deadlock potential with VT-d and legacy PCI device pass-through

[XSA-467, CVE-2025-1713]

.gitignore

@@ -6,4 +6,4 @@ lwip-1.3.0.tar.gz
 pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
-/xen-4.18.2.tar.gz
+/xen-4.18.4.tar.gz

newlib.gcc14.fixes.patch

@@ -1,388 +0,0 @@
---- xen-4.18.0/stubdom/newlib-makedoc.patch.orig	2023-11-16 21:44:21.000000000 +0000
-+++ xen-4.18.0/stubdom/newlib-makedoc.patch	2024-02-01 20:32:40.565785056 +0000
-@@ -33,3 +33,385 @@
-  #include <ctype.h>
-  
-  #define DEF_SIZE 5000
-+---
-+
-+patch makedoc.c for gcc14 build
-+
-+--- newlib-1.16.0/newlib/doc/makedoc.c.orig	2007-01-02 16:59:59.000000000 +0000
-++++ newlib-1.16.0/newlib/doc/makedoc.c	2024-02-01 20:26:32.415396758 +0000
-+@@ -63,25 +63,20 @@
-+ 
-+ 
-+ 
-+-static void DEFUN(init_string_with_size,(buffer, size),
-+-	   string_type *buffer AND
-+-	   unsigned int size )
-++static void init_string_with_size (string_type *buffer, unsigned int size)
-+ {
-+   buffer->write_idx = 0;
-+   buffer->size = size;
-+   buffer->ptr = malloc(size);
-+ }
-+ 
-+-static void DEFUN(init_string,(buffer),
-+-	   string_type *buffer)
-++static void init_string (string_type *buffer)
-+ {
-+     init_string_with_size(buffer, DEF_SIZE);
-+ 
-+ }
-+ 
-+-static int DEFUN(find, (str, what),
-+-	  string_type *str AND
-+-	  char *what)
-++static int find (string_type *str, char *what)
-+ {
-+     unsigned int i;
-+     char *p;
-+@@ -97,30 +92,24 @@
-+     
-+ }
-+ 
-+-static void DEFUN(write_buffer,(buffer),
-+-	   string_type *buffer)
-++static void write_buffer (string_type *buffer)
-+ {
-+     fwrite(buffer->ptr, buffer->write_idx, 1, stdout);
-+ }
-+ 
-+ 
-+-static void DEFUN(delete_string,(buffer),
-+-	   string_type *buffer)
-++static void delete_string (string_type *buffer)
-+ {
-+     free(buffer->ptr);
-+ }
-+ 
-+ 
-+-static char *DEFUN(addr, (buffer, idx),
-+-	    string_type *buffer AND
-+-	    unsigned int idx)
-++static char * addr (string_type *buffer, unsigned int idx)
-+ {
-+     return buffer->ptr + idx;
-+ }
-+ 
-+-static char DEFUN(at,(buffer, pos),
-+-	   string_type *buffer AND
-+-	   unsigned int pos) 
-++static char at (string_type *buffer, unsigned int pos) 
-+ {
-+     if ( pos >= buffer->write_idx) 
-+     {
-+@@ -129,9 +118,7 @@
-+     return buffer->ptr[pos];
-+ }
-+ 
-+-static void DEFUN(catchar,(buffer, ch), 
-+-	   string_type *buffer AND
-+-	   char ch)
-++static void catchar (string_type *buffer, char ch)
-+ {
-+   if (buffer->write_idx == buffer->size) 
-+   {
-+@@ -143,9 +130,7 @@
-+ }
-+ 
-+ 
-+-static void DEFUN(overwrite_string,(dst,   src),
-+-	   string_type *dst AND
-+-	   string_type *src)
-++static void overwrite_string (string_type *dst, string_type *src)
-+ {
-+     free(dst->ptr);
-+     dst->size = src->size;
-+@@ -153,9 +138,7 @@
-+     dst->ptr = src->ptr;
-+ }
-+ 
-+-static void DEFUN(catstr,(dst, src),
-+-	   string_type *dst AND
-+-	   string_type *src)
-++static void catstr ( string_type *dst, string_type *src)
-+ {
-+     unsigned int i;
-+     for (i = 0; i < src->write_idx; i++) 
-+@@ -165,9 +148,7 @@
-+ }
-+ 
-+ 
-+-static void DEFUN(cattext,(buffer, string),
-+-	   string_type *buffer AND
-+-	   char *string)
-++static void cattext (string_type *buffer, char *string)
-+ {
-+     
-+     while (*string) 
-+@@ -177,10 +158,7 @@
-+     }
-+ }
-+ 
-+-static void DEFUN(catbuf,(buffer, buf, len),
-+-	   string_type *buffer AND
-+-	   char *buf AND
-+-	   unsigned int len)
-++static void catbuf ( string_type *buffer, char *buf, unsigned int len)
-+ {
-+     
-+     while (len--) 
-+@@ -192,10 +170,7 @@
-+ 
-+ 
-+ 
-+-static unsigned int 
-+-DEFUN(skip_white_and_stars,(src, idx),
-+-      string_type *src AND
-+-      unsigned int idx)
-++static unsigned int skip_white_and_stars (string_type *src, unsigned int idx)
-+ {
-+     while (isspace(at(src,idx)) 
-+ 	   || (at(src,idx) == '*' && at(src,idx +1) !='/')) 
-+@@ -216,10 +191,23 @@
-+ stinst_type *pc;
-+ stinst_type sstack[STACK];
-+ stinst_type *ssp = &sstack[0];
-+-int istack[STACK];
-+-int *isp = &istack[0];
-+ 
-+-typedef int *word_type;
-++#if defined(__PTRDIFF_TYPE__)
-++typedef signed __PTRDIFF_TYPE__ intptr_t;
-++typedef unsigned __PTRDIFF_TYPE__ uintptr_t;
-++#else
-++/*
-++ * Fallback to hardcoded values,
-++ * should be valid on cpu's with 32bit int/32bit void*
-++ */
-++typedef signed long intptr_t;
-++typedef unsigned long uintptr_t;
-++#endif
-++
-++uintptr_t istack[STACK];
-++uintptr_t *isp = &istack[0];
-++
-++typedef uintptr_t *word_type;
-+ 
-+ 
-+ 
-+@@ -236,8 +224,7 @@
-+ typedef struct dict_struct dict_type;
-+ #define WORD(x) static void x()
-+ 
-+-static void DEFUN(exec,(word),
-+-		  dict_type *word)
-++static void exec (dict_type *word)
-+ {
-+     pc = word->code;
-+     while (*pc) 
-+@@ -267,7 +254,7 @@
-+ {
-+     isp++;
-+     pc++;
-+-    *isp = (int)(*pc);
-++    *isp = (uintptr_t)(*pc);
-+     pc++;
-+     
-+ }
-+@@ -294,10 +281,7 @@
-+    Blank lines are turned into one blank line
-+  */
-+ 
-+-static void 
-+-DEFUN(remove_noncomments,(src,dst),
-+-	   string_type *src AND
-+-	   string_type *dst)
-++static void remove_noncomments (string_type *src, string_type *dst)
-+ {
-+     unsigned int idx = 0;
-+     
-+@@ -349,8 +333,7 @@
-+ 
-+  */
-+ 
-+-static void
-+-DEFUN_VOID(exfunstuff)
-++static void exfunstuff (void)
-+ {
-+     unsigned int openp;
-+     unsigned int fname;
-+@@ -522,8 +505,7 @@
-+ }
-+ 
-+ /* Mod tos so that only lines with leading dots remain */
-+-static void
-+-DEFUN_VOID(outputdots)
-++static void (outputdots (void))
-+ {
-+     unsigned int idx = 0;
-+     string_type out;
-+@@ -772,10 +754,7 @@
-+     
-+ }
-+ /* A command is all upper case,and alone on a line */
-+-static int 
-+-DEFUN( iscommand,(ptr, idx),
-+-      string_type *ptr AND
-+-      unsigned int idx)
-++static int iscommand (string_type *ptr, unsigned int idx)
-+ {
-+     unsigned int len = 0;
-+     while (at(ptr,idx)) {
-+@@ -797,10 +776,7 @@
-+ }
-+ 
-+ 
-+-DEFUN(copy_past_newline,(ptr, idx, dst),
-+-      string_type *ptr AND
-+-      unsigned int idx AND
-+-      string_type *dst)
-++unsigned int copy_past_newline (string_type *ptr, unsigned int idx, string_type *dst)
-+ {
-+     while (at(ptr, idx) && at(ptr, idx) != '\n') 
-+     {
-+@@ -1060,10 +1036,7 @@
-+     
-+ }
-+ 
-+-char *
-+-DEFUN(nextword,(string, word),
-+-      char *string AND
-+-      char **word)
-++char * nextword (char *string, char **word)
-+ {
-+   char *word_start;
-+   int idx;
-+@@ -1138,9 +1111,7 @@
-+     
-+ }
-+ dict_type *root;
-+-dict_type *
-+-DEFUN(lookup_word,(word),
-+-      char *word)
-++dict_type * lookup_word (char *word)
-+ {
-+     dict_type *ptr = root;
-+     while (ptr) {
-+@@ -1154,7 +1125,7 @@
-+     
-+ }
-+ 
-+-static void DEFUN_VOID(perform)
-++static int perform (void)
-+ {
-+     tos = stack;
-+     
-+@@ -1192,9 +1163,7 @@
-+ 	}
-+ }
-+ 
-+-dict_type *
-+-DEFUN(newentry,(word),
-+-      char *word)
-++dict_type * newentry (char *word)
-+ {
-+     dict_type *new = (dict_type *)malloc(sizeof(dict_type));
-+     new->word = word;
-+@@ -1208,10 +1177,7 @@
-+ }
-+ 
-+ 
-+-unsigned int
-+-DEFUN(add_to_definition,(entry, word), 
-+-      dict_type *entry AND
-+-      stinst_type word)
-++unsigned int add_to_definition (dict_type *entry, stinst_type word)
-+ {
-+     if (entry->code_end == entry->code_length) 
-+     {
-+@@ -1232,9 +1198,7 @@
-+ 
-+ 
-+ void
-+-DEFUN(add_intrinsic,(name, func),
-+-      char *name AND
-+-      void (*func)())
-++add_intrinsic (char *name, void (*func)(void))
-+ {
-+     dict_type *new = newentry(name);
-+     add_to_definition(new, func);
-+@@ -1247,9 +1211,7 @@
-+ 
-+ }
-+ 
-+-void
-+-DEFUN(add_var,(name),
-+-      char *name)
-++void add_var (char *name)
-+ {
-+     dict_type *new = newentry(name);
-+     add_to_definition(new, push_number);
-+@@ -1262,8 +1224,7 @@
-+ 
-+ 
-+ void 
-+-DEFUN(compile, (string), 
-+-      char *string)
-++compile (char *string)
-+ 
-+ {
-+     int jstack[STACK];
-+@@ -1315,11 +1276,11 @@
-+ 		     /* Got a number, embedd the magic push number
-+ 			function */
-+ 		     add_to_definition(ptr, push_number);
-+-		     add_to_definition(ptr, atol(word));
-++		     add_to_definition(ptr, (stinst_type)atol(word));
-+ 		     break;
-+ 		   default:
-+ 		     add_to_definition(ptr, call);
-+-		     add_to_definition(ptr, lookup_word(word));
-++                     add_to_definition(ptr, (stinst_type)lookup_word(word));
-+ 		 }
-+ 
-+ 		string = nextword(string, &word);		     
-+@@ -1336,9 +1297,9 @@
-+ }
-+ 
-+  
-+-static void DEFUN_VOID(bang)
-++static void bang (void)
-+ {
-+-*(int *)((isp[0])) = isp[-1];
-++*(uintptr_t *)((isp[0])) = isp[-1];
-+ isp-=2;
-+ pc++;
-+ 
-+@@ -1359,9 +1320,7 @@
-+ 
-+ 
-+ 
-+-static void DEFUN(read_in, (str, file), 
-+-	   string_type *str AND
-+-		  FILE *file)
-++static void read_in (string_type *str, FILE *file)
-+ {
-+     char buff[10000];    
-+     unsigned int r;
-+@@ -1378,15 +1337,13 @@
-+ }
-+ 
-+ 
-+-static void DEFUN_VOID(usage)
-++static void usage (void)
-+ {
-+     fprintf(stderr,"usage: -[d|i|g] <file >file\n");
-+     exit(33);    
-+ }
-+ 
-+-int DEFUN(main,(ac,av),
-+-int ac AND
-+-char *av[])
-++int main (int ac, char *av[])
-+ {
-+     unsigned int i;
-+     

sources

@@ -4,4 +4,4 @@ SHA512 (newlib-1.16.0.tar.gz) = 40eb96bbc6736a16b6399e0cdb73e853d0d90b685c967e77
 SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
-SHA512 (xen-4.18.2.tar.gz) = c5feb450155883b5d2e7f43b05a64e7215b661b7d2f438d8f5a0896bd57283379ee11ca8e2e7a1d8787813cc6f1a260253fcb8688ed7d61a2bfb636db1626941
+SHA512 (xen-4.18.4.tar.gz) = b318cdcbf9b6408fb3047bfb0e8ccafd4545dab0ec9d7a14098b5853c2793b784a7ffeaa72102e6446da9c7b1ba9075260d606440ed8b7596610b505530b4b4b

xen.gcc13.fixes.patch

@@ -1,10 +0,0 @@
---- xen-4.17.0/xen/common/bunzip2.c.orig	2022-12-08 18:03:08.000000000 +0000
-+++ xen-4.17.0/xen/common/bunzip2.c	2023-01-17 21:35:39.251292015 +0000
-@@ -223,6 +223,7 @@
- 	for (j = 0; j < groupCount; j++) {
- 		unsigned char length[MAX_SYMBOLS], temp[MAX_HUFCODE_BITS+1];
- 		int	minLen,	maxLen, pp;
-+		length[0]=0;
- 		/* Read Huffman code lengths for each symbol.  They're
- 		   stored in a way similar to mtf; record a starting
- 		   value for the first symbol, and an offset from the

xen.gcc14.fixes.patch

@@ -1,24 +0,0 @@
-Work around newlib build problems with gcc14
-
---- xen-4.18.0/stubdom/Makefile.orig	2024-01-15 20:35:36.941740548 +0000
-+++ xen-4.18.0/stubdom/Makefile	2024-01-29 22:29:29.067367523 +0000
-@@ -45,6 +45,7 @@
- NEWLIB_CFLAGS+=-D_I386MACH_ALLOW_HW_INTERRUPTS
- STUBDOM_SUPPORTED=1
- endif
-+NEWLIB_CFLAGS+=-Wno-error=implicit-function-declaration
- 
- CROSS_ROOT=cross-root-$(GNU_TARGET_ARCH)
- CROSS_PREFIX=$(CURDIR)/$(CROSS_ROOT)
---- xen-4.18.0/extras/mini-os/include/posix/sys/mman.h.orig	2022-07-04 09:52:38.000000000 +0100
-+++ xen-4.18.0/extras/mini-os/include/posix/sys/mman.h	2024-02-01 23:00:19.923263409 +0000
-@@ -16,7 +16,7 @@
- 
- void *mmap(void *start, size_t length, int prot, int flags, int fd, off_t offset) asm("mmap64");
- int munmap(void *start, size_t length);
--static inline mlock(const void *addr, size_t len) { return 0; }
--static inline munlock(const void *addr, size_t len) { return 0; }
-+static inline int mlock(const void *addr, size_t len) { return 0; }
-+static inline int munlock(const void *addr, size_t len) { return 0; }
- 
- #endif /* _POSIX_SYS_MMAN_H */

xen.git-0b0c7dca70d64c35c86e5d503f67366ebe2b9138.patch

@@ -1,69 +0,0 @@
-From 0b0c7dca70d64c35c86e5d503f67366ebe2b9138 Mon Sep 17 00:00:00 2001
-From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:37:04 +0200
-Subject: [PATCH] x86/spec: fix reporting of BHB clearing usage from guest
- entry points
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-Reporting whether the BHB clearing on entry is done for the different domains
-types based on cpu_has_bhb_seq is unhelpful, as that variable signals whether
-there's a BHB clearing sequence selected, but that alone doesn't imply that
-such sequence is used from the PV and/or HVM entry points.
-
-Instead use opt_bhb_entry_{pv,hvm} which do signal whether BHB clearing is
-performed on entry from PV/HVM.
-
-Fixes: 689ad48ce9cf ('x86/spec-ctrl: Wire up the Native-BHI software sequences')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 049ab0b2c9f1f5edb54b505fef0bc575787dafe9
-master date: 2024-04-25 16:35:56 +0200
----
- xen/arch/x86/spec_ctrl.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
-index ba4349a024..8c67d6256a 100644
---- a/xen/arch/x86/spec_ctrl.c
-+++ b/xen/arch/x86/spec_ctrl.c
-@@ -634,7 +634,7 @@ static void __init print_details(enum ind_thunk thunk)
-            (boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ||
-             boot_cpu_has(X86_FEATURE_SC_RSB_HVM) ||
-             boot_cpu_has(X86_FEATURE_IBPB_ENTRY_HVM) ||
--            cpu_has_bhb_seq || amd_virt_spec_ctrl ||
-+            opt_bhb_entry_hvm || amd_virt_spec_ctrl ||
-             opt_eager_fpu || opt_verw_hvm)           ? ""               : " None",
-            boot_cpu_has(X86_FEATURE_SC_MSR_HVM)      ? " MSR_SPEC_CTRL" : "",
-            (boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ||
-@@ -643,7 +643,7 @@ static void __init print_details(enum ind_thunk thunk)
-            opt_eager_fpu                             ? " EAGER_FPU"     : "",
-            opt_verw_hvm                              ? " VERW"          : "",
-            boot_cpu_has(X86_FEATURE_IBPB_ENTRY_HVM)  ? " IBPB-entry"    : "",
--           cpu_has_bhb_seq                           ? " BHB-entry"     : "");
-+           opt_bhb_entry_hvm                         ? " BHB-entry"     : "");
- 
- #endif
- #ifdef CONFIG_PV
-@@ -651,14 +651,14 @@ static void __init print_details(enum ind_thunk thunk)
-            (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
-             boot_cpu_has(X86_FEATURE_SC_RSB_PV) ||
-             boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV) ||
--            cpu_has_bhb_seq ||
-+            opt_bhb_entry_pv ||
-             opt_eager_fpu || opt_verw_pv)            ? ""               : " None",
-            boot_cpu_has(X86_FEATURE_SC_MSR_PV)       ? " MSR_SPEC_CTRL" : "",
-            boot_cpu_has(X86_FEATURE_SC_RSB_PV)       ? " RSB"           : "",
-            opt_eager_fpu                             ? " EAGER_FPU"     : "",
-            opt_verw_pv                               ? " VERW"          : "",
-            boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV)   ? " IBPB-entry"    : "",
--           cpu_has_bhb_seq                           ? " BHB-entry"     : "");
-+           opt_bhb_entry_pv                          ? " BHB-entry"     : "");
- 
-     printk("  XPTI (64-bit PV only): Dom0 %s, DomU %s (with%s PCID)\n",
-            opt_xpti_hwdom ? "enabled" : "disabled",
--- 
-2.30.2
-

xen.git-2d38302c33b117aa9a417056db241aefc840c2f0.patch

@@ -1,32 +0,0 @@
-From 2d38302c33b117aa9a417056db241aefc840c2f0 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Tue, 9 Apr 2024 21:39:51 +0100
-Subject: [PATCH] x86/entry: Fix build with older toolchains
-
-Binutils older than 2.29 doesn't know INCSSPD.
-
-Fixes: 8e186f98ce0e ("x86: Use indirect calls in reset-stack infrastructure")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-(cherry picked from commit a9fa82500818a8d8ce5f2843f1577bd2c29d088e)
----
- xen/arch/x86/x86_64/entry.S | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
-index ad7dd3b23b..054fcb225f 100644
---- a/xen/arch/x86/x86_64/entry.S
-+++ b/xen/arch/x86/x86_64/entry.S
-@@ -643,7 +643,9 @@ ENTRY(continue_pv_domain)
-          * JMPed to.  Drop the return address.
-          */
-         add   $8, %rsp
-+#ifdef CONFIG_XEN_SHSTK
-         ALTERNATIVE "", "mov $2, %eax; incsspd %eax", X86_FEATURE_XEN_SHSTK
-+#endif
- 
-         call  check_wakeup_from_wait
- ret_from_intr:
--- 
-2.30.2
-

xen.git-8bdcb0b98b53140102031ceca0611f22190227fd.patch

@@ -1,49 +0,0 @@
-From 8bdcb0b98b53140102031ceca0611f22190227fd Mon Sep 17 00:00:00 2001
-From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:35:21 +0200
-Subject: [PATCH] altcall: fix __alt_call_maybe_initdata so it's safe for
- livepatch
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-Setting alternative call variables as __init is not safe for use with
-livepatch, as livepatches can rightfully introduce new alternative calls to
-structures marked as __alt_call_maybe_initdata (possibly just indirectly due to
-replacing existing functions that use those).  Attempting to resolve those
-alternative calls then results in page faults as the variable that holds the
-function pointer address has been freed.
-
-When livepatch is supported use the __ro_after_init attribute instead of
-__initdata for __alt_call_maybe_initdata.
-
-Fixes: f26bb285949b ('xen: Implement xen/alternative-call.h for use in common code')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: af4cd0a6a61cdb03bc1afca9478b05b0c9703599
-master date: 2024-04-11 18:51:36 +0100
----
- xen/include/xen/alternative-call.h | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/xen/include/xen/alternative-call.h b/xen/include/xen/alternative-call.h
-index 5c6b9a562b..10f7d7637e 100644
---- a/xen/include/xen/alternative-call.h
-+++ b/xen/include/xen/alternative-call.h
-@@ -50,7 +50,12 @@
- 
- #include <asm/alternative.h>
- 
--#define __alt_call_maybe_initdata __initdata
-+#ifdef CONFIG_LIVEPATCH
-+/* Must keep for livepatches to resolve alternative calls. */
-+# define __alt_call_maybe_initdata __ro_after_init
-+#else
-+# define __alt_call_maybe_initdata __initdata
-+#endif
- 
- #else
- 
--- 
-2.30.2
-

xen.git-af0e9ba44a58c87d6d135d8ffbf468b4ceac0a41.patch

@@ -1,56 +0,0 @@
-From af0e9ba44a58c87d6d135d8ffbf468b4ceac0a41 Mon Sep 17 00:00:00 2001
-From: Ross Lagerwall <ross.lagerwall@citrix.com>
-Date: Mon, 29 Apr 2024 09:36:04 +0200
-Subject: [PATCH] x86/rtc: Avoid UIP flag being set for longer than expected
-
-In a test, OVMF reported an error initializing the RTC without
-indicating the precise nature of the error. The only plausible
-explanation I can find is as follows:
-
-As part of the initialization, OVMF reads register C and then reads
-register A repatedly until the UIP flag is not set. If this takes longer
-than 100 ms, OVMF fails and reports an error. This may happen with the
-following sequence of events:
-
-At guest time=0s, rtc_init() calls check_update_timer() which schedules
-update_timer for t=(1 - 244us).
-
-At t=1s, the update_timer function happens to have been called >= 244us
-late. In the timer callback, it sets the UIP flag and schedules
-update_timer2 for t=1s.
-
-Before update_timer2 runs, the guest reads register C which calls
-check_update_timer(). check_update_timer() stops the scheduled
-update_timer2 and since the guest time is now outside of the update
-cycle, it schedules update_timer for t=(2 - 244us).
-
-The UIP flag will therefore be set for a whole second from t=1 to t=2
-while the guest repeatedly reads register A waiting for the UIP flag to
-clear. Fix it by clearing the UIP flag when scheduling update_timer.
-
-I was able to reproduce this issue with a synthetic test and this
-resolves the issue.
-
-Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 43a07069863b419433dee12c9b58c1f7ce70aa97
-master date: 2024-04-23 14:09:18 +0200
----
- xen/arch/x86/hvm/rtc.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c
-index 206b4296e9..4839374352 100644
---- a/xen/arch/x86/hvm/rtc.c
-+++ b/xen/arch/x86/hvm/rtc.c
-@@ -202,6 +202,7 @@ static void check_update_timer(RTCState *s)
-         }
-         else
-         {
-+            s->hw.cmos_data[RTC_REG_A] &= ~RTC_UIP;
-             next_update_time = (USEC_PER_SEC - guest_usec - 244) * NS_PER_USEC;
-             expire_time = NOW() + next_update_time;
-             s->next_update_time = expire_time;
--- 
-2.30.2
-

xen.git-eb7059767c82d833ebecdf8106e96482b04f3c40.patch

@@ -1,36 +0,0 @@
-From eb7059767c82d833ebecdf8106e96482b04f3c40 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Mon, 29 Apr 2024 09:36:37 +0200
-Subject: [PATCH] x86/MTRR: correct inadvertently inverted WC check
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-The ! clearly got lost by mistake.
-
-Fixes: e9e0eb30d4d6 ("x86/MTRR: avoid several indirect calls")
-Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 77e25f0e30ddd11e043e6fce84bf108ce7de5b6f
-master date: 2024-04-23 14:13:48 +0200
----
- xen/arch/x86/cpu/mtrr/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/cpu/mtrr/main.c b/xen/arch/x86/cpu/mtrr/main.c
-index 55a4da54a7..90b235f57e 100644
---- a/xen/arch/x86/cpu/mtrr/main.c
-+++ b/xen/arch/x86/cpu/mtrr/main.c
-@@ -316,7 +316,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
- 	}
- 
- 	/*  If the type is WC, check that this processor supports it  */
--	if ((type == X86_MT_WC) && mtrr_have_wrcomb()) {
-+	if ((type == X86_MT_WC) && !mtrr_have_wrcomb()) {
- 		printk(KERN_WARNING
- 		       "mtrr: your processor doesn't support write-combining\n");
- 		return -EOPNOTSUPP;
--- 
-2.30.2
-

xen.git-f0ff1d9cb96041a84a24857a6464628240deed4f.patch

@@ -1,75 +0,0 @@
-From f0ff1d9cb96041a84a24857a6464628240deed4f Mon Sep 17 00:00:00 2001
-From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:37:29 +0200
-Subject: [PATCH] x86/spec: adjust logic that elides lfence
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-It's currently too restrictive by just checking whether there's a BHB clearing
-sequence selected.  It should instead check whether BHB clearing is used on
-entry from PV or HVM specifically.
-
-Switch to use opt_bhb_entry_{pv,hvm} instead, and then remove cpu_has_bhb_seq
-since it no longer has any users.
-
-Reported-by: Jan Beulich <jbeulich@suse.com>
-Fixes: 954c983abcee ('x86/spec-ctrl: Software BHB-clearing sequences')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 656ae8f1091bcefec9c46ec3ea3ac2118742d4f6
-master date: 2024-04-25 16:37:01 +0200
----
- xen/arch/x86/include/asm/cpufeature.h | 3 ---
- xen/arch/x86/spec_ctrl.c              | 6 +++---
- 2 files changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/xen/arch/x86/include/asm/cpufeature.h b/xen/arch/x86/include/asm/cpufeature.h
-index 7a312c485e..3c57f55de0 100644
---- a/xen/arch/x86/include/asm/cpufeature.h
-+++ b/xen/arch/x86/include/asm/cpufeature.h
-@@ -228,9 +228,6 @@ static inline bool boot_cpu_has(unsigned int feat)
- #define cpu_bug_fpu_ptrs        boot_cpu_has(X86_BUG_FPU_PTRS)
- #define cpu_bug_null_seg        boot_cpu_has(X86_BUG_NULL_SEG)
- 
--#define cpu_has_bhb_seq        (boot_cpu_has(X86_SPEC_BHB_TSX) ||       \
--                                boot_cpu_has(X86_SPEC_BHB_LOOPS))
--
- enum _cache_type {
-     CACHE_TYPE_NULL = 0,
-     CACHE_TYPE_DATA = 1,
-diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
-index 8c67d6256a..12c19b7eca 100644
---- a/xen/arch/x86/spec_ctrl.c
-+++ b/xen/arch/x86/spec_ctrl.c
-@@ -2328,7 +2328,7 @@ void __init init_speculation_mitigations(void)
-          * unconditional WRMSR.  If we do have it, or we're not using any
-          * prior conditional block, then it's safe to drop the LFENCE.
-          */
--        if ( !cpu_has_bhb_seq &&
-+        if ( !opt_bhb_entry_pv &&
-              (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
-               !boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV)) )
-             setup_force_cpu_cap(X86_SPEC_NO_LFENCE_ENTRY_PV);
-@@ -2344,7 +2344,7 @@ void __init init_speculation_mitigations(void)
-          * active in the block that is skipped when interrupting guest
-          * context, then it's safe to drop the LFENCE.
-          */
--        if ( !cpu_has_bhb_seq &&
-+        if ( !opt_bhb_entry_pv &&
-              (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
-               (!boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV) &&
-                !boot_cpu_has(X86_FEATURE_SC_RSB_PV))) )
-@@ -2356,7 +2356,7 @@ void __init init_speculation_mitigations(void)
-          * A BHB sequence, if used, is the only conditional action, so if we
-          * don't have it, we don't need the safety LFENCE.
-          */
--        if ( !cpu_has_bhb_seq )
-+        if ( !opt_bhb_entry_hvm )
-             setup_force_cpu_cap(X86_SPEC_NO_LFENCE_ENTRY_VMX);
-     }
- 
--- 
-2.30.2
-

xen.hypervisor.config

@@ -97,6 +97,7 @@ CONFIG_ARCH_SUPPORTS_INT128=y
 # Debugging Options
 #
 # CONFIG_DEBUG is not set
+# CONFIG_DEBUG_INFO is not set
 # end of Debugging Options
 
 # ARM64 settings

xen.ocaml5.fixes.patch

@@ -1,32 +1,3 @@
---- xen-4.17.1/tools/ocaml/common.make.orig	2023-04-27 06:53:19.000000000 -0600
-+++ xen-4.17.1/tools/ocaml/common.make	2023-06-20 09:47:25.250969763 -0600
-@@ -11,9 +11,9 @@ OCAMLFIND ?= ocamlfind
- 
- CFLAGS += -fPIC -I$(shell ocamlc -where)
- 
--OCAMLOPTFLAG_G := $(shell $(OCAMLOPT) -h 2>&1 | sed -n 's/^  *\(-g\) .*/\1/p')
--OCAMLOPTFLAGS = $(OCAMLOPTFLAG_G) -ccopt "$(LDFLAGS)" -dtypes $(OCAMLINCLUDE) -cc $(CC) -w F -warn-error F
--OCAMLCFLAGS += -g $(OCAMLINCLUDE) -w F -warn-error F
-+OCAMLOPTFLAG_G := -g
-+OCAMLOPTFLAGS = $(OCAMLOPTFLAG_G) -ccopt "$(LDFLAGS)" -dtypes $(OCAMLINCLUDE) -cc $(CC) -w F -warn-error F -I +unix
-+OCAMLCFLAGS += -g $(OCAMLINCLUDE) -w F -warn-error F -I +unix
- 
- VERSION := 4.1
- 
---- xen-4.17.1/tools/ocaml/Makefile.rules.orig	2023-04-27 06:53:19.000000000 -0600
-+++ xen-4.17.1/tools/ocaml/Makefile.rules	2023-06-20 10:00:58.769235173 -0600
-@@ -59,9 +59,9 @@ quiet-command = $(if $(V),$1,@printf " %
- mk-caml-lib-native = $(call quiet-command, $(OCAMLOPT) $(OCAMLOPTFLAGS) -a -o $1 $2 $3,MLA,$1)
- mk-caml-lib-bytecode = $(call quiet-command, $(OCAMLC) $(OCAMLCFLAGS) -a -o $1 $2 $3,MLA,$1)
- 
--mk-caml-stubs = $(call quiet-command, $(OCAMLMKLIB) -o `basename $1 .a` $2,MKLIB,$1)
-+mk-caml-stubs = $(call quiet-command, $(OCAMLMKLIB) -g -o `basename $1 .a` $2,MKLIB,$1)
- mk-caml-lib-stubs = \
--	$(call quiet-command, $(AR) rcs $1 $2 && $(OCAMLMKLIB) -o `basename $1 .a | sed -e 's/^lib//'` $2,MKLIB,$1)
-+	$(call quiet-command, $(AR) rcs $1 $2 && $(OCAMLMKLIB) -g -o `basename $1 .a | sed -e 's/^lib//'` $2,MKLIB,$1)
- 
- # define a library target <name>.cmxa and <name>.cma
- define OCAML_LIBRARY_template
 --- xen-4.17.1/tools/ocaml/xenstored/disk.ml.orig	2023-04-27 06:53:19.000000000 -0600
 +++ xen-4.17.1/tools/ocaml/xenstored/disk.ml	2023-06-20 09:49:44.361963710 -0600
 @@ -30,7 +30,7 @@ let undec c =

xen.spec

@@ -54,8 +54,8 @@
 
 Summary: Xen is a virtual machine monitor
 Name:    xen
-Version: 4.18.2
-Release: 4%{?dist}
+Version: 4.18.4
+Release: 2%{?dist}
 License: GPLv2+ and LGPLv2+ and BSD
 URL:     http://xen.org/
 Source0: https://downloads.xenproject.org/release/xen/%{version}/xen-%{version}.tar.gz
@@ -109,18 +109,9 @@ Patch41: xen.gcc9.fixes.patch
 Patch43: xen.gcc11.fixes.patch
 Patch45: xen.gcc12.fixes.patch
 Patch46: xen.efi.build.patch
-Patch47: xen.gcc13.fixes.patch
 Patch49: xen.python3.12.patch
 Patch50: xen.ocaml5.fixes.patch
-Patch52: xen.gcc14.fixes.patch
-Patch53: newlib.gcc14.fixes.patch
-Patch54: xen.git-2d38302c33b117aa9a417056db241aefc840c2f0.patch
-Patch55: xen.git-8bdcb0b98b53140102031ceca0611f22190227fd.patch
-Patch56: xen.git-af0e9ba44a58c87d6d135d8ffbf468b4ceac0a41.patch
-Patch57: xen.git-eb7059767c82d833ebecdf8106e96482b04f3c40.patch
-Patch58: xen.git-0b0c7dca70d64c35c86e5d503f67366ebe2b9138.patch
-Patch59: xen.git-f0ff1d9cb96041a84a24857a6464628240deed4f.patch
-Patch60: xsa458.patch
+Patch51: xsa467.patch
 
 
 %if %build_qemutrad
@@ -328,20 +319,11 @@ manage Xen virtual machines.
 %patch 43 -p1
 %patch 45 -p1
 %patch 46 -p1
-%patch 47 -p1
 %patch 49 -p1
 %if "%dist" != ".fc38"
 %patch 50 -p1
 %endif
-%patch 52 -p1
-%patch 53 -p1
-%patch 54 -p1
-%patch 55 -p1
-%patch 56 -p1
-%patch 57 -p1
-%patch 58 -p1
-%patch 59 -p1
-%patch 60 -p1
+%patch 51 -p1
 
 # qemu-xen-traditional patches
 pushd tools/qemu-xen-traditional
@@ -403,6 +385,9 @@ CONFIG_EXTRA="$CONFIG_EXTRA --with-system-seabios=/usr/share/seabios/bios-256k.b
 %else
 CONFIG_EXTRA="$CONFIG_EXTRA --disable-seabios"
 %endif
+%if %with_systemd_presets
+CONFIG_EXTRA="$CONFIG_EXTRA --enable-systemd"
+%endif
 ./configure --prefix=%{_prefix} --libdir=%{_libdir} --libexecdir=%{_libexecdir} --with-system-qemu=/usr/bin/qemu-system-i386 --with-linux-backend-modules="xen-evtchn xen-gntdev xen-gntalloc xen-blkback xen-netback xen-pciback xen-scsiback xen-acpi-processor" $CONFIG_EXTRA
 unset CFLAGS CXXFLAGS FFLAGS LDFLAGS
 export LDFLAGS="$LDFLAGS_SAVE"
@@ -948,6 +933,38 @@ fi
 %endif
 
 %changelog
+* Thu Feb 27 2025 Michael Young <m.a.young@durham.ac.uk> - 4.18.4-2
+- deadlock potential with VT-d and legacy PCI device pass-through
+	[XSA-467, CVE-2025-1713]
+
+
+* Fri Dec 20 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.4-1
+- update to xen-4.18.4
+  remove patches now included or superceded upstream
+  rebase xen.ocaml5.fixes.patch
+  disable CONFIG_DEBUG_INFO in xen.hypervisor.config to fix x86_64 build
+
+* Wed Nov 13 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.3-3
+- Deadlock in x86 HVM standard VGA handling [XSA-463, CVE-2024-45818]
+	(#2333329)
+- libxl leaks data to PVH guests via ACPI tables [XSA-464, CVE-2024-45819]
+	(#2333332)
+- additional patches so above applies cleanly
+
+* Tue Sep 24 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.3-2
+- x86: Deadlock in vlapic_error() [XSA-462, CVE-2024-45817] (#2314782)
+
+* Fri Sep 13 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.3-1
+- update to xen-4.18.3
+  remove or adjust patches now included or superceded upstream
+  now need to enable systemd explicitly
+
+* Thu Aug 15 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.2-5
+- error handling in x86 IOMMU identity mapping [XSA-460, CVE-2024-31145]
+	(#2314784)
+- PCI device pass-through with shared resources [XSA-461, CVE-2024-31146]
+	(#2314783)
+
 * Tue Jul 16 2024 Michael Young <m.a.young@durham.ac.uk> - 4.18.2-4
 - double unlock in x86 guest IRQ handling [XSA-458, CVE-2024-31143]
 	(#2298690)

xsa458.patch

@@ -1,38 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: x86/IRQ: avoid double unlock in map_domain_pirq()
-
-Forever since its introduction the main loop in the function dealing
-with multi-vector MSI had error exit points ("break") with different
-properties: In one case no IRQ descriptor lock is being held.
-Nevertheless the subsequent error cleanup path assumed such a lock would
-uniformly need releasing. Identify the case by setting "desc" to NULL,
-thus allowing the unlock to be skipped as necessary.
-
-This is CVE-2024-31143 / XSA-458.
-
-Coverity ID: 1605298
-Fixes: d1b6d0a02489 ("x86: enable multi-vector MSI")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2273,6 +2273,7 @@ int map_domain_pirq(
- 
-             set_domain_irq_pirq(d, irq, info);
-             spin_unlock_irqrestore(&desc->lock, flags);
-+            desc = NULL;
- 
-             info = NULL;
-             irq = create_irq(NUMA_NO_NODE, true);
-@@ -2308,7 +2309,9 @@ int map_domain_pirq(
- 
-         if ( ret )
-         {
--            spin_unlock_irqrestore(&desc->lock, flags);
-+            if ( desc )
-+                spin_unlock_irqrestore(&desc->lock, flags);
-+
-             pci_disable_msi(msi_desc);
-             if ( nr )
-             {

xsa467.patch

@@ -0,0 +1,98 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: IOMMU/x86: the bus-to-bridge lock needs to be acquired IRQ-safe
+
+The function's use from set_msi_source_id() is guaranteed to be in an
+IRQs-off region. While the invocation of that function could be moved
+ahead in msi_msg_to_remap_entry() (doesn't need to be in the IOMMU-
+intremap-locked region), the call tree from map_domain_pirq() holds an
+IRQ descriptor lock. Hence all use sites of the lock need become IRQ-
+safe ones.
+
+In find_upstream_bridge() do a tiny bit of tidying in adjacent code:
+Change a variable's type to unsigned and merge a redundant assignment
+into another variable's initializer.
+
+This is XSA-467 / CVE-2025-1713.
+
+Fixes: 476bbccc811c ("VT-d: fix MSI source-id of interrupt remapping")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+
+--- a/xen/drivers/passthrough/pci.c
++++ b/xen/drivers/passthrough/pci.c
+@@ -354,20 +354,21 @@ static struct pci_dev *alloc_pdev(struct
+     switch ( pdev->type = pdev_type(pseg->nr, bus, devfn) )
+     {
+         unsigned int cap, sec_bus, sub_bus;
++        unsigned long flags;
+ 
+         case DEV_TYPE_PCIe2PCI_BRIDGE:
+         case DEV_TYPE_LEGACY_PCI_BRIDGE:
+             sec_bus = pci_conf_read8(pdev->sbdf, PCI_SECONDARY_BUS);
+             sub_bus = pci_conf_read8(pdev->sbdf, PCI_SUBORDINATE_BUS);
+ 
+-            spin_lock(&pseg->bus2bridge_lock);
++            spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
+             for ( ; sec_bus <= sub_bus; sec_bus++ )
+             {
+                 pseg->bus2bridge[sec_bus].map = 1;
+                 pseg->bus2bridge[sec_bus].bus = bus;
+                 pseg->bus2bridge[sec_bus].devfn = devfn;
+             }
+-            spin_unlock(&pseg->bus2bridge_lock);
++            spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
+             break;
+ 
+         case DEV_TYPE_PCIe_ENDPOINT:
+@@ -437,16 +438,17 @@ static void free_pdev(struct pci_seg *ps
+     switch ( pdev->type )
+     {
+         unsigned int sec_bus, sub_bus;
++        unsigned long flags;
+ 
+         case DEV_TYPE_PCIe2PCI_BRIDGE:
+         case DEV_TYPE_LEGACY_PCI_BRIDGE:
+             sec_bus = pci_conf_read8(pdev->sbdf, PCI_SECONDARY_BUS);
+             sub_bus = pci_conf_read8(pdev->sbdf, PCI_SUBORDINATE_BUS);
+ 
+-            spin_lock(&pseg->bus2bridge_lock);
++            spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
+             for ( ; sec_bus <= sub_bus; sec_bus++ )
+                 pseg->bus2bridge[sec_bus] = pseg->bus2bridge[pdev->bus];
+-            spin_unlock(&pseg->bus2bridge_lock);
++            spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
+             break;
+ 
+         default:
+@@ -1053,8 +1055,9 @@ enum pdev_type pdev_type(u16 seg, u8 bus
+ int find_upstream_bridge(u16 seg, u8 *bus, u8 *devfn, u8 *secbus)
+ {
+     struct pci_seg *pseg = get_pseg(seg);
+-    int ret = 0;
+-    int cnt = 0;
++    int ret = 1;
++    unsigned long flags;
++    unsigned int cnt = 0;
+ 
+     if ( *bus == 0 )
+         return 0;
+@@ -1065,8 +1068,7 @@ int find_upstream_bridge(u16 seg, u8 *bu
+     if ( !pseg->bus2bridge[*bus].map )
+         return 0;
+ 
+-    ret = 1;
+-    spin_lock(&pseg->bus2bridge_lock);
++    spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
+     while ( pseg->bus2bridge[*bus].map )
+     {
+         *secbus = *bus;
+@@ -1080,7 +1082,7 @@ int find_upstream_bridge(u16 seg, u8 *bu
+     }
+ 
+ out:
+-    spin_unlock(&pseg->bus2bridge_lock);
++    spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
+     return ret;
+ }
+