGS] = 2;
-     }
-     esp_raise_irq(s);
-

qemu.trad.CVE-2016-5338.patch

@@ -1,76 +0,0 @@
-------------------------------------------------------------------------
-*From*: 	P J P
-*Subject*: 	[Qemu-devel] [PATCH v3] scsi: esp: check TI buffer index
-before read/write
-*Date*: 	Mon, 6 Jun 2016 22:04:43 +0530
-
-------------------------------------------------------------------------
-
-From: Prasad J Pandit <address@hidden>
-
-The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte
-FIFO buffers. One is used to handle commands and other is for
-information transfer. Three control variables 'ti_rptr',
-'ti_wptr' and 'ti_size' are used to control r/w access to the
-information transfer buffer ti_buf[TI_BUFSZ=16]. In that,
-
-'ti_rptr' is used as read index, where read occurs.
-'ti_wptr' is a write index, where write would occur.
-'ti_size' indicates total bytes to be read from the buffer.
-
-While reading/writing to this buffer, index could exceed its
-size. Add check to avoid OOB r/w access.
-
-Reported-by: Huawei PSIRT <address@hidden>
-Reported-by: Li Qiang <address@hidden>
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/scsi/esp.c | 20 +++++++++-----------
- 1 file changed, 9 insertions(+), 11 deletions(-)
-
-Update as per:
-  -> https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01326.html
-
-diff --git a/tools/qemu-xen-traditional/hw/esp.c b/tools/qemu-xen-traditional/hw/esp.c
-index c2f6f8f..4b94bbc 100644
---- a/tools/qemu-xen-traditional/hw/esp.c
-+++ b/tools/qemu-xen-traditional/hw/esp.c
-@@ -403,18 +403,17 @@ uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
-     DPRINTF("read reg[%d]: 0x%2.2x\n", saddr, s->rregs[saddr]);
-     switch (saddr) {
-     case ESP_FIFO:
--        if (s->ti_size > 0) {
-+        if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
-+            /* Data out.  */
-+            ESP_ERROR("PIO data read not implemented\n");
-+            s->rregs[ESP_FIFO] = 0;
-+            esp_raise_irq(s);
-+        } else if (s->ti_rptr < s->ti_wptr) {
-             s->ti_size--;
--            if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
--                /* Data out.  */
--                ESP_ERROR("PIO data read not implemented\n");
--                s->rregs[ESP_FIFO] = 0;
--            } else {
--                s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
--            }
-+            s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
-             esp_raise_irq(s);
-         }
--        if (s->ti_size == 0) {
-+        if (s->ti_rptr == s->ti_wptr) {
-             s->ti_rptr = 0;
-             s->ti_wptr = 0;
-         }
-@@ -459,7 +457,7 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
-             } else {
-                 ESP_ERROR("fifo overrun\n");
-             }
--        } else if (s->ti_size == TI_BUFSZ - 1) {
-+        } else if (s->ti_wptr == TI_BUFSZ - 1) {
-             ESP_ERROR("fifo overrun\n");
-         } else {
-             s->ti_size++;
--- 
-2.5.5
-

qemu.trad.CVE-2016-6351.patch

@@ -1,81 +0,0 @@
-From 926cde5f3e4d2504ed161ed0cb771ac7cad6fd11 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 16 Jun 2016 00:22:35 +0200
-Subject: [PATCH] scsi: esp: make cmdbuf big enough for maximum CDB size
-
-While doing DMA read into ESP command buffer 's->cmdbuf', it could
-write past the 's->cmdbuf' area, if it was transferring more than 16
-bytes.  Increase the command buffer size to 32, which is maximum when
-'s->do_cmd' is set, and add a check on 'len' to avoid OOB access.
-
-Reported-by: Li Qiang <liqiang6-s@360.cn>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/esp.c         |    6 ++++--
- hw/esp.c |    3 ++-
- 2 files changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/hw/esp.c b/hw/esp.c
-index 64680b3..baa0a2c 100644
---- a/hw/esp.c
-+++ b/hw/esp.c
-@@ -25,6 +25,7 @@
- #include "hw.h"
- #include "scsi-disk.h"
- #include "scsi.h"
-+#include <assert.h>
- 
- /* debug ESP card */
- //#define DEBUG_ESP
-@@ -248,6 +248,8 @@ static void esp_do_dma(ESPState *s)
-     len = s->dma_left;
-     if (s->do_cmd) {
-         DPRINTF("command len %d + %d\n", s->cmdlen, len);
-+        assert (s->cmdlen <= sizeof(s->cmdbuf) &&
-+                len <= sizeof(s->cmdbuf) - s->cmdlen);
-         s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
-         s->ti_size = 0;
-         s->cmdlen = 0;
-@@ -345,7 +347,7 @@ static void handle_ti(ESPState *s)
-     s->dma_counter = dmalen;
- 
-     if (s->do_cmd)
--        minlen = (dmalen < 32) ? dmalen : 32;
-+        minlen = (dmalen < ESP_CMDBUF_SZ) ? dmalen : ESP_CMDBUF_SZ;
-     else if (s->ti_size < 0)
-         minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
-     else
-@@ -449,7 +451,7 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
-         break;
-     case ESP_FIFO:
-         if (s->do_cmd) {
--            if (s->cmdlen < TI_BUFSZ) {
-+            if (s->cmdlen < ESP_CMDBUF_SZ) {
-                 s->cmdbuf[s->cmdlen++] = val & 0xff;
-             } else {
-                 ESP_ERROR("fifo overrun\n");
-diff --git a/hw/esp.c b/hw/esp.c
-index 6c79527..d2c4886 100644
---- a/hw/esp.c
-+++ b/hw/esp.c
-@@ -14,6 +14,7 @@ void esp_init(hwaddr espaddr, int it_shift,
- 
- #define ESP_REGS 16
- #define TI_BUFSZ 16
-+#define ESP_CMDBUF_SZ 32
- 
- typedef struct ESPState ESPState;
- 
-@@ -31,7 +32,7 @@ struct ESPState {
-     uint32_t dma;
-     SCSIDevice *scsi_dev[ESP_MAX_DEVS];
-     SCSIDevice *current_dev;
--    uint8_t cmdbuf[TI_BUFSZ];
-+    uint8_t cmdbuf[ESP_CMDBUF_SZ];
-     uint32_t cmdlen;
-     uint32_t do_cmd;
- 
--- 
-1.7.0.4
-

qemu.trad.CVE-2016-8669.patch

@@ -1,37 +0,0 @@
-From 3592fe0c919cf27a81d8e9f9b4f269553418bb01 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 12 Oct 2016 11:28:08 +0530
-Subject: [PATCH] char: serial: check divider value against baud base
-
-16550A UART device uses an oscillator to generate frequencies
-(baud base), which decide communication speed. This speed could
-be changed by dividing it by a divider. If the divider is
-greater than the baud base, speed is set to zero, leading to a
-divide by zero error. Add check to avoid it.
-
-Reported-by: Huawei PSIRT <psirt@huawei.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-Id: <1476251888-20238-1-git-send-email-ppandit@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/char/serial.c |    3 ++-
- 1 files changed, 2 insertions(+), 1 deletions(-)
-
-diff --git a/hw/serial.c b/hw/serial.c
-index 3442f47..eec72b7 100644
---- a/hw/serial.c
-+++ b/hw/serial.c
-@@ -153,8 +153,9 @@ static void serial_update_parameters(SerialState *s)
-     int speed, parity, data_bits, stop_bits, frame_size;
-     QEMUSerialSetParams ssp;
- 
--    if (s->divider == 0)
-+    if (s->divider == 0 || s->divider > s->baudbase) {
-         return;
-+    }
- 
-     frame_size = 1;
-     if (s->lcr & 0x08) {
--- 
-1.7.0.4
-

qemu.trad.CVE-2016-8910.patch

@@ -1,29 +0,0 @@
-From: Prasad J Pandit <address@hidden>
-
-RTL8139 ethernet controller in C+ mode supports multiple
-descriptor rings, each with maximum of 64 descriptors. While
-processing transmit descriptor ring in 'rtl8139_cplus_transmit',
-it does not limit the descriptor count and runs forever. Add
-check to avoid it.
-
-Reported-by: Andrew Henderson <address@hidden>
-Signed-off-by: Prasad J Pandit <address@hidden>
----
- hw/net/rtl8139.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/rtl8139.c b/hw/rtl8139.c
-index 3345bc6..f05e59c 100644
---- a/hw/rtl8139.c
-+++ b/hw/rtl8139.c
-@@ -2350,7 +2350,7 @@ static void rtl8139_cplus_transmit(RTL8139State *s)
- {
-     int txcount = 0;
- 
--    while (rtl8139_cplus_transmit_one(s))
-+    while (txcount < 64 && rtl8139_cplus_transmit_one(s))
-     {
-         ++txcount;
-     }
--- 
-2.7.4

qemu.trad.CVE-2016-9776.patch

@@ -1,34 +0,0 @@
-From 77d54985b85a0cb760330ec2bd92505e0a2a97a9 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Tue, 29 Nov 2016 00:38:39 +0530
-Subject: [PATCH] net: mcf: check receive buffer size register value
-
-ColdFire Fast Ethernet Controller uses a receive buffer size
-register(EMRBR) to hold maximum size of all receive buffers.
-It is set by a user before any operation. If it was set to be
-zero, ColdFire emulator would go into an infinite loop while
-receiving data in mcf_fec_receive. Add check to avoid it.
-
-Reported-by: Wjjzhang <wjjzhang@tencent.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/mcf_fec.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
-index dc61bac..4025eb3 100644
---- a/hw/mcf_fec.c
-+++ b/hw/mcf_fec.c
-@@ -393,7 +393,7 @@ static void mcf_fec_write(void *opaque, hwaddr addr,
-         s->tx_descriptor = s->etdsr;
-         break;
-     case 0x188:
--        s->emrbr = value & 0x7f0;
-+        s->emrbr = value > 0 ? value & 0x7F0 : 0x7F0;
-         break;
-     default:
-         cpu_abort(cpu_single_env, "mcf_fec_write Bad address 0x%x\n",
--- 
-1.7.0.4
-

qemu.trad.CVE-2017-6505.patch

@@ -1,51 +0,0 @@
-From 95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb Mon Sep 17 00:00:00 2001
-From: Li Qiang <liqiang6-s@360.cn>
-Date: Tue, 7 Feb 2017 02:23:33 -0800
-Subject: [PATCH] usb: ohci: limit the number of link eds
-
-The guest may builds an infinite loop with link eds. This patch
-limit the number of linked ed to avoid this.
-
-Signed-off-by: Li Qiang <liqiang6-s@360.cn>
-Message-id: 5899a02e.45ca240a.6c373.93c1@mx.google.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/usb-ohci.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
-index 2cba3e3..21c93e0 100644
---- a/hw/usb-ohci.c
-+++ b/hw/usb-ohci.c
-@@ -42,6 +42,8 @@
- 
- #define OHCI_MAX_PORTS 15
- 
-+#define ED_LINK_LIMIT 4
-+
- static int64_t usb_frame_time;
- static int64_t usb_bit_time;
- 
-@@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
-     uint32_t next_ed;
-     uint32_t cur;
-     int active;
--
-+    uint32_t link_cnt = 0;
-     active = 0;
- 
-     if (head == 0)
-@@ -1199,6 +1201,10 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
- 
-         next_ed = ed.next & OHCI_DPTR_MASK;
- 
-+        if (++link_cnt > ED_LINK_LIMIT) {
-+            return 0;
-+        }
-+
-         if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
-             uint32_t addr;
-             /* Cancel pending packets for ED that have been paused.  */
--- 
-1.8.3.1
-

qemu.trad.CVE-2017-7718.patch

@@ -1,51 +0,0 @@
-From 215902d7b6fb50c6fc216fc74f770858278ed904 Mon Sep 17 00:00:00 2001
-From: hangaohuai <hangaohuai@huawei.com>
-Date: Tue, 14 Mar 2017 14:39:19 +0800
-Subject: [PATCH] fix :cirrus_vga fix OOB read case qemu Segmentation fault
-
-check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx
-and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault.
-
-After the fix, we will touch the assert in
-cirrus_invalidate_region:
-assert(off_cur_end >= off_cur);
-
-Signed-off-by: fangying <fangying1@huawei.com>
-Signed-off-by: hangaohuai <hangaohuai@huawei.com>
-Message-id: 20170314063919.16200-1-hangaohuai@huawei.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/cirrus_vga_rop.h | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/hw/cirrus_vga_rop.h b/hw/cirrus_vga_rop.h
-index 0925a00..b7447f8 100644
---- a/hw/cirrus_vga_rop.h
-+++ b/hw/cirrus_vga_rop.h
-@@ -97,6 +97,11 @@ glue(glue(cirrus_bitblt_rop_fwd_transp_, ROP_NAME),_8)(CirrusVGAState *s,
-     src = src_ - src_base;
-     dstpitch -= bltwidth;
-     srcpitch -= bltwidth;
-+
-+    if (bltheight > 1 && (dstpitch < 0 || srcpitch < 0)) {
-+        return;
-+    }
-+
-     for (y = 0; y < bltheight; y++) {
-         for (x = 0; x < bltwidth; x++) {
- 	    p = *(dst_base + m(dst));
-@@ -143,6 +148,11 @@ glue(glue(cirrus_bitblt_rop_fwd_transp_, ROP_NAME),_16)(CirrusVGAState *s,
-     src = src_ - src_base;
-     dstpitch -= bltwidth;
-     srcpitch -= bltwidth;
-+
-+    if (bltheight > 1 && (dstpitch < 0 || srcpitch < 0)) {
-+        return;
-+    }
-+
-     for (y = 0; y < bltheight; y++) {
-         for (x = 0; x < bltwidth; x+=2) {
- 	    p1 = *(dst_base + m(dst));
--- 
-1.8.3.1
-

qemu.trad.CVE-2017-8309.patch

@@ -1,38 +0,0 @@
-From 3268a845f41253fb55852a8429c32b50f36f349a Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 28 Apr 2017 09:56:12 +0200
-Subject: [PATCH] audio: release capture buffers
-
-AUD_add_capture() allocates two buffers which are never released.
-Add the missing calls to AUD_del_capture().
-
-Impact: Allows vnc clients to exhaust host memory by repeatedly
-starting and stopping audio capture.
-
-Fixes: CVE-2017-8309
-Cc: P J P <ppandit@redhat.com>
-Cc: Huawei PSIRT <PSIRT@huawei.com>
-Reported-by: "Jiangxin (hunter, SCC)" <jiangxin1@huawei.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 20170428075612.9997-1-kraxel@redhat.com
----
- audio/audio.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/audio/audio.c b/audio/audio.c
-index c8898d8..beafed2 100644
---- a/audio/audio.c
-+++ b/audio/audio.c
-@@ -2028,6 +2028,8 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
-                     sw = sw1;
-                 }
-                 LIST_REMOVE (cap, entries);
-+                qemu_free (cap->hw.mix_buf);
-+                qemu_free (cap->buf);
-                 qemu_free (cap);
-             }
-             return;
--- 
-1.8.3.1
-

qemu.trad.CVE-2017-9330.patch

@@ -1,31 +0,0 @@
-From 26f670a244982335cc08943fb1ec099a2c81e42d Mon Sep 17 00:00:00 2001
-From: Li Qiang <liqiang6-s@360.cn>
-Date: Tue, 7 Feb 2017 03:15:03 -0800
-Subject: [PATCH] usb: ohci: fix error return code in servicing iso td
-
-It should return 1 if an error occurs when reading iso td.
-This will avoid an infinite loop issue in ohci_service_ed_list.
-
-Signed-off-by: Li Qiang <liqiang6-s@360.cn>
-Message-id: 5899ac3e.1033240a.944d5.9a2d@mx.google.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/usb-ohci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
-index c82a92f..2cba3e3 100644
---- a/hw/usb-ohci.c
-+++ b/hw/usb-ohci.c
-@@ -725,7 +725,7 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
- 
-     if (!ohci_read_iso_td(addr, &iso_td)) {
-         printf("usb-ohci: ISO_TD read error at %x\n", addr);
--        return 0;
-+        return 1;
-     }
- 
-     starting_frame = OHCI_BM(iso_td.flags, TD_SF);
--- 
-1.8.3.1
-

qemu.trad.bug1399055.patch

@@ -1,76 +0,0 @@
-From 4299b90e9ba9ce5ca9024572804ba751aa1a7e70 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Tue, 18 Oct 2016 13:15:17 +0530
-Subject: [PATCH] display: cirrus: check vga bits per pixel(bpp) value
-
-In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA,
-'cirrus_get_bpp' returns zero(0), which could lead to a divide
-by zero error in while copying pixel data. The same could occur
-via blit pitch values. Add check to avoid it.
-
-Reported-by: Huawei PSIRT <psirt@huawei.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/cirrus_vga.c |   14 ++++++++++----
- 1 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
-index 3d712d5..bdb092e 100644
---- a/hw/cirrus_vga.c
-+++ b/hw/cirrus_vga.c
-@@ -272,6 +272,9 @@ static void cirrus_update_memory_access(CirrusVGAState *s);
- static bool blit_region_is_unsafe(struct CirrusVGAState *s,
-                                   int32_t pitch, int32_t addr)
- {
-+    if (!pitch) {
-+        return true;
-+    }
-     if (pitch < 0) {
-         int64_t min = addr
-             + ((int64_t)s->cirrus_blt_height - 1) * pitch
-@@ -715,7 +718,7 @@ static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
-                                             s->cirrus_addr_mask));
- }
- 
--static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-+static int cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- {
-     int sx = 0, sy = 0;
-     int dx = 0, dy = 0;
-@@ -729,6 +732,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-         int width, height;
- 
-         depth = s->get_bpp((VGAState *)s) / 8;
-+        if (!depth) {
-+            return 0;
-+        }
-         s->get_resolution((VGAState *)s, &width, &height);
- 
-         /* extra x, y */
-@@ -783,6 +789,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
- 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
- 				s->cirrus_blt_height);
-+
-+    return 1;
- }
- 
- static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
-@@ -790,11 +798,9 @@ static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
-     if (blit_is_unsafe(s))
-         return 0;
- 
--    cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
-+    return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
-             s->cirrus_blt_srcaddr - s->start_addr,
-             s->cirrus_blt_width, s->cirrus_blt_height);
--
--    return 1;
- }
- 
- /***************************************
--- 
-1.7.0.4
-

sources

@@ -4,4 +4,5 @@ SHA512 (newlib-1.16.0.tar.gz) = 40eb96bbc6736a16b6399e0cdb73e853d0d90b685c967e77
 SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
-SHA512 (xen-4.12.1.tar.gz) = be15d3af6b109771aaf59b3621e4e1560b7d9a963d9b7f6a1f6f4a1c907fd97434b060c15f75849b44fbda33f26eb51b030d14d068c6ad5103ad240fe7a98f40
+SHA512 (mini-os-4.21.0.tar.xz) = 7543774d15da84476d93d04154990923c82209cb3fa125574c0383652c5a310957200f54b63b34502161f9c3afce4907e0060d9036f3eaf3a7cb6b1b3119b546
+SHA512 (xen-4.21.1.tar.xz) = 8dfe65255e202b3dacf9d0d7265636bc1f97627c11b08babc13a5b8e74c7c65e7e2c6a1513e28b3c713fe512edb6702a73b2bf667e2a8f2ce825b196a2cd5aab

xen-net-disable-iptables-on-bridge.patch

@@ -1,27 +0,0 @@
---- xen-4.1.0-orig/tools/hotplug/Linux/vif-bridge	2008-08-22 10:49:07.000000000 +0100
-+++ xen-4.1.0-new/tools/hotplug/Linux/vif-bridge	2008-08-29 11:29:38.000000000 +0100
-@@ -96,8 +96,6 @@ case "$command" in
-         ;;
- esac
- 
--handle_iptable
--
- call_hooks vif post
- 
- log debug "Successful vif-bridge $command for $dev, bridge $bridge."
---- xen-3.3.0-orig/tools/hotplug/Linux/xen-network-common.sh	2008-08-22 10:49:07.000000000 +0100
-+++ xen-3.3.0-new/tools/hotplug/Linux/xen-network-common.sh	2008-08-29 11:29:38.000000000 +0100
-@@ -99,6 +99,13 @@ create_bridge () {
- 	brctl addbr ${bridge}
- 	brctl stp ${bridge} off
- 	brctl setfd ${bridge} 0
-+	# Setting these to zero stops guest<->LAN traffic
-+	# traversing the bridge from hitting the *tables
-+	# rulesets. guest<->host traffic still gets processed
-+	# by the host's iptables rules so this isn't a hole
-+	sysctl -q -w "net.bridge.bridge-nf-call-arptables=0"
-+	sysctl -q -w "net.bridge.bridge-nf-call-ip6tables=0"
-+	sysctl -q -w "net.bridge.bridge-nf-call-iptables=0"
-     fi
- }
- 

xen.canonicalize.patch

@@ -1,56 +1,54 @@
---- xen-4.9.0-rc1.2/tools/xenstore/xenstored_watch.c.orig	2017-04-12 16:18:57.000000000 +0100
-+++ xen-4.9.0-rc1.2/tools/xenstore/xenstored_watch.c	2017-04-13 21:17:12.255231094 +0100
-@@ -166,7 +166,7 @@
- 		/* check if valid event */
- 	} else {
- 		relative = !strstarts(vec[0], "/");
--		vec[0] = canonicalize(conn, in, vec[0]);
-+		vec[0] = xenstore_canonicalize(conn, in, vec[0]);
- 		if (!vec[0])
- 			return ENOMEM;
- 		if (!is_valid_nodename(vec[0]))
-@@ -219,7 +219,7 @@
+--- xen-4.18.0-rc1/tools/xenstored/watch.c.orig	2023-09-29 09:09:29.000000000 +0100
++++ xen-4.18.0-rc1/tools/xenstored/watch.c	2023-10-02 16:12:14.971264769 +0100
+@@ -164,7 +164,7 @@
+ 			    const char **path, bool *relative)
+ {
+ 	*relative = !strstarts(*path, "/") && !strstarts(*path, "@");
+-	*path = canonicalize(conn, ctx, *path, true);
++	*path = xenstore_canonicalize(conn, ctx, *path, true);
+ 
+ 	return *path ? 0 : errno;
+ }
+@@ -250,7 +250,7 @@
  	if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
  		return EINVAL;
  
--	node = canonicalize(conn, in, vec[0]);
-+	node = xenstore_canonicalize(conn, in, vec[0]);
+-	node = canonicalize(conn, ctx, vec[0], true);
++	node = xenstore_canonicalize(conn, ctx, vec[0], true);
  	if (!node)
- 		return ENOMEM;
+ 		return errno;
  	list_for_each_entry(watch, &conn->watches, list) {
---- xen-4.9.0-rc1.2/tools/xenstore/xenstored_core.c.orig	2017-04-12 16:18:57.000000000 +0100
-+++ xen-4.9.0-rc1.2/tools/xenstore/xenstored_core.c	2017-04-13 21:19:35.668429881 +0100
-@@ -777,7 +777,7 @@
+--- xen-4.18.0-rc1/tools/xenstored/core.c.orig	2023-09-29 09:09:29.000000000 +0100
++++ xen-4.18.0-rc1/tools/xenstored/core.c	2023-10-02 16:12:14.993264626 +0100
+@@ -1249,7 +1249,7 @@
  	return strings;
  }
  
--char *canonicalize(struct connection *conn, const void *ctx, const char *node)
-+char *xenstore_canonicalize(struct connection *conn, const void *ctx, const char *node)
+-const char *canonicalize(struct connection *conn, const void *ctx,
++const char *xenstore_canonicalize(struct connection *conn, const void *ctx,
+ 			 const char *node, bool allow_special)
  {
- 	const char *prefix;
+ 	const char *name;
+@@ -1303,7 +1303,7 @@
+ {
+ 	struct node *node;
  
-@@ -799,7 +799,7 @@
+-	*canonical_name = canonicalize(conn, ctx, name, allow_special);
++	*canonical_name = xenstore_canonicalize(conn, ctx, name, allow_special);
+ 	if (!*canonical_name)
+ 		return NULL;
  
- 	if (!canonical_name)
- 		canonical_name = &tmp_name;
--	*canonical_name = canonicalize(conn, ctx, name);
-+	*canonical_name = xenstore_canonicalize(conn, ctx, name);
- 	return get_node(conn, ctx, *canonical_name, perm);
- }
+@@ -1320,7 +1320,7 @@
+ 	const char *tmp_name;
+ 	const struct node *node;
  
---- xen-4.9.0-rc1.2/tools/xenstore/xenstored_core.h.orig	2017-04-12 16:18:57.000000000 +0100
-+++ xen-4.9.0-rc1.2/tools/xenstore/xenstored_core.h	2017-04-13 21:20:29.146368478 +0100
-@@ -148,7 +148,7 @@
- void send_ack(struct connection *conn, enum xsd_sockmsg_type type);
+-	tmp_name = canonicalize(conn, ctx, name, allow_special);
++	tmp_name = xenstore_canonicalize(conn, ctx, name, allow_special);
+ 	if (!tmp_name)
+ 		return NULL;
  
- /* Canonicalize this path if possible. */
--char *canonicalize(struct connection *conn, const void *ctx, const char *node);
-+char *xenstore_canonicalize(struct connection *conn, const void *ctx, const char *node);
- 
- /* Write a node to the tdb data base. */
- int write_node_raw(struct connection *conn, TDB_DATA *key, struct node *node);
---- xen-4.8.0/tools/console/testsuite/console-dom0.c.orig	2016-12-05 12:03:27.000000000 +0000
-+++ xen-4.8.0/tools/console/testsuite/console-dom0.c	2017-02-26 21:52:24.554678631 +0000
+--- xen-4.18.0-rc1/tools/console/testsuite/console-dom0.c.orig	2023-09-29 09:09:29.000000000 +0100
++++ xen-4.18.0-rc1/tools/console/testsuite/console-dom0.c	2023-10-02 16:12:15.001264574 +0100
 @@ -18,7 +18,7 @@
  	}
  }
@@ -87,8 +85,8 @@
  			fprintf(stderr, "%s", line);
  		} while (strcmp(line, "Okay.\n") != 0);
  
---- xen-4.8.0/tools/console/testsuite/console-domU.c.orig	2016-12-05 12:03:27.000000000 +0000
-+++ xen-4.8.0/tools/console/testsuite/console-domU.c	2017-02-26 21:52:50.320622804 +0000
+--- xen-4.18.0-rc1/tools/console/testsuite/console-domU.c.orig	2023-09-29 09:09:29.000000000 +0100
++++ xen-4.18.0-rc1/tools/console/testsuite/console-domU.c	2023-10-02 16:12:15.008264528 +0100
 @@ -6,7 +6,7 @@
  #include <termios.h>
  #include <unistd.h>
@@ -107,3 +105,14 @@
  	seed = strtoul(line, 0, 0);
  
  	printf("Seed Okay.\n"); fflush(stdout);
+--- xen-4.18.0-rc1/tools/xenstored/core.h.orig	2023-09-29 09:09:29.000000000 +0100
++++ xen-4.18.0-rc1/tools/xenstored/core.h	2023-10-02 16:12:15.015264482 +0100
+@@ -240,7 +240,7 @@
+ void send_ack(struct connection *conn, enum xsd_sockmsg_type type);
+ 
+ /* Canonicalize this path if possible. */
+-const char *canonicalize(struct connection *conn, const void *ctx,
++const char *xenstore_canonicalize(struct connection *conn, const void *ctx,
+ 			 const char *node, bool allow_special);
+ 
+ /* Get access permissions. */

xen.drop.brctl.patch

@@ -1,100 +0,0 @@
---- xen-4.11.0-rc7/tools/hotplug/Linux/colo-proxy-setup.orig	2018-06-28 08:39:45.000000000 +0100
-+++ xen-4.11.0-rc7/tools/hotplug/Linux/colo-proxy-setup	2018-07-03 20:09:26.637017216 +0100
-@@ -76,10 +76,10 @@
- 
- function setup_secondary()
- {
--    do_without_error brctl delif $bridge $vifname
--    do_without_error brctl addbr $forwardbr
--    do_without_error brctl addif $forwardbr $vifname
--    do_without_error brctl addif $forwardbr $forwarddev
-+    do_without_error ip link set $vifname nomaster
-+    do_without_error ip link add name $forwardbr type bridge
-+    do_without_error ip link set $vifname master $forwardbr
-+    do_without_error ip link set $forwarddev master $forwardbr
-     do_without_error ip link set dev $forwardbr up
-     do_without_error modprobe xt_SECCOLO
- 
-@@ -91,10 +91,10 @@
- 
- function teardown_secondary()
- {
--    do_without_error brctl delif $forwardbr $forwarddev
--    do_without_error brctl delif $forwardbr $vifname
--    do_without_error brctl delbr $forwardbr
--    do_without_error brctl addif $bridge $vifname
-+    do_without_error ip link set $forwarddev nomaster
-+    do_without_error ip link set $vifname nomaster
-+    do_without_error ip link delete $forwardbr type bridge
-+    do_without_error ip link set $vifname master $bridge
- 
-     do_without_error iptables -t mangle -D PREROUTING -m physdev --physdev-in \
-         $vifname -j SECCOLO --index $index
---- xen-4.11.0-rc7/tools/hotplug/Linux/vif2.orig	2018-06-28 08:39:45.000000000 +0100
-+++ xen-4.11.0-rc7/tools/hotplug/Linux/vif2	2018-07-03 20:11:07.558757301 +0100
-@@ -7,13 +7,12 @@
- bridge=$(xenstore_read_default "$XENBUS_PATH/bridge" "$bridge")
- if [ -z "$bridge" ]
-     then
--    nr_bridges=$(($(brctl show | cut -f 1 | grep -v "^$" | wc -l) - 1))
-+    nr_bridges=$(bridge link | wc -l)
-     if [ "$nr_bridges" != 1 ]
- 	then
- 	fatal "no bridge specified, and don't know which one to use ($nr_bridges found)"
-     fi
--    bridge=$(brctl show | cut -d "
--" -f 2 | cut -f 1)
-+    bridge=$(bridge link | cut -d" " -f10)
- fi
- 
- command="$1"
---- xen-4.11.0-rc7/tools/hotplug/Linux/vif-bridge.orig	2018-07-03 19:59:18.499474117 +0100
-+++ xen-4.11.0-rc7/tools/hotplug/Linux/vif-bridge	2018-07-03 20:12:31.088852864 +0100
-@@ -33,7 +33,7 @@
- 
- if [ -z "$bridge" ]
- then
--  bridge=$(brctl show | awk 'NR==2{print$1}')
-+  bridge=$(bridge link | cut -d" " -f10)
- 
-   if [ -z "$bridge" ]
-   then
-@@ -82,7 +82,7 @@
-         ;;
- 
-     offline)
--        do_without_error brctl delif "$bridge" "$dev"
-+        do_without_error ip link set "$dev" nomaster
-         do_without_error ifconfig "$dev" down
-         ;;
- 
---- xen-4.11.0-rc7/tools/hotplug/Linux/xen-network-common.sh.orig	2018-07-03 19:59:18.500474154 +0100
-+++ xen-4.11.0-rc7/tools/hotplug/Linux/xen-network-common.sh	2018-07-03 20:16:16.466205182 +0100
-@@ -111,9 +111,7 @@
- 
-     # Don't create the bridge if it already exists.
-     if [ ! -e "/sys/class/net/${bridge}/bridge" ]; then
--	brctl addbr ${bridge}
--	brctl stp ${bridge} off
--	brctl setfd ${bridge} 0
-+	ip link add name ${bridge} type bridge stp_state 0 forward_delay 0
- 	# Setting these to zero stops guest<->LAN traffic
- 	# traversing the bridge from hitting the *tables
- 	# rulesets. guest<->host traffic still gets processed
-@@ -134,7 +132,7 @@
- 	ip link set dev ${dev} up || true
- 	return
-     fi
--    brctl addif ${bridge} ${dev}
-+    ip link set ${dev} master ${bridge}
-     ip link set dev ${dev} up
- }
- 
---- xen-4.11.0-rc7/tools/qemu-xen-traditional/i386-dm/qemu-ifup-Linux.orig	2017-09-15 19:37:27.000000000 +0100
-+++ xen-4.11.0-rc7/tools/qemu-xen-traditional/i386-dm/qemu-ifup-Linux	2018-07-03 20:17:52.934780235 +0100
-@@ -34,4 +34,4 @@
- fi
- 
- ifconfig $1 0.0.0.0 up
--brctl addif $bridge $1 || true
-+ip link set $1 master $bridge || true

xen.efi.build.patch

@@ -0,0 +1,13 @@
+--- xen-4.20.0-rc4/xen/arch/x86/arch.mk.orig	2025-02-07 11:56:01.000000000 +0000
++++ xen-4.20.0-rc4/xen/arch/x86/arch.mk	2025-02-09 22:56:05.579507311 +0000
+@@ -95,7 +95,9 @@
+                                          -c $(srctree)/$(efi-check).c -o $(efi-check).o,y)
+ 
+ # Check if the linker supports PE.
+-EFI_LDFLAGS := $(patsubst -m%,-mi386pep,$(LDFLAGS)) --subsystem=10 --enable-long-section-names
++#EFI_LDFLAGS := $(patsubst -m%,-mi386pep,$(LDFLAGS)) --subsystem=10 --enable-long-section-names
++# use a reduced set of options from LDFLAGS
++EFI_LDFLAGS = --as-needed --build-id=sha1 -mi386pep --subsystem=10 --enable-long-section-names
+ LD_PE_check_cmd = $(call ld-option,$(EFI_LDFLAGS) --image-base=0x100000000 -o $(efi-check).efi $(efi-check).o)
+ XEN_BUILD_PE := $(LD_PE_check_cmd)
+ 

xen.fedora.crypt.patch

@@ -1,11 +0,0 @@
---- xen-4.5.1/tools/qemu-xen-traditional/vnc.c.orig	2015-07-12 21:55:32.875504811 +0100
-+++ xen-4.5.1/tools/qemu-xen-traditional/vnc.c	2015-07-12 22:03:03.860005391 +0100
-@@ -2140,7 +2140,7 @@
-     GNUTLS_VERSION_NUMBER >= 0x020200 /* 2.2.0 */
- static int vnc_set_gnutls_priority(gnutls_session_t s, int x509)
- {
--    const char *priority = x509 ? "NORMAL" : "NORMAL:+ANON-DH";
-+    const char *priority = x509 ? "@SYSTEM" : "@SYSTEM:+ANON-DH";
-     int rc;
- 
-     rc = gnutls_priority_set_direct(s, priority, NULL);

xen.fedora.efi.build.patch

@@ -1,10 +0,0 @@
---- xen-4.8.0/xen/Makefile.orig	2016-12-05 12:03:27.000000000 +0000
-+++ xen-4.8.0/xen/Makefile	2017-02-28 00:02:54.080529810 +0000
-@@ -20,6 +20,7 @@
- MAKEFLAGS += -rR
- 
- EFI_MOUNTPOINT ?= $(BOOT_DIR)/efi
-+EFI_VENDOR=fedora
- 
- ARCH=$(XEN_TARGET_ARCH)
- SRCARCH=$(shell echo $(ARCH) | sed -e 's/x86.*/x86/' -e s'/arm\(32\|64\)/arm/g')

xen.fedora.systemd.patch

@@ -1,7 +1,6 @@
-diff -uN xen-4.5.0/tools/hotplug/Linux/systemd.orig/Makefile xen-4.5.0/tools/hotplug/Linux/systemd/Makefile
---- xen-4.5.0/tools/hotplug/Linux/systemd.orig/Makefile	2015-01-12 16:53:24.000000000 +0000
-+++ xen-4.5.0/tools/hotplug/Linux/systemd/Makefile	2015-01-25 22:23:26.000000000 +0000
-@@ -14,7 +14,8 @@
+--- xen-4.17.0/tools/hotplug/Linux/systemd/Makefile.orig	2022-12-08 18:03:08.000000000 +0000
++++ xen-4.17.0/tools/hotplug/Linux/systemd/Makefile	2022-12-09 19:47:53.227189371 +0000
+@@ -10,7 +10,8 @@
  XEN_SYSTEMD_SERVICE += xen-qemu-dom0-disk-backend.service
  XEN_SYSTEMD_SERVICE += xendomains.service
  XEN_SYSTEMD_SERVICE += xen-watchdog.service
@@ -10,16 +9,7 @@ diff -uN xen-4.5.0/tools/hotplug/Linux/systemd.orig/Makefile xen-4.5.0/tools/hot
 +XEN_SYSTEMD_SERVICE += oxenstored.service
  XEN_SYSTEMD_SERVICE += xendriverdomain.service
  
- ALL_XEN_SYSTEMD =	$(XEN_SYSTEMD_MODULES)  \
-diff -uN xen-4.5.0/tools/hotplug/Linux/systemd.orig/var-lib-xenstored.mount.in xen-4.5.0/tools/hotplug/Linux/systemd/var-lib-xenstored.mount.in
---- xen-4.5.0/tools/hotplug/Linux/systemd.orig/var-lib-xenstored.mount.in	2015-01-12 16:53:24.000000000 +0000
-+++ xen-4.5.0/tools/hotplug/Linux/systemd/var-lib-xenstored.mount.in	2015-01-25 22:28:59.000000000 +0000
-@@ -9,4 +9,4 @@
- What=xenstore
- Where=@XEN_LIB_STORED@
- Type=tmpfs
--Options=mode=755
-+Options=mode=755,context="system_u:object_r:xenstored_var_lib_t:s0"
+ ALL_XEN_SYSTEMD :=	$(XEN_SYSTEMD_MODULES)  \
 diff -uN xen-4.5.0/tools/hotplug/Linux/systemd.orig/xenconsoled.service.in xen-4.5.0/tools/hotplug/Linux/systemd/xenconsoled.service.in
 --- xen-4.5.0/tools/hotplug/Linux/systemd.orig/xenconsoled.service.in	2015-01-12 16:53:24.000000000 +0000
 +++ xen-4.5.0/tools/hotplug/Linux/systemd/xenconsoled.service.in	2015-01-25 22:30:26.000000000 +0000
@@ -59,27 +49,26 @@ diff -uN xen-4.5.0/tools/hotplug/Linux/systemd.orig/xen-qemu-dom0-disk-backend.s
  Before=xendomains.service libvirtd.service libvirt-guests.service
  RefuseManualStop=true
  ConditionPathExists=/proc/xen/capabilities
---- xen-4.6.0/tools/configure.ac.orig	2015-02-15 16:47:22.000000000 +0000
-+++ xen-4.6.0/tools/configure.ac	2015-03-01 16:18:30.493647587 +0000
-@@ -382,9 +382,9 @@
+--- xen-4.17.0/tools/configure.ac.orig	2022-12-08 18:03:08.000000000 +0000
++++ xen-4.17.0/tools/configure.ac	2022-12-09 19:50:24.773193862 +0000
+@@ -481,8 +481,8 @@
  
  AS_IF([test "x$systemd" = "xy"], [
      AC_CONFIG_FILES([
 +    hotplug/Linux/systemd/oxenstored.service
      hotplug/Linux/systemd/proc-xen.mount
-     hotplug/Linux/systemd/var-lib-xenstored.mount
 -    hotplug/Linux/systemd/xen-init-dom0.service
      hotplug/Linux/systemd/xen-qemu-dom0-disk-backend.service
      hotplug/Linux/systemd/xen-watchdog.service
      hotplug/Linux/systemd/xenconsoled.service
---- xen-4.6.0/tools/configure.orig	2015-02-15 16:47:22.000000000 +0000
-+++ xen-4.6.0/tools/configure	2015-03-01 16:20:10.648285840 +0000
-@@ -8995,7 +8995,7 @@
+--- xen-4.17.0/tools/configure.orig	2022-12-08 18:03:08.000000000 +0000
++++ xen-4.17.0/tools/configure	2022-12-09 19:51:43.278708226 +0000
+@@ -10081,7 +10081,7 @@
+ if test "x$systemd" = "xy"
+ then :
  
- if test "x$systemd" = "xy"; then :
- 
--    ac_config_files="$ac_config_files hotplug/Linux/systemd/proc-xen.mount hotplug/Linux/systemd/var-lib-xenstored.mount hotplug/Linux/systemd/xen-init-dom0.service hotplug/Linux/systemd/xen-qemu-dom0-disk-backend.service hotplug/Linux/systemd/xen-watchdog.service hotplug/Linux/systemd/xenconsoled.service hotplug/Linux/systemd/xendomains.service hotplug/Linux/systemd/xendriverdomain.service hotplug/Linux/systemd/xenstored.service"
-+    ac_config_files="$ac_config_files hotplug/Linux/systemd/oxenstored.service hotplug/Linux/systemd/proc-xen.mount hotplug/Linux/systemd/var-lib-xenstored.mount hotplug/Linux/systemd/xen-qemu-dom0-disk-backend.service hotplug/Linux/systemd/xen-watchdog.service hotplug/Linux/systemd/xenconsoled.service hotplug/Linux/systemd/xendomains.service hotplug/Linux/systemd/xendriverdomain.service hotplug/Linux/systemd/xenstored.service"
+-    ac_config_files="$ac_config_files hotplug/Linux/systemd/proc-xen.mount hotplug/Linux/systemd/xen-init-dom0.service hotplug/Linux/systemd/xen-qemu-dom0-disk-backend.service hotplug/Linux/systemd/xen-watchdog.service hotplug/Linux/systemd/xenconsoled.service hotplug/Linux/systemd/xendomains.service hotplug/Linux/systemd/xendriverdomain.service hotplug/Linux/systemd/xenstored.service"
++    ac_config_files="$ac_config_files hotplug/Linux/systemd/oxenstored.service hotplug/Linux/systemd/proc-xen.mount hotplug/Linux/systemd/xen-qemu-dom0-disk-backend.service hotplug/Linux/systemd/xen-watchdog.service hotplug/Linux/systemd/xenconsoled.service hotplug/Linux/systemd/xendomains.service hotplug/Linux/systemd/xendriverdomain.service hotplug/Linux/systemd/xenstored.service"
  
  
  fi

xen.gcc11.fixes.patch

@@ -0,0 +1,24 @@
+--- xen-4.14.0/xen/include/crypto/vmac.h.orig	2020-07-23 16:07:51.000000000 +0100
++++ xen-4.14.0/xen/include/crypto/vmac.h	2020-10-24 15:45:49.246467465 +0100
+@@ -142,7 +142,7 @@
+ 
+ #define vmac_update vhash_update
+ 
+-void vhash_update(unsigned char m[],
++void vhash_update(uint8_t *m,
+           unsigned int mbytes,
+           vmac_ctx_t *ctx);
+ 
+diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c
+index 320e06f..618ae92 100644
+--- a/xen/arch/x86/tboot.c
++++ b/xen/arch/x86/tboot.c
+@@ -91,7 +91,7 @@ static void __init tboot_copy_memory(unsigned char *va, uint32_t size,
+ 
+ void __init tboot_probe(void)
+ {
+-    tboot_shared_t *tboot_shared;
++    tboot_shared_t * volatile tboot_shared;
+     static const uuid_t __initconst tboot_shared_uuid = TBOOT_SHARED_UUID;
+ 
+     /* Look for valid page-aligned address for shared page. */

xen.gcc12.fixes.patch

@@ -0,0 +1,10 @@
+--- xen-4.16.0/Config.mk.orig	2021-11-30 11:42:42.000000000 +0000
++++ xen-4.16.0/Config.mk	2022-01-24 20:25:16.687125822 +0000
+@@ -186,6 +186,7 @@
+ 
+ $(call cc-option-add,CFLAGS,CC,-Wno-unused-but-set-variable)
+ $(call cc-option-add,CFLAGS,CC,-Wno-unused-local-typedefs)
++$(call cc-option-add,CFLAGS,CC,-Wno-error=array-bounds)
+ 
+ LDFLAGS += $(foreach i, $(EXTRA_LIB), -L$(i)) 
+ CFLAGS += $(foreach i, $(EXTRA_INCLUDES), -I$(i))

xen.gcc7.fix.patch

@@ -1,12 +0,0 @@
---- xen-4.8.0/extras/mini-os/Makefile.orig	2016-09-28 12:09:38.000000000 +0100
-+++ xen-4.8.0/extras/mini-os/Makefile	2017-02-15 21:15:19.340197960 +0000
-@@ -142,6 +142,9 @@
- APP_LDLIBS += -lz
- APP_LDLIBS += -lm
- LDLIBS += -lc
-+ifeq ($(MINIOS_TARGET_ARCH),x86_32)
-+LDLIBS += -L$(shell dirname `gcc -m32 -print-libgcc-file-name`) -lgcc
-+endif
- endif
- 
- ifneq ($(APP_OBJS)-$(lwip),-y)

xen.git-1e8932f0d815bee3102ede328676e1a4ca1926c7.patch

@@ -1,341 +0,0 @@
-From 1e8932f0d815bee3102ede328676e1a4ca1926c7 Mon Sep 17 00:00:00 2001
-From: Paul Durrant <pdurrant@amazon.com>
-Date: Fri, 6 Dec 2019 12:46:24 +0100
-Subject: [PATCH] x86 / iommu: set up a scratch page in the quarantine domain
-
-This patch introduces a new iommu_op to facilitate a per-implementation
-quarantine set up, and then further code for x86 implementations
-(amd and vtd) to set up a read-only scratch page to serve as the source
-for DMA reads whilst a device is assigned to dom_io. DMA writes will
-continue to fault as before.
-
-The reason for doing this is that some hardware may continue to re-try
-DMA (despite FLR) in the event of an error, or even BME being cleared, and
-will fail to deal with DMA read faults gracefully. Having a scratch page
-mapped will allow pending DMA reads to complete and thus such buggy
-hardware will eventually be quiesced.
-
-NOTE: These modifications are restricted to x86 implementations only as
-      the buggy h/w I am aware of is only used with Xen in an x86
-      environment. ARM may require similar code but, since I am not
-      aware of the need, this patch does not modify any ARM implementation.
-
-Signed-off-by: Paul Durrant <pdurrant@amazon.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: ea38867831da67eed0e9c61672c8941016b63dd9
-master date: 2019-11-29 18:27:54 +0000
----
- xen/drivers/passthrough/amd/iommu_map.c       | 62 ++++++++++++++++++++++
- xen/drivers/passthrough/amd/pci_amd_iommu.c   | 14 ++---
- xen/drivers/passthrough/iommu.c               | 17 +++++-
- xen/drivers/passthrough/vtd/iommu.c           | 74 ++++++++++++++++++++++-----
- xen/include/asm-x86/hvm/svm/amd-iommu-proto.h |  3 ++
- xen/include/xen/iommu.h                       |  1 +
- 6 files changed, 147 insertions(+), 24 deletions(-)
-
-diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c
-index 628aa60230..f876ce832b 100644
---- a/xen/drivers/passthrough/amd/iommu_map.c
-+++ b/xen/drivers/passthrough/amd/iommu_map.c
-@@ -758,6 +758,68 @@ void amd_iommu_share_p2m(struct domain *d)
-     }
- }
- 
-+int __init amd_iommu_quarantine_init(struct domain *d)
-+{
-+    struct domain_iommu *hd = dom_iommu(d);
-+    unsigned long max_gfn =
-+        PFN_DOWN((1ul << DEFAULT_DOMAIN_ADDRESS_WIDTH) - 1);
-+    unsigned int level = amd_iommu_get_paging_mode(max_gfn);
-+    uint64_t *table;
-+
-+    if ( hd->arch.root_table )
-+    {
-+        ASSERT_UNREACHABLE();
-+        return 0;
-+    }
-+
-+    spin_lock(&hd->arch.mapping_lock);
-+
-+    hd->arch.root_table = alloc_amd_iommu_pgtable();
-+    if ( !hd->arch.root_table )
-+        goto out;
-+
-+    table = __map_domain_page(hd->arch.root_table);
-+    while ( level )
-+    {
-+        struct page_info *pg;
-+        unsigned int i;
-+
-+        /*
-+         * The pgtable allocator is fine for the leaf page, as well as
-+         * page table pages, and the resulting allocations are always
-+         * zeroed.
-+         */
-+        pg = alloc_amd_iommu_pgtable();
-+        if ( !pg )
-+            break;
-+
-+        for ( i = 0; i < PTE_PER_TABLE_SIZE; i++ )
-+        {
-+            uint32_t *pde = (uint32_t *)&table[i];
-+
-+            /*
-+             * PDEs are essentially a subset of PTEs, so this function
-+             * is fine to use even at the leaf.
-+             */
-+            set_iommu_pde_present(pde, mfn_x(page_to_mfn(pg)), level - 1,
-+                                  false, true);
-+        }
-+
-+        unmap_domain_page(table);
-+        table = __map_domain_page(pg);
-+        level--;
-+    }
-+    unmap_domain_page(table);
-+
-+ out:
-+    spin_unlock(&hd->arch.mapping_lock);
-+
-+    amd_iommu_flush_all_pages(d);
-+
-+    /* Pages leaked in failure case */
-+    return level ? -ENOMEM : 0;
-+}
-+
- /*
-  * Local variables:
-  * mode: C
-diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-index 15c13e1163..93ecae4a6c 100644
---- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
-+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-@@ -120,10 +120,6 @@ static void amd_iommu_setup_domain_device(
-     u8 bus = pdev->bus;
-     const struct domain_iommu *hd = dom_iommu(domain);
- 
--    /* dom_io is used as a sentinel for quarantined devices */
--    if ( domain == dom_io )
--        return;
--
-     BUG_ON( !hd->arch.root_table || !hd->arch.paging_mode ||
-             !iommu->dev_table.buffer );
- 
-@@ -226,7 +222,7 @@ static int __must_check allocate_domain_resources(struct domain_iommu *hd)
-     return rc;
- }
- 
--static int get_paging_mode(unsigned long entries)
-+int amd_iommu_get_paging_mode(unsigned long entries)
- {
-     int level = 1;
- 
-@@ -248,7 +244,8 @@ static int amd_iommu_domain_init(struct domain *d)
- 
-     /* For pv and dom0, stick with get_paging_mode(max_page)
-      * For HVM dom0, use 2 level page table at first */
--    hd->arch.paging_mode = is_hvm_domain(d) ? 2 : get_paging_mode(max_page);
-+    hd->arch.paging_mode = is_hvm_domain(d) ?
-+        2 : amd_iommu_get_paging_mode(max_page);
-     return 0;
- }
- 
-@@ -281,10 +278,6 @@ void amd_iommu_disable_domain_device(struct domain *domain,
-     int req_id;
-     u8 bus = pdev->bus;
- 
--    /* dom_io is used as a sentinel for quarantined devices */
--    if ( domain == dom_io )
--        return;
--
-     BUG_ON ( iommu->dev_table.buffer == NULL );
-     req_id = get_dma_requestor_id(iommu->seg, PCI_BDF2(bus, devfn));
-     dte = iommu->dev_table.buffer + (req_id * IOMMU_DEV_TABLE_ENTRY_SIZE);
-@@ -581,6 +574,7 @@ static void amd_dump_p2m_table(struct domain *d)
- static const struct iommu_ops __initconstrel amd_iommu_ops = {
-     .init = amd_iommu_domain_init,
-     .hwdom_init = amd_iommu_hwdom_init,
-+    .quarantine_init = amd_iommu_quarantine_init,
-     .add_device = amd_iommu_add_device,
-     .remove_device = amd_iommu_remove_device,
-     .assign_device  = amd_iommu_assign_device,
-diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
-index 20db08e1df..a747bfb946 100644
---- a/xen/drivers/passthrough/iommu.c
-+++ b/xen/drivers/passthrough/iommu.c
-@@ -497,6 +497,21 @@ int iommu_iotlb_flush_all(struct domain *d, unsigned int flush_flags)
-     return rc;
- }
- 
-+static int __init iommu_quarantine_init(void)
-+{
-+    const struct domain_iommu *hd = dom_iommu(dom_io);
-+    int rc;
-+
-+    rc = iommu_domain_init(dom_io);
-+    if ( rc )
-+        return rc;
-+
-+    if ( !hd->platform_ops->quarantine_init )
-+        return 0;
-+
-+    return hd->platform_ops->quarantine_init(dom_io);
-+}
-+
- int __init iommu_setup(void)
- {
-     int rc = -ENODEV;
-@@ -530,7 +545,7 @@ int __init iommu_setup(void)
-     printk("I/O virtualisation %sabled\n", iommu_enabled ? "en" : "dis");
-     if ( iommu_enabled )
-     {
--        if ( iommu_domain_init(dom_io) )
-+        if ( iommu_quarantine_init() )
-             panic("Could not set up quarantine\n");
- 
-         printk(" - Dom0 mode: %s\n",
-diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
-index 5663e9740d..576e72eba1 100644
---- a/xen/drivers/passthrough/vtd/iommu.c
-+++ b/xen/drivers/passthrough/vtd/iommu.c
-@@ -192,7 +192,7 @@ u64 alloc_pgtable_maddr(struct acpi_drhd_unit *drhd, unsigned long npages)
-     nodeid_t node = NUMA_NO_NODE;
-     unsigned int i;
- 
--    rhsa = drhd_to_rhsa(drhd);
-+    rhsa = drhd ? drhd_to_rhsa(drhd) : NULL;
-     if ( rhsa )
-         node =  pxm_to_node(rhsa->proximity_domain);
- 
-@@ -1340,10 +1340,6 @@ int domain_context_mapping_one(
-     int agaw, rc, ret;
-     bool_t flush_dev_iotlb;
- 
--    /* dom_io is used as a sentinel for quarantined devices */
--    if ( domain == dom_io )
--        return 0;
--
-     ASSERT(pcidevs_locked());
-     spin_lock(&iommu->lock);
-     maddr = bus_to_context_maddr(iommu, bus);
-@@ -1579,10 +1575,6 @@ int domain_context_unmap_one(
-     int iommu_domid, rc, ret;
-     bool_t flush_dev_iotlb;
- 
--    /* dom_io is used as a sentinel for quarantined devices */
--    if ( domain == dom_io )
--        return 0;
--
-     ASSERT(pcidevs_locked());
-     spin_lock(&iommu->lock);
- 
-@@ -1715,10 +1707,6 @@ static int domain_context_unmap(struct domain *domain, u8 devfn,
-         goto out;
-     }
- 
--    /* dom_io is used as a sentinel for quarantined devices */
--    if ( domain == dom_io )
--        goto out;
--
-     /*
-      * if no other devices under the same iommu owned by this domain,
-      * clear iommu in iommu_bitmap and clear domain_id in domid_bitmp
-@@ -2736,9 +2724,69 @@ static void vtd_dump_p2m_table(struct domain *d)
-     vtd_dump_p2m_table_level(hd->arch.pgd_maddr, agaw_to_level(hd->arch.agaw), 0, 0);
- }
- 
-+static int __init intel_iommu_quarantine_init(struct domain *d)
-+{
-+    struct domain_iommu *hd = dom_iommu(d);
-+    struct dma_pte *parent;
-+    unsigned int agaw = width_to_agaw(DEFAULT_DOMAIN_ADDRESS_WIDTH);
-+    unsigned int level = agaw_to_level(agaw);
-+    int rc;
-+
-+    if ( hd->arch.pgd_maddr )
-+    {
-+        ASSERT_UNREACHABLE();
-+        return 0;
-+    }
-+
-+    spin_lock(&hd->arch.mapping_lock);
-+
-+    hd->arch.pgd_maddr = alloc_pgtable_maddr(NULL, 1);
-+    if ( !hd->arch.pgd_maddr )
-+        goto out;
-+
-+    parent = map_vtd_domain_page(hd->arch.pgd_maddr);
-+    while ( level )
-+    {
-+        uint64_t maddr;
-+        unsigned int offset;
-+
-+        /*
-+         * The pgtable allocator is fine for the leaf page, as well as
-+         * page table pages, and the resulting allocations are always
-+         * zeroed.
-+         */
-+        maddr = alloc_pgtable_maddr(NULL, 1);
-+        if ( !maddr )
-+            break;
-+
-+        for ( offset = 0; offset < PTE_NUM; offset++ )
-+        {
-+            struct dma_pte *pte = &parent[offset];
-+
-+            dma_set_pte_addr(*pte, maddr);
-+            dma_set_pte_readable(*pte);
-+        }
-+        iommu_flush_cache_page(parent, 1);
-+
-+        unmap_vtd_domain_page(parent);
-+        parent = map_vtd_domain_page(maddr);
-+        level--;
-+    }
-+    unmap_vtd_domain_page(parent);
-+
-+ out:
-+    spin_unlock(&hd->arch.mapping_lock);
-+
-+    rc = iommu_flush_iotlb_all(d);
-+
-+    /* Pages leaked in failure case */
-+    return level ? -ENOMEM : rc;
-+}
-+
- const struct iommu_ops __initconstrel intel_iommu_ops = {
-     .init = intel_iommu_domain_init,
-     .hwdom_init = intel_iommu_hwdom_init,
-+    .quarantine_init = intel_iommu_quarantine_init,
-     .add_device = intel_iommu_add_device,
-     .enable_device = intel_iommu_enable_device,
-     .remove_device = intel_iommu_remove_device,
-diff --git a/xen/include/asm-x86/hvm/svm/amd-iommu-proto.h b/xen/include/asm-x86/hvm/svm/amd-iommu-proto.h
-index c5697565d6..5a160b89ca 100644
---- a/xen/include/asm-x86/hvm/svm/amd-iommu-proto.h
-+++ b/xen/include/asm-x86/hvm/svm/amd-iommu-proto.h
-@@ -51,6 +51,9 @@ void get_iommu_features(struct amd_iommu *iommu);
- int amd_iommu_init(void);
- int amd_iommu_update_ivrs_mapping_acpi(void);
- 
-+int amd_iommu_get_paging_mode(unsigned long entries);
-+int amd_iommu_quarantine_init(struct domain *d);
-+
- /* mapping functions */
- int __must_check amd_iommu_map_page(struct domain *d, dfn_t dfn,
-                                     mfn_t mfn, unsigned int flags,
-diff --git a/xen/include/xen/iommu.h b/xen/include/xen/iommu.h
-index 70ee53d083..617c993f50 100644
---- a/xen/include/xen/iommu.h
-+++ b/xen/include/xen/iommu.h
-@@ -189,6 +189,7 @@ typedef int iommu_grdm_t(xen_pfn_t start, xen_ulong_t nr, u32 id, void *ctxt);
- struct iommu_ops {
-     int (*init)(struct domain *d);
-     void (*hwdom_init)(struct domain *d);
-+    int (*quarantine_init)(struct domain *d);
-     int (*add_device)(u8 devfn, device_t *dev);
-     int (*enable_device)(device_t *dev);
-     int (*remove_device)(u8 devfn, device_t *dev);
--- 
-2.11.0
-

xen.git-36d2ecb9991bf2d1ddb933872c3dfbd26300ca68.patch

@@ -1,110 +0,0 @@
-From 36d2ecb9991bf2d1ddb933872c3dfbd26300ca68 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Mon, 25 Nov 2019 16:01:00 +0100
-Subject: [PATCH] AMD/IOMMU: don't needlessly trigger errors/crashes when
- unmapping a page
-
-Unmapping a page which has never been mapped should be a no-op (note how
-it already is in case there was no root page table allocated). There's
-in particular no need to grow the number of page table levels in use,
-and there's also no need to allocate intermediate page tables except
-when needing to split a large page.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Paul Durrant <paul@xen.org>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: ad591454f069647c36a7daaa9ec23384c0263f0b
-master date: 2019-11-12 11:08:34 +0100
----
- xen/drivers/passthrough/amd/iommu_map.c | 40 +++++++++++++++------------------
- 1 file changed, 18 insertions(+), 22 deletions(-)
-
-diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c
-index 67329b0c95..628aa60230 100644
---- a/xen/drivers/passthrough/amd/iommu_map.c
-+++ b/xen/drivers/passthrough/amd/iommu_map.c
-@@ -343,7 +343,7 @@ uint64_t amd_iommu_get_address_from_pte(void *pte)
-  * page tables.
-  */
- static int iommu_pde_from_dfn(struct domain *d, unsigned long dfn,
--                              unsigned long pt_mfn[])
-+                              unsigned long pt_mfn[], bool map)
- {
-     uint64_t *pde, *next_table_vaddr;
-     unsigned long  next_table_mfn;
-@@ -356,6 +356,13 @@ static int iommu_pde_from_dfn(struct domain *d, unsigned long dfn,
- 
-     BUG_ON( table == NULL || level < 1 || level > 6 );
- 
-+    /*
-+     * A frame number past what the current page tables can represent can't
-+     * possibly have a mapping.
-+     */
-+    if ( dfn >> (PTE_PER_TABLE_SHIFT * level) )
-+        return 0;
-+
-     next_table_mfn = mfn_x(page_to_mfn(table));
- 
-     if ( level == 1 )
-@@ -415,6 +422,9 @@ static int iommu_pde_from_dfn(struct domain *d, unsigned long dfn,
-         /* Install lower level page table for non-present entries */
-         else if ( !iommu_is_pte_present((uint32_t *)pde) )
-         {
-+            if ( !map )
-+                return 0;
-+
-             if ( next_table_mfn == 0 )
-             {
-                 table = alloc_amd_iommu_pgtable();
-@@ -577,7 +587,7 @@ int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn,
-         }
-     }
- 
--    if ( iommu_pde_from_dfn(d, dfn_x(dfn), pt_mfn) || (pt_mfn[1] == 0) )
-+    if ( iommu_pde_from_dfn(d, dfn_x(dfn), pt_mfn, true) || (pt_mfn[1] == 0) )
-     {
-         spin_unlock(&hd->arch.mapping_lock);
-         AMD_IOMMU_DEBUG("Invalid IO pagetable entry dfn = %"PRI_dfn"\n",
-@@ -615,24 +625,7 @@ int amd_iommu_unmap_page(struct domain *d, dfn_t dfn,
-         return 0;
-     }
- 
--    /* Since HVM domain is initialized with 2 level IO page table,
--     * we might need a deeper page table for lager dfn now */
--    if ( is_hvm_domain(d) )
--    {
--        int rc = update_paging_mode(d, dfn_x(dfn));
--
--        if ( rc )
--        {
--            spin_unlock(&hd->arch.mapping_lock);
--            AMD_IOMMU_DEBUG("Update page mode failed dfn = %"PRI_dfn"\n",
--                            dfn_x(dfn));
--            if ( rc != -EADDRNOTAVAIL )
--                domain_crash(d);
--            return rc;
--        }
--    }
--
--    if ( iommu_pde_from_dfn(d, dfn_x(dfn), pt_mfn) || (pt_mfn[1] == 0) )
-+    if ( iommu_pde_from_dfn(d, dfn_x(dfn), pt_mfn, false) )
-     {
-         spin_unlock(&hd->arch.mapping_lock);
-         AMD_IOMMU_DEBUG("Invalid IO pagetable entry dfn = %"PRI_dfn"\n",
-@@ -641,8 +634,11 @@ int amd_iommu_unmap_page(struct domain *d, dfn_t dfn,
-         return -EFAULT;
-     }
- 
--    /* mark PTE as 'page not present' */
--    *flush_flags |= clear_iommu_pte_present(pt_mfn[1], dfn_x(dfn));
-+    if ( pt_mfn[1] )
-+    {
-+        /* Mark PTE as 'page not present'. */
-+        *flush_flags |= clear_iommu_pte_present(pt_mfn[1], dfn_x(dfn));
-+    }
- 
-     spin_unlock(&hd->arch.mapping_lock);
- 
--- 
-2.11.0
-

xen.git-90b20547b756a5cf9b0fec9fb0de5b361e8bf4c3.patch

@@ -0,0 +1,88 @@
+From 90b20547b756a5cf9b0fec9fb0de5b361e8bf4c3 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Fri, 10 Apr 2026 21:55:46 +0100
+Subject: [PATCH] x86/amd: Mitigate AMD-SN-7053 / FP-DSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+This is XSA-488 / CVE-2025-54505
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+(cherry picked from commit 99912d346009fda1e7fb1510c9501fbab17e92a0)
+---
+ xen/arch/x86/cpu/amd.c               | 37 ++++++++++++++++++++++++++++
+ xen/arch/x86/include/asm/msr-index.h |  1 +
+ 2 files changed, 38 insertions(+)
+
+diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
+index 8c55d233f3..1bb0766ebf 100644
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -1048,6 +1048,42 @@ void amd_init_de_cfg(const struct cpuinfo_x86 *c)
+     wrmsrl(MSR_AMD64_DE_CFG, val | new);
+ }
+ 
++static void amd_init_fp_cfg(const struct cpuinfo_x86 *c)
++{
++    uint64_t val, new = 0;
++
++    /* If virtualised, we won't have mutable access even if we can read it. */
++    if ( cpu_has_hypervisor )
++        return;
++
++    /*
++     * On Zen1, mitigate SB-7053 / FP-DSS Floating Point Divider State
++     * Sampling by setting bit 9 as instructed.
++     */
++    if ( c->family == 0x17 && is_zen1_uarch() )
++        new |= 1 << 9;
++
++    /*
++     * Avoid reading FP_CFG if we don't intend to change anything.  The
++     * register doesn't exist on all families.
++     */
++    if ( !new )
++        return;
++
++    val = rdmsr(MSR_AMD64_FP_CFG);
++
++    if ( (val & new) == new )
++        return;
++
++    /*
++     * FP_CFG is a Core-scoped MSR, and this write is racy.  However, both
++     * threads calculate the new value from state which expected to be
++     * consistent across CPUs and unrelated to the old value, so the result
++     * should be consistent.
++     */
++    wrmsr(MSR_AMD64_FP_CFG, val | new);
++}
++
+ void __init amd_init_lfence_dispatch(void)
+ {
+     struct cpuinfo_x86 *c = &boot_cpu_data;
+@@ -1120,6 +1156,7 @@ static void cf_check init_amd(struct cpuinfo_x86 *c)
+ 	uint64_t value;
+ 
+ 	amd_init_de_cfg(c);
++	amd_init_fp_cfg(c);
+ 
+ 	if (c == &boot_cpu_data)
+ 		amd_init_lfence_dispatch(); /* Needs amd_init_de_cfg() */
+diff --git a/xen/arch/x86/include/asm/msr-index.h b/xen/arch/x86/include/asm/msr-index.h
+index df52587c85..6c5b2569e1 100644
+--- a/xen/arch/x86/include/asm/msr-index.h
++++ b/xen/arch/x86/include/asm/msr-index.h
+@@ -428,6 +428,7 @@
+ #define MSR_AMD64_LS_CFG		0xc0011020U
+ #define MSR_AMD64_IC_CFG		0xc0011021U
+ #define MSR_AMD64_DC_CFG		0xc0011022U
++#define MSR_AMD64_FP_CFG		0xc0011028U
+ #define MSR_AMD64_DE_CFG		0xc0011029U
+ #define AMD64_DE_CFG_LFENCE_SERIALISE	(_AC(1, ULL) << 1)
+ #define MSR_AMD64_EX_CFG		0xc001102cU
+-- 
+2.39.5
+

xen.hypervisor.config

@@ -1,92 +1,172 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Xen/x86 4.12.0 Configuration
+# Xen/x86 4.20 Configuration
 #
+CONFIG_CC_IS_GCC=y
+CONFIG_GCC_VERSION=150001
+CONFIG_CLANG_VERSION=0
+CONFIG_LD_IS_GNU=y
+CONFIG_CC_HAS_VISIBILITY_ATTRIBUTE=y
+CONFIG_CC_SPLIT_SECTIONS=y
+CONFIG_FUNCTION_ALIGNMENT_16B=y
+CONFIG_FUNCTION_ALIGNMENT=16
 CONFIG_X86_64=y
 CONFIG_X86=y
 CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
+CONFIG_CC_HAS_INDIRECT_THUNK=y
+CONFIG_HAS_AS_CET_SS=y
+CONFIG_HAS_CC_CET_IBT=y
 
 #
 # Architecture Features
 #
+CONFIG_AMD=y
+CONFIG_INTEL=y
+CONFIG_64BIT=y
 CONFIG_NR_CPUS=256
+CONFIG_NR_NUMA_NODES=64
 CONFIG_PV=y
+CONFIG_PV32=y
 CONFIG_PV_LINEAR_PT=y
 CONFIG_HVM=y
+CONFIG_AMD_SVM=y
+CONFIG_INTEL_VMX=y
+CONFIG_XEN_SHSTK=y
+CONFIG_XEN_IBT=y
 CONFIG_SHADOW_PAGING=y
 # CONFIG_BIGMEM is not set
-# CONFIG_HVM_FEP is not set
-CONFIG_TBOOT=y
+CONFIG_HVM_FEP=y
+CONFIG_X86_PSR=y
+CONFIG_XEN_ALIGN_DEFAULT=y
+# CONFIG_XEN_ALIGN_2M is not set
+# CONFIG_X2APIC_PHYSICAL is not set
+CONFIG_X2APIC_MIXED=y
 # CONFIG_XEN_GUEST is not set
+# CONFIG_HYPERV_GUEST is not set
+# CONFIG_REQUIRE_NX is not set
+CONFIG_ALTP2M=y
+# end of Architecture Features
 
 #
 # Common Features
 #
 CONFIG_COMPAT=y
 CONFIG_CORE_PARKING=y
+CONFIG_GRANT_TABLE=y
+CONFIG_ALTERNATIVE_CALL=y
+CONFIG_ARCH_MAP_DOMAIN_PAGE=y
+CONFIG_GENERIC_BUG_FRAME=y
 CONFIG_HAS_ALTERNATIVE=y
+CONFIG_HAS_COMPAT=y
+CONFIG_HAS_DIT=y
 CONFIG_HAS_EX_TABLE=y
+CONFIG_HAS_FAST_MULTIPLY=y
+CONFIG_HAS_IOPORTS=y
+CONFIG_HAS_KEXEC=y
+CONFIG_HAS_PIRQ=y
+CONFIG_HAS_SCHED_GRANULARITY=y
+CONFIG_HAS_UBSAN=y
+CONFIG_HAS_VMAP=y
 CONFIG_MEM_ACCESS_ALWAYS_ON=y
 CONFIG_MEM_ACCESS=y
-CONFIG_HAS_MEM_PAGING=y
-CONFIG_HAS_MEM_SHARING=y
-CONFIG_HAS_PDX=y
-CONFIG_HAS_UBSAN=y
-CONFIG_HAS_KEXEC=y
-CONFIG_HAS_GDBSX=y
-CONFIG_HAS_IOPORTS=y
 CONFIG_NEEDS_LIBELF=y
+CONFIG_NUMA=y
+
+#
+# Speculative hardening
+#
+CONFIG_INDIRECT_THUNK=y
+CONFIG_RETURN_THUNK=y
+CONFIG_SPECULATIVE_HARDEN_ARRAY=y
+CONFIG_SPECULATIVE_HARDEN_BRANCH=y
+CONFIG_SPECULATIVE_HARDEN_GUEST_ACCESS=y
+CONFIG_SPECULATIVE_HARDEN_LOCK=y
+# end of Speculative hardening
+
+# CONFIG_DIT_DEFAULT is not set
+CONFIG_HYPFS=y
+CONFIG_HYPFS_CONFIG=y
+CONFIG_IOREQ_SERVER=y
 CONFIG_KEXEC=y
-CONFIG_XENOPROF=y
 # CONFIG_XSM is not set
 CONFIG_SCHED_CREDIT=y
 CONFIG_SCHED_CREDIT2=y
 CONFIG_SCHED_RTDS=y
-# CONFIG_SCHED_ARINC653 is not set
+CONFIG_SCHED_ARINC653=y
 CONFIG_SCHED_NULL=y
 CONFIG_SCHED_DEFAULT="credit2"
-CONFIG_CRYPTO=y
+# CONFIG_BOOT_TIME_CPUPOOLS is not set
 CONFIG_LIVEPATCH=y
 CONFIG_FAST_SYMBOL_LOOKUP=y
+CONFIG_ENFORCE_UNIQUE_SYMBOLS=y
 CONFIG_CMDLINE=""
 CONFIG_DOM0_MEM=""
+CONFIG_DTB_FILE=""
+CONFIG_TRACEBUFFER=y
+# end of Common Features
 
 #
 # Device Drivers
 #
 CONFIG_ACPI=y
 CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
-CONFIG_NUMA=y
+CONFIG_ACPI_NUMA=y
 CONFIG_HAS_NS16550=y
 CONFIG_HAS_EHCI=y
+CONFIG_SERIAL_TX_BUFSIZE=32768
+# CONFIG_XHCI is not set
 CONFIG_HAS_CPUFREQ=y
 CONFIG_HAS_PASSTHROUGH=y
+CONFIG_AMD_IOMMU=y
+CONFIG_INTEL_IOMMU=y
+# CONFIG_IOMMU_QUARANTINE_NONE is not set
+CONFIG_IOMMU_QUARANTINE_BASIC=y
+# CONFIG_IOMMU_QUARANTINE_SCRATCH_PAGE is not set
 CONFIG_HAS_PCI=y
+CONFIG_HAS_PCI_MSI=y
 CONFIG_VIDEO=y
 CONFIG_VGA=y
 CONFIG_HAS_VPCI=y
+# end of Device Drivers
 
-#
-# Deprecated Functionality
-#
-# CONFIG_PV_LDT_PAGING is not set
-CONFIG_DEFCONFIG_LIST="$ARCH_DEFCONFIG"
+# CONFIG_EXPERT is not set
+# CONFIG_UNSUPPORTED is not set
 CONFIG_ARCH_SUPPORTS_INT128=y
+CONFIG_ARCH_VCPU_IOREQ_COMPLETION=y
 
 #
 # Debugging Options
 #
 # CONFIG_DEBUG is not set
+CONFIG_GDBSX=y
+CONFIG_FRAME_POINTER=y
+CONFIG_SELF_TESTS=y
+# CONFIG_DEBUG_LOCK_PROFILE is not set
+CONFIG_DEBUG_LOCKS=y
+# CONFIG_PERF_COUNTERS is not set
+CONFIG_VERBOSE_DEBUG=y
+CONFIG_SCRUB_DEBUG=y
+# CONFIG_UBSAN is not set
+# CONFIG_DEBUG_TRACE is not set
+CONFIG_XMEM_POOL_POISON=y
+CONFIG_DEBUG_INFO=y
+# end of Debugging Options
 
 # ARM64 settings
-CONFIG_64BIT=y
+CONFIG_MMU=y
 CONFIG_ARM_64=y
 CONFIG_ARM=y
+CONFIG_ARM_EFI=y
+CONFIG_GICV2=y
 CONFIG_GICV3=y
+CONFIG_VGICV2=y
 # CONFIG_NEW_VGIC is not set
 CONFIG_SBSA_VUART_CONSOLE=y
+CONFIG_HWDOM_VUART=y
 CONFIG_ARM_SSBD=y
 CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_STATIC_EVTCHN=y
+CONFIG_PARTIAL_EMULATION=y
 
 #
 # ARM errata workaround via the alternative framework
@@ -94,8 +174,15 @@ CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_ARM64_ERRATUM_827319=y
 CONFIG_ARM64_ERRATUM_824069=y
 CONFIG_ARM64_ERRATUM_819472=y
+CONFIG_ARM64_ERRATUM_843419=y
 CONFIG_ARM64_ERRATUM_832075=y
 CONFIG_ARM64_ERRATUM_834220=y
+CONFIG_ARM_ERRATUM_858921=y
+CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
+CONFIG_ARM64_ERRATUM_1286807=y
+CONFIG_ARM64_ERRATUM_1508412=y
+
+# end of ARM errata workaround via the alternative framework
 CONFIG_ARM64_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_ALL_PLAT=y
 # CONFIG_QEMU is not set
@@ -104,16 +191,18 @@ CONFIG_ALL_PLAT=y
 # CONFIG_NO_PLAT is not set
 CONFIG_ALL64_PLAT=y
 CONFIG_MPSOC_PLATFORM=y
+
+#
+# Common Features
+#
 CONFIG_HAS_DEVICE_TREE=y
 CONFIG_HAS_CADENCE_UART=y
+CONFIG_HAS_LINFLEX=y
+CONFIG_HAS_IMX_LPUART=y
 CONFIG_HAS_MVEBU=y
+CONFIG_HAS_MESON=y
 CONFIG_HAS_PL011=y
+CONFIG_HAS_OMAP=y
 CONFIG_HAS_SCIF=y
 CONFIG_ARM_SMMU=y
-
-# ARM32 settings
-CONFIG_ALL32_PLAT=y
-CONFIG_ARM32_HARDEN_BRANCH_PREDICTOR=y
-CONFIG_ARM_32=y
-CONFIG_HAS_EXYNOS4210=y
-CONFIG_HAS_OMAP=y
+# CONFIG_IPMMU_VMSA is not set

xen.json.nocpuid.patch

@@ -0,0 +1,27 @@
+--- xen-4.21.0/tools/libs/light/libxl_nocpuid.c.orig	2025-11-18 18:02:13.000000000 +0000
++++ xen-4.21.0/tools/libs/light/libxl_nocpuid.c	2025-11-20 09:03:56.517804514 +0000
+@@ -40,11 +40,24 @@
+     return 0;
+ }
+ 
++#ifdef HAVE_LIBJSONC
++#ifndef _hidden
++#define _hidden
++#endif
++_hidden int libxl_cpuid_policy_list_gen_jso(json_object **jso_r,
++                                libxl_cpuid_policy_list *pcpuid)
++{
++    return 0;
++}
++#endif
++
++#if defined(HAVE_LIBYAJL)
+ yajl_gen_status libxl_cpuid_policy_list_gen_json(yajl_gen hand,
+                                 libxl_cpuid_policy_list *pcpuid)
+ {
+     return 0;
+ }
++#endif
+ 
+ int libxl__cpuid_policy_list_parse_json(libxl__gc *gc,
+                                         const libxl__json_object *o,

xen.python.env.patch

@@ -1,43 +0,0 @@
---- xen-4.11.0/tools/xenmon/Makefile.orig	2018-07-09 14:47:19.000000000 +0100
-+++ xen-4.11.0/tools/xenmon/Makefile	2018-09-10 21:13:15.200655105 +0100
-@@ -32,7 +32,7 @@
- 	$(INSTALL_DIR) $(DESTDIR)$(sbindir)
- 	$(INSTALL_PROG) xenbaked $(DESTDIR)$(sbindir)/xenbaked
- 	$(INSTALL_PROG) xentrace_setmask  $(DESTDIR)$(sbindir)/xentrace_setmask
--	$(INSTALL_PROG) xenmon.py  $(DESTDIR)$(sbindir)/xenmon
-+	$(INSTALL_PYTHON_PROG) xenmon.py  $(DESTDIR)$(sbindir)/xenmon
- 
- .PHONY: uninstall
- uninstall:
---- xen-4.11.0/tools/python/Makefile.orig	2018-07-09 14:47:19.000000000 +0100
-+++ xen-4.11.0/tools/python/Makefile	2018-09-10 21:21:07.097979007 +0100
-@@ -20,8 +20,8 @@
- 		setup.py install --record $(INSTALL_LOG) $(PYTHON_PREFIX_ARG) \
- 		--root="$(DESTDIR)" --force
- 
--	$(INSTALL_PROG) scripts/convert-legacy-stream $(DESTDIR)$(LIBEXEC_BIN)
--	$(INSTALL_PROG) scripts/verify-stream-v2 $(DESTDIR)$(LIBEXEC_BIN)
-+	$(INSTALL_PYTHON_PROG) scripts/convert-legacy-stream $(DESTDIR)$(LIBEXEC_BIN)
-+	$(INSTALL_PYTHON_PROG) scripts/verify-stream-v2 $(DESTDIR)$(LIBEXEC_BIN)
- 
- .PHONY: uninstall
- uninstall:
---- xen-4.11.0/tools/python/install-wrap.orig	2018-07-09 14:47:19.000000000 +0100
-+++ xen-4.11.0/tools/python/install-wrap	2018-09-11 20:09:57.803655357 +0100
-@@ -44,7 +44,7 @@
- destf="$dest"
- for srcf in ${srcs}; do
- 	if test -d "$dest"; then
--		destf="$dest/${srcf%%*/}"
-+		destf="$dest/${srcf##*/}"
- 	fi
- 	org="$(sed -n '2q; /^#! *\/usr\/bin\/env python *$/p' $srcf)"
- 	if test "x$org" = x; then
---- xen-4.11.0/tools/misc/xencov_split.orig	2018-07-09 14:47:19.000000000 +0100
-+++ xen-4.11.0/tools/misc/xencov_split	2018-09-18 21:56:07.397893895 +0100
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/python3
- 
- import sys, os, os.path as path, struct, errno
- from optparse import OptionParser

xen.python3.12.patch

@@ -0,0 +1,22 @@
+--- xen-4.17.1/tools/python/Makefile.orig	2023-04-27 13:53:19.000000000 +0100
++++ xen-4.17.1/tools/python/Makefile	2023-06-22 22:21:25.287486906 +0100
+@@ -4,7 +4,7 @@
+ .PHONY: all
+ all: build
+ 
+-PY_CFLAGS = $(CFLAGS) $(PY_NOOPT_CFLAGS)
++PY_CFLAGS = $(CFLAGS) $(PY_NOOPT_CFLAGS) -Wno-error=declaration-after-statement
+ PY_LDFLAGS = $(SHLIB_LDFLAGS) $(APPEND_LDFLAGS)
+ INSTALL_LOG = build/installed_files.txt
+ 
+--- xen-4.17.1/tools/pygrub/Makefile.orig	2023-04-27 13:53:19.000000000 +0100
++++ xen-4.17.1/tools/pygrub/Makefile	2023-06-22 22:52:52.803047401 +0100
+@@ -2,7 +2,7 @@
+ XEN_ROOT = $(CURDIR)/../..
+ include $(XEN_ROOT)/tools/Rules.mk
+ 
+-PY_CFLAGS = $(CFLAGS) $(PY_NOOPT_CFLAGS)
++PY_CFLAGS = $(CFLAGS) $(PY_NOOPT_CFLAGS) -Wno-error=declaration-after-statement
+ PY_LDFLAGS = $(SHLIB_LDFLAGS) $(APPEND_LDFLAGS)
+ INSTALL_LOG = build/installed_files.txt
+ 

xen.python38.patch

@@ -1,94 +0,0 @@
---- xen-4.12.0/m4/python_devel.m4.orig	2019-05-31 23:30:42.489738121 +0100
-+++ xen-4.12.0/m4/python_devel.m4	2019-06-01 17:02:38.886934441 +0100
-@@ -24,7 +24,8 @@
-     dnl If python-config is found use it
-     CPPFLAGS="$CFLAGS `$PYTHON-config --cflags`"
-     LDFLAGS="$LDFLAGS `$PYTHON-config --ldflags`"
--    LIBS="$LIBS `$PYTHON-config --libs`"
-+    LIBSTMP="`$PYTHON-config --libs --embed`" || LIBSTMP="`$PYTHON-config --libs`"
-+    LIBS="$LIBS $LIBSTMP"
- ])
- 
- AC_CHECK_HEADER([Python.h], [],
---- xen-4.12.0/tools/configure.orig	2019-05-31 23:30:42.498738452 +0100
-+++ xen-4.12.0/tools/configure	2019-06-01 17:08:26.100727658 +0100
-@@ -7482,7 +7482,8 @@
- 
-         CPPFLAGS="$CFLAGS `$PYTHON-config --cflags`"
-     LDFLAGS="$LDFLAGS `$PYTHON-config --ldflags`"
--    LIBS="$LIBS `$PYTHON-config --libs`"
-+    LIBSTMP="`$PYTHON-config --libs --embed`" || LIBSTMP="`$PYTHON-config --libs`"
-+    LIBS="$LIBS $LIBSTMP"
- 
- fi
- 
---- xen-4.12.0/tools/python/xen/lowlevel/xc/xc.c.orig	2019-04-01 12:03:23.000000000 +0100
-+++ xen-4.12.0/tools/python/xen/lowlevel/xc/xc.c	2019-06-01 17:58:39.567729630 +0100
-@@ -118,7 +118,8 @@
-                                     PyObject *kwds)
- {
-     uint32_t dom = 0, target = 0;
--    int      ret, i;
-+    int      ret;
-+    unsigned int i;
-     PyObject *pyhandle = NULL;
-     struct xen_domctl_createdomain config = {
-         .handle = {
-@@ -296,7 +297,7 @@
- 
- static PyObject *pyxc_domain_sethandle(XcObject *self, PyObject *args)
- {
--    int i;
-+    unsigned int i;
-     uint32_t dom;
-     PyObject *pyhandle;
-     xen_domain_handle_t handle;
-@@ -337,7 +338,8 @@
-     PyObject *list, *info_dict, *pyhandle;
- 
-     uint32_t first_dom = 0;
--    int max_doms = 1024, nr_doms, i, j;
-+    int max_doms = 1024, nr_doms, i;
-+    unsigned int j;
-     xc_dominfo_t *info;
- 
-     static char *kwd_list[] = { "first_dom", "max_doms", NULL };
-@@ -632,7 +634,8 @@
- {
-     uint32_t sbdf;
-     uint32_t max_sdevs, num_sdevs;
--    int domid, seg, bus, dev, func, rc, i;
-+    int domid, seg, bus, dev, func, rc;
-+    unsigned int i;
-     PyObject *Pystr;
-     char *group_str;
-     char dev_str[9];
-@@ -972,7 +975,7 @@
- {
-     xc_physinfo_t pinfo;
-     char cpu_cap[128], virt_caps[128], *p;
--    int i;
-+    unsigned int i;
-     const char *virtcap_names[] = { "hvm", "hvm_directio" };
- 
-     if ( xc_physinfo(self->xc_handle, &pinfo) != 0 )
---- xen-4.12.0/tools/python/xen/lowlevel/xs/xs.c.orig	2019-04-01 12:03:23.000000000 +0100
-+++ xen-4.12.0/tools/python/xen/lowlevel/xs/xs.c	2019-06-01 18:59:46.316760561 +0100
-@@ -186,7 +186,7 @@
-     Py_END_ALLOW_THREADS
- 
-     if (xsval) {
--        int i;
-+        unsigned int i;
-         PyObject *val = PyList_New(xsval_n);
-         for (i = 0; i < xsval_n; i++)
- #if PY_MAJOR_VERSION >= 3
-@@ -276,7 +276,7 @@
-     struct xs_handle *xh = xshandle(self);
-     struct xs_permissions *perms;
-     unsigned int perms_n = 0;
--    int i;
-+    unsigned int i;
- 
-     xs_transaction_t th;
-     char *thstr;

xsa296.patch

@@ -1,195 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: xen/hypercall: Don't use BUG() for parameter checking in hypercall_create_continuation()
-
-Since c/s 1d429034 "hypercall: update vcpu_op to take an unsigned vcpuid",
-which incorrectly swapped 'i' for 'u' in the parameter type list, guests have
-been able to hit the BUG() in next_args()'s default case.
-
-Correct these back to 'i'.
-
-In addition, make adjustments to prevent this class of issue from occurring in
-the future - crashing Xen is not an appropriate form of parameter checking.
-
-Capitalise NEXT_ARG() to catch all uses, to highlight that it is a macro doing
-non-function-like things behind the scenes, and undef it when appropriate.
-Implement a bad_fmt: block which prints an error, asserts unreachable, and
-crashes the guest.
-
-On the ARM side, drop all parameter checking of p.  It is asymmetric with the
-x86 side, and akin to expecting memcpy() or sprintf() to check their src/fmt
-parameter before use.  A caller passing "" or something other than a string
-literal will be obvious during code review.
-
-This is XSA-296.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Julien Grall <julien.grall@arm.com>
-
-diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
-index 941bbff4fe..a3da8e9c08 100644
---- a/xen/arch/arm/domain.c
-+++ b/xen/arch/arm/domain.c
-@@ -383,14 +383,15 @@ void sync_vcpu_execstate(struct vcpu *v)
-     /* Nothing to do -- no lazy switching */
- }
- 
--#define next_arg(fmt, args) ({                                              \
-+#define NEXT_ARG(fmt, args)                                                 \
-+({                                                                          \
-     unsigned long __arg;                                                    \
-     switch ( *(fmt)++ )                                                     \
-     {                                                                       \
-     case 'i': __arg = (unsigned long)va_arg(args, unsigned int);  break;    \
-     case 'l': __arg = (unsigned long)va_arg(args, unsigned long); break;    \
-     case 'h': __arg = (unsigned long)va_arg(args, void *);        break;    \
--    default:  __arg = 0; BUG();                                             \
-+    default:  goto bad_fmt;                                                 \
-     }                                                                       \
-     __arg;                                                                  \
- })
-@@ -405,9 +406,6 @@ unsigned long hypercall_create_continuation(
-     unsigned int i;
-     va_list args;
- 
--    /* All hypercalls take at least one argument */
--    BUG_ON( !p || *p == '\0' );
--
-     current->hcall_preempted = true;
- 
-     va_start(args, format);
-@@ -415,7 +413,7 @@ unsigned long hypercall_create_continuation(
-     if ( mcs->flags & MCSF_in_multicall )
-     {
-         for ( i = 0; *p != '\0'; i++ )
--            mcs->call.args[i] = next_arg(p, args);
-+            mcs->call.args[i] = NEXT_ARG(p, args);
- 
-         /* Return value gets written back to mcs->call.result */
-         rc = mcs->call.result;
-@@ -431,7 +429,7 @@ unsigned long hypercall_create_continuation(
- 
-             for ( i = 0; *p != '\0'; i++ )
-             {
--                arg = next_arg(p, args);
-+                arg = NEXT_ARG(p, args);
- 
-                 switch ( i )
-                 {
-@@ -454,7 +452,7 @@ unsigned long hypercall_create_continuation(
- 
-             for ( i = 0; *p != '\0'; i++ )
-             {
--                arg = next_arg(p, args);
-+                arg = NEXT_ARG(p, args);
- 
-                 switch ( i )
-                 {
-@@ -475,8 +473,16 @@ unsigned long hypercall_create_continuation(
-     va_end(args);
- 
-     return rc;
-+
-+ bad_fmt:
-+    gprintk(XENLOG_ERR, "Bad hypercall continuation format '%c'\n", *p);
-+    ASSERT_UNREACHABLE();
-+    domain_crash(current->domain);
-+    return 0;
- }
- 
-+#undef NEXT_ARG
-+
- void startup_cpu_idle_loop(void)
- {
-     struct vcpu *v = current;
-diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
-index d483dbaa6b..4643e5eb43 100644
---- a/xen/arch/x86/hypercall.c
-+++ b/xen/arch/x86/hypercall.c
-@@ -80,14 +80,15 @@ const hypercall_args_t hypercall_args_table[NR_hypercalls] =
- #undef COMP
- #undef ARGS
- 
--#define next_arg(fmt, args) ({                                              \
-+#define NEXT_ARG(fmt, args)                                                 \
-+({                                                                          \
-     unsigned long __arg;                                                    \
-     switch ( *(fmt)++ )                                                     \
-     {                                                                       \
-     case 'i': __arg = (unsigned long)va_arg(args, unsigned int);  break;    \
-     case 'l': __arg = (unsigned long)va_arg(args, unsigned long); break;    \
-     case 'h': __arg = (unsigned long)va_arg(args, void *);        break;    \
--    default:  __arg = 0; BUG();                                             \
-+    default:  goto bad_fmt;                                                 \
-     }                                                                       \
-     __arg;                                                                  \
- })
-@@ -109,7 +110,7 @@ unsigned long hypercall_create_continuation(
-     if ( mcs->flags & MCSF_in_multicall )
-     {
-         for ( i = 0; *p != '\0'; i++ )
--            mcs->call.args[i] = next_arg(p, args);
-+            mcs->call.args[i] = NEXT_ARG(p, args);
-     }
-     else
-     {
-@@ -121,7 +122,7 @@ unsigned long hypercall_create_continuation(
-         {
-             for ( i = 0; *p != '\0'; i++ )
-             {
--                arg = next_arg(p, args);
-+                arg = NEXT_ARG(p, args);
-                 switch ( i )
-                 {
-                 case 0: regs->rdi = arg; break;
-@@ -137,7 +138,7 @@ unsigned long hypercall_create_continuation(
-         {
-             for ( i = 0; *p != '\0'; i++ )
-             {
--                arg = next_arg(p, args);
-+                arg = NEXT_ARG(p, args);
-                 switch ( i )
-                 {
-                 case 0: regs->rbx = arg; break;
-@@ -154,8 +155,16 @@ unsigned long hypercall_create_continuation(
-     va_end(args);
- 
-     return op;
-+
-+ bad_fmt:
-+    gprintk(XENLOG_ERR, "Bad hypercall continuation format '%c'\n", *p);
-+    ASSERT_UNREACHABLE();
-+    domain_crash(curr->domain);
-+    return 0;
- }
- 
-+#undef NEXT_ARG
-+
- int hypercall_xlat_continuation(unsigned int *id, unsigned int nr,
-                                 unsigned int mask, ...)
- {
-diff --git a/xen/common/compat/domain.c b/xen/common/compat/domain.c
-index 39877b3ab2..2531fa7421 100644
---- a/xen/common/compat/domain.c
-+++ b/xen/common/compat/domain.c
-@@ -81,7 +81,7 @@ int compat_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) ar
-         }
- 
-         if ( rc == -ERESTART )
--            rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iuh",
-+            rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iih",
-                                                cmd, vcpuid, arg);
- 
-         break;
-diff --git a/xen/common/domain.c b/xen/common/domain.c
-index 2308588052..65bcd85e34 100644
---- a/xen/common/domain.c
-+++ b/xen/common/domain.c
-@@ -1411,7 +1411,7 @@ long do_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
- 
-         rc = arch_initialise_vcpu(v, arg);
-         if ( rc == -ERESTART )
--            rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iuh",
-+            rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iih",
-                                                cmd, vcpuid, arg);
- 
-         break;

xsa298.patch

@@ -1,89 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: x86/PV: check GDT/LDT limits during emulation
-
-Accesses beyond the LDT limit originating from emulation would trigger
-the ASSERT() in pv_map_ldt_shadow_page(). On production builds such
-accesses would cause an attempt to promote the touched page (offset from
-the present LDT base address) to a segment descriptor one. If this
-happens to succeed, guest user mode would be able to elevate its
-privileges to that of the guest kernel. This is particularly easy when
-there's no LDT at all, in which case the LDT base stored internally to
-Xen is simply zero.
-
-Also adjust the ASSERT() that was triggering: It was off by one to
-begin with, and for production builds we also better use
-ASSERT_UNREACHABLE() instead with suitable recovery code afterwards.
-
-This is XSA-298.
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
----
-v2: Correct 64-bit-only limit check (by folding into the common one).
-
---- a/xen/arch/x86/pv/emul-gate-op.c
-+++ b/xen/arch/x86/pv/emul-gate-op.c
-@@ -51,7 +51,13 @@ static int read_gate_descriptor(unsigned
-     const seg_desc_t *pdesc = gdt_ldt_desc_ptr(gate_sel);
- 
-     if ( (gate_sel < 4) ||
--         ((gate_sel >= FIRST_RESERVED_GDT_BYTE) && !(gate_sel & 4)) ||
-+         /*
-+          * We're interested in call gates only, which occupy a single
-+          * seg_desc_t for 32-bit and a consecutive pair of them for 64-bit.
-+          */
-+         ((gate_sel >> 3) + !is_pv_32bit_vcpu(v) >=
-+          (gate_sel & 4 ? v->arch.pv.ldt_ents
-+                        : v->arch.pv.gdt_ents)) ||
-          __get_user(desc, pdesc) )
-         return 0;
- 
-@@ -70,7 +76,7 @@ static int read_gate_descriptor(unsigned
-     if ( !is_pv_32bit_vcpu(v) )
-     {
-         if ( (*ar & 0x1f00) != 0x0c00 ||
--             (gate_sel >= FIRST_RESERVED_GDT_BYTE - 8 && !(gate_sel & 4)) ||
-+             /* Limit check done above already. */
-              __get_user(desc, pdesc + 1) ||
-              (desc.b & 0x1f00) )
-             return 0;
---- a/xen/arch/x86/pv/emulate.c
-+++ b/xen/arch/x86/pv/emulate.c
-@@ -31,7 +31,14 @@ int pv_emul_read_descriptor(unsigned int
- {
-     seg_desc_t desc;
- 
--    if ( sel < 4)
-+    if ( sel < 4 ||
-+         /*
-+          * Don't apply the GDT limit here, as the selector may be a Xen
-+          * provided one. __get_user() will fail (without taking further
-+          * action) for ones falling in the gap between guest populated
-+          * and Xen ones.
-+          */
-+         ((sel & 4) && (sel >> 3) >= v->arch.pv.ldt_ents) )
-         desc.b = desc.a = 0;
-     else if ( __get_user(desc, gdt_ldt_desc_ptr(sel)) )
-         return 0;
---- a/xen/arch/x86/pv/mm.c
-+++ b/xen/arch/x86/pv/mm.c
-@@ -92,12 +92,16 @@ bool pv_map_ldt_shadow_page(unsigned int
-     BUG_ON(unlikely(in_irq()));
- 
-     /*
--     * Hardware limit checking should guarantee this property.  NB. This is
-+     * Prior limit checking should guarantee this property.  NB. This is
-      * safe as updates to the LDT can only be made by MMUEXT_SET_LDT to the
-      * current vcpu, and vcpu_reset() will block until this vcpu has been
-      * descheduled before continuing.
-      */
--    ASSERT((offset >> 3) <= curr->arch.pv.ldt_ents);
-+    if ( unlikely((offset >> 3) >= curr->arch.pv.ldt_ents) )
-+    {
-+        ASSERT_UNREACHABLE();
-+        return false;
-+    }
- 
-     if ( is_pv_32bit_domain(currd) )
-         linear = (uint32_t)linear;

xsa299-4.12-0001-x86-mm-L1TF-checks-don-t-leave-a-partial-entry.patch

@@ -1,94 +0,0 @@
-From 33d051917d5ef38f678b507a3c832afde48b9b49 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 01/11] x86/mm: L1TF checks don't leave a partial entry
-
-On detection of a potential L1TF issue, most validation code returns
--ERESTART to allow the switch to shadow mode to happen and cause the
-original operation to be restarted.
-
-However, in the validation code, the return value -ERESTART has been
-repurposed to indicate 1) the function has partially completed
-something which needs to be undone, and 2) calling put_page_type()
-should cleanly undo it.  This causes problems in several places.
-
-For L1 tables, on receiving an -ERESTART return from alloc_l1_table(),
-alloc_page_type() will set PGT_partial on the page.  If for some
-reason the original operation never restarts, then on domain
-destruction, relinquish_memory() will call free_page_type() on the
-page.
-
-Unfortunately, alloc_ and free_l1_table() aren't set up to deal with
-PGT_partial.  When returning a failure, alloc_l1_table() always
-de-validates whatever it's validated so far, and free_l1_table()
-always devalidates the whole page.  This means that if
-relinquish_memory() calls free_page_type() on an L1 that didn't
-complete due to an L1TF, it will call put_page_from_l1e() on "page
-entries" that have never been validated.
-
-For L2+ tables, setting rc to ERESTART causes the rest of the
-alloc_lN_table() function to *think* that the entry in question will
-have PGT_partial set.  This will cause it to set partial_pte = 1.  If
-relinqush_memory() then calls free_page_type() on one of those pages,
-then free_lN_table() will call put_page_from_lNe() on the entry when
-it shouldn't.
-
-Rather than indicating -ERESTART, indicate -EINTR.  This is the code
-to indicate that nothing has changed from when you started the call
-(which is effectively how alloc_l1_table() handles errors).
-
-mod_lN_entry() shouldn't have any of these types of problems, so leave
-potential changes there for a clean-up patch later.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 3557cd1178..a1b55c10ff 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1409,7 +1409,7 @@ static int alloc_l1_table(struct page_info *page)
-     {
-         if ( !(l1e_get_flags(pl1e[i]) & _PAGE_PRESENT) )
-         {
--            ret = pv_l1tf_check_l1e(d, pl1e[i]) ? -ERESTART : 0;
-+            ret = pv_l1tf_check_l1e(d, pl1e[i]) ? -EINTR : 0;
-             if ( ret )
-                 goto out;
-         }
-@@ -1517,7 +1517,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-         {
-             if ( !pv_l1tf_check_l2e(d, l2e) )
-                 continue;
--            rc = -ERESTART;
-+            rc = -EINTR;
-         }
-         else
-             rc = get_page_from_l2e(l2e, pfn, d, partial);
-@@ -1603,7 +1603,7 @@ static int alloc_l3_table(struct page_info *page)
-         {
-             if ( !pv_l1tf_check_l3e(d, l3e) )
-                 continue;
--            rc = -ERESTART;
-+            rc = -EINTR;
-         }
-         else
-             rc = get_page_from_l3e(l3e, pfn, d, partial);
-@@ -1783,7 +1783,7 @@ static int alloc_l4_table(struct page_info *page)
-         {
-             if ( !pv_l1tf_check_l4e(d, l4e) )
-                 continue;
--            rc = -ERESTART;
-+            rc = -EINTR;
-         }
-         else
-             rc = get_page_from_l4e(l4e, pfn, d, partial);
--- 
-2.23.0
-

xsa299-4.12-0002-x86-mm-Don-t-re-set-PGT_pinned-on-a-partially-de-val.patch

@@ -1,99 +0,0 @@
-From b490792c18f74b76ec8161721c1e07f810e36309 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 02/11] x86/mm: Don't re-set PGT_pinned on a partially
- de-validated page
-
-When unpinning pagetables, if an operation is interrupted,
-relinquish_memory() re-sets PGT_pinned so that the un-pin will
-pickedup again when the hypercall restarts.
-
-This is appropriate when put_page_and_type_preemptible() returns
--EINTR, which indicates that the page is back in its initial state
-(i.e., completely validated).  However, for -ERESTART, this leads to a
-state where a page has both PGT_pinned and PGT_partial set.
-
-This happens to work at the moment, although it's not really a
-"canonical" state; but in subsequent patches, where we need to make a
-distinction in handling between PGT_validated and PGT_partial pages,
-this causes issues.
-
-Move to a "canonical" state by:
-- Only re-setting PGT_pinned on -EINTR
-- Re-dropping the refcount held by PGT_pinned on -ERESTART
-
-In the latter case, the PGT_partial bit will be cleared further down
-with the rest of the other PGT_partial pages.
-
-While here, clean up some trainling whitespace.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/domain.c | 31 ++++++++++++++++++++++++++++---
- 1 file changed, 28 insertions(+), 3 deletions(-)
-
-diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
-index 2585327834..59df8a6d8d 100644
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -114,7 +114,7 @@ static void play_dead(void)
-      * this case, heap corruption or #PF can occur (when heap debugging is
-      * enabled). For example, even printk() can involve tasklet scheduling,
-      * which touches per-cpu vars.
--     * 
-+     *
-      * Consider very carefully when adding code to *dead_idle. Most hypervisor
-      * subsystems are unsafe to call.
-      */
-@@ -1909,9 +1909,34 @@ static int relinquish_memory(
-             break;
-         case -ERESTART:
-         case -EINTR:
-+            /*
-+             * -EINTR means PGT_validated has been re-set; re-set
-+             * PGT_pinned again so that it gets picked up next time
-+             * around.
-+             *
-+             * -ERESTART, OTOH, means PGT_partial is set instead.  Put
-+             * it back on the list, but don't set PGT_pinned; the
-+             * section below will finish off de-validation.  But we do
-+             * need to drop the general ref associated with
-+             * PGT_pinned, since put_page_and_type_preemptible()
-+             * didn't do it.
-+             *
-+             * NB we can do an ASSERT for PGT_validated, since we
-+             * "own" the type ref; but theoretically, the PGT_partial
-+             * could be cleared by someone else.
-+             */
-+            if ( ret == -EINTR )
-+            {
-+                ASSERT(page->u.inuse.type_info & PGT_validated);
-+                set_bit(_PGT_pinned, &page->u.inuse.type_info);
-+            }
-+            else
-+                put_page(page);
-+
-             ret = -ERESTART;
-+
-+            /* Put the page back on the list and drop the ref we grabbed above */
-             page_list_add(page, list);
--            set_bit(_PGT_pinned, &page->u.inuse.type_info);
-             put_page(page);
-             goto out;
-         default:
-@@ -2161,7 +2186,7 @@ void vcpu_kick(struct vcpu *v)
-      * pending flag. These values may fluctuate (after all, we hold no
-      * locks) but the key insight is that each change will cause
-      * evtchn_upcall_pending to be polled.
--     * 
-+     *
-      * NB2. We save the running flag across the unblock to avoid a needless
-      * IPI for domains that we IPI'd to unblock.
-      */
--- 
-2.23.0
-

xsa299-4.12-0003-x86-mm-Separate-out-partial_pte-tristate-into-indivi.patch

@@ -1,618 +0,0 @@
-From 0f9f61e5737fdd346550ec6e30161fa99e4653fa Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 03/11] x86/mm: Separate out partial_pte tristate into
- individual flags
-
-At the moment, partial_pte is a tri-state that contains two distinct bits
-of information:
-
-1. If zero, the pte at index [nr_validated_ptes] is un-validated.  If
-   non-zero, the pte was last seen with PGT_partial set.
-
-2. If positive, the pte at index [nr_validated_ptes] does not hold a
-   general reference count.  If negative, it does.
-
-To make future patches more clear, separate out this functionality
-into two distinct, named bits: PTF_partial_set (for #1) and
-PTF_partial_general_ref (for #2).
-
-Additionally, a number of functions which need this information also
-take other flags to control behavior (such as `preemptible` and
-`defer`).  These are hard to read in the caller (since you only see
-'true' or 'false'), and ugly when many are added together.  In
-preparation for adding yet another flag in a future patch, collapse
-all of these into a single `flag` variable.
-
-NB that this does mean checking for what was previously the '-1'
-condition a bit more ugly in the put_page_from_lNe functions (since
-you have to check for both partial_set and general ref); but this
-clause will go away in a future patch.
-
-Also note that the original comment had an off-by-one error:
-partial_flags (like partial_pte before it) concerns
-plNe[nr_validated_ptes], not plNe[nr_validated_ptes+1].
-
-No functional change intended.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c        | 165 ++++++++++++++++++++++++---------------
- xen/include/asm-x86/mm.h |  41 +++++++---
- 2 files changed, 128 insertions(+), 78 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index a1b55c10ff..3f6f8cc9b8 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1094,20 +1094,35 @@ get_page_from_l1e(
- }
- 
- #ifdef CONFIG_PV
-+
-+/*
-+ * The following flags are used to specify behavior of various get and
-+ * put commands.  The first two are also stored in page->partial_flags
-+ * to indicate the state of the page pointed to by
-+ * page->pte[page->nr_validated_entries].  See the comment in mm.h for
-+ * more information.
-+ */
-+#define PTF_partial_set         (1 << 0)
-+#define PTF_partial_general_ref (1 << 1)
-+#define PTF_preemptible         (1 << 2)
-+#define PTF_defer               (1 << 3)
-+
- static int get_page_and_type_from_mfn(
-     mfn_t mfn, unsigned long type, struct domain *d,
--    int partial, int preemptible)
-+    unsigned int flags)
- {
-     struct page_info *page = mfn_to_page(mfn);
-     int rc;
-+    bool preemptible = flags & PTF_preemptible,
-+         partial_ref = flags & PTF_partial_general_ref;
- 
--    if ( likely(partial >= 0) &&
-+    if ( likely(!partial_ref) &&
-          unlikely(!get_page_from_mfn(mfn, d)) )
-         return -EINVAL;
- 
-     rc = _get_page_type(page, type, preemptible);
- 
--    if ( unlikely(rc) && partial >= 0 &&
-+    if ( unlikely(rc) && !partial_ref &&
-          (!preemptible || page != current->arch.old_guest_table) )
-         put_page(page);
- 
-@@ -1117,7 +1132,7 @@ static int get_page_and_type_from_mfn(
- define_get_linear_pagetable(l2);
- static int
- get_page_from_l2e(
--    l2_pgentry_t l2e, unsigned long pfn, struct domain *d, int partial)
-+    l2_pgentry_t l2e, unsigned long pfn, struct domain *d, unsigned int flags)
- {
-     unsigned long mfn = l2e_get_pfn(l2e);
-     int rc;
-@@ -1129,8 +1144,9 @@ get_page_from_l2e(
-         return -EINVAL;
-     }
- 
--    rc = get_page_and_type_from_mfn(_mfn(mfn), PGT_l1_page_table, d,
--                                    partial, false);
-+    ASSERT(!(flags & PTF_preemptible));
-+
-+    rc = get_page_and_type_from_mfn(_mfn(mfn), PGT_l1_page_table, d, flags);
-     if ( unlikely(rc == -EINVAL) && get_l2_linear_pagetable(l2e, pfn, d) )
-         rc = 0;
- 
-@@ -1140,7 +1156,7 @@ get_page_from_l2e(
- define_get_linear_pagetable(l3);
- static int
- get_page_from_l3e(
--    l3_pgentry_t l3e, unsigned long pfn, struct domain *d, int partial)
-+    l3_pgentry_t l3e, unsigned long pfn, struct domain *d, unsigned int flags)
- {
-     int rc;
- 
-@@ -1152,7 +1168,7 @@ get_page_from_l3e(
-     }
- 
-     rc = get_page_and_type_from_mfn(
--        l3e_get_mfn(l3e), PGT_l2_page_table, d, partial, 1);
-+        l3e_get_mfn(l3e), PGT_l2_page_table, d, flags | PTF_preemptible);
-     if ( unlikely(rc == -EINVAL) &&
-          !is_pv_32bit_domain(d) &&
-          get_l3_linear_pagetable(l3e, pfn, d) )
-@@ -1164,7 +1180,7 @@ get_page_from_l3e(
- define_get_linear_pagetable(l4);
- static int
- get_page_from_l4e(
--    l4_pgentry_t l4e, unsigned long pfn, struct domain *d, int partial)
-+    l4_pgentry_t l4e, unsigned long pfn, struct domain *d, unsigned int flags)
- {
-     int rc;
- 
-@@ -1176,7 +1192,7 @@ get_page_from_l4e(
-     }
- 
-     rc = get_page_and_type_from_mfn(
--        l4e_get_mfn(l4e), PGT_l3_page_table, d, partial, 1);
-+        l4e_get_mfn(l4e), PGT_l3_page_table, d, flags | PTF_preemptible);
-     if ( unlikely(rc == -EINVAL) && get_l4_linear_pagetable(l4e, pfn, d) )
-         rc = 0;
- 
-@@ -1277,7 +1293,7 @@ static void put_data_page(struct page_info *page, bool writeable)
-  * Note also that this automatically deals correctly with linear p.t.'s.
-  */
- static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
--                             int partial, bool defer)
-+                             unsigned int flags)
- {
-     int rc = 0;
- 
-@@ -1300,12 +1316,13 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-         struct page_info *pg = l2e_get_page(l2e);
-         struct page_info *ptpg = mfn_to_page(_mfn(pfn));
- 
--        if ( unlikely(partial > 0) )
-+        if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-+              PTF_partial_set )
-         {
--            ASSERT(!defer);
-+            ASSERT(!(flags & PTF_defer));
-             rc = _put_page_type(pg, true, ptpg);
-         }
--        else if ( defer )
-+        else if ( flags & PTF_defer )
-         {
-             current->arch.old_guest_ptpg = ptpg;
-             current->arch.old_guest_table = pg;
-@@ -1322,7 +1339,7 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
- }
- 
- static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
--                             int partial, bool defer)
-+                             unsigned int flags)
- {
-     struct page_info *pg;
-     int rc;
-@@ -1345,13 +1362,14 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
- 
-     pg = l3e_get_page(l3e);
- 
--    if ( unlikely(partial > 0) )
-+    if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-+         PTF_partial_set )
-     {
--        ASSERT(!defer);
-+        ASSERT(!(flags & PTF_defer));
-         return _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-     }
- 
--    if ( defer )
-+    if ( flags & PTF_defer )
-     {
-         current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-         current->arch.old_guest_table = pg;
-@@ -1366,7 +1384,7 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
- }
- 
- static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
--                             int partial, bool defer)
-+                             unsigned int flags)
- {
-     int rc = 1;
- 
-@@ -1375,13 +1393,14 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-     {
-         struct page_info *pg = l4e_get_page(l4e);
- 
--        if ( unlikely(partial > 0) )
-+        if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-+              PTF_partial_set )
-         {
--            ASSERT(!defer);
-+            ASSERT(!(flags & PTF_defer));
-             return _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-         }
- 
--        if ( defer )
-+        if ( flags & PTF_defer )
-         {
-             current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-             current->arch.old_guest_table = pg;
-@@ -1492,12 +1511,13 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-     unsigned long  pfn = mfn_x(page_to_mfn(page));
-     l2_pgentry_t  *pl2e;
-     unsigned int   i;
--    int            rc = 0, partial = page->partial_pte;
-+    int            rc = 0;
-+    unsigned int   partial_flags = page->partial_flags;
- 
-     pl2e = map_domain_page(_mfn(pfn));
- 
-     for ( i = page->nr_validated_ptes; i < L2_PAGETABLE_ENTRIES;
--          i++, partial = 0 )
-+          i++, partial_flags = 0 )
-     {
-         l2_pgentry_t l2e;
- 
-@@ -1520,17 +1540,18 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-             rc = -EINTR;
-         }
-         else
--            rc = get_page_from_l2e(l2e, pfn, d, partial);
-+            rc = get_page_from_l2e(l2e, pfn, d, partial_flags);
- 
-         if ( rc == -ERESTART )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = partial ?: 1;
-+            /* Set 'set', retain 'general ref' */
-+            page->partial_flags = partial_flags | PTF_partial_set;
-         }
-         else if ( rc == -EINTR && i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = 0;
-+            page->partial_flags = 0;
-             rc = -ERESTART;
-         }
-         else if ( rc < 0 && rc != -EINTR )
-@@ -1539,7 +1560,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-             if ( i )
-             {
-                 page->nr_validated_ptes = i;
--                page->partial_pte = 0;
-+                page->partial_flags = 0;
-                 current->arch.old_guest_ptpg = NULL;
-                 current->arch.old_guest_table = page;
-             }
-@@ -1563,7 +1584,8 @@ static int alloc_l3_table(struct page_info *page)
-     unsigned long  pfn = mfn_x(page_to_mfn(page));
-     l3_pgentry_t  *pl3e;
-     unsigned int   i;
--    int            rc = 0, partial = page->partial_pte;
-+    int            rc = 0;
-+    unsigned int   partial_flags = page->partial_flags;
- 
-     pl3e = map_domain_page(_mfn(pfn));
- 
-@@ -1578,7 +1600,7 @@ static int alloc_l3_table(struct page_info *page)
-         memset(pl3e + 4, 0, (L3_PAGETABLE_ENTRIES - 4) * sizeof(*pl3e));
- 
-     for ( i = page->nr_validated_ptes; i < L3_PAGETABLE_ENTRIES;
--          i++, partial = 0 )
-+          i++, partial_flags = 0 )
-     {
-         l3_pgentry_t l3e = pl3e[i];
- 
-@@ -1597,7 +1619,8 @@ static int alloc_l3_table(struct page_info *page)
-             else
-                 rc = get_page_and_type_from_mfn(
-                     l3e_get_mfn(l3e),
--                    PGT_l2_page_table | PGT_pae_xen_l2, d, partial, 1);
-+                    PGT_l2_page_table | PGT_pae_xen_l2, d,
-+                    partial_flags | PTF_preemptible);
-         }
-         else if ( !(l3e_get_flags(l3e) & _PAGE_PRESENT) )
-         {
-@@ -1606,17 +1629,18 @@ static int alloc_l3_table(struct page_info *page)
-             rc = -EINTR;
-         }
-         else
--            rc = get_page_from_l3e(l3e, pfn, d, partial);
-+            rc = get_page_from_l3e(l3e, pfn, d, partial_flags);
- 
-         if ( rc == -ERESTART )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = partial ?: 1;
-+            /* Set 'set', leave 'general ref' set if this entry was set */
-+            page->partial_flags = partial_flags | PTF_partial_set;
-         }
-         else if ( rc == -EINTR && i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = 0;
-+            page->partial_flags = 0;
-             rc = -ERESTART;
-         }
-         if ( rc < 0 )
-@@ -1633,7 +1657,7 @@ static int alloc_l3_table(struct page_info *page)
-         if ( i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = 0;
-+            page->partial_flags = 0;
-             current->arch.old_guest_ptpg = NULL;
-             current->arch.old_guest_table = page;
-         }
-@@ -1767,10 +1791,11 @@ static int alloc_l4_table(struct page_info *page)
-     unsigned long  pfn = mfn_x(page_to_mfn(page));
-     l4_pgentry_t  *pl4e = map_domain_page(_mfn(pfn));
-     unsigned int   i;
--    int            rc = 0, partial = page->partial_pte;
-+    int            rc = 0;
-+    unsigned int   partial_flags = page->partial_flags;
- 
-     for ( i = page->nr_validated_ptes; i < L4_PAGETABLE_ENTRIES;
--          i++, partial = 0 )
-+          i++, partial_flags = 0 )
-     {
-         l4_pgentry_t l4e;
- 
-@@ -1786,12 +1811,13 @@ static int alloc_l4_table(struct page_info *page)
-             rc = -EINTR;
-         }
-         else
--            rc = get_page_from_l4e(l4e, pfn, d, partial);
-+            rc = get_page_from_l4e(l4e, pfn, d, partial_flags);
- 
-         if ( rc == -ERESTART )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_pte = partial ?: 1;
-+            /* Set 'set', leave 'general ref' set if this entry was set */
-+            page->partial_flags = partial_flags | PTF_partial_set;
-         }
-         else if ( rc < 0 )
-         {
-@@ -1801,7 +1827,7 @@ static int alloc_l4_table(struct page_info *page)
-             if ( i )
-             {
-                 page->nr_validated_ptes = i;
--                page->partial_pte = 0;
-+                page->partial_flags = 0;
-                 if ( rc == -EINTR )
-                     rc = -ERESTART;
-                 else
-@@ -1853,19 +1879,20 @@ static int free_l2_table(struct page_info *page)
-     struct domain *d = page_get_owner(page);
-     unsigned long pfn = mfn_x(page_to_mfn(page));
-     l2_pgentry_t *pl2e;
--    int rc = 0, partial = page->partial_pte;
--    unsigned int i = page->nr_validated_ptes - !partial;
-+    int rc = 0;
-+    unsigned int partial_flags = page->partial_flags,
-+        i = page->nr_validated_ptes - !(partial_flags & PTF_partial_set);
- 
-     pl2e = map_domain_page(_mfn(pfn));
- 
-     for ( ; ; )
-     {
-         if ( is_guest_l2_slot(d, page->u.inuse.type_info, i) )
--            rc = put_page_from_l2e(pl2e[i], pfn, partial, false);
-+            rc = put_page_from_l2e(pl2e[i], pfn, partial_flags);
-         if ( rc < 0 )
-             break;
- 
--        partial = 0;
-+        partial_flags = 0;
- 
-         if ( !i-- )
-             break;
-@@ -1887,12 +1914,14 @@ static int free_l2_table(struct page_info *page)
-     else if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_pte = partial ?: -1;
-+        page->partial_flags = (partial_flags & PTF_partial_set) ?
-+            partial_flags :
-+            (PTF_partial_set | PTF_partial_general_ref);
-     }
-     else if ( rc == -EINTR && i < L2_PAGETABLE_ENTRIES - 1 )
-     {
-         page->nr_validated_ptes = i + 1;
--        page->partial_pte = 0;
-+        page->partial_flags = 0;
-         rc = -ERESTART;
-     }
- 
-@@ -1904,18 +1933,19 @@ static int free_l3_table(struct page_info *page)
-     struct domain *d = page_get_owner(page);
-     unsigned long pfn = mfn_x(page_to_mfn(page));
-     l3_pgentry_t *pl3e;
--    int rc = 0, partial = page->partial_pte;
--    unsigned int  i = page->nr_validated_ptes - !partial;
-+    int rc = 0;
-+    unsigned int partial_flags = page->partial_flags,
-+        i = page->nr_validated_ptes - !(partial_flags & PTF_partial_set);
- 
-     pl3e = map_domain_page(_mfn(pfn));
- 
-     for ( ; ; )
-     {
--        rc = put_page_from_l3e(pl3e[i], pfn, partial, 0);
-+        rc = put_page_from_l3e(pl3e[i], pfn, partial_flags);
-         if ( rc < 0 )
-             break;
- 
--        partial = 0;
-+        partial_flags = 0;
-         if ( rc == 0 )
-             pl3e[i] = unadjust_guest_l3e(pl3e[i], d);
- 
-@@ -1934,12 +1964,14 @@ static int free_l3_table(struct page_info *page)
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_pte = partial ?: -1;
-+        page->partial_flags = (partial_flags & PTF_partial_set) ?
-+            partial_flags :
-+            (PTF_partial_set | PTF_partial_general_ref);
-     }
-     else if ( rc == -EINTR && i < L3_PAGETABLE_ENTRIES - 1 )
-     {
-         page->nr_validated_ptes = i + 1;
--        page->partial_pte = 0;
-+        page->partial_flags = 0;
-         rc = -ERESTART;
-     }
-     return rc > 0 ? 0 : rc;
-@@ -1950,26 +1982,29 @@ static int free_l4_table(struct page_info *page)
-     struct domain *d = page_get_owner(page);
-     unsigned long pfn = mfn_x(page_to_mfn(page));
-     l4_pgentry_t *pl4e = map_domain_page(_mfn(pfn));
--    int rc = 0, partial = page->partial_pte;
--    unsigned int  i = page->nr_validated_ptes - !partial;
-+    int rc = 0;
-+    unsigned partial_flags = page->partial_flags,
-+        i = page->nr_validated_ptes - !(partial_flags & PTF_partial_set);
- 
-     do {
-         if ( is_guest_l4_slot(d, i) )
--            rc = put_page_from_l4e(pl4e[i], pfn, partial, 0);
-+            rc = put_page_from_l4e(pl4e[i], pfn, partial_flags);
-         if ( rc < 0 )
-             break;
--        partial = 0;
-+        partial_flags = 0;
-     } while ( i-- );
- 
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_pte = partial ?: -1;
-+        page->partial_flags = (partial_flags & PTF_partial_set) ?
-+            partial_flags :
-+            (PTF_partial_set | PTF_partial_general_ref);
-     }
-     else if ( rc == -EINTR && i < L4_PAGETABLE_ENTRIES - 1 )
-     {
-         page->nr_validated_ptes = i + 1;
--        page->partial_pte = 0;
-+        page->partial_flags = 0;
-         rc = -ERESTART;
-     }
- 
-@@ -2247,7 +2282,7 @@ static int mod_l2_entry(l2_pgentry_t *pl2e,
-         return -EBUSY;
-     }
- 
--    put_page_from_l2e(ol2e, pfn, 0, true);
-+    put_page_from_l2e(ol2e, pfn, PTF_defer);
- 
-     return rc;
- }
-@@ -2315,7 +2350,7 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
-         if ( !create_pae_xen_mappings(d, pl3e) )
-             BUG();
- 
--    put_page_from_l3e(ol3e, pfn, 0, 1);
-+    put_page_from_l3e(ol3e, pfn, PTF_defer);
-     return rc;
- }
- 
-@@ -2378,7 +2413,7 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
-         return -EFAULT;
-     }
- 
--    put_page_from_l4e(ol4e, pfn, 0, 1);
-+    put_page_from_l4e(ol4e, pfn, PTF_defer);
-     return rc;
- }
- #endif /* CONFIG_PV */
-@@ -2649,7 +2684,7 @@ int free_page_type(struct page_info *page, unsigned long type,
-     if ( !(type & PGT_partial) )
-     {
-         page->nr_validated_ptes = 1U << PAGETABLE_ORDER;
--        page->partial_pte = 0;
-+        page->partial_flags = 0;
-     }
- 
-     switch ( type & PGT_type_mask )
-@@ -2946,7 +2981,7 @@ static int _get_page_type(struct page_info *page, unsigned long type,
-         if ( !(x & PGT_partial) )
-         {
-             page->nr_validated_ptes = 0;
--            page->partial_pte = 0;
-+            page->partial_flags = 0;
-         }
-         page->linear_pt_count = 0;
-         rc = alloc_page_type(page, type, preemptible);
-@@ -3122,7 +3157,7 @@ int new_guest_cr3(mfn_t mfn)
-         return 0;
-     }
- 
--    rc = get_page_and_type_from_mfn(mfn, PGT_root_page_table, d, 0, 1);
-+    rc = get_page_and_type_from_mfn(mfn, PGT_root_page_table, d, PTF_preemptible);
-     switch ( rc )
-     {
-     case 0:
-@@ -3473,7 +3508,7 @@ long do_mmuext_op(
-             if ( op.arg1.mfn != 0 )
-             {
-                 rc = get_page_and_type_from_mfn(
--                    _mfn(op.arg1.mfn), PGT_root_page_table, currd, 0, 1);
-+                    _mfn(op.arg1.mfn), PGT_root_page_table, currd, PTF_preemptible);
- 
-                 if ( unlikely(rc) )
-                 {
-diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
-index 6faa563167..8406ac3c37 100644
---- a/xen/include/asm-x86/mm.h
-+++ b/xen/include/asm-x86/mm.h
-@@ -228,19 +228,34 @@ struct page_info
-          * setting the flag must not drop that reference, whereas the instance
-          * clearing it will have to.
-          *
--         * If @partial_pte is positive then PTE at @nr_validated_ptes+1 has
--         * been partially validated. This implies that the general reference
--         * to the page (acquired from get_page_from_lNe()) would be dropped
--         * (again due to the apparent failure) and hence must be re-acquired
--         * when resuming the validation, but must not be dropped when picking
--         * up the page for invalidation.
-+         * If partial_flags & PTF_partial_set is set, then the page at
-+         * at @nr_validated_ptes had PGT_partial set as a result of an
-+         * operation on the current page.  (That page may or may not
-+         * still have PGT_partial set.)
-          *
--         * If @partial_pte is negative then PTE at @nr_validated_ptes+1 has
--         * been partially invalidated. This is basically the opposite case of
--         * above, i.e. the general reference to the page was not dropped in
--         * put_page_from_lNe() (due to the apparent failure), and hence it
--         * must be dropped when the put operation is resumed (and completes),
--         * but it must not be acquired if picking up the page for validation.
-+         * If PTF_partial_general_ref is set, then the PTE at
-+         * @nr_validated_ptef holds a general reference count for the
-+         * page.
-+         *
-+         * This happens:
-+         * - During de-validation, if de-validation of the page was
-+         *   interrupted
-+         * - During validation, if an invalid entry is encountered and
-+         *   validation is preemptible
-+         * - During validation, if PTF_partial_general_ref was set on
-+         *   this entry to begin with (perhaps because we're picking
-+         *   up from a partial de-validation).
-+         *
-+         * When resuming validation, if PTF_partial_general_ref is clear,
-+         * then a general reference must be re-acquired; if it is set, no
-+         * reference should be acquired.
-+         *
-+         * When resuming de-validation, if PTF_partial_general_ref is
-+         * clear, no reference should be dropped; if it is set, a
-+         * reference should be dropped.
-+         *
-+         * NB that PTF_partial_set and PTF_partial_general_ref are
-+         * defined in mm.c, the only place where they are used.
-          *
-          * The 3rd field, @linear_pt_count, indicates
-          * - by a positive value, how many same-level page table entries a page
-@@ -251,7 +266,7 @@ struct page_info
-         struct {
-             u16 nr_validated_ptes:PAGETABLE_ORDER + 1;
-             u16 :16 - PAGETABLE_ORDER - 1 - 2;
--            s16 partial_pte:2;
-+            u16 partial_flags:2;
-             s16 linear_pt_count;
-         };
- 
--- 
-2.23.0
-

xsa299-4.12-0004-x86-mm-Use-flags-for-_put_page_type-rather-than-a-bo.patch

@@ -1,140 +0,0 @@
-From db1d801aa8dcb918a27486a6e8d9cf5d7307dec3 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 04/11] x86/mm: Use flags for _put_page_type rather than a
- boolean
-
-This is in mainly in preparation for _put_page_type taking the
-partial_flags value in the future.  It also makes it easier to read in
-the caller (since you see a flag name rather than `true` or `false`).
-
-No functional change intended.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 25 +++++++++++++------------
- 1 file changed, 13 insertions(+), 12 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 3f6f8cc9b8..0740b61af8 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1200,7 +1200,7 @@ get_page_from_l4e(
- }
- #endif /* CONFIG_PV */
- 
--static int _put_page_type(struct page_info *page, bool preemptible,
-+static int _put_page_type(struct page_info *page, unsigned int flags,
-                           struct page_info *ptpg);
- 
- void put_page_from_l1e(l1_pgentry_t l1e, struct domain *l1e_owner)
-@@ -1320,7 +1320,7 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-               PTF_partial_set )
-         {
-             ASSERT(!(flags & PTF_defer));
--            rc = _put_page_type(pg, true, ptpg);
-+            rc = _put_page_type(pg, PTF_preemptible, ptpg);
-         }
-         else if ( flags & PTF_defer )
-         {
-@@ -1329,7 +1329,7 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-         }
-         else
-         {
--            rc = _put_page_type(pg, true, ptpg);
-+            rc = _put_page_type(pg, PTF_preemptible, ptpg);
-             if ( likely(!rc) )
-                 put_page(pg);
-         }
-@@ -1366,7 +1366,7 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
-          PTF_partial_set )
-     {
-         ASSERT(!(flags & PTF_defer));
--        return _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-+        return _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-     }
- 
-     if ( flags & PTF_defer )
-@@ -1376,7 +1376,7 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
-         return 0;
-     }
- 
--    rc = _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-+    rc = _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-     if ( likely(!rc) )
-         put_page(pg);
- 
-@@ -1397,7 +1397,7 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-               PTF_partial_set )
-         {
-             ASSERT(!(flags & PTF_defer));
--            return _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-+            return _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-         }
- 
-         if ( flags & PTF_defer )
-@@ -1407,7 +1407,7 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-             return 0;
-         }
- 
--        rc = _put_page_type(pg, true, mfn_to_page(_mfn(pfn)));
-+        rc = _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-         if ( likely(!rc) )
-             put_page(pg);
-     }
-@@ -2757,10 +2757,11 @@ static int _put_final_page_type(struct page_info *page, unsigned long type,
- }
- 
- 
--static int _put_page_type(struct page_info *page, bool preemptible,
-+static int _put_page_type(struct page_info *page, unsigned int flags,
-                           struct page_info *ptpg)
- {
-     unsigned long nx, x, y = page->u.inuse.type_info;
-+    bool preemptible = flags & PTF_preemptible;
- 
-     ASSERT(current_locked_page_ne_check(page));
- 
-@@ -2969,7 +2970,7 @@ static int _get_page_type(struct page_info *page, unsigned long type,
- 
-             if ( unlikely(iommu_ret) )
-             {
--                _put_page_type(page, false, NULL);
-+                _put_page_type(page, 0, NULL);
-                 rc = iommu_ret;
-                 goto out;
-             }
-@@ -2996,7 +2997,7 @@ static int _get_page_type(struct page_info *page, unsigned long type,
- 
- void put_page_type(struct page_info *page)
- {
--    int rc = _put_page_type(page, false, NULL);
-+    int rc = _put_page_type(page, 0, NULL);
-     ASSERT(rc == 0);
-     (void)rc;
- }
-@@ -3013,7 +3014,7 @@ int get_page_type(struct page_info *page, unsigned long type)
- 
- int put_page_type_preemptible(struct page_info *page)
- {
--    return _put_page_type(page, true, NULL);
-+    return _put_page_type(page, PTF_preemptible, NULL);
- }
- 
- int get_page_type_preemptible(struct page_info *page, unsigned long type)
-@@ -3030,7 +3031,7 @@ int put_old_guest_table(struct vcpu *v)
-     if ( !v->arch.old_guest_table )
-         return 0;
- 
--    switch ( rc = _put_page_type(v->arch.old_guest_table, true,
-+    switch ( rc = _put_page_type(v->arch.old_guest_table, PTF_preemptible,
-                                  v->arch.old_guest_ptpg) )
-     {
-     case -EINTR:
--- 
-2.23.0
-

xsa299-4.12-0005-x86-mm-Rework-get_page_and_type_from_mfn-conditional.patch

@@ -1,79 +0,0 @@
-From 6f257854c8778774210281c5c21028c4b7739b44 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 05/11] x86/mm: Rework get_page_and_type_from_mfn conditional
-
-Make it easier to read by declaring the conditions in which we will
-retain the ref, rather than the conditions under which we release it.
-
-The only way (page == current->arch.old_guest_table) can be true is if
-preemptible is true; so remove this from the query itself, and add an
-ASSERT() to that effect on the opposite path.
-
-No functional change intended.
-
-NB that alloc_lN_table() mishandle the "linear pt failure" situation
-described in the comment; this will be addressed in a future patch.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 39 +++++++++++++++++++++++++++++++++++++--
- 1 file changed, 37 insertions(+), 2 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 0740b61af8..0a4d39a2c3 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1122,8 +1122,43 @@ static int get_page_and_type_from_mfn(
- 
-     rc = _get_page_type(page, type, preemptible);
- 
--    if ( unlikely(rc) && !partial_ref &&
--         (!preemptible || page != current->arch.old_guest_table) )
-+    /*
-+     * Retain the refcount if:
-+     * - page is fully validated (rc == 0)
-+     * - page is not validated (rc < 0) but:
-+     *   - We came in with a reference (partial_ref)
-+     *   - page is partially validated but there's been an error
-+     *     (page == current->arch.old_guest_table)
-+     *
-+     * The partial_ref-on-error clause is worth an explanation.  There
-+     * are two scenarios where partial_ref might be true coming in:
-+     * - mfn has been partially demoted as type `type`; i.e. has
-+     *   PGT_partial set
-+     * - mfn has been partially demoted as L(type+1) (i.e., a linear
-+     *   page; e.g. we're being called from get_page_from_l2e with
-+     *   type == PGT_l1_table, but the mfn is PGT_l2_table)
-+     *
-+     * If there's an error, in the first case, _get_page_type will
-+     * either return -ERESTART, in which case we want to retain the
-+     * ref (as the caller will consider it retained), or -EINVAL, in
-+     * which case old_guest_table will be set; in both cases, we need
-+     * to retain the ref.
-+     *
-+     * In the second case, if there's an error, _get_page_type() can
-+     * *only* return -EINVAL, and *never* set old_guest_table.  In
-+     * that case we also want to retain the reference, to allow the
-+     * page to continue to be torn down (i.e., PGT_partial cleared)
-+     * safely.
-+     *
-+     * Also note that we shouldn't be able to leave with the reference
-+     * count retained unless we succeeded, or the operation was
-+     * preemptible.
-+     */
-+    if ( likely(!rc) || partial_ref )
-+        /* nothing */;
-+    else if ( page == current->arch.old_guest_table )
-+        ASSERT(preemptible);
-+    else
-         put_page(page);
- 
-     return rc;
--- 
-2.23.0
-

xsa299-4.12-0006-x86-mm-Have-alloc_l-23-_table-clear-partial_flags-wh.patch

@@ -1,111 +0,0 @@
-From 4ad70553611a7a4e4494d5a3b51b5cc295a488e0 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 06/11] x86/mm: Have alloc_l[23]_table clear partial_flags when
- preempting
-
-In order to allow recursive pagetable promotions and demotions to be
-interrupted, Xen must keep track of the state of the sub-pages
-promoted or demoted.  This is stored in two elements in the page
-struct: nr_entries_validated and partial_flags.
-
-The rule is that entries [0, nr_entries_validated) should always be
-validated and hold a general reference count.  If partial_flags is
-zero, then [nr_entries_validated] is not validated and no reference
-count is held.  If PTF_partial_set is set, then [nr_entries_validated]
-is partially validated.
-
-At the moment, a distinction is made between promotion and demotion
-with regard to whether the entry itself "holds" a general reference
-count: when entry promotion is interrupted (i.e., returns -ERESTART),
-the entry is not considered to hold a reference; when entry demotion
-is interrupted, the entry is still considered to hold a general
-reference.
-
-PTF_partial_general_ref is used to distinguish between these cases.
-If clear, it's a partial promotion => no general reference count held
-by the entry; if set, it's partial demotion, so a general reference
-count held.  Because promotions and demotions can be interleaved, this
-value is passed to get_page_and_type_from_mfn and put_page_from_l*e,
-to be able to properly handle reference counts.
-
-Unfortunately, when alloc_l[23]_table check hypercall_preempt_check()
-and return -ERESTART, they set nr_entries_validated, but don't clear
-partial_flags.
-
-If we were picking up from a previously-interrupted promotion, that
-means that PTF_partial_set would be set even though
-[nr_entries_validated] was not partially validated.  This means that
-if the page in this state were de-validated, put_page_type() would
-erroneously be called on that entry.
-
-Perhaps worse, if we were racing with a de-validation, then we might
-leave both PTF_partial_set and PTF_partial_general_ref; and when
-de-validation picked up again, both the type and the general ref would
-be erroneously dropped from [nr_entries_validated].
-
-In a sense, the real issue here is code duplication.  Rather than
-duplicate the interruption code, set rc to -EINTR and fall through to
-the code which already handles that case correctly.
-
-Given the logic at this point, it should be impossible for
-partial_flags to be non-zero; add an ASSERT() to catch any changes.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 25 ++++++-------------------
- 1 file changed, 6 insertions(+), 19 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 0a4d39a2c3..bbd29a68f4 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1554,21 +1554,13 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-     for ( i = page->nr_validated_ptes; i < L2_PAGETABLE_ENTRIES;
-           i++, partial_flags = 0 )
-     {
--        l2_pgentry_t l2e;
-+        l2_pgentry_t l2e = pl2e[i];
- 
-         if ( i > page->nr_validated_ptes && hypercall_preempt_check() )
--        {
--            page->nr_validated_ptes = i;
--            rc = -ERESTART;
--            break;
--        }
--
--        if ( !is_guest_l2_slot(d, type, i) )
-+            rc = -EINTR;
-+        else if ( !is_guest_l2_slot(d, type, i) )
-             continue;
--
--        l2e = pl2e[i];
--
--        if ( !(l2e_get_flags(l2e) & _PAGE_PRESENT) )
-+        else if ( !(l2e_get_flags(l2e) & _PAGE_PRESENT) )
-         {
-             if ( !pv_l1tf_check_l2e(d, l2e) )
-                 continue;
-@@ -1640,13 +1632,8 @@ static int alloc_l3_table(struct page_info *page)
-         l3_pgentry_t l3e = pl3e[i];
- 
-         if ( i > page->nr_validated_ptes && hypercall_preempt_check() )
--        {
--            page->nr_validated_ptes = i;
--            rc = -ERESTART;
--            break;
--        }
--
--        if ( is_pv_32bit_domain(d) && (i == 3) )
-+            rc = -EINTR;
-+        else if ( is_pv_32bit_domain(d) && (i == 3) )
-         {
-             if ( !(l3e_get_flags(l3e) & _PAGE_PRESENT) ||
-                  (l3e_get_flags(l3e) & l3_disallow_mask(d)) )
--- 
-2.23.0
-

xsa299-4.12-0007-x86-mm-Always-retain-a-general-ref-on-partial.patch

@@ -1,378 +0,0 @@
-From 51fe4e67d954649fcf103116be6206a769f0db1e Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 07/11] x86/mm: Always retain a general ref on partial
-
-In order to allow recursive pagetable promotions and demotions to be
-interrupted, Xen must keep track of the state of the sub-pages
-promoted or demoted.  This is stored in two elements in the page struct:
-nr_entries_validated and partial_flags.
-
-The rule is that entries [0, nr_entries_validated) should always be
-validated and hold a general reference count.  If partial_flags is
-zero, then [nr_entries_validated] is not validated and no reference
-count is held.  If PTF_partial_set is set, then [nr_entries_validated]
-is partially validated.
-
-At the moment, a distinction is made between promotion and demotion
-with regard to whether the entry itself "holds" a general reference
-count: when entry promotion is interrupted (i.e., returns -ERESTART),
-the entry is not considered to hold a reference; when entry demotion
-is interrupted, the entry is still considered to hold a general
-reference.
-
-PTF_partial_general_ref is used to distinguish between these cases.
-If clear, it's a partial promotion => no general reference count held
-by the entry; if set, it's partial demotion, so a general reference
-count held.  Because promotions and demotions can be interleaved, this
-value is passed to get_page_and_type_from_mfn and put_page_from_l*e,
-to be able to properly handle reference counts.
-
-Unfortunately, because a refcount is not held, it is possible to
-engineer a situation where PFT_partial_set is set but the page in
-question has been assigned to another domain.  A sketch is provided in
-the appendix.
-
-Fix this by having the parent page table entry hold a general
-reference count whenever PFT_partial_set is set.  (For clarity of
-change, keep two separate flags.  These will be collapsed in a
-subsequent changeset.)
-
-This has two basic implications.  On the put_page_from_lNe() side,
-this mean that the (partial_set && !partial_ref) case can never happen,
-and no longer needs to be special-cased.
-
-Secondly, because both flags are set together, there's no need to carry over
-existing bits from partial_pte.
-
-(NB there is still another issue with calling _put_page_type() on a
-page which had PGT_partial set; that will be handled in a subsequent
-patch.)
-
-On the get_page_and_type_from_mfn() side, we need to distinguish
-between callers which hold a reference on partial (i.e.,
-alloc_lN_table()), and those which do not (new_cr3, PIN_LN_TABLE, and
-so on): pass a flag if the type should be retained on interruption.
-
-NB that since l1 promotion can't be preempted, that get_page_from_l2e
-can't return -ERESTART.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
------
-* Appendix: Engineering PTF_partial_set while a page belongs to a
-  foreign domain
-
-Suppose A is a page which can be promoted to an l3, and B is a page
-which can be promoted to an l2, and A[x] points to B.  B has
-PGC_allocated set but no other general references.
-
-V1:  PIN_L3 A.
-  A is validated, B is validated.
-  A.type_count = 1 | PGT_validated | PGT_pinned
-  B.type_count = 1 | PGT_validated
-  B.count = 2 | PGC_allocated (A[x] holds a general ref)
-
-V1: UNPIN A.
-  A begins de-validation.
-  Arrange to be interrupted when i < x
-  V1->old_guest_table = A
-  V1->old_guest_table_ref_held = false
-  A.type_count = 1 | PGT_partial
-  A.nr_validated_entries = i < x
-  B.type_count = 0
-  B.count = 1 | PGC_allocated
-
-V2: MOD_L4_ENTRY to point some l4e to A.
-  Picks up re-validation of A.
-  Arrange to be interrupted halfway through B's validation
-  B.type_count = 1 | PGT_partial
-  B.count = 2 | PGC_allocated (PGT_partial holds a general ref)
-  A.type_count = 1 | PGT_partial
-  A.nr_validated_entries = x
-  A.partial_pte = PTF_partial_set
-
-V3: MOD_L3_ENTRY to point some other l3e (not in A) to B.
-  Validates B.
-  B.type_count = 1 | PGT_validated
-  B.count = 2 | PGC_allocated ("other l3e" holds a general ref)
-
-V3: MOD_L3_ENTRY to clear l3e pointing to B.
-  Devalidates B.
-  B.type_count = 0
-  B.count = 1 | PGC_allocated
-
-V3: decrease_reservation(B)
-  Clears PGC_allocated
-  B.count = 0 => B is freed
-
-B gets assigned to a different domain
-
-V1: Restarts UNPIN of A
-  put_old_guest_table(A)
-    ...
-      free_l3_table(A)
-
-Now since A.partial_flags has PTF_partial_set, free_l3_table() will
-call put_page_from_l3e() on A[x], which points to B, while B is owned
-by another domain.
-
-If A[x] held a general refcount for B on partial validation, as it does
-for partial de-validation, then B would still have a reference count of
-1 after PGC_allocated was freed; so B wouldn't be freed until after
-put_page_from_l3e() had happend on A[x].
----
- xen/arch/x86/mm.c        | 84 +++++++++++++++++++++++-----------------
- xen/include/asm-x86/mm.h | 15 ++++---
- 2 files changed, 58 insertions(+), 41 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index bbd29a68f4..4d3ebf341d 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1102,10 +1102,11 @@ get_page_from_l1e(
-  * page->pte[page->nr_validated_entries].  See the comment in mm.h for
-  * more information.
-  */
--#define PTF_partial_set         (1 << 0)
--#define PTF_partial_general_ref (1 << 1)
--#define PTF_preemptible         (1 << 2)
--#define PTF_defer               (1 << 3)
-+#define PTF_partial_set           (1 << 0)
-+#define PTF_partial_general_ref   (1 << 1)
-+#define PTF_preemptible           (1 << 2)
-+#define PTF_defer                 (1 << 3)
-+#define PTF_retain_ref_on_restart (1 << 4)
- 
- static int get_page_and_type_from_mfn(
-     mfn_t mfn, unsigned long type, struct domain *d,
-@@ -1114,7 +1115,11 @@ static int get_page_and_type_from_mfn(
-     struct page_info *page = mfn_to_page(mfn);
-     int rc;
-     bool preemptible = flags & PTF_preemptible,
--         partial_ref = flags & PTF_partial_general_ref;
-+         partial_ref = flags & PTF_partial_general_ref,
-+         partial_set = flags & PTF_partial_set,
-+         retain_ref  = flags & PTF_retain_ref_on_restart;
-+
-+    ASSERT(partial_ref == partial_set);
- 
-     if ( likely(!partial_ref) &&
-          unlikely(!get_page_from_mfn(mfn, d)) )
-@@ -1127,13 +1132,15 @@ static int get_page_and_type_from_mfn(
-      * - page is fully validated (rc == 0)
-      * - page is not validated (rc < 0) but:
-      *   - We came in with a reference (partial_ref)
-+     *   - page is partially validated (rc == -ERESTART), and the
-+     *     caller has asked the ref to be retained in that case
-      *   - page is partially validated but there's been an error
-      *     (page == current->arch.old_guest_table)
-      *
-      * The partial_ref-on-error clause is worth an explanation.  There
-      * are two scenarios where partial_ref might be true coming in:
--     * - mfn has been partially demoted as type `type`; i.e. has
--     *   PGT_partial set
-+     * - mfn has been partially promoted / demoted as type `type`;
-+     *   i.e. has PGT_partial set
-      * - mfn has been partially demoted as L(type+1) (i.e., a linear
-      *   page; e.g. we're being called from get_page_from_l2e with
-      *   type == PGT_l1_table, but the mfn is PGT_l2_table)
-@@ -1156,7 +1163,8 @@ static int get_page_and_type_from_mfn(
-      */
-     if ( likely(!rc) || partial_ref )
-         /* nothing */;
--    else if ( page == current->arch.old_guest_table )
-+    else if ( page == current->arch.old_guest_table ||
-+              (retain_ref && rc == -ERESTART) )
-         ASSERT(preemptible);
-     else
-         put_page(page);
-@@ -1354,8 +1362,8 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-         if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-               PTF_partial_set )
-         {
--            ASSERT(!(flags & PTF_defer));
--            rc = _put_page_type(pg, PTF_preemptible, ptpg);
-+            /* partial_set should always imply partial_ref */
-+            BUG();
-         }
-         else if ( flags & PTF_defer )
-         {
-@@ -1400,8 +1408,8 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
-     if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-          PTF_partial_set )
-     {
--        ASSERT(!(flags & PTF_defer));
--        return _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-+        /* partial_set should always imply partial_ref */
-+        BUG();
-     }
- 
-     if ( flags & PTF_defer )
-@@ -1431,8 +1439,8 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-         if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
-               PTF_partial_set )
-         {
--            ASSERT(!(flags & PTF_defer));
--            return _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-+            /* partial_set should always imply partial_ref */
-+            BUG();
-         }
- 
-         if ( flags & PTF_defer )
-@@ -1569,13 +1577,22 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-         else
-             rc = get_page_from_l2e(l2e, pfn, d, partial_flags);
- 
--        if ( rc == -ERESTART )
--        {
--            page->nr_validated_ptes = i;
--            /* Set 'set', retain 'general ref' */
--            page->partial_flags = partial_flags | PTF_partial_set;
--        }
--        else if ( rc == -EINTR && i )
-+        /*
-+         * It shouldn't be possible for get_page_from_l2e to return
-+         * -ERESTART, since we never call this with PTF_preemptible.
-+         * (alloc_l1_table may return -EINTR on an L1TF-vulnerable
-+         * entry.)
-+         *
-+         * NB that while on a "clean" promotion, we can never get
-+         * PGT_partial.  It is possible to arrange for an l2e to
-+         * contain a partially-devalidated l2; but in that case, both
-+         * of the following functions will fail anyway (the first
-+         * because the page in question is not an l1; the second
-+         * because the page is not fully validated).
-+         */
-+        ASSERT(rc != -ERESTART);
-+
-+        if ( rc == -EINTR && i )
-         {
-             page->nr_validated_ptes = i;
-             page->partial_flags = 0;
-@@ -1584,6 +1601,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-         else if ( rc < 0 && rc != -EINTR )
-         {
-             gdprintk(XENLOG_WARNING, "Failure in alloc_l2_table: slot %#x\n", i);
-+            ASSERT(current->arch.old_guest_table == NULL);
-             if ( i )
-             {
-                 page->nr_validated_ptes = i;
-@@ -1642,7 +1660,7 @@ static int alloc_l3_table(struct page_info *page)
-                 rc = get_page_and_type_from_mfn(
-                     l3e_get_mfn(l3e),
-                     PGT_l2_page_table | PGT_pae_xen_l2, d,
--                    partial_flags | PTF_preemptible);
-+                    partial_flags | PTF_preemptible | PTF_retain_ref_on_restart);
-         }
-         else if ( !(l3e_get_flags(l3e) & _PAGE_PRESENT) )
-         {
-@@ -1651,13 +1669,14 @@ static int alloc_l3_table(struct page_info *page)
-             rc = -EINTR;
-         }
-         else
--            rc = get_page_from_l3e(l3e, pfn, d, partial_flags);
-+            rc = get_page_from_l3e(l3e, pfn, d,
-+                                   partial_flags | PTF_retain_ref_on_restart);
- 
-         if ( rc == -ERESTART )
-         {
-             page->nr_validated_ptes = i;
-             /* Set 'set', leave 'general ref' set if this entry was set */
--            page->partial_flags = partial_flags | PTF_partial_set;
-+            page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-         }
-         else if ( rc == -EINTR && i )
-         {
-@@ -1833,13 +1852,14 @@ static int alloc_l4_table(struct page_info *page)
-             rc = -EINTR;
-         }
-         else
--            rc = get_page_from_l4e(l4e, pfn, d, partial_flags);
-+            rc = get_page_from_l4e(l4e, pfn, d,
-+                                   partial_flags | PTF_retain_ref_on_restart);
- 
-         if ( rc == -ERESTART )
-         {
-             page->nr_validated_ptes = i;
-             /* Set 'set', leave 'general ref' set if this entry was set */
--            page->partial_flags = partial_flags | PTF_partial_set;
-+            page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-         }
-         else if ( rc < 0 )
-         {
-@@ -1936,9 +1956,7 @@ static int free_l2_table(struct page_info *page)
-     else if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = (partial_flags & PTF_partial_set) ?
--            partial_flags :
--            (PTF_partial_set | PTF_partial_general_ref);
-+        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-     }
-     else if ( rc == -EINTR && i < L2_PAGETABLE_ENTRIES - 1 )
-     {
-@@ -1986,9 +2004,7 @@ static int free_l3_table(struct page_info *page)
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = (partial_flags & PTF_partial_set) ?
--            partial_flags :
--            (PTF_partial_set | PTF_partial_general_ref);
-+        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-     }
-     else if ( rc == -EINTR && i < L3_PAGETABLE_ENTRIES - 1 )
-     {
-@@ -2019,9 +2035,7 @@ static int free_l4_table(struct page_info *page)
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = (partial_flags & PTF_partial_set) ?
--            partial_flags :
--            (PTF_partial_set | PTF_partial_general_ref);
-+        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-     }
-     else if ( rc == -EINTR && i < L4_PAGETABLE_ENTRIES - 1 )
-     {
-diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
-index 8406ac3c37..02079e1324 100644
---- a/xen/include/asm-x86/mm.h
-+++ b/xen/include/asm-x86/mm.h
-@@ -238,22 +238,25 @@ struct page_info
-          * page.
-          *
-          * This happens:
--         * - During de-validation, if de-validation of the page was
-+         * - During validation or de-validation, if the operation was
-          *   interrupted
-          * - During validation, if an invalid entry is encountered and
-          *   validation is preemptible
-          * - During validation, if PTF_partial_general_ref was set on
--         *   this entry to begin with (perhaps because we're picking
--         *   up from a partial de-validation).
-+         *   this entry to begin with (perhaps because it picked up a
-+         *   previous operation)
-          *
--         * When resuming validation, if PTF_partial_general_ref is clear,
--         * then a general reference must be re-acquired; if it is set, no
--         * reference should be acquired.
-+         * When resuming validation, if PTF_partial_general_ref is
-+         * clear, then a general reference must be re-acquired; if it
-+         * is set, no reference should be acquired.
-          *
-          * When resuming de-validation, if PTF_partial_general_ref is
-          * clear, no reference should be dropped; if it is set, a
-          * reference should be dropped.
-          *
-+         * NB at the moment, PTF_partial_set should be set if and only if
-+         * PTF_partial_general_ref is set.
-+         *
-          * NB that PTF_partial_set and PTF_partial_general_ref are
-          * defined in mm.c, the only place where they are used.
-          *
--- 
-2.23.0
-

xsa299-4.12-0008-x86-mm-Collapse-PTF_partial_set-and-PTF_partial_gene.patch

@@ -1,227 +0,0 @@
-From 8a8d836f7f7418e659d37817a66cd7a6b115042b Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 08/11] x86/mm: Collapse PTF_partial_set and
- PTF_partial_general_ref into one
-
-...now that they are equivalent.  No functional change intended.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c        | 50 +++++++++++-----------------------------
- xen/include/asm-x86/mm.h | 29 +++++++++++------------
- 2 files changed, 26 insertions(+), 53 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 4d3ebf341d..886e93b8aa 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1097,13 +1097,12 @@ get_page_from_l1e(
- 
- /*
-  * The following flags are used to specify behavior of various get and
-- * put commands.  The first two are also stored in page->partial_flags
-- * to indicate the state of the page pointed to by
-+ * put commands.  The first is also stored in page->partial_flags to
-+ * indicate the state of the page pointed to by
-  * page->pte[page->nr_validated_entries].  See the comment in mm.h for
-  * more information.
-  */
- #define PTF_partial_set           (1 << 0)
--#define PTF_partial_general_ref   (1 << 1)
- #define PTF_preemptible           (1 << 2)
- #define PTF_defer                 (1 << 3)
- #define PTF_retain_ref_on_restart (1 << 4)
-@@ -1115,13 +1114,10 @@ static int get_page_and_type_from_mfn(
-     struct page_info *page = mfn_to_page(mfn);
-     int rc;
-     bool preemptible = flags & PTF_preemptible,
--         partial_ref = flags & PTF_partial_general_ref,
-          partial_set = flags & PTF_partial_set,
-          retain_ref  = flags & PTF_retain_ref_on_restart;
- 
--    ASSERT(partial_ref == partial_set);
--
--    if ( likely(!partial_ref) &&
-+    if ( likely(!partial_set) &&
-          unlikely(!get_page_from_mfn(mfn, d)) )
-         return -EINVAL;
- 
-@@ -1131,14 +1127,14 @@ static int get_page_and_type_from_mfn(
-      * Retain the refcount if:
-      * - page is fully validated (rc == 0)
-      * - page is not validated (rc < 0) but:
--     *   - We came in with a reference (partial_ref)
-+     *   - We came in with a reference (partial_set)
-      *   - page is partially validated (rc == -ERESTART), and the
-      *     caller has asked the ref to be retained in that case
-      *   - page is partially validated but there's been an error
-      *     (page == current->arch.old_guest_table)
-      *
--     * The partial_ref-on-error clause is worth an explanation.  There
--     * are two scenarios where partial_ref might be true coming in:
-+     * The partial_set-on-error clause is worth an explanation.  There
-+     * are two scenarios where partial_set might be true coming in:
-      * - mfn has been partially promoted / demoted as type `type`;
-      *   i.e. has PGT_partial set
-      * - mfn has been partially demoted as L(type+1) (i.e., a linear
-@@ -1161,7 +1157,7 @@ static int get_page_and_type_from_mfn(
-      * count retained unless we succeeded, or the operation was
-      * preemptible.
-      */
--    if ( likely(!rc) || partial_ref )
-+    if ( likely(!rc) || partial_set )
-         /* nothing */;
-     else if ( page == current->arch.old_guest_table ||
-               (retain_ref && rc == -ERESTART) )
-@@ -1359,13 +1355,7 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-         struct page_info *pg = l2e_get_page(l2e);
-         struct page_info *ptpg = mfn_to_page(_mfn(pfn));
- 
--        if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
--              PTF_partial_set )
--        {
--            /* partial_set should always imply partial_ref */
--            BUG();
--        }
--        else if ( flags & PTF_defer )
-+        if ( flags & PTF_defer )
-         {
-             current->arch.old_guest_ptpg = ptpg;
-             current->arch.old_guest_table = pg;
-@@ -1405,13 +1395,6 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
- 
-     pg = l3e_get_page(l3e);
- 
--    if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
--         PTF_partial_set )
--    {
--        /* partial_set should always imply partial_ref */
--        BUG();
--    }
--
-     if ( flags & PTF_defer )
-     {
-         current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-@@ -1436,13 +1419,6 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-     {
-         struct page_info *pg = l4e_get_page(l4e);
- 
--        if ( (flags & (PTF_partial_set | PTF_partial_general_ref)) ==
--              PTF_partial_set )
--        {
--            /* partial_set should always imply partial_ref */
--            BUG();
--        }
--
-         if ( flags & PTF_defer )
-         {
-             current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-@@ -1676,7 +1652,7 @@ static int alloc_l3_table(struct page_info *page)
-         {
-             page->nr_validated_ptes = i;
-             /* Set 'set', leave 'general ref' set if this entry was set */
--            page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-+            page->partial_flags = PTF_partial_set;
-         }
-         else if ( rc == -EINTR && i )
-         {
-@@ -1859,7 +1835,7 @@ static int alloc_l4_table(struct page_info *page)
-         {
-             page->nr_validated_ptes = i;
-             /* Set 'set', leave 'general ref' set if this entry was set */
--            page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-+            page->partial_flags = PTF_partial_set;
-         }
-         else if ( rc < 0 )
-         {
-@@ -1956,7 +1932,7 @@ static int free_l2_table(struct page_info *page)
-     else if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-+        page->partial_flags = PTF_partial_set;
-     }
-     else if ( rc == -EINTR && i < L2_PAGETABLE_ENTRIES - 1 )
-     {
-@@ -2004,7 +1980,7 @@ static int free_l3_table(struct page_info *page)
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-+        page->partial_flags = PTF_partial_set;
-     }
-     else if ( rc == -EINTR && i < L3_PAGETABLE_ENTRIES - 1 )
-     {
-@@ -2035,7 +2011,7 @@ static int free_l4_table(struct page_info *page)
-     if ( rc == -ERESTART )
-     {
-         page->nr_validated_ptes = i;
--        page->partial_flags = PTF_partial_set | PTF_partial_general_ref;
-+        page->partial_flags = PTF_partial_set;
-     }
-     else if ( rc == -EINTR && i < L4_PAGETABLE_ENTRIES - 1 )
-     {
-diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
-index 02079e1324..f0fd35bf6b 100644
---- a/xen/include/asm-x86/mm.h
-+++ b/xen/include/asm-x86/mm.h
-@@ -233,7 +233,7 @@ struct page_info
-          * operation on the current page.  (That page may or may not
-          * still have PGT_partial set.)
-          *
--         * If PTF_partial_general_ref is set, then the PTE at
-+         * Additionally, if PTF_partial_set is set, then the PTE at
-          * @nr_validated_ptef holds a general reference count for the
-          * page.
-          *
-@@ -242,23 +242,20 @@ struct page_info
-          *   interrupted
-          * - During validation, if an invalid entry is encountered and
-          *   validation is preemptible
--         * - During validation, if PTF_partial_general_ref was set on
--         *   this entry to begin with (perhaps because it picked up a
-+         * - During validation, if PTF_partial_set was set on this
-+         *   entry to begin with (perhaps because it picked up a
-          *   previous operation)
-          *
--         * When resuming validation, if PTF_partial_general_ref is
--         * clear, then a general reference must be re-acquired; if it
--         * is set, no reference should be acquired.
-+         * When resuming validation, if PTF_partial_set is clear, then
-+         * a general reference must be re-acquired; if it is set, no
-+         * reference should be acquired.
-          *
--         * When resuming de-validation, if PTF_partial_general_ref is
--         * clear, no reference should be dropped; if it is set, a
--         * reference should be dropped.
-+         * When resuming de-validation, if PTF_partial_set is clear,
-+         * no reference should be dropped; if it is set, a reference
-+         * should be dropped.
-          *
--         * NB at the moment, PTF_partial_set should be set if and only if
--         * PTF_partial_general_ref is set.
--         *
--         * NB that PTF_partial_set and PTF_partial_general_ref are
--         * defined in mm.c, the only place where they are used.
-+         * NB that PTF_partial_set is defined in mm.c, the only place
-+         * where it is used.
-          *
-          * The 3rd field, @linear_pt_count, indicates
-          * - by a positive value, how many same-level page table entries a page
-@@ -268,8 +265,8 @@ struct page_info
-          */
-         struct {
-             u16 nr_validated_ptes:PAGETABLE_ORDER + 1;
--            u16 :16 - PAGETABLE_ORDER - 1 - 2;
--            u16 partial_flags:2;
-+            u16 :16 - PAGETABLE_ORDER - 1 - 1;
-+            u16 partial_flags:1;
-             s16 linear_pt_count;
-         };
- 
--- 
-2.23.0
-

xsa299-4.12-0009-x86-mm-Properly-handle-linear-pagetable-promotion-fa.patch

@@ -1,106 +0,0 @@
-From da3d1d258e54fe600f7f75287183b74d957ec63b Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 09/11] x86/mm: Properly handle linear pagetable promotion
- failures
-
-In order to allow recursive pagetable promotions and demotions to be
-interrupted, Xen must keep track of the state of the sub-pages
-promoted or demoted.  This is stored in two elements in the page
-struct: nr_entries_validated and partial_flags.
-
-The rule is that entries [0, nr_entries_validated) should always be
-validated and hold a general reference count.  If partial_flags is
-zero, then [nr_entries_validated] is not validated and no reference
-count is held.  If PTF_partial_set is set, then [nr_entries_validated]
-is partially validated, and a general reference count is held.
-
-Unfortunately, in cases where an entry began with PTF_partial_set set,
-and get_page_from_lNe() returns -EINVAL, the PTF_partial_set bit is
-erroneously dropped.  (This scenario can be engineered mainly by the
-use of interleaving of promoting and demoting a page which has "linear
-pagetable" entries; see the appendix for a sketch.)  This means that
-we will "leak" a general reference count on the page in question,
-preventing the page from being freed.
-
-Fix this by setting page->partial_flags to the partial_flags local
-variable.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
------
-Appendix
-
-Suppose A and B can both be promoted to L2 pages, and A[x] points to B.
-
-V1: PIN_L2 B.
-  B.type_count = 1 | PGT_validated
-  B.count = 2 | PGC_allocated
-
-V1: MOD_L3_ENTRY pointing something to A.
-  In the process of validating A[x], grab an extra type / ref on B:
-  B.type_count = 2 | PGT_validated
-  B.count = 3 | PGC_allocated
-  A.type_count = 1 | PGT_validated
-  A.count = 2 | PGC_allocated
-
-V1: UNPIN B.
-  B.type_count = 1 | PGT_validate
-  B.count = 2 | PGC_allocated
-
-V1: MOD_L3_ENTRY removing the reference to A.
-  De-validate A, down to A[x], which points to B.
-  Drop the final type on B.  Arrange to be interrupted.
-  B.type_count = 1 | PGT_partial
-  B.count = 2 | PGC_allocated
-  A.type_count = 1 | PGT_partial
-  A.nr_validated_entries = x
-  A.partial_pte = -1
-
-V2: MOD_L3_ENTRY adds a reference to A.
-
-At this point, get_page_from_l2e(A[x]) tries
-get_page_and_type_from_mfn(), which fails because it's the wrong type;
-and get_l2_linear_pagetable() also fails, because B isn't validated as
-an l2 anymore.
----
- xen/arch/x86/mm.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 886e93b8aa..0a094291da 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1581,7 +1581,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-             if ( i )
-             {
-                 page->nr_validated_ptes = i;
--                page->partial_flags = 0;
-+                page->partial_flags = partial_flags;
-                 current->arch.old_guest_ptpg = NULL;
-                 current->arch.old_guest_table = page;
-             }
-@@ -1674,7 +1674,7 @@ static int alloc_l3_table(struct page_info *page)
-         if ( i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_flags = 0;
-+            page->partial_flags = partial_flags;
-             current->arch.old_guest_ptpg = NULL;
-             current->arch.old_guest_table = page;
-         }
-@@ -1845,7 +1845,7 @@ static int alloc_l4_table(struct page_info *page)
-             if ( i )
-             {
-                 page->nr_validated_ptes = i;
--                page->partial_flags = 0;
-+                page->partial_flags = partial_flags;
-                 if ( rc == -EINTR )
-                     rc = -ERESTART;
-                 else
--- 
-2.23.0
-

xsa299-4.12-0010-x86-mm-Fix-nested-de-validation-on-error.patch

@@ -1,166 +0,0 @@
-From b3e169dc8daeae85b0b51c25fdb142e2e552ec7f Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:49 +0100
-Subject: [PATCH 10/11] x86/mm: Fix nested de-validation on error
-
-If an invalid entry is discovered when validating a page-table tree,
-the entire tree which has so far been validated must be de-validated.
-Since this may take a long time, alloc_l[2-4]_table() set current
-vcpu's old_guest_table immediately; put_old_guest_table() will make
-sure that put_page_type() will be called to finish off the
-de-validation before any other MMU operations can happen on the vcpu.
-
-The invariant for partial pages should be:
-
-* Entries [0, nr_validated_ptes) should be completely validated;
-  put_page_type() will de-validate these.
-
-* If [nr_validated_ptes] is partially validated, partial_flags should
-  set PTF_partiaL_set.  put_page_type() will be called on this page to
-  finish off devalidation, and the appropriate refcount adjustments
-  will be done.
-
-alloc_l[2-3]_table() indicates partial validation to its callers by
-setting current->old_guest_table.
-
-Unfortunately, this is mishandled.
-
-Take the case where validating lNe[x] returns an error.
-
-First, alloc_l3_table() doesn't check old_guest_table at all; as a
-result, partial_flags is not set when it should be.  nr_validated_ptes
-is set to x; and since PFT_partial_set clear, de-validation resumes at
-nr_validated_ptes-1.  This means that the l2 page at pl3e[x] will not
-have put_page_type() called on it when de-validating the rest of the
-l3: it will be stuck in the PGT_partial state until the domain is
-destroyed, or until it is re-used as an l2.  (Any other page type will
-fail.)
-
-Worse, alloc_l4_table(), rather than setting PTF_partial_set as it
-should, sets nr_validated_ptes to x+1.  When de-validating, since
-partial is 0, this will correctly resume calling put_page_type at [x];
-but, if the put_page_type() is never called, but instead
-get_page_type() is called, validation will pick up at [x+1],
-neglecting to validate [x].  If the rest of the validation succeeds,
-the l4 will be validated even though [x] is invalid.
-
-Fix this in both cases by setting PTF_partial_set if old_guest_table
-is set.
-
-While here, add some safety catches:
-- old_guest_table must point to the page contained in
-  [nr_validated_ptes].
-- alloc_l1_page shouldn't set old_guest_table
-
-If we experience one of these situations in production builds, it's
-safer to avoid calling put_page_type for the pages in question.  If
-they have PGT_partial set, they will be cleaned up on domain
-destruction; if not, we have no idea whether a type count is safe to
-drop.  Retaining an extra type ref that should have been dropped may
-trigger a BUG() on the free_domain_page() path, but dropping a type
-count that shouldn't be dropped may cause a privilege escalation.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 53 +++++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 51 insertions(+), 2 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 0a094291da..a432e69c74 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1580,6 +1580,20 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-             ASSERT(current->arch.old_guest_table == NULL);
-             if ( i )
-             {
-+                /*
-+                 * alloc_l1_table() doesn't set old_guest_table; it does
-+                 * its own tear-down immediately on failure.  If it
-+                 * did we'd need to check it and set partial_flags as we
-+                 * do in alloc_l[34]_table().
-+                 *
-+                 * Note on the use of ASSERT: if it's non-null and
-+                 * hasn't been cleaned up yet, it should have
-+                 * PGT_partial set; and so the type will be cleaned up
-+                 * on domain destruction.  Unfortunately, we would
-+                 * leak the general ref held by old_guest_table; but
-+                 * leaking a page is less bad than a host crash.
-+                 */
-+                ASSERT(current->arch.old_guest_table == NULL);
-                 page->nr_validated_ptes = i;
-                 page->partial_flags = partial_flags;
-                 current->arch.old_guest_ptpg = NULL;
-@@ -1607,6 +1621,7 @@ static int alloc_l3_table(struct page_info *page)
-     unsigned int   i;
-     int            rc = 0;
-     unsigned int   partial_flags = page->partial_flags;
-+    l3_pgentry_t   l3e = l3e_empty();
- 
-     pl3e = map_domain_page(_mfn(pfn));
- 
-@@ -1623,7 +1638,7 @@ static int alloc_l3_table(struct page_info *page)
-     for ( i = page->nr_validated_ptes; i < L3_PAGETABLE_ENTRIES;
-           i++, partial_flags = 0 )
-     {
--        l3_pgentry_t l3e = pl3e[i];
-+        l3e = pl3e[i];
- 
-         if ( i > page->nr_validated_ptes && hypercall_preempt_check() )
-             rc = -EINTR;
-@@ -1675,6 +1690,24 @@ static int alloc_l3_table(struct page_info *page)
-         {
-             page->nr_validated_ptes = i;
-             page->partial_flags = partial_flags;
-+            if ( current->arch.old_guest_table )
-+            {
-+                /*
-+                 * We've experienced a validation failure.  If
-+                 * old_guest_table is set, "transfer" the general
-+                 * reference count to pl3e[nr_validated_ptes] by
-+                 * setting PTF_partial_set.
-+                 *
-+                 * As a precaution, check that old_guest_table is the
-+                 * page pointed to by pl3e[nr_validated_ptes].  If
-+                 * not, it's safer to leak a type ref on production
-+                 * builds.
-+                 */
-+                if ( current->arch.old_guest_table == l3e_get_page(l3e) )
-+                    page->partial_flags = PTF_partial_set;
-+                else
-+                    ASSERT_UNREACHABLE();
-+            }
-             current->arch.old_guest_ptpg = NULL;
-             current->arch.old_guest_table = page;
-         }
-@@ -1851,7 +1884,23 @@ static int alloc_l4_table(struct page_info *page)
-                 else
-                 {
-                     if ( current->arch.old_guest_table )
--                        page->nr_validated_ptes++;
-+                    {
-+                        /*
-+                         * We've experienced a validation failure.  If
-+                         * old_guest_table is set, "transfer" the general
-+                         * reference count to pl3e[nr_validated_ptes] by
-+                         * setting PTF_partial_set.
-+                         *
-+                         * As a precaution, check that old_guest_table is the
-+                         * page pointed to by pl4e[nr_validated_ptes].  If
-+                         * not, it's safer to leak a type ref on production
-+                         * builds.
-+                         */
-+                        if ( current->arch.old_guest_table == l4e_get_page(l4e) )
-+                            page->partial_flags = PTF_partial_set;
-+                        else
-+                            ASSERT_UNREACHABLE();
-+                    }
-                     current->arch.old_guest_ptpg = NULL;
-                     current->arch.old_guest_table = page;
-                 }
--- 
-2.23.0
-

xsa299-4.12-0011-x86-mm-Don-t-drop-a-type-ref-unless-you-held-a-ref-t.patch

@@ -1,413 +0,0 @@
-From ea3dc624c5e6325a9c2f079e52a85965d4ab6ce8 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 10 Oct 2019 17:57:50 +0100
-Subject: [PATCH 11/11] x86/mm: Don't drop a type ref unless you held a ref to
- begin with
-
-Validation and de-validation of pagetable trees may take arbitrarily
-large amounts of time, and so must be preemptible.  This is indicated
-by setting the PGT_partial bit in the type_info, and setting
-nr_validated_entries and partial_flags appropriately.  Specifically,
-if the entry at [nr_validated_entries] is partially validated,
-partial_flags should have the PGT_partial_set bit set, and the entry
-should hold a general reference count.  During de-validation,
-put_page_type() is called on partially validated entries.
-
-Unfortunately, there are a number of issues with the current algorithm.
-
-First, doing a "normal" put_page_type() is not safe when no type ref
-is held: there is nothing to stop another vcpu from coming along and
-picking up validation again: at which point the put_page_type may drop
-the only page ref on an in-use page.  Some examples are listed in the
-appendix.
-
-The core issue is that put_page_type() is being called both to clean
-up PGT_partial, and to drop a type count; and has no way of knowing
-which is which; and so if in between, PGT_partial is cleared,
-put_page_type() will drop the type ref erroneously.
-
-What is needed is to distinguish between two states:
-- Dropping a type ref which is held
-- Cleaning up a page which has been partially de/validated
-
-Fix this by telling put_page_type() which of the two activities you
-intend.
-
-When cleaning up a partial de/validation, take no action unless you
-find a page partially validated.
-
-If put_page_type() is called without PTF_partial_set, and finds the
-page in a PGT_partial state anyway, then there's certainly been a
-misaccounting somewhere, and carrying on would almost certainly cause
-a security issue, so crash the host instead.
-
-In put_page_from_lNe, pass partial_flags on to _put_page_type().
-
-old_guest_table may be set either with a fully validated page (when
-using the "deferred put" pattern), or with a partially validated page
-(when a normal "de-validation" is interrupted, or when a validation
-fails part-way through due to invalid entries).  Add a flag,
-old_guest_table_partial, to indicate which of these it is, and use
-that to pass the appropriate flag to _put_page_type().
-
-While here, delete stray trailing whitespace.
-
-This is part of XSA-299.
-
-Reported-by: George Dunlap <george.dunlap@citrix.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
------
-Appendix:
-
-Suppose page A, when interpreted as an l3 pagetable, contains all
-valid entries; and suppose A[x] points to page B, which when
-interpreted as an l2 pagetable, contains all valid entries.
-
-P1: PIN_L3_TABLE
-  A -> PGT_l3_table | 1 | valid
-  B -> PGT_l2_table | 1 | valid
-
-P1: UNPIN_TABLE
-  > Arrange to interrupt after B has been de-validated
-  B:
-    type_info -> PGT_l2_table | 0
-  A:
-    type_info -> PGT_l3_table | 1 | partial
-    nr_validated_enties -> (less than x)
-
-P2: mod_l4_entry to point to A
-  > Arrange for this to be interrupted while B is being validated
-  B:
-    type_info -> PGT_l2_table | 1 | partial
-    (nr_validated_entires &c set as appropriate)
-  A:
-    type_info -> PGT_l3_table | 1 | partial
-    nr_validated_entries -> x
-    partial_pte = 1
-
-P3: mod_l3_entry some other unrelated l3 to point to B:
-  B:
-    type_info -> PGT_l2_table | 1
-
-P1: Restart UNPIN_TABLE
-
-At this point, since A.nr_validate_entries == x and A.partial_pte !=
-0, free_l3_table() will call put_page_from_l3e() on pl3e[x], dropping
-its type count to 0 while it's still being pointed to by some other l3
-
-A similar issue arises with old_guest_table.  Consider the following
-scenario:
-
-Suppose A is a page which, when interpreted as an l2, has valid entries
-until entry x, which is invalid.
-
-V1:  PIN_L2_TABLE(A)
-  <Validate until we try to validate [x], get -EINVAL>
-  A -> PGT_l2_table | 1 | PGT_partial
-  V1 -> old_guest_table = A
-  <delayed>
-
-V2: PIN_L2_TABLE(A)
-  <Pick up where V1 left off, try to re-validate [x], get -EINVAL>
-  A -> PGT_l2_table | 1 | PGT_partial
-  V2 -> old_guest_table = A
-  <restart>
-  put_old_guest_table()
-    _put_page_type(A)
-      A -> PGT_l2_table | 0
-
-V1: <restart>
-  put_old_guest_table()
-    _put_page_type(A) # UNDERFLOW
-
-Indeed, it is possible to engineer for old_guest_table for every vcpu
-a guest has to point to the same page.
----
- xen/arch/x86/domain.c        |  6 +++
- xen/arch/x86/mm.c            | 99 +++++++++++++++++++++++++++++++-----
- xen/include/asm-x86/domain.h |  4 +-
- 3 files changed, 95 insertions(+), 14 deletions(-)
-
-diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
-index 59df8a6d8d..f1ae5f89f5 100644
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -1104,9 +1104,15 @@ int arch_set_info_guest(
-                     rc = -ERESTART;
-                     /* Fallthrough */
-                 case -ERESTART:
-+                    /*
-+                     * NB that we're putting the kernel-mode table
-+                     * here, which we've already successfully
-+                     * validated above; hence partial = false;
-+                     */
-                     v->arch.old_guest_ptpg = NULL;
-                     v->arch.old_guest_table =
-                         pagetable_get_page(v->arch.guest_table);
-+                    v->arch.old_guest_table_partial = false;
-                     v->arch.guest_table = pagetable_null();
-                     break;
-                 default:
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index a432e69c74..81774368a0 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1359,10 +1359,11 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn,
-         {
-             current->arch.old_guest_ptpg = ptpg;
-             current->arch.old_guest_table = pg;
-+            current->arch.old_guest_table_partial = false;
-         }
-         else
-         {
--            rc = _put_page_type(pg, PTF_preemptible, ptpg);
-+            rc = _put_page_type(pg, flags | PTF_preemptible, ptpg);
-             if ( likely(!rc) )
-                 put_page(pg);
-         }
-@@ -1385,6 +1386,7 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
-         unsigned long mfn = l3e_get_pfn(l3e);
-         bool writeable = l3e_get_flags(l3e) & _PAGE_RW;
- 
-+        ASSERT(!(flags & PTF_partial_set));
-         ASSERT(!(mfn & ((1UL << (L3_PAGETABLE_SHIFT - PAGE_SHIFT)) - 1)));
-         do {
-             put_data_page(mfn_to_page(_mfn(mfn)), writeable);
-@@ -1397,12 +1399,14 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
- 
-     if ( flags & PTF_defer )
-     {
-+        ASSERT(!(flags & PTF_partial_set));
-         current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-         current->arch.old_guest_table = pg;
-+        current->arch.old_guest_table_partial = false;
-         return 0;
-     }
- 
--    rc = _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-+    rc = _put_page_type(pg, flags | PTF_preemptible, mfn_to_page(_mfn(pfn)));
-     if ( likely(!rc) )
-         put_page(pg);
- 
-@@ -1421,12 +1425,15 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
- 
-         if ( flags & PTF_defer )
-         {
-+            ASSERT(!(flags & PTF_partial_set));
-             current->arch.old_guest_ptpg = mfn_to_page(_mfn(pfn));
-             current->arch.old_guest_table = pg;
-+            current->arch.old_guest_table_partial = false;
-             return 0;
-         }
- 
--        rc = _put_page_type(pg, PTF_preemptible, mfn_to_page(_mfn(pfn)));
-+        rc = _put_page_type(pg, flags | PTF_preemptible,
-+                            mfn_to_page(_mfn(pfn)));
-         if ( likely(!rc) )
-             put_page(pg);
-     }
-@@ -1535,6 +1542,14 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
- 
-     pl2e = map_domain_page(_mfn(pfn));
- 
-+    /*
-+     * NB that alloc_l2_table will never set partial_pte on an l2; but
-+     * free_l2_table might if a linear_pagetable entry is interrupted
-+     * partway through de-validation.  In that circumstance,
-+     * get_page_from_l2e() will always return -EINVAL; and we must
-+     * retain the type ref by doing the normal partial_flags tracking.
-+     */
-+
-     for ( i = page->nr_validated_ptes; i < L2_PAGETABLE_ENTRIES;
-           i++, partial_flags = 0 )
-     {
-@@ -1598,6 +1613,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-                 page->partial_flags = partial_flags;
-                 current->arch.old_guest_ptpg = NULL;
-                 current->arch.old_guest_table = page;
-+                current->arch.old_guest_table_partial = true;
-             }
-         }
-         if ( rc < 0 )
-@@ -1704,12 +1720,16 @@ static int alloc_l3_table(struct page_info *page)
-                  * builds.
-                  */
-                 if ( current->arch.old_guest_table == l3e_get_page(l3e) )
-+                {
-+                    ASSERT(current->arch.old_guest_table_partial);
-                     page->partial_flags = PTF_partial_set;
-+                }
-                 else
-                     ASSERT_UNREACHABLE();
-             }
-             current->arch.old_guest_ptpg = NULL;
-             current->arch.old_guest_table = page;
-+            current->arch.old_guest_table_partial = true;
-         }
-         while ( i-- > 0 )
-             pl3e[i] = unadjust_guest_l3e(pl3e[i], d);
-@@ -1897,12 +1917,16 @@ static int alloc_l4_table(struct page_info *page)
-                          * builds.
-                          */
-                         if ( current->arch.old_guest_table == l4e_get_page(l4e) )
-+                        {
-+                            ASSERT(current->arch.old_guest_table_partial);
-                             page->partial_flags = PTF_partial_set;
-+                        }
-                         else
-                             ASSERT_UNREACHABLE();
-                     }
-                     current->arch.old_guest_ptpg = NULL;
-                     current->arch.old_guest_table = page;
-+                    current->arch.old_guest_table_partial = true;
-                 }
-             }
-         }
-@@ -2831,6 +2855,28 @@ static int _put_page_type(struct page_info *page, unsigned int flags,
-         x  = y;
-         nx = x - 1;
- 
-+        /*
-+         * Is this expected to do a full reference drop, or only
-+         * cleanup partial validation / devalidation?
-+         *
-+         * If the former, the caller must hold a "full" type ref;
-+         * which means the page must be validated.  If the page is
-+         * *not* fully validated, continuing would almost certainly
-+         * open up a security hole.  An exception to this is during
-+         * domain destruction, where PGT_validated can be dropped
-+         * without dropping a type ref.
-+         *
-+         * If the latter, do nothing unless type PGT_partial is set.
-+         * If it is set, the type count must be 1.
-+         */
-+        if ( !(flags & PTF_partial_set) )
-+            BUG_ON((x & PGT_partial) ||
-+                   !((x & PGT_validated) || page_get_owner(page)->is_dying));
-+        else if ( !(x & PGT_partial) )
-+            return 0;
-+        else
-+            BUG_ON((x & PGT_count_mask) != 1);
-+
-         ASSERT((x & PGT_count_mask) != 0);
- 
-         switch ( nx & (PGT_locked | PGT_count_mask) )
-@@ -3092,17 +3138,34 @@ int put_old_guest_table(struct vcpu *v)
-     if ( !v->arch.old_guest_table )
-         return 0;
- 
--    switch ( rc = _put_page_type(v->arch.old_guest_table, PTF_preemptible,
--                                 v->arch.old_guest_ptpg) )
-+    rc = _put_page_type(v->arch.old_guest_table,
-+                        PTF_preemptible |
-+                        ( v->arch.old_guest_table_partial ?
-+                          PTF_partial_set : 0 ),
-+                        v->arch.old_guest_ptpg);
-+
-+    if ( rc == -ERESTART || rc == -EINTR )
-     {
--    case -EINTR:
--    case -ERESTART:
-+        v->arch.old_guest_table_partial = (rc == -ERESTART);
-         return -ERESTART;
--    case 0:
--        put_page(v->arch.old_guest_table);
-     }
- 
-+    /*
-+     * It shouldn't be possible for _put_page_type() to return
-+     * anything else at the moment; but if it does happen in
-+     * production, leaking the type ref is probably the best thing to
-+     * do.  Either way, drop the general ref held by old_guest_table.
-+     */
-+    ASSERT(rc == 0);
-+
-+    put_page(v->arch.old_guest_table);
-     v->arch.old_guest_table = NULL;
-+    v->arch.old_guest_ptpg = NULL;
-+    /*
-+     * Safest default if someone sets old_guest_table without
-+     * explicitly setting old_guest_table_partial.
-+     */
-+    v->arch.old_guest_table_partial = true;
- 
-     return rc;
- }
-@@ -3253,11 +3316,11 @@ int new_guest_cr3(mfn_t mfn)
-             switch ( rc = put_page_and_type_preemptible(page) )
-             {
-             case -EINTR:
--                rc = -ERESTART;
--                /* fallthrough */
-             case -ERESTART:
-                 curr->arch.old_guest_ptpg = NULL;
-                 curr->arch.old_guest_table = page;
-+                curr->arch.old_guest_table_partial = (rc == -ERESTART);
-+                rc = -ERESTART;
-                 break;
-             default:
-                 BUG_ON(rc);
-@@ -3494,6 +3557,7 @@ long do_mmuext_op(
-                     {
-                         curr->arch.old_guest_ptpg = NULL;
-                         curr->arch.old_guest_table = page;
-+                        curr->arch.old_guest_table_partial = false;
-                     }
-                 }
-             }
-@@ -3528,6 +3592,11 @@ long do_mmuext_op(
-             case -ERESTART:
-                 curr->arch.old_guest_ptpg = NULL;
-                 curr->arch.old_guest_table = page;
-+                /*
-+                 * EINTR means we still hold the type ref; ERESTART
-+                 * means PGT_partial holds the type ref
-+                 */
-+                curr->arch.old_guest_table_partial = (rc == -ERESTART);
-                 rc = 0;
-                 break;
-             default:
-@@ -3596,11 +3665,15 @@ long do_mmuext_op(
-                 switch ( rc = put_page_and_type_preemptible(page) )
-                 {
-                 case -EINTR:
--                    rc = -ERESTART;
--                    /* fallthrough */
-                 case -ERESTART:
-                     curr->arch.old_guest_ptpg = NULL;
-                     curr->arch.old_guest_table = page;
-+                    /*
-+                     * EINTR means we still hold the type ref;
-+                     * ERESTART means PGT_partial holds the ref
-+                     */
-+                    curr->arch.old_guest_table_partial = (rc == -ERESTART);
-+                    rc = -ERESTART;
-                     break;
-                 default:
-                     BUG_ON(rc);
-diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h
-index 214e44ce1c..2cfce7b36b 100644
---- a/xen/include/asm-x86/domain.h
-+++ b/xen/include/asm-x86/domain.h
-@@ -307,7 +307,7 @@ struct arch_domain
- 
-     struct paging_domain paging;
-     struct p2m_domain *p2m;
--    /* To enforce lock ordering in the pod code wrt the 
-+    /* To enforce lock ordering in the pod code wrt the
-      * page_alloc lock */
-     int page_alloc_unlock_level;
- 
-@@ -581,6 +581,8 @@ struct arch_vcpu
-     struct page_info *old_guest_table;  /* partially destructed pagetable */
-     struct page_info *old_guest_ptpg;   /* containing page table of the */
-                                         /* former, if any */
-+    bool old_guest_table_partial;       /* Are we dropping a type ref, or just
-+                                         * finishing up a partial de-validation? */
-     /* guest_table holds a ref to the page, and also a type-count unless
-      * shadow refcounts are in use */
-     pagetable_t shadow_table[4];        /* (MFN) shadow(s) of guest */
--- 
-2.23.0
-

xsa301-master-1.patch

@@ -1,80 +0,0 @@
-From 19d6330f142cb941b6340a88592e8a294de0ff8c Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Tue, 15 Oct 2019 17:10:40 +0100
-Subject: [PATCH 1/3] xen/arm: p2m: Avoid aliasing guest physical frame
-
-The P2M helpers implementation is quite lax and will end up to ignore
-the unused top bits of a guest physical frame.
-
-This effectively means that p2m_set_entry() will create a mapping for a
-different frame (it is always equal to gfn & (mask unused bits)). Yet
-p2m->max_mapped_gfn will be updated using the original frame.
-
-At the moment, p2m_get_entry() and p2m_resolve_translation_fault()
-assume that p2m_get_root_pointer() will always return a non-NULL pointer
-when the GFN is smaller than p2m->max_mapped_gfn.
-
-Unfortunately, because of the aliasing described above, it would be
-possible to set p2m->max_mapped_gfn high enough so it covers frame that
-would lead p2m_get_root_pointer() to return NULL.
-
-As we don't sanity check the guest physical frame provided by a guest, a
-malicious guest could craft a series of hypercalls that will hit the
-BUG_ON() and therefore DoS Xen.
-
-To prevent aliasing, the function p2m_get_root_pointer() is now reworked
-to return NULL If any of the unused top bits are not zero. The caller
-can then decide what's the appropriate action to do. Since the two paths
-(i.e. P2M_ROOT_PAGES == 1 and P2M_ROOT_PAGES != 1) are now very
-similarly, take the opportunity to consolidate them making the code a
-bit simpler.
-
-With this change, p2m_get_entry() will not try to insert a mapping as
-the root pointer is invalid.
-
-Note that root_table is now switch to unsigned long as unsigned int is
-not enough to hold part of a GFN.
-
-This is part of XSA-301.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
----
- xen/arch/arm/p2m.c | 17 +++++------------
- 1 file changed, 5 insertions(+), 12 deletions(-)
-
-diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
-index a2749d9b6f..d0045a8b28 100644
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -229,21 +229,14 @@ void p2m_tlb_flush_sync(struct p2m_domain *p2m)
- static lpae_t *p2m_get_root_pointer(struct p2m_domain *p2m,
-                                     gfn_t gfn)
- {
--    unsigned int root_table;
--
--    if ( P2M_ROOT_PAGES == 1 )
--        return __map_domain_page(p2m->root);
-+    unsigned long root_table;
- 
-     /*
--     * Concatenated root-level tables. The table number will be the
--     * offset at the previous level. It is not possible to
--     * concatenate a level-0 root.
-+     * While the root table index is the offset from the previous level,
-+     * we can't use (P2M_ROOT_LEVEL - 1) because the root level might be
-+     * 0. Yet we still want to check if all the unused bits are zeroed.
-      */
--    ASSERT(P2M_ROOT_LEVEL > 0);
--
--    root_table = gfn_x(gfn) >> (level_orders[P2M_ROOT_LEVEL - 1]);
--    root_table &= LPAE_ENTRY_MASK;
--
-+    root_table = gfn_x(gfn) >> (level_orders[P2M_ROOT_LEVEL] + LPAE_SHIFT);
-     if ( root_table >= P2M_ROOT_PAGES )
-         return NULL;
- 
--- 
-2.23.0
-

xsa301-master-2.patch

@@ -1,92 +0,0 @@
-From 3b896936f7505e929dd869d14afcb185d0ee75f8 Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Tue, 15 Oct 2019 17:10:41 +0100
-Subject: [PATCH 2/3] xen/arm: p2m: Avoid off-by-one check on
- p2m->max_mapped_gfn
-
-The code base is using inconsistently the field p2m->max_mapped_gfn.
-Some of the useres expect that p2m->max_guest_gfn contain the highest
-mapped GFN while others expect highest + 1.
-
-p2m->max_guest_gfn is set as highest + 1, because of that the sanity
-check on the GFN in p2m_resolved_translation_fault() and
-p2m_get_entry() can be bypassed when GFN == p2m->max_guest_gfn.
-
-p2m_get_root_pointer(p2m->max_guest_gfn) may return NULL if it is
-outside of address range supported and therefore the BUG_ON() could be
-hit.
-
-The current value hold in p2m->max_mapped_gfn is inconsistent with the
-expectation of the common code (see domain_get_maximum_gpfn()) and also
-the documentation of the field.
-
-Rather than changing the check in p2m_translation_fault() and
-p2m_get_entry(), p2m->max_mapped_gfn is now containing the highest
-mapped GFN and the callers assuming "highest + 1" are now adjusted.
-
-Take the opportunity to use 1UL rather than 1 as page_order could
-theoritically big enough to overflow a 32-bit integer.
-
-Lastly, the documentation of the field max_guest_gfn to reflect how it
-is computed.
-
-This is part of XSA-301.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
----
- xen/arch/arm/p2m.c        | 6 +++---
- xen/include/asm-arm/p2m.h | 5 +----
- 2 files changed, 4 insertions(+), 7 deletions(-)
-
-diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
-index d0045a8b28..8d20d27961 100644
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -1041,7 +1041,7 @@ static int __p2m_set_entry(struct p2m_domain *p2m,
-         p2m_write_pte(entry, pte, p2m->clean_pte);
- 
-         p2m->max_mapped_gfn = gfn_max(p2m->max_mapped_gfn,
--                                      gfn_add(sgfn, 1 << page_order));
-+                                      gfn_add(sgfn, (1UL << page_order) - 1));
-         p2m->lowest_mapped_gfn = gfn_min(p2m->lowest_mapped_gfn, sgfn);
-     }
- 
-@@ -1572,7 +1572,7 @@ int relinquish_p2m_mapping(struct domain *d)
-     p2m_write_lock(p2m);
- 
-     start = p2m->lowest_mapped_gfn;
--    end = p2m->max_mapped_gfn;
-+    end = gfn_add(p2m->max_mapped_gfn, 1);
- 
-     for ( ; gfn_x(start) < gfn_x(end);
-           start = gfn_next_boundary(start, order) )
-@@ -1641,7 +1641,7 @@ int p2m_cache_flush_range(struct domain *d, gfn_t *pstart, gfn_t end)
-     p2m_read_lock(p2m);
- 
-     start = gfn_max(start, p2m->lowest_mapped_gfn);
--    end = gfn_min(end, p2m->max_mapped_gfn);
-+    end = gfn_min(end, gfn_add(p2m->max_mapped_gfn, 1));
- 
-     next_block_gfn = start;
- 
-diff --git a/xen/include/asm-arm/p2m.h b/xen/include/asm-arm/p2m.h
-index 89f82df380..5fdb6e8183 100644
---- a/xen/include/asm-arm/p2m.h
-+++ b/xen/include/asm-arm/p2m.h
-@@ -36,10 +36,7 @@ struct p2m_domain {
-     /* Current Translation Table Base Register for the p2m */
-     uint64_t vttbr;
- 
--    /*
--     * Highest guest frame that's ever been mapped in the p2m
--     * Only takes into account ram and foreign mapping
--     */
-+    /* Highest guest frame that's ever been mapped in the p2m */
-     gfn_t max_mapped_gfn;
- 
-     /*
--- 
-2.23.0
-

xsa301-master-3.patch

@@ -1,67 +0,0 @@
-From 060c2dd3b7c2674a019d94afb2b4ebf3663f6c6e Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Tue, 15 Oct 2019 17:10:42 +0100
-Subject: [PATCH 3/3] xen/arm: p2m: Don't check the return of
- p2m_get_root_pointer() with BUG_ON()
-
-It turns out that the BUG_ON() was actually reachable with well-crafted
-hypercalls. The BUG_ON() is here to prevent catch logical error, so
-crashing Xen is a bit over the top.
-
-While all the holes should now be fixed, it would be better to downgrade
-the BUG_ON() to something less fatal to prevent any more DoS.
-
-The BUG_ON() in p2m_get_entry() is now replaced by ASSERT_UNREACHABLE()
-to catch mistake in debug build and return INVALID_MFN for production
-build. The interface also requires to set page_order to give an idea of
-the size of "hole". So 'level' is now set so we report a hole of size of
-the an entry of the root page-table. This stays inline with what happen
-when the GFN is higher than p2m->max_mapped_gfn.
-
-The BUG_ON() in p2m_resolve_translation_fault() is now replaced by
-ASSERT_UNREACHABLE() to catch mistake in debug build and just report a
-fault for producion build.
-
-This is part of XSA-301.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
----
- xen/arch/arm/p2m.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
-index 8d20d27961..ce59f2b503 100644
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -395,7 +395,12 @@ mfn_t p2m_get_entry(struct p2m_domain *p2m, gfn_t gfn,
-      * the table should always be non-NULL because the gfn is below
-      * p2m->max_mapped_gfn and the root table pages are always present.
-      */
--    BUG_ON(table == NULL);
-+    if ( !table )
-+    {
-+        ASSERT_UNREACHABLE();
-+        level = P2M_ROOT_LEVEL;
-+        goto out;
-+    }
- 
-     for ( level = P2M_ROOT_LEVEL; level < 3; level++ )
-     {
-@@ -1196,7 +1201,11 @@ bool p2m_resolve_translation_fault(struct domain *d, gfn_t gfn)
-      * The table should always be non-NULL because the gfn is below
-      * p2m->max_mapped_gfn and the root table pages are always present.
-      */
--    BUG_ON(table == NULL);
-+    if ( !table )
-+    {
-+        ASSERT_UNREACHABLE();
-+        goto out;
-+    }
- 
-     /*
-      * Go down the page-tables until an entry has the valid bit unset or
--- 
-2.23.0
-

xsa302-4.12-0001-IOMMU-add-missing-HVM-check.patch

@@ -1,37 +0,0 @@
-From 0c9c0fbb356e3210cb77b3d738be50981b26058a Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 2 Oct 2019 13:36:59 +0200
-Subject: [PATCH 1/2] IOMMU: add missing HVM check
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fix an unguarded d->arch.hvm access in assign_device().
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
-(cherry picked from commit 41fd1009cd7416b73d745a77c24b4e8d1a296fe6)
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
- xen/drivers/passthrough/pci.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c
-index 8108ed5f9a..d7420bd8bf 100644
---- a/xen/drivers/passthrough/pci.c
-+++ b/xen/drivers/passthrough/pci.c
-@@ -1452,7 +1452,8 @@ static int assign_device(struct domain *d, u16 seg, u8 bus, u8 devfn, u32 flag)
- 
-     /* Prevent device assign if mem paging or mem sharing have been 
-      * enabled for this domain */
--    if ( unlikely(d->arch.hvm.mem_sharing_enabled ||
-+    if ( unlikely((is_hvm_domain(d) &&
-+                   d->arch.hvm.mem_sharing_enabled) ||
-                   vm_event_check_ring(d->vm_event_paging) ||
-                   p2m_get_hostp2m(d)->global_logdirty) )
-         return -EXDEV;
--- 
-2.11.0
-

xsa302-4.12-0002-passthrough-quarantine-PCI-devices.patch

@@ -1,499 +0,0 @@
-From 278d8e585a9f110a1af0bd92a9fc43733c9c7227 Mon Sep 17 00:00:00 2001
-From: Paul Durrant <paul.durrant@citrix.com>
-Date: Mon, 14 Oct 2019 17:52:59 +0100
-Subject: [PATCH 2/2] passthrough: quarantine PCI devices
-
-When a PCI device is assigned to an untrusted domain, it is possible for
-that domain to program the device to DMA to an arbitrary address. The
-IOMMU is used to protect the host from malicious DMA by making sure that
-the device addresses can only target memory assigned to the guest. However,
-when the guest domain is torn down the device is assigned back to dom0,
-thus allowing any in-flight DMA to potentially target critical host data.
-
-This patch introduces a 'quarantine' for PCI devices using dom_io. When
-the toolstack makes a device assignable (by binding it to pciback), it
-will now also assign it to DOMID_IO and the device will only be assigned
-back to dom0 when the device is made unassignable again. Whilst device is
-assignable it will only ever transfer between dom_io and guest domains.
-dom_io is actually only used as a sentinel domain for quarantining purposes;
-it is not configured with any IOMMU mappings. Assignment to dom_io simply
-means that the device's initiator (requestor) identifier is not present in
-the IOMMU's device table and thus any DMA transactions issued will be
-terminated with a fault condition.
-
-In addition, a fix to assignment handling is made for VT-d.  Failure
-during the assignment step should not lead to a device still being
-associated with its prior owner. Hand the device to DomIO temporarily,
-until the assignment step has completed successfully.  Remove the PI
-hooks from the source domain then earlier as well.
-
-Failure of the recovery reassign_device_ownership() may not go silent:
-There e.g. may still be left over RMRR mappings in the domain assignment
-to which has failed, and hence we can't allow that domain to continue
-executing.
-
-NOTE: This patch also includes one printk() cleanup; the
-      "XEN_DOMCTL_assign_device: " tag is dropped in iommu_do_pci_domctl(),
-      since similar printk()-s elsewhere also don't log such a tag.
-
-This is XSA-302.
-
-Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
-(cherry picked from commit ec99857f59f7f06236f11ca8b0b2303e5e745cc4)
----
- tools/libxl/libxl_pci.c                     | 25 +++++++++++-
- xen/arch/x86/mm.c                           |  2 +
- xen/common/domctl.c                         | 14 ++++++-
- xen/drivers/passthrough/amd/pci_amd_iommu.c | 10 ++++-
- xen/drivers/passthrough/iommu.c             |  9 +++++
- xen/drivers/passthrough/pci.c               | 59 ++++++++++++++++++++++-------
- xen/drivers/passthrough/vtd/iommu.c         | 40 ++++++++++++++++---
- xen/include/xen/pci.h                       |  3 ++
- 8 files changed, 138 insertions(+), 24 deletions(-)
-
-diff --git a/tools/libxl/libxl_pci.c b/tools/libxl/libxl_pci.c
-index 88c324ea23..d6a23fb5f8 100644
---- a/tools/libxl/libxl_pci.c
-+++ b/tools/libxl/libxl_pci.c
-@@ -754,6 +754,7 @@ static int libxl__device_pci_assignable_add(libxl__gc *gc,
-                                             libxl_device_pci *pcidev,
-                                             int rebind)
- {
-+    libxl_ctx *ctx = libxl__gc_owner(gc);
-     unsigned dom, bus, dev, func;
-     char *spath, *driver_path = NULL;
-     int rc;
-@@ -779,7 +780,7 @@ static int libxl__device_pci_assignable_add(libxl__gc *gc,
-     }
-     if ( rc ) {
-         LOG(WARN, PCI_BDF" already assigned to pciback", dom, bus, dev, func);
--        return 0;
-+        goto quarantine;
-     }
- 
-     /* Check to see if there's already a driver that we need to unbind from */
-@@ -810,6 +811,19 @@ static int libxl__device_pci_assignable_add(libxl__gc *gc,
-         return ERROR_FAIL;
-     }
- 
-+quarantine:
-+    /*
-+     * DOMID_IO is just a sentinel domain, without any actual mappings,
-+     * so always pass XEN_DOMCTL_DEV_RDM_RELAXED to avoid assignment being
-+     * unnecessarily denied.
-+     */
-+    rc = xc_assign_device(ctx->xch, DOMID_IO, pcidev_encode_bdf(pcidev),
-+                          XEN_DOMCTL_DEV_RDM_RELAXED);
-+    if ( rc < 0 ) {
-+        LOG(ERROR, "failed to quarantine "PCI_BDF, dom, bus, dev, func);
-+        return ERROR_FAIL;
-+    }
-+
-     return 0;
- }
- 
-@@ -817,9 +831,18 @@ static int libxl__device_pci_assignable_remove(libxl__gc *gc,
-                                                libxl_device_pci *pcidev,
-                                                int rebind)
- {
-+    libxl_ctx *ctx = libxl__gc_owner(gc);
-     int rc;
-     char *driver_path;
- 
-+    /* De-quarantine */
-+    rc = xc_deassign_device(ctx->xch, DOMID_IO, pcidev_encode_bdf(pcidev));
-+    if ( rc < 0 ) {
-+        LOG(ERROR, "failed to de-quarantine "PCI_BDF, pcidev->domain, pcidev->bus,
-+            pcidev->dev, pcidev->func);
-+        return ERROR_FAIL;
-+    }
-+
-     /* Unbind from pciback */
-     if ( (rc=pciback_dev_is_assigned(gc, pcidev)) < 0 ) {
-         return ERROR_FAIL;
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 3557cd1178..11d753d8d2 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -295,9 +295,11 @@ void __init arch_init_memory(void)
-      * Initialise our DOMID_IO domain.
-      * This domain owns I/O pages that are within the range of the page_info
-      * array. Mappings occur at the priv of the caller.
-+     * Quarantined PCI devices will be associated with this domain.
-      */
-     dom_io = domain_create(DOMID_IO, NULL, false);
-     BUG_ON(IS_ERR(dom_io));
-+    INIT_LIST_HEAD(&dom_io->arch.pdev_list);
- 
-     /*
-      * Initialise our COW domain.
-diff --git a/xen/common/domctl.c b/xen/common/domctl.c
-index d08b6274e2..e3c4be2b48 100644
---- a/xen/common/domctl.c
-+++ b/xen/common/domctl.c
-@@ -391,6 +391,16 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
- 
-     switch ( op->cmd )
-     {
-+    case XEN_DOMCTL_assign_device:
-+    case XEN_DOMCTL_deassign_device:
-+        if ( op->domain == DOMID_IO )
-+        {
-+            d = dom_io;
-+            break;
-+        }
-+        else if ( op->domain == DOMID_INVALID )
-+            return -ESRCH;
-+        /* fall through */
-     case XEN_DOMCTL_test_assign_device:
-         if ( op->domain == DOMID_INVALID )
-         {
-@@ -412,7 +422,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
- 
-     if ( !domctl_lock_acquire() )
-     {
--        if ( d )
-+        if ( d && d != dom_io )
-             rcu_unlock_domain(d);
-         return hypercall_create_continuation(
-             __HYPERVISOR_domctl, "h", u_domctl);
-@@ -1074,7 +1084,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
-     domctl_lock_release();
- 
-  domctl_out_unlock_domonly:
--    if ( d )
-+    if ( d && d != dom_io )
-         rcu_unlock_domain(d);
- 
-     if ( copyback && __copy_to_guest(u_domctl, op, 1) )
-diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-index 33a3798f36..15c13e1163 100644
---- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
-+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-@@ -120,6 +120,10 @@ static void amd_iommu_setup_domain_device(
-     u8 bus = pdev->bus;
-     const struct domain_iommu *hd = dom_iommu(domain);
- 
-+    /* dom_io is used as a sentinel for quarantined devices */
-+    if ( domain == dom_io )
-+        return;
-+
-     BUG_ON( !hd->arch.root_table || !hd->arch.paging_mode ||
-             !iommu->dev_table.buffer );
- 
-@@ -277,6 +281,10 @@ void amd_iommu_disable_domain_device(struct domain *domain,
-     int req_id;
-     u8 bus = pdev->bus;
- 
-+    /* dom_io is used as a sentinel for quarantined devices */
-+    if ( domain == dom_io )
-+        return;
-+
-     BUG_ON ( iommu->dev_table.buffer == NULL );
-     req_id = get_dma_requestor_id(iommu->seg, PCI_BDF2(bus, devfn));
-     dte = iommu->dev_table.buffer + (req_id * IOMMU_DEV_TABLE_ENTRY_SIZE);
-@@ -363,7 +371,7 @@ static int amd_iommu_assign_device(struct domain *d, u8 devfn,
-             ivrs_mappings[req_id].read_permission);
-     }
- 
--    return reassign_device(hardware_domain, d, devfn, pdev);
-+    return reassign_device(pdev->domain, d, devfn, pdev);
- }
- 
- static void deallocate_next_page_table(struct page_info *pg, int level)
-diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
-index a6697d58fb..2762e1342f 100644
---- a/xen/drivers/passthrough/iommu.c
-+++ b/xen/drivers/passthrough/iommu.c
-@@ -232,6 +232,9 @@ void iommu_teardown(struct domain *d)
- {
-     struct domain_iommu *hd = dom_iommu(d);
- 
-+    if ( d == dom_io )
-+        return;
-+
-     hd->status = IOMMU_STATUS_disabled;
-     hd->platform_ops->teardown(d);
-     tasklet_schedule(&iommu_pt_cleanup_tasklet);
-@@ -241,6 +244,9 @@ int iommu_construct(struct domain *d)
- {
-     struct domain_iommu *hd = dom_iommu(d);
- 
-+    if ( d == dom_io )
-+        return 0;
-+
-     if ( hd->status == IOMMU_STATUS_initialized )
-         return 0;
- 
-@@ -521,6 +527,9 @@ int __init iommu_setup(void)
-     printk("I/O virtualisation %sabled\n", iommu_enabled ? "en" : "dis");
-     if ( iommu_enabled )
-     {
-+        if ( iommu_domain_init(dom_io) )
-+            panic("Could not set up quarantine\n");
-+
-         printk(" - Dom0 mode: %s\n",
-                iommu_hwdom_passthrough ? "Passthrough" :
-                iommu_hwdom_strict ? "Strict" : "Relaxed");
-diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c
-index d7420bd8bf..d66a8a1daf 100644
---- a/xen/drivers/passthrough/pci.c
-+++ b/xen/drivers/passthrough/pci.c
-@@ -1426,19 +1426,29 @@ static int iommu_remove_device(struct pci_dev *pdev)
-     return hd->platform_ops->remove_device(pdev->devfn, pci_to_dev(pdev));
- }
- 
--/*
-- * If the device isn't owned by the hardware domain, it means it already
-- * has been assigned to other domain, or it doesn't exist.
-- */
- static int device_assigned(u16 seg, u8 bus, u8 devfn)
- {
-     struct pci_dev *pdev;
-+    int rc = 0;
- 
-     pcidevs_lock();
--    pdev = pci_get_pdev_by_domain(hardware_domain, seg, bus, devfn);
-+
-+    pdev = pci_get_pdev(seg, bus, devfn);
-+
-+    if ( !pdev )
-+        rc = -ENODEV;
-+    /*
-+     * If the device exists and it is not owned by either the hardware
-+     * domain or dom_io then it must be assigned to a guest, or be
-+     * hidden (owned by dom_xen).
-+     */
-+    else if ( pdev->domain != hardware_domain &&
-+              pdev->domain != dom_io )
-+        rc = -EBUSY;
-+
-     pcidevs_unlock();
- 
--    return pdev ? 0 : -EBUSY;
-+    return rc;
- }
- 
- static int assign_device(struct domain *d, u16 seg, u8 bus, u8 devfn, u32 flag)
-@@ -1452,7 +1462,8 @@ static int assign_device(struct domain *d, u16 seg, u8 bus, u8 devfn, u32 flag)
- 
-     /* Prevent device assign if mem paging or mem sharing have been 
-      * enabled for this domain */
--    if ( unlikely((is_hvm_domain(d) &&
-+    if ( d != dom_io &&
-+         unlikely((is_hvm_domain(d) &&
-                    d->arch.hvm.mem_sharing_enabled) ||
-                   vm_event_check_ring(d->vm_event_paging) ||
-                   p2m_get_hostp2m(d)->global_logdirty) )
-@@ -1468,12 +1479,20 @@ static int assign_device(struct domain *d, u16 seg, u8 bus, u8 devfn, u32 flag)
-         return rc;
-     }
- 
--    pdev = pci_get_pdev_by_domain(hardware_domain, seg, bus, devfn);
-+    pdev = pci_get_pdev(seg, bus, devfn);
-+
-+    rc = -ENODEV;
-     if ( !pdev )
--    {
--        rc = pci_get_pdev(seg, bus, devfn) ? -EBUSY : -ENODEV;
-         goto done;
--    }
-+
-+    rc = 0;
-+    if ( d == pdev->domain )
-+        goto done;
-+
-+    rc = -EBUSY;
-+    if ( pdev->domain != hardware_domain &&
-+         pdev->domain != dom_io )
-+        goto done;
- 
-     if ( pdev->msix )
-         msixtbl_init(d);
-@@ -1496,6 +1515,10 @@ static int assign_device(struct domain *d, u16 seg, u8 bus, u8 devfn, u32 flag)
-     }
- 
-  done:
-+    /* The device is assigned to dom_io so mark it as quarantined */
-+    if ( !rc && d == dom_io )
-+        pdev->quarantine = true;
-+
-     if ( !has_arch_pdevs(d) && has_iommu_pt(d) )
-         iommu_teardown(d);
-     pcidevs_unlock();
-@@ -1508,6 +1531,7 @@ int deassign_device(struct domain *d, u16 seg, u8 bus, u8 devfn)
- {
-     const struct domain_iommu *hd = dom_iommu(d);
-     struct pci_dev *pdev = NULL;
-+    struct domain *target;
-     int ret = 0;
- 
-     if ( !iommu_enabled || !hd->platform_ops )
-@@ -1518,12 +1542,16 @@ int deassign_device(struct domain *d, u16 seg, u8 bus, u8 devfn)
-     if ( !pdev )
-         return -ENODEV;
- 
-+    /* De-assignment from dom_io should de-quarantine the device */
-+    target = (pdev->quarantine && pdev->domain != dom_io) ?
-+        dom_io : hardware_domain;
-+
-     while ( pdev->phantom_stride )
-     {
-         devfn += pdev->phantom_stride;
-         if ( PCI_SLOT(devfn) != PCI_SLOT(pdev->devfn) )
-             break;
--        ret = hd->platform_ops->reassign_device(d, hardware_domain, devfn,
-+        ret = hd->platform_ops->reassign_device(d, target, devfn,
-                                                 pci_to_dev(pdev));
-         if ( !ret )
-             continue;
-@@ -1534,7 +1562,7 @@ int deassign_device(struct domain *d, u16 seg, u8 bus, u8 devfn)
-     }
- 
-     devfn = pdev->devfn;
--    ret = hd->platform_ops->reassign_device(d, hardware_domain, devfn,
-+    ret = hd->platform_ops->reassign_device(d, target, devfn,
-                                             pci_to_dev(pdev));
-     if ( ret )
-     {
-@@ -1544,6 +1572,9 @@ int deassign_device(struct domain *d, u16 seg, u8 bus, u8 devfn)
-         return ret;
-     }
- 
-+    if ( pdev->domain == hardware_domain  )
-+        pdev->quarantine = false;
-+
-     pdev->fault.count = 0;
- 
-     if ( !has_arch_pdevs(d) && has_iommu_pt(d) )
-@@ -1722,7 +1753,7 @@ int iommu_do_pci_domctl(
-             ret = hypercall_create_continuation(__HYPERVISOR_domctl,
-                                                 "h", u_domctl);
-         else if ( ret )
--            printk(XENLOG_G_ERR "XEN_DOMCTL_assign_device: "
-+            printk(XENLOG_G_ERR
-                    "assign %04x:%02x:%02x.%u to dom%d failed (%d)\n",
-                    seg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
-                    d->domain_id, ret);
-diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
-index 1db1cd9f2d..a8d1baa064 100644
---- a/xen/drivers/passthrough/vtd/iommu.c
-+++ b/xen/drivers/passthrough/vtd/iommu.c
-@@ -1338,6 +1338,10 @@ int domain_context_mapping_one(
-     int agaw, rc, ret;
-     bool_t flush_dev_iotlb;
- 
-+    /* dom_io is used as a sentinel for quarantined devices */
-+    if ( domain == dom_io )
-+        return 0;
-+
-     ASSERT(pcidevs_locked());
-     spin_lock(&iommu->lock);
-     maddr = bus_to_context_maddr(iommu, bus);
-@@ -1573,6 +1577,10 @@ int domain_context_unmap_one(
-     int iommu_domid, rc, ret;
-     bool_t flush_dev_iotlb;
- 
-+    /* dom_io is used as a sentinel for quarantined devices */
-+    if ( domain == dom_io )
-+        return 0;
-+
-     ASSERT(pcidevs_locked());
-     spin_lock(&iommu->lock);
- 
-@@ -1705,6 +1713,10 @@ static int domain_context_unmap(struct domain *domain, u8 devfn,
-         goto out;
-     }
- 
-+    /* dom_io is used as a sentinel for quarantined devices */
-+    if ( domain == dom_io )
-+        goto out;
-+
-     /*
-      * if no other devices under the same iommu owned by this domain,
-      * clear iommu in iommu_bitmap and clear domain_id in domid_bitmp
-@@ -2441,6 +2453,15 @@ static int reassign_device_ownership(
-     if ( ret )
-         return ret;
- 
-+    if ( devfn == pdev->devfn )
-+    {
-+        list_move(&pdev->domain_list, &dom_io->arch.pdev_list);
-+        pdev->domain = dom_io;
-+    }
-+
-+    if ( !has_arch_pdevs(source) )
-+        vmx_pi_hooks_deassign(source);
-+
-     if ( !has_arch_pdevs(target) )
-         vmx_pi_hooks_assign(target);
- 
-@@ -2459,15 +2480,13 @@ static int reassign_device_ownership(
-         pdev->domain = target;
-     }
- 
--    if ( !has_arch_pdevs(source) )
--        vmx_pi_hooks_deassign(source);
--
-     return ret;
- }
- 
- static int intel_iommu_assign_device(
-     struct domain *d, u8 devfn, struct pci_dev *pdev, u32 flag)
- {
-+    struct domain *s = pdev->domain;
-     struct acpi_rmrr_unit *rmrr;
-     int ret = 0, i;
-     u16 bdf, seg;
-@@ -2510,8 +2529,8 @@ static int intel_iommu_assign_device(
-         }
-     }
- 
--    ret = reassign_device_ownership(hardware_domain, d, devfn, pdev);
--    if ( ret )
-+    ret = reassign_device_ownership(s, d, devfn, pdev);
-+    if ( ret || d == dom_io )
-         return ret;
- 
-     /* Setup rmrr identity mapping */
-@@ -2524,11 +2543,20 @@ static int intel_iommu_assign_device(
-             ret = rmrr_identity_mapping(d, 1, rmrr, flag);
-             if ( ret )
-             {
--                reassign_device_ownership(d, hardware_domain, devfn, pdev);
-+                int rc;
-+
-+                rc = reassign_device_ownership(d, s, devfn, pdev);
-                 printk(XENLOG_G_ERR VTDPREFIX
-                        " cannot map reserved region (%"PRIx64",%"PRIx64"] for Dom%d (%d)\n",
-                        rmrr->base_address, rmrr->end_address,
-                        d->domain_id, ret);
-+                if ( rc )
-+                {
-+                    printk(XENLOG_ERR VTDPREFIX
-+                           " failed to reclaim %04x:%02x:%02x.%u from %pd (%d)\n",
-+                           seg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn), d, rc);
-+                    domain_crash(d);
-+                }
-                 break;
-             }
-         }
-diff --git a/xen/include/xen/pci.h b/xen/include/xen/pci.h
-index 8b21e8dc84..a031fd6020 100644
---- a/xen/include/xen/pci.h
-+++ b/xen/include/xen/pci.h
-@@ -88,6 +88,9 @@ struct pci_dev {
- 
-     nodeid_t node; /* NUMA node */
- 
-+    /* Device to be quarantined, don't automatically re-assign to dom0 */
-+    bool quarantine;
-+
-     /* Device with errata, ignore the BARs. */
-     bool ignore_bars;
- 
--- 
-2.11.0
-

xsa303-0001-xen-arm32-entry-Split-__DEFINE_ENTRY_TRAP-in-two.patch

@@ -1,74 +0,0 @@
-From c8cb33fa64c9ccbfa2a494a9dad2e0a763c09176 Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Tue, 1 Oct 2019 13:07:53 +0100
-Subject: [PATCH 1/4] xen/arm32: entry: Split __DEFINE_ENTRY_TRAP in two
-
-The preprocessing macro __DEFINE_ENTRY_TRAP is used to generate trap
-entry function. While the macro is fairly small today, follow-up patches
-will increase the size signicantly.
-
-In general, assembly macros are more readable as they allow you to name
-parameters and avoid '\'. So the actual implementation of the trap is
-now switched to an assembly macro.
-
-This is part of XSA-303.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Reviewed-by: Andre Przywara <andre.przywara@arm.com>
----
- xen/arch/arm/arm32/entry.S | 34 +++++++++++++++++++---------------
- 1 file changed, 19 insertions(+), 15 deletions(-)
-
-diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S
-index 0b4cd19abd..4a762e04f1 100644
---- a/xen/arch/arm/arm32/entry.S
-+++ b/xen/arch/arm/arm32/entry.S
-@@ -126,24 +126,28 @@ abort_guest_exit_end:
- skip_check:
-         mov pc, lr
- 
--/*
-- * Macro to define trap entry. The iflags corresponds to the list of
-- * interrupts (Asynchronous Abort, IRQ, FIQ) to unmask.
-- */
-+        /*
-+         * Macro to define trap entry. The iflags corresponds to the list of
-+         * interrupts (Asynchronous Abort, IRQ, FIQ) to unmask.
-+         */
-+        .macro vector trap, iflags
-+        SAVE_ALL
-+        cpsie   \iflags
-+        adr     lr, return_from_trap
-+        mov     r0, sp
-+        /*
-+         * Save the stack pointer in r11. It will be restored after the
-+         * trap has been handled (see return_from_trap).
-+         */
-+        mov     r11, sp
-+        bic     sp, #7      /* Align the stack pointer (noop on guest trap) */
-+        b       do_trap_\trap
-+        .endm
-+
- #define __DEFINE_TRAP_ENTRY(trap, iflags)                               \
-         ALIGN;                                                          \
- trap_##trap:                                                            \
--        SAVE_ALL;                                                       \
--        cpsie iflags;                                                   \
--        adr lr, return_from_trap;                                       \
--        mov r0, sp;                                                     \
--        /*                                                              \
--         * Save the stack pointer in r11. It will be restored after the \
--         * trap has been handled (see return_from_trap).                \
--         */                                                             \
--        mov r11, sp;                                                    \
--        bic sp, #7; /* Align the stack pointer (noop on guest trap) */  \
--        b do_trap_##trap
-+        vector trap, iflags
- 
- /* Trap handler which unmask IRQ/Abort, keep FIQ masked */
- #define DEFINE_TRAP_ENTRY(trap) __DEFINE_TRAP_ENTRY(trap, ai)
--- 
-2.11.0
-

xsa303-0002-xen-arm32-entry-Fold-the-macro-SAVE_ALL-in-the-macro.patch

@@ -1,97 +0,0 @@
-From be7379207c83fa74f8a6c22a8ea213f02714776f Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Tue, 1 Oct 2019 13:15:48 +0100
-Subject: [PATCH 2/4] xen/arm32: entry: Fold the macro SAVE_ALL in the macro
- vector
-
-Follow-up rework will require the macro vector to distinguish between
-a trap from a guest vs while in the hypervisor.
-
-The macro SAVE_ALL already has code to distinguish between the two and
-it is only called by the vector macro. So fold the former into the
-latter. This will help to avoid duplicating the check.
-
-This is part of XSA-303.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Reviewed-by: Andre Przywara <andre.przywara@arm.com>
----
- xen/arch/arm/arm32/entry.S | 46 +++++++++++++++++++++++-----------------------
- 1 file changed, 23 insertions(+), 23 deletions(-)
-
-diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S
-index 4a762e04f1..150cbc0b4b 100644
---- a/xen/arch/arm/arm32/entry.S
-+++ b/xen/arch/arm/arm32/entry.S
-@@ -13,27 +13,6 @@
- #define RESTORE_BANKED(mode) \
-         RESTORE_ONE_BANKED(SP_##mode) ; RESTORE_ONE_BANKED(LR_##mode) ; RESTORE_ONE_BANKED(SPSR_##mode)
- 
--#define SAVE_ALL                                                        \
--        sub sp, #(UREGS_SP_usr - UREGS_sp); /* SP, LR, SPSR, PC */      \
--        push {r0-r12}; /* Save R0-R12 */                                \
--                                                                        \
--        mrs r11, ELR_hyp;               /* ELR_hyp is return address. */\
--        str r11, [sp, #UREGS_pc];                                       \
--                                                                        \
--        str lr, [sp, #UREGS_lr];                                        \
--                                                                        \
--        add r11, sp, #UREGS_kernel_sizeof+4;                            \
--        str r11, [sp, #UREGS_sp];                                       \
--                                                                        \
--        mrc CP32(r11, HSR);             /* Save exception syndrome */   \
--        str r11, [sp, #UREGS_hsr];                                      \
--                                                                        \
--        mrs r11, SPSR_hyp;                                              \
--        str r11, [sp, #UREGS_cpsr];                                     \
--        and r11, #PSR_MODE_MASK;                                        \
--        cmp r11, #PSR_MODE_HYP;                                         \
--        blne save_guest_regs
--
- save_guest_regs:
- #ifdef CONFIG_ARM32_HARDEN_BRANCH_PREDICTOR
-         /*
-@@ -52,7 +31,7 @@ save_guest_regs:
-         ldr r11, =0xffffffff  /* Clobber SP which is only valid for hypervisor frames. */
-         str r11, [sp, #UREGS_sp]
-         SAVE_ONE_BANKED(SP_usr)
--        /* LR_usr is the same physical register as lr and is saved in SAVE_ALL */
-+        /* LR_usr is the same physical register as lr and is saved by the caller */
-         SAVE_BANKED(svc)
-         SAVE_BANKED(abt)
-         SAVE_BANKED(und)
-@@ -131,7 +110,28 @@ skip_check:
-          * interrupts (Asynchronous Abort, IRQ, FIQ) to unmask.
-          */
-         .macro vector trap, iflags
--        SAVE_ALL
-+        /* Save registers in the stack */
-+        sub     sp, #(UREGS_SP_usr - UREGS_sp) /* SP, LR, SPSR, PC */
-+        push    {r0-r12}                       /* Save R0-R12 */
-+        mrs     r11, ELR_hyp                   /* ELR_hyp is return address */
-+        str     r11, [sp, #UREGS_pc]
-+
-+        str     lr, [sp, #UREGS_lr]
-+
-+        add     r11, sp, #(UREGS_kernel_sizeof + 4)
-+
-+        str     r11, [sp, #UREGS_sp]
-+
-+        mrc     CP32(r11, HSR)                 /* Save exception syndrome */
-+        str     r11, [sp, #UREGS_hsr]
-+
-+        mrs     r11, SPSR_hyp
-+        str     r11, [sp, #UREGS_cpsr]
-+        and     r11, #PSR_MODE_MASK
-+        cmp     r11, #PSR_MODE_HYP
-+        blne    save_guest_regs
-+
-+        /* We are ready to handle the trap, setup the registers and jump. */
-         cpsie   \iflags
-         adr     lr, return_from_trap
-         mov     r0, sp
--- 
-2.11.0
-

xsa303-0003-xen-arm32-Don-t-blindly-unmask-interrupts-on-trap-wi.patch

@@ -1,226 +0,0 @@
-From 098fe877967870ffda2dfd9629a5fd272f6aacdc Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Fri, 11 Oct 2019 17:49:28 +0100
-Subject: [PATCH 3/4] xen/arm32: Don't blindly unmask interrupts on trap
- without a change of level
-
-Exception vectors will unmask interrupts regardless the state of them in
-the interrupted context.
-
-One of the consequences is IRQ will be unmasked when receiving an
-undefined instruction exception (used by WARN*) from the hypervisor.
-This could result to unexpected behavior such as deadlock (if a lock was
-shared with interrupts).
-
-In a nutshell, interrupts should only be unmasked when it is safe to do.
-Xen only unmask IRQ and Abort interrupts, so the logic can stay simple.
-
-As vectors exceptions may be shared between guest and hypervisor, we now
-need to have a different policy for the interrupts.
-
-On exception from hypervisor, each vector will select the list of
-interrupts to inherit from the interrupted context. Any interrupts not
-listed will be kept masked.
-
-On exception from the guest, the Abort and IRQ will be unmasked
-depending on the exact vector.
-
-The interrupts will be kept unmasked when the vector cannot used by
-either guest or hypervisor.
-
-Note that each vector is not anymore preceded by ALIGN. This is fine
-because the alignment is already bigger than what we need.
-
-This is part of XSA-303.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Reviewed-by: Andre Przywara <andre.przywara@arm.com>
----
- xen/arch/arm/arm32/entry.S | 138 +++++++++++++++++++++++++++++++++++----------
- 1 file changed, 109 insertions(+), 29 deletions(-)
-
-diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S
-index 150cbc0b4b..ec90cca093 100644
---- a/xen/arch/arm/arm32/entry.S
-+++ b/xen/arch/arm/arm32/entry.S
-@@ -4,6 +4,17 @@
- #include <asm/alternative.h>
- #include <public/xen.h>
- 
-+/*
-+ * Short-hands to defined the interrupts (A, I, F)
-+ *
-+ * _ means the interrupt state will not change
-+ * X means the state of interrupt X will change
-+ *
-+ * To be used with msr cpsr_* only
-+ */
-+#define IFLAGS_AIF      PSR_ABT_MASK | PSR_IRQ_MASK | PSR_FIQ_MASK
-+#define IFLAGS_A_F      PSR_ABT_MASK | PSR_FIQ_MASK
-+
- #define SAVE_ONE_BANKED(reg)    mrs r11, reg; str r11, [sp, #UREGS_##reg]
- #define RESTORE_ONE_BANKED(reg) ldr r11, [sp, #UREGS_##reg]; msr reg, r11
- 
-@@ -106,10 +117,18 @@ skip_check:
-         mov pc, lr
- 
-         /*
--         * Macro to define trap entry. The iflags corresponds to the list of
--         * interrupts (Asynchronous Abort, IRQ, FIQ) to unmask.
-+         * Macro to define a trap entry.
-+         *
-+         *  @guest_iflags: Optional list of interrupts to unmask when
-+         *      entering from guest context. As this is used with cpsie,
-+         *      the letter (a, i, f) should be used.
-+         *
-+         *  @hyp_iflags: Optional list of interrupts to inherit when
-+         *      entering from hypervisor context. Any interrupts not
-+         *      listed will be kept unchanged. As this is used with cpsr_*,
-+         *      IFLAGS_* short-hands should be used.
-          */
--        .macro vector trap, iflags
-+        .macro vector trap, guest_iflags=n, hyp_iflags=0
-         /* Save registers in the stack */
-         sub     sp, #(UREGS_SP_usr - UREGS_sp) /* SP, LR, SPSR, PC */
-         push    {r0-r12}                       /* Save R0-R12 */
-@@ -127,12 +146,39 @@ skip_check:
- 
-         mrs     r11, SPSR_hyp
-         str     r11, [sp, #UREGS_cpsr]
--        and     r11, #PSR_MODE_MASK
--        cmp     r11, #PSR_MODE_HYP
--        blne    save_guest_regs
- 
-+        /*
-+         * We need to distinguish whether we came from guest or
-+         * hypervisor context.
-+         */
-+        and     r0, r11, #PSR_MODE_MASK
-+        cmp     r0, #PSR_MODE_HYP
-+
-+        bne     1f
-+        /*
-+         * Trap from the hypervisor
-+         *
-+         * Inherit the state of the interrupts from the hypervisor
-+         * context. For that we need to use SPSR (stored in r11) and
-+         * modify CPSR accordingly.
-+         *
-+         * CPSR = (CPSR & ~hyp_iflags) | (SPSR & hyp_iflags)
-+         */
-+        mrs     r10, cpsr
-+        bic     r10, r10, #\hyp_iflags
-+        and     r11, r11, #\hyp_iflags
-+        orr     r10, r10, r11
-+        msr     cpsr_cx, r10
-+        b       2f
-+
-+1:
-+        /* Trap from the guest */
-+        bl      save_guest_regs
-+        .if     \guest_iflags != n
-+        cpsie   \guest_iflags
-+        .endif
-+2:
-         /* We are ready to handle the trap, setup the registers and jump. */
--        cpsie   \iflags
-         adr     lr, return_from_trap
-         mov     r0, sp
-         /*
-@@ -144,20 +190,6 @@ skip_check:
-         b       do_trap_\trap
-         .endm
- 
--#define __DEFINE_TRAP_ENTRY(trap, iflags)                               \
--        ALIGN;                                                          \
--trap_##trap:                                                            \
--        vector trap, iflags
--
--/* Trap handler which unmask IRQ/Abort, keep FIQ masked */
--#define DEFINE_TRAP_ENTRY(trap) __DEFINE_TRAP_ENTRY(trap, ai)
--
--/* Trap handler which unmask Abort, keep IRQ/FIQ masked */
--#define DEFINE_TRAP_ENTRY_NOIRQ(trap) __DEFINE_TRAP_ENTRY(trap, a)
--
--/* Trap handler which unmask IRQ, keep Abort/FIQ masked */
--#define DEFINE_TRAP_ENTRY_NOABORT(trap) __DEFINE_TRAP_ENTRY(trap, i)
--
-         .align 5
- GLOBAL(hyp_traps_vector)
-         b trap_reset                    /* 0x00 - Reset */
-@@ -228,14 +260,62 @@ decode_vectors:
- 
- #endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
- 
--DEFINE_TRAP_ENTRY(reset)
--DEFINE_TRAP_ENTRY(undefined_instruction)
--DEFINE_TRAP_ENTRY(hypervisor_call)
--DEFINE_TRAP_ENTRY(prefetch_abort)
--DEFINE_TRAP_ENTRY(guest_sync)
--DEFINE_TRAP_ENTRY_NOIRQ(irq)
--DEFINE_TRAP_ENTRY_NOIRQ(fiq)
--DEFINE_TRAP_ENTRY_NOABORT(data_abort)
-+/* Vector not used by the Hypervisor. */
-+trap_reset:
-+        vector reset
-+
-+/*
-+ * Vector only used by the Hypervisor.
-+ *
-+ * While the exception can be executed with all the interrupts (e.g.
-+ * IRQ) unmasked, the interrupted context may have purposefully masked
-+ * some of them. So we want to inherit the state from the interrupted
-+ * context.
-+ */
-+trap_undefined_instruction:
-+        vector undefined_instruction, hyp_iflags=IFLAGS_AIF
-+
-+/* We should never reach this trap */
-+trap_hypervisor_call:
-+        vector hypervisor_call
-+
-+/*
-+ * Vector only used by the hypervisor.
-+ *
-+ * While the exception can be executed with all the interrupts (e.g.
-+ * IRQ) unmasked, the interrupted context may have purposefully masked
-+ * some of them. So we want to inherit the state from the interrupted
-+ * context.
-+ */
-+trap_prefetch_abort:
-+       vector prefetch_abort, hyp_iflags=IFLAGS_AIF
-+
-+/*
-+ * Vector only used by the hypervisor.
-+ *
-+ * Data Abort should be rare and most likely fatal. It is best to not
-+ * unmask any interrupts to limit the amount of code that can run before
-+ * the Data Abort is treated.
-+ */
-+trap_data_abort:
-+        vector data_abort
-+
-+/* Vector only used by the guest. We can unmask Abort/IRQ. */
-+trap_guest_sync:
-+        vector guest_sync, guest_iflags=ai
-+
-+
-+/* Vector used by the hypervisor and the guest. */
-+trap_irq:
-+        vector irq, guest_iflags=a, hyp_iflags=IFLAGS_A_F
-+
-+/*
-+ * Vector used by the hypervisor and the guest.
-+ *
-+ * FIQ are not meant to happen, so we don't unmask any interrupts.
-+ */
-+trap_fiq:
-+        vector fiq
- 
- return_from_trap:
-         /*
--- 
-2.11.0
-

xsa303-0004-xen-arm64-Don-t-blindly-unmask-interrupts-on-trap-wi.patch

@@ -1,114 +0,0 @@
-From c6d290ce157a044dec417fdda8db71e41a37d744 Mon Sep 17 00:00:00 2001
-From: Julien Grall <julien.grall@arm.com>
-Date: Mon, 7 Oct 2019 18:10:56 +0100
-Subject: [PATCH 4/4] xen/arm64: Don't blindly unmask interrupts on trap
- without a change of level
-
-Some of the traps without a change of the level (i.e. hypervisor ->
-hypervisor) will unmask interrupts regardless the state of them in the
-interrupted context.
-
-One of the consequences is IRQ will be unmasked when receiving a
-synchronous exception (used by WARN*()). This could result to unexpected
-behavior such as deadlock (if a lock was shared with interrupts).
-
-In a nutshell, interrupts should only be unmasked when it is safe to
-do. Xen only unmask IRQ and Abort interrupts, so the logic can stay
-simple:
-    - hyp_error: All the interrupts are now kept masked. SError should
-      be pretty rare and if ever happen then we most likely want to
-      avoid any other interrupts to be generated. The potential main
-      "caller" is during virtual SError synchronization on the exit
-      path from the guest (see check_pending_vserror).
-
-    - hyp_sync: The interrupts state is inherited from the interrupted
-      context.
-
-    - hyp_irq: All the interrupts but IRQ state are inherited from the
-      interrupted context. IRQ is kept masked.
-
-This is part of XSA-303.
-
-Reported-by: Julien Grall <Julien.Grall@arm.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Reviewed-by: Andre Przywara <andre.przywara@arm.com>
----
- xen/arch/arm/arm64/entry.S | 47 ++++++++++++++++++++++++++++++++++++++++++----
- 1 file changed, 43 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/arm/arm64/entry.S b/xen/arch/arm/arm64/entry.S
-index 2d9a2713a1..3e41ba65b6 100644
---- a/xen/arch/arm/arm64/entry.S
-+++ b/xen/arch/arm/arm64/entry.S
-@@ -188,24 +188,63 @@ hyp_error_invalid:
-         entry   hyp=1
-         invalid BAD_ERROR
- 
-+/*
-+ * SError received while running in the hypervisor mode.
-+ *
-+ * Technically, we could unmask the IRQ if it were unmasked in the
-+ * interrupted context. However, this require to check the PSTATE. For
-+ * simplicity, as SError should be rare and potentially fatal,
-+ * all interrupts are kept masked.
-+ */
- hyp_error:
-         entry   hyp=1
--        msr     daifclr, #2
-         mov     x0, sp
-         bl      do_trap_hyp_serror
-         exit    hyp=1
- 
--/* Traps taken in Current EL with SP_ELx */
-+/*
-+ * Synchronous exception received while running in the hypervisor mode.
-+ *
-+ * While the exception could be executed with all the interrupts (e.g.
-+ * IRQ) unmasked, the interrupted context may have purposefully masked
-+ * some of them. So we want to inherit the state from the interrupted
-+ * context.
-+ */
- hyp_sync:
-         entry   hyp=1
--        msr     daifclr, #6
-+
-+        /* Inherit interrupts */
-+        mrs     x0, SPSR_el2
-+        and     x0, x0, #(PSR_DBG_MASK | PSR_ABT_MASK | PSR_IRQ_MASK | PSR_FIQ_MASK)
-+        msr     daif, x0
-+
-         mov     x0, sp
-         bl      do_trap_hyp_sync
-         exit    hyp=1
- 
-+/*
-+ * IRQ received while running in the hypervisor mode.
-+ *
-+ * While the exception could be executed with all the interrupts but IRQ
-+ * unmasked, the interrupted context may have purposefully masked some
-+ * of them. So we want to inherit the state from the interrupt context
-+ * and keep IRQ masked.
-+ *
-+ * XXX: We may want to consider an ordering between interrupts (e.g. if
-+ * SError are masked, then IRQ should be masked too). However, this
-+ * would require some rework in some paths (e.g. panic, livepatch) to
-+ * ensure the ordering is enforced everywhere.
-+ */
- hyp_irq:
-         entry   hyp=1
--        msr     daifclr, #4
-+
-+        /* Inherit D, A, F interrupts and keep I masked */
-+        mrs     x0, SPSR_el2
-+        mov     x1, #(PSR_DBG_MASK | PSR_ABT_MASK | PSR_FIQ_MASK)
-+        and     x0, x0, x1
-+        orr     x0, x0, #PSR_IRQ_MASK
-+        msr     daif, x0
-+
-         mov     x0, sp
-         bl      do_trap_irq
-         exit    hyp=1
--- 
-2.11.0
-

xsa304-4.12-1.patch

@@ -1,71 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/vtd: Hide superpage support for SandyBridge IOMMUs
-
-Something causes SandyBridge IOMMUs to choke when sharing EPT pagetables, and
-an EPT superpage gets shattered.  The root cause is still under investigation,
-but the end result is unusable in combination with CVE-2018-12207 protections.
-
-This is part of XSA-304 / CVE-2018-12207
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-
-diff --git a/xen/drivers/passthrough/vtd/extern.h b/xen/drivers/passthrough/vtd/extern.h
-index 16eada9fa2..a71c8b0f84 100644
---- a/xen/drivers/passthrough/vtd/extern.h
-+++ b/xen/drivers/passthrough/vtd/extern.h
-@@ -97,6 +97,8 @@ void vtd_ops_postamble_quirk(struct iommu* iommu);
- int __must_check me_wifi_quirk(struct domain *domain,
-                                u8 bus, u8 devfn, int map);
- void pci_vtd_quirk(const struct pci_dev *);
-+void quirk_iommu_caps(struct iommu *iommu);
-+
- bool_t platform_supports_intremap(void);
- bool_t platform_supports_x2apic(void);
- 
-diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
-index b3664ecbe0..5d34f75306 100644
---- a/xen/drivers/passthrough/vtd/iommu.c
-+++ b/xen/drivers/passthrough/vtd/iommu.c
-@@ -1215,6 +1215,8 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd)
-     if ( !(iommu->cap + 1) || !(iommu->ecap + 1) )
-         return -ENODEV;
- 
-+    quirk_iommu_caps(iommu);
-+
-     if ( cap_fault_reg_offset(iommu->cap) +
-          cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_REG_LEN >= PAGE_SIZE ||
-          ecap_iotlb_offset(iommu->ecap) >= PAGE_SIZE )
-diff --git a/xen/drivers/passthrough/vtd/quirks.c b/xen/drivers/passthrough/vtd/quirks.c
-index d6db862678..b02688e316 100644
---- a/xen/drivers/passthrough/vtd/quirks.c
-+++ b/xen/drivers/passthrough/vtd/quirks.c
-@@ -540,3 +540,28 @@ void pci_vtd_quirk(const struct pci_dev *pdev)
-         break;
-     }
- }
-+
-+void __init quirk_iommu_caps(struct iommu *iommu)
-+{
-+    /*
-+     * IOMMU Quirks:
-+     *
-+     * SandyBridge IOMMUs claim support for 2M and 1G superpages, but don't
-+     * implement superpages internally.
-+     *
-+     * There are issues changing the walk length under in-flight DMA, which
-+     * has manifested as incompatibility between EPT/IOMMU sharing and the
-+     * workaround for CVE-2018-12207 / XSA-304.  Hide the superpages
-+     * capabilities in the IOMMU, which will prevent Xen from sharing the EPT
-+     * and IOMMU pagetables.
-+     *
-+     * Detection of SandyBridge unfortunately has to be done by processor
-+     * model because the client parts don't expose their IOMMUs as PCI devices
-+     * we could match with a Device ID.
-+     */
-+    if ( boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
-+         boot_cpu_data.x86 == 6 &&
-+         (boot_cpu_data.x86_model == 0x2a ||
-+          boot_cpu_data.x86_model == 0x2d) )
-+        iommu->cap &= ~(0xful << 34);
-+}

xsa304-4.12-2.patch

@@ -1,272 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/vtx: Disable executable EPT superpages to work around
- CVE-2018-12207
-
-CVE-2018-12207 covers a set of errata on various Intel processors, whereby a
-machine check exception can be generated in a corner case when an executable
-mapping changes size or cacheability without TLB invalidation.  HVM guest
-kernels can trigger this to DoS the host.
-
-To mitigate, in affected hardware, all EPT superpages are marked NX.  When an
-instruction fetch violation is observed against the superpage, the superpage
-is shattered to 4k and has execute permissions restored.  This prevents the
-guest kernel from being able to create the necessary preconditions in the iTLB
-to exploit the vulnerability.
-
-This does come with a workload-dependent performance overhead, caused by
-increased TLB pressure.  Performance can be restored, if guest kernels are
-trusted not to mount an attack, by specifying ept=exec-sp on the command line.
-
-This is part of XSA-304 / CVE-2018-12207
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-
-diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
-index 85081fdc94..e283017015 100644
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -895,7 +895,7 @@ Controls for interacting with the system Extended Firmware Interface.
-     uncacheable.
- 
- ### ept
--> `= List of [ ad=<bool>, pml=<bool> ]`
-+> `= List of [ ad=<bool>, pml=<bool>, exec-sp=<bool> ]`
- 
- > Applicability: Intel
- 
-@@ -926,6 +926,16 @@ introduced with the Nehalem architecture.
-     disable PML.  `pml=0` can be used to prevent the use of PML on otherwise
-     capable hardware.
- 
-+*   The `exec-sp` boolean controls whether EPT superpages with execute
-+    permissions are permitted.  In general this is good for performance.
-+
-+    However, on processors vulnerable CVE-2018-12207, HVM guest kernels can
-+    use executable superpages to crash the host.  By default, executable
-+    superpages are disabled on affected hardware.
-+
-+    If HVM guest kernels are trusted not to mount a DoS against the system,
-+    this option can enabled to regain performance.
-+
- ### extra_guest_irqs
- > `= [<domU number>][,<dom0 number>]`
- 
-diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
-index 2089a77270..84191d4e4b 100644
---- a/xen/arch/x86/hvm/hvm.c
-+++ b/xen/arch/x86/hvm/hvm.c
-@@ -1814,6 +1814,24 @@ int hvm_hap_nested_page_fault(paddr_t gpa, unsigned long gla,
-             break;
-         }
- 
-+        /*
-+         * Workaround for XSA-304 / CVE-2018-12207.  If we take an execution
-+         * fault against a non-executable superpage, shatter it to regain
-+         * execute permissions.
-+         */
-+        if ( page_order > 0 && npfec.insn_fetch && npfec.present && !violation )
-+        {
-+            int res = p2m_set_entry(p2m, _gfn(gfn), mfn, PAGE_ORDER_4K,
-+                                    p2mt, p2ma);
-+
-+            if ( res )
-+                printk(XENLOG_ERR "Failed to shatter gfn %"PRI_gfn": %d\n",
-+                       gfn, res);
-+
-+            rc = !res;
-+            goto out_put_gfn;
-+        }
-+
-         if ( violation )
-         {
-             /* Should #VE be emulated for this fault? */
-diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
-index 56519fee84..ec5ab860ad 100644
---- a/xen/arch/x86/hvm/vmx/vmcs.c
-+++ b/xen/arch/x86/hvm/vmx/vmcs.c
-@@ -67,6 +67,7 @@ integer_param("ple_window", ple_window);
- 
- static bool __read_mostly opt_ept_pml = true;
- static s8 __read_mostly opt_ept_ad = -1;
-+int8_t __read_mostly opt_ept_exec_sp = -1;
- 
- static int __init parse_ept_param(const char *s)
- {
-@@ -82,6 +83,8 @@ static int __init parse_ept_param(const char *s)
-             opt_ept_ad = val;
-         else if ( (val = parse_boolean("pml", s, ss)) >= 0 )
-             opt_ept_pml = val;
-+        else if ( (val = parse_boolean("exec-sp", s, ss)) >= 0 )
-+            opt_ept_exec_sp = val;
-         else
-             rc = -EINVAL;
- 
-diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
-index 26b7ddb5fe..28cba8ec28 100644
---- a/xen/arch/x86/hvm/vmx/vmx.c
-+++ b/xen/arch/x86/hvm/vmx/vmx.c
-@@ -2445,6 +2445,102 @@ static void pi_notification_interrupt(struct cpu_user_regs *regs)
- static void __init lbr_tsx_fixup_check(void);
- static void __init bdw_erratum_bdf14_fixup_check(void);
- 
-+/*
-+ * Calculate whether the CPU is vulnerable to Instruction Fetch page
-+ * size-change MCEs.
-+ */
-+static bool __init has_if_pschange_mc(void)
-+{
-+    uint64_t caps = 0;
-+
-+    /*
-+     * If we are virtualised, there is nothing we can do.  Our EPT tables are
-+     * shadowed by our hypervisor, and not walked by hardware.
-+     */
-+    if ( cpu_has_hypervisor )
-+        return false;
-+
-+    if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) )
-+        rdmsrl(MSR_ARCH_CAPABILITIES, caps);
-+
-+    if ( caps & ARCH_CAPS_IF_PSCHANGE_MC_NO )
-+        return false;
-+
-+    /*
-+     * IF_PSCHANGE_MC is only known to affect Intel Family 6 processors at
-+     * this time.
-+     */
-+    if ( boot_cpu_data.x86_vendor != X86_VENDOR_INTEL ||
-+         boot_cpu_data.x86 != 6 )
-+        return false;
-+
-+    switch ( boot_cpu_data.x86_model )
-+    {
-+        /*
-+         * Core processors since at least Nehalem are vulnerable.
-+         */
-+    case 0x1f: /* Auburndale / Havendale */
-+    case 0x1e: /* Nehalem */
-+    case 0x1a: /* Nehalem EP */
-+    case 0x2e: /* Nehalem EX */
-+    case 0x25: /* Westmere */
-+    case 0x2c: /* Westmere EP */
-+    case 0x2f: /* Westmere EX */
-+    case 0x2a: /* SandyBridge */
-+    case 0x2d: /* SandyBridge EP/EX */
-+    case 0x3a: /* IvyBridge */
-+    case 0x3e: /* IvyBridge EP/EX */
-+    case 0x3c: /* Haswell */
-+    case 0x3f: /* Haswell EX/EP */
-+    case 0x45: /* Haswell D */
-+    case 0x46: /* Haswell H */
-+    case 0x3d: /* Broadwell */
-+    case 0x47: /* Broadwell H */
-+    case 0x4f: /* Broadwell EP/EX */
-+    case 0x56: /* Broadwell D */
-+    case 0x4e: /* Skylake M */
-+    case 0x5e: /* Skylake D */
-+    case 0x55: /* Skylake-X / Cascade Lake */
-+    case 0x8e: /* Kaby / Coffee / Whiskey Lake M */
-+    case 0x9e: /* Kaby / Coffee / Whiskey Lake D */
-+        return true;
-+
-+        /*
-+         * Atom processors are not vulnerable.
-+         */
-+    case 0x1c: /* Pineview */
-+    case 0x26: /* Lincroft */
-+    case 0x27: /* Penwell */
-+    case 0x35: /* Cloverview */
-+    case 0x36: /* Cedarview */
-+    case 0x37: /* Baytrail / Valleyview (Silvermont) */
-+    case 0x4d: /* Avaton / Rangely (Silvermont) */
-+    case 0x4c: /* Cherrytrail / Brasswell */
-+    case 0x4a: /* Merrifield */
-+    case 0x5a: /* Moorefield */
-+    case 0x5c: /* Goldmont */
-+    case 0x5d: /* SoFIA 3G Granite/ES2.1 */
-+    case 0x65: /* SoFIA LTE AOSP */
-+    case 0x5f: /* Denverton */
-+    case 0x6e: /* Cougar Mountain */
-+    case 0x75: /* Lightning Mountain */
-+    case 0x7a: /* Gemini Lake */
-+    case 0x86: /* Jacobsville */
-+
-+        /*
-+         * Knights processors are not vulnerable.
-+         */
-+    case 0x57: /* Knights Landing */
-+    case 0x85: /* Knights Mill */
-+        return false;
-+
-+    default:
-+        printk("Unrecognised CPU model %#x - assuming vulnerable to IF_PSCHANGE_MC\n",
-+               boot_cpu_data.x86_model);
-+        return true;
-+    }
-+}
-+
- const struct hvm_function_table * __init start_vmx(void)
- {
-     set_in_cr4(X86_CR4_VMXE);
-@@ -2465,6 +2561,17 @@ const struct hvm_function_table * __init start_vmx(void)
-      */
-     if ( cpu_has_vmx_ept && (cpu_has_vmx_pat || opt_force_ept) )
-     {
-+        bool cpu_has_bug_pschange_mc = has_if_pschange_mc();
-+
-+        if ( opt_ept_exec_sp == -1 )
-+        {
-+            /* Default to non-executable superpages on vulnerable hardware. */
-+            opt_ept_exec_sp = !cpu_has_bug_pschange_mc;
-+
-+            if ( cpu_has_bug_pschange_mc )
-+                printk("VMX: Disabling executable EPT superpages due to CVE-2018-12207\n");
-+        }
-+
-         vmx_function_table.hap_supported = 1;
-         vmx_function_table.altp2m_supported = 1;
- 
-diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
-index 952ebad82f..834d4798c8 100644
---- a/xen/arch/x86/mm/p2m-ept.c
-+++ b/xen/arch/x86/mm/p2m-ept.c
-@@ -174,6 +174,12 @@ static void ept_p2m_type_to_flags(struct p2m_domain *p2m, ept_entry_t *entry,
-             break;
-     }
-     
-+    /*
-+     * Don't create executable superpages if we need to shatter them to
-+     * protect against CVE-2018-12207.
-+     */
-+    if ( !opt_ept_exec_sp && is_epte_superpage(entry) )
-+        entry->x = 0;
- }
- 
- #define GUEST_TABLE_MAP_FAILED  0
-diff --git a/xen/include/asm-x86/hvm/vmx/vmx.h b/xen/include/asm-x86/hvm/vmx/vmx.h
-index ebaa74449b..371b912887 100644
---- a/xen/include/asm-x86/hvm/vmx/vmx.h
-+++ b/xen/include/asm-x86/hvm/vmx/vmx.h
-@@ -28,6 +28,8 @@
- #include <asm/hvm/trace.h>
- #include <asm/hvm/vmx/vmcs.h>
- 
-+extern int8_t opt_ept_exec_sp;
-+
- typedef union {
-     struct {
-         u64 r       :   1,  /* bit 0 - Read permission */
-diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
-index 637259bd1f..32746aa8ae 100644
---- a/xen/include/asm-x86/msr-index.h
-+++ b/xen/include/asm-x86/msr-index.h
-@@ -52,6 +52,7 @@
- #define ARCH_CAPS_SKIP_L1DFL		(_AC(1, ULL) << 3)
- #define ARCH_CAPS_SSB_NO		(_AC(1, ULL) << 4)
- #define ARCH_CAPS_MDS_NO		(_AC(1, ULL) << 5)
-+#define ARCH_CAPS_IF_PSCHANGE_MC_NO	(_AC(1, ULL) << 6)
- 
- #define MSR_FLUSH_CMD			0x0000010b
- #define FLUSH_CMD_L1D			(_AC(1, ULL) << 0)

xsa304-4.12-3.patch

@@ -1,108 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/vtx: Allow runtime modification of the exec-sp setting
-
-See patch for details.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: George Dunlap <george.dunlap@citrix.com>
-
-diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
-index e283017015..84221fe60a 100644
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -936,6 +936,21 @@ introduced with the Nehalem architecture.
-     If HVM guest kernels are trusted not to mount a DoS against the system,
-     this option can enabled to regain performance.
- 
-+    This boolean may be modified at runtime using `xl set-parameters
-+    ept=[no-]exec-sp` to switch between fast and secure.
-+
-+    *   When switching from secure to fast, preexisting HVM domains will run
-+        at their current performance until they are rebooted; new domains will
-+        run without any overhead.
-+
-+    *   When switching from fast to secure, all HVM domains will immediately
-+        suffer a performance penalty.
-+
-+    **Warning: No guarantee is made that this runtime option will be retained
-+      indefinitely, or that it will retain this exact behaviour.  It is
-+      intended as an emergency option for people who first chose fast, then
-+      change their minds to secure, and wish not to reboot.**
-+
- ### extra_guest_irqs
- > `= [<domU number>][,<dom0 number>]`
- 
-diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
-index ec5ab860ad..c4d8a5ba78 100644
---- a/xen/arch/x86/hvm/vmx/vmcs.c
-+++ b/xen/arch/x86/hvm/vmx/vmcs.c
-@@ -95,6 +95,41 @@ static int __init parse_ept_param(const char *s)
- }
- custom_param("ept", parse_ept_param);
- 
-+static int parse_ept_param_runtime(const char *s)
-+{
-+    int val;
-+
-+    if ( !cpu_has_vmx_ept || !hvm_funcs.hap_supported ||
-+         !(hvm_funcs.hap_capabilities &
-+           (HVM_HAP_SUPERPAGE_2MB | HVM_HAP_SUPERPAGE_1GB)) )
-+    {
-+        printk("VMX: EPT not available, or not in use - ignoring\n");
-+        return 0;
-+    }
-+
-+    if ( (val = parse_boolean("exec-sp", s, NULL)) < 0 )
-+        return -EINVAL;
-+
-+    if ( val != opt_ept_exec_sp )
-+    {
-+        struct domain *d;
-+
-+        opt_ept_exec_sp = val;
-+
-+        rcu_read_lock(&domlist_read_lock);
-+        for_each_domain ( d )
-+            if ( paging_mode_hap(d) )
-+                p2m_change_entry_type_global(d, p2m_ram_rw, p2m_ram_rw);
-+        rcu_read_unlock(&domlist_read_lock);
-+    }
-+
-+    printk("VMX: EPT executable superpages %sabled\n",
-+           val ? "en" : "dis");
-+
-+    return 0;
-+}
-+custom_runtime_only_param("ept", parse_ept_param_runtime);
-+
- /* Dynamic (run-time adjusted) execution control flags. */
- u32 vmx_pin_based_exec_control __read_mostly;
- u32 vmx_cpu_based_exec_control __read_mostly;
-diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
-index f518f86493..16608098b1 100644
---- a/xen/arch/x86/mm/p2m.c
-+++ b/xen/arch/x86/mm/p2m.c
-@@ -289,15 +289,20 @@ static void change_entry_type_global(struct p2m_domain *p2m,
-                                      p2m_type_t ot, p2m_type_t nt)
- {
-     p2m->change_entry_type_global(p2m, ot, nt);
--    p2m->global_logdirty = (nt == p2m_ram_logdirty);
-+    /* Don't allow 'recalculate' operations to change the logdirty state. */
-+    if ( ot != nt )
-+        p2m->global_logdirty = (nt == p2m_ram_logdirty);
- }
- 
-+/*
-+ * May be called with ot = nt = p2m_ram_rw for its side effect of
-+ * recalculating all PTEs in the p2m.
-+ */
- void p2m_change_entry_type_global(struct domain *d,
-                                   p2m_type_t ot, p2m_type_t nt)
- {
-     struct p2m_domain *hostp2m = p2m_get_hostp2m(d);
- 
--    ASSERT(ot != nt);
-     ASSERT(p2m_is_changeable(ot) && p2m_is_changeable(nt));
- 
-     p2m_lock(hostp2m);

xsa305-4.12-1.patch

@@ -1,288 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/tsx: Introduce tsx= to use MSR_TSX_CTRL when available
-
-To protect against the TSX Async Abort speculative vulnerability, Intel have
-released new microcode for affected parts which introduce the MSR_TSX_CTRL
-control, which allows TSX to be turned off.  This will be architectural on
-future parts.
-
-Introduce tsx= to provide a global on/off for TSX, including its enumeration
-via CPUID.  Provide stub virtualisation of this MSR, as it is not exposed to
-guests at the moment.
-
-VMs may have booted before microcode is loaded, or before hosts have rebooted,
-and they still want to migrate freely.  A VM which booted seeing TSX can
-migrate safely to hosts with TSX disabled - TSX will start unconditionally
-aborting, but still behave in a manner compatible with the ABI.
-
-The guest-visible behaviour is equivalent to late loading the microcode and
-setting the RTM_DISABLE bit in the course of live patching.
-
-This is part of XSA-305 / CVE-2019-11135
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-
-diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
-index e283017015..b7e1bf8e8b 100644
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -2033,6 +2033,20 @@ Xen version.
- ### tsc (x86)
- > `= unstable | skewed | stable:socket`
- 
-+### tsx
-+    = <bool>
-+
-+    Applicability: x86
-+    Default: true
-+
-+Controls for the use of Transactional Synchronization eXtensions.
-+
-+On Intel parts released in Q3 2019 (with updated microcode), and future parts,
-+a control has been introduced which allows TSX to be turned off.
-+
-+On systems with the ability to turn TSX off, this boolean offers system wide
-+control of whether TSX is enabled or disabled.
-+
- ### ucode (x86)
- > `= [<integer> | scan]`
- 
-diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
-index 8a8d8f060f..9b9a4435fb 100644
---- a/xen/arch/x86/Makefile
-+++ b/xen/arch/x86/Makefile
-@@ -66,6 +66,7 @@ obj-y += sysctl.o
- obj-y += time.o
- obj-y += trace.o
- obj-y += traps.o
-+obj-y += tsx.o
- obj-y += usercopy.o
- obj-y += x86_emulate.o
- obj-$(CONFIG_TBOOT) += tboot.o
-diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c
-index 57e80694f2..1727497459 100644
---- a/xen/arch/x86/cpuid.c
-+++ b/xen/arch/x86/cpuid.c
-@@ -524,6 +524,20 @@ void recalculate_cpuid_policy(struct domain *d)
-     if ( cpu_has_itsc && (d->disable_migrate || d->arch.vtsc) )
-         __set_bit(X86_FEATURE_ITSC, max_fs);
- 
-+    /*
-+     * On hardware with MSR_TSX_CTRL, the admin may have elected to disable
-+     * TSX and hide the feature bits.  Migrating-in VMs may have been booted
-+     * pre-mitigation when the TSX features were visbile.
-+     *
-+     * This situation is compatible (albeit with a perf hit to any TSX code in
-+     * the guest), so allow the feature bits to remain set.
-+     */
-+    if ( cpu_has_tsx_ctrl )
-+    {
-+        __set_bit(X86_FEATURE_HLE, max_fs);
-+        __set_bit(X86_FEATURE_RTM, max_fs);
-+    }
-+
-     /* Clamp the toolstacks choices to reality. */
-     for ( i = 0; i < ARRAY_SIZE(fs); i++ )
-         fs[i] &= max_fs[i];
-diff --git a/xen/arch/x86/msr.c b/xen/arch/x86/msr.c
-index 56de0fe9e1..c2722d7c73 100644
---- a/xen/arch/x86/msr.c
-+++ b/xen/arch/x86/msr.c
-@@ -132,6 +132,7 @@ int guest_rdmsr(const struct vcpu *v, uint32_t msr, uint64_t *val)
-     case MSR_FLUSH_CMD:
-         /* Write-only */
-     case MSR_TSX_FORCE_ABORT:
-+    case MSR_TSX_CTRL:
-         /* Not offered to guests. */
-         goto gp_fault;
- 
-@@ -260,6 +261,7 @@ int guest_wrmsr(struct vcpu *v, uint32_t msr, uint64_t val)
-     case MSR_ARCH_CAPABILITIES:
-         /* Read-only */
-     case MSR_TSX_FORCE_ABORT:
-+    case MSR_TSX_CTRL:
-         /* Not offered to guests. */
-         goto gp_fault;
- 
-diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
-index cf790f36ef..c1c7c44000 100644
---- a/xen/arch/x86/setup.c
-+++ b/xen/arch/x86/setup.c
-@@ -1594,6 +1594,8 @@ void __init noreturn __start_xen(unsigned long mbi_p)
- 
-     early_microcode_init();
- 
-+    tsx_init(); /* Needs microcode.  May change HLE/RTM feature bits. */
-+
-     identify_cpu(&boot_cpu_data);
- 
-     set_in_cr4(X86_CR4_OSFXSR | X86_CR4_OSXMMEXCPT);
-diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
-index 737a44f055..e21cf0a310 100644
---- a/xen/arch/x86/smpboot.c
-+++ b/xen/arch/x86/smpboot.c
-@@ -376,6 +376,8 @@ void start_secondary(void *unused)
-     if ( boot_cpu_has(X86_FEATURE_IBRSB) )
-         wrmsrl(MSR_SPEC_CTRL, default_xen_spec_ctrl);
- 
-+    tsx_init(); /* Needs microcode.  May change HLE/RTM feature bits. */
-+
-     if ( xen_guest )
-         hypervisor_ap_setup();
- 
-diff --git a/xen/arch/x86/tsx.c b/xen/arch/x86/tsx.c
-new file mode 100644
-index 0000000000..a8ec2ccc69
---- /dev/null
-+++ b/xen/arch/x86/tsx.c
-@@ -0,0 +1,74 @@
-+#include <xen/init.h>
-+#include <asm/msr.h>
-+
-+/*
-+ * Valid values:
-+ *   1 => Explicit tsx=1
-+ *   0 => Explicit tsx=0
-+ *  -1 => Default, implicit tsx=1
-+ *
-+ * This is arranged such that the bottom bit encodes whether TSX is actually
-+ * disabled, while identifying various explicit (>=0) and implicit (<0)
-+ * conditions.
-+ */
-+int8_t __read_mostly opt_tsx = -1;
-+int8_t __read_mostly cpu_has_tsx_ctrl = -1;
-+
-+static int __init parse_tsx(const char *s)
-+{
-+    int rc = 0, val = parse_bool(s, NULL);
-+
-+    if ( val >= 0 )
-+        opt_tsx = val;
-+    else
-+        rc = -EINVAL;
-+
-+    return rc;
-+}
-+custom_param("tsx", parse_tsx);
-+
-+void tsx_init(void)
-+{
-+    /*
-+     * This function is first called between microcode being loaded, and CPUID
-+     * being scanned generally.  Calculate from raw data whether MSR_TSX_CTRL
-+     * is available.
-+     */
-+    if ( unlikely(cpu_has_tsx_ctrl < 0) )
-+    {
-+        uint64_t caps = 0;
-+
-+        if ( boot_cpu_data.cpuid_level >= 7 &&
-+             (cpuid_count_edx(7, 0) & cpufeat_mask(X86_FEATURE_ARCH_CAPS)) )
-+            rdmsrl(MSR_ARCH_CAPABILITIES, caps);
-+
-+        cpu_has_tsx_ctrl = !!(caps & ARCH_CAPS_TSX_CTRL);
-+    }
-+
-+    if ( cpu_has_tsx_ctrl )
-+    {
-+        uint64_t val;
-+
-+        rdmsrl(MSR_TSX_CTRL, val);
-+
-+        val &= ~(TSX_CTRL_RTM_DISABLE | TSX_CTRL_CPUID_CLEAR);
-+        /* Check bottom bit only.  Higher bits are various sentinals. */
-+        if ( !(opt_tsx & 1) )
-+            val |= TSX_CTRL_RTM_DISABLE | TSX_CTRL_CPUID_CLEAR;
-+
-+        wrmsrl(MSR_TSX_CTRL, val);
-+    }
-+    else if ( opt_tsx >= 0 )
-+        printk_once(XENLOG_WARNING
-+                    "MSR_TSX_CTRL not available - Ignoring tsx= setting\n");
-+}
-+
-+/*
-+ * Local variables:
-+ * mode: C
-+ * c-file-style: "BSD"
-+ * c-basic-offset: 4
-+ * tab-width: 4
-+ * indent-tabs-mode: nil
-+ * End:
-+ */
-diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
-index 32746aa8ae..d5f3899f73 100644
---- a/xen/include/asm-x86/msr-index.h
-+++ b/xen/include/asm-x86/msr-index.h
-@@ -53,6 +53,7 @@
- #define ARCH_CAPS_SSB_NO		(_AC(1, ULL) << 4)
- #define ARCH_CAPS_MDS_NO		(_AC(1, ULL) << 5)
- #define ARCH_CAPS_IF_PSCHANGE_MC_NO	(_AC(1, ULL) << 6)
-+#define ARCH_CAPS_TSX_CTRL		(_AC(1, ULL) << 7)
- 
- #define MSR_FLUSH_CMD			0x0000010b
- #define FLUSH_CMD_L1D			(_AC(1, ULL) << 0)
-@@ -60,6 +61,10 @@
- #define MSR_TSX_FORCE_ABORT             0x0000010f
- #define TSX_FORCE_ABORT_RTM             (_AC(1, ULL) <<  0)
- 
-+#define MSR_TSX_CTRL                    0x00000122
-+#define TSX_CTRL_RTM_DISABLE            (_AC(1, ULL) <<  0)
-+#define TSX_CTRL_CPUID_CLEAR            (_AC(1, ULL) <<  1)
-+
- /* Intel MSRs. Some also available on other CPUs */
- #define MSR_IA32_PERFCTR0		0x000000c1
- #define MSR_IA32_A_PERFCTR0		0x000004c1
-diff --git a/xen/include/asm-x86/processor.h b/xen/include/asm-x86/processor.h
-index d33ac34d29..1b52712180 100644
---- a/xen/include/asm-x86/processor.h
-+++ b/xen/include/asm-x86/processor.h
-@@ -263,6 +263,16 @@ static always_inline unsigned int cpuid_count_ebx(
-     return ebx;
- }
- 
-+static always_inline unsigned int cpuid_count_edx(
-+    unsigned int leaf, unsigned int subleaf)
-+{
-+    unsigned int edx, tmp;
-+
-+    cpuid_count(leaf, subleaf, &tmp, &tmp, &tmp, &edx);
-+
-+    return edx;
-+}
-+
- static inline unsigned long read_cr0(void)
- {
-     unsigned long cr0;
-@@ -609,6 +619,9 @@ static inline uint8_t get_cpu_family(uint32_t raw, uint8_t *model,
-     return fam;
- }
- 
-+extern int8_t opt_tsx, cpu_has_tsx_ctrl;
-+void tsx_init(void);
-+
- #endif /* !__ASSEMBLY__ */
- 
- #endif /* __ASM_X86_PROCESSOR_H */
-diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h
-index 89939f43c8..6529f12dae 100644
---- a/xen/include/xen/lib.h
-+++ b/xen/include/xen/lib.h
-@@ -114,6 +114,16 @@ extern int printk_ratelimit(void);
- #define gprintk(lvl, fmt, args...) \
-     printk(XENLOG_GUEST lvl "%pv " fmt, current, ## args)
- 
-+#define printk_once(fmt, args...)               \
-+({                                              \
-+    static bool __read_mostly once_;            \
-+    if ( unlikely(!once_) )                     \
-+    {                                           \
-+        once_ = true;                           \
-+        printk(fmt, ## args);                   \
-+    }                                           \
-+})
-+
- #ifdef NDEBUG
- 
- static inline void

xsa305-4.12-2.patch

@@ -1,192 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/spec-ctrl: Mitigate the TSX Asynchronous Abort sidechannel
-
-See patch documentation and comments.
-
-This is part of XSA-305 / CVE-2019-11135
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-
-diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
-index b7e1bf8e8b..74e1e35b88 100644
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -1920,7 +1920,7 @@ extreme care.**
- An overall boolean value, `spec-ctrl=no`, can be specified to turn off all
- mitigations, including pieces of infrastructure used to virtualise certain
- mitigation features for guests.  This also includes settings which `xpti`,
--`smt`, `pv-l1tf` control, unless the respective option(s) have been
-+`smt`, `pv-l1tf`, `tsx` control, unless the respective option(s) have been
- specified earlier on the command line.
- 
- Alternatively, a slightly more restricted `spec-ctrl=no-xen` can be used to
-@@ -2037,7 +2037,7 @@ Xen version.
-     = <bool>
- 
-     Applicability: x86
--    Default: true
-+    Default: false on parts vulnerable to TAA, true otherwise
- 
- Controls for the use of Transactional Synchronization eXtensions.
- 
-@@ -2047,6 +2047,19 @@ a control has been introduced which allows TSX to be turned off.
- On systems with the ability to turn TSX off, this boolean offers system wide
- control of whether TSX is enabled or disabled.
- 
-+On parts vulnerable to CVE-2019-11135 / TSX Asynchronous Abort, the following
-+logic applies:
-+
-+ * An explicit `tsx=` choice is honoured, even if it is `true` and would
-+   result in a vulnerable system.
-+
-+ * When no explicit `tsx=` choice is given, parts vulnerable to TAA will be
-+   mitigated by disabling TSX, as this is the lowest overhead option.
-+
-+ * If the use of TSX is important, the more expensive TAA mitigations can be
-+   opted in to with `smt=0 spec-ctrl=md-clear`, at which point TSX will remain
-+   active by default.
-+
- ### ucode (x86)
- > `= [<integer> | scan]`
- 
-diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
-index b37d40e643..800139d79c 100644
---- a/xen/arch/x86/spec_ctrl.c
-+++ b/xen/arch/x86/spec_ctrl.c
-@@ -96,6 +96,9 @@ static int __init parse_spec_ctrl(const char *s)
-             if ( opt_pv_l1tf_domu < 0 )
-                 opt_pv_l1tf_domu = 0;
- 
-+            if ( opt_tsx == -1 )
-+                opt_tsx = -3;
-+
-         disable_common:
-             opt_rsb_pv = false;
-             opt_rsb_hvm = false;
-@@ -306,7 +309,7 @@ static void __init print_details(enum ind_thunk thunk, uint64_t caps)
-     printk("Speculative mitigation facilities:\n");
- 
-     /* Hardware features which pertain to speculative mitigations. */
--    printk("  Hardware features:%s%s%s%s%s%s%s%s%s%s%s%s\n",
-+    printk("  Hardware features:%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
-            (_7d0 & cpufeat_mask(X86_FEATURE_IBRSB)) ? " IBRS/IBPB" : "",
-            (_7d0 & cpufeat_mask(X86_FEATURE_STIBP)) ? " STIBP"     : "",
-            (_7d0 & cpufeat_mask(X86_FEATURE_L1D_FLUSH)) ? " L1D_FLUSH" : "",
-@@ -318,7 +321,9 @@ static void __init print_details(enum ind_thunk thunk, uint64_t caps)
-            (caps & ARCH_CAPS_RSBA)                  ? " RSBA"      : "",
-            (caps & ARCH_CAPS_SKIP_L1DFL)            ? " SKIP_L1DFL": "",
-            (caps & ARCH_CAPS_SSB_NO)                ? " SSB_NO"    : "",
--           (caps & ARCH_CAPS_MDS_NO)                ? " MDS_NO"    : "");
-+           (caps & ARCH_CAPS_MDS_NO)                ? " MDS_NO"    : "",
-+           (caps & ARCH_CAPS_TSX_CTRL)              ? " TSX_CTRL"  : "",
-+           (caps & ARCH_CAPS_TAA_NO)                ? " TAA_NO"    : "");
- 
-     /* Compiled-in support which pertains to mitigations. */
-     if ( IS_ENABLED(CONFIG_INDIRECT_THUNK) || IS_ENABLED(CONFIG_SHADOW_PAGING) )
-@@ -332,7 +337,7 @@ static void __init print_details(enum ind_thunk thunk, uint64_t caps)
-                "\n");
- 
-     /* Settings for Xen's protection, irrespective of guests. */
--    printk("  Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s, Other:%s%s%s\n",
-+    printk("  Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s%s, Other:%s%s%s\n",
-            thunk == THUNK_NONE      ? "N/A" :
-            thunk == THUNK_RETPOLINE ? "RETPOLINE" :
-            thunk == THUNK_LFENCE    ? "LFENCE" :
-@@ -341,6 +346,8 @@ static void __init print_details(enum ind_thunk thunk, uint64_t caps)
-            (default_xen_spec_ctrl & SPEC_CTRL_IBRS)  ? "IBRS+" :  "IBRS-",
-            !boot_cpu_has(X86_FEATURE_SSBD)           ? "" :
-            (default_xen_spec_ctrl & SPEC_CTRL_SSBD)  ? " SSBD+" : " SSBD-",
-+           !(caps & ARCH_CAPS_TSX_CTRL)              ? "" :
-+           (opt_tsx & 1)                             ? " TSX+" : " TSX-",
-            opt_ibpb                                  ? " IBPB"  : "",
-            opt_l1d_flush                             ? " L1D_FLUSH" : "",
-            opt_md_clear_pv || opt_md_clear_hvm       ? " VERW"  : "");
-@@ -862,6 +869,7 @@ void __init init_speculation_mitigations(void)
- {
-     enum ind_thunk thunk = THUNK_DEFAULT;
-     bool use_spec_ctrl = false, ibrs = false, hw_smt_enabled;
-+    bool cpu_has_bug_taa;
-     uint64_t caps = 0;
- 
-     if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) )
-@@ -1086,6 +1094,53 @@ void __init init_speculation_mitigations(void)
-             "enabled.  Mitigations will not be fully effective.  Please\n"
-             "choose an explicit smt=<bool> setting.  See XSA-297.\n");
- 
-+    /*
-+     * Vulnerability to TAA is a little complicated to quantify.
-+     *
-+     * In the pipeline, it is just another way to get speculative access to
-+     * stale load port, store buffer or fill buffer data, and therefore can be
-+     * considered a superset of MDS (on TSX-capable parts).  On parts which
-+     * predate MDS_NO, the existing VERW flushing will mitigate this
-+     * sidechannel as well.
-+     *
-+     * On parts which contain MDS_NO, the lack of VERW flushing means that an
-+     * attacker can still use TSX to target microarchitectural buffers to leak
-+     * secrets.  Therefore, we consider TAA to be the set of TSX-capable parts
-+     * which have MDS_NO but lack TAA_NO.
-+     *
-+     * Note: cpu_has_rtm (== hle) could already be hidden by `tsx=0` on the
-+     *       cmdline.  MSR_TSX_CTRL will only appear on TSX-capable parts, so
-+     *       we check both to spot TSX in a microcode/cmdline independent way.
-+     */
-+    cpu_has_bug_taa =
-+        (cpu_has_rtm || (caps & ARCH_CAPS_TSX_CTRL)) &&
-+        (caps & (ARCH_CAPS_MDS_NO | ARCH_CAPS_TAA_NO)) == ARCH_CAPS_MDS_NO;
-+
-+    /*
-+     * On TAA-affected hardware, disabling TSX is the preferred mitigation, vs
-+     * the MDS mitigation of disabling HT and using VERW flushing.
-+     *
-+     * On CPUs which advertise MDS_NO, VERW has no flushing side effect until
-+     * the TSX_CTRL microcode is loaded, despite the MD_CLEAR CPUID bit being
-+     * advertised, and there isn't a MD_CLEAR_2 flag to use...
-+     *
-+     * If we're on affected hardware, able to do something about it (which
-+     * implies that VERW now works), no explicit TSX choice and traditional
-+     * MDS mitigations (no-SMT, VERW) not obviosuly in use (someone might
-+     * plausibly value TSX higher than Hyperthreading...), disable TSX to
-+     * mitigate TAA.
-+     */
-+    if ( opt_tsx == -1 && cpu_has_bug_taa && (caps & ARCH_CAPS_TSX_CTRL) &&
-+         ((hw_smt_enabled && opt_smt) ||
-+          !boot_cpu_has(X86_FEATURE_SC_VERW_IDLE)) )
-+    {
-+        setup_clear_cpu_cap(X86_FEATURE_HLE);
-+        setup_clear_cpu_cap(X86_FEATURE_RTM);
-+
-+        opt_tsx = 0;
-+        tsx_init();
-+    }
-+
-     print_details(thunk, caps);
- 
-     /*
-diff --git a/xen/arch/x86/tsx.c b/xen/arch/x86/tsx.c
-index a8ec2ccc69..2d202a0d4e 100644
---- a/xen/arch/x86/tsx.c
-+++ b/xen/arch/x86/tsx.c
-@@ -5,7 +5,8 @@
-  * Valid values:
-  *   1 => Explicit tsx=1
-  *   0 => Explicit tsx=0
-- *  -1 => Default, implicit tsx=1
-+ *  -1 => Default, implicit tsx=1, may change to 0 to mitigate TAA
-+ *  -3 => Implicit tsx=1 (feed-through from spec-ctrl=0)
-  *
-  * This is arranged such that the bottom bit encodes whether TSX is actually
-  * disabled, while identifying various explicit (>=0) and implicit (<0)
-diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
-index d5f3899f73..3971b992d3 100644
---- a/xen/include/asm-x86/msr-index.h
-+++ b/xen/include/asm-x86/msr-index.h
-@@ -54,6 +54,7 @@
- #define ARCH_CAPS_MDS_NO		(_AC(1, ULL) << 5)
- #define ARCH_CAPS_IF_PSCHANGE_MC_NO	(_AC(1, ULL) << 6)
- #define ARCH_CAPS_TSX_CTRL		(_AC(1, ULL) << 7)
-+#define ARCH_CAPS_TAA_NO		(_AC(1, ULL) << 8)
- 
- #define MSR_FLUSH_CMD			0x0000010b
- #define FLUSH_CMD_L1D			(_AC(1, ULL) << 0)

xsa306-4.12.patch

@@ -1,91 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: IOMMU: default to always quarantining PCI devices
-
-XSA-302 relies on the use of libxl's "assignable-add" feature to prepare
-devices to be assigned to untrusted guests.
-
-Unfortunately, this is not considered a strictly required step for
-device assignment. The PCI passthrough documentation on the wiki
-describes alternate ways of preparing devices for assignment, and
-libvirt uses its own ways as well. Hosts where these alternate methods
-are used will still leave the system in a vulnerable state after the
-device comes back from a guest.
-
-Default to always quarantining PCI devices, but provide a command line
-option to revert back to prior behavior (such that people who both
-sufficiently trust their guests and want to be able to use devices in
-Dom0 again after they had been in use by a guest wouldn't need to
-"manually" move such devices back from DomIO to Dom0).
-
-This is XSA-306.
-
-Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Wei Liu <wl@xen.org>
-
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -1171,7 +1171,7 @@ detection of systems known to misbehave
- > Default: `new` unless directed-EOI is supported
- 
- ### iommu
--    = List of [ <bool>, verbose, debug, force, required,
-+    = List of [ <bool>, verbose, debug, force, required, quarantine,
-                 sharept, intremap, intpost, crash-disable,
-                 snoop, qinval, igfx, amd-iommu-perdev-intremap,
-                 dom0-{passthrough,strict} ]
-@@ -1209,6 +1209,12 @@ boolean (e.g. `iommu=no`) can override t
-     will prevent Xen from booting if IOMMUs aren't discovered and enabled
-     successfully.
- 
-+*   The `quarantine` boolean can be used to control Xen's behavior when
-+    de-assigning devices from guests.  If enabled (the default), Xen always
-+    quarantines such devices; they must be explicitly assigned back to Dom0
-+    before they can be used there again.  If disabled, Xen will only
-+    quarantine devices the toolstack hass arranged for getting quarantined.
-+
- *   The `sharept` boolean controls whether the IOMMU pagetables are shared
-     with the CPU-side HAP pagetables, or allocated separately.  Sharing
-     reduces the memory overhead, but doesn't work in combination with CPU-side
---- a/xen/drivers/passthrough/iommu.c
-+++ b/xen/drivers/passthrough/iommu.c
-@@ -30,6 +30,7 @@ bool_t __initdata iommu_enable = 1;
- bool_t __read_mostly iommu_enabled;
- bool_t __read_mostly force_iommu;
- bool_t __read_mostly iommu_verbose;
-+bool __read_mostly iommu_quarantine = true;
- bool_t __read_mostly iommu_igfx = 1;
- bool_t __read_mostly iommu_snoop = 1;
- bool_t __read_mostly iommu_qinval = 1;
-@@ -74,6 +75,8 @@ static int __init parse_iommu_param(cons
-         else if ( (val = parse_boolean("force", s, ss)) >= 0 ||
-                   (val = parse_boolean("required", s, ss)) >= 0 )
-             force_iommu = val;
-+        else if ( (val = parse_boolean("quarantine", s, ss)) >= 0 )
-+            iommu_quarantine = val;
-         else if ( (val = parse_boolean("igfx", s, ss)) >= 0 )
-             iommu_igfx = val;
-         else if ( (val = parse_boolean("verbose", s, ss)) >= 0 )
---- a/xen/drivers/passthrough/pci.c
-+++ b/xen/drivers/passthrough/pci.c
-@@ -1548,7 +1548,8 @@ int deassign_device(struct domain *d, u1
-         return -ENODEV;
- 
-     /* De-assignment from dom_io should de-quarantine the device */
--    target = (pdev->quarantine && pdev->domain != dom_io) ?
-+    target = ((pdev->quarantine || iommu_quarantine) &&
-+              pdev->domain != dom_io) ?
-         dom_io : hardware_domain;
- 
-     while ( pdev->phantom_stride )
---- a/xen/include/xen/iommu.h
-+++ b/xen/include/xen/iommu.h
-@@ -53,7 +53,7 @@ static inline bool_t dfn_eq(dfn_t x, dfn
- }
- 
- extern bool_t iommu_enable, iommu_enabled;
--extern bool_t force_iommu, iommu_verbose, iommu_igfx;
-+extern bool force_iommu, iommu_quarantine, iommu_verbose, iommu_igfx;
- extern bool_t iommu_snoop, iommu_qinval, iommu_intremap, iommu_intpost;
- extern bool_t iommu_hap_pt_share;
- extern bool_t iommu_debug;

xsa307.patch

@@ -1,99 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: x86+Arm32: make find_next_{,zero_}bit() have well defined behavior
-
-These functions getting used with the 2nd and 3rd arguments being equal
-wasn't well defined: Arm64 reliably returns the value of the 2nd
-argument in this case, while on x86 for bitmaps up to 64 bits wide the
-return value was undefined (due to the undefined behavior of a shift of
-a value by the number of bits it's wide) when the incoming value was 64.
-On Arm32 an actual out of bounds access would happen when the
-size/offset value is a multiple of 32; if this access doesn't fault, the
-return value would have been sufficiently correct afaict.
-
-Make the functions consistently tolerate the last two arguments being
-equal (and in fact the 3rd argument being greater or equal to the 2nd),
-in favor of finding and fixing all the use sites that violate the
-original more strict assumption.
-
-This is XSA-307.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Julien Grall <julien@xen.org>
----
-The most obvious (albeit still indirect) exposure to guests is
-evtchn_check_pollers(), which imo makes this a security issue at least
-for Arm32.
-
-This was originally already discussed between (at least) Andrew and me,
-and I don't really recall who brought up the issue first.
-
-Note that Arm's Linux origin of the code may call for syncing
-publication with them. Then again I don't want to tell them just to see
-them go public ahead of us.
-
---- a/xen/arch/arm/arm32/lib/findbit.S
-+++ b/xen/arch/arm/arm32/lib/findbit.S
-@@ -42,8 +42,8 @@ ENDPROC(_find_first_zero_bit_le)
-  * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset)
-  */
- ENTRY(_find_next_zero_bit_le)
--		teq	r1, #0
--		beq	3b
-+		cmp	r1, r2
-+		bls	3b
- 		ands	ip, r2, #7
- 		beq	1b			@ If new byte, goto old routine
-  ARM(		ldrb	r3, [r0, r2, lsr #3]	)
-@@ -83,8 +83,8 @@ ENDPROC(_find_first_bit_le)
-  * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset)
-  */
- ENTRY(_find_next_bit_le)
--		teq	r1, #0
--		beq	3b
-+		cmp	r1, r2
-+		bls	3b
- 		ands	ip, r2, #7
- 		beq	1b			@ If new byte, goto old routine
-  ARM(		ldrb	r3, [r0, r2, lsr #3]	)
-@@ -117,8 +117,8 @@ ENTRY(_find_first_zero_bit_be)
- ENDPROC(_find_first_zero_bit_be)
- 
- ENTRY(_find_next_zero_bit_be)
--		teq	r1, #0
--		beq	3b
-+		cmp	r1, r2
-+		bls	3b
- 		ands	ip, r2, #7
- 		beq	1b			@ If new byte, goto old routine
- 		eor	r3, r2, #0x18		@ big endian byte ordering
-@@ -151,8 +151,8 @@ ENTRY(_find_first_bit_be)
- ENDPROC(_find_first_bit_be)
- 
- ENTRY(_find_next_bit_be)
--		teq	r1, #0
--		beq	3b
-+		cmp	r1, r2
-+		bls	3b
- 		ands	ip, r2, #7
- 		beq	1b			@ If new byte, goto old routine
- 		eor	r3, r2, #0x18		@ big endian byte ordering
---- a/xen/include/asm-x86/bitops.h
-+++ b/xen/include/asm-x86/bitops.h
-@@ -358,7 +358,7 @@ static always_inline unsigned int __scan
-     const unsigned long *a__ = (addr);                                      \
-     unsigned int s__ = (size);                                              \
-     unsigned int o__ = (off);                                               \
--    if ( __builtin_constant_p(size) && !s__ )                               \
-+    if ( o__ >= s__ )                                                       \
-         r__ = s__;                                                          \
-     else if ( __builtin_constant_p(size) && s__ <= BITS_PER_LONG )          \
-         r__ = o__ + __scanbit(*(const unsigned long *)(a__) >> o__, s__);   \
-@@ -390,7 +390,7 @@ static always_inline unsigned int __scan
-     const unsigned long *a__ = (addr);                                      \
-     unsigned int s__ = (size);                                              \
-     unsigned int o__ = (off);                                               \
--    if ( __builtin_constant_p(size) && !s__ )                               \
-+    if ( o__ >= s__ )                                                       \
-         r__ = s__;                                                          \
-     else if ( __builtin_constant_p(size) && s__ <= BITS_PER_LONG )          \
-         r__ = o__ + __scanbit(~*(const unsigned long *)(a__) >> o__, s__);  \

xsa308.patch

@@ -1,74 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/vtx: Work around SingleStep + STI/MovSS VMEntry failures
-
-See patch comment for technical details.
-
-Concerning the timeline, this was first discovered in the aftermath of
-XSA-156 which caused #DB to be intercepted unconditionally, but only in
-its SingleStep + STI form which is restricted to privileged software.
-
-After working with Intel and identifying the problematic vmentry check,
-this workaround was suggested, and the patch was posted in an RFC
-series.  Outstanding work for that series (not breaking Introspection)
-is still pending, and this fix from it (which wouldn't have been good
-enough in its original form) wasn't committed.
-
-A vmentry failure was reported to xen-devel, and debugging identified
-this bug in its SingleStep + MovSS form by way of INT1, which does not
-involve the use of any privileged instructions, and proving this to be a
-security issue.
-
-This is XSA-308
-
-Reported-by: Håkon Alstadheim <hakon@alstadheim.priv.no>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Kevin Tian <kevin.tian@intel.com>
-
-diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
-index 6a5eeb5c13..59b836f43f 100644
---- a/xen/arch/x86/hvm/vmx/vmx.c
-+++ b/xen/arch/x86/hvm/vmx/vmx.c
-@@ -3816,6 +3816,42 @@ void vmx_vmexit_handler(struct cpu_user_regs *regs)
-             HVMTRACE_1D(TRAP_DEBUG, exit_qualification);
-             __restore_debug_registers(v);
-             write_debugreg(6, exit_qualification | DR_STATUS_RESERVED_ONE);
-+
-+            /*
-+             * Work around SingleStep + STI/MovSS VMEntry failures.
-+             *
-+             * We intercept #DB unconditionally to work around CVE-2015-8104 /
-+             * XSA-156 (guest-kernel induced host DoS).
-+             *
-+             * STI/MovSS shadows block/defer interrupts/exceptions (exact
-+             * details are complicated and poorly documented).  Debug
-+             * exceptions delayed for any reason are stored in the
-+             * PENDING_DBG_EXCEPTIONS field.
-+             *
-+             * The falling edge of PENDING_DBG causes #DB to be delivered,
-+             * resulting in a VMExit, as #DB is intercepted.  The VMCS still
-+             * reports blocked-by-STI/MovSS.
-+             *
-+             * The VMEntry checks when EFLAGS.TF is set don't like a VMCS in
-+             * this state.  Despite a #DB queued in VMENTRY_INTR_INFO, the
-+             * state is rejected as DR6.BS isn't pending.  Fix this up.
-+             */
-+            if ( unlikely(regs->eflags & X86_EFLAGS_TF) )
-+            {
-+                unsigned long int_info;
-+
-+                __vmread(GUEST_INTERRUPTIBILITY_INFO, &int_info);
-+
-+                if ( int_info & (VMX_INTR_SHADOW_STI | VMX_INTR_SHADOW_MOV_SS) )
-+                {
-+                    unsigned long pending_dbg;
-+
-+                    __vmread(GUEST_PENDING_DBG_EXCEPTIONS, &pending_dbg);
-+                    __vmwrite(GUEST_PENDING_DBG_EXCEPTIONS,
-+                              pending_dbg | DR_STEP);
-+                }
-+            }
-+
-             if ( !v->domain->debugger_attached )
-             {
-                 unsigned long insn_len = 0;

xsa309.patch

@@ -1,58 +0,0 @@
-From 523e3974ed2213719a19218f5b246e382ceef18a Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Wed, 30 Oct 2019 17:05:28 +0000
-Subject: [PATCH] x86/mm: Don't reset linear_pt_count on partial validation
-
-"Linear pagetables" is a technique which involves either pointing a
-pagetable at itself, or to another pagetable the same or higher level.
-Xen has limited support for linear pagetables: A page may either point
-to itself, or point to another page of the same level (i.e., L2 to L2,
-L3 to L3, and so on).
-
-XSA-240 introduced an additional restriction that limited the "depth"
-of such chains by allowing pages to either *point to* other pages of
-the same level, or *be pointed to* by other pages of the same level,
-but not both.  To implement this, we keep track of the number of
-outstanding times a page points to or is pointed to another page
-table, to prevent both from happening at the same time.
-
-Unfortunately, the original commit introducing this reset this count
-when resuming validation of a partially-validated pagetable, dropping
-some "linear_pt_entry" counts.
-
-On debug builds on systems where guests used this feature, this might
-lead to crashes that look like this:
-
-    Assertion 'oc > 0' failed at mm.c:874
-
-Worse, if an attacker could engineer such a situation to occur, they
-might be able to make loops or other abitrary chains of linear
-pagetables, leading to the denial-of-service situation outlined in
-XSA-240.
-
-This is XSA-309.
-
-Reported-by: Manuel Bouyer <bouyer@antioche.eu.org>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 7d4dd80a85..01393fb0da 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -3059,8 +3059,8 @@ static int _get_page_type(struct page_info *page, unsigned long type,
-         {
-             page->nr_validated_ptes = 0;
-             page->partial_flags = 0;
-+            page->linear_pt_count = 0;
-         }
--        page->linear_pt_count = 0;
-         rc = alloc_page_type(page, type, preemptible);
-     }
- 
--- 
-2.24.0
-

xsa310-0001-x86-mm-Set-old_guest_table-when-destroying-vcpu-page.patch

@@ -1,167 +0,0 @@
-From 7c537dc8d28a03064a14171ed5c6fc329531816a Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Tue, 19 Nov 2019 11:40:34 +0000
-Subject: [PATCH 1/3] x86/mm: Set old_guest_table when destroying vcpu
- pagetables
-
-Changeset 6c4efc1eba ("x86/mm: Don't drop a type ref unless you held a
-ref to begin with"), part of XSA-299, changed the calling discipline
-of put_page_type() such that if put_page_type() returned -ERESTART
-(indicating a partially de-validated page), subsequent calls to
-put_page_type() must be called with PTF_partial_set.  If called on a
-partially de-validated page but without PTF_partial_set, Xen will
-BUG(), because to do otherwise would risk opening up the kind of
-privilege escalation bug described in XSA-299.
-
-One place this was missed was in vcpu_destroy_pagetables().
-put_page_and_type_preemptible() is called, but on -ERESTART, the
-entire operation is simply restarted, causing put_page_type() to be
-called on a partially de-validated page without PTF_partial_set.  The
-result was that if such an operation were interrupted, Xen would hit a
-BUG().
-
-Fix this by having vcpu_destroy_pagetables() consistently pass off
-interrupted de-validations to put_old_page_type():
-- Unconditionally clear references to the page, even if
-  put_page_and_type failed
-- Set old_guest_table and old_guest_table_partial appropriately
-
-While here, do some refactoring:
-
- - Move clearing of arch.cr3 to the top of the function
-
- - Now that clearing is unconditional, move the unmap to the same
-   conditional as the l4tab mapping.  This also allows us to reduce
-   the scope of the l4tab variable.
-
- - Avoid code duplication by looping to drop references on
-   guest_table_user
-
-This is part of XSA-310.
-
-Reported-by: Sarah Newman <srn@prgmr.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
-Added in v2.
-
-Changes in v3:
-- Minor comment / whitespace fixes
----
- xen/arch/x86/mm.c | 75 +++++++++++++++++++++++++++++------------------
- 1 file changed, 47 insertions(+), 28 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 01393fb0da..a759afc9e3 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -3142,40 +3142,36 @@ int put_old_guest_table(struct vcpu *v)
- int vcpu_destroy_pagetables(struct vcpu *v)
- {
-     unsigned long mfn = pagetable_get_pfn(v->arch.guest_table);
--    struct page_info *page;
--    l4_pgentry_t *l4tab = NULL;
-+    struct page_info *page = NULL;
-     int rc = put_old_guest_table(v);
-+    bool put_guest_table_user = false;
- 
-     if ( rc )
-         return rc;
- 
-+    v->arch.cr3 = 0;
-+
-+    /*
-+     * Get the top-level guest page; either the guest_table itself, for
-+     * 64-bit, or the top-level l4 entry for 32-bit.  Either way, remove
-+     * the reference to that page.
-+     */
-     if ( is_pv_32bit_vcpu(v) )
-     {
--        l4tab = map_domain_page(_mfn(mfn));
--        mfn = l4e_get_pfn(*l4tab);
--    }
-+        l4_pgentry_t *l4tab = map_domain_page(_mfn(mfn));
- 
--    if ( mfn )
--    {
--        page = mfn_to_page(_mfn(mfn));
--        if ( paging_mode_refcounts(v->domain) )
--            put_page(page);
--        else
--            rc = put_page_and_type_preemptible(page);
--    }
--
--    if ( l4tab )
--    {
--        if ( !rc )
--            l4e_write(l4tab, l4e_empty());
-+        mfn = l4e_get_pfn(*l4tab);
-+        l4e_write(l4tab, l4e_empty());
-         unmap_domain_page(l4tab);
-     }
--    else if ( !rc )
-+    else
-     {
-         v->arch.guest_table = pagetable_null();
-+        put_guest_table_user = true;
-+    }
- 
--        /* Drop ref to guest_table_user (from MMUEXT_NEW_USER_BASEPTR) */
--        mfn = pagetable_get_pfn(v->arch.guest_table_user);
-+    /* Free that page if non-zero */
-+    do {
-         if ( mfn )
-         {
-             page = mfn_to_page(_mfn(mfn));
-@@ -3183,18 +3179,41 @@ int vcpu_destroy_pagetables(struct vcpu *v)
-                 put_page(page);
-             else
-                 rc = put_page_and_type_preemptible(page);
-+            mfn = 0;
-         }
--        if ( !rc )
--            v->arch.guest_table_user = pagetable_null();
--    }
- 
--    v->arch.cr3 = 0;
-+        if ( !rc && put_guest_table_user )
-+        {
-+            /* Drop ref to guest_table_user (from MMUEXT_NEW_USER_BASEPTR) */
-+            mfn = pagetable_get_pfn(v->arch.guest_table_user);
-+            v->arch.guest_table_user = pagetable_null();
-+            put_guest_table_user = false;
-+        }
-+    } while ( mfn );
- 
-     /*
--     * put_page_and_type_preemptible() is liable to return -EINTR. The
--     * callers of us expect -ERESTART so convert it over.
-+     * If a "put" operation was interrupted, finish things off in
-+     * put_old_guest_table() when the operation is restarted.
-      */
--    return rc != -EINTR ? rc : -ERESTART;
-+    switch ( rc )
-+    {
-+    case -EINTR:
-+    case -ERESTART:
-+        v->arch.old_guest_ptpg = NULL;
-+        v->arch.old_guest_table = page;
-+        v->arch.old_guest_table_partial = (rc == -ERESTART);
-+        rc = -ERESTART;
-+        break;
-+    default:
-+        /*
-+         * Failure to 'put' a page may cause it to leak, but that's
-+         * less bad than a crash.
-+         */
-+        ASSERT(rc == 0);
-+        break;
-+    }
-+
-+    return rc;
- }
- 
- int new_guest_cr3(mfn_t mfn)
--- 
-2.24.0
-

xsa310-0002-x86-mm-alloc-free_lN_table-Retain-partial_flags-on-E.patch

@@ -1,104 +0,0 @@
-From 128cb126aee9b4a2855ab898fdfbfe7009fbf1f5 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Thu, 31 Oct 2019 11:17:38 +0000
-Subject: [PATCH 2/3] x86/mm: alloc/free_lN_table: Retain partial_flags on
- -EINTR
-
-When validating or de-validating pages (in alloc_lN_table and
-free_lN_table respectively), the `partial_flags` local variable is
-used to keep track of whether the "current" PTE started the entire
-operation in a "may be partial" state.
-
-One of the patches in XSA-299 addressed the fact that it is possible
-for a previously-partially-validated entry to subsequently be found to
-have invalid entries (indicated by returning -EINVAL); in which case
-page->partial_flags needs to be set to indicate that the current PTE
-may have the partial bit set (and thus _put_page_type() should be
-called with PTF_partial_set).
-
-Unfortunately, the patches in XSA-299 assumed that once
-put_page_from_lNe() returned -ERESTART on a page, it was not possible
-for it to return -EINTR.  This turns out to be true for
-alloc_lN_table() and free_lN_table, but not for _get_page_type() and
-_put_page_type(): both can return -EINTR when called on pages with
-PGT_partial set.  In these cases, the pages PGT_partial will still be
-set; failing to set partial_flags appropriately may allow an attacker
-to do a privilege escalation similar to those described in XSA-299.
-
-Fix this by always copying the local partial_flags variable into
-page->partial_flags when exiting early.
-
-NB that on the "get" side, no adjustment to nr_validated_entries is
-needed: whether pte[i] is partially validated or entirely
-un-validated, we want nr_validated_entries = i.  On the "put" side,
-however, we need to adjust nr_validated_entries appropriately: if
-pte[i] is entirely validated, we want nr_validated_entries = i + 1; if
-pte[i] is partially validated, we want nr_validated_entries = i.
-
-This is part of XSA-310.
-
-Reported-by: Sarah Newman <srn@prgmr.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/mm.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index a759afc9e3..97c8d73b7b 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1557,7 +1557,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type)
-         if ( rc == -EINTR && i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_flags = 0;
-+            page->partial_flags = partial_flags;;
-             rc = -ERESTART;
-         }
-         else if ( rc < 0 && rc != -EINTR )
-@@ -1660,7 +1660,7 @@ static int alloc_l3_table(struct page_info *page)
-         else if ( rc == -EINTR && i )
-         {
-             page->nr_validated_ptes = i;
--            page->partial_flags = 0;
-+            page->partial_flags = partial_flags;
-             rc = -ERESTART;
-         }
-         if ( rc < 0 )
-@@ -1982,8 +1982,8 @@ static int free_l2_table(struct page_info *page)
-     }
-     else if ( rc == -EINTR && i < L2_PAGETABLE_ENTRIES - 1 )
-     {
--        page->nr_validated_ptes = i + 1;
--        page->partial_flags = 0;
-+        page->nr_validated_ptes = i + !(partial_flags & PTF_partial_set);
-+        page->partial_flags = partial_flags;
-         rc = -ERESTART;
-     }
- 
-@@ -2030,8 +2030,8 @@ static int free_l3_table(struct page_info *page)
-     }
-     else if ( rc == -EINTR && i < L3_PAGETABLE_ENTRIES - 1 )
-     {
--        page->nr_validated_ptes = i + 1;
--        page->partial_flags = 0;
-+        page->nr_validated_ptes = i + !(partial_flags & PTF_partial_set);
-+        page->partial_flags = partial_flags;
-         rc = -ERESTART;
-     }
-     return rc > 0 ? 0 : rc;
-@@ -2061,8 +2061,8 @@ static int free_l4_table(struct page_info *page)
-     }
-     else if ( rc == -EINTR && i < L4_PAGETABLE_ENTRIES - 1 )
-     {
--        page->nr_validated_ptes = i + 1;
--        page->partial_flags = 0;
-+        page->nr_validated_ptes = i + !(partial_flags & PTF_partial_set);
-+        page->partial_flags = partial_flags;
-         rc = -ERESTART;
-     }
- 
--- 
-2.24.0
-

xsa310-0003-x86-mm-relinquish_memory-Grab-an-extra-type-ref-when.patch

@@ -1,75 +0,0 @@
-From e9f835982a726ae16997c566b5eafab74f8b4cb7 Mon Sep 17 00:00:00 2001
-From: George Dunlap <george.dunlap@citrix.com>
-Date: Mon, 28 Oct 2019 14:33:51 +0000
-Subject: [PATCH 3/3] x86/mm: relinquish_memory: Grab an extra type ref when
- setting PGT_partial
-
-The PGT_partial bit in page->type_info holds both a type count and a
-general ref count.  During domain tear-down, when free_page_type()
-returns -ERESTART, relinquish_memory() correctly handles the general
-ref count, but fails to grab an extra type count when setting
-PGT_partial.  When this bit is eventually cleared, type_count underflows
-and triggers the following BUG in page_alloc.c:free_domheap_pages():
-
-    BUG_ON((pg[i].u.inuse.type_info & PGT_count_mask) != 0);
-
-As far as we can tell, this page underflow cannot be exploited any any
-other way: The page can't be used as a pagetable by the dying domain
-because it's dying; it can't be used as a pagetable by any other
-domain since it belongs to the dying domain; and ownership can't
-transfer to any other domain without hitting the BUG_ON() in
-free_domheap_pages().
-
-(steal_page() won't work on a page in this state, since it requires
-PGC_allocated to be set, and PGC_allocated will already have been
-cleared.)
-
-Fix this by grabbing an extra type ref if setting PGT_partial in
-relinquish_memory.
-
-This is part of XSA-310.
-
-Reported-by: Sarah Newman <srn@prgmr.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Acked-by: Jan Beulich <jbeulich@suse.com>
----
-v2:
-- Move discussion of potential exploits into the commit message
-- Keep PGT_partial and put_page() ordering
----
- xen/arch/x86/domain.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
-index f1dd86e12e..51880fc50d 100644
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -2049,6 +2049,25 @@ static int relinquish_memory(
-                     goto out;
-                 case -ERESTART:
-                     page_list_add(page, list);
-+                    /*
-+                     * PGT_partial holds a type ref and a general ref.
-+                     * If we came in with PGT_partial set, then we 1)
-+                     * don't need to grab an extra type count, and 2)
-+                     * do need to drop the extra page ref we grabbed
-+                     * at the top of the loop.  If we didn't come in
-+                     * with PGT_partial set, we 1) do need to drab an
-+                     * extra type count, but 2) can transfer the page
-+                     * ref we grabbed above to it.
-+                     *
-+                     * Note that we must increment type_info before
-+                     * setting PGT_partial.  Theoretically it should
-+                     * be safe to drop the page ref before setting
-+                     * PGT_partial, but do it afterwards just to be
-+                     * extra safe.
-+                     */
-+                    if ( !(x & PGT_partial) )
-+                        page->u.inuse.type_info++;
-+                    smp_wmb();
-                     page->u.inuse.type_info |= PGT_partial;
-                     if ( x & PGT_partial )
-                         put_page(page);
--- 
-2.24.0
-

xsa311-4.12.patch

@@ -1,194 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: AMD/IOMMU: Cease using a dynamic height for the IOMMU pagetables
-
-update_paging_mode() has multiple bugs:
-
- 1) Booting with iommu=debug will cause it to inform you that that it called
-    without the pdev_list lock held.
- 2) When growing by more than a single level, it leaks the newly allocated
-    table(s) in the case of a further error.
-
-Furthermore, the choice of default level for a domain has issues:
-
- 1) All HVM guests grow from 2 to 3 levels during construction because of the
-    position of the VRAM just below the 4G boundary, so defaulting to 2 is a
-    waste of effort.
- 2) The limit for PV guests doesn't take memory hotplug into account, and
-    isn't dynamic at runtime like HVM guests.  This means that a PV guest may
-    get RAM which it can't map in the IOMMU.
-
-The dynamic height is a property unique to AMD, and adds a substantial
-quantity of complexity for what is a marginal performance improvement.  Remove
-the complexity by removing the dynamic height.
-
-PV guests now get 3 or 4 levels based on any hotplug regions in the host.
-This only makes a difference for hardware which previously had all RAM below
-the 512G boundary, and a hotplug region above.
-
-HVM guests now get 4 levels (which will be sufficient until 256TB guests
-become a thing), because we don't currently have the information to know when
-3 would be safe to use.
-
-The overhead of this extra level is not expected to be noticeable.  It costs
-one page (4k) per domain, and one extra IO-TLB paging structure cache entry
-which is very hot and less likely to be evicted.
-
-This is XSA-311.
-
-Reported-by: XXX PERSON <XXX EMAIL>3
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Jan Beulich <jbeulich@suse.com>
-
-diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c
-index 628aa60230..9a222c95e1 100644
---- a/xen/drivers/passthrough/amd/iommu_map.c
-+++ b/xen/drivers/passthrough/amd/iommu_map.c
-@@ -455,100 +455,6 @@ static int iommu_pde_from_dfn(struct domain *d, unsigned long dfn,
-     return 0;
- }
- 
--static int update_paging_mode(struct domain *d, unsigned long dfn)
--{
--    uint16_t bdf;
--    void *device_entry;
--    unsigned int req_id, level, offset;
--    unsigned long flags;
--    struct pci_dev *pdev;
--    struct amd_iommu *iommu = NULL;
--    struct page_info *new_root = NULL;
--    struct page_info *old_root = NULL;
--    void *new_root_vaddr;
--    unsigned long old_root_mfn;
--    struct domain_iommu *hd = dom_iommu(d);
--
--    if ( dfn == dfn_x(INVALID_DFN) )
--        return -EADDRNOTAVAIL;
--    ASSERT(!(dfn >> DEFAULT_DOMAIN_ADDRESS_WIDTH));
--
--    level = hd->arch.paging_mode;
--    old_root = hd->arch.root_table;
--    offset = dfn >> (PTE_PER_TABLE_SHIFT * (level - 1));
--
--    ASSERT(spin_is_locked(&hd->arch.mapping_lock) && is_hvm_domain(d));
--
--    while ( offset >= PTE_PER_TABLE_SIZE )
--    {
--        /* Allocate and install a new root table.
--         * Only upper I/O page table grows, no need to fix next level bits */
--        new_root = alloc_amd_iommu_pgtable();
--        if ( new_root == NULL )
--        {
--            AMD_IOMMU_DEBUG("%s Cannot allocate I/O page table\n",
--                            __func__);
--            return -ENOMEM;
--        }
--
--        new_root_vaddr = __map_domain_page(new_root);
--        old_root_mfn = mfn_x(page_to_mfn(old_root));
--        set_iommu_pde_present(new_root_vaddr, old_root_mfn, level,
--                              !!IOMMUF_writable, !!IOMMUF_readable);
--        level++;
--        old_root = new_root;
--        offset >>= PTE_PER_TABLE_SHIFT;
--        unmap_domain_page(new_root_vaddr);
--    }
--
--    if ( new_root != NULL )
--    {
--        hd->arch.paging_mode = level;
--        hd->arch.root_table = new_root;
--
--        if ( !pcidevs_locked() )
--            AMD_IOMMU_DEBUG("%s Try to access pdev_list "
--                            "without aquiring pcidevs_lock.\n", __func__);
--
--        /* Update device table entries using new root table and paging mode */
--        for_each_pdev( d, pdev )
--        {
--            if ( pdev->type == DEV_TYPE_PCI_HOST_BRIDGE )
--                continue;
--
--            bdf = PCI_BDF2(pdev->bus, pdev->devfn);
--            iommu = find_iommu_for_device(pdev->seg, bdf);
--            if ( !iommu )
--            {
--                AMD_IOMMU_DEBUG("%s Fail to find iommu.\n", __func__);
--                return -ENODEV;
--            }
--
--            spin_lock_irqsave(&iommu->lock, flags);
--            do {
--                req_id = get_dma_requestor_id(pdev->seg, bdf);
--                device_entry = iommu->dev_table.buffer +
--                               (req_id * IOMMU_DEV_TABLE_ENTRY_SIZE);
--
--                /* valid = 0 only works for dom0 passthrough mode */
--                amd_iommu_set_root_page_table((uint32_t *)device_entry,
--                                              page_to_maddr(hd->arch.root_table),
--                                              d->domain_id,
--                                              hd->arch.paging_mode, 1);
--
--                amd_iommu_flush_device(iommu, req_id);
--                bdf += pdev->phantom_stride;
--            } while ( PCI_DEVFN2(bdf) != pdev->devfn &&
--                      PCI_SLOT(bdf) == PCI_SLOT(pdev->devfn) );
--            spin_unlock_irqrestore(&iommu->lock, flags);
--        }
--
--        /* For safety, invalidate all entries */
--        amd_iommu_flush_all_pages(d);
--    }
--    return 0;
--}
--
- int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn,
-                        unsigned int flags, unsigned int *flush_flags)
- {
-@@ -573,20 +479,6 @@ int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn,
-         return rc;
-     }
- 
--    /* Since HVM domain is initialized with 2 level IO page table,
--     * we might need a deeper page table for wider dfn now */
--    if ( is_hvm_domain(d) )
--    {
--        if ( update_paging_mode(d, dfn_x(dfn)) )
--        {
--            spin_unlock(&hd->arch.mapping_lock);
--            AMD_IOMMU_DEBUG("Update page mode failed dfn = %"PRI_dfn"\n",
--                            dfn_x(dfn));
--            domain_crash(d);
--            return -EFAULT;
--        }
--    }
--
-     if ( iommu_pde_from_dfn(d, dfn_x(dfn), pt_mfn, true) || (pt_mfn[1] == 0) )
-     {
-         spin_unlock(&hd->arch.mapping_lock);
-diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-index 15c13e1163..57dc2c5f20 100644
---- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
-+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
-@@ -242,10 +242,17 @@ static int amd_iommu_domain_init(struct domain *d)
- {
-     struct domain_iommu *hd = dom_iommu(d);
- 
--    /* For pv and dom0, stick with get_paging_mode(max_page)
--     * For HVM dom0, use 2 level page table at first */
--    hd->arch.paging_mode = is_hvm_domain(d) ?
--        2 : amd_iommu_get_paging_mode(max_page);
-+    /*
-+     * Choose the number of levels for the IOMMU page tables.
-+     * - PV needs 3 or 4, depending on whether there is RAM (including hotplug
-+     *   RAM) above the 512G boundary.
-+     * - HVM could in principle use 3 or 4 depending on how much guest
-+     *   physical address space we give it, but this isn't known yet so use 4
-+     *   unilaterally.
-+     */
-+    hd->arch.paging_mode = is_hvm_domain(d)
-+        ? 4 : amd_iommu_get_paging_mode(get_upper_mfn_bound());
-+
-     return 0;
- }
- 

xsa483.patch

@@ -0,0 +1,30 @@
+From: Andrii Sultanov <andriy.sultanov@vates.tech>
+Subject: tools/oxenstored: Reset quota when resetting permissions
+
+The quota object contains both limits and the current node usage counts.
+
+When a domain is torn down, the node data itself is cleaned up but the node
+usage counts are not.  A later domain reusing the same domid can create fewer
+nodes before being deemed to be over quota.
+
+Reset the count when the node permissions are cleaned up.
+
+This is XSA-483 / CVE-2026-23556.
+
+Signed-off-by: Andrii Sultanov <andriy.sultanov@vates.tech>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+diff --git a/tools/ocaml/xenstored/store.ml b/tools/ocaml/xenstored/store.ml
+index 9b8dd2812df0..aa9204ead3ec 100644
+--- a/tools/ocaml/xenstored/store.ml
++++ b/tools/ocaml/xenstored/store.ml
+@@ -465,7 +465,8 @@ let reset_permissions store domid =
+         if perms <> node.perms then
+           Logging.debug "store|node" "Changed permissions for node %s" (Node.get_name node);
+         Some { node with Node.perms }
+-    ) store.root
++    ) store.root;
++  store.quota <- Quota.del store.quota domid
+ 
+ type ops = {
+   store: t;

xsa484.patch

@@ -0,0 +1,89 @@
+From 3d0d19ad17f29c64dde4a7baf392da4fd58f3654 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 16 Mar 2026 15:06:11 +0100
+Subject: [PATCH] tools/xenstored: make conn_delete_all_transactions()
+ idempotent
+
+conn_delete_all_transactions() should be callable in any context,
+resetting ALL transaction related data.
+
+This includes number of active transactions and the transaction
+pointer in struct connection.
+
+So reset conn->trans to NULL in conn_delete_all_transactions() and
+do the cleanup for each transaction in destroy_transaction().
+
+This avoids triggering the assert() in conn_delete_all_transactions()
+in case e.g. ignore_connection() was called while an operation inside
+a transaction was performed, or XS_RESET_WATCHES was called in a
+transaction.
+
+This is XSA-484 / CVE-2026-23557.
+
+Reported-by: Andrii Sultanov <andriy.sultanov@vates.tech>
+Fixes: 1f9d04fb021c ("xenstored: allow guest to shutdown all its watches/transactions")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ tools/xenstored/transaction.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/tools/xenstored/transaction.c b/tools/xenstored/transaction.c
+index 167cd597fd..0825c48859 100644
+--- a/tools/xenstored/transaction.c
++++ b/tools/xenstored/transaction.c
+@@ -432,17 +432,23 @@ static int finalize_transaction(struct connection *conn,
+ static int destroy_transaction(void *_transaction)
+ {
+ 	struct transaction *trans = _transaction;
++	struct connection *conn = trans->conn;
+ 	struct accessed_node *i;
+ 
+ 	wrl_ntransactions--;
+ 	trace_destroy(trans, "transaction");
+ 	while ((i = list_top(&trans->accessed, struct accessed_node, list))) {
+ 		if (i->ta_node)
+-			db_delete(trans->conn, i->trans_name, NULL);
++			db_delete(conn, i->trans_name, NULL);
+ 		list_del(&i->list);
+ 		talloc_free(i);
+ 	}
+ 
++	list_del(&trans->list);
++	domain_transaction_dec(conn);
++	if (list_empty(&conn->transaction_list))
++		conn->ta_start_time = 0;
++
+ 	return 0;
+ }
+ 
+@@ -523,10 +529,6 @@ int do_transaction_end(const void *ctx, struct connection *conn,
+ 		return ENOENT;
+ 
+ 	conn->transaction = NULL;
+-	list_del(&trans->list);
+-	domain_transaction_dec(conn);
+-	if (list_empty(&conn->transaction_list))
+-		conn->ta_start_time = 0;
+ 
+ 	chk_quota = trans->node_created && domain_is_unprivileged(conn);
+ 
+@@ -572,14 +574,10 @@ void conn_delete_all_transactions(struct connection *conn)
+ 	struct transaction *trans;
+ 
+ 	while ((trans = list_top(&conn->transaction_list,
+-				 struct transaction, list))) {
+-		list_del(&trans->list);
++				 struct transaction, list)))
+ 		talloc_free(trans);
+-	}
+-
+-	assert(conn->transaction == NULL);
+ 
+-	conn->ta_start_time = 0;
++	conn->transaction = NULL;
+ }
+ 
+ int check_transactions(struct hashtable *hash)
+-- 
+2.53.0
+

xsa486.patch

@@ -0,0 +1,181 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: gnttab: split gnttab_map_frame()
+
+If a domain tries to map status frames in parallel to switching grant
+table version from 2 to 1, the mapping operation may put in place P2M
+entries referencing MFNs which gnttab_unpopulate_status_frames() is in the
+process of freeing.
+
+Ideally we would refcount pages when entered into P2M tables, but that's a
+significant change. Extend the grant-table-locked region instead in
+xenmem_add_to_physmap_one() (being the sole caller of gnttab_map_frame()),
+such that a race with gnttab_unpopulate_status_frames() is no longer
+possible.
+
+This is XSA-486 / CVE-2026-23558.
+
+Fixes: 5ce8fafa947c ("Dynamic grant-table sizing")
+Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure")
+Reported-by: Rafal Wojtczuk <rafal.wojtczuk@7bulls.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/arch/arm/mm.c
++++ b/xen/arch/arm/mm.c
+@@ -174,12 +174,10 @@ int xenmem_add_to_physmap_one(
+     switch ( space )
+     {
+     case XENMAPSPACE_grant_table:
+-        rc = gnttab_map_frame(d, idx, gfn, &mfn);
++        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
+         if ( rc )
+             return rc;
+ 
+-        /* Need to take care of the reference obtained in gnttab_map_frame(). */
+-        page = mfn_to_page(mfn);
+         t = p2m_ram_rw;
+ 
+         break;
+@@ -281,10 +279,23 @@ int xenmem_add_to_physmap_one(
+      * to drop the reference we took earlier. In all other cases we need to
+      * drop any reference we took earlier (perhaps indirectly).
+      */
+-    if ( space == XENMAPSPACE_gmfn_foreign ? rc : page != NULL )
++    switch ( space )
+     {
++    default:
++        if ( page )
++            put_page(page);
++        break;
++
++    case XENMAPSPACE_grant_table:
++        gnttab_map_frame_end(d, mfn);
++        break;
++
++    case XENMAPSPACE_gmfn_foreign:
++        if ( !rc )
++            break;
+         ASSERT(page != NULL);
+         put_page(page);
++        break;
+     }
+ 
+     return rc;
+--- a/xen/arch/x86/mm/p2m.c
++++ b/xen/arch/x86/mm/p2m.c
+@@ -2009,11 +2009,9 @@ int xenmem_add_to_physmap_one(
+         break;
+ 
+     case XENMAPSPACE_grant_table:
+-        rc = gnttab_map_frame(d, idx, gfn, &mfn);
++        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
+         if ( rc )
+             return rc;
+-        /* Need to take care of the reference obtained in gnttab_map_frame(). */
+-        page = mfn_to_page(mfn);
+         break;
+ 
+     case XENMAPSPACE_gmfn:
+@@ -2095,19 +2093,28 @@ int xenmem_add_to_physmap_one(
+     put_gfn(d, gfn_x(gfn));
+ 
+  put_both:
+-    /*
+-     * In the XENMAPSPACE_gmfn case, we took a ref of the gfn at the top.
+-     * We also may need to transfer ownership of the page reference to our
+-     * caller.
+-     */
+-    if ( space == XENMAPSPACE_gmfn )
++    switch ( space )
+     {
++    case XENMAPSPACE_gmfn:
++        /*
++         * We took a ref of the gfn at the top.  We also may need to transfer
++         * ownership of the page reference to our caller.
++         */
+         put_gfn(d, gmfn);
+         if ( !rc && extra.ppage )
+         {
+             *extra.ppage = page;
+             page = NULL;
+         }
++        break;
++
++    case XENMAPSPACE_grant_table:
++        /*
++         * We (gnttab_map_frame_begin()) acquired a lock and took a ref of the
++         * page underlying the MFN at the top.
++         */
++        gnttab_map_frame_end(d, mfn);
++        break;
+     }
+ 
+     if ( page )
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
+@@ -4250,7 +4250,8 @@ int gnttab_acquire_resource(
+     return rc;
+ }
+ 
+-int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
++int gnttab_map_frame_begin(
++    struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
+ {
+     int rc = 0;
+     struct grant_table *gt = d->grant_table;
+@@ -4288,11 +4289,19 @@ int gnttab_map_frame(struct domain *d, u
+             put_page(pg);
+     }
+ 
+-    grant_write_unlock(gt);
++    if ( rc )
++        grant_write_unlock(d->grant_table);
+ 
+     return rc;
+ }
+ 
++void gnttab_map_frame_end(struct domain *d, mfn_t mfn)
++{
++    put_page(mfn_to_page(mfn));
++
++    grant_write_unlock(d->grant_table);
++}
++
+ static void gnttab_usage_print(struct domain *rd)
+ {
+     int first = 1;
+--- a/xen/include/xen/grant_table.h
++++ b/xen/include/xen/grant_table.h
+@@ -60,8 +60,13 @@ int gnttab_release_mappings(struct domai
+ int mem_sharing_gref_to_gfn(struct grant_table *gt, grant_ref_t ref,
+                             gfn_t *gfn, uint16_t *status);
+ 
+-int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn,
+-                     mfn_t *mfn);
++/*
++ * These need to be used as a pair, as the first (in the success case) returns
++ * with a lock and page reference held which the second needs to drop.
++ */
++int gnttab_map_frame_begin(struct domain *d, unsigned long idx, gfn_t gfn,
++                           mfn_t *mfn);
++void gnttab_map_frame_end(struct domain *d, mfn_t mfn);
+ 
+ unsigned int gnttab_resource_max_frames(const struct domain *d, unsigned int id);
+ 
+@@ -100,12 +105,14 @@ static inline int mem_sharing_gref_to_gf
+     return -EINVAL;
+ }
+ 
+-static inline int gnttab_map_frame(struct domain *d, unsigned long idx,
+-                                   gfn_t gfn, mfn_t *mfn)
++static inline int gnttab_map_frame_begin(struct domain *d, unsigned long idx,
++                                         gfn_t gfn, mfn_t *mfn)
+ {
+     return -EINVAL;
+ }
+ 
++static inline void gnttab_map_frame_end(struct domain *d, mfn_t mfn) {}
++
+ static inline unsigned int gnttab_resource_max_frames(
+     const struct domain *d, unsigned int id)
+ {

xsa490-4.21.patch

@@ -0,0 +1,43 @@
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Subject: x86/amd: Mitigate AMD-SN-7052
+
+This is XSA-490 / CVE-2025-54518.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
+index 1bb0766ebf13..b5bf2b732e8f 100644
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -1116,11 +1116,25 @@ static void amd_check_bp_cfg(void)
+ {
+ 	uint64_t val, new = 0;
+ 
+-	/*
+-	 * AMD Erratum #1485.  Set bit 5, as instructed.
+-	 */
+-	if (!cpu_has_hypervisor && boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
+-		new |= (1 << 5);
++	if (!cpu_has_hypervisor) {
++		/*
++		 * AMD Erratum #1485.  If SMT is enabled and STIBP disabled,
++		 * the CPU may fetch incorrect instruction bytes.
++		 *
++		 * Set bit 5, as instructed.
++		 */
++		if (boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
++			new |= (1 << 5);
++
++		/*
++		 * AMD SB-7052.  CPU OP Cache corruption, causing instructions
++		 * to be executed at a higher privilege.
++		 *
++		 * Set bit 33, as instructed.
++		 */
++		if (boot_cpu_data.x86 == 0x17 && is_zen2_uarch())
++			new |= (1UL << 33);
++	}
+ 
+ 	/*
+ 	 * On hardware supporting SRSO_MSR_FIX, activate BP_SPEC_REDUCE by

xsa491-4.21.patch

@@ -0,0 +1,211 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: x86/HVM: add locking to I/O port translation list traversal
+
+XEN_DOMCTL_ioport_mapping is usable by DM stubdoms, and hence we can't
+assume the list to be left unaltered while the guest (really: the
+hypervisor on behalf of the guest) is accessing it.
+
+This is XSA-491 / CVE-2026-42487.
+
+Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -663,6 +663,7 @@ long arch_do_domctl(
+                    "ioport_map:add: dom%d gport=%x mport=%x nr=%x\n",
+                    d->domain_id, fgp, fmp, np);
+ 
++            write_lock(&hvm->g2m_ioport_lock);
+             list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list)
+                 if (g2m_ioport->mport == fmp )
+                 {
+@@ -684,11 +685,14 @@ long arch_do_domctl(
+                 g2m_ioport->np = np;
+                 list_add_tail(&g2m_ioport->list, &hvm->g2m_ioport_list);
+             }
++            write_unlock(&hvm->g2m_ioport_lock);
+             if ( !ret )
+                 ret = ioports_permit_access(d, fmp, fmp + np - 1);
+             if ( ret && !found && g2m_ioport )
+             {
++                write_lock(&hvm->g2m_ioport_lock);
+                 list_del(&g2m_ioport->list);
++                write_unlock(&hvm->g2m_ioport_lock);
+                 xfree(g2m_ioport);
+             }
+         }
+@@ -697,6 +701,8 @@ long arch_do_domctl(
+             printk(XENLOG_G_INFO
+                    "ioport_map:remove: dom%d gport=%x mport=%x nr=%x\n",
+                    d->domain_id, fgp, fmp, np);
++
++            write_lock(&hvm->g2m_ioport_lock);
+             list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list)
+                 if ( g2m_ioport->mport == fmp )
+                 {
+@@ -704,6 +710,8 @@ long arch_do_domctl(
+                     xfree(g2m_ioport);
+                     break;
+                 }
++            write_unlock(&hvm->g2m_ioport_lock);
++
+             ret = ioports_deny_access(d, fmp, fmp + np - 1);
+             if ( ret && is_hardware_domain(currd) )
+                 printk(XENLOG_ERR
+--- a/xen/arch/x86/hvm/emulate.c
++++ b/xen/arch/x86/hvm/emulate.c
+@@ -160,7 +160,6 @@ void hvmemul_cancel(struct vcpu *v)
+     hvio->mmio_insn_bytes = 0;
+     hvio->mmio_access = (struct npfec){};
+     hvio->mmio_retry = false;
+-    hvio->g2m_ioport = NULL;
+ 
+     hvmemul_cache_disable(v);
+ }
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -610,6 +610,7 @@ int hvm_domain_initialise(struct domain
+     spin_lock_init(&d->arch.hvm.irq_lock);
+     spin_lock_init(&d->arch.hvm.uc_lock);
+     spin_lock_init(&d->arch.hvm.write_map.lock);
++    rwlock_init(&d->arch.hvm.g2m_ioport_lock);
+     rwlock_init(&d->arch.hvm.mmcfg_lock);
+     INIT_LIST_HEAD(&d->arch.hvm.write_map.list);
+     INIT_LIST_HEAD(&d->arch.hvm.g2m_ioport_list);
+--- a/xen/arch/x86/hvm/io.c
++++ b/xen/arch/x86/hvm/io.c
+@@ -143,36 +143,56 @@ bool handle_pio(uint16_t port, unsigned
+     return true;
+ }
+ 
+-static bool cf_check g2m_portio_accept(
+-    const struct hvm_io_handler *handler, const ioreq_t *p)
++/* NB: Returns with the lock held in the success case. */
++static const struct g2m_ioport *g2m_portio_find_and_lock(struct hvm_domain *hvm,
++                                                         uint64_t addr,
++                                                         uint32_t size)
+ {
+-    struct vcpu *curr = current;
+-    const struct hvm_domain *hvm = &curr->domain->arch.hvm;
+-    struct hvm_vcpu_io *hvio = &curr->arch.hvm.hvm_io;
+-    struct g2m_ioport *g2m_ioport;
+-    unsigned int start, end;
++    const struct g2m_ioport *g2m_ioport;
++
++    read_lock(&hvm->g2m_ioport_lock);
+ 
+     list_for_each_entry( g2m_ioport, &hvm->g2m_ioport_list, list )
+     {
+-        start = g2m_ioport->gport;
+-        end = start + g2m_ioport->np;
+-        if ( (p->addr >= start) && (p->addr + p->size <= end) )
+-        {
+-            hvio->g2m_ioport = g2m_ioport;
+-            return 1;
+-        }
++        unsigned int start = g2m_ioport->gport;
++
++        if ( addr >= start && addr + size <= start + g2m_ioport->np )
++            return g2m_ioport;
+     }
+ 
+-    return 0;
++    read_unlock(&hvm->g2m_ioport_lock);
++
++    return NULL;
++}
++
++static bool cf_check g2m_portio_accept(
++    const struct hvm_io_handler *handler, const ioreq_t *p)
++{
++    struct hvm_domain *hvm = &current->domain->arch.hvm;
++    const struct g2m_ioport *g2m_ioport =
++        g2m_portio_find_and_lock(hvm, p->addr, p->size);
++
++    if ( !g2m_ioport )
++        return false;
++
++    read_unlock(&hvm->g2m_ioport_lock);
++
++    return true;
+ }
+ 
+ static int cf_check g2m_portio_read(
+     const struct hvm_io_handler *handler, uint64_t addr, uint32_t size,
+     uint64_t *data)
+ {
+-    struct hvm_vcpu_io *hvio = &current->arch.hvm.hvm_io;
+-    const struct g2m_ioport *g2m_ioport = hvio->g2m_ioport;
+-    unsigned int mport = (addr - g2m_ioport->gport) + g2m_ioport->mport;
++    struct hvm_domain *hvm = &current->domain->arch.hvm;
++    const struct g2m_ioport *g2m_ioport =
++        g2m_portio_find_and_lock(hvm, addr, size);
++    unsigned int mport;
++
++    if ( !g2m_ioport )
++        return X86EMUL_RETRY;
++
++    mport = addr - g2m_ioport->gport + g2m_ioport->mport;
+ 
+     switch ( size )
+     {
+@@ -189,6 +209,8 @@ static int cf_check g2m_portio_read(
+         BUG();
+     }
+ 
++    read_unlock(&hvm->g2m_ioport_lock);
++
+     return X86EMUL_OKAY;
+ }
+ 
+@@ -196,9 +218,15 @@ static int cf_check g2m_portio_write(
+     const struct hvm_io_handler *handler, uint64_t addr, uint32_t size,
+     uint64_t data)
+ {
+-    struct hvm_vcpu_io *hvio = &current->arch.hvm.hvm_io;
+-    const struct g2m_ioport *g2m_ioport = hvio->g2m_ioport;
+-    unsigned int mport = (addr - g2m_ioport->gport) + g2m_ioport->mport;
++    struct hvm_domain *hvm = &current->domain->arch.hvm;
++    const struct g2m_ioport *g2m_ioport =
++        g2m_portio_find_and_lock(hvm, addr, size);
++    unsigned int mport;
++
++    if ( !g2m_ioport )
++        return X86EMUL_RETRY;
++
++    mport = addr - g2m_ioport->gport + g2m_ioport->mport;
+ 
+     switch ( size )
+     {
+@@ -215,6 +243,8 @@ static int cf_check g2m_portio_write(
+         BUG();
+     }
+ 
++    read_unlock(&hvm->g2m_ioport_lock);
++
+     return X86EMUL_OKAY;
+ }
+ 
+--- a/xen/arch/x86/include/asm/hvm/domain.h
++++ b/xen/arch/x86/include/asm/hvm/domain.h
+@@ -125,6 +125,7 @@ struct hvm_domain {
+ 
+     /* List of guest to machine IO ports mapping. */
+     struct list_head g2m_ioport_list;
++    rwlock_t g2m_ioport_lock;
+ 
+     /* List of MMCFG regions trapped by Xen. */
+     struct list_head mmcfg_regions;
+--- a/xen/arch/x86/include/asm/hvm/vcpu.h
++++ b/xen/arch/x86/include/asm/hvm/vcpu.h
+@@ -54,8 +54,6 @@ struct hvm_vcpu_io {
+     unsigned long msix_unmask_address;
+     unsigned long msix_snoop_address;
+     unsigned long msix_snoop_gpa;
+-
+-    const struct g2m_ioport *g2m_ioport;
+ };
+ 
+ struct nestedvcpu {

xsa492-4.21-01.patch

@@ -0,0 +1,264 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: sched: use sequence counter to enlighten vcpu_runstate_get()
+
+Subsequently XEN_DOMCTL_getdomaininfo will want to invoke the function
+without holding a lock, thus allowing parallel execution of potentially
+many instances. As was learned from 228ab9992ffb ("domctl: improve
+locking during domain destruction"), reverted by d0887cc6b16e, such
+parallelism can result in severe lock contention on any (previously)
+inner lock. To avoid taking that risk replace the use of the scheduler
+lock in vcpu_runstate_get() by a newly introduced sequence counter.
+Convert the "no lock if current" property to "use a local counter
+instance", thus guaranteeing the loop to exit after the first iteration.
+
+Skeleton and commentary of the seqcount implementation based on /
+derived from Linux 6.11-rc.
+
+To have runstate_seq placed next to runstate in struct vcpu, without
+introducing a new obvious padding hole, yet while keeping the latter
+adjacent to runstate_guest{,_area} as well, move runstate down a little.
+
+This is part of XSA-492.
+
+Requested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+
+--- a/xen/common/sched/core.c
++++ b/xen/common/sched/core.c
+@@ -281,13 +281,18 @@ static inline void vcpu_runstate_change(
+     }
+ 
+     delta = new_entry_time - v->runstate.state_entry_time;
+-    if ( delta > 0 )
++
++    /* Serialization: ->schedule_lock (see ASSERT() above). */
++    with_seq_write(&v->runstate_seq)
+     {
+-        v->runstate.time[v->runstate.state] += delta;
+-        v->runstate.state_entry_time = new_entry_time;
+-    }
++        if ( delta > 0 )
++        {
++            v->runstate.time[v->runstate.state] += delta;
++            v->runstate.state_entry_time = new_entry_time;
++        }
+ 
+-    v->runstate.state = new_state;
++        v->runstate.state = new_state;
++    }
+ }
+ 
+ void sched_guest_idle(void (*idle) (void), unsigned int cpu)
+@@ -307,30 +312,18 @@ void sched_guest_idle(void (*idle) (void
+ void vcpu_runstate_get(const struct vcpu *v,
+                        struct vcpu_runstate_info *runstate)
+ {
+-    spinlock_t *lock;
+-    s_time_t delta;
+-    struct sched_unit *unit;
++    struct seqcount seq = SEQCNT_ZERO();
++    const struct seqcount *s = likely(v == current) ? &seq : &v->runstate_seq;
+ 
+-    rcu_read_lock(&sched_res_rculock);
+-
+-    /*
+-     * Be careful in case of an idle vcpu: the assignment to a unit might
+-     * change even with the scheduling lock held, so be sure to use the
+-     * correct unit for locking in order to avoid triggering an ASSERT() in
+-     * the unlock function.
+-     */
+-    unit = is_idle_vcpu(v) ? get_sched_res(v->processor)->sched_unit_idle
+-                           : v->sched_unit;
+-    lock = likely(v == current) ? NULL : unit_schedule_lock_irq(unit);
+-    memcpy(runstate, &v->runstate, sizeof(*runstate));
+-    delta = NOW() - runstate->state_entry_time;
+-    if ( delta > 0 )
+-        runstate->time[runstate->state] += delta;
+-
+-    if ( unlikely(lock != NULL) )
+-        unit_schedule_unlock_irq(lock, unit);
++    until_seq_read(s)
++    {
++        s_time_t delta;
+ 
+-    rcu_read_unlock(&sched_res_rculock);
++        *runstate = v->runstate;
++        delta = NOW() - runstate->state_entry_time;
++        if ( delta > 0 )
++            runstate->time[runstate->state] += delta;
++    }
+ }
+ 
+ uint64_t get_cpu_idle_time(unsigned int cpu)
+--- a/xen/include/xen/sched.h
++++ b/xen/include/xen/sched.h
+@@ -16,6 +16,7 @@
+ #include <xen/radix-tree.h>
+ #include <xen/multicall.h>
+ #include <xen/nospec.h>
++#include <xen/seqcount.h>
+ #include <xen/tasklet.h>
+ #include <xen/mm.h>
+ #include <xen/smp.h>
+@@ -198,7 +199,6 @@ struct vcpu
+ 
+     struct sched_unit *sched_unit;
+ 
+-    struct vcpu_runstate_info runstate;
+ #ifndef CONFIG_COMPAT
+ # define runstate_guest(v) ((v)->runstate_guest)
+     XEN_GUEST_HANDLE(vcpu_runstate_info_t) runstate_guest; /* guest address */
+@@ -210,6 +210,8 @@ struct vcpu
+     } runstate_guest; /* guest address */
+ #endif
+     struct guest_area runstate_guest_area;
++    struct vcpu_runstate_info runstate;
++    struct seqcount  runstate_seq;
+     unsigned int     new_state;
+ 
+     /* Has the FPU been initialised? */
+--- /dev/null
++++ b/xen/include/xen/seqcount.h
+@@ -0,0 +1,139 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++#ifndef XEN_SEQCOUNT_H
++#define XEN_SEQCOUNT_H
++
++#include <xen/lib.h>
++#include <xen/nospec.h>
++
++#include <asm/atomic.h>
++#include <asm/system.h>
++
++/*
++ * Sequence counters (seqcount_t)
++ *
++ * This is the raw counting mechanism, without any writer protection.
++ *
++ * Write side critical sections must be serialized (and non-preemptible).
++ *
++ * If readers can be invoked from interrupt contexts, interrupts must also
++ * be respectively disabled before entering the write section.
++ *
++ * This mechanism can't be used if the protected data contains pointers,
++ * as the writer can invalidate a pointer that a reader is following.
++ */
++struct seqcount {
++    unsigned int sequence;
++};
++
++/*
++ * SEQCNT_ZERO() - initializer for seqcount_t
++ * @name: Name of the struct seqcount instance
++ */
++#define SEQCNT_ZERO() { .sequence = 0 }
++
++static inline unsigned int seqprop_sequence(const struct seqcount *s)
++{
++    return ACCESS_ONCE(s->sequence);
++}
++
++/*
++ * read_seqcount_begin() - begin a seqcount read critical section
++ * @s: Pointer to struct seqcount
++ *
++ * Return: count to be passed to read_seqcount_retry()
++ */
++static inline unsigned int _read_seqcount_begin(const struct seqcount *s)
++{
++    unsigned int seq;
++
++    while ((seq = seqprop_sequence(s)) & 1)
++        cpu_relax();
++
++    smp_rmb();
++
++    return seq;
++}
++
++static always_inline unsigned int read_seqcount_begin(const struct seqcount *s)
++{
++    unsigned int seq = _read_seqcount_begin(s);
++
++    block_lock_speculation();
++
++    return seq;
++}
++
++/*
++ * read_seqcount_retry() - end a seqcount read critical section
++ * @s: Pointer to struct seqcount
++ * @start: count, from read_seqcount_begin()
++ *
++ * read_seqcount_retry closes the read critical section of given struct
++ * seqcount.  If the critical section was invalid, it must be ignored
++ * (and typically retried).
++ *
++ * Return: true if a read section retry is required, else false
++ */
++static inline bool _read_seqcount_retry(const struct seqcount *s,
++                                        unsigned int start)
++{
++    smp_rmb();
++    return unlikely(seqprop_sequence(s) != start);
++}
++
++static always_inline bool read_seqcount_retry(const struct seqcount *s,
++                                              unsigned int start)
++{
++    return lock_evaluate_nospec(_read_seqcount_retry(s, start));
++}
++
++/* Loops until a consistent count has been observed across the loop body. */
++#define until_seq_read(seq)                                    \
++    for ( unsigned int retry_ = 1, count_;                     \
++          retry_ && (count_ = read_seqcount_begin(seq), true); \
++          retry_ = read_seqcount_retry(seq, count_) )
++
++/*
++ * write_seqcount_begin() - start a struct seqcount write side critical section
++ * @s: Pointer to struct seqcount
++ *
++ * Context: sequence counter write side sections must be serialized.
++ * If readers can be invoked from interrupt context, interrupts must be
++ * respectively disabled.
++ */
++static inline void write_seqcount_begin(struct seqcount *s)
++{
++    add_sized(&s->sequence, 1);
++    smp_wmb();
++}
++
++/*
++ * write_seqcount_end() - end a struct seqcount write side critical section
++ * @s: Pointer to seqcount
++ */
++static inline void write_seqcount_end(struct seqcount *s)
++{
++    smp_wmb();
++    add_sized(&s->sequence, 1);
++}
++
++/*
++ * Not really a loop, but we need write_seqcount_{begin,end}() in the correct
++ * position.
++ */
++#define with_seq_write(seq)                           \
++    for ( bool once_ = true;                          \
++          once_ && (write_seqcount_begin(seq), true); \
++          (write_seqcount_end(seq), once_ = false) )
++
++#endif /* XEN_SEQCOUNT_H */
++
++/*
++ * Local variables:
++ * mode: C
++ * c-file-style: "BSD"
++ * c-basic-offset: 4
++ * tab-width: 4
++ * indent-tabs-mode: nil
++ * End:
++ */

xsa492-4.21-02.patch

@@ -0,0 +1,104 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domctl: handle XEN_DOMCTL_getdomaininfo without acquiring domctl lock
+
+getdomaininfo() is not called under consistently the same lock. Thus,
+with caller side locking irrelevant, it can as well be called with the
+domctl lock not held. (Callers not pausing the domain they want to
+retrieve information for already need to be aware that not all of the
+data returned can be relied on as being consistent; most data will also
+be stale by the time the caller gets to look at it.)
+
+Move the handling not only ahead of acquiring the lock, but also ahead
+of the XSM check, leveraging that the sub-op has its own hook.
+
+While moving, convert an assignment to an assertion: The domain in
+question was determined from the field which previously was "updated".
+
+This is part of XSA-492.
+
+Fixes: 5513bd0b4675 ("add xenstore domain flag to hypervisor")
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -318,6 +318,26 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         break;
+     }
+ 
++    /* Handle sub-ops not requiring the domctl lock. */
++    switch ( op->cmd )
++    {
++    case XEN_DOMCTL_getdomaininfo:
++        ret = xsm_getdomaininfo(XSM_XS_PRIV, d);
++        if ( !ret )
++        {
++            getdomaininfo(d, &op->u.getdomaininfo);
++
++            ASSERT(op->domain == op->u.getdomaininfo.domain);
++            copyback = true;
++        }
++
++        goto domctl_out_unlock_domonly;
++
++    default:
++        /* Everything else handled further down. */
++        break;
++    }
++
+     ret = xsm_domctl(XSM_OTHER, d, op->cmd,
+                      /* SSIDRef only applicable for cmd == createdomain */
+                      op->u.createdomain.ssidref);
+@@ -516,17 +536,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         copyback = 1;
+         break;
+ 
+-    case XEN_DOMCTL_getdomaininfo:
+-        ret = xsm_getdomaininfo(XSM_XS_PRIV, d);
+-        if ( ret )
+-            break;
+-
+-        getdomaininfo(d, &op->u.getdomaininfo);
+-
+-        op->domain = op->u.getdomaininfo.domain;
+-        copyback = 1;
+-        break;
+-
+     case XEN_DOMCTL_getvcpucontext:
+     {
+         vcpu_guest_context_u c = { .nat = NULL };
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -172,9 +172,13 @@ static XSM_INLINE int cf_check xsm_domct
+     case XEN_DOMCTL_bind_pt_irq:
+     case XEN_DOMCTL_unbind_pt_irq:
+         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
+-    case XEN_DOMCTL_getdomaininfo:
+     case XEN_DOMCTL_get_domain_state:
+         return xsm_default_action(XSM_XS_PRIV, current->domain, d);
++
++    case XEN_DOMCTL_getdomaininfo:
++        ASSERT_UNREACHABLE();
++        return -EILSEQ;
++
+     default:
+         return xsm_default_action(XSM_PRIV, current->domain, d);
+     }
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -682,8 +682,12 @@ static int cf_check flask_domctl(struct
+          */
+         return avc_current_has_perm(ssidref, SECCLASS_DOMAIN, DOMAIN__CREATE, NULL);
+ 
+-    /* These have individual XSM hooks (common/domctl.c) */
++    /* These have individual XSM hooks and don't make it here. */
+     case XEN_DOMCTL_getdomaininfo:
++        ASSERT_UNREACHABLE();
++        return -EILSEQ;
++
++    /* These have individual XSM hooks (common/domctl.c) */
+     case XEN_DOMCTL_scheduler_op:
+     case XEN_DOMCTL_irq_permission:
+     case XEN_DOMCTL_iomem_permission:

xsa492-4.21-03.patch

@@ -0,0 +1,87 @@
+From: Daniel P. Smith <dpsmith@apertussolutions.com>
+Subject: domctl: protect locking for get_domain_state
+
+When DOMID_INVALID is passed, the dom exec handler lock is being taken
+without any check that the domain is even allowed to take the lock. This
+allows for an unauthorized domain to DoS the get_domain_state domctl op.
+Move to consider the op effectively being called against the hypervisor.
+Thus it is the target of the call being invoked to identify the last
+domain with a state change. The subsequent check of whether the source
+domain is allowed the state of the last domain to change state is still
+relevant.
+
+This is part of XSA-492.
+
+Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/tools/flask/policy/modules/xenstore.te
++++ b/tools/flask/policy/modules/xenstore.te
+@@ -14,6 +14,7 @@ allow xenstore_t xen_t:xen writeconsole;
+ # Xenstore queries domaininfo on all domains
+ allow xenstore_t domain_type:domain getdomaininfo;
+ allow xenstore_t domain_type:domain2 get_domain_state;
++allow xenstore_t domxen_t:domain2 get_domain_state;
+ 
+ # As a shortcut, the following 3 rules are used instead of adding a domain_comms
+ # rule between xenstore_t and every domain type that talks to xenstore
+--- a/xen/common/domain.c
++++ b/xen/common/domain.c
+@@ -216,12 +216,8 @@ int get_domain_state(struct xen_domctl_g
+     if ( info->pad0 )
+         return -EINVAL;
+ 
+-    if ( d )
++    if ( d != dom_xen )
+     {
+-        rc = xsm_get_domain_state(XSM_XS_PRIV, d);
+-        if ( rc )
+-            return rc;
+-
+         set_domain_state_info(info, d);
+ 
+         return 0;
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -304,13 +304,19 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         fallthrough;
+     case XEN_DOMCTL_test_assign_device:
+     case XEN_DOMCTL_vm_event_op:
+-    case XEN_DOMCTL_get_domain_state:
+         if ( op->domain == DOMID_INVALID )
+         {
+             d = NULL;
+             break;
+         }
+         fallthrough;
++    case XEN_DOMCTL_get_domain_state:
++        if ( op->domain == DOMID_INVALID )
++        {
++            d = dom_xen;
++            break;
++        }
++        fallthrough;
+     default:
+         d = rcu_lock_domain_by_id(op->domain);
+         if ( !d )
+@@ -863,7 +869,9 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         break;
+ 
+     case XEN_DOMCTL_get_domain_state:
+-        ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
++        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
++        if ( !ret )
++            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
+         if ( !ret )
+             copyback = true;
+         break;
+@@ -876,7 +884,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+     domctl_lock_release();
+ 
+  domctl_out_unlock_domonly:
+-    if ( d && d != dom_io )
++    if ( d && !is_system_domain(d) )
+         rcu_unlock_domain(d);
+ 
+     if ( copyback && __copy_to_guest(u_domctl, op, 1) )

xsa492-4.21-04.patch

@@ -0,0 +1,81 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domctl: handle XEN_DOMCTL_get_domain_state without acquiring domctl lock
+
+get_domain_state() uses its own locking. Thus, with caller side locking
+irrelevant, it can as well be called with the domctl lock not held.
+
+Move the handling not only ahead of acquiring the lock, but also ahead
+of the XSM check, leveraging that the sub-op has its own hook.
+
+This is part of XSA-492.
+
+Fixes: 3ad3df1bd0aa ("xen: add new domctl get_domain_state")
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -339,6 +339,14 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+ 
+         goto domctl_out_unlock_domonly;
+ 
++    case XEN_DOMCTL_get_domain_state:
++        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
++        if ( !ret )
++            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
++        if ( !ret )
++            copyback = true;
++        goto domctl_out_unlock_domonly;
++
+     default:
+         /* Everything else handled further down. */
+         break;
+@@ -868,14 +876,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             ret = -EOPNOTSUPP;
+         break;
+ 
+-    case XEN_DOMCTL_get_domain_state:
+-        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
+-        if ( !ret )
+-            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
+-        if ( !ret )
+-            copyback = true;
+-        break;
+-
+     default:
+         ret = arch_do_domctl(op, d, u_domctl);
+         break;
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -172,10 +172,9 @@ static XSM_INLINE int cf_check xsm_domct
+     case XEN_DOMCTL_bind_pt_irq:
+     case XEN_DOMCTL_unbind_pt_irq:
+         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
+-    case XEN_DOMCTL_get_domain_state:
+-        return xsm_default_action(XSM_XS_PRIV, current->domain, d);
+ 
+     case XEN_DOMCTL_getdomaininfo:
++    case XEN_DOMCTL_get_domain_state:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+ 
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -684,6 +684,7 @@ static int cf_check flask_domctl(struct
+ 
+     /* These have individual XSM hooks and don't make it here. */
+     case XEN_DOMCTL_getdomaininfo:
++    case XEN_DOMCTL_get_domain_state:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+ 
+@@ -694,7 +695,6 @@ static int cf_check flask_domctl(struct
+     case XEN_DOMCTL_memory_mapping:
+     case XEN_DOMCTL_set_target:
+     case XEN_DOMCTL_vm_event_op:
+-    case XEN_DOMCTL_get_domain_state:
+ 
+     /* These have individual XSM hooks (arch/../domctl.c) */
+     case XEN_DOMCTL_bind_pt_irq:

xsa492-4.21-05.patch

@@ -0,0 +1,156 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domain: locking for iomem_caps accesses
+
+In order to be able to pull at least the XEN_DOMCTL_iomem_mapping handling
+out of the domctl-locked region, a separate (per-domain) lock is needed to
+synchronize in particular with XEN_DOMCTL_iomem_permission.
+
+Locking is added only as far as domctl-s are affected. Uses presently
+outside of the domctl lock may want dealing with subsequently (perhaps
+limited to non-__init code).
+
+This is part of XSA-492.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/common/domain.c
++++ b/xen/common/domain.c
+@@ -518,10 +518,15 @@ static int late_hwdom_init(struct domain
+      * may be modified after this hypercall returns if a more complex
+      * device model is desired.
+      */
++    write_lock(&dom0->caps_lock);
+     rangeset_swap(d->irq_caps, dom0->irq_caps);
+     rangeset_swap(d->iomem_caps, dom0->iomem_caps);
+ #ifdef CONFIG_X86
+     rangeset_swap(d->arch.ioport_caps, dom0->arch.ioport_caps);
++#endif
++    write_unlock(&dom0->caps_lock);
++
++#ifdef CONFIG_X86
+     setup_io_bitmap(d);
+     setup_io_bitmap(dom0);
+ #endif
+@@ -873,6 +878,7 @@ struct domain *domain_create(domid_t dom
+     rspin_lock_init_prof(d, domain_lock);
+     rspin_lock_init_prof(d, page_alloc_lock);
+     spin_lock_init(&d->hypercall_deadlock_mutex);
++    rwlock_init(&d->caps_lock);
+     INIT_PAGE_LIST_HEAD(&d->page_list);
+     INIT_PAGE_LIST_HEAD(&d->extra_page_list);
+     INIT_PAGE_LIST_HEAD(&d->xenpage_list);
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -267,6 +267,35 @@ static struct vnuma_info *vnuma_init(con
+     return ERR_PTR(ret);
+ }
+ 
++void iocaps_double_lock(struct domain *d, bool write)
++{
++    struct domain *currd = current->domain;
++
++    if ( d->domain_id > currd->domain_id )
++        read_lock(&currd->caps_lock);
++
++    if ( write )
++        write_lock(&d->caps_lock);
++    else
++        read_lock(&d->caps_lock);
++
++    if ( d->domain_id < currd->domain_id )
++        read_lock(&currd->caps_lock);
++}
++
++void iocaps_double_unlock(struct domain *d, bool write)
++{
++    struct domain *currd = current->domain;
++
++    if ( d != currd )
++        read_unlock(&currd->caps_lock);
++
++    if ( write )
++        write_unlock(&d->caps_lock);
++    else
++        read_unlock(&d->caps_lock);
++}
++
+ static bool is_stable_domctl(uint32_t cmd)
+ {
+     return cmd == XEN_DOMCTL_get_domain_state;
+@@ -687,6 +716,8 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         if ( (mfn + nr_mfns - 1) < mfn ) /* wrap? */
+             break;
+ 
++        iocaps_double_lock(d, true);
++
+         if ( !iomem_access_permitted(current->domain,
+                                      mfn, mfn + nr_mfns - 1) ||
+              xsm_iomem_permission(XSM_HOOK, d, mfn, mfn + nr_mfns - 1, allow) )
+@@ -695,6 +726,8 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             ret = iomem_permit_access(d, mfn, mfn + nr_mfns - 1);
+         else
+             ret = iomem_deny_access(d, mfn, mfn + nr_mfns - 1);
++
++        iocaps_double_unlock(d, true);
+         break;
+     }
+ 
+@@ -719,19 +752,15 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             break;
+ #endif
+ 
++        iocaps_double_lock(d, false);
++
+         ret = -EPERM;
+         if ( !iomem_access_permitted(current->domain, mfn, mfn_end) ||
+-             !iomem_access_permitted(d, mfn, mfn_end) )
+-            break;
+-
+-        ret = xsm_iomem_mapping(XSM_HOOK, d, mfn, mfn_end, add);
+-        if ( ret )
+-            break;
+-
+-        if ( !paging_mode_translate(d) )
+-            break;
+-
+-        if ( add )
++             !iomem_access_permitted(d, mfn, mfn_end) ||
++             (ret = xsm_iomem_mapping(XSM_HOOK, d, mfn, mfn_end, add)) ||
++             !paging_mode_translate(d) )
++            /* Nothing. */;
++        else if ( add )
+         {
+             printk(XENLOG_G_DEBUG
+                    "memory_map:add: dom%d gfn=%lx mfn=%lx nr=%lx\n",
+@@ -755,6 +784,8 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+                        "memory_map: error %ld removing dom%d access to [%lx,%lx]\n",
+                        ret, d->domain_id, mfn, mfn_end);
+         }
++
++        iocaps_double_unlock(d, false);
+         break;
+     }
+ 
+--- a/xen/include/xen/iocap.h
++++ b/xen/include/xen/iocap.h
+@@ -12,6 +12,9 @@
+ #include <asm/iocap.h>
+ #include <asm/p2m.h>
+ 
++void iocaps_double_lock(struct domain *d, bool write);
++void iocaps_double_unlock(struct domain *d, bool write);
++
+ static inline int iomem_permit_access(struct domain *d, unsigned long s,
+                                       unsigned long e)
+ {
+--- a/xen/include/xen/sched.h
++++ b/xen/include/xen/sched.h
+@@ -536,6 +536,7 @@ struct domain
+ #endif
+ 
+     /* I/O capabilities (access to IRQs and memory-mapped I/O). */
++    rwlock_t         caps_lock;
+     struct rangeset *iomem_caps;
+     struct rangeset *irq_caps;
+ 

xsa492-4.21-06.patch

@@ -0,0 +1,84 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: x86/domain: locking for ioport_caps accesses
+
+In order to be able to pull at least the XEN_DOMCTL_ioport_mapping
+handling out of the domctl-locked region, the new separate (per-domain)
+lock is used to synchronize in particular with
+XEN_DOMCTL_ioport_permission.
+
+Locking is added only as far as domctl-s are affected. Uses presently
+outside of the domctl lock may want dealing with subsequently (perhaps
+limited to non-__init code).
+
+This is part of XSA-492.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -233,6 +233,8 @@ long arch_do_domctl(
+         unsigned int np = domctl->u.ioport_permission.nr_ports;
+         int allow = domctl->u.ioport_permission.allow_access;
+ 
++        iocaps_double_lock(d, true);
++
+         if ( (fp + np) <= fp || (fp + np) > MAX_IOPORTS )
+             ret = -EINVAL;
+         else if ( !ioports_access_permitted(currd, fp, fp + np - 1) ||
+@@ -242,6 +244,8 @@ long arch_do_domctl(
+             ret = ioports_permit_access(d, fp, fp + np - 1);
+         else
+             ret = ioports_deny_access(d, fp, fp + np - 1);
++
++        iocaps_double_unlock(d, true);
+         break;
+     }
+ 
+@@ -648,16 +652,13 @@ long arch_do_domctl(
+             break;
+         }
+ 
+-        ret = -EPERM;
+-        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) )
+-            break;
+-
+-        ret = xsm_ioport_mapping(XSM_HOOK, d, fmp, fmp + np - 1, add);
+-        if ( ret )
+-            break;
+-
+         hvm = &d->arch.hvm;
+-        if ( add )
++        iocaps_double_lock(d, true);
++
++        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) ||
++             (ret = xsm_ioport_mapping(XSM_HOOK, d, fmp, fmp + np - 1, add)) )
++            ret = ret ?: -EPERM;
++        else if ( add )
+         {
+             printk(XENLOG_G_INFO
+                    "ioport_map:add: dom%d gport=%x mport=%x nr=%x\n",
+@@ -718,6 +720,8 @@ long arch_do_domctl(
+                        "ioport_map: error %ld denying dom%d access to [%x,%x]\n",
+                        ret, d->domain_id, fmp, fmp + np - 1);
+         }
++
++        iocaps_double_unlock(d, true);
+         break;
+     }
+ 
+--- a/xen/arch/x86/setup.c
++++ b/xen/arch/x86/setup.c
+@@ -2339,9 +2339,12 @@ void __hwdom_init setup_io_bitmap(struct
+         return;
+ 
+     bitmap_fill(d->arch.hvm.io_bitmap, 0x10000);
++
++    read_lock(&d->caps_lock);
+     if ( rangeset_report_ranges(d->arch.ioport_caps, 0, 0x10000,
+                                 io_bitmap_cb, d) )
+         BUG();
++    read_unlock(&d->caps_lock);
+ 
+     /*
+      * We need to trap 4-byte accesses to 0xcf8 (see admin_io_okay(),

xsa492-4.21-07.patch

@@ -0,0 +1,202 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domain: locking for irq_caps accesses
+
+In order to be able to pull at least the XEN_DOMCTL_{,un}bind_pt_irq
+handling out of the domctl-locked region, a separate (per-domain) lock is
+needed to synchronize in particular with XEN_DOMCTL_{irq,gsi}_permission.
+
+Locking is added only as far as domctl-s are affected. Uses presently
+outside of the domctl lock may want dealing with subsequently (perhaps
+limited to non-__init code).
+
+This is part of XSA-492.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Julien Grall <julien@xen.org>
+
+--- a/xen/arch/arm/domctl.c
++++ b/xen/arch/arm/domctl.c
+@@ -76,6 +76,7 @@ long arch_do_domctl(struct xen_domctl *d
+     case XEN_DOMCTL_bind_pt_irq:
+     {
+         int rc;
++        struct domain *currd = current->domain;
+         struct xen_domctl_bind_pt_irq *bind = &domctl->u.bind_pt_irq;
+         uint32_t irq = bind->u.spi.spi;
+         uint32_t virq = bind->machine_irq;
+@@ -107,21 +108,26 @@ long arch_do_domctl(struct xen_domctl *d
+         if ( rc )
+             return rc;
+ 
+-        if ( !irq_access_permitted(current->domain, irq) )
+-            return -EPERM;
++        read_lock(&currd->caps_lock);
+ 
+-        if ( !vgic_reserve_virq(d, virq) )
+-            return -EBUSY;
+-
+-        rc = route_irq_to_guest(d, virq, irq, "routed IRQ");
+-        if ( rc )
+-            vgic_free_virq(d, virq);
++        if ( !irq_access_permitted(currd, irq) )
++            rc = -EPERM;
++        else if ( !vgic_reserve_virq(d, virq) )
++            rc = -EBUSY;
++        else
++        {
++            rc = route_irq_to_guest(d, virq, irq, "routed IRQ");
++            if ( rc )
++                vgic_free_virq(d, virq);
++        }
+ 
++        read_unlock(&currd->caps_lock);
+         return rc;
+     }
+     case XEN_DOMCTL_unbind_pt_irq:
+     {
+         int rc;
++        struct domain *currd = current->domain;
+         struct xen_domctl_bind_pt_irq *bind = &domctl->u.bind_pt_irq;
+         uint32_t irq = bind->u.spi.spi;
+         uint32_t virq = bind->machine_irq;
+@@ -138,16 +144,15 @@ long arch_do_domctl(struct xen_domctl *d
+         if ( rc )
+             return rc;
+ 
+-        if ( !irq_access_permitted(current->domain, irq) )
+-            return -EPERM;
+-
+-        rc = release_guest_irq(d, virq);
+-        if ( rc )
+-            return rc;
++        read_lock(&currd->caps_lock);
+ 
+-        vgic_free_virq(d, virq);
++        if ( !irq_access_permitted(currd, irq) )
++            rc = -EPERM;
++        else if ( !(rc = release_guest_irq(d, virq)) )
++            vgic_free_virq(d, virq);
+ 
+-        return 0;
++        read_unlock(&currd->caps_lock);
++        return rc;
+     }
+ 
+     case XEN_DOMCTL_vuart_op:
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -267,16 +267,17 @@ long arch_do_domctl(
+             break;
+         }
+ 
+-        ret = -EPERM;
++        iocaps_double_lock(d, true);
++
+         if ( !irq_access_permitted(currd, irq) ||
+              xsm_irq_permission(XSM_HOOK, d, irq, flags) )
+-            break;
+-
+-        if ( flags )
++            ret = -EPERM;
++        else if ( flags )
+             ret = irq_permit_access(d, irq);
+         else
+             ret = irq_deny_access(d, irq);
+ 
++        iocaps_double_unlock(d, true);
+         break;
+     }
+ 
+@@ -579,20 +580,27 @@ long arch_do_domctl(
+             break;
+ 
+         irq = domain_pirq_to_irq(d, bind->machine_irq);
+-        ret = -EPERM;
+-        if ( irq <= 0 || !irq_access_permitted(currd, irq) )
+-            break;
++        if ( irq <= 0 )
++            ret = -EPERM;
+ 
+-        ret = -ESRCH;
+-        if ( is_iommu_enabled(d) )
++        read_lock(&currd->caps_lock);
++
++        if ( !irq_access_permitted(currd, irq) )
++            ret = -EPERM;
++        else if ( is_iommu_enabled(d) )
+         {
+             pcidevs_lock();
+             ret = pt_irq_create_bind(d, bind);
+             pcidevs_unlock();
++
++            if ( ret < 0 )
++                printk(XENLOG_G_ERR "pt_irq_create_bind failed (%ld) for %pd\n",
++                       ret, d);
+         }
+-        if ( ret < 0 )
+-            printk(XENLOG_G_ERR "pt_irq_create_bind failed (%ld) for dom%d\n",
+-                   ret, d->domain_id);
++        else
++            ret = -ESRCH;
++
++        read_unlock(&currd->caps_lock);
+         break;
+     }
+ 
+@@ -605,23 +613,26 @@ long arch_do_domctl(
+         if ( !is_hvm_domain(d) )
+             break;
+ 
+-        ret = -EPERM;
+-        if ( irq <= 0 || !irq_access_permitted(currd, irq) )
+-            break;
+-
+         ret = xsm_unbind_pt_irq(XSM_HOOK, d, bind);
+         if ( ret )
+             break;
+ 
+-        if ( is_iommu_enabled(d) )
++        read_lock(&currd->caps_lock);
++
++        if ( !irq_access_permitted(currd, irq) )
++            ret = -EPERM;
++        else if ( is_iommu_enabled(d) )
+         {
+             pcidevs_lock();
+             ret = pt_irq_destroy_bind(d, bind);
+             pcidevs_unlock();
++
++            if ( ret < 0 )
++                printk(XENLOG_G_ERR "pt_irq_destroy_bind failed (%ld) for %pd\n",
++                       ret, d);
+         }
+-        if ( ret < 0 )
+-            printk(XENLOG_G_ERR "pt_irq_destroy_bind failed (%ld) for dom%d\n",
+-                   ret, d->domain_id);
++
++        read_unlock(&currd->caps_lock);
+         break;
+     }
+ 
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -695,6 +695,9 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             ret = -EINVAL;
+             break;
+         }
++
++        iocaps_double_lock(d, true);
++
+         irq = pirq_access_permitted(current->domain, pirq);
+         if ( !irq || xsm_irq_permission(XSM_HOOK, d, irq, allow) )
+             ret = -EPERM;
+@@ -702,6 +705,8 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             ret = irq_permit_access(d, irq);
+         else
+             ret = irq_deny_access(d, irq);
++
++        iocaps_double_unlock(d, true);
+         break;
+     }
+ #endif

xsa492-4.21-08.patch

@@ -0,0 +1,85 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: XSM/Flask: split the .iomem_mapping() hook
+
+It's used twice in entirely different situations. The use in do_domctl()
+wants to become an ordinary XSM_DM_PRIV invocation, while the one in vPCI
+code need to remain XSM_HOOK (it may plausibly become XSM_TARGET). For
+Flask, the same backing function will continue to be used for the time
+being.
+
+This is part of XSA-492.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+
+--- a/xen/drivers/vpci/header.c
++++ b/xen/drivers/vpci/header.c
+@@ -67,7 +67,7 @@ static int cf_check map_range(
+             return -EPERM;
+         }
+ 
+-        rc = xsm_iomem_mapping(XSM_HOOK, map->d, map_mfn, m_end, map->map);
++        rc = xsm_iomem_mapping_vpci(XSM_HOOK, map->d, map_mfn, m_end, map->map);
+         if ( rc )
+         {
+             printk(XENLOG_G_WARNING
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -580,6 +580,13 @@ static XSM_INLINE int cf_check xsm_iomem
+     return xsm_default_action(action, current->domain, d);
+ }
+ 
++static XSM_INLINE int cf_check xsm_iomem_mapping_vpci(
++    XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
++{
++    XSM_ASSERT_ACTION(XSM_HOOK);
++    return xsm_default_action(action, current->domain, d);
++}
++
+ static XSM_INLINE int cf_check xsm_pci_config_permission(
+     XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start,
+     uint16_t end, uint8_t access)
+--- a/xen/include/xsm/xsm.h
++++ b/xen/include/xsm/xsm.h
+@@ -118,6 +118,8 @@ struct xsm_ops {
+                             uint8_t allow);
+     int (*iomem_mapping)(struct domain *d, uint64_t s, uint64_t e,
+                          uint8_t allow);
++    int (*iomem_mapping_vpci)(struct domain *d, uint64_t s, uint64_t e,
++                              uint8_t allow);
+     int (*pci_config_permission)(struct domain *d, uint32_t machine_bdf,
+                                  uint16_t start, uint16_t end, uint8_t access);
+ 
+@@ -523,6 +525,12 @@ static inline int xsm_iomem_mapping(
+     return alternative_call(xsm_ops.iomem_mapping, d, s, e, allow);
+ }
+ 
++static inline int xsm_iomem_mapping_vpci(
++    xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
++{
++    return alternative_call(xsm_ops.iomem_mapping_vpci, d, s, e, allow);
++}
++
+ static inline int xsm_pci_config_permission(
+     xsm_default_t def, struct domain *d, uint32_t machine_bdf, uint16_t start,
+     uint16_t end, uint8_t access)
+--- a/xen/xsm/dummy.c
++++ b/xen/xsm/dummy.c
+@@ -76,6 +76,7 @@ static const struct xsm_ops __initconst_
+     .irq_permission                = xsm_irq_permission,
+     .iomem_permission              = xsm_iomem_permission,
+     .iomem_mapping                 = xsm_iomem_mapping,
++    .iomem_mapping_vpci            = xsm_iomem_mapping_vpci,
+     .pci_config_permission         = xsm_pci_config_permission,
+     .get_vnumainfo                 = xsm_get_vnumainfo,
+ 
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -1950,6 +1950,7 @@ static const struct xsm_ops __initconst_
+     .irq_permission = flask_irq_permission,
+     .iomem_permission = flask_iomem_permission,
+     .iomem_mapping = flask_iomem_mapping,
++    .iomem_mapping_vpci = flask_iomem_mapping,
+     .pci_config_permission = flask_pci_config_permission,
+ 
+     .resource_plug_core = flask_resource_plug_core,

xsa492-4.21-09.patch

@@ -0,0 +1,194 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domctl: handle XEN_DOMCTL_memory_mapping without acquiring domctl lock
+
+With dedicated locking added, the domctl lock isn't required here anymore.
+Move the re-purposed dedicated XSM check as early as possible.
+
+Minimal "modernization": Switch "add" to bool and use %pd in log messages.
+
+This is part of XSA-492.
+
+Fixes: fda49f9b3fbb ("Add build option to allow more hypercalls from stubdoms")
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -376,6 +376,66 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+             copyback = true;
+         goto domctl_out_unlock_domonly;
+ 
++    case XEN_DOMCTL_memory_mapping:
++    {
++        unsigned long gfn = op->u.memory_mapping.first_gfn;
++        unsigned long mfn = op->u.memory_mapping.first_mfn;
++        unsigned long nr_mfns = op->u.memory_mapping.nr_mfns;
++        unsigned long mfn_end = mfn + nr_mfns - 1;
++        bool add = op->u.memory_mapping.add_mapping;
++
++        ret = -EINVAL;
++        if ( mfn_end < mfn || /* Wrap? */
++             ((mfn | mfn_end) >> (paddr_bits - PAGE_SHIFT)) ||
++             (gfn + nr_mfns - 1) < gfn ) /* Wrap? */
++            goto domctl_out_unlock_domonly;
++
++        ret = xsm_iomem_mapping(XSM_DM_PRIV, d, mfn, mfn_end, add);
++        if ( ret || !paging_mode_translate(d) )
++            goto domctl_out_unlock_domonly;
++
++#ifndef CONFIG_X86 /* XXX ARM!? */
++        ret = -E2BIG;
++        /* Must break hypercall up as this could take a while. */
++        if ( nr_mfns > 64 )
++            goto domctl_out_unlock_domonly;
++#endif
++
++        iocaps_double_lock(d, false);
++
++        ret = -EPERM;
++        if ( !iomem_access_permitted(current->domain, mfn, mfn_end) ||
++             !iomem_access_permitted(d, mfn, mfn_end) )
++            /* Nothing. */;
++        else if ( add )
++        {
++            printk(XENLOG_G_DEBUG
++                   "memory_map:add: %pd gfn=%lx mfn=%lx nr=%lx\n",
++                   d, gfn, mfn, nr_mfns);
++
++            ret = map_mmio_regions(d, _gfn(gfn), nr_mfns, _mfn(mfn));
++            if ( ret < 0 )
++                printk(XENLOG_G_WARNING
++                       "memory_map:fail: %pd gfn=%lx mfn=%lx nr=%lx ret:%ld\n",
++                       d, gfn, mfn, nr_mfns, ret);
++        }
++        else
++        {
++            printk(XENLOG_G_DEBUG
++                   "memory_map:remove: %pd gfn=%lx mfn=%lx nr=%lx\n",
++                   d, gfn, mfn, nr_mfns);
++
++            ret = unmap_mmio_regions(d, _gfn(gfn), nr_mfns, _mfn(mfn));
++            if ( ret < 0 && is_hardware_domain(current->domain) )
++                printk(XENLOG_ERR
++                       "memory_map: error %ld removing %pd access to [%lx,%lx]\n",
++                       ret, d, mfn, mfn_end);
++        }
++
++        iocaps_double_unlock(d, false);
++        goto domctl_out_unlock_domonly;
++    }
++
+     default:
+         /* Everything else handled further down. */
+         break;
+@@ -736,64 +796,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         break;
+     }
+ 
+-    case XEN_DOMCTL_memory_mapping:
+-    {
+-        unsigned long gfn = op->u.memory_mapping.first_gfn;
+-        unsigned long mfn = op->u.memory_mapping.first_mfn;
+-        unsigned long nr_mfns = op->u.memory_mapping.nr_mfns;
+-        unsigned long mfn_end = mfn + nr_mfns - 1;
+-        int add = op->u.memory_mapping.add_mapping;
+-
+-        ret = -EINVAL;
+-        if ( mfn_end < mfn || /* wrap? */
+-             ((mfn | mfn_end) >> (paddr_bits - PAGE_SHIFT)) ||
+-             (gfn + nr_mfns - 1) < gfn ) /* wrap? */
+-            break;
+-
+-#ifndef CONFIG_X86 /* XXX ARM!? */
+-        ret = -E2BIG;
+-        /* Must break hypercall up as this could take a while. */
+-        if ( nr_mfns > 64 )
+-            break;
+-#endif
+-
+-        iocaps_double_lock(d, false);
+-
+-        ret = -EPERM;
+-        if ( !iomem_access_permitted(current->domain, mfn, mfn_end) ||
+-             !iomem_access_permitted(d, mfn, mfn_end) ||
+-             (ret = xsm_iomem_mapping(XSM_HOOK, d, mfn, mfn_end, add)) ||
+-             !paging_mode_translate(d) )
+-            /* Nothing. */;
+-        else if ( add )
+-        {
+-            printk(XENLOG_G_DEBUG
+-                   "memory_map:add: dom%d gfn=%lx mfn=%lx nr=%lx\n",
+-                   d->domain_id, gfn, mfn, nr_mfns);
+-
+-            ret = map_mmio_regions(d, _gfn(gfn), nr_mfns, _mfn(mfn));
+-            if ( ret < 0 )
+-                printk(XENLOG_G_WARNING
+-                       "memory_map:fail: dom%d gfn=%lx mfn=%lx nr=%lx ret:%ld\n",
+-                       d->domain_id, gfn, mfn, nr_mfns, ret);
+-        }
+-        else
+-        {
+-            printk(XENLOG_G_DEBUG
+-                   "memory_map:remove: dom%d gfn=%lx mfn=%lx nr=%lx\n",
+-                   d->domain_id, gfn, mfn, nr_mfns);
+-
+-            ret = unmap_mmio_regions(d, _gfn(gfn), nr_mfns, _mfn(mfn));
+-            if ( ret < 0 && is_hardware_domain(current->domain) )
+-                printk(XENLOG_ERR
+-                       "memory_map: error %ld removing dom%d access to [%lx,%lx]\n",
+-                       ret, d->domain_id, mfn, mfn_end);
+-        }
+-
+-        iocaps_double_unlock(d, false);
+-        break;
+-    }
+-
+     case XEN_DOMCTL_settimeoffset:
+         domain_set_time_offset(d, op->u.settimeoffset.time_offset_seconds);
+         break;
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -168,13 +168,13 @@ static XSM_INLINE int cf_check xsm_domct
+     switch ( cmd )
+     {
+     case XEN_DOMCTL_ioport_mapping:
+-    case XEN_DOMCTL_memory_mapping:
+     case XEN_DOMCTL_bind_pt_irq:
+     case XEN_DOMCTL_unbind_pt_irq:
+         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
+ 
+     case XEN_DOMCTL_getdomaininfo:
+     case XEN_DOMCTL_get_domain_state:
++    case XEN_DOMCTL_memory_mapping:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+ 
+@@ -576,7 +576,7 @@ static XSM_INLINE int cf_check xsm_iomem
+ static XSM_INLINE int cf_check xsm_iomem_mapping(
+     XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
+ {
+-    XSM_ASSERT_ACTION(XSM_HOOK);
++    XSM_ASSERT_ACTION(XSM_DM_PRIV);
+     return xsm_default_action(action, current->domain, d);
+ }
+ 
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -685,6 +685,7 @@ static int cf_check flask_domctl(struct
+     /* These have individual XSM hooks and don't make it here. */
+     case XEN_DOMCTL_getdomaininfo:
+     case XEN_DOMCTL_get_domain_state:
++    case XEN_DOMCTL_memory_mapping:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+ 
+@@ -692,7 +693,6 @@ static int cf_check flask_domctl(struct
+     case XEN_DOMCTL_scheduler_op:
+     case XEN_DOMCTL_irq_permission:
+     case XEN_DOMCTL_iomem_permission:
+-    case XEN_DOMCTL_memory_mapping:
+     case XEN_DOMCTL_set_target:
+     case XEN_DOMCTL_vm_event_op:
+ 

xsa492-4.21-10.patch

@@ -0,0 +1,97 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: domctl: handle XEN_DOMCTL_ioport_mapping without acquiring domctl lock
+
+With dedicated locking added, the domctl lock isn't required here anymore.
+As the handling is in arch-specific code (x86 only), almost no code is
+being moved, but a 2nd (extensible to other sub-ops) invocation of
+arch_do_domctl() is being added. Move just the re-purposed dedicated XSM
+check as early as possible.
+
+In flask_domctl() don't put #ifdef around the moved case label.
+
+This is part of XSA-492.
+
+Fixes: fda49f9b3fbb ("Add build option to allow more hypercalls from stubdoms")
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -663,12 +663,15 @@ long arch_do_domctl(
+             break;
+         }
+ 
++        ret = xsm_ioport_mapping(XSM_DM_PRIV, d, fmp, fmp + np - 1, add);
++        if ( ret )
++            break;
++
+         hvm = &d->arch.hvm;
+         iocaps_double_lock(d, true);
+ 
+-        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) ||
+-             (ret = xsm_ioport_mapping(XSM_HOOK, d, fmp, fmp + np - 1, add)) )
+-            ret = ret ?: -EPERM;
++        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) )
++            ret = -EPERM;
+         else if ( add )
+         {
+             printk(XENLOG_G_INFO
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -436,6 +436,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+         goto domctl_out_unlock_domonly;
+     }
+ 
++    case XEN_DOMCTL_ioport_mapping:
++        ret = arch_do_domctl(op, d, u_domctl);
++        goto domctl_out_unlock_domonly;
++
+     default:
+         /* Everything else handled further down. */
+         break;
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -167,13 +167,13 @@ static XSM_INLINE int cf_check xsm_domct
+     XSM_ASSERT_ACTION(XSM_OTHER);
+     switch ( cmd )
+     {
+-    case XEN_DOMCTL_ioport_mapping:
+     case XEN_DOMCTL_bind_pt_irq:
+     case XEN_DOMCTL_unbind_pt_irq:
+         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
+ 
+     case XEN_DOMCTL_getdomaininfo:
+     case XEN_DOMCTL_get_domain_state:
++    case XEN_DOMCTL_ioport_mapping:
+     case XEN_DOMCTL_memory_mapping:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+@@ -772,7 +772,7 @@ static XSM_INLINE int cf_check xsm_iopor
+ static XSM_INLINE int cf_check xsm_ioport_mapping(
+     XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
+ {
+-    XSM_ASSERT_ACTION(XSM_HOOK);
++    XSM_ASSERT_ACTION(XSM_DM_PRIV);
+     return xsm_default_action(action, current->domain, d);
+ }
+ 
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -685,6 +685,7 @@ static int cf_check flask_domctl(struct
+     /* These have individual XSM hooks and don't make it here. */
+     case XEN_DOMCTL_getdomaininfo:
+     case XEN_DOMCTL_get_domain_state:
++    case XEN_DOMCTL_ioport_mapping:
+     case XEN_DOMCTL_memory_mapping:
+         ASSERT_UNREACHABLE();
+         return -EILSEQ;
+@@ -703,7 +704,6 @@ static int cf_check flask_domctl(struct
+     /* These have individual XSM hooks (arch/x86/domctl.c) */
+     case XEN_DOMCTL_shadow_op:
+     case XEN_DOMCTL_ioport_permission:
+-    case XEN_DOMCTL_ioport_mapping:
+     case XEN_DOMCTL_gsi_permission:
+ #endif
+ #ifdef CONFIG_HAS_PASSTHROUGH