diff options
Diffstat (limited to 'system/xen/xsa/xsa222-1.patch')
| -rw-r--r-- | system/xen/xsa/xsa222-1.patch | 124 |
1 files changed, 0 insertions, 124 deletions
diff --git a/system/xen/xsa/xsa222-1.patch b/system/xen/xsa/xsa222-1.patch deleted file mode 100644 index 6f1290b6a8..0000000000 --- a/system/xen/xsa/xsa222-1.patch +++ /dev/null @@ -1,124 +0,0 @@ -From: Andrew Cooper <andrew.cooper3@citrix.com> -Subject: xen/memory: Fix return value handing of guest_remove_page() - -Despite the description in mm.h, guest_remove_page() previously returned 0 for -paging errors. - -Switch guest_remove_page() to having regular 0/-error semantics, and propagate -the return values from clear_mmio_p2m_entry() and mem_sharing_unshare_page() -to the callers (although decrease_reservation() is the only caller which -currently cares). - -This is part of XSA-222. - -Reported-by: Julien Grall <julien.grall@arm.com> -Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> - -diff --git a/xen/common/memory.c b/xen/common/memory.c -index 52879e7..a40bc1c 100644 ---- a/xen/common/memory.c -+++ b/xen/common/memory.c -@@ -265,6 +265,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - p2m_type_t p2mt; - #endif - mfn_t mfn; -+ int rc; - - #ifdef CONFIG_X86 - mfn = get_gfn_query(d, gmfn, &p2mt); -@@ -282,13 +283,15 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_page(page); - } - p2m_mem_paging_drop_page(d, gmfn, p2mt); -- return 1; -+ -+ return 0; - } - if ( p2mt == p2m_mmio_direct ) - { -- clear_mmio_p2m_entry(d, gmfn, mfn, 0); -+ rc = clear_mmio_p2m_entry(d, gmfn, mfn, PAGE_ORDER_4K); - put_gfn(d, gmfn); -- return 1; -+ -+ return rc; - } - #else - mfn = gfn_to_mfn(d, _gfn(gmfn)); -@@ -298,21 +301,25 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_gfn(d, gmfn); - gdprintk(XENLOG_INFO, "Domain %u page number %lx invalid\n", - d->domain_id, gmfn); -- return 0; -+ -+ return -EINVAL; - } - - #ifdef CONFIG_X86 - if ( p2m_is_shared(p2mt) ) - { -- /* Unshare the page, bail out on error. We unshare because -- * we might be the only one using this shared page, and we -- * need to trigger proper cleanup. Once done, this is -- * like any other page. */ -- if ( mem_sharing_unshare_page(d, gmfn, 0) ) -+ /* -+ * Unshare the page, bail out on error. We unshare because we -+ * might be the only one using this shared page, and we need to -+ * trigger proper cleanup. Once done, this is like any other page. -+ */ -+ rc = mem_sharing_unshare_page(d, gmfn, 0); -+ if ( rc ) - { - put_gfn(d, gmfn); - (void)mem_sharing_notify_enomem(d, gmfn, 0); -- return 0; -+ -+ return rc; - } - /* Maybe the mfn changed */ - mfn = get_gfn_query_unlocked(d, gmfn, &p2mt); -@@ -325,7 +332,8 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - { - put_gfn(d, gmfn); - gdprintk(XENLOG_INFO, "Bad page free for domain %u\n", d->domain_id); -- return 0; -+ -+ return -ENXIO; - } - - if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) ) -@@ -348,7 +356,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_page(page); - put_gfn(d, gmfn); - -- return 1; -+ return 0; - } - - static void decrease_reservation(struct memop_args *a) -@@ -392,7 +400,7 @@ static void decrease_reservation(struct memop_args *a) - continue; - - for ( j = 0; j < (1 << a->extent_order); j++ ) -- if ( !guest_remove_page(a->domain, gmfn + j) ) -+ if ( guest_remove_page(a->domain, gmfn + j) ) - goto out; - } - -diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h -index 88de3c1..b367930 100644 ---- a/xen/include/xen/mm.h -+++ b/xen/include/xen/mm.h -@@ -553,9 +553,8 @@ int xenmem_add_to_physmap_one(struct domain *d, unsigned int space, - union xen_add_to_physmap_batch_extra extra, - unsigned long idx, gfn_t gfn); - --/* Returns 1 on success, 0 on error, negative if the ring -- * for event propagation is full in the presence of paging */ --int guest_remove_page(struct domain *d, unsigned long gfn); -+/* Returns 0 on success, or negative on error. */ -+int guest_remove_page(struct domain *d, unsigned long gmfn); - - #define RAM_TYPE_CONVENTIONAL 0x00000001 - #define RAM_TYPE_RESERVED 0x00000002 |