diff options
Diffstat (limited to 'system')
34 files changed, 1592 insertions, 2518 deletions
diff --git a/system/xen/dom0/README.dom0 b/system/xen/dom0/README.dom0 index f23bf14c04..2521cf48bc 100644 --- a/system/xen/dom0/README.dom0 +++ b/system/xen/dom0/README.dom0 @@ -46,7 +46,7 @@ Xen EFI binary. To make things a bit easier, a copy of Xen EFI binary can be found here: - http://slackware.hr/~mario/xen/xen-4.8.1.efi.gz + http://slackware.hr/~mario/xen/xen-4.9.0.efi.gz If an automatic boot to Xen kernel is desired, the binary should be renamed and copied to the following location: /boot/efi/EFI/BOOT/bootx64.efi diff --git a/system/xen/dom0/config-4.4.38-xen.i686 b/system/xen/dom0/config-4.4.75-xen.i686 index cfbfe0d202..b29da0f7b0 100644 --- a/system/xen/dom0/config-4.4.38-xen.i686 +++ b/system/xen/dom0/config-4.4.75-xen.i686 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.4.38 Kernel Configuration +# Linux/x86 4.4.75 Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y diff --git a/system/xen/dom0/config-4.4.38-xen.x86_64 b/system/xen/dom0/config-4.4.75-xen.x86_64 index db5c9e8c51..9ed52dccfb 100644 --- a/system/xen/dom0/config-4.4.38-xen.x86_64 +++ b/system/xen/dom0/config-4.4.75-xen.x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.4.38 Kernel Configuration +# Linux/x86 4.4.75 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/system/xen/dom0/kernel-xen.sh b/system/xen/dom0/kernel-xen.sh index 27ad9bc836..d13851c97f 100644 --- a/system/xen/dom0/kernel-xen.sh +++ b/system/xen/dom0/kernel-xen.sh @@ -5,8 +5,8 @@ # Written by Chris Abela <chris.abela@maltats.com>, 20100515 # Modified by Mario Preksavec <mario@slackware.hr> -KERNEL=${KERNEL:-4.4.38} -XEN=${XEN:-4.8.1} +KERNEL=${KERNEL:-4.4.75} +XEN=${XEN:-4.9.0} BOOTLOADER=${BOOTLOADER:-lilo} ROOTMOD=${ROOTMOD:-ext4} diff --git a/system/xen/domU/domU.sh b/system/xen/domU/domU.sh index 6d61485b32..584132724e 100644 --- a/system/xen/domU/domU.sh +++ b/system/xen/domU/domU.sh @@ -7,7 +7,7 @@ set -e -KERNEL=${KERNEL:-4.4.38} +KERNEL=${KERNEL:-4.4.75} # Build an image for the root file system and another for the swap # Default values : 8GB and 500MB resepectively. diff --git a/system/xen/patches/gcc7-fix-incorrect-comparison.patch b/system/xen/patches/gcc7-fix-incorrect-comparison.patch new file mode 100644 index 0000000000..91dc6c08a6 --- /dev/null +++ b/system/xen/patches/gcc7-fix-incorrect-comparison.patch @@ -0,0 +1,40 @@ +From fe4a28ccbfd33cae9e1f56b174d46b4eb2329efd Mon Sep 17 00:00:00 2001 +From: Dandan Bi <dandan.bi@intel.com> +Date: Sat, 1 Apr 2017 10:31:14 +0800 +Subject: [PATCH] MdeModulePkg/UefiHiiLib:Fix incorrect comparison expression + +Fix the incorrect comparison between pointer and constant zero character. + +https://bugzilla.tianocore.org/show_bug.cgi?id=416 + +V2: The pointer StringPtr points to a string returned +by ExtractConfig/ExportConfig, if it is NULL, function +InternalHiiIfrValueAction will return FALSE. So in +current usage model, the StringPtr can not be NULL before +using it, so we can add ASSERT here. + +Cc: Eric Dong <eric.dong@intel.com> +Cc: Liming Gao <liming.gao@intel.com> +Contributed-under: TianoCore Contribution Agreement 1.0 +Signed-off-by: Dandan Bi <dandan.bi@intel.com> +Reviewed-by: Eric Dong <eric.dong@intel.com> +--- + MdeModulePkg/Library/UefiHiiLib/HiiLib.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c +index a2abf26980b..cd0cd35a0f3 100644 +--- a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c ++++ b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c +@@ -2201,8 +2201,9 @@ InternalHiiIfrValueAction ( + }
+
+ StringPtr = ConfigAltResp;
+-
+- while (StringPtr != L'\0') {
++ ASSERT (StringPtr != NULL);
++
++ while (*StringPtr != L'\0') {
+ //
+ // 1. Find <ConfigHdr> GUID=...&NAME=...&PATH=...
+ //
diff --git a/system/xen/patches/gcc7-minios-implement-udivmoddi4.patch b/system/xen/patches/gcc7-minios-implement-udivmoddi4.patch new file mode 100644 index 0000000000..7d6c510944 --- /dev/null +++ b/system/xen/patches/gcc7-minios-implement-udivmoddi4.patch @@ -0,0 +1,44 @@ +From d991bdbc062248221511ecb795617c36b37e1d2e Mon Sep 17 00:00:00 2001 +From: Wei Liu <wei.liu2@citrix.com> +Date: Wed, 9 Aug 2017 13:15:48 +0100 +Subject: [PATCH] lib/math.c: implement __udivmoddi4 + +Some code compiled by gcc 7 requires this. + +Signed-off-by: Wei Liu <wei.liu2@citrix.com> +Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> +--- + lib/math.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/lib/math.c b/lib/math.c +index 561393e..b98cc1d 100644 +--- a/lib/math.c ++++ b/lib/math.c +@@ -6,6 +6,7 @@ + * File: math.c + * Author: Rolf Neugebauer (neugebar@dcs.gla.ac.uk) + * Changes: ++ * Implement __udivmoddi4 (Wei Liu <wei.liu2@citrix.com>) + * + * Date: Aug 2003 + * +@@ -397,6 +398,15 @@ __umoddi3(u_quad_t a, u_quad_t b) + } + + /* ++ * Returns the quotient and places remainder in r ++ */ ++u_quad_t ++__udivmoddi4(u_quad_t a, u_quad_t b, u_quad_t *r) ++{ ++ return __qdivrem(a, b, r); ++} ++ ++/* + * From + * moddi3.c + */ +-- +2.1.4 + diff --git a/system/xen/patches/gcc7-vtpm-implicit-fallthrough.patch b/system/xen/patches/gcc7-vtpm-implicit-fallthrough.patch new file mode 100644 index 0000000000..068752d2d1 --- /dev/null +++ b/system/xen/patches/gcc7-vtpm-implicit-fallthrough.patch @@ -0,0 +1,46 @@ +GCC-7 have -Wimplicit-fallthrough enabled with -Wextra. Add appropriate +comment which both mute the warning and improve readibility. + +Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> +--- + stubdom/Makefile | 1 + + stubdom/vtpm-implicit-fallthrough.patch | 10 ++++++++++ + 2 files changed, 11 insertions(+) + create mode 100644 stubdom/vtpm-implicit-fallthrough.patch + +diff --git a/stubdom/Makefile b/stubdom/Makefile +index db01827..5055e31 100644 +--- a/stubdom/Makefile ++++ b/stubdom/Makefile +@@ -228,6 +228,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz + patch -d $@ -p1 < vtpm-deepquote.patch + patch -d $@ -p1 < vtpm-deepquote-anyloc.patch + patch -d $@ -p1 < vtpm-cmake-Wextra.patch ++ patch -d $@ -p1 < vtpm-implicit-fallthrough.patch + mkdir $@/build + cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement" + touch $@ +diff --git a/stubdom/vtpm-implicit-fallthrough.patch b/stubdom/vtpm-implicit-fallthrough.patch +new file mode 100644 +index 0000000..db97be5 +--- /dev/null ++++ b/stubdom/vtpm-implicit-fallthrough.patch +@@ -0,0 +1,10 @@ ++--- tpm_emulator-x86_64/tpm/tpm_cmd_handler.c.orig 2017-04-27 13:37:14.408000000 +0200 +++++ tpm_emulator-x86_64/tpm/tpm_cmd_handler.c 2017-04-27 13:39:53.585000000 +0200 ++@@ -3397,6 +3397,7 @@ ++ sizeof(rsp->auth2->nonceOdd.nonce)); ++ tpm_hmac_update(&hmac, (BYTE*)&rsp->auth2->continueAuthSession, 1); ++ tpm_hmac_final(&hmac, rsp->auth2->auth); +++ /* fall-thru */ ++ case TPM_TAG_RSP_AUTH1_COMMAND: ++ tpm_hmac_init(&hmac, rsp->auth1->secret, sizeof(rsp->auth1->secret)); ++ tpm_hmac_update(&hmac, rsp->auth1->digest, sizeof(rsp->auth1->digest)); +-- +2.7.4 + + +_______________________________________________ +Xen-devel mailing list +Xen-devel@lists.xen.org +https://lists.xen.org/xen-devel diff --git a/system/xen/patches/gcc7-vtpmmgr-make-inline-static.patch b/system/xen/patches/gcc7-vtpmmgr-make-inline-static.patch new file mode 100644 index 0000000000..a2c96691a9 --- /dev/null +++ b/system/xen/patches/gcc7-vtpmmgr-make-inline-static.patch @@ -0,0 +1,1161 @@ +gcc7 is more strict with functions marked as inline. They are not +automatically inlined. Instead a function call is generated, but the +actual code is not visible by the linker. + +Do a mechanical change and mark every 'inline' as 'static inline'. For +simpler review the static goes into an extra line. + +Signed-off-by: Olaf Hering <olaf@aepfle.de> +--- + stubdom/vtpmmgr/marshal.h | 76 ++++++++++++++++++++++++++++++++++++++++++ + stubdom/vtpmmgr/tcg.h | 14 ++++++++ + stubdom/vtpmmgr/tpm2_marshal.h | 58 ++++++++++++++++++++++++++++++++ + stubdom/vtpmmgr/tpmrsa.h | 1 + + 4 files changed, 149 insertions(+) + +diff --git a/stubdom/vtpmmgr/marshal.h b/stubdom/vtpmmgr/marshal.h +index d826f19d89..dce19c6439 100644 +--- a/stubdom/vtpmmgr/marshal.h ++++ b/stubdom/vtpmmgr/marshal.h +@@ -47,16 +47,19 @@ typedef enum UnpackPtr { + UNPACK_ALLOC + } UnpackPtr; + ++static + inline BYTE* pack_BYTE(BYTE* ptr, BYTE t) { + ptr[0] = t; + return ++ptr; + } + ++static + inline BYTE* unpack_BYTE(BYTE* ptr, BYTE* t) { + t[0] = ptr[0]; + return ++ptr; + } + ++static + inline int unpack3_BYTE(BYTE* ptr, UINT32* pos, UINT32 max, BYTE *t) + { + if (*pos + 1 > max) +@@ -72,18 +75,21 @@ inline int unpack3_BYTE(BYTE* ptr, UINT32* pos, UINT32 max, BYTE *t) + #define unpack3_BOOL(p, x, m, t) unpack3_BYTE(p, x, m, t) + #define sizeof_BOOL(t) 1 + ++static + inline BYTE* pack_UINT16(void* ptr, UINT16 t) { + UINT16* p = ptr; + *p = cpu_to_be16(t); + return ptr + sizeof(UINT16); + } + ++static + inline BYTE* unpack_UINT16(void* ptr, UINT16* t) { + UINT16* p = ptr; + *t = be16_to_cpu(*p); + return ptr + sizeof(UINT16); + } + ++static + inline int unpack3_UINT16(BYTE* ptr, UINT32* pos, UINT32 max, UINT16 *t) + { + if (*pos + 2 > max) +@@ -93,18 +99,21 @@ inline int unpack3_UINT16(BYTE* ptr, UINT32* pos, UINT32 max, UINT16 *t) + return 0; + } + ++static + inline BYTE* pack_UINT32(void* ptr, UINT32 t) { + UINT32* p = ptr; + *p = cpu_to_be32(t); + return ptr + sizeof(UINT32); + } + ++static + inline BYTE* unpack_UINT32(void* ptr, UINT32* t) { + UINT32* p = ptr; + *t = be32_to_cpu(*p); + return ptr + sizeof(UINT32); + } + ++static + inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) + { + if (*pos + 4 > max) +@@ -236,16 +245,19 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) + #define sizeof_TCS_KEY_HANDLE(t) sizeof_UINT32(t) + + ++static + inline BYTE* pack_BUFFER(BYTE* ptr, const BYTE* buf, UINT32 size) { + memcpy(ptr, buf, size); + return ptr + size; + } + ++static + inline BYTE* unpack_BUFFER(BYTE* ptr, BYTE* buf, UINT32 size) { + memcpy(buf, ptr, size); + return ptr + size; + } + ++static + inline int unpack3_BUFFER(BYTE* ptr, UINT32* pos, UINT32 max, BYTE* buf, UINT32 size) { + if (*pos + size > max) + return TPM_SIZE; +@@ -256,11 +268,13 @@ inline int unpack3_BUFFER(BYTE* ptr, UINT32* pos, UINT32 max, BYTE* buf, UINT32 + + #define sizeof_BUFFER(b, s) s + ++static + inline BYTE* unpack_ALIAS(BYTE* ptr, BYTE** buf, UINT32 size) { + *buf = ptr; + return ptr + size; + } + ++static + inline BYTE* unpack_ALLOC(BYTE* ptr, BYTE** buf, UINT32 size) { + if(size) { + *buf = malloc(size); +@@ -271,6 +285,7 @@ inline BYTE* unpack_ALLOC(BYTE* ptr, BYTE** buf, UINT32 size) { + return ptr + size; + } + ++static + inline BYTE* unpack_PTR(BYTE* ptr, BYTE** buf, UINT32 size, UnpackPtr alloc) { + if(alloc == UNPACK_ALLOC) { + return unpack_ALLOC(ptr, buf, size); +@@ -279,6 +294,7 @@ inline BYTE* unpack_PTR(BYTE* ptr, BYTE** buf, UINT32 size, UnpackPtr alloc) { + } + } + ++static + inline int unpack3_PTR(BYTE* ptr, UINT32* pos, UINT32 max, BYTE** buf, UINT32 size, UnpackPtr alloc) { + if (size > max || *pos + size > max) + return TPM_SIZE; +@@ -292,14 +308,17 @@ inline int unpack3_PTR(BYTE* ptr, UINT32* pos, UINT32 max, BYTE** buf, UINT32 si + } + #define unpack3_VPTR(ptr, pos, max, buf, size, alloc) unpack3_PTR(ptr, pos, max, (void*)(buf), size, alloc) + ++static + inline BYTE* pack_TPM_AUTHDATA(BYTE* ptr, const TPM_AUTHDATA* d) { + return pack_BUFFER(ptr, *d, TPM_DIGEST_SIZE); + } + ++static + inline BYTE* unpack_TPM_AUTHDATA(BYTE* ptr, TPM_AUTHDATA* d) { + return unpack_BUFFER(ptr, *d, TPM_DIGEST_SIZE); + } + ++static + inline int unpack3_TPM_AUTHDATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTHDATA* d) { + return unpack3_BUFFER(ptr, pos, len, *d, TPM_DIGEST_SIZE); + } +@@ -325,6 +344,7 @@ inline int unpack3_TPM_AUTHDATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTHDATA + #define sizeof_TPM_TAG(t) sizeof_UINT16(t) + #define sizeof_TPM_STRUCTURE_TAG(t) sizeof_UINT16(t) + ++static + inline BYTE* pack_TPM_VERSION(BYTE* ptr, const TPM_VERSION* t) { + ptr[0] = t->major; + ptr[1] = t->minor; +@@ -333,6 +353,7 @@ inline BYTE* pack_TPM_VERSION(BYTE* ptr, const TPM_VERSION* t) { + return ptr + 4; + } + ++static + inline BYTE* unpack_TPM_VERSION(BYTE* ptr, TPM_VERSION* t) { + t->major = ptr[0]; + t->minor = ptr[1]; +@@ -341,6 +362,7 @@ inline BYTE* unpack_TPM_VERSION(BYTE* ptr, TPM_VERSION* t) { + return ptr + 4; + } + ++static + inline int unpack3_TPM_VERSION(BYTE* ptr, UINT32 *pos, UINT32 max, TPM_VERSION* t) { + if (*pos + 4 > max) + return TPM_SIZE; +@@ -355,6 +377,7 @@ inline int unpack3_TPM_VERSION(BYTE* ptr, UINT32 *pos, UINT32 max, TPM_VERSION* + + #define sizeof_TPM_VERSION(x) 4 + ++static + inline BYTE* pack_TPM_CAP_VERSION_INFO(BYTE* ptr, const TPM_CAP_VERSION_INFO* v) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, v->tag); + ptr = pack_TPM_VERSION(ptr, &v->version); +@@ -366,6 +389,7 @@ inline BYTE* pack_TPM_CAP_VERSION_INFO(BYTE* ptr, const TPM_CAP_VERSION_INFO* v) + return ptr; + } + ++static + inline BYTE* unpack_TPM_CAP_VERSION_INFO(BYTE* ptr, TPM_CAP_VERSION_INFO* v, UnpackPtr alloc) { + ptr = unpack_TPM_STRUCTURE_TAG(ptr, &v->tag); + ptr = unpack_TPM_VERSION(ptr, &v->version); +@@ -377,14 +401,17 @@ inline BYTE* unpack_TPM_CAP_VERSION_INFO(BYTE* ptr, TPM_CAP_VERSION_INFO* v, Unp + return ptr; + } + ++static + inline BYTE* pack_TPM_DIGEST(BYTE* ptr, const TPM_DIGEST* d) { + return pack_BUFFER(ptr, d->digest, TPM_DIGEST_SIZE); + } + ++static + inline BYTE* unpack_TPM_DIGEST(BYTE* ptr, TPM_DIGEST* d) { + return unpack_BUFFER(ptr, d->digest, TPM_DIGEST_SIZE); + } + ++static + inline int unpack3_TPM_DIGEST(BYTE* ptr, UINT32* pos, UINT32 max, TPM_DIGEST* d) { + return unpack3_BUFFER(ptr, pos, max, d->digest, TPM_DIGEST_SIZE); + } +@@ -409,20 +436,24 @@ inline int unpack3_TPM_DIGEST(BYTE* ptr, UINT32* pos, UINT32 max, TPM_DIGEST* d) + #define pack_TPM_CHOSENID_HASH(ptr, d) pack_TPM_DIGEST(ptr, d) + #define unpack_TPM_CHOSENID_HASH(ptr, d) unpack_TPM_DIGEST(ptr, d) + ++static + inline BYTE* pack_TPM_NONCE(BYTE* ptr, const TPM_NONCE* n) { + return pack_BUFFER(ptr, n->nonce, TPM_DIGEST_SIZE); + } + ++static + inline BYTE* unpack_TPM_NONCE(BYTE* ptr, TPM_NONCE* n) { + return unpack_BUFFER(ptr, n->nonce, TPM_DIGEST_SIZE); + } + + #define sizeof_TPM_NONCE(x) TPM_DIGEST_SIZE + ++static + inline int unpack3_TPM_NONCE(BYTE* ptr, UINT32* pos, UINT32 max, TPM_NONCE* n) { + return unpack3_BUFFER(ptr, pos, max, n->nonce, TPM_DIGEST_SIZE); + } + ++static + inline BYTE* pack_TPM_SYMMETRIC_KEY_PARMS(BYTE* ptr, const TPM_SYMMETRIC_KEY_PARMS* k) { + ptr = pack_UINT32(ptr, k->keyLength); + ptr = pack_UINT32(ptr, k->blockSize); +@@ -430,6 +461,7 @@ inline BYTE* pack_TPM_SYMMETRIC_KEY_PARMS(BYTE* ptr, const TPM_SYMMETRIC_KEY_PAR + return pack_BUFFER(ptr, k->IV, k->ivSize); + } + ++static + inline BYTE* pack_TPM_SYMMETRIC_KEY(BYTE* ptr, const TPM_SYMMETRIC_KEY* k) { + ptr = pack_UINT32(ptr, k->algId); + ptr = pack_UINT16(ptr, k->encScheme); +@@ -437,6 +469,7 @@ inline BYTE* pack_TPM_SYMMETRIC_KEY(BYTE* ptr, const TPM_SYMMETRIC_KEY* k) { + return pack_BUFFER(ptr, k->data, k->size); + } + ++static + inline int unpack3_TPM_SYMMETRIC_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 max, TPM_SYMMETRIC_KEY_PARMS* k, UnpackPtr alloc) { + return unpack3_UINT32(ptr, pos, max, &k->keyLength) || + unpack3_UINT32(ptr, pos, max, &k->blockSize) || +@@ -444,10 +477,12 @@ inline int unpack3_TPM_SYMMETRIC_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 max, T + unpack3_PTR(ptr, pos, max, &k->IV, k->ivSize, alloc); + } + ++static + inline int sizeof_TPM_SYMMETRIC_KEY_PARMS(const TPM_SYMMETRIC_KEY_PARMS* k) { + return 12 + k->ivSize; + } + ++static + inline int unpack3_TPM_SYMMETRIC_KEY(BYTE* ptr, UINT32* pos, UINT32 max, TPM_SYMMETRIC_KEY* k, UnpackPtr alloc) { + return unpack3_UINT32(ptr, pos, max, &k->algId) || + unpack3_UINT16(ptr, pos, max, &k->encScheme) || +@@ -455,6 +490,7 @@ inline int unpack3_TPM_SYMMETRIC_KEY(BYTE* ptr, UINT32* pos, UINT32 max, TPM_SYM + unpack3_PTR(ptr, pos, max, &k->data, k->size, alloc); + } + ++static + inline BYTE* pack_TPM_RSA_KEY_PARMS(BYTE* ptr, const TPM_RSA_KEY_PARMS* k) { + ptr = pack_UINT32(ptr, k->keyLength); + ptr = pack_UINT32(ptr, k->numPrimes); +@@ -462,6 +498,7 @@ inline BYTE* pack_TPM_RSA_KEY_PARMS(BYTE* ptr, const TPM_RSA_KEY_PARMS* k) { + return pack_BUFFER(ptr, k->exponent, k->exponentSize); + } + ++static + inline int unpack3_TPM_RSA_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 max, TPM_RSA_KEY_PARMS* k, UnpackPtr alloc) { + return unpack3_UINT32(ptr, pos, max, &k->keyLength) || + unpack3_UINT32(ptr, pos, max, &k->numPrimes) || +@@ -469,11 +506,13 @@ inline int unpack3_TPM_RSA_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 max, TPM_RSA + unpack3_PTR(ptr, pos, max, &k->exponent, k->exponentSize, alloc); + } + ++static + inline int sizeof_TPM_RSA_KEY_PARMS(const TPM_RSA_KEY_PARMS* k) { + return 12 + k->exponentSize; + } + + ++static + inline BYTE* pack_TPM_KEY_PARMS(BYTE* ptr, const TPM_KEY_PARMS* k) { + ptr = pack_TPM_ALGORITHM_ID(ptr, k->algorithmID); + ptr = pack_TPM_ENC_SCHEME(ptr, k->encScheme); +@@ -493,6 +532,7 @@ inline BYTE* pack_TPM_KEY_PARMS(BYTE* ptr, const TPM_KEY_PARMS* k) { + return ptr; + } + ++static + inline int unpack3_TPM_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 len, TPM_KEY_PARMS* k, UnpackPtr alloc) { + int rc = unpack3_TPM_ALGORITHM_ID(ptr, pos, len, &k->algorithmID) || + unpack3_TPM_ENC_SCHEME(ptr, pos, len, &k->encScheme) || +@@ -511,6 +551,7 @@ inline int unpack3_TPM_KEY_PARMS(BYTE* ptr, UINT32* pos, UINT32 len, TPM_KEY_PAR + return TPM_FAIL; + } + ++static + inline int sizeof_TPM_KEY_PARMS(const TPM_KEY_PARMS* k) { + int rc = 0; + rc += sizeof_TPM_ALGORITHM_ID(&k->algorithmID); +@@ -532,52 +573,62 @@ inline int sizeof_TPM_KEY_PARMS(const TPM_KEY_PARMS* k) { + return rc; + } + ++static + inline BYTE* pack_TPM_STORE_PUBKEY(BYTE* ptr, const TPM_STORE_PUBKEY* k) { + ptr = pack_UINT32(ptr, k->keyLength); + ptr = pack_BUFFER(ptr, k->key, k->keyLength); + return ptr; + } + ++static + inline int unpack3_TPM_STORE_PUBKEY(BYTE* ptr, UINT32* pos, UINT32 max, TPM_STORE_PUBKEY* k, UnpackPtr alloc) { + return unpack3_UINT32(ptr, pos, max, &k->keyLength) || + unpack3_PTR(ptr, pos, max, &k->key, k->keyLength, alloc); + } + ++static + inline int sizeof_TPM_STORE_PUBKEY(const TPM_STORE_PUBKEY* k) { + return 4 + k->keyLength; + } + ++static + inline BYTE* pack_TPM_PUBKEY(BYTE* ptr, const TPM_PUBKEY* k) { + ptr = pack_TPM_KEY_PARMS(ptr, &k->algorithmParms); + return pack_TPM_STORE_PUBKEY(ptr, &k->pubKey); + } + ++static + inline int unpack3_TPM_PUBKEY(BYTE* ptr, UINT32* pos, UINT32 len, TPM_PUBKEY* k, UnpackPtr alloc) { + return unpack3_TPM_KEY_PARMS(ptr, pos, len, &k->algorithmParms, alloc) || + unpack3_TPM_STORE_PUBKEY(ptr, pos, len, &k->pubKey, alloc); + } + ++static + inline BYTE* pack_TPM_PCR_SELECTION(BYTE* ptr, const TPM_PCR_SELECTION* p) { + ptr = pack_UINT16(ptr, p->sizeOfSelect); + ptr = pack_BUFFER(ptr, p->pcrSelect, p->sizeOfSelect); + return ptr; + } + ++static + inline BYTE* unpack_TPM_PCR_SELECTION(BYTE* ptr, TPM_PCR_SELECTION* p, UnpackPtr alloc) { + ptr = unpack_UINT16(ptr, &p->sizeOfSelect); + ptr = unpack_PTR(ptr, &p->pcrSelect, p->sizeOfSelect, alloc); + return ptr; + } + ++static + inline int unpack3_TPM_PCR_SELECTION(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_SELECTION* p, UnpackPtr alloc) { + return unpack3_UINT16(ptr, pos, max, &p->sizeOfSelect) || + unpack3_PTR(ptr, pos, max, &p->pcrSelect, p->sizeOfSelect, alloc); + } + ++static + inline int sizeof_TPM_PCR_SELECTION(const TPM_PCR_SELECTION* p) { + return 2 + p->sizeOfSelect; + } + ++static + inline BYTE* pack_TPM_PCR_INFO(BYTE* ptr, const TPM_PCR_INFO* p) { + ptr = pack_TPM_PCR_SELECTION(ptr, &p->pcrSelection); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtRelease); +@@ -585,12 +636,14 @@ inline BYTE* pack_TPM_PCR_INFO(BYTE* ptr, const TPM_PCR_INFO* p) { + return ptr; + } + ++static + inline int unpack3_TPM_PCR_INFO(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_INFO* p, UnpackPtr alloc) { + return unpack3_TPM_PCR_SELECTION(ptr, pos, max, &p->pcrSelection, alloc) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtRelease) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtCreation); + } + ++static + inline int sizeof_TPM_PCR_INFO(const TPM_PCR_INFO* p) { + int rc = 0; + rc += sizeof_TPM_PCR_SELECTION(&p->pcrSelection); +@@ -599,6 +652,7 @@ inline int sizeof_TPM_PCR_INFO(const TPM_PCR_INFO* p) { + return rc; + } + ++static + inline BYTE* pack_TPM_PCR_INFO_LONG(BYTE* ptr, const TPM_PCR_INFO_LONG* p) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, p->tag); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtCreation); +@@ -610,6 +664,7 @@ inline BYTE* pack_TPM_PCR_INFO_LONG(BYTE* ptr, const TPM_PCR_INFO_LONG* p) { + return ptr; + } + ++static + inline int sizeof_TPM_PCR_INFO_LONG(const TPM_PCR_INFO_LONG* p) { + int rc = 0; + rc += sizeof_TPM_STRUCTURE_TAG(p->tag); +@@ -622,6 +677,7 @@ inline int sizeof_TPM_PCR_INFO_LONG(const TPM_PCR_INFO_LONG* p) { + return rc; + } + ++static + inline int unpack3_TPM_PCR_INFO_LONG(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_INFO_LONG* p, UnpackPtr alloc) { + return unpack3_TPM_STRUCTURE_TAG(ptr, pos, max, &p->tag) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, +@@ -637,6 +693,7 @@ inline int unpack3_TPM_PCR_INFO_LONG(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtRelease); + } + ++static + inline BYTE* pack_TPM_PCR_COMPOSITE(BYTE* ptr, const TPM_PCR_COMPOSITE* p) { + ptr = pack_TPM_PCR_SELECTION(ptr, &p->select); + ptr = pack_UINT32(ptr, p->valueSize); +@@ -644,12 +701,14 @@ inline BYTE* pack_TPM_PCR_COMPOSITE(BYTE* ptr, const TPM_PCR_COMPOSITE* p) { + return ptr; + } + ++static + inline int unpack3_TPM_PCR_COMPOSITE(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_COMPOSITE* p, UnpackPtr alloc) { + return unpack3_TPM_PCR_SELECTION(ptr, pos, max, &p->select, alloc) || + unpack3_UINT32(ptr, pos, max, &p->valueSize) || + unpack3_PTR(ptr, pos, max, (BYTE**)&p->pcrValue, p->valueSize, alloc); + } + ++static + inline BYTE* pack_TPM_KEY(BYTE* ptr, const TPM_KEY* k) { + ptr = pack_TPM_VERSION(ptr, &k->ver); + ptr = pack_TPM_KEY_USAGE(ptr, k->keyUsage); +@@ -665,6 +724,7 @@ inline BYTE* pack_TPM_KEY(BYTE* ptr, const TPM_KEY* k) { + return pack_BUFFER(ptr, k->encData, k->encDataSize); + } + ++static + inline int unpack3_TPM_KEY(BYTE* ptr, UINT32* pos, UINT32 max, TPM_KEY* k, UnpackPtr alloc) { + int rc = unpack3_TPM_VERSION(ptr, pos, max, &k->ver) || + unpack3_TPM_KEY_USAGE(ptr, pos, max, &k->keyUsage) || +@@ -682,6 +742,7 @@ inline int unpack3_TPM_KEY(BYTE* ptr, UINT32* pos, UINT32 max, TPM_KEY* k, Unpac + unpack3_PTR(ptr, pos, max, &k->encData, k->encDataSize, alloc); + } + ++static + inline int sizeof_TPM_KEY(const TPM_KEY* k) { + int rc = 0; + rc += sizeof_TPM_VERSION(&k->ver); +@@ -699,18 +760,21 @@ inline int sizeof_TPM_KEY(const TPM_KEY* k) { + return rc; + } + ++static + inline BYTE* pack_TPM_BOUND_DATA(BYTE* ptr, const TPM_BOUND_DATA* b, UINT32 payloadSize) { + ptr = pack_TPM_VERSION(ptr, &b->ver); + ptr = pack_TPM_PAYLOAD_TYPE(ptr, b->payload); + return pack_BUFFER(ptr, b->payloadData, payloadSize); + } + ++static + inline BYTE* unpack_TPM_BOUND_DATA(BYTE* ptr, TPM_BOUND_DATA* b, UINT32 payloadSize, UnpackPtr alloc) { + ptr = unpack_TPM_VERSION(ptr, &b->ver); + ptr = unpack_TPM_PAYLOAD_TYPE(ptr, &b->payload); + return unpack_PTR(ptr, &b->payloadData, payloadSize, alloc); + } + ++static + inline BYTE* pack_TPM_STORED_DATA(BYTE* ptr, const TPM_STORED_DATA* d) { + ptr = pack_TPM_VERSION(ptr, &d->ver); + ptr = pack_UINT32(ptr, d->sealInfoSize); +@@ -722,6 +786,7 @@ inline BYTE* pack_TPM_STORED_DATA(BYTE* ptr, const TPM_STORED_DATA* d) { + return ptr; + } + ++static + inline int sizeof_TPM_STORED_DATA(const TPM_STORED_DATA* d) { + int rv = sizeof_TPM_VERSION(&d->ver) + sizeof_UINT32(d->sealInfoSize); + if (d->sealInfoSize) { +@@ -732,6 +797,7 @@ inline int sizeof_TPM_STORED_DATA(const TPM_STORED_DATA* d) { + return rv; + } + ++static + inline int unpack3_TPM_STORED_DATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORED_DATA* d, UnpackPtr alloc) { + int rc = unpack3_TPM_VERSION(ptr, pos, len, &d->ver) || + unpack3_UINT32(ptr, pos, len, &d->sealInfoSize); +@@ -746,6 +812,7 @@ inline int unpack3_TPM_STORED_DATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORE + return rc; + } + ++static + inline BYTE* pack_TPM_STORED_DATA12(BYTE* ptr, const TPM_STORED_DATA12* d) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, d->tag); + ptr = pack_TPM_ENTITY_TYPE(ptr, d->et); +@@ -758,6 +825,7 @@ inline BYTE* pack_TPM_STORED_DATA12(BYTE* ptr, const TPM_STORED_DATA12* d) { + return ptr; + } + ++static + inline int sizeof_TPM_STORED_DATA12(const TPM_STORED_DATA12* d) { + int rv = sizeof_TPM_STRUCTURE_TAG(&d->ver) + + sizeof_TPM_ENTITY_TYPE(&d->et) + +@@ -770,6 +838,7 @@ inline int sizeof_TPM_STORED_DATA12(const TPM_STORED_DATA12* d) { + return rv; + } + ++static + inline int unpack3_TPM_STORED_DATA12(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORED_DATA12* d, UnpackPtr alloc) { + int rc = unpack3_TPM_STRUCTURE_TAG(ptr, pos, len, &d->tag) || + unpack3_TPM_ENTITY_TYPE(ptr, pos, len, &d->et) || +@@ -786,6 +855,7 @@ inline int unpack3_TPM_STORED_DATA12(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STO + return rc; + } + ++static + inline BYTE* pack_TPM_AUTH_SESSION(BYTE* ptr, const TPM_AUTH_SESSION* auth) { + ptr = pack_TPM_AUTH_HANDLE(ptr, auth->AuthHandle); + ptr = pack_TPM_NONCE(ptr, &auth->NonceOdd); +@@ -794,6 +864,7 @@ inline BYTE* pack_TPM_AUTH_SESSION(BYTE* ptr, const TPM_AUTH_SESSION* auth) { + return ptr; + } + ++static + inline BYTE* unpack_TPM_AUTH_SESSION(BYTE* ptr, TPM_AUTH_SESSION* auth) { + ptr = unpack_TPM_NONCE(ptr, &auth->NonceEven); + ptr = unpack_BOOL(ptr, &auth->fContinueAuthSession); +@@ -801,6 +872,7 @@ inline BYTE* unpack_TPM_AUTH_SESSION(BYTE* ptr, TPM_AUTH_SESSION* auth) { + return ptr; + } + ++static + inline int unpack3_TPM_AUTH_SESSION(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTH_SESSION* auth) { + return unpack3_TPM_NONCE(ptr, pos, len, &auth->NonceEven) || + unpack3_BOOL(ptr, pos, len, &auth->fContinueAuthSession) || +@@ -808,6 +880,7 @@ inline int unpack3_TPM_AUTH_SESSION(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTH + } + + ++static + inline int sizeof_TPM_AUTH_SESSION(const TPM_AUTH_SESSION* auth) { + int rv = 0; + rv += sizeof_TPM_AUTH_HANDLE(auth->AuthHandle); +@@ -817,6 +890,7 @@ inline int sizeof_TPM_AUTH_SESSION(const TPM_AUTH_SESSION* auth) { + return rv; + } + ++static + inline BYTE* pack_TPM_RQU_HEADER(BYTE* ptr, + TPM_TAG tag, + UINT32 size, +@@ -826,6 +900,7 @@ inline BYTE* pack_TPM_RQU_HEADER(BYTE* ptr, + return pack_UINT32(ptr, ord); + } + ++static + inline BYTE* unpack_TPM_RQU_HEADER(BYTE* ptr, + TPM_TAG* tag, + UINT32* size, +@@ -836,6 +911,7 @@ inline BYTE* unpack_TPM_RQU_HEADER(BYTE* ptr, + return ptr; + } + ++static + inline int unpack3_TPM_RQU_HEADER(BYTE* ptr, UINT32* pos, UINT32 max, + TPM_TAG* tag, UINT32* size, TPM_COMMAND_CODE* ord) { + return +diff --git a/stubdom/vtpmmgr/tcg.h b/stubdom/vtpmmgr/tcg.h +index 813ce57a2d..423131dc25 100644 +--- a/stubdom/vtpmmgr/tcg.h ++++ b/stubdom/vtpmmgr/tcg.h +@@ -461,6 +461,7 @@ typedef struct TPM_CAP_VERSION_INFO { + BYTE* vendorSpecific; + } TPM_CAP_VERSION_INFO; + ++static + inline void free_TPM_CAP_VERSION_INFO(TPM_CAP_VERSION_INFO* v) { + free(v->vendorSpecific); + v->vendorSpecific = NULL; +@@ -494,6 +495,7 @@ typedef struct TPM_SYMMETRIC_KEY { + BYTE* data; + } TPM_SYMMETRIC_KEY; + ++static + inline void free_TPM_SYMMETRIC_KEY_PARMS(TPM_SYMMETRIC_KEY_PARMS* p) { + free(p->IV); + p->IV = NULL; +@@ -510,6 +512,7 @@ typedef struct TPM_RSA_KEY_PARMS { + + #define TPM_RSA_KEY_PARMS_INIT { 0, 0, 0, NULL } + ++static + inline void free_TPM_RSA_KEY_PARMS(TPM_RSA_KEY_PARMS* p) { + free(p->exponent); + p->exponent = NULL; +@@ -528,6 +531,7 @@ typedef struct TPM_KEY_PARMS { + + #define TPM_KEY_PARMS_INIT { 0, 0, 0, 0 } + ++static + inline void free_TPM_KEY_PARMS(TPM_KEY_PARMS* p) { + if(p->parmSize) { + switch(p->algorithmID) { +@@ -550,6 +554,7 @@ typedef struct TPM_STORE_PUBKEY { + + #define TPM_STORE_PUBKEY_INIT { 0, NULL } + ++static + inline void free_TPM_STORE_PUBKEY(TPM_STORE_PUBKEY* p) { + free(p->key); + p->key = NULL; +@@ -562,6 +567,7 @@ typedef struct TPM_PUBKEY { + + #define TPM_PUBKEY_INIT { TPM_KEY_PARMS_INIT, TPM_STORE_PUBKEY_INIT } + ++static + inline void free_TPM_PUBKEY(TPM_PUBKEY* k) { + free_TPM_KEY_PARMS(&k->algorithmParms); + free_TPM_STORE_PUBKEY(&k->pubKey); +@@ -574,6 +580,7 @@ typedef struct TPM_PCR_SELECTION { + + #define TPM_PCR_SELECTION_INIT { 0, NULL } + ++static + inline void free_TPM_PCR_SELECTION(TPM_PCR_SELECTION* p) { + free(p->pcrSelect); + p->pcrSelect = NULL; +@@ -594,6 +601,7 @@ typedef struct TPM_PCR_INFO_LONG { + #define TPM_PCR_INFO_LONG_INIT { 0, 0, 0, TPM_PCR_SELECTION_INIT, \ + TPM_PCR_SELECTION_INIT } + ++static + inline void free_TPM_PCR_INFO_LONG(TPM_PCR_INFO_LONG* p) { + free_TPM_PCR_SELECTION(&p->creationPCRSelection); + free_TPM_PCR_SELECTION(&p->releasePCRSelection); +@@ -607,6 +615,7 @@ typedef struct TPM_PCR_INFO { + + #define TPM_PCR_INFO_INIT { TPM_PCR_SELECTION_INIT } + ++static + inline void free_TPM_PCR_INFO(TPM_PCR_INFO* p) { + free_TPM_PCR_SELECTION(&p->pcrSelection); + } +@@ -619,6 +628,7 @@ typedef struct TPM_PCR_COMPOSITE { + + #define TPM_PCR_COMPOSITE_INIT { TPM_PCR_SELECTION_INIT, 0, NULL } + ++static + inline void free_TPM_PCR_COMPOSITE(TPM_PCR_COMPOSITE* p) { + free_TPM_PCR_SELECTION(&p->select); + free(p->pcrValue); +@@ -643,6 +653,7 @@ typedef struct TPM_KEY { + .pubKey = TPM_STORE_PUBKEY_INIT, \ + .encDataSize = 0, .encData = NULL } + ++static + inline void free_TPM_KEY(TPM_KEY* k) { + if(k->PCRInfoSize) { + free_TPM_PCR_INFO(&k->PCRInfo); +@@ -660,6 +671,7 @@ typedef struct TPM_BOUND_DATA { + + #define TPM_BOUND_DATA_INIT { .payloadData = NULL } + ++static + inline void free_TPM_BOUND_DATA(TPM_BOUND_DATA* d) { + free(d->payloadData); + d->payloadData = NULL; +@@ -676,6 +688,7 @@ typedef struct TPM_STORED_DATA { + #define TPM_STORED_DATA_INIT { .sealInfoSize = 0, sealInfo = TPM_PCR_INFO_INIT,\ + .encDataSize = 0, .encData = NULL } + ++static + inline void free_TPM_STORED_DATA(TPM_STORED_DATA* d) { + if(d->sealInfoSize) { + free_TPM_PCR_INFO(&d->sealInfo); +@@ -696,6 +709,7 @@ typedef struct TPM_STORED_DATA12 { + #define TPM_STORED_DATA12_INIT { .sealInfoLongSize = 0, \ + sealInfoLong = TPM_PCR_INFO_INIT, .encDataSize = 0, .encData = NULL } + ++static + inline void free_TPM_STORED_DATA12(TPM_STORED_DATA12* d) { + if(d->sealInfoLongSize) { + free_TPM_PCR_INFO_LONG(&d->sealInfoLong); +diff --git a/stubdom/vtpmmgr/tpm2_marshal.h b/stubdom/vtpmmgr/tpm2_marshal.h +index aaa44645a2..ba070ad38e 100644 +--- a/stubdom/vtpmmgr/tpm2_marshal.h ++++ b/stubdom/vtpmmgr/tpm2_marshal.h +@@ -52,6 +52,7 @@ + #define pack_TPM_BUFFER(ptr, buf, size) pack_BUFFER(ptr, buf, size) + #define unpack_TPM_BUFFER(ptr, buf, size) unpack_BUFFER(ptr, buf, size) + ++static + inline BYTE* pack_BYTE_ARRAY(BYTE* ptr, const BYTE* array, UINT32 size) + { + int i; +@@ -60,21 +61,25 @@ inline BYTE* pack_BYTE_ARRAY(BYTE* ptr, const BYTE* array, UINT32 size) + return ptr; + } + ++static + inline BYTE* pack_TPMA_SESSION(BYTE* ptr, const TPMA_SESSION *attr) + { + return pack_BYTE(ptr, (BYTE)(*attr)); + } + ++static + inline BYTE* unpack_TPMA_SESSION(BYTE* ptr, TPMA_SESSION *attr) + { + return unpack_BYTE(ptr, (BYTE *)attr); + } + ++static + inline BYTE* pack_TPMI_ALG_HASH(BYTE* ptr, const TPMI_ALG_HASH *hash) + { + return pack_UINT16(ptr, *hash); + } + ++static + inline BYTE* unpack_TPMI_ALG_HASH(BYTE *ptr, TPMI_ALG_HASH *hash) + { + return unpack_UINT16(ptr, hash); +@@ -125,6 +130,7 @@ inline BYTE* unpack_TPMI_ALG_HASH(BYTE *ptr, TPMI_ALG_HASH *hash) + #define pack_TPMI_RH_LOCKOUT(ptr, l) pack_TPM2_HANDLE(ptr, l) + #define unpack_TPMI_RH_LOCKOUT(ptr, l) unpack_TPM2_HANDLE(ptr, l) + ++static + inline BYTE* pack_TPM2B_DIGEST(BYTE* ptr, const TPM2B_DIGEST *digest) + { + ptr = pack_UINT16(ptr, digest->size); +@@ -132,6 +138,7 @@ inline BYTE* pack_TPM2B_DIGEST(BYTE* ptr, const TPM2B_DIGEST *digest) + return ptr; + } + ++static + inline BYTE* unpack_TPM2B_DIGEST(BYTE* ptr, TPM2B_DIGEST *digest) + { + ptr = unpack_UINT16(ptr, &digest->size); +@@ -139,6 +146,7 @@ inline BYTE* unpack_TPM2B_DIGEST(BYTE* ptr, TPM2B_DIGEST *digest) + return ptr; + } + ++static + inline BYTE* pack_TPMT_TK_CREATION(BYTE* ptr,const TPMT_TK_CREATION *ticket ) + { + ptr = pack_TPM_ST(ptr , &ticket->tag); +@@ -147,6 +155,7 @@ inline BYTE* pack_TPMT_TK_CREATION(BYTE* ptr,const TPMT_TK_CREATION *ticket ) + return ptr; + } + ++static + inline BYTE* unpack_TPMT_TK_CREATION(BYTE* ptr, TPMT_TK_CREATION *ticket ) + { + ptr = unpack_TPM_ST(ptr, &ticket->tag); +@@ -155,6 +164,7 @@ inline BYTE* unpack_TPMT_TK_CREATION(BYTE* ptr, TPMT_TK_CREATION *ticket ) + return ptr; + } + ++static + inline BYTE* pack_TPM2B_NAME(BYTE* ptr,const TPM2B_NAME *name ) + { + ptr = pack_UINT16(ptr, name->size); +@@ -162,6 +172,7 @@ inline BYTE* pack_TPM2B_NAME(BYTE* ptr,const TPM2B_NAME *name ) + return ptr; + } + ++static + inline BYTE* unpack_TPM2B_NAME(BYTE* ptr, TPM2B_NAME *name) + { + ptr = unpack_UINT16(ptr, &name->size); +@@ -169,6 +180,7 @@ inline BYTE* unpack_TPM2B_NAME(BYTE* ptr, TPM2B_NAME *name) + return ptr; + } + ++static + inline BYTE* pack_TPM2B_NONCE(BYTE* ptr, const TPM2B_NONCE *nonce) + { + return pack_TPM2B_DIGEST(ptr, (const TPM2B_DIGEST*)nonce); +@@ -176,6 +188,7 @@ inline BYTE* pack_TPM2B_NONCE(BYTE* ptr, const TPM2B_NONCE *nonce) + + #define unpack_TPM2B_NONCE(ptr, nonce) unpack_TPM2B_DIGEST(ptr, (TPM2B_DIGEST*)nonce) + ++static + inline BYTE* pack_TPM2B_AUTH(BYTE* ptr, const TPM2B_AUTH *auth) + { + return pack_TPM2B_DIGEST(ptr, (const TPM2B_DIGEST*)auth); +@@ -183,6 +196,7 @@ inline BYTE* pack_TPM2B_AUTH(BYTE* ptr, const TPM2B_AUTH *auth) + + #define unpack_TPM2B_AUTH(ptr, auth) unpack_TPM2B_DIGEST(ptr, (TPM2B_DIGEST*)auth) + ++static + inline BYTE* pack_TPM2B_DATA(BYTE* ptr, const TPM2B_DATA *data) + { + return pack_TPM2B_DIGEST(ptr, (const TPM2B_DIGEST*)data); +@@ -190,6 +204,7 @@ inline BYTE* pack_TPM2B_DATA(BYTE* ptr, const TPM2B_DATA *data) + + #define unpack_TPM2B_DATA(ptr, data) unpack_TPM2B_DIGEST(ptr, (TPM2B_DIGEST*)data) + ++static + inline BYTE* pack_TPM2B_SENSITIVE_DATA(BYTE* ptr, const TPM2B_SENSITIVE_DATA *data) + { + return pack_TPM2B_DIGEST(ptr, (const TPM2B_DIGEST*)data); +@@ -197,6 +212,7 @@ inline BYTE* pack_TPM2B_SENSITIVE_DATA(BYTE* ptr, const TPM2B_SENSITIVE_DATA *da + + #define unpack_TPM2B_SENSITIVE_DATA(ptr, data) unpack_TPM2B_DIGEST(ptr, (TPM2B_DIGEST*)data) + ++static + inline BYTE* pack_TPM2B_PUBLIC_KEY_RSA(BYTE* ptr, const TPM2B_PUBLIC_KEY_RSA *rsa) + { + return pack_TPM2B_DIGEST(ptr, (const TPM2B_DIGEST*)rsa); +@@ -204,6 +220,7 @@ inline BYTE* pack_TPM2B_PUBLIC_KEY_RSA(BYTE* ptr, const TPM2B_PUBLIC_KEY_RSA *rs + + #define unpack_TPM2B_PUBLIC_KEY_RSA(ptr, rsa) unpack_TPM2B_DIGEST(ptr, (TPM2B_DIGEST*)rsa) + ++static + inline BYTE* pack_TPM2B_PRIVATE(BYTE* ptr, const TPM2B_PRIVATE *Private) + { + ptr = pack_UINT16(ptr, Private->size); +@@ -211,6 +228,7 @@ inline BYTE* pack_TPM2B_PRIVATE(BYTE* ptr, const TPM2B_PRIVATE *Private) + return ptr; + } + ++static + inline BYTE* unpack_TPM2B_PRIVATE(BYTE* ptr, TPM2B_PRIVATE *Private) + { + ptr = unpack_UINT16(ptr, &Private->size); +@@ -218,6 +236,7 @@ inline BYTE* unpack_TPM2B_PRIVATE(BYTE* ptr, TPM2B_PRIVATE *Private) + return ptr; + } + ++static + inline BYTE* pack_TPMS_PCR_SELECTION_ARRAY(BYTE* ptr, const TPMS_PCR_SELECTION *sel, UINT32 count) + { + int i; +@@ -229,6 +248,7 @@ inline BYTE* pack_TPMS_PCR_SELECTION_ARRAY(BYTE* ptr, const TPMS_PCR_SELECTION * + return ptr; + } + ++static + inline BYTE* unpack_TPMS_PCR_SELECTION_ARRAY(BYTE* ptr, TPMS_PCR_SELECTION *sel, UINT32 count) + { + int i; +@@ -240,6 +260,7 @@ inline BYTE* unpack_TPMS_PCR_SELECTION_ARRAY(BYTE* ptr, TPMS_PCR_SELECTION *sel, + return ptr; + } + ++static + inline BYTE* pack_TPML_PCR_SELECTION(BYTE* ptr, const TPML_PCR_SELECTION *sel) + { + ptr = pack_UINT32(ptr, sel->count); +@@ -247,6 +268,7 @@ inline BYTE* pack_TPML_PCR_SELECTION(BYTE* ptr, const TPML_PCR_SELECTION *sel) + return ptr; + } + ++static + inline BYTE* unpack_TPML_PCR_SELECTION(BYTE* ptr, TPML_PCR_SELECTION *sel) + { + ptr = unpack_UINT32(ptr, &sel->count); +@@ -254,6 +276,7 @@ inline BYTE* unpack_TPML_PCR_SELECTION(BYTE* ptr, TPML_PCR_SELECTION *sel) + return ptr; + } + ++static + inline BYTE* unpack_TPML_DIGEST(BYTE* ptr,TPML_DIGEST *digest) + { + int i; +@@ -265,6 +288,7 @@ inline BYTE* unpack_TPML_DIGEST(BYTE* ptr,TPML_DIGEST *digest) + return ptr; + } + ++static + inline BYTE* pack_TPMS_CREATION_DATA(BYTE* ptr,const TPMS_CREATION_DATA *data) + { + ptr = pack_TPML_PCR_SELECTION(ptr, &data->pcrSelect); +@@ -276,6 +300,7 @@ inline BYTE* pack_TPMS_CREATION_DATA(BYTE* ptr,const TPMS_CREATION_DATA *data) + return ptr; + } + ++static + inline BYTE* unpack_TPMS_CREATION_DATA(BYTE* ptr, TPMS_CREATION_DATA *data) + { + ptr = unpack_TPML_PCR_SELECTION(ptr, &data->pcrSelect); +@@ -288,6 +313,7 @@ inline BYTE* unpack_TPMS_CREATION_DATA(BYTE* ptr, TPMS_CREATION_DATA *data) + return ptr; + } + ++static + inline BYTE* pack_TPM2B_CREATION_DATA(BYTE* ptr, const TPM2B_CREATION_DATA *data ) + { + ptr = pack_UINT16(ptr, data->size); +@@ -295,6 +321,7 @@ inline BYTE* pack_TPM2B_CREATION_DATA(BYTE* ptr, const TPM2B_CREATION_DATA *data + return ptr; + } + ++static + inline BYTE* unpack_TPM2B_CREATION_DATA(BYTE* ptr, TPM2B_CREATION_DATA * data) + { + ptr = unpack_UINT16(ptr, &data->size); +@@ -302,6 +329,7 @@ inline BYTE* unpack_TPM2B_CREATION_DATA(BYTE* ptr, TPM2B_CREATION_DATA * data) + return ptr; + } + ++static + inline BYTE* pack_TPMS_SENSITIVE_CREATE(BYTE* ptr, const TPMS_SENSITIVE_CREATE *create) + { + ptr = pack_TPM2B_AUTH(ptr, &create->userAuth); +@@ -309,6 +337,7 @@ inline BYTE* pack_TPMS_SENSITIVE_CREATE(BYTE* ptr, const TPMS_SENSITIVE_CREATE * + return ptr; + } + ++static + inline BYTE* pack_TPM2B_SENSITIVE_CREATE(BYTE* ptr, const TPM2B_SENSITIVE_CREATE *create) + { + BYTE* sizePtr = ptr; +@@ -318,6 +347,7 @@ inline BYTE* pack_TPM2B_SENSITIVE_CREATE(BYTE* ptr, const TPM2B_SENSITIVE_CREATE + return ptr; + } + ++static + inline BYTE* pack_TPMU_SYM_MODE(BYTE* ptr, const TPMU_SYM_MODE *p, + const TPMI_ALG_SYM_OBJECT *sel) + { +@@ -336,6 +366,7 @@ inline BYTE* pack_TPMU_SYM_MODE(BYTE* ptr, const TPMU_SYM_MODE *p, + } + return ptr; + } ++static + inline BYTE* unpack_TPMU_SYM_MODE(BYTE* ptr, TPMU_SYM_MODE *p, + const TPMI_ALG_SYM_OBJECT *sel) + { +@@ -355,6 +386,7 @@ inline BYTE* unpack_TPMU_SYM_MODE(BYTE* ptr, TPMU_SYM_MODE *p, + return ptr; + } + ++static + inline BYTE* pack_TPMU_SYM_KEY_BITS(BYTE* ptr, const TPMU_SYM_KEY_BITS *p, + const TPMI_ALG_SYM_OBJECT *sel) + { +@@ -376,6 +408,7 @@ inline BYTE* pack_TPMU_SYM_KEY_BITS(BYTE* ptr, const TPMU_SYM_KEY_BITS *p, + return ptr; + } + ++static + inline BYTE* unpack_TPMU_SYM_KEY_BITS(BYTE* ptr, TPMU_SYM_KEY_BITS *p, + const TPMI_ALG_SYM_OBJECT *sel) + { +@@ -397,6 +430,7 @@ inline BYTE* unpack_TPMU_SYM_KEY_BITS(BYTE* ptr, TPMU_SYM_KEY_BITS *p, + return ptr; + } + ++static + inline BYTE* pack_TPMT_SYM_DEF_OBJECT(BYTE* ptr, const TPMT_SYM_DEF_OBJECT *p) + { + ptr = pack_TPMI_ALG_SYM_OBJECT(ptr, &p->algorithm); +@@ -405,6 +439,7 @@ inline BYTE* pack_TPMT_SYM_DEF_OBJECT(BYTE* ptr, const TPMT_SYM_DEF_OBJECT *p) + return ptr; + } + ++static + inline BYTE* unpack_TPMT_SYM_DEF_OBJECT(BYTE *ptr, TPMT_SYM_DEF_OBJECT *p) + { + ptr = unpack_TPMI_ALG_SYM_OBJECT(ptr, &p->algorithm); +@@ -416,6 +451,7 @@ inline BYTE* unpack_TPMT_SYM_DEF_OBJECT(BYTE *ptr, TPMT_SYM_DEF_OBJECT *p) + #define pack_TPMS_SCHEME_OAEP(p, t) pack_TPMI_ALG_HASH(p, &((t)->hashAlg)) + #define unpack_TPMS_SCHEME_OAEP(p, t) unpack_TPMI_ALG_HASH(p, &((t)->hashAlg)) + ++static + inline BYTE* pack_TPMU_ASYM_SCHEME(BYTE *ptr, const TPMU_ASYM_SCHEME *p, + const TPMI_ALG_RSA_SCHEME *s) + { +@@ -438,6 +474,7 @@ inline BYTE* pack_TPMU_ASYM_SCHEME(BYTE *ptr, const TPMU_ASYM_SCHEME *p, + return ptr; + } + ++static + inline BYTE* unpack_TPMU_ASYM_SCHEME(BYTE *ptr, TPMU_ASYM_SCHEME *p, + const TPMI_ALG_RSA_SCHEME *s) + { +@@ -462,6 +499,7 @@ inline BYTE* unpack_TPMU_ASYM_SCHEME(BYTE *ptr, TPMU_ASYM_SCHEME *p, + return ptr; + } + ++static + inline BYTE* pack_TPMT_RSA_SCHEME(BYTE* ptr, const TPMT_RSA_SCHEME *p) + { + ptr = pack_TPMI_ALG_RSA_SCHEME(ptr, &p->scheme); +@@ -469,6 +507,7 @@ inline BYTE* pack_TPMT_RSA_SCHEME(BYTE* ptr, const TPMT_RSA_SCHEME *p) + return ptr; + } + ++static + inline BYTE* unpack_TPMT_RSA_SCHEME(BYTE* ptr, TPMT_RSA_SCHEME *p) + { + ptr = unpack_TPMI_ALG_RSA_SCHEME(ptr, &p->scheme); +@@ -476,6 +515,7 @@ inline BYTE* unpack_TPMT_RSA_SCHEME(BYTE* ptr, TPMT_RSA_SCHEME *p) + return ptr; + } + ++static + inline BYTE* pack_TPMT_RSA_DECRYPT(BYTE* ptr, const TPMT_RSA_DECRYPT *p) + { + ptr = pack_TPMI_ALG_RSA_SCHEME(ptr, &p->scheme); +@@ -483,6 +523,7 @@ inline BYTE* pack_TPMT_RSA_DECRYPT(BYTE* ptr, const TPMT_RSA_DECRYPT *p) + return ptr; + } + ++static + inline BYTE* pack_TPMS_RSA_PARMS(BYTE* ptr, const TPMS_RSA_PARMS *p) + { + ptr = pack_TPMT_SYM_DEF_OBJECT(ptr, &p->symmetric); +@@ -492,6 +533,7 @@ inline BYTE* pack_TPMS_RSA_PARMS(BYTE* ptr, const TPMS_RSA_PARMS *p) + return ptr; + } + ++static + inline BYTE* unpack_TPMS_RSA_PARMS(BYTE *ptr, TPMS_RSA_PARMS *p) + { + ptr = unpack_TPMT_SYM_DEF_OBJECT(ptr, &p->symmetric); +@@ -501,6 +543,7 @@ inline BYTE* unpack_TPMS_RSA_PARMS(BYTE *ptr, TPMS_RSA_PARMS *p) + return ptr; + } + ++static + inline BYTE* pack_TPMU_PUBLIC_PARMS(BYTE* ptr, const TPMU_PUBLIC_PARMS *param, + const TPMI_ALG_PUBLIC *selector) + { +@@ -518,6 +561,7 @@ inline BYTE* pack_TPMU_PUBLIC_PARMS(BYTE* ptr, const TPMU_PUBLIC_PARMS *param, + return NULL; + } + ++static + inline BYTE* unpack_TPMU_PUBLIC_PARMS(BYTE* ptr, TPMU_PUBLIC_PARMS *param, + const TPMI_ALG_PUBLIC *selector) + { +@@ -535,18 +579,21 @@ inline BYTE* unpack_TPMU_PUBLIC_PARMS(BYTE* ptr, TPMU_PUBLIC_PARMS *param, + return NULL; + } + ++static + inline BYTE* pack_TPMS_ECC_POINT(BYTE* ptr, const TPMS_ECC_POINT *point) + { + assert(false); + return ptr; + } + ++static + inline BYTE* unpack_TPMS_ECC_POINT(BYTE* ptr, TPMS_ECC_POINT *point) + { + assert(false); + return ptr; + } + ++static + inline BYTE* pack_TPMU_PUBLIC_ID(BYTE* ptr, const TPMU_PUBLIC_ID *id, + const TPMI_ALG_PUBLIC *selector) + { +@@ -564,6 +611,7 @@ inline BYTE* pack_TPMU_PUBLIC_ID(BYTE* ptr, const TPMU_PUBLIC_ID *id, + return NULL; + } + ++static + inline BYTE* unpack_TPMU_PUBLIC_ID(BYTE* ptr, TPMU_PUBLIC_ID *id, TPMI_ALG_PUBLIC *selector) + { + switch (*selector) { +@@ -580,6 +628,7 @@ inline BYTE* unpack_TPMU_PUBLIC_ID(BYTE* ptr, TPMU_PUBLIC_ID *id, TPMI_ALG_PUBLI + return NULL; + } + ++static + inline BYTE* pack_TPMT_PUBLIC(BYTE* ptr, const TPMT_PUBLIC *public) + { + ptr = pack_TPMI_ALG_PUBLIC(ptr, &public->type); +@@ -591,6 +640,7 @@ inline BYTE* pack_TPMT_PUBLIC(BYTE* ptr, const TPMT_PUBLIC *public) + return ptr; + } + ++static + inline BYTE* unpack_TPMT_PUBLIC(BYTE* ptr, TPMT_PUBLIC *public) + { + ptr = unpack_TPMI_ALG_PUBLIC(ptr, &public->type); +@@ -602,6 +652,7 @@ inline BYTE* unpack_TPMT_PUBLIC(BYTE* ptr, TPMT_PUBLIC *public) + return ptr; + } + ++static + inline BYTE* pack_TPM2B_PUBLIC(BYTE* ptr, const TPM2B_PUBLIC *public) + { + BYTE *sizePtr = ptr; +@@ -611,6 +662,7 @@ inline BYTE* pack_TPM2B_PUBLIC(BYTE* ptr, const TPM2B_PUBLIC *public) + return ptr; + } + ++static + inline BYTE* unpack_TPM2B_PUBLIC(BYTE* ptr, TPM2B_PUBLIC *public) + { + ptr = unpack_UINT16(ptr, &public->size); +@@ -618,6 +670,7 @@ inline BYTE* unpack_TPM2B_PUBLIC(BYTE* ptr, TPM2B_PUBLIC *public) + return ptr; + } + ++static + inline BYTE* pack_TPMS_PCR_SELECTION(BYTE* ptr, const TPMS_PCR_SELECTION *selection) + { + ptr = pack_TPMI_ALG_HASH(ptr, &selection->hash); +@@ -626,6 +679,7 @@ inline BYTE* pack_TPMS_PCR_SELECTION(BYTE* ptr, const TPMS_PCR_SELECTION *select + return ptr; + } + ++static + inline BYTE* pack_TPMS_PCR_SELECTION_Array(BYTE* ptr, const TPMS_PCR_SELECTION *selections, + const UINT32 cnt) + { +@@ -635,6 +689,7 @@ inline BYTE* pack_TPMS_PCR_SELECTION_Array(BYTE* ptr, const TPMS_PCR_SELECTION * + return ptr; + } + ++static + inline BYTE* pack_TPM_AuthArea(BYTE* ptr, const TPM_AuthArea *auth) + { + BYTE* sizePtr = ptr; +@@ -647,6 +702,7 @@ inline BYTE* pack_TPM_AuthArea(BYTE* ptr, const TPM_AuthArea *auth) + return ptr; + } + ++static + inline BYTE* unpack_TPM_AuthArea(BYTE* ptr, TPM_AuthArea *auth) + { + ptr = unpack_UINT32(ptr, &auth->size); +@@ -657,6 +713,7 @@ inline BYTE* unpack_TPM_AuthArea(BYTE* ptr, TPM_AuthArea *auth) + return ptr; + } + ++static + inline BYTE* pack_TPM2_RSA_KEY(BYTE* ptr, const TPM2_RSA_KEY *key) + { + ptr = pack_TPM2B_PRIVATE(ptr, &key->Private); +@@ -664,6 +721,7 @@ inline BYTE* pack_TPM2_RSA_KEY(BYTE* ptr, const TPM2_RSA_KEY *key) + return ptr; + } + ++static + inline BYTE* unpack_TPM2_RSA_KEY(BYTE* ptr, TPM2_RSA_KEY *key) + { + ptr = unpack_TPM2B_PRIVATE(ptr, &key->Private); +diff --git a/stubdom/vtpmmgr/tpmrsa.h b/stubdom/vtpmmgr/tpmrsa.h +index 08213bbb7a..65fd32a45c 100644 +--- a/stubdom/vtpmmgr/tpmrsa.h ++++ b/stubdom/vtpmmgr/tpmrsa.h +@@ -62,6 +62,7 @@ TPM_RESULT tpmrsa_pub_encrypt_oaep( tpmrsa_context *ctx, + unsigned char *output ); + + /* free tpmrsa key */ ++static + inline void tpmrsa_free( tpmrsa_context *ctx ) { + mpi_free( &ctx->RN ); mpi_free( &ctx->E ); mpi_free( &ctx->N ); + } + +_______________________________________________ +Xen-devel mailing list +Xen-devel@lists.xen.org +https://lists.xen.org/xen-devel diff --git a/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-ath5k.patch b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-ath5k.patch new file mode 100644 index 0000000000..2de261aa02 --- /dev/null +++ b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-ath5k.patch @@ -0,0 +1,28 @@ +From 45f2265bfcbbf2afd7fac24372ae26e453f2b52d Mon Sep 17 00:00:00 2001 +From: Michael Brown <mcb30@ipxe.org> +Date: Wed, 22 Mar 2017 11:52:09 +0200 +Subject: [PATCH] [ath] Add missing break statements + +Signed-off-by: Michael Brown <mcb30@ipxe.org> +--- + src/drivers/net/ath/ath5k/ath5k_desc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/drivers/net/ath/ath5k/ath5k_desc.c b/src/drivers/net/ath/ath5k/ath5k_desc.c +index 30fe1c777..816d26ede 100644 +--- a/src/drivers/net/ath/ath5k/ath5k_desc.c ++++ b/src/drivers/net/ath/ath5k/ath5k_desc.c +@@ -104,10 +104,13 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc, + case AR5K_PKT_TYPE_BEACON: + case AR5K_PKT_TYPE_PROBE_RESP: + frame_type = AR5K_AR5210_TX_DESC_FRAME_TYPE_NO_DELAY; ++ break; + case AR5K_PKT_TYPE_PIFS: + frame_type = AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS; ++ break; + default: + frame_type = type /*<< 2 ?*/; ++ break; + } + + tx_ctl->tx_control_0 |= diff --git a/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-curses.patch b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-curses.patch new file mode 100644 index 0000000000..5faa5600ba --- /dev/null +++ b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough-curses.patch @@ -0,0 +1,24 @@ +From 28e26dd2503e6006fabb26f8c33050ba93a99623 Mon Sep 17 00:00:00 2001 +From: Michael Brown <mcb30@ipxe.org> +Date: Wed, 29 Mar 2017 10:35:05 +0300 +Subject: [PATCH] [mucurses] Fix erroneous __nonnull attribute + +Signed-off-by: Michael Brown <mcb30@ipxe.org> +--- + src/include/curses.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/include/curses.h b/src/include/curses.h +index 04060fe27..1f6fe029b 100644 +--- a/src/include/curses.h ++++ b/src/include/curses.h +@@ -443,7 +443,8 @@ extern int wborder ( WINDOW *, chtype, chtype, chtype, chtype, chtype, chtype, + extern int wclrtobot ( WINDOW * ) __nonnull; + extern int wclrtoeol ( WINDOW * ) __nonnull; + extern void wcursyncup ( WINDOW * ); +-extern int wcolour_set ( WINDOW *, short, void * ) __nonnull; ++extern int wcolour_set ( WINDOW *, short, void * ) ++ __attribute__ (( nonnull (1))); + #define wcolor_set(w,s,v) wcolour_set((w),(s),(v)) + extern int wdelch ( WINDOW * ) __nonnull; + extern int wdeleteln ( WINDOW * ) __nonnull; diff --git a/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough.patch b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough.patch new file mode 100644 index 0000000000..fe379699b3 --- /dev/null +++ b/system/xen/patches/patch-inbuild-ipxe-gcc7-implicit-fallthrough.patch @@ -0,0 +1,163 @@ +From 5f85cbb9ee1c00cec81a848a9e871ad5d1e7f53f Mon Sep 17 00:00:00 2001 +From: Michael Brown <mcb30@ipxe.org> +Date: Wed, 29 Mar 2017 10:36:03 +0300 +Subject: [PATCH] [build] Avoid implicit-fallthrough warnings on GCC 7 + +Reported-by: Vinson Lee <vlee@freedesktop.org> +Reported-by: Liang Yan <lyan@suse.com> +Signed-off-by: Michael Brown <mcb30@ipxe.org> +--- + src/arch/x86/image/bzimage.c | 2 ++ + src/drivers/infiniband/golan.c | 1 + + src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c | 2 ++ + src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c | 1 + + src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c | 1 + + src/drivers/net/igbvf/igbvf_vf.c | 1 + + src/drivers/net/tg3/tg3_hw.c | 12 ++++++++++++ + src/tests/setjmp_test.c | 5 +++-- + 8 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/src/arch/x86/image/bzimage.c b/src/arch/x86/image/bzimage.c +index e3c4cb83d..51498bf95 100644 +--- a/src/arch/x86/image/bzimage.c ++++ b/src/arch/x86/image/bzimage.c +@@ -282,9 +282,11 @@ static int bzimage_parse_cmdline ( struct image *image, + case 'G': + case 'g': + bzimg->mem_limit <<= 10; ++ /* Fall through */ + case 'M': + case 'm': + bzimg->mem_limit <<= 10; ++ /* Fall through */ + case 'K': + case 'k': + bzimg->mem_limit <<= 10; +diff --git a/src/drivers/infiniband/golan.c b/src/drivers/infiniband/golan.c +index 30eaabab2..61331d4c1 100755 +--- a/src/drivers/infiniband/golan.c ++++ b/src/drivers/infiniband/golan.c +@@ -1956,6 +1956,7 @@ static inline void golan_handle_port_event(struct golan *golan, struct golan_eqe + case GOLAN_PORT_CHANGE_SUBTYPE_CLIENT_REREG: + case GOLAN_PORT_CHANGE_SUBTYPE_ACTIVE: + golan_ib_update ( ibdev ); ++ /* Fall through */ + case GOLAN_PORT_CHANGE_SUBTYPE_DOWN: + case GOLAN_PORT_CHANGE_SUBTYPE_LID: + case GOLAN_PORT_CHANGE_SUBTYPE_PKEY: +diff --git a/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c +index 2b6c133cb..a98e4bb66 100644 +--- a/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c ++++ b/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c +@@ -640,12 +640,14 @@ static void ar5008_hw_init_chain_masks(struct ath_hw *ah) + case 0x5: + REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP, + AR_PHY_SWAP_ALT_CHAIN); ++ /* Fall through */ + case 0x3: + if (ah->hw_version.macVersion == AR_SREV_REVISION_5416_10) { + REG_WRITE(ah, AR_PHY_RX_CHAINMASK, 0x7); + REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, 0x7); + break; + } ++ /* Fall through */ + case 0x1: + case 0x2: + case 0x7: +diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c +index 72203ba48..65cfad597 100644 +--- a/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c ++++ b/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c +@@ -122,6 +122,7 @@ static int ar9002_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan) + aModeRefSel = 2; + if (aModeRefSel) + break; ++ /* Fall through */ + case 1: + default: + aModeRefSel = 0; +diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c +index 2244b775a..b66358b92 100644 +--- a/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c ++++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c +@@ -539,6 +539,7 @@ void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx) + case 0x5: + REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP, + AR_PHY_SWAP_ALT_CHAIN); ++ /* Fall through */ + case 0x3: + case 0x1: + case 0x2: +diff --git a/src/drivers/net/igbvf/igbvf_vf.c b/src/drivers/net/igbvf/igbvf_vf.c +index f2dac8be7..f841d5e3d 100644 +--- a/src/drivers/net/igbvf/igbvf_vf.c ++++ b/src/drivers/net/igbvf/igbvf_vf.c +@@ -357,6 +357,7 @@ s32 igbvf_promisc_set_vf(struct e1000_hw *hw, enum e1000_promisc_type type) + break; + case e1000_promisc_enabled: + msgbuf |= E1000_VF_SET_PROMISC_MULTICAST; ++ /* Fall through */ + case e1000_promisc_unicast: + msgbuf |= E1000_VF_SET_PROMISC_UNICAST; + case e1000_promisc_disabled: +diff --git a/src/drivers/net/tg3/tg3_hw.c b/src/drivers/net/tg3/tg3_hw.c +index 50353cf36..798f8519f 100644 +--- a/src/drivers/net/tg3/tg3_hw.c ++++ b/src/drivers/net/tg3/tg3_hw.c +@@ -2518,28 +2518,40 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy) + switch (limit) { + case 16: + tw32(MAC_RCV_RULE_15, 0); tw32(MAC_RCV_VALUE_15, 0); ++ /* Fall through */ + case 15: + tw32(MAC_RCV_RULE_14, 0); tw32(MAC_RCV_VALUE_14, 0); ++ /* Fall through */ + case 14: + tw32(MAC_RCV_RULE_13, 0); tw32(MAC_RCV_VALUE_13, 0); ++ /* Fall through */ + case 13: + tw32(MAC_RCV_RULE_12, 0); tw32(MAC_RCV_VALUE_12, 0); ++ /* Fall through */ + case 12: + tw32(MAC_RCV_RULE_11, 0); tw32(MAC_RCV_VALUE_11, 0); ++ /* Fall through */ + case 11: + tw32(MAC_RCV_RULE_10, 0); tw32(MAC_RCV_VALUE_10, 0); ++ /* Fall through */ + case 10: + tw32(MAC_RCV_RULE_9, 0); tw32(MAC_RCV_VALUE_9, 0); ++ /* Fall through */ + case 9: + tw32(MAC_RCV_RULE_8, 0); tw32(MAC_RCV_VALUE_8, 0); ++ /* Fall through */ + case 8: + tw32(MAC_RCV_RULE_7, 0); tw32(MAC_RCV_VALUE_7, 0); ++ /* Fall through */ + case 7: + tw32(MAC_RCV_RULE_6, 0); tw32(MAC_RCV_VALUE_6, 0); ++ /* Fall through */ + case 6: + tw32(MAC_RCV_RULE_5, 0); tw32(MAC_RCV_VALUE_5, 0); ++ /* Fall through */ + case 5: + tw32(MAC_RCV_RULE_4, 0); tw32(MAC_RCV_VALUE_4, 0); ++ /* Fall through */ + case 4: + /* tw32(MAC_RCV_RULE_3, 0); tw32(MAC_RCV_VALUE_3, 0); */ + case 3: +diff --git a/src/tests/setjmp_test.c b/src/tests/setjmp_test.c +index 50ad13f3c..deafcee09 100644 +--- a/src/tests/setjmp_test.c ++++ b/src/tests/setjmp_test.c +@@ -111,8 +111,9 @@ static void setjmp_return_ok ( struct setjmp_test *test, int value ) { + * @v file Test code file + * @v line Test code line + */ +-static void longjmp_okx ( struct setjmp_test *test, int value, +- const char *file, unsigned int line ) { ++static void __attribute__ (( noreturn )) ++longjmp_okx ( struct setjmp_test *test, int value, ++ const char *file, unsigned int line ) { + + /* Record expected value. A zero passed to longjmp() should + * result in setjmp() returning a value of one. diff --git a/system/xen/patches/patch-ipxe-patches-series.patch b/system/xen/patches/patch-ipxe-patches-series.patch new file mode 100644 index 0000000000..30e9164177 --- /dev/null +++ b/system/xen/patches/patch-ipxe-patches-series.patch @@ -0,0 +1,18 @@ +Subject: [PATCH] Fix gcc7 warn + +--- + tools/firmware/etherboot/patches/series | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/firmware/etherboot/patches/series b/tools/firmware/etherboot/patches/series +index 86cb300..780c6c6 100644 +--- a/tools/firmware/etherboot/patches/series ++++ b/tools/firmware/etherboot/patches/series +@@ -1 +1,4 @@ + boot_prompt_option.patch ++patch-inbuild-ipxe-gcc7-implicit-fallthrough.patch ++patch-inbuild-ipxe-gcc7-implicit-fallthrough-ath5k.patch ++patch-inbuild-ipxe-gcc7-implicit-fallthrough-curses.patch +-- +2.13.0 + diff --git a/system/xen/patches/stubdom_zlib_disable_man_install.diff b/system/xen/patches/stubdom_zlib_disable_man_install.diff new file mode 100644 index 0000000000..e59d377005 --- /dev/null +++ b/system/xen/patches/stubdom_zlib_disable_man_install.diff @@ -0,0 +1,32 @@ +--- xen-4.9.0/stubdom/Makefile.orig 2017-06-27 20:13:19.000000000 +0200 ++++ xen-4.9.0/stubdom/Makefile 2017-08-08 19:03:03.968141229 +0200 +@@ -117,6 +117,7 @@ + cross-zlib: $(ZLIB_STAMPFILE) + $(ZLIB_STAMPFILE): zlib-$(XEN_TARGET_ARCH) $(NEWLIB_STAMPFILE) + ( cd $< && \ ++ patch -p1 < ../zlib_disable_man_install.diff && \ + CFLAGS="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" CC=$(CC) ./configure --prefix=$(CROSS_PREFIX)/$(GNU_TARGET_ARCH)-xen-elf && \ + $(MAKE) DESTDIR= libz.a && \ + $(MAKE) DESTDIR= install ) +--- xen-4.9.0/stubdom/zlib_disable_man_install.diff.orig 1970-01-01 01:00:00.000000000 +0100 ++++ xen-4.9.0/stubdom/zlib_disable_man_install.diff 2017-08-08 18:57:11.541178819 +0200 +@@ -0,0 +1,19 @@ ++--- zlib-1.2.3/Makefile.in.orig 2005-07-18 04:25:21.000000000 +0200 +++++ zlib-1.2.3/Makefile.in 2017-08-08 18:56:06.611161407 +0200 ++@@ -93,7 +93,6 @@ ++ -@if [ ! -d $(exec_prefix) ]; then mkdir -p $(exec_prefix); fi ++ -@if [ ! -d $(includedir) ]; then mkdir -p $(includedir); fi ++ -@if [ ! -d $(libdir) ]; then mkdir -p $(libdir); fi ++- -@if [ ! -d $(man3dir) ]; then mkdir -p $(man3dir); fi ++ cp zlib.h zconf.h $(includedir) ++ chmod 644 $(includedir)/zlib.h $(includedir)/zconf.h ++ cp $(LIBS) $(libdir) ++@@ -105,8 +104,6 @@ ++ ln -s $(SHAREDLIBV) $(SHAREDLIBM); \ ++ (ldconfig || true) >/dev/null 2>&1; \ ++ fi ++- cp zlib.3 $(man3dir) ++- chmod 644 $(man3dir)/zlib.3 ++ # The ranlib in install is needed on NeXTSTEP which checks file times ++ # ldconfig is for Linux ++ diff --git a/system/xen/xen.SlackBuild b/system/xen/xen.SlackBuild index 7421c54c05..54e278aad4 100644 --- a/system/xen/xen.SlackBuild +++ b/system/xen/xen.SlackBuild @@ -23,12 +23,12 @@ # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. PRGNAM=xen -VERSION=${VERSION:-4.8.1} -BUILD=${BUILD:-2} +VERSION=${VERSION:-4.9.0} +BUILD=${BUILD:-1} TAG=${TAG:-_SBo} SEABIOS=${SEABIOS:-1.10.0} -OVMF=${OVMF:-20160905_bc54e50} +OVMF=${OVMF:-20170321_5920a9d} IPXE=${IPXE:-827dd1bfee67daa683935ce65316f7e0f057fe1c} if [ -z "$ARCH" ]; then @@ -158,6 +158,25 @@ cp $CWD/ipxe-git-$IPXE.tar.gz tools/firmware/etherboot/_ipxe.tar.gz cp $CWD/{lwip,zlib,newlib,pciutils,grub,gmp,tpm_emulator}-*.tar.?z* \ $CWD/polarssl-*.tgz stubdom +# Prevent leaks during the build +patch -p1 <$CWD/patches/stubdom_zlib_disable_man_install.diff + +# GCC7 support with help from Mark Pryor (PryMar56) and ArchLinux folks +if [ $(gcc -dumpfullversion | cut -d. -f1) -eq 7 ]; then + # OVMF + patch -d tools/firmware/ovmf-dir \ + -p1 <$CWD/patches/gcc7-fix-incorrect-comparison.patch + # vTPM + patch -p1 <$CWD/patches/gcc7-vtpmmgr-make-inline-static.patch + patch -p1 <$CWD/patches/gcc7-vtpm-implicit-fallthrough.patch + # Mini-OS + patch -d extras/mini-os \ + -p1 <$CWD/patches/gcc7-minios-implement-udivmoddi4.patch + # IPXE + patch -p1 <$CWD/patches/patch-ipxe-patches-series.patch + cp $CWD/patches/patch-inbuild-ipxe*.patch tools/firmware/etherboot/patches/ +fi + CFLAGS="$SLKCFLAGS" \ CXXFLAGS="$SLKCFLAGS" \ ./configure \ @@ -214,6 +233,9 @@ rmdir $PKG/etc/rc.d/init.d/ # Append .new to config files for i in $PKG/etc/{default/*,xen/*.conf} ; do mv $i $i.new ; done +# Remove some executable flags +chmod -x $PKG/usr/libexec/xen/boot/*.gz 2>/dev/null || true + find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \ | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true diff --git a/system/xen/xen.info b/system/xen/xen.info index fff59055e6..946878c42b 100644 --- a/system/xen/xen.info +++ b/system/xen/xen.info @@ -1,7 +1,7 @@ PRGNAM="xen" -VERSION="4.8.1" +VERSION="4.9.0" HOMEPAGE="http://www.xenproject.org/" -DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.8.1.tar.gz \ +DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.9.0.tar.gz \ http://mirror.slackware.hr/sources/xen-extfiles/ipxe-git-827dd1bfee67daa683935ce65316f7e0f057fe1c.tar.gz \ http://mirror.slackware.hr/sources/xen-extfiles/lwip-1.3.0.tar.gz \ http://mirror.slackware.hr/sources/xen-extfiles/zlib-1.2.3.tar.gz \ @@ -12,8 +12,8 @@ DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.8.1.tar.gz \ http://mirror.slackware.hr/sources/xen-extfiles/gmp-4.3.2.tar.bz2 \ http://mirror.slackware.hr/sources/xen-extfiles/tpm_emulator-0.7.4.tar.gz \ http://mirror.slackware.hr/sources/xen-seabios/seabios-1.10.0.tar.gz \ - http://mirror.slackware.hr/sources/xen-ovmf/xen-ovmf-20160905_bc54e50.tar.bz2" -MD5SUM="2ef8a991752bf71614651bf2ab0df390 \ + http://mirror.slackware.hr/sources/xen-ovmf/xen-ovmf-20170321_5920a9d.tar.bz2" +MD5SUM="f0a753637630f982dfbdb64121fd71e1 \ 71c69b5e1db9e01d5f246226eca03c22 \ 36cc57650cffda9a0269493be2a169bb \ debc62758716a169df9f62e6ab2bc634 \ @@ -24,7 +24,7 @@ MD5SUM="2ef8a991752bf71614651bf2ab0df390 \ dd60683d7057917e34630b4a787932e8 \ e26becb8a6a2b6695f6b3e8097593db8 \ 633ffc9df0295eeeb4182444eb0300ee \ - 87ba85cfec3993e4ee566dc58724d8a6" + 8caf4ea54fcc035d604f35556066e312" DOWNLOAD_x86_64="" MD5SUM_x86_64="" REQUIRES="acpica yajl" diff --git a/system/xen/xsa/xsa213-4.8.patch b/system/xen/xsa/xsa213-4.8.patch deleted file mode 100644 index 2f9fa6ab11..0000000000 --- a/system/xen/xsa/xsa213-4.8.patch +++ /dev/null @@ -1,177 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: multicall: deal with early exit conditions - -In particular changes to guest privilege level require the multicall -sequence to be aborted, as hypercalls are permitted from kernel mode -only. While likely not very useful in a multicall, also properly handle -the return value in the HYPERVISOR_iret case (which should be the guest -specified value). - -This is XSA-213. - -Reported-by: Jann Horn <jannh@google.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> -Acked-by: Julien Grall <julien.grall@arm.com> - ---- a/xen/arch/arm/traps.c -+++ b/xen/arch/arm/traps.c -@@ -1550,7 +1550,7 @@ static bool_t check_multicall_32bit_clea - return true; - } - --void arch_do_multicall_call(struct mc_state *state) -+enum mc_disposition arch_do_multicall_call(struct mc_state *state) - { - struct multicall_entry *multi = &state->call; - arm_hypercall_fn_t call = NULL; -@@ -1558,23 +1558,26 @@ void arch_do_multicall_call(struct mc_st - if ( multi->op >= ARRAY_SIZE(arm_hypercall_table) ) - { - multi->result = -ENOSYS; -- return; -+ return mc_continue; - } - - call = arm_hypercall_table[multi->op].fn; - if ( call == NULL ) - { - multi->result = -ENOSYS; -- return; -+ return mc_continue; - } - - if ( is_32bit_domain(current->domain) && - !check_multicall_32bit_clean(multi) ) -- return; -+ return mc_continue; - - multi->result = call(multi->args[0], multi->args[1], - multi->args[2], multi->args[3], - multi->args[4]); -+ -+ return likely(!psr_mode_is_user(guest_cpu_user_regs())) -+ ? mc_continue : mc_preempt; - } - - /* ---- a/xen/arch/x86/hypercall.c -+++ b/xen/arch/x86/hypercall.c -@@ -255,15 +255,19 @@ void pv_hypercall(struct cpu_user_regs * - perfc_incr(hypercalls); - } - --void arch_do_multicall_call(struct mc_state *state) -+enum mc_disposition arch_do_multicall_call(struct mc_state *state) - { -- if ( !is_pv_32bit_vcpu(current) ) -+ struct vcpu *curr = current; -+ unsigned long op; -+ -+ if ( !is_pv_32bit_vcpu(curr) ) - { - struct multicall_entry *call = &state->call; - -- if ( (call->op < ARRAY_SIZE(pv_hypercall_table)) && -- pv_hypercall_table[call->op].native ) -- call->result = pv_hypercall_table[call->op].native( -+ op = call->op; -+ if ( (op < ARRAY_SIZE(pv_hypercall_table)) && -+ pv_hypercall_table[op].native ) -+ call->result = pv_hypercall_table[op].native( - call->args[0], call->args[1], call->args[2], - call->args[3], call->args[4], call->args[5]); - else -@@ -274,15 +278,21 @@ void arch_do_multicall_call(struct mc_st - { - struct compat_multicall_entry *call = &state->compat_call; - -- if ( (call->op < ARRAY_SIZE(pv_hypercall_table)) && -- pv_hypercall_table[call->op].compat ) -- call->result = pv_hypercall_table[call->op].compat( -+ op = call->op; -+ if ( (op < ARRAY_SIZE(pv_hypercall_table)) && -+ pv_hypercall_table[op].compat ) -+ call->result = pv_hypercall_table[op].compat( - call->args[0], call->args[1], call->args[2], - call->args[3], call->args[4], call->args[5]); - else - call->result = -ENOSYS; - } - #endif -+ -+ return unlikely(op == __HYPERVISOR_iret) -+ ? mc_exit -+ : likely(guest_kernel_mode(curr, guest_cpu_user_regs())) -+ ? mc_continue : mc_preempt; - } - - /* ---- a/xen/common/multicall.c -+++ b/xen/common/multicall.c -@@ -40,6 +40,7 @@ do_multicall( - struct mc_state *mcs = ¤t->mc_state; - uint32_t i; - int rc = 0; -+ enum mc_disposition disp = mc_continue; - - if ( unlikely(__test_and_set_bit(_MCSF_in_multicall, &mcs->flags)) ) - { -@@ -50,7 +51,7 @@ do_multicall( - if ( unlikely(!guest_handle_okay(call_list, nr_calls)) ) - rc = -EFAULT; - -- for ( i = 0; !rc && i < nr_calls; i++ ) -+ for ( i = 0; !rc && disp == mc_continue && i < nr_calls; i++ ) - { - if ( i && hypercall_preempt_check() ) - goto preempted; -@@ -63,7 +64,7 @@ do_multicall( - - trace_multicall_call(&mcs->call); - -- arch_do_multicall_call(mcs); -+ disp = arch_do_multicall_call(mcs); - - #ifndef NDEBUG - { -@@ -77,7 +78,14 @@ do_multicall( - } - #endif - -- if ( unlikely(__copy_field_to_guest(call_list, &mcs->call, result)) ) -+ if ( unlikely(disp == mc_exit) ) -+ { -+ if ( __copy_field_to_guest(call_list, &mcs->call, result) ) -+ /* nothing, best effort only */; -+ rc = mcs->call.result; -+ } -+ else if ( unlikely(__copy_field_to_guest(call_list, &mcs->call, -+ result)) ) - rc = -EFAULT; - else if ( mcs->flags & MCSF_call_preempted ) - { -@@ -93,6 +101,9 @@ do_multicall( - guest_handle_add_offset(call_list, 1); - } - -+ if ( unlikely(disp == mc_preempt) && i < nr_calls ) -+ goto preempted; -+ - perfc_incr(calls_to_multicall); - perfc_add(calls_from_multicall, i); - mcs->flags = 0; ---- a/xen/include/xen/multicall.h -+++ b/xen/include/xen/multicall.h -@@ -24,6 +24,10 @@ struct mc_state { - }; - }; - --void arch_do_multicall_call(struct mc_state *mc); -+enum mc_disposition { -+ mc_continue, -+ mc_exit, -+ mc_preempt, -+} arch_do_multicall_call(struct mc_state *mc); - - #endif /* __XEN_MULTICALL_H__ */ diff --git a/system/xen/xsa/xsa214.patch b/system/xen/xsa/xsa214.patch deleted file mode 100644 index 46a3d3a4c6..0000000000 --- a/system/xen/xsa/xsa214.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: x86: discard type information when stealing pages - -While a page having just a single general reference left necessarily -has a zero type reference count too, its type may still be valid (and -in validated state; at present this is only possible and relevant for -PGT_seg_desc_page, as page tables have their type forcibly zapped when -their type reference count drops to zero, and -PGT_{writable,shared}_page pages don't require any validation). In -such a case when the page is being re-used with the same type again, -validation is being skipped. As validation criteria differ between -32- and 64-bit guests, pages to be transferred between guests need to -have their validation indicator zapped (and with it we zap all other -type information at once). - -This is XSA-214. - -Reported-by: Jann Horn <jannh@google.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> - ---- a/xen/arch/x86/mm.c -+++ b/xen/arch/x86/mm.c -@@ -4466,6 +4466,17 @@ int steal_page( - y = cmpxchg(&page->count_info, x, x & ~PGC_count_mask); - } while ( y != x ); - -+ /* -+ * With the sole reference dropped temporarily, no-one can update type -+ * information. Type count also needs to be zero in this case, but e.g. -+ * PGT_seg_desc_page may still have PGT_validated set, which we need to -+ * clear before transferring ownership (as validation criteria vary -+ * depending on domain type). -+ */ -+ BUG_ON(page->u.inuse.type_info & (PGT_count_mask | PGT_locked | -+ PGT_pinned)); -+ page->u.inuse.type_info = 0; -+ - /* Swizzle the owner then reinstate the PGC_allocated reference. */ - page_set_owner(page, NULL); - y = page->count_info; diff --git a/system/xen/xsa/xsa216-qemuu.patch b/system/xen/xsa/xsa216-qemuu.patch deleted file mode 100644 index dd4d90d2ce..0000000000 --- a/system/xen/xsa/xsa216-qemuu.patch +++ /dev/null @@ -1,113 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: xen/disk: don't leak stack data via response ring - -Rather than constructing a local structure instance on the stack, fill -the fields directly on the shared ring, just like other (Linux) -backends do. Build on the fact that all response structure flavors are -actually identical (the old code did make this assumption too). - -This is XSA-216. - -Reported-by: Anthony Perard <anthony.perard@citrix.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Acked-by: Anthony PERARD <anthony.perard@citrix.com> ---- -v2: Add QEMU_PACKED to fix handling 32-bit guests by 64-bit qemu. - ---- a/hw/block/xen_blkif.h -+++ b/hw/block/xen_blkif.h -@@ -14,9 +14,6 @@ - struct blkif_common_request { - char dummy; - }; --struct blkif_common_response { -- char dummy; --}; - - /* i386 protocol version */ - #pragma pack(push, 4) -@@ -36,13 +33,7 @@ struct blkif_x86_32_request_discard { - blkif_sector_t sector_number; /* start sector idx on disk (r/w only) */ - uint64_t nr_sectors; /* # of contiguous sectors to discard */ - }; --struct blkif_x86_32_response { -- uint64_t id; /* copied from request */ -- uint8_t operation; /* copied from request */ -- int16_t status; /* BLKIF_RSP_??? */ --}; - typedef struct blkif_x86_32_request blkif_x86_32_request_t; --typedef struct blkif_x86_32_response blkif_x86_32_response_t; - #pragma pack(pop) - - /* x86_64 protocol version */ -@@ -62,20 +53,14 @@ struct blkif_x86_64_request_discard { - blkif_sector_t sector_number; /* start sector idx on disk (r/w only) */ - uint64_t nr_sectors; /* # of contiguous sectors to discard */ - }; --struct blkif_x86_64_response { -- uint64_t __attribute__((__aligned__(8))) id; -- uint8_t operation; /* copied from request */ -- int16_t status; /* BLKIF_RSP_??? */ --}; - typedef struct blkif_x86_64_request blkif_x86_64_request_t; --typedef struct blkif_x86_64_response blkif_x86_64_response_t; - - DEFINE_RING_TYPES(blkif_common, struct blkif_common_request, -- struct blkif_common_response); -+ struct blkif_response); - DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request, -- struct blkif_x86_32_response); -+ struct blkif_response QEMU_PACKED); - DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request, -- struct blkif_x86_64_response); -+ struct blkif_response); - - union blkif_back_rings { - blkif_back_ring_t native; ---- a/hw/block/xen_disk.c -+++ b/hw/block/xen_disk.c -@@ -769,31 +769,30 @@ static int blk_send_response_one(struct - struct XenBlkDev *blkdev = ioreq->blkdev; - int send_notify = 0; - int have_requests = 0; -- blkif_response_t resp; -- void *dst; -- -- resp.id = ioreq->req.id; -- resp.operation = ioreq->req.operation; -- resp.status = ioreq->status; -+ blkif_response_t *resp; - - /* Place on the response ring for the relevant domain. */ - switch (blkdev->protocol) { - case BLKIF_PROTOCOL_NATIVE: -- dst = RING_GET_RESPONSE(&blkdev->rings.native, blkdev->rings.native.rsp_prod_pvt); -+ resp = RING_GET_RESPONSE(&blkdev->rings.native, -+ blkdev->rings.native.rsp_prod_pvt); - break; - case BLKIF_PROTOCOL_X86_32: -- dst = RING_GET_RESPONSE(&blkdev->rings.x86_32_part, -- blkdev->rings.x86_32_part.rsp_prod_pvt); -+ resp = RING_GET_RESPONSE(&blkdev->rings.x86_32_part, -+ blkdev->rings.x86_32_part.rsp_prod_pvt); - break; - case BLKIF_PROTOCOL_X86_64: -- dst = RING_GET_RESPONSE(&blkdev->rings.x86_64_part, -- blkdev->rings.x86_64_part.rsp_prod_pvt); -+ resp = RING_GET_RESPONSE(&blkdev->rings.x86_64_part, -+ blkdev->rings.x86_64_part.rsp_prod_pvt); - break; - default: -- dst = NULL; - return 0; - } -- memcpy(dst, &resp, sizeof(resp)); -+ -+ resp->id = ioreq->req.id; -+ resp->operation = ioreq->req.operation; -+ resp->status = ioreq->status; -+ - blkdev->rings.common.rsp_prod_pvt++; - - RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blkdev->rings.common, send_notify); diff --git a/system/xen/xsa/xsa217.patch b/system/xen/xsa/xsa217.patch deleted file mode 100644 index 1d4eb01f23..0000000000 --- a/system/xen/xsa/xsa217.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: x86/mm: disallow page stealing from HVM domains - -The operation's success can't be controlled by the guest, as the device -model may have an active mapping of the page. If we nevertheless -permitted this operation, we'd have to add further TLB flushing to -prevent scenarios like - -"Domains A (HVM), B (PV), C (PV); B->target==A - Steps: - 1. B maps page X from A as writable - 2. B unmaps page X without a TLB flush - 3. A sends page X to C via GNTTABOP_transfer - 4. C maps page X as pagetable (potentially causing a TLB flush in C, - but not in B) - - At this point, X would be mapped as a pagetable in C while being - writable through a stale TLB entry in B." - -A similar scenario could be constructed for A using XENMEM_exchange and -some arbitrary PV domain C then having this page allocated. - -This is XSA-217. - -Reported-by: Jann Horn <jannh@google.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Acked-by: George Dunlap <george.dunlap@citrix.com> -Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> - ---- a/xen/arch/x86/mm.c -+++ b/xen/arch/x86/mm.c -@@ -4449,6 +4449,9 @@ int steal_page( - bool_t drop_dom_ref = 0; - const struct domain *owner = dom_xen; - -+ if ( paging_mode_external(d) ) -+ return -1; -+ - spin_lock(&d->page_alloc_lock); - - if ( is_xen_heap_page(page) || ((owner = page_get_owner(page)) != d) ) diff --git a/system/xen/xsa/xsa218-0001-gnttab-fix-unmap-pin-accounting-race.patch b/system/xen/xsa/xsa218-0001-gnttab-fix-unmap-pin-accounting-race.patch deleted file mode 100644 index ecdf0943ef..0000000000 --- a/system/xen/xsa/xsa218-0001-gnttab-fix-unmap-pin-accounting-race.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 25263d50f1440e3c1ff7782892e81f2612bcfce1 Mon Sep 17 00:00:00 2001 -From: Jan Beulich <jbeulich@suse.com> -Date: Fri, 2 Jun 2017 12:22:42 +0100 -Subject: [PATCH 1/3] gnttab: fix unmap pin accounting race - -Once all {writable} mappings of a grant entry have been unmapped, the -hypervisor informs the guest that the grant entry has been released by -clearing the _GTF_{reading,writing} usage flags in the guest's grant -table as appropriate. - -Unfortunately, at the moment, the code that updates the accounting -happens in a different critical section than the one which updates the -usage flags; this means that under the right circumstances, there may be -a window in time after the hypervisor reported the grant as being free -during which the grant referee still had access to the page. - -Move the grant accounting code into the same critical section as the -reporting code to make sure this kind of race can't happen. - -This is part of XSA-218. - -Reported-by: Jann Horn <jannh.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 32 +++++++++++++++++--------------- - 1 file changed, 17 insertions(+), 15 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index e2c4097..d80bd49 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -1150,15 +1150,8 @@ __gnttab_unmap_common( - PIN_FAIL(act_release_out, GNTST_general_error, - "Bad frame number doesn't match gntref. (%lx != %lx)\n", - op->frame, act->frame); -- if ( op->flags & GNTMAP_device_map ) -- { -- ASSERT(act->pin & (GNTPIN_devw_mask | GNTPIN_devr_mask)); -- op->map->flags &= ~GNTMAP_device_map; -- if ( op->flags & GNTMAP_readonly ) -- act->pin -= GNTPIN_devr_inc; -- else -- act->pin -= GNTPIN_devw_inc; -- } -+ -+ op->map->flags &= ~GNTMAP_device_map; - } - - if ( (op->host_addr != 0) && (op->flags & GNTMAP_host_map) ) -@@ -1168,12 +1161,7 @@ __gnttab_unmap_common( - op->flags)) < 0 ) - goto act_release_out; - -- ASSERT(act->pin & (GNTPIN_hstw_mask | GNTPIN_hstr_mask)); - op->map->flags &= ~GNTMAP_host_map; -- if ( op->flags & GNTMAP_readonly ) -- act->pin -= GNTPIN_hstr_inc; -- else -- act->pin -= GNTPIN_hstw_inc; - } - - act_release_out: -@@ -1266,6 +1254,12 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - else - put_page_and_type(pg); - } -+ -+ ASSERT(act->pin & (GNTPIN_devw_mask | GNTPIN_devr_mask)); -+ if ( op->flags & GNTMAP_readonly ) -+ act->pin -= GNTPIN_devr_inc; -+ else -+ act->pin -= GNTPIN_devw_inc; - } - - if ( (op->host_addr != 0) && (op->flags & GNTMAP_host_map) ) -@@ -1274,7 +1268,9 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - { - /* - * Suggests that __gntab_unmap_common failed in -- * replace_grant_host_mapping() so nothing further to do -+ * replace_grant_host_mapping() or IOMMU handling, so nothing -+ * further to do (short of re-establishing the mapping in the -+ * latter case). - */ - goto act_release_out; - } -@@ -1285,6 +1281,12 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - put_page_type(pg); - put_page(pg); - } -+ -+ ASSERT(act->pin & (GNTPIN_hstw_mask | GNTPIN_hstr_mask)); -+ if ( op->flags & GNTMAP_readonly ) -+ act->pin -= GNTPIN_hstr_inc; -+ else -+ act->pin -= GNTPIN_hstw_inc; - } - - if ( (op->map->flags & (GNTMAP_device_map|GNTMAP_host_map)) == 0 ) --- -2.1.4 - diff --git a/system/xen/xsa/xsa218-0002-gnttab-Avoid-potential-double-put-of-maptrack-entry.patch b/system/xen/xsa/xsa218-0002-gnttab-Avoid-potential-double-put-of-maptrack-entry.patch deleted file mode 100644 index b07c978b3c..0000000000 --- a/system/xen/xsa/xsa218-0002-gnttab-Avoid-potential-double-put-of-maptrack-entry.patch +++ /dev/null @@ -1,231 +0,0 @@ -From bb6d476b09e635baf5e9fb22540ab7c3530d1d98 Mon Sep 17 00:00:00 2001 -From: George Dunlap <george.dunlap@citrix.com> -Date: Thu, 15 Jun 2017 12:05:14 +0100 -Subject: [PATCH 2/3] gnttab: Avoid potential double-put of maptrack entry - -Each grant mapping for a particular domain is tracked by an in-Xen -"maptrack" entry. This entry is is referenced by a "handle", which is -given to the guest when it calls gnttab_map_grant_ref(). - -There are two types of mapping a particular handle can refer to: -GNTMAP_host_map and GNTMAP_device_map. A given -gnttab_unmap_grant_ref() call can remove either only one or both of -these entries. When a particular handle has no entries left, it must -be freed. - -gnttab_unmap_grant_ref() loops through its grant unmap request list -twice. It first removes entries from any host pagetables and (if -appropraite) iommus; then it does a single domain TLB flush; then it -does the clean-up, including telling the granter that entries are no -longer being used (if appropriate). - -At the moment, it's during the first pass that the maptrack flags are -cleared, but the second pass that the maptrack entry is freed. - -Unfortunately this allows the following race, which results in a -double-free: - - A: (pass 1) clear host_map - B: (pass 1) clear device_map - A: (pass 2) See that maptrack entry has no mappings, free it - B: (pass 2) See that maptrack entry has no mappings, free it # - -Unfortunately, unlike the active entry pinning update, we can't simply -move the maptrack flag changes to the second half, because the -maptrack flags are used to determine if iommu entries need to be -added: a domain's iommu must never have fewer permissions than the -maptrack flags indicate, or a subsequent map_grant_ref() might fail to -add the necessary iommu entries. - -Instead, free the maptrack entry in the first pass if there are no -further mappings. - -This is part of XSA-218. - -Reported-by: Jan Beulich <jbeulich.com> -Signed-off-by: George Dunlap <george.dunlap@citrix.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 77 +++++++++++++++++++++++++++++++++--------------- - 1 file changed, 53 insertions(+), 24 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index d80bd49..ba10e76 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -98,8 +98,8 @@ struct gnttab_unmap_common { - /* Shared state beteen *_unmap and *_unmap_complete */ - u16 flags; - unsigned long frame; -- struct grant_mapping *map; - struct domain *rd; -+ grant_ref_t ref; - }; - - /* Number of unmap operations that are done between each tlb flush */ -@@ -1079,6 +1079,8 @@ __gnttab_unmap_common( - struct grant_table *lgt, *rgt; - struct active_grant_entry *act; - s16 rc = 0; -+ struct grant_mapping *map; -+ bool put_handle = false; - - ld = current->domain; - lgt = ld->grant_table; -@@ -1092,11 +1094,11 @@ __gnttab_unmap_common( - return; - } - -- op->map = &maptrack_entry(lgt, op->handle); -+ map = &maptrack_entry(lgt, op->handle); - - grant_read_lock(lgt); - -- if ( unlikely(!read_atomic(&op->map->flags)) ) -+ if ( unlikely(!read_atomic(&map->flags)) ) - { - grant_read_unlock(lgt); - gdprintk(XENLOG_INFO, "Zero flags for handle (%d).\n", op->handle); -@@ -1104,7 +1106,7 @@ __gnttab_unmap_common( - return; - } - -- dom = op->map->domid; -+ dom = map->domid; - grant_read_unlock(lgt); - - if ( unlikely((rd = rcu_lock_domain_by_id(dom)) == NULL) ) -@@ -1129,16 +1131,43 @@ __gnttab_unmap_common( - - grant_read_lock(rgt); - -- op->flags = read_atomic(&op->map->flags); -- if ( unlikely(!op->flags) || unlikely(op->map->domid != dom) ) -+ op->rd = rd; -+ op->ref = map->ref; -+ -+ /* -+ * We can't assume there was no racing unmap for this maptrack entry, -+ * and hence we can't assume map->ref is valid for rd. While the checks -+ * below (with the active entry lock held) will reject any such racing -+ * requests, we still need to make sure we don't attempt to acquire an -+ * invalid lock. -+ */ -+ smp_rmb(); -+ if ( unlikely(op->ref >= nr_grant_entries(rgt)) ) - { - gdprintk(XENLOG_WARNING, "Unstable handle %u\n", op->handle); - rc = GNTST_bad_handle; -- goto unmap_out; -+ goto unlock_out; - } - -- op->rd = rd; -- act = active_entry_acquire(rgt, op->map->ref); -+ act = active_entry_acquire(rgt, op->ref); -+ -+ /* -+ * Note that we (ab)use the active entry lock here to protect against -+ * multiple unmaps of the same mapping here. We don't want to hold lgt's -+ * lock, and we only hold rgt's lock for reading (but the latter wouldn't -+ * be the right one anyway). Hence the easiest is to rely on a lock we -+ * hold anyway; see docs/misc/grant-tables.txt's "Locking" section. -+ */ -+ -+ op->flags = read_atomic(&map->flags); -+ smp_rmb(); -+ if ( unlikely(!op->flags) || unlikely(map->domid != dom) || -+ unlikely(map->ref != op->ref) ) -+ { -+ gdprintk(XENLOG_WARNING, "Unstable handle %#x\n", op->handle); -+ rc = GNTST_bad_handle; -+ goto act_release_out; -+ } - - if ( op->frame == 0 ) - { -@@ -1151,7 +1180,7 @@ __gnttab_unmap_common( - "Bad frame number doesn't match gntref. (%lx != %lx)\n", - op->frame, act->frame); - -- op->map->flags &= ~GNTMAP_device_map; -+ map->flags &= ~GNTMAP_device_map; - } - - if ( (op->host_addr != 0) && (op->flags & GNTMAP_host_map) ) -@@ -1161,14 +1190,23 @@ __gnttab_unmap_common( - op->flags)) < 0 ) - goto act_release_out; - -- op->map->flags &= ~GNTMAP_host_map; -+ map->flags &= ~GNTMAP_host_map; -+ } -+ -+ if ( !(map->flags & (GNTMAP_device_map|GNTMAP_host_map)) ) -+ { -+ map->flags = 0; -+ put_handle = true; - } - - act_release_out: - active_entry_release(act); -- unmap_out: -+ unlock_out: - grant_read_unlock(rgt); - -+ if ( put_handle ) -+ put_maptrack_handle(lgt, op->handle); -+ - if ( rc == GNTST_okay && gnttab_need_iommu_mapping(ld) ) - { - unsigned int kind; -@@ -1205,7 +1243,6 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - grant_entry_header_t *sha; - struct page_info *pg; - uint16_t *status; -- bool_t put_handle = 0; - - if ( rd == NULL ) - { -@@ -1226,13 +1263,13 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - if ( rgt->gt_version == 0 ) - goto unlock_out; - -- act = active_entry_acquire(rgt, op->map->ref); -- sha = shared_entry_header(rgt, op->map->ref); -+ act = active_entry_acquire(rgt, op->ref); -+ sha = shared_entry_header(rgt, op->ref); - - if ( rgt->gt_version == 1 ) - status = &sha->flags; - else -- status = &status_entry(rgt, op->map->ref); -+ status = &status_entry(rgt, op->ref); - - if ( unlikely(op->frame != act->frame) ) - { -@@ -1289,9 +1326,6 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - act->pin -= GNTPIN_hstw_inc; - } - -- if ( (op->map->flags & (GNTMAP_device_map|GNTMAP_host_map)) == 0 ) -- put_handle = 1; -- - if ( ((act->pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask)) == 0) && - !(op->flags & GNTMAP_readonly) ) - gnttab_clear_flag(_GTF_writing, status); -@@ -1304,11 +1338,6 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - unlock_out: - grant_read_unlock(rgt); - -- if ( put_handle ) -- { -- op->map->flags = 0; -- put_maptrack_handle(ld->grant_table, op->handle); -- } - rcu_unlock_domain(rd); - } - --- -2.1.4 - diff --git a/system/xen/xsa/xsa218-0003-gnttab-correct-maptrack-table-accesses.patch b/system/xen/xsa/xsa218-0003-gnttab-correct-maptrack-table-accesses.patch deleted file mode 100644 index 60e1583f0f..0000000000 --- a/system/xen/xsa/xsa218-0003-gnttab-correct-maptrack-table-accesses.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 29f04a077972e07c86c9e911005220f6d691ffa6 Mon Sep 17 00:00:00 2001 -From: Jan Beulich <jbeulich@suse.com> -Date: Thu, 15 Jun 2017 12:05:29 +0100 -Subject: [PATCH 3/3] gnttab: correct maptrack table accesses - -In order to observe a consistent (limit,pointer-table) pair, the reader -needs to either hold the maptrack lock (in line with documentation) or -both sides need to order their accesses suitably (the writer side -barrier was removed by commit dff515dfea ["gnttab: use per-VCPU -maptrack free lists"], and a read side barrier has never been there). - -Make the writer publish a new table page before limit (for bounds -checks to work), and new list head last (for racing maptrack_entry() -invocations to work). At the same time add read barriers to lockless -readers. - -Additionally get_maptrack_handle() must not assume ->maptrack_head to -not change behind its back: Another handle may be put (updating only -->maptrack_tail) and then got or stolen (updating ->maptrack_head). - -This is part of XSA-218. - -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: George Dunlap <george.dunlap@citrix.com> ---- - xen/common/grant_table.c | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index ba10e76..627947a 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -395,7 +395,7 @@ get_maptrack_handle( - struct grant_table *lgt) - { - struct vcpu *curr = current; -- int i; -+ unsigned int i, head; - grant_handle_t handle; - struct grant_mapping *new_mt; - -@@ -451,17 +451,20 @@ get_maptrack_handle( - new_mt[i].ref = handle + i + 1; - new_mt[i].vcpu = curr->vcpu_id; - } -- new_mt[i - 1].ref = curr->maptrack_head; - - /* Set tail directly if this is the first page for this VCPU. */ - if ( curr->maptrack_tail == MAPTRACK_TAIL ) - curr->maptrack_tail = handle + MAPTRACK_PER_PAGE - 1; - -- write_atomic(&curr->maptrack_head, handle + 1); -- - lgt->maptrack[nr_maptrack_frames(lgt)] = new_mt; -+ smp_wmb(); - lgt->maptrack_limit += MAPTRACK_PER_PAGE; - -+ do { -+ new_mt[i - 1].ref = read_atomic(&curr->maptrack_head); -+ head = cmpxchg(&curr->maptrack_head, new_mt[i - 1].ref, handle + 1); -+ } while ( head != new_mt[i - 1].ref ); -+ - spin_unlock(&lgt->maptrack_lock); - - return handle; -@@ -727,6 +730,7 @@ static unsigned int mapkind( - for ( handle = 0; !(kind & MAPKIND_WRITE) && - handle < lgt->maptrack_limit; handle++ ) - { -+ smp_rmb(); - map = &maptrack_entry(lgt, handle); - if ( !(map->flags & (GNTMAP_device_map|GNTMAP_host_map)) || - map->domid != rd->domain_id ) -@@ -1094,6 +1098,7 @@ __gnttab_unmap_common( - return; - } - -+ smp_rmb(); - map = &maptrack_entry(lgt, op->handle); - - grant_read_lock(lgt); --- -2.1.4 - diff --git a/system/xen/xsa/xsa219-4.8.patch b/system/xen/xsa/xsa219-4.8.patch deleted file mode 100644 index 68c4677da3..0000000000 --- a/system/xen/xsa/xsa219-4.8.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 3986b845e87c3f963227ece86bb633450761ec18 Mon Sep 17 00:00:00 2001 -From: Andrew Cooper <andrew.cooper3@citrix.com> -Date: Thu, 11 May 2017 14:47:00 +0100 -Subject: [PATCH] x86/shadow: Hold references for the duration of emulated - writes - -The (misnamed) emulate_gva_to_mfn() function translates a linear address to an -mfn, but releases its page reference before returning the mfn to its caller. - -sh_emulate_map_dest() uses the results of one or two translations to construct -a virtual mapping to the underlying frames, completes an emulated -write/cmpxchg, then unmaps the virtual mappings. - -The page references need holding until the mappings are unmapped, or the -frames can change ownership before the writes occurs. - -This is XSA-219 - -Reported-by: Andrew Cooper <andrew.cooper3@citrix.com> -Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> -Reviewed-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Tim Deegan <tim@xen.org> ---- - xen/arch/x86/mm/shadow/common.c | 54 +++++++++++++++++++++++++++-------------- - 1 file changed, 36 insertions(+), 18 deletions(-) - -diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c -index ced2313..13305d2 100644 ---- a/xen/arch/x86/mm/shadow/common.c -+++ b/xen/arch/x86/mm/shadow/common.c -@@ -1703,7 +1703,10 @@ static unsigned int shadow_get_allocation(struct domain *d) - /**************************************************************************/ - /* Handling guest writes to pagetables. */ - --/* Translate a VA to an MFN, injecting a page-fault if we fail. */ -+/* -+ * Translate a VA to an MFN, injecting a page-fault if we fail. If the -+ * mapping succeeds, a reference will be held on the underlying page. -+ */ - #define BAD_GVA_TO_GFN (~0UL) - #define BAD_GFN_TO_MFN (~1UL) - #define READONLY_GFN (~2UL) -@@ -1751,16 +1754,15 @@ static mfn_t emulate_gva_to_mfn(struct vcpu *v, unsigned long vaddr, - ASSERT(mfn_valid(mfn)); - - v->arch.paging.last_write_was_pt = !!sh_mfn_is_a_page_table(mfn); -- /* -- * Note shadow cannot page out or unshare this mfn, so the map won't -- * disappear. Otherwise, caller must hold onto page until done. -- */ -- put_page(page); - - return mfn; - } - --/* Check that the user is allowed to perform this write. */ -+/* -+ * Check that the user is allowed to perform this write. If a mapping is -+ * returned, page references will be held on sh_ctxt->mfn[0] and -+ * sh_ctxt->mfn[1] iff !INVALID_MFN. -+ */ - void *sh_emulate_map_dest(struct vcpu *v, unsigned long vaddr, - unsigned int bytes, - struct sh_emulate_ctxt *sh_ctxt) -@@ -1768,13 +1770,6 @@ void *sh_emulate_map_dest(struct vcpu *v, unsigned long vaddr, - struct domain *d = v->domain; - void *map; - -- sh_ctxt->mfn[0] = emulate_gva_to_mfn(v, vaddr, sh_ctxt); -- if ( !mfn_valid(sh_ctxt->mfn[0]) ) -- return ((mfn_x(sh_ctxt->mfn[0]) == BAD_GVA_TO_GFN) ? -- MAPPING_EXCEPTION : -- (mfn_x(sh_ctxt->mfn[0]) == READONLY_GFN) ? -- MAPPING_SILENT_FAIL : MAPPING_UNHANDLEABLE); -- - #ifndef NDEBUG - /* We don't emulate user-mode writes to page tables. */ - if ( has_hvm_container_domain(d) -@@ -1787,6 +1782,17 @@ void *sh_emulate_map_dest(struct vcpu *v, unsigned long vaddr, - } - #endif - -+ sh_ctxt->mfn[0] = emulate_gva_to_mfn(v, vaddr, sh_ctxt); -+ if ( !mfn_valid(sh_ctxt->mfn[0]) ) -+ { -+ switch ( mfn_x(sh_ctxt->mfn[0]) ) -+ { -+ case BAD_GVA_TO_GFN: return MAPPING_EXCEPTION; -+ case READONLY_GFN: return MAPPING_SILENT_FAIL; -+ default: return MAPPING_UNHANDLEABLE; -+ } -+ } -+ - /* Unaligned writes mean probably this isn't a pagetable. */ - if ( vaddr & (bytes - 1) ) - sh_remove_shadows(d, sh_ctxt->mfn[0], 0, 0 /* Slow, can fail. */ ); -@@ -1803,6 +1809,7 @@ void *sh_emulate_map_dest(struct vcpu *v, unsigned long vaddr, - * Cross-page emulated writes are only supported for HVM guests; - * PV guests ought to know better. - */ -+ put_page(mfn_to_page(sh_ctxt->mfn[0])); - return MAPPING_UNHANDLEABLE; - } - else -@@ -1810,17 +1817,26 @@ void *sh_emulate_map_dest(struct vcpu *v, unsigned long vaddr, - /* This write crosses a page boundary. Translate the second page. */ - sh_ctxt->mfn[1] = emulate_gva_to_mfn(v, vaddr + bytes - 1, sh_ctxt); - if ( !mfn_valid(sh_ctxt->mfn[1]) ) -- return ((mfn_x(sh_ctxt->mfn[1]) == BAD_GVA_TO_GFN) ? -- MAPPING_EXCEPTION : -- (mfn_x(sh_ctxt->mfn[1]) == READONLY_GFN) ? -- MAPPING_SILENT_FAIL : MAPPING_UNHANDLEABLE); -+ { -+ put_page(mfn_to_page(sh_ctxt->mfn[0])); -+ switch ( mfn_x(sh_ctxt->mfn[1]) ) -+ { -+ case BAD_GVA_TO_GFN: return MAPPING_EXCEPTION; -+ case READONLY_GFN: return MAPPING_SILENT_FAIL; -+ default: return MAPPING_UNHANDLEABLE; -+ } -+ } - - /* Cross-page writes mean probably not a pagetable. */ - sh_remove_shadows(d, sh_ctxt->mfn[1], 0, 0 /* Slow, can fail. */ ); - - map = vmap(sh_ctxt->mfn, 2); - if ( !map ) -+ { -+ put_page(mfn_to_page(sh_ctxt->mfn[0])); -+ put_page(mfn_to_page(sh_ctxt->mfn[1])); - return MAPPING_UNHANDLEABLE; -+ } - map += (vaddr & ~PAGE_MASK); - } - -@@ -1890,10 +1906,12 @@ void sh_emulate_unmap_dest(struct vcpu *v, void *addr, unsigned int bytes, - } - - paging_mark_dirty(v->domain, mfn_x(sh_ctxt->mfn[0])); -+ put_page(mfn_to_page(sh_ctxt->mfn[0])); - - if ( unlikely(mfn_valid(sh_ctxt->mfn[1])) ) - { - paging_mark_dirty(v->domain, mfn_x(sh_ctxt->mfn[1])); -+ put_page(mfn_to_page(sh_ctxt->mfn[1])); - vunmap((void *)((unsigned long)addr & PAGE_MASK)); - } - else --- -2.1.4 - diff --git a/system/xen/xsa/xsa220-4.8.patch b/system/xen/xsa/xsa220-4.8.patch deleted file mode 100644 index 4a1ecd0d6d..0000000000 --- a/system/xen/xsa/xsa220-4.8.patch +++ /dev/null @@ -1,94 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: x86: avoid leaking PKRU and BND* between vCPU-s - -PKRU is explicitly "XSAVE-managed but not XSAVE-enabled", so guests -might access the register (via {RD,WR}PKRU) without setting XCR0.PKRU. -Force context switching as well as migrating the register as soon as -CR4.PKE is being set the first time. - -For MPX (BND<n>, BNDCFGU, and BNDSTATUS) the situation is less clear, -and the SDM has not entirely consistent information for that case. -While experimentally the instructions don't change register state as -long as the two XCR0 bits aren't both 1, be on the safe side and enable -both if BNDCFGS.EN is being set the first time. - -This is XSA-220. - -Reported-by: Andrew Cooper <andrew.cooper3@citrix.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> - ---- a/xen/arch/x86/hvm/hvm.c -+++ b/xen/arch/x86/hvm/hvm.c -@@ -311,10 +311,39 @@ int hvm_set_guest_pat(struct vcpu *v, u6 - - bool hvm_set_guest_bndcfgs(struct vcpu *v, u64 val) - { -- return hvm_funcs.set_guest_bndcfgs && -- is_canonical_address(val) && -- !(val & IA32_BNDCFGS_RESERVED) && -- hvm_funcs.set_guest_bndcfgs(v, val); -+ if ( !hvm_funcs.set_guest_bndcfgs || -+ !is_canonical_address(val) || -+ (val & IA32_BNDCFGS_RESERVED) ) -+ return false; -+ -+ /* -+ * While MPX instructions are supposed to be gated on XCR0.BND*, let's -+ * nevertheless force the relevant XCR0 bits on when the feature is being -+ * enabled in BNDCFGS. -+ */ -+ if ( (val & IA32_BNDCFGS_ENABLE) && -+ !(v->arch.xcr0_accum & (XSTATE_BNDREGS | XSTATE_BNDCSR)) ) -+ { -+ uint64_t xcr0 = get_xcr0(); -+ int rc; -+ -+ if ( v != current ) -+ return false; -+ -+ rc = handle_xsetbv(XCR_XFEATURE_ENABLED_MASK, -+ xcr0 | XSTATE_BNDREGS | XSTATE_BNDCSR); -+ -+ if ( rc ) -+ { -+ HVM_DBG_LOG(DBG_LEVEL_1, "Failed to force XCR0.BND*: %d", rc); -+ return false; -+ } -+ -+ if ( handle_xsetbv(XCR_XFEATURE_ENABLED_MASK, xcr0) ) -+ /* nothing, best effort only */; -+ } -+ -+ return hvm_funcs.set_guest_bndcfgs(v, val); - } - - /* -@@ -2477,6 +2506,27 @@ int hvm_set_cr4(unsigned long value, boo - paging_update_paging_modes(v); - } - -+ /* -+ * {RD,WR}PKRU are not gated on XCR0.PKRU and hence an oddly behaving -+ * guest may enable the feature in CR4 without enabling it in XCR0. We -+ * need to context switch / migrate PKRU nevertheless. -+ */ -+ if ( (value & X86_CR4_PKE) && !(v->arch.xcr0_accum & XSTATE_PKRU) ) -+ { -+ int rc = handle_xsetbv(XCR_XFEATURE_ENABLED_MASK, -+ get_xcr0() | XSTATE_PKRU); -+ -+ if ( rc ) -+ { -+ HVM_DBG_LOG(DBG_LEVEL_1, "Failed to force XCR0.PKRU: %d", rc); -+ goto gpf; -+ } -+ -+ if ( handle_xsetbv(XCR_XFEATURE_ENABLED_MASK, -+ get_xcr0() & ~XSTATE_PKRU) ) -+ /* nothing, best effort only */; -+ } -+ - return X86EMUL_OKAY; - - gpf: diff --git a/system/xen/xsa/xsa221.patch b/system/xen/xsa/xsa221.patch deleted file mode 100644 index c7fec96668..0000000000 --- a/system/xen/xsa/xsa221.patch +++ /dev/null @@ -1,194 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: evtchn: avoid NULL derefs - -Commit fbbd5009e6 ("evtchn: refactor low-level event channel port ops") -added a de-reference of the struct evtchn pointer for a port without -first making sure the bucket pointer is non-NULL. This de-reference is -actually entirely unnecessary, as all relevant callers (beyond the -problematic do_poll()) already hold the port number in their hands, and -the actual leaf functions need nothing else. - -For FIFO event channels there's a second problem in that the ordering -of reads and updates to ->num_evtchns and ->event_array[] was so far -undefined (the read side isn't always holding the domain's event lock). -Add respective barriers. - -This is XSA-221. - -Reported-by: Ankur Arora <ankur.a.arora@oracle.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> - ---- a/xen/arch/x86/irq.c -+++ b/xen/arch/x86/irq.c -@@ -1486,7 +1486,7 @@ int pirq_guest_unmask(struct domain *d) - { - pirq = pirqs[i]->pirq; - if ( pirqs[i]->masked && -- !evtchn_port_is_masked(d, evtchn_from_port(d, pirqs[i]->evtchn)) ) -+ !evtchn_port_is_masked(d, pirqs[i]->evtchn) ) - pirq_guest_eoi(pirqs[i]); - } - } while ( ++pirq < d->nr_pirqs && n == ARRAY_SIZE(pirqs) ); -@@ -2244,7 +2244,6 @@ static void dump_irqs(unsigned char key) - int i, irq, pirq; - struct irq_desc *desc; - irq_guest_action_t *action; -- struct evtchn *evtchn; - struct domain *d; - const struct pirq *info; - unsigned long flags; -@@ -2287,11 +2286,10 @@ static void dump_irqs(unsigned char key) - d = action->guest[i]; - pirq = domain_irq_to_pirq(d, irq); - info = pirq_info(d, pirq); -- evtchn = evtchn_from_port(d, info->evtchn); - printk("%u:%3d(%c%c%c)", - d->domain_id, pirq, -- (evtchn_port_is_pending(d, evtchn) ? 'P' : '-'), -- (evtchn_port_is_masked(d, evtchn) ? 'M' : '-'), -+ evtchn_port_is_pending(d, info->evtchn) ? 'P' : '-', -+ evtchn_port_is_masked(d, info->evtchn) ? 'M' : '-', - (info->masked ? 'M' : '-')); - if ( i != action->nr_guests ) - printk(","); ---- a/xen/common/event_2l.c -+++ b/xen/common/event_2l.c -@@ -61,16 +61,20 @@ static void evtchn_2l_unmask(struct doma - } - } - --static bool_t evtchn_2l_is_pending(struct domain *d, -- const struct evtchn *evtchn) -+static bool_t evtchn_2l_is_pending(struct domain *d, evtchn_port_t port) - { -- return test_bit(evtchn->port, &shared_info(d, evtchn_pending)); -+ unsigned int max_ports = BITS_PER_EVTCHN_WORD(d) * BITS_PER_EVTCHN_WORD(d); -+ -+ ASSERT(port < max_ports); -+ return port < max_ports && test_bit(port, &shared_info(d, evtchn_pending)); - } - --static bool_t evtchn_2l_is_masked(struct domain *d, -- const struct evtchn *evtchn) -+static bool_t evtchn_2l_is_masked(struct domain *d, evtchn_port_t port) - { -- return test_bit(evtchn->port, &shared_info(d, evtchn_mask)); -+ unsigned int max_ports = BITS_PER_EVTCHN_WORD(d) * BITS_PER_EVTCHN_WORD(d); -+ -+ ASSERT(port < max_ports); -+ return port >= max_ports || test_bit(port, &shared_info(d, evtchn_mask)); - } - - static void evtchn_2l_print_state(struct domain *d, ---- a/xen/common/event_channel.c -+++ b/xen/common/event_channel.c -@@ -1380,8 +1380,8 @@ static void domain_dump_evtchn_info(stru - - printk(" %4u [%d/%d/", - port, -- !!evtchn_port_is_pending(d, chn), -- !!evtchn_port_is_masked(d, chn)); -+ evtchn_port_is_pending(d, port), -+ evtchn_port_is_masked(d, port)); - evtchn_port_print_state(d, chn); - printk("]: s=%d n=%d x=%d", - chn->state, chn->notify_vcpu_id, chn->xen_consumer); ---- a/xen/common/event_fifo.c -+++ b/xen/common/event_fifo.c -@@ -27,6 +27,12 @@ static inline event_word_t *evtchn_fifo_ - if ( unlikely(port >= d->evtchn_fifo->num_evtchns) ) - return NULL; - -+ /* -+ * Callers aren't required to hold d->event_lock, so we need to synchronize -+ * with add_page_to_event_array(). -+ */ -+ smp_rmb(); -+ - p = port / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE; - w = port % EVTCHN_FIFO_EVENT_WORDS_PER_PAGE; - -@@ -287,24 +293,22 @@ static void evtchn_fifo_unmask(struct do - evtchn_fifo_set_pending(v, evtchn); - } - --static bool_t evtchn_fifo_is_pending(struct domain *d, -- const struct evtchn *evtchn) -+static bool_t evtchn_fifo_is_pending(struct domain *d, evtchn_port_t port) - { - event_word_t *word; - -- word = evtchn_fifo_word_from_port(d, evtchn->port); -+ word = evtchn_fifo_word_from_port(d, port); - if ( unlikely(!word) ) - return 0; - - return test_bit(EVTCHN_FIFO_PENDING, word); - } - --static bool_t evtchn_fifo_is_masked(struct domain *d, -- const struct evtchn *evtchn) -+static bool_t evtchn_fifo_is_masked(struct domain *d, evtchn_port_t port) - { - event_word_t *word; - -- word = evtchn_fifo_word_from_port(d, evtchn->port); -+ word = evtchn_fifo_word_from_port(d, port); - if ( unlikely(!word) ) - return 1; - -@@ -593,6 +597,10 @@ static int add_page_to_event_array(struc - return rc; - - d->evtchn_fifo->event_array[slot] = virt; -+ -+ /* Synchronize with evtchn_fifo_word_from_port(). */ -+ smp_wmb(); -+ - d->evtchn_fifo->num_evtchns += EVTCHN_FIFO_EVENT_WORDS_PER_PAGE; - - /* ---- a/xen/common/schedule.c -+++ b/xen/common/schedule.c -@@ -965,7 +965,7 @@ static long do_poll(struct sched_poll *s - goto out; - - rc = 0; -- if ( evtchn_port_is_pending(d, evtchn_from_port(d, port)) ) -+ if ( evtchn_port_is_pending(d, port) ) - goto out; - } - ---- a/xen/include/xen/event.h -+++ b/xen/include/xen/event.h -@@ -137,8 +137,8 @@ struct evtchn_port_ops { - void (*set_pending)(struct vcpu *v, struct evtchn *evtchn); - void (*clear_pending)(struct domain *d, struct evtchn *evtchn); - void (*unmask)(struct domain *d, struct evtchn *evtchn); -- bool_t (*is_pending)(struct domain *d, const struct evtchn *evtchn); -- bool_t (*is_masked)(struct domain *d, const struct evtchn *evtchn); -+ bool_t (*is_pending)(struct domain *d, evtchn_port_t port); -+ bool_t (*is_masked)(struct domain *d, evtchn_port_t port); - /* - * Is the port unavailable because it's still being cleaned up - * after being closed? -@@ -175,15 +175,15 @@ static inline void evtchn_port_unmask(st - } - - static inline bool_t evtchn_port_is_pending(struct domain *d, -- const struct evtchn *evtchn) -+ evtchn_port_t port) - { -- return d->evtchn_port_ops->is_pending(d, evtchn); -+ return d->evtchn_port_ops->is_pending(d, port); - } - - static inline bool_t evtchn_port_is_masked(struct domain *d, -- const struct evtchn *evtchn) -+ evtchn_port_t port) - { -- return d->evtchn_port_ops->is_masked(d, evtchn); -+ return d->evtchn_port_ops->is_masked(d, port); - } - - static inline bool_t evtchn_port_is_busy(struct domain *d, evtchn_port_t port) diff --git a/system/xen/xsa/xsa222-1.patch b/system/xen/xsa/xsa222-1.patch deleted file mode 100644 index 6f1290b6a8..0000000000 --- a/system/xen/xsa/xsa222-1.patch +++ /dev/null @@ -1,124 +0,0 @@ -From: Andrew Cooper <andrew.cooper3@citrix.com> -Subject: xen/memory: Fix return value handing of guest_remove_page() - -Despite the description in mm.h, guest_remove_page() previously returned 0 for -paging errors. - -Switch guest_remove_page() to having regular 0/-error semantics, and propagate -the return values from clear_mmio_p2m_entry() and mem_sharing_unshare_page() -to the callers (although decrease_reservation() is the only caller which -currently cares). - -This is part of XSA-222. - -Reported-by: Julien Grall <julien.grall@arm.com> -Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> - -diff --git a/xen/common/memory.c b/xen/common/memory.c -index 52879e7..a40bc1c 100644 ---- a/xen/common/memory.c -+++ b/xen/common/memory.c -@@ -265,6 +265,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - p2m_type_t p2mt; - #endif - mfn_t mfn; -+ int rc; - - #ifdef CONFIG_X86 - mfn = get_gfn_query(d, gmfn, &p2mt); -@@ -282,13 +283,15 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_page(page); - } - p2m_mem_paging_drop_page(d, gmfn, p2mt); -- return 1; -+ -+ return 0; - } - if ( p2mt == p2m_mmio_direct ) - { -- clear_mmio_p2m_entry(d, gmfn, mfn, 0); -+ rc = clear_mmio_p2m_entry(d, gmfn, mfn, PAGE_ORDER_4K); - put_gfn(d, gmfn); -- return 1; -+ -+ return rc; - } - #else - mfn = gfn_to_mfn(d, _gfn(gmfn)); -@@ -298,21 +301,25 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_gfn(d, gmfn); - gdprintk(XENLOG_INFO, "Domain %u page number %lx invalid\n", - d->domain_id, gmfn); -- return 0; -+ -+ return -EINVAL; - } - - #ifdef CONFIG_X86 - if ( p2m_is_shared(p2mt) ) - { -- /* Unshare the page, bail out on error. We unshare because -- * we might be the only one using this shared page, and we -- * need to trigger proper cleanup. Once done, this is -- * like any other page. */ -- if ( mem_sharing_unshare_page(d, gmfn, 0) ) -+ /* -+ * Unshare the page, bail out on error. We unshare because we -+ * might be the only one using this shared page, and we need to -+ * trigger proper cleanup. Once done, this is like any other page. -+ */ -+ rc = mem_sharing_unshare_page(d, gmfn, 0); -+ if ( rc ) - { - put_gfn(d, gmfn); - (void)mem_sharing_notify_enomem(d, gmfn, 0); -- return 0; -+ -+ return rc; - } - /* Maybe the mfn changed */ - mfn = get_gfn_query_unlocked(d, gmfn, &p2mt); -@@ -325,7 +332,8 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - { - put_gfn(d, gmfn); - gdprintk(XENLOG_INFO, "Bad page free for domain %u\n", d->domain_id); -- return 0; -+ -+ return -ENXIO; - } - - if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) ) -@@ -348,7 +356,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn) - put_page(page); - put_gfn(d, gmfn); - -- return 1; -+ return 0; - } - - static void decrease_reservation(struct memop_args *a) -@@ -392,7 +400,7 @@ static void decrease_reservation(struct memop_args *a) - continue; - - for ( j = 0; j < (1 << a->extent_order); j++ ) -- if ( !guest_remove_page(a->domain, gmfn + j) ) -+ if ( guest_remove_page(a->domain, gmfn + j) ) - goto out; - } - -diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h -index 88de3c1..b367930 100644 ---- a/xen/include/xen/mm.h -+++ b/xen/include/xen/mm.h -@@ -553,9 +553,8 @@ int xenmem_add_to_physmap_one(struct domain *d, unsigned int space, - union xen_add_to_physmap_batch_extra extra, - unsigned long idx, gfn_t gfn); - --/* Returns 1 on success, 0 on error, negative if the ring -- * for event propagation is full in the presence of paging */ --int guest_remove_page(struct domain *d, unsigned long gfn); -+/* Returns 0 on success, or negative on error. */ -+int guest_remove_page(struct domain *d, unsigned long gmfn); - - #define RAM_TYPE_CONVENTIONAL 0x00000001 - #define RAM_TYPE_RESERVED 0x00000002 diff --git a/system/xen/xsa/xsa222-2-4.8.patch b/system/xen/xsa/xsa222-2-4.8.patch deleted file mode 100644 index 2825d2a061..0000000000 --- a/system/xen/xsa/xsa222-2-4.8.patch +++ /dev/null @@ -1,405 +0,0 @@ -From: Jan Beulich <jbeulich@suse.com> -Subject: guest_physmap_remove_page() needs its return value checked - -Callers, namely such subsequently freeing the page, must not blindly -assume success - the function may namely fail when needing to shatter a -super page, but there not being memory available for the then needed -intermediate page table. - -As it happens, guest_remove_page() callers now also all check the -return value. - -Furthermore a missed put_gfn() on an error path in gnttab_transfer() is -also being taken care of. - -This is part of XSA-222. - -Reported-by: Julien Grall <julien.grall@arm.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: Julien Grall <julien.grall@arm.com> -Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> - ---- a/xen/arch/arm/mm.c -+++ b/xen/arch/arm/mm.c -@@ -1340,13 +1340,14 @@ int replace_grant_host_mapping(unsigned - { - gfn_t gfn = _gfn(addr >> PAGE_SHIFT); - struct domain *d = current->domain; -+ int rc; - - if ( new_addr != 0 || (flags & GNTMAP_contains_pte) ) - return GNTST_general_error; - -- guest_physmap_remove_page(d, gfn, _mfn(mfn), 0); -+ rc = guest_physmap_remove_page(d, gfn, _mfn(mfn), 0); - -- return GNTST_okay; -+ return rc ? GNTST_general_error : GNTST_okay; - } - - int is_iomem_page(unsigned long mfn) ---- a/xen/arch/arm/p2m.c -+++ b/xen/arch/arm/p2m.c -@@ -1211,11 +1211,10 @@ int guest_physmap_add_entry(struct domai - return p2m_insert_mapping(d, gfn, (1 << page_order), mfn, t); - } - --void guest_physmap_remove_page(struct domain *d, -- gfn_t gfn, -- mfn_t mfn, unsigned int page_order) -+int guest_physmap_remove_page(struct domain *d, gfn_t gfn, mfn_t mfn, -+ unsigned int page_order) - { -- p2m_remove_mapping(d, gfn, (1 << page_order), mfn); -+ return p2m_remove_mapping(d, gfn, (1 << page_order), mfn); - } - - static int p2m_alloc_table(struct domain *d) ---- a/xen/arch/x86/domain.c -+++ b/xen/arch/x86/domain.c -@@ -808,7 +808,15 @@ int arch_domain_soft_reset(struct domain - ret = -ENOMEM; - goto exit_put_gfn; - } -- guest_physmap_remove_page(d, _gfn(gfn), _mfn(mfn), PAGE_ORDER_4K); -+ -+ ret = guest_physmap_remove_page(d, _gfn(gfn), _mfn(mfn), PAGE_ORDER_4K); -+ if ( ret ) -+ { -+ printk(XENLOG_G_ERR "Failed to remove Dom%d's shared_info frame %lx\n", -+ d->domain_id, gfn); -+ free_domheap_page(new_page); -+ goto exit_put_gfn; -+ } - - ret = guest_physmap_add_page(d, _gfn(gfn), _mfn(page_to_mfn(new_page)), - PAGE_ORDER_4K); ---- a/xen/arch/x86/domain_build.c -+++ b/xen/arch/x86/domain_build.c -@@ -427,7 +427,9 @@ static __init void pvh_add_mem_mapping(s - if ( !iomem_access_permitted(d, mfn + i, mfn + i) ) - { - omfn = get_gfn_query_unlocked(d, gfn + i, &t); -- guest_physmap_remove_page(d, _gfn(gfn + i), omfn, PAGE_ORDER_4K); -+ if ( guest_physmap_remove_page(d, _gfn(gfn + i), omfn, -+ PAGE_ORDER_4K) ) -+ /* nothing, best effort only */; - continue; - } - ---- a/xen/arch/x86/hvm/ioreq.c -+++ b/xen/arch/x86/hvm/ioreq.c -@@ -267,8 +267,9 @@ bool_t is_ioreq_server_page(struct domai - static void hvm_remove_ioreq_gmfn( - struct domain *d, struct hvm_ioreq_page *iorp) - { -- guest_physmap_remove_page(d, _gfn(iorp->gmfn), -- _mfn(page_to_mfn(iorp->page)), 0); -+ if ( guest_physmap_remove_page(d, _gfn(iorp->gmfn), -+ _mfn(page_to_mfn(iorp->page)), 0) ) -+ domain_crash(d); - clear_page(iorp->va); - } - ---- a/xen/arch/x86/mm.c -+++ b/xen/arch/x86/mm.c -@@ -4276,7 +4276,11 @@ static int replace_grant_p2m_mapping( - type, mfn_x(old_mfn), frame); - return GNTST_general_error; - } -- guest_physmap_remove_page(d, _gfn(gfn), _mfn(frame), PAGE_ORDER_4K); -+ if ( guest_physmap_remove_page(d, _gfn(gfn), _mfn(frame), PAGE_ORDER_4K) ) -+ { -+ put_gfn(d, gfn); -+ return GNTST_general_error; -+ } - - put_gfn(d, gfn); - return GNTST_okay; -@@ -4798,7 +4802,7 @@ int xenmem_add_to_physmap_one( - struct page_info *page = NULL; - unsigned long gfn = 0; /* gcc ... */ - unsigned long prev_mfn, mfn = 0, old_gpfn; -- int rc; -+ int rc = 0; - p2m_type_t p2mt; - - switch ( space ) -@@ -4872,25 +4876,30 @@ int xenmem_add_to_physmap_one( - { - if ( is_xen_heap_mfn(prev_mfn) ) - /* Xen heap frames are simply unhooked from this phys slot. */ -- guest_physmap_remove_page(d, gpfn, _mfn(prev_mfn), PAGE_ORDER_4K); -+ rc = guest_physmap_remove_page(d, gpfn, _mfn(prev_mfn), PAGE_ORDER_4K); - else - /* Normal domain memory is freed, to avoid leaking memory. */ -- guest_remove_page(d, gfn_x(gpfn)); -+ rc = guest_remove_page(d, gfn_x(gpfn)); - } - /* In the XENMAPSPACE_gmfn case we still hold a ref on the old page. */ - put_gfn(d, gfn_x(gpfn)); - -+ if ( rc ) -+ goto put_both; -+ - /* Unmap from old location, if any. */ - old_gpfn = get_gpfn_from_mfn(mfn); - ASSERT( old_gpfn != SHARED_M2P_ENTRY ); - if ( space == XENMAPSPACE_gmfn || space == XENMAPSPACE_gmfn_range ) - ASSERT( old_gpfn == gfn ); - if ( old_gpfn != INVALID_M2P_ENTRY ) -- guest_physmap_remove_page(d, _gfn(old_gpfn), _mfn(mfn), PAGE_ORDER_4K); -+ rc = guest_physmap_remove_page(d, _gfn(old_gpfn), _mfn(mfn), PAGE_ORDER_4K); - - /* Map at new location. */ -- rc = guest_physmap_add_page(d, gpfn, _mfn(mfn), PAGE_ORDER_4K); -+ if ( !rc ) -+ rc = guest_physmap_add_page(d, gpfn, _mfn(mfn), PAGE_ORDER_4K); - -+ put_both: - /* In the XENMAPSPACE_gmfn, we took a ref of the gfn at the top */ - if ( space == XENMAPSPACE_gmfn || space == XENMAPSPACE_gmfn_range ) - put_gfn(d, gfn); ---- a/xen/arch/x86/mm/p2m.c -+++ b/xen/arch/x86/mm/p2m.c -@@ -2925,10 +2925,12 @@ int p2m_add_foreign(struct domain *tdom, - { - if ( is_xen_heap_mfn(mfn_x(prev_mfn)) ) - /* Xen heap frames are simply unhooked from this phys slot */ -- guest_physmap_remove_page(tdom, _gfn(gpfn), prev_mfn, 0); -+ rc = guest_physmap_remove_page(tdom, _gfn(gpfn), prev_mfn, 0); - else - /* Normal domain memory is freed, to avoid leaking memory. */ -- guest_remove_page(tdom, gpfn); -+ rc = guest_remove_page(tdom, gpfn); -+ if ( rc ) -+ goto put_both; - } - /* - * Create the new mapping. Can't use guest_physmap_add_page() because it -@@ -2941,6 +2943,7 @@ int p2m_add_foreign(struct domain *tdom, - "gpfn:%lx mfn:%lx fgfn:%lx td:%d fd:%d\n", - gpfn, mfn_x(mfn), fgfn, tdom->domain_id, fdom->domain_id); - -+ put_both: - put_page(page); - - /* ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -1768,6 +1768,7 @@ gnttab_transfer( - for ( i = 0; i < count; i++ ) - { - bool_t okay; -+ int rc; - - if (i && hypercall_preempt_check()) - return i; -@@ -1818,27 +1819,33 @@ gnttab_transfer( - goto copyback; - } - -- guest_physmap_remove_page(d, _gfn(gop.mfn), _mfn(mfn), 0); -+ rc = guest_physmap_remove_page(d, _gfn(gop.mfn), _mfn(mfn), 0); - gnttab_flush_tlb(d); -+ if ( rc ) -+ { -+ gdprintk(XENLOG_INFO, -+ "gnttab_transfer: can't remove GFN %"PRI_xen_pfn" (MFN %lx)\n", -+ gop.mfn, mfn); -+ gop.status = GNTST_general_error; -+ goto put_gfn_and_copyback; -+ } - - /* Find the target domain. */ - if ( unlikely((e = rcu_lock_domain_by_id(gop.domid)) == NULL) ) - { -- put_gfn(d, gop.mfn); - gdprintk(XENLOG_INFO, "gnttab_transfer: can't find domain %d\n", - gop.domid); -- page->count_info &= ~(PGC_count_mask|PGC_allocated); -- free_domheap_page(page); - gop.status = GNTST_bad_domain; -- goto copyback; -+ goto put_gfn_and_copyback; - } - - if ( xsm_grant_transfer(XSM_HOOK, d, e) ) - { -- put_gfn(d, gop.mfn); - gop.status = GNTST_permission_denied; - unlock_and_copyback: - rcu_unlock_domain(e); -+ put_gfn_and_copyback: -+ put_gfn(d, gop.mfn); - page->count_info &= ~(PGC_count_mask|PGC_allocated); - free_domheap_page(page); - goto copyback; -@@ -1887,12 +1894,8 @@ gnttab_transfer( - "Transferee (d%d) has no headroom (tot %u, max %u)\n", - e->domain_id, e->tot_pages, e->max_pages); - -- rcu_unlock_domain(e); -- put_gfn(d, gop.mfn); -- page->count_info &= ~(PGC_count_mask|PGC_allocated); -- free_domheap_page(page); - gop.status = GNTST_general_error; -- goto copyback; -+ goto unlock_and_copyback; - } - - /* Okay, add the page to 'e'. */ -@@ -1921,13 +1924,8 @@ gnttab_transfer( - - if ( drop_dom_ref ) - put_domain(e); -- rcu_unlock_domain(e); -- -- put_gfn(d, gop.mfn); -- page->count_info &= ~(PGC_count_mask|PGC_allocated); -- free_domheap_page(page); - gop.status = GNTST_general_error; -- goto copyback; -+ goto unlock_and_copyback; - } - - page_list_add_tail(page, &e->page_list); ---- a/xen/common/memory.c -+++ b/xen/common/memory.c -@@ -272,8 +272,12 @@ int guest_remove_page(struct domain *d, - mfn = get_gfn_query(d, gmfn, &p2mt); - if ( unlikely(p2m_is_paging(p2mt)) ) - { -- guest_physmap_remove_page(d, _gfn(gmfn), mfn, 0); -+ rc = guest_physmap_remove_page(d, _gfn(gmfn), mfn, 0); - put_gfn(d, gmfn); -+ -+ if ( rc ) -+ return rc; -+ - /* If the page hasn't yet been paged out, there is an - * actual page that needs to be released. */ - if ( p2mt == p2m_ram_paging_out ) -@@ -337,7 +341,9 @@ int guest_remove_page(struct domain *d, - return -ENXIO; - } - -- if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) ) -+ rc = guest_physmap_remove_page(d, _gfn(gmfn), mfn, 0); -+ -+ if ( !rc && test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) ) - put_page_and_type(page); - - /* -@@ -348,16 +354,14 @@ int guest_remove_page(struct domain *d, - * For this purpose (and to match populate_physmap() behavior), the page - * is kept allocated. - */ -- if ( !is_domain_direct_mapped(d) && -+ if ( !rc && !is_domain_direct_mapped(d) && - test_and_clear_bit(_PGC_allocated, &page->count_info) ) - put_page(page); - -- guest_physmap_remove_page(d, _gfn(gmfn), mfn, 0); -- - put_page(page); - put_gfn(d, gmfn); - -- return 0; -+ return rc; - } - - static void decrease_reservation(struct memop_args *a) -@@ -592,7 +596,8 @@ static long memory_exchange(XEN_GUEST_HA - gfn = mfn_to_gmfn(d, mfn); - /* Pages were unshared above */ - BUG_ON(SHARED_M2P(gfn)); -- guest_physmap_remove_page(d, _gfn(gfn), _mfn(mfn), 0); -+ if ( guest_physmap_remove_page(d, _gfn(gfn), _mfn(mfn), 0) ) -+ domain_crash(d); - put_page(page); - } - -@@ -1151,8 +1156,8 @@ long do_memory_op(unsigned long cmd, XEN - page = get_page_from_gfn(d, xrfp.gpfn, NULL, P2M_ALLOC); - if ( page ) - { -- guest_physmap_remove_page(d, _gfn(xrfp.gpfn), -- _mfn(page_to_mfn(page)), 0); -+ rc = guest_physmap_remove_page(d, _gfn(xrfp.gpfn), -+ _mfn(page_to_mfn(page)), 0); - put_page(page); - } - else ---- a/xen/drivers/passthrough/arm/smmu.c -+++ b/xen/drivers/passthrough/arm/smmu.c -@@ -2786,9 +2786,7 @@ static int __must_check arm_smmu_unmap_p - if ( !is_domain_direct_mapped(d) ) - return -EINVAL; - -- guest_physmap_remove_page(d, _gfn(gfn), _mfn(gfn), 0); -- -- return 0; -+ return guest_physmap_remove_page(d, _gfn(gfn), _mfn(gfn), 0); - } - - static const struct iommu_ops arm_smmu_iommu_ops = { ---- a/xen/include/asm-arm/p2m.h -+++ b/xen/include/asm-arm/p2m.h -@@ -268,10 +268,6 @@ static inline int guest_physmap_add_page - return guest_physmap_add_entry(d, gfn, mfn, page_order, p2m_ram_rw); - } - --void guest_physmap_remove_page(struct domain *d, -- gfn_t gfn, -- mfn_t mfn, unsigned int page_order); -- - mfn_t gfn_to_mfn(struct domain *d, gfn_t gfn); - - /* ---- a/xen/include/asm-x86/p2m.h -+++ b/xen/include/asm-x86/p2m.h -@@ -561,10 +561,6 @@ static inline int guest_physmap_add_page - return guest_physmap_add_entry(d, gfn, mfn, page_order, p2m_ram_rw); - } - --/* Remove a page from a domain's p2m table */ --int guest_physmap_remove_page(struct domain *d, -- gfn_t gfn, mfn_t mfn, unsigned int page_order); -- - /* Set a p2m range as populate-on-demand */ - int guest_physmap_mark_populate_on_demand(struct domain *d, unsigned long gfn, - unsigned int order); ---- a/xen/include/xen/p2m-common.h -+++ b/xen/include/xen/p2m-common.h -@@ -1,6 +1,7 @@ - #ifndef _XEN_P2M_COMMON_H - #define _XEN_P2M_COMMON_H - -+#include <xen/mm.h> - #include <public/vm_event.h> - - /* -@@ -33,6 +34,11 @@ typedef enum { - /* NOTE: Assumed to be only 4 bits right now on x86. */ - } p2m_access_t; - -+/* Remove a page from a domain's p2m table */ -+int __must_check -+guest_physmap_remove_page(struct domain *d, gfn_t gfn, mfn_t mfn, -+ unsigned int page_order); -+ - /* Map MMIO regions in the p2m: start_gfn and nr describe the range in - * * the guest physical address space to map, starting from the machine - * * frame number mfn. */ ---- a/xen/include/xen/mm.h -+++ b/xen/include/xen/mm.h -@@ -554,7 +554,7 @@ int xenmem_add_to_physmap_one(struct dom - unsigned long idx, gfn_t gfn); - - /* Returns 0 on success, or negative on error. */ --int guest_remove_page(struct domain *d, unsigned long gmfn); -+int __must_check guest_remove_page(struct domain *d, unsigned long gmfn); - - #define RAM_TYPE_CONVENTIONAL 0x00000001 - #define RAM_TYPE_RESERVED 0x00000002 diff --git a/system/xen/xsa/xsa223.patch b/system/xen/xsa/xsa223.patch deleted file mode 100644 index 42f116b70c..0000000000 --- a/system/xen/xsa/xsa223.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: Julien Grall <julien.grall@arm.com> -Subject: arm: vgic: Don't update the LR when the IRQ is not enabled - -gic_raise_inflight_irq will be called if the IRQ is already inflight -(i.e the IRQ is injected to the guest). If the IRQ is already already in -the LRs, then the associated LR will be updated. - -To know if the interrupt is already in the LR, the function check if the -interrupt is queued. However, if the interrupt is not enabled then the -interrupt may not be queued nor in the LR. So gic_update_one_lr may be -called (if we inject on the current vCPU) and read the LR. - -Because the interrupt is not in the LR, Xen will either read: - * LR 0 if the interrupt was never injected before - * LR 255 (GIC_INVALID_LR) if the interrupt was injected once. This - is because gic_update_one_lr will reset p->lr. - -Reading LR 0 will result to potentially update the wrong interrupt and -not keep the LRs in sync with Xen. - -Reading LR 255 will result to: - * Crash Xen on GICv3 as the LR index is bigger than supported (see - gicv3_ich_read_lr). - * Read/write always GICH_LR + 255 * 4 that is not part of the memory - mapped. - -The problem can be prevented by checking whether the interrupt is -enabled in gic_raise_inflight_irq before calling gic_update_one_lr. - -A follow-up of this patch is expected to mitigate the issue in the -future. - -This is XSA-223. - -Reported-by: Julien Grall <julien.grall@arm.com> -Signed-off-by: Julien Grall <julien.grall@arm.com> -Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> ---- - xen/arch/arm/gic.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/xen/arch/arm/gic.c -+++ b/xen/arch/arm/gic.c -@@ -417,6 +417,10 @@ void gic_raise_inflight_irq(struct vcpu *v, unsigned int virtual_irq) - - ASSERT(spin_is_locked(&v->arch.vgic.lock)); - -+ /* Don't try to update the LR if the interrupt is disabled */ -+ if ( !test_bit(GIC_IRQ_GUEST_ENABLED, &n->status) ) -+ return; -+ - if ( list_empty(&n->lr_queue) ) - { - if ( v == current ) diff --git a/system/xen/xsa/xsa224-0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch b/system/xen/xsa/xsa224-0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch deleted file mode 100644 index 6a55f86b07..0000000000 --- a/system/xen/xsa/xsa224-0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch +++ /dev/null @@ -1,111 +0,0 @@ -From 9808ed0b1ebc3a5d2aa08a9ff91fcf3ecb42bc9f Mon Sep 17 00:00:00 2001 -From: George Dunlap <george.dunlap@citrix.com> -Date: Thu, 15 Jun 2017 16:24:02 +0100 -Subject: [PATCH 1/4] gnttab: Fix handling of dev_bus_addr during unmap - -If a grant has been mapped with the GNTTAB_device_map flag, calling -grant_unmap_ref() with dev_bus_addr set to zero should cause the -GNTTAB_device_map part of the mapping to be left alone. - -Unfortunately, at the moment, op->dev_bus_addr is implicitly checked -before clearing the map and adjusting the pin count, but only the bits -above 12; and it is not checked at all before dropping page -references. This means a guest can repeatedly make such a call to -cause the reference count to drop to zero, causing the page to be -freed and re-used, even though it's still mapped in its pagetables. - -To fix this, always check op->dev_bus_addr explicitly for being -non-zero, as well as op->flag & GNTMAP_device_map, before doing -operations on the device_map. - -While we're here, make the logic a bit cleaner: - -* Always initialize op->frame to zero and set it from act->frame, to reduce the -chance of untrusted input being used - -* Explicitly check the full dev_bus_addr against act->frame << - PAGE_SHIFT, rather than ignoring the lower 12 bits - -This is part of XSA-224. - -Reported-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: George Dunlap <george.dunlap@citrix.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 23 +++++++++++------------ - 1 file changed, 11 insertions(+), 12 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index ba10e76..2671761 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -1085,8 +1085,6 @@ __gnttab_unmap_common( - ld = current->domain; - lgt = ld->grant_table; - -- op->frame = (unsigned long)(op->dev_bus_addr >> PAGE_SHIFT); -- - if ( unlikely(op->handle >= lgt->maptrack_limit) ) - { - gdprintk(XENLOG_INFO, "Bad handle (%d).\n", op->handle); -@@ -1169,16 +1167,14 @@ __gnttab_unmap_common( - goto act_release_out; - } - -- if ( op->frame == 0 ) -- { -- op->frame = act->frame; -- } -- else -+ op->frame = act->frame; -+ -+ if ( op->dev_bus_addr ) - { -- if ( unlikely(op->frame != act->frame) ) -+ if ( unlikely(op->dev_bus_addr != pfn_to_paddr(act->frame)) ) - PIN_FAIL(act_release_out, GNTST_general_error, -- "Bad frame number doesn't match gntref. (%lx != %lx)\n", -- op->frame, act->frame); -+ "Bus address doesn't match gntref (%"PRIx64" != %"PRIpaddr")\n", -+ op->dev_bus_addr, pfn_to_paddr(act->frame)); - - map->flags &= ~GNTMAP_device_map; - } -@@ -1271,7 +1267,8 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - else - status = &status_entry(rgt, op->ref); - -- if ( unlikely(op->frame != act->frame) ) -+ if ( op->dev_bus_addr && -+ unlikely(op->dev_bus_addr != pfn_to_paddr(act->frame)) ) - { - /* - * Suggests that __gntab_unmap_common failed early and so -@@ -1282,7 +1279,7 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - - pg = mfn_to_page(op->frame); - -- if ( op->flags & GNTMAP_device_map ) -+ if ( op->dev_bus_addr && (op->flags & GNTMAP_device_map) ) - { - if ( !is_iomem_page(act->frame) ) - { -@@ -1353,6 +1350,7 @@ __gnttab_unmap_grant_ref( - /* Intialise these in case common contains old state */ - common->new_addr = 0; - common->rd = NULL; -+ common->frame = 0; - - __gnttab_unmap_common(common); - op->status = common->status; -@@ -1417,6 +1415,7 @@ __gnttab_unmap_and_replace( - /* Intialise these in case common contains old state */ - common->dev_bus_addr = 0; - common->rd = NULL; -+ common->frame = 0; - - __gnttab_unmap_common(common); - op->status = common->status; --- -2.1.4 - diff --git a/system/xen/xsa/xsa224-0002-gnttab-never-create-host-mapping-unless-asked-to.patch b/system/xen/xsa/xsa224-0002-gnttab-never-create-host-mapping-unless-asked-to.patch deleted file mode 100644 index bea0214db0..0000000000 --- a/system/xen/xsa/xsa224-0002-gnttab-never-create-host-mapping-unless-asked-to.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 2d6357522946bd5a105066db8079e5dd46cb3047 Mon Sep 17 00:00:00 2001 -From: Jan Beulich <jbeulich@suse.com> -Date: Fri, 2 Jun 2017 15:21:27 +0100 -Subject: [PATCH 2/4] gnttab: never create host mapping unless asked to - -We shouldn't create a host mapping unless asked to even in the case of -mapping a granted MMIO page. In particular the mapping wouldn't be torn -down when processing the matching unmap request. - -This is part of XSA-224. - -Reported-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index 2671761..5baae24 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -907,10 +907,13 @@ __gnttab_map_grant_ref( - goto undo_out; - } - -- rc = create_grant_host_mapping( -- op->host_addr, frame, op->flags, cache_flags); -- if ( rc != GNTST_okay ) -- goto undo_out; -+ if ( op->flags & GNTMAP_host_map ) -+ { -+ rc = create_grant_host_mapping(op->host_addr, frame, op->flags, -+ cache_flags); -+ if ( rc != GNTST_okay ) -+ goto undo_out; -+ } - } - else if ( owner == rd || owner == dom_cow ) - { --- -2.1.4 - diff --git a/system/xen/xsa/xsa224-0003-gnttab-correct-logic-to-get-page-references-during-m.patch b/system/xen/xsa/xsa224-0003-gnttab-correct-logic-to-get-page-references-during-m.patch deleted file mode 100644 index f2d26d5fff..0000000000 --- a/system/xen/xsa/xsa224-0003-gnttab-correct-logic-to-get-page-references-during-m.patch +++ /dev/null @@ -1,186 +0,0 @@ -From 4e718be6f59526927d5cd31ecd80c5c758dca3f5 Mon Sep 17 00:00:00 2001 -From: George Dunlap <george.dunlap@citrix.com> -Date: Fri, 2 Jun 2017 15:21:27 +0100 -Subject: [PATCH 3/4] gnttab: correct logic to get page references during map - requests - -The rules for reference counting are somewhat complicated: - -* Each of GNTTAB_host_map and GNTTAB_device_map need their own -reference count - -* If the mapping is writeable: - - GNTTAB_host_map needs a type count under only some conditions - - GNTTAB_device_map always needs a type count - -If the mapping succeeds, we need to keep all of these; if the mapping -fails, we need to release whatever references we have acquired so far. - -Additionally, the code that does a lot of this calculation "inherits" -a reference as part of the process of finding out who the owner is. - -Finally, if the grant is mapped as writeable (without the -GNTMAP_readonly flag), but the hypervisor cannot grab a -PGT_writeable_page type, the entire operation should fail. - -Unfortunately, the current code has several logic holes: - -* If a grant is mapped only GNTTAB_device_map, and with a writeable - mapping, but in conditions where a *host* type count is not - necessary, the code will fail to grab the necessary type count. - -* If a grant is mapped both GNTTAB_device_map and GNTTAB_host_map, - with a writeable mapping, in conditions where the host type count is - not necessary, *and* where the page cannot be changed to type - PGT_writeable, the condition will not be detected. - -In both cases, this means that on success, the type count will be -erroneously reduced when the grant is unmapped. In the second case, -the type count will be erroneously reduced on the failure path as -well. (In the first case the failure path logic has the same hole -as the reference grabbing logic.) - -Additionally, the return value of get_page() is not checked; but this -may fail even if the first get_page() succeeded due to a reference -counting overflow. - -First of all, simplify the restoration logic by explicitly counting -the reference and type references acquired. - -Consider each mapping type separately, explicitly marking the -'incoming' reference as used so we know when we need to grab a second -one. - -Finally, always check the return value of get_page[_type]() and go to -the failure path if appropriate. - -This is part of XSA-224. - -Reported-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: George Dunlap <george.dunlap@citrix.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 58 +++++++++++++++++++++++++++--------------------- - 1 file changed, 33 insertions(+), 25 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index 5baae24..d07b931 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -754,12 +754,12 @@ __gnttab_map_grant_ref( - struct grant_table *lgt, *rgt; - struct vcpu *led; - int handle; -- unsigned long frame = 0, nr_gets = 0; -+ unsigned long frame = 0; - struct page_info *pg = NULL; - int rc = GNTST_okay; - u32 old_pin; - u32 act_pin; -- unsigned int cache_flags; -+ unsigned int cache_flags, refcnt = 0, typecnt = 0; - struct active_grant_entry *act = NULL; - struct grant_mapping *mt; - grant_entry_header_t *shah; -@@ -885,11 +885,17 @@ __gnttab_map_grant_ref( - else - owner = page_get_owner(pg); - -+ if ( owner ) -+ refcnt++; -+ - if ( !pg || (owner == dom_io) ) - { - /* Only needed the reference to confirm dom_io ownership. */ - if ( pg ) -+ { - put_page(pg); -+ refcnt--; -+ } - - if ( paging_mode_external(ld) ) - { -@@ -917,27 +923,38 @@ __gnttab_map_grant_ref( - } - else if ( owner == rd || owner == dom_cow ) - { -- if ( gnttab_host_mapping_get_page_type(op, ld, rd) ) -+ if ( (op->flags & GNTMAP_device_map) && !(op->flags & GNTMAP_readonly) ) - { - if ( (owner == dom_cow) || - !get_page_type(pg, PGT_writable_page) ) - goto could_not_pin; -+ typecnt++; - } - -- nr_gets++; - if ( op->flags & GNTMAP_host_map ) - { -- rc = create_grant_host_mapping(op->host_addr, frame, op->flags, 0); -- if ( rc != GNTST_okay ) -- goto undo_out; -- -+ /* -+ * Only need to grab another reference if device_map claimed -+ * the other one. -+ */ - if ( op->flags & GNTMAP_device_map ) - { -- nr_gets++; -- (void)get_page(pg, rd); -- if ( !(op->flags & GNTMAP_readonly) ) -- get_page_type(pg, PGT_writable_page); -+ if ( !get_page(pg, rd) ) -+ goto could_not_pin; -+ refcnt++; -+ } -+ -+ if ( gnttab_host_mapping_get_page_type(op, ld, rd) ) -+ { -+ if ( (owner == dom_cow) || -+ !get_page_type(pg, PGT_writable_page) ) -+ goto could_not_pin; -+ typecnt++; - } -+ -+ rc = create_grant_host_mapping(op->host_addr, frame, op->flags, 0); -+ if ( rc != GNTST_okay ) -+ goto undo_out; - } - } - else -@@ -946,8 +963,6 @@ __gnttab_map_grant_ref( - if ( !rd->is_dying ) - gdprintk(XENLOG_WARNING, "Could not pin grant frame %lx\n", - frame); -- if ( owner != NULL ) -- put_page(pg); - rc = GNTST_general_error; - goto undo_out; - } -@@ -1010,18 +1025,11 @@ __gnttab_map_grant_ref( - return; - - undo_out: -- if ( nr_gets > 1 ) -- { -- if ( !(op->flags & GNTMAP_readonly) ) -- put_page_type(pg); -- put_page(pg); -- } -- if ( nr_gets > 0 ) -- { -- if ( gnttab_host_mapping_get_page_type(op, ld, rd) ) -- put_page_type(pg); -+ while ( typecnt-- ) -+ put_page_type(pg); -+ -+ while ( refcnt-- ) - put_page(pg); -- } - - grant_read_lock(rgt); - --- -2.1.4 - diff --git a/system/xen/xsa/xsa224-0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch b/system/xen/xsa/xsa224-0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch deleted file mode 100644 index 9c1bd40bec..0000000000 --- a/system/xen/xsa/xsa224-0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch +++ /dev/null @@ -1,319 +0,0 @@ -From d27237abe37e45a1f245e23484062b09ff3477ed Mon Sep 17 00:00:00 2001 -From: Jan Beulich <jbeulich@suse.com> -Date: Thu, 15 Jun 2017 16:25:27 +0100 -Subject: [PATCH 4/4] gnttab: __gnttab_unmap_common_complete() is - all-or-nothing - -All failures have to be detected in __gnttab_unmap_common(), the -completion function must not skip part of its processing. In particular -the GNTMAP_device_map related putting of page references and adjustment -of pin count must not occur if __gnttab_unmap_common() signaled an -error. Furthermore the function must not make adjustments to global -state (here: clearing GNTTAB_device_map) before all possibly failing -operations have been performed. - -There's one exception for IOMMU related failures: As IOMMU manipulation -occurs after GNTMAP_*_map have been cleared already, the related page -reference and pin count adjustments need to be done nevertheless. A -fundamental requirement for the correctness of this is that -iommu_{,un}map_page() crash any affected DomU in case of failure. - -The version check appears to be pointless (or could perhaps be a -BUG_ON() or ASSERT()), but for the moment also move it. - -This is part of XSA-224. - -Reported-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: Jan Beulich <jbeulich@suse.com> ---- - xen/common/grant_table.c | 108 ++++++++++++++++++-------------------- - xen/include/asm-arm/grant_table.h | 2 +- - xen/include/asm-x86/grant_table.h | 5 +- - 3 files changed, 55 insertions(+), 60 deletions(-) - -diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c -index d07b931..7ea68b1 100644 ---- a/xen/common/grant_table.c -+++ b/xen/common/grant_table.c -@@ -96,7 +96,7 @@ struct gnttab_unmap_common { - int16_t status; - - /* Shared state beteen *_unmap and *_unmap_complete */ -- u16 flags; -+ u16 done; - unsigned long frame; - struct domain *rd; - grant_ref_t ref; -@@ -944,7 +944,8 @@ __gnttab_map_grant_ref( - refcnt++; - } - -- if ( gnttab_host_mapping_get_page_type(op, ld, rd) ) -+ if ( gnttab_host_mapping_get_page_type(op->flags & GNTMAP_readonly, -+ ld, rd) ) - { - if ( (owner == dom_cow) || - !get_page_type(pg, PGT_writable_page) ) -@@ -1091,6 +1092,7 @@ __gnttab_unmap_common( - struct active_grant_entry *act; - s16 rc = 0; - struct grant_mapping *map; -+ unsigned int flags; - bool put_handle = false; - - ld = current->domain; -@@ -1140,6 +1142,20 @@ __gnttab_unmap_common( - - grant_read_lock(rgt); - -+ if ( rgt->gt_version == 0 ) -+ { -+ /* -+ * This ought to be impossible, as such a mapping should not have -+ * been established (see the nr_grant_entries(rgt) bounds check in -+ * __gnttab_map_grant_ref()). Doing this check only in -+ * __gnttab_unmap_common_complete() - as it used to be done - would, -+ * however, be too late. -+ */ -+ rc = GNTST_bad_gntref; -+ flags = 0; -+ goto unlock_out; -+ } -+ - op->rd = rd; - op->ref = map->ref; - -@@ -1155,6 +1171,7 @@ __gnttab_unmap_common( - { - gdprintk(XENLOG_WARNING, "Unstable handle %u\n", op->handle); - rc = GNTST_bad_handle; -+ flags = 0; - goto unlock_out; - } - -@@ -1168,9 +1185,9 @@ __gnttab_unmap_common( - * hold anyway; see docs/misc/grant-tables.txt's "Locking" section. - */ - -- op->flags = read_atomic(&map->flags); -+ flags = read_atomic(&map->flags); - smp_rmb(); -- if ( unlikely(!op->flags) || unlikely(map->domid != dom) || -+ if ( unlikely(!flags) || unlikely(map->domid != dom) || - unlikely(map->ref != op->ref) ) - { - gdprintk(XENLOG_WARNING, "Unstable handle %#x\n", op->handle); -@@ -1180,24 +1197,27 @@ __gnttab_unmap_common( - - op->frame = act->frame; - -- if ( op->dev_bus_addr ) -- { -- if ( unlikely(op->dev_bus_addr != pfn_to_paddr(act->frame)) ) -- PIN_FAIL(act_release_out, GNTST_general_error, -- "Bus address doesn't match gntref (%"PRIx64" != %"PRIpaddr")\n", -- op->dev_bus_addr, pfn_to_paddr(act->frame)); -- -- map->flags &= ~GNTMAP_device_map; -- } -+ if ( op->dev_bus_addr && -+ unlikely(op->dev_bus_addr != pfn_to_paddr(act->frame)) ) -+ PIN_FAIL(act_release_out, GNTST_general_error, -+ "Bus address doesn't match gntref (%"PRIx64" != %"PRIpaddr")\n", -+ op->dev_bus_addr, pfn_to_paddr(act->frame)); - -- if ( (op->host_addr != 0) && (op->flags & GNTMAP_host_map) ) -+ if ( op->host_addr && (flags & GNTMAP_host_map) ) - { - if ( (rc = replace_grant_host_mapping(op->host_addr, - op->frame, op->new_addr, -- op->flags)) < 0 ) -+ flags)) < 0 ) - goto act_release_out; - - map->flags &= ~GNTMAP_host_map; -+ op->done |= GNTMAP_host_map | (flags & GNTMAP_readonly); -+ } -+ -+ if ( op->dev_bus_addr && (flags & GNTMAP_device_map) ) -+ { -+ map->flags &= ~GNTMAP_device_map; -+ op->done |= GNTMAP_device_map | (flags & GNTMAP_readonly); - } - - if ( !(map->flags & (GNTMAP_device_map|GNTMAP_host_map)) ) -@@ -1234,7 +1254,7 @@ __gnttab_unmap_common( - } - - /* If just unmapped a writable mapping, mark as dirtied */ -- if ( rc == GNTST_okay && !(op->flags & GNTMAP_readonly) ) -+ if ( rc == GNTST_okay && !(flags & GNTMAP_readonly) ) - gnttab_mark_dirty(rd, op->frame); - - op->status = rc; -@@ -1251,13 +1271,9 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - struct page_info *pg; - uint16_t *status; - -- if ( rd == NULL ) -+ if ( !op->done ) - { -- /* -- * Suggests that __gntab_unmap_common failed in -- * rcu_lock_domain_by_id() or earlier, and so we have nothing -- * to complete -- */ -+ /* __gntab_unmap_common() didn't do anything - nothing to complete. */ - return; - } - -@@ -1267,8 +1283,6 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - rgt = rd->grant_table; - - grant_read_lock(rgt); -- if ( rgt->gt_version == 0 ) -- goto unlock_out; - - act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); -@@ -1278,72 +1292,50 @@ __gnttab_unmap_common_complete(struct gnttab_unmap_common *op) - else - status = &status_entry(rgt, op->ref); - -- if ( op->dev_bus_addr && -- unlikely(op->dev_bus_addr != pfn_to_paddr(act->frame)) ) -- { -- /* -- * Suggests that __gntab_unmap_common failed early and so -- * nothing further to do -- */ -- goto act_release_out; -- } -- - pg = mfn_to_page(op->frame); - -- if ( op->dev_bus_addr && (op->flags & GNTMAP_device_map) ) -+ if ( op->done & GNTMAP_device_map ) - { - if ( !is_iomem_page(act->frame) ) - { -- if ( op->flags & GNTMAP_readonly ) -+ if ( op->done & GNTMAP_readonly ) - put_page(pg); - else - put_page_and_type(pg); - } - - ASSERT(act->pin & (GNTPIN_devw_mask | GNTPIN_devr_mask)); -- if ( op->flags & GNTMAP_readonly ) -+ if ( op->done & GNTMAP_readonly ) - act->pin -= GNTPIN_devr_inc; - else - act->pin -= GNTPIN_devw_inc; - } - -- if ( (op->host_addr != 0) && (op->flags & GNTMAP_host_map) ) -+ if ( op->done & GNTMAP_host_map ) - { -- if ( op->status != 0 ) -+ if ( !is_iomem_page(op->frame) ) - { -- /* -- * Suggests that __gntab_unmap_common failed in -- * replace_grant_host_mapping() or IOMMU handling, so nothing -- * further to do (short of re-establishing the mapping in the -- * latter case). -- */ -- goto act_release_out; -- } -- -- if ( !is_iomem_page(op->frame) ) -- { -- if ( gnttab_host_mapping_get_page_type(op, ld, rd) ) -+ if ( gnttab_host_mapping_get_page_type(op->done & GNTMAP_readonly, -+ ld, rd) ) - put_page_type(pg); - put_page(pg); - } - - ASSERT(act->pin & (GNTPIN_hstw_mask | GNTPIN_hstr_mask)); -- if ( op->flags & GNTMAP_readonly ) -+ if ( op->done & GNTMAP_readonly ) - act->pin -= GNTPIN_hstr_inc; - else - act->pin -= GNTPIN_hstw_inc; - } - - if ( ((act->pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask)) == 0) && -- !(op->flags & GNTMAP_readonly) ) -+ !(op->done & GNTMAP_readonly) ) - gnttab_clear_flag(_GTF_writing, status); - - if ( act->pin == 0 ) - gnttab_clear_flag(_GTF_reading, status); - -- act_release_out: - active_entry_release(act); -- unlock_out: - grant_read_unlock(rgt); - - rcu_unlock_domain(rd); -@@ -1359,6 +1351,7 @@ __gnttab_unmap_grant_ref( - common->handle = op->handle; - - /* Intialise these in case common contains old state */ -+ common->done = 0; - common->new_addr = 0; - common->rd = NULL; - common->frame = 0; -@@ -1424,6 +1417,7 @@ __gnttab_unmap_and_replace( - common->handle = op->handle; - - /* Intialise these in case common contains old state */ -+ common->done = 0; - common->dev_bus_addr = 0; - common->rd = NULL; - common->frame = 0; -@@ -3385,7 +3379,9 @@ gnttab_release_mappings( - if ( gnttab_release_host_mappings(d) && - !is_iomem_page(act->frame) ) - { -- if ( gnttab_host_mapping_get_page_type(map, d, rd) ) -+ if ( gnttab_host_mapping_get_page_type((map->flags & -+ GNTMAP_readonly), -+ d, rd) ) - put_page_type(pg); - put_page(pg); - } -diff --git a/xen/include/asm-arm/grant_table.h b/xen/include/asm-arm/grant_table.h -index eb02423..bc4d61a 100644 ---- a/xen/include/asm-arm/grant_table.h -+++ b/xen/include/asm-arm/grant_table.h -@@ -9,7 +9,7 @@ void gnttab_clear_flag(unsigned long nr, uint16_t *addr); - int create_grant_host_mapping(unsigned long gpaddr, - unsigned long mfn, unsigned int flags, unsigned int - cache_flags); --#define gnttab_host_mapping_get_page_type(op, d, rd) (0) -+#define gnttab_host_mapping_get_page_type(ro, ld, rd) (0) - int replace_grant_host_mapping(unsigned long gpaddr, unsigned long mfn, - unsigned long new_gpaddr, unsigned int flags); - void gnttab_mark_dirty(struct domain *d, unsigned long l); -diff --git a/xen/include/asm-x86/grant_table.h b/xen/include/asm-x86/grant_table.h -index 8c9bbcf..9ca631c 100644 ---- a/xen/include/asm-x86/grant_table.h -+++ b/xen/include/asm-x86/grant_table.h -@@ -58,9 +58,8 @@ static inline void gnttab_clear_flag(unsigned int nr, uint16_t *st) - } - - /* Foreign mappings of HHVM-guest pages do not modify the type count. */ --#define gnttab_host_mapping_get_page_type(op, ld, rd) \ -- (!((op)->flags & GNTMAP_readonly) && \ -- (((ld) == (rd)) || !paging_mode_external(rd))) -+#define gnttab_host_mapping_get_page_type(ro, ld, rd) \ -+ (!(ro) && (((ld) == (rd)) || !paging_mode_external(rd))) - - /* Done implicitly when page tables are destroyed. */ - #define gnttab_release_host_mappings(domain) ( paging_mode_external(domain) ) --- -2.1.4 - diff --git a/system/xen/xsa/xsa225.patch b/system/xen/xsa/xsa225.patch deleted file mode 100644 index 900487a631..0000000000 --- a/system/xen/xsa/xsa225.patch +++ /dev/null @@ -1,35 +0,0 @@ -From b0547f9c9707e0dc473601a166da32dfec1f526e Mon Sep 17 00:00:00 2001 -From: Julien Grall <julien.grall@arm.com> -Date: Tue, 6 Jun 2017 15:35:42 +0100 -Subject: [PATCH] xen/arm: vgic: Sanitize target mask used to send SGI - -The current function vgic_to_sgi does not sanitize the target mask and -may therefore get an invalid vCPU ID. This will result to an out of -bound access of d->vcpu[...] as there is no check whether the vCPU ID is -within the maximum supported by the guest. - -This was introduced by commit ea37fd2111 "xen/arm: split vgic driver -into generic and vgic-v2 driver". - -Signed-off-by: Julien Grall <julien.grall@arm.com> -Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> ---- - xen/arch/arm/vgic.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c -index 83569b09e7..c6c6f8cb66 100644 ---- a/xen/arch/arm/vgic.c -+++ b/xen/arch/arm/vgic.c -@@ -399,7 +399,8 @@ bool vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode, - for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 ) - { - vcpuid = base + i; -- if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) ) -+ if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL || -+ !is_vcpu_online(d->vcpu[vcpuid]) ) - { - gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \ - target->list=%hx, wrong CPUTargetList \n", --- -2.11.0 |