main/xen: upgrade to 4.7.1

11 files changed, 5 insertions, 816 deletions

diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD
index 9fadaa0fe1..d06b4243a0 100644
--- a/main/xen/APKBUILD
+++ b/main/xen/APKBUILD
@@ -2,8 +2,8 @@
 # Contributor: Roger Pau Monne <roger.pau@entel.upc.edu>
 # Maintainer: William Pitcock <nenolod@dereferenced.org>
 pkgname=xen
-pkgver=4.7.0
-pkgrel=5
+pkgver=4.7.1
+pkgrel=0
 pkgdesc="Xen hypervisor"
 url="http://www.xen.org/"
 arch="x86_64 armhf"
@@ -69,17 +69,6 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
 	http://xenbits.xen.org/xen-extfiles/zlib-$_ZLIB_VERSION.tar.gz
 	http://xenbits.xen.org/xen-extfiles/ipxe-git-$_IPXE_GIT_TAG.tar.gz
 
-	xsa182-unstable.patch
-	xsa183-unstable.patch
-	xsa184-qemut-master.patch
-	xsa184-qemuu-master.patch
-	xsa185.patch
-	xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
-	xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
-	xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
-	xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
-	xsa190.patch
-
 	qemu-coroutine-gthread.patch
 	qemu-xen_paths.patch
 
@@ -300,7 +289,7 @@ hypervisor() {
 	mv "$pkgdir"/boot "$subpkgdir"/
 }
 
-md5sums="3aa4e01bf37a3a5bc8572907cb88e649  xen-4.7.0.tar.gz
+md5sums="8e258d87a1008a3200eec6989e164fa4  xen-4.7.1.tar.gz
 dd60683d7057917e34630b4a787932e8  gmp-4.3.2.tar.bz2
 cd3f3eb54446be6003156158d51f4884  grub-0.97.tar.gz
 36cc57650cffda9a0269493be2a169bb  lwip-1.3.0.tar.gz
@@ -310,16 +299,6 @@ cec05e7785497c5e19da2f114b934ffd  pciutils-2.2.9.tar.bz2
 e26becb8a6a2b6695f6b3e8097593db8  tpm_emulator-0.7.4.tar.gz
 debc62758716a169df9f62e6ab2bc634  zlib-1.2.3.tar.gz
 7496268cebf47d5c9ccb0696e3b26065  ipxe-git-9a93db3f0947484e30e753bbd61a10b17336e20e.tar.gz
-d162fdb5a2def649a18e377dfb8c618e  xsa182-unstable.patch
-4e89035687d1fcdabe34610f947871ae  xsa183-unstable.patch
-95bc220677fc2bb9a3df4dc14a0b31f6  xsa184-qemut-master.patch
-cc0904605d03a9e4f6f21d16824e41c9  xsa184-qemuu-master.patch
-8ae22c70681f3daf97ee7ef8ad947e76  xsa185.patch
-9a2b74f2079ba0b7a6e2420e6887cc3a  xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
-7849473e564a01b348d9f60a53fefe65  xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
-c426383254acdcbb9466bbec2d6f8d9b  xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
-ed2ad5eaaa275dd64f9fdca3ef8a5ca7  xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
-73bd0fc4a4d51c7160eadf527adb1195  xsa190.patch
 de1a3db370b87cfb0bddb51796b50315  qemu-coroutine-gthread.patch
 08bfdf8caff5d631f53660bf3fd4edaf  qemu-xen_paths.patch
 e449bb3359b490804ffc7b0ae08d62a0  hotplug-vif-vtrill.patch
@@ -355,7 +334,7 @@ dcdd1de2c29e469e834a02ede4f47806  xendomains.confd
 9df68ac65dc3f372f5d61183abdc83ff  xen-consoles.logrotate
 6a2f777c16678d84039acf670d86fff6  xenqemu.confd
 e1c9e1c83a5cc49224608a48060bd677  xenqemu.initd"
-sha256sums="be5876144d49729572ae06142e0bb93f1c1f2695578141eff2931995add24623  xen-4.7.0.tar.gz
+sha256sums="e87f4b0575e78657ee23d31470a15ecf1ce8c3a92a771cda46bbcd4d0d671ffe  xen-4.7.1.tar.gz
 936162c0312886c21581002b79932829aa048cfaf9937c6265aeaa14f1cd1775  gmp-4.3.2.tar.bz2
 4e1d15d12dbd3e9208111d6b806ad5a9857ca8850c47877d36575b904559260b  grub-0.97.tar.gz
 772e4d550e07826665ed0528c071dd5404ef7dbe1825a38c8adbc2a00bca948f  lwip-1.3.0.tar.gz
@@ -365,16 +344,6 @@ f60ae61cfbd5da1d849d0beaa21f593c38dac9359f0b3ddc612f447408265b24  pciutils-2.2.9
 4e48ea0d83dd9441cc1af04ab18cd6c961b9fa54d5cbf2c2feee038988dea459  tpm_emulator-0.7.4.tar.gz
 1795c7d067a43174113fdf03447532f373e1c6c57c08d61d9e4e9be5e244b05e  zlib-1.2.3.tar.gz
 632ce8c193ccacc3012bd354bdb733a4be126f7c098e111930aa41dad537405c  ipxe-git-9a93db3f0947484e30e753bbd61a10b17336e20e.tar.gz
-303400b9a832a3c1d423cc2cc97c2f00482793722f9ef7dd246783a049ac2792  xsa182-unstable.patch
-ea0ea4b294332814330f222e6d78eea3b19c394eac8ae22feb4a5bd21e90331f  xsa183-unstable.patch
-88c939c64b8f9fc9f86d0a30517d5455462d1ff837aa4285a9cb189b54c0cf20  xsa184-qemut-master.patch
-3877e19992c4532b8b2a37e151fe6a6187a1bbee2b54c1718b995260bb0fcf65  xsa184-qemuu-master.patch
-3328a1953ecdf4de35462ea8396b0927171d718e95f73a87a7f651427bd8f8b4  xsa185.patch
-f2082a36d968a47e477bb5082d0e0aaa58e6cb3dc20b26389f043a9b7b595fa6  xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
-5a826a32763d82ac83c924f8c89d12aae5f069a4cbc7d5193aa8413a02b6dc05  xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
-be9fe85d36c2c1fbca246c1f4d834c3ef11b6ab3d5467da0ac8c079aa5a68de9  xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
-36b22d6a168be39f31a1c1304f708269a2a10fe5105f7da4a06877d6059f1cd6  xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
-21e7b1d08874527ab2e4cd23d467e9945afcd753dd3390ab2aaf9d24d231916c  xsa190.patch
 3941f99b49c7e8dafc9fae8aad2136a14c6d84533cd542cc5f1040a41ef7c6fe  qemu-coroutine-gthread.patch
 e4e5e838e259a3116978aabbcebc1865a895179a7fcbf4bad195c83e9b4c0f98  qemu-xen_paths.patch
 dd1e784bc455eb62cb85b3fa24bfc34f575ceaab9597ef6a2f1ee7ff7b3cae0a  hotplug-vif-vtrill.patch
@@ -410,7 +379,7 @@ d13719093a2c3824525f36ac91ac3c9bd1154e5ba0974e5441e4a2ab5e883521  xenconsoled.in
 0da87a4b9094f934e3de937e8ef8d3afc752e76793aa3d730182d0241e118b19  xen-consoles.logrotate
 4cfcddcade5d055422ab4543e8caa6e5c5eee7625c41880a9000b7a87c7c424e  xenqemu.confd
 c92bbb1166edd61141fdf678116974209c4422daf373cdd5bc438aa4adb25b8d  xenqemu.initd"
-sha512sums="2c52c8ef145dfab7d069e79318d5d631e1106a0ddc79d88b3bacf36c7f15cea67dccb704a245e785d2a1e42c6fb6c0ad74832f564aaeec025ad7b864031f0921  xen-4.7.0.tar.gz
+sha512sums="eb03244f5fa7b54402fcc1d38f1e69c0ea4536d5ab2f9859b41b5e94920ad9db20fb146e3c3d3635e9ca1d12e93ce0429e57f24bf53d4a2c4b69babc76ec724e  xen-4.7.1.tar.gz
 2e0b0fd23e6f10742a5517981e5171c6e88b0a93c83da701b296f5c0861d72c19782daab589a7eac3f9032152a0fc7eff7f5362db8fccc4859564a9aa82329cf  gmp-4.3.2.tar.bz2
 c2bc9ffc8583aeae71cee9ddcc4418969768d4e3764d47307da54f93981c0109fb07d84b061b3a3628bd00ba4d14a54742bc04848110eb3ae8ca25dbfbaabadb  grub-0.97.tar.gz
 1465b58279af1647f909450e394fe002ca165f0ff4a0254bfa9fe0e64316f50facdde2729d79a4e632565b4500cf4d6c74192ac0dd3bc9fe09129bbd67ba089d  lwip-1.3.0.tar.gz
@@ -420,16 +389,6 @@ c2bc9ffc8583aeae71cee9ddcc4418969768d4e3764d47307da54f93981c0109fb07d84b061b3a36
 4928b5b82f57645be9408362706ff2c4d9baa635b21b0d41b1c82930e8c60a759b1ea4fa74d7e6c7cae1b7692d006aa5cb72df0c3b88bf049779aa2b566f9d35  tpm_emulator-0.7.4.tar.gz
 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e  zlib-1.2.3.tar.gz
 c5cb1cdff40d2d71fd3e692a9d0efadf2aa17290daf5195391a1c81ddd9dfc913a8e44d5be2b12be85b2a5565ea31631c99c7053564f2fb2225c80ea0bb0e4a4  ipxe-git-9a93db3f0947484e30e753bbd61a10b17336e20e.tar.gz
-e0a195ca377be7e4d584eff451d7b077406f54ca64c94b1515a4b23318fed33880da759144237de3be4abc92572037c8f5119b6b70ffc26a1872a771d769b8b2  xsa182-unstable.patch
-a5c23c5ecc6c01875da2c0791c3d62334f3709dff12cb6a1b7a486778da7604994b610a6fc1fb12a46aca409b833c1f37ca704006cd52a283f1ead66a4d9af2a  xsa183-unstable.patch
-14c07d077a9d60a03859ca1b92347517c93faf88db06f8cb0515e486a3919afa8401203161ff671dda8fbdb64e6ca5e86120f1b8f65e6bfaa63a8c6a33211bad  xsa184-qemut-master.patch
-862e00d9cd126f8323f9c9706bf6ce7896d97e68e647416c699d9f2e01b88083a5fea346b13403577311384946912123f64bf5a568f1a6f92077d28923df54c6  xsa184-qemuu-master.patch
-6b774cfef049d457d89149a973b5a5af674b995726c88ce09278f4a64cb94f5b3c2c2380a6273475a13eb9cdd972f5429f393247ecca6463f6068d606ea74886  xsa185.patch
-bf899dde20cee730598b90e0a07941155b20e0ea17b9a3017a53bd0e1495fb6e5dc251934e01d02937b56ad65faf3accecf695b4fd7f6dcc0bae91290bd87b19  xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
-8e2a6c32aeb7cfb6ffa4395709ea849850d4c356dce139857a6783310b2efb47a01b1cf946b890264f7db543c5304830f64b5e40563c72318391569986146ab7  xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
-d85bc3c56805ff5b3df6b85b2b34ff97d15fe254fc5a873b5c43c2c15564eea42753723a6296292a543e7b7dc83ad71f0fafe01fa6a6ebf82fa0a7268fc67486  xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
-f60b51de992225ea6f48ad108c18717fb84a6f3c7cc3a3d567a1799403eefdc965c1ec4ccb9190affa58f81c48f13525a86144b04674b42732c8bdcad6084ff2  xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
-7cd36ad72a97ddbcf3454c87e6adebddfa3204f023446e399c38ecb8914a165a9df2d4939efd40dba149260df3380b2751321c654aff7011b5110e215b0afb37  xsa190.patch
 c3c46f232f0bd9f767b232af7e8ce910a6166b126bd5427bb8dc325aeb2c634b956de3fc225cab5af72649070c8205cc8e1cab7689fc266c204f525086f1a562  qemu-coroutine-gthread.patch
 1936ab39a1867957fa640eb81c4070214ca4856a2743ba7e49c0cd017917071a9680d015f002c57fa7b9600dbadd29dcea5887f50e6c133305df2669a7a933f3  qemu-xen_paths.patch
 f095ea373f36381491ad36f0662fb4f53665031973721256b23166e596318581da7cbb0146d0beb2446729adfdb321e01468e377793f6563a67d68b8b0f7ffe3  hotplug-vif-vtrill.patch
diff --git a/main/xen/xsa182-unstable.patch b/main/xen/xsa182-unstable.patch
deleted file mode 100644
index 3e40e8a530..0000000000
--- a/main/xen/xsa182-unstable.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 00593655e231ed5ea20704120037026e33b83fbb Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Mon, 11 Jul 2016 14:32:03 +0100
-Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
-
-All changes in writeability and cacheability must go through full
-re-validation.
-
-Rework the logic as a whitelist, to make it clearer to follow.
-
-This is XSA-182
-
-Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Tim Deegan <tim@xen.org>
----
- xen/arch/x86/mm.c          | 28 ++++++++++++++++------------
- xen/include/asm-x86/page.h |  1 +
- 2 files changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index dbcf6cb..56ca19f 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1852,6 +1852,14 @@ static inline int update_intpte(intpte_t *p,
-                   _t ## e_get_intpte(_o), _t ## e_get_intpte(_n),   \
-                   (_m), (_v), (_ad))
- 
-+/*
-+ * PTE flags that a guest may change without re-validating the PTE.
-+ * All other bits affect translation, caching, or Xen's safety.
-+ */
-+#define FASTPATH_FLAG_WHITELIST                                     \
-+    (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \
-+     _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER)
-+
- /* Update the L1 entry at pl1e to new value nl1e. */
- static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
-                         unsigned long gl1mfn, int preserve_ad,
-@@ -1891,9 +1899,8 @@ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
-             nl1e = l1e_from_pfn(page_to_mfn(page), l1e_get_flags(nl1e));
-         }
- 
--        /* Fast path for identical mapping, r/w, presence, and cachability. */
--        if ( !l1e_has_changed(ol1e, nl1e,
--                              PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) )
-+        /* Fast path for sufficiently-similar mappings. */
-+        if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) )
-         {
-             adjust_guest_l1e(nl1e, pt_dom);
-             rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu,
-@@ -1970,11 +1977,8 @@ static int mod_l2_entry(l2_pgentry_t *pl2e,
-             return -EINVAL;
-         }
- 
--        /* Fast path for identical mapping and presence. */
--        if ( !l2e_has_changed(ol2e, nl2e,
--                              unlikely(opt_allow_superpage)
--                              ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
--                              : _PAGE_PRESENT) )
-+        /* Fast path for sufficiently-similar mappings. */
-+        if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) )
-         {
-             adjust_guest_l2e(nl2e, d);
-             if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
-@@ -2039,8 +2043,8 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
-             return -EINVAL;
-         }
- 
--        /* Fast path for identical mapping and presence. */
--        if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) )
-+        /* Fast path for sufficiently-similar mappings. */
-+        if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) )
-         {
-             adjust_guest_l3e(nl3e, d);
-             rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad);
-@@ -2103,8 +2107,8 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
-             return -EINVAL;
-         }
- 
--        /* Fast path for identical mapping and presence. */
--        if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) )
-+        /* Fast path for sufficiently-similar mappings. */
-+        if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) )
-         {
-             adjust_guest_l4e(nl4e, d);
-             rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad);
-diff --git a/xen/include/asm-x86/page.h b/xen/include/asm-x86/page.h
-index 224852a..4ae387f 100644
---- a/xen/include/asm-x86/page.h
-+++ b/xen/include/asm-x86/page.h
-@@ -313,6 +313,7 @@ void efi_update_l4_pgtable(unsigned int l4idx, l4_pgentry_t);
- #define _PAGE_AVAIL2   _AC(0x800,U)
- #define _PAGE_AVAIL    _AC(0xE00,U)
- #define _PAGE_PSE_PAT  _AC(0x1000,U)
-+#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12)
- #define _PAGE_NX       (cpu_has_nx ? _PAGE_NX_BIT : 0)
- /* non-architectural flags */
- #define _PAGE_PAGED   0x2000U
--- 
-2.1.4
-
diff --git a/main/xen/xsa183-unstable.patch b/main/xen/xsa183-unstable.patch
deleted file mode 100644
index 573c530112..0000000000
--- a/main/xen/xsa183-unstable.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 2fd4f34058fb5f87fbd80978dbd2cb458aff565d Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 15 Jun 2016 18:32:14 +0100
-Subject: [PATCH] x86/entry: Avoid SMAP violation in
- compat_create_bounce_frame()
-
-A 32bit guest kernel might be running on user mappings.
-compat_create_bounce_frame() must whitelist its guest accesses to avoid
-risking a SMAP violation.
-
-For both variants of create_bounce_frame(), re-blacklist user accesses if
-execution exits via an exception table redirection.
-
-This is XSA-183 / CVE-2016-6259
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: George Dunlap <george.dunlap@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
-v2:
- * Include CLAC on the exit paths from compat_create_bounce_frame which occur
-   from faults attempting to load %fs
- * Reposition ASM_STAC to avoid breaking the macro-op fusion of test/jz
----
- xen/arch/x86/x86_64/compat/entry.S | 3 +++
- xen/arch/x86/x86_64/entry.S        | 2 ++
- 2 files changed, 5 insertions(+)
-
-diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S
-index 7f02afd..e80c53c 100644
---- a/xen/arch/x86/x86_64/compat/entry.S
-+++ b/xen/arch/x86/x86_64/compat/entry.S
-@@ -318,6 +318,7 @@ ENTRY(compat_int80_direct_trap)
- compat_create_bounce_frame:
-         ASSERT_INTERRUPTS_ENABLED
-         mov   %fs,%edi
-+        ASM_STAC
-         testb $2,UREGS_cs+8(%rsp)
-         jz    1f
-         /* Push new frame at registered guest-OS stack base. */
-@@ -364,6 +365,7 @@ compat_create_bounce_frame:
-         movl  TRAPBOUNCE_error_code(%rdx),%eax
- .Lft8:  movl  %eax,%fs:(%rsi)           # ERROR CODE
- 1:
-+        ASM_CLAC
-         /* Rewrite our stack frame and return to guest-OS mode. */
-         /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */
-         andl  $~(X86_EFLAGS_VM|X86_EFLAGS_RF|\
-@@ -403,6 +405,7 @@ compat_crash_page_fault_4:
-         addl  $4,%esi
- compat_crash_page_fault:
- .Lft14: mov   %edi,%fs
-+        ASM_CLAC
-         movl  %esi,%edi
-         call  show_page_walk
-         jmp   dom_crash_sync_extable
-diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
-index ad8c64c..f7178cd 100644
---- a/xen/arch/x86/x86_64/entry.S
-+++ b/xen/arch/x86/x86_64/entry.S
-@@ -420,9 +420,11 @@ domain_crash_page_fault_16:
- domain_crash_page_fault_8:
-         addq  $8,%rsi
- domain_crash_page_fault:
-+        ASM_CLAC
-         movq  %rsi,%rdi
-         call  show_page_walk
- ENTRY(dom_crash_sync_extable)
-+        ASM_CLAC
-         # Get out of the guest-save area of the stack.
-         GET_STACK_END(ax)
-         leaq  STACK_CPUINFO_FIELD(guest_cpu_user_regs)(%rax),%rsp
--- 
-2.1.4
-
diff --git a/main/xen/xsa184-qemut-master.patch b/main/xen/xsa184-qemut-master.patch
deleted file mode 100644
index b376f33a52..0000000000
--- a/main/xen/xsa184-qemut-master.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 17d8c4e47dfb41cb6778520ff2eab7a11fe12dfd Mon Sep 17 00:00:00 2001
-From: P J P <ppandit@redhat.com>
-Date: Tue, 26 Jul 2016 15:31:59 +0100
-Subject: [PATCH] virtio: error out if guest exceeds virtqueue size
-
-A broken or malicious guest can submit more requests than the virtqueue
-size permits.
-
-The guest can submit requests without bothering to wait for completion
-and is therefore not bound by virtqueue size.  This requires reusing
-vring descriptors in more than one request, which is incorrect but
-possible.  Processing a request allocates a VirtQueueElement and
-therefore causes unbounded memory allocation controlled by the guest.
-
-Exit with an error if the guest provides more requests than the
-virtqueue size permits.  This bounds memory allocation and makes the
-buggy guest visible to the user.
-
-Reported-by: Zhenhao Hong <zhenhaohong@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/virtio.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/hw/virtio.c b/hw/virtio.c
-index c26feff..42897bf 100644
---- a/tools/qemu-xen-traditional/hw/virtio.c
-+++ b/tools/qemu-xen-traditional/hw/virtio.c
-@@ -421,6 +421,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQueueElement *elem)
-     /* When we start there are none of either input nor output. */
-     elem->out_num = elem->in_num = 0;
- 
-+    if (vq->inuse >= vq->vring.num) {
-+        fprintf(stderr, "Virtqueue size exceeded");
-+        exit(1);
-+    }
-+
-     i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
-     do {
-         struct iovec *sg;
--- 
-2.1.4
-
diff --git a/main/xen/xsa184-qemuu-master.patch b/main/xen/xsa184-qemuu-master.patch
deleted file mode 100644
index bbe44e8fcb..0000000000
--- a/main/xen/xsa184-qemuu-master.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From e469db25d6b2e5c71cd15451889226641c53a5cd Mon Sep 17 00:00:00 2001
-From: P J P <ppandit@redhat.com>
-Date: Mon, 25 Jul 2016 17:37:18 +0530
-Subject: [PATCH] virtio: error out if guest exceeds virtqueue size
-
-A broken or malicious guest can submit more requests than the virtqueue
-size permits.
-
-The guest can submit requests without bothering to wait for completion
-and is therefore not bound by virtqueue size.  This requires reusing
-vring descriptors in more than one request, which is incorrect but
-possible.  Processing a request allocates a VirtQueueElement and
-therefore causes unbounded memory allocation controlled by the guest.
-
-Exit with an error if the guest provides more requests than the
-virtqueue size permits.  This bounds memory allocation and makes the
-buggy guest visible to the user.
-
-Reported-by: Zhenhao Hong <zhenhaohong@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/virtio/virtio.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index d24f775..f8ac0fb 100644
---- a/tools/qemu-xen/hw/virtio/virtio.c
-+++ b/tools/qemu-xen/hw/virtio/virtio.c
-@@ -483,6 +483,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQueueElement *elem)
- 
-     max = vq->vring.num;
- 
-+    if (vq->inuse >= max) {
-+        error_report("Virtqueue size exceeded");
-+        exit(1);
-+    }
-+
-     i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
-     if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
-         vring_set_avail_event(vq, vq->last_avail_idx);
--- 
-2.1.4
-
diff --git a/main/xen/xsa185.patch b/main/xen/xsa185.patch
deleted file mode 100644
index a4c133ee19..0000000000
--- a/main/xen/xsa185.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 30aba4992b18245c436f16df7326a16c01a51570 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Mon, 8 Aug 2016 10:58:12 +0100
-Subject: x86/32on64: don't allow recursive page tables from L3
-
-L3 entries are special in PAE mode, and hence can't reasonably be used
-for setting up recursive (and hence linear) page table mappings. Since
-abuse is possible when the guest in fact gets run on 4-level page
-tables, this needs to be excluded explicitly.
-
-This is XSA-185.
-
-Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
-Reported-by: 栾尚聪(好风) <shangcong.lsc@alibaba-inc.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
----
- xen/arch/x86/mm.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 109b8be..69b8b8d 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1122,7 +1122,9 @@ get_page_from_l3e(
- 
-     rc = get_page_and_type_from_pagenr(
-         l3e_get_pfn(l3e), PGT_l2_page_table, d, partial, 1);
--    if ( unlikely(rc == -EINVAL) && get_l3_linear_pagetable(l3e, pfn, d) )
-+    if ( unlikely(rc == -EINVAL) &&
-+         !is_pv_32bit_domain(d) &&
-+         get_l3_linear_pagetable(l3e, pfn, d) )
-         rc = 0;
- 
-     return rc;
--- 
-2.1.4
-
diff --git a/main/xen/xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch b/main/xen/xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
deleted file mode 100644
index b257497085..0000000000
--- a/main/xen/xsa186-0001-x86-emulate-Correct-boundary-interactions-of-emulate.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From e938be013ba73ff08fa4f1d8670501aacefde7fb Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Fri, 22 Jul 2016 16:02:54 +0000
-Subject: [PATCH 1/2] x86/emulate: Correct boundary interactions of emulated
- instructions
-
-This reverts most of c/s 0640ffb6 "x86emul: fix rIP handling".
-
-Experimentally, in long mode processors will execute an instruction stream
-which crosses the 64bit -1 -> 0 virtual boundary, whether the instruction
-boundary is aligned on the virtual boundary, or is misaligned.
-
-In compatibility mode, Intel processors will execute an instruction stream
-which crosses the 32bit -1 -> 0 virtual boundary, while AMD processors raise a
-segmentation fault.  Xen's segmentation behaviour matches AMD.
-
-For 16bit code, hardware does not ever truncated %ip.  %eip is always used and
-behaves normally as a 32bit register, including in 16bit protected mode
-segments, as well as in Real and Unreal mode.
-
-This is XSA-186
-
-Reported-by: Brian Marcotte <marcotte@panix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/x86_emulate/x86_emulate.c | 22 ++++------------------
- 1 file changed, 4 insertions(+), 18 deletions(-)
-
-diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
-index d5a56cf..bf3529a 100644
---- a/xen/arch/x86/x86_emulate/x86_emulate.c
-+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
-@@ -1570,10 +1570,6 @@ x86_emulate(
- #endif
-     }
- 
--    /* Truncate rIP to def_ad_bytes (2 or 4) if necessary. */
--    if ( def_ad_bytes < sizeof(_regs.eip) )
--        _regs.eip &= (1UL << (def_ad_bytes * 8)) - 1;
--
-     /* Prefix bytes. */
-     for ( ; ; )
-     {
-@@ -3906,21 +3902,11 @@ x86_emulate(
- 
-     /* Commit shadow register state. */
-     _regs.eflags &= ~EFLG_RF;
--    switch ( __builtin_expect(def_ad_bytes, sizeof(_regs.eip)) )
--    {
--        uint16_t ip;
- 
--    case 2:
--        ip = _regs.eip;
--        _regs.eip = ctxt->regs->eip;
--        *(uint16_t *)&_regs.eip = ip;
--        break;
--#ifdef __x86_64__
--    case 4:
--        _regs.rip = _regs._eip;
--        break;
--#endif
--    }
-+    /* Zero the upper 32 bits of %rip if not in long mode. */
-+    if ( def_ad_bytes < sizeof(_regs.eip) )
-+        _regs.eip = (uint32_t)_regs.eip;
-+
-     *ctxt->regs = _regs;
- 
-  done:
--- 
-2.1.4
-
diff --git a/main/xen/xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch b/main/xen/xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
deleted file mode 100644
index cb73a81042..0000000000
--- a/main/xen/xsa186-4.7-0002-hvm-fep-Allow-testing-of-instructions-crossing-the.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: hvm/fep: Allow testing of instructions crossing the -1 -> 0 virtual boundary
-
-The Force Emulation Prefix is named to follow its PV counterpart for cpuid or
-rdtsc, but isn't really an instruction prefix.  It behaves as a break-out into
-Xen, with the purpose of emulating the next instruction in the current state.
-
-It is important to be able to test legal situations which occur in real
-hardware, including instruction which cross certain boundaries, and
-instructions starting at 0.
-
-Reported-by: Brian Marcotte <marcotte@panix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-
---- a/xen/arch/x86/hvm/hvm.c
-+++ b/xen/arch/x86/hvm/hvm.c
-@@ -3905,6 +3905,10 @@ void hvm_ud_intercept(struct cpu_user_re
-         {
-             regs->eip += sizeof(sig);
-             regs->eflags &= ~X86_EFLAGS_RF;
-+
-+            /* Zero the upper 32 bits of %rip if not in long mode. */
-+            if ( !(hvm_long_mode_enabled(cur) && cs.attr.fields.l) )
-+                regs->eip = regs->_eip;
-         }
-     }
- 
diff --git a/main/xen/xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch b/main/xen/xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
deleted file mode 100644
index bc99596083..0000000000
--- a/main/xen/xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/shadow: Avoid overflowing sh_ctxt->seg_reg[]
-
-hvm_get_seg_reg() does not perform a range check on its input segment, calls
-hvm_get_segment_register() and writes straight into sh_ctxt->seg_reg[].
-
-x86_seg_none is outside the bounds of sh_ctxt->seg_reg[], and will hit a BUG()
-in {vmx,svm}_get_segment_register().
-
-HVM guests running with shadow paging can end up performing a virtual to
-linear translation with x86_seg_none.  This is used for addresses which are
-already linear.  However, none of this is a legitimate pagetable update, so
-fail the emulation in such a case.
-
-This is XSA-187
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Tim Deegan <tim@xen.org>
-
---- a/xen/arch/x86/mm/shadow/common.c
-+++ b/xen/arch/x86/mm/shadow/common.c
-@@ -140,9 +140,18 @@ static int hvm_translate_linear_addr(
-     struct sh_emulate_ctxt *sh_ctxt,
-     unsigned long *paddr)
- {
--    struct segment_register *reg = hvm_get_seg_reg(seg, sh_ctxt);
-+    struct segment_register *reg;
-     int okay;
- 
-+    /*
-+     * Can arrive here with non-user segments.  However, no such cirucmstance
-+     * is part of a legitimate pagetable update, so fail the emulation.
-+     */
-+    if ( !is_x86_user_segment(seg) )
-+        return X86EMUL_UNHANDLEABLE;
-+
-+    reg = hvm_get_seg_reg(seg, sh_ctxt);
-+
-     okay = hvm_virtual_to_linear_addr(
-         seg, reg, offset, bytes, access_type, sh_ctxt->ctxt.addr_size, paddr);
- 
diff --git a/main/xen/xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch b/main/xen/xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
deleted file mode 100644
index 5529701d36..0000000000
--- a/main/xen/xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/segment: Bounds check accesses to emulation ctxt->seg_reg[]
-
-HVM HAP codepaths have space for all segment registers in the seg_reg[]
-cache (with x86_seg_none still risking an array overrun), while the shadow
-codepaths only have space for the user segments.
-
-Range check the input segment of *_get_seg_reg() against the size of the array
-used to cache the results, to avoid overruns in the case that the callers
-don't filter their input suitably.
-
-Subsume the is_x86_user_segment(seg) checks from the shadow code, which were
-an incomplete attempt at range checking, and are now superceeded.  Make
-hvm_get_seg_reg() static, as it is not used outside of shadow/common.c
-
-No functional change, but far easier to reason that no overflow is possible.
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Tim Deegan <tim@xen.org>
-Acked-by: Jan Beulich <jbeulich@suse.com>
-
---- a/xen/arch/x86/hvm/emulate.c
-+++ b/xen/arch/x86/hvm/emulate.c
-@@ -534,6 +534,8 @@ static int hvmemul_virtual_to_linear(
-     *reps = min_t(unsigned long, *reps, max_reps);
- 
-     reg = hvmemul_get_seg_reg(seg, hvmemul_ctxt);
-+    if ( IS_ERR(reg) )
-+        return -PTR_ERR(reg);
- 
-     if ( (hvmemul_ctxt->ctxt.regs->eflags & X86_EFLAGS_DF) && (*reps > 1) )
-     {
-@@ -1369,6 +1371,10 @@ static int hvmemul_read_segment(
-     struct hvm_emulate_ctxt *hvmemul_ctxt =
-         container_of(ctxt, struct hvm_emulate_ctxt, ctxt);
-     struct segment_register *sreg = hvmemul_get_seg_reg(seg, hvmemul_ctxt);
-+
-+    if ( IS_ERR(sreg) )
-+         return -PTR_ERR(sreg);
-+
-     memcpy(reg, sreg, sizeof(struct segment_register));
-     return X86EMUL_OKAY;
- }
-@@ -1382,6 +1388,9 @@ static int hvmemul_write_segment(
-         container_of(ctxt, struct hvm_emulate_ctxt, ctxt);
-     struct segment_register *sreg = hvmemul_get_seg_reg(seg, hvmemul_ctxt);
- 
-+    if ( IS_ERR(sreg) )
-+         return -PTR_ERR(sreg);
-+
-     memcpy(sreg, reg, sizeof(struct segment_register));
-     __set_bit(seg, &hvmemul_ctxt->seg_reg_dirty);
- 
-@@ -1934,10 +1943,17 @@ void hvm_emulate_writeback(
-     }
- }
- 
-+/*
-+ * Callers which pass a known in-range x86_segment can rely on the return
-+ * pointer being valid.  Other callers must explicitly check for errors.
-+ */
- struct segment_register *hvmemul_get_seg_reg(
-     enum x86_segment seg,
-     struct hvm_emulate_ctxt *hvmemul_ctxt)
- {
-+    if ( seg < 0 || seg >= ARRAY_SIZE(hvmemul_ctxt->seg_reg) )
-+        return ERR_PTR(-X86EMUL_UNHANDLEABLE);
-+
-     if ( !__test_and_set_bit(seg, &hvmemul_ctxt->seg_reg_accessed) )
-         hvm_get_segment_register(current, seg, &hvmemul_ctxt->seg_reg[seg]);
-     return &hvmemul_ctxt->seg_reg[seg];
---- a/xen/arch/x86/mm/shadow/common.c
-+++ b/xen/arch/x86/mm/shadow/common.c
-@@ -123,10 +123,19 @@ __initcall(shadow_audit_key_init);
- /* x86 emulator support for the shadow code
-  */
- 
--struct segment_register *hvm_get_seg_reg(
-+/*
-+ * Callers which pass a known in-range x86_segment can rely on the return
-+ * pointer being valid.  Other callers must explicitly check for errors.
-+ */
-+static struct segment_register *hvm_get_seg_reg(
-     enum x86_segment seg, struct sh_emulate_ctxt *sh_ctxt)
- {
--    struct segment_register *seg_reg = &sh_ctxt->seg_reg[seg];
-+    struct segment_register *seg_reg;
-+
-+    if ( seg < 0 || seg >= ARRAY_SIZE(sh_ctxt->seg_reg) )
-+        return ERR_PTR(-X86EMUL_UNHANDLEABLE);
-+
-+    seg_reg = &sh_ctxt->seg_reg[seg];
-     if ( !__test_and_set_bit(seg, &sh_ctxt->valid_seg_regs) )
-         hvm_get_segment_register(current, seg, seg_reg);
-     return seg_reg;
-@@ -143,14 +152,9 @@ static int hvm_translate_linear_addr(
-     struct segment_register *reg;
-     int okay;
- 
--    /*
--     * Can arrive here with non-user segments.  However, no such cirucmstance
--     * is part of a legitimate pagetable update, so fail the emulation.
--     */
--    if ( !is_x86_user_segment(seg) )
--        return X86EMUL_UNHANDLEABLE;
--
-     reg = hvm_get_seg_reg(seg, sh_ctxt);
-+    if ( IS_ERR(reg) )
-+        return -PTR_ERR(reg);
- 
-     okay = hvm_virtual_to_linear_addr(
-         seg, reg, offset, bytes, access_type, sh_ctxt->ctxt.addr_size, paddr);
-@@ -253,9 +257,6 @@ hvm_emulate_write(enum x86_segment seg,
-     unsigned long addr;
-     int rc;
- 
--    if ( !is_x86_user_segment(seg) )
--        return X86EMUL_UNHANDLEABLE;
--
-     /* How many emulations could we save if we unshadowed on stack writes? */
-     if ( seg == x86_seg_ss )
-         perfc_incr(shadow_fault_emulate_stack);
-@@ -283,7 +284,7 @@ hvm_emulate_cmpxchg(enum x86_segment seg
-     unsigned long addr, old, new;
-     int rc;
- 
--    if ( !is_x86_user_segment(seg) || bytes > sizeof(long) )
-+    if ( bytes > sizeof(long) )
-         return X86EMUL_UNHANDLEABLE;
- 
-     rc = hvm_translate_linear_addr(
---- a/xen/arch/x86/mm/shadow/private.h
-+++ b/xen/arch/x86/mm/shadow/private.h
-@@ -740,8 +740,6 @@ const struct x86_emulate_ops *shadow_ini
-     struct sh_emulate_ctxt *sh_ctxt, struct cpu_user_regs *regs);
- void shadow_continue_emulation(
-     struct sh_emulate_ctxt *sh_ctxt, struct cpu_user_regs *regs);
--struct segment_register *hvm_get_seg_reg(
--    enum x86_segment seg, struct sh_emulate_ctxt *sh_ctxt);
- 
- #if (SHADOW_OPTIMIZATIONS & SHOPT_VIRTUAL_TLB)
- /**************************************************************************/
---- a/xen/include/asm-x86/hvm/emulate.h
-+++ b/xen/include/asm-x86/hvm/emulate.h
-@@ -13,6 +13,7 @@
- #define __ASM_X86_HVM_EMULATE_H__
- 
- #include <xen/config.h>
-+#include <xen/err.h>
- #include <asm/hvm/hvm.h>
- #include <asm/x86_emulate.h>
- 
diff --git a/main/xen/xsa190.patch b/main/xen/xsa190.patch
deleted file mode 100644
index 3c242e6cc2..0000000000
--- a/main/xen/xsa190.patch
+++ /dev/null
@@ -1,173 +0,0 @@
-x86emul: honor guest CR0.TS and CR0.EM
-
-We must not emulate any instructions accessing respective registers
-when either of these flags is set in the guest view of the register, or
-else we may do so on data not belonging to the guest's current task.
-
-Being architecturally required behavior, the logic gets placed in the
-instruction emulator instead of hvmemul_get_fpu(). It should be noted,
-though, that hvmemul_get_fpu() being the only current handler for the
-get_fpu() callback, we don't have an active problem with CR4: Both
-CR4.OSFXSR and CR4.OSXSAVE get handled as necessary by that function.
-
-This is XSA-190.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
----
-v4: Only raise #NM on FWAIT when CR0.TS and CR0.MP are set.
-v3: Correct which exception to raise upon set CR0.EM.
-v2: Require the read_cr hook to be set, which then requires a change to
-    the test code too.
----
-The change to xen/arch/x86/hvm/emulate.c isn't strictly needed for
-fixing the security issue, but the patch would be rather incomplete
-without.
-
---- a/tools/tests/x86_emulator/test_x86_emulator.c
-+++ b/tools/tests/x86_emulator/test_x86_emulator.c
-@@ -158,6 +158,22 @@ static inline uint64_t xgetbv(uint32_t x
-     (ebx & (1U << 5)) != 0; \
- })
- 
-+static int read_cr(
-+    unsigned int reg,
-+    unsigned long *val,
-+    struct x86_emulate_ctxt *ctxt)
-+{
-+    /* Fake just enough state for the emulator's _get_fpu() to be happy. */
-+    switch ( reg )
-+    {
-+    case 0:
-+        *val = 0x00000001; /* PE */
-+        return X86EMUL_OKAY;
-+    }
-+
-+    return X86EMUL_UNHANDLEABLE;
-+}
-+
- int get_fpu(
-     void (*exception_callback)(void *, struct cpu_user_regs *),
-     void *exception_callback_arg,
-@@ -189,6 +205,7 @@ static struct x86_emulate_ops emulops =
-     .write      = write,
-     .cmpxchg    = cmpxchg,
-     .cpuid      = cpuid,
-+    .read_cr    = read_cr,
-     .get_fpu    = get_fpu,
- };
- 
---- a/xen/arch/x86/hvm/emulate.c
-+++ b/xen/arch/x86/hvm/emulate.c
-@@ -1628,14 +1628,14 @@ static int hvmemul_get_fpu(
-     switch ( type )
-     {
-     case X86EMUL_FPU_fpu:
-+    case X86EMUL_FPU_wait:
-         break;
-     case X86EMUL_FPU_mmx:
-         if ( !cpu_has_mmx )
-             return X86EMUL_UNHANDLEABLE;
-         break;
-     case X86EMUL_FPU_xmm:
--        if ( (curr->arch.hvm_vcpu.guest_cr[0] & X86_CR0_EM) ||
--             !(curr->arch.hvm_vcpu.guest_cr[4] & X86_CR4_OSFXSR) )
-+        if ( !(curr->arch.hvm_vcpu.guest_cr[4] & X86_CR4_OSFXSR) )
-             return X86EMUL_UNHANDLEABLE;
-         break;
-     case X86EMUL_FPU_ymm:
---- a/xen/arch/x86/x86_emulate/x86_emulate.c
-+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
-@@ -420,6 +420,9 @@ typedef union {
- 
- /* Control register flags. */
- #define CR0_PE    (1<<0)
-+#define CR0_MP    (1<<1)
-+#define CR0_EM    (1<<2)
-+#define CR0_TS    (1<<3)
- #define CR4_TSD   (1<<2)
- 
- /* EFLAGS bit definitions. */
-@@ -447,6 +450,7 @@ typedef union {
- #define EXC_OF  4
- #define EXC_BR  5
- #define EXC_UD  6
-+#define EXC_NM  7
- #define EXC_TS 10
- #define EXC_NP 11
- #define EXC_SS 12
-@@ -746,10 +750,45 @@ static void fpu_handle_exception(void *_
-     regs->eip += fic->insn_bytes;
- }
- 
-+static int _get_fpu(
-+    enum x86_emulate_fpu_type type,
-+    struct fpu_insn_ctxt *fic,
-+    struct x86_emulate_ctxt *ctxt,
-+    const struct x86_emulate_ops *ops)
-+{
-+    int rc;
-+
-+    fic->exn_raised = 0;
-+
-+    fail_if(!ops->get_fpu);
-+    rc = ops->get_fpu(fpu_handle_exception, fic, type, ctxt);
-+
-+    if ( rc == X86EMUL_OKAY )
-+    {
-+        unsigned long cr0;
-+
-+        fail_if(!ops->read_cr);
-+        rc = ops->read_cr(0, &cr0, ctxt);
-+        if ( rc != X86EMUL_OKAY )
-+            return rc;
-+        if ( cr0 & CR0_EM )
-+        {
-+            generate_exception_if(type == X86EMUL_FPU_fpu, EXC_NM, -1);
-+            generate_exception_if(type == X86EMUL_FPU_mmx, EXC_UD, -1);
-+            generate_exception_if(type == X86EMUL_FPU_xmm, EXC_UD, -1);
-+        }
-+        generate_exception_if((cr0 & CR0_TS) &&
-+                              (type != X86EMUL_FPU_wait || (cr0 & CR0_MP)),
-+                              EXC_NM, -1);
-+    }
-+
-+ done:
-+    return rc;
-+}
-+
- #define get_fpu(_type, _fic)                                    \
--do{ (_fic)->exn_raised = 0;                                     \
--    fail_if(ops->get_fpu == NULL);                              \
--    rc = ops->get_fpu(fpu_handle_exception, _fic, _type, ctxt); \
-+do {                                                            \
-+    rc = _get_fpu(_type, _fic, ctxt, ops);                      \
-     if ( rc ) goto done;                                        \
- } while (0)
- #define _put_fpu()                                              \
-@@ -2879,8 +2918,14 @@ x86_emulate(
-     }
- 
-     case 0x9b:  /* wait/fwait */
--        emulate_fpu_insn("fwait");
-+    {
-+        struct fpu_insn_ctxt fic = { .insn_bytes = 1 };
-+
-+        get_fpu(X86EMUL_FPU_wait, &fic);
-+        asm volatile ( "fwait" ::: "memory" );
-+        put_fpu(&fic);
-         break;
-+    }
- 
-     case 0x9c: /* pushf */
-         src.val = _regs.eflags;
---- a/xen/arch/x86/x86_emulate/x86_emulate.h
-+++ b/xen/arch/x86/x86_emulate/x86_emulate.h
-@@ -115,6 +115,7 @@ struct __packed segment_register {
- /* FPU sub-types which may be requested via ->get_fpu(). */
- enum x86_emulate_fpu_type {
-     X86EMUL_FPU_fpu, /* Standard FPU coprocessor instruction set */
-+    X86EMUL_FPU_wait, /* WAIT/FWAIT instruction */
-     X86EMUL_FPU_mmx, /* MMX instruction set (%mm0-%mm7) */
-     X86EMUL_FPU_xmm, /* SSE instruction set (%xmm0-%xmm7/15) */
-     X86EMUL_FPU_ymm  /* AVX/XOP instruction set (%ymm0-%ymm7/15) */