summaryrefslogtreecommitdiffstats
path: root/main
diff options
context:
space:
mode:
authorWilliam Pitcock <nenolod@dereferenced.org>2013-09-08 13:15:46 +0000
committerWilliam Pitcock <nenolod@dereferenced.org>2013-09-08 13:34:53 +0000
commita17a579a91bee5f66a6f3ff0d782a5c23133c740 (patch)
tree09958260ae24e094f1159fe14ddd0fdd0a0846db /main
parent86591e0d45277b720435fca5babaa5d21c507b9c (diff)
downloadaports-a17a579a91bee5f66a6f3ff0d782a5c23133c740.tar.bz2
aports-a17a579a91bee5f66a6f3ff0d782a5c23133c740.tar.xz
main/xen: initial rebase of patches, fixups needed
Diffstat (limited to 'main')
-rw-r--r--main/xen/APKBUILD61
-rw-r--r--main/xen/fix-pod2man-choking.patch46
-rw-r--r--main/xen/qemu-xen-websocket.patch225
-rw-r--r--main/xen/qemu_uclibc_configure.patch48
-rw-r--r--main/xen/xsa45-4.2.patch1133
-rw-r--r--main/xen/xsa52-4.2-unstable.patch46
-rw-r--r--main/xen/xsa53-4.2.patch57
-rw-r--r--main/xen/xsa54.patch24
-rw-r--r--main/xen/xsa55.patch3431
-rw-r--r--main/xen/xsa56.patch50
-rw-r--r--main/xen/xsa57.patch333
-rw-r--r--main/xen/xsa58-4.2.patch129
12 files changed, 140 insertions, 5443 deletions
diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD
index 3cb426b92..def6d7968 100644
--- a/main/xen/APKBUILD
+++ b/main/xen/APKBUILD
@@ -2,8 +2,8 @@
# Contributor: Roger Pau Monne <roger.pau@entel.upc.edu>
# Maintainer: William Pitcock <nenolod@dereferenced.org>
pkgname=xen
-pkgver=4.2.2
-pkgrel=11
+pkgver=4.3.0
+pkgrel=0
pkgdesc="Xen hypervisor"
url="http://www.xen.org/"
arch="x86 x86_64"
@@ -16,7 +16,6 @@ makedepends="$depends_dev"
install=""
subpackages="$pkgname-doc $pkgname-dev $pkgname-libs $pkgname-hypervisor $pkgname-xend"
source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.gz
- qemu_uclibc_configure.patch
librt.patch
qemu-xen_paths.patch
docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
@@ -24,17 +23,10 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
xsa41.patch
xsa41b.patch
xsa41c.patch
- xsa45-4.2.patch
xsa48-4.2.patch
- xsa52-4.2-unstable.patch
- xsa53-4.2.patch
- xsa54.patch
- xsa55.patch
- xsa56.patch
- xsa57.patch
- xsa58-4.2.patch
fix-pod2man-choking.patch
+
qemu-xen-websocket.patch
qemu-xen-tls-websockets.patch
@@ -76,7 +68,7 @@ build() {
cd "$_builddir"
msg "Running configure..."
- ./configure \
+ ./configure --prefix=/usr \
--build=$CBUILD \
--host=$CHOST \
|| return 1
@@ -153,25 +145,16 @@ xend() {
-exec mv '{}' "$subpkgdir"/"$sitepackages"/xen \;
}
-md5sums="f7362b19401a47826f2d8fd603a1782a xen-4.2.2.tar.gz
-506e7ab6f9482dc95f230978d340bcd9 qemu_uclibc_configure.patch
+md5sums="7b18cfb58f1ac2ce39cf35a1867f0c0a xen-4.3.0.tar.gz
2dc5ddf47c53ea168729975046c3c1f9 librt.patch
1ccde6b36a6f9542a16d998204dc9a22 qemu-xen_paths.patch
6dcff640268d514fa9164b4c812cc52d docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
8ad8942000b8a4be4917599cad9209cf xsa41.patch
ed7d0399c6ca6aeee479da5d8f807fe0 xsa41b.patch
2f3dd7bdc59d104370066d6582725575 xsa41c.patch
-9265540493f41f7d40c48d0886ec5823 xsa45-4.2.patch
b3e3a57d189a4f86c9766eaf3b5207f4 xsa48-4.2.patch
-83a9cdd035bcd18bf035434a1ba08c38 xsa52-4.2-unstable.patch
-03a1a4ebc470ee7e638e04db2701a4f7 xsa53-4.2.patch
-a8393d1ec6b886ea72ffe624a04ee10a xsa54.patch
-42cd104f2a33d67938a63a6372cff573 xsa55.patch
-e70b9128ffc2175cea314a533a7d8457 xsa56.patch
-7475158130474ee062a4eb878259af61 xsa57.patch
-7de2cd11c10d6a554f3c81e0688c38b7 xsa58-4.2.patch
-c1d1a415415b0192e5dae9032962bf61 fix-pod2man-choking.patch
-af5c5e21e68ae27847e2307815c82f98 qemu-xen-websocket.patch
+2651e5c42934bc5d37bae1fdeb7aa0c4 fix-pod2man-choking.patch
+2b5e6af003ca8246701a3673d2d2292f qemu-xen-websocket.patch
35bdea1d4e3ae2565edc7e40906efdd5 qemu-xen-tls-websockets.patch
a90c36642f0701a8aaa4ebe4dde430f5 xenstored.initd
b017ccdd5e1c27bbf1513e3569d4ff07 xenstored.confd
@@ -184,25 +167,16 @@ fa8c72b42e0479d521a353386d8543ef xendomains.initd
9df68ac65dc3f372f5d61183abdc83ff xen-consoles.logrotate
6a2f777c16678d84039acf670d86fff6 xenqemu.confd
f9afbf39e2b5a7d9dde60ebbd249ea7d xenqemu.initd"
-sha256sums="c9bfe91a5e72f8545acebad9889d64368020359bfe18044c0e683133e55ae005 xen-4.2.2.tar.gz
-4fb92fa1ce67eb3f78a15c6c971415d4d53599904969596acc7a52edc83a5fee qemu_uclibc_configure.patch
+sha256sums="e1e9faabe4886e2227aacdbde74410653b233d66642ca1972a860cbec6439961 xen-4.3.0.tar.gz
12bf32f9937b09283f2df4955b50d6739768f66137a7d991f661f45cf77cb53b librt.patch
9440ca31a6911201f02694e93faafb5ca9b17de18b7f15b53ceac39a03411b4a qemu-xen_paths.patch
a0c225d716d343fe041b63e3940900c5b3573ed3bcfc5b7c2d52ea2861c3fc28 docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
93452beba88a8da8e89b8bfa743074a358ba1d9052151c608e21c4d62f8c4867 xsa41.patch
896a07f57310c9bea9bc2a305166cf796282c381cb7839be49105b1726a860b5 xsa41b.patch
683dd96a0a8899f794070c8c09643dfeeb39f92da531955cba961b45f6075914 xsa41c.patch
-f3c8c75cc6f55409139b1928017d1e432e5e64b6fac2083395f4723353e1c775 xsa45-4.2.patch
dc23077028584e71a08dd0dc9e81552c76744a5ce9d39df5958a95ae9cf3107b xsa48-4.2.patch
-5b8582185bf90386729e81db1f7780c69a891b074a87d9a619a90d6f639bea13 xsa52-4.2-unstable.patch
-785f7612bd229f7501f4e98e4760f307d90c64305ee14707d262b77f05fa683d xsa53-4.2.patch
-5d94946b3c9cba52aae2bffd4b0ebb11d09181650b5322a3c85170674a05f6b7 xsa54.patch
-ac3ebaf3ec37e28ba08e23d63626d7aaccf0a3f282dd0af9c24cc4df3fd8fae0 xsa55.patch
-a691c5f5332a42c0d38ddb4dc037eb902f01ba31033b64c47d02909a8de0257d xsa56.patch
-b6a5106848541972519cc529859d9ff3083c79367276c7031560fa4ce6f9f770 xsa57.patch
-194d6610fc38b767d643e5d58a1268f45921fb35e309b47aca6a388b861311c2 xsa58-4.2.patch
-b4e7d43364a06b2cb04527db3e9567524bc489fef475709fd8493ebf1e62406d fix-pod2man-choking.patch
-cc4bf76be2c87ba089f9e330f3f18419a8399920319e04f6a97be463ce1bfa1e qemu-xen-websocket.patch
+b58bc9c048d05856f1a7571c60afd0bab72493cc6aa402c15a5f5dc85483fa7e fix-pod2man-choking.patch
+0ed31a9f92662c38ac6ec75280387304816703441fcc4721003f9c2347507893 qemu-xen-websocket.patch
435dd428d83acdfde58888532a1cece1e9075b2a2460fe3f6cd33c7d400f2715 qemu-xen-tls-websockets.patch
868c77d689ae54b7041da169bfaa01868503337d4105a071eb771f4ec5a0543d xenstored.initd
ea9171e71ab3d33061979bcf3bb737156192aa4b0be4d1234438ced75b6fdef3 xenstored.confd
@@ -215,25 +189,16 @@ a50a4485e84bcc098ad021556cd2aa7947c228f0a546ab942e880787ced57be3 xend.initd
0da87a4b9094f934e3de937e8ef8d3afc752e76793aa3d730182d0241e118b19 xen-consoles.logrotate
4cfcddcade5d055422ab4543e8caa6e5c5eee7625c41880a9000b7a87c7c424e xenqemu.confd
bf17808a79c57a9efc38b9f14cc87f556b2bb7ecfdec5763d9cf686255a47fce xenqemu.initd"
-sha512sums="4943b18016ed8c2b194a3b55e6655b3b734b39ffb8cb7ee0a0580f2f4460a1d0e92e1de8ac23f5186272914fad1650586af51fd7c3644d0310eb16f2e11c5e80 xen-4.2.2.tar.gz
-81a5555c123daad6a9a1835186a82d604e68d833efe3a6576a88717268e5335f809a6621846645c2e1eb1d33a51951a6306e4c393a76c677959149bc28a886be qemu_uclibc_configure.patch
+sha512sums="e6b8f64e15e48704ea5cee5585cd6151fe6a5a62bc4670caf0b762c1aa71c9598db236c637ac34c42c92c6e8a5001acdd3d9d4b9305401a26273279358f481d6 xen-4.3.0.tar.gz
74e3cfc51e367fc445cb3d8149f0c8830e94719a266daf04d2cd0889864591860c4c8842de2bc78070e4c5be7d14dfbb8b236c511d5faeddc2ad97177c1d3764 librt.patch
425149aea57a6deae9f488cea867f125983998dc6e8c63893fb3b9caf0ea34214251dd98ad74db823f5168631c44c49b988b6fe9c11b76bd493ddf51bc0baaa2 qemu-xen_paths.patch
477d3d08bd4fcdfbc54abea1a18acb6a41d298c366cd01c954f474515cb862d0dd59217c0dfca5460a725a8bc036de42132f522c3eefdffcc4fd511f016b783f docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
94672a4d37db4e370370157cac9507ee1a75832f4be779fba148c1faa0b18f26ed57126eee6256ccd5d218463325a730266b53139554f4865adedb7659154c16 xsa41.patch
bda9105793f2327e1317991762120d0668af0e964076b18c9fdbfd509984b2e88d85df95702c46b2e00d5350e8113f6aa7b34b19064d19abbeb4d43f0c431d38 xsa41b.patch
36b60478660ff7748328f5ab9adff13286eee1a1bad06e42fdf7e6aafe105103988525725aacd660cf5b2a184a9e2d6b3818655203c1fa07e07dcebdf23f35d9 xsa41c.patch
-a57b4c8be76a938d51e51ffb39f0781389ebef320f359b0ae9af4a93af970d37dde50a304d4864a75b7fb32861a4745b9da5fa6acce0f2a688b11b13ab43fb4e xsa45-4.2.patch
31dd8c62d41cc0a01a79d9b24a5b793f5e2058230808d9c5364c6ff3477ab02f3258f1bbd761d97dc1b97ee120b41524b999eaac77f33b606496fc324b5fa2e4 xsa48-4.2.patch
-b64a965fab8534958e453c493211ed3a6555aafb90d18f6d56a45b41d3086a0029aee85b6b6eb93b0d861d5fdc0ef10fc32e9b4f83593b37c43922d838085dd8 xsa52-4.2-unstable.patch
-9b08924e563e79d2b308c1521da520c0579b334b61ac99a5593eabdb96dbda2da898b542cc47bda6d663c68343216d9d29c04853b6d1b6ecdde964b0cbb3f7ab xsa53-4.2.patch
-c9010be637d4f96ef03c880e1ef28228f762c5980108380a105bd190b631a882c8dff81e9421246d88d597e72f69ad1a8c672be6ddd06936acfcacd4575a2650 xsa54.patch
-b4f43095163146a29ae258575bb03bd45f5a315d3cca7434a0b88c18eb1b6e1cf17ef13b4ac428a08797271a3dbc756d3f705a990991c8d2fc96f0f272c3665a xsa55.patch
-26a1c2cc92ddd4c1ab6712b0e41a0135d0e76a7fe3a14b651fb0235e352e5a24077414371acccb93058b7ce4d882b667386811170ba74570c53165837bcd983d xsa56.patch
-5ccc1654d9f0270485495f9fc913e41663ddbda602ffe049e0a9c3247c6246690b7ec4165482f96921c5253a2a5205ca384048339996e611c07ab60a6a75cf6a xsa57.patch
-60813c01f6bb909da8748919df4d0ffa923baf4b7b55287e0bec3389fb83020158225182e112941c9e126b4df57e7b8724f2a69d0c1fa9ce3b37c0bdf1a49da4 xsa58-4.2.patch
-ffb1113fcec0853b690c177655c7d1136388efdebf0d7f625b80481b98eadd3e9ef461442ced53e11acf0e347800a2b0a41e18b05065b5d04bffdd8a4e127cec fix-pod2man-choking.patch
-5da25a997c69d737b6a43f460d54e34dccf3c94751990969c93e674ab3aaa34ddd41c2b2a7988aaa68a22abf1508705336d9a9ae3637147b0cf9036b9909daf8 qemu-xen-websocket.patch
+dd8f016b36719e0f96ce3c9c7098d4047ee2d36e7147f3c35a730253eec2f64100f7702430f5e637727dc7c3a20b1762270ffce2291b2046e08028da14d4c7e6 fix-pod2man-choking.patch
+442b6e6ed771e58226cd541d0ee0e2eafc9442ef77236a86e02d594eaeb1abb725895d44b8ed8a04d64280bd4c61b7ca91b0fdd448647f59ba5d0fdc82f85cc9 qemu-xen-websocket.patch
11eaccc346440ff285552f204d491e3b31bda1665c3219ecae3061b5d55db9dec885af0c031fa19c67e87bbe238002b1911bbd5bfea2f2ba0d61e6b3d0c952c9 qemu-xen-tls-websockets.patch
880584e0866b1efcf3b7a934f07072ec84c13c782e3e7a15848d38ba8af50259d46db037dca1e037b15274989f2c22acd1134954dd60c59f4ee693b417d03e0d xenstored.initd
100cf4112f401f45c1e4e885a5074698c484b40521262f6268fad286498e95f4c51e746f0e94eb43a590bb8e813a397bb53801ccacebec9541020799d8d70514 xenstored.confd
diff --git a/main/xen/fix-pod2man-choking.patch b/main/xen/fix-pod2man-choking.patch
index c4a4ac6a2..fba9be9d2 100644
--- a/main/xen/fix-pod2man-choking.patch
+++ b/main/xen/fix-pod2man-choking.patch
@@ -11,32 +11,6 @@
qemu must be told to not have parallel ports to have working GUS
--- xen-4.2.2.orig/docs/man/xl.cfg.pod.5
+++ xen-4.2.2/docs/man/xl.cfg.pod.5
-@@ -402,10 +402,10 @@
-
- =back
-
--=item B<ioports=[ "IOPORT_RANGE", "IOPORT_RANGE", ... ]>
--
- =over 4
-
-+=item B<ioports=[ "IOPORT_RANGE", "IOPORT_RANGE", ... ]>
-+
- Allow guest to access specific legacy I/O ports. Each B<IOPORT_RANGE>
- is given in hexadecimal and may either a span e.g. C<2f8-2ff>
- (inclusive) or a single I/O port C<2f8>.
-@@ -415,10 +415,10 @@
-
- =back
-
--=item B<irqs=[ NUMBER, NUMBER, ... ]>
--
- =over 4
-
-+=item B<irqs=[ NUMBER, NUMBER, ... ]>
-+
- Allow a guest to access specific physical IRQs.
-
- It is recommended to use this option only for trusted VMs under
@@ -680,9 +680,11 @@
=back
@@ -50,23 +24,3 @@
=item B<localtime=BOOLEAN>
-@@ -691,6 +693,8 @@
- =item B<rtc_timeoffset=SECONDS>
-
- Set the real time clock offset in seconds. 0 by default.
-+
-+=back
-
- =head3 Support for Paravirtualisation of HVM Guests
-
---- xen-4.2.2.orig/docs/man/xl.pod.1
-+++ xen-4.2.2/docs/man/xl.pod.1
-@@ -851,8 +851,6 @@
-
- =item B<-p [pool] -d>... : Illegal
-
--=item
--
- =back
-
- =item B<sched-credit2> [I<OPTIONS>]
diff --git a/main/xen/qemu-xen-websocket.patch b/main/xen/qemu-xen-websocket.patch
index 4e54d7e21..02bb805da 100644
--- a/main/xen/qemu-xen-websocket.patch
+++ b/main/xen/qemu-xen-websocket.patch
@@ -1,36 +1,26 @@
---- xen-4.2.2.orig/tools/Makefile
-+++ xen-4.2.2/tools/Makefile
-@@ -202,6 +202,7 @@
+--- xen-4.3.0.orig/tools/Makefile
++++ xen-4.3.0/tools/Makefile
+@@ -203,6 +203,7 @@
--docdir=$(PREFIX)/share/doc \
--sysconfdir=/etc/qemu \
--disable-kvm \
+ --enable-vnc-ws \
+ --disable-docs \
--python=$(PYTHON) \
$(IOEMU_CONFIGURE_CROSS); \
- $(MAKE) all
---- xen-4.2.2.orig/tools/qemu-xen/Makefile.objs
-+++ xen-4.2.2/tools/qemu-xen/Makefile.objs
-@@ -149,6 +149,7 @@
- vnc-obj-y += vnc-enc-zrle.o
- vnc-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
- vnc-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
-+vnc-obj-$(CONFIG_VNC_WS) += vnc-ws.o
- ifdef CONFIG_VNC_THREAD
- vnc-obj-y += vnc-jobs-async.o
- else
---- xen-4.2.2.orig/tools/qemu-xen/configure
-+++ xen-4.2.2/tools/qemu-xen/configure
-@@ -124,6 +124,7 @@
+--- xen-4.3.0.orig/tools/qemu-xen/configure
++++ xen-4.3.0/tools/qemu-xen/configure
+@@ -158,6 +158,7 @@
vnc_sasl=""
vnc_jpeg=""
vnc_png=""
+vnc_ws=""
- vnc_thread="no"
xen=""
xen_ctrl_version=""
-@@ -638,6 +639,10 @@
+ xen_pci_passthrough=""
+@@ -703,6 +704,10 @@
;;
- --enable-vnc-thread) vnc_thread="yes"
+ --enable-vnc-png) vnc_png="yes"
;;
+ --disable-vnc-ws) vnc_ws="no"
+ ;;
@@ -39,16 +29,16 @@
--disable-slirp) slirp="no"
;;
--disable-uuid) uuid="no"
-@@ -1008,6 +1013,8 @@
+@@ -1048,6 +1053,8 @@
+ echo " --enable-vnc-jpeg enable JPEG lossy compression for VNC server"
+ echo " --disable-vnc-png disable PNG compression for VNC server (default)"
echo " --enable-vnc-png enable PNG compression for VNC server"
- echo " --disable-vnc-thread disable threaded VNC server"
- echo " --enable-vnc-thread enable threaded VNC server"
+echo " --disable-vnc-ws disable Websockets support for VNC server"
+echo " --enable-vnc-ws enable Websockets support for VNC server"
echo " --disable-curses disable curses output"
echo " --enable-curses enable curses output"
echo " --disable-curl disable curl connectivity"
-@@ -1554,8 +1561,8 @@
+@@ -1692,8 +1699,8 @@
fi
##########################################
@@ -59,7 +49,7 @@
cat > $TMPC <<EOF
#include <gnutls/gnutls.h>
int main(void) { gnutls_session_t s; gnutls_init(&s, GNUTLS_SERVER); return 0; }
-@@ -1563,13 +1570,22 @@
+@@ -1701,13 +1708,22 @@
vnc_tls_cflags=`$pkg_config --cflags gnutls 2> /dev/null`
vnc_tls_libs=`$pkg_config --libs gnutls 2> /dev/null`
if compile_prog "$vnc_tls_cflags" "$vnc_tls_libs" ; then
@@ -83,18 +73,18 @@
fi
fi
-@@ -2864,6 +2880,7 @@
+@@ -3209,6 +3225,7 @@
echo "VNC SASL support $vnc_sasl"
echo "VNC JPEG support $vnc_jpeg"
echo "VNC PNG support $vnc_png"
+ echo "VNC WS support $vnc_ws"
- echo "VNC thread $vnc_thread"
fi
if test -n "$sparc_cpu"; then
-@@ -3053,6 +3070,10 @@
- fi
- if test "$vnc_thread" = "yes" ; then
- echo "CONFIG_VNC_THREAD=y" >> $config_host_mak
+ echo "Target Sparc Arch $sparc_cpu"
+@@ -3384,6 +3401,10 @@
+ if test "$vnc_png" = "yes" ; then
+ echo "CONFIG_VNC_PNG=y" >> $config_host_mak
+ echo "VNC_PNG_CFLAGS=$vnc_png_cflags" >> $config_host_mak
+fi
+if test "$vnc_ws" = "yes" ; then
+ echo "CONFIG_VNC_WS=y" >> $config_host_mak
@@ -102,9 +92,9 @@
fi
if test "$fnmatch" = "yes" ; then
echo "CONFIG_FNMATCH=y" >> $config_host_mak
---- xen-4.2.2.orig/tools/qemu-xen/qemu-options.hx
-+++ xen-4.2.2/tools/qemu-xen/qemu-options.hx
-@@ -976,6 +976,14 @@
+--- xen-4.3.0.orig/tools/qemu-xen/qemu-options.hx
++++ xen-4.3.0/tools/qemu-xen/qemu-options.hx
+@@ -1096,6 +1096,14 @@
connections (@var{host}:@var{d},@code{reverse}), the @var{d} argument
is a TCP port number, not a display number.
@@ -119,8 +109,46 @@
@item password
Require that password based authentication is used for client connections.
+--- xen-4.3.0.orig/tools/qemu-xen/qemu-options.hx.orig
++++ xen-4.3.0/tools/qemu-xen/qemu-options.hx.orig
+@@ -2045,18 +2045,13 @@
+ devices.
+
+ Syntax for specifying a sheepdog device
+-@table @list
+-``sheepdog:<vdiname>''
+-
+-``sheepdog:<vdiname>:<snapid>''
+-
+-``sheepdog:<vdiname>:<tag>''
+-
+-``sheepdog:<host>:<port>:<vdiname>''
+-
+-``sheepdog:<host>:<port>:<vdiname>:<snapid>''
+-
+-``sheepdog:<host>:<port>:<vdiname>:<tag>''
++@table @code
++@item sheepdog:<vdiname>
++@item sheepdog:<vdiname>:<snapid>
++@item sheepdog:<vdiname>:<tag>
++@item sheepdog:<host>:<port>:<vdiname>
++@item sheepdog:<host>:<port>:<vdiname>:<snapid>
++@item sheepdog:<host>:<port>:<vdiname>:<tag>
+ @end table
+
+ Example
+--- xen-4.3.0.orig/tools/qemu-xen/ui/Makefile.objs
++++ xen-4.3.0/tools/qemu-xen/ui/Makefile.objs
+@@ -4,6 +4,7 @@
+ vnc-obj-y += vnc-enc-zrle.o
+ vnc-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
+ vnc-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
++vnc-obj-$(CONFIG_VNC_WS) += vnc-ws.o
+ vnc-obj-y += vnc-jobs.o
+
+ common-obj-y += keymaps.o
--- /dev/null
-+++ xen-4.2.2/tools/qemu-xen/ui/vnc-ws.c
++++ xen-4.3.0/tools/qemu-xen/ui/vnc-ws.c
@@ -0,0 +1,284 @@
+/*
+ * QEMU VNC display driver: Websockets support
@@ -407,7 +435,7 @@
+ return 1;
+}
--- /dev/null
-+++ xen-4.2.2/tools/qemu-xen/ui/vnc-ws.h
++++ xen-4.3.0/tools/qemu-xen/ui/vnc-ws.h
@@ -0,0 +1,86 @@
+/*
+ * QEMU VNC display driver: Websockets support
@@ -495,9 +523,9 @@
+ size_t *payload_size, size_t *frame_size);
+
+#endif /* __QEMU_UI_VNC_WS_H */
---- xen-4.2.2.orig/tools/qemu-xen/ui/vnc.c
-+++ xen-4.2.2/tools/qemu-xen/ui/vnc.c
-@@ -391,7 +391,6 @@
+--- xen-4.3.0.orig/tools/qemu-xen/ui/vnc.c
++++ xen-4.3.0/tools/qemu-xen/ui/vnc.c
+@@ -420,7 +420,6 @@
static int vnc_update_client(VncState *vs, int has_dirty);
static int vnc_update_client_sync(VncState *vs, int has_dirty);
static void vnc_disconnect_start(VncState *vs);
@@ -505,7 +533,7 @@
static void vnc_init_timer(VncDisplay *vd);
static void vnc_remove_timer(VncDisplay *vd);
-@@ -479,6 +478,13 @@
+@@ -510,6 +509,13 @@
buffer->offset += len;
}
@@ -519,7 +547,7 @@
static void vnc_desktop_resize(VncState *vs)
{
DisplayState *ds = vs->ds;
-@@ -1002,7 +1008,7 @@
+@@ -1016,7 +1022,7 @@
vs->csock = -1;
}
@@ -528,7 +556,7 @@
{
int i;
-@@ -1013,6 +1019,10 @@
+@@ -1027,6 +1033,10 @@
buffer_free(&vs->input);
buffer_free(&vs->output);
@@ -539,7 +567,7 @@
qobject_decref(vs->info);
-@@ -1150,8 +1160,7 @@
+@@ -1166,8 +1176,7 @@
if (!ret)
return 0;
@@ -549,7 +577,7 @@
if (vs->output.offset == 0) {
qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
-@@ -1177,7 +1186,16 @@
+@@ -1193,7 +1202,16 @@
vnc_client_write_sasl(vs);
} else
#endif /* CONFIG_VNC_SASL */
@@ -567,7 +595,7 @@
}
void vnc_client_write(void *opaque)
-@@ -1185,7 +1203,11 @@
+@@ -1201,7 +1219,11 @@
VncState *vs = opaque;
vnc_lock_output(vs);
@@ -580,7 +608,7 @@
vnc_client_write_locked(opaque);
} else if (vs->csock != -1) {
qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
-@@ -1273,7 +1295,21 @@
+@@ -1295,7 +1317,21 @@
ret = vnc_client_read_sasl(vs);
else
#endif /* CONFIG_VNC_SASL */
@@ -602,7 +630,7 @@
if (!ret) {
if (vs->csock == -1)
vnc_disconnect_finish(vs);
-@@ -1291,8 +1327,7 @@
+@@ -1313,8 +1349,7 @@
}
if (!ret) {
@@ -612,7 +640,7 @@
} else {
vs->read_handler_expect = ret;
}
-@@ -1345,7 +1380,11 @@
+@@ -1367,7 +1402,11 @@
void vnc_flush(VncState *vs)
{
vnc_lock_output(vs);
@@ -625,7 +653,7 @@
vnc_client_write_locked(vs);
}
vnc_unlock_output(vs);
-@@ -2525,7 +2564,7 @@
+@@ -2657,7 +2696,7 @@
}
}
@@ -634,7 +662,7 @@
{
VncState *vs = g_malloc0(sizeof(VncState));
int i;
-@@ -2552,12 +2591,33 @@
+@@ -2684,13 +2723,34 @@
VNC_DEBUG("New client on socket %d\n", csock);
dcl->idle = 0;
socket_set_nonblock(vs->csock);
@@ -651,6 +679,7 @@
vnc_client_cache_addr(vs);
vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
+ vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
vs->vd = vd;
+
@@ -669,7 +698,7 @@
vs->ds = vd->ds;
vs->last_x = -1;
vs->last_y = -1;
-@@ -2590,21 +2650,41 @@
+@@ -2722,21 +2782,41 @@
/* vs might be free()ed here */
}
@@ -714,7 +743,7 @@
void vnc_display_init(DisplayState *ds)
{
VncDisplay *vs = g_malloc0(sizeof(*vs));
-@@ -2616,6 +2696,9 @@
+@@ -2748,6 +2828,9 @@
vnc_display = vs;
vs->lsock = -1;
@@ -724,7 +753,7 @@
vs->ds = ds;
QTAILQ_INIT(&vs->clients);
-@@ -2659,6 +2742,15 @@
+@@ -2789,6 +2872,15 @@
close(vs->lsock);
vs->lsock = -1;
}
@@ -740,7 +769,7 @@
vs->auth = VNC_AUTH_INVALID;
#ifdef CONFIG_VNC_TLS
vs->subauth = VNC_AUTH_INVALID;
-@@ -2769,6 +2861,36 @@
+@@ -2910,6 +3002,36 @@
} else if (strncmp(options, "sasl", 4) == 0) {
sasl = 1; /* Require SASL auth */
#endif
@@ -777,23 +806,30 @@
#ifdef CONFIG_VNC_TLS
} else if (strncmp(options, "tls", 3) == 0) {
tls = 1; /* Require TLS */
-@@ -2931,7 +3053,10 @@
- } else {
- int csock = vs->lsock;
- vs->lsock = -1;
-- vnc_connect(vs, csock, 0);
+@@ -3068,6 +3190,9 @@
+ /* connect to viewer */
+ int csock;
+ vs->lsock = -1;
+#ifdef CONFIG_VNC_WS
-+ vs->lwebsock = -1;
++ vs->lwebsock = -1;
+#endif
-+ vnc_connect(vs, csock, 0, 0);
+ if (strncmp(display, "unix:", 5) == 0) {
+ csock = unix_connect(display+5, errp);
+ } else {
+@@ -3076,7 +3201,7 @@
+ if (csock < 0) {
+ goto fail;
}
- return 0;
-
-@@ -2944,21 +3069,56 @@
- vs->lsock = unix_listen(display+5, dpy+5, 256-5);
+- vnc_connect(vs, csock, 0);
++ vnc_connect(vs, csock, 0, 0);
+ } else {
+ /* listen for connects */
+ char *dpy;
+@@ -3087,25 +3212,54 @@
} else {
- vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
-+ if (-1 == vs->lsock) {
+ vs->lsock = inet_listen(display, dpy, 256,
+ SOCK_STREAM, 5900, errp);
++ if (vs->lsock < 0) {
+ g_free(dpy);
+ goto fail;
+ }
@@ -818,45 +854,41 @@
+ }
+#endif /* CONFIG_VNC_WS */
}
-- if (-1 == vs->lsock) {
+- if (vs->lsock < 0) {
- g_free(dpy);
-- return -1;
-- } else {
-- g_free(vs->display);
-- vs->display = dpy;
-+ g_free(vs->display);
-+ vs->display = dpy;
-+
+- goto fail;
+- }
+ g_free(vs->display);
+ vs->display = dpy;
+- qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
+ qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_regular_read, NULL, vs);
+#ifdef CONFIG_VNC_WS
+ if (vs->websocket) {
+ qemu_set_fd_handler2(vs->lwebsock, NULL, vnc_listen_websocket_read, NULL, vs);
- }
++ }
+#endif
}
-- return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
-+ return 0;
-+
-+fail:
-+ g_free(vs->display);
-+ vs->display = NULL;
+ return;
+
+ fail:
+ g_free(vs->display);
+ vs->display = NULL;
+#ifdef CONFIG_VNC_WS
+ g_free(vs->ws_display);
+ vs->ws_display = NULL;
+#endif /* CONFIG_VNC_WS */
-+ return -1;
}
void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
{
VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
-- return vnc_connect(vs, csock, skipauth);
-+ return vnc_connect(vs, csock, skipauth, 0);
+- vnc_connect(vs, csock, skipauth);
++ vnc_connect(vs, csock, skipauth, 0);
}
---- xen-4.2.2.orig/tools/qemu-xen/ui/vnc.h
-+++ xen-4.2.2/tools/qemu-xen/ui/vnc.h
-@@ -101,6 +101,9 @@
+--- xen-4.3.0.orig/tools/qemu-xen/ui/vnc.h
++++ xen-4.3.0/tools/qemu-xen/ui/vnc.h
+@@ -99,6 +99,9 @@
#ifdef CONFIG_VNC_SASL
#include "vnc-auth-sasl.h"
#endif
@@ -866,7 +898,7 @@
struct VncRectStat
{
-@@ -128,6 +131,11 @@
+@@ -142,6 +145,11 @@
QEMUTimer *timer;
int timer_interval;
int lsock;
@@ -878,7 +910,7 @@
DisplayState *ds;
kbd_layout_t *kbd_layout;
int lock_key_sync;
-@@ -265,11 +273,19 @@
+@@ -269,11 +277,19 @@
#ifdef CONFIG_VNC_SASL
VncStateSASL sasl;
#endif
@@ -897,8 +929,8 @@
+#endif
/* current output mode information */
VncWritePixels *write_pixels;
- DisplaySurface clientds;
-@@ -489,6 +505,8 @@
+ PixelFormat client_pf;
+@@ -493,6 +509,8 @@
void vnc_write_u8(VncState *vs, uint8_t value);
void vnc_flush(VncState *vs);
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting);
@@ -907,16 +939,13 @@
/* Buffer I/O functions */
-@@ -507,10 +525,11 @@
- /* Buffer management */
- void buffer_reserve(Buffer *buffer, size_t len);
- int buffer_empty(Buffer *buffer);
--uint8_t *buffer_end(Buffer *buffer);
+@@ -510,7 +528,8 @@
void buffer_reset(Buffer *buffer);
void buffer_free(Buffer *buffer);
void buffer_append(Buffer *buffer, const void *data, size_t len);
+-
+void buffer_advance(Buffer *buf, size_t len);
+uint8_t *buffer_end(Buffer *buffer);
-
/* Misc helpers */
+
diff --git a/main/xen/qemu_uclibc_configure.patch b/main/xen/qemu_uclibc_configure.patch
deleted file mode 100644
index c948f8c2f..000000000
--- a/main/xen/qemu_uclibc_configure.patch
+++ /dev/null
@@ -1,48 +0,0 @@
---- a/tools/qemu-xen/configure
-+++ b/tools/qemu-xen/configure
-@@ -2457,19 +2457,44 @@ EOF
- fi
- fi
-
-+##########################################
-+# Do we need libm
-+cat > $TMPC << EOF
-+#include <math.h>
-+int main(void) { return isnan(sin(0.0)); }
-+EOF
-+if compile_prog "" "" ; then
-+ :
-+elif compile_prog "" "-lm" ; then
-+ LIBS="-lm $LIBS"
-+ libs_qga="-lm $libs_qga"
-+else
-+ echo
-+ echo "Error: libm check failed"
-+ echo
-+ exit 1
-+fi
-
- ##########################################
- # Do we need librt
-+# uClibc provides 2 versions of clock_gettime(), one with realtime
-+# support and one without. This means that the clock_gettime() don't
-+# need -lrt. We still need it for timer_create() so we check for this
-+# function in addition.
- cat > $TMPC <<EOF
- #include <signal.h>
- #include <time.h>
--int main(void) { clockid_t id; return clock_gettime(id, NULL); }
-+int main(void) {
-+ timer_create(CLOCK_REALTIME, NULL, NULL);
-+ return clock_gettime(CLOCK_REALTIME, NULL);
-+}
- EOF
-
- if compile_prog "" "" ; then
- :
- elif compile_prog "" "-lrt" ; then
- LIBS="-lrt $LIBS"
-+ libs_qga="-lrt $libs_qga"
- fi
-
- if test "$darwin" != "yes" -a "$mingw32" != "yes" -a "$solaris" != yes -a \
diff --git a/main/xen/xsa45-4.2.patch b/main/xen/xsa45-4.2.patch
deleted file mode 100644
index dfdfdea64..000000000
--- a/main/xen/xsa45-4.2.patch
+++ /dev/null
@@ -1,1133 +0,0 @@
-diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
-index 26a7f12..b97ac6d 100644
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -73,8 +73,6 @@ void (*dead_idle) (void) __read_mostly = default_dead_idle;
- static void paravirt_ctxt_switch_from(struct vcpu *v);
- static void paravirt_ctxt_switch_to(struct vcpu *v);
-
--static void vcpu_destroy_pagetables(struct vcpu *v);
--
- static void default_idle(void)
- {
- local_irq_disable();
-@@ -860,6 +858,9 @@ int arch_set_info_guest(
-
- if ( !v->is_initialised )
- {
-+ if ( !compat && !(flags & VGCF_in_kernel) && !c.nat->ctrlreg[1] )
-+ return -EINVAL;
-+
- v->arch.pv_vcpu.ldt_base = c(ldt_base);
- v->arch.pv_vcpu.ldt_ents = c(ldt_ents);
- }
-@@ -957,24 +958,44 @@ int arch_set_info_guest(
- if ( rc != 0 )
- return rc;
-
-+ set_bit(_VPF_in_reset, &v->pause_flags);
-+
- if ( !compat )
-- {
- cr3_gfn = xen_cr3_to_pfn(c.nat->ctrlreg[3]);
-- cr3_page = get_page_from_gfn(d, cr3_gfn, NULL, P2M_ALLOC);
--
-- if ( !cr3_page )
-- {
-- destroy_gdt(v);
-- return -EINVAL;
-- }
-- if ( !paging_mode_refcounts(d)
-- && !get_page_type(cr3_page, PGT_base_page_table) )
-- {
-- put_page(cr3_page);
-- destroy_gdt(v);
-- return -EINVAL;
-- }
-+#ifdef CONFIG_COMPAT
-+ else
-+ cr3_gfn = compat_cr3_to_pfn(c.cmp->ctrlreg[3]);
-+#endif
-+ cr3_page = get_page_from_gfn(d, cr3_gfn, NULL, P2M_ALLOC);
-
-+ if ( !cr3_page )
-+ rc = -EINVAL;
-+ else if ( paging_mode_refcounts(d) )
-+ /* nothing */;
-+ else if ( cr3_page == v->arch.old_guest_table )
-+ {
-+ v->arch.old_guest_table = NULL;
-+ put_page(cr3_page);
-+ }
-+ else
-+ {
-+ /*
-+ * Since v->arch.guest_table{,_user} are both NULL, this effectively
-+ * is just a call to put_old_guest_table().
-+ */
-+ if ( !compat )
-+ rc = vcpu_destroy_pagetables(v);
-+ if ( !rc )
-+ rc = get_page_type_preemptible(cr3_page,
-+ !compat ? PGT_root_page_table
-+ : PGT_l3_page_table);
-+ if ( rc == -EINTR )
-+ rc = -EAGAIN;
-+ }
-+ if ( rc )
-+ /* handled below */;
-+ else if ( !compat )
-+ {
- v->arch.guest_table = pagetable_from_page(cr3_page);
- #ifdef __x86_64__
- if ( c.nat->ctrlreg[1] )
-@@ -982,56 +1003,44 @@ int arch_set_info_guest(
- cr3_gfn = xen_cr3_to_pfn(c.nat->ctrlreg[1]);
- cr3_page = get_page_from_gfn(d, cr3_gfn, NULL, P2M_ALLOC);
-
-- if ( !cr3_page ||
-- (!paging_mode_refcounts(d)
-- && !get_page_type(cr3_page, PGT_base_page_table)) )
-+ if ( !cr3_page )
-+ rc = -EINVAL;
-+ else if ( !paging_mode_refcounts(d) )
- {
-- if (cr3_page)
-- put_page(cr3_page);
-- cr3_page = pagetable_get_page(v->arch.guest_table);
-- v->arch.guest_table = pagetable_null();
-- if ( paging_mode_refcounts(d) )
-- put_page(cr3_page);
-- else
-- put_page_and_type(cr3_page);
-- destroy_gdt(v);
-- return -EINVAL;
-+ rc = get_page_type_preemptible(cr3_page, PGT_root_page_table);
-+ switch ( rc )
-+ {
-+ case -EINTR:
-+ rc = -EAGAIN;
-+ case -EAGAIN:
-+ v->arch.old_guest_table =
-+ pagetable_get_page(v->arch.guest_table);
-+ v->arch.guest_table = pagetable_null();
-+ break;
-+ }
- }
--
-- v->arch.guest_table_user = pagetable_from_page(cr3_page);
-- }
-- else if ( !(flags & VGCF_in_kernel) )
-- {
-- destroy_gdt(v);
-- return -EINVAL;
-+ if ( !rc )
-+ v->arch.guest_table_user = pagetable_from_page(cr3_page);
- }
- }
- else
- {
- l4_pgentry_t *l4tab;
-
-- cr3_gfn = compat_cr3_to_pfn(c.cmp->ctrlreg[3]);
-- cr3_page = get_page_from_gfn(d, cr3_gfn, NULL, P2M_ALLOC);
--
-- if ( !cr3_page)
-- {
-- destroy_gdt(v);
-- return -EINVAL;
-- }
--
-- if (!paging_mode_refcounts(d)
-- && !get_page_type(cr3_page, PGT_l3_page_table) )
-- {
-- put_page(cr3_page);
-- destroy_gdt(v);
-- return -EINVAL;
-- }
--
- l4tab = __va(pagetable_get_paddr(v->arch.guest_table));
- *l4tab = l4e_from_pfn(page_to_mfn(cr3_page),
- _PAGE_PRESENT|_PAGE_RW|_PAGE_USER|_PAGE_ACCESSED);
- #endif
- }
-+ if ( rc )
-+ {
-+ if ( cr3_page )
-+ put_page(cr3_page);
-+ destroy_gdt(v);
-+ return rc;
-+ }
-+
-+ clear_bit(_VPF_in_reset, &v->pause_flags);
-
- if ( v->vcpu_id == 0 )
- update_domain_wallclock_time(d);
-@@ -1053,17 +1062,16 @@ int arch_set_info_guest(
- #undef c
- }
-
--void arch_vcpu_reset(struct vcpu *v)
-+int arch_vcpu_reset(struct vcpu *v)
- {
- if ( !is_hvm_vcpu(v) )
- {
- destroy_gdt(v);
-- vcpu_destroy_pagetables(v);
-- }
-- else
-- {
-- vcpu_end_shutdown_deferral(v);
-+ return vcpu_destroy_pagetables(v);
- }
-+
-+ vcpu_end_shutdown_deferral(v);
-+ return 0;
- }
-
- /*
-@@ -2069,63 +2077,6 @@ static int relinquish_memory(
- return ret;
- }
-
--static void vcpu_destroy_pagetables(struct vcpu *v)
--{
-- struct domain *d = v->domain;
-- unsigned long pfn;
--
--#ifdef __x86_64__
-- if ( is_pv_32on64_vcpu(v) )
-- {
-- pfn = l4e_get_pfn(*(l4_pgentry_t *)
-- __va(pagetable_get_paddr(v->arch.guest_table)));
--
-- if ( pfn != 0 )
-- {
-- if ( paging_mode_refcounts(d) )
-- put_page(mfn_to_page(pfn));
-- else
-- put_page_and_type(mfn_to_page(pfn));
-- }
--
-- l4e_write(
-- (l4_pgentry_t *)__va(pagetable_get_paddr(v->arch.guest_table)),
-- l4e_empty());
--
-- v->arch.cr3 = 0;
-- return;
-- }
--#endif
--
-- pfn = pagetable_get_pfn(v->arch.guest_table);
-- if ( pfn != 0 )
-- {
-- if ( paging_mode_refcounts(d) )
-- put_page(mfn_to_page(pfn));
-- else
-- put_page_and_type(mfn_to_page(pfn));
-- v->arch.guest_table = pagetable_null();
-- }
--
--#ifdef __x86_64__
-- /* Drop ref to guest_table_user (from MMUEXT_NEW_USER_BASEPTR) */
-- pfn = pagetable_get_pfn(v->arch.guest_table_user);
-- if ( pfn != 0 )
-- {
-- if ( !is_pv_32bit_vcpu(v) )
-- {
-- if ( paging_mode_refcounts(d) )
-- put_page(mfn_to_page(pfn));
-- else
-- put_page_and_type(mfn_to_page(pfn));
-- }
-- v->arch.guest_table_user = pagetable_null();
-- }
--#endif
--
-- v->arch.cr3 = 0;
--}
--
- int domain_relinquish_resources(struct domain *d)
- {
- int ret;
-@@ -2143,7 +2094,11 @@ int domain_relinquish_resources(struct domain *d)
-
- /* Drop the in-use references to page-table bases. */
- for_each_vcpu ( d, v )
-- vcpu_destroy_pagetables(v);
-+ {
-+ ret = vcpu_destroy_pagetables(v);
-+ if ( ret )
-+ return ret;
-+ }
-
- if ( !is_hvm_domain(d) )
- {
-diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
-index 3d471a5..efacc98 100644
---- a/xen/arch/x86/hvm/hvm.c
-+++ b/xen/arch/x86/hvm/hvm.c
-@@ -3509,8 +3509,11 @@ static void hvm_s3_suspend(struct domain *d)
-
- for_each_vcpu ( d, v )
- {
-+ int rc;
-+
- vlapic_reset(vcpu_vlapic(v));
-- vcpu_reset(v);
-+ rc = vcpu_reset(v);
-+ ASSERT(!rc);
- }
-
- vpic_reset(d);
-diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c
-index 52d111b..7778342 100644
---- a/xen/arch/x86/hvm/vlapic.c
-+++ b/xen/arch/x86/hvm/vlapic.c
-@@ -252,10 +252,13 @@ static void vlapic_init_sipi_action(unsigned long _vcpu)
- {
- case APIC_DM_INIT: {
- bool_t fpu_initialised;
-+ int rc;
-+
- domain_lock(target->domain);
- /* Reset necessary VCPU state. This does not include FPU state. */
- fpu_initialised = target->fpu_initialised;
-- vcpu_reset(target);
-+ rc = vcpu_reset(target);
-+ ASSERT(!rc);
- target->fpu_initialised = fpu_initialised;
- vlapic_reset(vcpu_vlapic(target));
- domain_unlock(target->domain);
-diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
-index 8444610..055f307 100644
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -1241,7 +1241,16 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
- #endif
-
- if ( unlikely(partial > 0) )
-+ {
-+ ASSERT(preemptible >= 0);
- return __put_page_type(l3e_get_page(l3e), preemptible);
-+ }
-+
-+ if ( preemptible < 0 )
-+ {
-+ current->arch.old_guest_table = l3e_get_page(l3e);
-+ return 0;
-+ }
-
- return put_page_and_type_preemptible(l3e_get_page(l3e), preemptible);
- }
-@@ -1254,7 +1263,17 @@ static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
- (l4e_get_pfn(l4e) != pfn) )
- {
- if ( unlikely(partial > 0) )
-+ {
-+ ASSERT(preemptible >= 0);
- return __put_page_type(l4e_get_page(l4e), preemptible);
-+ }
-+
-+ if ( preemptible < 0 )
-+ {
-+ current->arch.old_guest_table = l4e_get_page(l4e);
-+ return 0;
-+ }
-+
- return put_page_and_type_preemptible(l4e_get_page(l4e), preemptible);
- }
- return 1;
-@@ -1549,12 +1568,17 @@ static int alloc_l3_table(struct page_info *page, int preemptible)
- if ( rc < 0 && rc != -EAGAIN && rc != -EINTR )
- {
- MEM_LOG("Failure in alloc_l3_table: entry %d", i);
-+ if ( i )
-+ {
-+ page->nr_validated_ptes = i;
-+ page->partial_pte = 0;
-+ current->arch.old_guest_table = page;
-+ }
- while ( i-- > 0 )
- {
- if ( !is_guest_l3_slot(i) )
- continue;
- unadjust_guest_l3e(pl3e[i], d);
-- put_page_from_l3e(pl3e[i], pfn, 0, 0);
- }
- }
-
-@@ -1584,22 +1608,24 @@ static int alloc_l4_table(struct page_info *page, int preemptible)
- page->nr_validated_ptes = i;
- page->partial_pte = partial ?: 1;
- }
-- else if ( rc == -EINTR )
-+ else if ( rc < 0 )
- {
-+ if ( rc != -EINTR )
-+ MEM_LOG("Failure in alloc_l4_table: entry %d", i);
- if ( i )
- {
- page->nr_validated_ptes = i;
- page->partial_pte = 0;
-- rc = -EAGAIN;
-+ if ( rc == -EINTR )
-+ rc = -EAGAIN;
-+ else
-+ {
-+ if ( current->arch.old_guest_table )
-+ page->nr_validated_ptes++;
-+ current->arch.old_guest_table = page;
-+ }
- }
- }
-- else if ( rc < 0 )
-- {
-- MEM_LOG("Failure in alloc_l4_table: entry %d", i);
-- while ( i-- > 0 )
-- if ( is_guest_l4_slot(d, i) )
-- put_page_from_l4e(pl4e[i], pfn, 0, 0);
-- }
- if ( rc < 0 )
- return rc;
-
-@@ -2047,7 +2073,7 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
- pae_flush_pgd(pfn, pgentry_ptr_to_slot(pl3e), nl3e);
- }
-
-- put_page_from_l3e(ol3e, pfn, 0, 0);
-+ put_page_from_l3e(ol3e, pfn, 0, -preemptible);
- return rc;
- }
-
-@@ -2110,7 +2136,7 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
- return -EFAULT;
- }
-
-- put_page_from_l4e(ol4e, pfn, 0, 0);
-+ put_page_from_l4e(ol4e, pfn, 0, -preemptible);
- return rc;
- }
-
-@@ -2268,7 +2294,15 @@ static int alloc_page_type(struct page_info *page, unsigned long type,
- PRtype_info ": caf=%08lx taf=%" PRtype_info,
- page_to_mfn(page), get_gpfn_from_mfn(page_to_mfn(page)),
- type, page->count_info, page->u.inuse.type_info);
-- page->u.inuse.type_info = 0;
-+ if ( page != current->arch.old_guest_table )
-+ page->u.inuse.type_info = 0;
-+ else
-+ {
-+ ASSERT((page->u.inuse.type_info &
-+ (PGT_count_mask | PGT_validated)) == 1);
-+ get_page_light(page);
-+ page->u.inuse.type_info |= PGT_partial;
-+ }
- }
- else
- {
-@@ -2808,49 +2842,150 @@ static void put_superpage(unsigned long mfn)
-
- #endif
-
-+static int put_old_guest_table(struct vcpu *v)
-+{
-+ int rc;
-+
-+ if ( !v->arch.old_guest_table )
-+ return 0;
-+
-+ switch ( rc = put_page_and_type_preemptible(v->arch.old_guest_table, 1) )
-+ {
-+ case -EINTR:
-+ case -EAGAIN:
-+ return -EAGAIN;
-+ }
-+
-+ v->arch.old_guest_table = NULL;
-+
-+ return rc;
-+}
-+
-+int vcpu_destroy_pagetables(struct vcpu *v)
-+{
-+ unsigned long mfn = pagetable_get_pfn(v->arch.guest_table);
-+ struct page_info *page;
-+ int rc = put_old_guest_table(v);
-+
-+ if ( rc )
-+ return rc;
-+
-+#ifdef __x86_64__
-+ if ( is_pv_32on64_vcpu(v) )
-+ mfn = l4e_get_pfn(*(l4_pgentry_t *)mfn_to_virt(mfn));
-+#endif
-+
-+ if ( mfn )
-+ {
-+ page = mfn_to_page(mfn);
-+ if ( paging_mode_refcounts(v->domain) )
-+ put_page(page);
-+ else
-+ rc = put_page_and_type_preemptible(page, 1);
-+ }
-+
-+#ifdef __x86_64__
-+ if ( is_pv_32on64_vcpu(v) )
-+ {
-+ if ( !rc )
-+ l4e_write(
-+ (l4_pgentry_t *)__va(pagetable_get_paddr(v->arch.guest_table)),
-+ l4e_empty());
-+ }
-+ else
-+#endif
-+ if ( !rc )
-+ {
-+ v->arch.guest_table = pagetable_null();
-+
-+#ifdef __x86_64__
-+ /* Drop ref to guest_table_user (from MMUEXT_NEW_USER_BASEPTR) */
-+ mfn = pagetable_get_pfn(v->arch.guest_table_user);
-+ if ( mfn )
-+ {
-+ page = mfn_to_page(mfn);
-+ if ( paging_mode_refcounts(v->domain) )
-+ put_page(page);
-+ else
-+ rc = put_page_and_type_preemptible(page, 1);
-+ }
-+ if ( !rc )
-+ v->arch.guest_table_user = pagetable_null();
-+#endif
-+ }
-+
-+ v->arch.cr3 = 0;
-+
-+ return rc;
-+}
-
- int new_guest_cr3(unsigned long mfn)
- {
- struct vcpu *curr = current;
- struct domain *d = curr->domain;
-- int okay;
-+ int rc;
- unsigned long old_base_mfn;
-
- #ifdef __x86_64__
- if ( is_pv_32on64_domain(d) )
- {
-- okay = paging_mode_refcounts(d)
-- ? 0 /* Old code was broken, but what should it be? */
-- : mod_l4_entry(
-+ rc = paging_mode_refcounts(d)
-+ ? -EINVAL /* Old code was broken, but what should it be? */
-+ : mod_l4_entry(
- __va(pagetable_get_paddr(curr->arch.guest_table)),
- l4e_from_pfn(
- mfn,
- (_PAGE_PRESENT|_PAGE_RW|_PAGE_USER|_PAGE_ACCESSED)),
-- pagetable_get_pfn(curr->arch.guest_table), 0, 0, curr) == 0;
-- if ( unlikely(!okay) )
-+ pagetable_get_pfn(curr->arch.guest_table), 0, 1, curr);
-+ switch ( rc )
- {
-+ case 0:
-+ break;
-+ case -EINTR:
-+ case -EAGAIN:
-+ return -EAGAIN;
-+ default:
- MEM_LOG("Error while installing new compat baseptr %lx", mfn);
-- return 0;
-+ return rc;
- }
-
- invalidate_shadow_ldt(curr, 0);
- write_ptbase(curr);
-
-- return 1;
-+ return 0;
- }
- #endif
-- okay = paging_mode_refcounts(d)
-- ? get_page_from_pagenr(mfn, d)
-- : !get_page_and_type_from_pagenr(mfn, PGT_root_page_table, d, 0, 0);
-- if ( unlikely(!okay) )
-+ rc = put_old_guest_table(curr);
-+ if ( unlikely(rc) )
-+ return rc;
-+
-+ old_base_mfn = pagetable_get_pfn(curr->arch.guest_table);
-+ /*
-+ * This is particularly important when getting restarted after the
-+ * previous attempt got preempted in the put-old-MFN phase.
-+ */
-+ if ( old_base_mfn == mfn )
- {
-- MEM_LOG("Error while installing new baseptr %lx", mfn);
-+ write_ptbase(curr);
- return 0;
- }
-
-- invalidate_shadow_ldt(curr, 0);
-+ rc = paging_mode_refcounts(d)
-+ ? (get_page_from_pagenr(mfn, d) ? 0 : -EINVAL)
-+ : get_page_and_type_from_pagenr(mfn, PGT_root_page_table, d, 0, 1);
-+ switch ( rc )
-+ {
-+ case 0:
-+ break;
-+ case -EINTR:
-+ case -EAGAIN:
-+ return -EAGAIN;
-+ default:
-+ MEM_LOG("Error while installing new baseptr %lx", mfn);
-+ return rc;
-+ }
-
-- old_base_mfn = pagetable_get_pfn(curr->arch.guest_table);
-+ invalidate_shadow_ldt(curr, 0);
-
- curr->arch.guest_table = pagetable_from_pfn(mfn);
- update_cr3(curr);
-@@ -2859,13 +2994,25 @@ int new_guest_cr3(unsigned long mfn)
-
- if ( likely(old_base_mfn != 0) )
- {
-+ struct page_info *page = mfn_to_page(old_base_mfn);
-+
- if ( paging_mode_refcounts(d) )
-- put_page(mfn_to_page(old_base_mfn));
-+ put_page(page);
- else
-- put_page_and_type(mfn_to_page(old_base_mfn));
-+ switch ( rc = put_page_and_type_preemptible(page, 1) )
-+ {
-+ case -EINTR:
-+ rc = -EAGAIN;
-+ case -EAGAIN:
-+ curr->arch.old_guest_table = page;
-+ break;
-+ default:
-+ BUG_ON(rc);
-+ break;
-+ }
- }
-
-- return 1;
-+ return rc;
- }
-
- static struct domain *get_pg_owner(domid_t domid)
-@@ -2994,12 +3141,29 @@ long do_mmuext_op(
- unsigned int foreigndom)
- {
- struct mmuext_op op;
-- int rc = 0, i = 0, okay;
- unsigned long type;
-- unsigned int done = 0;
-+ unsigned int i = 0, done = 0;
- struct vcpu *curr = current;
- struct domain *d = curr->domain;
- struct domain *pg_owner;
-+ int okay, rc = put_old_guest_table(curr);
-+
-+ if ( unlikely(rc) )
-+ {
-+ if ( likely(rc == -EAGAIN) )
-+ rc = hypercall_create_continuation(
-+ __HYPERVISOR_mmuext_op, "hihi", uops, count, pdone,
-+ foreigndom);
-+ return rc;
-+ }
-+
-+ if ( unlikely(count == MMU_UPDATE_PREEMPTED) &&
-+ likely(guest_handle_is_null(uops)) )
-+ {
-+ /* See the curr->arch.old_guest_table related
-+ * hypercall_create_continuation() below. */
-+ return (int)foreigndom;
-+ }
-
- if ( unlikely(count & MMU_UPDATE_PREEMPTED) )
- {
-@@ -3024,7 +3188,7 @@ long do_mmuext_op(
-
- for ( i = 0; i < count; i++ )
- {
-- if ( hypercall_preempt_check() )
-+ if ( curr->arch.old_guest_table || hypercall_preempt_check() )
- {
- rc = -EAGAIN;
- break;
-@@ -3088,21 +3252,17 @@ long do_mmuext_op(
- }
-
- if ( (rc = xsm_memory_pin_page(d, pg_owner, page)) != 0 )
-- {
-- put_page_and_type(page);
- okay = 0;
-- break;
-- }
--
-- if ( unlikely(test_and_set_bit(_PGT_pinned,
-- &page->u.inuse.type_info)) )
-+ else if ( unlikely(test_and_set_bit(_PGT_pinned,
-+ &page->u.inuse.type_info)) )
- {
- MEM_LOG("Mfn %lx already pinned", page_to_mfn(page));
-- put_page_and_type(page);
- okay = 0;
-- break;
- }
-
-+ if ( unlikely(!okay) )
-+ goto pin_drop;
-+
- /* A page is dirtied when its pin status is set. */
- paging_mark_dirty(pg_owner, page_to_mfn(page));
-
-@@ -3116,7 +3276,13 @@ long do_mmuext_op(
- &page->u.inuse.type_info));
- spin_unlock(&pg_owner->page_alloc_lock);
- if ( drop_ref )
-- put_page_and_type(page);
-+ {
-+ pin_drop:
-+ if ( type == PGT_l1_page_table )
-+ put_page_and_type(page);
-+ else
-+ curr->arch.old_guest_table = page;
-+ }
- }
-
- break;
-@@ -3144,7 +3310,17 @@ long do_mmuext_op(
- break;
- }
-
-- put_page_and_type(page);
-+ switch ( rc = put_page_and_type_preemptible(page, 1) )
-+ {
-+ case -EINTR:
-+ case -EAGAIN:
-+ curr->arch.old_guest_table = page;
-+ rc = 0;
-+ break;
-+ default:
-+ BUG_ON(rc);
-+ break;
-+ }
- put_page(page);
-
- /* A page is dirtied when its pin status is cleared. */
-@@ -3154,8 +3330,13 @@ long do_mmuext_op(
- }
-
- case MMUEXT_NEW_BASEPTR:
-- okay = (!paging_mode_translate(d)
-- && new_guest_cr3(op.arg1.mfn));
-+ if ( paging_mode_translate(d) )
-+ okay = 0;
-+ else
-+ {
-+ rc = new_guest_cr3(op.arg1.mfn);
-+ okay = !rc;
-+ }
- break;
-
-
-@@ -3169,29 +3350,56 @@ long do_mmuext_op(
- break;
- }
-
-+ old_mfn = pagetable_get_pfn(curr->arch.guest_table_user);
-+ /*
-+ * This is particularly important when getting restarted after the
-+ * previous attempt got preempted in the put-old-MFN phase.
-+ */
-+ if ( old_mfn == op.arg1.mfn )
-+ break;
-+
- if ( op.arg1.mfn != 0 )
- {
- if ( paging_mode_refcounts(d) )
- okay = get_page_from_pagenr(op.arg1.mfn, d);
- else
-- okay = !get_page_and_type_from_pagenr(
-- op.arg1.mfn, PGT_root_page_table, d, 0, 0);
-+ {
-+ rc = get_page_and_type_from_pagenr(
-+ op.arg1.mfn, PGT_root_page_table, d, 0, 1);
-+ okay = !rc;
-+ }
- if ( unlikely(!okay) )
- {
-- MEM_LOG("Error while installing new mfn %lx", op.arg1.mfn);
-+ if ( rc == -EINTR )
-+ rc = -EAGAIN;
-+ else if ( rc != -EAGAIN )
-+ MEM_LOG("Error while installing new mfn %lx",
-+ op.arg1.mfn);
- break;
- }
- }
-
-- old_mfn = pagetable_get_pfn(curr->arch.guest_table_user);
- curr->arch.guest_table_user = pagetable_from_pfn(op.arg1.mfn);
-
- if ( old_mfn != 0 )
- {
-+ struct page_info *page = mfn_to_page(old_mfn);
-+
- if ( paging_mode_refcounts(d) )
-- put_page(mfn_to_page(old_mfn));
-+ put_page(page);
- else
-- put_page_and_type(mfn_to_page(old_mfn));
-+ switch ( rc = put_page_and_type_preemptible(page, 1) )
-+ {
-+ case -EINTR:
-+ rc = -EAGAIN;
-+ case -EAGAIN:
-+ curr->arch.old_guest_table = page;
-+ okay = 0;
-+ break;
-+ default:
-+ BUG_ON(rc);
-+ break;
-+ }
- }
-
- break;
-@@ -3433,9 +3641,27 @@ long do_mmuext_op(
- }
-
- if ( rc == -EAGAIN )
-+ {
-+ ASSERT(i < count);
- rc = hypercall_create_continuation(
- __HYPERVISOR_mmuext_op, "hihi",
- uops, (count - i) | MMU_UPDATE_PREEMPTED, pdone, foreigndom);
-+ }
-+ else if ( curr->arch.old_guest_table )
-+ {
-+ XEN_GUEST_HANDLE(void) null;
-+
-+ ASSERT(rc || i == count);
-+ set_xen_guest_handle(null, NULL);
-+ /*
-+ * In order to have a way to communicate the final return value to
-+ * our continuation, we pass this in place of "foreigndom", building
-+ * on the fact that this argument isn't needed anymore.
-+ */
-+ rc = hypercall_create_continuation(
-+ __HYPERVISOR_mmuext_op, "hihi", null,
-+ MMU_UPDATE_PREEMPTED, null, rc);
-+ }
-
- put_pg_owner(pg_owner);
-
-@@ -3462,11 +3688,28 @@ long do_mmu_update(
- void *va;
- unsigned long gpfn, gmfn, mfn;
- struct page_info *page;
-- int rc = 0, i = 0;
-- unsigned int cmd, done = 0, pt_dom;
-- struct vcpu *v = current;
-+ unsigned int cmd, i = 0, done = 0, pt_dom;
-+ struct vcpu *curr = current, *v = curr;
- struct domain *d = v->domain, *pt_owner = d, *pg_owner;
- struct domain_mmap_cache mapcache;
-+ int rc = put_old_guest_table(curr);
-+
-+ if ( unlikely(rc) )
-+ {
-+ if ( likely(rc == -EAGAIN) )
-+ rc = hypercall_create_continuation(
-+ __HYPERVISOR_mmu_update, "hihi", ureqs, count, pdone,
-+ foreigndom);
-+ return rc;
-+ }
-+
-+ if ( unlikely(count == MMU_UPDATE_PREEMPTED) &&
-+ likely(guest_handle_is_null(ureqs)) )
-+ {
-+ /* See the curr->arch.old_guest_table related
-+ * hypercall_create_continuation() below. */
-+ return (int)foreigndom;
-+ }
-
- if ( unlikely(count & MMU_UPDATE_PREEMPTED) )
- {
-@@ -3515,7 +3758,7 @@ long do_mmu_update(
-
- for ( i = 0; i < count; i++ )
- {
-- if ( hypercall_preempt_check() )
-+ if ( curr->arch.old_guest_table || hypercall_preempt_check() )
- {
- rc = -EAGAIN;
- break;
-@@ -3696,9 +3939,27 @@ long do_mmu_update(
- }
-
- if ( rc == -EAGAIN )
-+ {
-+ ASSERT(i < count);
- rc = hypercall_create_continuation(
- __HYPERVISOR_mmu_update, "hihi",
- ureqs, (count - i) | MMU_UPDATE_PREEMPTED, pdone, foreigndom);
-+ }
-+ else if ( curr->arch.old_guest_table )
-+ {
-+ XEN_GUEST_HANDLE(void) null;
-+
-+ ASSERT(rc || i == count);
-+ set_xen_guest_handle(null, NULL);
-+ /*
-+ * In order to have a way to communicate the final return value to
-+ * our continuation, we pass this in place of "foreigndom", building
-+ * on the fact that this argument isn't needed anymore.
-+ */
-+ rc = hypercall_create_continuation(
-+ __HYPERVISOR_mmu_update, "hihi", null,
-+ MMU_UPDATE_PREEMPTED, null, rc);
-+ }
-
- put_pg_owner(pg_owner);
-
-diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
-index 692281a..eada470 100644
---- a/xen/arch/x86/traps.c
-+++ b/xen/arch/x86/traps.c
-@@ -2407,12 +2407,23 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
- #endif
- }
- page = get_page_from_gfn(v->domain, gfn, NULL, P2M_ALLOC);
-- rc = page ? new_guest_cr3(page_to_mfn(page)) : 0;
- if ( page )
-+ {
-+ rc = new_guest_cr3(page_to_mfn(page));
- put_page(page);
-+ }
-+ else
-+ rc = -EINVAL;
- domain_unlock(v->domain);
-- if ( rc == 0 ) /* not okay */
-+ switch ( rc )
-+ {
-+ case 0:
-+ break;
-+ case -EAGAIN: /* retry after preemption */
-+ goto skip;
-+ default: /* not okay */
- goto fail;
-+ }
- break;
- }
-
-diff --git a/xen/arch/x86/x86_64/compat/mm.c b/xen/arch/x86/x86_64/compat/mm.c
-index fb7baca..ef7822b 100644
---- a/xen/arch/x86/x86_64/compat/mm.c
-+++ b/xen/arch/x86/x86_64/compat/mm.c
-@@ -268,6 +268,13 @@ int compat_mmuext_op(XEN_GUEST_HANDLE(mmuext_op_compat_t) cmp_uops,
- int rc = 0;
- XEN_GUEST_HANDLE(mmuext_op_t) nat_ops;
-
-+ if ( unlikely(count == MMU_UPDATE_PREEMPTED) &&
-+ likely(guest_handle_is_null(cmp_uops)) )
-+ {
-+ set_xen_guest_handle(nat_ops, NULL);
-+ return do_mmuext_op(nat_ops, count, pdone, foreigndom);
-+ }
-+
- preempt_mask = count & MMU_UPDATE_PREEMPTED;
- count ^= preempt_mask;
-
-@@ -365,17 +372,23 @@ int compat_mmuext_op(XEN_GUEST_HANDLE(mmuext_op_compat_t) cmp_uops,
- : mcs->call.args[1];
- unsigned int left = arg1 & ~MMU_UPDATE_PREEMPTED;
-
-- BUG_ON(left == arg1);
-+ BUG_ON(left == arg1 && left != i);
- BUG_ON(left > count);
- guest_handle_add_offset(nat_ops, i - left);
- guest_handle_subtract_offset(cmp_uops, left);
- left = 1;
-- BUG_ON(!hypercall_xlat_continuation(&left, 0x01, nat_ops, cmp_uops));
-- BUG_ON(left != arg1);
-- if (!test_bit(_MCSF_in_multicall, &mcs->flags))
-- regs->_ecx += count - i;
-+ if ( arg1 != MMU_UPDATE_PREEMPTED )
-+ {
-+ BUG_ON(!hypercall_xlat_continuation(&left, 0x01, nat_ops,
-+ cmp_uops));
-+ if ( !test_bit(_MCSF_in_multicall, &mcs->flags) )
-+ regs->_ecx += count - i;
-+ else
-+ mcs->compat_call.args[1] += count - i;
-+ }
- else
-- mcs->compat_call.args[1] += count - i;
-+ BUG_ON(hypercall_xlat_continuation(&left, 0));
-+ BUG_ON(left != arg1);
- }
- else
- BUG_ON(err > 0);
-diff --git a/xen/common/compat/domain.c b/xen/common/compat/domain.c
-index 40a0287..9ddaa38 100644
---- a/xen/common/compat/domain.c
-+++ b/xen/common/compat/domain.c
-@@ -50,6 +50,10 @@ int compat_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
- rc = v->is_initialised ? -EEXIST : arch_set_info_guest(v, cmp_ctxt);
- domain_unlock(d);
-
-+ if ( rc == -EAGAIN )
-+ rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iih",
-+ cmd, vcpuid, arg);
-+
- xfree(cmp_ctxt);
- break;
- }
-diff --git a/xen/common/domain.c b/xen/common/domain.c
-index c09fb73..89ab922 100644
---- a/xen/common/domain.c
-+++ b/xen/common/domain.c
-@@ -779,14 +779,18 @@ void domain_unpause_by_systemcontroller(struct domain *d)
- domain_unpause(d);
- }
-
--void vcpu_reset(struct vcpu *v)
-+int vcpu_reset(struct vcpu *v)
- {
- struct domain *d = v->domain;
-+ int rc;
-
- vcpu_pause(v);
- domain_lock(d);
-
-- arch_vcpu_reset(v);
-+ set_bit(_VPF_in_reset, &v->pause_flags);
-+ rc = arch_vcpu_reset(v);
-+ if ( rc )
-+ goto out_unlock;
-
- set_bit(_VPF_down, &v->pause_flags);
-
-@@ -802,9 +806,13 @@ void vcpu_reset(struct vcpu *v)
- #endif
- cpumask_clear(v->cpu_affinity_tmp);
- clear_bit(_VPF_blocked, &v->pause_flags);
-+ clear_bit(_VPF_in_reset, &v->pause_flags);
-
-+ out_unlock:
- domain_unlock(v->domain);
- vcpu_unpause(v);
-+
-+ return rc;
- }
-
-
-@@ -841,6 +849,11 @@ long do_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
- domain_unlock(d);
-
- free_vcpu_guest_context(ctxt);
-+
-+ if ( rc == -EAGAIN )
-+ rc = hypercall_create_continuation(__HYPERVISOR_vcpu_op, "iih",
-+ cmd, vcpuid, arg);
-+
- break;
-
- case VCPUOP_up: {
-diff --git a/xen/common/domctl.c b/xen/common/domctl.c
-index cbc8146..b3bfb38 100644
---- a/xen/common/domctl.c
-+++ b/xen/common/domctl.c
-@@ -307,8 +307,10 @@ long do_domctl(XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
-
- if ( guest_handle_is_null(op->u.vcpucontext.ctxt) )
- {
-- vcpu_reset(v);
-- ret = 0;
-+ ret = vcpu_reset(v);
-+ if ( ret == -EAGAIN )
-+ ret = hypercall_create_continuation(
-+ __HYPERVISOR_domctl, "h", u_domctl);
- goto svc_out;
- }
-
-@@ -337,6 +339,10 @@ long do_domctl(XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
- domain_pause(d);
- ret = arch_set_info_guest(v, c);
- domain_unpause(d);
-+
-+ if ( ret == -EAGAIN )
-+ ret = hypercall_create_continuation(
-+ __HYPERVISOR_domctl, "h", u_domctl);
- }
-
- svc_out:
-diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h
-index aecee68..898f63a 100644
---- a/xen/include/asm-x86/domain.h
-+++ b/xen/include/asm-x86/domain.h
-@@ -464,6 +464,7 @@ struct arch_vcpu
- pagetable_t guest_table_user; /* (MFN) x86/64 user-space pagetable */
- #endif
- pagetable_t guest_table; /* (MFN) guest notion of cr3 */
-+ struct page_info *old_guest_table; /* partially destructed pagetable */
- /* guest_table holds a ref to the page, and also a type-count unless
- * shadow refcounts are in use */
- pagetable_t shadow_table[4]; /* (MFN) shadow(s) of guest */
-diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
-index ba92568..82cdde6 100644
---- a/xen/include/asm-x86/mm.h
-+++ b/xen/include/asm-x86/mm.h
-@@ -605,6 +605,7 @@ void audit_domains(void);
- int new_guest_cr3(unsigned long pfn);
- void make_cr3(struct vcpu *v, unsigned long mfn);
- void update_cr3(struct vcpu *v);
-+int vcpu_destroy_pagetables(struct vcpu *);
- void propagate_page_fault(unsigned long addr, u16 error_code);
- void *do_page_walk(struct vcpu *v, unsigned long addr);
-
-diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h
-index d4ac50f..504a70f 100644
---- a/xen/include/xen/domain.h
-+++ b/xen/include/xen/domain.h
-@@ -13,7 +13,7 @@ typedef union {
- struct vcpu *alloc_vcpu(
- struct domain *d, unsigned int vcpu_id, unsigned int cpu_id);
- struct vcpu *alloc_dom0_vcpu0(void);
--void vcpu_reset(struct vcpu *v);
-+int vcpu_reset(struct vcpu *);
-
- struct xen_domctl_getdomaininfo;
- void getdomaininfo(struct domain *d, struct xen_domctl_getdomaininfo *info);
-@@ -67,7 +67,7 @@ void arch_dump_vcpu_info(struct vcpu *v);
-
- void arch_dump_domain_info(struct domain *d);
-
--void arch_vcpu_reset(struct vcpu *v);
-+int arch_vcpu_reset(struct vcpu *);
-
- extern spinlock_t vcpu_alloc_lock;
- bool_t domctl_lock_acquire(void);
-diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
-index b619269..b0715cb 100644
---- a/xen/include/xen/sched.h
-+++ b/xen/include/xen/sched.h
-@@ -644,6 +644,9 @@ static inline struct domain *next_domain_in_cpupool(
- /* VCPU is blocked due to missing mem_sharing ring. */
- #define _VPF_mem_sharing 6
- #define VPF_mem_sharing (1UL<<_VPF_mem_sharing)
-+ /* VCPU is being reset. */
-+#define _VPF_in_reset 7
-+#define VPF_in_reset (1UL<<_VPF_in_reset)
-
- static inline int vcpu_runnable(struct vcpu *v)
- {
diff --git a/main/xen/xsa52-4.2-unstable.patch b/main/xen/xsa52-4.2-unstable.patch
deleted file mode 100644
index 14db8a8a7..000000000
--- a/main/xen/xsa52-4.2-unstable.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-x86/xsave: fix information leak on AMD CPUs
-
-Just like for FXSAVE/FXRSTOR, XSAVE/XRSTOR also don't save/restore the
-last instruction and operand pointers as well as the last opcode if
-there's no pending unmasked exception (see CVE-2006-1056 and commit
-9747:4d667a139318).
-
-While the FXSR solution sits in the save path, I prefer to have this in
-the restore path because there the handling is simpler (namely in the
-context of the pending changes to properly save the selector values for
-32-bit guest code).
-
-Also this is using FFREE instead of EMMS, as it doesn't seem unlikely
-that in the future we may see CPUs with x87 and SSE/AVX but no MMX
-support. The goal here anyway is just to avoid an FPU stack overflow.
-I would have preferred to use FFREEP instead of FFREE (freeing two
-stack slots at once), but AMD doesn't document that instruction.
-
-This is CVE-2013-2076 / XSA-52.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-
---- a/xen/arch/x86/xstate.c
-+++ b/xen/arch/x86/xstate.c
-@@ -78,6 +78,21 @@ void xrstor(struct vcpu *v, uint64_t mas
-
- struct xsave_struct *ptr = v->arch.xsave_area;
-
-+ /*
-+ * AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
-+ * is pending. Clear the x87 state here by setting it to fixed
-+ * values. The hypervisor data segment can be sometimes 0 and
-+ * sometimes new user value. Both should be ok. Use the FPU saved
-+ * data block as a safe address because it should be in L1.
-+ */
-+ if ( (mask & ptr->xsave_hdr.xstate_bv & XSTATE_FP) &&
-+ !(ptr->fpu_sse.fsw & 0x0080) &&
-+ boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
-+ asm volatile ( "fnclex\n\t" /* clear exceptions */
-+ "ffree %%st(7)\n\t" /* clear stack tag */
-+ "fildl %0" /* load to clear state */
-+ : : "m" (ptr->fpu_sse) );
-+
- asm volatile (
- ".byte " REX_PREFIX "0x0f,0xae,0x2f"
- :
diff --git a/main/xen/xsa53-4.2.patch b/main/xen/xsa53-4.2.patch
deleted file mode 100644
index eb8e79bed..000000000
--- a/main/xen/xsa53-4.2.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-x86/xsave: recover from faults on XRSTOR
-
-Just like FXRSTOR, XRSTOR can raise #GP if bad content is being passed
-to it in the memory block (i.e. aspects not under the control of the
-hypervisor, other than e.g. proper alignment of the block).
-
-Also correct the comment explaining why FXRSTOR needs exception
-recovery code to not wrongly state that this can only be a result of
-the control tools passing a bad image.
-
-This is CVE-2013-2077 / XSA-53.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-
---- a/xen/arch/x86/i387.c
-+++ b/xen/arch/x86/i387.c
-@@ -53,7 +53,7 @@ static inline void fpu_fxrstor(struct vc
- /*
- * FXRSTOR can fault if passed a corrupted data block. We handle this
- * possibility, which may occur if the block was passed to us by control
-- * tools, by silently clearing the block.
-+ * tools or through VCPUOP_initialise, by silently clearing the block.
- */
- asm volatile (
- #ifdef __i386__
---- a/xen/arch/x86/xstate.c
-+++ b/xen/arch/x86/xstate.c
-@@ -93,10 +93,25 @@ void xrstor(struct vcpu *v, uint64_t mas
- "fildl %0" /* load to clear state */
- : : "m" (ptr->fpu_sse) );
-
-- asm volatile (
-- ".byte " REX_PREFIX "0x0f,0xae,0x2f"
-- :
-- : "m" (*ptr), "a" (lmask), "d" (hmask), "D"(ptr) );
-+ /*
-+ * XRSTOR can fault if passed a corrupted data block. We handle this
-+ * possibility, which may occur if the block was passed to us by control
-+ * tools or through VCPUOP_initialise, by silently clearing the block.
-+ */
-+ asm volatile ( "1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
-+ ".section .fixup,\"ax\"\n"
-+ "2: mov %5,%%ecx \n"
-+ " xor %1,%1 \n"
-+ " rep stosb \n"
-+ " lea %2,%0 \n"
-+ " mov %3,%1 \n"
-+ " jmp 1b \n"
-+ ".previous \n"
-+ _ASM_EXTABLE(1b, 2b)
-+ : "+&D" (ptr), "+&a" (lmask)
-+ : "m" (*ptr), "g" (lmask), "d" (hmask),
-+ "m" (xsave_cntxt_size)
-+ : "ecx" );
- }
-
- bool_t xsave_enabled(const struct vcpu *v)
diff --git a/main/xen/xsa54.patch b/main/xen/xsa54.patch
deleted file mode 100644
index 83c8993d6..000000000
--- a/main/xen/xsa54.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-x86/xsave: properly check guest input to XSETBV
-
-Other than the HVM emulation path, the PV case so far failed to check
-that YMM state requires SSE state to be enabled, allowing for a #GP to
-occur upon passing the inputs to XSETBV inside the hypervisor.
-
-This is CVE-2013-2078 / XSA-54.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-
---- a/xen/arch/x86/traps.c
-+++ b/xen/arch/x86/traps.c
-@@ -2205,6 +2205,11 @@ static int emulate_privileged_op(struct
- if ( !(new_xfeature & XSTATE_FP) || (new_xfeature & ~xfeature_mask) )
- goto fail;
-
-+ /* YMM state takes SSE state as prerequisite. */
-+ if ( (xfeature_mask & new_xfeature & XSTATE_YMM) &&
-+ !(new_xfeature & XSTATE_SSE) )
-+ goto fail;
-+
- v->arch.xcr0 = new_xfeature;
- v->arch.xcr0_accum |= new_xfeature;
- set_xcr0(new_xfeature);
diff --git a/main/xen/xsa55.patch b/main/xen/xsa55.patch
deleted file mode 100644
index 35fe7afd0..000000000
--- a/main/xen/xsa55.patch
+++ /dev/null
@@ -1,3431 +0,0 @@
-diff --git a/tools/libxc/Makefile b/tools/libxc/Makefile
-index 876c148..1a5249c 100644
---- a/tools/libxc/Makefile
-+++ b/tools/libxc/Makefile
-@@ -52,8 +52,13 @@ endif
- vpath %.c ../../xen/common/libelf
- CFLAGS += -I../../xen/common/libelf
-
--GUEST_SRCS-y += libelf-tools.c libelf-loader.c
--GUEST_SRCS-y += libelf-dominfo.c libelf-relocate.c
-+ELF_SRCS-y += libelf-tools.c libelf-loader.c
-+ELF_SRCS-y += libelf-dominfo.c
-+
-+GUEST_SRCS-y += $(ELF_SRCS-y)
-+
-+$(patsubst %.c,%.o,$(ELF_SRCS-y)): CFLAGS += -Wno-pointer-sign
-+$(patsubst %.c,%.opic,$(ELF_SRCS-y)): CFLAGS += -Wno-pointer-sign
-
- # new domain builder
- GUEST_SRCS-y += xc_dom_core.c xc_dom_boot.c
-diff --git a/tools/libxc/ia64/xc_ia64_dom_fwloader.c b/tools/libxc/ia64/xc_ia64_dom_fwloader.c
-index cdf3333..dbd3349 100644
---- a/tools/libxc/ia64/xc_ia64_dom_fwloader.c
-+++ b/tools/libxc/ia64/xc_ia64_dom_fwloader.c
-@@ -60,6 +60,8 @@ static int xc_dom_load_fw_kernel(struct xc_dom_image *dom)
- unsigned long i;
-
- dest = xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart);
-+ if ( dest == NULL )
-+ return -1;
- memcpy(dest, dom->kernel_blob, FW_SIZE);
-
- /* Synchronize cache. */
-diff --git a/tools/libxc/xc_cpuid_x86.c b/tools/libxc/xc_cpuid_x86.c
-index 0882ce6..da435ce 100644
---- a/tools/libxc/xc_cpuid_x86.c
-+++ b/tools/libxc/xc_cpuid_x86.c
-@@ -589,6 +589,8 @@ static int xc_cpuid_do_domctl(
- static char *alloc_str(void)
- {
- char *s = malloc(33);
-+ if ( s == NULL )
-+ return s;
- memset(s, 0, 33);
- return s;
- }
-@@ -600,6 +602,8 @@ void xc_cpuid_to_str(const unsigned int *regs, char **strs)
- for ( i = 0; i < 4; i++ )
- {
- strs[i] = alloc_str();
-+ if ( strs[i] == NULL )
-+ continue;
- for ( j = 0; j < 32; j++ )
- strs[i][j] = !!((regs[i] & (1U << (31 - j)))) ? '1' : '0';
- }
-@@ -680,7 +684,7 @@ int xc_cpuid_check(
- const char **config,
- char **config_transformed)
- {
-- int i, j;
-+ int i, j, rc;
- unsigned int regs[4];
-
- memset(config_transformed, 0, 4 * sizeof(*config_transformed));
-@@ -692,6 +696,11 @@ int xc_cpuid_check(
- if ( config[i] == NULL )
- continue;
- config_transformed[i] = alloc_str();
-+ if ( config_transformed[i] == NULL )
-+ {
-+ rc = -ENOMEM;
-+ goto fail_rc;
-+ }
- for ( j = 0; j < 32; j++ )
- {
- unsigned char val = !!((regs[i] & (1U << (31 - j))));
-@@ -708,12 +717,14 @@ int xc_cpuid_check(
- return 0;
-
- fail:
-+ rc = -EPERM;
-+ fail_rc:
- for ( i = 0; i < 4; i++ )
- {
- free(config_transformed[i]);
- config_transformed[i] = NULL;
- }
-- return -EPERM;
-+ return rc;
- }
-
- /*
-@@ -758,6 +769,11 @@ int xc_cpuid_set(
- }
-
- config_transformed[i] = alloc_str();
-+ if ( config_transformed[i] == NULL )
-+ {
-+ rc = -ENOMEM;
-+ goto fail;
-+ }
-
- for ( j = 0; j < 32; j++ )
- {
-diff --git a/tools/libxc/xc_dom.h b/tools/libxc/xc_dom.h
-index 6a72aa9..d801f66 100644
---- a/tools/libxc/xc_dom.h
-+++ b/tools/libxc/xc_dom.h
-@@ -140,9 +140,10 @@ struct xc_dom_image {
-
- struct xc_dom_loader {
- char *name;
-- int (*probe) (struct xc_dom_image * dom);
-- int (*parser) (struct xc_dom_image * dom);
-- int (*loader) (struct xc_dom_image * dom);
-+ /* Sadly the error returns from these functions are not consistent: */
-+ elf_negerrnoval (*probe) (struct xc_dom_image * dom);
-+ elf_negerrnoval (*parser) (struct xc_dom_image * dom);
-+ elf_errorstatus (*loader) (struct xc_dom_image * dom);
-
- struct xc_dom_loader *next;
- };
-@@ -275,27 +276,50 @@ int xc_dom_alloc_segment(struct xc_dom_image *dom,
-
- void *xc_dom_pfn_to_ptr(struct xc_dom_image *dom, xen_pfn_t first,
- xen_pfn_t count);
-+void *xc_dom_pfn_to_ptr_retcount(struct xc_dom_image *dom, xen_pfn_t first,
-+ xen_pfn_t count, xen_pfn_t *count_out);
- void xc_dom_unmap_one(struct xc_dom_image *dom, xen_pfn_t pfn);
- void xc_dom_unmap_all(struct xc_dom_image *dom);
-
--static inline void *xc_dom_seg_to_ptr(struct xc_dom_image *dom,
-- struct xc_dom_seg *seg)
-+static inline void *xc_dom_seg_to_ptr_pages(struct xc_dom_image *dom,
-+ struct xc_dom_seg *seg,
-+ xen_pfn_t *pages_out)
- {
- xen_vaddr_t segsize = seg->vend - seg->vstart;
- unsigned int page_size = XC_DOM_PAGE_SIZE(dom);
- xen_pfn_t pages = (segsize + page_size - 1) / page_size;
-+ void *retval;
-+
-+ retval = xc_dom_pfn_to_ptr(dom, seg->pfn, pages);
-
-- return xc_dom_pfn_to_ptr(dom, seg->pfn, pages);
-+ *pages_out = retval ? pages : 0;
-+ return retval;
-+}
-+
-+static inline void *xc_dom_seg_to_ptr(struct xc_dom_image *dom,
-+ struct xc_dom_seg *seg)
-+{
-+ xen_pfn_t dummy;
-+
-+ return xc_dom_seg_to_ptr_pages(dom, seg, &dummy);
- }
-
- static inline void *xc_dom_vaddr_to_ptr(struct xc_dom_image *dom,
-- xen_vaddr_t vaddr)
-+ xen_vaddr_t vaddr,
-+ size_t *safe_region_out)
- {
- unsigned int page_size = XC_DOM_PAGE_SIZE(dom);
- xen_pfn_t page = (vaddr - dom->parms.virt_base) / page_size;
- unsigned int offset = (vaddr - dom->parms.virt_base) % page_size;
-- void *ptr = xc_dom_pfn_to_ptr(dom, page, 0);
-- return (ptr ? (ptr + offset) : NULL);
-+ xen_pfn_t safe_region_count;
-+ void *ptr;
-+
-+ *safe_region_out = 0;
-+ ptr = xc_dom_pfn_to_ptr_retcount(dom, page, 0, &safe_region_count);
-+ if ( ptr == NULL )
-+ return ptr;
-+ *safe_region_out = (safe_region_count << XC_DOM_PAGE_SHIFT(dom)) - offset;
-+ return ptr;
- }
-
- static inline int xc_dom_feature_translated(struct xc_dom_image *dom)
-@@ -307,6 +331,8 @@ static inline xen_pfn_t xc_dom_p2m_host(struct xc_dom_image *dom, xen_pfn_t pfn)
- {
- if (dom->shadow_enabled)
- return pfn;
-+ if (pfn >= dom->total_pages)
-+ return INVALID_MFN;
- return dom->p2m_host[pfn];
- }
-
-@@ -315,6 +341,8 @@ static inline xen_pfn_t xc_dom_p2m_guest(struct xc_dom_image *dom,
- {
- if (xc_dom_feature_translated(dom))
- return pfn;
-+ if (pfn >= dom->total_pages)
-+ return INVALID_MFN;
- return dom->p2m_host[pfn];
- }
-
-diff --git a/tools/libxc/xc_dom_binloader.c b/tools/libxc/xc_dom_binloader.c
-index 769e97d..553b366 100644
---- a/tools/libxc/xc_dom_binloader.c
-+++ b/tools/libxc/xc_dom_binloader.c
-@@ -123,10 +123,13 @@ static struct xen_bin_image_table *find_table(struct xc_dom_image *dom)
- uint32_t *probe_ptr;
- uint32_t *probe_end;
-
-+ if ( dom->kernel_size < sizeof(*table) )
-+ return NULL;
- probe_ptr = dom->kernel_blob;
-- probe_end = dom->kernel_blob + dom->kernel_size - sizeof(*table);
-- if ( (void*)probe_end > (dom->kernel_blob + 8192) )
-+ if ( dom->kernel_size > (8192 + sizeof(*table)) )
- probe_end = dom->kernel_blob + 8192;
-+ else
-+ probe_end = dom->kernel_blob + dom->kernel_size - sizeof(*table);
-
- for ( table = NULL; probe_ptr < probe_end; probe_ptr++ )
- {
-@@ -249,6 +252,7 @@ static int xc_dom_load_bin_kernel(struct xc_dom_image *dom)
- char *image = dom->kernel_blob;
- char *dest;
- size_t image_size = dom->kernel_size;
-+ size_t dest_size;
- uint32_t start_addr;
- uint32_t load_end_addr;
- uint32_t bss_end_addr;
-@@ -272,7 +276,29 @@ static int xc_dom_load_bin_kernel(struct xc_dom_image *dom)
- DOMPRINTF(" text_size: 0x%" PRIx32 "", text_size);
- DOMPRINTF(" bss_size: 0x%" PRIx32 "", bss_size);
-
-- dest = xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart);
-+ dest = xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart, &dest_size);
-+ if ( dest == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart)"
-+ " => NULL", __FUNCTION__);
-+ return -EINVAL;
-+ }
-+
-+ if ( dest_size < text_size ||
-+ dest_size - text_size < bss_size )
-+ {
-+ DOMPRINTF("%s: mapped region is too small for image", __FUNCTION__);
-+ return -EINVAL;
-+ }
-+
-+ if ( image_size < skip ||
-+ image_size - skip < text_size )
-+ {
-+ DOMPRINTF("%s: image is too small for declared text size",
-+ __FUNCTION__);
-+ return -EINVAL;
-+ }
-+
- memcpy(dest, image + skip, text_size);
- memset(dest + text_size, 0, bss_size);
-
-diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
-index 2a01d7c..e79e38d 100644
---- a/tools/libxc/xc_dom_core.c
-+++ b/tools/libxc/xc_dom_core.c
-@@ -120,9 +120,17 @@ void *xc_dom_malloc(struct xc_dom_image *dom, size_t size)
- {
- struct xc_dom_mem *block;
-
-+ if ( size > SIZE_MAX - sizeof(*block) )
-+ {
-+ DOMPRINTF("%s: unreasonable allocation size", __FUNCTION__);
-+ return NULL;
-+ }
- block = malloc(sizeof(*block) + size);
- if ( block == NULL )
-+ {
-+ DOMPRINTF("%s: allocation failed", __FUNCTION__);
- return NULL;
-+ }
- memset(block, 0, sizeof(*block) + size);
- block->next = dom->memblocks;
- dom->memblocks = block;
-@@ -138,7 +146,10 @@ void *xc_dom_malloc_page_aligned(struct xc_dom_image *dom, size_t size)
-
- block = malloc(sizeof(*block));
- if ( block == NULL )
-+ {
-+ DOMPRINTF("%s: allocation failed", __FUNCTION__);
- return NULL;
-+ }
- memset(block, 0, sizeof(*block));
- block->mmap_len = size;
- block->mmap_ptr = mmap(NULL, block->mmap_len,
-@@ -146,6 +157,7 @@ void *xc_dom_malloc_page_aligned(struct xc_dom_image *dom, size_t size)
- -1, 0);
- if ( block->mmap_ptr == MAP_FAILED )
- {
-+ DOMPRINTF("%s: mmap failed", __FUNCTION__);
- free(block);
- return NULL;
- }
-@@ -202,6 +214,7 @@ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
- close(fd);
- if ( block != NULL )
- free(block);
-+ DOMPRINTF("%s: failed (on file `%s')", __FUNCTION__, filename);
- return NULL;
- }
-
-@@ -271,6 +284,11 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen)
- unsigned char *gzlen;
- size_t unziplen;
-
-+ if ( ziplen < 6 )
-+ /* Too small. We need (i.e. the subsequent code relies on)
-+ * 2 bytes for the magic number plus 4 bytes length. */
-+ return 0;
-+
- if ( strncmp(blob, "\037\213", 2) )
- /* not gzipped */
- return 0;
-@@ -351,10 +369,19 @@ int xc_dom_try_gunzip(struct xc_dom_image *dom, void **blob, size_t * size)
- void *xc_dom_pfn_to_ptr(struct xc_dom_image *dom, xen_pfn_t pfn,
- xen_pfn_t count)
- {
-+ xen_pfn_t count_out_dummy;
-+ return xc_dom_pfn_to_ptr_retcount(dom, pfn, count, &count_out_dummy);
-+}
-+
-+void *xc_dom_pfn_to_ptr_retcount(struct xc_dom_image *dom, xen_pfn_t pfn,
-+ xen_pfn_t count, xen_pfn_t *count_out)
-+{
- struct xc_dom_phys *phys;
- unsigned int page_shift = XC_DOM_PAGE_SHIFT(dom);
- char *mode = "unset";
-
-+ *count_out = 0;
-+
- if ( pfn > dom->total_pages || /* multiple checks to avoid overflows */
- count > dom->total_pages ||
- pfn > dom->total_pages - count )
-@@ -384,6 +411,7 @@ void *xc_dom_pfn_to_ptr(struct xc_dom_image *dom, xen_pfn_t pfn,
- phys->count);
- return NULL;
- }
-+ *count_out = count;
- }
- else
- {
-@@ -391,6 +419,9 @@ void *xc_dom_pfn_to_ptr(struct xc_dom_image *dom, xen_pfn_t pfn,
- just hand out a pointer to it */
- if ( pfn < phys->first )
- continue;
-+ if ( pfn >= phys->first + phys->count )
-+ continue;
-+ *count_out = phys->count - (pfn - phys->first);
- }
- return phys->ptr + ((pfn - phys->first) << page_shift);
- }
-@@ -478,7 +509,8 @@ int xc_dom_alloc_segment(struct xc_dom_image *dom,
- seg->vstart = start;
- seg->pfn = (seg->vstart - dom->parms.virt_base) / page_size;
-
-- if ( pages > dom->total_pages || /* double test avoids overflow probs */
-+ if ( pages > dom->total_pages || /* multiple test avoids overflow probs */
-+ seg->pfn > dom->total_pages ||
- pages > dom->total_pages - seg->pfn)
- {
- xc_dom_panic(dom->xch, XC_OUT_OF_MEMORY,
-@@ -855,6 +887,12 @@ int xc_dom_build_image(struct xc_dom_image *dom)
- ramdisklen) != 0 )
- goto err;
- ramdiskmap = xc_dom_seg_to_ptr(dom, &dom->ramdisk_seg);
-+ if ( ramdiskmap == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_seg_to_ptr(dom, &dom->ramdisk_seg) => NULL",
-+ __FUNCTION__);
-+ goto err;
-+ }
- if ( unziplen )
- {
- if ( xc_dom_do_gunzip(dom->xch,
-diff --git a/tools/libxc/xc_dom_elfloader.c b/tools/libxc/xc_dom_elfloader.c
-index 2e69559..be58276 100644
---- a/tools/libxc/xc_dom_elfloader.c
-+++ b/tools/libxc/xc_dom_elfloader.c
-@@ -28,13 +28,14 @@
-
- #include "xg_private.h"
- #include "xc_dom.h"
-+#include "xc_bitops.h"
-
- #define XEN_VER "xen-3.0"
-
- /* ------------------------------------------------------------------------ */
-
- static void log_callback(struct elf_binary *elf, void *caller_data,
-- int iserr, const char *fmt, va_list al) {
-+ bool iserr, const char *fmt, va_list al) {
- xc_interface *xch = caller_data;
-
- xc_reportv(xch,
-@@ -46,7 +47,7 @@ static void log_callback(struct elf_binary *elf, void *caller_data,
-
- void xc_elf_set_logfile(xc_interface *xch, struct elf_binary *elf,
- int verbose) {
-- elf_set_log(elf, log_callback, xch, verbose);
-+ elf_set_log(elf, log_callback, xch, verbose /* convert to bool */);
- }
-
- /* ------------------------------------------------------------------------ */
-@@ -84,7 +85,7 @@ static char *xc_dom_guest_type(struct xc_dom_image *dom,
- /* ------------------------------------------------------------------------ */
- /* parse elf binary */
-
--static int check_elf_kernel(struct xc_dom_image *dom, int verbose)
-+static elf_negerrnoval check_elf_kernel(struct xc_dom_image *dom, bool verbose)
- {
- if ( dom->kernel_blob == NULL )
- {
-@@ -95,7 +96,7 @@ static int check_elf_kernel(struct xc_dom_image *dom, int verbose)
- return -EINVAL;
- }
-
-- if ( !elf_is_elfbinary(dom->kernel_blob) )
-+ if ( !elf_is_elfbinary(dom->kernel_blob, dom->kernel_size) )
- {
- if ( verbose )
- xc_dom_panic(dom->xch,
-@@ -106,20 +107,21 @@ static int check_elf_kernel(struct xc_dom_image *dom, int verbose)
- return 0;
- }
-
--static int xc_dom_probe_elf_kernel(struct xc_dom_image *dom)
-+static elf_negerrnoval xc_dom_probe_elf_kernel(struct xc_dom_image *dom)
- {
- return check_elf_kernel(dom, 0);
- }
-
--static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
-- struct elf_binary *elf, int load)
-+static elf_errorstatus xc_dom_load_elf_symtab(struct xc_dom_image *dom,
-+ struct elf_binary *elf, bool load)
- {
- struct elf_binary syms;
-- const elf_shdr *shdr, *shdr2;
-+ ELF_HANDLE_DECL(elf_shdr) shdr; ELF_HANDLE_DECL(elf_shdr) shdr2;
- xen_vaddr_t symtab, maxaddr;
-- char *hdr;
-+ elf_ptrval hdr;
- size_t size;
-- int h, count, type, i, tables = 0;
-+ unsigned h, count, type, i, tables = 0;
-+ unsigned long *strtab_referenced = NULL;
-
- if ( elf_swap(elf) )
- {
-@@ -130,31 +132,48 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
-
- if ( load )
- {
-+ char *hdr_ptr;
-+ size_t allow_size;
-+
- if ( !dom->bsd_symtab_start )
- return 0;
- size = dom->kernel_seg.vend - dom->bsd_symtab_start;
-- hdr = xc_dom_vaddr_to_ptr(dom, dom->bsd_symtab_start);
-- *(int *)hdr = size - sizeof(int);
-+ hdr_ptr = xc_dom_vaddr_to_ptr(dom, dom->bsd_symtab_start, &allow_size);
-+ if ( hdr_ptr == NULL )
-+ {
-+ DOMPRINTF("%s/load: xc_dom_vaddr_to_ptr(dom,dom->bsd_symtab_start"
-+ " => NULL", __FUNCTION__);
-+ return -1;
-+ }
-+ elf->caller_xdest_base = hdr_ptr;
-+ elf->caller_xdest_size = allow_size;
-+ hdr = ELF_REALPTR2PTRVAL(hdr_ptr);
-+ elf_store_val(elf, unsigned, hdr, size - sizeof(unsigned));
- }
- else
- {
-- size = sizeof(int) + elf_size(elf, elf->ehdr) +
-+ char *hdr_ptr;
-+
-+ size = sizeof(unsigned) + elf_size(elf, elf->ehdr) +
- elf_shdr_count(elf) * elf_size(elf, shdr);
-- hdr = xc_dom_malloc(dom, size);
-- if ( hdr == NULL )
-+ hdr_ptr = xc_dom_malloc(dom, size);
-+ if ( hdr_ptr == NULL )
- return 0;
-- dom->bsd_symtab_start = elf_round_up(&syms, dom->kernel_seg.vend);
-+ elf->caller_xdest_base = hdr_ptr;
-+ elf->caller_xdest_size = size;
-+ hdr = ELF_REALPTR2PTRVAL(hdr_ptr);
-+ dom->bsd_symtab_start = elf_round_up(elf, dom->kernel_seg.vend);
- }
-
-- memcpy(hdr + sizeof(int),
-- elf->image,
-+ elf_memcpy_safe(elf, hdr + sizeof(unsigned),
-+ ELF_IMAGE_BASE(elf),
- elf_size(elf, elf->ehdr));
-- memcpy(hdr + sizeof(int) + elf_size(elf, elf->ehdr),
-- elf->image + elf_uval(elf, elf->ehdr, e_shoff),
-+ elf_memcpy_safe(elf, hdr + sizeof(unsigned) + elf_size(elf, elf->ehdr),
-+ ELF_IMAGE_BASE(elf) + elf_uval(elf, elf->ehdr, e_shoff),
- elf_shdr_count(elf) * elf_size(elf, shdr));
- if ( elf_64bit(elf) )
- {
-- Elf64_Ehdr *ehdr = (Elf64_Ehdr *)(hdr + sizeof(int));
-+ Elf64_Ehdr *ehdr = (Elf64_Ehdr *)(hdr + sizeof(unsigned));
- ehdr->e_phoff = 0;
- ehdr->e_phentsize = 0;
- ehdr->e_phnum = 0;
-@@ -163,19 +182,42 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
- }
- else
- {
-- Elf32_Ehdr *ehdr = (Elf32_Ehdr *)(hdr + sizeof(int));
-+ Elf32_Ehdr *ehdr = (Elf32_Ehdr *)(hdr + sizeof(unsigned));
- ehdr->e_phoff = 0;
- ehdr->e_phentsize = 0;
- ehdr->e_phnum = 0;
- ehdr->e_shoff = elf_size(elf, elf->ehdr);
- ehdr->e_shstrndx = SHN_UNDEF;
- }
-- if ( elf_init(&syms, hdr + sizeof(int), size - sizeof(int)) )
-+ if ( elf->caller_xdest_size < sizeof(unsigned) )
-+ {
-+ DOMPRINTF("%s/%s: header size %"PRIx64" too small",
-+ __FUNCTION__, load ? "load" : "parse",
-+ (uint64_t)elf->caller_xdest_size);
-+ return -1;
-+ }
-+ if ( elf_init(&syms, elf->caller_xdest_base + sizeof(unsigned),
-+ elf->caller_xdest_size - sizeof(unsigned)) )
- return -1;
-
-+ /*
-+ * The caller_xdest_{base,size} and dest_{base,size} need to
-+ * remain valid so long as each struct elf_image does. The
-+ * principle we adopt is that these values are set when the
-+ * memory is allocated or mapped, and cleared when (and if)
-+ * they are unmapped.
-+ *
-+ * Mappings of the guest are normally undone by xc_dom_unmap_all
-+ * (directly or via xc_dom_release). We do not explicitly clear
-+ * these because in fact that happens only at the end of
-+ * xc_dom_boot_image, at which time all of these ELF loading
-+ * functions have returned. No relevant struct elf_binary*
-+ * escapes this file.
-+ */
-+
- xc_elf_set_logfile(dom->xch, &syms, 1);
-
-- symtab = dom->bsd_symtab_start + sizeof(int);
-+ symtab = dom->bsd_symtab_start + sizeof(unsigned);
- maxaddr = elf_round_up(&syms, symtab + elf_size(&syms, syms.ehdr) +
- elf_shdr_count(&syms) * elf_size(&syms, shdr));
-
-@@ -186,27 +228,40 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
- symtab, maxaddr);
-
- count = elf_shdr_count(&syms);
-+ /* elf_shdr_count guarantees that count is reasonable */
-+
-+ strtab_referenced = xc_dom_malloc(dom, bitmap_size(count));
-+ if ( strtab_referenced == NULL )
-+ return -1;
-+ bitmap_clear(strtab_referenced, count);
-+ /* Note the symtabs @h linked to by any strtab @i. */
-+ for ( i = 0; i < count; i++ )
-+ {
-+ shdr2 = elf_shdr_by_index(&syms, i);
-+ if ( elf_uval(&syms, shdr2, sh_type) == SHT_SYMTAB )
-+ {
-+ h = elf_uval(&syms, shdr2, sh_link);
-+ if (h < count)
-+ set_bit(h, strtab_referenced);
-+ }
-+ }
-+
- for ( h = 0; h < count; h++ )
- {
- shdr = elf_shdr_by_index(&syms, h);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
-+ /* input has an insane section header count field */
-+ break;
- type = elf_uval(&syms, shdr, sh_type);
- if ( type == SHT_STRTAB )
- {
-- /* Look for a strtab @i linked to symtab @h. */
-- for ( i = 0; i < count; i++ )
-- {
-- shdr2 = elf_shdr_by_index(&syms, i);
-- if ( (elf_uval(&syms, shdr2, sh_type) == SHT_SYMTAB) &&
-- (elf_uval(&syms, shdr2, sh_link) == h) )
-- break;
-- }
- /* Skip symtab @h if we found no corresponding strtab @i. */
-- if ( i == count )
-+ if ( !test_bit(h, strtab_referenced) )
- {
- if ( elf_64bit(&syms) )
-- *(Elf64_Off*)(&shdr->e64.sh_offset) = 0;
-+ elf_store_field(elf, shdr, e64.sh_offset, 0);
- else
-- *(Elf32_Off*)(&shdr->e32.sh_offset) = 0;
-+ elf_store_field(elf, shdr, e32.sh_offset, 0);
- continue;
- }
- }
-@@ -215,13 +270,13 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
- {
- /* Mangled to be based on ELF header location. */
- if ( elf_64bit(&syms) )
-- *(Elf64_Off*)(&shdr->e64.sh_offset) = maxaddr - symtab;
-+ elf_store_field(elf, shdr, e64.sh_offset, maxaddr - symtab);
- else
-- *(Elf32_Off*)(&shdr->e32.sh_offset) = maxaddr - symtab;
-+ elf_store_field(elf, shdr, e32.sh_offset, maxaddr - symtab);
- size = elf_uval(&syms, shdr, sh_size);
- maxaddr = elf_round_up(&syms, maxaddr + size);
- tables++;
-- DOMPRINTF("%s: h=%d %s, size=0x%zx, maxaddr=0x%" PRIx64 "",
-+ DOMPRINTF("%s: h=%u %s, size=0x%zx, maxaddr=0x%" PRIx64 "",
- __FUNCTION__, h,
- type == SHT_SYMTAB ? "symtab" : "strtab",
- size, maxaddr);
-@@ -229,7 +284,7 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
- if ( load )
- {
- shdr2 = elf_shdr_by_index(elf, h);
-- memcpy((void*)elf_section_start(&syms, shdr),
-+ elf_memcpy_safe(elf, elf_section_start(&syms, shdr),
- elf_section_start(elf, shdr2),
- size);
- }
-@@ -237,11 +292,18 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
-
- /* Name is NULL. */
- if ( elf_64bit(&syms) )
-- *(Elf64_Word*)(&shdr->e64.sh_name) = 0;
-+ elf_store_field(elf, shdr, e64.sh_name, 0);
- else
-- *(Elf32_Word*)(&shdr->e32.sh_name) = 0;
-+ elf_store_field(elf, shdr, e32.sh_name, 0);
- }
-
-+ if ( elf_check_broken(&syms) )
-+ DOMPRINTF("%s: symbols ELF broken: %s", __FUNCTION__,
-+ elf_check_broken(&syms));
-+ if ( elf_check_broken(elf) )
-+ DOMPRINTF("%s: ELF broken: %s", __FUNCTION__,
-+ elf_check_broken(elf));
-+
- if ( tables == 0 )
- {
- DOMPRINTF("%s: no symbol table present", __FUNCTION__);
-@@ -253,16 +315,22 @@ static int xc_dom_load_elf_symtab(struct xc_dom_image *dom,
- return 0;
- }
-
--static int xc_dom_parse_elf_kernel(struct xc_dom_image *dom)
-+static elf_errorstatus xc_dom_parse_elf_kernel(struct xc_dom_image *dom)
-+ /*
-+ * This function sometimes returns -1 for error and sometimes
-+ * an errno value. ?!?!
-+ */
- {
- struct elf_binary *elf;
-- int rc;
-+ elf_errorstatus rc;
-
- rc = check_elf_kernel(dom, 1);
- if ( rc != 0 )
- return rc;
-
- elf = xc_dom_malloc(dom, sizeof(*elf));
-+ if ( elf == NULL )
-+ return -1;
- dom->private_loader = elf;
- rc = elf_init(elf, dom->kernel_blob, dom->kernel_size);
- xc_elf_set_logfile(dom->xch, elf, 1);
-@@ -274,23 +342,27 @@ static int xc_dom_parse_elf_kernel(struct xc_dom_image *dom)
- }
-
- /* Find the section-header strings table. */
-- if ( elf->sec_strtab == NULL )
-+ if ( ELF_PTRVAL_INVALID(elf->sec_strtab) )
- {
- xc_dom_panic(dom->xch, XC_INVALID_KERNEL, "%s: ELF image"
- " has no shstrtab", __FUNCTION__);
-- return -EINVAL;
-+ rc = -EINVAL;
-+ goto out;
- }
-
- /* parse binary and get xen meta info */
- elf_parse_binary(elf);
- if ( (rc = elf_xen_parse(elf, &dom->parms)) != 0 )
-- return rc;
-+ {
-+ goto out;
-+ }
-
- if ( elf_xen_feature_get(XENFEAT_dom0, dom->parms.f_required) )
- {
- xc_dom_panic(dom->xch, XC_INVALID_KERNEL, "%s: Kernel does not"
- " support unprivileged (DomU) operation", __FUNCTION__);
-- return -EINVAL;
-+ rc = -EINVAL;
-+ goto out;
- }
-
- /* find kernel segment */
-@@ -304,15 +376,30 @@ static int xc_dom_parse_elf_kernel(struct xc_dom_image *dom)
- DOMPRINTF("%s: %s: 0x%" PRIx64 " -> 0x%" PRIx64 "",
- __FUNCTION__, dom->guest_type,
- dom->kernel_seg.vstart, dom->kernel_seg.vend);
-- return 0;
-+ rc = 0;
-+out:
-+ if ( elf_check_broken(elf) )
-+ DOMPRINTF("%s: ELF broken: %s", __FUNCTION__,
-+ elf_check_broken(elf));
-+
-+ return rc;
- }
-
--static int xc_dom_load_elf_kernel(struct xc_dom_image *dom)
-+static elf_errorstatus xc_dom_load_elf_kernel(struct xc_dom_image *dom)
- {
- struct elf_binary *elf = dom->private_loader;
-- int rc;
-+ elf_errorstatus rc;
-+ xen_pfn_t pages;
-+
-+ elf->dest_base = xc_dom_seg_to_ptr_pages(dom, &dom->kernel_seg, &pages);
-+ if ( elf->dest_base == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_vaddr_to_ptr(dom,dom->kernel_seg)"
-+ " => NULL", __FUNCTION__);
-+ return -1;
-+ }
-+ elf->dest_size = pages * XC_DOM_PAGE_SIZE(dom);
-
-- elf->dest = xc_dom_seg_to_ptr(dom, &dom->kernel_seg);
- rc = elf_load_binary(elf);
- if ( rc < 0 )
- {
-diff --git a/tools/libxc/xc_dom_ia64.c b/tools/libxc/xc_dom_ia64.c
-index dcd1523..076821c 100644
---- a/tools/libxc/xc_dom_ia64.c
-+++ b/tools/libxc/xc_dom_ia64.c
-@@ -60,6 +60,12 @@ int start_info_ia64(struct xc_dom_image *dom)
-
- DOMPRINTF_CALLED(dom->xch);
-
-+ if ( start_info == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_pfn_to_ptr failed on start_info", __FUNCTION__);
-+ return -1; /* our caller throws away our return value :-/ */
-+ }
-+
- memset(start_info, 0, sizeof(*start_info));
- sprintf(start_info->magic, dom->guest_type);
- start_info->flags = dom->flags;
-@@ -182,6 +188,12 @@ int arch_setup_meminit(struct xc_dom_image *dom)
-
- /* setup initial p2m */
- dom->p2m_host = xc_dom_malloc(dom, sizeof(xen_pfn_t) * nbr);
-+ if ( dom->p2m_host == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_malloc failed for p2m_host",
-+ __FUNCTION__);
-+ return -1;
-+ }
- for ( pfn = 0; pfn < nbr; pfn++ )
- dom->p2m_host[pfn] = start + pfn;
-
-diff --git a/tools/libxc/xc_dom_x86.c b/tools/libxc/xc_dom_x86.c
-index 0cf1687..448d9a1 100644
---- a/tools/libxc/xc_dom_x86.c
-+++ b/tools/libxc/xc_dom_x86.c
-@@ -144,6 +144,9 @@ static int setup_pgtables_x86_32(struct xc_dom_image *dom)
- xen_vaddr_t addr;
- xen_pfn_t pgpfn;
-
-+ if ( l2tab == NULL )
-+ goto pfn_error;
-+
- for ( addr = dom->parms.virt_base; addr < dom->virt_pgtab_end;
- addr += PAGE_SIZE_X86 )
- {
-@@ -151,6 +154,8 @@ static int setup_pgtables_x86_32(struct xc_dom_image *dom)
- {
- /* get L1 tab, make L2 entry */
- l1tab = xc_dom_pfn_to_ptr(dom, l1pfn, 1);
-+ if ( l1tab == NULL )
-+ goto pfn_error;
- l2off = l2_table_offset_i386(addr);
- l2tab[l2off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l1pfn)) | L2_PROT;
-@@ -169,6 +174,11 @@ static int setup_pgtables_x86_32(struct xc_dom_image *dom)
- l1tab = NULL;
- }
- return 0;
-+
-+pfn_error:
-+ xc_dom_panic(dom->xch, XC_INTERNAL_ERROR,
-+ "%s: xc_dom_pfn_to_ptr failed", __FUNCTION__);
-+ return -EINVAL;
- }
-
- /*
-@@ -219,6 +229,12 @@ static xen_pfn_t move_l3_below_4G(struct xc_dom_image *dom,
- goto out;
-
- l3tab = xc_dom_pfn_to_ptr(dom, l3pfn, 1);
-+ if ( l3tab == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_pfn_to_ptr(dom, l3pfn, 1) => NULL",
-+ __FUNCTION__);
-+ return l3mfn; /* our one call site will call xc_dom_panic and fail */
-+ }
- memset(l3tab, 0, XC_DOM_PAGE_SIZE(dom));
-
- DOMPRINTF("%s: successfully relocated L3 below 4G. "
-@@ -262,6 +278,8 @@ static int setup_pgtables_x86_32_pae(struct xc_dom_image *dom)
- }
-
- l3tab = xc_dom_pfn_to_ptr(dom, l3pfn, 1);
-+ if ( l3tab == NULL )
-+ goto pfn_error;
-
- for ( addr = dom->parms.virt_base; addr < dom->virt_pgtab_end;
- addr += PAGE_SIZE_X86 )
-@@ -270,6 +288,8 @@ static int setup_pgtables_x86_32_pae(struct xc_dom_image *dom)
- {
- /* get L2 tab, make L3 entry */
- l2tab = xc_dom_pfn_to_ptr(dom, l2pfn, 1);
-+ if ( l2tab == NULL )
-+ goto pfn_error;
- l3off = l3_table_offset_pae(addr);
- l3tab[l3off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l2pfn)) | L3_PROT;
-@@ -280,6 +300,8 @@ static int setup_pgtables_x86_32_pae(struct xc_dom_image *dom)
- {
- /* get L1 tab, make L2 entry */
- l1tab = xc_dom_pfn_to_ptr(dom, l1pfn, 1);
-+ if ( l1tab == NULL )
-+ goto pfn_error;
- l2off = l2_table_offset_pae(addr);
- l2tab[l2off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l1pfn)) | L2_PROT;
-@@ -306,6 +328,11 @@ static int setup_pgtables_x86_32_pae(struct xc_dom_image *dom)
- l3tab[3] = pfn_to_paddr(xc_dom_p2m_guest(dom, l2pfn)) | L3_PROT;
- }
- return 0;
-+
-+pfn_error:
-+ xc_dom_panic(dom->xch, XC_INTERNAL_ERROR,
-+ "%s: xc_dom_pfn_to_ptr failed", __FUNCTION__);
-+ return -EINVAL;
- }
-
- #undef L1_PROT
-@@ -344,6 +371,9 @@ static int setup_pgtables_x86_64(struct xc_dom_image *dom)
- uint64_t addr;
- xen_pfn_t pgpfn;
-
-+ if ( l4tab == NULL )
-+ goto pfn_error;
-+
- for ( addr = dom->parms.virt_base; addr < dom->virt_pgtab_end;
- addr += PAGE_SIZE_X86 )
- {
-@@ -351,6 +381,8 @@ static int setup_pgtables_x86_64(struct xc_dom_image *dom)
- {
- /* get L3 tab, make L4 entry */
- l3tab = xc_dom_pfn_to_ptr(dom, l3pfn, 1);
-+ if ( l3tab == NULL )
-+ goto pfn_error;
- l4off = l4_table_offset_x86_64(addr);
- l4tab[l4off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l3pfn)) | L4_PROT;
-@@ -361,6 +393,8 @@ static int setup_pgtables_x86_64(struct xc_dom_image *dom)
- {
- /* get L2 tab, make L3 entry */
- l2tab = xc_dom_pfn_to_ptr(dom, l2pfn, 1);
-+ if ( l2tab == NULL )
-+ goto pfn_error;
- l3off = l3_table_offset_x86_64(addr);
- l3tab[l3off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l2pfn)) | L3_PROT;
-@@ -373,6 +407,8 @@ static int setup_pgtables_x86_64(struct xc_dom_image *dom)
- {
- /* get L1 tab, make L2 entry */
- l1tab = xc_dom_pfn_to_ptr(dom, l1pfn, 1);
-+ if ( l1tab == NULL )
-+ goto pfn_error;
- l2off = l2_table_offset_x86_64(addr);
- l2tab[l2off] =
- pfn_to_paddr(xc_dom_p2m_guest(dom, l1pfn)) | L2_PROT;
-@@ -393,6 +429,11 @@ static int setup_pgtables_x86_64(struct xc_dom_image *dom)
- l1tab = NULL;
- }
- return 0;
-+
-+pfn_error:
-+ xc_dom_panic(dom->xch, XC_INTERNAL_ERROR,
-+ "%s: xc_dom_pfn_to_ptr failed", __FUNCTION__);
-+ return -EINVAL;
- }
-
- #undef L1_PROT
-@@ -410,6 +451,8 @@ static int alloc_magic_pages(struct xc_dom_image *dom)
- if ( xc_dom_alloc_segment(dom, &dom->p2m_seg, "phys2mach", 0, p2m_size) )
- return -1;
- dom->p2m_guest = xc_dom_seg_to_ptr(dom, &dom->p2m_seg);
-+ if ( dom->p2m_guest == NULL )
-+ return -1;
-
- /* allocate special pages */
- dom->start_info_pfn = xc_dom_alloc_page(dom, "start info");
-@@ -434,6 +477,12 @@ static int start_info_x86_32(struct xc_dom_image *dom)
-
- DOMPRINTF_CALLED(dom->xch);
-
-+ if ( start_info == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_pfn_to_ptr failed on start_info", __FUNCTION__);
-+ return -1; /* our caller throws away our return value :-/ */
-+ }
-+
- memset(start_info, 0, sizeof(*start_info));
- strncpy(start_info->magic, dom->guest_type, sizeof(start_info->magic));
- start_info->magic[sizeof(start_info->magic) - 1] = '\0';
-@@ -474,6 +523,12 @@ static int start_info_x86_64(struct xc_dom_image *dom)
-
- DOMPRINTF_CALLED(dom->xch);
-
-+ if ( start_info == NULL )
-+ {
-+ DOMPRINTF("%s: xc_dom_pfn_to_ptr failed on start_info", __FUNCTION__);
-+ return -1; /* our caller throws away our return value :-/ */
-+ }
-+
- memset(start_info, 0, sizeof(*start_info));
- strncpy(start_info->magic, dom->guest_type, sizeof(start_info->magic));
- start_info->magic[sizeof(start_info->magic) - 1] = '\0';
-@@ -725,6 +780,9 @@ int arch_setup_meminit(struct xc_dom_image *dom)
- }
-
- dom->p2m_host = xc_dom_malloc(dom, sizeof(xen_pfn_t) * dom->total_pages);
-+ if ( dom->p2m_host == NULL )
-+ return -EINVAL;
-+
- if ( dom->superpages )
- {
- int count = dom->total_pages >> SUPERPAGE_PFN_SHIFT;
-diff --git a/tools/libxc/xc_domain_restore.c b/tools/libxc/xc_domain_restore.c
-index b4c0b10..f9ed6b2 100644
---- a/tools/libxc/xc_domain_restore.c
-+++ b/tools/libxc/xc_domain_restore.c
-@@ -1180,6 +1180,11 @@ static int apply_batch(xc_interface *xch, uint32_t dom, struct restore_ctx *ctx,
-
- /* Map relevant mfns */
- pfn_err = calloc(j, sizeof(*pfn_err));
-+ if ( pfn_err == NULL )
-+ {
-+ PERROR("allocation for pfn_err failed");
-+ return -1;
-+ }
- region_base = xc_map_foreign_bulk(
- xch, dom, PROT_WRITE, region_mfn, pfn_err, j);
-
-@@ -1556,6 +1561,12 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom,
- mfn = ctx->p2m[pfn];
- buf = xc_map_foreign_range(xch, dom, PAGE_SIZE,
- PROT_READ | PROT_WRITE, mfn);
-+ if ( buf == NULL )
-+ {
-+ ERROR("xc_map_foreign_range for generation id"
-+ " buffer failed");
-+ goto out;
-+ }
-
- generationid = *(unsigned long long *)(buf + offset);
- *(unsigned long long *)(buf + offset) = generationid + 1;
-@@ -1713,6 +1724,11 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom,
- l3tab = (uint64_t *)
- xc_map_foreign_range(xch, dom, PAGE_SIZE,
- PROT_READ, ctx->p2m[i]);
-+ if ( l3tab == NULL )
-+ {
-+ PERROR("xc_map_foreign_range failed (for l3tab)");
-+ goto out;
-+ }
-
- for ( j = 0; j < 4; j++ )
- l3ptes[j] = l3tab[j];
-@@ -1739,6 +1755,11 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom,
- l3tab = (uint64_t *)
- xc_map_foreign_range(xch, dom, PAGE_SIZE,
- PROT_READ | PROT_WRITE, ctx->p2m[i]);
-+ if ( l3tab == NULL )
-+ {
-+ PERROR("xc_map_foreign_range failed (for l3tab, 2nd)");
-+ goto out;
-+ }
-
- for ( j = 0; j < 4; j++ )
- l3tab[j] = l3ptes[j];
-@@ -1909,6 +1930,12 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom,
- SET_FIELD(ctxt, user_regs.edx, mfn);
- start_info = xc_map_foreign_range(
- xch, dom, PAGE_SIZE, PROT_READ | PROT_WRITE, mfn);
-+ if ( start_info == NULL )
-+ {
-+ PERROR("xc_map_foreign_range failed (for start_info)");
-+ goto out;
-+ }
-+
- SET_FIELD(start_info, nr_pages, dinfo->p2m_size);
- SET_FIELD(start_info, shared_info, shared_info_frame<<PAGE_SHIFT);
- SET_FIELD(start_info, flags, 0);
-@@ -2056,6 +2083,11 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom,
- /* Restore contents of shared-info page. No checking needed. */
- new_shared_info = xc_map_foreign_range(
- xch, dom, PAGE_SIZE, PROT_WRITE, shared_info_frame);
-+ if ( new_shared_info == NULL )
-+ {
-+ PERROR("xc_map_foreign_range failed (for new_shared_info)");
-+ goto out;
-+ }
-
- /* restore saved vcpu_info and arch specific info */
- MEMCPY_FIELD(new_shared_info, old_shared_info, vcpu_info);
-diff --git a/tools/libxc/xc_hvm_build_x86.c b/tools/libxc/xc_hvm_build_x86.c
-index cf5d7fb..8165287 100644
---- a/tools/libxc/xc_hvm_build_x86.c
-+++ b/tools/libxc/xc_hvm_build_x86.c
-@@ -104,21 +104,23 @@ static int loadelfimage(
- for ( i = 0; i < pages; i++ )
- entries[i].mfn = parray[(elf->pstart >> PAGE_SHIFT) + i];
-
-- elf->dest = xc_map_foreign_ranges(
-+ elf->dest_base = xc_map_foreign_ranges(
- xch, dom, pages << PAGE_SHIFT, PROT_READ | PROT_WRITE, 1 << PAGE_SHIFT,
- entries, pages);
-- if ( elf->dest == NULL )
-+ if ( elf->dest_base == NULL )
- goto err;
-+ elf->dest_size = pages * PAGE_SIZE;
-
-- elf->dest += elf->pstart & (PAGE_SIZE - 1);
-+ ELF_ADVANCE_DEST(elf, elf->pstart & (PAGE_SIZE - 1));
-
- /* Load the initial elf image. */
- rc = elf_load_binary(elf);
- if ( rc < 0 )
- PERROR("Failed to load elf binary\n");
-
-- munmap(elf->dest, pages << PAGE_SHIFT);
-- elf->dest = NULL;
-+ munmap(elf->dest_base, pages << PAGE_SHIFT);
-+ elf->dest_base = NULL;
-+ elf->dest_size = 0;
-
- err:
- free(entries);
-@@ -401,11 +403,16 @@ static int setup_guest(xc_interface *xch,
- munmap(page0, PAGE_SIZE);
- }
-
-+ if ( elf_check_broken(&elf) )
-+ ERROR("HVM ELF broken: %s", elf_check_broken(&elf));
-+
- free(page_array);
- return 0;
-
- error_out:
- free(page_array);
-+ if ( elf_check_broken(&elf) )
-+ ERROR("HVM ELF broken, failing: %s", elf_check_broken(&elf));
- return -1;
- }
-
-diff --git a/tools/libxc/xc_linux_osdep.c b/tools/libxc/xc_linux_osdep.c
-index 787e742..98e041c 100644
---- a/tools/libxc/xc_linux_osdep.c
-+++ b/tools/libxc/xc_linux_osdep.c
-@@ -378,6 +378,8 @@ static void *linux_privcmd_map_foreign_range(xc_interface *xch, xc_osdep_handle
-
- num = (size + XC_PAGE_SIZE - 1) >> XC_PAGE_SHIFT;
- arr = calloc(num, sizeof(xen_pfn_t));
-+ if ( arr == NULL )
-+ return NULL;
-
- for ( i = 0; i < num; i++ )
- arr[i] = mfn + i;
-@@ -402,6 +404,8 @@ static void *linux_privcmd_map_foreign_ranges(xc_interface *xch, xc_osdep_handle
- num_per_entry = chunksize >> XC_PAGE_SHIFT;
- num = num_per_entry * nentries;
- arr = calloc(num, sizeof(xen_pfn_t));
-+ if ( arr == NULL )
-+ return NULL;
-
- for ( i = 0; i < nentries; i++ )
- for ( j = 0; j < num_per_entry; j++ )
-diff --git a/tools/libxc/xc_offline_page.c b/tools/libxc/xc_offline_page.c
-index 089a361..36b9812 100644
---- a/tools/libxc/xc_offline_page.c
-+++ b/tools/libxc/xc_offline_page.c
-@@ -714,6 +714,11 @@ int xc_exchange_page(xc_interface *xch, int domid, xen_pfn_t mfn)
-
- new_p = xc_map_foreign_range(xch, domid, PAGE_SIZE,
- PROT_READ|PROT_WRITE, new_mfn);
-+ if ( new_p == NULL )
-+ {
-+ ERROR("failed to map new_p for copy, guest may be broken?");
-+ goto failed;
-+ }
- memcpy(new_p, backup, PAGE_SIZE);
- munmap(new_p, PAGE_SIZE);
- mops.arg1.mfn = new_mfn;
-diff --git a/tools/libxc/xc_private.c b/tools/libxc/xc_private.c
-index 3e03a91..848ceed 100644
---- a/tools/libxc/xc_private.c
-+++ b/tools/libxc/xc_private.c
-@@ -771,6 +771,8 @@ const char *xc_strerror(xc_interface *xch, int errcode)
- errbuf = pthread_getspecific(errbuf_pkey);
- if (errbuf == NULL) {
- errbuf = malloc(XS_BUFSIZE);
-+ if ( errbuf == NULL )
-+ return "(failed to allocate errbuf)";
- pthread_setspecific(errbuf_pkey, errbuf);
- }
-
-diff --git a/tools/libxc/xenctrl.h b/tools/libxc/xenctrl.h
-index b7741ca..8952048 100644
---- a/tools/libxc/xenctrl.h
-+++ b/tools/libxc/xenctrl.h
-@@ -1778,7 +1778,7 @@ int xc_cpuid_set(xc_interface *xch,
- int xc_cpuid_apply_policy(xc_interface *xch,
- domid_t domid);
- void xc_cpuid_to_str(const unsigned int *regs,
-- char **strs);
-+ char **strs); /* some strs[] may be NULL if ENOMEM */
- int xc_mca_op(xc_interface *xch, struct xen_mc *mc);
- #endif
-
-diff --git a/tools/xcutils/readnotes.c b/tools/xcutils/readnotes.c
-index c926186..5fa445e 100644
---- a/tools/xcutils/readnotes.c
-+++ b/tools/xcutils/readnotes.c
-@@ -61,51 +61,56 @@ struct setup_header {
- } __attribute__((packed));
-
- static void print_string_note(const char *prefix, struct elf_binary *elf,
-- const elf_note *note)
-+ ELF_HANDLE_DECL(elf_note) note)
- {
-- printf("%s: %s\n", prefix, (char*)elf_note_desc(elf, note));
-+ printf("%s: %s\n", prefix, elf_strfmt(elf, elf_note_desc(elf, note)));
- }
-
- static void print_numeric_note(const char *prefix, struct elf_binary *elf,
-- const elf_note *note)
-+ ELF_HANDLE_DECL(elf_note) note)
- {
- uint64_t value = elf_note_numeric(elf, note);
-- int descsz = elf_uval(elf, note, descsz);
-+ unsigned descsz = elf_uval(elf, note, descsz);
-
- printf("%s: %#*" PRIx64 " (%d bytes)\n",
- prefix, 2+2*descsz, value, descsz);
- }
-
- static void print_l1_mfn_valid_note(const char *prefix, struct elf_binary *elf,
-- const elf_note *note)
-+ ELF_HANDLE_DECL(elf_note) note)
- {
-- int descsz = elf_uval(elf, note, descsz);
-- const uint32_t *desc32 = elf_note_desc(elf, note);
-- const uint64_t *desc64 = elf_note_desc(elf, note);
-+ unsigned descsz = elf_uval(elf, note, descsz);
-+ elf_ptrval desc = elf_note_desc(elf, note);
-
- /* XXX should be able to cope with a list of values. */
- switch ( descsz / 2 )
- {
- case 8:
- printf("%s: mask=%#"PRIx64" value=%#"PRIx64"\n", prefix,
-- desc64[0], desc64[1]);
-+ elf_access_unsigned(elf, desc, 0, 8),
-+ elf_access_unsigned(elf, desc, 8, 8));
- break;
- case 4:
- printf("%s: mask=%#"PRIx32" value=%#"PRIx32"\n", prefix,
-- desc32[0],desc32[1]);
-+ (uint32_t)elf_access_unsigned(elf, desc, 0, 4),
-+ (uint32_t)elf_access_unsigned(elf, desc, 4, 4));
- break;
- }
-
- }
-
--static int print_notes(struct elf_binary *elf, const elf_note *start, const elf_note *end)
-+static unsigned print_notes(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) start, ELF_HANDLE_DECL(elf_note) end)
- {
-- const elf_note *note;
-- int notes_found = 0;
-+ ELF_HANDLE_DECL(elf_note) note;
-+ unsigned notes_found = 0;
-+ const char *this_note_name;
-
-- for ( note = start; note < end; note = elf_note_next(elf, note) )
-+ for ( note = start; ELF_HANDLE_PTRVAL(note) < ELF_HANDLE_PTRVAL(end); note = elf_note_next(elf, note) )
- {
-- if (0 != strcmp(elf_note_name(elf, note), "Xen"))
-+ this_note_name = elf_note_name(elf, note);
-+ if (NULL == this_note_name)
-+ continue;
-+ if (0 != strcmp(this_note_name, "Xen"))
- continue;
-
- notes_found++;
-@@ -156,7 +161,7 @@ static int print_notes(struct elf_binary *elf, const elf_note *start, const elf_
- break;
- default:
- printf("unknown note type %#x\n",
-- (int)elf_uval(elf, note, type));
-+ (unsigned)elf_uval(elf, note, type));
- break;
- }
- }
-@@ -166,12 +171,13 @@ static int print_notes(struct elf_binary *elf, const elf_note *start, const elf_
- int main(int argc, char **argv)
- {
- const char *f;
-- int fd,h,size,usize,count;
-+ int fd;
-+ unsigned h,size,usize,count;
- void *image,*tmp;
- struct stat st;
- struct elf_binary elf;
-- const elf_shdr *shdr;
-- int notes_found = 0;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
-+ unsigned notes_found = 0;
-
- struct setup_header *hdr;
- uint64_t payload_offset, payload_length;
-@@ -257,7 +263,7 @@ int main(int argc, char **argv)
- count = elf_phdr_count(&elf);
- for ( h=0; h < count; h++)
- {
-- const elf_phdr *phdr;
-+ ELF_HANDLE_DECL(elf_phdr) phdr;
- phdr = elf_phdr_by_index(&elf, h);
- if (elf_uval(&elf, phdr, p_type) != PT_NOTE)
- continue;
-@@ -269,8 +275,8 @@ int main(int argc, char **argv)
- continue;
-
- notes_found = print_notes(&elf,
-- elf_segment_start(&elf, phdr),
-- elf_segment_end(&elf, phdr));
-+ ELF_MAKE_HANDLE(elf_note, elf_segment_start(&elf, phdr)),
-+ ELF_MAKE_HANDLE(elf_note, elf_segment_end(&elf, phdr)));
- }
-
- if ( notes_found == 0 )
-@@ -278,13 +284,13 @@ int main(int argc, char **argv)
- count = elf_shdr_count(&elf);
- for ( h=0; h < count; h++)
- {
-- const elf_shdr *shdr;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
- shdr = elf_shdr_by_index(&elf, h);
- if (elf_uval(&elf, shdr, sh_type) != SHT_NOTE)
- continue;
- notes_found = print_notes(&elf,
-- elf_section_start(&elf, shdr),
-- elf_section_end(&elf, shdr));
-+ ELF_MAKE_HANDLE(elf_note, elf_section_start(&elf, shdr)),
-+ ELF_MAKE_HANDLE(elf_note, elf_section_end(&elf, shdr)));
- if ( notes_found )
- fprintf(stderr, "using notes from SHT_NOTE section\n");
-
-@@ -292,8 +298,12 @@ int main(int argc, char **argv)
- }
-
- shdr = elf_shdr_by_name(&elf, "__xen_guest");
-- if (shdr)
-- printf("__xen_guest: %s\n", (char*)elf_section_start(&elf, shdr));
-+ if (ELF_HANDLE_VALID(shdr))
-+ printf("__xen_guest: %s\n",
-+ elf_strfmt(&elf, elf_section_start(&elf, shdr)));
-+
-+ if (elf_check_broken(&elf))
-+ printf("warning: broken ELF: %s\n", elf_check_broken(&elf));
-
- return 0;
- }
-diff --git a/xen/arch/arm/kernel.c b/xen/arch/arm/kernel.c
-index 2d56130..dec0519 100644
---- a/xen/arch/arm/kernel.c
-+++ b/xen/arch/arm/kernel.c
-@@ -146,6 +146,8 @@ static int kernel_try_elf_prepare(struct kernel_info *info)
- {
- int rc;
-
-+ memset(&info->elf.elf, 0, sizeof(info->elf.elf));
-+
- info->kernel_order = get_order_from_bytes(KERNEL_FLASH_SIZE);
- info->kernel_img = alloc_xenheap_pages(info->kernel_order, 0);
- if ( info->kernel_img == NULL )
-@@ -160,7 +162,7 @@ static int kernel_try_elf_prepare(struct kernel_info *info)
- #endif
- elf_parse_binary(&info->elf.elf);
- if ( (rc = elf_xen_parse(&info->elf.elf, &info->elf.parms)) != 0 )
-- return rc;
-+ goto err;
-
- /*
- * TODO: can the ELF header be used to find the physical address
-@@ -169,7 +171,18 @@ static int kernel_try_elf_prepare(struct kernel_info *info)
- info->entry = info->elf.parms.virt_entry;
- info->load = kernel_elf_load;
-
-+ if ( elf_check_broken(&info->elf.elf) )
-+ printk("Xen: warning: ELF kernel broken: %s\n",
-+ elf_check_broken(&info->elf.elf));
-+
- return 0;
-+
-+err:
-+ if ( elf_check_broken(&info->elf.elf) )
-+ printk("Xen: ELF kernel broken: %s\n",
-+ elf_check_broken(&info->elf.elf));
-+
-+ return rc;
- }
-
- int kernel_prepare(struct kernel_info *info)
-diff --git a/xen/arch/x86/bzimage.c b/xen/arch/x86/bzimage.c
-index 5adc223..3600dca 100644
---- a/xen/arch/x86/bzimage.c
-+++ b/xen/arch/x86/bzimage.c
-@@ -220,7 +220,7 @@ unsigned long __init bzimage_headroom(char *image_start,
- image_length = hdr->payload_length;
- }
-
-- if ( elf_is_elfbinary(image_start) )
-+ if ( elf_is_elfbinary(image_start, image_length) )
- return 0;
-
- orig_image_len = image_length;
-@@ -251,7 +251,7 @@ int __init bzimage_parse(char *image_base, char **image_start, unsigned long *im
- *image_len = hdr->payload_length;
- }
-
-- if ( elf_is_elfbinary(*image_start) )
-+ if ( elf_is_elfbinary(*image_start, *image_len) )
- return 0;
-
- BUG_ON(!(image_base < *image_start));
-diff --git a/xen/arch/x86/domain_build.c b/xen/arch/x86/domain_build.c
-index 469d363..0dbec96 100644
---- a/xen/arch/x86/domain_build.c
-+++ b/xen/arch/x86/domain_build.c
-@@ -374,7 +374,7 @@ int __init construct_dom0(
- #endif
- elf_parse_binary(&elf);
- if ( (rc = elf_xen_parse(&elf, &parms)) != 0 )
-- return rc;
-+ goto out;
-
- /* compatibility check */
- compatible = 0;
-@@ -413,14 +413,16 @@ int __init construct_dom0(
- if ( !compatible )
- {
- printk("Mismatch between Xen and DOM0 kernel\n");
-- return -EINVAL;
-+ rc = -EINVAL;
-+ goto out;
- }
-
- if ( parms.elf_notes[XEN_ELFNOTE_SUPPORTED_FEATURES].type != XEN_ENT_NONE &&
- !test_bit(XENFEAT_dom0, parms.f_supported) )
- {
- printk("Kernel does not support Dom0 operation\n");
-- return -EINVAL;
-+ rc = -EINVAL;
-+ goto out;
- }
-
- #if defined(__x86_64__)
-@@ -734,7 +736,8 @@ int __init construct_dom0(
- (v_end > HYPERVISOR_COMPAT_VIRT_START(d)) )
- {
- printk("DOM0 image overlaps with Xen private area.\n");
-- return -EINVAL;
-+ rc = -EINVAL;
-+ goto out;
- }
-
- if ( is_pv_32on64_domain(d) )
-@@ -908,12 +911,13 @@ int __init construct_dom0(
- write_ptbase(v);
-
- /* Copy the OS image and free temporary buffer. */
-- elf.dest = (void*)vkern_start;
-+ elf.dest_base = (void*)vkern_start;
-+ elf.dest_size = vkern_end - vkern_start;
- rc = elf_load_binary(&elf);
- if ( rc < 0 )
- {
- printk("Failed to load the kernel binary\n");
-- return rc;
-+ goto out;
- }
- bootstrap_map(NULL);
-
-@@ -924,7 +928,8 @@ int __init construct_dom0(
- {
- write_ptbase(current);
- printk("Invalid HYPERCALL_PAGE field in ELF notes.\n");
-- return -1;
-+ rc = -1;
-+ goto out;
- }
- hypercall_page_initialise(
- d, (void *)(unsigned long)parms.virt_hypercall);
-@@ -1271,9 +1276,19 @@ int __init construct_dom0(
-
- BUG_ON(rc != 0);
-
-- iommu_dom0_init(dom0);
-+ if ( elf_check_broken(&elf) )
-+ printk(" Xen warning: dom0 kernel broken ELF: %s\n",
-+ elf_check_broken(&elf));
-
-+ iommu_dom0_init(dom0);
- return 0;
-+
-+out:
-+ if ( elf_check_broken(&elf) )
-+ printk(" Xen dom0 kernel broken ELF: %s\n",
-+ elf_check_broken(&elf));
-+
-+ return rc;
- }
-
- /*
-diff --git a/xen/common/libelf/Makefile b/xen/common/libelf/Makefile
-index 18dc8e2..5bf8f76 100644
---- a/xen/common/libelf/Makefile
-+++ b/xen/common/libelf/Makefile
-@@ -2,6 +2,8 @@ obj-bin-y := libelf.o
-
- SECTIONS := text data $(SPECIAL_DATA_SECTIONS)
-
-+CFLAGS += -Wno-pointer-sign
-+
- libelf.o: libelf-temp.o Makefile
- $(OBJCOPY) $(foreach s,$(SECTIONS),--rename-section .$(s)=.init.$(s)) $< $@
-
-diff --git a/xen/common/libelf/libelf-dominfo.c b/xen/common/libelf/libelf-dominfo.c
-index 523837f..412ea70 100644
---- a/xen/common/libelf/libelf-dominfo.c
-+++ b/xen/common/libelf/libelf-dominfo.c
-@@ -29,22 +29,22 @@ static const char *const elf_xen_feature_names[] = {
- [XENFEAT_pae_pgdir_above_4gb] = "pae_pgdir_above_4gb",
- [XENFEAT_dom0] = "dom0"
- };
--static const int elf_xen_features =
-+static const unsigned elf_xen_features =
- sizeof(elf_xen_feature_names) / sizeof(elf_xen_feature_names[0]);
-
--int elf_xen_parse_features(const char *features,
-+elf_errorstatus elf_xen_parse_features(const char *features,
- uint32_t *supported,
- uint32_t *required)
- {
-- char feature[64];
-- int pos, len, i;
-+ unsigned char feature[64];
-+ unsigned pos, len, i;
-
- if ( features == NULL )
- return 0;
-
- for ( pos = 0; features[pos] != '\0'; pos += len )
- {
-- memset(feature, 0, sizeof(feature));
-+ elf_memset_unchecked(feature, 0, sizeof(feature));
- for ( len = 0;; len++ )
- {
- if ( len >= sizeof(feature)-1 )
-@@ -94,14 +94,14 @@ int elf_xen_parse_features(const char *features,
- /* ------------------------------------------------------------------------ */
- /* xen elf notes */
-
--int elf_xen_parse_note(struct elf_binary *elf,
-+elf_errorstatus elf_xen_parse_note(struct elf_binary *elf,
- struct elf_dom_parms *parms,
-- const elf_note *note)
-+ ELF_HANDLE_DECL(elf_note) note)
- {
- /* *INDENT-OFF* */
- static const struct {
- char *name;
-- int str;
-+ bool str;
- } note_desc[] = {
- [XEN_ELFNOTE_ENTRY] = { "ENTRY", 0},
- [XEN_ELFNOTE_HYPERCALL_PAGE] = { "HYPERCALL_PAGE", 0},
-@@ -125,7 +125,7 @@ int elf_xen_parse_note(struct elf_binary *elf,
- const char *str = NULL;
- uint64_t val = 0;
- unsigned int i;
-- int type = elf_uval(elf, note, type);
-+ unsigned type = elf_uval(elf, note, type);
-
- if ( (type >= sizeof(note_desc) / sizeof(note_desc[0])) ||
- (note_desc[type].name == NULL) )
-@@ -137,7 +137,10 @@ int elf_xen_parse_note(struct elf_binary *elf,
-
- if ( note_desc[type].str )
- {
-- str = elf_note_desc(elf, note);
-+ str = elf_strval(elf, elf_note_desc(elf, note));
-+ if (str == NULL)
-+ /* elf_strval will mark elf broken if it fails so no need to log */
-+ return 0;
- elf_msg(elf, "%s: %s = \"%s\"\n", __FUNCTION__,
- note_desc[type].name, str);
- parms->elf_notes[type].type = XEN_ENT_STR;
-@@ -213,23 +216,37 @@ int elf_xen_parse_note(struct elf_binary *elf,
- return 0;
- }
-
--static int elf_xen_parse_notes(struct elf_binary *elf,
-+#define ELF_NOTE_INVALID (~0U)
-+
-+static unsigned elf_xen_parse_notes(struct elf_binary *elf,
- struct elf_dom_parms *parms,
-- const void *start, const void *end)
-+ elf_ptrval start,
-+ elf_ptrval end,
-+ unsigned *total_note_count)
- {
-- int xen_elfnotes = 0;
-- const elf_note *note;
-+ unsigned xen_elfnotes = 0;
-+ ELF_HANDLE_DECL(elf_note) note;
-+ const char *note_name;
-
- parms->elf_note_start = start;
- parms->elf_note_end = end;
-- for ( note = parms->elf_note_start;
-- (void *)note < parms->elf_note_end;
-+ for ( note = ELF_MAKE_HANDLE(elf_note, parms->elf_note_start);
-+ ELF_HANDLE_PTRVAL(note) < parms->elf_note_end;
- note = elf_note_next(elf, note) )
- {
-- if ( strcmp(elf_note_name(elf, note), "Xen") )
-+ if ( *total_note_count >= ELF_MAX_TOTAL_NOTE_COUNT )
-+ {
-+ elf_mark_broken(elf, "too many ELF notes");
-+ break;
-+ }
-+ (*total_note_count)++;
-+ note_name = elf_note_name(elf, note);
-+ if ( note_name == NULL )
-+ continue;
-+ if ( strcmp(note_name, "Xen") )
- continue;
- if ( elf_xen_parse_note(elf, parms, note) )
-- return -1;
-+ return ELF_NOTE_INVALID;
- xen_elfnotes++;
- }
- return xen_elfnotes;
-@@ -238,48 +255,49 @@ static int elf_xen_parse_notes(struct elf_binary *elf,
- /* ------------------------------------------------------------------------ */
- /* __xen_guest section */
-
--int elf_xen_parse_guest_info(struct elf_binary *elf,
-+elf_errorstatus elf_xen_parse_guest_info(struct elf_binary *elf,
- struct elf_dom_parms *parms)
- {
-- const char *h;
-- char name[32], value[128];
-- int len;
-+ elf_ptrval h;
-+ unsigned char name[32], value[128];
-+ unsigned len;
-
- h = parms->guest_info;
-- while ( *h )
-+#define STAR(h) (elf_access_unsigned(elf, (h), 0, 1))
-+ while ( STAR(h) )
- {
-- memset(name, 0, sizeof(name));
-- memset(value, 0, sizeof(value));
-+ elf_memset_unchecked(name, 0, sizeof(name));
-+ elf_memset_unchecked(value, 0, sizeof(value));
- for ( len = 0;; len++, h++ )
- {
- if ( len >= sizeof(name)-1 )
- break;
-- if ( *h == '\0' )
-+ if ( STAR(h) == '\0' )
- break;
-- if ( *h == ',' )
-+ if ( STAR(h) == ',' )
- {
- h++;
- break;
- }
-- if ( *h == '=' )
-+ if ( STAR(h) == '=' )
- {
- h++;
- for ( len = 0;; len++, h++ )
- {
- if ( len >= sizeof(value)-1 )
- break;
-- if ( *h == '\0' )
-+ if ( STAR(h) == '\0' )
- break;
-- if ( *h == ',' )
-+ if ( STAR(h) == ',' )
- {
- h++;
- break;
- }
-- value[len] = *h;
-+ value[len] = STAR(h);
- }
- break;
- }
-- name[len] = *h;
-+ name[len] = STAR(h);
- }
- elf_msg(elf, "%s: %s=\"%s\"\n", __FUNCTION__, name, value);
-
-@@ -325,12 +343,13 @@ int elf_xen_parse_guest_info(struct elf_binary *elf,
- /* ------------------------------------------------------------------------ */
- /* sanity checks */
-
--static int elf_xen_note_check(struct elf_binary *elf,
-+static elf_errorstatus elf_xen_note_check(struct elf_binary *elf,
- struct elf_dom_parms *parms)
- {
-- if ( (parms->elf_note_start == NULL) && (parms->guest_info == NULL) )
-+ if ( (ELF_PTRVAL_INVALID(parms->elf_note_start)) &&
-+ (ELF_PTRVAL_INVALID(parms->guest_info)) )
- {
-- int machine = elf_uval(elf, elf->ehdr, e_machine);
-+ unsigned machine = elf_uval(elf, elf->ehdr, e_machine);
- if ( (machine == EM_386) || (machine == EM_X86_64) )
- {
- elf_err(elf, "%s: ERROR: Not a Xen-ELF image: "
-@@ -368,7 +387,7 @@ static int elf_xen_note_check(struct elf_binary *elf,
- return 0;
- }
-
--static int elf_xen_addr_calc_check(struct elf_binary *elf,
-+static elf_errorstatus elf_xen_addr_calc_check(struct elf_binary *elf,
- struct elf_dom_parms *parms)
- {
- if ( (parms->elf_paddr_offset != UNSET_ADDR) &&
-@@ -454,15 +473,16 @@ static int elf_xen_addr_calc_check(struct elf_binary *elf,
- /* ------------------------------------------------------------------------ */
- /* glue it all together ... */
-
--int elf_xen_parse(struct elf_binary *elf,
-+elf_errorstatus elf_xen_parse(struct elf_binary *elf,
- struct elf_dom_parms *parms)
- {
-- const elf_shdr *shdr;
-- const elf_phdr *phdr;
-- int xen_elfnotes = 0;
-- int i, count, rc;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
-+ ELF_HANDLE_DECL(elf_phdr) phdr;
-+ unsigned xen_elfnotes = 0;
-+ unsigned i, count, more_notes;
-+ unsigned total_note_count = 0;
-
-- memset(parms, 0, sizeof(*parms));
-+ elf_memset_unchecked(parms, 0, sizeof(*parms));
- parms->virt_base = UNSET_ADDR;
- parms->virt_entry = UNSET_ADDR;
- parms->virt_hypercall = UNSET_ADDR;
-@@ -475,6 +495,9 @@ int elf_xen_parse(struct elf_binary *elf,
- for ( i = 0; i < count; i++ )
- {
- phdr = elf_phdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(phdr), 1) )
-+ /* input has an insane program header count field */
-+ break;
- if ( elf_uval(elf, phdr, p_type) != PT_NOTE )
- continue;
-
-@@ -485,13 +508,14 @@ int elf_xen_parse(struct elf_binary *elf,
- if (elf_uval(elf, phdr, p_offset) == 0)
- continue;
-
-- rc = elf_xen_parse_notes(elf, parms,
-+ more_notes = elf_xen_parse_notes(elf, parms,
- elf_segment_start(elf, phdr),
-- elf_segment_end(elf, phdr));
-- if ( rc == -1 )
-+ elf_segment_end(elf, phdr),
-+ &total_note_count);
-+ if ( more_notes == ELF_NOTE_INVALID )
- return -1;
-
-- xen_elfnotes += rc;
-+ xen_elfnotes += more_notes;
- }
-
- /*
-@@ -504,21 +528,25 @@ int elf_xen_parse(struct elf_binary *elf,
- for ( i = 0; i < count; i++ )
- {
- shdr = elf_shdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
-+ /* input has an insane section header count field */
-+ break;
-
- if ( elf_uval(elf, shdr, sh_type) != SHT_NOTE )
- continue;
-
-- rc = elf_xen_parse_notes(elf, parms,
-+ more_notes = elf_xen_parse_notes(elf, parms,
- elf_section_start(elf, shdr),
-- elf_section_end(elf, shdr));
-+ elf_section_end(elf, shdr),
-+ &total_note_count);
-
-- if ( rc == -1 )
-+ if ( more_notes == ELF_NOTE_INVALID )
- return -1;
-
-- if ( xen_elfnotes == 0 && rc > 0 )
-+ if ( xen_elfnotes == 0 && more_notes > 0 )
- elf_msg(elf, "%s: using notes from SHT_NOTE section\n", __FUNCTION__);
-
-- xen_elfnotes += rc;
-+ xen_elfnotes += more_notes;
- }
-
- }
-@@ -528,20 +556,15 @@ int elf_xen_parse(struct elf_binary *elf,
- */
- if ( xen_elfnotes == 0 )
- {
-- count = elf_shdr_count(elf);
-- for ( i = 0; i < count; i++ )
-+ shdr = elf_shdr_by_name(elf, "__xen_guest");
-+ if ( ELF_HANDLE_VALID(shdr) )
- {
-- shdr = elf_shdr_by_name(elf, "__xen_guest");
-- if ( shdr )
-- {
-- parms->guest_info = elf_section_start(elf, shdr);
-- parms->elf_note_start = NULL;
-- parms->elf_note_end = NULL;
-- elf_msg(elf, "%s: __xen_guest: \"%s\"\n", __FUNCTION__,
-- parms->guest_info);
-- elf_xen_parse_guest_info(elf, parms);
-- break;
-- }
-+ parms->guest_info = elf_section_start(elf, shdr);
-+ parms->elf_note_start = ELF_INVALID_PTRVAL;
-+ parms->elf_note_end = ELF_INVALID_PTRVAL;
-+ elf_msg(elf, "%s: __xen_guest: \"%s\"\n", __FUNCTION__,
-+ elf_strfmt(elf, parms->guest_info));
-+ elf_xen_parse_guest_info(elf, parms);
- }
- }
-
-diff --git a/xen/common/libelf/libelf-loader.c b/xen/common/libelf/libelf-loader.c
-index ab58b8b..e2e75af 100644
---- a/xen/common/libelf/libelf-loader.c
-+++ b/xen/common/libelf/libelf-loader.c
-@@ -16,27 +16,33 @@
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- */
-
-+#ifdef __XEN__
-+#include <asm/guest_access.h>
-+#endif
-+
- #include "libelf-private.h"
-
- /* ------------------------------------------------------------------------ */
-
--int elf_init(struct elf_binary *elf, const char *image, size_t size)
-+elf_errorstatus elf_init(struct elf_binary *elf, const char *image_input, size_t size)
- {
-- const elf_shdr *shdr;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
- uint64_t i, count, section, offset;
-
-- if ( !elf_is_elfbinary(image) )
-+ if ( !elf_is_elfbinary(image_input, size) )
- {
- elf_err(elf, "%s: not an ELF binary\n", __FUNCTION__);
- return -1;
- }
-
-- memset(elf, 0, sizeof(*elf));
-- elf->image = image;
-+ elf_memset_unchecked(elf, 0, sizeof(*elf));
-+ elf->image_base = image_input;
- elf->size = size;
-- elf->ehdr = (elf_ehdr *)image;
-- elf->class = elf->ehdr->e32.e_ident[EI_CLASS];
-- elf->data = elf->ehdr->e32.e_ident[EI_DATA];
-+ elf->ehdr = ELF_MAKE_HANDLE(elf_ehdr, (elf_ptrval)image_input);
-+ elf->class = elf_uval_3264(elf, elf->ehdr, e32.e_ident[EI_CLASS]);
-+ elf->data = elf_uval_3264(elf, elf->ehdr, e32.e_ident[EI_DATA]);
-+ elf->caller_xdest_base = NULL;
-+ elf->caller_xdest_size = 0;
-
- /* Sanity check phdr. */
- offset = elf_uval(elf, elf->ehdr, e_phoff) +
-@@ -61,7 +67,7 @@ int elf_init(struct elf_binary *elf, const char *image, size_t size)
- /* Find section string table. */
- section = elf_uval(elf, elf->ehdr, e_shstrndx);
- shdr = elf_shdr_by_index(elf, section);
-- if ( shdr != NULL )
-+ if ( ELF_HANDLE_VALID(shdr) )
- elf->sec_strtab = elf_section_start(elf, shdr);
-
- /* Find symbol table and symbol string table. */
-@@ -69,13 +75,16 @@ int elf_init(struct elf_binary *elf, const char *image, size_t size)
- for ( i = 0; i < count; i++ )
- {
- shdr = elf_shdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
-+ /* input has an insane section header count field */
-+ break;
- if ( elf_uval(elf, shdr, sh_type) != SHT_SYMTAB )
- continue;
- elf->sym_tab = shdr;
- shdr = elf_shdr_by_index(elf, elf_uval(elf, shdr, sh_link));
-- if ( shdr == NULL )
-+ if ( !ELF_HANDLE_VALID(shdr) )
- {
-- elf->sym_tab = NULL;
-+ elf->sym_tab = ELF_INVALID_HANDLE(elf_shdr);
- continue;
- }
- elf->sym_strtab = elf_section_start(elf, shdr);
-@@ -86,7 +95,7 @@ int elf_init(struct elf_binary *elf, const char *image, size_t size)
- }
-
- #ifndef __XEN__
--void elf_call_log_callback(struct elf_binary *elf, int iserr,
-+void elf_call_log_callback(struct elf_binary *elf, bool iserr,
- const char *fmt,...) {
- va_list al;
-
-@@ -101,36 +110,39 @@ void elf_call_log_callback(struct elf_binary *elf, int iserr,
- }
-
- void elf_set_log(struct elf_binary *elf, elf_log_callback *log_callback,
-- void *log_caller_data, int verbose)
-+ void *log_caller_data, bool verbose)
- {
- elf->log_callback = log_callback;
- elf->log_caller_data = log_caller_data;
- elf->verbose = verbose;
- }
-
--static int elf_load_image(void *dst, const void *src, uint64_t filesz, uint64_t memsz)
-+static elf_errorstatus elf_load_image(struct elf_binary *elf,
-+ elf_ptrval dst, elf_ptrval src,
-+ uint64_t filesz, uint64_t memsz)
- {
-- memcpy(dst, src, filesz);
-- memset(dst + filesz, 0, memsz - filesz);
-+ elf_memcpy_safe(elf, dst, src, filesz);
-+ elf_memset_safe(elf, dst + filesz, 0, memsz - filesz);
- return 0;
- }
- #else
--#include <asm/guest_access.h>
-
- void elf_set_verbose(struct elf_binary *elf)
- {
- elf->verbose = 1;
- }
-
--static int elf_load_image(void *dst, const void *src, uint64_t filesz, uint64_t memsz)
-+static elf_errorstatus elf_load_image(struct elf_binary *elf, elf_ptrval dst, elf_ptrval src, uint64_t filesz, uint64_t memsz)
- {
-- int rc;
-+ elf_errorstatus rc;
- if ( filesz > ULONG_MAX || memsz > ULONG_MAX )
- return -1;
-- rc = raw_copy_to_guest(dst, src, filesz);
-+ /* We trust the dom0 kernel image completely, so we don't care
-+ * about overruns etc. here. */
-+ rc = raw_copy_to_guest(ELF_UNSAFE_PTR(dst), ELF_UNSAFE_PTR(src), filesz);
- if ( rc != 0 )
- return -1;
-- rc = raw_clear_guest(dst + filesz, memsz - filesz);
-+ rc = raw_clear_guest(ELF_UNSAFE_PTR(dst + filesz), memsz - filesz);
- if ( rc != 0 )
- return -1;
- return 0;
-@@ -141,10 +153,10 @@ static int elf_load_image(void *dst, const void *src, uint64_t filesz, uint64_t
- void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart)
- {
- uint64_t sz;
-- const elf_shdr *shdr;
-- int i, type;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
-+ unsigned i, type;
-
-- if ( !elf->sym_tab )
-+ if ( !ELF_HANDLE_VALID(elf->sym_tab) )
- return;
-
- pstart = elf_round_up(elf, pstart);
-@@ -161,7 +173,10 @@ void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart)
- for ( i = 0; i < elf_shdr_count(elf); i++ )
- {
- shdr = elf_shdr_by_index(elf, i);
-- type = elf_uval(elf, (elf_shdr *)shdr, sh_type);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
-+ /* input has an insane section header count field */
-+ break;
-+ type = elf_uval(elf, shdr, sh_type);
- if ( (type == SHT_STRTAB) || (type == SHT_SYMTAB) )
- sz = elf_round_up(elf, sz + elf_uval(elf, shdr, sh_size));
- }
-@@ -172,11 +187,13 @@ void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart)
-
- static void elf_load_bsdsyms(struct elf_binary *elf)
- {
-- elf_ehdr *sym_ehdr;
-+ ELF_HANDLE_DECL(elf_ehdr) sym_ehdr;
- unsigned long sz;
-- char *maxva, *symbase, *symtab_addr;
-- elf_shdr *shdr;
-- int i, type;
-+ elf_ptrval maxva;
-+ elf_ptrval symbase;
-+ elf_ptrval symtab_addr;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
-+ unsigned i, type;
-
- if ( !elf->bsd_symtab_pstart )
- return;
-@@ -184,18 +201,18 @@ static void elf_load_bsdsyms(struct elf_binary *elf)
- #define elf_hdr_elm(_elf, _hdr, _elm, _val) \
- do { \
- if ( elf_64bit(_elf) ) \
-- (_hdr)->e64._elm = _val; \
-+ elf_store_field(_elf, _hdr, e64._elm, _val); \
- else \
-- (_hdr)->e32._elm = _val; \
-+ elf_store_field(_elf, _hdr, e32._elm, _val); \
- } while ( 0 )
-
- symbase = elf_get_ptr(elf, elf->bsd_symtab_pstart);
- symtab_addr = maxva = symbase + sizeof(uint32_t);
-
- /* Set up Elf header. */
-- sym_ehdr = (elf_ehdr *)symtab_addr;
-+ sym_ehdr = ELF_MAKE_HANDLE(elf_ehdr, symtab_addr);
- sz = elf_uval(elf, elf->ehdr, e_ehsize);
-- memcpy(sym_ehdr, elf->ehdr, sz);
-+ elf_memcpy_safe(elf, ELF_HANDLE_PTRVAL(sym_ehdr), ELF_HANDLE_PTRVAL(elf->ehdr), sz);
- maxva += sz; /* no round up */
-
- elf_hdr_elm(elf, sym_ehdr, e_phoff, 0);
-@@ -204,37 +221,50 @@ do { \
- elf_hdr_elm(elf, sym_ehdr, e_phnum, 0);
-
- /* Copy Elf section headers. */
-- shdr = (elf_shdr *)maxva;
-+ shdr = ELF_MAKE_HANDLE(elf_shdr, maxva);
- sz = elf_shdr_count(elf) * elf_uval(elf, elf->ehdr, e_shentsize);
-- memcpy(shdr, elf->image + elf_uval(elf, elf->ehdr, e_shoff), sz);
-- maxva = (char *)(long)elf_round_up(elf, (long)maxva + sz);
-+ elf_memcpy_safe(elf, ELF_HANDLE_PTRVAL(shdr),
-+ ELF_IMAGE_BASE(elf) + elf_uval(elf, elf->ehdr, e_shoff),
-+ sz);
-+ maxva = elf_round_up(elf, (unsigned long)maxva + sz);
-
- for ( i = 0; i < elf_shdr_count(elf); i++ )
- {
-+ elf_ptrval old_shdr_p;
-+ elf_ptrval new_shdr_p;
-+
- type = elf_uval(elf, shdr, sh_type);
- if ( (type == SHT_STRTAB) || (type == SHT_SYMTAB) )
- {
-- elf_msg(elf, "%s: shdr %i at 0x%p -> 0x%p\n", __func__, i,
-+ elf_msg(elf, "%s: shdr %i at 0x%"ELF_PRPTRVAL" -> 0x%"ELF_PRPTRVAL"\n", __func__, i,
- elf_section_start(elf, shdr), maxva);
- sz = elf_uval(elf, shdr, sh_size);
-- memcpy(maxva, elf_section_start(elf, shdr), sz);
-+ elf_memcpy_safe(elf, maxva, elf_section_start(elf, shdr), sz);
- /* Mangled to be based on ELF header location. */
- elf_hdr_elm(elf, shdr, sh_offset, maxva - symtab_addr);
-- maxva = (char *)(long)elf_round_up(elf, (long)maxva + sz);
-+ maxva = elf_round_up(elf, (unsigned long)maxva + sz);
- }
-- shdr = (elf_shdr *)((long)shdr +
-- (long)elf_uval(elf, elf->ehdr, e_shentsize));
-+ old_shdr_p = ELF_HANDLE_PTRVAL(shdr);
-+ new_shdr_p = old_shdr_p + elf_uval(elf, elf->ehdr, e_shentsize);
-+ if ( new_shdr_p <= old_shdr_p ) /* wrapped or stuck */
-+ {
-+ elf_mark_broken(elf, "bad section header length");
-+ break;
-+ }
-+ if ( !elf_access_ok(elf, new_shdr_p, 1) ) /* outside image */
-+ break;
-+ shdr = ELF_MAKE_HANDLE(elf_shdr, new_shdr_p);
- }
-
- /* Write down the actual sym size. */
-- *(uint32_t *)symbase = maxva - symtab_addr;
-+ elf_store_val(elf, uint32_t, symbase, maxva - symtab_addr);
-
- #undef elf_ehdr_elm
- }
-
- void elf_parse_binary(struct elf_binary *elf)
- {
-- const elf_phdr *phdr;
-+ ELF_HANDLE_DECL(elf_phdr) phdr;
- uint64_t low = -1;
- uint64_t high = 0;
- uint64_t i, count, paddr, memsz;
-@@ -243,6 +273,9 @@ void elf_parse_binary(struct elf_binary *elf)
- for ( i = 0; i < count; i++ )
- {
- phdr = elf_phdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(phdr), 1) )
-+ /* input has an insane program header count field */
-+ break;
- if ( !elf_phdr_is_loadable(elf, phdr) )
- continue;
- paddr = elf_uval(elf, phdr, p_paddr);
-@@ -260,16 +293,25 @@ void elf_parse_binary(struct elf_binary *elf)
- __FUNCTION__, elf->pstart, elf->pend);
- }
-
--int elf_load_binary(struct elf_binary *elf)
-+elf_errorstatus elf_load_binary(struct elf_binary *elf)
- {
-- const elf_phdr *phdr;
-+ ELF_HANDLE_DECL(elf_phdr) phdr;
- uint64_t i, count, paddr, offset, filesz, memsz;
-- char *dest;
-+ elf_ptrval dest;
-+ /*
-+ * Let bizarre ELFs write the output image up to twice; this
-+ * calculation is just to ensure our copying loop is no worse than
-+ * O(domain_size).
-+ */
-+ uint64_t remain_allow_copy = (uint64_t)elf->dest_size * 2;
-
- count = elf_uval(elf, elf->ehdr, e_phnum);
- for ( i = 0; i < count; i++ )
- {
- phdr = elf_phdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(phdr), 1) )
-+ /* input has an insane program header count field */
-+ break;
- if ( !elf_phdr_is_loadable(elf, phdr) )
- continue;
- paddr = elf_uval(elf, phdr, p_paddr);
-@@ -277,9 +319,23 @@ int elf_load_binary(struct elf_binary *elf)
- filesz = elf_uval(elf, phdr, p_filesz);
- memsz = elf_uval(elf, phdr, p_memsz);
- dest = elf_get_ptr(elf, paddr);
-- elf_msg(elf, "%s: phdr %" PRIu64 " at 0x%p -> 0x%p\n",
-- __func__, i, dest, dest + filesz);
-- if ( elf_load_image(dest, elf->image + offset, filesz, memsz) != 0 )
-+
-+ /*
-+ * We need to check that the input image doesn't have us copy
-+ * the whole image zillions of times, as that could lead to
-+ * O(n^2) time behaviour and possible DoS by a malicous ELF.
-+ */
-+ if ( remain_allow_copy < memsz )
-+ {
-+ elf_mark_broken(elf, "program segments total to more"
-+ " than the input image size");
-+ break;
-+ }
-+ remain_allow_copy -= memsz;
-+
-+ elf_msg(elf, "%s: phdr %" PRIu64 " at 0x%"ELF_PRPTRVAL" -> 0x%"ELF_PRPTRVAL"\n",
-+ __func__, i, dest, (elf_ptrval)(dest + filesz));
-+ if ( elf_load_image(elf, dest, ELF_IMAGE_BASE(elf) + offset, filesz, memsz) != 0 )
- return -1;
- }
-
-@@ -287,18 +343,18 @@ int elf_load_binary(struct elf_binary *elf)
- return 0;
- }
-
--void *elf_get_ptr(struct elf_binary *elf, unsigned long addr)
-+elf_ptrval elf_get_ptr(struct elf_binary *elf, unsigned long addr)
- {
-- return elf->dest + addr - elf->pstart;
-+ return ELF_REALPTR2PTRVAL(elf->dest_base) + addr - elf->pstart;
- }
-
- uint64_t elf_lookup_addr(struct elf_binary * elf, const char *symbol)
- {
-- const elf_sym *sym;
-+ ELF_HANDLE_DECL(elf_sym) sym;
- uint64_t value;
-
- sym = elf_sym_by_name(elf, symbol);
-- if ( sym == NULL )
-+ if ( !ELF_HANDLE_VALID(sym) )
- {
- elf_err(elf, "%s: not found: %s\n", __FUNCTION__, symbol);
- return -1;
-diff --git a/xen/common/libelf/libelf-private.h b/xen/common/libelf/libelf-private.h
-index 3ef753c..277be04 100644
---- a/xen/common/libelf/libelf-private.h
-+++ b/xen/common/libelf/libelf-private.h
-@@ -77,7 +77,7 @@
- #define elf_err(elf, fmt, args ... ) \
- elf_call_log_callback(elf, 1, fmt , ## args );
-
--void elf_call_log_callback(struct elf_binary*, int iserr, const char *fmt,...);
-+void elf_call_log_callback(struct elf_binary*, bool iserr, const char *fmt,...);
-
- #define safe_strcpy(d,s) \
- do { strncpy((d),(s),sizeof((d))-1); \
-@@ -86,6 +86,19 @@ do { strncpy((d),(s),sizeof((d))-1); \
-
- #endif
-
-+#undef memcpy
-+#undef memset
-+#undef memmove
-+#undef strcpy
-+
-+#define memcpy MISTAKE_unspecified_memcpy
-+#define memset MISTAKE_unspecified_memset
-+#define memmove MISTAKE_unspecified_memmove
-+#define strcpy MISTAKE_unspecified_strcpy
-+ /* This prevents libelf from using these undecorated versions
-+ * of memcpy, memset, memmove and strcpy. Every call site
-+ * must either use elf_mem*_unchecked, or elf_mem*_safe. */
-+
- #endif /* __LIBELF_PRIVATE_H_ */
-
- /*
-diff --git a/xen/common/libelf/libelf-relocate.c b/xen/common/libelf/libelf-relocate.c
-deleted file mode 100644
-index 7ef4b01..0000000
---- a/xen/common/libelf/libelf-relocate.c
-+++ /dev/null
-@@ -1,372 +0,0 @@
--/*
-- * ELF relocation code (not used by xen kernel right now).
-- *
-- * This library is free software; you can redistribute it and/or
-- * modify it under the terms of the GNU Lesser General Public
-- * License as published by the Free Software Foundation;
-- * version 2.1 of the License.
-- *
-- * This library is distributed in the hope that it will be useful,
-- * but WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-- * Lesser General Public License for more details.
-- *
-- * You should have received a copy of the GNU Lesser General Public
-- * License along with this library; if not, write to the Free Software
-- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-- */
--
--#include "libelf-private.h"
--
--/* ------------------------------------------------------------------------ */
--
--static const char *rel_names_i386[] = {
-- "R_386_NONE",
-- "R_386_32",
-- "R_386_PC32",
-- "R_386_GOT32",
-- "R_386_PLT32",
-- "R_386_COPY",
-- "R_386_GLOB_DAT",
-- "R_386_JMP_SLOT",
-- "R_386_RELATIVE",
-- "R_386_GOTOFF",
-- "R_386_GOTPC",
-- "R_386_32PLT",
-- "R_386_TLS_TPOFF",
-- "R_386_TLS_IE",
-- "R_386_TLS_GOTIE",
-- "R_386_TLS_LE",
-- "R_386_TLS_GD",
-- "R_386_TLS_LDM",
-- "R_386_16",
-- "R_386_PC16",
-- "R_386_8",
-- "R_386_PC8",
-- "R_386_TLS_GD_32",
-- "R_386_TLS_GD_PUSH",
-- "R_386_TLS_GD_CALL",
-- "R_386_TLS_GD_POP",
-- "R_386_TLS_LDM_32",
-- "R_386_TLS_LDM_PUSH",
-- "R_386_TLS_LDM_CALL",
-- "R_386_TLS_LDM_POP",
-- "R_386_TLS_LDO_32",
-- "R_386_TLS_IE_32",
-- "R_386_TLS_LE_32",
-- "R_386_TLS_DTPMOD32",
-- "R_386_TLS_DTPOFF32",
-- "R_386_TLS_TPOFF32",
--};
--
--static int elf_reloc_i386(struct elf_binary *elf, int type,
-- uint64_t addr, uint64_t value)
--{
-- void *ptr = elf_get_ptr(elf, addr);
-- uint32_t *u32;
--
-- switch ( type )
-- {
-- case 1 /* R_386_32 */ :
-- u32 = ptr;
-- *u32 += elf->reloc_offset;
-- break;
-- case 2 /* R_386_PC32 */ :
-- /* nothing */
-- break;
-- default:
-- return -1;
-- }
-- return 0;
--}
--
--/* ------------------------------------------------------------------------ */
--
--static const char *rel_names_x86_64[] = {
-- "R_X86_64_NONE",
-- "R_X86_64_64",
-- "R_X86_64_PC32",
-- "R_X86_64_GOT32",
-- "R_X86_64_PLT32",
-- "R_X86_64_COPY",
-- "R_X86_64_GLOB_DAT",
-- "R_X86_64_JUMP_SLOT",
-- "R_X86_64_RELATIVE",
-- "R_X86_64_GOTPCREL",
-- "R_X86_64_32",
-- "R_X86_64_32S",
-- "R_X86_64_16",
-- "R_X86_64_PC16",
-- "R_X86_64_8",
-- "R_X86_64_PC8",
-- "R_X86_64_DTPMOD64",
-- "R_X86_64_DTPOFF64",
-- "R_X86_64_TPOFF64",
-- "R_X86_64_TLSGD",
-- "R_X86_64_TLSLD",
-- "R_X86_64_DTPOFF32",
-- "R_X86_64_GOTTPOFF",
-- "R_X86_64_TPOFF32",
--};
--
--static int elf_reloc_x86_64(struct elf_binary *elf, int type,
-- uint64_t addr, uint64_t value)
--{
-- void *ptr = elf_get_ptr(elf, addr);
-- uint64_t *u64;
-- uint32_t *u32;
-- int32_t *s32;
--
-- switch ( type )
-- {
-- case 1 /* R_X86_64_64 */ :
-- u64 = ptr;
-- value += elf->reloc_offset;
-- *u64 = value;
-- break;
-- case 2 /* R_X86_64_PC32 */ :
-- u32 = ptr;
-- *u32 = value - addr;
-- if ( *u32 != (uint32_t)(value - addr) )
-- {
-- elf_err(elf, "R_X86_64_PC32 overflow: 0x%" PRIx32
-- " != 0x%" PRIx32 "\n",
-- *u32, (uint32_t) (value - addr));
-- return -1;
-- }
-- break;
-- case 10 /* R_X86_64_32 */ :
-- u32 = ptr;
-- value += elf->reloc_offset;
-- *u32 = value;
-- if ( *u32 != value )
-- {
-- elf_err(elf, "R_X86_64_32 overflow: 0x%" PRIx32
-- " != 0x%" PRIx64 "\n",
-- *u32, value);
-- return -1;
-- }
-- break;
-- case 11 /* R_X86_64_32S */ :
-- s32 = ptr;
-- value += elf->reloc_offset;
-- *s32 = value;
-- if ( *s32 != (int64_t) value )
-- {
-- elf_err(elf, "R_X86_64_32S overflow: 0x%" PRIx32
-- " != 0x%" PRIx64 "\n",
-- *s32, (int64_t) value);
-- return -1;
-- }
-- break;
-- default:
-- return -1;
-- }
-- return 0;
--}
--
--/* ------------------------------------------------------------------------ */
--
--static struct relocs {
-- const char **names;
-- int count;
-- int (*func) (struct elf_binary * elf, int type, uint64_t addr,
-- uint64_t value);
--} relocs[] =
--/* *INDENT-OFF* */
--{
-- [EM_386] = {
-- .names = rel_names_i386,
-- .count = sizeof(rel_names_i386) / sizeof(rel_names_i386[0]),
-- .func = elf_reloc_i386,
-- },
-- [EM_X86_64] = {
-- .names = rel_names_x86_64,
-- .count = sizeof(rel_names_x86_64) / sizeof(rel_names_x86_64[0]),
-- .func = elf_reloc_x86_64,
-- }
--};
--/* *INDENT-ON* */
--
--/* ------------------------------------------------------------------------ */
--
--static const char *rela_name(int machine, int type)
--{
-- if ( machine > sizeof(relocs) / sizeof(relocs[0]) )
-- return "unknown mach";
-- if ( !relocs[machine].names )
-- return "unknown mach";
-- if ( type > relocs[machine].count )
-- return "unknown rela";
-- return relocs[machine].names[type];
--}
--
--static int elf_reloc_section(struct elf_binary *elf,
-- const elf_shdr * rels,
-- const elf_shdr * sect, const elf_shdr * syms)
--{
-- const void *ptr, *end;
-- const elf_shdr *shdr;
-- const elf_rela *rela;
-- const elf_rel *rel;
-- const elf_sym *sym;
-- uint64_t s_type;
-- uint64_t r_offset;
-- uint64_t r_info;
-- uint64_t r_addend;
-- int r_type, r_sym;
-- size_t rsize;
-- uint64_t shndx, sbase, addr, value;
-- const char *sname;
-- int machine;
--
-- machine = elf_uval(elf, elf->ehdr, e_machine);
-- if ( (machine >= (sizeof(relocs) / sizeof(relocs[0]))) ||
-- (relocs[machine].func == NULL) )
-- {
-- elf_err(elf, "%s: can't handle machine %d\n",
-- __FUNCTION__, machine);
-- return -1;
-- }
-- if ( elf_swap(elf) )
-- {
-- elf_err(elf, "%s: non-native byte order, relocation not supported\n",
-- __FUNCTION__);
-- return -1;
-- }
--
-- s_type = elf_uval(elf, rels, sh_type);
-- rsize = (SHT_REL == s_type) ? elf_size(elf, rel) : elf_size(elf, rela);
-- ptr = elf_section_start(elf, rels);
-- end = elf_section_end(elf, rels);
--
-- for ( ; ptr < end; ptr += rsize )
-- {
-- switch ( s_type )
-- {
-- case SHT_REL:
-- rel = ptr;
-- r_offset = elf_uval(elf, rel, r_offset);
-- r_info = elf_uval(elf, rel, r_info);
-- r_addend = 0;
-- break;
-- case SHT_RELA:
-- rela = ptr;
-- r_offset = elf_uval(elf, rela, r_offset);
-- r_info = elf_uval(elf, rela, r_info);
-- r_addend = elf_uval(elf, rela, r_addend);
-- break;
-- default:
-- /* can't happen */
-- return -1;
-- }
-- if ( elf_64bit(elf) )
-- {
-- r_type = ELF64_R_TYPE(r_info);
-- r_sym = ELF64_R_SYM(r_info);
-- }
-- else
-- {
-- r_type = ELF32_R_TYPE(r_info);
-- r_sym = ELF32_R_SYM(r_info);
-- }
--
-- sym = elf_sym_by_index(elf, r_sym);
-- shndx = elf_uval(elf, sym, st_shndx);
-- switch ( shndx )
-- {
-- case SHN_UNDEF:
-- sname = "*UNDEF*";
-- sbase = 0;
-- break;
-- case SHN_COMMON:
-- elf_err(elf, "%s: invalid section: %" PRId64 "\n",
-- __FUNCTION__, shndx);
-- return -1;
-- case SHN_ABS:
-- sname = "*ABS*";
-- sbase = 0;
-- break;
-- default:
-- shdr = elf_shdr_by_index(elf, shndx);
-- if ( shdr == NULL )
-- {
-- elf_err(elf, "%s: invalid section: %" PRId64 "\n",
-- __FUNCTION__, shndx);
-- return -1;
-- }
-- sname = elf_section_name(elf, shdr);
-- sbase = elf_uval(elf, shdr, sh_addr);
-- }
--
-- addr = r_offset;
-- value = elf_uval(elf, sym, st_value);
-- value += r_addend;
--
-- if ( elf->log_callback && (elf->verbose > 1) )
-- {
-- uint64_t st_name = elf_uval(elf, sym, st_name);
-- const char *name = st_name ? elf->sym_strtab + st_name : "*NONE*";
--
-- elf_msg(elf,
-- "%s: type %s [%d], off 0x%" PRIx64 ", add 0x%" PRIx64 ","
-- " sym %s [0x%" PRIx64 "], sec %s [0x%" PRIx64 "]"
-- " -> addr 0x%" PRIx64 " value 0x%" PRIx64 "\n",
-- __FUNCTION__, rela_name(machine, r_type), r_type, r_offset,
-- r_addend, name, elf_uval(elf, sym, st_value), sname, sbase,
-- addr, value);
-- }
--
-- if ( relocs[machine].func(elf, r_type, addr, value) == -1 )
-- {
-- elf_err(elf, "%s: unknown/unsupported reloc type %s [%d]\n",
-- __FUNCTION__, rela_name(machine, r_type), r_type);
-- return -1;
-- }
-- }
-- return 0;
--}
--
--int elf_reloc(struct elf_binary *elf)
--{
-- const elf_shdr *rels, *sect, *syms;
-- uint64_t i, count, type;
--
-- count = elf_shdr_count(elf);
-- for ( i = 0; i < count; i++ )
-- {
-- rels = elf_shdr_by_index(elf, i);
-- type = elf_uval(elf, rels, sh_type);
-- if ( (type != SHT_REL) && (type != SHT_RELA) )
-- continue;
--
-- sect = elf_shdr_by_index(elf, elf_uval(elf, rels, sh_info));
-- syms = elf_shdr_by_index(elf, elf_uval(elf, rels, sh_link));
-- if ( NULL == sect || NULL == syms )
-- continue;
--
-- if ( !(elf_uval(elf, sect, sh_flags) & SHF_ALLOC) )
-- {
-- elf_msg(elf, "%s: relocations for %s, skipping\n",
-- __FUNCTION__, elf_section_name(elf, sect));
-- continue;
-- }
--
-- elf_msg(elf, "%s: relocations for %s @ 0x%" PRIx64 "\n",
-- __FUNCTION__, elf_section_name(elf, sect),
-- elf_uval(elf, sect, sh_addr));
-- if ( elf_reloc_section(elf, rels, sect, syms) != 0 )
-- return -1;
-- }
-- return 0;
--}
--
--/*
-- * Local variables:
-- * mode: C
-- * c-set-style: "BSD"
-- * c-basic-offset: 4
-- * tab-width: 4
-- * indent-tabs-mode: nil
-- * End:
-- */
-diff --git a/xen/common/libelf/libelf-tools.c b/xen/common/libelf/libelf-tools.c
-index cb97908..e202249 100644
---- a/xen/common/libelf/libelf-tools.c
-+++ b/xen/common/libelf/libelf-tools.c
-@@ -20,201 +20,292 @@
-
- /* ------------------------------------------------------------------------ */
-
--uint64_t elf_access_unsigned(struct elf_binary * elf, const void *ptr,
-- uint64_t offset, size_t size)
-+void elf_mark_broken(struct elf_binary *elf, const char *msg)
- {
-- int need_swap = elf_swap(elf);
-+ if ( elf->broken == NULL )
-+ elf->broken = msg;
-+}
-+
-+const char *elf_check_broken(const struct elf_binary *elf)
-+{
-+ return elf->broken;
-+}
-+
-+static bool elf_ptrval_in_range(elf_ptrval ptrval, uint64_t size,
-+ const void *region, uint64_t regionsize)
-+ /*
-+ * Returns true if the putative memory area [ptrval,ptrval+size>
-+ * is completely inside the region [region,region+regionsize>.
-+ *
-+ * ptrval and size are the untrusted inputs to be checked.
-+ * region and regionsize are trusted and must be correct and valid,
-+ * although it is OK for region to perhaps be maliciously NULL
-+ * (but not some other malicious value).
-+ */
-+{
-+ elf_ptrval regionp = (elf_ptrval)region;
-+
-+ if ( (region == NULL) ||
-+ (ptrval < regionp) || /* start is before region */
-+ (ptrval > regionp + regionsize) || /* start is after region */
-+ (size > regionsize - (ptrval - regionp)) ) /* too big */
-+ return 0;
-+ return 1;
-+}
-+
-+bool elf_access_ok(struct elf_binary * elf,
-+ uint64_t ptrval, size_t size)
-+{
-+ if ( elf_ptrval_in_range(ptrval, size, elf->image_base, elf->size) )
-+ return 1;
-+ if ( elf_ptrval_in_range(ptrval, size, elf->dest_base, elf->dest_size) )
-+ return 1;
-+ if ( elf_ptrval_in_range(ptrval, size,
-+ elf->caller_xdest_base, elf->caller_xdest_size) )
-+ return 1;
-+ elf_mark_broken(elf, "out of range access");
-+ return 0;
-+}
-+
-+void elf_memcpy_safe(struct elf_binary *elf, elf_ptrval dst,
-+ elf_ptrval src, size_t size)
-+{
-+ if ( elf_access_ok(elf, dst, size) &&
-+ elf_access_ok(elf, src, size) )
-+ {
-+ /* use memmove because these checks do not prove that the
-+ * regions don't overlap and overlapping regions grant
-+ * permission for compiler malice */
-+ elf_memmove_unchecked(ELF_UNSAFE_PTR(dst), ELF_UNSAFE_PTR(src), size);
-+ }
-+}
-+
-+void elf_memset_safe(struct elf_binary *elf, elf_ptrval dst, int c, size_t size)
-+{
-+ if ( elf_access_ok(elf, dst, size) )
-+ {
-+ elf_memset_unchecked(ELF_UNSAFE_PTR(dst), c, size);
-+ }
-+}
-+
-+uint64_t elf_access_unsigned(struct elf_binary * elf, elf_ptrval base,
-+ uint64_t moreoffset, size_t size)
-+{
-+ elf_ptrval ptrval = base + moreoffset;
-+ bool need_swap = elf_swap(elf);
- const uint8_t *u8;
- const uint16_t *u16;
- const uint32_t *u32;
- const uint64_t *u64;
-
-+ if ( !elf_access_ok(elf, ptrval, size) )
-+ return 0;
-+
- switch ( size )
- {
- case 1:
-- u8 = ptr + offset;
-+ u8 = (const void*)ptrval;
- return *u8;
- case 2:
-- u16 = ptr + offset;
-+ u16 = (const void*)ptrval;
- return need_swap ? bswap_16(*u16) : *u16;
- case 4:
-- u32 = ptr + offset;
-+ u32 = (const void*)ptrval;
- return need_swap ? bswap_32(*u32) : *u32;
- case 8:
-- u64 = ptr + offset;
-+ u64 = (const void*)ptrval;
- return need_swap ? bswap_64(*u64) : *u64;
- default:
- return 0;
- }
- }
-
--int64_t elf_access_signed(struct elf_binary *elf, const void *ptr,
-- uint64_t offset, size_t size)
--{
-- int need_swap = elf_swap(elf);
-- const int8_t *s8;
-- const int16_t *s16;
-- const int32_t *s32;
-- const int64_t *s64;
--
-- switch ( size )
-- {
-- case 1:
-- s8 = ptr + offset;
-- return *s8;
-- case 2:
-- s16 = ptr + offset;
-- return need_swap ? bswap_16(*s16) : *s16;
-- case 4:
-- s32 = ptr + offset;
-- return need_swap ? bswap_32(*s32) : *s32;
-- case 8:
-- s64 = ptr + offset;
-- return need_swap ? bswap_64(*s64) : *s64;
-- default:
-- return 0;
-- }
--}
--
- uint64_t elf_round_up(struct elf_binary *elf, uint64_t addr)
- {
-- int elf_round = (elf_64bit(elf) ? 8 : 4) - 1;
-+ uint64_t elf_round = (elf_64bit(elf) ? 8 : 4) - 1;
-
- return (addr + elf_round) & ~elf_round;
- }
-
- /* ------------------------------------------------------------------------ */
-
--int elf_shdr_count(struct elf_binary *elf)
-+unsigned elf_shdr_count(struct elf_binary *elf)
- {
-- return elf_uval(elf, elf->ehdr, e_shnum);
-+ unsigned count = elf_uval(elf, elf->ehdr, e_shnum);
-+ uint64_t max = elf->size / sizeof(Elf32_Shdr);
-+ if (max > ~(unsigned)0)
-+ max = ~(unsigned)0; /* Xen doesn't have limits.h :-/ */
-+ if (count > max)
-+ {
-+ elf_mark_broken(elf, "far too many section headers");
-+ count = max;
-+ }
-+ return count;
- }
-
--int elf_phdr_count(struct elf_binary *elf)
-+unsigned elf_phdr_count(struct elf_binary *elf)
- {
- return elf_uval(elf, elf->ehdr, e_phnum);
- }
-
--const elf_shdr *elf_shdr_by_name(struct elf_binary *elf, const char *name)
-+ELF_HANDLE_DECL(elf_shdr) elf_shdr_by_name(struct elf_binary *elf, const char *name)
- {
- uint64_t count = elf_shdr_count(elf);
-- const elf_shdr *shdr;
-+ ELF_HANDLE_DECL(elf_shdr) shdr;
- const char *sname;
-- int i;
-+ unsigned i;
-
- for ( i = 0; i < count; i++ )
- {
- shdr = elf_shdr_by_index(elf, i);
-+ if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
-+ /* input has an insane section header count field */
-+ break;
- sname = elf_section_name(elf, shdr);
- if ( sname && !strcmp(sname, name) )
- return shdr;
- }
-- return NULL;
-+ return ELF_INVALID_HANDLE(elf_shdr);
- }
-
--const elf_shdr *elf_shdr_by_index(struct elf_binary *elf, int index)
-+ELF_HANDLE_DECL(elf_shdr) elf_shdr_by_index(struct elf_binary *elf, unsigned index)
- {
- uint64_t count = elf_shdr_count(elf);
-- const void *ptr;
-+ elf_ptrval ptr;
-
- if ( index >= count )
-- return NULL;
-+ return ELF_INVALID_HANDLE(elf_shdr);
-
-- ptr = (elf->image
-+ ptr = (ELF_IMAGE_BASE(elf)
- + elf_uval(elf, elf->ehdr, e_shoff)
- + elf_uval(elf, elf->ehdr, e_shentsize) * index);
-- return ptr;
-+ return ELF_MAKE_HANDLE(elf_shdr, ptr);
- }
-
--const elf_phdr *elf_phdr_by_index(struct elf_binary *elf, int index)
-+ELF_HANDLE_DECL(elf_phdr) elf_phdr_by_index(struct elf_binary *elf, unsigned index)
- {
- uint64_t count = elf_uval(elf, elf->ehdr, e_phnum);
-- const void *ptr;
-+ elf_ptrval ptr;
-
- if ( index >= count )
-- return NULL;
-+ return ELF_INVALID_HANDLE(elf_phdr);
-
-- ptr = (elf->image
-+ ptr = (ELF_IMAGE_BASE(elf)
- + elf_uval(elf, elf->ehdr, e_phoff)
- + elf_uval(elf, elf->ehdr, e_phentsize) * index);
-- return ptr;
-+ return ELF_MAKE_HANDLE(elf_phdr, ptr);
- }
-
--const char *elf_section_name(struct elf_binary *elf, const elf_shdr * shdr)
-+
-+const char *elf_section_name(struct elf_binary *elf,
-+ ELF_HANDLE_DECL(elf_shdr) shdr)
- {
-- if ( elf->sec_strtab == NULL )
-+ if ( ELF_PTRVAL_INVALID(elf->sec_strtab) )
- return "unknown";
-- return elf->sec_strtab + elf_uval(elf, shdr, sh_name);
-+
-+ return elf_strval(elf, elf->sec_strtab + elf_uval(elf, shdr, sh_name));
- }
-
--const void *elf_section_start(struct elf_binary *elf, const elf_shdr * shdr)
-+const char *elf_strval(struct elf_binary *elf, elf_ptrval start)
- {
-- return elf->image + elf_uval(elf, shdr, sh_offset);
-+ uint64_t length;
-+
-+ for ( length = 0; ; length++ ) {
-+ if ( !elf_access_ok(elf, start + length, 1) )
-+ return NULL;
-+ if ( !elf_access_unsigned(elf, start, length, 1) )
-+ /* ok */
-+ return ELF_UNSAFE_PTR(start);
-+ if ( length >= ELF_MAX_STRING_LENGTH )
-+ {
-+ elf_mark_broken(elf, "excessively long string");
-+ return NULL;
-+ }
-+ }
- }
-
--const void *elf_section_end(struct elf_binary *elf, const elf_shdr * shdr)
-+const char *elf_strfmt(struct elf_binary *elf, elf_ptrval start)
- {
-- return elf->image
-+ const char *str = elf_strval(elf, start);
-+
-+ if ( str == NULL )
-+ return "(invalid)";
-+ return str;
-+}
-+
-+elf_ptrval elf_section_start(struct elf_binary *elf, ELF_HANDLE_DECL(elf_shdr) shdr)
-+{
-+ return ELF_IMAGE_BASE(elf) + elf_uval(elf, shdr, sh_offset);
-+}
-+
-+elf_ptrval elf_section_end(struct elf_binary *elf, ELF_HANDLE_DECL(elf_shdr) shdr)
-+{
-+ return ELF_IMAGE_BASE(elf)
- + elf_uval(elf, shdr, sh_offset) + elf_uval(elf, shdr, sh_size);
- }
-
--const void *elf_segment_start(struct elf_binary *elf, const elf_phdr * phdr)
-+elf_ptrval elf_segment_start(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr)
- {
-- return elf->image + elf_uval(elf, phdr, p_offset);
-+ return ELF_IMAGE_BASE(elf)
-+ + elf_uval(elf, phdr, p_offset);
- }
-
--const void *elf_segment_end(struct elf_binary *elf, const elf_phdr * phdr)
-+elf_ptrval elf_segment_end(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr)
- {
-- return elf->image
-+ return ELF_IMAGE_BASE(elf)
- + elf_uval(elf, phdr, p_offset) + elf_uval(elf, phdr, p_filesz);
- }
-
--const elf_sym *elf_sym_by_name(struct elf_binary *elf, const char *symbol)
-+ELF_HANDLE_DECL(elf_sym) elf_sym_by_name(struct elf_binary *elf, const char *symbol)
- {
-- const void *ptr = elf_section_start(elf, elf->sym_tab);
-- const void *end = elf_section_end(elf, elf->sym_tab);
-- const elf_sym *sym;
-+ elf_ptrval ptr = elf_section_start(elf, elf->sym_tab);
-+ elf_ptrval end = elf_section_end(elf, elf->sym_tab);
-+ ELF_HANDLE_DECL(elf_sym) sym;
- uint64_t info, name;
-+ const char *sym_name;
-
- for ( ; ptr < end; ptr += elf_size(elf, sym) )
- {
-- sym = ptr;
-+ sym = ELF_MAKE_HANDLE(elf_sym, ptr);
- info = elf_uval(elf, sym, st_info);
- name = elf_uval(elf, sym, st_name);
- if ( ELF32_ST_BIND(info) != STB_GLOBAL )
- continue;
-- if ( strcmp(elf->sym_strtab + name, symbol) )
-+ sym_name = elf_strval(elf, elf->sym_strtab + name);
-+ if ( sym_name == NULL ) /* out of range, oops */
-+ return ELF_INVALID_HANDLE(elf_sym);
-+ if ( strcmp(sym_name, symbol) )
- continue;
- return sym;
- }
-- return NULL;
-+ return ELF_INVALID_HANDLE(elf_sym);
- }
-
--const elf_sym *elf_sym_by_index(struct elf_binary *elf, int index)
-+ELF_HANDLE_DECL(elf_sym) elf_sym_by_index(struct elf_binary *elf, unsigned index)
- {
-- const void *ptr = elf_section_start(elf, elf->sym_tab);
-- const elf_sym *sym;
-+ elf_ptrval ptr = elf_section_start(elf, elf->sym_tab);
-+ ELF_HANDLE_DECL(elf_sym) sym;
-
-- sym = ptr + index * elf_size(elf, sym);
-+ sym = ELF_MAKE_HANDLE(elf_sym, ptr + index * elf_size(elf, sym));
- return sym;
- }
-
--const char *elf_note_name(struct elf_binary *elf, const elf_note * note)
-+const char *elf_note_name(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note)
- {
-- return (void *)note + elf_size(elf, note);
-+ return elf_strval(elf, ELF_HANDLE_PTRVAL(note) + elf_size(elf, note));
- }
-
--const void *elf_note_desc(struct elf_binary *elf, const elf_note * note)
-+elf_ptrval elf_note_desc(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note)
- {
-- int namesz = (elf_uval(elf, note, namesz) + 3) & ~3;
-+ unsigned namesz = (elf_uval(elf, note, namesz) + 3) & ~3;
-
-- return (void *)note + elf_size(elf, note) + namesz;
-+ return ELF_HANDLE_PTRVAL(note) + elf_size(elf, note) + namesz;
- }
-
--uint64_t elf_note_numeric(struct elf_binary *elf, const elf_note * note)
-+uint64_t elf_note_numeric(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note)
- {
-- const void *desc = elf_note_desc(elf, note);
-- int descsz = elf_uval(elf, note, descsz);
-+ elf_ptrval desc = elf_note_desc(elf, note);
-+ unsigned descsz = elf_uval(elf, note, descsz);
-
- switch (descsz)
- {
-@@ -228,11 +319,11 @@ uint64_t elf_note_numeric(struct elf_binary *elf, const elf_note * note)
- }
- }
-
--uint64_t elf_note_numeric_array(struct elf_binary *elf, const elf_note *note,
-+uint64_t elf_note_numeric_array(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note,
- unsigned int unitsz, unsigned int idx)
- {
-- const void *desc = elf_note_desc(elf, note);
-- int descsz = elf_uval(elf, note, descsz);
-+ elf_ptrval desc = elf_note_desc(elf, note);
-+ unsigned descsz = elf_uval(elf, note, descsz);
-
- if ( descsz % unitsz || idx >= descsz / unitsz )
- return 0;
-@@ -248,24 +339,34 @@ uint64_t elf_note_numeric_array(struct elf_binary *elf, const elf_note *note,
- }
- }
-
--const elf_note *elf_note_next(struct elf_binary *elf, const elf_note * note)
-+ELF_HANDLE_DECL(elf_note) elf_note_next(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note)
- {
-- int namesz = (elf_uval(elf, note, namesz) + 3) & ~3;
-- int descsz = (elf_uval(elf, note, descsz) + 3) & ~3;
-+ unsigned namesz = (elf_uval(elf, note, namesz) + 3) & ~3;
-+ unsigned descsz = (elf_uval(elf, note, descsz) + 3) & ~3;
-+
-+ elf_ptrval ptrval = ELF_HANDLE_PTRVAL(note)
-+ + elf_size(elf, note) + namesz + descsz;
-
-- return (void *)note + elf_size(elf, note) + namesz + descsz;
-+ if ( ( ptrval <= ELF_HANDLE_PTRVAL(note) || /* wrapped or stuck */
-+ !elf_access_ok(elf, ELF_HANDLE_PTRVAL(note), 1) ) )
-+ ptrval = ELF_MAX_PTRVAL; /* terminate caller's loop */
-+
-+ return ELF_MAKE_HANDLE(elf_note, ptrval);
- }
-
- /* ------------------------------------------------------------------------ */
-
--int elf_is_elfbinary(const void *image)
-+bool elf_is_elfbinary(const void *image_start, size_t image_size)
- {
-- const Elf32_Ehdr *ehdr = image;
-+ const Elf32_Ehdr *ehdr = image_start;
-+
-+ if ( image_size < sizeof(*ehdr) )
-+ return 0;
-
- return IS_ELF(*ehdr);
- }
-
--int elf_phdr_is_loadable(struct elf_binary *elf, const elf_phdr * phdr)
-+bool elf_phdr_is_loadable(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr)
- {
- uint64_t p_type = elf_uval(elf, phdr, p_type);
- uint64_t p_flags = elf_uval(elf, phdr, p_flags);
-diff --git a/xen/include/xen/libelf.h b/xen/include/xen/libelf.h
-index e8f6508..174f8da 100644
---- a/xen/include/xen/libelf.h
-+++ b/xen/include/xen/libelf.h
-@@ -29,6 +29,11 @@
- #error define architectural endianness
- #endif
-
-+#include <stdbool.h>
-+
-+typedef int elf_errorstatus; /* 0: ok; -ve (normally -1): error */
-+typedef int elf_negerrnoval; /* 0: ok; -EFOO: error */
-+
- #undef ELFSIZE
- #include "elfstructs.h"
- #ifdef __XEN__
-@@ -42,12 +47,98 @@
-
- struct elf_binary;
- typedef void elf_log_callback(struct elf_binary*, void *caller_data,
-- int iserr, const char *fmt, va_list al);
-+ bool iserr, const char *fmt, va_list al);
-+
-+#endif
-+
-+#define ELF_MAX_STRING_LENGTH 4096
-+#define ELF_MAX_TOTAL_NOTE_COUNT 65536
-+
-+/* ------------------------------------------------------------------------ */
-+
-+/* Macros for accessing the input image and output area. */
-+
-+/*
-+ * We abstract away the pointerness of these pointers, replacing
-+ * various void*, char* and struct* with the following:
-+ * elf_ptrval A pointer to a byte; one can do pointer arithmetic
-+ * on this.
-+ * HANDLE A pointer to a struct. There is one of these types
-+ * for each pointer type - that is, for each "structname".
-+ * In the arguments to the various HANDLE macros, structname
-+ * must be a single identifier which is a typedef.
-+ * It is not permitted to do arithmetic on these
-+ * pointers. In the current code attempts to do so will
-+ * compile, but in the next patch this will become a
-+ * compile error.
-+ */
-+
-+typedef uintptr_t elf_ptrval;
-+
-+#define ELF_REALPTR2PTRVAL(realpointer) ((elf_ptrval)(realpointer))
-+ /* Converts an actual C pointer into a PTRVAL */
-+
-+#define ELF_HANDLE_DECL(structname) structname##_handle
-+ /* Provides a type declaration for a HANDLE. */
-
-+#ifdef __XEN__
-+# define ELF_PRPTRVAL "lu"
-+ /*
-+ * PRIuPTR is misdefined in xen/include/xen/inttypes.h, on 32-bit,
-+ * to "u", when in fact uintptr_t is an unsigned long.
-+ */
-+#else
-+# define ELF_PRPTRVAL PRIuPTR
- #endif
-+ /* printf format a la PRId... for a PTRVAL */
-+
-+#define ELF_DEFINE_HANDLE(structname) \
-+ typedef union { \
-+ elf_ptrval ptrval; \
-+ const structname *typeonly; /* for sizeof, offsetof, &c only */ \
-+ } structname##_handle;
-+ /*
-+ * This must be invoked for each HANDLE type to define
-+ * the actual C type used for that kind of HANDLE.
-+ */
-+
-+#define ELF_MAKE_HANDLE(structname, ptrval) ((structname##_handle){ ptrval })
-+ /* Converts a PTRVAL to a HANDLE */
-+
-+#define ELF_IMAGE_BASE(elf) ((elf_ptrval)(elf)->image_base)
-+ /* Returns the base of the image as a PTRVAL. */
-+
-+#define ELF_HANDLE_PTRVAL(handleval) ((handleval).ptrval)
-+ /* Converts a HANDLE to a PTRVAL. */
-+
-+#define ELF_UNSAFE_PTR(ptrval) ((void*)(elf_ptrval)(ptrval))
-+ /*
-+ * Turns a PTRVAL into an actual C pointer. Before this is done
-+ * the caller must have ensured that the PTRVAL does in fact point
-+ * to a permissible location.
-+ */
-+
-+/* PTRVALs can be INVALID (ie, NULL). */
-+#define ELF_INVALID_PTRVAL ((elf_ptrval)0) /* returns NULL PTRVAL */
-+#define ELF_INVALID_HANDLE(structname) /* returns NULL handle */ \
-+ ELF_MAKE_HANDLE(structname, ELF_INVALID_PTRVAL)
-+#define ELF_PTRVAL_VALID(ptrval) (!!(ptrval)) /* } */
-+#define ELF_HANDLE_VALID(handleval) (!!(handleval).ptrval) /* } predicates */
-+#define ELF_PTRVAL_INVALID(ptrval) (!ELF_PTRVAL_VALID((ptrval))) /* } */
-+
-+#define ELF_MAX_PTRVAL (~(elf_ptrval)0)
-+ /* PTRVAL value guaranteed to compare > to any valid PTRVAL */
-+
-+/* For internal use by other macros here */
-+#define ELF__HANDLE_FIELD_TYPE(handleval, elm) \
-+ typeof((handleval).typeonly->elm)
-+#define ELF__HANDLE_FIELD_OFFSET(handleval, elm) \
-+ offsetof(typeof(*(handleval).typeonly),elm)
-+
-
- /* ------------------------------------------------------------------------ */
-
-+
- typedef union {
- Elf32_Ehdr e32;
- Elf64_Ehdr e64;
-@@ -83,20 +174,32 @@ typedef union {
- Elf64_Note e64;
- } elf_note;
-
-+ELF_DEFINE_HANDLE(elf_ehdr)
-+ELF_DEFINE_HANDLE(elf_shdr)
-+ELF_DEFINE_HANDLE(elf_phdr)
-+ELF_DEFINE_HANDLE(elf_sym)
-+ELF_DEFINE_HANDLE(elf_note)
-+
- struct elf_binary {
- /* elf binary */
-- const char *image;
-+ const void *image_base;
- size_t size;
- char class;
- char data;
-
-- const elf_ehdr *ehdr;
-- const char *sec_strtab;
-- const elf_shdr *sym_tab;
-- const char *sym_strtab;
-+ ELF_HANDLE_DECL(elf_ehdr) ehdr;
-+ elf_ptrval sec_strtab;
-+ ELF_HANDLE_DECL(elf_shdr) sym_tab;
-+ uint64_t sym_strtab;
-
- /* loaded to */
-- char *dest;
-+ /*
-+ * dest_base and dest_size are trusted and must be correct;
-+ * whenever dest_size is not 0, both of these must be valid
-+ * so long as the struct elf_binary is in use.
-+ */
-+ char *dest_base;
-+ size_t dest_size;
- uint64_t pstart;
- uint64_t pend;
- uint64_t reloc_offset;
-@@ -104,12 +207,22 @@ struct elf_binary {
- uint64_t bsd_symtab_pstart;
- uint64_t bsd_symtab_pend;
-
-+ /*
-+ * caller's other acceptable destination
-+ *
-+ * Again, these are trusted and must be valid (or 0) so long
-+ * as the struct elf_binary is in use.
-+ */
-+ void *caller_xdest_base;
-+ uint64_t caller_xdest_size;
-+
- #ifndef __XEN__
- /* misc */
- elf_log_callback *log_callback;
- void *log_caller_data;
- #endif
-- int verbose;
-+ bool verbose;
-+ const char *broken;
- };
-
- /* ------------------------------------------------------------------------ */
-@@ -127,88 +240,145 @@ struct elf_binary {
- #define elf_lsb(elf) (ELFDATA2LSB == (elf)->data)
- #define elf_swap(elf) (NATIVE_ELFDATA != (elf)->data)
-
--#define elf_uval(elf, str, elem) \
-- ((ELFCLASS64 == (elf)->class) \
-- ? elf_access_unsigned((elf), (str), \
-- offsetof(typeof(*(str)),e64.elem), \
-- sizeof((str)->e64.elem)) \
-- : elf_access_unsigned((elf), (str), \
-- offsetof(typeof(*(str)),e32.elem), \
-- sizeof((str)->e32.elem)))
--
--#define elf_sval(elf, str, elem) \
-- ((ELFCLASS64 == (elf)->class) \
-- ? elf_access_signed((elf), (str), \
-- offsetof(typeof(*(str)),e64.elem), \
-- sizeof((str)->e64.elem)) \
-- : elf_access_signed((elf), (str), \
-- offsetof(typeof(*(str)),e32.elem), \
-- sizeof((str)->e32.elem)))
--
--#define elf_size(elf, str) \
-- ((ELFCLASS64 == (elf)->class) \
-- ? sizeof((str)->e64) : sizeof((str)->e32))
-+#define elf_uval_3264(elf, handle, elem) \
-+ elf_access_unsigned((elf), (handle).ptrval, \
-+ offsetof(typeof(*(handle).typeonly),elem), \
-+ sizeof((handle).typeonly->elem))
-+
-+#define elf_uval(elf, handle, elem) \
-+ ((ELFCLASS64 == (elf)->class) \
-+ ? elf_uval_3264(elf, handle, e64.elem) \
-+ : elf_uval_3264(elf, handle, e32.elem))
-+ /*
-+ * Reads an unsigned field in a header structure in the ELF.
-+ * str is a HANDLE, and elem is the field name in it.
-+ */
-
--uint64_t elf_access_unsigned(struct elf_binary *elf, const void *ptr,
-+
-+#define elf_size(elf, handle_or_handletype) ({ \
-+ typeof(handle_or_handletype) elf_size__dummy; \
-+ ((ELFCLASS64 == (elf)->class) \
-+ ? sizeof(elf_size__dummy.typeonly->e64) \
-+ : sizeof(elf_size__dummy.typeonly->e32)); \
-+})
-+ /*
-+ * Returns the size of the substructure for the appropriate 32/64-bitness.
-+ * str should be a HANDLE.
-+ */
-+
-+uint64_t elf_access_unsigned(struct elf_binary *elf, elf_ptrval ptr,
- uint64_t offset, size_t size);
--int64_t elf_access_signed(struct elf_binary *elf, const void *ptr,
-- uint64_t offset, size_t size);
-+ /* Reads a field at arbitrary offset and alignemnt */
-
- uint64_t elf_round_up(struct elf_binary *elf, uint64_t addr);
-
-+const char *elf_strval(struct elf_binary *elf, elf_ptrval start);
-+ /* may return NULL if the string is out of range etc. */
-+
-+const char *elf_strfmt(struct elf_binary *elf, elf_ptrval start);
-+ /* like elf_strval but returns "(invalid)" instead of NULL */
-+
-+void elf_memcpy_safe(struct elf_binary*, elf_ptrval dst, elf_ptrval src, size_t);
-+void elf_memset_safe(struct elf_binary*, elf_ptrval dst, int c, size_t);
-+ /*
-+ * Versions of memcpy and memset which arrange never to write
-+ * outside permitted areas.
-+ */
-+
-+bool elf_access_ok(struct elf_binary * elf,
-+ uint64_t ptrval, size_t size);
-+
-+#define elf_store_val(elf, type, ptr, val) \
-+ ({ \
-+ typeof(type) elf_store__val = (val); \
-+ elf_ptrval elf_store__targ = ptr; \
-+ if (elf_access_ok((elf), elf_store__targ, \
-+ sizeof(elf_store__val))) { \
-+ elf_memcpy_unchecked((void*)elf_store__targ, &elf_store__val, \
-+ sizeof(elf_store__val)); \
-+ } \
-+ }) \
-+ /* Stores a value at a particular PTRVAL. */
-+
-+#define elf_store_field(elf, hdr, elm, val) \
-+ (elf_store_val((elf), ELF__HANDLE_FIELD_TYPE(hdr, elm), \
-+ ELF_HANDLE_PTRVAL(hdr) + ELF__HANDLE_FIELD_OFFSET(hdr, elm), \
-+ (val)))
-+ /* Stores a 32/64-bit field. hdr is a HANDLE and elm is the field name. */
-+
-+
- /* ------------------------------------------------------------------------ */
- /* xc_libelf_tools.c */
-
--int elf_shdr_count(struct elf_binary *elf);
--int elf_phdr_count(struct elf_binary *elf);
-+unsigned elf_shdr_count(struct elf_binary *elf);
-+unsigned elf_phdr_count(struct elf_binary *elf);
-
--const elf_shdr *elf_shdr_by_name(struct elf_binary *elf, const char *name);
--const elf_shdr *elf_shdr_by_index(struct elf_binary *elf, int index);
--const elf_phdr *elf_phdr_by_index(struct elf_binary *elf, int index);
-+ELF_HANDLE_DECL(elf_shdr) elf_shdr_by_name(struct elf_binary *elf, const char *name);
-+ELF_HANDLE_DECL(elf_shdr) elf_shdr_by_index(struct elf_binary *elf, unsigned index);
-+ELF_HANDLE_DECL(elf_phdr) elf_phdr_by_index(struct elf_binary *elf, unsigned index);
-
--const char *elf_section_name(struct elf_binary *elf, const elf_shdr * shdr);
--const void *elf_section_start(struct elf_binary *elf, const elf_shdr * shdr);
--const void *elf_section_end(struct elf_binary *elf, const elf_shdr * shdr);
-+const char *elf_section_name(struct elf_binary *elf, ELF_HANDLE_DECL(elf_shdr) shdr); /* might return NULL if inputs are invalid */
-+elf_ptrval elf_section_start(struct elf_binary *elf, ELF_HANDLE_DECL(elf_shdr) shdr);
-+elf_ptrval elf_section_end(struct elf_binary *elf, ELF_HANDLE_DECL(elf_shdr) shdr);
-
--const void *elf_segment_start(struct elf_binary *elf, const elf_phdr * phdr);
--const void *elf_segment_end(struct elf_binary *elf, const elf_phdr * phdr);
-+elf_ptrval elf_segment_start(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr);
-+elf_ptrval elf_segment_end(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr);
-
--const elf_sym *elf_sym_by_name(struct elf_binary *elf, const char *symbol);
--const elf_sym *elf_sym_by_index(struct elf_binary *elf, int index);
-+ELF_HANDLE_DECL(elf_sym) elf_sym_by_name(struct elf_binary *elf, const char *symbol);
-+ELF_HANDLE_DECL(elf_sym) elf_sym_by_index(struct elf_binary *elf, unsigned index);
-
--const char *elf_note_name(struct elf_binary *elf, const elf_note * note);
--const void *elf_note_desc(struct elf_binary *elf, const elf_note * note);
--uint64_t elf_note_numeric(struct elf_binary *elf, const elf_note * note);
--uint64_t elf_note_numeric_array(struct elf_binary *, const elf_note *,
-+const char *elf_note_name(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note); /* may return NULL */
-+elf_ptrval elf_note_desc(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note);
-+uint64_t elf_note_numeric(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note);
-+uint64_t elf_note_numeric_array(struct elf_binary *, ELF_HANDLE_DECL(elf_note),
- unsigned int unitsz, unsigned int idx);
--const elf_note *elf_note_next(struct elf_binary *elf, const elf_note * note);
-
--int elf_is_elfbinary(const void *image);
--int elf_phdr_is_loadable(struct elf_binary *elf, const elf_phdr * phdr);
-+/*
-+ * If you use elf_note_next in a loop, you must put a nontrivial upper
-+ * bound on the returned value as part of your loop condition. In
-+ * some cases elf_note_next will substitute ELF_PTRVAL_MAX as return
-+ * value to indicate that the iteration isn't going well (for example,
-+ * the putative "next" value would be earlier in memory). In this
-+ * case the caller's loop must terminate. Checking against the
-+ * end of the notes segment with a strict inequality is sufficient.
-+ */
-+ELF_HANDLE_DECL(elf_note) elf_note_next(struct elf_binary *elf, ELF_HANDLE_DECL(elf_note) note);
-+
-+/* (Only) checks that the image has the right magic number. */
-+bool elf_is_elfbinary(const void *image_start, size_t image_size);
-+
-+bool elf_phdr_is_loadable(struct elf_binary *elf, ELF_HANDLE_DECL(elf_phdr) phdr);
-
- /* ------------------------------------------------------------------------ */
- /* xc_libelf_loader.c */
-
--int elf_init(struct elf_binary *elf, const char *image, size_t size);
-+elf_errorstatus elf_init(struct elf_binary *elf, const char *image, size_t size);
-+ /*
-+ * image and size must be correct. They will be recorded in
-+ * *elf, and must remain valid while the elf is in use.
-+ */
- #ifdef __XEN__
- void elf_set_verbose(struct elf_binary *elf);
- #else
- void elf_set_log(struct elf_binary *elf, elf_log_callback*,
-- void *log_caller_pointer, int verbose);
-+ void *log_caller_pointer, bool verbose);
- #endif
-
- void elf_parse_binary(struct elf_binary *elf);
--int elf_load_binary(struct elf_binary *elf);
-+elf_errorstatus elf_load_binary(struct elf_binary *elf);
-
--void *elf_get_ptr(struct elf_binary *elf, unsigned long addr);
-+elf_ptrval elf_get_ptr(struct elf_binary *elf, unsigned long addr);
- uint64_t elf_lookup_addr(struct elf_binary *elf, const char *symbol);
-
- void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart); /* private */
-
-+void elf_mark_broken(struct elf_binary *elf, const char *msg);
-+const char *elf_check_broken(const struct elf_binary *elf); /* NULL means OK */
-+
- /* ------------------------------------------------------------------------ */
- /* xc_libelf_relocate.c */
-
--int elf_reloc(struct elf_binary *elf);
-+elf_errorstatus elf_reloc(struct elf_binary *elf);
-
- /* ------------------------------------------------------------------------ */
- /* xc_libelf_dominfo.c */
-@@ -232,9 +402,9 @@ struct xen_elfnote {
-
- struct elf_dom_parms {
- /* raw */
-- const char *guest_info;
-- const void *elf_note_start;
-- const void *elf_note_end;
-+ elf_ptrval guest_info;
-+ elf_ptrval elf_note_start;
-+ elf_ptrval elf_note_end;
- struct xen_elfnote elf_notes[XEN_ELFNOTE_MAX + 1];
-
- /* parsed */
-@@ -242,8 +412,8 @@ struct elf_dom_parms {
- char guest_ver[16];
- char xen_ver[16];
- char loader[16];
-- int pae;
-- int bsd_symtab;
-+ int pae; /* some kind of enum apparently */
-+ bool bsd_symtab;
- uint64_t virt_base;
- uint64_t virt_entry;
- uint64_t virt_hypercall;
-@@ -273,10 +443,44 @@ int elf_xen_parse_features(const char *features,
- uint32_t *required);
- int elf_xen_parse_note(struct elf_binary *elf,
- struct elf_dom_parms *parms,
-- const elf_note *note);
-+ ELF_HANDLE_DECL(elf_note) note);
- int elf_xen_parse_guest_info(struct elf_binary *elf,
- struct elf_dom_parms *parms);
- int elf_xen_parse(struct elf_binary *elf,
- struct elf_dom_parms *parms);
-
-+static inline void *elf_memcpy_unchecked(void *dest, const void *src, size_t n)
-+ { return memcpy(dest, src, n); }
-+static inline void *elf_memmove_unchecked(void *dest, const void *src, size_t n)
-+ { return memmove(dest, src, n); }
-+static inline void *elf_memset_unchecked(void *s, int c, size_t n)
-+ { return memset(s, c, n); }
-+ /*
-+ * Unsafe versions of memcpy, memmove memset which take actual C
-+ * pointers. These are just like the real functions.
-+ * We provide these so that in libelf-private.h we can #define
-+ * memcpy, memset and memmove to undefined MISTAKE things.
-+ */
-+
-+
-+/* Advances past amount bytes of the current destination area. */
-+static inline void ELF_ADVANCE_DEST(struct elf_binary *elf, uint64_t amount)
-+{
-+ if ( elf->dest_base == NULL )
-+ {
-+ elf_mark_broken(elf, "advancing in null image");
-+ }
-+ else if ( elf->dest_size >= amount )
-+ {
-+ elf->dest_base += amount;
-+ elf->dest_size -= amount;
-+ }
-+ else
-+ {
-+ elf->dest_size = 0;
-+ elf_mark_broken(elf, "advancing past end (image very short?)");
-+ }
-+}
-+
-+
- #endif /* __XEN_LIBELF_H__ */
diff --git a/main/xen/xsa56.patch b/main/xen/xsa56.patch
deleted file mode 100644
index 1368ac351..000000000
--- a/main/xen/xsa56.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-libxc: limit cpu values when setting vcpu affinity
-
-When support for pinning more than 64 cpus was added, check for cpu
-out-of-range values was removed. This can lead to subsequent
-out-of-bounds cpumap array accesses in case the cpu number is higher
-than the actual count.
-
-This patch returns the check.
-
-This is CVE-2013-2072 / XSA-56
-
-Signed-off-by: Petr Matousek <pmatouse@redhat.com>
-
-diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
-index e220f68..e611b24 100644
---- a/tools/python/xen/lowlevel/xc/xc.c
-+++ b/tools/python/xen/lowlevel/xc/xc.c
-@@ -228,6 +228,7 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
- int vcpu = 0, i;
- xc_cpumap_t cpumap;
- PyObject *cpulist = NULL;
-+ int nr_cpus;
-
- static char *kwd_list[] = { "domid", "vcpu", "cpumap", NULL };
-
-@@ -235,6 +236,10 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
- &dom, &vcpu, &cpulist) )
- return NULL;
-
-+ nr_cpus = xc_get_max_cpus(self->xc_handle);
-+ if ( nr_cpus == 0 )
-+ return pyxc_error_to_exception(self->xc_handle);
-+
- cpumap = xc_cpumap_alloc(self->xc_handle);
- if(cpumap == NULL)
- return pyxc_error_to_exception(self->xc_handle);
-@@ -244,6 +249,13 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
- for ( i = 0; i < PyList_Size(cpulist); i++ )
- {
- long cpu = PyInt_AsLong(PyList_GetItem(cpulist, i));
-+ if ( cpu < 0 || cpu >= nr_cpus )
-+ {
-+ free(cpumap);
-+ errno = EINVAL;
-+ PyErr_SetFromErrno(xc_error_obj);
-+ return NULL;
-+ }
- cpumap[cpu / 8] |= 1 << (cpu % 8);
- }
- }
diff --git a/main/xen/xsa57.patch b/main/xen/xsa57.patch
deleted file mode 100644
index 178b81889..000000000
--- a/main/xen/xsa57.patch
+++ /dev/null
@@ -1,333 +0,0 @@
-libxl: Restrict permissions on PV console device xenstore nodes
-
-Matthew Daley has observed that the PV console protocol places sensitive host
-state into a guest writeable xenstore locations, this includes:
-
- - The pty used to communicate between the console backend daemon and its
- client, allowing the guest administrator to read and write arbitrary host
- files.
- - The output file, allowing the guest administrator to write arbitrary host
- files or to target arbitrary qemu chardevs which include sockets, udp, ptr,
- pipes etc (see -chardev in qemu(1) for a more complete list).
- - The maximum buffer size, allowing the guest administrator to consume more
- resources than the host administrator has configured.
- - The backend to use (qemu vs xenconsoled), potentially allowing the guest
- administrator to confuse host software.
-
-So we arrange to make the sensitive keys in the xenstore frontend directory
-read only for the guest. This is safe since the xenstore permissions model,
-unlike POSIX directory permissions, does not allow the guest to remove and
-recreate a node if it has write access to the containing directory.
-
-There are a few associated wrinkles:
-
- - The primary PV console is "special". It's xenstore node is not under the
- usual /devices/ subtree and it does not use the customary xenstore state
- machine protocol. Unfortunately its directory is used for other things,
- including the vnc-port node, which we do not want the guest to be able to
- write to. Rather than trying to track down all the possible secondary uses
- of this directory just make it r/o to the guest. All newly created
- subdirectories inherit these permissions and so are now safe by default.
-
- - The other serial consoles do use the customary xenstore state machine and
- therefore need write access to at least the "protocol" and "state" nodes,
- however they may also want to use arbitrary "feature-foo" nodes (although
- I'm not aware of any) and therefore we cannot simply lock down the entire
- frontend directory. Instead we add support to libxl__device_generic_add for
- frontend keys which are explicitly read only and use that to lock down the
- sensitive keys.
-
- - Minios' console frontend wants to write the "type" node, which it has no
- business doing since this is a host/toolstack level decision. This fails
- now that the node has become read only to the PV guest. Since the toolstack
- already writes this node just remove the attempt to set it.
-
-This is CVE-XXXX-XXX / XSA-57
-
-Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
-
-Conflicts:
- tools/libxl/libxl.c (no vtpm, free front_ro on error in
- libxl__device_console_add)
-
-diff --git a/extras/mini-os/console/xenbus.c b/extras/mini-os/console/xenbus.c
-index 77de82a..e65baf7 100644
---- a/extras/mini-os/console/xenbus.c
-+++ b/extras/mini-os/console/xenbus.c
-@@ -122,12 +122,6 @@ again:
- goto abort_transaction;
- }
-
-- err = xenbus_printf(xbt, nodename, "type", "%s", "ioemu");
-- if (err) {
-- message = "writing type";
-- goto abort_transaction;
-- }
--
- snprintf(path, sizeof(path), "%s/state", nodename);
- err = xenbus_switch_state(xbt, path, XenbusStateConnected);
- if (err) {
-diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
-index a6e9601..32d788a 100644
---- a/tools/libxl/libxl.c
-+++ b/tools/libxl/libxl.c
-@@ -1920,8 +1920,9 @@ static void device_disk_add(libxl__egc *egc, uint32_t domid,
- flexarray_append(front, disk->is_cdrom ? "cdrom" : "disk");
-
- libxl__device_generic_add(gc, t, device,
-- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, back, back->count),
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ NULL);
-
- rc = libxl__xs_transaction_commit(gc, &t);
- if (!rc) break;
-@@ -2633,8 +2634,9 @@ void libxl__device_nic_add(libxl__egc *egc, uint32_t domid,
- flexarray_append(front, libxl__sprintf(gc,
- LIBXL_MAC_FMT, LIBXL_MAC_BYTES(nic->mac)));
- libxl__device_generic_add(gc, XBT_NULL, device,
-- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, back, back->count),
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ NULL);
-
- aodev->dev = device;
- aodev->action = DEVICE_CONNECT;
-@@ -2830,7 +2832,7 @@ int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
- libxl__device_console *console,
- libxl__domain_build_state *state)
- {
-- flexarray_t *front;
-+ flexarray_t *front, *ro_front;
- flexarray_t *back;
- libxl__device device;
- int rc;
-@@ -2845,6 +2847,11 @@ int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
- rc = ERROR_NOMEM;
- goto out;
- }
-+ ro_front = flexarray_make(16, 1);
-+ if (!ro_front) {
-+ rc = ERROR_NOMEM;
-+ goto out;
-+ }
- back = flexarray_make(16, 1);
- if (!back) {
- rc = ERROR_NOMEM;
-@@ -2871,21 +2878,24 @@ int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
-
- flexarray_append(front, "backend-id");
- flexarray_append(front, libxl__sprintf(gc, "%d", console->backend_domid));
-- flexarray_append(front, "limit");
-- flexarray_append(front, libxl__sprintf(gc, "%d", LIBXL_XENCONSOLE_LIMIT));
-- flexarray_append(front, "type");
-+
-+ flexarray_append(ro_front, "limit");
-+ flexarray_append(ro_front, libxl__sprintf(gc, "%d", LIBXL_XENCONSOLE_LIMIT));
-+ flexarray_append(ro_front, "type");
- if (console->consback == LIBXL__CONSOLE_BACKEND_XENCONSOLED)
-- flexarray_append(front, "xenconsoled");
-+ flexarray_append(ro_front, "xenconsoled");
- else
-- flexarray_append(front, "ioemu");
-- flexarray_append(front, "output");
-- flexarray_append(front, console->output);
-+ flexarray_append(ro_front, "ioemu");
-+ flexarray_append(ro_front, "output");
-+ flexarray_append(ro_front, console->output);
-+ flexarray_append(ro_front, "tty");
-+ flexarray_append(ro_front, "");
-
- if (state) {
-- flexarray_append(front, "port");
-- flexarray_append(front, libxl__sprintf(gc, "%"PRIu32, state->console_port));
-- flexarray_append(front, "ring-ref");
-- flexarray_append(front, libxl__sprintf(gc, "%lu", state->console_mfn));
-+ flexarray_append(ro_front, "port");
-+ flexarray_append(ro_front, libxl__sprintf(gc, "%"PRIu32, state->console_port));
-+ flexarray_append(ro_front, "ring-ref");
-+ flexarray_append(ro_front, libxl__sprintf(gc, "%lu", state->console_mfn));
- } else {
- flexarray_append(front, "state");
- flexarray_append(front, libxl__sprintf(gc, "%d", 1));
-@@ -2894,11 +2904,13 @@ int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
- }
-
- libxl__device_generic_add(gc, XBT_NULL, &device,
-- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, back, back->count),
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ libxl__xs_kvs_of_flexarray(gc, ro_front, ro_front->count));
- rc = 0;
- out_free:
- flexarray_free(back);
-+ flexarray_free(ro_front);
- flexarray_free(front);
- out:
- return rc;
-@@ -2982,8 +2994,9 @@ int libxl__device_vkb_add(libxl__gc *gc, uint32_t domid,
- flexarray_append(front, libxl__sprintf(gc, "%d", 1));
-
- libxl__device_generic_add(gc, XBT_NULL, &device,
-- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, back, back->count),
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ NULL);
- rc = 0;
- out_free:
- flexarray_free(back);
-@@ -3096,8 +3109,9 @@ int libxl__device_vfb_add(libxl__gc *gc, uint32_t domid, libxl_device_vfb *vfb)
- flexarray_append_pair(front, "state", libxl__sprintf(gc, "%d", 1));
-
- libxl__device_generic_add(gc, XBT_NULL, &device,
-- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, back, back->count),
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ NULL);
- rc = 0;
- out_free:
- flexarray_free(front);
-diff --git a/tools/libxl/libxl_device.c b/tools/libxl/libxl_device.c
-index c3283f1..1c04a21 100644
---- a/tools/libxl/libxl_device.c
-+++ b/tools/libxl/libxl_device.c
-@@ -84,11 +84,12 @@ out:
- }
-
- int libxl__device_generic_add(libxl__gc *gc, xs_transaction_t t,
-- libxl__device *device, char **bents, char **fents)
-+ libxl__device *device, char **bents, char **fents, char **ro_fents)
- {
- libxl_ctx *ctx = libxl__gc_owner(gc);
- char *frontend_path, *backend_path;
- struct xs_permissions frontend_perms[2];
-+ struct xs_permissions ro_frontend_perms[2];
- struct xs_permissions backend_perms[2];
- int create_transaction = t == XBT_NULL;
-
-@@ -100,22 +101,37 @@ int libxl__device_generic_add(libxl__gc *gc, xs_transaction_t t,
- frontend_perms[1].id = device->backend_domid;
- frontend_perms[1].perms = XS_PERM_READ;
-
-- backend_perms[0].id = device->backend_domid;
-- backend_perms[0].perms = XS_PERM_NONE;
-- backend_perms[1].id = device->domid;
-- backend_perms[1].perms = XS_PERM_READ;
-+ ro_frontend_perms[0].id = backend_perms[0].id = device->backend_domid;
-+ ro_frontend_perms[0].perms = backend_perms[0].perms = XS_PERM_NONE;
-+ ro_frontend_perms[1].id = backend_perms[1].id = device->domid;
-+ ro_frontend_perms[1].perms = backend_perms[1].perms = XS_PERM_READ;
-
- retry_transaction:
- if (create_transaction)
- t = xs_transaction_start(ctx->xsh);
- /* FIXME: read frontend_path and check state before removing stuff */
-
-- if (fents) {
-+ if (fents || ro_fents) {
- xs_rm(ctx->xsh, t, frontend_path);
- xs_mkdir(ctx->xsh, t, frontend_path);
-- xs_set_permissions(ctx->xsh, t, frontend_path, frontend_perms, ARRAY_SIZE(frontend_perms));
-+ /* Console 0 is a special case. It doesn't use the regular PV
-+ * state machine but also the frontend directory has
-+ * historically contained other information, such as the
-+ * vnc-port, which we don't want the guest fiddling with.
-+ */
-+ if (device->kind == LIBXL__DEVICE_KIND_CONSOLE && device->devid == 0)
-+ xs_set_permissions(ctx->xsh, t, frontend_path,
-+ ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms));
-+ else
-+ xs_set_permissions(ctx->xsh, t, frontend_path,
-+ frontend_perms, ARRAY_SIZE(frontend_perms));
- xs_write(ctx->xsh, t, libxl__sprintf(gc, "%s/backend", frontend_path), backend_path, strlen(backend_path));
-- libxl__xs_writev(gc, t, frontend_path, fents);
-+ if (fents)
-+ libxl__xs_writev_perms(gc, t, frontend_path, fents,
-+ frontend_perms, ARRAY_SIZE(frontend_perms));
-+ if (ro_fents)
-+ libxl__xs_writev_perms(gc, t, frontend_path, ro_fents,
-+ ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms));
- }
-
- if (bents) {
-diff --git a/tools/libxl/libxl_internal.h b/tools/libxl/libxl_internal.h
-index 13fa509..ae96a74 100644
---- a/tools/libxl/libxl_internal.h
-+++ b/tools/libxl/libxl_internal.h
-@@ -516,6 +516,11 @@ _hidden char **libxl__xs_kvs_of_flexarray(libxl__gc *gc, flexarray_t *array, int
- /* treats kvs as pairs of keys and values and writes each to dir. */
- _hidden int libxl__xs_writev(libxl__gc *gc, xs_transaction_t t,
- const char *dir, char **kvs);
-+/* as writev but also sets the permissions on each path */
-+_hidden int libxl__xs_writev_perms(libxl__gc *gc, xs_transaction_t t,
-+ const char *dir, char *kvs[],
-+ struct xs_permissions *perms,
-+ unsigned int num_perms);
- /* _atonce creates a transaction and writes all keys at once */
- _hidden int libxl__xs_writev_atonce(libxl__gc *gc,
- const char *dir, char **kvs);
-@@ -930,7 +935,7 @@ _hidden int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
- libxl__domain_build_state *state);
-
- _hidden int libxl__device_generic_add(libxl__gc *gc, xs_transaction_t t,
-- libxl__device *device, char **bents, char **fents);
-+ libxl__device *device, char **bents, char **fents, char **ro_fents);
- _hidden char *libxl__device_backend_path(libxl__gc *gc, libxl__device *device);
- _hidden char *libxl__device_frontend_path(libxl__gc *gc, libxl__device *device);
- _hidden int libxl__parse_backend_path(libxl__gc *gc, const char *path,
-diff --git a/tools/libxl/libxl_pci.c b/tools/libxl/libxl_pci.c
-index 48986f3..d373b4d 100644
---- a/tools/libxl/libxl_pci.c
-+++ b/tools/libxl/libxl_pci.c
-@@ -106,7 +106,8 @@ int libxl__create_pci_backend(libxl__gc *gc, uint32_t domid,
-
- libxl__device_generic_add(gc, XBT_NULL, &device,
- libxl__xs_kvs_of_flexarray(gc, back, back->count),
-- libxl__xs_kvs_of_flexarray(gc, front, front->count));
-+ libxl__xs_kvs_of_flexarray(gc, front, front->count),
-+ NULL);
-
- out:
- if (back)
-diff --git a/tools/libxl/libxl_xshelp.c b/tools/libxl/libxl_xshelp.c
-index 52af484..d7eaa66 100644
---- a/tools/libxl/libxl_xshelp.c
-+++ b/tools/libxl/libxl_xshelp.c
-@@ -41,8 +41,10 @@ char **libxl__xs_kvs_of_flexarray(libxl__gc *gc, flexarray_t *array, int length)
- return kvs;
- }
-
--int libxl__xs_writev(libxl__gc *gc, xs_transaction_t t,
-- const char *dir, char *kvs[])
-+int libxl__xs_writev_perms(libxl__gc *gc, xs_transaction_t t,
-+ const char *dir, char *kvs[],
-+ struct xs_permissions *perms,
-+ unsigned int num_perms)
- {
- libxl_ctx *ctx = libxl__gc_owner(gc);
- char *path;
-@@ -56,11 +58,19 @@ int libxl__xs_writev(libxl__gc *gc, xs_transaction_t t,
- if (path && kvs[i + 1]) {
- int length = strlen(kvs[i + 1]);
- xs_write(ctx->xsh, t, path, kvs[i + 1], length);
-+ if (perms)
-+ xs_set_permissions(ctx->xsh, t, path, perms, num_perms);
- }
- }
- return 0;
- }
-
-+int libxl__xs_writev(libxl__gc *gc, xs_transaction_t t,
-+ const char *dir, char *kvs[])
-+{
-+ return libxl__xs_writev_perms(gc, t, dir, kvs, NULL, 0);
-+}
-+
- int libxl__xs_writev_atonce(libxl__gc *gc,
- const char *dir, char *kvs[])
- {
diff --git a/main/xen/xsa58-4.2.patch b/main/xen/xsa58-4.2.patch
deleted file mode 100644
index 1ea3aaa97..000000000
--- a/main/xen/xsa58-4.2.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-x86: fix page refcount handling in page table pin error path
-
-In the original patch 7 of the series addressing XSA-45 I mistakenly
-took the addition of the call to get_page_light() in alloc_page_type()
-to cover two decrements that would happen: One for the PGT_partial bit
-that is getting set along with the call, and the other for the page
-reference the caller hold (and would be dropping on its error path).
-But of course the additional page reference is tied to the PGT_partial
-bit, and hence any caller of a function that may leave
-->arch.old_guest_table non-NULL for error cleanup purposes has to make
-sure a respective page reference gets retained.
-
-Similar issues were then also spotted elsewhere: In effect all callers
-of get_page_type_preemptible() need to deal with errors in similar
-ways. To make sure error handling can work this way without leaking
-page references, a respective assertion gets added to that function.
-
-This is CVE-2013-1432 / XSA-58.
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Tim Deegan <tim@xen.org>
-
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -941,6 +941,10 @@ int arch_set_info_guest(
- if ( v->vcpu_id == 0 )
- d->vm_assist = c(vm_assist);
-
-+ rc = put_old_guest_table(current);
-+ if ( rc )
-+ return rc;
-+
- if ( !compat )
- rc = (int)set_gdt(v, c.nat->gdt_frames, c.nat->gdt_ents);
- #ifdef CONFIG_COMPAT
-@@ -980,18 +984,24 @@ int arch_set_info_guest(
- }
- else
- {
-- /*
-- * Since v->arch.guest_table{,_user} are both NULL, this effectively
-- * is just a call to put_old_guest_table().
-- */
- if ( !compat )
-- rc = vcpu_destroy_pagetables(v);
-+ rc = put_old_guest_table(v);
- if ( !rc )
- rc = get_page_type_preemptible(cr3_page,
- !compat ? PGT_root_page_table
- : PGT_l3_page_table);
-- if ( rc == -EINTR )
-+ switch ( rc )
-+ {
-+ case -EINTR:
- rc = -EAGAIN;
-+ case -EAGAIN:
-+ case 0:
-+ break;
-+ default:
-+ if ( cr3_page == current->arch.old_guest_table )
-+ cr3_page = NULL;
-+ break;
-+ }
- }
- if ( rc )
- /* handled below */;
-@@ -1018,6 +1028,11 @@ int arch_set_info_guest(
- pagetable_get_page(v->arch.guest_table);
- v->arch.guest_table = pagetable_null();
- break;
-+ default:
-+ if ( cr3_page == current->arch.old_guest_table )
-+ cr3_page = NULL;
-+ case 0:
-+ break;
- }
- }
- if ( !rc )
---- a/xen/arch/x86/mm.c
-+++ b/xen/arch/x86/mm.c
-@@ -718,7 +718,8 @@ static int get_page_and_type_from_pagenr
- get_page_type_preemptible(page, type) :
- (get_page_type(page, type) ? 0 : -EINVAL));
-
-- if ( unlikely(rc) && partial >= 0 )
-+ if ( unlikely(rc) && partial >= 0 &&
-+ (!preemptible || page != current->arch.old_guest_table) )
- put_page(page);
-
- return rc;
-@@ -2638,6 +2639,7 @@ int put_page_type_preemptible(struct pag
-
- int get_page_type_preemptible(struct page_info *page, unsigned long type)
- {
-+ ASSERT(!current->arch.old_guest_table);
- return __get_page_type(page, type, 1);
- }
-
-@@ -2848,7 +2850,7 @@ static void put_superpage(unsigned long
-
- #endif
-
--static int put_old_guest_table(struct vcpu *v)
-+int put_old_guest_table(struct vcpu *v)
- {
- int rc;
-
-@@ -3253,7 +3255,8 @@ long do_mmuext_op(
- rc = -EAGAIN;
- else if ( rc != -EAGAIN )
- MEM_LOG("Error while pinning mfn %lx", page_to_mfn(page));
-- put_page(page);
-+ if ( page != curr->arch.old_guest_table )
-+ put_page(page);
- break;
- }
-
---- a/xen/include/asm-x86/mm.h
-+++ b/xen/include/asm-x86/mm.h
-@@ -374,6 +374,7 @@ void put_page_type(struct page_info *pag
- int get_page_type(struct page_info *page, unsigned long type);
- int put_page_type_preemptible(struct page_info *page);
- int get_page_type_preemptible(struct page_info *page, unsigned long type);
-+int put_old_guest_table(struct vcpu *);
- int get_page_from_l1e(
- l1_pgentry_t l1e, struct domain *l1e_owner, struct domain *pg_owner);
- void put_page_from_l1e(l1_pgentry_t l1e, struct domain *l1e_owner);
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-17 17:45:58 +0000