system/xen: XSA 216-225 update.

Signed-off-by: Mario Preksavec <mario@slackware.hr>

1 files changed, 124 insertions, 0 deletions

diff --git a/system/xen/xsa/xsa222-1.patch b/system/xen/xsa/xsa222-1.patch
new file mode 100644
index 0000000000..6f1290b6a8
--- /dev/null
+++ b/system/xen/xsa/xsa222-1.patch
@@ -0,0 +1,124 @@
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Subject: xen/memory: Fix return value handing of guest_remove_page()
+
+Despite the description in mm.h, guest_remove_page() previously returned 0 for
+paging errors.
+
+Switch guest_remove_page() to having regular 0/-error semantics, and propagate
+the return values from clear_mmio_p2m_entry() and mem_sharing_unshare_page()
+to the callers (although decrease_reservation() is the only caller which
+currently cares).
+
+This is part of XSA-222.
+
+Reported-by: Julien Grall <julien.grall@arm.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+diff --git a/xen/common/memory.c b/xen/common/memory.c
+index 52879e7..a40bc1c 100644
+--- a/xen/common/memory.c
++++ b/xen/common/memory.c
+@@ -265,6 +265,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
+     p2m_type_t p2mt;
+ #endif
+     mfn_t mfn;
++    int rc;
+ 
+ #ifdef CONFIG_X86
+     mfn = get_gfn_query(d, gmfn, &p2mt);
+@@ -282,13 +283,15 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
+                 put_page(page);
+         }
+         p2m_mem_paging_drop_page(d, gmfn, p2mt);
+-        return 1;
++
++        return 0;
+     }
+     if ( p2mt == p2m_mmio_direct )
+     {
+-        clear_mmio_p2m_entry(d, gmfn, mfn, 0);
++        rc = clear_mmio_p2m_entry(d, gmfn, mfn, PAGE_ORDER_4K);
+         put_gfn(d, gmfn);
+-        return 1;
++
++        return rc;
+     }
+ #else
+     mfn = gfn_to_mfn(d, _gfn(gmfn));
+@@ -298,21 +301,25 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
+         put_gfn(d, gmfn);
+         gdprintk(XENLOG_INFO, "Domain %u page number %lx invalid\n",
+                 d->domain_id, gmfn);
+-        return 0;
++
++        return -EINVAL;
+     }
+             
+ #ifdef CONFIG_X86
+     if ( p2m_is_shared(p2mt) )
+     {
+-        /* Unshare the page, bail out on error. We unshare because 
+-         * we might be the only one using this shared page, and we
+-         * need to trigger proper cleanup. Once done, this is 
+-         * like any other page. */
+-        if ( mem_sharing_unshare_page(d, gmfn, 0) )
++        /*
++         * Unshare the page, bail out on error. We unshare because we
++         * might be the only one using this shared page, and we need to
++         * trigger proper cleanup. Once done, this is like any other page.
++         */
++        rc = mem_sharing_unshare_page(d, gmfn, 0);
++        if ( rc )
+         {
+             put_gfn(d, gmfn);
+             (void)mem_sharing_notify_enomem(d, gmfn, 0);
+-            return 0;
++
++            return rc;
+         }
+         /* Maybe the mfn changed */
+         mfn = get_gfn_query_unlocked(d, gmfn, &p2mt);
+@@ -325,7 +332,8 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
+     {
+         put_gfn(d, gmfn);
+         gdprintk(XENLOG_INFO, "Bad page free for domain %u\n", d->domain_id);
+-        return 0;
++
++        return -ENXIO;
+     }
+ 
+     if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) )
+@@ -348,7 +356,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
+     put_page(page);
+     put_gfn(d, gmfn);
+ 
+-    return 1;
++    return 0;
+ }
+ 
+ static void decrease_reservation(struct memop_args *a)
+@@ -392,7 +400,7 @@ static void decrease_reservation(struct memop_args *a)
+             continue;
+ 
+         for ( j = 0; j < (1 << a->extent_order); j++ )
+-            if ( !guest_remove_page(a->domain, gmfn + j) )
++            if ( guest_remove_page(a->domain, gmfn + j) )
+                 goto out;
+     }
+ 
+diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
+index 88de3c1..b367930 100644
+--- a/xen/include/xen/mm.h
++++ b/xen/include/xen/mm.h
+@@ -553,9 +553,8 @@ int xenmem_add_to_physmap_one(struct domain *d, unsigned int space,
+                               union xen_add_to_physmap_batch_extra extra,
+                               unsigned long idx, gfn_t gfn);
+ 
+-/* Returns 1 on success, 0 on error, negative if the ring
+- * for event propagation is full in the presence of paging */
+-int guest_remove_page(struct domain *d, unsigned long gfn);
++/* Returns 0 on success, or negative on error. */
++int guest_remove_page(struct domain *d, unsigned long gmfn);
+ 
+ #define RAM_TYPE_CONVENTIONAL 0x00000001
+ #define RAM_TYPE_RESERVED     0x00000002