From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350047.1607609 (Exim 4.92) (envelope-from ) id 1wewAW-0000U1-Bo; Wed, 01 Jul 2026 14:44:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350047.1607609; Wed, 01 Jul 2026 14:44:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAW-0000Tt-8u; Wed, 01 Jul 2026 14:44:04 +0000 Received: by outflank-mailman (input) for mailman id 1350047; Wed, 01 Jul 2026 14:44:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAV-0000Tg-48 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewAU-0028BW-1j for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewAU-0019uO-0g for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=odjVwMlr6qykyHbHJajsUROwdaqUSpasg5BykE9xzmQ=; b=VB1LCMnq2b8qJIPYFgqi6Ax9Vm b1hEGpj+k+0oTuqwj/X1/Zn2NF/u2f8QopObVFF9NqBgrH3+a9erQU5XQi5lWBST1Rg2HB4HyGW/E /HffUJCVz2T4TaB5s8MHDyJfqKB2khp2DEavr03GPKDWGVzHKTv47n2RIFlOHwzllYyE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libxc: adjust string size calculations in xc_{,de,test_}assign_dt_device() Message-Id: Date: Wed, 01 Jul 2026 14:44:02 +0000 commit 873bc77d3d212484b66a1c8665a44f9dd86a2a41 Author: Jan Beulich AuthorDate: Wed Jul 1 14:10:10 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:10:10 2026 +0200 libxc: adjust string size calculations in xc_{,de,test_}assign_dt_device() In preparation for a hypervisor change also include the nul terminator in the size calculations. Signed-off-by: Jan Beulich Reviewed-by: Teddy Astie Reviewed-by: Juergen Gross Acked-by: Anthony PERARD --- tools/libs/ctrl/xc_domain.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/libs/ctrl/xc_domain.c b/tools/libs/ctrl/xc_domain.c index 01c0669c88..94cfab0fa1 100644 --- a/tools/libs/ctrl/xc_domain.c +++ b/tools/libs/ctrl/xc_domain.c @@ -1592,7 +1592,7 @@ int xc_assign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); @@ -1624,7 +1624,7 @@ int xc_test_assign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); @@ -1652,7 +1652,7 @@ int xc_deassign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350048.1607612 (Exim 4.92) (envelope-from ) id 1wewAf-0000WV-Cn; Wed, 01 Jul 2026 14:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350048.1607612; Wed, 01 Jul 2026 14:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAf-0000WN-AA; Wed, 01 Jul 2026 14:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1350048; Wed, 01 Jul 2026 14:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAe-0000WF-ET for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewAe-0028Bb-2E for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewAe-001AAB-11 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zAj66ui/FqOBDS8bUgawXPklVOdVIvSie+f0VD6eO1w=; b=G9CqmQWrT4nFhHmb2+ETrk43ib Dggk899fJQcF8BEygcCkKEJL1LSgj6336VKiZnyMa5TDvWF6NyITjy+aqTgC4x9bzd+DQRyCQfEkL uktbqeNNaS2/041wEVS9J/+1QFIMeOtxXFtk/RlBToC1A9sJJPBFDeSQqFL6KUNirFiA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libxc: adjust string size calculations in xc_flask_{getbool_byname,setbool}() Message-Id: Date: Wed, 01 Jul 2026 14:44:12 +0000 commit 40e93479999a9c6e227340fdb5ffa877292294bf Author: Jan Beulich AuthorDate: Wed Jul 1 14:10:46 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:10:46 2026 +0200 libxc: adjust string size calculations in xc_flask_{getbool_byname,setbool}() In preparation for a hypervisor change also include the nul terminator in the size calculations. (Note that xc_flask_getbool_byid() doesn't support FLASK_GETBOOL's "ID being -1" variant of operation, and hence doesn't need fiddling with. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Reviewed-by: Teddy Astie Acked-by: Anthony PERARD --- tools/libs/ctrl/xc_flask.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/libs/ctrl/xc_flask.c b/tools/libs/ctrl/xc_flask.c index 21ba697ad6..f5389dbd96 100644 --- a/tools/libs/ctrl/xc_flask.c +++ b/tools/libs/ctrl/xc_flask.c @@ -186,7 +186,8 @@ int xc_flask_getbool_byname(xc_interface *xch, char *name, int *curr, int *pend) { int rv; struct xen_flask_op op = {}; - DECLARE_HYPERCALL_BOUNCE(name, strlen(name), XC_HYPERCALL_BUFFER_BOUNCE_IN); + size_t size = strlen(name) + 1; + DECLARE_HYPERCALL_BOUNCE(name, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, name) ) { @@ -196,7 +197,7 @@ int xc_flask_getbool_byname(xc_interface *xch, char *name, int *curr, int *pend) op.cmd = FLASK_GETBOOL; op.u.boolean.bool_id = -1; - op.u.boolean.size = strlen(name); + op.u.boolean.size = size; set_xen_guest_handle(op.u.boolean.name, name); rv = xc_flask_op(xch, &op); @@ -218,7 +219,8 @@ int xc_flask_setbool(xc_interface *xch, char *name, int value, int commit) { int rv; struct xen_flask_op op = {}; - DECLARE_HYPERCALL_BOUNCE(name, strlen(name), XC_HYPERCALL_BUFFER_BOUNCE_IN); + size_t size = strlen(name) + 1; + DECLARE_HYPERCALL_BOUNCE(name, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, name) ) { @@ -230,7 +232,7 @@ int xc_flask_setbool(xc_interface *xch, char *name, int value, int commit) op.u.boolean.bool_id = -1; op.u.boolean.new_value = value; op.u.boolean.commit = 1; - op.u.boolean.size = strlen(name); + op.u.boolean.size = size; set_xen_guest_handle(op.u.boolean.name, name); rv = xc_flask_op(xch, &op); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350049.1607616 (Exim 4.92) (envelope-from ) id 1wewAp-0000aD-EB; Wed, 01 Jul 2026 14:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350049.1607616; Wed, 01 Jul 2026 14:44:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAp-0000a6-BQ; Wed, 01 Jul 2026 14:44:23 +0000 Received: by outflank-mailman (input) for mailman id 1350049; Wed, 01 Jul 2026 14:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAo-0000Zy-Hm for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewAo-0028Bf-2a for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewAo-001AaE-1X for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+FDGWtyn1qJNJD8NZuFQCIUQogQi9wzY1EeJl4ZvaQY=; b=aRynzSRqMv8if/C2xfuEtC6W5s F0TdHlOHdXWflFUxNEpuUu82+3jFasRUh93CukTznQiryxnlxfbC9SecVlyePzHGWpCQXZpOGHHPo wjT4aGac8pyqUu7MHUkPc9GFHhb006CHt6Z6Pwsfl6zgsQDCf7yYlLe6rvHQvFbkeWzg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/riscv: rename enum intc_version to intc_variant Message-Id: Date: Wed, 01 Jul 2026 14:44:22 +0000 commit 3375b70058dbdbc26121a1b38831430b53be7af3 Author: Oleksii Kurochko AuthorDate: Wed Jul 1 14:12:51 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:12:51 2026 +0200 xen/riscv: rename enum intc_version to intc_variant Rename the enum to intc_variant and the structure member from hw_version to hw_variant to better reflect that these values select between different controller variants, not versions of the same one. Requested-by: Jan Beulich Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/aplic.c | 2 +- xen/arch/riscv/include/asm/intc.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c index 739e8dab34..6a1255c5f4 100644 --- a/xen/arch/riscv/aplic.c +++ b/xen/arch/riscv/aplic.c @@ -35,7 +35,7 @@ static struct aplic_priv aplic = { }; static struct intc_info __ro_after_init aplic_info = { - .hw_version = INTC_APLIC, + .hw_variant = INTC_APLIC, }; static void __init aplic_init_hw_interrupts(void) diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h index ecdc8a5e65..675f703ec9 100644 --- a/xen/arch/riscv/include/asm/intc.h +++ b/xen/arch/riscv/include/asm/intc.h @@ -10,7 +10,7 @@ struct dt_device_node; -enum intc_version { +enum intc_variant { INTC_APLIC, }; @@ -18,7 +18,7 @@ struct cpu_user_regs; struct irq_desc; struct intc_info { - enum intc_version hw_version; + enum intc_variant hw_variant; const struct dt_device_node *node; /* number of irqs */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350050.1607620 (Exim 4.92) (envelope-from ) id 1wewB0-0000cF-Fa; Wed, 01 Jul 2026 14:44:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350050.1607620; Wed, 01 Jul 2026 14:44:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewB0-0000c7-Cx; Wed, 01 Jul 2026 14:44:34 +0000 Received: by outflank-mailman (input) for mailman id 1350050; Wed, 01 Jul 2026 14:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewAy-0000c1-Om for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewAy-0028Bj-33 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewAy-001Atx-1s for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RtdKA6QAteWpLWRWYLWLI1HLDLdCidD0VPP2LF8B26o=; b=s5gq4DQuiNCHasrgTFpUOSbeUl otNtNDb4ANmLk2AZOuCE//f0f8JgQFbIyanbNWekaLAeqLYplO992vW/BVB9WxvCoVe8q5Nt+VkXO Xwe8HNeTGrcCWaWUS3cDu4SqrICitl9ZE+NBt7vihlA0boRK7z45xu9blCIyMjOVCsqU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] console+serial: don't open-code IRQ-safe locking primitives Message-Id: Date: Wed, 01 Jul 2026 14:44:32 +0000 commit 55ba831b14ea6f501c85974e0155169518b881ce Author: Jan Beulich AuthorDate: Wed Jul 1 14:13:59 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:13:59 2026 +0200 console+serial: don't open-code IRQ-safe locking primitives Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/drivers/char/console.c | 6 ++---- xen/drivers/char/serial.c | 11 +++-------- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index bcd6d26149..dbda7f2596 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -1010,8 +1010,7 @@ vprintk_common(const char *fmt, va_list args, const char *prefix) unsigned long flags; /* console_lock can be acquired recursively from __printk_ratelimit(). */ - local_irq_save(flags); - rspin_lock(&console_lock); + flags = rspin_lock_irqsave(&console_lock); state = &this_cpu(state); (void)vsnprintf(buf, sizeof(buf), fmt, args); @@ -1047,8 +1046,7 @@ vprintk_common(const char *fmt, va_list args, const char *prefix) state->continued = 1; } - rspin_unlock(&console_lock); - local_irq_restore(flags); + rspin_unlock_irqrestore(&console_lock, flags); } void vprintk(const char *fmt, va_list args) diff --git a/xen/drivers/char/serial.c b/xen/drivers/char/serial.c index adb312d796..bbbe758788 100644 --- a/xen/drivers/char/serial.c +++ b/xen/drivers/char/serial.c @@ -76,17 +76,15 @@ void serial_tx_interrupt(struct serial_port *port) int i, n; unsigned long flags; - local_irq_save(flags); - /* * Avoid spinning for a long time: if there is a long-term lock holder * then we know that they'll be stuffing bytes into the transmitter which * will therefore not be empty for long. */ - while ( !spin_trylock(&port->tx_lock) ) + while ( !spin_trylock_irqsave(&port->tx_lock, flags) ) { if ( port->driver->tx_ready(port) <= 0 ) - goto out; + return; cpu_relax(); } @@ -94,7 +92,6 @@ void serial_tx_interrupt(struct serial_port *port) { /* Disable TX. nothing to send */ serial_stop_tx(port); - spin_unlock(&port->tx_lock); goto out; } else @@ -112,10 +109,8 @@ void serial_tx_interrupt(struct serial_port *port) if ( i && port->driver->flush ) port->driver->flush(port); - spin_unlock(&port->tx_lock); - out: - local_irq_restore(flags); + spin_unlock_irqrestore(&port->tx_lock, flags); } static void __serial_putc(struct serial_port *port, char c) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350051.1607624 (Exim 4.92) (envelope-from ) id 1wewBA-0000eK-Gp; Wed, 01 Jul 2026 14:44:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350051.1607624; Wed, 01 Jul 2026 14:44:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewBA-0000eD-ED; Wed, 01 Jul 2026 14:44:44 +0000 Received: by outflank-mailman (input) for mailman id 1350051; Wed, 01 Jul 2026 14:44:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewB8-0000e4-Pp for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewB9-0028C6-09 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewB8-001BKX-2N for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ORTXHmP3eZTsqtcK/iXTdY6RaWNTXynzNHdvtarfU8w=; b=G+sQsPkww+DCS+oL19wv3gHMWt GCSYurWdYqUhEpw4bt/pYLxucWWLfDiZ//uDFnQdLpu4MJzLrMqY2pZYL3AbbjrPXA4riTuit9gGR LQU1c/oxxa6Tx3sPgdantt/x5J19GuDBy3W+T5kTwA3jqQ5UJoM/p5yu1F4AsaEilBIc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] domain: domlist_update_lock can be static Message-Id: Date: Wed, 01 Jul 2026 14:44:42 +0000 commit 0969fc9fa121a19a7ad7e1c286a22029d3cbecf4 Author: Jan Beulich AuthorDate: Wed Jul 1 14:14:30 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:14:30 2026 +0200 domain: domlist_update_lock can be static For a long time (if not forever) this lock has been referenced only from a single CU. Misra C:2012 rule 8.7 (which we didn't accept yet) wants us to have such identifiers non-external. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Oleksii Kurochko --- xen/common/domain.c | 2 +- xen/include/xen/sched.h | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 8f2bfcae28..53ac1d6c40 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -58,7 +58,7 @@ bool opt_dom0_vcpus_pin; boolean_param("dom0_vcpus_pin", opt_dom0_vcpus_pin); /* Protect updates/reads (resp.) of domain_list and domain_hash. */ -DEFINE_SPINLOCK(domlist_update_lock); +static DEFINE_SPINLOCK(domlist_update_lock); DEFINE_RCU_READ_LOCK(domlist_read_lock); #define DOMAIN_HASH_SIZE 256 diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h index 91f6db7a32..011292e9f7 100644 --- a/xen/include/xen/sched.h +++ b/xen/include/xen/sched.h @@ -697,8 +697,10 @@ static inline unsigned int domain_tot_pages(const struct domain *d) return d->tot_pages - d->extra_pages; } -/* Protect updates/reads (resp.) of domain_list and domain_hash. */ -extern spinlock_t domlist_update_lock; +/* + * Protect updates/reads (resp.) of domain_list and domain_hash, together with + * domlist_update_lock. + */ extern rcu_read_lock_t domlist_read_lock; extern struct vcpu *idle_vcpu[NR_CPUS]; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:44:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:44:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350052.1607628 (Exim 4.92) (envelope-from ) id 1wewBK-0000gW-IP; Wed, 01 Jul 2026 14:44:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350052.1607628; Wed, 01 Jul 2026 14:44:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewBK-0000gM-Fh; Wed, 01 Jul 2026 14:44:54 +0000 Received: by outflank-mailman (input) for mailman id 1350052; Wed, 01 Jul 2026 14:44:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewBI-0000gD-Sm for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewBJ-0028CC-0R for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewBI-001Bjf-2f for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:44:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3r+0K0ZAUQLL+GPuKrfjnwGWz5KMZetGgKFUHB4a/3Y=; b=e0cue1BP3T1OlnGCUv4XiE5trk 2b75nPz8pcxIX3CbQRDs9SDsGxAGz6adAx7v1aJdotoqJjWOmke2WtkbuQFY+MJ44ghwSPiU8w8EK h0/gl9i/WACiZVS1gAf4eDP9ucmd0cuifUXd1t6Zjwx8qVWFHlsvaO9i2BNn40sHHxrQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xmalloc: drop pool list Message-Id: Date: Wed, 01 Jul 2026 14:44:52 +0000 commit 2dc805ceae42b23ee3fdff9fac0848bf6ffbbc38 Author: Jan Beulich AuthorDate: Wed Jul 1 14:14:59 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:14:59 2026 +0200 xmalloc: drop pool list From its introduction it has been used solely to add and remove pools. No list traversal or alike did ever occur. Drop all of this as being dead code. Signed-off-by: Jan Beulich Reviewed-by: Oleksii Kurochko Reviewed-by: Andrew Cooper --- xen/common/xmalloc_tlsf.c | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/xen/common/xmalloc_tlsf.c b/xen/common/xmalloc_tlsf.c index 5e55fc463e..b43219b4af 100644 --- a/xen/common/xmalloc_tlsf.c +++ b/xen/common/xmalloc_tlsf.c @@ -66,9 +66,6 @@ #define PREV_FREE (0x2) #define PREV_USED (0x0) -static DEFINE_SPINLOCK(pool_list_lock); -static LIST_HEAD(pool_list_head); - struct free_ptr { struct bhdr *prev; struct bhdr *next; @@ -113,8 +110,6 @@ struct xmem_pool { xmem_pool_get_memory *get_mem; xmem_pool_put_memory *put_mem; - struct list_head list; - char name[MAX_POOL_NAME_LEN]; }; @@ -340,10 +335,6 @@ struct xmem_pool *xmem_pool_create( spin_lock_init(&pool->lock); - spin_lock(&pool_list_lock); - list_add_tail(&pool->list, &pool_list_head); - spin_unlock(&pool_list_lock); - return pool; } @@ -373,10 +364,6 @@ void xmem_pool_destroy(struct xmem_pool *pool) "%lu bytes still in use.\n", pool->name, pool, xmem_pool_get_used_size(pool)); - spin_lock(&pool_list_lock); - list_del_init(&pool->list); - spin_unlock(&pool_list_lock); - pool_bytes = ROUNDUP_SIZE(sizeof(*pool)); pool_order = get_order_from_bytes(pool_bytes); free_xenheap_pages(pool,pool_order); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 14:45:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 14:45:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350053.1607632 (Exim 4.92) (envelope-from ) id 1wewBU-0000jb-JX; Wed, 01 Jul 2026 14:45:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350053.1607632; Wed, 01 Jul 2026 14:45:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewBU-0000jS-Gx; Wed, 01 Jul 2026 14:45:04 +0000 Received: by outflank-mailman (input) for mailman id 1350053; Wed, 01 Jul 2026 14:45:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wewBS-0000jL-VY for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:45:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wewBT-0028Cc-0j for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:45:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wewBS-001C8w-2z for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 14:45:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HPrx3DprIawvNG4nQC7KNFB6ZCooiTtJDaBvBP5kWvg=; b=1cyWtU3Ktmzjrf0bfJ6d9oNebg vpUIMmc1IMEDubdBqv+qAM7Dy14IPgCgblqnM+twF4bNr8GoH3QDO6P8vbnADVJ8Jus2k+S2Xqjq3 SPEkibIEN7KbDDuif2+wkzIVD1sjY2jJyphCkBELqU4PxqD0DIpbxLu72CK2EZqnYoNI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] hypercall: mmuext_op is PV-only Message-Id: Date: Wed, 01 Jul 2026 14:45:02 +0000 commit 5db702e3b21d2dd1a9094db71596d557f4a6d672 Author: Jan Beulich AuthorDate: Wed Jul 1 14:15:17 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:15:17 2026 +0200 hypercall: mmuext_op is PV-only In a !PV configuration the functions aren't built. Hence we're better off also not declaring them. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné --- xen/include/hypercall-defs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c index 63755bb8df..a625d634b6 100644 --- a/xen/include/hypercall-defs.c +++ b/xen/include/hypercall-defs.c @@ -137,7 +137,9 @@ memory_op(unsigned int cmd, void *arg) #ifdef CONFIG_IOREQ_SERVER dm_op(domid_t domid, unsigned int nr_bufs, void *bufs) #endif +#ifdef CONFIG_PV mmuext_op(void *arg, unsigned int count, uint *pdone, unsigned int foreigndom) +#endif #ifdef CONFIG_PV32 set_trap_table(trap_info_compat_t *traps) set_gdt(unsigned int *frame_list, unsigned int entries) @@ -168,9 +170,9 @@ set_timer_op(s_time_t timeout) console_io(unsigned int cmd, unsigned int count, char *buffer) vm_assist(unsigned int cmd, unsigned int type) event_channel_op(int cmd, void *arg) -mmuext_op(mmuext_op_t *uops, unsigned int count, unsigned int *pdone, unsigned int foreigndom) multicall(multicall_entry_t *call_list, unsigned long nr_calls) #ifdef CONFIG_PV +mmuext_op(mmuext_op_t *uops, unsigned int count, unsigned int *pdone, unsigned int foreigndom) mmu_update(mmu_update_t *ureqs, unsigned int count, unsigned int *pdone, unsigned int foreigndom) stack_switch(unsigned long ss, unsigned long esp) fpu_taskswitch(int set) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350274.1607772 (Exim 4.92) (envelope-from ) id 1weySl-0002H8-Tg; Wed, 01 Jul 2026 17:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350274.1607772; Wed, 01 Jul 2026 17:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weySl-0002H0-Pz; Wed, 01 Jul 2026 17:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1350274; Wed, 01 Jul 2026 17:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weySk-0002Gu-34 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weySk-002BKi-0I for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weySj-0065fD-2M for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iqaEFLawATpTx9r9SjQPl7Z0HtU+8Y+eJIwvB8hnIG8=; b=p5ZX46kBGQwAuYaAumpDmLmlLc itlI3mimVnjvbNriamG2LY7p4E6cX3qy/C2UgHraJK0FWcfYxENOT8Y4mLZ+l0CRpTHMuXGgaOrVp D8/zV02T8t5jIyybdLAf6TY93bOy0Hhb2pwwPDoIGBY/1NqG/wCCDrYgQmrxNCMgD1i8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libxc: adjust string size calculations in xc_{,de,test_}assign_dt_device() Message-Id: Date: Wed, 01 Jul 2026 17:11:01 +0000 commit 873bc77d3d212484b66a1c8665a44f9dd86a2a41 Author: Jan Beulich AuthorDate: Wed Jul 1 14:10:10 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:10:10 2026 +0200 libxc: adjust string size calculations in xc_{,de,test_}assign_dt_device() In preparation for a hypervisor change also include the nul terminator in the size calculations. Signed-off-by: Jan Beulich Reviewed-by: Teddy Astie Reviewed-by: Juergen Gross Acked-by: Anthony PERARD --- tools/libs/ctrl/xc_domain.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/libs/ctrl/xc_domain.c b/tools/libs/ctrl/xc_domain.c index 01c0669c88..94cfab0fa1 100644 --- a/tools/libs/ctrl/xc_domain.c +++ b/tools/libs/ctrl/xc_domain.c @@ -1592,7 +1592,7 @@ int xc_assign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); @@ -1624,7 +1624,7 @@ int xc_test_assign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); @@ -1652,7 +1652,7 @@ int xc_deassign_dt_device( char *path) { int rc; - size_t size = strlen(path); + size_t size = strlen(path) + 1; struct xen_domctl domctl = {}; DECLARE_HYPERCALL_BOUNCE(path, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350275.1607775 (Exim 4.92) (envelope-from ) id 1weySu-0002JU-Vi; Wed, 01 Jul 2026 17:11:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350275.1607775; Wed, 01 Jul 2026 17:11:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weySu-0002JK-Sg; Wed, 01 Jul 2026 17:11:12 +0000 Received: by outflank-mailman (input) for mailman id 1350275; Wed, 01 Jul 2026 17:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weySt-0002J8-V6 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weySu-002BKm-0g for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weySt-0065xH-2r for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yxzzIqUXqWmK+uT9Fg43etdx2a26rqfN5lDbGH06JII=; b=z4cG6CVaWCXy2F2Q5o1xxQC+0U 2bJ2dsY+BFmKAfZ5ZWKOKdGqZv+mU/yzJFw/WHxGJsMkaJE5PeLxL5r2/KtQ8Sa8FKt4qQ24gJcmt dWSEDCVq2DTMhxVomk1xl0wArfVWmzyUltpc0oAT8DOTaQukoZ4NprfMug2BEtM5bS94=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libxc: adjust string size calculations in xc_flask_{getbool_byname,setbool}() Message-Id: Date: Wed, 01 Jul 2026 17:11:11 +0000 commit 40e93479999a9c6e227340fdb5ffa877292294bf Author: Jan Beulich AuthorDate: Wed Jul 1 14:10:46 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:10:46 2026 +0200 libxc: adjust string size calculations in xc_flask_{getbool_byname,setbool}() In preparation for a hypervisor change also include the nul terminator in the size calculations. (Note that xc_flask_getbool_byid() doesn't support FLASK_GETBOOL's "ID being -1" variant of operation, and hence doesn't need fiddling with. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Reviewed-by: Teddy Astie Acked-by: Anthony PERARD --- tools/libs/ctrl/xc_flask.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/libs/ctrl/xc_flask.c b/tools/libs/ctrl/xc_flask.c index 21ba697ad6..f5389dbd96 100644 --- a/tools/libs/ctrl/xc_flask.c +++ b/tools/libs/ctrl/xc_flask.c @@ -186,7 +186,8 @@ int xc_flask_getbool_byname(xc_interface *xch, char *name, int *curr, int *pend) { int rv; struct xen_flask_op op = {}; - DECLARE_HYPERCALL_BOUNCE(name, strlen(name), XC_HYPERCALL_BUFFER_BOUNCE_IN); + size_t size = strlen(name) + 1; + DECLARE_HYPERCALL_BOUNCE(name, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, name) ) { @@ -196,7 +197,7 @@ int xc_flask_getbool_byname(xc_interface *xch, char *name, int *curr, int *pend) op.cmd = FLASK_GETBOOL; op.u.boolean.bool_id = -1; - op.u.boolean.size = strlen(name); + op.u.boolean.size = size; set_xen_guest_handle(op.u.boolean.name, name); rv = xc_flask_op(xch, &op); @@ -218,7 +219,8 @@ int xc_flask_setbool(xc_interface *xch, char *name, int value, int commit) { int rv; struct xen_flask_op op = {}; - DECLARE_HYPERCALL_BOUNCE(name, strlen(name), XC_HYPERCALL_BUFFER_BOUNCE_IN); + size_t size = strlen(name) + 1; + DECLARE_HYPERCALL_BOUNCE(name, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, name) ) { @@ -230,7 +232,7 @@ int xc_flask_setbool(xc_interface *xch, char *name, int value, int commit) op.u.boolean.bool_id = -1; op.u.boolean.new_value = value; op.u.boolean.commit = 1; - op.u.boolean.size = strlen(name); + op.u.boolean.size = size; set_xen_guest_handle(op.u.boolean.name, name); rv = xc_flask_op(xch, &op); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350276.1607778 (Exim 4.92) (envelope-from ) id 1weyT6-0002Lg-0U; Wed, 01 Jul 2026 17:11:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350276.1607778; Wed, 01 Jul 2026 17:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyT5-0002LX-U4; Wed, 01 Jul 2026 17:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1350276; Wed, 01 Jul 2026 17:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyT4-0002LQ-20 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weyT4-002BKu-0z for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weyT3-0066Ga-3C for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KhI18jsExnPA1ct1thFpVt/7hTF0Yt6KYMgcHYKHSiU=; b=clF3fZN/KIQdkxp8C2JkPLXGle CrxueD0m2/J2QozLnGl/OLEgtA4zVwBLURbodxmYTZCDYVHsOYohPVAkZfFzkRGXwD8pAimIY9aql 1zbQB9USDNdyka11mj3ze6NL0YC9Cg/zHmO3tt2EpO8eb6N6r7H9UCgrvImy7MuyEmWc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/riscv: rename enum intc_version to intc_variant Message-Id: Date: Wed, 01 Jul 2026 17:11:21 +0000 commit 3375b70058dbdbc26121a1b38831430b53be7af3 Author: Oleksii Kurochko AuthorDate: Wed Jul 1 14:12:51 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:12:51 2026 +0200 xen/riscv: rename enum intc_version to intc_variant Rename the enum to intc_variant and the structure member from hw_version to hw_variant to better reflect that these values select between different controller variants, not versions of the same one. Requested-by: Jan Beulich Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/aplic.c | 2 +- xen/arch/riscv/include/asm/intc.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c index 739e8dab34..6a1255c5f4 100644 --- a/xen/arch/riscv/aplic.c +++ b/xen/arch/riscv/aplic.c @@ -35,7 +35,7 @@ static struct aplic_priv aplic = { }; static struct intc_info __ro_after_init aplic_info = { - .hw_version = INTC_APLIC, + .hw_variant = INTC_APLIC, }; static void __init aplic_init_hw_interrupts(void) diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h index ecdc8a5e65..675f703ec9 100644 --- a/xen/arch/riscv/include/asm/intc.h +++ b/xen/arch/riscv/include/asm/intc.h @@ -10,7 +10,7 @@ struct dt_device_node; -enum intc_version { +enum intc_variant { INTC_APLIC, }; @@ -18,7 +18,7 @@ struct cpu_user_regs; struct irq_desc; struct intc_info { - enum intc_version hw_version; + enum intc_variant hw_variant; const struct dt_device_node *node; /* number of irqs */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350277.1607783 (Exim 4.92) (envelope-from ) id 1weyTG-0002NV-2A; Wed, 01 Jul 2026 17:11:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350277.1607783; Wed, 01 Jul 2026 17:11:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTF-0002NO-VP; Wed, 01 Jul 2026 17:11:33 +0000 Received: by outflank-mailman (input) for mailman id 1350277; Wed, 01 Jul 2026 17:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTE-0002NH-7f for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weyTE-002BKy-1Z for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weyTE-0066Yc-0W for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AxC/ILi5NLdoiQVxsIJh/umgyyoaR5Oybmk2rO/5mdE=; b=5brB453UC7Z8xIrVNYFSUYuokS frD2LHlMDtC41DjuU/qLglVTJtuQZJ2GlnAQsYsM2eAiy3flTTIwlKIgaQR5cAFVFtKkVMIeD27tp vRXG/n39vNqP2SgjB/+vTxA3r9Gvq/BsSCezClDGJw8QkLPlZhyfGOepb3k3H9h102zo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] console+serial: don't open-code IRQ-safe locking primitives Message-Id: Date: Wed, 01 Jul 2026 17:11:32 +0000 commit 55ba831b14ea6f501c85974e0155169518b881ce Author: Jan Beulich AuthorDate: Wed Jul 1 14:13:59 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:13:59 2026 +0200 console+serial: don't open-code IRQ-safe locking primitives Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/drivers/char/console.c | 6 ++---- xen/drivers/char/serial.c | 11 +++-------- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index bcd6d26149..dbda7f2596 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -1010,8 +1010,7 @@ vprintk_common(const char *fmt, va_list args, const char *prefix) unsigned long flags; /* console_lock can be acquired recursively from __printk_ratelimit(). */ - local_irq_save(flags); - rspin_lock(&console_lock); + flags = rspin_lock_irqsave(&console_lock); state = &this_cpu(state); (void)vsnprintf(buf, sizeof(buf), fmt, args); @@ -1047,8 +1046,7 @@ vprintk_common(const char *fmt, va_list args, const char *prefix) state->continued = 1; } - rspin_unlock(&console_lock); - local_irq_restore(flags); + rspin_unlock_irqrestore(&console_lock, flags); } void vprintk(const char *fmt, va_list args) diff --git a/xen/drivers/char/serial.c b/xen/drivers/char/serial.c index adb312d796..bbbe758788 100644 --- a/xen/drivers/char/serial.c +++ b/xen/drivers/char/serial.c @@ -76,17 +76,15 @@ void serial_tx_interrupt(struct serial_port *port) int i, n; unsigned long flags; - local_irq_save(flags); - /* * Avoid spinning for a long time: if there is a long-term lock holder * then we know that they'll be stuffing bytes into the transmitter which * will therefore not be empty for long. */ - while ( !spin_trylock(&port->tx_lock) ) + while ( !spin_trylock_irqsave(&port->tx_lock, flags) ) { if ( port->driver->tx_ready(port) <= 0 ) - goto out; + return; cpu_relax(); } @@ -94,7 +92,6 @@ void serial_tx_interrupt(struct serial_port *port) { /* Disable TX. nothing to send */ serial_stop_tx(port); - spin_unlock(&port->tx_lock); goto out; } else @@ -112,10 +109,8 @@ void serial_tx_interrupt(struct serial_port *port) if ( i && port->driver->flush ) port->driver->flush(port); - spin_unlock(&port->tx_lock); - out: - local_irq_restore(flags); + spin_unlock_irqrestore(&port->tx_lock, flags); } static void __serial_putc(struct serial_port *port, char c) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350278.1607787 (Exim 4.92) (envelope-from ) id 1weyTQ-0002PV-3O; Wed, 01 Jul 2026 17:11:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350278.1607787; Wed, 01 Jul 2026 17:11:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTQ-0002PO-0g; Wed, 01 Jul 2026 17:11:44 +0000 Received: by outflank-mailman (input) for mailman id 1350278; Wed, 01 Jul 2026 17:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTO-0002PG-BP for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weyTO-002BL4-1w for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weyTO-0066tA-0s for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Orvb5FW2PB3cVPI8X2J5A7xGe8vxTTfAB5+4yRd7LSE=; b=wTGzfn+MTVFmkRfS3MrcFVAIgb Bos+XvUNDSo73DcwkWpg6edBSH9xo6ZWYrvlIgZFM51NiMuB1LH+KkUV6R96T4h9CsPAcBa5iGe06 /S17Tr12QWzI7UDdPl1yWAbUjgtkioQx9DiYyUEKMxB0lN2jlqfAgOZAXLcOYU5VxLDg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] domain: domlist_update_lock can be static Message-Id: Date: Wed, 01 Jul 2026 17:11:42 +0000 commit 0969fc9fa121a19a7ad7e1c286a22029d3cbecf4 Author: Jan Beulich AuthorDate: Wed Jul 1 14:14:30 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:14:30 2026 +0200 domain: domlist_update_lock can be static For a long time (if not forever) this lock has been referenced only from a single CU. Misra C:2012 rule 8.7 (which we didn't accept yet) wants us to have such identifiers non-external. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Oleksii Kurochko --- xen/common/domain.c | 2 +- xen/include/xen/sched.h | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 8f2bfcae28..53ac1d6c40 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -58,7 +58,7 @@ bool opt_dom0_vcpus_pin; boolean_param("dom0_vcpus_pin", opt_dom0_vcpus_pin); /* Protect updates/reads (resp.) of domain_list and domain_hash. */ -DEFINE_SPINLOCK(domlist_update_lock); +static DEFINE_SPINLOCK(domlist_update_lock); DEFINE_RCU_READ_LOCK(domlist_read_lock); #define DOMAIN_HASH_SIZE 256 diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h index 91f6db7a32..011292e9f7 100644 --- a/xen/include/xen/sched.h +++ b/xen/include/xen/sched.h @@ -697,8 +697,10 @@ static inline unsigned int domain_tot_pages(const struct domain *d) return d->tot_pages - d->extra_pages; } -/* Protect updates/reads (resp.) of domain_list and domain_hash. */ -extern spinlock_t domlist_update_lock; +/* + * Protect updates/reads (resp.) of domain_list and domain_hash, together with + * domlist_update_lock. + */ extern rcu_read_lock_t domlist_read_lock; extern struct vcpu *idle_vcpu[NR_CPUS]; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:11:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:11:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350279.1607790 (Exim 4.92) (envelope-from ) id 1weyTa-0002RQ-4t; Wed, 01 Jul 2026 17:11:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350279.1607790; Wed, 01 Jul 2026 17:11:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTa-0002RH-2C; Wed, 01 Jul 2026 17:11:54 +0000 Received: by outflank-mailman (input) for mailman id 1350279; Wed, 01 Jul 2026 17:11:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTY-0002RB-FW for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weyTY-002BLO-2M for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weyTY-0067B2-1G for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:11:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yLaM5a+hbSFo4YBQz1ZaP66lbRtsr8FhcpY4xOm1CJU=; b=bXdyb4gR5fyVEePuh0mJAe/3eS xPnOQC3KBwt8l2l961fsjUntUdaFIExnvfIIi12589d7/4rlXFu+BqD7QW1ee5I6JNjzuSOfnq+wI NFBaLHqlyV20UEtVGk0il2bhZCQmBzetFcwLZbzDgOpk2D/8DyUUQnVBEl7PNx/AyrZQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xmalloc: drop pool list Message-Id: Date: Wed, 01 Jul 2026 17:11:52 +0000 commit 2dc805ceae42b23ee3fdff9fac0848bf6ffbbc38 Author: Jan Beulich AuthorDate: Wed Jul 1 14:14:59 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:14:59 2026 +0200 xmalloc: drop pool list From its introduction it has been used solely to add and remove pools. No list traversal or alike did ever occur. Drop all of this as being dead code. Signed-off-by: Jan Beulich Reviewed-by: Oleksii Kurochko Reviewed-by: Andrew Cooper --- xen/common/xmalloc_tlsf.c | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/xen/common/xmalloc_tlsf.c b/xen/common/xmalloc_tlsf.c index 5e55fc463e..b43219b4af 100644 --- a/xen/common/xmalloc_tlsf.c +++ b/xen/common/xmalloc_tlsf.c @@ -66,9 +66,6 @@ #define PREV_FREE (0x2) #define PREV_USED (0x0) -static DEFINE_SPINLOCK(pool_list_lock); -static LIST_HEAD(pool_list_head); - struct free_ptr { struct bhdr *prev; struct bhdr *next; @@ -113,8 +110,6 @@ struct xmem_pool { xmem_pool_get_memory *get_mem; xmem_pool_put_memory *put_mem; - struct list_head list; - char name[MAX_POOL_NAME_LEN]; }; @@ -340,10 +335,6 @@ struct xmem_pool *xmem_pool_create( spin_lock_init(&pool->lock); - spin_lock(&pool_list_lock); - list_add_tail(&pool->list, &pool_list_head); - spin_unlock(&pool_list_lock); - return pool; } @@ -373,10 +364,6 @@ void xmem_pool_destroy(struct xmem_pool *pool) "%lu bytes still in use.\n", pool->name, pool, xmem_pool_get_used_size(pool)); - spin_lock(&pool_list_lock); - list_del_init(&pool->list); - spin_unlock(&pool_list_lock); - pool_bytes = ROUNDUP_SIZE(sizeof(*pool)); pool_order = get_order_from_bytes(pool_bytes); free_xenheap_pages(pool,pool_order); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 01 17:12:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 01 Jul 2026 17:12:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1350280.1607795 (Exim 4.92) (envelope-from ) id 1weyTk-0002TK-6H; Wed, 01 Jul 2026 17:12:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1350280.1607795; Wed, 01 Jul 2026 17:12:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTk-0002TC-3W; Wed, 01 Jul 2026 17:12:04 +0000 Received: by outflank-mailman (input) for mailman id 1350280; Wed, 01 Jul 2026 17:12:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1weyTi-0002T5-I9 for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:12:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1weyTi-002BLd-2c for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:12:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1weyTi-0067WI-1d for xen-changelog@lists.xenproject.org; Wed, 01 Jul 2026 17:12:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=N45C1v50NbVSN9MwvrRRtoiJy1MkFGyF0yiLZ3Ki+ao=; b=dbnXUIyRjmppBV91gHo6QcxE3f CfLFTUpRCBHovEkNaTi3egNRi8s5JVwOLRLP5fmr4EScMixu9/ZjP8bmoexR24sTTX2JaMfRKx9DB DK4b/H1BeDgCVz4SrnGpxEmzU/qkjCXYO0cZqlAWgZsYnPetoJxqV5uycduchwALTRGo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] hypercall: mmuext_op is PV-only Message-Id: Date: Wed, 01 Jul 2026 17:12:02 +0000 commit 5db702e3b21d2dd1a9094db71596d557f4a6d672 Author: Jan Beulich AuthorDate: Wed Jul 1 14:15:17 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 1 14:15:17 2026 +0200 hypercall: mmuext_op is PV-only In a !PV configuration the functions aren't built. Hence we're better off also not declaring them. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné --- xen/include/hypercall-defs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c index 63755bb8df..a625d634b6 100644 --- a/xen/include/hypercall-defs.c +++ b/xen/include/hypercall-defs.c @@ -137,7 +137,9 @@ memory_op(unsigned int cmd, void *arg) #ifdef CONFIG_IOREQ_SERVER dm_op(domid_t domid, unsigned int nr_bufs, void *bufs) #endif +#ifdef CONFIG_PV mmuext_op(void *arg, unsigned int count, uint *pdone, unsigned int foreigndom) +#endif #ifdef CONFIG_PV32 set_trap_table(trap_info_compat_t *traps) set_gdt(unsigned int *frame_list, unsigned int entries) @@ -168,9 +170,9 @@ set_timer_op(s_time_t timeout) console_io(unsigned int cmd, unsigned int count, char *buffer) vm_assist(unsigned int cmd, unsigned int type) event_channel_op(int cmd, void *arg) -mmuext_op(mmuext_op_t *uops, unsigned int count, unsigned int *pdone, unsigned int foreigndom) multicall(multicall_entry_t *call_list, unsigned long nr_calls) #ifdef CONFIG_PV +mmuext_op(mmuext_op_t *uops, unsigned int count, unsigned int *pdone, unsigned int foreigndom) mmu_update(mmu_update_t *ureqs, unsigned int count, unsigned int *pdone, unsigned int foreigndom) stack_switch(unsigned long ss, unsigned long esp) fpu_taskswitch(int set) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 02 09:00:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 02 Jul 2026 09:00:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1351428.1608593 (Exim 4.92) (envelope-from ) id 1wfDHA-0000Ek-BH; Thu, 02 Jul 2026 09:00:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1351428.1608593; Thu, 02 Jul 2026 09:00:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHA-0000EB-84; Thu, 02 Jul 2026 09:00:04 +0000 Received: by outflank-mailman (input) for mailman id 1351428; Thu, 02 Jul 2026 09:00:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDH8-0008Ib-ET for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfDH8-003d89-1y for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfDH8-000xUN-0u for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=gcGZWgdk7QUvTopfi4qkR+0wE9llxLsJmnvBI5qmijs=; b=4CyKmt435bDMkf6Gc1lLKDxTUH k5fq7Sy1axxqQeC0zIRHMDKhdR6ljw0v3ta/w+xNRxlVITGltrGyd+4YcEf2PK5WUMLFn/BjAGUPw J64A9SnG+BcolL2oLLzLEmpnaLsP8dOJwgceNLCx5CE8CLQp278JdGolP+nFEJ4pfO1w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] ns16550: properly initialize booleans in uart_param[] Message-Id: Date: Thu, 02 Jul 2026 09:00:02 +0000 commit 7c4b5d01cd218c753b3aef81b5d32496373e8e91 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:45:17 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:45:17 2026 +0200 ns16550: properly initialize booleans in uart_param[] .bar0 and .mmio in struct ns16550_config_param are booleans, hence they should be initialized with "true", not "1". No functional change. Signed-off-by: Jiaqing Zhao Reviewed-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/ns16550.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index a371bc5cc8..48c9016246 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -786,7 +786,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = (UART_LSR_THRE | UART_LSR_TEMT), - .mmio = 1, + .mmio = true, .max_ports = 1, }, [param_oxford] = { @@ -796,7 +796,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .mmio = 1, + .mmio = true, .max_ports = 1, /* It can do more, but we would need more custom code.*/ }, [param_oxford_2port] = { @@ -806,7 +806,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .mmio = 1, + .mmio = true, .max_ports = 2, }, [param_pericom_1port] = { @@ -815,7 +815,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 1, }, [param_pericom_2port] = { @@ -824,7 +824,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 2, }, /* @@ -837,7 +837,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 4, }, [param_pericom_8port] = { @@ -846,7 +846,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 8, }, [param_exar_xr17v352] = { @@ -855,8 +855,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 2, }, [param_exar_xr17v354] = { @@ -865,8 +865,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 4, }, [param_exar_xr17v358] = { @@ -875,8 +875,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 8, }, [param_intel_lpss] = { @@ -885,8 +885,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 64, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 1, }, }; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 02 09:00:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 02 Jul 2026 09:00:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1351430.1608596 (Exim 4.92) (envelope-from ) id 1wfDHJ-0000gM-Dv; Thu, 02 Jul 2026 09:00:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1351430.1608596; Thu, 02 Jul 2026 09:00:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHJ-0000gE-B4; Thu, 02 Jul 2026 09:00:13 +0000 Received: by outflank-mailman (input) for mailman id 1351430; Thu, 02 Jul 2026 09:00:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHI-0000g2-F5 for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfDHI-003d9s-2J for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfDHI-000xhu-1G for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=J9Lt8GTn/cmkVorC6vdwTNfLCvQx6f5X23J8OBqIP9s=; b=VuAk6gxGqqW/Th9edAgwfobhe3 UmEiRnrifqtE89qNpl+hULVc+x9bjPRArV70ihi1ZmTkcy/+HTXDTuQttizAi+ISZTJZJGOSDAdlC oKqPIyEj84N8BIoprgHouFgy/LM+8dLtarei6YFX55Gd1Ssk3OVglTTUSnDB6KxZyMPo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] ns16550: add support for WCH CH382 serial adapters Message-Id: Date: Thu, 02 Jul 2026 09:00:12 +0000 commit 6029b683321382c4bf4dec859980c01ff3109561 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:45:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:45:43 2026 +0200 ns16550: add support for WCH CH382 serial adapters Add support for the WCH (Nanjing Qinheng Microelectronics Co., Ltd.) CH382 PCIe dual port serial adapter. The CH382 is available in two variants: - CH382 2S [1c00:3253]: 2 serial ports - CH382 2S1P [1c00:3250]: 2 serial ports + 1 parallel port This chip uses IO BAR0, base baud rate 115200, ports starting at offset 0xc0 and spaced 8 bytes apart, and a 256-byte FIFO. [1] [1] https://www.wch-ic.com/downloads/CH382DS1_PDF.html Signed-off-by: Jiaqing Zhao Reviewed-by: Denis Mukhin Reviewed-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/drivers/char/ns16550.c | 23 +++++++++++++++++++++++ xen/include/xen/pci_ids.h | 2 ++ 2 files changed, 25 insertions(+) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 48c9016246..916bb7325e 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -96,6 +96,7 @@ struct ns16550_config { param_exar_xr17v354, param_exar_xr17v358, param_intel_lpss, + param_wch_ch382, } param; }; @@ -889,6 +890,16 @@ static const struct ns16550_config_param __initconst uart_param[] = { .mmio = true, .max_ports = 1, }, + [param_wch_ch382] = { + .base_baud = 115200, + .first_offset = 0xc0, + .uart_offset = 8, + .reg_width = 1, + .fifo_size = 256, + .lsr_mask = UART_LSR_THRE, + .bar0 = true, + .max_ports = 2, + }, }; static const struct ns16550_config __initconst uart_config[] = @@ -1217,6 +1228,18 @@ static const struct ns16550_config __initconst uart_config[] = .dev_id = 0x7adc, .param = param_intel_lpss }, + /* WCH CH382 2S1P */ + { + .vendor_id = PCI_VENDOR_ID_WCHIC, + .dev_id = 0x3250, + .param = param_wch_ch382 + }, + /* WCH CH382 2S */ + { + .vendor_id = PCI_VENDOR_ID_WCHIC, + .dev_id = 0x3253, + .param = param_wch_ch382 + }, }; static int __init diff --git a/xen/include/xen/pci_ids.h b/xen/include/xen/pci_ids.h index 5884a20b8f..15e938225c 100644 --- a/xen/include/xen/pci_ids.h +++ b/xen/include/xen/pci_ids.h @@ -13,6 +13,8 @@ #define PCI_VENDOR_ID_BROADCOM 0x14e4 +#define PCI_VENDOR_ID_WCHIC 0x1c00 + #define PCI_VENDOR_ID_INTEL 0x8086 #endif /* XEN_PCI_IDS_H */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 02 09:00:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 02 Jul 2026 09:00:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1351431.1608601 (Exim 4.92) (envelope-from ) id 1wfDHU-0000jL-Ep; Thu, 02 Jul 2026 09:00:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1351431.1608601; Thu, 02 Jul 2026 09:00:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHU-0000jD-CL; Thu, 02 Jul 2026 09:00:24 +0000 Received: by outflank-mailman (input) for mailman id 1351431; Thu, 02 Jul 2026 09:00:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHS-0000ix-IH for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfDHS-003dAb-2c for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfDHS-000xt1-1c for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jfem+oP+znvLRqS2qiihPiBJa7mPRhSOFQhF543JbBQ=; b=QvKvddFyGsMXOy2xteN3p+3JR9 6cM/vGVCbXKX7qGaR42peRdKo5ahTAJ0bhmWG4PS08lWXTl4BEL5gOGbiT1yYG48fLHBxCqGceBLL dVXNxiFQD2l141d7vnDLfyJuRN5QmdaxmqBVYekcjh807keZNzvG6QNnwy0OXQ8mGQ3k=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] ns16550: add support for ASIX AX99100 PCIe Multi-I/O controller Message-Id: Date: Thu, 02 Jul 2026 09:00:22 +0000 commit d1f70074a59d3ee267c9462d3bef45e44be5bff6 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:46:12 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:46:12 2026 +0200 ns16550: add support for ASIX AX99100 PCIe Multi-I/O controller Add a PCI device table entry and matching parameter for the ASIX AX99100 PCIe to Multi-I/O controller [125b:9910]. Each port on the chip is a standalone PCI function, with UART registers on its I/O BAR0. Signed-off-by: Jiaqing Zhao Reviewed-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/drivers/char/ns16550.c | 15 +++++++++++++++ xen/include/xen/pci_ids.h | 2 ++ 2 files changed, 17 insertions(+) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 916bb7325e..120ac09d23 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -97,6 +97,7 @@ struct ns16550_config { param_exar_xr17v358, param_intel_lpss, param_wch_ch382, + param_asix, } param; }; @@ -900,6 +901,14 @@ static const struct ns16550_config_param __initconst uart_param[] = { .bar0 = true, .max_ports = 2, }, + [param_asix] = { + .base_baud = 115200, + .reg_width = 1, + .fifo_size = 256, + .lsr_mask = UART_LSR_THRE, + .bar0 = true, + .max_ports = 1, + }, }; static const struct ns16550_config __initconst uart_config[] = @@ -1240,6 +1249,12 @@ static const struct ns16550_config __initconst uart_config[] = .dev_id = 0x3253, .param = param_wch_ch382 }, + /* ASIX AX99100 PCIe to Multi I/O Controller */ + { + .vendor_id = PCI_VENDOR_ID_ASIX, + .dev_id = 0x9910, + .param = param_asix + }, }; static int __init diff --git a/xen/include/xen/pci_ids.h b/xen/include/xen/pci_ids.h index 15e938225c..fd424ef55d 100644 --- a/xen/include/xen/pci_ids.h +++ b/xen/include/xen/pci_ids.h @@ -5,6 +5,8 @@ #define PCI_VENDOR_ID_NVIDIA 0x10de +#define PCI_VENDOR_ID_ASIX 0x125b + #define PCI_VENDOR_ID_PERICOM 0x12d8 #define PCI_VENDOR_ID_EXAR 0x13a8 -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 02 09:00:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 02 Jul 2026 09:00:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1351432.1608605 (Exim 4.92) (envelope-from ) id 1wfDHe-0000mb-Gr; Thu, 02 Jul 2026 09:00:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1351432.1608605; Thu, 02 Jul 2026 09:00:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHe-0000mT-Df; Thu, 02 Jul 2026 09:00:34 +0000 Received: by outflank-mailman (input) for mailman id 1351432; Thu, 02 Jul 2026 09:00:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfDHc-0000lA-Mr for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfDHc-003dAs-36 for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfDHc-000y5R-23 for xen-changelog@lists.xenproject.org; Thu, 02 Jul 2026 09:00:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PXRfpT+xmY5tN7GVJPfdrGkN80+eSLTpPsrH4HnSIUg=; b=TOfooAHu5KXomCVqSdx45Ax6ae OHhXxxUazCWb3MO/3jvF9uArreo2C6JfN5M/h2b1PUcB6xUKc7xRna5ixJbHc/MUVe3Md3E0TFid0 jPDQ15SMt4KejK7ItUyyYsSYJxsQWXQIlIT7OkHbJQc5aC08sJ9vSY3tT1s2aGKCLRkU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/xen-hvmctx: shorten various format strings a little Message-Id: Date: Thu, 02 Jul 2026 09:00:32 +0000 commit ad9f564a5d840389cbf1b230086e1dd8257d8820 Author: Jan Beulich AuthorDate: Thu Jul 2 08:46:34 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:46:34 2026 +0200 tools/xen-hvmctx: shorten various format strings a little %4.4x and alike format specifiers can be expressed shorter as %04x or, as e.g. dump_ioapic() has it, %.4x. In dump_fpu()'s XMM register dumping, also move away from showing bogus xmm03 and alike. The proper register name is xmm3 for that particular example. Also strip trailing whitespace from lines touched. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Acked-by: Anthony PERARD --- tools/misc/xen-hvmctx.c | 56 ++++++++++++++++++++++++------------------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/tools/misc/xen-hvmctx.c b/tools/misc/xen-hvmctx.c index 4f336a6cea..ecb7f054be 100644 --- a/tools/misc/xen-hvmctx.c +++ b/tools/misc/xen-hvmctx.c @@ -107,26 +107,26 @@ static void dump_fpu(void *p) struct fpu_regs *r = p; int i; - printf(" FPU: fcw 0x%4.4x fsw 0x%4.4x\n" - " ftw 0x%2.2x (0x%2.2x) fop 0x%4.4x\n" - " fpuip 0x%16.16"PRIx64" fpudp 0x%16.16"PRIx64"\n" - " mxcsr 0x%8.8lx mask 0x%8.8lx\n", + printf(" FPU: fcw 0x%04x fsw 0x%04x\n" + " ftw 0x%02x (0x%02x) fop 0x%04x\n" + " fpuip 0x%016"PRIx64" fpudp 0x%016"PRIx64"\n" + " mxcsr 0x%08lx mask 0x%08lx\n", (unsigned)r->fcw, (unsigned)r->fsw, (unsigned)r->ftw, (unsigned)r->res0, (unsigned)r->fop, r->fpuip, r->fpudp, (unsigned long)r->mxcsr, (unsigned long)r->mxcsr_mask); for ( i = 0 ; i < 8 ; i++ ) - printf(" mm%i 0x%4.4x%16.16"PRIx64" (0x%4.4x%4.4x%4.4x)\n", + printf(" mm%i 0x%04x%016"PRIx64" (0x%04x%04x%04x)\n", i, r->mm[i].hi, r->mm[i].lo, r->mm[i].pad[2], r->mm[i].pad[1], r->mm[i].pad[0]); for ( i = 0 ; i < 16 ; i++ ) - printf(" xmm%2.2i 0x%16.16"PRIx64"%16.16"PRIx64"\n", + printf(" xmm%-2i 0x%016"PRIx64"%016"PRIx64"\n", i, r->xmm[i].hi, r->xmm[i].lo); for ( i = 0 ; i < 6 ; i++ ) - printf(" (0x%16.16"PRIx64"%16.16"PRIx64")\n", + printf(" (0x%016"PRIx64"%016"PRIx64")\n", r->res1[2*i+1], r->res1[2*i]); } @@ -134,20 +134,20 @@ static void dump_cpu(void) { HVM_SAVE_TYPE(CPU) c; READ(c); - printf(" CPU: rax 0x%16.16llx rbx 0x%16.16llx\n" - " rcx 0x%16.16llx rdx 0x%16.16llx\n" - " rbp 0x%16.16llx rsi 0x%16.16llx\n" - " rdi 0x%16.16llx rsp 0x%16.16llx\n" - " r8 0x%16.16llx r9 0x%16.16llx\n" - " r10 0x%16.16llx r11 0x%16.16llx\n" - " r12 0x%16.16llx r13 0x%16.16llx\n" - " r14 0x%16.16llx r15 0x%16.16llx\n" - " rip 0x%16.16llx rflags 0x%16.16llx\n" - " cr0 0x%16.16llx cr2 0x%16.16llx\n" - " cr3 0x%16.16llx cr4 0x%16.16llx\n" - " dr0 0x%16.16llx dr1 0x%16.16llx\n" - " dr2 0x%16.16llx dr3 0x%16.16llx\n" - " dr6 0x%16.16llx dr7 0x%16.16llx\n" + printf(" CPU: rax 0x%016llx rbx 0x%016llx\n" + " rcx 0x%016llx rdx 0x%016llx\n" + " rbp 0x%016llx rsi 0x%016llx\n" + " rdi 0x%016llx rsp 0x%016llx\n" + " r8 0x%016llx r9 0x%016llx\n" + " r10 0x%016llx r11 0x%016llx\n" + " r12 0x%016llx r13 0x%016llx\n" + " r14 0x%016llx r15 0x%016llx\n" + " rip 0x%016llx rflags 0x%016llx\n" + " cr0 0x%016llx cr2 0x%016llx\n" + " cr3 0x%016llx cr4 0x%016llx\n" + " dr0 0x%016llx dr1 0x%016llx\n" + " dr2 0x%016llx dr3 0x%016llx\n" + " dr6 0x%016llx dr7 0x%016llx\n" " cs %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" " es %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" " ds %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" @@ -158,12 +158,12 @@ static void dump_cpu(void) " ldtr %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.4" PRIx32 " / %#7.4" PRIx32 ")\n" " idtr (%#18.8" PRIx64 " + %#10.4" PRIx32 ")\n" " gdtr (%#18.8" PRIx64 " + %#10.4" PRIx32 ")\n" - " sysenter cs 0x%8.8llx eip 0x%16.16llx esp 0x%16.16llx\n" + " sysenter cs 0x%08llx eip 0x%016llx esp 0x%016llx\n" " shadow gs %#18.16" PRIx64 " efer %#18.8" PRIx64 "\n" " lstar %#18.16" PRIx64 " cstar %#18.16" PRIx64 "\n" " star %#18.16" PRIx64 " sfmask %#18.8" PRIx64 "\n" - " tsc 0x%16.16llx\n" - " event 0x%8.8lx error 0x%8.8lx\n", + " tsc 0x%016llx\n" + " event 0x%08lx error 0x%08lx\n", (unsigned long long) c.rax, (unsigned long long) c.rbx, (unsigned long long) c.rcx, (unsigned long long) c.rdx, (unsigned long long) c.rbp, (unsigned long long) c.rsi, @@ -260,7 +260,7 @@ static void dump_pci_irq(void) { HVM_SAVE_TYPE(PCI_IRQ) i; READ(i); - printf(" PCI IRQs: 0x%16.16llx%16.16llx\n", + printf(" PCI IRQs: 0x%016llx%016llx\n", (unsigned long long) i.pad[0], (unsigned long long) i.pad[1]); } @@ -268,7 +268,7 @@ static void dump_isa_irq(void) { HVM_SAVE_TYPE(ISA_IRQ) i; READ(i); - printf(" ISA IRQs: 0x%4.4llx\n", + printf(" ISA IRQs: 0x%04llx\n", (unsigned long long) i.pad[0]); } @@ -305,10 +305,10 @@ static void dump_rtc(void) { HVM_SAVE_TYPE(RTC) r; READ(r); - printf(" RTC: regs 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", + printf(" RTC: regs 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x\n", r.cmos_data[0], r.cmos_data[1], r.cmos_data[2], r.cmos_data[3], r.cmos_data[4], r.cmos_data[5], r.cmos_data[6], r.cmos_data[7]); - printf(" 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x, index 0x%2.2x\n", + printf(" 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x, index 0x%02x\n", r.cmos_data[8], r.cmos_data[9], r.cmos_data[10], r.cmos_data[11], r.cmos_data[12], r.cmos_data[13], r.cmos_index); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 06:33:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 06:33:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1352865.1609176 (Exim 4.92) (envelope-from ) id 1wfXSR-0007eU-Mg; Fri, 03 Jul 2026 06:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1352865.1609176; Fri, 03 Jul 2026 06:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSR-0007eL-Jz; Fri, 03 Jul 2026 06:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1352865; Fri, 03 Jul 2026 06:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSQ-0007eF-1Z for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfXSQ-0058ik-0A for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfXSP-008L0w-22 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RPpIKc/ZEo+hJIawDjOZ0sBnDOTixF0S9QS4aaiqL0c=; b=Q+tn0CV+rJZBN5bBeyFkV9j8kq 0DG4TiwEeQEon3mkaetZqWoTI4u131toGJ6/9tKIFeKvydMRV7yq1Zx0TVGnuz1Gq+rqrUM/xRaCj wYJhuZOtgFdGn/CvB4+eyDmHoCB96Wp/qqa3U4+ZZB5D2utOIylerWQBAjE7P9My9IEw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] ns16550: properly initialize booleans in uart_param[] Message-Id: Date: Fri, 03 Jul 2026 06:33:01 +0000 commit 7c4b5d01cd218c753b3aef81b5d32496373e8e91 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:45:17 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:45:17 2026 +0200 ns16550: properly initialize booleans in uart_param[] .bar0 and .mmio in struct ns16550_config_param are booleans, hence they should be initialized with "true", not "1". No functional change. Signed-off-by: Jiaqing Zhao Reviewed-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/ns16550.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index a371bc5cc8..48c9016246 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -786,7 +786,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = (UART_LSR_THRE | UART_LSR_TEMT), - .mmio = 1, + .mmio = true, .max_ports = 1, }, [param_oxford] = { @@ -796,7 +796,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .mmio = 1, + .mmio = true, .max_ports = 1, /* It can do more, but we would need more custom code.*/ }, [param_oxford_2port] = { @@ -806,7 +806,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .mmio = 1, + .mmio = true, .max_ports = 2, }, [param_pericom_1port] = { @@ -815,7 +815,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 1, }, [param_pericom_2port] = { @@ -824,7 +824,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 2, }, /* @@ -837,7 +837,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 4, }, [param_pericom_8port] = { @@ -846,7 +846,7 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 16, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, + .bar0 = true, .max_ports = 8, }, [param_exar_xr17v352] = { @@ -855,8 +855,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 2, }, [param_exar_xr17v354] = { @@ -865,8 +865,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 4, }, [param_exar_xr17v358] = { @@ -875,8 +875,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 256, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 8, }, [param_intel_lpss] = { @@ -885,8 +885,8 @@ static const struct ns16550_config_param __initconst uart_param[] = { .reg_width = 1, .fifo_size = 64, .lsr_mask = UART_LSR_THRE, - .bar0 = 1, - .mmio = 1, + .bar0 = true, + .mmio = true, .max_ports = 1, }, }; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 06:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 06:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1352866.1609179 (Exim 4.92) (envelope-from ) id 1wfXSb-0007g4-Nx; Fri, 03 Jul 2026 06:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1352866.1609179; Fri, 03 Jul 2026 06:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSb-0007fx-LI; Fri, 03 Jul 2026 06:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1352866; Fri, 03 Jul 2026 06:33:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSZ-0007fj-TD for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfXSa-0058io-0U for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfXSZ-008L7A-2h for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jfIUQlGjKs82lDy9iW25ZxMaKy4kl/encVK0jtktxnE=; b=mCY1EIgLZIB6+2//2ZQ9m7hwfb T57aweNTqFEozmLkIAg7AbzGCTqkIaI4R3r71NRI4ZdYY9t3pACJeuif7zbycANqT3+1vpj33WHiv EoKMcyaAVlCU5azXJ/bArhPan1QMMnUE2G4csdrUk8QnEkoKtXda9lalTOTol88mZl38=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] ns16550: add support for WCH CH382 serial adapters Message-Id: Date: Fri, 03 Jul 2026 06:33:11 +0000 commit 6029b683321382c4bf4dec859980c01ff3109561 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:45:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:45:43 2026 +0200 ns16550: add support for WCH CH382 serial adapters Add support for the WCH (Nanjing Qinheng Microelectronics Co., Ltd.) CH382 PCIe dual port serial adapter. The CH382 is available in two variants: - CH382 2S [1c00:3253]: 2 serial ports - CH382 2S1P [1c00:3250]: 2 serial ports + 1 parallel port This chip uses IO BAR0, base baud rate 115200, ports starting at offset 0xc0 and spaced 8 bytes apart, and a 256-byte FIFO. [1] [1] https://www.wch-ic.com/downloads/CH382DS1_PDF.html Signed-off-by: Jiaqing Zhao Reviewed-by: Denis Mukhin Reviewed-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/drivers/char/ns16550.c | 23 +++++++++++++++++++++++ xen/include/xen/pci_ids.h | 2 ++ 2 files changed, 25 insertions(+) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 48c9016246..916bb7325e 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -96,6 +96,7 @@ struct ns16550_config { param_exar_xr17v354, param_exar_xr17v358, param_intel_lpss, + param_wch_ch382, } param; }; @@ -889,6 +890,16 @@ static const struct ns16550_config_param __initconst uart_param[] = { .mmio = true, .max_ports = 1, }, + [param_wch_ch382] = { + .base_baud = 115200, + .first_offset = 0xc0, + .uart_offset = 8, + .reg_width = 1, + .fifo_size = 256, + .lsr_mask = UART_LSR_THRE, + .bar0 = true, + .max_ports = 2, + }, }; static const struct ns16550_config __initconst uart_config[] = @@ -1217,6 +1228,18 @@ static const struct ns16550_config __initconst uart_config[] = .dev_id = 0x7adc, .param = param_intel_lpss }, + /* WCH CH382 2S1P */ + { + .vendor_id = PCI_VENDOR_ID_WCHIC, + .dev_id = 0x3250, + .param = param_wch_ch382 + }, + /* WCH CH382 2S */ + { + .vendor_id = PCI_VENDOR_ID_WCHIC, + .dev_id = 0x3253, + .param = param_wch_ch382 + }, }; static int __init diff --git a/xen/include/xen/pci_ids.h b/xen/include/xen/pci_ids.h index 5884a20b8f..15e938225c 100644 --- a/xen/include/xen/pci_ids.h +++ b/xen/include/xen/pci_ids.h @@ -13,6 +13,8 @@ #define PCI_VENDOR_ID_BROADCOM 0x14e4 +#define PCI_VENDOR_ID_WCHIC 0x1c00 + #define PCI_VENDOR_ID_INTEL 0x8086 #endif /* XEN_PCI_IDS_H */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 06:33:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 06:33:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1352867.1609184 (Exim 4.92) (envelope-from ) id 1wfXSl-0007iG-PL; Fri, 03 Jul 2026 06:33:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1352867.1609184; Fri, 03 Jul 2026 06:33:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSl-0007i8-Mb; Fri, 03 Jul 2026 06:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1352867; Fri, 03 Jul 2026 06:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSk-0007i0-23 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfXSk-0058jD-0y for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfXSj-008LDU-2z for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=DLhIvxwE9oiE6nsB7WCH3ukQxdmDlWoaNCCg2QpEx2g=; b=Z5E6OVJI1QVZHyHggJ4U14SxIY FA1ZAdEHwGK+BoQF5dBC1NDpoi42kBWNyarzLCo/dB89CI3i2GNvMlY23c/hoN33L7lywvg1IltDi I1RlBmIPZD7FwWC1hORyOxzs6RVJ6YZ+lUujrFofjQGRNye5bPS/FjSkDr71IZBPjpYg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] ns16550: add support for ASIX AX99100 PCIe Multi-I/O controller Message-Id: Date: Fri, 03 Jul 2026 06:33:21 +0000 commit d1f70074a59d3ee267c9462d3bef45e44be5bff6 Author: Jiaqing Zhao AuthorDate: Thu Jul 2 08:46:12 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:46:12 2026 +0200 ns16550: add support for ASIX AX99100 PCIe Multi-I/O controller Add a PCI device table entry and matching parameter for the ASIX AX99100 PCIe to Multi-I/O controller [125b:9910]. Each port on the chip is a standalone PCI function, with UART registers on its I/O BAR0. Signed-off-by: Jiaqing Zhao Reviewed-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/drivers/char/ns16550.c | 15 +++++++++++++++ xen/include/xen/pci_ids.h | 2 ++ 2 files changed, 17 insertions(+) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 916bb7325e..120ac09d23 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -97,6 +97,7 @@ struct ns16550_config { param_exar_xr17v358, param_intel_lpss, param_wch_ch382, + param_asix, } param; }; @@ -900,6 +901,14 @@ static const struct ns16550_config_param __initconst uart_param[] = { .bar0 = true, .max_ports = 2, }, + [param_asix] = { + .base_baud = 115200, + .reg_width = 1, + .fifo_size = 256, + .lsr_mask = UART_LSR_THRE, + .bar0 = true, + .max_ports = 1, + }, }; static const struct ns16550_config __initconst uart_config[] = @@ -1240,6 +1249,12 @@ static const struct ns16550_config __initconst uart_config[] = .dev_id = 0x3253, .param = param_wch_ch382 }, + /* ASIX AX99100 PCIe to Multi I/O Controller */ + { + .vendor_id = PCI_VENDOR_ID_ASIX, + .dev_id = 0x9910, + .param = param_asix + }, }; static int __init diff --git a/xen/include/xen/pci_ids.h b/xen/include/xen/pci_ids.h index 15e938225c..fd424ef55d 100644 --- a/xen/include/xen/pci_ids.h +++ b/xen/include/xen/pci_ids.h @@ -5,6 +5,8 @@ #define PCI_VENDOR_ID_NVIDIA 0x10de +#define PCI_VENDOR_ID_ASIX 0x125b + #define PCI_VENDOR_ID_PERICOM 0x12d8 #define PCI_VENDOR_ID_EXAR 0x13a8 -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 06:33:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 06:33:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1352868.1609187 (Exim 4.92) (envelope-from ) id 1wfXSv-0007kD-QT; Fri, 03 Jul 2026 06:33:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1352868.1609187; Fri, 03 Jul 2026 06:33:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSv-0007k5-Nz; Fri, 03 Jul 2026 06:33:33 +0000 Received: by outflank-mailman (input) for mailman id 1352868; Fri, 03 Jul 2026 06:33:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfXSu-0007jx-8B for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfXSu-0058jH-1Q for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfXSu-008LIN-0G for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 06:33:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TYuQuI+lO5u34qVRGjJqhEllNnfDO9nlWPbjazZ0QGQ=; b=toCe9KTZRD+FT72Rf+lUQwmnqY aEOzY+cOlWNcB81fN7pAC6KX14SMC6dpnj6IekzxhlqChiCb/lqq+FAjuIZFIBqnWtp7pvocCEDGs rBFswusMYJTxp5Q3MckWDFqSQ/jwzXPH9zcKP24WnGLryXFsbVGqKMPE3GFZHGuhuzdQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/xen-hvmctx: shorten various format strings a little Message-Id: Date: Fri, 03 Jul 2026 06:33:32 +0000 commit ad9f564a5d840389cbf1b230086e1dd8257d8820 Author: Jan Beulich AuthorDate: Thu Jul 2 08:46:34 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 2 08:46:34 2026 +0200 tools/xen-hvmctx: shorten various format strings a little %4.4x and alike format specifiers can be expressed shorter as %04x or, as e.g. dump_ioapic() has it, %.4x. In dump_fpu()'s XMM register dumping, also move away from showing bogus xmm03 and alike. The proper register name is xmm3 for that particular example. Also strip trailing whitespace from lines touched. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Acked-by: Anthony PERARD --- tools/misc/xen-hvmctx.c | 56 ++++++++++++++++++++++++------------------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/tools/misc/xen-hvmctx.c b/tools/misc/xen-hvmctx.c index 4f336a6cea..ecb7f054be 100644 --- a/tools/misc/xen-hvmctx.c +++ b/tools/misc/xen-hvmctx.c @@ -107,26 +107,26 @@ static void dump_fpu(void *p) struct fpu_regs *r = p; int i; - printf(" FPU: fcw 0x%4.4x fsw 0x%4.4x\n" - " ftw 0x%2.2x (0x%2.2x) fop 0x%4.4x\n" - " fpuip 0x%16.16"PRIx64" fpudp 0x%16.16"PRIx64"\n" - " mxcsr 0x%8.8lx mask 0x%8.8lx\n", + printf(" FPU: fcw 0x%04x fsw 0x%04x\n" + " ftw 0x%02x (0x%02x) fop 0x%04x\n" + " fpuip 0x%016"PRIx64" fpudp 0x%016"PRIx64"\n" + " mxcsr 0x%08lx mask 0x%08lx\n", (unsigned)r->fcw, (unsigned)r->fsw, (unsigned)r->ftw, (unsigned)r->res0, (unsigned)r->fop, r->fpuip, r->fpudp, (unsigned long)r->mxcsr, (unsigned long)r->mxcsr_mask); for ( i = 0 ; i < 8 ; i++ ) - printf(" mm%i 0x%4.4x%16.16"PRIx64" (0x%4.4x%4.4x%4.4x)\n", + printf(" mm%i 0x%04x%016"PRIx64" (0x%04x%04x%04x)\n", i, r->mm[i].hi, r->mm[i].lo, r->mm[i].pad[2], r->mm[i].pad[1], r->mm[i].pad[0]); for ( i = 0 ; i < 16 ; i++ ) - printf(" xmm%2.2i 0x%16.16"PRIx64"%16.16"PRIx64"\n", + printf(" xmm%-2i 0x%016"PRIx64"%016"PRIx64"\n", i, r->xmm[i].hi, r->xmm[i].lo); for ( i = 0 ; i < 6 ; i++ ) - printf(" (0x%16.16"PRIx64"%16.16"PRIx64")\n", + printf(" (0x%016"PRIx64"%016"PRIx64")\n", r->res1[2*i+1], r->res1[2*i]); } @@ -134,20 +134,20 @@ static void dump_cpu(void) { HVM_SAVE_TYPE(CPU) c; READ(c); - printf(" CPU: rax 0x%16.16llx rbx 0x%16.16llx\n" - " rcx 0x%16.16llx rdx 0x%16.16llx\n" - " rbp 0x%16.16llx rsi 0x%16.16llx\n" - " rdi 0x%16.16llx rsp 0x%16.16llx\n" - " r8 0x%16.16llx r9 0x%16.16llx\n" - " r10 0x%16.16llx r11 0x%16.16llx\n" - " r12 0x%16.16llx r13 0x%16.16llx\n" - " r14 0x%16.16llx r15 0x%16.16llx\n" - " rip 0x%16.16llx rflags 0x%16.16llx\n" - " cr0 0x%16.16llx cr2 0x%16.16llx\n" - " cr3 0x%16.16llx cr4 0x%16.16llx\n" - " dr0 0x%16.16llx dr1 0x%16.16llx\n" - " dr2 0x%16.16llx dr3 0x%16.16llx\n" - " dr6 0x%16.16llx dr7 0x%16.16llx\n" + printf(" CPU: rax 0x%016llx rbx 0x%016llx\n" + " rcx 0x%016llx rdx 0x%016llx\n" + " rbp 0x%016llx rsi 0x%016llx\n" + " rdi 0x%016llx rsp 0x%016llx\n" + " r8 0x%016llx r9 0x%016llx\n" + " r10 0x%016llx r11 0x%016llx\n" + " r12 0x%016llx r13 0x%016llx\n" + " r14 0x%016llx r15 0x%016llx\n" + " rip 0x%016llx rflags 0x%016llx\n" + " cr0 0x%016llx cr2 0x%016llx\n" + " cr3 0x%016llx cr4 0x%016llx\n" + " dr0 0x%016llx dr1 0x%016llx\n" + " dr2 0x%016llx dr3 0x%016llx\n" + " dr6 0x%016llx dr7 0x%016llx\n" " cs %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" " es %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" " ds %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.8" PRIx32 " / %#7.4" PRIx32 ")\n" @@ -158,12 +158,12 @@ static void dump_cpu(void) " ldtr %#6.4" PRIx32 " (%#18.8" PRIx64 " + %#10.4" PRIx32 " / %#7.4" PRIx32 ")\n" " idtr (%#18.8" PRIx64 " + %#10.4" PRIx32 ")\n" " gdtr (%#18.8" PRIx64 " + %#10.4" PRIx32 ")\n" - " sysenter cs 0x%8.8llx eip 0x%16.16llx esp 0x%16.16llx\n" + " sysenter cs 0x%08llx eip 0x%016llx esp 0x%016llx\n" " shadow gs %#18.16" PRIx64 " efer %#18.8" PRIx64 "\n" " lstar %#18.16" PRIx64 " cstar %#18.16" PRIx64 "\n" " star %#18.16" PRIx64 " sfmask %#18.8" PRIx64 "\n" - " tsc 0x%16.16llx\n" - " event 0x%8.8lx error 0x%8.8lx\n", + " tsc 0x%016llx\n" + " event 0x%08lx error 0x%08lx\n", (unsigned long long) c.rax, (unsigned long long) c.rbx, (unsigned long long) c.rcx, (unsigned long long) c.rdx, (unsigned long long) c.rbp, (unsigned long long) c.rsi, @@ -260,7 +260,7 @@ static void dump_pci_irq(void) { HVM_SAVE_TYPE(PCI_IRQ) i; READ(i); - printf(" PCI IRQs: 0x%16.16llx%16.16llx\n", + printf(" PCI IRQs: 0x%016llx%016llx\n", (unsigned long long) i.pad[0], (unsigned long long) i.pad[1]); } @@ -268,7 +268,7 @@ static void dump_isa_irq(void) { HVM_SAVE_TYPE(ISA_IRQ) i; READ(i); - printf(" ISA IRQs: 0x%4.4llx\n", + printf(" ISA IRQs: 0x%04llx\n", (unsigned long long) i.pad[0]); } @@ -305,10 +305,10 @@ static void dump_rtc(void) { HVM_SAVE_TYPE(RTC) r; READ(r); - printf(" RTC: regs 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", + printf(" RTC: regs 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x\n", r.cmos_data[0], r.cmos_data[1], r.cmos_data[2], r.cmos_data[3], r.cmos_data[4], r.cmos_data[5], r.cmos_data[6], r.cmos_data[7]); - printf(" 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x, index 0x%2.2x\n", + printf(" 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x, index 0x%02x\n", r.cmos_data[8], r.cmos_data[9], r.cmos_data[10], r.cmos_data[11], r.cmos_data[12], r.cmos_data[13], r.cmos_index); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 15:22:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 15:22:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353467.1609345 (Exim 4.92) (envelope-from ) id 1wffiQ-0001gY-9d; Fri, 03 Jul 2026 15:22:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353467.1609345; Fri, 03 Jul 2026 15:22:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffiQ-0001gN-5w; Fri, 03 Jul 2026 15:22:06 +0000 Received: by outflank-mailman (input) for mailman id 1353467; Fri, 03 Jul 2026 15:22:05 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffiO-0001g9-VP for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wffiO-005IxV-38 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wffiO-001ara-1d for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=YdZRaf1GyjPYJ7CLm4ILd8gJks72yv9InMXpNU0c9Ls=; b=ktSfOCjcWKWGdoVP/5Z26zgNtk AcxjUpfHvbsZBQsq26bP3Hw0a9ulobkAfk9SPlUCUlIJ2jYueGIUJvJVK4l9P1Ea6oMAw6CQR9z5w URWoOk9FJLuPEe9uvpDEfkGXsFeTfgIyodDz5IxU5bF/syqBtDj4R6eGjjN3lKgXmjsg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] argo: fall back maintainership into the rest Message-Id: Date: Fri, 03 Jul 2026 15:22:04 +0000 commit 5646849e0e7e3d99d2db0f391a358b7648d8f66d Author: Roger Pau Monne AuthorDate: Wed Jul 1 20:53:43 2026 +0200 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:45:27 2026 +0200 argo: fall back maintainership into the rest Due to unresponsiveness of the current maintainer. In particular, the committers have been trying to get in touch with Christopher for 2 weeks to have a chat about disputes around recent commits and pending changes to the ARGO component without getting any response. Signed-of-by: Roger Pau Monné Acked-by: Stefano Stabellini Acked-by: Jan Beulich Acked-by: Anthony PERARD --- MAINTAINERS | 1 - 1 file changed, 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 81bd0dfeec..6b2e391441 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -241,7 +241,6 @@ F: xen/arch/x86/hvm/svm/ F: xen/arch/x86/include/asm/hvm/svm/ ARGO -M: Christopher Clark R: Daniel P. Smith S: Maintained F: xen/include/public/argo.h -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 15:22:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 15:22:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353469.1609348 (Exim 4.92) (envelope-from ) id 1wffia-0001jh-9m; Fri, 03 Jul 2026 15:22:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353469.1609348; Fri, 03 Jul 2026 15:22:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffia-0001jZ-7D; Fri, 03 Jul 2026 15:22:16 +0000 Received: by outflank-mailman (input) for mailman id 1353469; Fri, 03 Jul 2026 15:22:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffiZ-0001jP-01 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wffiZ-005IxZ-0n for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wffiY-001bEl-2p for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AkT5dLJI6kcqeVf3QpAMCP5r8Bk9IwauYxIlZ2ewPtk=; b=dW+Jays0qU39dFxyx9sfBpji7a L6yMqk5eMTr5YzBNOH58IlJWPo6zhJcNS9tobLuvAqcD0zlLpZS6QeNZPo7Sos2hcUaYZI3LNJIxL Nwb5VMa0gvi59KxU8GKIJJ2/p1f1KoFWeetpHLcEv5rITTBJlXytDTc8Tl1wqqIj+keo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] MAINTAINERS: Add myself as an Argo reviewer Message-Id: Date: Fri, 03 Jul 2026 15:22:14 +0000 commit 62bc8e2c3b2db177aa8d20169396d43f0a913056 Author: Jason Andryuk AuthorDate: Thu Jun 4 14:44:13 2026 -0400 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:52:38 2026 +0200 MAINTAINERS: Add myself as an Argo reviewer I'd like to help with reviews of Argo. Signed-off-by: Jason Andryuk Acked-by: Jan Beulich --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 6b2e391441..d37adf18ab 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -241,6 +241,7 @@ F: xen/arch/x86/hvm/svm/ F: xen/arch/x86/include/asm/hvm/svm/ ARGO +R: Jason Andryuk R: Daniel P. Smith S: Maintained F: xen/include/public/argo.h -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 15:22:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 15:22:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353470.1609352 (Exim 4.92) (envelope-from ) id 1wffik-0001lk-BE; Fri, 03 Jul 2026 15:22:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353470.1609352; Fri, 03 Jul 2026 15:22:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffik-0001lc-8T; Fri, 03 Jul 2026 15:22:26 +0000 Received: by outflank-mailman (input) for mailman id 1353470; Fri, 03 Jul 2026 15:22:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffij-0001lU-36 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wffij-005Ixv-16 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wffij-001bKt-05 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JqcMEhUXNgXu5XRg3udoM9k+bWXn5DYGh9H6qFCGttE=; b=MZVykx5hHJq4cUDTd+bVfwcqyS Qwjs9j0qRQDRkoiFsTX1eVn66JZpctedkC0eFqy67FdF/gcmbQYEl4gNyYj4KClGaqnhxrTJIGy5y DtdltBGcPemcgxHdBu4mAqGog5zd0rcQTGa5P1D90/4ue4hYpqomd8Ee7kxg4i9vYBNM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable Message-Id: Date: Fri, 03 Jul 2026 15:22:25 +0000 commit f0161d2d89cfae43a6c5e974568c10b760bf13a4 Author: Andrew Cooper AuthorDate: Thu Jul 2 16:03:01 2026 +0100 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:52:47 2026 +0200 tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable This was reported to the security team, demonstrating that code execution could be achieved, but without a demonstration of a priviliege boundary being bypassed. Still, it's a high risk path with no obvious evidence of having been used even for debugging, so remove the environment variable and use the build time $(libdir)/xenfsimage path only. Signed-off-by: Andrew Cooper Reviewed-by: Roger Pau Monné Acked-by: Oleksii Kurochko Acked-by: Anthony PERARD Release-Acked-by: Oleksii Kurochko --- CHANGELOG.md | 1 + tools/libfsimage/common/fsimage_plugin.c | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ef4e6ae9c4..0a4e5f013c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -63,6 +63,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - Removed xenpm tool on non-x86 platforms as it doesn't actually provide anything useful outside of x86. + - Removed the XEN_FSIMAGE_FSDIR environment variable. ## [4.21.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.21.0) - 2025-11-19 diff --git a/tools/libfsimage/common/fsimage_plugin.c b/tools/libfsimage/common/fsimage_plugin.c index d0cb9e96a6..539dc24735 100644 --- a/tools/libfsimage/common/fsimage_plugin.c +++ b/tools/libfsimage/common/fsimage_plugin.c @@ -121,7 +121,7 @@ fail: int fsi_init(void) { - const char *fsdir = getenv("XEN_FSIMAGE_FSDIR"); + const char *fsdir = FSIMAGE_FSDIR; struct dirent *dp = NULL; DIR *dir = NULL; char *tmp = NULL; @@ -129,9 +129,6 @@ int fsi_init(void) int err; int ret = -1; - if (fsdir == NULL) - fsdir = FSIMAGE_FSDIR; - if ((name_max = pathconf(fsdir, _PC_NAME_MAX)) == -1) goto fail; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 15:22:37 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 15:22:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353471.1609357 (Exim 4.92) (envelope-from ) id 1wffiv-0001pb-Cv; Fri, 03 Jul 2026 15:22:37 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353471.1609357; Fri, 03 Jul 2026 15:22:37 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffiv-0001p9-9x; Fri, 03 Jul 2026 15:22:37 +0000 Received: by outflank-mailman (input) for mailman id 1353471; Fri, 03 Jul 2026 15:22:35 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wffit-0001os-Cf for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wffit-005Iy2-21 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wffit-001bW8-10 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 15:22:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vPXY7b4Aiy3EvQtvdJvBAbdFEXdnkZG8RJB0qauJL8U=; b=gncm0Cz7YUmq+G+kokpB7cg328 i6q7WmZlhyA5s3SvOFCBY5jxnaoLI2xhUvnzk06UF3GGwZtQmcdjFBJcDT4Cl93cpIdZ41GThKDdf OL6QyS4+5zHpYJKvB1mm4hkJTr4a8KjjoMV7nZHG2vS12DuLgd3xPELATnGHS0WlkLQM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable Message-Id: Date: Fri, 03 Jul 2026 15:22:35 +0000 commit 1678ab2a77c3db5eebb4562acd6d5a68d7af3d6f Author: Andrew Cooper AuthorDate: Thu Jul 2 16:03:01 2026 +0100 Commit: Roger Pau Monne CommitDate: Fri Jul 3 17:17:14 2026 +0200 tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable This was reported to the security team, demonstrating that code execution could be achieved, but without a demonstration of a priviliege boundary being bypassed. Still, it's a high risk path with no obvious evidence of having been used even for debugging, so remove the environment variable and use the build time $(libdir)/xenfsimage path only. Signed-off-by: Andrew Cooper Reviewed-by: Roger Pau Monné Acked-by: Oleksii Kurochko Acked-by: Anthony PERARD Release-Acked-by: Oleksii Kurochko (cherry picked from commit f0161d2d89cfae43a6c5e974568c10b760bf13a4) --- CHANGELOG.md | 1 + tools/libfsimage/common/fsimage_plugin.c | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cf19372a3..6bb18fca75 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - Removed xenpm tool on non-x86 platforms as it doesn't actually provide anything useful outside of x86. + - Removed the XEN_FSIMAGE_FSDIR environment variable. ## [4.21.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.21.0) - 2025-11-19 diff --git a/tools/libfsimage/common/fsimage_plugin.c b/tools/libfsimage/common/fsimage_plugin.c index d0cb9e96a6..539dc24735 100644 --- a/tools/libfsimage/common/fsimage_plugin.c +++ b/tools/libfsimage/common/fsimage_plugin.c @@ -121,7 +121,7 @@ fail: int fsi_init(void) { - const char *fsdir = getenv("XEN_FSIMAGE_FSDIR"); + const char *fsdir = FSIMAGE_FSDIR; struct dirent *dp = NULL; DIR *dir = NULL; char *tmp = NULL; @@ -129,9 +129,6 @@ int fsi_init(void) int err; int ret = -1; - if (fsdir == NULL) - fsdir = FSIMAGE_FSDIR; - if ((name_max = pathconf(fsdir, _PC_NAME_MAX)) == -1) goto fail; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 17:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 17:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353587.1609378 (Exim 4.92) (envelope-from ) id 1wfhaV-0006TA-RB; Fri, 03 Jul 2026 17:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353587.1609378; Fri, 03 Jul 2026 17:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhaV-0006T2-OP; Fri, 03 Jul 2026 17:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1353587; Fri, 03 Jul 2026 17:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhaU-0006Rr-KA for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfhaU-005LcF-1S for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfhaU-004rKI-0P for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=l4v9XjMZYG1kJMyoduAnq5LcvgkNDzFBteybzIz7aSg=; b=W4Thjbby4noGzPgTj2aJna0+Jr bOCtj0C5nw028N4l2NSJixoUMjeJfjEsbl2V/vM3qw2qX5FLe73yByZBqLSoztvdrPaAKDha58ukh iRfW9fKOADsiPpuZfwjKNjXuEuyle42Qyy4rkB4uZjwbZpMvMWuj3112rGCBR0m9csXw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] argo: fall back maintainership into the rest Message-Id: Date: Fri, 03 Jul 2026 17:22:02 +0000 commit 5646849e0e7e3d99d2db0f391a358b7648d8f66d Author: Roger Pau Monne AuthorDate: Wed Jul 1 20:53:43 2026 +0200 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:45:27 2026 +0200 argo: fall back maintainership into the rest Due to unresponsiveness of the current maintainer. In particular, the committers have been trying to get in touch with Christopher for 2 weeks to have a chat about disputes around recent commits and pending changes to the ARGO component without getting any response. Signed-of-by: Roger Pau Monné Acked-by: Stefano Stabellini Acked-by: Jan Beulich Acked-by: Anthony PERARD --- MAINTAINERS | 1 - 1 file changed, 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 81bd0dfeec..6b2e391441 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -241,7 +241,6 @@ F: xen/arch/x86/hvm/svm/ F: xen/arch/x86/include/asm/hvm/svm/ ARGO -M: Christopher Clark R: Daniel P. Smith S: Maintained F: xen/include/public/argo.h -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 17:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 17:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353588.1609382 (Exim 4.92) (envelope-from ) id 1wfhaf-0006V4-SP; Fri, 03 Jul 2026 17:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353588.1609382; Fri, 03 Jul 2026 17:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhaf-0006Uw-Pj; Fri, 03 Jul 2026 17:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1353588; Fri, 03 Jul 2026 17:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhae-0006Uk-Da for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfhae-005LcL-27 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfhae-004rTd-0z for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vGCtQ4WiZWO8rCuZPIjJ6IrOqLKEz3r7TcX+TxQccSo=; b=nyzOzjRHznpMnah1dqfxkUiXob Zd63Fu4NwGZrwdo5tLVhFfH8oSsS96Gqi/RhDHn63ym7zM6QpXrC+IaedXmBfManjsDaaEqUDx2Bl Ayr1TFv9gosBknuRJHsgaqrw8k8m3QOT4st5wnFtcKy3obirfcgKgeCv56qQ0NLXgzrg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] MAINTAINERS: Add myself as an Argo reviewer Message-Id: Date: Fri, 03 Jul 2026 17:22:12 +0000 commit 62bc8e2c3b2db177aa8d20169396d43f0a913056 Author: Jason Andryuk AuthorDate: Thu Jun 4 14:44:13 2026 -0400 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:52:38 2026 +0200 MAINTAINERS: Add myself as an Argo reviewer I'd like to help with reviews of Argo. Signed-off-by: Jason Andryuk Acked-by: Jan Beulich --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 6b2e391441..d37adf18ab 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -241,6 +241,7 @@ F: xen/arch/x86/hvm/svm/ F: xen/arch/x86/include/asm/hvm/svm/ ARGO +R: Jason Andryuk R: Daniel P. Smith S: Maintained F: xen/include/public/argo.h -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 17:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 17:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353589.1609386 (Exim 4.92) (envelope-from ) id 1wfhap-0006YA-TO; Fri, 03 Jul 2026 17:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353589.1609386; Fri, 03 Jul 2026 17:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhap-0006Y2-R2; Fri, 03 Jul 2026 17:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1353589; Fri, 03 Jul 2026 17:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfhao-0006Wr-Gy for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfhao-005LcP-2U for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfhao-004s3u-1S for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 17:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=V22yDG4RNSioPjYWrpoy5jeRr/JvRvU8hm7sXs3mkfE=; b=oj+6CJGwFQ69bCIOt8fyPn7UyS uJimdXf0J7MVO+NhPftqQgnwTOakq5ic7R6hJB9dazymSPDXrpw8+yy2HuKAuYCrCxmjqKR+AsOyZ 0izCYeqyFat/DzwcjhqUQrfpcN+cOxe8xGim3PrW3YGULhMyDEXeLnXInNt3nshqmWbk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable Message-Id: Date: Fri, 03 Jul 2026 17:22:22 +0000 commit f0161d2d89cfae43a6c5e974568c10b760bf13a4 Author: Andrew Cooper AuthorDate: Thu Jul 2 16:03:01 2026 +0100 Commit: Roger Pau Monne CommitDate: Fri Jul 3 16:52:47 2026 +0200 tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable This was reported to the security team, demonstrating that code execution could be achieved, but without a demonstration of a priviliege boundary being bypassed. Still, it's a high risk path with no obvious evidence of having been used even for debugging, so remove the environment variable and use the build time $(libdir)/xenfsimage path only. Signed-off-by: Andrew Cooper Reviewed-by: Roger Pau Monné Acked-by: Oleksii Kurochko Acked-by: Anthony PERARD Release-Acked-by: Oleksii Kurochko --- CHANGELOG.md | 1 + tools/libfsimage/common/fsimage_plugin.c | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ef4e6ae9c4..0a4e5f013c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -63,6 +63,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - Removed xenpm tool on non-x86 platforms as it doesn't actually provide anything useful outside of x86. + - Removed the XEN_FSIMAGE_FSDIR environment variable. ## [4.21.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.21.0) - 2025-11-19 diff --git a/tools/libfsimage/common/fsimage_plugin.c b/tools/libfsimage/common/fsimage_plugin.c index d0cb9e96a6..539dc24735 100644 --- a/tools/libfsimage/common/fsimage_plugin.c +++ b/tools/libfsimage/common/fsimage_plugin.c @@ -121,7 +121,7 @@ fail: int fsi_init(void) { - const char *fsdir = getenv("XEN_FSIMAGE_FSDIR"); + const char *fsdir = FSIMAGE_FSDIR; struct dirent *dp = NULL; DIR *dir = NULL; char *tmp = NULL; @@ -129,9 +129,6 @@ int fsi_init(void) int err; int ret = -1; - if (fsdir == NULL) - fsdir = FSIMAGE_FSDIR; - if ((name_max = pathconf(fsdir, _PC_NAME_MAX)) == -1) goto fail; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 03 19:33:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 03 Jul 2026 19:33:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1353683.1609393 (Exim 4.92) (envelope-from ) id 1wfjdH-0006xf-PH; Fri, 03 Jul 2026 19:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1353683.1609393; Fri, 03 Jul 2026 19:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfjdH-0006xX-MR; Fri, 03 Jul 2026 19:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1353683; Fri, 03 Jul 2026 19:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wfjdG-0006xR-G0 for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 19:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wfjdG-005Nvf-1r for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 19:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wfjdG-008NRs-0e for xen-changelog@lists.xenproject.org; Fri, 03 Jul 2026 19:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mg1Z9/k6cspejJh9q1IsFkGLkuZeqzttepIZTBiL23A=; b=QDCJiYNM7sAq6MMQdBdKuJhiEx CU2IOvEB8lQShjDoStofbDPNerwo+ub9g5iD/GiRUYbT4Ky2T5ynCil/tcZi6twSaqwKZSAatTGDI cp6wfkbPOK3OuV3XYtu25PyHcv6F4QVMdm/YXfX1/0ctx+TE6InpncGf/PNt7W/NYvxw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable Message-Id: Date: Fri, 03 Jul 2026 19:33:02 +0000 commit 1678ab2a77c3db5eebb4562acd6d5a68d7af3d6f Author: Andrew Cooper AuthorDate: Thu Jul 2 16:03:01 2026 +0100 Commit: Roger Pau Monne CommitDate: Fri Jul 3 17:17:14 2026 +0200 tools/libfsimage: Remove the XEN_FSIMAGE_FSDIR environment variable This was reported to the security team, demonstrating that code execution could be achieved, but without a demonstration of a priviliege boundary being bypassed. Still, it's a high risk path with no obvious evidence of having been used even for debugging, so remove the environment variable and use the build time $(libdir)/xenfsimage path only. Signed-off-by: Andrew Cooper Reviewed-by: Roger Pau Monné Acked-by: Oleksii Kurochko Acked-by: Anthony PERARD Release-Acked-by: Oleksii Kurochko (cherry picked from commit f0161d2d89cfae43a6c5e974568c10b760bf13a4) --- CHANGELOG.md | 1 + tools/libfsimage/common/fsimage_plugin.c | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cf19372a3..6bb18fca75 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - Removed xenpm tool on non-x86 platforms as it doesn't actually provide anything useful outside of x86. + - Removed the XEN_FSIMAGE_FSDIR environment variable. ## [4.21.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.21.0) - 2025-11-19 diff --git a/tools/libfsimage/common/fsimage_plugin.c b/tools/libfsimage/common/fsimage_plugin.c index d0cb9e96a6..539dc24735 100644 --- a/tools/libfsimage/common/fsimage_plugin.c +++ b/tools/libfsimage/common/fsimage_plugin.c @@ -121,7 +121,7 @@ fail: int fsi_init(void) { - const char *fsdir = getenv("XEN_FSIMAGE_FSDIR"); + const char *fsdir = FSIMAGE_FSDIR; struct dirent *dp = NULL; DIR *dir = NULL; char *tmp = NULL; @@ -129,9 +129,6 @@ int fsi_init(void) int err; int ret = -1; - if (fsdir == NULL) - fsdir = FSIMAGE_FSDIR; - if ((name_max = pathconf(fsdir, _PC_NAME_MAX)) == -1) goto fail; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 09:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 09:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355282.1610034 (Exim 4.92) (envelope-from ) id 1wgg2Z-0003iM-L2; Mon, 06 Jul 2026 09:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355282.1610034; Mon, 06 Jul 2026 09:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2Z-0003iE-Hs; Mon, 06 Jul 2026 09:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1355282; Mon, 06 Jul 2026 09:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2Y-0003i6-7l for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgg2Y-00ACUj-11 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgg2X-00Ah9p-39 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IFdd/e0mF7JdqXVhBBtoFfRg4Mg0o0G+yYvQWEPHmn4=; b=faOg3FzsVvAh5MVkKUW9cSY1cN 01hvTDLnluv6YD+Bn1xOdbFG9JdmuYW1EQbFcqFli9FxUf0U8m2s1muss7N5zFmidDGl34UagwmPg BvKv1lBH50vGhsDpV90tQxJKDK4gSZl0Wa2VRvLrHtvEphQc790gfm2KHom2H0MKAcXQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools: Use posix_memalign instead of valloc for NetBSD Message-Id: Date: Mon, 06 Jul 2026 09:55:01 +0000 commit ac840e066f8aec254b83b2f1825905410368facb Author: Frediano Ziglio AuthorDate: Mon Jul 6 09:40:17 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:40:17 2026 +0200 tools: Use posix_memalign instead of valloc for NetBSD More similar to other implementation. posix_memalign was adde in NetBSD 8.0, released on July 17, 2018 and went out of support on May 4, 2024. Signed-off-by: Frediano Ziglio Acked-by: Anthony PERARD --- tools/include/xenctrl.h | 5 +++++ tools/libs/ctrl/xc_netbsd.c | 9 ++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h index d5dbf69c89..f4316089e7 100644 --- a/tools/include/xenctrl.h +++ b/tools/include/xenctrl.h @@ -1390,6 +1390,11 @@ int xc_lockprof_query(xc_interface *xch, uint64_t *time, xc_hypercall_buffer_t *data); +/** + * Allocate memory with a given alignment. + * The alignment must be a power of 2 and at least sizeof(void*). + * It returns NULL on error, errno is not set. + */ void *xc_memalign(xc_interface *xch, size_t alignment, size_t size); /** diff --git a/tools/libs/ctrl/xc_netbsd.c b/tools/libs/ctrl/xc_netbsd.c index 1318d4d906..d27154dce9 100644 --- a/tools/libs/ctrl/xc_netbsd.c +++ b/tools/libs/ctrl/xc_netbsd.c @@ -60,7 +60,14 @@ void discard_file_cache(xc_interface *xch, int fd, int flush) void *xc_memalign(xc_interface *xch, size_t alignment, size_t size) { - return valloc(size); + int ret; + void *ptr; + + ret = posix_memalign(&ptr, alignment, size); + if (ret != 0 || !ptr) + return NULL; + + return ptr; } int xc_pcidev_get_gsi(xc_interface *xch, uint32_t sbdf) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 09:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 09:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355283.1610038 (Exim 4.92) (envelope-from ) id 1wgg2j-0003kL-Lm; Mon, 06 Jul 2026 09:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355283.1610038; Mon, 06 Jul 2026 09:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2j-0003kD-JA; Mon, 06 Jul 2026 09:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1355283; Mon, 06 Jul 2026 09:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2i-0003js-5H for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgg2i-00ACVY-1K for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgg2i-00AhEZ-0K for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jaGMCJbhvJrZ5K8xx8zP2on21tK2/qKtR026ShEkMGk=; b=r/lO9yDW24mX7zRUusQCgzkVL+ XBbMPdBYpeM7vdezzetFHlkYMdyha8UZj+dM0EmUQezhM73TkL9IrifNrMnVa6T4HXTbS6gdELv7g uNrJ8kV2TNpOyXKx01GYB6mF2voO8MKqCJJV89VgkpvZx4Ch16PmDPuSYVTragUm2t34=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] pci: Use pci_sbdf_t in pci_device_detect() Message-Id: Date: Mon, 06 Jul 2026 09:55:12 +0000 commit e4575202456d83bc27768baf1da4dfa77f00afff Author: Teddy Astie AuthorDate: Mon Jul 6 09:40:38 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:40:38 2026 +0200 pci: Use pci_sbdf_t in pci_device_detect() Use a single pci_sbdf_t instead of each of its part as individual parameters. Signed-off-by: Teddy Astie Reviewed-by: Jan Beulich --- xen/drivers/char/ehci-dbgp.c | 4 ++-- xen/drivers/passthrough/pci.c | 6 +++--- xen/drivers/passthrough/vtd/dmar.c | 9 +++++---- xen/include/xen/pci.h | 2 +- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/xen/drivers/char/ehci-dbgp.c b/xen/drivers/char/ehci-dbgp.c index a5c79f56fc..2a58213cab 100644 --- a/xen/drivers/char/ehci-dbgp.c +++ b/xen/drivers/char/ehci-dbgp.c @@ -706,7 +706,7 @@ static unsigned int __init find_dbgp(struct ehci_dbgp *dbgp, { unsigned int cap; - if ( !pci_device_detect(0, bus, slot, func) ) + if ( !pci_device_detect(PCI_SBDF(0, bus, slot, func)) ) { if ( !func ) break; @@ -1520,7 +1520,7 @@ void __init ehci_dbgp_init(void) dbgp->slot = slot; dbgp->func = func; - if ( !pci_device_detect(0, bus, slot, func) ) + if ( !pci_device_detect(PCI_SBDF(0, bus, slot, func)) ) return; dbgp->cap = __find_dbgp(bus, slot, func); diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index d37ceb7b6c..0adf573150 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1166,11 +1166,11 @@ out: return ret; } -bool __init pci_device_detect(u16 seg, u8 bus, u8 dev, u8 func) +bool __init pci_device_detect(pci_sbdf_t sbdf) { u32 vendor; - vendor = pci_conf_read32(PCI_SBDF(seg, bus, dev, func), PCI_VENDOR_ID); + vendor = pci_conf_read32(sbdf, PCI_VENDOR_ID); /* some broken boards return 0 or ~0 if a slot is empty: */ if ( (vendor == 0xffffffffU) || (vendor == 0x00000000U) || (vendor == 0x0000ffffU) || (vendor == 0xffff0000U) ) @@ -1221,7 +1221,7 @@ static int __init cf_check _scan_pci_devices(struct pci_seg *pseg, void *arg) { for ( func = 0; func < 8; func++ ) { - if ( !pci_device_detect(pseg->nr, bus, dev, func) ) + if ( !pci_device_detect(PCI_SBDF(pseg->nr, bus, dev, func)) ) { if ( !func ) break; diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 2a756831a6..09165efca5 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -389,7 +389,8 @@ static int __init acpi_parse_dev_scope( printk(VTDPREFIX " endpoint: %pp\n", &PCI_SBDF(seg, bus, path->dev, path->fn)); - if ( drhd && pci_device_detect(seg, bus, path->dev, path->fn) ) + if ( drhd && + pci_device_detect(PCI_SBDF(seg, bus, path->dev, path->fn)) ) { if ( pci_conf_read8(PCI_SBDF(seg, bus, path->dev, path->fn), PCI_CLASS_DEVICE + 1) != 0x03 @@ -537,7 +538,7 @@ acpi_parse_one_drhd(struct acpi_dmar_header *header) d = PCI_SLOT(dmaru->scope.devices[i]); f = PCI_FUNC(dmaru->scope.devices[i]); - if ( !pci_device_detect(drhd->segment, b, d, f) ) + if ( !pci_device_detect(PCI_SBDF(drhd->segment, b, d, f)) ) printk(XENLOG_WARNING VTDPREFIX " Non-existent device (%pp) in this DRHD's scope!\n", &PCI_SBDF(drhd->segment, b, d, f)); @@ -573,7 +574,7 @@ static int __init register_one_rmrr(struct acpi_rmrr_unit *rmrru) u8 d = PCI_SLOT(rmrru->scope.devices[i]); u8 f = PCI_FUNC(rmrru->scope.devices[i]); - if ( pci_device_detect(rmrru->segment, b, d, f) == 0 ) + if ( pci_device_detect(PCI_SBDF(rmrru->segment, b, d, f)) == 0 ) { dprintk(XENLOG_WARNING VTDPREFIX, " Non-existent device (%pp) is reported" @@ -767,7 +768,7 @@ static int __init register_one_satc(struct acpi_satc_unit *satcu) uint8_t d = PCI_SLOT(satcu->scope.devices[i]); uint8_t f = PCI_FUNC(satcu->scope.devices[i]); - if ( !pci_device_detect(satcu->segment, b, d, f) ) + if ( !pci_device_detect(PCI_SBDF(satcu->segment, b, d, f)) ) { dprintk(XENLOG_WARNING VTDPREFIX, " Non-existent device (%pp) is reported in SATC scope!\n", diff --git a/xen/include/xen/pci.h b/xen/include/xen/pci.h index afb6bbf50d..ade882caee 100644 --- a/xen/include/xen/pci.h +++ b/xen/include/xen/pci.h @@ -218,7 +218,7 @@ static always_inline bool pcidevs_trylock(void) #endif bool pci_known_segment(u16 seg); -bool pci_device_detect(u16 seg, u8 bus, u8 dev, u8 func); +bool pci_device_detect(pci_sbdf_t sbdf); int scan_pci_devices(void); enum pdev_type pdev_type(u16 seg, u8 bus, u8 devfn); int find_upstream_bridge(u16 seg, u8 *bus, u8 *devfn, u8 *secbus); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 09:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 09:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355284.1610041 (Exim 4.92) (envelope-from ) id 1wgg2t-0003mX-N7; Mon, 06 Jul 2026 09:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355284.1610041; Mon, 06 Jul 2026 09:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2t-0003mP-KS; Mon, 06 Jul 2026 09:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1355284; Mon, 06 Jul 2026 09:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg2s-0003mB-8V for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgg2s-00ACXW-1e for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgg2s-00AhMY-0d for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RMLrF5BG1QM3YLd2L/k+TaWQjfDic+xo1KLLX0RnDgE=; b=aUJ5y1bV9bqwWW3/OpmbuKXAP9 Sbw39Hjkg/8M02FGAH/r3a77ohogTD13VlkBl27GD0CNAImawgYlmLiNmaylkaXyqtRK9NtAmtsO9 0r8q73JtXsl2h531UPnelXbj5mnq8ZtMmSWLSmf+M+fMUQMLk2Pf+6quFlMXhf4W/DgQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libxc: drop size parameter from xc_flask_context_to_sid() Message-Id: Date: Mon, 06 Jul 2026 09:55:22 +0000 commit dc21138144d6b88e5b1fecffa2a80048f560d6e4 Author: Jan Beulich AuthorDate: Mon Jul 6 09:41:45 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:41:45 2026 +0200 libxc: drop size parameter from xc_flask_context_to_sid() Nul-terminated strings are passed in all cases, so the strlen() can very well be invoked by the function itself. In preparation for a hypervisor change also include the nul terminator in the size calculation. Signed-off-by: Jan Beulich Acked-by: Marek Marczykowski-Górecki Reviewed-by: Anthony PERARD Reviewed-by: Daniel P. Smith --- tools/helpers/init-xenstore-domain.c | 2 +- tools/include/xenctrl.h | 2 +- tools/libs/ctrl/xc_flask.c | 9 +++++---- tools/libs/light/libxl_flask.c | 5 ++++- tools/python/xen/lowlevel/xc/xc.c | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/tools/helpers/init-xenstore-domain.c b/tools/helpers/init-xenstore-domain.c index 2be5831a57..6c0c85f032 100644 --- a/tools/helpers/init-xenstore-domain.c +++ b/tools/helpers/init-xenstore-domain.c @@ -108,7 +108,7 @@ static int build(xc_interface *xch) if ( flask ) { - rv = xc_flask_context_to_sid(xch, flask, strlen(flask), &config.ssidref); + rv = xc_flask_context_to_sid(xch, flask, &config.ssidref); if ( rv ) { fprintf(stderr, "xc_flask_context_to_sid failed\n"); diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h index f4316089e7..9f00d4a19d 100644 --- a/tools/include/xenctrl.h +++ b/tools/include/xenctrl.h @@ -2377,7 +2377,7 @@ long xc_sharing_used_frames(xc_interface *xch); /*** End sharing interface ***/ int xc_flask_load(xc_interface *xc_handle, char *buf, uint32_t size); -int xc_flask_context_to_sid(xc_interface *xc_handle, char *buf, uint32_t size, uint32_t *sid); +int xc_flask_context_to_sid(xc_interface *xc_handle, char *buf, uint32_t *sid); int xc_flask_sid_to_context(xc_interface *xc_handle, int sid, char *buf, uint32_t size); int xc_flask_getenforce(xc_interface *xc_handle); int xc_flask_setenforce(xc_interface *xc_handle, int mode); diff --git a/tools/libs/ctrl/xc_flask.c b/tools/libs/ctrl/xc_flask.c index f5389dbd96..f275093735 100644 --- a/tools/libs/ctrl/xc_flask.c +++ b/tools/libs/ctrl/xc_flask.c @@ -83,10 +83,11 @@ int xc_flask_load(xc_interface *xch, char *buf, uint32_t size) return err; } -int xc_flask_context_to_sid(xc_interface *xch, char *buf, uint32_t size, uint32_t *sid) +int xc_flask_context_to_sid(xc_interface *xch, char *buf, uint32_t *sid) { int err; struct xen_flask_op op = {}; + size_t size = strlen(buf) + 1; DECLARE_HYPERCALL_BOUNCE(buf, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, buf) ) @@ -249,7 +250,7 @@ static int xc_flask_add(xc_interface *xch, uint32_t ocon, uint64_t low, uint64_t int err; struct xen_flask_op op = {}; - err = xc_flask_context_to_sid(xch, scontext, strlen(scontext), &sid); + err = xc_flask_context_to_sid(xch, scontext, &sid); if ( err ) return err; @@ -325,10 +326,10 @@ int xc_flask_access(xc_interface *xch, const char *scon, const char *tcon, struct xen_flask_op op = {}; int err; - err = xc_flask_context_to_sid(xch, (char*)scon, strlen(scon), &op.u.access.ssid); + err = xc_flask_context_to_sid(xch, (char*)scon, &op.u.access.ssid); if ( err ) return err; - err = xc_flask_context_to_sid(xch, (char*)tcon, strlen(tcon), &op.u.access.tsid); + err = xc_flask_context_to_sid(xch, (char*)tcon, &op.u.access.tsid); if ( err ) return err; diff --git a/tools/libs/light/libxl_flask.c b/tools/libs/light/libxl_flask.c index 38347a31a3..8d9c92bfdc 100644 --- a/tools/libs/light/libxl_flask.c +++ b/tools/libs/light/libxl_flask.c @@ -21,7 +21,10 @@ int libxl_flask_context_to_sid(libxl_ctx *ctx, char *buf, size_t len, { int rc; - rc = xc_flask_context_to_sid(ctx->xch, buf, len, ssidref); + if (len != strlen(buf)) + return ERROR_INVAL; + + rc = xc_flask_context_to_sid(ctx->xch, buf, ssidref); return rc; } diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c index a94f01d40b..7a4bf54597 100644 --- a/tools/python/xen/lowlevel/xc/xc.c +++ b/tools/python/xen/lowlevel/xc/xc.c @@ -1754,7 +1754,7 @@ static PyObject *pyflask_context_to_sid(PyObject *self, PyObject *args, return PyErr_SetFromErrno(xc_error_obj); } - ret = xc_flask_context_to_sid(xc_handle, ctx, strlen(ctx), &sid); + ret = xc_flask_context_to_sid(xc_handle, ctx, &sid); xc_interface_close(xc_handle); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 09:55:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 09:55:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355285.1610046 (Exim 4.92) (envelope-from ) id 1wgg33-0003pM-OL; Mon, 06 Jul 2026 09:55:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355285.1610046; Mon, 06 Jul 2026 09:55:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg33-0003pE-Lj; Mon, 06 Jul 2026 09:55:33 +0000 Received: by outflank-mailman (input) for mailman id 1355285; Mon, 06 Jul 2026 09:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg32-0003ot-Cz for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgg32-00ACXb-22 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgg32-00AhTX-0w for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=DTmcQVNivcYgyiiiObUCln5fVgQz6x7619e2FXyM9v4=; b=MOAUy1dZik/mbSJi8QhmEcGUs/ QXhk5B9S7aQaGCV5dRyYl6/oYOmf4ExJxo8fYZW1kxsj7kKjCWhRhSiusEigp4bD/N7QCRfJ7MS1h X3F+HlaoBdelLn2I7Dy31F89sJgSVV6IU5sBKa5bQFbFhhLoLt/fA5BlN/0i1CcMRPbk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] lib: make safe_copy_string_from_guest() validate input Message-Id: Date: Mon, 06 Jul 2026 09:55:32 +0000 commit 508209c47305f6655b36933e1bd96a682a438aaa Author: Jan Beulich AuthorDate: Mon Jul 6 09:42:10 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:42:10 2026 +0200 lib: make safe_copy_string_from_guest() validate input ... rather than papering over guest flaws: Strings passed ought to be nul- terminated (yet sadly libxc hasn't been doing so thus far). This way we also avoid order-1 allocations, seeing that all present callers pass PAGE_SIZE for max_size. Signed-off-by: Jan Beulich Reviewed-by: Anthony PERARD Acked-by: Oleksii Kurochko # Changelog --- CHANGELOG.md | 2 ++ xen/include/public/domctl.h | 2 +- xen/include/public/xsm/flask_op.h | 12 ++++++++---- xen/lib/guest-strcpy.c | 14 +++++++++----- 4 files changed, 20 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a4e5f013c..d8287fc311 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ## [4.23.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD ### Changed + - XEN_DOMCTL_DEV_DT's, FLASK_[GS]ETBOOL's, and FLASK_DEVICETREE_LABEL's input + string sizes need to include the nul terminator. ### Added diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h index cdf350a290..510300bb67 100644 --- a/xen/include/public/domctl.h +++ b/xen/include/public/domctl.h @@ -574,7 +574,7 @@ struct xen_domctl_assign_device { uint32_t machine_sbdf; /* machine PCI ID of assigned device */ } pci; struct { - uint32_t size; /* Length of the path */ + uint32_t size; /* Length of the path, including nul terminator */ XEN_GUEST_HANDLE_64(char) path; /* Path to the device tree node */ #ifdef __XEN__ struct dt_device_node *dev; /* Resolved device node of the above */ diff --git a/xen/include/public/xsm/flask_op.h b/xen/include/public/xsm/flask_op.h index 7185e80621..10e4ffe86e 100644 --- a/xen/include/public/xsm/flask_op.h +++ b/xen/include/public/xsm/flask_op.h @@ -26,7 +26,8 @@ typedef struct xen_flask_setenforce xen_flask_setenforce_t; struct xen_flask_sid_context { /* IN/OUT: sid to convert to/from string */ uint32_t sid; - /* IN: size of the context buffer + /* + * IN: size of the context buffer, including nul terminator * OUT: actual size of the output context string */ uint32_t size; @@ -86,8 +87,11 @@ struct xen_flask_boolean { uint8_t new_value; /* IN: commit new value instead of only setting pending [SET] */ uint8_t commit; - /* IN: size of boolean name buffer [GET/SET] - * OUT: actual size of name [GET only] */ + /* + * IN: size of boolean name buffer [GET/SET]; must cover nul terminator + * if "name" (below) is an input + * OUT: actual size of name [GET only] + */ uint32_t size; /* IN: if bool_id is -1, used to find boolean [GET/SET] * OUT: textual name of boolean [GET only] @@ -150,7 +154,7 @@ typedef struct xen_flask_relabel xen_flask_relabel_t; struct xen_flask_devicetree_label { /* IN */ uint32_t sid; - uint32_t length; + uint32_t length; /* length of the path, including nul terminator */ XEN_GUEST_HANDLE(char) path; }; typedef struct xen_flask_devicetree_label xen_flask_devicetree_label_t; diff --git a/xen/lib/guest-strcpy.c b/xen/lib/guest-strcpy.c index 6d38eefedd..94e7e38eda 100644 --- a/xen/lib/guest-strcpy.c +++ b/xen/lib/guest-strcpy.c @@ -3,8 +3,8 @@ #include /* - * The function copies a string from the guest and adds a NUL to - * make sure the string is correctly terminated. + * The function copies a string from the guest and checks there's a NUL + * terminating the string. */ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, size_t size, size_t max_size) @@ -14,8 +14,7 @@ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, if ( size > max_size ) return ERR_PTR(-ENOBUFS); - /* Add an extra +1 to append \0 */ - tmp = xmalloc_array(char, size + 1); + tmp = xmalloc_array(char, size); if ( !tmp ) return ERR_PTR(-ENOMEM); @@ -24,7 +23,12 @@ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, xfree(tmp); return ERR_PTR(-EFAULT); } - tmp[size] = '\0'; + + if ( !memchr(tmp, 0, size) ) + { + xfree(tmp); + return ERR_PTR(-EMSGSIZE); + } return tmp; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 09:55:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 09:55:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355286.1610050 (Exim 4.92) (envelope-from ) id 1wgg3D-0003rR-PX; Mon, 06 Jul 2026 09:55:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355286.1610050; Mon, 06 Jul 2026 09:55:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg3D-0003rJ-N0; Mon, 06 Jul 2026 09:55:43 +0000 Received: by outflank-mailman (input) for mailman id 1355286; Mon, 06 Jul 2026 09:55:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgg3C-0003rA-Fe for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgg3C-00ACXi-2K for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgg3C-00AhXx-1K for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 09:55:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=wcDSss578niDkhJt03kDA86cor1E2ub97BjmA0kR4XM=; b=AQvKNLHF28qs7l/sS1TTVsk07N 2vWicswQoxUgU+RCNoF4nukvNtNf1+5IlDztZck+jCpWjvA5wo1ZBocBVKaNdXIKq+82uaKBnaWbD Nq6ug/HporhUsYoK48r60Ygn2Vk+uyfk+VIcL8p4qwOBWeP5COTVsQiO2DhYVquPIJQs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/HVM: don't (almost) open-code POP_GPRS Message-Id: Date: Mon, 06 Jul 2026 09:55:42 +0000 commit e58a8e0889b872723ca6720cffb1e15e8e17fc85 Author: Jan Beulich AuthorDate: Mon Jul 6 09:42:46 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:42:46 2026 +0200 x86/HVM: don't (almost) open-code POP_GPRS It can be used as-is for VMX. For SVM the special treatment of %rax needs accounting for. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/hvm/svm/entry.S | 16 +--------------- xen/arch/x86/hvm/vmx/entry.S | 16 +--------------- xen/arch/x86/include/asm/asm_defns.h | 6 +++++- 3 files changed, 7 insertions(+), 31 deletions(-) diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index af8db23b03..b6ea699bb9 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -82,22 +82,8 @@ __UNLIKELY_END(nsvm_hap) */ sti - pop %r15 - pop %r14 - pop %r13 - pop %r12 - pop %rbp mov VCPU_svm_vmcb_pa(%rbx),%rax - pop %rbx - pop %r11 - pop %r10 - pop %r9 - pop %r8 - pop %rcx /* Skip %rax: restored by VMRUN. */ - pop %rcx - pop %rdx - pop %rsi - pop %rdi + POP_GPRS skip_rax=1 /* %rax restored by VMRUN. */ SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ diff --git a/xen/arch/x86/hvm/vmx/entry.S b/xen/arch/x86/hvm/vmx/entry.S index 2bfee715b3..c34f5a1ee0 100644 --- a/xen/arch/x86/hvm/vmx/entry.S +++ b/xen/arch/x86/hvm/vmx/entry.S @@ -139,21 +139,7 @@ UNLIKELY_END(realmode) and $SCF_verw, %eax or %eax, %ecx - pop %r15 - pop %r14 - pop %r13 - pop %r12 - pop %rbp - pop %rbx - pop %r11 - pop %r10 - pop %r9 - pop %r8 - pop %rax - pop %rcx - pop %rdx - pop %rsi - pop %rdi + POP_GPRS /* Preserves flags. */ jpe .L_skip_verw /* VERW clobbers ZF, but preserves all others, including SF. */ diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index 0dd63270fc..87bd6b1193 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -357,7 +357,7 @@ static always_inline void stac(void) /* * POP GPRs from a UREGS_* frame on the stack. Does not modify flags. */ -.macro POP_GPRS +.macro POP_GPRS skip_rax=0 pop %r15 pop %r14 pop %r13 @@ -368,7 +368,11 @@ static always_inline void stac(void) pop %r10 pop %r9 pop %r8 + .if \skip_rax + pop %rcx + .else pop %rax + .endif pop %rcx pop %rdx pop %rsi -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 11:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 11:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355349.1610108 (Exim 4.92) (envelope-from ) id 1wghOl-0001G5-JP; Mon, 06 Jul 2026 11:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355349.1610108; Mon, 06 Jul 2026 11:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghOl-0001Fw-GV; Mon, 06 Jul 2026 11:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1355349; Mon, 06 Jul 2026 11:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghOj-0001Fq-NE for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wghOj-00AEJ9-2i for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wghOj-00BVcm-1i for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8lGn5LkCwscDMhmDUfo3f0iaLm2s734UaSzmJ4cSGQk=; b=ikJUkVLWGyvwpGsJbniy4+QPsx gMuaK0zRuniEci2ZYlX99+VOWirQbnp1CY7wTOmmPAkYUDqjav8HRRnjZdIdwmi62Fr1u76FbvyWB spF3u7W8Zo5j0OWnxcos/hppLH6Kero+VbqAz54CK1VYdVDF1BTKquIedsT0KIduRZe0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools: Use posix_memalign instead of valloc for NetBSD Message-Id: Date: Mon, 06 Jul 2026 11:22:01 +0000 commit ac840e066f8aec254b83b2f1825905410368facb Author: Frediano Ziglio AuthorDate: Mon Jul 6 09:40:17 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:40:17 2026 +0200 tools: Use posix_memalign instead of valloc for NetBSD More similar to other implementation. posix_memalign was adde in NetBSD 8.0, released on July 17, 2018 and went out of support on May 4, 2024. Signed-off-by: Frediano Ziglio Acked-by: Anthony PERARD --- tools/include/xenctrl.h | 5 +++++ tools/libs/ctrl/xc_netbsd.c | 9 ++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h index d5dbf69c89..f4316089e7 100644 --- a/tools/include/xenctrl.h +++ b/tools/include/xenctrl.h @@ -1390,6 +1390,11 @@ int xc_lockprof_query(xc_interface *xch, uint64_t *time, xc_hypercall_buffer_t *data); +/** + * Allocate memory with a given alignment. + * The alignment must be a power of 2 and at least sizeof(void*). + * It returns NULL on error, errno is not set. + */ void *xc_memalign(xc_interface *xch, size_t alignment, size_t size); /** diff --git a/tools/libs/ctrl/xc_netbsd.c b/tools/libs/ctrl/xc_netbsd.c index 1318d4d906..d27154dce9 100644 --- a/tools/libs/ctrl/xc_netbsd.c +++ b/tools/libs/ctrl/xc_netbsd.c @@ -60,7 +60,14 @@ void discard_file_cache(xc_interface *xch, int fd, int flush) void *xc_memalign(xc_interface *xch, size_t alignment, size_t size) { - return valloc(size); + int ret; + void *ptr; + + ret = posix_memalign(&ptr, alignment, size); + if (ret != 0 || !ptr) + return NULL; + + return ptr; } int xc_pcidev_get_gsi(xc_interface *xch, uint32_t sbdf) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 11:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 11:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355350.1610111 (Exim 4.92) (envelope-from ) id 1wghOv-0001IQ-Ll; Mon, 06 Jul 2026 11:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355350.1610111; Mon, 06 Jul 2026 11:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghOv-0001IJ-JB; Mon, 06 Jul 2026 11:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1355350; Mon, 06 Jul 2026 11:22:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghOt-0001I3-MV for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wghOt-00AEJH-32 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wghOt-00BVhA-21 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=G4zbu2yFsYXkQqcy8JT5DqLBN9TnwflO+T39AkH30K0=; b=OwBOcjuB6FE5IJNk/wldOq2i3B OnHEXanm4zEzL2sQ28JiH/+zlxuTGopTC81gY7LVwuCvb6wvjoea22k9U04SJcmCrij13HtkTfKBb L5FtTBIcxGFhesKkyeJqCpdkG2WRUCOTjJRI8BZveR6jZrFhvX6rbG8/hVU53kxSeISE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] pci: Use pci_sbdf_t in pci_device_detect() Message-Id: Date: Mon, 06 Jul 2026 11:22:11 +0000 commit e4575202456d83bc27768baf1da4dfa77f00afff Author: Teddy Astie AuthorDate: Mon Jul 6 09:40:38 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:40:38 2026 +0200 pci: Use pci_sbdf_t in pci_device_detect() Use a single pci_sbdf_t instead of each of its part as individual parameters. Signed-off-by: Teddy Astie Reviewed-by: Jan Beulich --- xen/drivers/char/ehci-dbgp.c | 4 ++-- xen/drivers/passthrough/pci.c | 6 +++--- xen/drivers/passthrough/vtd/dmar.c | 9 +++++---- xen/include/xen/pci.h | 2 +- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/xen/drivers/char/ehci-dbgp.c b/xen/drivers/char/ehci-dbgp.c index a5c79f56fc..2a58213cab 100644 --- a/xen/drivers/char/ehci-dbgp.c +++ b/xen/drivers/char/ehci-dbgp.c @@ -706,7 +706,7 @@ static unsigned int __init find_dbgp(struct ehci_dbgp *dbgp, { unsigned int cap; - if ( !pci_device_detect(0, bus, slot, func) ) + if ( !pci_device_detect(PCI_SBDF(0, bus, slot, func)) ) { if ( !func ) break; @@ -1520,7 +1520,7 @@ void __init ehci_dbgp_init(void) dbgp->slot = slot; dbgp->func = func; - if ( !pci_device_detect(0, bus, slot, func) ) + if ( !pci_device_detect(PCI_SBDF(0, bus, slot, func)) ) return; dbgp->cap = __find_dbgp(bus, slot, func); diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index d37ceb7b6c..0adf573150 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1166,11 +1166,11 @@ out: return ret; } -bool __init pci_device_detect(u16 seg, u8 bus, u8 dev, u8 func) +bool __init pci_device_detect(pci_sbdf_t sbdf) { u32 vendor; - vendor = pci_conf_read32(PCI_SBDF(seg, bus, dev, func), PCI_VENDOR_ID); + vendor = pci_conf_read32(sbdf, PCI_VENDOR_ID); /* some broken boards return 0 or ~0 if a slot is empty: */ if ( (vendor == 0xffffffffU) || (vendor == 0x00000000U) || (vendor == 0x0000ffffU) || (vendor == 0xffff0000U) ) @@ -1221,7 +1221,7 @@ static int __init cf_check _scan_pci_devices(struct pci_seg *pseg, void *arg) { for ( func = 0; func < 8; func++ ) { - if ( !pci_device_detect(pseg->nr, bus, dev, func) ) + if ( !pci_device_detect(PCI_SBDF(pseg->nr, bus, dev, func)) ) { if ( !func ) break; diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 2a756831a6..09165efca5 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -389,7 +389,8 @@ static int __init acpi_parse_dev_scope( printk(VTDPREFIX " endpoint: %pp\n", &PCI_SBDF(seg, bus, path->dev, path->fn)); - if ( drhd && pci_device_detect(seg, bus, path->dev, path->fn) ) + if ( drhd && + pci_device_detect(PCI_SBDF(seg, bus, path->dev, path->fn)) ) { if ( pci_conf_read8(PCI_SBDF(seg, bus, path->dev, path->fn), PCI_CLASS_DEVICE + 1) != 0x03 @@ -537,7 +538,7 @@ acpi_parse_one_drhd(struct acpi_dmar_header *header) d = PCI_SLOT(dmaru->scope.devices[i]); f = PCI_FUNC(dmaru->scope.devices[i]); - if ( !pci_device_detect(drhd->segment, b, d, f) ) + if ( !pci_device_detect(PCI_SBDF(drhd->segment, b, d, f)) ) printk(XENLOG_WARNING VTDPREFIX " Non-existent device (%pp) in this DRHD's scope!\n", &PCI_SBDF(drhd->segment, b, d, f)); @@ -573,7 +574,7 @@ static int __init register_one_rmrr(struct acpi_rmrr_unit *rmrru) u8 d = PCI_SLOT(rmrru->scope.devices[i]); u8 f = PCI_FUNC(rmrru->scope.devices[i]); - if ( pci_device_detect(rmrru->segment, b, d, f) == 0 ) + if ( pci_device_detect(PCI_SBDF(rmrru->segment, b, d, f)) == 0 ) { dprintk(XENLOG_WARNING VTDPREFIX, " Non-existent device (%pp) is reported" @@ -767,7 +768,7 @@ static int __init register_one_satc(struct acpi_satc_unit *satcu) uint8_t d = PCI_SLOT(satcu->scope.devices[i]); uint8_t f = PCI_FUNC(satcu->scope.devices[i]); - if ( !pci_device_detect(satcu->segment, b, d, f) ) + if ( !pci_device_detect(PCI_SBDF(satcu->segment, b, d, f)) ) { dprintk(XENLOG_WARNING VTDPREFIX, " Non-existent device (%pp) is reported in SATC scope!\n", diff --git a/xen/include/xen/pci.h b/xen/include/xen/pci.h index afb6bbf50d..ade882caee 100644 --- a/xen/include/xen/pci.h +++ b/xen/include/xen/pci.h @@ -218,7 +218,7 @@ static always_inline bool pcidevs_trylock(void) #endif bool pci_known_segment(u16 seg); -bool pci_device_detect(u16 seg, u8 bus, u8 dev, u8 func); +bool pci_device_detect(pci_sbdf_t sbdf); int scan_pci_devices(void); enum pdev_type pdev_type(u16 seg, u8 bus, u8 devfn); int find_upstream_bridge(u16 seg, u8 *bus, u8 *devfn, u8 *secbus); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 11:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 11:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355351.1610116 (Exim 4.92) (envelope-from ) id 1wghP5-0001KU-NJ; Mon, 06 Jul 2026 11:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355351.1610116; Mon, 06 Jul 2026 11:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghP5-0001KM-Kd; Mon, 06 Jul 2026 11:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1355351; Mon, 06 Jul 2026 11:22:21 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghP3-0001KF-Pr for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:21 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wghP4-00AEJe-09 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:21 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wghP3-00BVm3-2M for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ShSvvv9ZwnjE5g31DGIcy4wxA4qVoYR2InpdG7qP/ck=; b=gaiV0e2askYtHLFm0XhrxuZ7vb qolR/geeORsQOsTCok9fjLFkxlStrrfKk8Xpxb3DhQnvpbQ6tbCxcQGC8qB6oHJUPL1ZVvaxLQAVJ AxFjYRnuNmdk0Hv1dd1lw0+jRl3iTJ5qcvz+bsSiibm8n8h2Do+Na0YRyf/Ts0b8n3LI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libxc: drop size parameter from xc_flask_context_to_sid() Message-Id: Date: Mon, 06 Jul 2026 11:22:21 +0000 commit dc21138144d6b88e5b1fecffa2a80048f560d6e4 Author: Jan Beulich AuthorDate: Mon Jul 6 09:41:45 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:41:45 2026 +0200 libxc: drop size parameter from xc_flask_context_to_sid() Nul-terminated strings are passed in all cases, so the strlen() can very well be invoked by the function itself. In preparation for a hypervisor change also include the nul terminator in the size calculation. Signed-off-by: Jan Beulich Acked-by: Marek Marczykowski-Górecki Reviewed-by: Anthony PERARD Reviewed-by: Daniel P. Smith --- tools/helpers/init-xenstore-domain.c | 2 +- tools/include/xenctrl.h | 2 +- tools/libs/ctrl/xc_flask.c | 9 +++++---- tools/libs/light/libxl_flask.c | 5 ++++- tools/python/xen/lowlevel/xc/xc.c | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/tools/helpers/init-xenstore-domain.c b/tools/helpers/init-xenstore-domain.c index 2be5831a57..6c0c85f032 100644 --- a/tools/helpers/init-xenstore-domain.c +++ b/tools/helpers/init-xenstore-domain.c @@ -108,7 +108,7 @@ static int build(xc_interface *xch) if ( flask ) { - rv = xc_flask_context_to_sid(xch, flask, strlen(flask), &config.ssidref); + rv = xc_flask_context_to_sid(xch, flask, &config.ssidref); if ( rv ) { fprintf(stderr, "xc_flask_context_to_sid failed\n"); diff --git a/tools/include/xenctrl.h b/tools/include/xenctrl.h index f4316089e7..9f00d4a19d 100644 --- a/tools/include/xenctrl.h +++ b/tools/include/xenctrl.h @@ -2377,7 +2377,7 @@ long xc_sharing_used_frames(xc_interface *xch); /*** End sharing interface ***/ int xc_flask_load(xc_interface *xc_handle, char *buf, uint32_t size); -int xc_flask_context_to_sid(xc_interface *xc_handle, char *buf, uint32_t size, uint32_t *sid); +int xc_flask_context_to_sid(xc_interface *xc_handle, char *buf, uint32_t *sid); int xc_flask_sid_to_context(xc_interface *xc_handle, int sid, char *buf, uint32_t size); int xc_flask_getenforce(xc_interface *xc_handle); int xc_flask_setenforce(xc_interface *xc_handle, int mode); diff --git a/tools/libs/ctrl/xc_flask.c b/tools/libs/ctrl/xc_flask.c index f5389dbd96..f275093735 100644 --- a/tools/libs/ctrl/xc_flask.c +++ b/tools/libs/ctrl/xc_flask.c @@ -83,10 +83,11 @@ int xc_flask_load(xc_interface *xch, char *buf, uint32_t size) return err; } -int xc_flask_context_to_sid(xc_interface *xch, char *buf, uint32_t size, uint32_t *sid) +int xc_flask_context_to_sid(xc_interface *xch, char *buf, uint32_t *sid) { int err; struct xen_flask_op op = {}; + size_t size = strlen(buf) + 1; DECLARE_HYPERCALL_BOUNCE(buf, size, XC_HYPERCALL_BUFFER_BOUNCE_IN); if ( xc_hypercall_bounce_pre(xch, buf) ) @@ -249,7 +250,7 @@ static int xc_flask_add(xc_interface *xch, uint32_t ocon, uint64_t low, uint64_t int err; struct xen_flask_op op = {}; - err = xc_flask_context_to_sid(xch, scontext, strlen(scontext), &sid); + err = xc_flask_context_to_sid(xch, scontext, &sid); if ( err ) return err; @@ -325,10 +326,10 @@ int xc_flask_access(xc_interface *xch, const char *scon, const char *tcon, struct xen_flask_op op = {}; int err; - err = xc_flask_context_to_sid(xch, (char*)scon, strlen(scon), &op.u.access.ssid); + err = xc_flask_context_to_sid(xch, (char*)scon, &op.u.access.ssid); if ( err ) return err; - err = xc_flask_context_to_sid(xch, (char*)tcon, strlen(tcon), &op.u.access.tsid); + err = xc_flask_context_to_sid(xch, (char*)tcon, &op.u.access.tsid); if ( err ) return err; diff --git a/tools/libs/light/libxl_flask.c b/tools/libs/light/libxl_flask.c index 38347a31a3..8d9c92bfdc 100644 --- a/tools/libs/light/libxl_flask.c +++ b/tools/libs/light/libxl_flask.c @@ -21,7 +21,10 @@ int libxl_flask_context_to_sid(libxl_ctx *ctx, char *buf, size_t len, { int rc; - rc = xc_flask_context_to_sid(ctx->xch, buf, len, ssidref); + if (len != strlen(buf)) + return ERROR_INVAL; + + rc = xc_flask_context_to_sid(ctx->xch, buf, ssidref); return rc; } diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c index a94f01d40b..7a4bf54597 100644 --- a/tools/python/xen/lowlevel/xc/xc.c +++ b/tools/python/xen/lowlevel/xc/xc.c @@ -1754,7 +1754,7 @@ static PyObject *pyflask_context_to_sid(PyObject *self, PyObject *args, return PyErr_SetFromErrno(xc_error_obj); } - ret = xc_flask_context_to_sid(xc_handle, ctx, strlen(ctx), &sid); + ret = xc_flask_context_to_sid(xc_handle, ctx, &sid); xc_interface_close(xc_handle); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 11:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 11:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355352.1610120 (Exim 4.92) (envelope-from ) id 1wghPF-0001Mi-Ob; Mon, 06 Jul 2026 11:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355352.1610120; Mon, 06 Jul 2026 11:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghPF-0001Ma-Lz; Mon, 06 Jul 2026 11:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1355352; Mon, 06 Jul 2026 11:22:31 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghPD-0001MS-So for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:31 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wghPE-00AEJp-0R for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:31 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wghPD-00BVrg-2g for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:31 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Mz+Qi8llLeWV9yqU5WTR/MZNyp4ay0IF705S3V7iIHk=; b=0uUQNaR4dA+RDLOdJimr+tE6y6 3hh3HgFtQ1N2PVSLHp5yJMoXqPyo6QWoKg4SVRorObxKO/00PVmuPQZ/GiNmACg5VCletikph7lJw gL0VtsfKPmbVPP0TqxmoyuOSuT3f1Hi9w0tyfUKGMRqYe/SQ00pHpO82bouiVAUwSkCo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] lib: make safe_copy_string_from_guest() validate input Message-Id: Date: Mon, 06 Jul 2026 11:22:31 +0000 commit 508209c47305f6655b36933e1bd96a682a438aaa Author: Jan Beulich AuthorDate: Mon Jul 6 09:42:10 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:42:10 2026 +0200 lib: make safe_copy_string_from_guest() validate input ... rather than papering over guest flaws: Strings passed ought to be nul- terminated (yet sadly libxc hasn't been doing so thus far). This way we also avoid order-1 allocations, seeing that all present callers pass PAGE_SIZE for max_size. Signed-off-by: Jan Beulich Reviewed-by: Anthony PERARD Acked-by: Oleksii Kurochko # Changelog --- CHANGELOG.md | 2 ++ xen/include/public/domctl.h | 2 +- xen/include/public/xsm/flask_op.h | 12 ++++++++---- xen/lib/guest-strcpy.c | 14 +++++++++----- 4 files changed, 20 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a4e5f013c..d8287fc311 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ## [4.23.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD ### Changed + - XEN_DOMCTL_DEV_DT's, FLASK_[GS]ETBOOL's, and FLASK_DEVICETREE_LABEL's input + string sizes need to include the nul terminator. ### Added diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h index cdf350a290..510300bb67 100644 --- a/xen/include/public/domctl.h +++ b/xen/include/public/domctl.h @@ -574,7 +574,7 @@ struct xen_domctl_assign_device { uint32_t machine_sbdf; /* machine PCI ID of assigned device */ } pci; struct { - uint32_t size; /* Length of the path */ + uint32_t size; /* Length of the path, including nul terminator */ XEN_GUEST_HANDLE_64(char) path; /* Path to the device tree node */ #ifdef __XEN__ struct dt_device_node *dev; /* Resolved device node of the above */ diff --git a/xen/include/public/xsm/flask_op.h b/xen/include/public/xsm/flask_op.h index 7185e80621..10e4ffe86e 100644 --- a/xen/include/public/xsm/flask_op.h +++ b/xen/include/public/xsm/flask_op.h @@ -26,7 +26,8 @@ typedef struct xen_flask_setenforce xen_flask_setenforce_t; struct xen_flask_sid_context { /* IN/OUT: sid to convert to/from string */ uint32_t sid; - /* IN: size of the context buffer + /* + * IN: size of the context buffer, including nul terminator * OUT: actual size of the output context string */ uint32_t size; @@ -86,8 +87,11 @@ struct xen_flask_boolean { uint8_t new_value; /* IN: commit new value instead of only setting pending [SET] */ uint8_t commit; - /* IN: size of boolean name buffer [GET/SET] - * OUT: actual size of name [GET only] */ + /* + * IN: size of boolean name buffer [GET/SET]; must cover nul terminator + * if "name" (below) is an input + * OUT: actual size of name [GET only] + */ uint32_t size; /* IN: if bool_id is -1, used to find boolean [GET/SET] * OUT: textual name of boolean [GET only] @@ -150,7 +154,7 @@ typedef struct xen_flask_relabel xen_flask_relabel_t; struct xen_flask_devicetree_label { /* IN */ uint32_t sid; - uint32_t length; + uint32_t length; /* length of the path, including nul terminator */ XEN_GUEST_HANDLE(char) path; }; typedef struct xen_flask_devicetree_label xen_flask_devicetree_label_t; diff --git a/xen/lib/guest-strcpy.c b/xen/lib/guest-strcpy.c index 6d38eefedd..94e7e38eda 100644 --- a/xen/lib/guest-strcpy.c +++ b/xen/lib/guest-strcpy.c @@ -3,8 +3,8 @@ #include /* - * The function copies a string from the guest and adds a NUL to - * make sure the string is correctly terminated. + * The function copies a string from the guest and checks there's a NUL + * terminating the string. */ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, size_t size, size_t max_size) @@ -14,8 +14,7 @@ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, if ( size > max_size ) return ERR_PTR(-ENOBUFS); - /* Add an extra +1 to append \0 */ - tmp = xmalloc_array(char, size + 1); + tmp = xmalloc_array(char, size); if ( !tmp ) return ERR_PTR(-ENOMEM); @@ -24,7 +23,12 @@ char *safe_copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, xfree(tmp); return ERR_PTR(-EFAULT); } - tmp[size] = '\0'; + + if ( !memchr(tmp, 0, size) ) + { + xfree(tmp); + return ERR_PTR(-EMSGSIZE); + } return tmp; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 11:22:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 11:22:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355353.1610124 (Exim 4.92) (envelope-from ) id 1wghPP-0001Q7-Q2; Mon, 06 Jul 2026 11:22:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355353.1610124; Mon, 06 Jul 2026 11:22:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghPP-0001Pz-NP; Mon, 06 Jul 2026 11:22:43 +0000 Received: by outflank-mailman (input) for mailman id 1355353; Mon, 06 Jul 2026 11:22:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wghPN-0001Ps-VF for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:41 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wghPO-00AEJt-0h for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:41 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wghPN-00BVzq-2x for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 11:22:41 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6y8JVF4beYe/uYZ21FvGICgUBbA8efhoyR09vFg0wMU=; b=BojwVc+MnUvemupFAcMbZUtvVM hPsZZxF2RlQlNQiXszymegamxnG1pLIf65pjesTAZqMWWu5T2fIOpzdpSIrTLIITk0gcwS9zuMYuB Joqyvc94Sud1AqF8yzWlSt/LedLC/zmYf1kM8KD1rt0Md/Z6VhP74n9WI+O3gQ5WJT4M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/HVM: don't (almost) open-code POP_GPRS Message-Id: Date: Mon, 06 Jul 2026 11:22:41 +0000 commit e58a8e0889b872723ca6720cffb1e15e8e17fc85 Author: Jan Beulich AuthorDate: Mon Jul 6 09:42:46 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 6 09:42:46 2026 +0200 x86/HVM: don't (almost) open-code POP_GPRS It can be used as-is for VMX. For SVM the special treatment of %rax needs accounting for. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/hvm/svm/entry.S | 16 +--------------- xen/arch/x86/hvm/vmx/entry.S | 16 +--------------- xen/arch/x86/include/asm/asm_defns.h | 6 +++++- 3 files changed, 7 insertions(+), 31 deletions(-) diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index af8db23b03..b6ea699bb9 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -82,22 +82,8 @@ __UNLIKELY_END(nsvm_hap) */ sti - pop %r15 - pop %r14 - pop %r13 - pop %r12 - pop %rbp mov VCPU_svm_vmcb_pa(%rbx),%rax - pop %rbx - pop %r11 - pop %r10 - pop %r9 - pop %r8 - pop %rcx /* Skip %rax: restored by VMRUN. */ - pop %rcx - pop %rdx - pop %rsi - pop %rdi + POP_GPRS skip_rax=1 /* %rax restored by VMRUN. */ SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ diff --git a/xen/arch/x86/hvm/vmx/entry.S b/xen/arch/x86/hvm/vmx/entry.S index 2bfee715b3..c34f5a1ee0 100644 --- a/xen/arch/x86/hvm/vmx/entry.S +++ b/xen/arch/x86/hvm/vmx/entry.S @@ -139,21 +139,7 @@ UNLIKELY_END(realmode) and $SCF_verw, %eax or %eax, %ecx - pop %r15 - pop %r14 - pop %r13 - pop %r12 - pop %rbp - pop %rbx - pop %r11 - pop %r10 - pop %r9 - pop %r8 - pop %rax - pop %rcx - pop %rdx - pop %rsi - pop %rdi + POP_GPRS /* Preserves flags. */ jpe .L_skip_verw /* VERW clobbers ZF, but preserves all others, including SF. */ diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index 0dd63270fc..87bd6b1193 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -357,7 +357,7 @@ static always_inline void stac(void) /* * POP GPRs from a UREGS_* frame on the stack. Does not modify flags. */ -.macro POP_GPRS +.macro POP_GPRS skip_rax=0 pop %r15 pop %r14 pop %r13 @@ -368,7 +368,11 @@ static always_inline void stac(void) pop %r10 pop %r9 pop %r8 + .if \skip_rax + pop %rcx + .else pop %rax + .endif pop %rcx pop %rdx pop %rsi -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 14:22:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 14:22:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355405.1610165 (Exim 4.92) (envelope-from ) id 1wgkCz-0007Zs-Bj; Mon, 06 Jul 2026 14:22:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355405.1610165; Mon, 06 Jul 2026 14:22:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkCz-0007Zk-9D; Mon, 06 Jul 2026 14:22:05 +0000 Received: by outflank-mailman (input) for mailman id 1355405; Mon, 06 Jul 2026 14:22:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkCx-0007Ze-UF for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgkCx-00AHnd-1y for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgkCx-00F9Vi-0n for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TQD+Qz2sfhZSAXll4l3SAI2BP5IcI1MUJgR8O3Zwmg8=; b=6q+cFG4YC3IupIdcmIL5gTM8ks rlM8f0gNRo4VpC1q/nuYPojWjJaHM2UZv36Z87WsoWs/hMzoyABfQqEyUFjz6WtxKNpydwOkzo5BT iodEphBTCg1y8STpnWmuoBIdNfa01Z7pWJPWbyUVE5MaJPVB27saXtUphhPxUMcV+g1U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/kexec: Drop compat_mode_gdt_desc Message-Id: Date: Mon, 06 Jul 2026 14:22:03 +0000 commit be22d975b0017b10daec42f21471caccb9a3d241 Author: Andrew Cooper AuthorDate: Mon Mar 16 14:29:28 2026 +0000 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 x86/kexec: Drop compat_mode_gdt_desc Given the need to calculate the base anyway, it's easier to do so entirely on the stack. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/x86_64/kexec_reloc.S | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/x86_64/kexec_reloc.S b/xen/arch/x86/x86_64/kexec_reloc.S index 81da81a827..1d023733a9 100644 --- a/xen/arch/x86/x86_64/kexec_reloc.S +++ b/xen/arch/x86/x86_64/kexec_reloc.S @@ -114,9 +114,11 @@ FUNC(kexec_reloc, PAGE_SIZE) .L_call_32_bit: /* Load compat GDT. */ - leaq compat_mode_gdt(%rip), %rax - movq %rax, (compat_mode_gdt_desc + 2)(%rip) - lgdt compat_mode_gdt_desc(%rip) + lea compat_mode_gdt(%rip), %rax + push %rax + pushw $.Lcompat_mode_gdt_end - 1 - compat_mode_gdt + lgdt (%rsp) + add $10, %rsp /* Enter compatibility mode. */ lea compatibility_mode(%rip), %rax @@ -206,11 +208,6 @@ END(compatibility_mode) /* Separate code and data into into different cache lines */ .balign L1_CACHE_BYTES -DATA_LOCAL(compat_mode_gdt_desc, 4) - .word .Lcompat_mode_gdt_end - compat_mode_gdt -1 - .quad 0x0000000000000000 /* set in call_32_bit above */ -END(compat_mode_gdt_desc) - DATA_LOCAL(compat_mode_gdt, 8) .quad 0x0000000000000000 /* null */ .quad 0x00cf93000000ffff /* 0x0008 ring 0 data */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 14:22:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 14:22:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355406.1610169 (Exim 4.92) (envelope-from ) id 1wgkD8-0007bd-DB; Mon, 06 Jul 2026 14:22:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355406.1610169; Mon, 06 Jul 2026 14:22:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkD8-0007bV-AX; Mon, 06 Jul 2026 14:22:14 +0000 Received: by outflank-mailman (input) for mailman id 1355406; Mon, 06 Jul 2026 14:22:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkD7-0007bL-Ga for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgkD7-00AHni-2P for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgkD7-00F9qP-1L for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vuxRBoPTSiiLd9fSKMPHaDs69Af8QFUHfkR3Ec7bNpQ=; b=4YWIKAAQE5+/TFvXuYWyHy8t4v fX/VAIV4VKbwtxf4bFUMJJkIiizqv9YVrjqRL4zqWyrmtbf9kUVpbUD60TB0eHb+irAakTZ4T+RZs Xa1DJg15PMXasqLDH7Epp/ICLu+rqdUsLVGaIewsN1kak2P7sro3SRTEOyqZ4B5yub5E=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] stubdom: remove c-stubdom Message-Id: Date: Mon, 06 Jul 2026 14:22:13 +0000 commit 95c36e9d87ad68d1b784bb4be5c53230bf71f4be Author: Juergen Gross AuthorDate: Mon Jul 6 11:05:20 2026 +0200 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 stubdom: remove c-stubdom C-stubdom was meant as a base for building new Mini-OS based stubdoms. It hasn't seen any work for many years now and creating new stubdoms should use UNIKRAFT instead of Mini-OS. So remove c-stubdom. Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- stubdom/Makefile | 19 ------------------- stubdom/c/Makefile | 13 ------------- stubdom/c/main.c | 8 -------- stubdom/c/minios.cfg | 2 -- stubdom/configure | 44 -------------------------------------------- stubdom/configure.ac | 1 - 6 files changed, 87 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index 9aa0d3dee4..acd5e56f16 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -339,17 +339,6 @@ $(TARGETS_MINIOS): mini-os-%: mkdir -p $@/$$i ; \ done -### -# C -### - -c-minios-config.mk: $(CURDIR)/c/minios.cfg - MINIOS_CONFIG="$<" CONFIG_FILE="$(CURDIR)/$@" $(MAKE) DESTDIR= -C $(MINI_OS) config - -.PHONY: c -c: $(CROSS_ROOT) c-minios-config.mk - CPPFLAGS="$(TARGET_CPPFLAGS) $(shell cat c-minios-config.mk)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) DESTDIR= -C $@ LWIPDIR=$(CURDIR)/lwip-$(XEN_TARGET_ARCH) - ###### # VTPM ###### @@ -432,10 +421,6 @@ xenstorepvh: $(CROSS_ROOT) xenstorepvh-minios-config.mk # minios ######## -.PHONY: c-stubdom -c-stubdom: mini-os-$(XEN_TARGET_ARCH)-c lwip-$(XEN_TARGET_ARCH) libxenguest c - DEF_CPPFLAGS="$(TARGET_CPPFLAGS)" DEF_CFLAGS="$(TARGET_CFLAGS)" DEF_LDFLAGS="$(TARGET_LDFLAGS)" MINIOS_CONFIG="$(CURDIR)/c/minios.cfg" $(MAKE) DESTDIR= -C $(MINI_OS) OBJ_DIR=$(CURDIR)/$< LWIPDIR=$(CURDIR)/lwip-$(XEN_TARGET_ARCH) APP_OBJS=$(CURDIR)/c/main.a - .PHONY: vtpm-stubdom vtpm-stubdom: mini-os-$(XEN_TARGET_ARCH)-vtpm vtpm DEF_CPPFLAGS="$(TARGET_CPPFLAGS)" DEF_CFLAGS="$(TARGET_CFLAGS)" DEF_LDFLAGS="$(TARGET_LDFLAGS)" MINIOS_CONFIG="$(CURDIR)/vtpm/minios.cfg" $(MAKE) -C $(MINI_OS) OBJ_DIR=$(CURDIR)/$< APP_OBJS="$(CURDIR)/vtpm/vtpm.a" APP_LDLIBS="-ltpm -ltpm_crypto -lgmp -lpolarssl" @@ -485,8 +470,6 @@ else install-grub-if-enabled: endif -install-c: c-stubdom - install-xenstore: xenstore-stubdom $(INSTALL_DIR) "$(DESTDIR)$(XENFIRMWAREDIR)" $(INSTALL_DATA) mini-os-$(XEN_TARGET_ARCH)-xenstore/mini-os.gz "$(DESTDIR)$(XENFIRMWAREDIR)/xenstore-stubdom.gz" @@ -540,13 +523,11 @@ uninstall-vtpmmgr: .PHONY: clean clean: $(foreach lib,$(STUB_LIBS),clean-libxen$(lib)) clean: - rm -fr mini-os-$(XEN_TARGET_ARCH)-c rm -fr mini-os-$(XEN_TARGET_ARCH)-grub rm -fr mini-os-$(XEN_TARGET_ARCH)-xenstore rm -fr mini-os-$(XEN_TARGET_ARCH)-xenstorepvh rm -fr mini-os-$(XEN_TARGET_ARCH)-vtpm rm -fr mini-os-$(XEN_TARGET_ARCH)-vtpmmgr - $(MAKE) DESTDIR= -C c clean $(MAKE) -C vtpm clean $(MAKE) -C vtpmmgr clean rm -fr grub-$(XEN_TARGET_ARCH) diff --git a/stubdom/c/Makefile b/stubdom/c/Makefile deleted file mode 100644 index b252dcad0b..0000000000 --- a/stubdom/c/Makefile +++ /dev/null @@ -1,13 +0,0 @@ -XEN_ROOT = $(CURDIR)/../.. - -ifeq (,$(findstring clean,$(MAKECMDGOALS))) -include $(XEN_ROOT)/Config.mk -endif - -all: main.a - -main.a: main.o - $(AR) cr $@ $^ - -clean: - rm -f *.a *.o diff --git a/stubdom/c/main.c b/stubdom/c/main.c deleted file mode 100644 index f97a0f72d4..0000000000 --- a/stubdom/c/main.c +++ /dev/null @@ -1,8 +0,0 @@ -#include -#include - -int main(void) { - sleep(2); - printf("Hello, world!\n"); - return 0; -} diff --git a/stubdom/c/minios.cfg b/stubdom/c/minios.cfg deleted file mode 100644 index 56d65510cd..0000000000 --- a/stubdom/c/minios.cfg +++ /dev/null @@ -1,2 +0,0 @@ -CONFIG_LIBC=y -CONFIG_LWIP=y diff --git a/stubdom/configure b/stubdom/configure index e127ef44eb..8a0a798bd2 100755 --- a/stubdom/configure +++ b/stubdom/configure @@ -661,7 +661,6 @@ debug xenstorepvh xenstore grub -c host_os host_vendor host_cpu @@ -712,7 +711,6 @@ SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking -enable_c_stubdom enable_pv_grub enable_xenstore_stubdom enable_xenstorepvh_stubdom @@ -1360,7 +1358,6 @@ Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] - --enable-c-stubdom Build and install c-stubdom (default is DISABLED) --enable-pv-grub Build and install pv-grub (default is DISABLED) --disable-xenstore-stubdom Build and install xenstore-stubdom (default is @@ -2406,47 +2403,6 @@ case $host_os in *\ *) host_os=`echo "$host_os" | sed 's/ /-/g'`;; esac # Enable/disable stub domains -# Check whether --enable-c-stubdom was given. -if test ${enable_c_stubdom+y} -then : - enableval=$enable_c_stubdom; - -if test "x$enableval" = "xyes" -then : - - -c=y -STUBDOM_TARGETS="$STUBDOM_TARGETS c" -STUBDOM_BUILD="$STUBDOM_BUILD c-stubdom" -STUBDOM_INSTALL="$STUBDOM_INSTALL install-c" -STUBDOM_UNINSTALL="$STUBDOM_UNINSTALL install-c" - - -else $as_nop - -if test "x$enableval" = "xno" -then : - - -c=n - - -fi - -fi - - -else $as_nop - - -c=n - - -fi - - - - # Check whether --enable-pv-grub was given. if test ${enable_pv_grub+y} then : diff --git a/stubdom/configure.ac b/stubdom/configure.ac index f07b08c5b3..33f170144e 100644 --- a/stubdom/configure.ac +++ b/stubdom/configure.ac @@ -18,7 +18,6 @@ m4_include([../m4/depends.m4]) m4_include([../m4/fetcher.m4]) # Enable/disable stub domains -AX_STUBDOM_DEFAULT_DISABLE([c-stubdom], [c]) AX_STUBDOM_DEFAULT_DISABLE([pv-grub], [grub]) AX_STUBDOM_DEFAULT_ENABLE([xenstore-stubdom], [xenstore]) AX_STUBDOM_DEFAULT_ENABLE([xenstorepvh-stubdom], [xenstorepvh]) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 14:22:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 14:22:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355407.1610173 (Exim 4.92) (envelope-from ) id 1wgkDI-0007di-EV; Mon, 06 Jul 2026 14:22:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355407.1610173; Mon, 06 Jul 2026 14:22:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkDI-0007da-Br; Mon, 06 Jul 2026 14:22:24 +0000 Received: by outflank-mailman (input) for mailman id 1355407; Mon, 06 Jul 2026 14:22:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgkDH-0007dU-Jl for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wgkDH-00AHo5-2m for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wgkDH-00F9uG-1g for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 14:22:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Olrx8UwGLYXF2K0flWj1cLFDhDUJupGPXo1dDao5qKw=; b=RNXaXLubYnscaDBPYnXlmSwMpF UzAsXgrTFbXm2ZnrAywQeccufkAIdCU67DXJWeeI+qQZRZLX7Wzx1glyCz4ND60n/bKk4aGp+Z713 3en+6TtjpOlBY8Y/gHnMFDdZDDkAmo7nvv0mSbONmgrKBttsmSW+2T1ST1YfOwAg48OM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] CHANGELOG: add entry for removed c-stubdom Message-Id: Date: Mon, 06 Jul 2026 14:22:23 +0000 commit eca5f92e6b6b6135092ec179647a9349dfe8f907 Author: Juergen Gross AuthorDate: Mon Jul 6 11:05:21 2026 +0200 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 CHANGELOG: add entry for removed c-stubdom Signed-off-by: Juergen Gross Reviewed-by: Teddy Astie Acked-by: Oleksii Kurochko --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8287fc311..356be88351 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - The kexec "v1" interface, which was declared obsolete in Xen 4.4 (2013). The only known user was the classic-xen fork of Linux. This does not affect Xen kexec support in the kexec-tools package. + - The example stubdom "c-stubdom" has been removed. ## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 15:55:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 15:55:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355475.1610243 (Exim 4.92) (envelope-from ) id 1wgley-0005kS-94; Mon, 06 Jul 2026 15:55:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355475.1610243; Mon, 06 Jul 2026 15:55:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wgley-0005kK-6b; Mon, 06 Jul 2026 15:55:04 +0000 Received: by outflank-mailman (input) for mailman id 1355475; Mon, 06 Jul 2026 15:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wglew-0005kE-KJ for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wglew-00AJUF-1w for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wglew-00HSE2-0u for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ftQwTvoILYgK6rmXXAoEHOyinGKz6fnONRYHuemlg10=; b=v/NbjqJzkA59Id74i/a70Sxwx2 DYcygg1NRBone0KZXENTlvKwuoA5e6whfQaAw17iJGla4Hmxv5z08n5J+mlMFaC0RShF0RSbLyc3v m2dvAWH0DHiTcFmfdpJMepn5RRRZ7kYIaYlT6CmeGavUzY6QpuwZldbvRLPzB1Jx+cto=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/kexec: Drop compat_mode_gdt_desc Message-Id: Date: Mon, 06 Jul 2026 15:55:02 +0000 commit be22d975b0017b10daec42f21471caccb9a3d241 Author: Andrew Cooper AuthorDate: Mon Mar 16 14:29:28 2026 +0000 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 x86/kexec: Drop compat_mode_gdt_desc Given the need to calculate the base anyway, it's easier to do so entirely on the stack. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/x86_64/kexec_reloc.S | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/x86_64/kexec_reloc.S b/xen/arch/x86/x86_64/kexec_reloc.S index 81da81a827..1d023733a9 100644 --- a/xen/arch/x86/x86_64/kexec_reloc.S +++ b/xen/arch/x86/x86_64/kexec_reloc.S @@ -114,9 +114,11 @@ FUNC(kexec_reloc, PAGE_SIZE) .L_call_32_bit: /* Load compat GDT. */ - leaq compat_mode_gdt(%rip), %rax - movq %rax, (compat_mode_gdt_desc + 2)(%rip) - lgdt compat_mode_gdt_desc(%rip) + lea compat_mode_gdt(%rip), %rax + push %rax + pushw $.Lcompat_mode_gdt_end - 1 - compat_mode_gdt + lgdt (%rsp) + add $10, %rsp /* Enter compatibility mode. */ lea compatibility_mode(%rip), %rax @@ -206,11 +208,6 @@ END(compatibility_mode) /* Separate code and data into into different cache lines */ .balign L1_CACHE_BYTES -DATA_LOCAL(compat_mode_gdt_desc, 4) - .word .Lcompat_mode_gdt_end - compat_mode_gdt -1 - .quad 0x0000000000000000 /* set in call_32_bit above */ -END(compat_mode_gdt_desc) - DATA_LOCAL(compat_mode_gdt, 8) .quad 0x0000000000000000 /* null */ .quad 0x00cf93000000ffff /* 0x0008 ring 0 data */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 15:55:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 15:55:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355476.1610248 (Exim 4.92) (envelope-from ) id 1wglf8-0005mC-Ar; Mon, 06 Jul 2026 15:55:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355476.1610248; Mon, 06 Jul 2026 15:55:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wglf8-0005m4-7w; Mon, 06 Jul 2026 15:55:14 +0000 Received: by outflank-mailman (input) for mailman id 1355476; Mon, 06 Jul 2026 15:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wglf6-0005lw-R4 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wglf7-00AJW7-0C for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wglf6-00HSOJ-28 for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IbcoeRBe/jqY+NXCh0jBea1mCxVBuKsy8o6v+oJ8gfE=; b=CR416JDwqs5YIqHhWtCjucdgTZ Y6t0YqUfqUe2tzIz9WSlHzi2f8R5tMJSZJiRuZJdcUrS4u8Erbiaa2k3arMGV1ml2tUAU+fzBRCLO Wj47J9c2FSt3qk/NAnpaXxUJaXBjpO3m9FjLtccpizDzvPVYTKMdz9vK10NyvHP0B48M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] stubdom: remove c-stubdom Message-Id: Date: Mon, 06 Jul 2026 15:55:12 +0000 commit 95c36e9d87ad68d1b784bb4be5c53230bf71f4be Author: Juergen Gross AuthorDate: Mon Jul 6 11:05:20 2026 +0200 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 stubdom: remove c-stubdom C-stubdom was meant as a base for building new Mini-OS based stubdoms. It hasn't seen any work for many years now and creating new stubdoms should use UNIKRAFT instead of Mini-OS. So remove c-stubdom. Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- stubdom/Makefile | 19 ------------------- stubdom/c/Makefile | 13 ------------- stubdom/c/main.c | 8 -------- stubdom/c/minios.cfg | 2 -- stubdom/configure | 44 -------------------------------------------- stubdom/configure.ac | 1 - 6 files changed, 87 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index 9aa0d3dee4..acd5e56f16 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -339,17 +339,6 @@ $(TARGETS_MINIOS): mini-os-%: mkdir -p $@/$$i ; \ done -### -# C -### - -c-minios-config.mk: $(CURDIR)/c/minios.cfg - MINIOS_CONFIG="$<" CONFIG_FILE="$(CURDIR)/$@" $(MAKE) DESTDIR= -C $(MINI_OS) config - -.PHONY: c -c: $(CROSS_ROOT) c-minios-config.mk - CPPFLAGS="$(TARGET_CPPFLAGS) $(shell cat c-minios-config.mk)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) DESTDIR= -C $@ LWIPDIR=$(CURDIR)/lwip-$(XEN_TARGET_ARCH) - ###### # VTPM ###### @@ -432,10 +421,6 @@ xenstorepvh: $(CROSS_ROOT) xenstorepvh-minios-config.mk # minios ######## -.PHONY: c-stubdom -c-stubdom: mini-os-$(XEN_TARGET_ARCH)-c lwip-$(XEN_TARGET_ARCH) libxenguest c - DEF_CPPFLAGS="$(TARGET_CPPFLAGS)" DEF_CFLAGS="$(TARGET_CFLAGS)" DEF_LDFLAGS="$(TARGET_LDFLAGS)" MINIOS_CONFIG="$(CURDIR)/c/minios.cfg" $(MAKE) DESTDIR= -C $(MINI_OS) OBJ_DIR=$(CURDIR)/$< LWIPDIR=$(CURDIR)/lwip-$(XEN_TARGET_ARCH) APP_OBJS=$(CURDIR)/c/main.a - .PHONY: vtpm-stubdom vtpm-stubdom: mini-os-$(XEN_TARGET_ARCH)-vtpm vtpm DEF_CPPFLAGS="$(TARGET_CPPFLAGS)" DEF_CFLAGS="$(TARGET_CFLAGS)" DEF_LDFLAGS="$(TARGET_LDFLAGS)" MINIOS_CONFIG="$(CURDIR)/vtpm/minios.cfg" $(MAKE) -C $(MINI_OS) OBJ_DIR=$(CURDIR)/$< APP_OBJS="$(CURDIR)/vtpm/vtpm.a" APP_LDLIBS="-ltpm -ltpm_crypto -lgmp -lpolarssl" @@ -485,8 +470,6 @@ else install-grub-if-enabled: endif -install-c: c-stubdom - install-xenstore: xenstore-stubdom $(INSTALL_DIR) "$(DESTDIR)$(XENFIRMWAREDIR)" $(INSTALL_DATA) mini-os-$(XEN_TARGET_ARCH)-xenstore/mini-os.gz "$(DESTDIR)$(XENFIRMWAREDIR)/xenstore-stubdom.gz" @@ -540,13 +523,11 @@ uninstall-vtpmmgr: .PHONY: clean clean: $(foreach lib,$(STUB_LIBS),clean-libxen$(lib)) clean: - rm -fr mini-os-$(XEN_TARGET_ARCH)-c rm -fr mini-os-$(XEN_TARGET_ARCH)-grub rm -fr mini-os-$(XEN_TARGET_ARCH)-xenstore rm -fr mini-os-$(XEN_TARGET_ARCH)-xenstorepvh rm -fr mini-os-$(XEN_TARGET_ARCH)-vtpm rm -fr mini-os-$(XEN_TARGET_ARCH)-vtpmmgr - $(MAKE) DESTDIR= -C c clean $(MAKE) -C vtpm clean $(MAKE) -C vtpmmgr clean rm -fr grub-$(XEN_TARGET_ARCH) diff --git a/stubdom/c/Makefile b/stubdom/c/Makefile deleted file mode 100644 index b252dcad0b..0000000000 --- a/stubdom/c/Makefile +++ /dev/null @@ -1,13 +0,0 @@ -XEN_ROOT = $(CURDIR)/../.. - -ifeq (,$(findstring clean,$(MAKECMDGOALS))) -include $(XEN_ROOT)/Config.mk -endif - -all: main.a - -main.a: main.o - $(AR) cr $@ $^ - -clean: - rm -f *.a *.o diff --git a/stubdom/c/main.c b/stubdom/c/main.c deleted file mode 100644 index f97a0f72d4..0000000000 --- a/stubdom/c/main.c +++ /dev/null @@ -1,8 +0,0 @@ -#include -#include - -int main(void) { - sleep(2); - printf("Hello, world!\n"); - return 0; -} diff --git a/stubdom/c/minios.cfg b/stubdom/c/minios.cfg deleted file mode 100644 index 56d65510cd..0000000000 --- a/stubdom/c/minios.cfg +++ /dev/null @@ -1,2 +0,0 @@ -CONFIG_LIBC=y -CONFIG_LWIP=y diff --git a/stubdom/configure b/stubdom/configure index e127ef44eb..8a0a798bd2 100755 --- a/stubdom/configure +++ b/stubdom/configure @@ -661,7 +661,6 @@ debug xenstorepvh xenstore grub -c host_os host_vendor host_cpu @@ -712,7 +711,6 @@ SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking -enable_c_stubdom enable_pv_grub enable_xenstore_stubdom enable_xenstorepvh_stubdom @@ -1360,7 +1358,6 @@ Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] - --enable-c-stubdom Build and install c-stubdom (default is DISABLED) --enable-pv-grub Build and install pv-grub (default is DISABLED) --disable-xenstore-stubdom Build and install xenstore-stubdom (default is @@ -2406,47 +2403,6 @@ case $host_os in *\ *) host_os=`echo "$host_os" | sed 's/ /-/g'`;; esac # Enable/disable stub domains -# Check whether --enable-c-stubdom was given. -if test ${enable_c_stubdom+y} -then : - enableval=$enable_c_stubdom; - -if test "x$enableval" = "xyes" -then : - - -c=y -STUBDOM_TARGETS="$STUBDOM_TARGETS c" -STUBDOM_BUILD="$STUBDOM_BUILD c-stubdom" -STUBDOM_INSTALL="$STUBDOM_INSTALL install-c" -STUBDOM_UNINSTALL="$STUBDOM_UNINSTALL install-c" - - -else $as_nop - -if test "x$enableval" = "xno" -then : - - -c=n - - -fi - -fi - - -else $as_nop - - -c=n - - -fi - - - - # Check whether --enable-pv-grub was given. if test ${enable_pv_grub+y} then : diff --git a/stubdom/configure.ac b/stubdom/configure.ac index f07b08c5b3..33f170144e 100644 --- a/stubdom/configure.ac +++ b/stubdom/configure.ac @@ -18,7 +18,6 @@ m4_include([../m4/depends.m4]) m4_include([../m4/fetcher.m4]) # Enable/disable stub domains -AX_STUBDOM_DEFAULT_DISABLE([c-stubdom], [c]) AX_STUBDOM_DEFAULT_DISABLE([pv-grub], [grub]) AX_STUBDOM_DEFAULT_ENABLE([xenstore-stubdom], [xenstore]) AX_STUBDOM_DEFAULT_ENABLE([xenstorepvh-stubdom], [xenstorepvh]) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 06 15:55:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 06 Jul 2026 15:55:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1355477.1610252 (Exim 4.92) (envelope-from ) id 1wglfI-0005oD-CD; Mon, 06 Jul 2026 15:55:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1355477.1610252; Mon, 06 Jul 2026 15:55:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wglfI-0005o6-9J; Mon, 06 Jul 2026 15:55:24 +0000 Received: by outflank-mailman (input) for mailman id 1355477; Mon, 06 Jul 2026 15:55:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wglfH-0005ny-8T for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wglfH-00AJWl-1b for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wglfH-00HSo7-0O for xen-changelog@lists.xenproject.org; Mon, 06 Jul 2026 15:55:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Yq4Z7kuFXaIOhT6ue1ewmPcosBfbRkC6XiFshOMn3KM=; b=zFj8NuZ87dOqIiO0KdktwRjqV+ jI3KmKUn2AqWY43n8MXtSZa2iBpXgcqn4C8rcf6JcD65q9jlITBBRwV21677xne7gJv1yAJN3I789 hGI2gGqI1yhvHbU+j25AW3iAddUwTLvrCTgBZycxABttFHYK85x1lEQcOmRaeZgRYelI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] CHANGELOG: add entry for removed c-stubdom Message-Id: Date: Mon, 06 Jul 2026 15:55:23 +0000 commit eca5f92e6b6b6135092ec179647a9349dfe8f907 Author: Juergen Gross AuthorDate: Mon Jul 6 11:05:21 2026 +0200 Commit: Andrew Cooper CommitDate: Mon Jul 6 13:44:05 2026 +0100 CHANGELOG: add entry for removed c-stubdom Signed-off-by: Juergen Gross Reviewed-by: Teddy Astie Acked-by: Oleksii Kurochko --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8287fc311..356be88351 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - The kexec "v1" interface, which was declared obsolete in Xen 4.4 (2013). The only known user was the classic-xen fork of Linux. This does not affect Xen kexec support in the kexec-tools package. + - The example stubdom "c-stubdom" has been removed. ## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 09:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 09:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356145.1610796 (Exim 4.92) (envelope-from ) id 1wh2W7-0000JY-Jl; Tue, 07 Jul 2026 09:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356145.1610796; Tue, 07 Jul 2026 09:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2W7-0000JQ-H5; Tue, 07 Jul 2026 09:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1356145; Tue, 07 Jul 2026 09:55:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2W6-0000JK-Vb for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh2W6-00BrDO-38 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh2W6-009tjt-1g for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LG+j8TvFVDim5NBHNlMXi+JBt7gF+IBsUBJ2MSHz8ec=; b=ZgidlvU9qxQOt27K3bDe2rrD5M 21JTmWMM5OUdoLboc5ds5vVXOq7BtmBimd4ukNNzxjwmHs2kIfWq1+NZKZS5V+hdfy8xNwAyFuHp9 RgYXlBgH2UvvGkNTjI0ewUnYRkJxoMS1okWPBU6sRb9zoBvPEsjqL38VCYMghWoR4xBY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/arm: move declaration of map_device_irqs_to_domain() to common header Message-Id: Date: Tue, 07 Jul 2026 09:55:02 +0000 commit acaf298028b91250bab782cf88a77d7f56f98cfe Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:07:35 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:07:35 2026 +0200 xen/arm: move declaration of map_device_irqs_to_domain() to common header As map_device_irqs_to_domain() is used unconditionally by common part of dom0less code, move the prototype to a common header. fdt-domain-build.h is chosen as map_device_irqs_to_domain() could be also called indirectly in Arm's DOM0-related code and DT overlay feature. Signed-off-by: Oleksii Kurochko Reviewed-by: Michal Orzel --- xen/arch/arm/device.c | 9 +-------- xen/arch/arm/include/asm/setup.h | 3 --- xen/include/xen/fdt-domain-build.h | 13 +++++++++++++ 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/device.c b/xen/arch/arm/device.c index 7d9644fd8b..b11366d722 100644 --- a/xen/arch/arm/device.c +++ b/xen/arch/arm/device.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include @@ -117,14 +118,6 @@ int __overlay_init map_range_to_domain(const struct dt_device_node *dev, return 0; } -/* - * map_device_irqs_to_domain retrieves the interrupts configuration from - * a device tree node and maps those interrupts to the target domain. - * - * Returns: - * < 0 error - * 0 success - */ int __overlay_init map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, bool need_mapping, diff --git a/xen/arch/arm/include/asm/setup.h b/xen/arch/arm/include/asm/setup.h index 0d29b46ea5..0adfa4993a 100644 --- a/xen/arch/arm/include/asm/setup.h +++ b/xen/arch/arm/include/asm/setup.h @@ -53,9 +53,6 @@ void init_traps(void); int handle_device(struct domain *d, struct dt_device_node *dev, p2m_type_t p2mt, struct rangeset *iomem_ranges, struct rangeset *irq_ranges); -int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, - bool need_mapping, struct rangeset *irq_ranges); - int map_irq_to_domain(struct domain *d, unsigned int irq, bool need_mapping, const char *devname); diff --git a/xen/include/xen/fdt-domain-build.h b/xen/include/xen/fdt-domain-build.h index 671486c1c8..8612e98dfd 100644 --- a/xen/include/xen/fdt-domain-build.h +++ b/xen/include/xen/fdt-domain-build.h @@ -12,6 +12,7 @@ struct domain; struct page_info; +struct rangeset; struct membanks; typedef bool (*alloc_domheap_mem_cb)(struct domain *d, struct page_info *pg, @@ -79,6 +80,18 @@ static inline void set_domain_type(struct domain *d, const struct kernel_info *k #endif } +/* + * Retrieves the interrupts configuration from a device tree node and maps + * those interrupts to the target domain. + * + * Returns: + * < 0 error + * 0 success + */ +int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, + bool need_mapping, + struct rangeset *irq_ranges); + #endif /* __XEN_FDT_DOMAIN_BUILD_H__ */ /* -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 09:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 09:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356146.1610799 (Exim 4.92) (envelope-from ) id 1wh2WH-0000LR-LI; Tue, 07 Jul 2026 09:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356146.1610799; Tue, 07 Jul 2026 09:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2WH-0000LI-Ic; Tue, 07 Jul 2026 09:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1356146; Tue, 07 Jul 2026 09:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2WG-0000LA-QC for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh2WH-00BrFG-0B for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh2WG-009tuC-2P for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CoPiAXsiZbQTtpsy68/pqsALfwAFSjFxHkW5QC8F7L4=; b=OMhI1j2HxtCUzj7WSraqo/FroI bvHqTTyhImpEjje8YBgt573bX8iIF1vxvBWs/Jk/yhfGwdDw2W9509n413ubb1d9NWzIDSMqL8msg jE8UM2S6juJJVrlV9/rmiENfpmjSjjpHMLQzMJYgaTs3a/jYlRJK4Bw8HxGVUDqvEpas=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/Kconfig: introduce HAS_STATIC_MEMORY Message-Id: Date: Tue, 07 Jul 2026 09:55:12 +0000 commit 62599910858a980d1a8bc67f04f5a03b50f0569e Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:10:41 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:10:41 2026 +0200 xen/Kconfig: introduce HAS_STATIC_MEMORY Introduce HAS_STATIC_MEMORY so that STATIC_MEMORY can be enabled or disabled on a per-architecture basis. ARM selects the new flag; RISC-V does not, so CONFIG_STATIC_MEMORY is unavailable on RISC-V and randconfig builds no longer require an explicit STATIC_MEMORY=n override to avoid a compilation error. Suggested-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Michal Orzel --- xen/arch/arm/Kconfig | 1 + xen/common/Kconfig | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index 5fa89fcb24..843a43897e 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -21,6 +21,7 @@ config ARM select HAS_DOM0LESS select HAS_GRANT_CACHE_FLUSH if GRANT_TABLE select HAS_STACK_PROTECTOR + select HAS_STATIC_MEMORY select HAS_UBSAN config ARCH_DEFCONFIG diff --git a/xen/common/Kconfig b/xen/common/Kconfig index 5ff71480ee..da80fdba84 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -158,6 +158,9 @@ config HAS_PMAP config HAS_SCHED_GRANULARITY bool +config HAS_STATIC_MEMORY + bool + config HAS_SOFT_RESET bool @@ -193,6 +196,7 @@ config NUMA config STATIC_MEMORY bool "Static Allocation Support (UNSUPPORTED)" if UNSUPPORTED + depends on HAS_STATIC_MEMORY depends on DOM0LESS_BOOT && HAS_DEVICE_TREE_DISCOVERY help Static Allocation refers to system or sub-system(domains) for -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 09:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 09:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356147.1610804 (Exim 4.92) (envelope-from ) id 1wh2WR-0000Ne-MY; Tue, 07 Jul 2026 09:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356147.1610804; Tue, 07 Jul 2026 09:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2WR-0000NW-Jz; Tue, 07 Jul 2026 09:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1356147; Tue, 07 Jul 2026 09:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2WQ-0000NO-Tr for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh2WR-00BrFt-0X for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh2WQ-009u7X-2g for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7OvtOXmdai6gqEX8IT1MRPdMYcuc1T60qXrUWmLv90M=; b=46tujJRWSprDT+czd0YMC/7gtH fM5oe2Dlz4AD3y5IQcRaGiNnBxWVdjsAVwgA3GucrI8XAfJjQRCcvGMkGEP9sAXkFcWfrms5VyQbl 2qhCuflia6ZAplOy/lDQdGll+88y2QRrh9YS50V6NMJeIiVOXdJVDZuPLe6QuwdAqCfk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/riscv: implement prerequisites for domain_create() Message-Id: Date: Tue, 07 Jul 2026 09:55:22 +0000 commit 7bab7aabff2fae063a9f1a15878d6865ea3d5e57 Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:14:07 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:14:07 2026 +0200 xen/riscv: implement prerequisites for domain_create() arch_domain_create() and arch_sanitise_domain_config() are prerequisites for domain_create(). arch_sanitise_domain_config() currently returns 0, as there is no specific work required at this stage. arch_domain_create() performs basic initialization, such as setting up the P2M and initializing of next unused phandle. Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/domain.c | 29 +++++++++++++++++++++++++++++ xen/arch/riscv/stubs.c | 17 ----------------- 2 files changed, 29 insertions(+), 17 deletions(-) diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c index c77be3b827..2819ff4e7c 100644 --- a/xen/arch/riscv/domain.c +++ b/xen/arch/riscv/domain.c @@ -289,6 +289,35 @@ void sync_vcpu_execstate(struct vcpu *v) /* Nothing to do -- no lazy switching */ } +int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) +{ + return 0; +} + +void arch_domain_destroy(struct domain *d) +{ + printk(XENLOG_WARNING "%s: unimplemented\n", __func__); +} + +int arch_domain_create(struct domain *d, + struct xen_domctl_createdomain *config, + unsigned int flags) +{ + int rc = 0; + + if ( is_idle_domain(d) ) + return 0; + + if ( (rc = p2m_init(d, config)) != 0) + goto fail; + + return rc; + + fail: + arch_domain_destroy(d); + return rc; +} + static void __init __maybe_unused build_assertions(void) { /* diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c index acbb5b9123..3a7953593d 100644 --- a/xen/arch/riscv/stubs.c +++ b/xen/arch/riscv/stubs.c @@ -101,28 +101,11 @@ void dump_pageframe_info(struct domain *d) BUG_ON("unimplemented"); } -int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) -{ - BUG_ON("unimplemented"); -} - -int arch_domain_create(struct domain *d, - struct xen_domctl_createdomain *config, - unsigned int flags) -{ - BUG_ON("unimplemented"); -} - int arch_domain_teardown(struct domain *d) { BUG_ON("unimplemented"); } -void arch_domain_destroy(struct domain *d) -{ - BUG_ON("unimplemented"); -} - void arch_domain_shutdown(struct domain *d) { BUG_ON("unimplemented"); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 09:55:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 09:55:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356148.1610808 (Exim 4.92) (envelope-from ) id 1wh2Wb-0000Pd-Nt; Tue, 07 Jul 2026 09:55:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356148.1610808; Tue, 07 Jul 2026 09:55:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2Wb-0000PV-LL; Tue, 07 Jul 2026 09:55:33 +0000 Received: by outflank-mailman (input) for mailman id 1356148; Tue, 07 Jul 2026 09:55:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh2Wb-0000PP-0q for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh2Wb-00BrFx-0s for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh2Wa-009uLs-33 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 09:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eMNT/3jtogqHiOTN5tJy7bLeO/FFvskkYkzRy6Cj+M8=; b=qkYpeJGwL2S2eqEs9Ry9J5KgH3 RZ25INhj53gSd+SmZglWr+zSdvekKlQu3B3GfzeasQ1NntrnCBryWx0d8+vX7KdwYaZpF46N8sRBj +6NG062F5IoK08A2X2AZCgGW+PQwNfinjFnKvlnkC1e9YRqOsGx+pXqFZ22c6ZLJapMA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86: Fix typo in comment (indicies -> indices) Message-Id: Date: Tue, 07 Jul 2026 09:55:32 +0000 commit 9ed72c697be1841e0f72628bec6c3af063050d2e Author: Frediano Ziglio AuthorDate: Tue Jul 7 10:14:53 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:14:53 2026 +0200 x86: Fix typo in comment (indicies -> indices) Signed-off-by: Frediano Ziglio Acked-by: Jan Beulich --- xen/arch/x86/traps-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/traps-setup.c b/xen/arch/x86/traps-setup.c index a79a3b2013..3fe79ff0d0 100644 --- a/xen/arch/x86/traps-setup.c +++ b/xen/arch/x86/traps-setup.c @@ -245,7 +245,7 @@ static void __init init_ler(void) /* * Intel Pentium 4 is the only known CPU to not use the architectural MSR - * indicies. + * indices. */ switch ( boot_cpu_data.vendor ) { -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 12:22:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 12:22:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356207.1610839 (Exim 4.92) (envelope-from ) id 1wh4oO-0004sZ-5t; Tue, 07 Jul 2026 12:22:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356207.1610839; Tue, 07 Jul 2026 12:22:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oO-0004sS-3I; Tue, 07 Jul 2026 12:22:04 +0000 Received: by outflank-mailman (input) for mailman id 1356207; Tue, 07 Jul 2026 12:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oM-0004sM-Bm for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh4oM-00Btzg-17 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh4oM-00Bzw1-04 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tr+7dzgVIbkvR/YXmpAYGIjTGSghVqEMpN3aQ7dh6ac=; b=VGiQE0EdBuGIkqdCFVoo2n7D1f wjvCzuX5t/qqEiu/TMMBtU6+vEDXe0DKYhokXSgxW6xViQcaEC89UtxcaH3X6dDUqx6UmjPr57KOt JrlOI9pQViaH6l1CAYxF0INg2JrXn0euBAaYzaYt/6CNP6MHqwm3RIFgbQeRoJmG/rPw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/arm: move declaration of map_device_irqs_to_domain() to common header Message-Id: Date: Tue, 07 Jul 2026 12:22:02 +0000 commit acaf298028b91250bab782cf88a77d7f56f98cfe Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:07:35 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:07:35 2026 +0200 xen/arm: move declaration of map_device_irqs_to_domain() to common header As map_device_irqs_to_domain() is used unconditionally by common part of dom0less code, move the prototype to a common header. fdt-domain-build.h is chosen as map_device_irqs_to_domain() could be also called indirectly in Arm's DOM0-related code and DT overlay feature. Signed-off-by: Oleksii Kurochko Reviewed-by: Michal Orzel --- xen/arch/arm/device.c | 9 +-------- xen/arch/arm/include/asm/setup.h | 3 --- xen/include/xen/fdt-domain-build.h | 13 +++++++++++++ 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/device.c b/xen/arch/arm/device.c index 7d9644fd8b..b11366d722 100644 --- a/xen/arch/arm/device.c +++ b/xen/arch/arm/device.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include @@ -117,14 +118,6 @@ int __overlay_init map_range_to_domain(const struct dt_device_node *dev, return 0; } -/* - * map_device_irqs_to_domain retrieves the interrupts configuration from - * a device tree node and maps those interrupts to the target domain. - * - * Returns: - * < 0 error - * 0 success - */ int __overlay_init map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, bool need_mapping, diff --git a/xen/arch/arm/include/asm/setup.h b/xen/arch/arm/include/asm/setup.h index 0d29b46ea5..0adfa4993a 100644 --- a/xen/arch/arm/include/asm/setup.h +++ b/xen/arch/arm/include/asm/setup.h @@ -53,9 +53,6 @@ void init_traps(void); int handle_device(struct domain *d, struct dt_device_node *dev, p2m_type_t p2mt, struct rangeset *iomem_ranges, struct rangeset *irq_ranges); -int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, - bool need_mapping, struct rangeset *irq_ranges); - int map_irq_to_domain(struct domain *d, unsigned int irq, bool need_mapping, const char *devname); diff --git a/xen/include/xen/fdt-domain-build.h b/xen/include/xen/fdt-domain-build.h index 671486c1c8..8612e98dfd 100644 --- a/xen/include/xen/fdt-domain-build.h +++ b/xen/include/xen/fdt-domain-build.h @@ -12,6 +12,7 @@ struct domain; struct page_info; +struct rangeset; struct membanks; typedef bool (*alloc_domheap_mem_cb)(struct domain *d, struct page_info *pg, @@ -79,6 +80,18 @@ static inline void set_domain_type(struct domain *d, const struct kernel_info *k #endif } +/* + * Retrieves the interrupts configuration from a device tree node and maps + * those interrupts to the target domain. + * + * Returns: + * < 0 error + * 0 success + */ +int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev, + bool need_mapping, + struct rangeset *irq_ranges); + #endif /* __XEN_FDT_DOMAIN_BUILD_H__ */ /* -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 12:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 12:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356208.1610843 (Exim 4.92) (envelope-from ) id 1wh4oX-0004uE-7j; Tue, 07 Jul 2026 12:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356208.1610843; Tue, 07 Jul 2026 12:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oX-0004u6-4r; Tue, 07 Jul 2026 12:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1356208; Tue, 07 Jul 2026 12:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oW-0004ts-8H for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh4oW-00Btzk-1a for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh4oW-00C03H-0O for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=SYDZQdVFg9HlnPcE30jX5zAGlojygUVl8N2S1C3B1Hk=; b=5ezp7h27q2OZ5l73BHXo8Lgd8N AZExT2vORIHGSAKxKZ/B2JMsuLm7dksOcZmhN0MhjVbQixxgUR5vDFlvQ4kC+qwCZvnZprQOKqbhX c3CkRCEFjZKcD3EKt3F8WcS0y2bwtc60bLe42Lo3oVXQLCetcQ+iHxmCg8qnow9dvNLU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/Kconfig: introduce HAS_STATIC_MEMORY Message-Id: Date: Tue, 07 Jul 2026 12:22:12 +0000 commit 62599910858a980d1a8bc67f04f5a03b50f0569e Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:10:41 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:10:41 2026 +0200 xen/Kconfig: introduce HAS_STATIC_MEMORY Introduce HAS_STATIC_MEMORY so that STATIC_MEMORY can be enabled or disabled on a per-architecture basis. ARM selects the new flag; RISC-V does not, so CONFIG_STATIC_MEMORY is unavailable on RISC-V and randconfig builds no longer require an explicit STATIC_MEMORY=n override to avoid a compilation error. Suggested-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Michal Orzel --- xen/arch/arm/Kconfig | 1 + xen/common/Kconfig | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index 5fa89fcb24..843a43897e 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -21,6 +21,7 @@ config ARM select HAS_DOM0LESS select HAS_GRANT_CACHE_FLUSH if GRANT_TABLE select HAS_STACK_PROTECTOR + select HAS_STATIC_MEMORY select HAS_UBSAN config ARCH_DEFCONFIG diff --git a/xen/common/Kconfig b/xen/common/Kconfig index 5ff71480ee..da80fdba84 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -158,6 +158,9 @@ config HAS_PMAP config HAS_SCHED_GRANULARITY bool +config HAS_STATIC_MEMORY + bool + config HAS_SOFT_RESET bool @@ -193,6 +196,7 @@ config NUMA config STATIC_MEMORY bool "Static Allocation Support (UNSUPPORTED)" if UNSUPPORTED + depends on HAS_STATIC_MEMORY depends on DOM0LESS_BOOT && HAS_DEVICE_TREE_DISCOVERY help Static Allocation refers to system or sub-system(domains) for -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 12:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 12:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356209.1610847 (Exim 4.92) (envelope-from ) id 1wh4oh-0004wP-8i; Tue, 07 Jul 2026 12:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356209.1610847; Tue, 07 Jul 2026 12:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oh-0004wH-67; Tue, 07 Jul 2026 12:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1356209; Tue, 07 Jul 2026 12:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4og-0004wA-BA for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh4og-00Btzo-1u for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh4og-00C08Y-0r for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=BMKiMecy/vSYW2yfdVIhbybHUAdUDR9nhZt43K4WIUM=; b=iKDL/hS9oAkXzz6EL8n74k/Auw QJmC5mzPqSvbvbEsVD1pm9NyvVGCcpYcA8PnvaSruuTLJQqxQKVNFIdaMswLrB1JYFgSqGSetHXfe P/SzOD3RJgsEZ6DATFXc2SUeMgceUVvrse+E5iCHO2jV5Lj+qtf8PqIB6vyLaKuzDgz8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/riscv: implement prerequisites for domain_create() Message-Id: Date: Tue, 07 Jul 2026 12:22:22 +0000 commit 7bab7aabff2fae063a9f1a15878d6865ea3d5e57 Author: Oleksii Kurochko AuthorDate: Tue Jul 7 10:14:07 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:14:07 2026 +0200 xen/riscv: implement prerequisites for domain_create() arch_domain_create() and arch_sanitise_domain_config() are prerequisites for domain_create(). arch_sanitise_domain_config() currently returns 0, as there is no specific work required at this stage. arch_domain_create() performs basic initialization, such as setting up the P2M and initializing of next unused phandle. Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/domain.c | 29 +++++++++++++++++++++++++++++ xen/arch/riscv/stubs.c | 17 ----------------- 2 files changed, 29 insertions(+), 17 deletions(-) diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c index c77be3b827..2819ff4e7c 100644 --- a/xen/arch/riscv/domain.c +++ b/xen/arch/riscv/domain.c @@ -289,6 +289,35 @@ void sync_vcpu_execstate(struct vcpu *v) /* Nothing to do -- no lazy switching */ } +int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) +{ + return 0; +} + +void arch_domain_destroy(struct domain *d) +{ + printk(XENLOG_WARNING "%s: unimplemented\n", __func__); +} + +int arch_domain_create(struct domain *d, + struct xen_domctl_createdomain *config, + unsigned int flags) +{ + int rc = 0; + + if ( is_idle_domain(d) ) + return 0; + + if ( (rc = p2m_init(d, config)) != 0) + goto fail; + + return rc; + + fail: + arch_domain_destroy(d); + return rc; +} + static void __init __maybe_unused build_assertions(void) { /* diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c index acbb5b9123..3a7953593d 100644 --- a/xen/arch/riscv/stubs.c +++ b/xen/arch/riscv/stubs.c @@ -101,28 +101,11 @@ void dump_pageframe_info(struct domain *d) BUG_ON("unimplemented"); } -int arch_sanitise_domain_config(struct xen_domctl_createdomain *config) -{ - BUG_ON("unimplemented"); -} - -int arch_domain_create(struct domain *d, - struct xen_domctl_createdomain *config, - unsigned int flags) -{ - BUG_ON("unimplemented"); -} - int arch_domain_teardown(struct domain *d) { BUG_ON("unimplemented"); } -void arch_domain_destroy(struct domain *d) -{ - BUG_ON("unimplemented"); -} - void arch_domain_shutdown(struct domain *d) { BUG_ON("unimplemented"); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 12:22:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 12:22:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356210.1610850 (Exim 4.92) (envelope-from ) id 1wh4os-0004yN-9z; Tue, 07 Jul 2026 12:22:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356210.1610850; Tue, 07 Jul 2026 12:22:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4os-0004yF-7V; Tue, 07 Jul 2026 12:22:34 +0000 Received: by outflank-mailman (input) for mailman id 1356210; Tue, 07 Jul 2026 12:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh4oq-0004y9-EH for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh4oq-00Btzv-2E for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh4oq-00C0DW-1B for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 12:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UQ7nYwf+c9d/xFBX3Yx9/wwDfrvnq87wqmFkU+R2qJ4=; b=WBugSSvJL4UPElI/URWa46pFEr QdaGf6qoijkM1PNu6wRwNn1PI3M1bjIsBF26MHPU0s42Mv2CXYlPhsXfrFCU8ijjnx2FQFvs0xFsM 2z2Kqv6EevdS+/tV4uJHnaHYaCmDUj2K6HyTwC3++SpyTj6ZP33N9ixWOLWJ8r//CHW8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86: Fix typo in comment (indicies -> indices) Message-Id: Date: Tue, 07 Jul 2026 12:22:32 +0000 commit 9ed72c697be1841e0f72628bec6c3af063050d2e Author: Frediano Ziglio AuthorDate: Tue Jul 7 10:14:53 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 7 10:14:53 2026 +0200 x86: Fix typo in comment (indicies -> indices) Signed-off-by: Frediano Ziglio Acked-by: Jan Beulich --- xen/arch/x86/traps-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/traps-setup.c b/xen/arch/x86/traps-setup.c index a79a3b2013..3fe79ff0d0 100644 --- a/xen/arch/x86/traps-setup.c +++ b/xen/arch/x86/traps-setup.c @@ -245,7 +245,7 @@ static void __init init_ler(void) /* * Intel Pentium 4 is the only known CPU to not use the architectural MSR - * indicies. + * indices. */ switch ( boot_cpu_data.vendor ) { -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 16:22:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 16:22:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356422.1611052 (Exim 4.92) (envelope-from ) id 1wh8Yf-00058p-6Z; Tue, 07 Jul 2026 16:22:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356422.1611052; Tue, 07 Jul 2026 16:22:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Yf-00058h-3u; Tue, 07 Jul 2026 16:22:05 +0000 Received: by outflank-mailman (input) for mailman id 1356422; Tue, 07 Jul 2026 16:22:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Ye-00058b-QQ for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh8Ye-00C07k-31 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh8Ye-001QqU-1p for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bHcoc/eMvZqQ1DwJGH4A9jqRLiWIwTSnNg5xutWjbaA=; b=eOdG3S9R4HolqCmKkqJzTj6h0n EabMMaG0GLBYPLnjCVi81NeimMYq3I2N4/FT5+XhM9nbv/dEPUzkpzdAJe++3wFUXGrBNhPKzYS5s fgBD2zXtIeJD4kXF5tZPliU4JQsMwNUB4aEHmoYQ29zEtmv2sToubJucOk1PjsEZpxA0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/pv: Adjust the save_segments() comment regarding MSR_GS_SHADOW Message-Id: Date: Tue, 07 Jul 2026 16:22:04 +0000 commit a41bba43a7f913b1e952a8693af825ad315ee2d1 Author: Andrew Cooper AuthorDate: Thu Apr 9 10:07:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/pv: Adjust the save_segments() comment regarding MSR_GS_SHADOW This is slightly stale mentioning SWAPGS and not LKGS. However, take the opportunity to make the comment more general and less likely to bitrot. It would be a serious vulnerability for operating systems generally if CPL3 could modify GS_SHADOW at all. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie --- xen/arch/x86/domain.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 1d458f1372..4252339978 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1951,9 +1951,8 @@ static void load_segments(struct vcpu *n) * changes to bases can also be made with the WR{FS,GS}BASE instructions, when * enabled. * - * Guests however cannot use SWAPGS, so there is no mechanism to modify the - * inactive GS base behind Xen's back. Therefore, Xen's copy of the inactive - * GS base is still accurate, and doesn't need reading back from hardware. + * Guests cannot modify the inactive GS base behind Xen's back. Therefore + * Xen's copy is still accurate and doesn't need reading back. * * Under FRED, hardware automatically swaps GS for us, so SHADOW_GS is the * active GS from the guest's point of view. -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 16:22:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 16:22:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356423.1611057 (Exim 4.92) (envelope-from ) id 1wh8Yq-0005Ac-7z; Tue, 07 Jul 2026 16:22:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356423.1611057; Tue, 07 Jul 2026 16:22:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Yq-0005AV-5N; Tue, 07 Jul 2026 16:22:16 +0000 Received: by outflank-mailman (input) for mailman id 1356423; Tue, 07 Jul 2026 16:22:14 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Yo-0005AK-TQ for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:14 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh8Yp-00C07o-0U for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh8Yo-001RAj-2g for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=j9qXjCQ+nmluGWSXVLlErC82R7Z0dZCuaCmblzms38g=; b=s5HvITWahy5eqTjfcuN2tjxMuJ d8JI/UdaK33Ucw2qGZXLjFID8NE5p6fgNbI0AKscNd6AD2XgqcmezF+X5SdzS43F20AthrUIHgWek 68aGfoPblC7/xR4j7hOe2D++I12BUSQxW1fpvsypERQv+M639T8rmdWb/9C/9cDeuNrg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/hvm: Use PUSH_AND_CLEAR_GPRS in preference to SAVE_ALL Message-Id: Date: Tue, 07 Jul 2026 16:22:14 +0000 commit 1557e0357960e526f4a9ec3e36099cb7f841f27d Author: Andrew Cooper AuthorDate: Fri Mar 27 23:17:41 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/hvm: Use PUSH_AND_CLEAR_GPRS in preference to SAVE_ALL PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code. SAVE_ALL hides a CLD instruction which is not needed anywhere here. * VMX VMExit always clears flags. VMX VMentry failure never switched away from the host flags, so they're still good. * SVM VMRUN always saves and restores the host flags. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/svm/entry.S | 2 +- xen/arch/x86/hvm/vmx/entry.S | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index b6ea699bb9..d9613a2a8f 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -89,7 +89,7 @@ __UNLIKELY_END(nsvm_hap) vmrun - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_CURRENT(bx) diff --git a/xen/arch/x86/hvm/vmx/entry.S b/xen/arch/x86/hvm/vmx/entry.S index c34f5a1ee0..cebc700640 100644 --- a/xen/arch/x86/hvm/vmx/entry.S +++ b/xen/arch/x86/hvm/vmx/entry.S @@ -22,7 +22,7 @@ #include FUNC(vmx_asm_vmexit_handler) - SAVE_ALL + PUSH_AND_CLEAR_GPRS mov %cr2,%rax GET_CURRENT(bx) @@ -157,7 +157,7 @@ UNLIKELY_END(realmode) .Lvmx_vmentry_fail: sti - SAVE_ALL + PUSH_AND_CLEAR_GPRS /* * SPEC_CTRL_ENTRY notes -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 16:22:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 16:22:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356424.1611062 (Exim 4.92) (envelope-from ) id 1wh8Z0-0005Ch-Ag; Tue, 07 Jul 2026 16:22:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356424.1611062; Tue, 07 Jul 2026 16:22:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Z0-0005CX-6s; Tue, 07 Jul 2026 16:22:26 +0000 Received: by outflank-mailman (input) for mailman id 1356424; Tue, 07 Jul 2026 16:22:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Yz-0005CQ-1j for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh8Yz-00C07s-0x for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh8Yy-001RFo-2z for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PRDTeS54A6AsiUfHUQPzywWZsUnM9d2EDTk7WchbsGY=; b=d5xKvqIy/c/Ghn1ntLgHQ/OUYR OuCCNADZSga3xv16qsZ+yXi91uS38xgUU+T+ml2AOyO8K3PnugSAYWKKFW7b+byn4wAQfD2/FgarC 5RkaBGae7A2vhYjjf7fCos0aQzQtKZiAc63y4JGJclsRTvUFBWOTDkGevs5N1ii1Y70M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/entry: Use POP_GPRS and remove RESTORE_ALL Message-Id: Date: Tue, 07 Jul 2026 16:22:24 +0000 commit 8af337dfb8e29c07ce214a8e7223daa857b1e386 Author: Andrew Cooper AuthorDate: Mon Jul 6 15:28:19 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/entry: Use POP_GPRS and remove RESTORE_ALL POP_GPRS is shorter than RESTORE_ALL in terms of emitted code. By separating the popping of entry_vector/error_code off the stack, SPEC_CTRL_COND_VERW doesn't need custom displacements. Get rid of the compat=1 special case for PV32. It's not obviously a win, and PV32 is getting increasingly rare these days. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/include/asm/asm_defns.h | 50 +----------------------------------- xen/arch/x86/x86_64/compat/entry.S | 9 +++---- xen/arch/x86/x86_64/entry.S | 12 ++++----- 3 files changed, 10 insertions(+), 61 deletions(-) diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index 87bd6b1193..d1b80186c1 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -264,54 +264,6 @@ static always_inline void stac(void) xor %r15d, %r15d .endm -#define LOAD_ONE_REG(reg, compat) \ -.if !(compat); \ - movq UREGS_r##reg(%rsp),%r##reg; \ -.else; \ - movl UREGS_r##reg(%rsp),%e##reg; \ -.endif - -/* - * Restore all previously saved registers. - * - * @adj: extra stack pointer adjustment to be folded into the adjustment done - * anyway at the end of the macro - * @compat: R8-R15 don't need reloading, but they are clobbered for added - * safety against information leaks. - */ -.macro RESTORE_ALL adj=0, compat=0 -.if !\compat - movq UREGS_r15(%rsp), %r15 - movq UREGS_r14(%rsp), %r14 - movq UREGS_r13(%rsp), %r13 - movq UREGS_r12(%rsp), %r12 -.else - xor %r15d, %r15d - xor %r14d, %r14d - xor %r13d, %r13d - xor %r12d, %r12d -.endif - LOAD_ONE_REG(bp, \compat) - LOAD_ONE_REG(bx, \compat) -.if !\compat - movq UREGS_r11(%rsp),%r11 - movq UREGS_r10(%rsp),%r10 - movq UREGS_r9(%rsp),%r9 - movq UREGS_r8(%rsp),%r8 -.else - xor %r11d, %r11d - xor %r10d, %r10d - xor %r9d, %r9d - xor %r8d, %r8d -.endif - LOAD_ONE_REG(ax, \compat) - LOAD_ONE_REG(cx, \compat) - LOAD_ONE_REG(dx, \compat) - LOAD_ONE_REG(si, \compat) - LOAD_ONE_REG(di, \compat) - subq $-(UREGS_error_code-UREGS_r15+\adj), %rsp -.endm - /* * Push and clear GPRs */ @@ -369,7 +321,7 @@ static always_inline void stac(void) pop %r9 pop %r8 .if \skip_rax - pop %rcx + pop %rcx /* Any register yet to restore. */ .else pop %rax .endif diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 39925d80a6..4bf4ee7c94 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -160,12 +160,11 @@ FUNC(compat_restore_all_guest) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_PV /* Req: a=spec_ctrl %rsp=regs/cpuinfo, Clob: cd */ - RESTORE_ALL adj=8, compat=1 + POP_GPRS - /* Account for ev/ec having already been popped off the stack. */ - SPEC_CTRL_COND_VERW \ - scf=STK_REL(CPUINFO_scf, CPUINFO_rip), \ - sel=STK_REL(CPUINFO_verw_sel, CPUINFO_rip) + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + + add $8, %rsp /* Pop ev/ec off the stack */ jmp iret_to_guest END(compat_restore_all_guest) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index de5d854f55..cd3532d7d1 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -226,7 +226,8 @@ FUNC_LOCAL(restore_all_guest) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_PV /* Req: a=spec_ctrl %rsp=regs/cpuinfo, Clob: cd */ - RESTORE_ALL + POP_GPRS + BUILD_BUG_ON(TRAP_syscall & 0xff) testb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) jz iret_exit_to_guest @@ -753,20 +754,17 @@ UNLIKELY_END(exit_cr3) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_XEN /* Req: %r12=ist_exit %r14=end %rsp=regs, Clob: abcd */ - RESTORE_ALL adj=8 + POP_GPRS /* * When the CPU pushed this exception frame, it zero-extended eflags. * For an IST exit, SPEC_CTRL_EXIT_TO_XEN stashed shadow copies of * scf and ver_sel above eflags, as we can't use any GPRs, * and we're at a random place on the stack, not in a CPUFINFO block. - * - * Account for ev/ec having already been popped off the stack. */ - SPEC_CTRL_COND_VERW \ - scf=STK_REL(EFRAME_shadow_scf, EFRAME_rip), \ - sel=STK_REL(EFRAME_shadow_sel, EFRAME_rip) + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + add $8, %rsp /* Pop ev/ec off the stack */ iretq END(restore_all_xen) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 16:22:37 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 16:22:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356425.1611066 (Exim 4.92) (envelope-from ) id 1wh8ZB-0005FR-Cc; Tue, 07 Jul 2026 16:22:37 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356425.1611066; Tue, 07 Jul 2026 16:22:37 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8ZB-0005F2-9U; Tue, 07 Jul 2026 16:22:37 +0000 Received: by outflank-mailman (input) for mailman id 1356425; Tue, 07 Jul 2026 16:22:36 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh8Z9-0005Eu-VO for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh8Z9-00C07z-1I for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh8Z9-001RK6-0H for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 16:22:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GoZ9xm/xF+BrLuWJItlPEPOc02gpDAz4SvmC/VNYZ0Y=; b=a1kCvIaOGNtfgREdcoAbQQHFe8 lgbemZwhZoAPYywF3hHlWe6D68jsLBAfIyoMN+HNhFsUdgxu/WEUKBiO712kewUsemHpI79rMw8Fh qhS0Bs7HGz2F6T+HRgXf+RKx5+l1JZ1gB9tHriAOCCK1AaLUIr5OXsHBlRVaasAqcRQg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/entry: Use PUSH_AND_CLEAR_GPRS and drop SAVE_ALL Message-Id: Date: Tue, 07 Jul 2026 16:22:35 +0000 commit c4bf5bc5f0edbcbc5965c924db069483b2cf6049 Author: Andrew Cooper AuthorDate: Mon Jul 6 15:59:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/entry: Use PUSH_AND_CLEAR_GPRS and drop SAVE_ALL PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code. lstar_enter() and cstar_enter() do not need CLD. The SYSCALL instruction sanitises flags based on MSR_SYSCALL_MASK. For all other cases, place the CLD instruction next to STAC/CLAC so the flag handling is together. Get rid of the compat=1 special case for PV32. It's not obviously a win, and PV32 is getting increasingly rare these days. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/include/asm/asm_defns.h | 45 ------------------------------------ xen/arch/x86/x86_64/compat/entry.S | 4 +++- xen/arch/x86/x86_64/entry.S | 25 ++++++++++++-------- 3 files changed, 19 insertions(+), 55 deletions(-) diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index d1b80186c1..6c65acd083 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -219,51 +219,6 @@ static always_inline void stac(void) #endif #ifdef __ASSEMBLER__ -.macro SAVE_ALL compat=0 - addq $-(UREGS_error_code-UREGS_r15), %rsp - cld - movq %rdi,UREGS_rdi(%rsp) - xor %edi, %edi - movq %rsi,UREGS_rsi(%rsp) - xor %esi, %esi - movq %rdx,UREGS_rdx(%rsp) - xor %edx, %edx - movq %rcx,UREGS_rcx(%rsp) - xor %ecx, %ecx - movq %rax,UREGS_rax(%rsp) - xor %eax, %eax -.if !\compat - movq %r8,UREGS_r8(%rsp) - movq %r9,UREGS_r9(%rsp) - movq %r10,UREGS_r10(%rsp) - movq %r11,UREGS_r11(%rsp) -.endif - xor %r8d, %r8d - xor %r9d, %r9d - xor %r10d, %r10d - xor %r11d, %r11d - movq %rbx,UREGS_rbx(%rsp) - xor %ebx, %ebx - movq %rbp,UREGS_rbp(%rsp) -#ifdef CONFIG_FRAME_POINTER -/* Indicate special exception stack frame by inverting the frame pointer. */ - leaq UREGS_rbp(%rsp), %rbp - notq %rbp -#else - xor %ebp, %ebp -#endif -.if !\compat - movq %r12,UREGS_r12(%rsp) - movq %r13,UREGS_r13(%rsp) - movq %r14,UREGS_r14(%rsp) - movq %r15,UREGS_r15(%rsp) -.endif - xor %r12d, %r12d - xor %r13d, %r13d - xor %r14d, %r14d - xor %r15d, %r15d -.endm - /* * Push and clear GPRs */ diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 4bf4ee7c94..ca20ea12f9 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -11,12 +11,14 @@ #include #include +/* DPL1 gate, restricted to 32bit PV guest kernels only. */ FUNC(entry_int82) ENDBR64 + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movb $HYPERCALL_VECTOR, EFRAME_entry_vector(%rsp) - SAVE_ALL compat=1 /* DPL1 gate, restricted to 32bit PV guests only. */ + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index cd3532d7d1..22729b1f43 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -305,7 +305,7 @@ FUNC(lstar_enter) pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -345,7 +345,7 @@ FUNC(cstar_enter) pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -383,13 +383,14 @@ FUNC(sysenter_entry) pushq $0 pushfq LABEL(sysenter_eflags_saved, 0) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $3 /* ring 3 null cs */ pushq $0 /* null rip */ pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -442,10 +443,11 @@ END(sysenter_entry) FUNC(entry_int80) ENDBR64 + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movb $0x80, EFRAME_entry_vector(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -722,8 +724,9 @@ END(ret_from_intr) .section .init.text, "ax", @progbits FUNC(early_page_fault) ENDBR64 + cld movb $X86_EXC_PF, EFRAME_entry_vector(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS movq %rsp, %rdi call do_early_page_fault jmp restore_all_xen @@ -769,8 +772,9 @@ UNLIKELY_END(exit_cr3) END(restore_all_xen) FUNC(common_interrupt) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -805,8 +809,9 @@ FUNC(entry_PF) END(entry_PF) /* No special register assumptions. */ FUNC(handle_exception, 0) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -1103,9 +1108,10 @@ END(entry_CP) FUNC(entry_DF) ENDBR64 movb $X86_EXC_DF, EFRAME_entry_vector(%rsp) + cld /* Set AC to reduce chance of further SMAP faults */ ALTERNATIVE "", stac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -1132,8 +1138,9 @@ FUNC(entry_NMI) END(entry_NMI) FUNC(handle_ist_exception) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 17:22:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 17:22:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356458.1611069 (Exim 4.92) (envelope-from ) id 1wh9Uh-0004LD-FW; Tue, 07 Jul 2026 17:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356458.1611069; Tue, 07 Jul 2026 17:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9Uh-0004L4-Cm; Tue, 07 Jul 2026 17:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1356458; Tue, 07 Jul 2026 17:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9Ug-0004Ky-A9 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh9Ug-00C1E5-0p for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh9Uf-002zi2-2y for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+7KUCqHzxGubbiRTdzoRCLvN846bX3BESfLNJMeWgnU=; b=pni6Vx4WLepKcn4fe4b5siTsA0 E1sCoH190QfKX/4bC9mqCui4kqFREm4GycRrwL4DZgyYkEDbhgcSjUUEn2OhTah+PGoochemWgr3b /bsxKzagG2Z0Cn/sS31ajCAlRrX1cgU5ONid0s3vjoYu/z2f5JfrCK2F5Gt06s5BapIE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/pv: Adjust the save_segments() comment regarding MSR_GS_SHADOW Message-Id: Date: Tue, 07 Jul 2026 17:22:01 +0000 commit a41bba43a7f913b1e952a8693af825ad315ee2d1 Author: Andrew Cooper AuthorDate: Thu Apr 9 10:07:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/pv: Adjust the save_segments() comment regarding MSR_GS_SHADOW This is slightly stale mentioning SWAPGS and not LKGS. However, take the opportunity to make the comment more general and less likely to bitrot. It would be a serious vulnerability for operating systems generally if CPL3 could modify GS_SHADOW at all. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie --- xen/arch/x86/domain.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 1d458f1372..4252339978 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1951,9 +1951,8 @@ static void load_segments(struct vcpu *n) * changes to bases can also be made with the WR{FS,GS}BASE instructions, when * enabled. * - * Guests however cannot use SWAPGS, so there is no mechanism to modify the - * inactive GS base behind Xen's back. Therefore, Xen's copy of the inactive - * GS base is still accurate, and doesn't need reading back from hardware. + * Guests cannot modify the inactive GS base behind Xen's back. Therefore + * Xen's copy is still accurate and doesn't need reading back. * * Under FRED, hardware automatically swaps GS for us, so SHADOW_GS is the * active GS from the guest's point of view. -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 17:22:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 17:22:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356459.1611072 (Exim 4.92) (envelope-from ) id 1wh9Ur-0004Mk-H5; Tue, 07 Jul 2026 17:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356459.1611072; Tue, 07 Jul 2026 17:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9Ur-0004Mc-E6; Tue, 07 Jul 2026 17:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1356459; Tue, 07 Jul 2026 17:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9Uq-0004MO-9w for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh9Uq-00C1E9-1m for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh9Uq-002zr2-0c for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GPLPDjXXxRLOImoovqtMeYqXGL3Bl2765qDUA9PdTOg=; b=hcbX4ZPidkx0UG1Z674dvI1a2S sku6X1vjysQnNWIc20OHrzNYNRRQ0sHErlIsFz8+A7vfGCecV211OZi4RqSrkX6kY12841DR3NQ0k F+H9uh5nuQZo7EMu/XrUUl8PLwYGPBaqJMi5m23k1wnKCm+ebFkyvEezL0zNIdu8seAM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/hvm: Use PUSH_AND_CLEAR_GPRS in preference to SAVE_ALL Message-Id: Date: Tue, 07 Jul 2026 17:22:12 +0000 commit 1557e0357960e526f4a9ec3e36099cb7f841f27d Author: Andrew Cooper AuthorDate: Fri Mar 27 23:17:41 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/hvm: Use PUSH_AND_CLEAR_GPRS in preference to SAVE_ALL PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code. SAVE_ALL hides a CLD instruction which is not needed anywhere here. * VMX VMExit always clears flags. VMX VMentry failure never switched away from the host flags, so they're still good. * SVM VMRUN always saves and restores the host flags. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/svm/entry.S | 2 +- xen/arch/x86/hvm/vmx/entry.S | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index b6ea699bb9..d9613a2a8f 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -89,7 +89,7 @@ __UNLIKELY_END(nsvm_hap) vmrun - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_CURRENT(bx) diff --git a/xen/arch/x86/hvm/vmx/entry.S b/xen/arch/x86/hvm/vmx/entry.S index c34f5a1ee0..cebc700640 100644 --- a/xen/arch/x86/hvm/vmx/entry.S +++ b/xen/arch/x86/hvm/vmx/entry.S @@ -22,7 +22,7 @@ #include FUNC(vmx_asm_vmexit_handler) - SAVE_ALL + PUSH_AND_CLEAR_GPRS mov %cr2,%rax GET_CURRENT(bx) @@ -157,7 +157,7 @@ UNLIKELY_END(realmode) .Lvmx_vmentry_fail: sti - SAVE_ALL + PUSH_AND_CLEAR_GPRS /* * SPEC_CTRL_ENTRY notes -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 17:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 17:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356460.1611077 (Exim 4.92) (envelope-from ) id 1wh9V1-0004P1-I4; Tue, 07 Jul 2026 17:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356460.1611077; Tue, 07 Jul 2026 17:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9V1-0004Ot-FW; Tue, 07 Jul 2026 17:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1356460; Tue, 07 Jul 2026 17:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9V0-0004On-Mu for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh9V0-00C1ED-35 for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh9V0-0030Sd-1t for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5lzzFk0p0DIByvEIUPSAvWEgXmgLbUtDN86EDOPpqtc=; b=o/m9D+FWJrtgmQ7rSYCjxSmIef 5lDnLEXPP1A9NEQGDMvv83T/6q7gzLE8VFjerMwKw34Q/c3DEJtkTodBb/QOmtnl0koVWepeg32Le NNHc/jsJbWL5jWNCk6uIqsVPOsJ77XNRv6yNDCSScDF/nXCXGy1vgqRJllb9lU+9DVoI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/entry: Use POP_GPRS and remove RESTORE_ALL Message-Id: Date: Tue, 07 Jul 2026 17:22:22 +0000 commit 8af337dfb8e29c07ce214a8e7223daa857b1e386 Author: Andrew Cooper AuthorDate: Mon Jul 6 15:28:19 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/entry: Use POP_GPRS and remove RESTORE_ALL POP_GPRS is shorter than RESTORE_ALL in terms of emitted code. By separating the popping of entry_vector/error_code off the stack, SPEC_CTRL_COND_VERW doesn't need custom displacements. Get rid of the compat=1 special case for PV32. It's not obviously a win, and PV32 is getting increasingly rare these days. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/include/asm/asm_defns.h | 50 +----------------------------------- xen/arch/x86/x86_64/compat/entry.S | 9 +++---- xen/arch/x86/x86_64/entry.S | 12 ++++----- 3 files changed, 10 insertions(+), 61 deletions(-) diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index 87bd6b1193..d1b80186c1 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -264,54 +264,6 @@ static always_inline void stac(void) xor %r15d, %r15d .endm -#define LOAD_ONE_REG(reg, compat) \ -.if !(compat); \ - movq UREGS_r##reg(%rsp),%r##reg; \ -.else; \ - movl UREGS_r##reg(%rsp),%e##reg; \ -.endif - -/* - * Restore all previously saved registers. - * - * @adj: extra stack pointer adjustment to be folded into the adjustment done - * anyway at the end of the macro - * @compat: R8-R15 don't need reloading, but they are clobbered for added - * safety against information leaks. - */ -.macro RESTORE_ALL adj=0, compat=0 -.if !\compat - movq UREGS_r15(%rsp), %r15 - movq UREGS_r14(%rsp), %r14 - movq UREGS_r13(%rsp), %r13 - movq UREGS_r12(%rsp), %r12 -.else - xor %r15d, %r15d - xor %r14d, %r14d - xor %r13d, %r13d - xor %r12d, %r12d -.endif - LOAD_ONE_REG(bp, \compat) - LOAD_ONE_REG(bx, \compat) -.if !\compat - movq UREGS_r11(%rsp),%r11 - movq UREGS_r10(%rsp),%r10 - movq UREGS_r9(%rsp),%r9 - movq UREGS_r8(%rsp),%r8 -.else - xor %r11d, %r11d - xor %r10d, %r10d - xor %r9d, %r9d - xor %r8d, %r8d -.endif - LOAD_ONE_REG(ax, \compat) - LOAD_ONE_REG(cx, \compat) - LOAD_ONE_REG(dx, \compat) - LOAD_ONE_REG(si, \compat) - LOAD_ONE_REG(di, \compat) - subq $-(UREGS_error_code-UREGS_r15+\adj), %rsp -.endm - /* * Push and clear GPRs */ @@ -369,7 +321,7 @@ static always_inline void stac(void) pop %r9 pop %r8 .if \skip_rax - pop %rcx + pop %rcx /* Any register yet to restore. */ .else pop %rax .endif diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 39925d80a6..4bf4ee7c94 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -160,12 +160,11 @@ FUNC(compat_restore_all_guest) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_PV /* Req: a=spec_ctrl %rsp=regs/cpuinfo, Clob: cd */ - RESTORE_ALL adj=8, compat=1 + POP_GPRS - /* Account for ev/ec having already been popped off the stack. */ - SPEC_CTRL_COND_VERW \ - scf=STK_REL(CPUINFO_scf, CPUINFO_rip), \ - sel=STK_REL(CPUINFO_verw_sel, CPUINFO_rip) + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + + add $8, %rsp /* Pop ev/ec off the stack */ jmp iret_to_guest END(compat_restore_all_guest) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index de5d854f55..cd3532d7d1 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -226,7 +226,8 @@ FUNC_LOCAL(restore_all_guest) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_PV /* Req: a=spec_ctrl %rsp=regs/cpuinfo, Clob: cd */ - RESTORE_ALL + POP_GPRS + BUILD_BUG_ON(TRAP_syscall & 0xff) testb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) jz iret_exit_to_guest @@ -753,20 +754,17 @@ UNLIKELY_END(exit_cr3) /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ SPEC_CTRL_EXIT_TO_XEN /* Req: %r12=ist_exit %r14=end %rsp=regs, Clob: abcd */ - RESTORE_ALL adj=8 + POP_GPRS /* * When the CPU pushed this exception frame, it zero-extended eflags. * For an IST exit, SPEC_CTRL_EXIT_TO_XEN stashed shadow copies of * scf and ver_sel above eflags, as we can't use any GPRs, * and we're at a random place on the stack, not in a CPUFINFO block. - * - * Account for ev/ec having already been popped off the stack. */ - SPEC_CTRL_COND_VERW \ - scf=STK_REL(EFRAME_shadow_scf, EFRAME_rip), \ - sel=STK_REL(EFRAME_shadow_sel, EFRAME_rip) + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + add $8, %rsp /* Pop ev/ec off the stack */ iretq END(restore_all_xen) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 07 17:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 07 Jul 2026 17:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356461.1611082 (Exim 4.92) (envelope-from ) id 1wh9VB-0004Qx-Jz; Tue, 07 Jul 2026 17:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356461.1611082; Tue, 07 Jul 2026 17:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9VB-0004Qp-Gt; Tue, 07 Jul 2026 17:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1356461; Tue, 07 Jul 2026 17:22:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wh9VA-0004Qj-Uw for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wh9VB-00C1EK-0f for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wh9VA-0030rv-2f for xen-changelog@lists.xenproject.org; Tue, 07 Jul 2026 17:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xI+x0HfxGxn/+6IdQOq3PX8BlZDBHvLOddlXA1Jchfg=; b=kO4IBzDKs8IVEM1k1z28dwW+C5 pzB9CGfvN2rZWDqYGWE6doHxtccms8zK53xcebLpp/7H8BeryrMnBl0Ua6qsRHaVerd0iTBBihXux JPL8J5FYIvAl/nz07HG3qt4AhtMboNGbzCIg7E2hsL1Q2DAHJyDxhV6RgoYuZn3Sg/cQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/entry: Use PUSH_AND_CLEAR_GPRS and drop SAVE_ALL Message-Id: Date: Tue, 07 Jul 2026 17:22:32 +0000 commit c4bf5bc5f0edbcbc5965c924db069483b2cf6049 Author: Andrew Cooper AuthorDate: Mon Jul 6 15:59:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 7 17:19:38 2026 +0100 x86/entry: Use PUSH_AND_CLEAR_GPRS and drop SAVE_ALL PUSH_AND_CLEAR_GPRS is shorter than SAVE_ALL in terms of emitted code. lstar_enter() and cstar_enter() do not need CLD. The SYSCALL instruction sanitises flags based on MSR_SYSCALL_MASK. For all other cases, place the CLD instruction next to STAC/CLAC so the flag handling is together. Get rid of the compat=1 special case for PV32. It's not obviously a win, and PV32 is getting increasingly rare these days. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/include/asm/asm_defns.h | 45 ------------------------------------ xen/arch/x86/x86_64/compat/entry.S | 4 +++- xen/arch/x86/x86_64/entry.S | 25 ++++++++++++-------- 3 files changed, 19 insertions(+), 55 deletions(-) diff --git a/xen/arch/x86/include/asm/asm_defns.h b/xen/arch/x86/include/asm/asm_defns.h index d1b80186c1..6c65acd083 100644 --- a/xen/arch/x86/include/asm/asm_defns.h +++ b/xen/arch/x86/include/asm/asm_defns.h @@ -219,51 +219,6 @@ static always_inline void stac(void) #endif #ifdef __ASSEMBLER__ -.macro SAVE_ALL compat=0 - addq $-(UREGS_error_code-UREGS_r15), %rsp - cld - movq %rdi,UREGS_rdi(%rsp) - xor %edi, %edi - movq %rsi,UREGS_rsi(%rsp) - xor %esi, %esi - movq %rdx,UREGS_rdx(%rsp) - xor %edx, %edx - movq %rcx,UREGS_rcx(%rsp) - xor %ecx, %ecx - movq %rax,UREGS_rax(%rsp) - xor %eax, %eax -.if !\compat - movq %r8,UREGS_r8(%rsp) - movq %r9,UREGS_r9(%rsp) - movq %r10,UREGS_r10(%rsp) - movq %r11,UREGS_r11(%rsp) -.endif - xor %r8d, %r8d - xor %r9d, %r9d - xor %r10d, %r10d - xor %r11d, %r11d - movq %rbx,UREGS_rbx(%rsp) - xor %ebx, %ebx - movq %rbp,UREGS_rbp(%rsp) -#ifdef CONFIG_FRAME_POINTER -/* Indicate special exception stack frame by inverting the frame pointer. */ - leaq UREGS_rbp(%rsp), %rbp - notq %rbp -#else - xor %ebp, %ebp -#endif -.if !\compat - movq %r12,UREGS_r12(%rsp) - movq %r13,UREGS_r13(%rsp) - movq %r14,UREGS_r14(%rsp) - movq %r15,UREGS_r15(%rsp) -.endif - xor %r12d, %r12d - xor %r13d, %r13d - xor %r14d, %r14d - xor %r15d, %r15d -.endm - /* * Push and clear GPRs */ diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 4bf4ee7c94..ca20ea12f9 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -11,12 +11,14 @@ #include #include +/* DPL1 gate, restricted to 32bit PV guest kernels only. */ FUNC(entry_int82) ENDBR64 + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movb $HYPERCALL_VECTOR, EFRAME_entry_vector(%rsp) - SAVE_ALL compat=1 /* DPL1 gate, restricted to 32bit PV guests only. */ + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index cd3532d7d1..22729b1f43 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -305,7 +305,7 @@ FUNC(lstar_enter) pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -345,7 +345,7 @@ FUNC(cstar_enter) pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -383,13 +383,14 @@ FUNC(sysenter_entry) pushq $0 pushfq LABEL(sysenter_eflags_saved, 0) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $3 /* ring 3 null cs */ pushq $0 /* null rip */ pushq $0 BUILD_BUG_ON(TRAP_syscall & 0xff) movb $TRAP_syscall >> 8, EFRAME_entry_vector + 1(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -442,10 +443,11 @@ END(sysenter_entry) FUNC(entry_int80) ENDBR64 + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movb $0x80, EFRAME_entry_vector(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -722,8 +724,9 @@ END(ret_from_intr) .section .init.text, "ax", @progbits FUNC(early_page_fault) ENDBR64 + cld movb $X86_EXC_PF, EFRAME_entry_vector(%rsp) - SAVE_ALL + PUSH_AND_CLEAR_GPRS movq %rsp, %rdi call do_early_page_fault jmp restore_all_xen @@ -769,8 +772,9 @@ UNLIKELY_END(exit_cr3) END(restore_all_xen) FUNC(common_interrupt) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -805,8 +809,9 @@ FUNC(entry_PF) END(entry_PF) /* No special register assumptions. */ FUNC(handle_exception, 0) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -1103,9 +1108,10 @@ END(entry_CP) FUNC(entry_DF) ENDBR64 movb $X86_EXC_DF, EFRAME_entry_vector(%rsp) + cld /* Set AC to reduce chance of further SMAP faults */ ALTERNATIVE "", stac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) @@ -1132,8 +1138,9 @@ FUNC(entry_NMI) END(entry_NMI) FUNC(handle_ist_exception) + cld ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP - SAVE_ALL + PUSH_AND_CLEAR_GPRS GET_STACK_END(14) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 08:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 08:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356673.1611219 (Exim 4.92) (envelope-from ) id 1whNXf-00038J-DM; Wed, 08 Jul 2026 08:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356673.1611219; Wed, 08 Jul 2026 08:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whNXf-00038B-Ai; Wed, 08 Jul 2026 08:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1356673; Wed, 08 Jul 2026 08:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whNXe-000385-9j for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 08:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whNXe-00DVHG-1J for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 08:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whNXe-00CiBI-0C for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 08:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8qdudHelfn6tgHYYFiyJDnOJdfkWzG4U0et0XGJNWS8=; b=ntvBP2mnSFz9rmjFS8euLKGnOn zfKLgsplJ0i4xbpwGskI7/BP/wRgrUAMeP+9WehvrxgIWqma/IjqatYj3JLXeR6E68aX4TZFqe1NI +8uicCQvzawwEhhv0ADuvAB8dKwoYq4GMaGN6I3QljkP6+Y4MfwGETlRtDmNY2UoKZ0s=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 08 Jul 2026 08:22:02 +0000 commit ccde3773c1762d32fb5f6037d6b22780c30895d3 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 8 09:52:39 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 7f3cfa812e..ba5fd2dd52 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -238,7 +238,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -251,10 +253,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 09:11:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 09:11:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1356722.1611269 (Exim 4.92) (envelope-from ) id 1whOJ5-00039I-PQ; Wed, 08 Jul 2026 09:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1356722.1611269; Wed, 08 Jul 2026 09:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whOJ5-00039A-Mr; Wed, 08 Jul 2026 09:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1356722; Wed, 08 Jul 2026 09:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whOJ4-000394-DL for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 09:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whOJ4-00DWBV-1C for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 09:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whOJ4-00EGA6-0B for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 09:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=VhBZn/57HWjZMFtAUvtQE41i8vbDul/SCD0VayY8TNQ=; b=7L12c+iHHXqvF/FH0OU0mg6RzP K9glcSCMYb0f5Z6z5tfn8pob6aZsYoUGYEBbzkruAPq0dSeg8ac0S9tEJGCIMoQfiJWKIi/VraeYl A9Fs7cvpFsK6XQQTlEtGlpUX59wdWg9w6qKuMZfnAJikhCISbQxKX/uvjMrJtFAiN5PE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 08 Jul 2026 09:11:02 +0000 commit ccde3773c1762d32fb5f6037d6b22780c30895d3 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 8 09:52:39 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 7f3cfa812e..ba5fd2dd52 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -238,7 +238,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -251,10 +253,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 15:11:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 15:11:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357166.1611653 (Exim 4.92) (envelope-from ) id 1whTvT-00045c-H5; Wed, 08 Jul 2026 15:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357166.1611653; Wed, 08 Jul 2026 15:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvT-00045T-EJ; Wed, 08 Jul 2026 15:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1357166; Wed, 08 Jul 2026 15:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvS-00045N-7X for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whTvS-00Dd4G-13 for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whTvR-0077Oz-2u for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=kWzWAZtBjVHpoAzj3OPPBzY+fcBeAsp8ViMbpBzD7LA=; b=AZCecYm2rpvOG5Skzo8PUzWSdj u+B4j+s651Bc+inj12VYrtyxFuolo6TRC+TGN7a1O1P7KDqjvugc8e8MOl1m76Xi7Ya1HPS7vt+kH MPyFa0xMiO2EkZPZ735+lncbCV2zlG7BeYAkJIDfoBk3CJvtdPEfb/t7tQQ9ehSkk+5U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Avoids using 2 indexes in process_page_data() Message-Id: Date: Wed, 08 Jul 2026 15:11:01 +0000 commit 42ef7f610653d743bf8c04f9bbe26239148ac84f Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:52 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Avoids using 2 indexes in process_page_data() Simplify code, after the first scan of the various arrays we don't need to keep original types and PFNs but only the ones having data. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_restore.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/tools/libs/guest/xg_sr_restore.c b/tools/libs/guest/xg_sr_restore.c index e148fc594a..458eaa5992 100644 --- a/tools/libs/guest/xg_sr_restore.c +++ b/tools/libs/guest/xg_sr_restore.c @@ -260,9 +260,7 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, int *map_errs = malloc(count * sizeof(*map_errs)); int rc; void *mapping = NULL, *guest_page = NULL; - unsigned int i, /* i indexes the pfns from the record. */ - j, /* j indexes the subset of pfns we decide to map. */ - nr_pages = 0; + unsigned int nr_pages = 0; if ( !mfns || !map_errs ) { @@ -279,12 +277,17 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, goto err; } - for ( i = 0; i < count; ++i ) + for ( unsigned int i = 0; i < count; ++i ) { ctx->restore.ops.set_page_type(ctx, pfns[i], types[i]); - if ( page_type_has_stream_data(types[i]) ) - mfns[nr_pages++] = ctx->restore.ops.pfn_to_gfn(ctx, pfns[i]); + if ( !page_type_has_stream_data(types[i]) ) + continue; + + mfns[nr_pages] = ctx->restore.ops.pfn_to_gfn(ctx, pfns[i]); + pfns[nr_pages] = pfns[i]; + types[nr_pages] = types[i]; + nr_pages++; } /* Nothing to do? */ @@ -302,16 +305,13 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, goto err; } - for ( i = 0, j = 0; i < count; ++i ) + for ( unsigned int i = 0; i < nr_pages; ++i ) { - if ( !page_type_has_stream_data(types[i]) ) - continue; - - if ( map_errs[j] ) + if ( map_errs[i] ) { rc = -1; ERROR("Mapping pfn %#"PRIpfn" (mfn %#"PRIpfn", type %#"PRIx32") failed with %d", - pfns[i], mfns[j], types[i], map_errs[j]); + pfns[i], mfns[i], types[i], map_errs[i]); goto err; } @@ -337,7 +337,6 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, memcpy(guest_page, page_data, PAGE_SIZE); } - ++j; guest_page += PAGE_SIZE; page_data += PAGE_SIZE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 15:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 15:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357167.1611657 (Exim 4.92) (envelope-from ) id 1whTvd-00047K-IG; Wed, 08 Jul 2026 15:11:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357167.1611657; Wed, 08 Jul 2026 15:11:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvd-00047B-Fd; Wed, 08 Jul 2026 15:11:13 +0000 Received: by outflank-mailman (input) for mailman id 1357167; Wed, 08 Jul 2026 15:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvc-00046x-7v for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whTvc-00Dd4h-1a for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whTvc-0077lN-0S for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tobtPuO6dpLLxMgCK1EjqDur0lTDAtpkJMKiexRHf+Q=; b=406cZXkM2IOYcBm+R8o4a2Q+jd cpDN6R/cJ42E7jtU+qi/L3Bzr7q/7aC3vp4skX0MMNIsXZ1hg21t/GN4ZXAIz0yDLnTv9uX3lAvbE PYwVafSmMzdJGY1/GYv/xuhrLE2977AxCnU1EsezVC9P5iEujP3vm9DyDJT4WdKQMWiQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Reduce number of iovecs in write_split_record() Message-Id: Date: Wed, 08 Jul 2026 15:11:12 +0000 commit 32204e8e194bfe991fd9d3dd57cdc44663da9f3b Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:46 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Reduce number of iovecs in write_split_record() Construct xc_sr_rhdr directly rather than in two halves. Use size_t for combined_len, which allows the later size check to spot a few more cases which might have truncated. Signed-off-by: Frediano Ziglio Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/libs/guest/xg_sr_common.c b/tools/libs/guest/xg_sr_common.c index c7b3c6f3bc..9b2782b5cf 100644 --- a/tools/libs/guest/xg_sr_common.c +++ b/tools/libs/guest/xg_sr_common.c @@ -59,11 +59,11 @@ int write_split_record(struct xc_sr_context *ctx, struct xc_sr_record *rec, static const char zeroes[REC_ALIGN] = {}; xc_interface *xch = ctx->xch; - typeof(rec->length) combined_length = rec->length + sz; + size_t combined_length = rec->length + sz; size_t record_length = ROUNDUP(combined_length, REC_ALIGN); + struct xc_sr_rhdr rhdr = { rec->type, combined_length }; struct iovec parts[] = { - { &rec->type, sizeof(rec->type) }, - { &combined_length, sizeof(combined_length) }, + { &rhdr, sizeof(rhdr) }, { rec->data, rec->length }, { buf, sz }, { (void *)zeroes, record_length - combined_length }, -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 15:11:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 15:11:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357168.1611661 (Exim 4.92) (envelope-from ) id 1whTvn-00049M-Jq; Wed, 08 Jul 2026 15:11:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357168.1611661; Wed, 08 Jul 2026 15:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvn-00049E-H5; Wed, 08 Jul 2026 15:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1357168; Wed, 08 Jul 2026 15:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvm-000498-BV for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whTvm-00Dd4p-1w for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whTvm-0077yo-0t for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bT7Fv4SKLmCwzcBmkU+9tDcbOe6iz6BzCNXKh1j4xmM=; b=Rk7bGkku6IUCk3QRNTZS5nJmrU dDkrI/PaO2MIHDTXUyZmQnhFyMZ/dEKhQJ6qP9gDBB6Gfvg9nIh2xCmp12Y6ZkOlkHlJdOLBdb5NF +cxD4NJnIIuK04qf9we5i6n9lhpZO4UYFpd+w9n8ZjDFwNdFAQLK0nuFfc1YETPwCyLc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Use a single write_exact() in write_headers() Message-Id: Date: Wed, 08 Jul 2026 15:11:22 +0000 commit dfb11094ae586a1ccc3cfab9e93c7099aed0cede Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Use a single write_exact() in write_headers() Reduce number of syscalls by coalescing the image and the domain headers. Signed-off-by: Frediano Ziglio Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index fdbceab52e..6f310d6d8c 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -10,17 +10,22 @@ static int write_headers(struct xc_sr_context *ctx, uint16_t guest_type) { xc_interface *xch = ctx->xch; int32_t xen_version = xc_version(xch, XENVER_version, NULL); - struct xc_sr_ihdr ihdr = { - .marker = IHDR_MARKER, - .id = htonl(IHDR_ID), - .version = htonl(3), - .options = htons(IHDR_OPT_LITTLE_ENDIAN), - }; - struct xc_sr_dhdr dhdr = { - .type = guest_type, - .page_shift = XC_PAGE_SHIFT, - .xen_major = (xen_version >> 16) & 0xffff, - .xen_minor = (xen_version) & 0xffff, + struct { + struct xc_sr_ihdr ihdr; + struct xc_sr_dhdr dhdr; + } hdrs = { + .ihdr = { + .marker = IHDR_MARKER, + .id = htonl(IHDR_ID), + .version = htonl(3), + .options = htons(IHDR_OPT_LITTLE_ENDIAN), + }, + .dhdr = { + .type = guest_type, + .page_shift = XC_PAGE_SHIFT, + .xen_major = (xen_version >> 16) & 0xffff, + .xen_minor = (xen_version) & 0xffff, + }, }; if ( xen_version < 0 ) @@ -29,15 +34,9 @@ static int write_headers(struct xc_sr_context *ctx, uint16_t guest_type) return -1; } - if ( write_exact(ctx->fd, &ihdr, sizeof(ihdr)) ) - { - PERROR("Unable to write Image Header to stream"); - return -1; - } - - if ( write_exact(ctx->fd, &dhdr, sizeof(dhdr)) ) + if ( write_exact(ctx->fd, &hdrs, sizeof(hdrs)) ) { - PERROR("Unable to write Domain Header to stream"); + PERROR("Unable to write Image/Domain headers to stream"); return -1; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 15:11:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 15:11:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357169.1611665 (Exim 4.92) (envelope-from ) id 1whTvx-0004BE-L3; Wed, 08 Jul 2026 15:11:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357169.1611665; Wed, 08 Jul 2026 15:11:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvx-0004B7-Ia; Wed, 08 Jul 2026 15:11:33 +0000 Received: by outflank-mailman (input) for mailman id 1357169; Wed, 08 Jul 2026 15:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTvw-0004B0-Ev for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whTvw-00Dd4t-2H for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whTvw-0078Fk-1F for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yJjOMsau1HQW3B86dCQaJmXkXKH7zIRT7sZKs3nSjj4=; b=gLVZi076/kxT8EL4afFjpDs6sw TVjbPXIWvA6wNtKz3zAWdOR6jzlUiA3l08+EyN8OBRctySSw35TF6weACdfIjaYGs1h1BsRNA5eZE IOBNjiGEjB1Tu+dEXFc0q75el+Y4H2iMBBT9sKATHw7bO9JovHdWWJeCGP6m+y+1aSls=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Allocate rec_pfns earlier in write_batch() Message-Id: Date: Wed, 08 Jul 2026 15:11:32 +0000 commit 72927fc6f7e87b8f791022e78a618bb6a66e5361 Author: Andrew Cooper AuthorDate: Wed Jul 1 14:27:39 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Allocate rec_pfns earlier in write_batch() For reasons which escape me, rec_pfns are allocated separately to the rest of the batch allocations. Allocate them all together. This will allow for future simplifications to be performed in an incremental mannor. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index 6f310d6d8c..185ef80e1f 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -115,8 +115,10 @@ static int write_batch(struct xc_sr_context *ctx) local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ iov = malloc((nr_pfns + 4) * sizeof(*iov)); + /* page_data record PFNs list */ + rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov ) + if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov || !rec_pfns ) { ERROR("Unable to allocate arrays for a batch of %u pages", nr_pfns); @@ -207,14 +209,6 @@ static int write_batch(struct xc_sr_context *ctx) } } - rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !rec_pfns ) - { - ERROR("Unable to allocate %zu bytes of memory for page data pfn list", - nr_pfns * sizeof(*rec_pfns)); - goto err; - } - hdr.count = nr_pfns; rec.length = sizeof(hdr); @@ -263,11 +257,11 @@ static int write_batch(struct xc_sr_context *ctx) rc = ctx->save.nr_batch_pfns = 0; err: - free(rec_pfns); if ( guest_mapping ) xenforeignmemory_unmap(xch->fmem, guest_mapping, nr_pages_mapped); for ( i = 0; local_pages && i < nr_pfns; ++i ) free(local_pages[i]); + free(rec_pfns); free(iov); free(local_pages); free(guest_data); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 15:11:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 15:11:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357170.1611669 (Exim 4.92) (envelope-from ) id 1whTw7-0004D8-Mb; Wed, 08 Jul 2026 15:11:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357170.1611669; Wed, 08 Jul 2026 15:11:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTw7-0004D0-K2; Wed, 08 Jul 2026 15:11:43 +0000 Received: by outflank-mailman (input) for mailman id 1357170; Wed, 08 Jul 2026 15:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whTw6-0004Cu-HQ for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whTw6-00Dd4x-2X for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whTw6-0078WZ-1Y for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 15:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LgJjk2GZbe8dOzJMKA6IlMF72k/HNpUoVkRJ4Yu6taA=; b=vzlW/I/fOIPN4I7kIZu5AONhHy iwQy3KKHIJIRIEAnpDoQG+xsxcj8lJhXIU38eQNx7DaIGy1jiNQ7R9PEQY9VH6PsqI/SpaWxxdLYC 46l79iGuyRfxjehixAS8mWeYz/DezlWI0TYo4p6k9lEso+ZmBSH9i1w07gbIPbltBsns=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Reduce number of iovecs in write_batch() Message-Id: Date: Wed, 08 Jul 2026 15:11:42 +0000 commit 03851197a7b2cd58851b9ec2293bdf4a68c47b66 Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:47 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Reduce number of iovecs in write_batch() Construct all of the headers together in one block, rather than a field at a time. Initialise as many of the fields as possible at declaration time. Start filling in iov[] earlier, to allow for future simplifications. No practical change. Signed-off-by: Frediano Ziglio Signed-off-by: Andrew Cooper Reviewed-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 45 +++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index 185ef80e1f..a6734579aa 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -96,9 +96,18 @@ static int write_batch(struct xc_sr_context *ctx) void *page, *orig_page; uint64_t *rec_pfns = NULL; struct iovec *iov = NULL; int iovcnt = 0; - struct xc_sr_rec_page_data_header hdr = { 0 }; - struct xc_sr_record rec = { - .type = REC_TYPE_PAGE_DATA, + struct { + struct xc_sr_rhdr rec; + struct xc_sr_rec_page_data_header page_data; + } hdrs = { + .rec = { + .type = REC_TYPE_PAGE_DATA, + .length = offsetof(struct xc_sr_rec_page_data_header, + pfn[nr_pfns]), /* + the pages to send */ + }, + .page_data = { + .count = nr_pfns, + }, }; assert(nr_pfns != 0); @@ -114,7 +123,7 @@ static int write_batch(struct xc_sr_context *ctx) /* Pointers to locally allocated pages. Need freeing. */ local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ - iov = malloc((nr_pfns + 4) * sizeof(*iov)); + iov = malloc((nr_pfns + 2) * sizeof(*iov)); /* page_data record PFNs list */ rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); @@ -125,6 +134,14 @@ static int write_batch(struct xc_sr_context *ctx) goto err; } + iov[0].iov_base = &hdrs; + iov[0].iov_len = sizeof(hdrs); + + iov[1].iov_base = rec_pfns; + iov[1].iov_len = nr_pfns * sizeof(*rec_pfns); + + iovcnt = 2; + for ( i = 0; i < nr_pfns; ++i ) { types[i] = mfns[i] = ctx->save.ops.pfn_to_gfn(ctx, @@ -209,29 +226,11 @@ static int write_batch(struct xc_sr_context *ctx) } } - hdr.count = nr_pfns; - - rec.length = sizeof(hdr); - rec.length += nr_pfns * sizeof(*rec_pfns); - rec.length += nr_pages * PAGE_SIZE; + hdrs.rec.length += nr_pages * PAGE_SIZE; for ( i = 0; i < nr_pfns; ++i ) rec_pfns[i] = ((uint64_t)(types[i]) << 32) | ctx->save.batch_pfns[i]; - iov[0].iov_base = &rec.type; - iov[0].iov_len = sizeof(rec.type); - - iov[1].iov_base = &rec.length; - iov[1].iov_len = sizeof(rec.length); - - iov[2].iov_base = &hdr; - iov[2].iov_len = sizeof(hdr); - - iov[3].iov_base = rec_pfns; - iov[3].iov_len = nr_pfns * sizeof(*rec_pfns); - - iovcnt = 4; - if ( nr_pages ) { for ( i = 0; i < nr_pfns; ++i ) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 16:00:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 16:00:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357185.1611674 (Exim 4.92) (envelope-from ) id 1whUgt-0002ps-UO; Wed, 08 Jul 2026 16:00:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357185.1611674; Wed, 08 Jul 2026 16:00:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUgt-0002pR-R6; Wed, 08 Jul 2026 16:00:03 +0000 Received: by outflank-mailman (input) for mailman id 1357185; Wed, 08 Jul 2026 16:00:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUgs-0002Sz-KN for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whUgs-00De3U-1l for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whUgs-008ZGl-0l for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yP3tZWvPT0YDd4qXqgjxXXcQbwviL9QZJ1+oujo0lO8=; b=JN38DS9CMAUJUY8IXoSTqOXBi9 yb2O0Jx94Ee6xmi5icQLW8U/xOEdt43ZIybHRIDm0pC6SGxewQ1HotBDTrgsEEJbl8y9bob4MmrNg mrIaxnCIzLLiZ8WVsMvnI6gqO88lB+Q+UEySB6d8w9R7B+Grpc4sQ6xrdBdndwbrQJIk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Avoids using 2 indexes in process_page_data() Message-Id: Date: Wed, 08 Jul 2026 16:00:02 +0000 commit 42ef7f610653d743bf8c04f9bbe26239148ac84f Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:52 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Avoids using 2 indexes in process_page_data() Simplify code, after the first scan of the various arrays we don't need to keep original types and PFNs but only the ones having data. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_restore.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/tools/libs/guest/xg_sr_restore.c b/tools/libs/guest/xg_sr_restore.c index e148fc594a..458eaa5992 100644 --- a/tools/libs/guest/xg_sr_restore.c +++ b/tools/libs/guest/xg_sr_restore.c @@ -260,9 +260,7 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, int *map_errs = malloc(count * sizeof(*map_errs)); int rc; void *mapping = NULL, *guest_page = NULL; - unsigned int i, /* i indexes the pfns from the record. */ - j, /* j indexes the subset of pfns we decide to map. */ - nr_pages = 0; + unsigned int nr_pages = 0; if ( !mfns || !map_errs ) { @@ -279,12 +277,17 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, goto err; } - for ( i = 0; i < count; ++i ) + for ( unsigned int i = 0; i < count; ++i ) { ctx->restore.ops.set_page_type(ctx, pfns[i], types[i]); - if ( page_type_has_stream_data(types[i]) ) - mfns[nr_pages++] = ctx->restore.ops.pfn_to_gfn(ctx, pfns[i]); + if ( !page_type_has_stream_data(types[i]) ) + continue; + + mfns[nr_pages] = ctx->restore.ops.pfn_to_gfn(ctx, pfns[i]); + pfns[nr_pages] = pfns[i]; + types[nr_pages] = types[i]; + nr_pages++; } /* Nothing to do? */ @@ -302,16 +305,13 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, goto err; } - for ( i = 0, j = 0; i < count; ++i ) + for ( unsigned int i = 0; i < nr_pages; ++i ) { - if ( !page_type_has_stream_data(types[i]) ) - continue; - - if ( map_errs[j] ) + if ( map_errs[i] ) { rc = -1; ERROR("Mapping pfn %#"PRIpfn" (mfn %#"PRIpfn", type %#"PRIx32") failed with %d", - pfns[i], mfns[j], types[i], map_errs[j]); + pfns[i], mfns[i], types[i], map_errs[i]); goto err; } @@ -337,7 +337,6 @@ static int process_page_data(struct xc_sr_context *ctx, unsigned int count, memcpy(guest_page, page_data, PAGE_SIZE); } - ++j; guest_page += PAGE_SIZE; page_data += PAGE_SIZE; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 16:00:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 16:00:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357186.1611677 (Exim 4.92) (envelope-from ) id 1whUh3-0003Iu-V5; Wed, 08 Jul 2026 16:00:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357186.1611677; Wed, 08 Jul 2026 16:00:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUh3-0003Im-SZ; Wed, 08 Jul 2026 16:00:13 +0000 Received: by outflank-mailman (input) for mailman id 1357186; Wed, 08 Jul 2026 16:00:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUh2-0003IP-Ch for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whUh2-00DeQL-23 for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whUh2-008ZaF-12 for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UELOeW6WxFsPopnltFCN9nY53zqvhTV3KhbatRrmmYA=; b=QDnDZLZ/ztdhTttlYiuTGnJziO hC/Bbcd6QwY7Ud9f23+iA3d+zBHrolcmHEc4rSPFmGJxYkvROehhUFTd5UkLcVnhi3qJSQzs0twIv NHKsEaHLCFbVDBlNOrhGlE5BaVVp8kqDn+gF7CbddF2QkqRtn/CyXGZFKmw0ADM75jds=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Reduce number of iovecs in write_split_record() Message-Id: Date: Wed, 08 Jul 2026 16:00:12 +0000 commit 32204e8e194bfe991fd9d3dd57cdc44663da9f3b Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:46 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Reduce number of iovecs in write_split_record() Construct xc_sr_rhdr directly rather than in two halves. Use size_t for combined_len, which allows the later size check to spot a few more cases which might have truncated. Signed-off-by: Frediano Ziglio Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/libs/guest/xg_sr_common.c b/tools/libs/guest/xg_sr_common.c index c7b3c6f3bc..9b2782b5cf 100644 --- a/tools/libs/guest/xg_sr_common.c +++ b/tools/libs/guest/xg_sr_common.c @@ -59,11 +59,11 @@ int write_split_record(struct xc_sr_context *ctx, struct xc_sr_record *rec, static const char zeroes[REC_ALIGN] = {}; xc_interface *xch = ctx->xch; - typeof(rec->length) combined_length = rec->length + sz; + size_t combined_length = rec->length + sz; size_t record_length = ROUNDUP(combined_length, REC_ALIGN); + struct xc_sr_rhdr rhdr = { rec->type, combined_length }; struct iovec parts[] = { - { &rec->type, sizeof(rec->type) }, - { &combined_length, sizeof(combined_length) }, + { &rhdr, sizeof(rhdr) }, { rec->data, rec->length }, { buf, sz }, { (void *)zeroes, record_length - combined_length }, -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 16:00:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 16:00:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357188.1611681 (Exim 4.92) (envelope-from ) id 1whUhE-0003Mn-26; Wed, 08 Jul 2026 16:00:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357188.1611681; Wed, 08 Jul 2026 16:00:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhD-0003Mf-VU; Wed, 08 Jul 2026 16:00:23 +0000 Received: by outflank-mailman (input) for mailman id 1357188; Wed, 08 Jul 2026 16:00:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhC-0003MV-Hz for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whUhC-00DeWP-2Y for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whUhC-008Ztk-1K for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WGLV6NxWH6kZsnX4GGvF6AFURWVD4tXz5FDnf6IUqho=; b=DKmShsbroioiZIXb4ZECEpdQ5S y6YnmCakNYnuD4GoXQxStvqefLNYMyFHQlPq4KwLyFjb9KLwnXGlHYvyKHXAxw9AQ+WXIb7l9lAio bDOs8OQs/4n1QW79ZRIMQnow360hb3B0Ww6E0ScO5/jiiWwUbj25dUXmtFw2CXEvDbEc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Use a single write_exact() in write_headers() Message-Id: Date: Wed, 08 Jul 2026 16:00:22 +0000 commit dfb11094ae586a1ccc3cfab9e93c7099aed0cede Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Use a single write_exact() in write_headers() Reduce number of syscalls by coalescing the image and the domain headers. Signed-off-by: Frediano Ziglio Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index fdbceab52e..6f310d6d8c 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -10,17 +10,22 @@ static int write_headers(struct xc_sr_context *ctx, uint16_t guest_type) { xc_interface *xch = ctx->xch; int32_t xen_version = xc_version(xch, XENVER_version, NULL); - struct xc_sr_ihdr ihdr = { - .marker = IHDR_MARKER, - .id = htonl(IHDR_ID), - .version = htonl(3), - .options = htons(IHDR_OPT_LITTLE_ENDIAN), - }; - struct xc_sr_dhdr dhdr = { - .type = guest_type, - .page_shift = XC_PAGE_SHIFT, - .xen_major = (xen_version >> 16) & 0xffff, - .xen_minor = (xen_version) & 0xffff, + struct { + struct xc_sr_ihdr ihdr; + struct xc_sr_dhdr dhdr; + } hdrs = { + .ihdr = { + .marker = IHDR_MARKER, + .id = htonl(IHDR_ID), + .version = htonl(3), + .options = htons(IHDR_OPT_LITTLE_ENDIAN), + }, + .dhdr = { + .type = guest_type, + .page_shift = XC_PAGE_SHIFT, + .xen_major = (xen_version >> 16) & 0xffff, + .xen_minor = (xen_version) & 0xffff, + }, }; if ( xen_version < 0 ) @@ -29,15 +34,9 @@ static int write_headers(struct xc_sr_context *ctx, uint16_t guest_type) return -1; } - if ( write_exact(ctx->fd, &ihdr, sizeof(ihdr)) ) - { - PERROR("Unable to write Image Header to stream"); - return -1; - } - - if ( write_exact(ctx->fd, &dhdr, sizeof(dhdr)) ) + if ( write_exact(ctx->fd, &hdrs, sizeof(hdrs)) ) { - PERROR("Unable to write Domain Header to stream"); + PERROR("Unable to write Image/Domain headers to stream"); return -1; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 16:00:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 16:00:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357189.1611685 (Exim 4.92) (envelope-from ) id 1whUhO-0003YB-3h; Wed, 08 Jul 2026 16:00:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357189.1611685; Wed, 08 Jul 2026 16:00:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhO-0003Y3-0n; Wed, 08 Jul 2026 16:00:34 +0000 Received: by outflank-mailman (input) for mailman id 1357189; Wed, 08 Jul 2026 16:00:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhM-0003Xw-KQ for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whUhM-00DeWT-2q for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whUhM-008aCZ-1p for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=u4Cb5UhYVl9meA57mS68yhoP352+uCMX3hL9Dez9gxU=; b=rKrwTemlAAHUARiB18WibGuP2h utYg8BEfcTJ4eFUlNyAnt5n0x3LMDU/1KT9qUTAcPknylw4p6GvXE63YGy6YhmDumewqoVZe6KsD3 FYrou/XByPlMKwfFB7xVavqVpokRObOamP1hd7+063nTgzNSKQ41O2JCKV6CsBL7jxnw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Allocate rec_pfns earlier in write_batch() Message-Id: Date: Wed, 08 Jul 2026 16:00:32 +0000 commit 72927fc6f7e87b8f791022e78a618bb6a66e5361 Author: Andrew Cooper AuthorDate: Wed Jul 1 14:27:39 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Allocate rec_pfns earlier in write_batch() For reasons which escape me, rec_pfns are allocated separately to the rest of the batch allocations. Allocate them all together. This will allow for future simplifications to be performed in an incremental mannor. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index 6f310d6d8c..185ef80e1f 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -115,8 +115,10 @@ static int write_batch(struct xc_sr_context *ctx) local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ iov = malloc((nr_pfns + 4) * sizeof(*iov)); + /* page_data record PFNs list */ + rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov ) + if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov || !rec_pfns ) { ERROR("Unable to allocate arrays for a batch of %u pages", nr_pfns); @@ -207,14 +209,6 @@ static int write_batch(struct xc_sr_context *ctx) } } - rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !rec_pfns ) - { - ERROR("Unable to allocate %zu bytes of memory for page data pfn list", - nr_pfns * sizeof(*rec_pfns)); - goto err; - } - hdr.count = nr_pfns; rec.length = sizeof(hdr); @@ -263,11 +257,11 @@ static int write_batch(struct xc_sr_context *ctx) rc = ctx->save.nr_batch_pfns = 0; err: - free(rec_pfns); if ( guest_mapping ) xenforeignmemory_unmap(xch->fmem, guest_mapping, nr_pages_mapped); for ( i = 0; local_pages && i < nr_pfns; ++i ) free(local_pages[i]); + free(rec_pfns); free(iov); free(local_pages); free(guest_data); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 08 16:00:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 08 Jul 2026 16:00:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1357190.1611689 (Exim 4.92) (envelope-from ) id 1whUhY-0003a6-4k; Wed, 08 Jul 2026 16:00:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1357190.1611689; Wed, 08 Jul 2026 16:00:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhY-0003Zy-2A; Wed, 08 Jul 2026 16:00:44 +0000 Received: by outflank-mailman (input) for mailman id 1357190; Wed, 08 Jul 2026 16:00:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whUhW-0003Zp-Nt for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1whUhW-00DeWa-3B for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1whUhW-008aUQ-2A for xen-changelog@lists.xenproject.org; Wed, 08 Jul 2026 16:00:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=W3Jr5mtpAOS3BMzqlQ+Enn+M9h84PXIZWE3jn2imDBI=; b=0IIJi/SvN3tp9p/gLqsQc9++KZ PEXIihGt8LzmLL8ssRrUk3mbSk1XDXq+p+b9ZCE/8CFPq3njA0sf9qG+cceqzj/GzbrZQ7PHXfL0j QJmsSoV//gBIkgb7sxA0JqO1g221c5wwpzjqZUKaguY2MsD/EODZmXK5HgMNxWvQb2fU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Reduce number of iovecs in write_batch() Message-Id: Date: Wed, 08 Jul 2026 16:00:42 +0000 commit 03851197a7b2cd58851b9ec2293bdf4a68c47b66 Author: Frediano Ziglio AuthorDate: Fri Jun 19 14:04:47 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 8 15:35:45 2026 +0100 libs/guest: Reduce number of iovecs in write_batch() Construct all of the headers together in one block, rather than a field at a time. Initialise as many of the fields as possible at declaration time. Start filling in iov[] earlier, to allow for future simplifications. No practical change. Signed-off-by: Frediano Ziglio Signed-off-by: Andrew Cooper Reviewed-by: Anthony PERARD --- tools/libs/guest/xg_sr_save.c | 45 +++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index 185ef80e1f..a6734579aa 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -96,9 +96,18 @@ static int write_batch(struct xc_sr_context *ctx) void *page, *orig_page; uint64_t *rec_pfns = NULL; struct iovec *iov = NULL; int iovcnt = 0; - struct xc_sr_rec_page_data_header hdr = { 0 }; - struct xc_sr_record rec = { - .type = REC_TYPE_PAGE_DATA, + struct { + struct xc_sr_rhdr rec; + struct xc_sr_rec_page_data_header page_data; + } hdrs = { + .rec = { + .type = REC_TYPE_PAGE_DATA, + .length = offsetof(struct xc_sr_rec_page_data_header, + pfn[nr_pfns]), /* + the pages to send */ + }, + .page_data = { + .count = nr_pfns, + }, }; assert(nr_pfns != 0); @@ -114,7 +123,7 @@ static int write_batch(struct xc_sr_context *ctx) /* Pointers to locally allocated pages. Need freeing. */ local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ - iov = malloc((nr_pfns + 4) * sizeof(*iov)); + iov = malloc((nr_pfns + 2) * sizeof(*iov)); /* page_data record PFNs list */ rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); @@ -125,6 +134,14 @@ static int write_batch(struct xc_sr_context *ctx) goto err; } + iov[0].iov_base = &hdrs; + iov[0].iov_len = sizeof(hdrs); + + iov[1].iov_base = rec_pfns; + iov[1].iov_len = nr_pfns * sizeof(*rec_pfns); + + iovcnt = 2; + for ( i = 0; i < nr_pfns; ++i ) { types[i] = mfns[i] = ctx->save.ops.pfn_to_gfn(ctx, @@ -209,29 +226,11 @@ static int write_batch(struct xc_sr_context *ctx) } } - hdr.count = nr_pfns; - - rec.length = sizeof(hdr); - rec.length += nr_pfns * sizeof(*rec_pfns); - rec.length += nr_pages * PAGE_SIZE; + hdrs.rec.length += nr_pages * PAGE_SIZE; for ( i = 0; i < nr_pfns; ++i ) rec_pfns[i] = ((uint64_t)(types[i]) << 32) | ctx->save.batch_pfns[i]; - iov[0].iov_base = &rec.type; - iov[0].iov_len = sizeof(rec.type); - - iov[1].iov_base = &rec.length; - iov[1].iov_len = sizeof(rec.length); - - iov[2].iov_base = &hdr; - iov[2].iov_len = sizeof(hdr); - - iov[3].iov_base = rec_pfns; - iov[3].iov_len = nr_pfns * sizeof(*rec_pfns); - - iovcnt = 4; - if ( nr_pages ) { for ( i = 0; i < nr_pfns; ++i ) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359830.1613205 (Exim 4.92) (envelope-from ) id 1wiGy8-00077L-Vc; Fri, 10 Jul 2026 19:33:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359830.1613205; Fri, 10 Jul 2026 19:33:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGy8-00077C-Sa; Fri, 10 Jul 2026 19:33:04 +0000 Received: by outflank-mailman (input) for mailman id 1359830; Fri, 10 Jul 2026 19:33:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGy7-000776-4g for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGy6-00H3Pj-2q for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGy6-00Bn12-1j for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3uPXn92L4D3q01IK0Y7g18NHw7IurVoy5L4K4XkJsZ0=; b=jlExja17XzT44v0TatANyo0eb9 H4X+/EXXrTajSdK/uJTm1Tv+0aNEa7q09e2LGiM1jvKtlB8j+xntF8zDZJb4sSy5wyC1FzCibUAJy FvLITRTf593Lz5RWVY5JFjSvgpNV2P3T8h7rdeDyQQNnLJEBCgQ45mqjHnvHD1Lqw4mA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] argo: lower level of noisy connection-refused log Message-Id: Date: Fri, 10 Jul 2026 19:33:02 +0000 commit 050598c254802af0d39ab371e3c3d88d427794ee Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:21 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: lower level of noisy connection-refused log Switch the log line to argo_dprintk() so it is enabled only in debug environments, as it can spam the logs when a dom0 service using the Argo hypercall tries to communicate with a domain that is still starting up. Note that this also lowers the log level to debug when the argo_dprintk() facility is enabled. Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk --- xen/common/argo.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 28626e00a8..98a3db7fd0 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -2034,10 +2034,9 @@ sendv(struct domain *src_d, xen_argo_addr_t *src_addr, src_id.domain_id); if ( !ring_info ) { - gprintk(XENLOG_ERR, - "argo: vm%u connection refused, src (vm%u:%x) dst (vm%u:%x)\n", - current->domain->domain_id, src_id.domain_id, src_id.aport, - dst_addr->domain_id, dst_addr->aport); + argo_dprintk("vm%u connection refused, src (vm%u:%x) dst (vm%u:%x)\n", + current->domain->domain_id, src_id.domain_id, src_id.aport, + dst_addr->domain_id, dst_addr->aport); ret = -ECONNREFUSED; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359831.1613208 (Exim 4.92) (envelope-from ) id 1wiGyI-00078r-0K; Fri, 10 Jul 2026 19:33:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359831.1613208; Fri, 10 Jul 2026 19:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyH-00078j-Tz; Fri, 10 Jul 2026 19:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1359831; Fri, 10 Jul 2026 19:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyG-00078Z-Nn for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGyG-00H3Pn-3B for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGyG-00BnHq-28 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Gd+v2bVPgyfY+mvLyLdNlk95RG6R5eCi68VwBSPvOcg=; b=WbwaXH/A5aiFlJ47K40j6ULRKQ wU+in7oIg9ZGda/e5OgBf8r94Bztu1Kj4oIqbBhLgaXs1UstRrAQU4SHreztzTIFJJVcZQgb68Pks ZsSZZtwbrf62jiCRQa4031PYSFKeICoHWqdnwhd5XZKkDbz6Di52EJ7OUB/NVs9a84MY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] argo: correct logline in ring_unmap() Message-Id: Date: Fri, 10 Jul 2026 19:33:12 +0000 commit b66ad9b9ad772e1078b9b5ff0b3e16a81c99fa2d Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:22 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: correct logline in ring_unmap() Drop XENLOG_ERR from the logline since argo_dprintk() already injects the proper log level indicator. Also, drop "argo: " prefix, since it is also injected by argo_dprintk() Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 98a3db7fd0..5da14c929e 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -474,7 +474,7 @@ ring_unmap(const struct domain *d, struct argo_ring_info *ring_info) continue; ASSERT(!mfn_eq(ring_info->mfns[i], INVALID_MFN)); - argo_dprintk(XENLOG_ERR "argo: unmapping page %"PRI_mfn" from %p\n", + argo_dprintk("unmapping page %"PRI_mfn" from %p\n", mfn_x(ring_info->mfns[i]), ring_info->mfn_mapping[i]); unmap_domain_page_global(ring_info->mfn_mapping[i]); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359832.1613212 (Exim 4.92) (envelope-from ) id 1wiGyS-0007B7-1q; Fri, 10 Jul 2026 19:33:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359832.1613212; Fri, 10 Jul 2026 19:33:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyR-0007Ay-VL; Fri, 10 Jul 2026 19:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1359832; Fri, 10 Jul 2026 19:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyQ-0007As-SE for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGyR-00H3Pt-0O for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGyQ-00BnTl-2T for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KztGphhwCSsQWU47GSQzpOG20VIh8tAp9xZrVHhYtzw=; b=0umjco6Bpe+oqMrW6YV8yEE368 KcMVlnz9sr2PEaYq+WMR9uhIQohSibeevKlYSHg8sTfV/pv3ICr3e0GXyAhwbse6fKkB8EHiMpDJr ILKP5L44qB++Yaz+CmrA2QfkM4lFiFOWr3E6AoIEwPzrFxliRTfqyD6yDDBF79aL23VE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] argo: drop argo prefix from argo_dprintk() calls Message-Id: Date: Fri, 10 Jul 2026 19:33:22 +0000 commit a656d5c3a3c0c7d124ef6477310ee73e37a7a391 Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:23 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: drop argo prefix from argo_dprintk() calls argo_dprintk() prefixes all log lines with "argo: " automatically. Remove duplicate prefixes from log messages in the Argo module where applicable. Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 5da14c929e..ffa1f43437 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -1467,7 +1467,7 @@ find_ring_mfns(struct domain *d, struct argo_ring_info *ring_info, if ( ring_info->mfns ) { /* Ring already existed: drop the previous mapping. */ - argo_dprintk("argo: vm%u re-register existing ring " + argo_dprintk("vm%u re-register existing ring " "(vm%u:%x vm%u) clears mapping\n", d->domain_id, ring_info->id.domain_id, ring_info->id.aport, ring_info->id.partner_id); @@ -1527,7 +1527,7 @@ find_ring_mfns(struct domain *d, struct argo_ring_info *ring_info, { ASSERT(ring_info->nmfns == NPAGES_RING(len)); - argo_dprintk("argo: vm%u ring (vm%u:%x vm%u) %p " + argo_dprintk("vm%u ring (vm%u:%x vm%u) %p " "mfn_mapping %p len %u nmfns %u\n", d->domain_id, ring_info->id.domain_id, ring_info->id.aport, ring_info->id.partner_id, ring_info, @@ -1741,7 +1741,7 @@ register_ring(struct domain *currd, list_add(&ring_info->node, &currd->argo->ring_hash[hash_index(&ring_info->id)]); - argo_dprintk("argo: vm%u registering ring (vm%u:%x vm%u)\n", + argo_dprintk("vm%u registering ring (vm%u:%x vm%u)\n", currd->domain_id, ring_id.domain_id, ring_id.aport, ring_id.partner_id); } @@ -1781,7 +1781,7 @@ register_ring(struct domain *currd, goto out_unlock2; } - argo_dprintk("argo: vm%u re-registering existing ring (vm%u:%x vm%u)\n", + argo_dprintk("vm%u re-registering existing ring (vm%u:%x vm%u)\n", currd->domain_id, ring_id.domain_id, ring_id.aport, ring_id.partner_id); } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359833.1613215 (Exim 4.92) (envelope-from ) id 1wiGyd-0007DM-3G; Fri, 10 Jul 2026 19:33:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359833.1613215; Fri, 10 Jul 2026 19:33:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyd-0007DE-0Q; Fri, 10 Jul 2026 19:33:35 +0000 Received: by outflank-mailman (input) for mailman id 1359833; Fri, 10 Jul 2026 19:33:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyb-0007Cp-69 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGyb-00H3Px-1P for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGyb-00Bnuq-0J for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zUU2/vqmvfLm4zb66OC28yj0rkn49v7jXNPxGBXy8Ks=; b=3oFOmjmeYEZADfGYgG9WnQdjVD xVKR9B9bJ1yg5LkgjisM8etWNVgl92kPDGwJMCguc9PH+hjGV1yS4tgX/JyEhKRKcrqEt0bhDjdBx ILvPybBhQfLhlFgjdoa7l4oNlatvLuXDJdXGefnalBKmTH7y8pUhT/jErOUIWoDu1Z+E=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] argo: fixup argo_dprintk() Message-Id: Date: Fri, 10 Jul 2026 19:33:33 +0000 commit bf0fd170726c3531076feb8f3c8d228384f31c36 Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:24 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: fixup argo_dprintk() Current argo_dprintk() implementation is a wrapper around raw printk(). Rewire it through gprintk() to allow for better debugging context (such as domain ID). Signed-off-by: Denis Mukhin Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index ffa1f43437..3c38a51d09 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -322,7 +322,7 @@ static DEFINE_RWLOCK(L1_global_argo_rwlock); /* L1 */ #define argo_dprintk(fmt, args...) \ do { \ if ( ARGO_DEBUG ) \ - printk(XENLOG_DEBUG "argo: " fmt, ##args); \ + gprintk(XENLOG_DEBUG, "argo: " fmt, ##args);\ } while ( 0 ) /* -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359834.1613219 (Exim 4.92) (envelope-from ) id 1wiGyn-0007FM-4O; Fri, 10 Jul 2026 19:33:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359834.1613219; Fri, 10 Jul 2026 19:33:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyn-0007FE-1q; Fri, 10 Jul 2026 19:33:45 +0000 Received: by outflank-mailman (input) for mailman id 1359834; Fri, 10 Jul 2026 19:33:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyl-0007F7-C6 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGyl-00H3Q2-20 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGyl-00Bocq-0y for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iIVyXI48bqgljk8DWpJfWekH+Zu73NWOg/OT6QKHj24=; b=jVXnpgYtwc5CFXhj3wj932q3Bw fwnjnF3Aac5f+Z0ztfFhxdN6yKY90zt3q54msAD9p3TuWnG4XiDTfc8BCO04gclYALZUFu7DULYOV mpHu7PXdgrmplsEoNxCQI6SgpuhIYWEAWHUP8NhMOXoU1o66Uls54ZjHim9k7HW1/evM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Fri, 10 Jul 2026 19:33:43 +0000 commit 7d48ef45b6df0cf8985b84305e02b7440de8f50f Author: Andrew Cooper AuthorDate: Mon Mar 24 23:25:59 2025 +0000 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 2c13356c4d..57f6baffb0 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -780,12 +780,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:33:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:33:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359835.1613224 (Exim 4.92) (envelope-from ) id 1wiGyx-0007HF-5q; Fri, 10 Jul 2026 19:33:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359835.1613224; Fri, 10 Jul 2026 19:33:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyx-0007H7-3C; Fri, 10 Jul 2026 19:33:55 +0000 Received: by outflank-mailman (input) for mailman id 1359835; Fri, 10 Jul 2026 19:33:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGyv-0007Gz-Er for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGyv-00H3QP-2H for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGyv-00Bou6-1I for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:33:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AHEd9BZYfjHJqln1rh9GjWvI/+B16Hec3u7zPxcTOrE=; b=yxefw1pthijhOAJs974dfMy/sC wJG9P6yWegUg291L9KiIlYMJm340sTSJSZ3qc3Ewdpw/DjjTjWAQ2ho5vDnzi6es7UOKTcpH62QNo RDNPkUyD6SXqAHTULpY0NwXMKYvQvEQhPQX7JxgVv3PZ7PlkwP2eR0XnZCIlTxjNwytM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/ctrl: Allow writev_exact() to change the iov array Message-Id: Date: Fri, 10 Jul 2026 19:33:53 +0000 commit 85bdb67eaa5354cbc19b5e1c2f5f3d0f1984dd5c Author: Frediano Ziglio AuthorDate: Thu Jul 9 08:43:53 2026 +0100 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 libs/ctrl: Allow writev_exact() to change the iov array Avoid having to allocate and copy the array if a partial write happens. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper --- tools/libs/ctrl/xc_private.c | 70 ++++++++++---------------------------------- tools/libs/ctrl/xc_private.h | 3 +- 2 files changed, 18 insertions(+), 55 deletions(-) diff --git a/tools/libs/ctrl/xc_private.c b/tools/libs/ctrl/xc_private.c index bb0f81d6f3..5398a7c626 100644 --- a/tools/libs/ctrl/xc_private.c +++ b/tools/libs/ctrl/xc_private.c @@ -635,7 +635,7 @@ int write_exact(int fd, const void *data, size_t size) /* * MiniOS's libc doesn't know about writev(). Implement it as multiple write()s. */ -int writev_exact(int fd, const struct iovec *iov, int iovcnt) +int writev_exact(int fd, struct iovec *iov, int iovcnt) { int rc, i; @@ -649,71 +649,33 @@ int writev_exact(int fd, const struct iovec *iov, int iovcnt) return 0; } #else -int writev_exact(int fd, const struct iovec *iov, int iovcnt) +int writev_exact(int fd, struct iovec *iov, int iovcnt) { - struct iovec *local_iov = NULL; - int rc = 0, iov_idx = 0, saved_errno = 0; - ssize_t len; + int iov_idx = 0; + ssize_t len = 0; while ( iov_idx < iovcnt ) { - /* - * Skip over iov[] entries with 0 length. - * - * This is needed to cover the case where we took a partial write and - * all remaining vectors are of 0 length. In such a case, the results - * from writev() are indistinguishable from EOF. - */ - while ( iov[iov_idx].iov_len == 0 ) - if ( ++iov_idx == iovcnt ) - goto out; + /* Check iov[] to see whether we had a partial or complete write. */ + if ( len >= iov[iov_idx].iov_len ) + { + len -= iov[iov_idx++].iov_len; + continue; + } + + /* Partial write of iov[iov_idx]. */ + iov[iov_idx].iov_base += len; + iov[iov_idx].iov_len -= len; len = writev(fd, &iov[iov_idx], min(iovcnt - iov_idx, IOV_MAX)); - saved_errno = errno; if ( (len == -1) && (errno == EINTR) ) continue; if ( len <= 0 ) - { - rc = -1; - goto out; - } - - /* Check iov[] to see whether we had a partial or complete write. */ - while ( (len > 0) && (iov_idx < iovcnt) ) - { - if ( len >= iov[iov_idx].iov_len ) - len -= iov[iov_idx++].iov_len; - else - { - /* Partial write of iov[iov_idx]. Copy iov so we can adjust - * element iov_idx and resubmit the rest. */ - if ( !local_iov ) - { - local_iov = malloc(iovcnt * sizeof(*iov)); - if ( !local_iov ) - { - saved_errno = ENOMEM; - rc = -1; - goto out; - } - - iov = memcpy(local_iov, iov, iovcnt * sizeof(*iov)); - } - - local_iov[iov_idx].iov_base += len; - local_iov[iov_idx].iov_len -= len; - break; - } - } + return -1; } - saved_errno = 0; - - out: - free(local_iov); - errno = saved_errno; - return rc; + return 0; } #endif diff --git a/tools/libs/ctrl/xc_private.h b/tools/libs/ctrl/xc_private.h index b5892ae8dc..8a325c17b0 100644 --- a/tools/libs/ctrl/xc_private.h +++ b/tools/libs/ctrl/xc_private.h @@ -383,7 +383,8 @@ int xc_flush_mmu_updates(xc_interface *xch, struct xc_mmu *mmu); /* Return 0 on success; -1 on error setting errno. */ int read_exact(int fd, void *data, size_t size); /* EOF => -1, errno=0 */ int write_exact(int fd, const void *data, size_t size); -int writev_exact(int fd, const struct iovec *iov, int iovcnt); +/* May alter @iov to cope with partial writes. */ +int writev_exact(int fd, struct iovec *iov, int iovcnt); int xc_ffs8(uint8_t x); int xc_ffs16(uint16_t x); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:34:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:34:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359836.1613227 (Exim 4.92) (envelope-from ) id 1wiGz7-0007JB-7W; Fri, 10 Jul 2026 19:34:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359836.1613227; Fri, 10 Jul 2026 19:34:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGz7-0007J3-4e; Fri, 10 Jul 2026 19:34:05 +0000 Received: by outflank-mailman (input) for mailman id 1359836; Fri, 10 Jul 2026 19:34:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGz5-0007Iv-Hx for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGz5-00H3Qj-2a for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGz5-00Bp6z-1Y for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xaPddGtGBaoO5IXKK80kOhrnuHl3pNC06i17Gg6zY9k=; b=LVRQoaiY3UMVcVuPPpKjbdoueA 4kzwOirP9UaBl5k0B+PFTYyZiCHemU0ErBApLjKXoF3ytybnrWSci6iAB4tpz6n8AFd1BuPIIbDlh z2jMvXk+vRw7D/Om1JoBLXclSkFpFD19PEIbQp2VxU/vVJ27IBCfrzfQUREm5OUWYWvA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libs/guest: Drop guest_data in write_batch() and fill iov directly Message-Id: Date: Fri, 10 Jul 2026 19:34:03 +0000 commit fdeba9d55fe49a49ff11afafe283dcb6612521ec Author: Frediano Ziglio AuthorDate: Thu Jul 9 08:43:54 2026 +0100 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 libs/guest: Drop guest_data in write_batch() and fill iov directly There is no need to store the page pointers simply to transcribe the same information into iov later. Drop the guest_data intermediate array. These days, linux has a maximum limit of 1024 iovs. Libc under the hood will subdivide the submission if necessary, which is why our general case of 1026 submissions works. xenforeignmemory_map() maps the requested guest memory contiguously, and except for PV pagetable frames, we submit contiguously into the stream. When safe to do, merge adjacent vectors by extending iov_len, reducing the likelihood that libc needs to subdivide the submission. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper --- tools/libs/guest/xg_sr_save.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index a6734579aa..84fdbe4140 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -88,7 +88,6 @@ static int write_batch(struct xc_sr_context *ctx) xc_interface *xch = ctx->xch; xen_pfn_t *mfns = NULL, *types = NULL; void *guest_mapping = NULL; - void **guest_data = NULL; void **local_pages = NULL; int *errors = NULL, rc = -1; unsigned int i, p, nr_pages = 0, nr_pages_mapped = 0; @@ -118,8 +117,6 @@ static int write_batch(struct xc_sr_context *ctx) types = malloc(nr_pfns * sizeof(*types)); /* Errors from attempting to map the gfns. */ errors = malloc(nr_pfns * sizeof(*errors)); - /* Pointers to page data to send. Mapped gfns or local allocations. */ - guest_data = calloc(nr_pfns, sizeof(*guest_data)); /* Pointers to locally allocated pages. Need freeing. */ local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ @@ -127,7 +124,7 @@ static int write_batch(struct xc_sr_context *ctx) /* page_data record PFNs list */ rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov || !rec_pfns ) + if ( !mfns || !types || !errors || !local_pages || !iov || !rec_pfns ) { ERROR("Unable to allocate arrays for a batch of %u pages", nr_pfns); @@ -218,8 +215,17 @@ static int write_batch(struct xc_sr_context *ctx) else goto err; } + else if ( iov[iovcnt - 1].iov_base + iov[iovcnt - 1].iov_len != + page ) + { + iov[iovcnt].iov_base = page; + iov[iovcnt].iov_len = PAGE_SIZE; + iovcnt++; + } else - guest_data[i] = page; + { + iov[iovcnt - 1].iov_len += PAGE_SIZE; + } rc = -1; ++p; @@ -231,28 +237,12 @@ static int write_batch(struct xc_sr_context *ctx) for ( i = 0; i < nr_pfns; ++i ) rec_pfns[i] = ((uint64_t)(types[i]) << 32) | ctx->save.batch_pfns[i]; - if ( nr_pages ) - { - for ( i = 0; i < nr_pfns; ++i ) - { - if ( guest_data[i] ) - { - iov[iovcnt].iov_base = guest_data[i]; - iov[iovcnt].iov_len = PAGE_SIZE; - iovcnt++; - --nr_pages; - } - } - } - if ( writev_exact(ctx->fd, iov, iovcnt) ) { PERROR("Failed to write page data to stream"); goto err; } - /* Sanity check we have sent all the pages we expected to. */ - assert(nr_pages == 0); rc = ctx->save.nr_batch_pfns = 0; err: @@ -263,7 +253,6 @@ static int write_batch(struct xc_sr_context *ctx) free(rec_pfns); free(iov); free(local_pages); - free(guest_data); free(errors); free(types); free(mfns); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:34:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:34:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359837.1613231 (Exim 4.92) (envelope-from ) id 1wiGzH-0007Ld-AG; Fri, 10 Jul 2026 19:34:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359837.1613231; Fri, 10 Jul 2026 19:34:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGzH-0007LV-7l; Fri, 10 Jul 2026 19:34:15 +0000 Received: by outflank-mailman (input) for mailman id 1359837; Fri, 10 Jul 2026 19:34:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGzF-0007LN-U9 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGzG-00H3Qo-0a for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGzF-00BpPH-2Z for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=W+6AbQh3tEN8+FZZtkkCKX/MLsDTbJZLF1yluaW44yc=; b=IS2Eee8kVLyiyY9uAtZdfFlz9y HFp3JAZD3eKPPHq4OgLzjOPf/xFd+qE1VuaiJI7JuSPOSUoOmegi1ONHGC6xK9bWQg2lhej1XVMjA 5vkehLaFmrJx1AK2TEESxticbkhHoPsPsHtgsezFKfEs8d5gIiklBwiXOhm54S5ycwO4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] CI: Add the new Panther Lake runner Message-Id: Date: Fri, 10 Jul 2026 19:34:13 +0000 commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 20db71b1c9..7cc5214630 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -170,6 +170,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86_64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86_64: # it's really similar to the above extends: .adl-x86_64 @@ -405,6 +416,76 @@ kbl-tools-tests-pvh-x86_64-gcc-debug: - *x86_64-test-needs - alpine-3.24-x86_64-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + zen2-smoke-x86_64-gcc-debug: extends: .zen2-x86_64 script: -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 19:34:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 19:34:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359838.1613236 (Exim 4.92) (envelope-from ) id 1wiGzS-0007Nb-Bi; Fri, 10 Jul 2026 19:34:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359838.1613236; Fri, 10 Jul 2026 19:34:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGzS-0007NS-96; Fri, 10 Jul 2026 19:34:26 +0000 Received: by outflank-mailman (input) for mailman id 1359838; Fri, 10 Jul 2026 19:34:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiGzQ-0007NL-C4 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiGzQ-00H3Qu-20 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiGzQ-00Bq9F-0n for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 19:34:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+3AmomcIn/aJqvJUmEti6pj/LGxa+Gcah3voUlp9VTU=; b=QPtQeWRaSKUYMOVM3/p/bzwfvY ZsqEPCnaR4yz7Qbv0hwyx6RljWvilcPmzNA3vrkC+A+vVRVo5noGEIy0Q9vMXQ4UzJ25l7dAPuA2C 5qo6XQS/d5/KMcTlPLQDQtxOaZ9X014Wq99AE3eq05rF7x4h49BxqcLN/3MJt0Y0RDmA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] CI: Enable FRED on the PTL runner Message-Id: Date: Fri, 10 Jul 2026 19:34:24 +0000 commit d9e36605ff1d6888d3934f7c7452da781aee37d7 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:05 2026 +0200 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 CI: Enable FRED on the PTL runner Add new job-level EXTRA_XEN_OPTS variable, in addition to CONSOLE_OPTS. FRED is not yet enabled by default on Intel systems, but is expected to function. Explicitly turn it on for added test coverage in the short term. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper --- automation/gitlab-ci/test.yaml | 1 + automation/scripts/qubes-x86_64.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 7cc5214630..61adc1baff 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -177,6 +177,7 @@ PCIDEV: "56:00.0" PCIDEV_INTR: "MSI-X" CONSOLE_OPTS: "console=com1 com1=115200,8n1" + EXTRA_XEN_OPTS: "fred" SUT_ADDR: test-22.testnet tags: - qubes-hw22 diff --git a/automation/scripts/qubes-x86_64.sh b/automation/scripts/qubes-x86_64.sh index 7a59fa5f11..065f03931b 100755 --- a/automation/scripts/qubes-x86_64.sh +++ b/automation/scripts/qubes-x86_64.sh @@ -260,14 +260,14 @@ TFTP=/scratch/gitlab-runner/tftp CONTROLLER=control@thor.testnet echo " -multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts +multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts module2 (http)/gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen module2 --nounzip (http)/gitlab-ci/initrd-dom0 " > $TFTP/grub.cfg echo "#!ipxe -kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts || reboot +kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts || reboot module /gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen || reboot module /gitlab-ci/initrd-dom0 || reboot boot -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359873.1613243 (Exim 4.92) (envelope-from ) id 1wiHjX-0004nY-Iz; Fri, 10 Jul 2026 20:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359873.1613243; Fri, 10 Jul 2026 20:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjX-0004nO-GG; Fri, 10 Jul 2026 20:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1359873; Fri, 10 Jul 2026 20:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjW-0004nI-P3 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHjW-00H4Q4-2K for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHjW-00DSNO-1E for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Iza3BMwO58YTjMzxIbe7MhCUV1yrAmFwh/eWYA8t4Og=; b=AhbDM+qVMrA6nJQ5wM5j+Z/X9F zKPSUfLgpYIwVjxiSd7qBKqm6ilrHWLIugqYEejGf2mLeGe7FngrkapLG04/Upq7LspsjQNf+fzxq THFNqzFGdT17T2GwOLFkGheFFHTQIthZh2SlCnSjUNJ2oibD+LaNE1tcUtvtZMJCSqW4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] argo: lower level of noisy connection-refused log Message-Id: Date: Fri, 10 Jul 2026 20:22:02 +0000 commit 050598c254802af0d39ab371e3c3d88d427794ee Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:21 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: lower level of noisy connection-refused log Switch the log line to argo_dprintk() so it is enabled only in debug environments, as it can spam the logs when a dom0 service using the Argo hypercall tries to communicate with a domain that is still starting up. Note that this also lowers the log level to debug when the argo_dprintk() facility is enabled. Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk --- xen/common/argo.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 28626e00a8..98a3db7fd0 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -2034,10 +2034,9 @@ sendv(struct domain *src_d, xen_argo_addr_t *src_addr, src_id.domain_id); if ( !ring_info ) { - gprintk(XENLOG_ERR, - "argo: vm%u connection refused, src (vm%u:%x) dst (vm%u:%x)\n", - current->domain->domain_id, src_id.domain_id, src_id.aport, - dst_addr->domain_id, dst_addr->aport); + argo_dprintk("vm%u connection refused, src (vm%u:%x) dst (vm%u:%x)\n", + current->domain->domain_id, src_id.domain_id, src_id.aport, + dst_addr->domain_id, dst_addr->aport); ret = -ECONNREFUSED; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359874.1613246 (Exim 4.92) (envelope-from ) id 1wiHjh-0004pA-K6; Fri, 10 Jul 2026 20:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359874.1613246; Fri, 10 Jul 2026 20:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjh-0004p2-Hg; Fri, 10 Jul 2026 20:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1359874; Fri, 10 Jul 2026 20:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjg-0004om-JN for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHjg-00H4Q9-2j for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHjg-00DSiL-1c for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=An9yzDu8HQG+Frh8ieHZPIfp+EOQg1obQqNtaFtRYoM=; b=cxuhB0+SibkdHnHpriZrh9MerZ 2Lw891lHF0cL0cdPHis54BqKMfqo9v2bgSyUWvvpvebSBdDA9gIOLWHqxQFsve/Sl0Fmsuv+NUvQn IZ44BzHrEu3qKIWjucTNaVeL1ynOlmQXCVccWazVb3Ajnzu27Spse8bYa0xeeI8swtJA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] argo: correct logline in ring_unmap() Message-Id: Date: Fri, 10 Jul 2026 20:22:12 +0000 commit b66ad9b9ad772e1078b9b5ff0b3e16a81c99fa2d Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:22 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: correct logline in ring_unmap() Drop XENLOG_ERR from the logline since argo_dprintk() already injects the proper log level indicator. Also, drop "argo: " prefix, since it is also injected by argo_dprintk() Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 98a3db7fd0..5da14c929e 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -474,7 +474,7 @@ ring_unmap(const struct domain *d, struct argo_ring_info *ring_info) continue; ASSERT(!mfn_eq(ring_info->mfns[i], INVALID_MFN)); - argo_dprintk(XENLOG_ERR "argo: unmapping page %"PRI_mfn" from %p\n", + argo_dprintk("unmapping page %"PRI_mfn" from %p\n", mfn_x(ring_info->mfns[i]), ring_info->mfn_mapping[i]); unmap_domain_page_global(ring_info->mfn_mapping[i]); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359875.1613251 (Exim 4.92) (envelope-from ) id 1wiHjr-0004rA-LQ; Fri, 10 Jul 2026 20:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359875.1613251; Fri, 10 Jul 2026 20:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjr-0004r2-Iy; Fri, 10 Jul 2026 20:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1359875; Fri, 10 Jul 2026 20:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHjq-0004qs-Q6 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHjr-00H4QD-0B for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHjq-00DTAb-2I for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=l5YqqCXubLhiIkaT9hSjWY8TRLLXLaHRNV4MolthMqs=; b=dZqGtAwdJqEj6S83bfDoTye0id XuV7NUDS7e8QV4gA/LmnTRAlP/5J3Ag+RTn6QCOIEQ43OpocnmO/Mzo3bOjvZHd6NNHss7ZB+kOoQ 9uy4kKorhqitJ/Qbwq1ySQL637xNEgfqYsX5LYosMhLIRO5j0NbiOtxemJuiAKq5vf2c=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] argo: drop argo prefix from argo_dprintk() calls Message-Id: Date: Fri, 10 Jul 2026 20:22:22 +0000 commit a656d5c3a3c0c7d124ef6477310ee73e37a7a391 Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:23 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: drop argo prefix from argo_dprintk() calls argo_dprintk() prefixes all log lines with "argo: " automatically. Remove duplicate prefixes from log messages in the Argo module where applicable. Signed-off-by: Denis Mukhin Reviewed-by: Mykola Kvach Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 5da14c929e..ffa1f43437 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -1467,7 +1467,7 @@ find_ring_mfns(struct domain *d, struct argo_ring_info *ring_info, if ( ring_info->mfns ) { /* Ring already existed: drop the previous mapping. */ - argo_dprintk("argo: vm%u re-register existing ring " + argo_dprintk("vm%u re-register existing ring " "(vm%u:%x vm%u) clears mapping\n", d->domain_id, ring_info->id.domain_id, ring_info->id.aport, ring_info->id.partner_id); @@ -1527,7 +1527,7 @@ find_ring_mfns(struct domain *d, struct argo_ring_info *ring_info, { ASSERT(ring_info->nmfns == NPAGES_RING(len)); - argo_dprintk("argo: vm%u ring (vm%u:%x vm%u) %p " + argo_dprintk("vm%u ring (vm%u:%x vm%u) %p " "mfn_mapping %p len %u nmfns %u\n", d->domain_id, ring_info->id.domain_id, ring_info->id.aport, ring_info->id.partner_id, ring_info, @@ -1741,7 +1741,7 @@ register_ring(struct domain *currd, list_add(&ring_info->node, &currd->argo->ring_hash[hash_index(&ring_info->id)]); - argo_dprintk("argo: vm%u registering ring (vm%u:%x vm%u)\n", + argo_dprintk("vm%u registering ring (vm%u:%x vm%u)\n", currd->domain_id, ring_id.domain_id, ring_id.aport, ring_id.partner_id); } @@ -1781,7 +1781,7 @@ register_ring(struct domain *currd, goto out_unlock2; } - argo_dprintk("argo: vm%u re-registering existing ring (vm%u:%x vm%u)\n", + argo_dprintk("vm%u re-registering existing ring (vm%u:%x vm%u)\n", currd->domain_id, ring_id.domain_id, ring_id.aport, ring_id.partner_id); } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359876.1613255 (Exim 4.92) (envelope-from ) id 1wiHk1-0004tJ-N3; Fri, 10 Jul 2026 20:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359876.1613255; Fri, 10 Jul 2026 20:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHk1-0004tA-KF; Fri, 10 Jul 2026 20:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1359876; Fri, 10 Jul 2026 20:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHk0-0004t4-TO for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHk1-00H4QM-0V for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHk0-00DTln-2k for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Seyl6ffXygxq1vBah/HsYOqp21ykGo+0wGarY4eS9iA=; b=Chpqda+ynmCVL/fPmLbeBr8NKj ZIGnyXr2/PFR8Z4b9u0dweGQm7VuSWgvIOyfjVNLKbtBbivSNMb5MSeeKTevIq4Lj1SKKhRbe1hwY TI0W3of50DNdDsS0avx0gT/3YxF/0yUhjKoOXs/kxVwy3JIUzQYh9i9pm5NhrDPqDV/I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] argo: fixup argo_dprintk() Message-Id: Date: Fri, 10 Jul 2026 20:22:32 +0000 commit bf0fd170726c3531076feb8f3c8d228384f31c36 Author: Denis Mukhin AuthorDate: Thu Jun 4 14:49:24 2026 -0700 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 argo: fixup argo_dprintk() Current argo_dprintk() implementation is a wrapper around raw printk(). Rewire it through gprintk() to allow for better debugging context (such as domain ID). Signed-off-by: Denis Mukhin Reviewed-by: Stefano Stabellini Reviewed-by: Jason Andryuk Reviewed-by: Daniel P. Smith --- xen/common/argo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index ffa1f43437..3c38a51d09 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -322,7 +322,7 @@ static DEFINE_RWLOCK(L1_global_argo_rwlock); /* L1 */ #define argo_dprintk(fmt, args...) \ do { \ if ( ARGO_DEBUG ) \ - printk(XENLOG_DEBUG "argo: " fmt, ##args); \ + gprintk(XENLOG_DEBUG, "argo: " fmt, ##args);\ } while ( 0 ) /* -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359877.1613259 (Exim 4.92) (envelope-from ) id 1wiHkB-0004wz-OA; Fri, 10 Jul 2026 20:22:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359877.1613259; Fri, 10 Jul 2026 20:22:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkB-0004wr-Lc; Fri, 10 Jul 2026 20:22:43 +0000 Received: by outflank-mailman (input) for mailman id 1359877; Fri, 10 Jul 2026 20:22:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkB-0004wl-0N for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHkB-00H4QQ-0n for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHkA-00DUAe-32 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=b4HYS242DY2aRJGkFavz9opLQduLadXzDN+k9Q2A2LQ=; b=PxfYoEsbqJK5aZFTC1x8F6aYIp U74EkR7N8WMkvD//SbMV4VsZ4zfyo9yRf54sYhntCUKzbUFc5JMe1cNhkpq+QVzU3QjSlttEj5g4a AGTBZlzVw8mtyydEhVJ6GU0L96nAzLaPC8JrGRf6CMzuasXZOOuMl+/H7eUKGhBUwkhM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Fri, 10 Jul 2026 20:22:42 +0000 commit 7d48ef45b6df0cf8985b84305e02b7440de8f50f Author: Andrew Cooper AuthorDate: Mon Mar 24 23:25:59 2025 +0000 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 2c13356c4d..57f6baffb0 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -780,12 +780,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:22:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:22:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359878.1613263 (Exim 4.92) (envelope-from ) id 1wiHkM-0004yw-Ps; Fri, 10 Jul 2026 20:22:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359878.1613263; Fri, 10 Jul 2026 20:22:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkM-0004ym-N4; Fri, 10 Jul 2026 20:22:54 +0000 Received: by outflank-mailman (input) for mailman id 1359878; Fri, 10 Jul 2026 20:22:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkL-0004yg-3f for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHkL-00H4Qm-1A for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHkL-00DUZU-04 for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:22:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FuqxiKUGWAio//oqPlMESQKrvzmr01OjSc4PcZu5c9A=; b=6hJOe4j9ECJd2fm9qHGGTCqpAo kQVvPzpziysJehGXAwEbqRH1+gHeOpuoBN931w4vSGOL2kSPFeDHF4497EOReGc6CeE97M5YWxYvj /oN2i9eurHM9zkwkYvUf8e0+8Y4X+d9QmJkZ7TDi2Q2+LYISbNGGBM/VAeVceMLdOGsw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/ctrl: Allow writev_exact() to change the iov array Message-Id: Date: Fri, 10 Jul 2026 20:22:53 +0000 commit 85bdb67eaa5354cbc19b5e1c2f5f3d0f1984dd5c Author: Frediano Ziglio AuthorDate: Thu Jul 9 08:43:53 2026 +0100 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 libs/ctrl: Allow writev_exact() to change the iov array Avoid having to allocate and copy the array if a partial write happens. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper --- tools/libs/ctrl/xc_private.c | 70 ++++++++++---------------------------------- tools/libs/ctrl/xc_private.h | 3 +- 2 files changed, 18 insertions(+), 55 deletions(-) diff --git a/tools/libs/ctrl/xc_private.c b/tools/libs/ctrl/xc_private.c index bb0f81d6f3..5398a7c626 100644 --- a/tools/libs/ctrl/xc_private.c +++ b/tools/libs/ctrl/xc_private.c @@ -635,7 +635,7 @@ int write_exact(int fd, const void *data, size_t size) /* * MiniOS's libc doesn't know about writev(). Implement it as multiple write()s. */ -int writev_exact(int fd, const struct iovec *iov, int iovcnt) +int writev_exact(int fd, struct iovec *iov, int iovcnt) { int rc, i; @@ -649,71 +649,33 @@ int writev_exact(int fd, const struct iovec *iov, int iovcnt) return 0; } #else -int writev_exact(int fd, const struct iovec *iov, int iovcnt) +int writev_exact(int fd, struct iovec *iov, int iovcnt) { - struct iovec *local_iov = NULL; - int rc = 0, iov_idx = 0, saved_errno = 0; - ssize_t len; + int iov_idx = 0; + ssize_t len = 0; while ( iov_idx < iovcnt ) { - /* - * Skip over iov[] entries with 0 length. - * - * This is needed to cover the case where we took a partial write and - * all remaining vectors are of 0 length. In such a case, the results - * from writev() are indistinguishable from EOF. - */ - while ( iov[iov_idx].iov_len == 0 ) - if ( ++iov_idx == iovcnt ) - goto out; + /* Check iov[] to see whether we had a partial or complete write. */ + if ( len >= iov[iov_idx].iov_len ) + { + len -= iov[iov_idx++].iov_len; + continue; + } + + /* Partial write of iov[iov_idx]. */ + iov[iov_idx].iov_base += len; + iov[iov_idx].iov_len -= len; len = writev(fd, &iov[iov_idx], min(iovcnt - iov_idx, IOV_MAX)); - saved_errno = errno; if ( (len == -1) && (errno == EINTR) ) continue; if ( len <= 0 ) - { - rc = -1; - goto out; - } - - /* Check iov[] to see whether we had a partial or complete write. */ - while ( (len > 0) && (iov_idx < iovcnt) ) - { - if ( len >= iov[iov_idx].iov_len ) - len -= iov[iov_idx++].iov_len; - else - { - /* Partial write of iov[iov_idx]. Copy iov so we can adjust - * element iov_idx and resubmit the rest. */ - if ( !local_iov ) - { - local_iov = malloc(iovcnt * sizeof(*iov)); - if ( !local_iov ) - { - saved_errno = ENOMEM; - rc = -1; - goto out; - } - - iov = memcpy(local_iov, iov, iovcnt * sizeof(*iov)); - } - - local_iov[iov_idx].iov_base += len; - local_iov[iov_idx].iov_len -= len; - break; - } - } + return -1; } - saved_errno = 0; - - out: - free(local_iov); - errno = saved_errno; - return rc; + return 0; } #endif diff --git a/tools/libs/ctrl/xc_private.h b/tools/libs/ctrl/xc_private.h index b5892ae8dc..8a325c17b0 100644 --- a/tools/libs/ctrl/xc_private.h +++ b/tools/libs/ctrl/xc_private.h @@ -383,7 +383,8 @@ int xc_flush_mmu_updates(xc_interface *xch, struct xc_mmu *mmu); /* Return 0 on success; -1 on error setting errno. */ int read_exact(int fd, void *data, size_t size); /* EOF => -1, errno=0 */ int write_exact(int fd, const void *data, size_t size); -int writev_exact(int fd, const struct iovec *iov, int iovcnt); +/* May alter @iov to cope with partial writes. */ +int writev_exact(int fd, struct iovec *iov, int iovcnt); int xc_ffs8(uint8_t x); int xc_ffs16(uint16_t x); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:23:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:23:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359879.1613267 (Exim 4.92) (envelope-from ) id 1wiHkW-00051I-SA; Fri, 10 Jul 2026 20:23:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359879.1613267; Fri, 10 Jul 2026 20:23:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkW-00051A-Pe; Fri, 10 Jul 2026 20:23:04 +0000 Received: by outflank-mailman (input) for mailman id 1359879; Fri, 10 Jul 2026 20:23:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkV-000513-8N for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHkV-00H4RF-1d for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHkV-00DV2C-0Y for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CcDgJ3IJFsE/C1KZozZXa4tu2i00Mr8PSQeOlXhd0yY=; b=xbSHYK1zYCFauumNSPPtTpvExc lgxMvGTxONwmF07V8KJum77pFNISjO09KX/shXL0r8js03Q9E2jv/rYkc8IxK3X55Bi0+jkJvC0wY rjhpS7/S4Z102rfbVuNY347sK2p0Pnr1zGwK22b7yhp/h/ySHXlYnKQ3Y4hhys/ZDFYo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libs/guest: Drop guest_data in write_batch() and fill iov directly Message-Id: Date: Fri, 10 Jul 2026 20:23:03 +0000 commit fdeba9d55fe49a49ff11afafe283dcb6612521ec Author: Frediano Ziglio AuthorDate: Thu Jul 9 08:43:54 2026 +0100 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 libs/guest: Drop guest_data in write_batch() and fill iov directly There is no need to store the page pointers simply to transcribe the same information into iov later. Drop the guest_data intermediate array. These days, linux has a maximum limit of 1024 iovs. Libc under the hood will subdivide the submission if necessary, which is why our general case of 1026 submissions works. xenforeignmemory_map() maps the requested guest memory contiguously, and except for PV pagetable frames, we submit contiguously into the stream. When safe to do, merge adjacent vectors by extending iov_len, reducing the likelihood that libc needs to subdivide the submission. Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper --- tools/libs/guest/xg_sr_save.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-) diff --git a/tools/libs/guest/xg_sr_save.c b/tools/libs/guest/xg_sr_save.c index a6734579aa..84fdbe4140 100644 --- a/tools/libs/guest/xg_sr_save.c +++ b/tools/libs/guest/xg_sr_save.c @@ -88,7 +88,6 @@ static int write_batch(struct xc_sr_context *ctx) xc_interface *xch = ctx->xch; xen_pfn_t *mfns = NULL, *types = NULL; void *guest_mapping = NULL; - void **guest_data = NULL; void **local_pages = NULL; int *errors = NULL, rc = -1; unsigned int i, p, nr_pages = 0, nr_pages_mapped = 0; @@ -118,8 +117,6 @@ static int write_batch(struct xc_sr_context *ctx) types = malloc(nr_pfns * sizeof(*types)); /* Errors from attempting to map the gfns. */ errors = malloc(nr_pfns * sizeof(*errors)); - /* Pointers to page data to send. Mapped gfns or local allocations. */ - guest_data = calloc(nr_pfns, sizeof(*guest_data)); /* Pointers to locally allocated pages. Need freeing. */ local_pages = calloc(nr_pfns, sizeof(*local_pages)); /* iovec[] for writev(). */ @@ -127,7 +124,7 @@ static int write_batch(struct xc_sr_context *ctx) /* page_data record PFNs list */ rec_pfns = malloc(nr_pfns * sizeof(*rec_pfns)); - if ( !mfns || !types || !errors || !guest_data || !local_pages || !iov || !rec_pfns ) + if ( !mfns || !types || !errors || !local_pages || !iov || !rec_pfns ) { ERROR("Unable to allocate arrays for a batch of %u pages", nr_pfns); @@ -218,8 +215,17 @@ static int write_batch(struct xc_sr_context *ctx) else goto err; } + else if ( iov[iovcnt - 1].iov_base + iov[iovcnt - 1].iov_len != + page ) + { + iov[iovcnt].iov_base = page; + iov[iovcnt].iov_len = PAGE_SIZE; + iovcnt++; + } else - guest_data[i] = page; + { + iov[iovcnt - 1].iov_len += PAGE_SIZE; + } rc = -1; ++p; @@ -231,28 +237,12 @@ static int write_batch(struct xc_sr_context *ctx) for ( i = 0; i < nr_pfns; ++i ) rec_pfns[i] = ((uint64_t)(types[i]) << 32) | ctx->save.batch_pfns[i]; - if ( nr_pages ) - { - for ( i = 0; i < nr_pfns; ++i ) - { - if ( guest_data[i] ) - { - iov[iovcnt].iov_base = guest_data[i]; - iov[iovcnt].iov_len = PAGE_SIZE; - iovcnt++; - --nr_pages; - } - } - } - if ( writev_exact(ctx->fd, iov, iovcnt) ) { PERROR("Failed to write page data to stream"); goto err; } - /* Sanity check we have sent all the pages we expected to. */ - assert(nr_pages == 0); rc = ctx->save.nr_batch_pfns = 0; err: @@ -263,7 +253,6 @@ static int write_batch(struct xc_sr_context *ctx) free(rec_pfns); free(iov); free(local_pages); - free(guest_data); free(errors); free(types); free(mfns); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:23:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:23:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359880.1613271 (Exim 4.92) (envelope-from ) id 1wiHkg-00053D-Ta; Fri, 10 Jul 2026 20:23:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359880.1613271; Fri, 10 Jul 2026 20:23:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkg-000535-Qx; Fri, 10 Jul 2026 20:23:14 +0000 Received: by outflank-mailman (input) for mailman id 1359880; Fri, 10 Jul 2026 20:23:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkf-00052y-BF for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHkf-00H4RJ-1v for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHkf-00DVV6-0w for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=L20rkFcotLa5uIuFZWPUpfnhJa+auTxKZ1akGHcLXnc=; b=MGpdukpvm7k/l40SnRtzFTDgzi tFyBYpKApCm2K+U+CtlSrVfy04mipb1jLzAxZGZ9Xat+iyBrbFfQYDT9FwYmwtpWiSOY9JubI9xIK 36zcahk8ccXLJ6fYI8yzdey792y/DgRNc9P0rYlSI5aLhRtY+LfYTN+IKkXP7M5CSiic=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] CI: Add the new Panther Lake runner Message-Id: Date: Fri, 10 Jul 2026 20:23:13 +0000 commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 20db71b1c9..7cc5214630 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -170,6 +170,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86_64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86_64: # it's really similar to the above extends: .adl-x86_64 @@ -405,6 +416,76 @@ kbl-tools-tests-pvh-x86_64-gcc-debug: - *x86_64-test-needs - alpine-3.24-x86_64-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + zen2-smoke-x86_64-gcc-debug: extends: .zen2-x86_64 script: -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 10 20:23:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 10 Jul 2026 20:23:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359881.1613275 (Exim 4.92) (envelope-from ) id 1wiHkq-000552-Us; Fri, 10 Jul 2026 20:23:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359881.1613275; Fri, 10 Jul 2026 20:23:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkq-00054u-SH; Fri, 10 Jul 2026 20:23:24 +0000 Received: by outflank-mailman (input) for mailman id 1359881; Fri, 10 Jul 2026 20:23:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHkp-00054n-Jx for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHkp-00H4RP-2n for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wiHkp-00DW1a-1e for xen-changelog@lists.xenproject.org; Fri, 10 Jul 2026 20:23:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NjHrt3/KTEdP+QQa9vv4rn3X8wQz6FMXKccJmaGVUvg=; b=tWFpcNh8pUa23yQmkYV7ajNe1K uBEl0nwQ3Dz4nMyWH5CeSinoqeLCbJNLhxLz+BY+smPF6NxZOubYJPkMwILtLaUxM2jvpSg98Rc2S 8n2ZUtE4lV1phV2KLHcW/mMZslTWm0BE93yonxmRXKvILaY70leLYoY26lwiLL9fQMa8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] CI: Enable FRED on the PTL runner Message-Id: Date: Fri, 10 Jul 2026 20:23:23 +0000 commit d9e36605ff1d6888d3934f7c7452da781aee37d7 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:05 2026 +0200 Commit: Andrew Cooper CommitDate: Fri Jul 10 19:35:49 2026 +0100 CI: Enable FRED on the PTL runner Add new job-level EXTRA_XEN_OPTS variable, in addition to CONSOLE_OPTS. FRED is not yet enabled by default on Intel systems, but is expected to function. Explicitly turn it on for added test coverage in the short term. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper --- automation/gitlab-ci/test.yaml | 1 + automation/scripts/qubes-x86_64.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 7cc5214630..61adc1baff 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -177,6 +177,7 @@ PCIDEV: "56:00.0" PCIDEV_INTR: "MSI-X" CONSOLE_OPTS: "console=com1 com1=115200,8n1" + EXTRA_XEN_OPTS: "fred" SUT_ADDR: test-22.testnet tags: - qubes-hw22 diff --git a/automation/scripts/qubes-x86_64.sh b/automation/scripts/qubes-x86_64.sh index 7a59fa5f11..065f03931b 100755 --- a/automation/scripts/qubes-x86_64.sh +++ b/automation/scripts/qubes-x86_64.sh @@ -260,14 +260,14 @@ TFTP=/scratch/gitlab-runner/tftp CONTROLLER=control@thor.testnet echo " -multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts +multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts module2 (http)/gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen module2 --nounzip (http)/gitlab-ci/initrd-dom0 " > $TFTP/grub.cfg echo "#!ipxe -kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts || reboot +kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts || reboot module /gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen || reboot module /gitlab-ci/initrd-dom0 || reboot boot -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 13 07:11:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 13 Jul 2026 07:11:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1361438.1613667 (Exim 4.92) (envelope-from ) id 1wjAoh-0007ml-Ev; Mon, 13 Jul 2026 07:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1361438.1613667; Mon, 13 Jul 2026 07:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjAoh-0007mc-CF; Mon, 13 Jul 2026 07:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1361438; Mon, 13 Jul 2026 07:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjAog-0007mU-4p for xen-changelog@lists.xenproject.org; Mon, 13 Jul 2026 07:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjAog-004DvM-0n for xen-changelog@lists.xenproject.org; Mon, 13 Jul 2026 07:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjAof-00FbAs-2z for xen-changelog@lists.xenproject.org; Mon, 13 Jul 2026 07:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7QTgA1rlkWskWyyq01yuYKb8ZBI9zW/RL1BZDs31dE0=; b=pGacxURMyJHSqnBgtGR/oJTODK G7WsO8aOzNvSLJdSKhga5o06QKETmqYJnbWUpgJJJeckefzHy/CoA4bPEslYadedWz997BR1E0Myv qzH1rV65AuzEHarahRmTjCptGCdtc82vom8Et1wG9D5W6H4wK0hVTlbDG+LDv8gOA93M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Mon, 13 Jul 2026 07:11:01 +0000 commit e3aa330017c533cc312ee4751b8387d988682efc Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Mon Jul 13 09:01:26 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 550617f152..72d5316180 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 11:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 11:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362217.1614114 (Exim 4.92) (envelope-from ) id 1wjbYQ-0000ZT-Af; Tue, 14 Jul 2026 11:44:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362217.1614114; Tue, 14 Jul 2026 11:44:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjbYQ-0000ZK-87; Tue, 14 Jul 2026 11:44:02 +0000 Received: by outflank-mailman (input) for mailman id 1362217; Tue, 14 Jul 2026 11:44:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjbYP-0000ZE-Lc for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 11:44:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjbYP-005ysf-2F for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 11:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjbYP-001ZJu-19 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 11:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=EkepQp4+kTON7jnGAWW5HyxBmkh3GKQjPuOWMnBqjB8=; b=op+ijzgzv2im6u32xHiXyzjGBt umgu+RvipeB7gcdgo1SYS4mA7I0//gUuh5GJrB6vWTcFnEMfgZxCbZTTQF7tMPwx9TWgLLtWeZiHc +valpsQBkKqIIUa95AKehh3tX5W4+6djyQ7rc/owRsSwYcKl+INIUnRceToT4j2iG14U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Tue, 14 Jul 2026 11:44:01 +0000 commit e3aa330017c533cc312ee4751b8387d988682efc Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Mon Jul 13 09:01:26 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 550617f152..72d5316180 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 12:33:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 12:33:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362354.1614176 (Exim 4.92) (envelope-from ) id 1wjcJr-0001JL-AT; Tue, 14 Jul 2026 12:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362354.1614176; Tue, 14 Jul 2026 12:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcJr-0001JD-7v; Tue, 14 Jul 2026 12:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1362354; Tue, 14 Jul 2026 12:33:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcJp-0001J7-TD for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjcJq-005zpA-0M for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjcJp-001udv-2W for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zfUHw5f8QQuyXJPpjMJP1tTludwYctUoC9HMVSCiTKM=; b=vg2Mhl7iOkOHPGNpk0XpV25fB+ r6agiuNOL+4AACcM24JeIVbW07HeraEmj89OUvU6g6ftIVaYbzMbsgIu+6vl4IPE32xWialPvv4kK Ld9WIsnvZTLoxJ5LWrUpfQzPBYDeiKJHLqq91qegTg0vP/fTlbtsNf49JD2N+XXlo404=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 12:33:01 +0000 commit 7b98d94e759b5ec54c7380d63287119b3712785d Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:01:46 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 12:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 12:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362355.1614180 (Exim 4.92) (envelope-from ) id 1wjcK1-0001L9-Bv; Tue, 14 Jul 2026 12:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362355.1614180; Tue, 14 Jul 2026 12:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcK1-0001L2-9K; Tue, 14 Jul 2026 12:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1362355; Tue, 14 Jul 2026 12:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcJz-0001Kw-Vz for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjcK0-005zpZ-0i for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjcJz-001uhr-2s for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=YraIen8molSfXXh+LRo3qo9hK56MIZG8bgn0ST4Hoc4=; b=1eEjP9MpfpGhFpRggJLLRp8SsK wx6+YOTxWnf+c/8X3dG343UY1E9/vZvSusI8zR0jXtMaI2vhdha+SWC0bqKZBF+63ZrjKP+GmZdRF BQbVbP48yKj2hHTrK3Y3i7Ic2Z5re8raWTfN/NfgkECL4l9LLsr7b0V2vbPrXE5aoGw4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Tue, 14 Jul 2026 12:33:11 +0000 commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:02:50 2026 +0100 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index eacfd93087..9513c1c837 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 12:33:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 12:33:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362356.1614184 (Exim 4.92) (envelope-from ) id 1wjcKB-0001NB-DO; Tue, 14 Jul 2026 12:33:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362356.1614184; Tue, 14 Jul 2026 12:33:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcKB-0001N3-Ar; Tue, 14 Jul 2026 12:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1362356; Tue, 14 Jul 2026 12:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjcKA-0001Mw-1w for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjcKA-005zpj-0z for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjcK9-001uli-3D for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 12:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HSWe5e0iFQWAwiitN+Ewo8oSXoTlfLe6u2J0Qirlv24=; b=xdMZiAKHJYD93+A8M9OOpNuNir ZTNVPZBm4NeL9V+ACFuDak7qnzV1Fz9bP9BzzqBLFz4QicdnHcZlqVADZottYWceOJN7trT+BcmgT +dMZ4bu48GmYhclBFsZgsFeTbaPT5z9iIeno3pwffsJ2L7HOlBnL5cHQWeAXe8/SCc54=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] arm/vgic-v3: Fix data abort in get_vcpu_from_rdist() Message-Id: Date: Tue, 14 Jul 2026 12:33:21 +0000 commit 7ad6cfa66fbd8d5e5569b65d2c8085ecc5e672f1 Author: Andrew Cooper AuthorDate: Wed Jul 8 13:12:52 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:10:44 2026 +0100 arm/vgic-v3: Fix data abort in get_vcpu_from_rdist() Just because vcpu_id is within d->max_vcpus doesn't mean d->vcpu[vcpu_id] is non-NULL. Use the proper accessor to look up a vcpu object. Reported-by: Michal Orzel Fixes: acf65e5a25a7 ("xen/arm: vgic-v3: Emulate correctly the re-distributor") Signed-off-by: Andrew Cooper Reviewed-by: Julien Grall --- xen/arch/arm/vgic-v3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index c1c4d6f71e..c01cc596d5 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1111,10 +1111,10 @@ static struct vcpu *get_vcpu_from_rdist(struct domain *d, unsigned int vcpu_id; vcpu_id = region->first_cpu + ((gpa - region->base) / GICV3_GICR_SIZE); - if ( unlikely(vcpu_id >= d->max_vcpus) ) - return NULL; - v = d->vcpu[vcpu_id]; + v = domain_vcpu(d, vcpu_id); + if ( !v ) + return NULL; *offset = gpa - v->arch.vgic.rdist_base; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 13:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 13:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362388.1614205 (Exim 4.92) (envelope-from ) id 1wjd5R-0008DO-8X; Tue, 14 Jul 2026 13:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362388.1614205; Tue, 14 Jul 2026 13:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5R-0008DG-5v; Tue, 14 Jul 2026 13:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1362388; Tue, 14 Jul 2026 13:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5Q-0008D8-0i for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjd5Q-0060oI-0g for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjd5P-002fia-2j for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=2Rx5kCVZqjz6OIJGWldBQx4L7SFn04dunooL/KdmSYg=; b=5HlF4rsMFSfXnYj1d+Yjm4sLO9 FyqFwDo8ZWI5EkrZ4DCaFIRbNNiuU/LWpWnONYQggfZ8yR2VDGFbfT+VoBK+Taik9+cczq+hPK4TA no13PfrbNCJMdeSvSxBWouD1CmlCaMuByel3H9Xxt7GRRcyh9QGVeL+QfZfG/KWOlvqo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Tue, 14 Jul 2026 13:22:11 +0000 commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:02:50 2026 +0100 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index eacfd93087..9513c1c837 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 13:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 13:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362387.1614202 (Exim 4.92) (envelope-from ) id 1wjd5G-0008Bq-7A; Tue, 14 Jul 2026 13:22:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362387.1614202; Tue, 14 Jul 2026 13:22:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5G-0008Bi-4T; Tue, 14 Jul 2026 13:22:02 +0000 Received: by outflank-mailman (input) for mailman id 1362387; Tue, 14 Jul 2026 13:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5F-0008Bc-S6 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjd5G-0060nw-0D for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjd5F-002fYs-29 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xBK5HojPt8MFzhyisRl7d16eL8TsT01nmvskKiQzrtM=; b=cSo8CcYNpdBf3HftZNUATRCVnK vgnmG/m+7gXCvpiWDvWbpWyB0I0qk7jAJXIY7KOoL01LixOwiLlvqeRb8/NO5NuttYhT8VL0YB6CR aO7dP8KyAYCFVQE71JIAR14Xeq7fJHgMrX6nhZ+RM1bRJQmtOWEL21traKWcOuLW7Wjc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 13:22:01 +0000 commit 7b98d94e759b5ec54c7380d63287119b3712785d Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:01:46 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 13:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 13:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362389.1614209 (Exim 4.92) (envelope-from ) id 1wjd5b-0008Fg-9k; Tue, 14 Jul 2026 13:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362389.1614209; Tue, 14 Jul 2026 13:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5b-0008FY-7H; Tue, 14 Jul 2026 13:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1362389; Tue, 14 Jul 2026 13:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjd5a-0008FS-1o for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjd5a-0060oM-0y for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjd5Z-002fqO-3C for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 13:22:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ZAmdqQzocXPHfVFrKGPF+U68RywXx/j0IOcL6AkBn0Q=; b=4kvkaP9SQ6rHICBuc0kQ8cj3KQ Lx0F5nE6ePwA/MtdivoY3cB3Zz/ThXDRzuTkqdQpBv7xJAI3d0CTF/NBtjsY2FZUails8Gb2M1cIz U6sfAxvu6FTNjZ/lLTtENyz+1zByVmFJkn3uP5t3mvQOZlS7uVOvcsnWhdCqahYsjsag=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] arm/vgic-v3: Fix data abort in get_vcpu_from_rdist() Message-Id: Date: Tue, 14 Jul 2026 13:22:21 +0000 commit 7ad6cfa66fbd8d5e5569b65d2c8085ecc5e672f1 Author: Andrew Cooper AuthorDate: Wed Jul 8 13:12:52 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 12:10:44 2026 +0100 arm/vgic-v3: Fix data abort in get_vcpu_from_rdist() Just because vcpu_id is within d->max_vcpus doesn't mean d->vcpu[vcpu_id] is non-NULL. Use the proper accessor to look up a vcpu object. Reported-by: Michal Orzel Fixes: acf65e5a25a7 ("xen/arm: vgic-v3: Emulate correctly the re-distributor") Signed-off-by: Andrew Cooper Reviewed-by: Julien Grall --- xen/arch/arm/vgic-v3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index c1c4d6f71e..c01cc596d5 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1111,10 +1111,10 @@ static struct vcpu *get_vcpu_from_rdist(struct domain *d, unsigned int vcpu_id; vcpu_id = region->first_cpu + ((gpa - region->base) / GICV3_GICR_SIZE); - if ( unlikely(vcpu_id >= d->max_vcpus) ) - return NULL; - v = d->vcpu[vcpu_id]; + v = domain_vcpu(d, vcpu_id); + if ( !v ) + return NULL; *offset = gpa - v->arch.vgic.rdist_base; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:44:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:44:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362447.1614253 (Exim 4.92) (envelope-from ) id 1wjgEk-00016v-PX; Tue, 14 Jul 2026 16:44:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362447.1614253; Tue, 14 Jul 2026 16:44:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgEk-00016m-MZ; Tue, 14 Jul 2026 16:44:02 +0000 Received: by outflank-mailman (input) for mailman id 1362447; Tue, 14 Jul 2026 16:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgEk-00016g-3n for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgEk-0065Fc-0o for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgEj-007QJ5-2z for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7wgUd6/nWo2SyvgW11ULS+NLS04yyBbqr3pgl3t9b+A=; b=JUdsI9e+QPgeH8/4wQnGRDFHkL 6Kwv5NHs3lv4dF5oXaS303bpK5hKyV5HNL7xJOxR3yMhVHiiIWDCMvAsUyqXoEXgSg+ZSUFKOdoIP yj+nkAHbOTon5t2YY1lePFAwEbWcu6tAEE/7uNyJYwsTZzMTeONMbXudO0UbXrhifOBU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Tue, 14 Jul 2026 16:44:01 +0000 commit 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 Author: Andrew Cooper AuthorDate: Mon Jul 6 22:49:25 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:31:08 2026 +0100 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 3f2e9dedcd..5378299b8c 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -53,7 +53,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -88,9 +88,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362448.1614257 (Exim 4.92) (envelope-from ) id 1wjgPO-0002IC-Im; Tue, 14 Jul 2026 16:55:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362448.1614257; Tue, 14 Jul 2026 16:55:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPO-0002I4-G7; Tue, 14 Jul 2026 16:55:02 +0000 Received: by outflank-mailman (input) for mailman id 1362448; Tue, 14 Jul 2026 16:55:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPN-0002Hy-Qx for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgPO-0065SG-09 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgPN-007o69-2I for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mwzRGd7faq2spGlKKGn404dkk7emAze3tMj7rY1gtVI=; b=O/MOeTn6AHuPqOiRxwypcaCmzd pxlixWwzN3QII916n4NvQm+Uf+l35Vj5mmJWpc3XB5cIXE1KEK3dwTd/3ae6Cut5gtRans8Tgqkeh JislESDq5qy7i/vhPf+0UmE7/GyAgvOmlizVkacgbLJOQiq22JeWs9YM6/ct1j2Nv/cY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] CI: Add the new Panther Lake runner Message-Id: Date: Tue, 14 Jul 2026 16:55:01 +0000 commit 6286a896f4664ff874bebc133804c0554ece6191 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 20db71b1c9..7cc5214630 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -170,6 +170,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86_64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86_64: # it's really similar to the above extends: .adl-x86_64 @@ -405,6 +416,76 @@ kbl-tools-tests-pvh-x86_64-gcc-debug: - *x86_64-test-needs - alpine-3.24-x86_64-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + zen2-smoke-x86_64-gcc-debug: extends: .zen2-x86_64 script: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362449.1614261 (Exim 4.92) (envelope-from ) id 1wjgPZ-0002K2-KC; Tue, 14 Jul 2026 16:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362449.1614261; Tue, 14 Jul 2026 16:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPZ-0002Ju-Hc; Tue, 14 Jul 2026 16:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1362449; Tue, 14 Jul 2026 16:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPX-0002Jm-VY for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgPY-0065Tb-0i for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgPX-007oJp-2i for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qaKw0Zr2445Okk3NvA7K2xEaO1qV+Qdi0uBx9oppO0U=; b=ryrYdk5eqr6+yPEkr2eGBT7ncI 01j/pm8XIA2fCaoEVN/QnaBiTYYPihRLx741qb50lOpeAPRkuJSf6/wXtgH8/BSrnl7TxxVA5Iaou 8mEmpJG107q9fziYDr6qQdwVAD0EiCzMyAkJ0ATVTn5lYpU8vUEwga0YXhReRIFtNKWM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] CI: Enable FRED on the PTL runner Message-Id: Date: Tue, 14 Jul 2026 16:55:11 +0000 commit e6c6da39bcff0c96dc0713a021b8efcfab71c52d Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:05 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 CI: Enable FRED on the PTL runner Add new job-level EXTRA_XEN_OPTS variable, in addition to CONSOLE_OPTS. FRED is not yet enabled by default on Intel systems, but is expected to function. Explicitly turn it on for added test coverage in the short term. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit d9e36605ff1d6888d3934f7c7452da781aee37d7) --- automation/gitlab-ci/test.yaml | 1 + automation/scripts/qubes-x86_64.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 7cc5214630..61adc1baff 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -177,6 +177,7 @@ PCIDEV: "56:00.0" PCIDEV_INTR: "MSI-X" CONSOLE_OPTS: "console=com1 com1=115200,8n1" + EXTRA_XEN_OPTS: "fred" SUT_ADDR: test-22.testnet tags: - qubes-hw22 diff --git a/automation/scripts/qubes-x86_64.sh b/automation/scripts/qubes-x86_64.sh index 7a59fa5f11..065f03931b 100755 --- a/automation/scripts/qubes-x86_64.sh +++ b/automation/scripts/qubes-x86_64.sh @@ -260,14 +260,14 @@ TFTP=/scratch/gitlab-runner/tftp CONTROLLER=control@thor.testnet echo " -multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts +multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts module2 (http)/gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen module2 --nounzip (http)/gitlab-ci/initrd-dom0 " > $TFTP/grub.cfg echo "#!ipxe -kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts || reboot +kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts || reboot module /gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen || reboot module /gitlab-ci/initrd-dom0 || reboot boot -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362450.1614264 (Exim 4.92) (envelope-from ) id 1wjgPj-0002Lv-Lo; Tue, 14 Jul 2026 16:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362450.1614264; Tue, 14 Jul 2026 16:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPj-0002Ln-Iy; Tue, 14 Jul 2026 16:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1362450; Tue, 14 Jul 2026 16:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPi-0002Lg-3I for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgPi-0065VM-14 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgPi-007onw-04 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PGkrFFH49c4xvk7Cfs2jqA/Anwm/xw7fiF/mUh1WYzY=; b=ZOnqFoLIyqVrHm7jt7vQ6c2+oj wdBY1EW42lAZI0ZNJNsmS/JAn6feZRXg4pKswjikZFBL7WPy/kOT9UyJT9W0i/pNKxPpkIS8YY+if ujJUWKUzjf28ShsotJ3HCozkQ277JQUaEzpGl1r2ge+AkY9pRo5/FCDZ5aGCxnmwFs4s=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Tue, 14 Jul 2026 16:55:22 +0000 commit 88301b2e61ed0fc781975c835c508c581d560324 Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 550617f152..72d5316180 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362451.1614268 (Exim 4.92) (envelope-from ) id 1wjgPt-0002No-My; Tue, 14 Jul 2026 16:55:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362451.1614268; Tue, 14 Jul 2026 16:55:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPt-0002Ng-KM; Tue, 14 Jul 2026 16:55:33 +0000 Received: by outflank-mailman (input) for mailman id 1362451; Tue, 14 Jul 2026 16:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgPs-0002Na-9O for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgPs-0065VS-1h for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgPs-007oxs-0L for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=k0x16RQfTirk7hNTRUnGy35/QJlceuAsDDZ9ovPsOnw=; b=E4cQX6RGSxX7dG6bR1DqwgTXyE nAq6hyXIw+JBx5+oZahR5rmZpGiskaN2PgwbN7EAGv6XrRQleeBfN0CZxNYKTcWqLgWpFTQ/+1x4n 6enD87HmGj5DD0R/uihR1ry//7oxK1bCTZ9sMyFrQlHaT/cUmlIwAA9wC8wUPN3bRKQM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 16:55:32 +0000 commit fb83c2354b32c8a5f41cd87359b78cd4cabcca37 Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362452.1614273 (Exim 4.92) (envelope-from ) id 1wjgQ3-0002Px-OY; Tue, 14 Jul 2026 16:55:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362452.1614273; Tue, 14 Jul 2026 16:55:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQ3-0002Pp-Lj; Tue, 14 Jul 2026 16:55:43 +0000 Received: by outflank-mailman (input) for mailman id 1362452; Tue, 14 Jul 2026 16:55:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQ2-0002Pj-CE for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgQ2-0065VZ-20 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgQ2-007p7i-0y for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3Ibngk6FHQCGjtKzdMahhYK0B304042xamMe/PVr65s=; b=azNrv5ve1HmiXmPacbV/Vbm83o ZAJNw5X7xGgGPpU34lIf8n1caVCi3DLggTYDKiiJ1bXOeGk+5RR6G/CmsG483cGhpaqSgRje+ovKR VzRLOsxwMmMKH6tlE6hpWcH0fCFNuUdVGtUAXRehChoyIgkUK2mVPt9yRaxzQCmINdV0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Tue, 14 Jul 2026 16:55:42 +0000 commit c3ce09cd90a18190042fb5fd83b3772ac3e4bfd8 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index eacfd93087..9513c1c837 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:55:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:55:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362453.1614278 (Exim 4.92) (envelope-from ) id 1wjgQD-0002Ru-QD; Tue, 14 Jul 2026 16:55:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362453.1614278; Tue, 14 Jul 2026 16:55:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQD-0002Rl-NC; Tue, 14 Jul 2026 16:55:53 +0000 Received: by outflank-mailman (input) for mailman id 1362453; Tue, 14 Jul 2026 16:55:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQC-0002Rd-Fe for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgQC-0065Vd-2M for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgQC-007pSa-1I for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:55:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FrRFXzRcHOCK/eBnnX9nh1FiVd0tNfvb81udmteO3us=; b=tElPi0To9kdTJfnCrI8W0trnkk PgfPt0nxkFOnGKxpwkbADI/Mr7BTXT+Ut0GK0A9x58vaPhaRFKwplrujvaaiq0t//mJknjYQNeJvB +SNCrzQRTgY6XrXES09I2mYvdv1PjUGjZRxp6VpU4Fpot5mHMXr9CxUYPwTyv2t76elU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Tue, 14 Jul 2026 16:55:52 +0000 commit 6959caf0fb711e3e5674de9375f5ac8249242ee9 Author: Andrew Cooper AuthorDate: Mon Jul 6 22:49:25 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:40:12 2026 +0100 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Release-Acked-by: Oleksii Kurochko (cherry picked from commit 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58) --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 3f2e9dedcd..5378299b8c 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -53,7 +53,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -88,9 +88,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 16:56:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 16:56:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362455.1614280 (Exim 4.92) (envelope-from ) id 1wjgQN-0002Tx-RA; Tue, 14 Jul 2026 16:56:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362455.1614280; Tue, 14 Jul 2026 16:56:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQN-0002Tp-OT; Tue, 14 Jul 2026 16:56:03 +0000 Received: by outflank-mailman (input) for mailman id 1362455; Tue, 14 Jul 2026 16:56:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjgQM-0002Ti-IP for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:56:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjgQM-0065Vu-2d for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:56:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjgQM-007plk-1e for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 16:56:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=E0k3aQTfhPhy7SZDMURBztdMsrD7Ks1JqHcNz6+YHRM=; b=ZbIsZbFN7CgODhUmRCh10slD60 ayZjMpKavXhAftk14ttAFGWgqekyhdzkgL9X1HIXnxmsMlpyeLdeWNYsqhmaGaPkmI18PE8BoH9Vo x0PzKeu2yqKUHCgZK3vGVxlUWylXmrhGQMb/fzimUNQsalRdxpVZKIMIEhYoKyk3ZyMI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] Update Xen version to 4.22.0-rc4 Message-Id: Date: Tue, 14 Jul 2026 16:56:02 +0000 commit 01cccf5a3e03efbec6423b2ea6b3c6d3dd2ea1a4 Author: Andrew Cooper AuthorDate: Tue Jul 14 17:44:02 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:44:02 2026 +0100 Update Xen version to 4.22.0-rc4 Signed-off-by: Andrew Cooper --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 483901fb2f..8d4cfb737a 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 22 -export XEN_EXTRAVERSION ?= .0-rc3$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .0-rc4$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:22:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:22:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362483.1614303 (Exim 4.92) (envelope-from ) id 1wjhla-0005ff-W0; Tue, 14 Jul 2026 18:22:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362483.1614303; Tue, 14 Jul 2026 18:22:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhla-0005fW-T6; Tue, 14 Jul 2026 18:22:02 +0000 Received: by outflank-mailman (input) for mailman id 1362483; Tue, 14 Jul 2026 18:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhla-0005fQ-5P for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhla-0067DN-16 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhla-00A4dw-01 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=57fznh/yeYb8WaTakq/5/s6HzioJo+Zf6xL1eQF7Ibs=; b=u7mgFOCYv92defWc1ECLOolo2v oi1YNBGs90jOFObLNC5ao28J6nySj6iciW56MsPGUCBqV3x50yKgjhRLngQOk0VRaoPDjo8zR6cU4 dB+mJi2eI+zcEYpOz6Y/uQpnp4/fGKmtPMmzIMOGURlMNyqAAlG/58GgcSu5G+Pueekw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Tue, 14 Jul 2026 18:22:02 +0000 commit 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 Author: Andrew Cooper AuthorDate: Mon Jul 6 22:49:25 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:31:08 2026 +0100 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 3f2e9dedcd..5378299b8c 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -53,7 +53,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -88,9 +88,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362488.1614307 (Exim 4.92) (envelope-from ) id 1wjhwE-0006rm-O9; Tue, 14 Jul 2026 18:33:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362488.1614307; Tue, 14 Jul 2026 18:33:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwE-0006re-LL; Tue, 14 Jul 2026 18:33:02 +0000 Received: by outflank-mailman (input) for mailman id 1362488; Tue, 14 Jul 2026 18:33:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwD-0006rY-T8 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhwE-0067Pb-0K for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhwD-00ASen-2V for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7/+pIRan5UE5WFoF2leDPN6dOnAJ5raZEqKwe94mJW4=; b=p0VNxzZwN18xGmU8x084g9MXo5 6OkaP4qYMY1eadUBNFKBwvPwoh8fHoebpElcBXsiyDjqR8DPa/Wb0IEduqhFY7XJ0Pd/mgFy/AJct 5EQQvUEaK2EKXWVF+Q+blswftiB/gxtsj3jILxvSpV+BO04lM+r6Wz7089eECh9teT/o=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] CI: Add the new Panther Lake runner Message-Id: Date: Tue, 14 Jul 2026 18:33:01 +0000 commit 6286a896f4664ff874bebc133804c0554ece6191 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 20db71b1c9..7cc5214630 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -170,6 +170,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86_64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86_64: # it's really similar to the above extends: .adl-x86_64 @@ -405,6 +416,76 @@ kbl-tools-tests-pvh-x86_64-gcc-debug: - *x86_64-test-needs - alpine-3.24-x86_64-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86_64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86_64-test-needs + - alpine-3.24-x86_64-gcc-debug + zen2-smoke-x86_64-gcc-debug: extends: .zen2-x86_64 script: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362489.1614311 (Exim 4.92) (envelope-from ) id 1wjhwO-0006tZ-PW; Tue, 14 Jul 2026 18:33:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362489.1614311; Tue, 14 Jul 2026 18:33:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwO-0006tR-Mf; Tue, 14 Jul 2026 18:33:12 +0000 Received: by outflank-mailman (input) for mailman id 1362489; Tue, 14 Jul 2026 18:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwN-0006tH-VV for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhwO-0067Q2-0i for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhwN-00ASy8-2s for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NuBb4EPUpDndlYxKTXrpx+DP/Jj8tXkh6Xa5TfANtw8=; b=M1fKGqDs+p/c45naDCfZoTkVP9 taDtp0r6anB1NxchT2jih8nOySTJJA0yqBp3W+Gpfhub/HneXDkdvjh9PBGSyiMv0d3fB+u7pblP0 h3+jFhUn4pweAki8PrVg6feyfsOGq0lk/t6cUvt3V/unkqrOEzO+XuXNxUhVoLx8htRM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] CI: Enable FRED on the PTL runner Message-Id: Date: Tue, 14 Jul 2026 18:33:11 +0000 commit e6c6da39bcff0c96dc0713a021b8efcfab71c52d Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:05 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 CI: Enable FRED on the PTL runner Add new job-level EXTRA_XEN_OPTS variable, in addition to CONSOLE_OPTS. FRED is not yet enabled by default on Intel systems, but is expected to function. Explicitly turn it on for added test coverage in the short term. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit d9e36605ff1d6888d3934f7c7452da781aee37d7) --- automation/gitlab-ci/test.yaml | 1 + automation/scripts/qubes-x86_64.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 7cc5214630..61adc1baff 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -177,6 +177,7 @@ PCIDEV: "56:00.0" PCIDEV_INTR: "MSI-X" CONSOLE_OPTS: "console=com1 com1=115200,8n1" + EXTRA_XEN_OPTS: "fred" SUT_ADDR: test-22.testnet tags: - qubes-hw22 diff --git a/automation/scripts/qubes-x86_64.sh b/automation/scripts/qubes-x86_64.sh index 7a59fa5f11..065f03931b 100755 --- a/automation/scripts/qubes-x86_64.sh +++ b/automation/scripts/qubes-x86_64.sh @@ -260,14 +260,14 @@ TFTP=/scratch/gitlab-runner/tftp CONTROLLER=control@thor.testnet echo " -multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts +multiboot2 (http)/gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts module2 (http)/gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen module2 --nounzip (http)/gitlab-ci/initrd-dom0 " > $TFTP/grub.cfg echo "#!ipxe -kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog $extra_xen_opts || reboot +kernel /gitlab-ci/xen $CONSOLE_OPTS loglvl=all guest_loglvl=all dom0_mem=4G console_timestamps=boot watchdog ${EXTRA_XEN_OPTS-} $extra_xen_opts || reboot module /gitlab-ci/vmlinuz console=hvc0 root=/dev/ram0 earlyprintk=xen || reboot module /gitlab-ci/initrd-dom0 || reboot boot -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362490.1614315 (Exim 4.92) (envelope-from ) id 1wjhwZ-0006vc-Ql; Tue, 14 Jul 2026 18:33:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362490.1614315; Tue, 14 Jul 2026 18:33:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwZ-0006vU-O5; Tue, 14 Jul 2026 18:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1362490; Tue, 14 Jul 2026 18:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwY-0006vN-DI for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhwY-0067QB-24 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhwY-00ATUA-0p for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rg93p5qF2Vi8jt0l9QlTnI346aq9zht8CTzAEgoPe8I=; b=BuXPD3h60AFABuvb/N0O6/vivc bJ9CPfyQfidzJNDpMr/ZzoI+frAxGdpIehg+SgU6s+vTOS2HeQcJqSp7tT1qa7I0Uty+2Y3nA4Klo OJPIrEDqZDNyNkSN//WtDMvPDG+l98aMOQ7hKbheos+2sAjOWZD0knpTuJT4jIN5XK5Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Tue, 14 Jul 2026 18:33:22 +0000 commit 88301b2e61ed0fc781975c835c508c581d560324 Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 550617f152..72d5316180 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362491.1614319 (Exim 4.92) (envelope-from ) id 1wjhwj-0006xV-SJ; Tue, 14 Jul 2026 18:33:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362491.1614319; Tue, 14 Jul 2026 18:33:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwj-0006xN-PR; Tue, 14 Jul 2026 18:33:33 +0000 Received: by outflank-mailman (input) for mailman id 1362491; Tue, 14 Jul 2026 18:33:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwi-0006xG-H7 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhwi-0067QF-2V for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhwi-00AUGq-1U for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WT4oxfv2MKLCPovzJ7dmNHb8xZooMEVqVo9xi+Oz2qA=; b=VCcGpLaR2FIddN1cu7QsVTTSPv 4L18u4rYrpYjtUVJM/6UCP4giuH4EAeQy99cuFh3ws4UxbLC/i8p81BgVIgbSE5Kd2fJWreh+Zqc+ FIGGr6AIH5u61+X080TDvln//++tONlS3+ytDTuoubwt5Ey//DAqrqWVkP5P2iNEppag=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 18:33:32 +0000 commit fb83c2354b32c8a5f41cd87359b78cd4cabcca37 Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362492.1614322 (Exim 4.92) (envelope-from ) id 1wjhwt-0006zi-TJ; Tue, 14 Jul 2026 18:33:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362492.1614322; Tue, 14 Jul 2026 18:33:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhwt-0006za-Qk; Tue, 14 Jul 2026 18:33:43 +0000 Received: by outflank-mailman (input) for mailman id 1362492; Tue, 14 Jul 2026 18:33:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhws-0006zT-Jt for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhws-0067QK-2m for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhws-00AUWq-1n for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WxADnCPJXgXQwApuuGR+g96J1yCruzwA4OfG147+SbE=; b=heheTONBNsoqH0bYZWaZsbLu33 wJSzuYCHVFltOsI+qGBGEHejKwBcegThYn/LDbpE5WcP2a8QVbrdSyZpFLp2gZAIw7ZyY+M85orpe icdv7bhy1EQtvCzWEy5WcZ9oWssgAhvXk0ybnt5AJYr8MwrszHeN14EXQlP1IKTPyffo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Tue, 14 Jul 2026 18:33:42 +0000 commit c3ce09cd90a18190042fb5fd83b3772ac3e4bfd8 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 13:35:24 2026 +0100 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index eacfd93087..9513c1c837 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:33:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:33:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362493.1614329 (Exim 4.92) (envelope-from ) id 1wjhx4-00071a-00; Tue, 14 Jul 2026 18:33:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362493.1614329; Tue, 14 Jul 2026 18:33:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhx3-00071S-S4; Tue, 14 Jul 2026 18:33:53 +0000 Received: by outflank-mailman (input) for mailman id 1362493; Tue, 14 Jul 2026 18:33:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhx2-00071L-MZ for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhx2-0067QO-33 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhx2-00AUbY-24 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:33:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FdCD/fMSuS71/JDC/lDYzVKJPvDlTGc0rtXvuS/mSWs=; b=tPtGcWVY4rjvUKzj3VUKtw3XqB YdIZfIPuaU/8uESa3ZdaQKCu0iOSQzV1sQAIXfCX7D0tlrEw6X9h6bPEC9J0LbvnPQTw0EdNJ9DWx sThwWT482LrlpE8P+INYMR964e5PVsS95ZczcxUKRaStStrifS7K0wu4+jArCv+bDiC4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Tue, 14 Jul 2026 18:33:52 +0000 commit 6959caf0fb711e3e5674de9375f5ac8249242ee9 Author: Andrew Cooper AuthorDate: Mon Jul 6 22:49:25 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:40:12 2026 +0100 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Release-Acked-by: Oleksii Kurochko (cherry picked from commit 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58) --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 3f2e9dedcd..5378299b8c 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -53,7 +53,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -88,9 +88,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 18:34:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 18:34:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362494.1614331 (Exim 4.92) (envelope-from ) id 1wjhxE-000740-1n; Tue, 14 Jul 2026 18:34:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362494.1614331; Tue, 14 Jul 2026 18:34:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhxD-00073s-VH; Tue, 14 Jul 2026 18:34:03 +0000 Received: by outflank-mailman (input) for mailman id 1362494; Tue, 14 Jul 2026 18:34:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjhxC-00073l-PR for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:34:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjhxD-0067Qg-07 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:34:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjhxC-00AUkI-2L for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 18:34:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5kS1bVCwXUyb9oaMADnuBT15AYU3tcM7tXNbGqFhS4I=; b=WObBBtSWfuinB6JEvqhKRKmpL8 FK+CeZE/wM6noboLsx6LcljnyZJIt3GXBOzkI+UIdMfWjtTpz6hnv7GYZOD970MJC+60EOgpCJiF6 YCUSGfDnQIfVqrcvI1c3ldTgyA67rxMla6Hx58wjkECeEqUeikiMe+Tmz629Y28YJJpQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] Update Xen version to 4.22.0-rc4 Message-Id: Date: Tue, 14 Jul 2026 18:34:02 +0000 commit 01cccf5a3e03efbec6423b2ea6b3c6d3dd2ea1a4 Author: Andrew Cooper AuthorDate: Tue Jul 14 17:44:02 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 14 17:44:02 2026 +0100 Update Xen version to 4.22.0-rc4 Signed-off-by: Andrew Cooper --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 483901fb2f..8d4cfb737a 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 22 -export XEN_EXTRAVERSION ?= .0-rc3$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .0-rc4$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 20:55:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 20:55:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362558.1614372 (Exim 4.92) (envelope-from ) id 1wjk9g-0008JJ-EG; Tue, 14 Jul 2026 20:55:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362558.1614372; Tue, 14 Jul 2026 20:55:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjk9g-0008JA-BA; Tue, 14 Jul 2026 20:55:04 +0000 Received: by outflank-mailman (input) for mailman id 1362558; Tue, 14 Jul 2026 20:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjk9e-0008J4-OH for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjk9e-006A9N-2v for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjk9e-00FDiY-1b for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1WowFD5cL4UIiYWybOU0umZ8rW+IeXy8FOih2VSSyd4=; b=jA9mgT0GIgyF77nG9Z6p6/i6q1 9wwcng/b7RBbyQyp5gn24vXvtbpZK8pkeQ1bs8rUX9RXbsPsdXQ0ZylOr+KigSc9nqoU8gFyBzeYy Q+C+MeosaeT0xBaI3LE20ut08GKzkDEYPEi5ISX9uCetMNVH7JGJrx+IcsLfi4QhN5HM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] CI: Add the new Panther Lake runner Message-Id: Date: Tue, 14 Jul 2026 20:55:02 +0000 commit 4d824ccc3b87f9662e2bd67f8118dc62bfac75be Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 19:06:19 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index a3f661d380..fcf2d4e573 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -175,6 +175,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86-64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86-64: # it's really similar to the above extends: .adl-x86-64 @@ -410,6 +421,76 @@ kbl-tools-tests-pvh-x86-64-gcc-debug: - *x86-64-test-needs - alpine-3.18-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + zen2-smoke-x86-64-gcc-debug: extends: .zen2-x86-64 script: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 20:55:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 20:55:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362559.1614375 (Exim 4.92) (envelope-from ) id 1wjk9q-0008Kt-F8; Tue, 14 Jul 2026 20:55:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362559.1614375; Tue, 14 Jul 2026 20:55:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjk9q-0008Km-CV; Tue, 14 Jul 2026 20:55:14 +0000 Received: by outflank-mailman (input) for mailman id 1362559; Tue, 14 Jul 2026 20:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjk9o-0008Ka-RO for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjk9p-006ABY-0J for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjk9o-00FE70-2V for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 20:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TzL1dw2Lcd/YPgagAkisaPEAvBZ2TYcaTA/+pyOR8Ok=; b=TywkEfddhaH0wIycBiDQwLOY8W fHd0vKW76pQaEfPHCacBk68GPgNAjEKHKxXADMO7gW1TVlhlvDcW6Na1FIwX+rAnCSGvtxF8LAeBu s+9Qui6i0CgWAasPaKatfYBXKHpY/vqh7BxkwmeDYo9KY9C12EyMQ/RvYwVd1gYzVtHw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 20:55:12 +0000 commit 00c0f66594106f174b0af91007030bf8b30545ca Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 19:06:19 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 22:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 22:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362605.1614402 (Exim 4.92) (envelope-from ) id 1wjm1w-00068X-VK; Tue, 14 Jul 2026 22:55:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362605.1614402; Tue, 14 Jul 2026 22:55:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjm1w-00068P-RO; Tue, 14 Jul 2026 22:55:12 +0000 Received: by outflank-mailman (input) for mailman id 1362605; Tue, 14 Jul 2026 22:55:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjm1v-00068F-PK for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjm1w-006CP8-05 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjm1v-001a4M-2D for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5fYSERf+vf6ge06tJmvI6to4ouVt+ejlQW6Rp3tXcYc=; b=wE2biABkhQJBa5BJ0Qlm1eMumA m5BKXqsglj/NOrV36apmH72pa887xoP5gOMI5v43uthqPdTGR4axR5WUYzTzRnHvQ1FJ90tVV+lRQ CfmISZ6kwCts/jmVAC/f93y7hDEjjzHX4+FRhH9SN4jKVykq8ufpjJDHPmFjf0gauZfw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 22:55:11 +0000 commit 00c0f66594106f174b0af91007030bf8b30545ca Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 19:06:19 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 22:55:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 22:55:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362604.1614397 (Exim 4.92) (envelope-from ) id 1wjm1m-00067D-SW; Tue, 14 Jul 2026 22:55:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362604.1614397; Tue, 14 Jul 2026 22:55:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjm1m-000675-Q1; Tue, 14 Jul 2026 22:55:02 +0000 Received: by outflank-mailman (input) for mailman id 1362604; Tue, 14 Jul 2026 22:55:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjm1l-00066z-Lr for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjm1l-006COK-2u for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjm1l-001Zuy-1o for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 22:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=0332TeH72yCjwSfhiBr3kLsd0D3vnSxicRqryAEpDGc=; b=6KT2CTYb/QwnEna+PYLV15H4jA nA0bLyjcaZv2MWFDTKeOnUfNoDkkh6watm6tB25z/udYryvnMmwBgjwU6xIw0xxKng2vV+S4pLUMu NvCsrBaSgTYTDLPfRsdMhHQSl0hhoW7HYapHtrlSiKqpTm5gDGyS5Dd/i1sRySvXzbSE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] CI: Add the new Panther Lake runner Message-Id: Date: Tue, 14 Jul 2026 22:55:01 +0000 commit 4d824ccc3b87f9662e2bd67f8118dc62bfac75be Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 19:06:19 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index a3f661d380..fcf2d4e573 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -175,6 +175,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86-64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86-64: # it's really similar to the above extends: .adl-x86-64 @@ -410,6 +421,76 @@ kbl-tools-tests-pvh-x86-64-gcc-debug: - *x86-64-test-needs - alpine-3.18-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + zen2-smoke-x86-64-gcc-debug: extends: .zen2-x86-64 script: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 23:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 23:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362616.1614405 (Exim 4.92) (envelope-from ) id 1wjmnD-0003Or-93; Tue, 14 Jul 2026 23:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362616.1614405; Tue, 14 Jul 2026 23:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjmnD-0003Oj-6G; Tue, 14 Jul 2026 23:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1362616; Tue, 14 Jul 2026 23:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjmnC-0003Od-1Q for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjmnC-006DLb-0p for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjmnB-002xto-30 for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/Lj23pnMAp+piY1rC7tnasRgbk165a+HjEvrAMPK32U=; b=6ccTdPUYHWVbPzOooJ6uNqgZvM JYZJz/6YrQjGROHDyFOHgakxxGxt5VL5blHZlYX7boYVbzIOGCOfl60Q/ltyDI7pgvFmobXxl6qFb NrA5o6mp/MChegxmKbhSR6qf8xbtxjN+cwV67tFkjPrfWgpOota0q754mKB24XYmB2GA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] CI: Add the new Panther Lake runner Message-Id: Date: Tue, 14 Jul 2026 23:44:01 +0000 commit 206003ac6a6ac2281b4ae82cde94ba030f0c46e5 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 23:51:22 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 0a2b80956b..5d43ec64e8 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -175,6 +175,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86-64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86-64: # it's really similar to the above extends: .adl-x86-64 @@ -410,6 +421,76 @@ kbl-tools-tests-pvh-x86-64-gcc-debug: - *x86-64-test-needs - alpine-3.18-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + zen2-smoke-x86-64-gcc-debug: extends: .zen2-x86-64 script: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 14 23:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 14 Jul 2026 23:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362617.1614409 (Exim 4.92) (envelope-from ) id 1wjmnN-0003Qk-AC; Tue, 14 Jul 2026 23:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362617.1614409; Tue, 14 Jul 2026 23:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjmnN-0003Qc-7Y; Tue, 14 Jul 2026 23:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1362617; Tue, 14 Jul 2026 23:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjmnM-0003QU-EJ for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjmnM-006DLg-2D for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjmnM-002y9c-0v for xen-changelog@lists.xenproject.org; Tue, 14 Jul 2026 23:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+j+KlZxQaa1QRKEW6bHyVZoFI5ohEEwVtyiezwGMAqo=; b=bdLROG48K4CpDBhrinTbfOuubC J5cQKUpztyRM72l9MQbnTdJMt3zeJYxJpu3Fz8dG4385qSUSKs37qfB8Ud9to+c2dfgYgSSObPVkB DtxRaTddOteQrJQt0OHIXFORQFC1JMdFtg5cq9tLcRhudLS4ExgJAjPb+JAzhWfKNaTw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Tue, 14 Jul 2026 23:44:12 +0000 commit ea5e0ef356a9f6ededc36106fffd0ff505b58374 Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 23:51:22 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 08:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 08:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362821.1614538 (Exim 4.92) (envelope-from ) id 1wjusW-0004oX-Ie; Wed, 15 Jul 2026 08:22:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362821.1614538; Wed, 15 Jul 2026 08:22:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjusW-0004oO-G0; Wed, 15 Jul 2026 08:22:04 +0000 Received: by outflank-mailman (input) for mailman id 1362821; Wed, 15 Jul 2026 08:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjusU-0004oI-Ns for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjusU-007aL0-31 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjusU-00Frv0-1y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=y7pKz2+xSKSmnKzlgvfQkCfnZE02x1zT82CX0qs5iVw=; b=uI5oHeU8RTtKhcDud2TqWspSIa 7dvZ0Rqw/dP2tc2VFoSooOVsHczAtsEgDpBNXpi0gNWC8PwH9y8I8uLQXOAlaBGzyVfUoSs4dLShH 7UhrQrHBybwFUqWspUIgPv4iQMMEa7gPWqXWVKOkZb5xzNR5PTa6ZgrNbYFuHQNZQtBs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] CI: Add the new Panther Lake runner Message-Id: Date: Wed, 15 Jul 2026 08:22:02 +0000 commit 206003ac6a6ac2281b4ae82cde94ba030f0c46e5 Author: Marek Marczykowski-Górecki AuthorDate: Thu Jul 9 21:57:04 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 14 23:51:22 2026 +0100 CI: Add the new Panther Lake runner For now run similar set of tests as ADL. Exclude suspend test for now. While firmware claims S3 is supported, suspend attempt fails (power LED blinks for a few seconds, and then system reboots). With no messages on the serial console, even with `sync_console`. Signed-off-by: Marek Marczykowski-Górecki Acked-by: Andrew Cooper (cherry picked from commit 77ed730bfbc8e7f36e50827630a5437e2a13e6b1) --- automation/gitlab-ci/test.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml index 0a2b80956b..5d43ec64e8 100644 --- a/automation/gitlab-ci/test.yaml +++ b/automation/gitlab-ci/test.yaml @@ -175,6 +175,17 @@ tags: - qubes-hw3 +.ptl-x86_64: + # it's really similar to the ADL one + extends: .adl-x86-64 + variables: + PCIDEV: "56:00.0" + PCIDEV_INTR: "MSI-X" + CONSOLE_OPTS: "console=com1 com1=115200,8n1" + SUT_ADDR: test-22.testnet + tags: + - qubes-hw22 + .zen2-x86-64: # it's really similar to the above extends: .adl-x86-64 @@ -410,6 +421,76 @@ kbl-tools-tests-pvh-x86-64-gcc-debug: - *x86-64-test-needs - alpine-3.18-gcc-debug +ptl-smoke-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-smoke-x86_64-dom0pvh-hvm-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh dom0pvh-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-pv 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pci-hvm-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pci-hvm 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-pvshim-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh pvshim 2>&1 | tee ${LOGFILE} + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pv-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pv 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + +ptl-tools-tests-pvh-x86_64-gcc-debug: + extends: .ptl-x86_64 + script: + - ./automation/scripts/qubes-x86-64.sh tools-tests-pvh 2>&1 | tee ${LOGFILE} + artifacts: + reports: + junit: tests-junit.xml + needs: + - *x86-64-test-needs + - alpine-3.18-gcc-debug + zen2-smoke-x86-64-gcc-debug: extends: .zen2-x86-64 script: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 08:22:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 08:22:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362822.1614543 (Exim 4.92) (envelope-from ) id 1wjusg-0004qC-K6; Wed, 15 Jul 2026 08:22:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362822.1614543; Wed, 15 Jul 2026 08:22:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjusg-0004q4-HL; Wed, 15 Jul 2026 08:22:14 +0000 Received: by outflank-mailman (input) for mailman id 1362822; Wed, 15 Jul 2026 08:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjuse-0004pg-S5 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjusf-007aL4-0M for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjuse-00FsFw-2U for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 08:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iegzz5WePuzdu/4qlaIR/wWuEC4knH8IQcZy++YUDk0=; b=bwweFPqrnJvbi64q0wgfXLkvIM TeOEgTPcFMiYp//0plJc+WUwDQ5Z3MvB5kH7V5dm5GDs13Id5QneL0/H31pU7LFzu1o/p9sT80jNe sfRA5AFsNyHykwGRKwF6SGcbILEO9EU3f11xlPIVMA8j/EbID9mSxNKJF4qHQxFBXg5A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Message-Id: Date: Wed, 15 Jul 2026 08:22:12 +0000 commit ea5e0ef356a9f6ededc36106fffd0ff505b58374 Author: Andrii Sultanov AuthorDate: Thu Jul 9 12:00:09 2026 +0000 Commit: Andrew Cooper CommitDate: Tue Jul 14 23:51:22 2026 +0100 tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections Without this fix, the backend would be stuck waiting on the zero-sized body until the next request comes in. Instead return the request immediately after reading the header, there's no need to wait for another call to .has_more_input and .input Reported-by: George Dunlap Link: https://lore.kernel.org/xen-devel/CAFLBxZaeTMcF4tcV45MJdCVx4A6qbzQdjKei_Quh_iLrtARVFA@mail.gmail.com/ Signed-off-by: Andrii Sultanov Reviewed-by: Guillaume Thouvenin Release-Acked-by: Oleksii Kurochko (cherry picked from commit 7b98d94e759b5ec54c7380d63287119b3712785d) --- tools/ocaml/libs/xb/xb.ml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/tools/ocaml/libs/xb/xb.ml b/tools/ocaml/libs/xb/xb.ml index 3e3ef2b29d..12ddb05c6d 100644 --- a/tools/ocaml/libs/xb/xb.ml +++ b/tools/ocaml/libs/xb/xb.ml @@ -249,6 +249,11 @@ let can_input con = Queue.can_push con.pkt_out CommandReply (* NB: can throw Reconnect *) let input con = + let reset_and_return partial_pkt = + let pkt = Packet.of_partialpkt partial_pkt in + con.partial_in <- init_partial_in (); + Some pkt + in if not (can_input con) then None else let to_read = to_read con in @@ -264,17 +269,25 @@ let input con = if sz > 0 then Partial.append partial_pkt (Bytes.to_string b) sz; if Partial.to_complete partial_pkt = 0 then ( - let pkt = Packet.of_partialpkt partial_pkt in - con.partial_in <- init_partial_in (); - Some pkt + reset_and_return partial_pkt ) else None | NoHdr (i, buf) -> (* we complete the partial header *) if sz > 0 then Bytes.blit b 0 buf (Partial.header_size () - i) sz; - con.partial_in <- if sz = i then - HaveHdr (Partial.of_string (Bytes.to_string buf)) else NoHdr (i - sz, buf); - None + if sz = i then + let partial_pkt = Partial.of_string (Bytes.to_string buf) in + (* If there is no body, we can return the full request immediately *) + if Partial.to_complete partial_pkt = 0 then + reset_and_return partial_pkt + else ( + con.partial_in <- HaveHdr partial_pkt; + None + ) + else ( + con.partial_in <- NoHdr (i - sz, buf); + None + ) ) let classify t = -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362870.1614580 (Exim 4.92) (envelope-from ) id 1wjwkd-0002IC-6d; Wed, 15 Jul 2026 10:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362870.1614580; Wed, 15 Jul 2026 10:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkd-0002I4-3m; Wed, 15 Jul 2026 10:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1362870; Wed, 15 Jul 2026 10:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkc-0002Hy-9l for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwkc-007ceY-1Z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwkc-001TVU-0V for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TMtgGBEYvuwSgZCLWZyKcbimnYTNJDQdomfvZb+bS8E=; b=voxAPVTVEaeMW7M2rqSUnt9iXX A47YIZD6otf7oTEjPUPtTRFZhNdtFxA+5hBRUei6rEThMHwvr+v7NpNgAiqm0UjRM2e4961FkdNsf Ith9i3dZa331K/0Yrqbee10tTVkk8mlHURxEapJBf5UZNwN2o7BrVUKnaOAQkWNUajfg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/device-tree: Fix off-by-one bounds check in make_memory_node() Message-Id: Date: Wed, 15 Jul 2026 10:22:02 +0000 commit d52eda2b099dc516fb2434f1ae3a11de345f4fcf Author: Oleksandr Tyshchenko AuthorDate: Thu Apr 2 20:38:35 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/device-tree: Fix off-by-one bounds check in make_memory_node() When building Xen with CONFIG_STATIC_SHM=n, booting a hardware domain with exactly NR_MEM_BANKS (256) reserved-memory regions causes a panic: (XEN) Xen BUG at common/device-tree/domain-build.c:497 (XEN) Xen call trace: (XEN) [<00000a0000289aa8>] make_memory_node+0x178/0x234 (PC) This occurs due to an off-by-one error in the bounds checking of the reg array in make_memory_node(). The check: BUG_ON(nr_cells >= ARRAY_SIZE(reg)); incorrectly triggers when the array is exactly full (i.e., when nr_cells == ARRAY_SIZE(reg)), preventing the 256th and final valid memory region from being written. When CONFIG_STATIC_SHM=y, this bug is usually hidden because DT_MEM_NODE_REG_RANGE_SIZE adds extra space for SHM banks. This extra capacity prevents the array from reaching its maximum limit while processing the 256th memory region. However, if a domain is configured with exactly NR_MEM_BANKS and NR_SHMEM_BANKS, the array will completely fill up and trigger the same panic. Fix this by changing the condition to strictly greater than (>). Apply the exact same fix to shm_mem_node_fill_reg_range() to prevent the same error. Fixes: cd8015b634b0 ("ARM/dom0: Avoid using a variable length array in make_memory_node()") Fixes: 7846f7699fea ("xen/arm: List static shared memory regions as /memory nodes") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel [michal: adjust for make_memory_node() living in a different file] Signed-off-by: Michal Orzel (cherry picked from commit fc453fef7708f65d4023ff63ebafe52c822229a1) --- xen/arch/arm/domain_build.c | 2 +- xen/common/device-tree/static-shmem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index fb8fbb1650..3c808e2c07 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -688,7 +688,7 @@ int __init make_memory_node(const struct kernel_info *kinfo, int addrcells, continue; nr_cells += reg_size; - BUG_ON(nr_cells >= ARRAY_SIZE(reg)); + BUG_ON(nr_cells > ARRAY_SIZE(reg)); dt_child_set_range(&cells, addrcells, sizecells, start, size); } diff --git a/xen/common/device-tree/static-shmem.c b/xen/common/device-tree/static-shmem.c index 79f23caa77..4c4cc1b123 100644 --- a/xen/common/device-tree/static-shmem.c +++ b/xen/common/device-tree/static-shmem.c @@ -838,7 +838,7 @@ void __init shm_mem_node_fill_reg_range(const struct kernel_info *kinfo, paddr_t size = mem->bank[i].size; *nr_cells += addrcells + sizecells; - BUG_ON(*nr_cells >= DT_MEM_NODE_REG_RANGE_SIZE); + BUG_ON(*nr_cells > DT_MEM_NODE_REG_RANGE_SIZE); dt_child_set_range(&cells, addrcells, sizecells, start, size); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362872.1614583 (Exim 4.92) (envelope-from ) id 1wjwkn-0002KA-7i; Wed, 15 Jul 2026 10:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362872.1614583; Wed, 15 Jul 2026 10:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkn-0002K2-54; Wed, 15 Jul 2026 10:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1362872; Wed, 15 Jul 2026 10:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkm-0002Js-BI for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwkm-007cec-1u for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwkm-001TZf-0t for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zNDb5emXcdPpRrYtUXLmYddDjtpKeZoNC5Vej3enABE=; b=k1y1tvl34uCatnih51aCTS6hVS FSv1mFjYa8bw/XkUdszzhQ4zqYa1B+W0T4w87YSIJGA1SW9z7OO1wo+qswXkPSKYXKAsfZKQgw/LI 3J1AUi9qPI5nBovrBe5N0uo1kOi6VxX+UN5FRl/w1Wio8vG5+ZkS/07hEh3KXoXhQVRw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: Fix off-by-one in iomem_deny_access() calls Message-Id: Date: Wed, 15 Jul 2026 10:22:12 +0000 commit 8a615b0281bcf8b20ce5bd730058b43888aee592 Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:32 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: Fix off-by-one in iomem_deny_access() calls iomem_deny_access() wraps rangeset_remove_range() which takes inclusive endpoints. All call sites in the GIC and ACPI code pass 'mfn + nr' (or 'mfn + 1' for single-page regions) as the end parameter, which causes one extra page beyond each region to be denied. For single-page regions, use 'mfn' as the end (denying exactly one page). For all multi-page regions, use 'mfn + nr - 1'. This matches the correct pattern used elsewhere, e.g. in device.c. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Fixes: 66158be465 ("ARM: ITS: Deny hardware domain access to ITS") Fixes: 97e9875646 ("arm/acpi: Permit MMIO access of Xen unused devices for Dom0") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Stefano Stabellini (cherry picked from commit f25fe2452b821270ac62c2ee4f6dd4dea9ad3298) --- xen/arch/arm/acpi/domain_build.c | 2 +- xen/arch/arm/gic-v2.c | 8 ++++---- xen/arch/arm/gic-v3-its.c | 2 +- xen/arch/arm/gic-v3.c | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/xen/arch/arm/acpi/domain_build.c b/xen/arch/arm/acpi/domain_build.c index 1c3555d814..dfdd73a8ee 100644 --- a/xen/arch/arm/acpi/domain_build.c +++ b/xen/arch/arm/acpi/domain_build.c @@ -48,7 +48,7 @@ static int __init acpi_iomem_deny_access(struct domain *d) { mfn = spcr->serial_port.address >> PAGE_SHIFT; /* Deny MMIO access for UART */ - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; } diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index b23e72a3d0..014f955967 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -1079,23 +1079,23 @@ static int gicv2_iomem_deny_access(struct domain *d) unsigned long mfn, nr; mfn = dbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = hbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = cbase >> PAGE_SHIFT; nr = DIV_ROUND_UP(csize, PAGE_SIZE); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; mfn = vbase >> PAGE_SHIFT; - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } #ifdef CONFIG_ACPI diff --git a/xen/arch/arm/gic-v3-its.c b/xen/arch/arm/gic-v3-its.c index 34833166ad..2b186fe6bc 100644 --- a/xen/arch/arm/gic-v3-its.c +++ b/xen/arch/arm/gic-v3-its.c @@ -1009,7 +1009,7 @@ int gicv3_its_deny_access(struct domain *d) { mfn = paddr_to_pfn(its_data->addr); nr = PFN_UP(its_data->size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) { printk("iomem_deny_access failed for %lx:%lx \r\n", mfn, nr); diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index bc07f97c16..b3e104ea4a 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1602,7 +1602,7 @@ static int gicv3_iomem_deny_access(struct domain *d) mfn = dbase >> PAGE_SHIFT; nr = PFN_UP(SZ_64K); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; @@ -1614,7 +1614,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = gicv3.rdist_regions[i].base >> PAGE_SHIFT; nr = PFN_UP(gicv3.rdist_regions[i].size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1623,7 +1623,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = cbase >> PAGE_SHIFT; nr = PFN_UP(csize); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1632,7 +1632,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = vbase >> PAGE_SHIFT; nr = PFN_UP(csize); - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } return 0; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362874.1614588 (Exim 4.92) (envelope-from ) id 1wjwkx-0002MN-91; Wed, 15 Jul 2026 10:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362874.1614588; Wed, 15 Jul 2026 10:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkx-0002MF-6W; Wed, 15 Jul 2026 10:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1362874; Wed, 15 Jul 2026 10:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwkw-0002M9-Fx for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwkw-007cei-2D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwkw-001Te6-1B for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=D0XDSBAYN+0JMYo6AKPf9lQiJn8HPHRykAOyF9cE8pk=; b=Jrue3BxV3B6qUIDvxZN4FdvWC6 bLYg6KbGNA1P0QkcTZcjWrXtfhkb28L2GxcQ4dOmOQp2faHNQD7nGPBrmaYp67LHiczisQUU2imdH ++2vdThSIRSEvLlelHGqKacxx8O9B48JzrUGZSocauPjkBIdQgZS0UAK88tsbjY+XJuE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface Message-Id: Date: Wed, 15 Jul 2026 10:22:22 +0000 commit c72fa3472505ff1f1957548c2783d894979876fa Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:34 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface gicv3_iomem_deny_access() incorrectly uses csize (physical CPU interface size) instead of vsize (virtual CPU interface size) when calculating the number of pages to deny for the virtual CPU interface region at vbase. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit 9af54b65a4272e438d6b8508eb8d0749506856c3) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index b3e104ea4a..5641ee870f 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1631,7 +1631,7 @@ static int gicv3_iomem_deny_access(struct domain *d) if ( vbase != INVALID_PADDR ) { mfn = vbase >> PAGE_SHIFT; - nr = PFN_UP(csize); + nr = PFN_UP(vsize); return iomem_deny_access(d, mfn, mfn + nr - 1); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362875.1614592 (Exim 4.92) (envelope-from ) id 1wjwl8-0002OK-Ak; Wed, 15 Jul 2026 10:22:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362875.1614592; Wed, 15 Jul 2026 10:22:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwl8-0002OC-7p; Wed, 15 Jul 2026 10:22:34 +0000 Received: by outflank-mailman (input) for mailman id 1362875; Wed, 15 Jul 2026 10:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwl6-0002O6-Rn for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwl7-007cf7-0M for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwl6-001U8L-26 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HFhDfBzXMpLXSQXEP6dRPH4QqvqtZ7C3P12ih9a5NTg=; b=UqqBpdp0GPrJsm2i5ccs1HxoOW dw78IJUWlvBvYy52Exx6OA19HtGjbDR0zr+pr3R2FK6eHWNFX5siOXcWS+FhZDX63W53B1bRXP9G3 grYZ1INNXCWp99GyG/d2ULMo5kjdTRv1i/kiLh72RVLY1+cwVGwqT5nL7gQWY8NISfQU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v3: disable Group 1 before CPU power-down Message-Id: Date: Wed, 15 Jul 2026 10:22:32 +0000 commit 0927c7f348f9477b2757b566d9f269c26006e150 Author: Mykola Kvach AuthorDate: Fri Apr 10 09:47:45 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: disable Group 1 before CPU power-down gicv3_cpu_disable() currently writes 0 to ICC_CTLR_EL1. Unlike GICC_CTLR in the GICv2 path, ICC_CTLR_EL1 does not enable or disable physical Group 1 interrupt signalling, so this write only clears EOImode. The GICv3 power management rules require the physical group enables in the CPU interface to be cleared before the redistributor is driven into ProcessorSleep, otherwise behaviour is UNPREDICTABLE. Xen only enables Group 1 interrupts on this path, so disable the interface by clearing ICC_IGRPEN1_EL1 instead. This appears to be a copy of the GICv2 pattern where the enable control lives in CTLR, but for GICv3 the enable moved to ICC_IGRPEN1_EL1. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 18b718b6af3d38d8bed23439ec396fd4bde9b75d) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 5641ee870f..7f365cdbe9 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1028,7 +1028,7 @@ static int gicv3_cpu_init(void) static void gicv3_cpu_disable(void) { - WRITE_SYSREG(0, ICC_CTLR_EL1); + WRITE_SYSREG(0, ICC_IGRPEN1_EL1); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362876.1614596 (Exim 4.92) (envelope-from ) id 1wjwlI-0002SE-De; Wed, 15 Jul 2026 10:22:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362876.1614596; Wed, 15 Jul 2026 10:22:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlI-0002S6-As; Wed, 15 Jul 2026 10:22:44 +0000 Received: by outflank-mailman (input) for mailman id 1362876; Wed, 15 Jul 2026 10:22:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlH-0002S0-49 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwlH-007cfB-1D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwlH-001UXh-02 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WESpfVptrKe/ZT2pIapAYOXorppG6VEJK9CPhKd9IXE=; b=3yNMfgdmLmraJLfmv38JS5R1qw AXefxDTTksJH0Gj9i5tP1yAy+a7iufLIR8el9eQFhXPPGaRlI3ToWbLLMT3QWLqI7/g80GiivpnI0 p0llWIju5jEGs4fbr8mO01ZuEBi/WJXkBFbEP82fq3TnMIferiJvGP1T7o/EhAlHFK5I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] arm64/insn: Avoid undefined behaviour in branch offset decode Message-Id: Date: Wed, 15 Jul 2026 10:22:43 +0000 commit 7d003af01d0d196e0bf1d5fde7a9083d27258fa1 Author: Edgar E. Iglesias AuthorDate: Wed Apr 22 18:45:06 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 arm64/insn: Avoid undefined behaviour in branch offset decode Branch offset decoding sign-extends the immediate by shifting it left into bit 31 and back. Perform the left shift in uint32_t and cast to int32_t only for the final right shift to avoid UBSAN failures on negative offsets. Fixes: 6dbf3f0e3074 ("xen/arm: arm64: Add helpers to decode and encode branch instructions") Signed-off-by: Edgar E. Iglesias Reviewed-by: Stefano Stabellini (cherry picked from commit 65a99a4063ccac92237f6d2cd45cb94b5574baa9) --- xen/arch/arm/arm64/insn.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/arm64/insn.c b/xen/arch/arm/arm64/insn.c index 81f7914610..6b97a84ba7 100644 --- a/xen/arch/arm/arm64/insn.c +++ b/xen/arch/arm/arm64/insn.c @@ -225,22 +225,22 @@ u32 __kprobes aarch64_insn_gen_nop(void) */ int32_t aarch64_get_branch_offset(uint32_t insn) { - int32_t imm; + uint32_t imm; if (aarch64_insn_is_b(insn) || aarch64_insn_is_bl(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_26, insn); - return (imm << 6) >> 4; + return (int32_t)(imm << 6) >> 4; } if (aarch64_insn_is_cbz(insn) || aarch64_insn_is_cbnz(insn) || aarch64_insn_is_bcond(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_19, insn); - return (imm << 13) >> 11; + return (int32_t)(imm << 13) >> 11; } if (aarch64_insn_is_tbz(insn) || aarch64_insn_is_tbnz(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_14, insn); - return (imm << 18) >> 16; + return (int32_t)(imm << 18) >> 16; } /* Unhandled instruction */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:22:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:22:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362877.1614601 (Exim 4.92) (envelope-from ) id 1wjwlS-0002UR-FI; Wed, 15 Jul 2026 10:22:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362877.1614601; Wed, 15 Jul 2026 10:22:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlS-0002UJ-CA; Wed, 15 Jul 2026 10:22:54 +0000 Received: by outflank-mailman (input) for mailman id 1362877; Wed, 15 Jul 2026 10:22:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlR-0002UC-7p for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwlR-007cfK-1Z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwlR-001Uck-0X for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:22:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ALtABP5Ui383B1syHe1Swd+Sr4sGcf51l4p4Jdr8BYo=; b=u0Q2DZti13yrJsgXtkrHE+KRiK mXtIc7ew5lmNGM/JOFnrkX6Mh2GsZds7hyHAkC1JqMoKENOg2klm5FYvGyjeJmidf7vqQmLtD69/A BF0sbNxHqJK4yI0koEzK6XAIyGfNGDGvekMf4NA+XP1mVudq9grcWWo5D/n90xuHQOzs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v2: disable interrupt bypass on CPU shutdown Message-Id: Date: Wed, 15 Jul 2026 10:22:53 +0000 commit 715bf77ce1741e01dfd51c7e5c3e354126d5a839 Author: Mykola Kvach AuthorDate: Tue Apr 28 14:57:55 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v2: disable interrupt bypass on CPU shutdown The GICv2 CPU shutdown path currently writes 0 to GICC_CTLR. Per IHI0048B.b section 2.3.1, clearing the architected bypass-disable bits selects bypass rather than deasserted interrupt outputs when the CPU interface stops driving them. Tables 2-2 and 2-3 show that a zeroed GICC_CTLR can fall back to the legacy IRQ/FIQ inputs instead of fully disabling the interface. Fix this by reading GICC_CTLR, then setting the bypass-disable bits and clearing the group-enable bits that are architecturally defined for the current GICC_CTLR view before writing the value back. When Security Extensions are implemented Xen accesses the Non-secure copy of GICC_CTLR, where IRQBypDisGrp1 and FIQBypDisGrp1 are at bits [6:5] and bits [8:7] are reserved. Without Security Extensions (GICD_CTLR.DS=1), GICD_IGROUPR is RAZ/WI and all interrupts are Group 0, so clearing EnableGrp0 alone is sufficient to stop interrupt delivery through the CPU interface. Section 2.3.2 also states that wakeup event signals remain available even when both GIC interrupt signaling and interrupt bypass are disabled, so disabling bypass does not break the power-management use case, i.e. suspend modes. Fixes: 5e40a1b4351e ("arm: SMP CPU shutdown") Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Reviewed-by: Michal Orzel (cherry picked from commit 6f00fd9d6c1d6f08ab21f16c0406b3bb2c1e3b01) --- xen/arch/arm/gic-v2.c | 12 +++++++++++- xen/arch/arm/include/asm/gic.h | 25 +++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index 014f955967..43a379fdda 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -408,7 +408,17 @@ static void gicv2_cpu_init(void) static void gicv2_cpu_disable(void) { - writel_gicc(0x0, GICC_CTLR); + uint32_t ctlr = readl_gicc(GICC_CTLR); + + if ( readl_gicd(GICD_TYPER) & GICD_TYPE_SEC ) + ctlr |= GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK; + else + ctlr |= GICC_CTLR_BYPASS_DISABLE_GRP0_MASK | + GICC_CTLR_BYPASS_DISABLE_GRP1_MASK; + + ctlr &= ~GICC_CTL_ENABLE; + + writel_gicc(ctlr, GICC_CTLR); } static void gicv2_hyp_init(void) diff --git a/xen/arch/arm/include/asm/gic.h b/xen/arch/arm/include/asm/gic.h index 3947c8634d..8ea256ecc6 100644 --- a/xen/arch/arm/include/asm/gic.h +++ b/xen/arch/arm/include/asm/gic.h @@ -102,8 +102,29 @@ #define GICD_TYPE_SEC 0x400 #define GICD_TYPER_DVIS (1U << 18) -#define GICC_CTL_ENABLE 0x1 -#define GICC_CTL_EOI (0x1 << 9) +/* + * Xen runs in the Non-secure world. When Security Extensions are present, + * Xen accesses the Non-secure GICC_CTLR view, where bit[0] is EnableGrp1 + * and bits[6:5] are the Group 1 bypass-disable bits. Otherwise Xen sees the + * common GICC_CTLR layout, where bit[0] is EnableGrp0, bit[1] is EnableGrp1, + * bits[6:5] are the Group 0 bypass-disable bits, and bits[8:7] are the + * Group 1 bypass-disable bits. + */ +#define GICC_CTL_ENABLE (0x1 << 0) +#define GICC_CTL_ENABLE_GRP1 (0x1 << 1) +#define GICC_CTL_FIQBypDisGrp0 (0x1 << 5) +#define GICC_CTL_IRQBypDisGrp0 (0x1 << 6) +#define GICC_CTL_FIQBypDisGrp1 (0x1 << 7) +#define GICC_CTL_IRQBypDisGrp1 (0x1 << 8) + +#define GICC_CTLR_BYPASS_DISABLE_GRP0_MASK \ + (GICC_CTL_FIQBypDisGrp0 | GICC_CTL_IRQBypDisGrp0) +#define GICC_CTLR_BYPASS_DISABLE_GRP1_MASK \ + (GICC_CTL_FIQBypDisGrp1 | GICC_CTL_IRQBypDisGrp1) +#define GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK \ + GICC_CTLR_BYPASS_DISABLE_GRP0_MASK + +#define GICC_CTL_EOI (0x1 << 9) #define GICC_IA_IRQ 0x03ff #define GICC_IA_CPU_MASK 0x1c00 -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362878.1614604 (Exim 4.92) (envelope-from ) id 1wjwlc-0002WK-G5; Wed, 15 Jul 2026 10:23:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362878.1614604; Wed, 15 Jul 2026 10:23:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlc-0002WC-DY; Wed, 15 Jul 2026 10:23:04 +0000 Received: by outflank-mailman (input) for mailman id 1362878; Wed, 15 Jul 2026 10:23:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlb-0002W5-Ao for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwlb-007cfn-1s for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwlb-001Uha-0r for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OZUhaRLdhZX4u6bXtbwt4yuDmklPiTZSpk5msSp94VE=; b=A/oZKBxkpbFS9YMQ/FD2YVfqEs +4xBc297x1z5SrBsNDJqrcTW9iqABCBhIj+I2DRxB9g9UnziN5VrsSFYsOzAQfyIWjODc6dCMfYUx X08Qva6DsnBxlthgjhO/8N/goEHjL6cJk5Pp7pJ/EmmpEYFyPGWa1U3kkzYoZHExuets=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: sci: Don't create a domain with unsatisfied user requests Message-Id: Date: Wed, 15 Jul 2026 10:23:03 +0000 commit 483a3035fd6bdb7933ff2bb6d2d58d10af97393c Author: Michal Orzel AuthorDate: Tue May 12 09:52:55 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: sci: Don't create a domain with unsatisfied user requests On Arm we stay on the safe side and refuse to create a domain on user requests (e.g. via xl.cfg, DT options) that cannot be satisfied due to the feature not being compiled in. SCI fall through the crack and does not adhere to that i.e. a user request for SCI type other than NONE when CONFIG_SCMI_SMC (and thus CONFIG_ARM_SCI) is not set would be silently ignored. Fix it by not allowing anything else other than NONE if the feature is not enabled. Fixes: 10e7473d6024 ("xen/arm: scmi-smc: passthrough SCMI SMC to domain, single agent") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Bertrand Marquis (cherry picked from commit f7b9752dc88c626192d3115ace7585b20a025433) --- xen/arch/arm/dom0less-build.c | 11 +++++++++-- xen/arch/arm/include/asm/firmware/sci.h | 5 +++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/dom0less-build.c b/xen/arch/arm/dom0less-build.c index 4181c10538..f7f8a86b30 100644 --- a/xen/arch/arm/dom0less-build.c +++ b/xen/arch/arm/dom0less-build.c @@ -287,8 +287,7 @@ static int __init domu_dt_sci_parse(struct dt_device_node *node, d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_NONE; - if ( !IS_ENABLED(CONFIG_ARM_SCI) || - !dt_property_read_bool(node, "xen,sci_type") ) + if ( !dt_property_read_bool(node, "xen,sci_type") ) return 0; ret = dt_property_read_string(node, "xen,sci_type", &sci_type); @@ -298,7 +297,15 @@ static int __init domu_dt_sci_parse(struct dt_device_node *node, if ( !strcmp(sci_type, "none") ) d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_NONE; else if ( !strcmp(sci_type, "scmi_smc") ) + { + if ( !IS_ENABLED(CONFIG_SCMI_SMC) ) + { + printk(XENLOG_ERR "xen,sci_type=scmi_smc requested, but CONFIG_SCMI_SMC not set\n"); + return -EINVAL; + } + d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_SCMI_SMC; + } else { printk(XENLOG_ERR "xen,sci_type in not valid (%s) for domain %s\n", diff --git a/xen/arch/arm/include/asm/firmware/sci.h b/xen/arch/arm/include/asm/firmware/sci.h index 3500216bc2..485ce211c9 100644 --- a/xen/arch/arm/include/asm/firmware/sci.h +++ b/xen/arch/arm/include/asm/firmware/sci.h @@ -148,6 +148,8 @@ int sci_dt_finalize(struct domain *d, void *fdt); int sci_assign_dt_device(struct domain *d, struct dt_device_node *dev); #else +#include + static inline bool sci_domain_is_enabled(struct domain *d) { return false; @@ -162,6 +164,9 @@ static inline int sci_domain_init(struct domain *d, static inline int sci_domain_sanitise_config(struct xen_domctl_createdomain *config) { + if ( config->arch.arm_sci_type != XEN_DOMCTL_CONFIG_ARM_SCI_NONE ) + return -EINVAL; + return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362879.1614607 (Exim 4.92) (envelope-from ) id 1wjwln-0002YD-HI; Wed, 15 Jul 2026 10:23:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362879.1614607; Wed, 15 Jul 2026 10:23:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwln-0002Y5-Eq; Wed, 15 Jul 2026 10:23:15 +0000 Received: by outflank-mailman (input) for mailman id 1362879; Wed, 15 Jul 2026 10:23:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwll-0002Xy-Nf for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwll-007cfr-37 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwll-001Uvd-1x for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UGR+V5mWie0vkf6Ors0fgLUMKn8HFvDbxyvMQ5OAEqc=; b=oSgftsKWzyzb4OfS5TGDRvbWLn 69ER9DuwayWEgP1wqAVF5vRUFcfCRMtPt7CSM6Gbht7HdgJWuHwR/QuEmXa9/0B830cv0bu/IP9XO Gy7NAqmavG+5cDBtz4MFlrt7M2qakrcRnXTv5ijW5EIN27EjVI3VM1aX0CDAmfJCYD6I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen: arm: fix len type for guest copy functions Message-Id: Date: Wed, 15 Jul 2026 10:23:13 +0000 commit f593155e7c73b8d074ce37212841368321e22ec8 Author: Oleksii Kurochko AuthorDate: Thu May 7 10:58:40 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen: arm: fix len type for guest copy functions Widen the len argument of copy_to_guest_phys_flush_dcache() and the copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as the function can be used to copy large blobs such as the initrd which may exceed 4GB. Update the internal copy_guest() len argument to unsigned long accordingly. Change the type for local variable size in copy_guest() to avoid compilation error because of type mismatch. raw_* wrappers above copy_guest() keep returning unsigned long to avoid type narrowing; it is not an issue for raw_*'s len argument to remain 'unsigned int' since the assignment to copy_guest()'s wider unsigned long parameter is safe and there is no raw_* users who are using a value bigger than what can fit into 'unsigned int'. Fixes: 2986481b3d9e6 ("xen/arm: guest_copy: Extend the prototype to pass the vCPU") Fixes: 5302bd490bea7 ("xen/arm: Introduce copy_to_guest_phys_flush_dcache") Fixes: d07b7369aa65b ("xen/common: dom0less: introduce common domain-build.c") Reported-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Luca Fancellu Acked-by: Michal Orzel (cherry picked from commit e4424b9a635623b247a9a070db1238bf93f94764) --- xen/arch/arm/guestcopy.c | 6 +++--- xen/arch/arm/include/asm/guest_access.h | 2 +- xen/include/xen/fdt-domain-build.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c index 497e785ec4..a257bee3e4 100644 --- a/xen/arch/arm/guestcopy.c +++ b/xen/arch/arm/guestcopy.c @@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t info, uint64_t addr, return page; } -static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, +static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len, copy_info_t info, unsigned int flags) { /* XXX needs to handle faults */ @@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, while ( len ) { void *p; - unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset); + unsigned long size = min(len, PAGE_SIZE + 0UL - offset); struct page_info *page; page = translate_get_page(info, addr, flags & COPY_linear, @@ -136,7 +136,7 @@ unsigned long raw_copy_from_guest(void *to, const void __user *from, unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len) + unsigned long len) { return copy_guest(buf, gpa, len, GPA_INFO(d), COPY_to_guest | COPY_ipa | COPY_flush_dcache); diff --git a/xen/arch/arm/include/asm/guest_access.h b/xen/arch/arm/include/asm/guest_access.h index 18c88b70d7..c13cbec55b 100644 --- a/xen/arch/arm/include/asm/guest_access.h +++ b/xen/arch/arm/include/asm/guest_access.h @@ -14,7 +14,7 @@ unsigned long raw_clear_guest(void *to, unsigned int len); unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); int access_guest_memory_by_gpa(struct domain *d, paddr_t gpa, void *buf, uint32_t size, bool is_write); diff --git a/xen/include/xen/fdt-domain-build.h b/xen/include/xen/fdt-domain-build.h index 886a853816..1d9e77df0e 100644 --- a/xen/include/xen/fdt-domain-build.h +++ b/xen/include/xen/fdt-domain-build.h @@ -47,7 +47,7 @@ static inline int get_allocation_size(paddr_t size) typedef unsigned long (*copy_to_guest_phys_cb)(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); void initrd_load(struct kernel_info *kinfo, copy_to_guest_phys_cb cb); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362880.1614612 (Exim 4.92) (envelope-from ) id 1wjwlx-0002aB-Ie; Wed, 15 Jul 2026 10:23:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362880.1614612; Wed, 15 Jul 2026 10:23:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlx-0002a3-G9; Wed, 15 Jul 2026 10:23:25 +0000 Received: by outflank-mailman (input) for mailman id 1362880; Wed, 15 Jul 2026 10:23:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwlw-0002Zw-3Y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwlw-007cgH-19 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwlv-001VcT-3B for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=nQsOvMzqCh/iaDJxTwIA6gIEZcGwmG0j6JU549pXhxg=; b=pgCuwjhq4QTwBcTNBKyXpVbDJ0 9UlfHNexI4ZSITyjKa98RTK8AQSq3b1P0Ta6q/ZPsK3LM7b/ggFKShlD97AZF45qJOaSoR1ba676a JUSxfNOxNVwwS1tabGcn8mKTrKci/sxYLZF3gtP4svHANunwAgBNSwscpyu3hYsnuVcc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v3: Wait for redistributor RWP using the right bit Message-Id: Date: Wed, 15 Jul 2026 10:23:23 +0000 commit 08156620f12e03aa63876544cefcd635062fc62e Author: Mykola Kvach AuthorDate: Thu May 14 12:08:13 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Wait for redistributor RWP using the right bit gicv3_do_wait_for_rwp() is used for both distributor and redistributor writes. The CTLR register is at offset 0 for both, but the RWP bit is not in the same position. For GICD_CTLR, RWP is bit 31. For GICR_CTLR, bit 31 is UWP, while RWP is bit 3. The redistributor wait path was therefore polling UWP instead of RWP. UWP covers upstream writes, including Generate SGI packets, and is not a substitute for redistributor register write completion. The existing redistributor callers need RWP semantics for redistributor register writes such as GICR_ICENABLER0 and GICR_CTLR updates. Add GICR_CTLR_RWP and pass the expected RWP bit to the shared helper. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Reported-by: Luca Fancellu Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit d86cf3cbd4ad105c00e12b0d51646049a87f1c44) --- xen/arch/arm/gic-v3.c | 14 +++++++++----- xen/arch/arm/include/asm/gic_v3_defs.h | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 7f365cdbe9..dfd5d44603 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -274,16 +274,20 @@ static void gicv3_enable_sre(void) isb(); } -/* Wait for completion of a distributor change */ -static void gicv3_do_wait_for_rwp(void __iomem *base) +/* Wait for completion of a distributor/redistributor change */ +static void gicv3_do_wait_for_rwp(void __iomem *base, uint32_t rwp_bit) { uint32_t val; bool timeout = false; s_time_t deadline = NOW() + MILLISECS(1000); do { + /* + * GICD_CTLR and GICR_CTLR are both at offset 0, so this is + * valid for either a distributor or redistributor base. + */ val = readl_relaxed(base + GICD_CTLR); - if ( !(val & GICD_CTLR_RWP) ) + if ( !(val & rwp_bit) ) break; if ( NOW() > deadline ) { @@ -300,12 +304,12 @@ static void gicv3_do_wait_for_rwp(void __iomem *base) static void gicv3_dist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD); + gicv3_do_wait_for_rwp(GICD, GICD_CTLR_RWP); } static void gicv3_redist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD_RDIST_BASE); + gicv3_do_wait_for_rwp(GICD_RDIST_BASE, GICR_CTLR_RWP); } static void gicv3_wait_for_rwp(int irq) diff --git a/xen/arch/arm/include/asm/gic_v3_defs.h b/xen/arch/arm/include/asm/gic_v3_defs.h index c373b94d19..3714cfeb7d 100644 --- a/xen/arch/arm/include/asm/gic_v3_defs.h +++ b/xen/arch/arm/include/asm/gic_v3_defs.h @@ -146,6 +146,7 @@ #define GICR_NSACR (0x0E00) #define GICR_CTLR_ENABLE_LPIS (1U << 0) +#define GICR_CTLR_RWP (1U << 3) #define GICR_TYPER_PLPIS (1U << 0) #define GICR_TYPER_VLPIS (1U << 1) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362881.1614616 (Exim 4.92) (envelope-from ) id 1wjwm7-0002cE-KQ; Wed, 15 Jul 2026 10:23:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362881.1614616; Wed, 15 Jul 2026 10:23:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwm7-0002c4-HV; Wed, 15 Jul 2026 10:23:35 +0000 Received: by outflank-mailman (input) for mailman id 1362881; Wed, 15 Jul 2026 10:23:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwm6-0002br-8E for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwm6-007cgL-1d for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwm6-001VpT-0d for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:34 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JKjSfAq+z/Y6KbnEUUOVEJf24IhYLUOdryBWFgKIPCE=; b=ykjEBAE4U4Nx8f+GGWUbWOFCoR n06s7ljv4q3B7OXWo+1D5+KSoJtRCr+VHI6JuPWgIMGCgmaIA/ScucjEQ6Z15EHORwnlqFoOmmW8Q LmrX38v5lVzoLK8IR8WyV5STSrUyUYGcen6EMP/FQOvhADm05KJA4sM88RlHAGz3gz5I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor Message-Id: Date: Wed, 15 Jul 2026 10:23:34 +0000 commit 20c5792dc96ed2ae55784b4b761c4233135d308d Author: Mykola Kvach AuthorDate: Tue May 19 17:31:54 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor gicv3_dist_init() disables the distributor before reprogramming the global interrupt state. It used to do this by writing 0 to GICD_CTLR. On a system where firmware has already enabled Non-secure affinity routing, a zero write clears the Non-secure view's GICD_CTLR.ARE_NS bit. Arm IHI 0069H.b, section 2.3.3 ("Changing affinity routing enables"), states that changing GICD_CTLR.ARE_NS from 1 to 0 is UNPREDICTABLE. The GICD_CTLR register description in section 12.9.4 carries the same rule for the ARE_NS field. Preserve ARE_NS while clearing the group enable bits. If firmware left ARE_NS clear, the value written is still 0, preserving the existing initialization flow. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel Reviewed-by: Luca Fancellu Release-Acked-by: Oleksii Kurochko (cherry picked from commit e63ba93511b33c0d3bb8cc5870f946f41e1d2655) --- xen/arch/arm/gic-v3.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index dfd5d44603..194a984f0b 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -749,12 +749,17 @@ static void __init gicv3_dist_espi_init_aff(uint64_t affinity) { } static void __init gicv3_dist_init(void) { uint32_t type; + uint32_t ctlr; uint64_t affinity; unsigned int nr_lines; int i; - /* Disable the distributor */ - writel_relaxed(0, GICD + GICD_CTLR); + /* + * Disable the distributor without clearing ARE_NS. The GIC architecture + * makes changing ARE_NS from 1 to 0 UNPREDICTABLE. + */ + ctlr = readl_relaxed(GICD + GICD_CTLR); + writel_relaxed(ctlr & GICD_CTLR_ARE_NS, GICD + GICD_CTLR); type = readl_relaxed(GICD + GICD_TYPER); nr_lines = 32 * ((type & GICD_TYPE_LINES) + 1); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362883.1614620 (Exim 4.92) (envelope-from ) id 1wjwmH-0002eg-Mo; Wed, 15 Jul 2026 10:23:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362883.1614620; Wed, 15 Jul 2026 10:23:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmH-0002eY-KL; Wed, 15 Jul 2026 10:23:45 +0000 Received: by outflank-mailman (input) for mailman id 1362883; Wed, 15 Jul 2026 10:23:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmG-0002eQ-B6 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwmG-007cgQ-1u for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwmG-001VuV-0v for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=cC/wC5A4XPvJRzu1CCIqYuEj70ZSx7tp2oGqgb43ZuY=; b=OaXplNZS5UpOr2RpFI2JavUFAf 6v1DhHFm/2Q/3qzRorV3vPrXZzAou2mvcXIEVz4QnQh2TKd1/uT2Cp8MH1Dav5io2fkO0JSlpadYE 4FbMuZSjhSFDB4KEtUFLGPvCMSUX8Lh7EA1tybUiAcWAwGrNAqloaelCuDqRq6Np/dOw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: propagate vGIC vCPU init failures Message-Id: Date: Wed, 15 Jul 2026 10:23:44 +0000 commit 3322c7355be21278a59e7a8dffd74c5a4c8ba04d Author: Mykola Kvach AuthorDate: Wed May 27 03:18:50 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: propagate vGIC vCPU init failures The vGIC per-vCPU init callback can fail. In particular, GICv3 rejects a vCPU when the domain's redistributor layout has no MMIO slot covering that vCPU. However, the generic vGIC init path ignored the callback return value, so vcpu_create() could succeed with an invalid vGICv3 per-vCPU state. This can be reproduced on FVP Base RevC by exposing a 2 MiB GICv3 redistributor region to Dom0 and booting Xen with: maxcpus=1 dom0_max_vcpus=64 The host GICv3 redistributor range is: region 0: 0x0000002f100000 - 0x0000002f300000 With Xen's guest redistributor frame size of 128 KiB, that range covers 16 guest redistributors. vCPU16 and above have no corresponding redistributor slot. Before this fix, Xen detected the missing redistributors: d0: Unable to find a re-distributor for VCPU 16 ... d0: Unable to find a re-distributor for VCPU 63 but ignored the error and continued as if the secondary vCPUs had been created correctly. Dom0 then saw 64 possible CPUs and could hang during secondary CPU bring-up: smp: Bringing up secondary CPUs ... d0v15: vGICR: SGI: unhandled word write ... to ICACTIVER0 Propagate the vGIC vcpu_init() error so the caller can stop creating secondary vCPUs. With this fix, Dom0 construction reports: d0: Unable to find a re-distributor for VCPU 16 Failed to allocate d0v16 and the guest continues booting with the vCPUs created before the failure: smp: Brought up 1 node, 16 CPUs Free the private IRQ rank allocated by vcpu_vgic_init() on this error path. The caller will still run the generic vCPU creation cleanup, but XFREE() clears the pointer so that cleanup remains idempotent. Also fix the host-layout redistributor region count for the case where the requested vCPU count is larger than the capacity of all host redistributor regions. The old code always stored i + 1 after the loop. That is correct when the loop stops inside a valid region because the requested vCPU count is covered. If the loop exits after consuming all hardware regions, i is already equal to the number of allocated regions, so i + 1 records one region too many. In the same FVP setup, that off-by-one made Xen describe host-layout GICR state beyond the populated redistributor region list. Dom0 then accessed the GICR MMIO window described in its device tree, but Xen could not match the access to a valid emulated redistributor frame. During debugging this was seen as an unexpected vGICR access followed by a guest panic: d0v0: vGICR: unknown gpa read address 000000002f10ffe8 pc : gic_iterate_rdists+0x4c/0x104 Kernel panic - not syncing: Attempted to kill the idle task! Keep the existing construct_domain() policy used by Dom0 and dom0less domain construction: a failure to create a secondary vCPU stops the secondary vCPU creation loop, but does not fail the whole domain construction. Fixes: ea37fd21110b ("xen/arm: split vgic driver into generic and vgic-v2 driver") Fixes: 54ec59f6b0b3 ("xen/arm: vgic-v3: Don't create empty re-distributor regions") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 961cc8cc0febcd8b2e515c7896a076a3246d06b1) --- xen/arch/arm/vgic-v3.c | 2 +- xen/arch/arm/vgic.c | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index 8b1c8eef80..fbd2c395c0 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1824,7 +1824,7 @@ static int vgic_v3_domain_init(struct domain *d) * not match the number of pCPUs). Update the number of regions to * avoid exposing unused region as they will not get emulated. */ - d->arch.vgic.nr_regions = i + 1; + d->arch.vgic.nr_regions = min(i + 1U, vgic_v3_hw.nr_rdist_regions); d->arch.vgic.intid_bits = vgic_v3_hw.intid_bits; } diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c index 3ebdf9953f..edabf28903 100644 --- a/xen/arch/arm/vgic.c +++ b/xen/arch/arm/vgic.c @@ -368,7 +368,7 @@ void domain_vgic_free(struct domain *d) int vcpu_vgic_init(struct vcpu *v) { - int i; + int i, ret; v->arch.vgic.private_irqs = xzalloc(struct vgic_irq_rank); if ( v->arch.vgic.private_irqs == NULL ) @@ -377,7 +377,12 @@ int vcpu_vgic_init(struct vcpu *v) /* SGIs/PPIs are always routed to this VCPU */ vgic_rank_init(v->arch.vgic.private_irqs, 0, v->vcpu_id); - v->domain->arch.vgic.handler->vcpu_init(v); + ret = v->domain->arch.vgic.handler->vcpu_init(v); + if ( ret ) + { + XFREE(v->arch.vgic.private_irqs); + return ret; + } memset(&v->arch.vgic.pending_irqs, 0, sizeof(v->arch.vgic.pending_irqs)); for (i = 0; i < 32; i++) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:23:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:23:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362884.1614624 (Exim 4.92) (envelope-from ) id 1wjwmR-0002gp-OH; Wed, 15 Jul 2026 10:23:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362884.1614624; Wed, 15 Jul 2026 10:23:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmR-0002gi-Le; Wed, 15 Jul 2026 10:23:55 +0000 Received: by outflank-mailman (input) for mailman id 1362884; Wed, 15 Jul 2026 10:23:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmQ-0002ga-Dd for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwmQ-007cgU-2A for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwmQ-001W3l-1B for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:23:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=l1LcafdBKdubl9vY8BLchXMzLSNxt82BOF0au2l9eWU=; b=MrW4/ZZ4zM6XSWqXbYjLRTY+dA cVqUFkHZ0wqfGtIhQgny171ICkrwQJDyCQf7M3go97ACAsfu06Ou4ryhTdl4YOqkp6irUGOT4HbGS pZf7rtCaBgFzGDG6sfMoPc+h5Y2gaaAqjwoC5gcHyjoqUaOHTX56sEWMF6RmBYsNraDk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: gic-v3: Fix redistributor wakeup polling Message-Id: Date: Wed, 15 Jul 2026 10:23:54 +0000 commit 530406cf21c0b7271797ee6d68375eca2fd5adf5 Author: Luca Fancellu AuthorDate: Mon May 18 08:05:24 2026 +0100 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Fix redistributor wakeup polling gicv3_enable_redist() clears GICR_WAKER.ProcessorSleep and then waits for GICR_WAKER.ChildrenAsleep to clear, as required after waking a redistributor. However, the polling loop currently uses "while ( timeout )". Since timeout is initially false, the loop runs only once unless the timeout path has already been reached. As a result, Xen can continue before the redistributor has completed wakeup. Use an unconditional loop, matching the surrounding timeout/break pattern, so the code polls until either ChildrenAsleep is clear or the deadline is reached. While there, also fix the timeout message. This path polls GICR_WAKER.ChildrenAsleep, not an RWP bit, so "RWP timeout" is misleading. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Luca Fancellu Reviewed-by: Mykola Kvach Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit 941fdfc03e109a28ca9cfe71c111a1ef6cb9ed12) --- xen/arch/arm/gic-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 194a984f0b..17ff85ef5d 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -837,11 +837,11 @@ static int gicv3_enable_redist(void) } cpu_relax(); udelay(1); - } while ( timeout ); + } while ( 1 ); if ( timeout ) { - dprintk(XENLOG_ERR, "GICv3: Redist enable RWP timeout\n"); + dprintk(XENLOG_ERR, "GICv3: Redist wakeup timeout\n"); return 1; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362885.1614627 (Exim 4.92) (envelope-from ) id 1wjwmc-0002io-Pe; Wed, 15 Jul 2026 10:24:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362885.1614627; Wed, 15 Jul 2026 10:24:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmc-0002ig-NB; Wed, 15 Jul 2026 10:24:06 +0000 Received: by outflank-mailman (input) for mailman id 1362885; Wed, 15 Jul 2026 10:24:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwma-0002iY-Qe for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwmb-007cgm-0F for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwma-001WUJ-2E for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3cmyCRiiIZ4E+KUgE0vfLtUrxdnNM5iRSzWB7gmtkaA=; b=f++WS/yx/7yjrZ6GzlUlI76Lgk aSB/LNKPcSskryPMwi30xhm6UxFZmD6MpHEOcplz2D+UrUJaQN5l9WgmBGNEm1vh+X0jwPSVDp0dn JdKhoKWvi0R8uELe9IWbDSeCstbv4itg5ZyLs/PNEVSLTx74sfbzpppsWQQUh67zVhF8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] libfdt: fix UBSAN null pointer in fdt_property() Message-Id: Date: Wed, 15 Jul 2026 10:24:04 +0000 commit 60fc5ccb810d28adc53186587308389a131a821e Author: Oleksii Kurochko AuthorDate: Wed Jun 17 09:20:51 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 libfdt: fix UBSAN null pointer in fdt_property() fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit be18ad502e5d4f9248e1f020d3e0d55a7b9ea986) --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb..96d4cf5713 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len) ret = fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362886.1614632 (Exim 4.92) (envelope-from ) id 1wjwmm-0002kk-RL; Wed, 15 Jul 2026 10:24:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362886.1614632; Wed, 15 Jul 2026 10:24:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmm-0002kc-Oh; Wed, 15 Jul 2026 10:24:16 +0000 Received: by outflank-mailman (input) for mailman id 1362886; Wed, 15 Jul 2026 10:24:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwml-0002kV-1U for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwml-007cgr-0x for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:15 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwmk-001WnC-3B for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Hv6+vGgAQMCjygAe8V5HT54j4BtgHIXu54k71QRe3Os=; b=7Av2rbgVmEBq5c6IKSPx6wOQAV Svp9oFlRk24nda8Ffo1I0RzZhTFcHZ9HFGgBQIanxeeC9U271CO7bKJXQZzdrwOlrrzQjxEp97H5u dnxy6EJhRo9a86lLQl9pkl69AxRQcTI36SHxr4kV4jhtU+rXCl9ZIhyF8caqOIgGhLiQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] bootfdt: Fix infinite loop in device_tree_for_each_node() Message-Id: Date: Wed, 15 Jul 2026 10:24:14 +0000 commit a455b73ddba951f0a3534612159ddcc0d7c46e0f Author: Dmytro Prokopchuk1 AuthorDate: Fri Jun 26 07:57:33 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 bootfdt: Fix infinite loop in device_tree_for_each_node() When a node's depth exceeds DEVICE_TREE_MAX_DEPTH inside the device_tree_for_each_node() loop, the code prints a warning and executes 'continue;' statement, which jumps to condition check, bypassing the iterator update step: node = fdt_next_node(fdt, node, &depth). The node and depth are not updated, the loop repeatedly evaluates the same too-deep node, causing a hang. Fix this by wrapping the node processing logic in an 'else' block. This ensures the loop update step is executed on every iteration, safely skipping deeply nested nodes and doing the traversal. Fixes: 40f2ea3df2e2 ("xen/arm: pass node to device_tree_for_each_node") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleskii Kurochko (cherry picked from commit 3b717f57dca508f546303dd34067b7b906ba459e) --- xen/common/device-tree/bootfdt.c | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/xen/common/device-tree/bootfdt.c b/xen/common/device-tree/bootfdt.c index 7c790b9a4d..8e9b45d1a7 100644 --- a/xen/common/device-tree/bootfdt.c +++ b/xen/common/device-tree/bootfdt.c @@ -90,23 +90,28 @@ int __init device_tree_for_each_node(const void *fdt, int node, { printk("Warning: device tree node `%s' is nested too deep\n", name); - continue; } - - as = depth > 0 ? address_cells[depth-1] : DT_ROOT_NODE_ADDR_CELLS_DEFAULT; - ss = depth > 0 ? size_cells[depth-1] : DT_ROOT_NODE_SIZE_CELLS_DEFAULT; - - address_cells[depth] = device_tree_get_u32(fdt, node, - "#address-cells", as); - size_cells[depth] = device_tree_get_u32(fdt, node, - "#size-cells", ss); - - /* skip the first node */ - if ( node != first_node ) + else { - ret = func(fdt, node, name, depth, as, ss, data); - if ( ret != 0 ) - return ret; + as = depth > 0 ? + address_cells[depth - 1] : + DT_ROOT_NODE_ADDR_CELLS_DEFAULT; + ss = depth > 0 ? + size_cells[depth - 1] : + DT_ROOT_NODE_SIZE_CELLS_DEFAULT; + + address_cells[depth] = device_tree_get_u32(fdt, node, + "#address-cells", as); + size_cells[depth] = device_tree_get_u32(fdt, node, + "#size-cells", ss); + + /* skip the first node */ + if ( node != first_node ) + { + ret = func(fdt, node, name, depth, as, ss, data); + if ( ret != 0 ) + return ret; + } } node = fdt_next_node(fdt, node, &depth); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362887.1614636 (Exim 4.92) (envelope-from ) id 1wjwmw-0002mj-Sp; Wed, 15 Jul 2026 10:24:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362887.1614636; Wed, 15 Jul 2026 10:24:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmw-0002mZ-QF; Wed, 15 Jul 2026 10:24:26 +0000 Received: by outflank-mailman (input) for mailman id 1362887; Wed, 15 Jul 2026 10:24:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwmv-0002mS-4P for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwmv-007chD-1E for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwmv-001WtD-0E for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+ObmsLGkR1orz4qDs7o9HH1UX5G+UyDaVUIxc4oTYOk=; b=bSXU/5IrhzqZV0M/K4jYW0Bx7T Ar0OIvDv3ipy9UZlJARpHR1Bqg6SY5dUOZ/etxtUyY/RSWY4WysZiLnOMpEDWzWCgZpgLuCxxumPB Mu+l5PVSGBVg79LzILHsAJMVx+U//fqWjxBlbgomUBPHPHEotlZ5wpX1AjhP6eCdt3q4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 15 Jul 2026 10:24:25 +0000 commit f53ec9edb64c0bcad21540fffd44c9b747e3d861 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel (cherry picked from commit ccde3773c1762d32fb5f6037d6b22780c30895d3) --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 7f3cfa812e..ba5fd2dd52 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -238,7 +238,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -251,10 +253,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362888.1614640 (Exim 4.92) (envelope-from ) id 1wjwn6-0002oe-UF; Wed, 15 Jul 2026 10:24:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362888.1614640; Wed, 15 Jul 2026 10:24:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwn6-0002oU-Rd; Wed, 15 Jul 2026 10:24:36 +0000 Received: by outflank-mailman (input) for mailman id 1362888; Wed, 15 Jul 2026 10:24:35 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwn5-0002oN-6s for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwn5-007chH-1V for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwn5-001Wxo-0W for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=fqse+HYVwORC3KHBwPt9Fd/sUAagDNI6gzIJa0NOUms=; b=KFgUCG6Yf06rHOeKMArXhy/kcv iB0+zKFWCDGXmMlY2UVy8n86S+RvAKmdNMgpRj13SPOQe8yOAMFRzmLHt/34ajsplNq03NIfZsIeT MHyfLRTvhLYFpLz0/FSiqD1daJr3j+HSO62j8Sf4duA/qfDZjJ8HgK8YwWvVXGl8lfgs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Wed, 15 Jul 2026 10:24:35 +0000 commit f26f5e83521bc6ed942f32787b4389635c622a8d Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:50:16 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 3c808e2c07..2a4c3dcae7 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1947,7 +1947,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:47 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:47 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362889.1614644 (Exim 4.92) (envelope-from ) id 1wjwnG-0002qp-Vu; Wed, 15 Jul 2026 10:24:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362889.1614644; Wed, 15 Jul 2026 10:24:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnG-0002qh-Sy; Wed, 15 Jul 2026 10:24:46 +0000 Received: by outflank-mailman (input) for mailman id 1362889; Wed, 15 Jul 2026 10:24:45 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnF-0002qH-JH for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:45 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwnF-007chN-2j for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:45 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwnF-001XEe-1V for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:45 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=n8wY2C5XCxy6eNID+zVTcCWwFMREor1pbVfUGHt2SUE=; b=DVpAX2a1akMpEW/YZw5fE32eNC PK2BrnBtM3DbWKe5gUZC+DOZ1uPbIBKNVrOEv0dQSib03UyvQJQiMGrvVPssDz7S6bNLfduaHmxzH ZjLicV9N70UIoK2gANHZptwSxbCq6giQP0WhT14r7DukRnhKP6lGuMWF0/G8TpL1RwcU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Wed, 15 Jul 2026 10:24:45 +0000 commit 137827d858090851cfbb3cd81e8133bca9485354 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:50:49 2026 +0200 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index 9fd004c42a..e4d5e95c6e 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:24:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:24:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362890.1614647 (Exim 4.92) (envelope-from ) id 1wjwnS-0002tH-1w; Wed, 15 Jul 2026 10:24:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362890.1614647; Wed, 15 Jul 2026 10:24:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnR-0002t9-Vi; Wed, 15 Jul 2026 10:24:57 +0000 Received: by outflank-mailman (input) for mailman id 1362890; Wed, 15 Jul 2026 10:24:56 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnQ-0002t2-Aa for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:56 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwnQ-007chT-1s for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:56 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwnQ-001Y0d-0t for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:24:56 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sorul3jrU4BfVqREauNhtbQ7Yo0pcKcMPDVWIBlNBkw=; b=g/enwLe5GlL7ZtPrI/TAut2fNF lZMFjQFnXd7KXsoqeJiHTUwxvodZT3NVQ3lnkjKE2ZnsMOxkKbtFuxzszsQBcC93o6t6daIuq9N1j cZG3HBcSad83haZ8bSoaqwu56SWvyGZoB+ww3oJ2q5JYYNFMzSL3qwRh0vhIT8fDDFac=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/device-tree: Fix off-by-one bounds check in make_memory_node() Message-Id: Date: Wed, 15 Jul 2026 10:24:56 +0000 commit 6610b4f3ac8722dfdbbd9e0f587e5af83a164540 Author: Oleksandr Tyshchenko AuthorDate: Thu Apr 2 20:38:35 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/device-tree: Fix off-by-one bounds check in make_memory_node() When building Xen with CONFIG_STATIC_SHM=n, booting a hardware domain with exactly NR_MEM_BANKS (256) reserved-memory regions causes a panic: (XEN) Xen BUG at common/device-tree/domain-build.c:497 (XEN) Xen call trace: (XEN) [<00000a0000289aa8>] make_memory_node+0x178/0x234 (PC) This occurs due to an off-by-one error in the bounds checking of the reg array in make_memory_node(). The check: BUG_ON(nr_cells >= ARRAY_SIZE(reg)); incorrectly triggers when the array is exactly full (i.e., when nr_cells == ARRAY_SIZE(reg)), preventing the 256th and final valid memory region from being written. When CONFIG_STATIC_SHM=y, this bug is usually hidden because DT_MEM_NODE_REG_RANGE_SIZE adds extra space for SHM banks. This extra capacity prevents the array from reaching its maximum limit while processing the 256th memory region. However, if a domain is configured with exactly NR_MEM_BANKS and NR_SHMEM_BANKS, the array will completely fill up and trigger the same panic. Fix this by changing the condition to strictly greater than (>). Apply the exact same fix to shm_mem_node_fill_reg_range() to prevent the same error. Fixes: cd8015b634b0 ("ARM/dom0: Avoid using a variable length array in make_memory_node()") Fixes: 7846f7699fea ("xen/arm: List static shared memory regions as /memory nodes") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel [michal: adjust for functions living in different files] Signed-off-by: Michal Orzel (cherry picked from commit fc453fef7708f65d4023ff63ebafe52c822229a1) --- xen/arch/arm/domain_build.c | 2 +- xen/arch/arm/static-shmem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 7b47abade1..7df1f757fb 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -826,7 +826,7 @@ int __init make_memory_node(const struct kernel_info *kinfo, int addrcells, continue; nr_cells += reg_size; - BUG_ON(nr_cells >= ARRAY_SIZE(reg)); + BUG_ON(nr_cells > ARRAY_SIZE(reg)); dt_child_set_range(&cells, addrcells, sizecells, start, size); } diff --git a/xen/arch/arm/static-shmem.c b/xen/arch/arm/static-shmem.c index 8f87154c35..4dfdd5d193 100644 --- a/xen/arch/arm/static-shmem.c +++ b/xen/arch/arm/static-shmem.c @@ -896,7 +896,7 @@ void __init shm_mem_node_fill_reg_range(const struct kernel_info *kinfo, paddr_t size = mem->bank[i].size; *nr_cells += addrcells + sizecells; - BUG_ON(*nr_cells >= DT_MEM_NODE_REG_RANGE_SIZE); + BUG_ON(*nr_cells > DT_MEM_NODE_REG_RANGE_SIZE); dt_child_set_range(&cells, addrcells, sizecells, start, size); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362891.1614651 (Exim 4.92) (envelope-from ) id 1wjwnc-0002vF-3K; Wed, 15 Jul 2026 10:25:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362891.1614651; Wed, 15 Jul 2026 10:25:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnc-0002v7-0n; Wed, 15 Jul 2026 10:25:08 +0000 Received: by outflank-mailman (input) for mailman id 1362891; Wed, 15 Jul 2026 10:25:06 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwna-0002uy-Ek for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:06 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwna-007chi-2H for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:06 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwna-001Y9y-1G for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:06 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WXM3JKKc3ZJmdYLAvERvjwUAcHtidcZpqbfi7HzC9Hs=; b=T8aOLl1pZZrEOnrmFRxHsK7j8g cUqh84xa9NqlClgGLAPElvP7n3OUajCWJPLhSkt96X6nMdFV7CHlunT2obj3CKplAnw6AQejZr8TN t78AlJ1T6mu5k3nhBuUFjzdUmr4JNwcfuYyoUCoLbkSNFrx2TAhEiDO20DCcjv48Qqn4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: Fix off-by-one in iomem_deny_access() calls Message-Id: Date: Wed, 15 Jul 2026 10:25:06 +0000 commit c635373c2539b6527fa64d2e1c751610901e8013 Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:32 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: Fix off-by-one in iomem_deny_access() calls iomem_deny_access() wraps rangeset_remove_range() which takes inclusive endpoints. All call sites in the GIC and ACPI code pass 'mfn + nr' (or 'mfn + 1' for single-page regions) as the end parameter, which causes one extra page beyond each region to be denied. For single-page regions, use 'mfn' as the end (denying exactly one page). For all multi-page regions, use 'mfn + nr - 1'. This matches the correct pattern used elsewhere, e.g. in device.c. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Fixes: 66158be465 ("ARM: ITS: Deny hardware domain access to ITS") Fixes: 97e9875646 ("arm/acpi: Permit MMIO access of Xen unused devices for Dom0") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Stefano Stabellini (cherry picked from commit f25fe2452b821270ac62c2ee4f6dd4dea9ad3298) --- xen/arch/arm/acpi/domain_build.c | 2 +- xen/arch/arm/gic-v2.c | 8 ++++---- xen/arch/arm/gic-v3-its.c | 2 +- xen/arch/arm/gic-v3.c | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/xen/arch/arm/acpi/domain_build.c b/xen/arch/arm/acpi/domain_build.c index 2ce75543d0..1f6b318854 100644 --- a/xen/arch/arm/acpi/domain_build.c +++ b/xen/arch/arm/acpi/domain_build.c @@ -47,7 +47,7 @@ static int __init acpi_iomem_deny_access(struct domain *d) { mfn = spcr->serial_port.address >> PAGE_SHIFT; /* Deny MMIO access for UART */ - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; } diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index 02043c0d4b..a3fc3cee75 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -1079,23 +1079,23 @@ static int gicv2_iomem_deny_access(struct domain *d) unsigned long mfn, nr; mfn = dbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = hbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = cbase >> PAGE_SHIFT; nr = DIV_ROUND_UP(csize, PAGE_SIZE); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; mfn = vbase >> PAGE_SHIFT; - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } #ifdef CONFIG_ACPI diff --git a/xen/arch/arm/gic-v3-its.c b/xen/arch/arm/gic-v3-its.c index 5fd83af25a..e3e068f778 100644 --- a/xen/arch/arm/gic-v3-its.c +++ b/xen/arch/arm/gic-v3-its.c @@ -894,7 +894,7 @@ int gicv3_its_deny_access(struct domain *d) { mfn = paddr_to_pfn(its_data->addr); nr = PFN_UP(its_data->size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) { printk("iomem_deny_access failed for %lx:%lx \r\n", mfn, nr); diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index cd3e1acf79..d15f0bc8a7 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1463,7 +1463,7 @@ static int gicv3_iomem_deny_access(struct domain *d) mfn = dbase >> PAGE_SHIFT; nr = PFN_UP(SZ_64K); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; @@ -1475,7 +1475,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = gicv3.rdist_regions[i].base >> PAGE_SHIFT; nr = PFN_UP(gicv3.rdist_regions[i].size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1484,7 +1484,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = cbase >> PAGE_SHIFT; nr = PFN_UP(csize); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1493,7 +1493,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = vbase >> PAGE_SHIFT; nr = PFN_UP(csize); - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } return 0; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:18 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:18 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362893.1614656 (Exim 4.92) (envelope-from ) id 1wjwnm-0002xH-4r; Wed, 15 Jul 2026 10:25:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362893.1614656; Wed, 15 Jul 2026 10:25:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnm-0002x9-2G; Wed, 15 Jul 2026 10:25:18 +0000 Received: by outflank-mailman (input) for mailman id 1362893; Wed, 15 Jul 2026 10:25:16 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnk-0002x2-JZ for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:16 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwnk-007ckA-2l for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:16 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwnk-001YFP-1b for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:16 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=so0wancj63ch9U8z4SaSCTEcIfp2+rmzHG0fYk/9ZVk=; b=34N+wuWWytwdOlehnr1m0NgmTv 65N7gQ4ObmCadEmWAGOcoml9WeSpqN//9Huul1zMq7RXr7e9iSv5WV/hkkSgZIQs9DkRmieMAUpTy hGw+8q+ZxYvJ7kgjeeZI9EKbyqyIiTBDH4DTdpBr5m3K/zKjhSOEBN1mkmk0RA1TT2u0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface Message-Id: Date: Wed, 15 Jul 2026 10:25:16 +0000 commit 42a8a8abfe5a0f2c6ebe092970d219ca0885c80e Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:34 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface gicv3_iomem_deny_access() incorrectly uses csize (physical CPU interface size) instead of vsize (virtual CPU interface size) when calculating the number of pages to deny for the virtual CPU interface region at vbase. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit 9af54b65a4272e438d6b8508eb8d0749506856c3) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index d15f0bc8a7..6b8ff46aaa 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1492,7 +1492,7 @@ static int gicv3_iomem_deny_access(struct domain *d) if ( vbase != INVALID_PADDR ) { mfn = vbase >> PAGE_SHIFT; - nr = PFN_UP(csize); + nr = PFN_UP(vsize); return iomem_deny_access(d, mfn, mfn + nr - 1); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362894.1614660 (Exim 4.92) (envelope-from ) id 1wjwnw-0002zB-6P; Wed, 15 Jul 2026 10:25:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362894.1614660; Wed, 15 Jul 2026 10:25:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnw-0002z3-3e; Wed, 15 Jul 2026 10:25:28 +0000 Received: by outflank-mailman (input) for mailman id 1362894; Wed, 15 Jul 2026 10:25:26 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwnu-0002yw-Te for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:26 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwnv-007ckX-0X for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:26 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwnu-001YSE-2b for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:26 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FKajBc5KeYorNMSwWqidESpfImEMnFPpAP4kReJ+AQM=; b=UefChrfd+5MSfyxyRbkJHmsRqX ejyyVieNrA99k0TIe0MeClsJCeTuR6FysADCSEmaJ/qtOwsjIx/YkSHMonTiCfaewUh2LU7c3y9zY rRmZjIBuNXkDt2zCbFzG7GxTEb59HLIW1CYXNgxG6q+p0bYIg0/AuY6B8q3DATF3boqU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v3: disable Group 1 before CPU power-down Message-Id: Date: Wed, 15 Jul 2026 10:25:26 +0000 commit b3943777397d6b914e1ceda9a91f21223303404a Author: Mykola Kvach AuthorDate: Fri Apr 10 09:47:45 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: disable Group 1 before CPU power-down gicv3_cpu_disable() currently writes 0 to ICC_CTLR_EL1. Unlike GICC_CTLR in the GICv2 path, ICC_CTLR_EL1 does not enable or disable physical Group 1 interrupt signalling, so this write only clears EOImode. The GICv3 power management rules require the physical group enables in the CPU interface to be cleared before the redistributor is driven into ProcessorSleep, otherwise behaviour is UNPREDICTABLE. Xen only enables Group 1 interrupts on this path, so disable the interface by clearing ICC_IGRPEN1_EL1 instead. This appears to be a copy of the GICv2 pattern where the enable control lives in CTLR, but for GICv3 the enable moved to ICC_IGRPEN1_EL1. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 18b718b6af3d38d8bed23439ec396fd4bde9b75d) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 6b8ff46aaa..c609596def 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -895,7 +895,7 @@ static int gicv3_cpu_init(void) static void gicv3_cpu_disable(void) { - WRITE_SYSREG(0, ICC_CTLR_EL1); + WRITE_SYSREG(0, ICC_IGRPEN1_EL1); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:39 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:39 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362896.1614664 (Exim 4.92) (envelope-from ) id 1wjwo7-00031F-86; Wed, 15 Jul 2026 10:25:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362896.1614664; Wed, 15 Jul 2026 10:25:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwo7-000315-56; Wed, 15 Jul 2026 10:25:39 +0000 Received: by outflank-mailman (input) for mailman id 1362896; Wed, 15 Jul 2026 10:25:37 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwo5-00030y-DA for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:37 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwo5-007ckc-27 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:37 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwo5-001Z7R-0t for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:37 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7Pg9WpKDflQPRUR8t9P2k/YHME6hiaevVTlhUzU+oqc=; b=luR43bjhZ+4GO5oevcue1JM+6u WbLkby9K7wEQKwl94ZciLzCnWHamVnB2OUgt7jZYPnVFnw7Y4faJ2UDvllYFpEe6DwAOjHr1JbnUf fbb/c6wYARD7VEVqRtEpDRkqzsKP0u0xHGjT51/ElDD49hWzWm7w/3oYl5mPZcqa0xJ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] arm64/insn: Avoid undefined behaviour in branch offset decode Message-Id: Date: Wed, 15 Jul 2026 10:25:37 +0000 commit 82bf1f0cf2e092f86ad7fa9de4c3ce5799979c22 Author: Edgar E. Iglesias AuthorDate: Wed Apr 22 18:45:06 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 arm64/insn: Avoid undefined behaviour in branch offset decode Branch offset decoding sign-extends the immediate by shifting it left into bit 31 and back. Perform the left shift in uint32_t and cast to int32_t only for the final right shift to avoid UBSAN failures on negative offsets. Fixes: 6dbf3f0e3074 ("xen/arm: arm64: Add helpers to decode and encode branch instructions") Signed-off-by: Edgar E. Iglesias Reviewed-by: Stefano Stabellini (cherry picked from commit 65a99a4063ccac92237f6d2cd45cb94b5574baa9) --- xen/arch/arm/arm64/insn.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/arm64/insn.c b/xen/arch/arm/arm64/insn.c index 81f7914610..6b97a84ba7 100644 --- a/xen/arch/arm/arm64/insn.c +++ b/xen/arch/arm/arm64/insn.c @@ -225,22 +225,22 @@ u32 __kprobes aarch64_insn_gen_nop(void) */ int32_t aarch64_get_branch_offset(uint32_t insn) { - int32_t imm; + uint32_t imm; if (aarch64_insn_is_b(insn) || aarch64_insn_is_bl(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_26, insn); - return (imm << 6) >> 4; + return (int32_t)(imm << 6) >> 4; } if (aarch64_insn_is_cbz(insn) || aarch64_insn_is_cbnz(insn) || aarch64_insn_is_bcond(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_19, insn); - return (imm << 13) >> 11; + return (int32_t)(imm << 13) >> 11; } if (aarch64_insn_is_tbz(insn) || aarch64_insn_is_tbnz(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_14, insn); - return (imm << 18) >> 16; + return (int32_t)(imm << 18) >> 16; } /* Unhandled instruction */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362897.1614668 (Exim 4.92) (envelope-from ) id 1wjwoG-00033N-8o; Wed, 15 Jul 2026 10:25:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362897.1614668; Wed, 15 Jul 2026 10:25:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoG-00033F-6M; Wed, 15 Jul 2026 10:25:48 +0000 Received: by outflank-mailman (input) for mailman id 1362897; Wed, 15 Jul 2026 10:25:47 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoF-000339-J7 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:47 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwoF-007cki-2h for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:47 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwoF-001ZPQ-1k for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:47 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=4jI0KLUsaLUmi4ny9lgq+BSpulnUuti+GEYKP2CudCc=; b=r5vhtM06uw5A4FizSiKjPv2el9 zBFoKmZCKvQRcX8chmU3ILW9oAMj/zhD37bkqKeiZ0B9G/spaHzDqMvtYvbmnqifjjbvcgcTFg+e8 gprhBG7nVLA8yRALlOysXtZaQIiic6BVvuAVsb6irncV8MNRqGHQHQ74EK4m1LMwFTW0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v2: disable interrupt bypass on CPU shutdown Message-Id: Date: Wed, 15 Jul 2026 10:25:47 +0000 commit ecbef536d7cf69dbecf98c6a6f2a0ca29ab419fa Author: Mykola Kvach AuthorDate: Tue Apr 28 14:57:55 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v2: disable interrupt bypass on CPU shutdown The GICv2 CPU shutdown path currently writes 0 to GICC_CTLR. Per IHI0048B.b section 2.3.1, clearing the architected bypass-disable bits selects bypass rather than deasserted interrupt outputs when the CPU interface stops driving them. Tables 2-2 and 2-3 show that a zeroed GICC_CTLR can fall back to the legacy IRQ/FIQ inputs instead of fully disabling the interface. Fix this by reading GICC_CTLR, then setting the bypass-disable bits and clearing the group-enable bits that are architecturally defined for the current GICC_CTLR view before writing the value back. When Security Extensions are implemented Xen accesses the Non-secure copy of GICC_CTLR, where IRQBypDisGrp1 and FIQBypDisGrp1 are at bits [6:5] and bits [8:7] are reserved. Without Security Extensions (GICD_CTLR.DS=1), GICD_IGROUPR is RAZ/WI and all interrupts are Group 0, so clearing EnableGrp0 alone is sufficient to stop interrupt delivery through the CPU interface. Section 2.3.2 also states that wakeup event signals remain available even when both GIC interrupt signaling and interrupt bypass are disabled, so disabling bypass does not break the power-management use case, i.e. suspend modes. Fixes: 5e40a1b4351e ("arm: SMP CPU shutdown") Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Reviewed-by: Michal Orzel (cherry picked from commit 6f00fd9d6c1d6f08ab21f16c0406b3bb2c1e3b01) --- xen/arch/arm/gic-v2.c | 12 +++++++++++- xen/arch/arm/include/asm/gic.h | 25 +++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index a3fc3cee75..77491e635d 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -408,7 +408,17 @@ static void gicv2_cpu_init(void) static void gicv2_cpu_disable(void) { - writel_gicc(0x0, GICC_CTLR); + uint32_t ctlr = readl_gicc(GICC_CTLR); + + if ( readl_gicd(GICD_TYPER) & GICD_TYPE_SEC ) + ctlr |= GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK; + else + ctlr |= GICC_CTLR_BYPASS_DISABLE_GRP0_MASK | + GICC_CTLR_BYPASS_DISABLE_GRP1_MASK; + + ctlr &= ~GICC_CTL_ENABLE; + + writel_gicc(ctlr, GICC_CTLR); } static void gicv2_hyp_init(void) diff --git a/xen/arch/arm/include/asm/gic.h b/xen/arch/arm/include/asm/gic.h index 541f0eeb80..066a00c676 100644 --- a/xen/arch/arm/include/asm/gic.h +++ b/xen/arch/arm/include/asm/gic.h @@ -102,8 +102,29 @@ #define GICD_TYPE_SEC 0x400 #define GICD_TYPER_DVIS (1U << 18) -#define GICC_CTL_ENABLE 0x1 -#define GICC_CTL_EOI (0x1 << 9) +/* + * Xen runs in the Non-secure world. When Security Extensions are present, + * Xen accesses the Non-secure GICC_CTLR view, where bit[0] is EnableGrp1 + * and bits[6:5] are the Group 1 bypass-disable bits. Otherwise Xen sees the + * common GICC_CTLR layout, where bit[0] is EnableGrp0, bit[1] is EnableGrp1, + * bits[6:5] are the Group 0 bypass-disable bits, and bits[8:7] are the + * Group 1 bypass-disable bits. + */ +#define GICC_CTL_ENABLE (0x1 << 0) +#define GICC_CTL_ENABLE_GRP1 (0x1 << 1) +#define GICC_CTL_FIQBypDisGrp0 (0x1 << 5) +#define GICC_CTL_IRQBypDisGrp0 (0x1 << 6) +#define GICC_CTL_FIQBypDisGrp1 (0x1 << 7) +#define GICC_CTL_IRQBypDisGrp1 (0x1 << 8) + +#define GICC_CTLR_BYPASS_DISABLE_GRP0_MASK \ + (GICC_CTL_FIQBypDisGrp0 | GICC_CTL_IRQBypDisGrp0) +#define GICC_CTLR_BYPASS_DISABLE_GRP1_MASK \ + (GICC_CTL_FIQBypDisGrp1 | GICC_CTL_IRQBypDisGrp1) +#define GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK \ + GICC_CTLR_BYPASS_DISABLE_GRP0_MASK + +#define GICC_CTL_EOI (0x1 << 9) #define GICC_IA_IRQ 0x03ff #define GICC_IA_CPU_MASK 0x1c00 -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:25:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:25:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362898.1614672 (Exim 4.92) (envelope-from ) id 1wjwoQ-00035P-9v; Wed, 15 Jul 2026 10:25:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362898.1614672; Wed, 15 Jul 2026 10:25:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoQ-00035G-7T; Wed, 15 Jul 2026 10:25:58 +0000 Received: by outflank-mailman (input) for mailman id 1362898; Wed, 15 Jul 2026 10:25:57 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoP-000359-LR for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:57 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwoP-007ckm-2x for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:57 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwoP-001ZaB-1z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:25:57 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OYcvDwAmSxG/v+p9sNK6A/k+2EJotNos0NJadnZoQi8=; b=ONKUVI88SBcdqMw2VED/TOjOKl NFOyzwiNy+ZzLpf6PkjHrmPSKdi+5RJSygrkGuzpUxleZI+PUsO4lVFJCed3xdPY32lYR2r0K+FMJ lEQO7erK8SpYgYR99xfrBkLPhw2uopKfztO/tWxeTMUFzm+0zKo/OSehJRpwYZ8q6Q9w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen: arm: fix len type for guest copy functions Message-Id: Date: Wed, 15 Jul 2026 10:25:57 +0000 commit 9b88e852eff72110bb0d67966ecc757a4d9328d0 Author: Oleksii Kurochko AuthorDate: Thu May 7 10:58:40 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen: arm: fix len type for guest copy functions Widen the len argument of copy_to_guest_phys_flush_dcache() and the copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as the function can be used to copy large blobs such as the initrd which may exceed 4GB. Update the internal copy_guest() len argument to unsigned long accordingly. Change the type for local variable size in copy_guest() to avoid compilation error because of type mismatch. raw_* wrappers above copy_guest() keep returning unsigned long to avoid type narrowing; it is not an issue for raw_*'s len argument to remain 'unsigned int' since the assignment to copy_guest()'s wider unsigned long parameter is safe and there is no raw_* users who are using a value bigger than what can fit into 'unsigned int'. Fixes: 2986481b3d9e6 ("xen/arm: guest_copy: Extend the prototype to pass the vCPU") Fixes: 5302bd490bea7 ("xen/arm: Introduce copy_to_guest_phys_flush_dcache") Fixes: d07b7369aa65b ("xen/common: dom0less: introduce common domain-build.c") Reported-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Luca Fancellu Acked-by: Michal Orzel (cherry picked from commit e4424b9a635623b247a9a070db1238bf93f94764) --- xen/arch/arm/guestcopy.c | 6 +++--- xen/arch/arm/include/asm/guest_access.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c index 497e785ec4..a257bee3e4 100644 --- a/xen/arch/arm/guestcopy.c +++ b/xen/arch/arm/guestcopy.c @@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t info, uint64_t addr, return page; } -static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, +static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len, copy_info_t info, unsigned int flags) { /* XXX needs to handle faults */ @@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, while ( len ) { void *p; - unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset); + unsigned long size = min(len, PAGE_SIZE + 0UL - offset); struct page_info *page; page = translate_get_page(info, addr, flags & COPY_linear, @@ -136,7 +136,7 @@ unsigned long raw_copy_from_guest(void *to, const void __user *from, unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len) + unsigned long len) { return copy_guest(buf, gpa, len, GPA_INFO(d), COPY_to_guest | COPY_ipa | COPY_flush_dcache); diff --git a/xen/arch/arm/include/asm/guest_access.h b/xen/arch/arm/include/asm/guest_access.h index 18c88b70d7..c13cbec55b 100644 --- a/xen/arch/arm/include/asm/guest_access.h +++ b/xen/arch/arm/include/asm/guest_access.h @@ -14,7 +14,7 @@ unsigned long raw_clear_guest(void *to, unsigned int len); unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); int access_guest_memory_by_gpa(struct domain *d, paddr_t gpa, void *buf, uint32_t size, bool is_write); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362899.1614675 (Exim 4.92) (envelope-from ) id 1wjwoa-00037q-Cf; Wed, 15 Jul 2026 10:26:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362899.1614675; Wed, 15 Jul 2026 10:26:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoa-00037i-A5; Wed, 15 Jul 2026 10:26:08 +0000 Received: by outflank-mailman (input) for mailman id 1362899; Wed, 15 Jul 2026 10:26:07 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwoZ-00037c-OA for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:07 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwoZ-007cl1-3D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:07 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwoZ-001Zhi-2F for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:07 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=o6RDT/O6+OVxmAtCMztahEDbnUMz8QTnCuU4TDyf+1c=; b=KD9sHtdYDjIkHvYNeeHESV17vc vlKS9HJeF8s0poIZUcSc/yPLzOPS/xJbpeAxR2gxbAJ65HZAGtpTL3XVmtA36GISqRQcSYf9U2Q0J 9/lJXl+ZwNhVmeq5/amY0P3kBh7OrbQiKcYJ3koIq7KP6o8NKXPIjmp/l2PX018FIz8s=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v3: Wait for redistributor RWP using the right bit Message-Id: Date: Wed, 15 Jul 2026 10:26:07 +0000 commit 4f3dbd9ee08597b11247da55f53eaab64805a4b1 Author: Mykola Kvach AuthorDate: Thu May 14 12:08:13 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Wait for redistributor RWP using the right bit gicv3_do_wait_for_rwp() is used for both distributor and redistributor writes. The CTLR register is at offset 0 for both, but the RWP bit is not in the same position. For GICD_CTLR, RWP is bit 31. For GICR_CTLR, bit 31 is UWP, while RWP is bit 3. The redistributor wait path was therefore polling UWP instead of RWP. UWP covers upstream writes, including Generate SGI packets, and is not a substitute for redistributor register write completion. The existing redistributor callers need RWP semantics for redistributor register writes such as GICR_ICENABLER0 and GICR_CTLR updates. Add GICR_CTLR_RWP and pass the expected RWP bit to the shared helper. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Reported-by: Luca Fancellu Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit d86cf3cbd4ad105c00e12b0d51646049a87f1c44) --- xen/arch/arm/gic-v3.c | 14 +++++++++----- xen/arch/arm/include/asm/gic_v3_defs.h | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index c609596def..809f6b5cdd 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -274,16 +274,20 @@ static void gicv3_enable_sre(void) isb(); } -/* Wait for completion of a distributor change */ -static void gicv3_do_wait_for_rwp(void __iomem *base) +/* Wait for completion of a distributor/redistributor change */ +static void gicv3_do_wait_for_rwp(void __iomem *base, uint32_t rwp_bit) { uint32_t val; bool timeout = false; s_time_t deadline = NOW() + MILLISECS(1000); do { + /* + * GICD_CTLR and GICR_CTLR are both at offset 0, so this is + * valid for either a distributor or redistributor base. + */ val = readl_relaxed(base + GICD_CTLR); - if ( !(val & GICD_CTLR_RWP) ) + if ( !(val & rwp_bit) ) break; if ( NOW() > deadline ) { @@ -300,12 +304,12 @@ static void gicv3_do_wait_for_rwp(void __iomem *base) static void gicv3_dist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD); + gicv3_do_wait_for_rwp(GICD, GICD_CTLR_RWP); } static void gicv3_redist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD_RDIST_BASE); + gicv3_do_wait_for_rwp(GICD_RDIST_BASE, GICR_CTLR_RWP); } static void gicv3_wait_for_rwp(int irq) diff --git a/xen/arch/arm/include/asm/gic_v3_defs.h b/xen/arch/arm/include/asm/gic_v3_defs.h index 2af093e774..143eceaa9d 100644 --- a/xen/arch/arm/include/asm/gic_v3_defs.h +++ b/xen/arch/arm/include/asm/gic_v3_defs.h @@ -108,6 +108,7 @@ #define GICR_NSACR (0x0E00) #define GICR_CTLR_ENABLE_LPIS (1U << 0) +#define GICR_CTLR_RWP (1U << 3) #define GICR_TYPER_PLPIS (1U << 0) #define GICR_TYPER_VLPIS (1U << 1) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:18 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:18 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362900.1614680 (Exim 4.92) (envelope-from ) id 1wjwok-00039l-ED; Wed, 15 Jul 2026 10:26:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362900.1614680; Wed, 15 Jul 2026 10:26:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwok-00039d-BT; Wed, 15 Jul 2026 10:26:18 +0000 Received: by outflank-mailman (input) for mailman id 1362900; Wed, 15 Jul 2026 10:26:18 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwok-00039X-0K for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:18 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwok-007cl9-0q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:17 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwoj-001a9s-31 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:17 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Q8vAvC6ZA6R5yBr+N44OEXnTuMDS1XQKB8nyogDLLTs=; b=lyoogrKVgnZpHXCaHSSie2Tryn /Wc9I6I+9lH2eTqjDe9jcvFvkusgxlqrPhG8ue3Zrba9Vo2wDpLgKtLXvOdZfA2Ln7f+Qqpcfb9Qj JyAm++LD/QQ8orC1iv1CuZqSrQm3rszDhc2kWd7d09FXwQDcqMz7QpKS+tTctUS025Sg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor Message-Id: Date: Wed, 15 Jul 2026 10:26:17 +0000 commit 4299e59d1eb332923bef13f5f812ad6f5b48e862 Author: Mykola Kvach AuthorDate: Tue May 19 17:31:54 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor gicv3_dist_init() disables the distributor before reprogramming the global interrupt state. It used to do this by writing 0 to GICD_CTLR. On a system where firmware has already enabled Non-secure affinity routing, a zero write clears the Non-secure view's GICD_CTLR.ARE_NS bit. Arm IHI 0069H.b, section 2.3.3 ("Changing affinity routing enables"), states that changing GICD_CTLR.ARE_NS from 1 to 0 is UNPREDICTABLE. The GICD_CTLR register description in section 12.9.4 carries the same rule for the ARE_NS field. Preserve ARE_NS while clearing the group enable bits. If firmware left ARE_NS clear, the value written is still 0, preserving the existing initialization flow. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel Reviewed-by: Luca Fancellu Release-Acked-by: Oleksii Kurochko (cherry picked from commit e63ba93511b33c0d3bb8cc5870f946f41e1d2655) --- xen/arch/arm/gic-v3.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 809f6b5cdd..69112a831f 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -620,12 +620,17 @@ static void gicv3_set_irq_priority(struct irq_desc *desc, static void __init gicv3_dist_init(void) { uint32_t type; + uint32_t ctlr; uint64_t affinity; unsigned int nr_lines; int i; - /* Disable the distributor */ - writel_relaxed(0, GICD + GICD_CTLR); + /* + * Disable the distributor without clearing ARE_NS. The GIC architecture + * makes changing ARE_NS from 1 to 0 UNPREDICTABLE. + */ + ctlr = readl_relaxed(GICD + GICD_CTLR); + writel_relaxed(ctlr & GICD_CTLR_ARE_NS, GICD + GICD_CTLR); type = readl_relaxed(GICD + GICD_TYPER); nr_lines = 32 * ((type & GICD_TYPE_LINES) + 1); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:29 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:29 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362901.1614684 (Exim 4.92) (envelope-from ) id 1wjwov-0003Bi-FM; Wed, 15 Jul 2026 10:26:29 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362901.1614684; Wed, 15 Jul 2026 10:26:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwov-0003Ba-Cl; Wed, 15 Jul 2026 10:26:29 +0000 Received: by outflank-mailman (input) for mailman id 1362901; Wed, 15 Jul 2026 10:26:28 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwou-0003BT-6M for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:28 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwou-007clT-1R for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:28 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwou-001alx-0T for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:28 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AGf3suInUGMJJ4zAbBj643Nm7uN0wW/U6WB95bSsYro=; b=FQ7LTgH7/Q6M8eZkWpuqymCJFp jW97tzbIX1lWeTBsxfzXD6/1GEGqnAVxwsLND6La09GTZygRh34ylSq6IMVgJV+f8ZTUQKcVOF3Ax 55kusIXA94ngbQBnOSe+ytajZlSiuogxpbFRFMitP8+dsaFTcPoRhmKUX0LNlHlnclrU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: propagate vGIC vCPU init failures Message-Id: Date: Wed, 15 Jul 2026 10:26:28 +0000 commit 6668b73c6bbcf0256f0f4abc7ab216f80cf693bf Author: Mykola Kvach AuthorDate: Wed May 27 03:18:50 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: propagate vGIC vCPU init failures The vGIC per-vCPU init callback can fail. In particular, GICv3 rejects a vCPU when the domain's redistributor layout has no MMIO slot covering that vCPU. However, the generic vGIC init path ignored the callback return value, so vcpu_create() could succeed with an invalid vGICv3 per-vCPU state. This can be reproduced on FVP Base RevC by exposing a 2 MiB GICv3 redistributor region to Dom0 and booting Xen with: maxcpus=1 dom0_max_vcpus=64 The host GICv3 redistributor range is: region 0: 0x0000002f100000 - 0x0000002f300000 With Xen's guest redistributor frame size of 128 KiB, that range covers 16 guest redistributors. vCPU16 and above have no corresponding redistributor slot. Before this fix, Xen detected the missing redistributors: d0: Unable to find a re-distributor for VCPU 16 ... d0: Unable to find a re-distributor for VCPU 63 but ignored the error and continued as if the secondary vCPUs had been created correctly. Dom0 then saw 64 possible CPUs and could hang during secondary CPU bring-up: smp: Bringing up secondary CPUs ... d0v15: vGICR: SGI: unhandled word write ... to ICACTIVER0 Propagate the vGIC vcpu_init() error so the caller can stop creating secondary vCPUs. With this fix, Dom0 construction reports: d0: Unable to find a re-distributor for VCPU 16 Failed to allocate d0v16 and the guest continues booting with the vCPUs created before the failure: smp: Brought up 1 node, 16 CPUs Free the private IRQ rank allocated by vcpu_vgic_init() on this error path. The caller will still run the generic vCPU creation cleanup, but XFREE() clears the pointer so that cleanup remains idempotent. Also fix the host-layout redistributor region count for the case where the requested vCPU count is larger than the capacity of all host redistributor regions. The old code always stored i + 1 after the loop. That is correct when the loop stops inside a valid region because the requested vCPU count is covered. If the loop exits after consuming all hardware regions, i is already equal to the number of allocated regions, so i + 1 records one region too many. In the same FVP setup, that off-by-one made Xen describe host-layout GICR state beyond the populated redistributor region list. Dom0 then accessed the GICR MMIO window described in its device tree, but Xen could not match the access to a valid emulated redistributor frame. During debugging this was seen as an unexpected vGICR access followed by a guest panic: d0v0: vGICR: unknown gpa read address 000000002f10ffe8 pc : gic_iterate_rdists+0x4c/0x104 Kernel panic - not syncing: Attempted to kill the idle task! Keep the existing construct_domain() policy used by Dom0 and dom0less domain construction: a failure to create a secondary vCPU stops the secondary vCPU creation loop, but does not fail the whole domain construction. Fixes: ea37fd21110b ("xen/arm: split vgic driver into generic and vgic-v2 driver") Fixes: 54ec59f6b0b3 ("xen/arm: vgic-v3: Don't create empty re-distributor regions") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 961cc8cc0febcd8b2e515c7896a076a3246d06b1) --- xen/arch/arm/vgic-v3.c | 2 +- xen/arch/arm/vgic.c | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index 2eaa48fadb..d427b7a9ac 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1708,7 +1708,7 @@ static int vgic_v3_domain_init(struct domain *d) * not match the number of pCPUs). Update the number of regions to * avoid exposing unused region as they will not get emulated. */ - d->arch.vgic.nr_regions = i + 1; + d->arch.vgic.nr_regions = min(i + 1U, vgic_v3_hw.nr_rdist_regions); d->arch.vgic.intid_bits = vgic_v3_hw.intid_bits; } diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c index c563ba93af..0508624f39 100644 --- a/xen/arch/arm/vgic.c +++ b/xen/arch/arm/vgic.c @@ -198,7 +198,7 @@ void domain_vgic_free(struct domain *d) int vcpu_vgic_init(struct vcpu *v) { - int i; + int i, ret; v->arch.vgic.private_irqs = xzalloc(struct vgic_irq_rank); if ( v->arch.vgic.private_irqs == NULL ) @@ -207,7 +207,12 @@ int vcpu_vgic_init(struct vcpu *v) /* SGIs/PPIs are always routed to this VCPU */ vgic_rank_init(v->arch.vgic.private_irqs, 0, v->vcpu_id); - v->domain->arch.vgic.handler->vcpu_init(v); + ret = v->domain->arch.vgic.handler->vcpu_init(v); + if ( ret ) + { + XFREE(v->arch.vgic.private_irqs); + return ret; + } memset(&v->arch.vgic.pending_irqs, 0, sizeof(v->arch.vgic.pending_irqs)); for (i = 0; i < 32; i++) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:39 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:39 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362903.1614688 (Exim 4.92) (envelope-from ) id 1wjwp5-0003Dh-H3; Wed, 15 Jul 2026 10:26:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362903.1614688; Wed, 15 Jul 2026 10:26:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwp5-0003DZ-E5; Wed, 15 Jul 2026 10:26:39 +0000 Received: by outflank-mailman (input) for mailman id 1362903; Wed, 15 Jul 2026 10:26:38 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwp4-0003DS-8s for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:38 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwp4-007clX-1h for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:38 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwp4-001aqb-0j for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:38 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OoCjNMuVZFpN8/KDFO9+inud+ejMAmyKq2qUSDlBtqw=; b=soP4VuLAySSnAXwnYqBmNwyB9U AuEasitXUd28wtPKRFh0QlKAk8DgU7hbQpwLULv4mxXdifBYK3+oBJGwZ3oG/PxhApJ1z23qTP/Ms 3D/D8vzyR7iRLag5g1gie66ajl4q1thOAm0nR2Pfu7T91jRefPsKDzpodU+zgriWAuB4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: gic-v3: Fix redistributor wakeup polling Message-Id: Date: Wed, 15 Jul 2026 10:26:38 +0000 commit 4813da923159a792f506d6de4f4db2f11fb56b35 Author: Luca Fancellu AuthorDate: Mon May 18 08:05:24 2026 +0100 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Fix redistributor wakeup polling gicv3_enable_redist() clears GICR_WAKER.ProcessorSleep and then waits for GICR_WAKER.ChildrenAsleep to clear, as required after waking a redistributor. However, the polling loop currently uses "while ( timeout )". Since timeout is initially false, the loop runs only once unless the timeout path has already been reached. As a result, Xen can continue before the redistributor has completed wakeup. Use an unconditional loop, matching the surrounding timeout/break pattern, so the code polls until either ChildrenAsleep is clear or the deadline is reached. While there, also fix the timeout message. This path polls GICR_WAKER.ChildrenAsleep, not an RWP bit, so "RWP timeout" is misleading. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Luca Fancellu Reviewed-by: Mykola Kvach Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit 941fdfc03e109a28ca9cfe71c111a1ef6cb9ed12) --- xen/arch/arm/gic-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 69112a831f..843824acae 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -704,11 +704,11 @@ static int gicv3_enable_redist(void) } cpu_relax(); udelay(1); - } while ( timeout ); + } while ( 1 ); if ( timeout ) { - dprintk(XENLOG_ERR, "GICv3: Redist enable RWP timeout\n"); + dprintk(XENLOG_ERR, "GICv3: Redist wakeup timeout\n"); return 1; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:49 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:49 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362904.1614692 (Exim 4.92) (envelope-from ) id 1wjwpF-0003G2-Hx; Wed, 15 Jul 2026 10:26:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362904.1614692; Wed, 15 Jul 2026 10:26:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpF-0003Fu-FL; Wed, 15 Jul 2026 10:26:49 +0000 Received: by outflank-mailman (input) for mailman id 1362904; Wed, 15 Jul 2026 10:26:48 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpE-0003Fg-Bj for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:48 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwpE-007clb-1y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:48 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwpE-001auJ-0y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:48 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lGvLi3l3XW3tMDV8UGwZ/YUVe6xMuA4saKNyTYFkTas=; b=OroFiolIEL9yYgKzMYur5dLurt 08/MHeAxdUCcAatz31RR0kBy+RzVnQe/71zfvoxvrdyO+tizAIlJ8GmIz3z3fs3WRFshMGjCmfn9I lJ5UWCpVy3i11NKwIiDcbm4ZXgHI/nin5T0n2pj0ThodMcgWTcfuNFcYh05WISR+2dvg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] libfdt: fix UBSAN null pointer in fdt_property() Message-Id: Date: Wed, 15 Jul 2026 10:26:48 +0000 commit befb42bff687e96e1279fdb85454e243167dc641 Author: Oleksii Kurochko AuthorDate: Wed Jun 17 09:20:51 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 libfdt: fix UBSAN null pointer in fdt_property() fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit be18ad502e5d4f9248e1f020d3e0d55a7b9ea986) --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb..96d4cf5713 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len) ret = fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:26:59 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:26:59 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362906.1614696 (Exim 4.92) (envelope-from ) id 1wjwpP-0003Hy-JX; Wed, 15 Jul 2026 10:26:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362906.1614696; Wed, 15 Jul 2026 10:26:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpP-0003Hq-Gm; Wed, 15 Jul 2026 10:26:59 +0000 Received: by outflank-mailman (input) for mailman id 1362906; Wed, 15 Jul 2026 10:26:58 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpO-0003Hj-Jw for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:58 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwpO-007clf-2n for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:58 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwpO-001bAc-1f for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:26:58 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=e83JzbwS1SL9KsNfoyRe2u3ZoREnh7wovI4GmTxOVmo=; b=nhWccaYnZN26l7hgtMhzHq2AFe dy5zcIyX31ZmED4rdIfXH6meaYxLzO+WERtRoWsRVjzq4xQkN7g4EBquTFBHsGwrn3j9m6ksgZORk 0WbjRZ8gLbcFVCNKJTmGD10rHa58/68B4hR9luZrPhaikXdR1R/fWGZQQ3eOSiHxwRis=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] bootfdt: Fix infinite loop in device_tree_for_each_node() Message-Id: Date: Wed, 15 Jul 2026 10:26:58 +0000 commit a0c5fde6f7ccae0a2dc93512a66a4bf1c0484414 Author: Dmytro Prokopchuk1 AuthorDate: Fri Jun 26 07:57:33 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 bootfdt: Fix infinite loop in device_tree_for_each_node() When a node's depth exceeds DEVICE_TREE_MAX_DEPTH inside the device_tree_for_each_node() loop, the code prints a warning and executes 'continue;' statement, which jumps to condition check, bypassing the iterator update step: node = fdt_next_node(fdt, node, &depth). The node and depth are not updated, the loop repeatedly evaluates the same too-deep node, causing a hang. Fix this by wrapping the node processing logic in an 'else' block. This ensures the loop update step is executed on every iteration, safely skipping deeply nested nodes and doing the traversal. Fixes: 40f2ea3df2e2 ("xen/arm: pass node to device_tree_for_each_node") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleskii Kurochko (cherry picked from commit 3b717f57dca508f546303dd34067b7b906ba459e) --- xen/common/device-tree/bootfdt.c | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/xen/common/device-tree/bootfdt.c b/xen/common/device-tree/bootfdt.c index 529c91e603..9ce7699833 100644 --- a/xen/common/device-tree/bootfdt.c +++ b/xen/common/device-tree/bootfdt.c @@ -250,23 +250,28 @@ int __init device_tree_for_each_node(const void *fdt, int node, { printk("Warning: device tree node `%s' is nested too deep\n", name); - continue; } - - as = depth > 0 ? address_cells[depth-1] : DT_ROOT_NODE_ADDR_CELLS_DEFAULT; - ss = depth > 0 ? size_cells[depth-1] : DT_ROOT_NODE_SIZE_CELLS_DEFAULT; - - address_cells[depth] = device_tree_get_u32(fdt, node, - "#address-cells", as); - size_cells[depth] = device_tree_get_u32(fdt, node, - "#size-cells", ss); - - /* skip the first node */ - if ( node != first_node ) + else { - ret = func(fdt, node, name, depth, as, ss, data); - if ( ret != 0 ) - return ret; + as = depth > 0 ? + address_cells[depth - 1] : + DT_ROOT_NODE_ADDR_CELLS_DEFAULT; + ss = depth > 0 ? + size_cells[depth - 1] : + DT_ROOT_NODE_SIZE_CELLS_DEFAULT; + + address_cells[depth] = device_tree_get_u32(fdt, node, + "#address-cells", as); + size_cells[depth] = device_tree_get_u32(fdt, node, + "#size-cells", ss); + + /* skip the first node */ + if ( node != first_node ) + { + ret = func(fdt, node, name, depth, as, ss, data); + if ( ret != 0 ) + return ret; + } } node = fdt_next_node(fdt, node, &depth); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:27:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:27:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362907.1614700 (Exim 4.92) (envelope-from ) id 1wjwpZ-0003KU-M2; Wed, 15 Jul 2026 10:27:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362907.1614700; Wed, 15 Jul 2026 10:27:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpZ-0003KM-JN; Wed, 15 Jul 2026 10:27:09 +0000 Received: by outflank-mailman (input) for mailman id 1362907; Wed, 15 Jul 2026 10:27:09 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpZ-0003KG-2i for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:09 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwpZ-007clu-0w for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:09 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwpY-001brH-2r for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:08 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=VwwrZWc8chUeHTVGoaVNelUFqDTLxqD6tvpi9pxHu08=; b=KBq+YwpJBbL0Ice2AwqsTfTNlf SZ9R7Mz/5TD8M+jkgJgjQh+k5Os3yRakyIRcPZXhR4NLBTjrvlmoIDIP6RsmYUy+xvC87DMdlnuqw eJ/y1h372Yn0o1Enda4PlK4iuXRlGYruXikNcF9RQswMR3DASVma5dlzhVNc40OCWCzw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 15 Jul 2026 10:27:08 +0000 commit 77015ef70d4fde7a095d7f085bc69d2a66b71296 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel (cherry picked from commit ccde3773c1762d32fb5f6037d6b22780c30895d3) --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 04e363088d..0f9300aad8 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -242,7 +242,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -255,10 +257,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:27:20 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:27:20 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362908.1614703 (Exim 4.92) (envelope-from ) id 1wjwpk-0003MP-NE; Wed, 15 Jul 2026 10:27:20 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362908.1614703; Wed, 15 Jul 2026 10:27:20 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpk-0003MH-Kh; Wed, 15 Jul 2026 10:27:20 +0000 Received: by outflank-mailman (input) for mailman id 1362908; Wed, 15 Jul 2026 10:27:19 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpj-0003MA-7Q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:19 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwpj-007cm2-1Y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:19 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwpj-001bzK-0Z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:19 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IMdvW2mVuGkikDd8/BHPQGTlF0sBlPqwgQ+SfynIvAc=; b=keethXqR7k9cG5jn7fbwhFzzfV /KMleoZOvRqEsKO8Cwv1oCPKWX5qEPFNzEjXK2sumb78K2tQmTFiI8q7h2pe4h4FuUK9MMnPYJE/3 TvQER4veDBHzz54cJmnCFnwP741+TcRJqS+gPed6hGr3GvnxFdCvTBzq2iLqWEnhw14w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Wed, 15 Jul 2026 10:27:19 +0000 commit 94d2902c8cf27621ee539469f53426018c987cd7 Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:52:06 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 7df1f757fb..878b2f483c 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -2254,7 +2254,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:27:30 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:27:30 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362909.1614709 (Exim 4.92) (envelope-from ) id 1wjwpu-0003OX-Q8; Wed, 15 Jul 2026 10:27:30 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362909.1614709; Wed, 15 Jul 2026 10:27:30 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpu-0003OP-M6; Wed, 15 Jul 2026 10:27:30 +0000 Received: by outflank-mailman (input) for mailman id 1362909; Wed, 15 Jul 2026 10:27:29 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjwpt-0003O7-AH for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:29 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjwpt-007cmP-1o for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:29 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjwpt-001c21-0p for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:27:29 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mSRX0NgOfSOtE5YA1hS6rqd3WropFmSs5AuQbs/J/ro=; b=d04qn2PVRJBdWOJZqAXQvFqMqX dLkQJHAvMTu3wTB5+y8LQS+En28fCV602EA7g57izxRfhpHUi73UuBeeJFG9AV7ljrUxEWiAHo3El +3/UtGY2tTABzNtpllFSuHvBhBafERbAPtEAIX9+Rj2FwwypLczoHz2bgQe5J2TCDgqU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Wed, 15 Jul 2026 10:27:29 +0000 commit e16e18e3128508954bc481e02611830de9f06925 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:54:27 2026 +0200 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko [michal: adjust for handle_passthrough_prop() living in a different file] Signed-off-by: Michal Orzel (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/arch/arm/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/dom0less-build.c b/xen/arch/arm/dom0less-build.c index 49d1f14d65..21045e31af 100644 --- a/xen/arch/arm/dom0less-build.c +++ b/xen/arch/arm/dom0less-build.c @@ -258,10 +258,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, int res; paddr_t mstart, size, gstart; + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362926.1614721 (Exim 4.92) (envelope-from ) id 1wjxGZ-0007Fs-Re; Wed, 15 Jul 2026 10:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362926.1614721; Wed, 15 Jul 2026 10:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGZ-0007Fj-Ov; Wed, 15 Jul 2026 10:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1362926; Wed, 15 Jul 2026 10:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGY-0007Fd-Lq for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxGY-007dFf-2p for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxGY-002NRp-1o for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AzbJWraksFVV310wrMzd19Rl26iM6+Ok1Qo2jf0W3/g=; b=eKr1IfjqI9PaszKXNJxIzMC43x S+mbH2FoW9awiSF5AW9BiMSWEZ6F4Eh6H7OMW0Mui6dsekuEHi9yZBX3CIRXL+EVW53AIKRWuASPs GO3gyLEKVyArf4oAKijjxMrnna/T4Cy7ylIguXpv3kGE56GiXDBOcfkLZL8v0yNru6JM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/device-tree: Fix off-by-one bounds check in make_memory_node() Message-Id: Date: Wed, 15 Jul 2026 10:55:02 +0000 commit d52eda2b099dc516fb2434f1ae3a11de345f4fcf Author: Oleksandr Tyshchenko AuthorDate: Thu Apr 2 20:38:35 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/device-tree: Fix off-by-one bounds check in make_memory_node() When building Xen with CONFIG_STATIC_SHM=n, booting a hardware domain with exactly NR_MEM_BANKS (256) reserved-memory regions causes a panic: (XEN) Xen BUG at common/device-tree/domain-build.c:497 (XEN) Xen call trace: (XEN) [<00000a0000289aa8>] make_memory_node+0x178/0x234 (PC) This occurs due to an off-by-one error in the bounds checking of the reg array in make_memory_node(). The check: BUG_ON(nr_cells >= ARRAY_SIZE(reg)); incorrectly triggers when the array is exactly full (i.e., when nr_cells == ARRAY_SIZE(reg)), preventing the 256th and final valid memory region from being written. When CONFIG_STATIC_SHM=y, this bug is usually hidden because DT_MEM_NODE_REG_RANGE_SIZE adds extra space for SHM banks. This extra capacity prevents the array from reaching its maximum limit while processing the 256th memory region. However, if a domain is configured with exactly NR_MEM_BANKS and NR_SHMEM_BANKS, the array will completely fill up and trigger the same panic. Fix this by changing the condition to strictly greater than (>). Apply the exact same fix to shm_mem_node_fill_reg_range() to prevent the same error. Fixes: cd8015b634b0 ("ARM/dom0: Avoid using a variable length array in make_memory_node()") Fixes: 7846f7699fea ("xen/arm: List static shared memory regions as /memory nodes") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel [michal: adjust for make_memory_node() living in a different file] Signed-off-by: Michal Orzel (cherry picked from commit fc453fef7708f65d4023ff63ebafe52c822229a1) --- xen/arch/arm/domain_build.c | 2 +- xen/common/device-tree/static-shmem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index fb8fbb1650..3c808e2c07 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -688,7 +688,7 @@ int __init make_memory_node(const struct kernel_info *kinfo, int addrcells, continue; nr_cells += reg_size; - BUG_ON(nr_cells >= ARRAY_SIZE(reg)); + BUG_ON(nr_cells > ARRAY_SIZE(reg)); dt_child_set_range(&cells, addrcells, sizecells, start, size); } diff --git a/xen/common/device-tree/static-shmem.c b/xen/common/device-tree/static-shmem.c index 79f23caa77..4c4cc1b123 100644 --- a/xen/common/device-tree/static-shmem.c +++ b/xen/common/device-tree/static-shmem.c @@ -838,7 +838,7 @@ void __init shm_mem_node_fill_reg_range(const struct kernel_info *kinfo, paddr_t size = mem->bank[i].size; *nr_cells += addrcells + sizecells; - BUG_ON(*nr_cells >= DT_MEM_NODE_REG_RANGE_SIZE); + BUG_ON(*nr_cells > DT_MEM_NODE_REG_RANGE_SIZE); dt_child_set_range(&cells, addrcells, sizecells, start, size); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362927.1614725 (Exim 4.92) (envelope-from ) id 1wjxGj-0007Hh-St; Wed, 15 Jul 2026 10:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362927.1614725; Wed, 15 Jul 2026 10:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGj-0007HZ-QF; Wed, 15 Jul 2026 10:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1362927; Wed, 15 Jul 2026 10:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGi-0007HR-OJ for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxGj-007dHX-00 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxGi-002Nm3-2A for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XPdiJ4VoDdWbvzW5a65pAMdeu4cnN3qXilBxb2EimU4=; b=2bAnAoh1uIoaYn0X9tj8jzKC4M pFqq0tZftaHY7Lpq0pkMhRxlxl7tVY4oB53MP9DUCntSXWd2KiPAyVJlhGJciWQpX9ogv1AJzHZae vKj7YooUPf/gERmeQ0QnTr7B+sM+58zUU3fUagJ2oUe82hSjtrehJXZJqtkBURddUsCg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: Fix off-by-one in iomem_deny_access() calls Message-Id: Date: Wed, 15 Jul 2026 10:55:12 +0000 commit 8a615b0281bcf8b20ce5bd730058b43888aee592 Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:32 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: Fix off-by-one in iomem_deny_access() calls iomem_deny_access() wraps rangeset_remove_range() which takes inclusive endpoints. All call sites in the GIC and ACPI code pass 'mfn + nr' (or 'mfn + 1' for single-page regions) as the end parameter, which causes one extra page beyond each region to be denied. For single-page regions, use 'mfn' as the end (denying exactly one page). For all multi-page regions, use 'mfn + nr - 1'. This matches the correct pattern used elsewhere, e.g. in device.c. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Fixes: 66158be465 ("ARM: ITS: Deny hardware domain access to ITS") Fixes: 97e9875646 ("arm/acpi: Permit MMIO access of Xen unused devices for Dom0") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Stefano Stabellini (cherry picked from commit f25fe2452b821270ac62c2ee4f6dd4dea9ad3298) --- xen/arch/arm/acpi/domain_build.c | 2 +- xen/arch/arm/gic-v2.c | 8 ++++---- xen/arch/arm/gic-v3-its.c | 2 +- xen/arch/arm/gic-v3.c | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/xen/arch/arm/acpi/domain_build.c b/xen/arch/arm/acpi/domain_build.c index 1c3555d814..dfdd73a8ee 100644 --- a/xen/arch/arm/acpi/domain_build.c +++ b/xen/arch/arm/acpi/domain_build.c @@ -48,7 +48,7 @@ static int __init acpi_iomem_deny_access(struct domain *d) { mfn = spcr->serial_port.address >> PAGE_SHIFT; /* Deny MMIO access for UART */ - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; } diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index b23e72a3d0..014f955967 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -1079,23 +1079,23 @@ static int gicv2_iomem_deny_access(struct domain *d) unsigned long mfn, nr; mfn = dbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = hbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = cbase >> PAGE_SHIFT; nr = DIV_ROUND_UP(csize, PAGE_SIZE); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; mfn = vbase >> PAGE_SHIFT; - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } #ifdef CONFIG_ACPI diff --git a/xen/arch/arm/gic-v3-its.c b/xen/arch/arm/gic-v3-its.c index 34833166ad..2b186fe6bc 100644 --- a/xen/arch/arm/gic-v3-its.c +++ b/xen/arch/arm/gic-v3-its.c @@ -1009,7 +1009,7 @@ int gicv3_its_deny_access(struct domain *d) { mfn = paddr_to_pfn(its_data->addr); nr = PFN_UP(its_data->size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) { printk("iomem_deny_access failed for %lx:%lx \r\n", mfn, nr); diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index bc07f97c16..b3e104ea4a 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1602,7 +1602,7 @@ static int gicv3_iomem_deny_access(struct domain *d) mfn = dbase >> PAGE_SHIFT; nr = PFN_UP(SZ_64K); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; @@ -1614,7 +1614,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = gicv3.rdist_regions[i].base >> PAGE_SHIFT; nr = PFN_UP(gicv3.rdist_regions[i].size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1623,7 +1623,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = cbase >> PAGE_SHIFT; nr = PFN_UP(csize); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1632,7 +1632,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = vbase >> PAGE_SHIFT; nr = PFN_UP(csize); - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } return 0; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362928.1614728 (Exim 4.92) (envelope-from ) id 1wjxGt-0007Je-UD; Wed, 15 Jul 2026 10:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362928.1614728; Wed, 15 Jul 2026 10:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGt-0007JX-Rg; Wed, 15 Jul 2026 10:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1362928; Wed, 15 Jul 2026 10:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxGs-0007JP-TF for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxGt-007dIA-0J for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxGs-002O60-2W for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XWr9XBalzaLnpTjnryafnJaP12Lglk89JhIxF+JtAT0=; b=N4yihXbsfAkSvBAy0301GNCDLx mKt0qJfF4Oyber+nz5RK7Ej8eE7bJvueqkmsAzYiC/ThJ/gyfg8GFB6br163ou8PrYhIVd01ym7XJ Y9TOfddxSn548YZR7xXIRcxVkYvHAdAGW+g8OrQpyy3Z8Fx0l0Vr+uGgVb5xHHuceC+U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface Message-Id: Date: Wed, 15 Jul 2026 10:55:22 +0000 commit c72fa3472505ff1f1957548c2783d894979876fa Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:34 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface gicv3_iomem_deny_access() incorrectly uses csize (physical CPU interface size) instead of vsize (virtual CPU interface size) when calculating the number of pages to deny for the virtual CPU interface region at vbase. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit 9af54b65a4272e438d6b8508eb8d0749506856c3) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index b3e104ea4a..5641ee870f 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1631,7 +1631,7 @@ static int gicv3_iomem_deny_access(struct domain *d) if ( vbase != INVALID_PADDR ) { mfn = vbase >> PAGE_SHIFT; - nr = PFN_UP(csize); + nr = PFN_UP(vsize); return iomem_deny_access(d, mfn, mfn + nr - 1); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362929.1614732 (Exim 4.92) (envelope-from ) id 1wjxH3-0007Lm-W1; Wed, 15 Jul 2026 10:55:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362929.1614732; Wed, 15 Jul 2026 10:55:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxH3-0007Le-TD; Wed, 15 Jul 2026 10:55:33 +0000 Received: by outflank-mailman (input) for mailman id 1362929; Wed, 15 Jul 2026 10:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxH2-0007LV-UT for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxH3-007dIX-0c for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxH2-002OPJ-2o for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KJ+t5Y0ECgEz+n0Yiz9BZcEKGWbj4ymEr0FatrFS8+4=; b=uYvT+INNC++Gf0q7au/F2hbK/X yTMk7iks5nSF1I6JAMvqLXxgyCNNZPIYTxhNQAGriEB7v0Op1r5NMml8i996QGZHjlwF+R9s8gF80 i0RTsknRFvyTxCFFqnlPQYy45vCuTKgfaXqr8wZEdRix14o4qY+1dASO46Rv57RqH2ws=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v3: disable Group 1 before CPU power-down Message-Id: Date: Wed, 15 Jul 2026 10:55:32 +0000 commit 0927c7f348f9477b2757b566d9f269c26006e150 Author: Mykola Kvach AuthorDate: Fri Apr 10 09:47:45 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: disable Group 1 before CPU power-down gicv3_cpu_disable() currently writes 0 to ICC_CTLR_EL1. Unlike GICC_CTLR in the GICv2 path, ICC_CTLR_EL1 does not enable or disable physical Group 1 interrupt signalling, so this write only clears EOImode. The GICv3 power management rules require the physical group enables in the CPU interface to be cleared before the redistributor is driven into ProcessorSleep, otherwise behaviour is UNPREDICTABLE. Xen only enables Group 1 interrupts on this path, so disable the interface by clearing ICC_IGRPEN1_EL1 instead. This appears to be a copy of the GICv2 pattern where the enable control lives in CTLR, but for GICv3 the enable moved to ICC_IGRPEN1_EL1. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 18b718b6af3d38d8bed23439ec396fd4bde9b75d) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 5641ee870f..7f365cdbe9 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1028,7 +1028,7 @@ static int gicv3_cpu_init(void) static void gicv3_cpu_disable(void) { - WRITE_SYSREG(0, ICC_CTLR_EL1); + WRITE_SYSREG(0, ICC_IGRPEN1_EL1); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362930.1614736 (Exim 4.92) (envelope-from ) id 1wjxHE-0007OK-26; Wed, 15 Jul 2026 10:55:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362930.1614736; Wed, 15 Jul 2026 10:55:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHD-0007OB-Vh; Wed, 15 Jul 2026 10:55:43 +0000 Received: by outflank-mailman (input) for mailman id 1362930; Wed, 15 Jul 2026 10:55:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHD-0007O2-1D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxHD-007dIg-0u for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxHC-002Odj-37 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/ADhb30oZlQPcBeGTsFESluxVFrKGcz5t0dcyAdhOBs=; b=sDseDWRek5lpuC01dswrgEWtIj UyzvGaccUaVpvbpnGbYTbl8ZTTvVJyIpxY2IykUcSXGYX5nHvmf2XSLuHee+eiF+9VF7q6ojpLDw4 TERRbdq9DPYKDKRcBPKNpTn4F55uIXH7a/+MummPqqsPA9l5mA8R9TczPASr3DT94zUQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] arm64/insn: Avoid undefined behaviour in branch offset decode Message-Id: Date: Wed, 15 Jul 2026 10:55:42 +0000 commit 7d003af01d0d196e0bf1d5fde7a9083d27258fa1 Author: Edgar E. Iglesias AuthorDate: Wed Apr 22 18:45:06 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 arm64/insn: Avoid undefined behaviour in branch offset decode Branch offset decoding sign-extends the immediate by shifting it left into bit 31 and back. Perform the left shift in uint32_t and cast to int32_t only for the final right shift to avoid UBSAN failures on negative offsets. Fixes: 6dbf3f0e3074 ("xen/arm: arm64: Add helpers to decode and encode branch instructions") Signed-off-by: Edgar E. Iglesias Reviewed-by: Stefano Stabellini (cherry picked from commit 65a99a4063ccac92237f6d2cd45cb94b5574baa9) --- xen/arch/arm/arm64/insn.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/arm64/insn.c b/xen/arch/arm/arm64/insn.c index 81f7914610..6b97a84ba7 100644 --- a/xen/arch/arm/arm64/insn.c +++ b/xen/arch/arm/arm64/insn.c @@ -225,22 +225,22 @@ u32 __kprobes aarch64_insn_gen_nop(void) */ int32_t aarch64_get_branch_offset(uint32_t insn) { - int32_t imm; + uint32_t imm; if (aarch64_insn_is_b(insn) || aarch64_insn_is_bl(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_26, insn); - return (imm << 6) >> 4; + return (int32_t)(imm << 6) >> 4; } if (aarch64_insn_is_cbz(insn) || aarch64_insn_is_cbnz(insn) || aarch64_insn_is_bcond(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_19, insn); - return (imm << 13) >> 11; + return (int32_t)(imm << 13) >> 11; } if (aarch64_insn_is_tbz(insn) || aarch64_insn_is_tbnz(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_14, insn); - return (imm << 18) >> 16; + return (int32_t)(imm << 18) >> 16; } /* Unhandled instruction */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:55:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:55:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362931.1614741 (Exim 4.92) (envelope-from ) id 1wjxHO-0007QZ-3S; Wed, 15 Jul 2026 10:55:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362931.1614741; Wed, 15 Jul 2026 10:55:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHO-0007QR-0q; Wed, 15 Jul 2026 10:55:54 +0000 Received: by outflank-mailman (input) for mailman id 1362931; Wed, 15 Jul 2026 10:55:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHN-0007QL-40 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxHN-007dIm-1C for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxHN-002P4u-0D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:55:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7NGwZztXIz4VYJeEMq7DnmzUPMFqYp0mF8ZTFx6owws=; b=Yjp/3cqJtzHspA7YCBk7u2KQmN pmxARbBMgCm3R309JPuZjXWKICzs8aO/TRlGNQ+rmUHOgysDW570mXEsORNsT8uTeDCets1KzeECf KEOscAAfWlR1vOswEh2SvJnd/bnFf8+td3Yw7D493SsAW9nYMfIYIFFmz5vFObtAYvMc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v2: disable interrupt bypass on CPU shutdown Message-Id: Date: Wed, 15 Jul 2026 10:55:53 +0000 commit 715bf77ce1741e01dfd51c7e5c3e354126d5a839 Author: Mykola Kvach AuthorDate: Tue Apr 28 14:57:55 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v2: disable interrupt bypass on CPU shutdown The GICv2 CPU shutdown path currently writes 0 to GICC_CTLR. Per IHI0048B.b section 2.3.1, clearing the architected bypass-disable bits selects bypass rather than deasserted interrupt outputs when the CPU interface stops driving them. Tables 2-2 and 2-3 show that a zeroed GICC_CTLR can fall back to the legacy IRQ/FIQ inputs instead of fully disabling the interface. Fix this by reading GICC_CTLR, then setting the bypass-disable bits and clearing the group-enable bits that are architecturally defined for the current GICC_CTLR view before writing the value back. When Security Extensions are implemented Xen accesses the Non-secure copy of GICC_CTLR, where IRQBypDisGrp1 and FIQBypDisGrp1 are at bits [6:5] and bits [8:7] are reserved. Without Security Extensions (GICD_CTLR.DS=1), GICD_IGROUPR is RAZ/WI and all interrupts are Group 0, so clearing EnableGrp0 alone is sufficient to stop interrupt delivery through the CPU interface. Section 2.3.2 also states that wakeup event signals remain available even when both GIC interrupt signaling and interrupt bypass are disabled, so disabling bypass does not break the power-management use case, i.e. suspend modes. Fixes: 5e40a1b4351e ("arm: SMP CPU shutdown") Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Reviewed-by: Michal Orzel (cherry picked from commit 6f00fd9d6c1d6f08ab21f16c0406b3bb2c1e3b01) --- xen/arch/arm/gic-v2.c | 12 +++++++++++- xen/arch/arm/include/asm/gic.h | 25 +++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index 014f955967..43a379fdda 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -408,7 +408,17 @@ static void gicv2_cpu_init(void) static void gicv2_cpu_disable(void) { - writel_gicc(0x0, GICC_CTLR); + uint32_t ctlr = readl_gicc(GICC_CTLR); + + if ( readl_gicd(GICD_TYPER) & GICD_TYPE_SEC ) + ctlr |= GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK; + else + ctlr |= GICC_CTLR_BYPASS_DISABLE_GRP0_MASK | + GICC_CTLR_BYPASS_DISABLE_GRP1_MASK; + + ctlr &= ~GICC_CTL_ENABLE; + + writel_gicc(ctlr, GICC_CTLR); } static void gicv2_hyp_init(void) diff --git a/xen/arch/arm/include/asm/gic.h b/xen/arch/arm/include/asm/gic.h index 3947c8634d..8ea256ecc6 100644 --- a/xen/arch/arm/include/asm/gic.h +++ b/xen/arch/arm/include/asm/gic.h @@ -102,8 +102,29 @@ #define GICD_TYPE_SEC 0x400 #define GICD_TYPER_DVIS (1U << 18) -#define GICC_CTL_ENABLE 0x1 -#define GICC_CTL_EOI (0x1 << 9) +/* + * Xen runs in the Non-secure world. When Security Extensions are present, + * Xen accesses the Non-secure GICC_CTLR view, where bit[0] is EnableGrp1 + * and bits[6:5] are the Group 1 bypass-disable bits. Otherwise Xen sees the + * common GICC_CTLR layout, where bit[0] is EnableGrp0, bit[1] is EnableGrp1, + * bits[6:5] are the Group 0 bypass-disable bits, and bits[8:7] are the + * Group 1 bypass-disable bits. + */ +#define GICC_CTL_ENABLE (0x1 << 0) +#define GICC_CTL_ENABLE_GRP1 (0x1 << 1) +#define GICC_CTL_FIQBypDisGrp0 (0x1 << 5) +#define GICC_CTL_IRQBypDisGrp0 (0x1 << 6) +#define GICC_CTL_FIQBypDisGrp1 (0x1 << 7) +#define GICC_CTL_IRQBypDisGrp1 (0x1 << 8) + +#define GICC_CTLR_BYPASS_DISABLE_GRP0_MASK \ + (GICC_CTL_FIQBypDisGrp0 | GICC_CTL_IRQBypDisGrp0) +#define GICC_CTLR_BYPASS_DISABLE_GRP1_MASK \ + (GICC_CTL_FIQBypDisGrp1 | GICC_CTL_IRQBypDisGrp1) +#define GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK \ + GICC_CTLR_BYPASS_DISABLE_GRP0_MASK + +#define GICC_CTL_EOI (0x1 << 9) #define GICC_IA_IRQ 0x03ff #define GICC_IA_CPU_MASK 0x1c00 -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362933.1614744 (Exim 4.92) (envelope-from ) id 1wjxHZ-0007Sm-4k; Wed, 15 Jul 2026 10:56:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362933.1614744; Wed, 15 Jul 2026 10:56:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHZ-0007Se-2D; Wed, 15 Jul 2026 10:56:05 +0000 Received: by outflank-mailman (input) for mailman id 1362933; Wed, 15 Jul 2026 10:56:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHX-0007SV-9F for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxHX-007dJ6-1i for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxHX-002PFq-0X for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ojDzdHwMy0vvg5ndlf1DttP/sS/V8xsJ7yLVtKEUIGE=; b=Q0naDJJd1NVXJWmJWLWkM2sgDf dFRxSsndAQGioVfqoPG5oGHo6oY/aOn+qJvNg9siCLeTeVtxZreU8qFeEZ6lXSVxhMmiXwUE/Z/Iu GlvHU/zUu6nmsYWucuGIovz6mHOXrGBSIgQUDgX3PGn0VInFA4QJle+0cXKxmvcbRt7U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: sci: Don't create a domain with unsatisfied user requests Message-Id: Date: Wed, 15 Jul 2026 10:56:03 +0000 commit 483a3035fd6bdb7933ff2bb6d2d58d10af97393c Author: Michal Orzel AuthorDate: Tue May 12 09:52:55 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: sci: Don't create a domain with unsatisfied user requests On Arm we stay on the safe side and refuse to create a domain on user requests (e.g. via xl.cfg, DT options) that cannot be satisfied due to the feature not being compiled in. SCI fall through the crack and does not adhere to that i.e. a user request for SCI type other than NONE when CONFIG_SCMI_SMC (and thus CONFIG_ARM_SCI) is not set would be silently ignored. Fix it by not allowing anything else other than NONE if the feature is not enabled. Fixes: 10e7473d6024 ("xen/arm: scmi-smc: passthrough SCMI SMC to domain, single agent") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Bertrand Marquis (cherry picked from commit f7b9752dc88c626192d3115ace7585b20a025433) --- xen/arch/arm/dom0less-build.c | 11 +++++++++-- xen/arch/arm/include/asm/firmware/sci.h | 5 +++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/dom0less-build.c b/xen/arch/arm/dom0less-build.c index 4181c10538..f7f8a86b30 100644 --- a/xen/arch/arm/dom0less-build.c +++ b/xen/arch/arm/dom0less-build.c @@ -287,8 +287,7 @@ static int __init domu_dt_sci_parse(struct dt_device_node *node, d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_NONE; - if ( !IS_ENABLED(CONFIG_ARM_SCI) || - !dt_property_read_bool(node, "xen,sci_type") ) + if ( !dt_property_read_bool(node, "xen,sci_type") ) return 0; ret = dt_property_read_string(node, "xen,sci_type", &sci_type); @@ -298,7 +297,15 @@ static int __init domu_dt_sci_parse(struct dt_device_node *node, if ( !strcmp(sci_type, "none") ) d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_NONE; else if ( !strcmp(sci_type, "scmi_smc") ) + { + if ( !IS_ENABLED(CONFIG_SCMI_SMC) ) + { + printk(XENLOG_ERR "xen,sci_type=scmi_smc requested, but CONFIG_SCMI_SMC not set\n"); + return -EINVAL; + } + d_cfg->arch.arm_sci_type = XEN_DOMCTL_CONFIG_ARM_SCI_SCMI_SMC; + } else { printk(XENLOG_ERR "xen,sci_type in not valid (%s) for domain %s\n", diff --git a/xen/arch/arm/include/asm/firmware/sci.h b/xen/arch/arm/include/asm/firmware/sci.h index 3500216bc2..485ce211c9 100644 --- a/xen/arch/arm/include/asm/firmware/sci.h +++ b/xen/arch/arm/include/asm/firmware/sci.h @@ -148,6 +148,8 @@ int sci_dt_finalize(struct domain *d, void *fdt); int sci_assign_dt_device(struct domain *d, struct dt_device_node *dev); #else +#include + static inline bool sci_domain_is_enabled(struct domain *d) { return false; @@ -162,6 +164,9 @@ static inline int sci_domain_init(struct domain *d, static inline int sci_domain_sanitise_config(struct xen_domctl_createdomain *config) { + if ( config->arch.arm_sci_type != XEN_DOMCTL_CONFIG_ARM_SCI_NONE ) + return -EINVAL; + return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362934.1614749 (Exim 4.92) (envelope-from ) id 1wjxHj-0007Uf-6B; Wed, 15 Jul 2026 10:56:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362934.1614749; Wed, 15 Jul 2026 10:56:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHj-0007UX-3a; Wed, 15 Jul 2026 10:56:15 +0000 Received: by outflank-mailman (input) for mailman id 1362934; Wed, 15 Jul 2026 10:56:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHh-0007UP-C2 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxHh-007dJC-20 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxHh-002PnE-11 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zRLBsfMySH/GVJYSTrZGLQRtbxb/HeEOxuFWgSPiOE8=; b=Kgyxzv/1Q/Xbab9xUBRM74vYLD lZPI1JjlnSZmichmdHYJyTjmsFiB8u3yge48vzmUwvWf2qlHV/Q14N2Edw2ThB0nQrFTmhWiSTuBV yubzrsBXYCGK1NV0dc32zq85yrKOLoFeJH8ONy2v7hZuqyYVeR0Amc4LX75d4QzyDMwI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen: arm: fix len type for guest copy functions Message-Id: Date: Wed, 15 Jul 2026 10:56:13 +0000 commit f593155e7c73b8d074ce37212841368321e22ec8 Author: Oleksii Kurochko AuthorDate: Thu May 7 10:58:40 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen: arm: fix len type for guest copy functions Widen the len argument of copy_to_guest_phys_flush_dcache() and the copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as the function can be used to copy large blobs such as the initrd which may exceed 4GB. Update the internal copy_guest() len argument to unsigned long accordingly. Change the type for local variable size in copy_guest() to avoid compilation error because of type mismatch. raw_* wrappers above copy_guest() keep returning unsigned long to avoid type narrowing; it is not an issue for raw_*'s len argument to remain 'unsigned int' since the assignment to copy_guest()'s wider unsigned long parameter is safe and there is no raw_* users who are using a value bigger than what can fit into 'unsigned int'. Fixes: 2986481b3d9e6 ("xen/arm: guest_copy: Extend the prototype to pass the vCPU") Fixes: 5302bd490bea7 ("xen/arm: Introduce copy_to_guest_phys_flush_dcache") Fixes: d07b7369aa65b ("xen/common: dom0less: introduce common domain-build.c") Reported-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Luca Fancellu Acked-by: Michal Orzel (cherry picked from commit e4424b9a635623b247a9a070db1238bf93f94764) --- xen/arch/arm/guestcopy.c | 6 +++--- xen/arch/arm/include/asm/guest_access.h | 2 +- xen/include/xen/fdt-domain-build.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c index 497e785ec4..a257bee3e4 100644 --- a/xen/arch/arm/guestcopy.c +++ b/xen/arch/arm/guestcopy.c @@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t info, uint64_t addr, return page; } -static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, +static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len, copy_info_t info, unsigned int flags) { /* XXX needs to handle faults */ @@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, while ( len ) { void *p; - unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset); + unsigned long size = min(len, PAGE_SIZE + 0UL - offset); struct page_info *page; page = translate_get_page(info, addr, flags & COPY_linear, @@ -136,7 +136,7 @@ unsigned long raw_copy_from_guest(void *to, const void __user *from, unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len) + unsigned long len) { return copy_guest(buf, gpa, len, GPA_INFO(d), COPY_to_guest | COPY_ipa | COPY_flush_dcache); diff --git a/xen/arch/arm/include/asm/guest_access.h b/xen/arch/arm/include/asm/guest_access.h index 18c88b70d7..c13cbec55b 100644 --- a/xen/arch/arm/include/asm/guest_access.h +++ b/xen/arch/arm/include/asm/guest_access.h @@ -14,7 +14,7 @@ unsigned long raw_clear_guest(void *to, unsigned int len); unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); int access_guest_memory_by_gpa(struct domain *d, paddr_t gpa, void *buf, uint32_t size, bool is_write); diff --git a/xen/include/xen/fdt-domain-build.h b/xen/include/xen/fdt-domain-build.h index 886a853816..1d9e77df0e 100644 --- a/xen/include/xen/fdt-domain-build.h +++ b/xen/include/xen/fdt-domain-build.h @@ -47,7 +47,7 @@ static inline int get_allocation_size(paddr_t size) typedef unsigned long (*copy_to_guest_phys_cb)(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); void initrd_load(struct kernel_info *kinfo, copy_to_guest_phys_cb cb); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362935.1614753 (Exim 4.92) (envelope-from ) id 1wjxHt-0007Wb-80; Wed, 15 Jul 2026 10:56:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362935.1614753; Wed, 15 Jul 2026 10:56:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHt-0007WS-4v; Wed, 15 Jul 2026 10:56:25 +0000 Received: by outflank-mailman (input) for mailman id 1362935; Wed, 15 Jul 2026 10:56:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxHr-0007WL-Gm for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxHr-007dJL-2T for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxHr-002QBY-1J for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ak6LoUu4R1s2KTibtA0LCo5PZhtfWi3gRBcqSjdpU00=; b=1e7iQ6vkNfktkzAyT74Wlrr8Vi Fv26Ey6Q6h3WXMR9q1RwANGp8d8C3PMZohs9XVARBfrdvihaRj/XAv2hX2yC0/nkt5sxJfasVJZwV NOySKwvNoVfb+A66BM3sIElQUJ6SD0F1TdRF4Cxpeen07AoJtZiz37bbV2QVX27B5HmU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v3: Wait for redistributor RWP using the right bit Message-Id: Date: Wed, 15 Jul 2026 10:56:23 +0000 commit 08156620f12e03aa63876544cefcd635062fc62e Author: Mykola Kvach AuthorDate: Thu May 14 12:08:13 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Wait for redistributor RWP using the right bit gicv3_do_wait_for_rwp() is used for both distributor and redistributor writes. The CTLR register is at offset 0 for both, but the RWP bit is not in the same position. For GICD_CTLR, RWP is bit 31. For GICR_CTLR, bit 31 is UWP, while RWP is bit 3. The redistributor wait path was therefore polling UWP instead of RWP. UWP covers upstream writes, including Generate SGI packets, and is not a substitute for redistributor register write completion. The existing redistributor callers need RWP semantics for redistributor register writes such as GICR_ICENABLER0 and GICR_CTLR updates. Add GICR_CTLR_RWP and pass the expected RWP bit to the shared helper. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Reported-by: Luca Fancellu Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit d86cf3cbd4ad105c00e12b0d51646049a87f1c44) --- xen/arch/arm/gic-v3.c | 14 +++++++++----- xen/arch/arm/include/asm/gic_v3_defs.h | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 7f365cdbe9..dfd5d44603 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -274,16 +274,20 @@ static void gicv3_enable_sre(void) isb(); } -/* Wait for completion of a distributor change */ -static void gicv3_do_wait_for_rwp(void __iomem *base) +/* Wait for completion of a distributor/redistributor change */ +static void gicv3_do_wait_for_rwp(void __iomem *base, uint32_t rwp_bit) { uint32_t val; bool timeout = false; s_time_t deadline = NOW() + MILLISECS(1000); do { + /* + * GICD_CTLR and GICR_CTLR are both at offset 0, so this is + * valid for either a distributor or redistributor base. + */ val = readl_relaxed(base + GICD_CTLR); - if ( !(val & GICD_CTLR_RWP) ) + if ( !(val & rwp_bit) ) break; if ( NOW() > deadline ) { @@ -300,12 +304,12 @@ static void gicv3_do_wait_for_rwp(void __iomem *base) static void gicv3_dist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD); + gicv3_do_wait_for_rwp(GICD, GICD_CTLR_RWP); } static void gicv3_redist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD_RDIST_BASE); + gicv3_do_wait_for_rwp(GICD_RDIST_BASE, GICR_CTLR_RWP); } static void gicv3_wait_for_rwp(int irq) diff --git a/xen/arch/arm/include/asm/gic_v3_defs.h b/xen/arch/arm/include/asm/gic_v3_defs.h index c373b94d19..3714cfeb7d 100644 --- a/xen/arch/arm/include/asm/gic_v3_defs.h +++ b/xen/arch/arm/include/asm/gic_v3_defs.h @@ -146,6 +146,7 @@ #define GICR_NSACR (0x0E00) #define GICR_CTLR_ENABLE_LPIS (1U << 0) +#define GICR_CTLR_RWP (1U << 3) #define GICR_TYPER_PLPIS (1U << 0) #define GICR_TYPER_VLPIS (1U << 1) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362936.1614758 (Exim 4.92) (envelope-from ) id 1wjxI3-0007YL-9X; Wed, 15 Jul 2026 10:56:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362936.1614758; Wed, 15 Jul 2026 10:56:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxI3-0007YD-6G; Wed, 15 Jul 2026 10:56:35 +0000 Received: by outflank-mailman (input) for mailman id 1362936; Wed, 15 Jul 2026 10:56:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxI1-0007Y6-RV for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxI2-007dJf-08 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxI1-002Qdw-2G for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8qPOVqfrpGPY7Mv72GdU61ZFtnwXZ2oI+Edf2LprZe8=; b=NEYC+GK6Jq3+oAbCanrxNNNfCN 7/NBXtR5hrW/Htd/PWoL+B5gg9mZZ0XD9fk6LFz6pv4J2FXOxEwy9371iJ0pK9551Zu1CcdkOIYd4 Yn6Fzyv/gTRNJwEwAyN+eEkfL+i2QBSZgwbwtnExWmkZb7RJ+vLeK4wSxyk6K1X4BqcU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor Message-Id: Date: Wed, 15 Jul 2026 10:56:33 +0000 commit 20c5792dc96ed2ae55784b4b761c4233135d308d Author: Mykola Kvach AuthorDate: Tue May 19 17:31:54 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor gicv3_dist_init() disables the distributor before reprogramming the global interrupt state. It used to do this by writing 0 to GICD_CTLR. On a system where firmware has already enabled Non-secure affinity routing, a zero write clears the Non-secure view's GICD_CTLR.ARE_NS bit. Arm IHI 0069H.b, section 2.3.3 ("Changing affinity routing enables"), states that changing GICD_CTLR.ARE_NS from 1 to 0 is UNPREDICTABLE. The GICD_CTLR register description in section 12.9.4 carries the same rule for the ARE_NS field. Preserve ARE_NS while clearing the group enable bits. If firmware left ARE_NS clear, the value written is still 0, preserving the existing initialization flow. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel Reviewed-by: Luca Fancellu Release-Acked-by: Oleksii Kurochko (cherry picked from commit e63ba93511b33c0d3bb8cc5870f946f41e1d2655) --- xen/arch/arm/gic-v3.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index dfd5d44603..194a984f0b 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -749,12 +749,17 @@ static void __init gicv3_dist_espi_init_aff(uint64_t affinity) { } static void __init gicv3_dist_init(void) { uint32_t type; + uint32_t ctlr; uint64_t affinity; unsigned int nr_lines; int i; - /* Disable the distributor */ - writel_relaxed(0, GICD + GICD_CTLR); + /* + * Disable the distributor without clearing ARE_NS. The GIC architecture + * makes changing ARE_NS from 1 to 0 UNPREDICTABLE. + */ + ctlr = readl_relaxed(GICD + GICD_CTLR); + writel_relaxed(ctlr & GICD_CTLR_ARE_NS, GICD + GICD_CTLR); type = readl_relaxed(GICD + GICD_TYPER); nr_lines = 32 * ((type & GICD_TYPE_LINES) + 1); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362937.1614761 (Exim 4.92) (envelope-from ) id 1wjxID-0007ar-CA; Wed, 15 Jul 2026 10:56:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362937.1614761; Wed, 15 Jul 2026 10:56:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxID-0007aj-9N; Wed, 15 Jul 2026 10:56:45 +0000 Received: by outflank-mailman (input) for mailman id 1362937; Wed, 15 Jul 2026 10:56:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIB-0007ad-VL for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxIC-007dJj-0i for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxIB-002Qw8-2x for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ZBiHOCkSP9jdEFWmMdYxCjB5BWLDCkVjpKrU8eeKRto=; b=vBS3bGkDQutaoS9h7yXr94c9Dw ukoDLgzcQhbBmPr99kgstm4BM/gdRdV1UBvPfhNRi1NqNbVfM3ZM4JANGip01AgQyP8a/foKWgiZE tjH2nN+ZmhQDZcyOgTY70ABgVdyCOmRmsMLL/3BLuLKXBZDc7cykrHmPNMoXUPWmO2CE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: propagate vGIC vCPU init failures Message-Id: Date: Wed, 15 Jul 2026 10:56:43 +0000 commit 3322c7355be21278a59e7a8dffd74c5a4c8ba04d Author: Mykola Kvach AuthorDate: Wed May 27 03:18:50 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: propagate vGIC vCPU init failures The vGIC per-vCPU init callback can fail. In particular, GICv3 rejects a vCPU when the domain's redistributor layout has no MMIO slot covering that vCPU. However, the generic vGIC init path ignored the callback return value, so vcpu_create() could succeed with an invalid vGICv3 per-vCPU state. This can be reproduced on FVP Base RevC by exposing a 2 MiB GICv3 redistributor region to Dom0 and booting Xen with: maxcpus=1 dom0_max_vcpus=64 The host GICv3 redistributor range is: region 0: 0x0000002f100000 - 0x0000002f300000 With Xen's guest redistributor frame size of 128 KiB, that range covers 16 guest redistributors. vCPU16 and above have no corresponding redistributor slot. Before this fix, Xen detected the missing redistributors: d0: Unable to find a re-distributor for VCPU 16 ... d0: Unable to find a re-distributor for VCPU 63 but ignored the error and continued as if the secondary vCPUs had been created correctly. Dom0 then saw 64 possible CPUs and could hang during secondary CPU bring-up: smp: Bringing up secondary CPUs ... d0v15: vGICR: SGI: unhandled word write ... to ICACTIVER0 Propagate the vGIC vcpu_init() error so the caller can stop creating secondary vCPUs. With this fix, Dom0 construction reports: d0: Unable to find a re-distributor for VCPU 16 Failed to allocate d0v16 and the guest continues booting with the vCPUs created before the failure: smp: Brought up 1 node, 16 CPUs Free the private IRQ rank allocated by vcpu_vgic_init() on this error path. The caller will still run the generic vCPU creation cleanup, but XFREE() clears the pointer so that cleanup remains idempotent. Also fix the host-layout redistributor region count for the case where the requested vCPU count is larger than the capacity of all host redistributor regions. The old code always stored i + 1 after the loop. That is correct when the loop stops inside a valid region because the requested vCPU count is covered. If the loop exits after consuming all hardware regions, i is already equal to the number of allocated regions, so i + 1 records one region too many. In the same FVP setup, that off-by-one made Xen describe host-layout GICR state beyond the populated redistributor region list. Dom0 then accessed the GICR MMIO window described in its device tree, but Xen could not match the access to a valid emulated redistributor frame. During debugging this was seen as an unexpected vGICR access followed by a guest panic: d0v0: vGICR: unknown gpa read address 000000002f10ffe8 pc : gic_iterate_rdists+0x4c/0x104 Kernel panic - not syncing: Attempted to kill the idle task! Keep the existing construct_domain() policy used by Dom0 and dom0less domain construction: a failure to create a secondary vCPU stops the secondary vCPU creation loop, but does not fail the whole domain construction. Fixes: ea37fd21110b ("xen/arm: split vgic driver into generic and vgic-v2 driver") Fixes: 54ec59f6b0b3 ("xen/arm: vgic-v3: Don't create empty re-distributor regions") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 961cc8cc0febcd8b2e515c7896a076a3246d06b1) --- xen/arch/arm/vgic-v3.c | 2 +- xen/arch/arm/vgic.c | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index 8b1c8eef80..fbd2c395c0 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1824,7 +1824,7 @@ static int vgic_v3_domain_init(struct domain *d) * not match the number of pCPUs). Update the number of regions to * avoid exposing unused region as they will not get emulated. */ - d->arch.vgic.nr_regions = i + 1; + d->arch.vgic.nr_regions = min(i + 1U, vgic_v3_hw.nr_rdist_regions); d->arch.vgic.intid_bits = vgic_v3_hw.intid_bits; } diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c index 3ebdf9953f..edabf28903 100644 --- a/xen/arch/arm/vgic.c +++ b/xen/arch/arm/vgic.c @@ -368,7 +368,7 @@ void domain_vgic_free(struct domain *d) int vcpu_vgic_init(struct vcpu *v) { - int i; + int i, ret; v->arch.vgic.private_irqs = xzalloc(struct vgic_irq_rank); if ( v->arch.vgic.private_irqs == NULL ) @@ -377,7 +377,12 @@ int vcpu_vgic_init(struct vcpu *v) /* SGIs/PPIs are always routed to this VCPU */ vgic_rank_init(v->arch.vgic.private_irqs, 0, v->vcpu_id); - v->domain->arch.vgic.handler->vcpu_init(v); + ret = v->domain->arch.vgic.handler->vcpu_init(v); + if ( ret ) + { + XFREE(v->arch.vgic.private_irqs); + return ret; + } memset(&v->arch.vgic.pending_irqs, 0, sizeof(v->arch.vgic.pending_irqs)); for (i = 0; i < 32; i++) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:56:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:56:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362938.1614765 (Exim 4.92) (envelope-from ) id 1wjxIN-0007d5-DL; Wed, 15 Jul 2026 10:56:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362938.1614765; Wed, 15 Jul 2026 10:56:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIN-0007cx-Ae; Wed, 15 Jul 2026 10:56:55 +0000 Received: by outflank-mailman (input) for mailman id 1362938; Wed, 15 Jul 2026 10:56:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIM-0007cq-1t for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxIM-007dJn-0z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxIM-002ROP-00 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:56:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jcT2+4v+96Oyssfr9mQoVJZI14Ubqtt5wKJNaGdRJG4=; b=Rewu94sGgyo37pgqbt4DZ7Tt1F 2p3d9wyz2kh3bJBS1qdQSZFEqojQTJKptamtQ3pr4LRQ0i70YF4/6cf/WOOQri0/luqLClyJa5Pl4 IHQP+/zd8NHQqw7CBoEQtl7X6rTawtp67V2nZOEuKcxNEa0zm3LGj08uPjjgQo6TwIfg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: gic-v3: Fix redistributor wakeup polling Message-Id: Date: Wed, 15 Jul 2026 10:56:54 +0000 commit 530406cf21c0b7271797ee6d68375eca2fd5adf5 Author: Luca Fancellu AuthorDate: Mon May 18 08:05:24 2026 +0100 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: gic-v3: Fix redistributor wakeup polling gicv3_enable_redist() clears GICR_WAKER.ProcessorSleep and then waits for GICR_WAKER.ChildrenAsleep to clear, as required after waking a redistributor. However, the polling loop currently uses "while ( timeout )". Since timeout is initially false, the loop runs only once unless the timeout path has already been reached. As a result, Xen can continue before the redistributor has completed wakeup. Use an unconditional loop, matching the surrounding timeout/break pattern, so the code polls until either ChildrenAsleep is clear or the deadline is reached. While there, also fix the timeout message. This path polls GICR_WAKER.ChildrenAsleep, not an RWP bit, so "RWP timeout" is misleading. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Luca Fancellu Reviewed-by: Mykola Kvach Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit 941fdfc03e109a28ca9cfe71c111a1ef6cb9ed12) --- xen/arch/arm/gic-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 194a984f0b..17ff85ef5d 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -837,11 +837,11 @@ static int gicv3_enable_redist(void) } cpu_relax(); udelay(1); - } while ( timeout ); + } while ( 1 ); if ( timeout ) { - dprintk(XENLOG_ERR, "GICv3: Redist enable RWP timeout\n"); + dprintk(XENLOG_ERR, "GICv3: Redist wakeup timeout\n"); return 1; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:57:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:57:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362939.1614769 (Exim 4.92) (envelope-from ) id 1wjxIX-0007f0-Et; Wed, 15 Jul 2026 10:57:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362939.1614769; Wed, 15 Jul 2026 10:57:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIX-0007er-Bw; Wed, 15 Jul 2026 10:57:05 +0000 Received: by outflank-mailman (input) for mailman id 1362939; Wed, 15 Jul 2026 10:57:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIW-0007ek-4k for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxIW-007dK2-1H for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxIW-002RaV-0I for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=heKYDXmorMpoAbTa5BkKpSStYxUXbfi4ufgjz90RJrc=; b=Kgqw8rP68OXDAM+oJC2bq99fmk YnGBjQaFrKaDC0TWjeXO9AnSVvE7pECMGGdHhy0waDLibiBawp0ZICWuyuYJuF8RzcH6hLnBxIrGo c2sdjSg0S9dmw5aFeoDxW4kFqr1UEfFGGFR944xSHnstX8UyHiP6ryXcd6UpqdA9q/jA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] libfdt: fix UBSAN null pointer in fdt_property() Message-Id: Date: Wed, 15 Jul 2026 10:57:04 +0000 commit 60fc5ccb810d28adc53186587308389a131a821e Author: Oleksii Kurochko AuthorDate: Wed Jun 17 09:20:51 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 libfdt: fix UBSAN null pointer in fdt_property() fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit be18ad502e5d4f9248e1f020d3e0d55a7b9ea986) --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb..96d4cf5713 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len) ret = fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:57:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:57:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362940.1614773 (Exim 4.92) (envelope-from ) id 1wjxIh-0007gz-G0; Wed, 15 Jul 2026 10:57:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362940.1614773; Wed, 15 Jul 2026 10:57:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIh-0007gr-DE; Wed, 15 Jul 2026 10:57:15 +0000 Received: by outflank-mailman (input) for mailman id 1362940; Wed, 15 Jul 2026 10:57:14 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIg-0007gk-7K for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:14 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxIg-007dK6-1X for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxIg-002Rw9-0Z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sWscBtqpvEIBq2orZ22tfXDLL0FxOAcCZyXAk3Mt0nw=; b=EZs8gSvAmg3PWW7HoaH8CqReSJ eEaF5cFW51tk5Vs8qongU+N5evoW5+o1XJXdT4tmfvf8luq1SEqE6Hz72duVFlxNTPjQqPbgONGDW O64f68PrRIWBOt/Tsqh/fBi68VQicbs9yMOKLRTfU2II2BHM0U3veC6BOcaz7Oyll6e0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] bootfdt: Fix infinite loop in device_tree_for_each_node() Message-Id: Date: Wed, 15 Jul 2026 10:57:14 +0000 commit a455b73ddba951f0a3534612159ddcc0d7c46e0f Author: Dmytro Prokopchuk1 AuthorDate: Fri Jun 26 07:57:33 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 bootfdt: Fix infinite loop in device_tree_for_each_node() When a node's depth exceeds DEVICE_TREE_MAX_DEPTH inside the device_tree_for_each_node() loop, the code prints a warning and executes 'continue;' statement, which jumps to condition check, bypassing the iterator update step: node = fdt_next_node(fdt, node, &depth). The node and depth are not updated, the loop repeatedly evaluates the same too-deep node, causing a hang. Fix this by wrapping the node processing logic in an 'else' block. This ensures the loop update step is executed on every iteration, safely skipping deeply nested nodes and doing the traversal. Fixes: 40f2ea3df2e2 ("xen/arm: pass node to device_tree_for_each_node") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleskii Kurochko (cherry picked from commit 3b717f57dca508f546303dd34067b7b906ba459e) --- xen/common/device-tree/bootfdt.c | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/xen/common/device-tree/bootfdt.c b/xen/common/device-tree/bootfdt.c index 7c790b9a4d..8e9b45d1a7 100644 --- a/xen/common/device-tree/bootfdt.c +++ b/xen/common/device-tree/bootfdt.c @@ -90,23 +90,28 @@ int __init device_tree_for_each_node(const void *fdt, int node, { printk("Warning: device tree node `%s' is nested too deep\n", name); - continue; } - - as = depth > 0 ? address_cells[depth-1] : DT_ROOT_NODE_ADDR_CELLS_DEFAULT; - ss = depth > 0 ? size_cells[depth-1] : DT_ROOT_NODE_SIZE_CELLS_DEFAULT; - - address_cells[depth] = device_tree_get_u32(fdt, node, - "#address-cells", as); - size_cells[depth] = device_tree_get_u32(fdt, node, - "#size-cells", ss); - - /* skip the first node */ - if ( node != first_node ) + else { - ret = func(fdt, node, name, depth, as, ss, data); - if ( ret != 0 ) - return ret; + as = depth > 0 ? + address_cells[depth - 1] : + DT_ROOT_NODE_ADDR_CELLS_DEFAULT; + ss = depth > 0 ? + size_cells[depth - 1] : + DT_ROOT_NODE_SIZE_CELLS_DEFAULT; + + address_cells[depth] = device_tree_get_u32(fdt, node, + "#address-cells", as); + size_cells[depth] = device_tree_get_u32(fdt, node, + "#size-cells", ss); + + /* skip the first node */ + if ( node != first_node ) + { + ret = func(fdt, node, name, depth, as, ss, data); + if ( ret != 0 ) + return ret; + } } node = fdt_next_node(fdt, node, &depth); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:57:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:57:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362941.1614777 (Exim 4.92) (envelope-from ) id 1wjxIr-0007is-HH; Wed, 15 Jul 2026 10:57:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362941.1614777; Wed, 15 Jul 2026 10:57:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIr-0007ik-Eh; Wed, 15 Jul 2026 10:57:25 +0000 Received: by outflank-mailman (input) for mailman id 1362941; Wed, 15 Jul 2026 10:57:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxIq-0007ic-A8 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxIq-007dKC-1p for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxIq-002SBq-0o for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=h8hM1C67n7W4KEwVg6+TRatHbOnGBGUDlccBrILIfh4=; b=t5QGJnUgVNVkZCf3BKMH8t4mYR 5OJ5Hnui2VDwbqYGthgCKFMkp3pbIG2m8sa2TXO1Md2K18wRPDlxVkzWdLQGwBhB1E0epf44+5SCq c90v/sOdfNlUnCpwHdbo4eyHFW5Bl/y05q6fSkg6jX2lXVEWiOCbHRm4/wQ5D6tk+/Ic=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 15 Jul 2026 10:57:24 +0000 commit f53ec9edb64c0bcad21540fffd44c9b747e3d861 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 15 09:46:50 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel (cherry picked from commit ccde3773c1762d32fb5f6037d6b22780c30895d3) --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 7f3cfa812e..ba5fd2dd52 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -238,7 +238,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -251,10 +253,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:57:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:57:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362942.1614781 (Exim 4.92) (envelope-from ) id 1wjxJ2-0007nY-IZ; Wed, 15 Jul 2026 10:57:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362942.1614781; Wed, 15 Jul 2026 10:57:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxJ2-0007nQ-Fz; Wed, 15 Jul 2026 10:57:36 +0000 Received: by outflank-mailman (input) for mailman id 1362942; Wed, 15 Jul 2026 10:57:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxJ0-0007lx-Dl for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxJ0-007dKc-28 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxJ0-002SJu-18 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:34 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=uD+9LnCfBZcpN66qV2qddb4KNRKV+SX6XIGwi9FOVBA=; b=Zf18tcYIouGaoICPtWPPH7FM6A tTdrh30jKbCrIzVTYdDx6QKtzWK6ixKnosAHfb4dOcu0jOKsqyOoNvUEfWoL+Do0HQPcPGvolvd2G 6qxpGb7StCUYLSvEgIRJ3PztJaFsJ0goRkaVUx3O7/0PFzb0/e0Avp4AtbxvTsYKpN3k=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Wed, 15 Jul 2026 10:57:34 +0000 commit f26f5e83521bc6ed942f32787b4389635c622a8d Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:50:16 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 3c808e2c07..2a4c3dcae7 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1947,7 +1947,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 10:57:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 10:57:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362943.1614785 (Exim 4.92) (envelope-from ) id 1wjxJC-0007tS-KG; Wed, 15 Jul 2026 10:57:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362943.1614785; Wed, 15 Jul 2026 10:57:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxJC-0007tK-HE; Wed, 15 Jul 2026 10:57:46 +0000 Received: by outflank-mailman (input) for mailman id 1362943; Wed, 15 Jul 2026 10:57:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjxJA-0007ss-Ge for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjxJA-007dKg-2Q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjxJA-002Sa9-1Q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 10:57:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=K7hGplMv0K5oaSEwzg9plB3kYjqIiBcDT17v/TqUquo=; b=pyrNRghhgzot0sovTu3WdzHpjm XIoFDuOl8UQq2XR5I2RJkpJhqCrl4FJxLQ5cqJo6zBjtQcUk6VLBYLmgYTXpv7t14imzt9i4/IsJF oLny3LW2Zs72Mck4QLgUnIR9GmR7H1ZwrLfZ5rdG40ZMs+DQwAA6XZ9tp6YsX0debhz8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Wed, 15 Jul 2026 10:57:44 +0000 commit 137827d858090851cfbb3cd81e8133bca9485354 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:50:49 2026 +0200 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/common/device-tree/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c index 9fd004c42a..e4d5e95c6e 100644 --- a/xen/common/device-tree/dom0less-build.c +++ b/xen/common/device-tree/dom0less-build.c @@ -152,10 +152,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, return -ENOMEM; } + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363005.1614806 (Exim 4.92) (envelope-from ) id 1wjyS7-0001lO-EI; Wed, 15 Jul 2026 12:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363005.1614806; Wed, 15 Jul 2026 12:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyS7-0001lG-Bi; Wed, 15 Jul 2026 12:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1363005; Wed, 15 Jul 2026 12:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyS6-0001lA-0W for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyS6-007ejt-0a for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyS5-004f38-2l for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xS4eZNJF2GjwqJHe85C/tIOBkNxCYdVasIrzkDQGgSA=; b=uyU6RuDeab0A7ExKZxPxGODBMy OAHEr2cAUYW72vdxTkwVBC+lz8HDw8byingU3lTpb6PisDbvbIHMZNmj+chtO6KCm7ZZgn5f+nqUx VMvHgrQ8cZdkR0jnonMY9HjGkamCKaiKfASHcwseq3+eORTl8TfnEcYDdjbT+sgpkaAg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/device-tree: Fix off-by-one bounds check in make_memory_node() Message-Id: Date: Wed, 15 Jul 2026 12:11:01 +0000 commit 6610b4f3ac8722dfdbbd9e0f587e5af83a164540 Author: Oleksandr Tyshchenko AuthorDate: Thu Apr 2 20:38:35 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/device-tree: Fix off-by-one bounds check in make_memory_node() When building Xen with CONFIG_STATIC_SHM=n, booting a hardware domain with exactly NR_MEM_BANKS (256) reserved-memory regions causes a panic: (XEN) Xen BUG at common/device-tree/domain-build.c:497 (XEN) Xen call trace: (XEN) [<00000a0000289aa8>] make_memory_node+0x178/0x234 (PC) This occurs due to an off-by-one error in the bounds checking of the reg array in make_memory_node(). The check: BUG_ON(nr_cells >= ARRAY_SIZE(reg)); incorrectly triggers when the array is exactly full (i.e., when nr_cells == ARRAY_SIZE(reg)), preventing the 256th and final valid memory region from being written. When CONFIG_STATIC_SHM=y, this bug is usually hidden because DT_MEM_NODE_REG_RANGE_SIZE adds extra space for SHM banks. This extra capacity prevents the array from reaching its maximum limit while processing the 256th memory region. However, if a domain is configured with exactly NR_MEM_BANKS and NR_SHMEM_BANKS, the array will completely fill up and trigger the same panic. Fix this by changing the condition to strictly greater than (>). Apply the exact same fix to shm_mem_node_fill_reg_range() to prevent the same error. Fixes: cd8015b634b0 ("ARM/dom0: Avoid using a variable length array in make_memory_node()") Fixes: 7846f7699fea ("xen/arm: List static shared memory regions as /memory nodes") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel [michal: adjust for functions living in different files] Signed-off-by: Michal Orzel (cherry picked from commit fc453fef7708f65d4023ff63ebafe52c822229a1) --- xen/arch/arm/domain_build.c | 2 +- xen/arch/arm/static-shmem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 7b47abade1..7df1f757fb 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -826,7 +826,7 @@ int __init make_memory_node(const struct kernel_info *kinfo, int addrcells, continue; nr_cells += reg_size; - BUG_ON(nr_cells >= ARRAY_SIZE(reg)); + BUG_ON(nr_cells > ARRAY_SIZE(reg)); dt_child_set_range(&cells, addrcells, sizecells, start, size); } diff --git a/xen/arch/arm/static-shmem.c b/xen/arch/arm/static-shmem.c index 8f87154c35..4dfdd5d193 100644 --- a/xen/arch/arm/static-shmem.c +++ b/xen/arch/arm/static-shmem.c @@ -896,7 +896,7 @@ void __init shm_mem_node_fill_reg_range(const struct kernel_info *kinfo, paddr_t size = mem->bank[i].size; *nr_cells += addrcells + sizecells; - BUG_ON(*nr_cells >= DT_MEM_NODE_REG_RANGE_SIZE); + BUG_ON(*nr_cells > DT_MEM_NODE_REG_RANGE_SIZE); dt_child_set_range(&cells, addrcells, sizecells, start, size); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363006.1614810 (Exim 4.92) (envelope-from ) id 1wjySH-0001mn-Fc; Wed, 15 Jul 2026 12:11:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363006.1614810; Wed, 15 Jul 2026 12:11:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySH-0001me-D7; Wed, 15 Jul 2026 12:11:13 +0000 Received: by outflank-mailman (input) for mailman id 1363006; Wed, 15 Jul 2026 12:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySG-0001mO-1J for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjySG-007ek8-0v for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjySF-004fEh-38 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zZrb5iDOixn2EWuMkAwo8EdxOl4ft4z5727u1AF2S7E=; b=zhdbBZIscI/RWyGSEGfrAEunC6 nqAmfDkpJsv+ku491+KYUfOCcMuXN1eGmwv83jfi2Ipz1iDzU/b/3KcfBdod8v3vdKsCGGhWoOkTX wkXnYJvYZ4x8QLfv5ijHoM18rUte8bYbRCqBe9FuHqDkRQ+0mo8kWlbclWY+GeRvKUx0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: Fix off-by-one in iomem_deny_access() calls Message-Id: Date: Wed, 15 Jul 2026 12:11:11 +0000 commit c635373c2539b6527fa64d2e1c751610901e8013 Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:32 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: Fix off-by-one in iomem_deny_access() calls iomem_deny_access() wraps rangeset_remove_range() which takes inclusive endpoints. All call sites in the GIC and ACPI code pass 'mfn + nr' (or 'mfn + 1' for single-page regions) as the end parameter, which causes one extra page beyond each region to be denied. For single-page regions, use 'mfn' as the end (denying exactly one page). For all multi-page regions, use 'mfn + nr - 1'. This matches the correct pattern used elsewhere, e.g. in device.c. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Fixes: 66158be465 ("ARM: ITS: Deny hardware domain access to ITS") Fixes: 97e9875646 ("arm/acpi: Permit MMIO access of Xen unused devices for Dom0") Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Reviewed-by: Stefano Stabellini (cherry picked from commit f25fe2452b821270ac62c2ee4f6dd4dea9ad3298) --- xen/arch/arm/acpi/domain_build.c | 2 +- xen/arch/arm/gic-v2.c | 8 ++++---- xen/arch/arm/gic-v3-its.c | 2 +- xen/arch/arm/gic-v3.c | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/xen/arch/arm/acpi/domain_build.c b/xen/arch/arm/acpi/domain_build.c index 2ce75543d0..1f6b318854 100644 --- a/xen/arch/arm/acpi/domain_build.c +++ b/xen/arch/arm/acpi/domain_build.c @@ -47,7 +47,7 @@ static int __init acpi_iomem_deny_access(struct domain *d) { mfn = spcr->serial_port.address >> PAGE_SHIFT; /* Deny MMIO access for UART */ - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; } diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index 02043c0d4b..a3fc3cee75 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -1079,23 +1079,23 @@ static int gicv2_iomem_deny_access(struct domain *d) unsigned long mfn, nr; mfn = dbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = hbase >> PAGE_SHIFT; - rc = iomem_deny_access(d, mfn, mfn + 1); + rc = iomem_deny_access(d, mfn, mfn); if ( rc ) return rc; mfn = cbase >> PAGE_SHIFT; nr = DIV_ROUND_UP(csize, PAGE_SIZE); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; mfn = vbase >> PAGE_SHIFT; - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } #ifdef CONFIG_ACPI diff --git a/xen/arch/arm/gic-v3-its.c b/xen/arch/arm/gic-v3-its.c index 5fd83af25a..e3e068f778 100644 --- a/xen/arch/arm/gic-v3-its.c +++ b/xen/arch/arm/gic-v3-its.c @@ -894,7 +894,7 @@ int gicv3_its_deny_access(struct domain *d) { mfn = paddr_to_pfn(its_data->addr); nr = PFN_UP(its_data->size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) { printk("iomem_deny_access failed for %lx:%lx \r\n", mfn, nr); diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index cd3e1acf79..d15f0bc8a7 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1463,7 +1463,7 @@ static int gicv3_iomem_deny_access(struct domain *d) mfn = dbase >> PAGE_SHIFT; nr = PFN_UP(SZ_64K); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; @@ -1475,7 +1475,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = gicv3.rdist_regions[i].base >> PAGE_SHIFT; nr = PFN_UP(gicv3.rdist_regions[i].size); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1484,7 +1484,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = cbase >> PAGE_SHIFT; nr = PFN_UP(csize); - rc = iomem_deny_access(d, mfn, mfn + nr); + rc = iomem_deny_access(d, mfn, mfn + nr - 1); if ( rc ) return rc; } @@ -1493,7 +1493,7 @@ static int gicv3_iomem_deny_access(struct domain *d) { mfn = vbase >> PAGE_SHIFT; nr = PFN_UP(csize); - return iomem_deny_access(d, mfn, mfn + nr); + return iomem_deny_access(d, mfn, mfn + nr - 1); } return 0; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363007.1614815 (Exim 4.92) (envelope-from ) id 1wjySR-0001ou-Gv; Wed, 15 Jul 2026 12:11:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363007.1614815; Wed, 15 Jul 2026 12:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySR-0001om-ER; Wed, 15 Jul 2026 12:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1363007; Wed, 15 Jul 2026 12:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySQ-0001of-4d for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjySQ-007ekI-1G for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjySQ-004fJN-0D for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eA6FDEXjXJA6zHvVB7cBmmVxyyPF3qwFUa26le7Xv4g=; b=HHUpsvHoEA5AuRabJMO0pVQpjU SKBOGiRFJbxR3a54DzvAqHRuuobU7FrsWDAhn87Gn4VHlsJ2nxRbGovWQRcK/1foAjT+AwHdRUDxE r2ZrMSVwkzPKa9O6h35y3gBqs1Pw/7ramKJnvVWO5SJtL4+ZIkviz6+Yz1pw1dJbu9Ck=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface Message-Id: Date: Wed, 15 Jul 2026 12:11:22 +0000 commit 42a8a8abfe5a0f2c6ebe092970d219ca0885c80e Author: Michal Orzel AuthorDate: Thu Apr 9 13:39:34 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Use vsize instead of csize for virtual CPU interface gicv3_iomem_deny_access() incorrectly uses csize (physical CPU interface size) instead of vsize (virtual CPU interface size) when calculating the number of pages to deny for the virtual CPU interface region at vbase. Fixes: 8300b3377e ("arm/gic: Add a new callback to deny Dom0 access to GIC regions") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit 9af54b65a4272e438d6b8508eb8d0749506856c3) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index d15f0bc8a7..6b8ff46aaa 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -1492,7 +1492,7 @@ static int gicv3_iomem_deny_access(struct domain *d) if ( vbase != INVALID_PADDR ) { mfn = vbase >> PAGE_SHIFT; - nr = PFN_UP(csize); + nr = PFN_UP(vsize); return iomem_deny_access(d, mfn, mfn + nr - 1); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363008.1614818 (Exim 4.92) (envelope-from ) id 1wjySb-0001r4-IC; Wed, 15 Jul 2026 12:11:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363008.1614818; Wed, 15 Jul 2026 12:11:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySb-0001qw-Fj; Wed, 15 Jul 2026 12:11:33 +0000 Received: by outflank-mailman (input) for mailman id 1363008; Wed, 15 Jul 2026 12:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySa-0001qp-7q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjySa-007ekh-1Y for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjySa-004fTj-0Z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=0V+fgGyGk3JBh2rGmWEbby/3DTsB96VrkXE6b+Ynu54=; b=4DxQPLv0vQ//S9B+ocPh7gcor7 SRX7qigzwnEUsFRbC06ezCnc/27DgPcg/LBTklInw/jADgEH5d6HNGCSAJGqJWOmJqJ0YNYmvRAIE AuKCkyzuj3KGudbVcedKS1bGKngKQ2sbrZ4fX3H0ClI4OpBV3vRkUSJRyPgcwLfvRLxs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v3: disable Group 1 before CPU power-down Message-Id: Date: Wed, 15 Jul 2026 12:11:32 +0000 commit b3943777397d6b914e1ceda9a91f21223303404a Author: Mykola Kvach AuthorDate: Fri Apr 10 09:47:45 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: disable Group 1 before CPU power-down gicv3_cpu_disable() currently writes 0 to ICC_CTLR_EL1. Unlike GICC_CTLR in the GICv2 path, ICC_CTLR_EL1 does not enable or disable physical Group 1 interrupt signalling, so this write only clears EOImode. The GICv3 power management rules require the physical group enables in the CPU interface to be cleared before the redistributor is driven into ProcessorSleep, otherwise behaviour is UNPREDICTABLE. Xen only enables Group 1 interrupts on this path, so disable the interface by clearing ICC_IGRPEN1_EL1 instead. This appears to be a copy of the GICv2 pattern where the enable control lives in CTLR, but for GICv3 the enable moved to ICC_IGRPEN1_EL1. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 18b718b6af3d38d8bed23439ec396fd4bde9b75d) --- xen/arch/arm/gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 6b8ff46aaa..c609596def 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -895,7 +895,7 @@ static int gicv3_cpu_init(void) static void gicv3_cpu_disable(void) { - WRITE_SYSREG(0, ICC_CTLR_EL1); + WRITE_SYSREG(0, ICC_IGRPEN1_EL1); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363009.1614823 (Exim 4.92) (envelope-from ) id 1wjySl-0001sx-JZ; Wed, 15 Jul 2026 12:11:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363009.1614823; Wed, 15 Jul 2026 12:11:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySl-0001sp-H2; Wed, 15 Jul 2026 12:11:43 +0000 Received: by outflank-mailman (input) for mailman id 1363009; Wed, 15 Jul 2026 12:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySk-0001sj-AQ for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjySk-007ekm-1q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjySk-004ffD-0q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hEk5z6GKcVi6h+DAVEW+2T6xV5slyg2NR67PSrfWPHw=; b=fhBav3eePe8uR5VfjvcOreByMI eIO6O7gKN0MHYf1dsk7lSD4Ik74f2vDzP4vQzV9Tf0oxiF9W+MlrZsRw02zwENq8tUtosdYlvr94M MEejjT5+m986J37DrLqyNiNNFnB/ZqUk23Ha6Tr1zRwnTImATlHN74+/KT5p6ghVjMhU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] arm64/insn: Avoid undefined behaviour in branch offset decode Message-Id: Date: Wed, 15 Jul 2026 12:11:42 +0000 commit 82bf1f0cf2e092f86ad7fa9de4c3ce5799979c22 Author: Edgar E. Iglesias AuthorDate: Wed Apr 22 18:45:06 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 arm64/insn: Avoid undefined behaviour in branch offset decode Branch offset decoding sign-extends the immediate by shifting it left into bit 31 and back. Perform the left shift in uint32_t and cast to int32_t only for the final right shift to avoid UBSAN failures on negative offsets. Fixes: 6dbf3f0e3074 ("xen/arm: arm64: Add helpers to decode and encode branch instructions") Signed-off-by: Edgar E. Iglesias Reviewed-by: Stefano Stabellini (cherry picked from commit 65a99a4063ccac92237f6d2cd45cb94b5574baa9) --- xen/arch/arm/arm64/insn.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/arm64/insn.c b/xen/arch/arm/arm64/insn.c index 81f7914610..6b97a84ba7 100644 --- a/xen/arch/arm/arm64/insn.c +++ b/xen/arch/arm/arm64/insn.c @@ -225,22 +225,22 @@ u32 __kprobes aarch64_insn_gen_nop(void) */ int32_t aarch64_get_branch_offset(uint32_t insn) { - int32_t imm; + uint32_t imm; if (aarch64_insn_is_b(insn) || aarch64_insn_is_bl(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_26, insn); - return (imm << 6) >> 4; + return (int32_t)(imm << 6) >> 4; } if (aarch64_insn_is_cbz(insn) || aarch64_insn_is_cbnz(insn) || aarch64_insn_is_bcond(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_19, insn); - return (imm << 13) >> 11; + return (int32_t)(imm << 13) >> 11; } if (aarch64_insn_is_tbz(insn) || aarch64_insn_is_tbnz(insn)) { imm = aarch64_insn_decode_immediate(AARCH64_INSN_IMM_14, insn); - return (imm << 18) >> 16; + return (int32_t)(imm << 18) >> 16; } /* Unhandled instruction */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:11:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:11:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363010.1614827 (Exim 4.92) (envelope-from ) id 1wjySv-0001v6-Ky; Wed, 15 Jul 2026 12:11:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363010.1614827; Wed, 15 Jul 2026 12:11:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySv-0001uy-IN; Wed, 15 Jul 2026 12:11:53 +0000 Received: by outflank-mailman (input) for mailman id 1363010; Wed, 15 Jul 2026 12:11:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjySu-0001us-DM for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjySu-007ekq-28 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjySu-004fw3-18 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:11:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=4CAwwWnu9KVAOZcPRAXA8/zGmOxnF6ZZ+Ki6Ms4G5JY=; b=HlU3wJ+sWkumDlCI1TpyRz6Sre 8mwSJeGXxe97qsN2UF8+ccoN1Ibl6F4tXylVK0NAw4oroQxekr4vCr4XYoS1BGkWXnCqJkaJOTxrd MZkuRUdIvkMLgiN+0iYvGAvjJkwtsteQvslC6hn59y4cobHnEDaPD2GrAQ76mw4R0hhU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v2: disable interrupt bypass on CPU shutdown Message-Id: Date: Wed, 15 Jul 2026 12:11:52 +0000 commit ecbef536d7cf69dbecf98c6a6f2a0ca29ab419fa Author: Mykola Kvach AuthorDate: Tue Apr 28 14:57:55 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v2: disable interrupt bypass on CPU shutdown The GICv2 CPU shutdown path currently writes 0 to GICC_CTLR. Per IHI0048B.b section 2.3.1, clearing the architected bypass-disable bits selects bypass rather than deasserted interrupt outputs when the CPU interface stops driving them. Tables 2-2 and 2-3 show that a zeroed GICC_CTLR can fall back to the legacy IRQ/FIQ inputs instead of fully disabling the interface. Fix this by reading GICC_CTLR, then setting the bypass-disable bits and clearing the group-enable bits that are architecturally defined for the current GICC_CTLR view before writing the value back. When Security Extensions are implemented Xen accesses the Non-secure copy of GICC_CTLR, where IRQBypDisGrp1 and FIQBypDisGrp1 are at bits [6:5] and bits [8:7] are reserved. Without Security Extensions (GICD_CTLR.DS=1), GICD_IGROUPR is RAZ/WI and all interrupts are Group 0, so clearing EnableGrp0 alone is sufficient to stop interrupt delivery through the CPU interface. Section 2.3.2 also states that wakeup event signals remain available even when both GIC interrupt signaling and interrupt bypass are disabled, so disabling bypass does not break the power-management use case, i.e. suspend modes. Fixes: 5e40a1b4351e ("arm: SMP CPU shutdown") Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Reviewed-by: Michal Orzel (cherry picked from commit 6f00fd9d6c1d6f08ab21f16c0406b3bb2c1e3b01) --- xen/arch/arm/gic-v2.c | 12 +++++++++++- xen/arch/arm/include/asm/gic.h | 25 +++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/gic-v2.c b/xen/arch/arm/gic-v2.c index a3fc3cee75..77491e635d 100644 --- a/xen/arch/arm/gic-v2.c +++ b/xen/arch/arm/gic-v2.c @@ -408,7 +408,17 @@ static void gicv2_cpu_init(void) static void gicv2_cpu_disable(void) { - writel_gicc(0x0, GICC_CTLR); + uint32_t ctlr = readl_gicc(GICC_CTLR); + + if ( readl_gicd(GICD_TYPER) & GICD_TYPE_SEC ) + ctlr |= GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK; + else + ctlr |= GICC_CTLR_BYPASS_DISABLE_GRP0_MASK | + GICC_CTLR_BYPASS_DISABLE_GRP1_MASK; + + ctlr &= ~GICC_CTL_ENABLE; + + writel_gicc(ctlr, GICC_CTLR); } static void gicv2_hyp_init(void) diff --git a/xen/arch/arm/include/asm/gic.h b/xen/arch/arm/include/asm/gic.h index 541f0eeb80..066a00c676 100644 --- a/xen/arch/arm/include/asm/gic.h +++ b/xen/arch/arm/include/asm/gic.h @@ -102,8 +102,29 @@ #define GICD_TYPE_SEC 0x400 #define GICD_TYPER_DVIS (1U << 18) -#define GICC_CTL_ENABLE 0x1 -#define GICC_CTL_EOI (0x1 << 9) +/* + * Xen runs in the Non-secure world. When Security Extensions are present, + * Xen accesses the Non-secure GICC_CTLR view, where bit[0] is EnableGrp1 + * and bits[6:5] are the Group 1 bypass-disable bits. Otherwise Xen sees the + * common GICC_CTLR layout, where bit[0] is EnableGrp0, bit[1] is EnableGrp1, + * bits[6:5] are the Group 0 bypass-disable bits, and bits[8:7] are the + * Group 1 bypass-disable bits. + */ +#define GICC_CTL_ENABLE (0x1 << 0) +#define GICC_CTL_ENABLE_GRP1 (0x1 << 1) +#define GICC_CTL_FIQBypDisGrp0 (0x1 << 5) +#define GICC_CTL_IRQBypDisGrp0 (0x1 << 6) +#define GICC_CTL_FIQBypDisGrp1 (0x1 << 7) +#define GICC_CTL_IRQBypDisGrp1 (0x1 << 8) + +#define GICC_CTLR_BYPASS_DISABLE_GRP0_MASK \ + (GICC_CTL_FIQBypDisGrp0 | GICC_CTL_IRQBypDisGrp0) +#define GICC_CTLR_BYPASS_DISABLE_GRP1_MASK \ + (GICC_CTL_FIQBypDisGrp1 | GICC_CTL_IRQBypDisGrp1) +#define GICC_NS_CTLR_BYPASS_DISABLE_GRP1_MASK \ + GICC_CTLR_BYPASS_DISABLE_GRP0_MASK + +#define GICC_CTL_EOI (0x1 << 9) #define GICC_IA_IRQ 0x03ff #define GICC_IA_CPU_MASK 0x1c00 -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363011.1614831 (Exim 4.92) (envelope-from ) id 1wjyT5-0001wz-Mr; Wed, 15 Jul 2026 12:12:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363011.1614831; Wed, 15 Jul 2026 12:12:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyT5-0001wr-Jk; Wed, 15 Jul 2026 12:12:03 +0000 Received: by outflank-mailman (input) for mailman id 1363011; Wed, 15 Jul 2026 12:12:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyT4-0001wl-Fx for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyT4-007el5-2O for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyT4-004g2b-1P for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=E2jZ3fYPOoIR1gf4heoG1q1lT0kIVWPjpSoQDa8TnCw=; b=Q5c+MwqYiaTt7+lYD9NB3pQBWt wWbDCDPS7wrrcfaFKN0gOLC4p1z9ngT0L9DZxJbWozXnNvsqh5YB0GJTzoP9mit+GevnR8XNb1iBS +0TX6gm8J/OIfopvqyhJtTiiIeiVTRUyG/l5yGzTgP8AERZFHsB8Le0ZBNBWtkUKzFMA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen: arm: fix len type for guest copy functions Message-Id: Date: Wed, 15 Jul 2026 12:12:02 +0000 commit 9b88e852eff72110bb0d67966ecc757a4d9328d0 Author: Oleksii Kurochko AuthorDate: Thu May 7 10:58:40 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen: arm: fix len type for guest copy functions Widen the len argument of copy_to_guest_phys_flush_dcache() and the copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as the function can be used to copy large blobs such as the initrd which may exceed 4GB. Update the internal copy_guest() len argument to unsigned long accordingly. Change the type for local variable size in copy_guest() to avoid compilation error because of type mismatch. raw_* wrappers above copy_guest() keep returning unsigned long to avoid type narrowing; it is not an issue for raw_*'s len argument to remain 'unsigned int' since the assignment to copy_guest()'s wider unsigned long parameter is safe and there is no raw_* users who are using a value bigger than what can fit into 'unsigned int'. Fixes: 2986481b3d9e6 ("xen/arm: guest_copy: Extend the prototype to pass the vCPU") Fixes: 5302bd490bea7 ("xen/arm: Introduce copy_to_guest_phys_flush_dcache") Fixes: d07b7369aa65b ("xen/common: dom0less: introduce common domain-build.c") Reported-by: Jan Beulich Signed-off-by: Oleksii Kurochko Reviewed-by: Jan Beulich Reviewed-by: Luca Fancellu Acked-by: Michal Orzel (cherry picked from commit e4424b9a635623b247a9a070db1238bf93f94764) --- xen/arch/arm/guestcopy.c | 6 +++--- xen/arch/arm/include/asm/guest_access.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c index 497e785ec4..a257bee3e4 100644 --- a/xen/arch/arm/guestcopy.c +++ b/xen/arch/arm/guestcopy.c @@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t info, uint64_t addr, return page; } -static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, +static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len, copy_info_t info, unsigned int flags) { /* XXX needs to handle faults */ @@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len, while ( len ) { void *p; - unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset); + unsigned long size = min(len, PAGE_SIZE + 0UL - offset); struct page_info *page; page = translate_get_page(info, addr, flags & COPY_linear, @@ -136,7 +136,7 @@ unsigned long raw_copy_from_guest(void *to, const void __user *from, unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len) + unsigned long len) { return copy_guest(buf, gpa, len, GPA_INFO(d), COPY_to_guest | COPY_ipa | COPY_flush_dcache); diff --git a/xen/arch/arm/include/asm/guest_access.h b/xen/arch/arm/include/asm/guest_access.h index 18c88b70d7..c13cbec55b 100644 --- a/xen/arch/arm/include/asm/guest_access.h +++ b/xen/arch/arm/include/asm/guest_access.h @@ -14,7 +14,7 @@ unsigned long raw_clear_guest(void *to, unsigned int len); unsigned long copy_to_guest_phys_flush_dcache(struct domain *d, paddr_t gpa, void *buf, - unsigned int len); + unsigned long len); int access_guest_memory_by_gpa(struct domain *d, paddr_t gpa, void *buf, uint32_t size, bool is_write); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363012.1614835 (Exim 4.92) (envelope-from ) id 1wjyTF-0001zT-PG; Wed, 15 Jul 2026 12:12:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363012.1614835; Wed, 15 Jul 2026 12:12:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTF-0001zL-Me; Wed, 15 Jul 2026 12:12:13 +0000 Received: by outflank-mailman (input) for mailman id 1363012; Wed, 15 Jul 2026 12:12:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTE-0001zE-J6 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyTE-007elB-2f for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyTE-004gDY-1g for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XlFH53+QZp4I/D0V9AoSulNeRQG4DfxnrHesIG/zcH0=; b=Z6+2C5eeGB6k7ySTDVoNBO/ksm 10xClBJur2qaRkC/sgNJj1VXXxmZaPpIk/FEvmTrwDhLAnSAGFZ2LQEssJ+SkhY/jcX51P2mhnYVP o8IohzoUrewXLsG4r5hib+MWhY+rrZT7eREP4+dRr0fqBhCpjeQH6OAfkbqBXB4A/ESw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v3: Wait for redistributor RWP using the right bit Message-Id: Date: Wed, 15 Jul 2026 12:12:12 +0000 commit 4f3dbd9ee08597b11247da55f53eaab64805a4b1 Author: Mykola Kvach AuthorDate: Thu May 14 12:08:13 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Wait for redistributor RWP using the right bit gicv3_do_wait_for_rwp() is used for both distributor and redistributor writes. The CTLR register is at offset 0 for both, but the RWP bit is not in the same position. For GICD_CTLR, RWP is bit 31. For GICR_CTLR, bit 31 is UWP, while RWP is bit 3. The redistributor wait path was therefore polling UWP instead of RWP. UWP covers upstream writes, including Generate SGI packets, and is not a substitute for redistributor register write completion. The existing redistributor callers need RWP semantics for redistributor register writes such as GICR_ICENABLER0 and GICR_CTLR updates. Add GICR_CTLR_RWP and pass the expected RWP bit to the shared helper. Fixes: bc183a0235e ("xen/arm: Add support for GIC v3") Reported-by: Luca Fancellu Signed-off-by: Mykola Kvach Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini (cherry picked from commit d86cf3cbd4ad105c00e12b0d51646049a87f1c44) --- xen/arch/arm/gic-v3.c | 14 +++++++++----- xen/arch/arm/include/asm/gic_v3_defs.h | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index c609596def..809f6b5cdd 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -274,16 +274,20 @@ static void gicv3_enable_sre(void) isb(); } -/* Wait for completion of a distributor change */ -static void gicv3_do_wait_for_rwp(void __iomem *base) +/* Wait for completion of a distributor/redistributor change */ +static void gicv3_do_wait_for_rwp(void __iomem *base, uint32_t rwp_bit) { uint32_t val; bool timeout = false; s_time_t deadline = NOW() + MILLISECS(1000); do { + /* + * GICD_CTLR and GICR_CTLR are both at offset 0, so this is + * valid for either a distributor or redistributor base. + */ val = readl_relaxed(base + GICD_CTLR); - if ( !(val & GICD_CTLR_RWP) ) + if ( !(val & rwp_bit) ) break; if ( NOW() > deadline ) { @@ -300,12 +304,12 @@ static void gicv3_do_wait_for_rwp(void __iomem *base) static void gicv3_dist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD); + gicv3_do_wait_for_rwp(GICD, GICD_CTLR_RWP); } static void gicv3_redist_wait_for_rwp(void) { - gicv3_do_wait_for_rwp(GICD_RDIST_BASE); + gicv3_do_wait_for_rwp(GICD_RDIST_BASE, GICR_CTLR_RWP); } static void gicv3_wait_for_rwp(int irq) diff --git a/xen/arch/arm/include/asm/gic_v3_defs.h b/xen/arch/arm/include/asm/gic_v3_defs.h index 2af093e774..143eceaa9d 100644 --- a/xen/arch/arm/include/asm/gic_v3_defs.h +++ b/xen/arch/arm/include/asm/gic_v3_defs.h @@ -108,6 +108,7 @@ #define GICR_NSACR (0x0E00) #define GICR_CTLR_ENABLE_LPIS (1U << 0) +#define GICR_CTLR_RWP (1U << 3) #define GICR_TYPER_PLPIS (1U << 0) #define GICR_TYPER_VLPIS (1U << 1) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363013.1614840 (Exim 4.92) (envelope-from ) id 1wjyTP-00021N-Qw; Wed, 15 Jul 2026 12:12:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363013.1614840; Wed, 15 Jul 2026 12:12:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTP-00021E-Nv; Wed, 15 Jul 2026 12:12:23 +0000 Received: by outflank-mailman (input) for mailman id 1363013; Wed, 15 Jul 2026 12:12:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTO-000218-Lu for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyTO-007elF-2z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyTO-004gK7-1z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LrA8KYItOzu4krE4LnVDS8HWhKWna0n3sFw6ul/n5z4=; b=C4uXzpgNGHYPbiuyWo0huG8qnq rDQHBj3AiBf3cIalvWN0tBUo4J7sAV3hlDPwq1P7jVTMS4u02weF681pDih+UClHC2okRB63Grj8q 17XP/PO12R9WZx3kdQqh7zeiGnZZOak+ptKrOFBUruYOUpfWq6EIJjlBemU9tZdOe7I4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor Message-Id: Date: Wed, 15 Jul 2026 12:12:22 +0000 commit 4299e59d1eb332923bef13f5f812ad6f5b48e862 Author: Mykola Kvach AuthorDate: Tue May 19 17:31:54 2026 +0300 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Preserve ARE_NS when disabling the distributor gicv3_dist_init() disables the distributor before reprogramming the global interrupt state. It used to do this by writing 0 to GICD_CTLR. On a system where firmware has already enabled Non-secure affinity routing, a zero write clears the Non-secure view's GICD_CTLR.ARE_NS bit. Arm IHI 0069H.b, section 2.3.3 ("Changing affinity routing enables"), states that changing GICD_CTLR.ARE_NS from 1 to 0 is UNPREDICTABLE. The GICD_CTLR register description in section 12.9.4 carries the same rule for the ARE_NS field. Preserve ARE_NS while clearing the group enable bits. If firmware left ARE_NS clear, the value written is still 0, preserving the existing initialization flow. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel Reviewed-by: Luca Fancellu Release-Acked-by: Oleksii Kurochko (cherry picked from commit e63ba93511b33c0d3bb8cc5870f946f41e1d2655) --- xen/arch/arm/gic-v3.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 809f6b5cdd..69112a831f 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -620,12 +620,17 @@ static void gicv3_set_irq_priority(struct irq_desc *desc, static void __init gicv3_dist_init(void) { uint32_t type; + uint32_t ctlr; uint64_t affinity; unsigned int nr_lines; int i; - /* Disable the distributor */ - writel_relaxed(0, GICD + GICD_CTLR); + /* + * Disable the distributor without clearing ARE_NS. The GIC architecture + * makes changing ARE_NS from 1 to 0 UNPREDICTABLE. + */ + ctlr = readl_relaxed(GICD + GICD_CTLR); + writel_relaxed(ctlr & GICD_CTLR_ARE_NS, GICD + GICD_CTLR); type = readl_relaxed(GICD + GICD_TYPER); nr_lines = 32 * ((type & GICD_TYPE_LINES) + 1); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363014.1614844 (Exim 4.92) (envelope-from ) id 1wjyTa-00023H-SJ; Wed, 15 Jul 2026 12:12:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363014.1614844; Wed, 15 Jul 2026 12:12:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTa-000239-PG; Wed, 15 Jul 2026 12:12:34 +0000 Received: by outflank-mailman (input) for mailman id 1363014; Wed, 15 Jul 2026 12:12:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTY-000231-P3 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyTZ-007ele-04 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyTY-004gSr-2I for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WluSD3SqO4d2gkf4yPYKVB7tK5skmCtERG8pjnCRv78=; b=xyWZWkaMHeA//xkOHfUlLRNhVj Fqf8NZUB8UR7A/BgPxawHlKimqZ+HjYIlODx2KWQnWki9EYOFQ1NG2KDePZ5CwtnvLZgCRAlywYM6 R46luE4YoOmJjTU/L+vZcrJ2EqhkQroAx9GTXqT3gAaXJ8MGPhySSmYkG+HQTsKq3s84=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: propagate vGIC vCPU init failures Message-Id: Date: Wed, 15 Jul 2026 12:12:32 +0000 commit 6668b73c6bbcf0256f0f4abc7ab216f80cf693bf Author: Mykola Kvach AuthorDate: Wed May 27 03:18:50 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: propagate vGIC vCPU init failures The vGIC per-vCPU init callback can fail. In particular, GICv3 rejects a vCPU when the domain's redistributor layout has no MMIO slot covering that vCPU. However, the generic vGIC init path ignored the callback return value, so vcpu_create() could succeed with an invalid vGICv3 per-vCPU state. This can be reproduced on FVP Base RevC by exposing a 2 MiB GICv3 redistributor region to Dom0 and booting Xen with: maxcpus=1 dom0_max_vcpus=64 The host GICv3 redistributor range is: region 0: 0x0000002f100000 - 0x0000002f300000 With Xen's guest redistributor frame size of 128 KiB, that range covers 16 guest redistributors. vCPU16 and above have no corresponding redistributor slot. Before this fix, Xen detected the missing redistributors: d0: Unable to find a re-distributor for VCPU 16 ... d0: Unable to find a re-distributor for VCPU 63 but ignored the error and continued as if the secondary vCPUs had been created correctly. Dom0 then saw 64 possible CPUs and could hang during secondary CPU bring-up: smp: Bringing up secondary CPUs ... d0v15: vGICR: SGI: unhandled word write ... to ICACTIVER0 Propagate the vGIC vcpu_init() error so the caller can stop creating secondary vCPUs. With this fix, Dom0 construction reports: d0: Unable to find a re-distributor for VCPU 16 Failed to allocate d0v16 and the guest continues booting with the vCPUs created before the failure: smp: Brought up 1 node, 16 CPUs Free the private IRQ rank allocated by vcpu_vgic_init() on this error path. The caller will still run the generic vCPU creation cleanup, but XFREE() clears the pointer so that cleanup remains idempotent. Also fix the host-layout redistributor region count for the case where the requested vCPU count is larger than the capacity of all host redistributor regions. The old code always stored i + 1 after the loop. That is correct when the loop stops inside a valid region because the requested vCPU count is covered. If the loop exits after consuming all hardware regions, i is already equal to the number of allocated regions, so i + 1 records one region too many. In the same FVP setup, that off-by-one made Xen describe host-layout GICR state beyond the populated redistributor region list. Dom0 then accessed the GICR MMIO window described in its device tree, but Xen could not match the access to a valid emulated redistributor frame. During debugging this was seen as an unexpected vGICR access followed by a guest panic: d0v0: vGICR: unknown gpa read address 000000002f10ffe8 pc : gic_iterate_rdists+0x4c/0x104 Kernel panic - not syncing: Attempted to kill the idle task! Keep the existing construct_domain() policy used by Dom0 and dom0less domain construction: a failure to create a secondary vCPU stops the secondary vCPU creation loop, but does not fail the whole domain construction. Fixes: ea37fd21110b ("xen/arm: split vgic driver into generic and vgic-v2 driver") Fixes: 54ec59f6b0b3 ("xen/arm: vgic-v3: Don't create empty re-distributor regions") Signed-off-by: Mykola Kvach Reviewed-by: Michal Orzel (cherry picked from commit 961cc8cc0febcd8b2e515c7896a076a3246d06b1) --- xen/arch/arm/vgic-v3.c | 2 +- xen/arch/arm/vgic.c | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/vgic-v3.c b/xen/arch/arm/vgic-v3.c index 2eaa48fadb..d427b7a9ac 100644 --- a/xen/arch/arm/vgic-v3.c +++ b/xen/arch/arm/vgic-v3.c @@ -1708,7 +1708,7 @@ static int vgic_v3_domain_init(struct domain *d) * not match the number of pCPUs). Update the number of regions to * avoid exposing unused region as they will not get emulated. */ - d->arch.vgic.nr_regions = i + 1; + d->arch.vgic.nr_regions = min(i + 1U, vgic_v3_hw.nr_rdist_regions); d->arch.vgic.intid_bits = vgic_v3_hw.intid_bits; } diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c index c563ba93af..0508624f39 100644 --- a/xen/arch/arm/vgic.c +++ b/xen/arch/arm/vgic.c @@ -198,7 +198,7 @@ void domain_vgic_free(struct domain *d) int vcpu_vgic_init(struct vcpu *v) { - int i; + int i, ret; v->arch.vgic.private_irqs = xzalloc(struct vgic_irq_rank); if ( v->arch.vgic.private_irqs == NULL ) @@ -207,7 +207,12 @@ int vcpu_vgic_init(struct vcpu *v) /* SGIs/PPIs are always routed to this VCPU */ vgic_rank_init(v->arch.vgic.private_irqs, 0, v->vcpu_id); - v->domain->arch.vgic.handler->vcpu_init(v); + ret = v->domain->arch.vgic.handler->vcpu_init(v); + if ( ret ) + { + XFREE(v->arch.vgic.private_irqs); + return ret; + } memset(&v->arch.vgic.pending_irqs, 0, sizeof(v->arch.vgic.pending_irqs)); for (i = 0; i < 32; i++) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363015.1614848 (Exim 4.92) (envelope-from ) id 1wjyTk-00026i-TV; Wed, 15 Jul 2026 12:12:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363015.1614848; Wed, 15 Jul 2026 12:12:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTk-00026Y-Qd; Wed, 15 Jul 2026 12:12:44 +0000 Received: by outflank-mailman (input) for mailman id 1363015; Wed, 15 Jul 2026 12:12:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTi-00026R-Rm for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyTj-007eli-0L for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyTi-004gl3-2a for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UUU3XJFfacO/oAtKLrLqhePsI5m3nhkl77+CfMEWTao=; b=2Pu8qkZf9xIl70MU1jsqO+7enB +1yZuZf2erz8B8qlRATUp0nhZIXA0PIeQqLjVZZqderth/60LMx3whaYGxq7HBw8Tjn6S3Idxb24o 4Pppbmxva+MGxhW76J9N22o07ap1wCVWRo+FVkYZJvhLuqA48fVesF8yXRMQdDfsh8d8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: gic-v3: Fix redistributor wakeup polling Message-Id: Date: Wed, 15 Jul 2026 12:12:42 +0000 commit 4813da923159a792f506d6de4f4db2f11fb56b35 Author: Luca Fancellu AuthorDate: Mon May 18 08:05:24 2026 +0100 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: gic-v3: Fix redistributor wakeup polling gicv3_enable_redist() clears GICR_WAKER.ProcessorSleep and then waits for GICR_WAKER.ChildrenAsleep to clear, as required after waking a redistributor. However, the polling loop currently uses "while ( timeout )". Since timeout is initially false, the loop runs only once unless the timeout path has already been reached. As a result, Xen can continue before the redistributor has completed wakeup. Use an unconditional loop, matching the surrounding timeout/break pattern, so the code polls until either ChildrenAsleep is clear or the deadline is reached. While there, also fix the timeout message. This path polls GICR_WAKER.ChildrenAsleep, not an RWP bit, so "RWP timeout" is misleading. Fixes: bc183a0235e0 ("xen/arm: Add support for GIC v3") Signed-off-by: Luca Fancellu Reviewed-by: Mykola Kvach Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit 941fdfc03e109a28ca9cfe71c111a1ef6cb9ed12) --- xen/arch/arm/gic-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/gic-v3.c b/xen/arch/arm/gic-v3.c index 69112a831f..843824acae 100644 --- a/xen/arch/arm/gic-v3.c +++ b/xen/arch/arm/gic-v3.c @@ -704,11 +704,11 @@ static int gicv3_enable_redist(void) } cpu_relax(); udelay(1); - } while ( timeout ); + } while ( 1 ); if ( timeout ) { - dprintk(XENLOG_ERR, "GICv3: Redist enable RWP timeout\n"); + dprintk(XENLOG_ERR, "GICv3: Redist wakeup timeout\n"); return 1; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:12:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:12:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363016.1614851 (Exim 4.92) (envelope-from ) id 1wjyTu-00028t-Uj; Wed, 15 Jul 2026 12:12:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363016.1614851; Wed, 15 Jul 2026 12:12:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTu-00028l-Rx; Wed, 15 Jul 2026 12:12:54 +0000 Received: by outflank-mailman (input) for mailman id 1363016; Wed, 15 Jul 2026 12:12:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyTs-00028c-UA for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyTt-007elo-0b for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyTs-004hEE-2q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:12:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=EGtAy4BwNjK2uDnQ/nW2X+FhOzFcFy543h0UFhR1qkU=; b=LnqNvj1ysg6LRaaabAnwl/SgdT +FZB2myMQvpssN5eYbr8ip0MpYgu4e4kmGngp+QSQ6cv40c1Th6rNqU7ldUbBg7bWr0gscnoixIcl rErlrkJonh9C08da1cXhAZY1ggNu8TgF0rtQYS1U8/BLtqeaFggBC7IaqI8h7ZhmIL5A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] libfdt: fix UBSAN null pointer in fdt_property() Message-Id: Date: Wed, 15 Jul 2026 12:12:52 +0000 commit befb42bff687e96e1279fdb85454e243167dc641 Author: Oleksii Kurochko AuthorDate: Wed Jun 17 09:20:51 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 libfdt: fix UBSAN null pointer in fdt_property() fdt_property() unconditionally calls memcpy(ptr, val, len) even when len is zero and val is NULL. This is a legitimate calling convention for adding empty FDT properties such as "interrupt-controller", which carry no payload. However, compilers that treat memcpy as nonnull on its pointer arguments will fire UBSAN before observing that len is zero. Guard the memcpy() with a check on len so it is skipped entirely when there is no payload to copy, bringing the code in line with the nonnull contract. Signed-off-by: Oleksii Kurochko Signed-off-by: David Gibson Origin: git://git.kernel.org/pub/scm/utils/dtc/dtc.git f57e7df35df4 Fixes: f0ea06558068 ("libfdt: add version 1.3.0") Signed-off-by: Oleksii Kurochko Reviewed-by: Baptiste Le Duc Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit be18ad502e5d4f9248e1f020d3e0d55a7b9ea986) --- xen/common/libfdt/fdt_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/libfdt/fdt_sw.c b/xen/common/libfdt/fdt_sw.c index 4c569ee7eb..96d4cf5713 100644 --- a/xen/common/libfdt/fdt_sw.c +++ b/xen/common/libfdt/fdt_sw.c @@ -330,7 +330,8 @@ int fdt_property(void *fdt, const char *name, const void *val, int len) ret = fdt_property_placeholder(fdt, name, len, &ptr); if (ret) return ret; - memcpy(ptr, val, len); + if (len) + memcpy(ptr, val, len); return 0; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:13:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:13:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363017.1614855 (Exim 4.92) (envelope-from ) id 1wjyU4-0002An-W9; Wed, 15 Jul 2026 12:13:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363017.1614855; Wed, 15 Jul 2026 12:13:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyU4-0002Af-TG; Wed, 15 Jul 2026 12:13:04 +0000 Received: by outflank-mailman (input) for mailman id 1363017; Wed, 15 Jul 2026 12:13:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyU3-0002AY-6f for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyU3-007emI-1T for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyU3-004hZc-0H for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=kpwjD8S0+E5wFK1yMbZjI5pyQokdolMR7GYpcj4y/IM=; b=s9pN0QhvOeyTdl/RxzSHQcjR9Q apAdiLXrfw9Jwiueu4/lEVBvwp+Cyq22lYgKOdFuOiqG/0uNuv7sf5MaR8h1WFiLnIYnanCm+AsL0 v2ToMWYlwoQ+3Rr7q3dt15teDRizfnp8fQbVfSFUKa8hEiH06eBm6tUeGIReZYDiGjO4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] bootfdt: Fix infinite loop in device_tree_for_each_node() Message-Id: Date: Wed, 15 Jul 2026 12:13:03 +0000 commit a0c5fde6f7ccae0a2dc93512a66a4bf1c0484414 Author: Dmytro Prokopchuk1 AuthorDate: Fri Jun 26 07:57:33 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 bootfdt: Fix infinite loop in device_tree_for_each_node() When a node's depth exceeds DEVICE_TREE_MAX_DEPTH inside the device_tree_for_each_node() loop, the code prints a warning and executes 'continue;' statement, which jumps to condition check, bypassing the iterator update step: node = fdt_next_node(fdt, node, &depth). The node and depth are not updated, the loop repeatedly evaluates the same too-deep node, causing a hang. Fix this by wrapping the node processing logic in an 'else' block. This ensures the loop update step is executed on every iteration, safely skipping deeply nested nodes and doing the traversal. Fixes: 40f2ea3df2e2 ("xen/arm: pass node to device_tree_for_each_node") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleskii Kurochko (cherry picked from commit 3b717f57dca508f546303dd34067b7b906ba459e) --- xen/common/device-tree/bootfdt.c | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/xen/common/device-tree/bootfdt.c b/xen/common/device-tree/bootfdt.c index 529c91e603..9ce7699833 100644 --- a/xen/common/device-tree/bootfdt.c +++ b/xen/common/device-tree/bootfdt.c @@ -250,23 +250,28 @@ int __init device_tree_for_each_node(const void *fdt, int node, { printk("Warning: device tree node `%s' is nested too deep\n", name); - continue; } - - as = depth > 0 ? address_cells[depth-1] : DT_ROOT_NODE_ADDR_CELLS_DEFAULT; - ss = depth > 0 ? size_cells[depth-1] : DT_ROOT_NODE_SIZE_CELLS_DEFAULT; - - address_cells[depth] = device_tree_get_u32(fdt, node, - "#address-cells", as); - size_cells[depth] = device_tree_get_u32(fdt, node, - "#size-cells", ss); - - /* skip the first node */ - if ( node != first_node ) + else { - ret = func(fdt, node, name, depth, as, ss, data); - if ( ret != 0 ) - return ret; + as = depth > 0 ? + address_cells[depth - 1] : + DT_ROOT_NODE_ADDR_CELLS_DEFAULT; + ss = depth > 0 ? + size_cells[depth - 1] : + DT_ROOT_NODE_SIZE_CELLS_DEFAULT; + + address_cells[depth] = device_tree_get_u32(fdt, node, + "#address-cells", as); + size_cells[depth] = device_tree_get_u32(fdt, node, + "#size-cells", ss); + + /* skip the first node */ + if ( node != first_node ) + { + ret = func(fdt, node, name, depth, as, ss, data); + if ( ret != 0 ) + return ret; + } } node = fdt_next_node(fdt, node, &depth); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:13:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:13:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363018.1614861 (Exim 4.92) (envelope-from ) id 1wjyUE-0002DC-34; Wed, 15 Jul 2026 12:13:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363018.1614861; Wed, 15 Jul 2026 12:13:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUD-0002D4-W2; Wed, 15 Jul 2026 12:13:13 +0000 Received: by outflank-mailman (input) for mailman id 1363018; Wed, 15 Jul 2026 12:13:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUD-0002Cx-Hs for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyUD-007emM-2a for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyUD-004hvB-1V for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Qs0xaqVRjQ8bDfcLYjlbgl0agHd9x0SwQl5b05DNAx4=; b=D8wkfP6vuhPBfH2jwSctbHx6bo 9bJhR3OY3Er0iHwizbbZ+1asEAabiF4+Ag3giuKEcyKf9fiHA4tcgqx32rgJ9IVg/zxc4Iw0KrUSD rw7Mdcn/FoqvZkguHCZMZDGTuuX94e1PJ8+LlzMJCNe/ZQusQf+HeaQy7gqFY9mK3hok=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: fix sparse cpu_possible_map calculation on SMP boot Message-Id: Date: Wed, 15 Jul 2026 12:13:13 +0000 commit 77015ef70d4fde7a095d7f085bc69d2a66b71296 Author: Hirokazu Takahashi AuthorDate: Thu Jul 2 07:40:57 2026 +0900 Commit: Michal Orzel CommitDate: Wed Jul 15 09:48:36 2026 +0200 xen/arm: fix sparse cpu_possible_map calculation on SMP boot Currently, during ARM Xen's SMP initialization, if there is a Device Tree error (such as an invalid 'enable-method'), cpu_possible_map can end up being sparse. The issue here is that nr_cpu_ids is calculated in a way that doesn't properly account for the maximum CPU ID when the map is sparse, causing a mismatch. For example, if cpu_possible_map is 0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID is 15. Xen's common code is built on the assumption that 'CPU ID < nr_cpu_ids', so this mismatch can break things. To fix this, modify dt_smp_init_cpus() so that if the arch_cpu_init() call fails, we don't consume the CPU ID slot. Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu bring up") Signed-off-by: Hirokazu Takahashi Reviewed-by: Michal Orzel (cherry picked from commit ccde3773c1762d32fb5f6037d6b22780c30895d3) --- xen/arch/arm/smpboot.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c index 04e363088d..0f9300aad8 100644 --- a/xen/arch/arm/smpboot.c +++ b/xen/arch/arm/smpboot.c @@ -242,7 +242,9 @@ static void __init dt_smp_init_cpus(void) if ( (rc = arch_cpu_init(i, cpu)) < 0 ) { printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, rc); - tmp_map[i] = MPIDR_INVALID; + + if ( i != 0 ) + cpuidx--; } else tmp_map[i] = hwid; @@ -255,10 +257,9 @@ static void __init dt_smp_init_cpus(void) return; } - for ( i = 0; i < cpuidx; i++ ) + /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */ + for ( i = 1; i < cpuidx; i++ ) { - if ( tmp_map[i] == MPIDR_INVALID ) - continue; cpumask_set_cpu(i, &cpu_possible_map); cpu_logical_map(i) = tmp_map[i]; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:13:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:13:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363019.1614862 (Exim 4.92) (envelope-from ) id 1wjyUO-0002FB-3b; Wed, 15 Jul 2026 12:13:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363019.1614862; Wed, 15 Jul 2026 12:13:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUO-0002F3-12; Wed, 15 Jul 2026 12:13:24 +0000 Received: by outflank-mailman (input) for mailman id 1363019; Wed, 15 Jul 2026 12:13:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUN-0002Ex-Ln for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyUN-007emS-2z for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyUN-004iDR-20 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dSMJ3X8ammwDUvR9pu8eOzXVsWoEZ09xGD7eczrm0B8=; b=Opz8LVkmhIPFIxOFfkBnkST7ZZ t8mq/3xnnchfQzvxoN/9E7ipjdN1v5PXlyvR3frzAvjt8Y7eGwsKoc3BfV0+L/UFhRJHTFKSANdfo a8vyaDB84NvOuMDCuIxwzqKV++5t/mQljxtYTfEaatOEBKaw6O3pLiznIyEW6uBezhx8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: Fail domain construction if a secondary vCPU cannot be created Message-Id: Date: Wed, 15 Jul 2026 12:13:23 +0000 commit 94d2902c8cf27621ee539469f53426018c987cd7 Author: Michal Orzel AuthorDate: Thu Jul 9 08:36:43 2026 +0200 Commit: Michal Orzel CommitDate: Wed Jul 15 09:52:06 2026 +0200 xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini (cherry picked from commit e3aa330017c533cc312ee4751b8387d988682efc) --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 7df1f757fb..878b2f483c 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -2254,7 +2254,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 12:13:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 12:13:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363020.1614867 (Exim 4.92) (envelope-from ) id 1wjyUY-0002H7-50; Wed, 15 Jul 2026 12:13:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363020.1614867; Wed, 15 Jul 2026 12:13:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUY-0002Gz-2N; Wed, 15 Jul 2026 12:13:34 +0000 Received: by outflank-mailman (input) for mailman id 1363020; Wed, 15 Jul 2026 12:13:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjyUX-0002Gt-Oj for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wjyUY-007emp-04 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wjyUX-004iUU-2I for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 12:13:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=me/KR64mIof9W1hv0U3idEgAkZdZovQ5l6eStcRPrUA=; b=2pcG94+ZLoZDJ1Yww47Tw8kL1G esDOERqNv7LQYavAG+RihRA3B2P/oSa2JIOJjUEOAjmQ1bd711A4UMCQ10kDYPuRXAQwPtYSmyiHO UtX4H8Ed1KXcacAacFJU3/HOA8r/e+81D33hrZPgFVQxTcESv8fI0cgQbRbZGvpWu9RU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] dom0less: Prevent division by zero in handle_passthrough_prop() Message-Id: Date: Wed, 15 Jul 2026 12:13:33 +0000 commit e16e18e3128508954bc481e02611830de9f06925 Author: Dmytro Prokopchuk1 AuthorDate: Sun Jul 12 11:56:55 2026 +0000 Commit: Michal Orzel CommitDate: Wed Jul 15 09:54:27 2026 +0200 dom0less: Prevent division by zero in handle_passthrough_prop() A malformed partial DTB specifying both '#address-cells = <0>' and '#size-cells = <0>' causes '(address_cells * 2 + size_cells)' to evaluate to 0. This sum is subsequently used as a divisor when calculating the number of regions in the 'xen,reg' property inside handle_passthrough_prop(): len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * sizeof(uint32_t)); This leads to a division by zero exception in the Xen hypervisor during boot, causing a hypervisor panic/crash. Fix this by validating that both 'address_cells' and 'size_cells' are within the range of [1, 2] at the top of handle_passthrough_prop(). Any invalid cell size combination is safely rejected early with an error message and return -EINVAL. Furthermore, update handle_passthrough_prop() to use the sizeof(*cell) instead of sizeof(uint32_t). Fixes: 9ce974c47588 ("xen/arm: assign devices to boot domains") Signed-off-by: Dmytro Prokopchuk Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko [michal: adjust for handle_passthrough_prop() living in a different file] Signed-off-by: Michal Orzel (cherry picked from commit b83e1d9a1ad34436e64c44a1d9355be7b72722e0) --- xen/arch/arm/dom0less-build.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/dom0less-build.c b/xen/arch/arm/dom0less-build.c index 49d1f14d65..21045e31af 100644 --- a/xen/arch/arm/dom0less-build.c +++ b/xen/arch/arm/dom0less-build.c @@ -258,10 +258,23 @@ static int __init handle_passthrough_prop(struct kernel_info *kinfo, int res; paddr_t mstart, size, gstart; + /* + * xen,reg holds flat host/guest physical addresses and sizes, so the + * inherited #address-cells/#size-cells must each be 1 or 2. This also + * guards the len division below against a zero or wrapped divisor. + */ + if ( (address_cells < 1) || (address_cells > 2) || + (size_cells < 1) || (size_cells > 2) ) + { + printk(XENLOG_ERR "Invalid address_cells %u or size_cells %u\n", + address_cells, size_cells); + return -EINVAL; + } + /* xen,reg specifies where to map the MMIO region */ cell = (const __be32 *)xen_reg->data; len = fdt32_to_cpu(xen_reg->len) / ((address_cells * 2 + size_cells) * - sizeof(uint32_t)); + sizeof(*cell)); for ( i = 0; i < len; i++ ) { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 15:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 15:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363208.1614982 (Exim 4.92) (envelope-from ) id 1wk1ws-0000TP-Gj; Wed, 15 Jul 2026 15:55:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363208.1614982; Wed, 15 Jul 2026 15:55:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wk1ws-0000TH-EC; Wed, 15 Jul 2026 15:55:02 +0000 Received: by outflank-mailman (input) for mailman id 1363208; Wed, 15 Jul 2026 15:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wk1ws-0000TB-2U for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 15:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wk1ws-007jUt-0r for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 15:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wk1wr-00A7fG-32 for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 15:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TT8qdhKUHkC5vc8CK/2XLLdtQWz7Dk9QSDuXz+UjiWU=; b=f7QH3E2aCLa9gsN5ptdBlFevYn msCDE1nJ5Cw0S3t773EZdAy+U7ZbG6/xkNGdPc2NwyAfPBaZYMx4Na0+oxK40CJBbJSr7bb3teYj6 sD8U70kUOnsrB6I8shYk7PpplgjnpfIM449/OiylYRdg7I2M/HFJFWicw1FuKXn5Y/ag=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/entry: Fix VERW offsets in restore_all_xen() Message-Id: Date: Wed, 15 Jul 2026 15:55:01 +0000 commit bab839180525ad1b8c87d24c1b83149d012129a5 Author: Andrew Cooper AuthorDate: Wed Jul 15 11:25:58 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 15 16:41:00 2026 +0100 x86/entry: Fix VERW offsets in restore_all_xen() As explained in the comment partially in context, and contrary to what was said in commit 8af337dfb8e2 ("x86/entry: Use POP_GPRS and remove RESTORE_ALL"), the restore_all_xen() path cannot use default offsets for SPEC_CTRL_COND_VERW. Getting this wrong is surprisingly benign. VERW doesn't fault for any limit or descriptor reasons. However, in SVM vCPU context LDTR is the guest's not Xen's. When the segment selector VERW uses happens to be an LDT selector, the CPU accesses the guest LDTR in Xen context: (XEN) ----[ Xen-4.23.0 x86_64 debug=y Not tainted ]---- (XEN) CPU: 14 (XEN) RIP: e008:[] x86_64/entry.S#restore_all_xen+0x72/0x80 (XEN) RFLAGS: 0000000000010002 CONTEXT: hypervisor (d3v1) ... (XEN) Xen code around (x86_64/entry.S#restore_all_xen+0x72/0x80): (XEN) 5f f6 44 24 7c 08 74 05 <0f> 00 6c 24 44 48 83 c4 08 48 cf 0f 1f 00 fc 0f ... (XEN) Xen call trace: (XEN) [] R x86_64/entry.S#restore_all_xen+0x72/0x80 (XEN) [] F nestedhap_fix_p2m+0x5f/0xc9 (XEN) [] F nestedhvm_hap_nested_page_fault+0x11e/0x22e (XEN) [] F hvm_hap_nested_page_fault+0x1b8/0x5d2 (XEN) [] F svm_vmexit_handler+0xbe9/0x18b3 (XEN) [] F svm_asm_do_resume+0x162/0x172 (XEN) (XEN) Pagetable walk from 000000000000fff8: (XEN) L4[0x000] = 0000000000000000 ffffffffffffffff (XEN) (XEN) **************************************** (XEN) Panic on CPU 14: (XEN) FATAL PAGE FAULT (XEN) [error_code=0000] (XEN) Faulting linear address: 000000000000fff8 (XEN) **************************************** In this case, the guest's LDT obviously has a base of 0 and limit of 0xffff for the segmentation checks to pass and a memory access to be attempted. Fixes: 8af337dfb8e2 ("x86/entry: Use POP_GPRS and remove RESTORE_ALL") Reported-by: Ross Lagerwall Signed-off-by: Andrew Cooper Tested-by: Ross Lagerwall Reviewed-by: Teddy Astie Reviewed-by: Jan Beulich --- xen/arch/x86/x86_64/asm-offsets.c | 1 + xen/arch/x86/x86_64/entry.S | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_64/asm-offsets.c b/xen/arch/x86/x86_64/asm-offsets.c index 9d45364026..baf266ab80 100644 --- a/xen/arch/x86/x86_64/asm-offsets.c +++ b/xen/arch/x86/x86_64/asm-offsets.c @@ -64,6 +64,7 @@ void __dummy__(void) DEFINE(sym, offsetof(struct cpu_user_regs, mem) - \ offsetof(struct cpu_user_regs, error_code) __VA_ARGS__) + OFFSET_EF(EFRAME_error_code, error_code); OFFSET_EF(EFRAME_entry_vector, entry_vector); OFFSET_EF(EFRAME_rip, rip); OFFSET_EF(EFRAME_cs, cs); diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 22729b1f43..59953c9f52 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -765,7 +765,9 @@ UNLIKELY_END(exit_cr3) * scf and ver_sel above eflags, as we can't use any GPRs, * and we're at a random place on the stack, not in a CPUFINFO block. */ - SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ \ + scf=STK_REL(EFRAME_shadow_scf, EFRAME_error_code), \ + sel=STK_REL(EFRAME_shadow_sel, EFRAME_error_code) add $8, %rsp /* Pop ev/ec off the stack */ iretq -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 15 16:33:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 15 Jul 2026 16:33:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363218.1614987 (Exim 4.92) (envelope-from ) id 1wk2Xf-0005XE-S2; Wed, 15 Jul 2026 16:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363218.1614987; Wed, 15 Jul 2026 16:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wk2Xf-0005X6-PX; Wed, 15 Jul 2026 16:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1363218; Wed, 15 Jul 2026 16:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wk2Xe-0005X0-Kg for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 16:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wk2Xe-007klO-2m for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 16:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wk2Xe-00B22v-1Q for xen-changelog@lists.xenproject.org; Wed, 15 Jul 2026 16:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3zx9b+YuEmx46MP241KUL0vmEutfH9+BlcsczBwsIhU=; b=wp77/NrNmXGegPhZ7A/Q49s2Wk aXx5hHLTJ0WRoh32MdcFRyKhJz3uNfvkzBbDdEnkYZbrr/ifZr3Y/IPHFp6nUl39ED8ITY+dD0IBF dqD9rJgOMR3fKfJ4i1XveB9PMb87VdT4barg1T3vuNGwPLDH5Hs/fAFBNwvZBgamASAM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/entry: Fix VERW offsets in restore_all_xen() Message-Id: Date: Wed, 15 Jul 2026 16:33:02 +0000 commit bab839180525ad1b8c87d24c1b83149d012129a5 Author: Andrew Cooper AuthorDate: Wed Jul 15 11:25:58 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 15 16:41:00 2026 +0100 x86/entry: Fix VERW offsets in restore_all_xen() As explained in the comment partially in context, and contrary to what was said in commit 8af337dfb8e2 ("x86/entry: Use POP_GPRS and remove RESTORE_ALL"), the restore_all_xen() path cannot use default offsets for SPEC_CTRL_COND_VERW. Getting this wrong is surprisingly benign. VERW doesn't fault for any limit or descriptor reasons. However, in SVM vCPU context LDTR is the guest's not Xen's. When the segment selector VERW uses happens to be an LDT selector, the CPU accesses the guest LDTR in Xen context: (XEN) ----[ Xen-4.23.0 x86_64 debug=y Not tainted ]---- (XEN) CPU: 14 (XEN) RIP: e008:[] x86_64/entry.S#restore_all_xen+0x72/0x80 (XEN) RFLAGS: 0000000000010002 CONTEXT: hypervisor (d3v1) ... (XEN) Xen code around (x86_64/entry.S#restore_all_xen+0x72/0x80): (XEN) 5f f6 44 24 7c 08 74 05 <0f> 00 6c 24 44 48 83 c4 08 48 cf 0f 1f 00 fc 0f ... (XEN) Xen call trace: (XEN) [] R x86_64/entry.S#restore_all_xen+0x72/0x80 (XEN) [] F nestedhap_fix_p2m+0x5f/0xc9 (XEN) [] F nestedhvm_hap_nested_page_fault+0x11e/0x22e (XEN) [] F hvm_hap_nested_page_fault+0x1b8/0x5d2 (XEN) [] F svm_vmexit_handler+0xbe9/0x18b3 (XEN) [] F svm_asm_do_resume+0x162/0x172 (XEN) (XEN) Pagetable walk from 000000000000fff8: (XEN) L4[0x000] = 0000000000000000 ffffffffffffffff (XEN) (XEN) **************************************** (XEN) Panic on CPU 14: (XEN) FATAL PAGE FAULT (XEN) [error_code=0000] (XEN) Faulting linear address: 000000000000fff8 (XEN) **************************************** In this case, the guest's LDT obviously has a base of 0 and limit of 0xffff for the segmentation checks to pass and a memory access to be attempted. Fixes: 8af337dfb8e2 ("x86/entry: Use POP_GPRS and remove RESTORE_ALL") Reported-by: Ross Lagerwall Signed-off-by: Andrew Cooper Tested-by: Ross Lagerwall Reviewed-by: Teddy Astie Reviewed-by: Jan Beulich --- xen/arch/x86/x86_64/asm-offsets.c | 1 + xen/arch/x86/x86_64/entry.S | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_64/asm-offsets.c b/xen/arch/x86/x86_64/asm-offsets.c index 9d45364026..baf266ab80 100644 --- a/xen/arch/x86/x86_64/asm-offsets.c +++ b/xen/arch/x86/x86_64/asm-offsets.c @@ -64,6 +64,7 @@ void __dummy__(void) DEFINE(sym, offsetof(struct cpu_user_regs, mem) - \ offsetof(struct cpu_user_regs, error_code) __VA_ARGS__) + OFFSET_EF(EFRAME_error_code, error_code); OFFSET_EF(EFRAME_entry_vector, entry_vector); OFFSET_EF(EFRAME_rip, rip); OFFSET_EF(EFRAME_cs, cs); diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 22729b1f43..59953c9f52 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -765,7 +765,9 @@ UNLIKELY_END(exit_cr3) * scf and ver_sel above eflags, as we can't use any GPRs, * and we're at a random place on the stack, not in a CPUFINFO block. */ - SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ + SPEC_CTRL_COND_VERW /* Req: %rsp=eframe Clob: efl */ \ + scf=STK_REL(EFRAME_shadow_scf, EFRAME_error_code), \ + sel=STK_REL(EFRAME_shadow_sel, EFRAME_error_code) add $8, %rsp /* Pop ev/ec off the stack */ iretq -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 08:33:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 08:33:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363532.1615102 (Exim 4.92) (envelope-from ) id 1wkHWh-000562-Il; Thu, 16 Jul 2026 08:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363532.1615102; Thu, 16 Jul 2026 08:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHWh-00055u-G9; Thu, 16 Jul 2026 08:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1363532; Thu, 16 Jul 2026 08:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHWg-00055o-JP for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkHWg-009G0o-2c for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkHWg-0025nt-1V for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=SfV23JKGvR8OvB1YfbQWkZvSwtMbW+0jmpiGqwlVnPQ=; b=PNMS1GyZYvxi50KOtko5jFTGIg 6lx4iBjiBzGvHrJkwDKqMH5+tsaTQnew8hzRW5EoXABMMBvR3YsY6WidS0WE5G/LLXa3YfGBd9DbO SRl2z8Wql0G5C+THPall/RutiQKQupLoKWnVJd6GfbhRW0nochU8GMddbvKvNYSfBux0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: drop wrapper C file Message-Id: Date: Thu, 16 Jul 2026 08:33:02 +0000 commit c5b4ba49a3a5e45937e94a22567ed620d1d77906 Author: Jan Beulich AuthorDate: Thu Jul 16 09:17:23 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:17:23 2026 +0200 x86emul: drop wrapper C file Move the little bit that's still left in x86/x86_emulate.c into a __XEN__ conditional in x86/x86_emulate/x86_emulate.c. Move what are roughly the test/fuzzing harness counterparts from there into the corresponding #else. Interestingly more recent gcc takes issue with three static const arrays which are unused when HVM=n (noticeable in particular in the shim build). Apparently such are diagnosed only when present in the top-level file, but not when living in an #include-d one. Requested-by: Andrew Cooper Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- tools/tests/x86_emulator/x86-emulate.c | 21 -------------- xen/arch/x86/Makefile | 8 ------ xen/arch/x86/x86_emulate.c | 37 ------------------------- xen/arch/x86/x86_emulate/Makefile | 11 ++++++++ xen/arch/x86/x86_emulate/x86_emulate.c | 50 ++++++++++++++++++++++++++++++++++ 5 files changed, 61 insertions(+), 66 deletions(-) diff --git a/tools/tests/x86_emulator/x86-emulate.c b/tools/tests/x86_emulator/x86-emulate.c index b22c7d6add..e2fbeb52e7 100644 --- a/tools/tests/x86_emulator/x86-emulate.c +++ b/tools/tests/x86_emulator/x86-emulate.c @@ -3,27 +3,6 @@ #include #include -/* See gcc bug 100680, but here don't bother making this version dependent. */ -#define gcc11_wrap(x) ({ \ - unsigned long x_; \ - __asm__ ( "" : "=g" (x_) : "0" (x) ); \ - (typeof(x))x_; \ -}) - -#define cpu_has_amd_erratum(nr) 0 -#define cpu_has_mpx false -#define read_bndcfgu() 0 -#define xstate_set_init(what) - -/* For generic assembly code: use macros to define operation/operand sizes. */ -#ifdef __i386__ -# define __OS "l" /* Operation Suffix */ -# define __OP "e" /* Operand Prefix */ -#else -# define __OS "q" /* Operation Suffix */ -# define __OP "r" /* Operand Prefix */ -#endif - uint32_t mxcsr_mask = 0x0000ffbf; struct cpu_policy cpu_policy; diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile index 1474b2121e..eac4c08c1d 100644 --- a/xen/arch/x86/Makefile +++ b/xen/arch/x86/Makefile @@ -69,7 +69,6 @@ obj-y += traps-setup.o obj-y += traps.o obj-$(CONFIG_INTEL) += tsx.o obj-$(CONFIG_VM_EVENT) += vm_event.o -obj-y += x86_emulate.o obj-y += xstate.o ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y) @@ -86,13 +85,6 @@ hostprogs-y += efi/mkreloc $(obj)/efi/mkreloc: HOSTCFLAGS += -I$(srctree)/include -ifneq ($(CONFIG_HVM),y) -$(obj)/x86_emulate.o: CFLAGS-y += -Wno-unused-label -endif -ifeq ($(CONFIG_CONDITION_COVERAGE)$(CONFIG_CC_IS_GCC),yy) -$(obj)/x86_emulate.o: CFLAGS-y += -Wno-error=coverage-too-many-conditions -endif - efi-y := $(shell if [ ! -r $(objtree)/include/xen/compile.h -o \ -O $(objtree)/include/xen/compile.h ]; then \ echo '$(TARGET).efi'; fi) \ diff --git a/xen/arch/x86/x86_emulate.c b/xen/arch/x86/x86_emulate.c deleted file mode 100644 index 5f614bd691..0000000000 --- a/xen/arch/x86/x86_emulate.c +++ /dev/null @@ -1,37 +0,0 @@ -/****************************************************************************** - * x86_emulate.c - * - * Wrapper for generic x86 instruction decoder and emulator. - * - * Copyright (c) 2008, Citrix Systems, Inc. - * - * Authors: - * Keir Fraser - */ - -#include - -#include -#include /* current_cpu_info */ -#include -#include /* cpu_has_amd_erratum() */ - -/* Avoid namespace pollution. */ -#undef cmpxchg -#undef cpuid -#undef wbinvd - -#define cpu_has_amd_erratum(nr) \ - cpu_has_amd_erratum(¤t_cpu_data, AMD_ERRATUM_##nr) - -#include "x86_emulate/x86_emulate.c" - -/* - * Local variables: - * mode: C - * c-file-style: "BSD" - * c-basic-offset: 4 - * tab-width: 4 - * indent-tabs-mode: nil - * End: - */ diff --git a/xen/arch/x86/x86_emulate/Makefile b/xen/arch/x86/x86_emulate/Makefile index 2e20d65d78..295e602f6b 100644 --- a/xen/arch/x86/x86_emulate/Makefile +++ b/xen/arch/x86/x86_emulate/Makefile @@ -1,3 +1,14 @@ +# Put this ahead of the sorted list below, as it takes long to build and hence +# we'd like parallel make to schedule its building early. +obj-y += x86_emulate.o + +ifneq ($(CONFIG_HVM),y) +$(obj)/x86_emulate.o: CFLAGS-y += -Wno-unused-label +endif +ifeq ($(CONFIG_CONDITION_COVERAGE)$(CONFIG_CC_IS_GCC),yy) +$(obj)/x86_emulate.o: CFLAGS-y += -Wno-error=coverage-too-many-conditions +endif + obj-y += 0f01.o obj-y += 0fae.o obj-y += 0fc7.o diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 364e6c092d..71546095d4 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -8,8 +8,52 @@ * Copyright (c) 2005-2007 XenSource Inc. */ +#ifdef __XEN__ + +# include + +# include /* cpu_has_amd_erratum() */ +# include /* current_cpu_info */ +# include +# include + +/* Avoid namespace pollution. */ +# undef cmpxchg +# undef cpuid +# undef wbinvd + +# define cpu_has_amd_erratum(nr) \ + cpu_has_amd_erratum(¤t_cpu_data, AMD_ERRATUM_##nr) + +#else /* !__XEN__ */ + +/* See gcc bug 100680, but here don't bother making this version dependent. */ +# define gcc11_wrap(x) ({ \ + unsigned long x_; \ + __asm__ ( "" : "=g" (x_) : "0" (x) ); \ + (typeof(x))x_; \ +}) + +# define cpu_has_amd_erratum(nr) 0 +# define cpu_has_mpx false +# define read_bndcfgu() 0 +# define xstate_set_init(what) + +/* For generic assembly code: use macros to define operation/operand sizes. */ +# ifdef __i386__ +# define __OS "l" /* Operation Suffix */ +# define __OP "e" /* Operand Prefix */ +# else +# define __OS "q" /* Operation Suffix */ +# define __OP "r" /* Operand Prefix */ +# endif + +#endif /* __XEN__ */ + #include "private.h" +#ifndef X86EMUL_NO_MMX + /* * The next two tables are indexed by high opcode extension byte (the one * that's encoded like an immediate) nibble, with each table element then @@ -45,9 +89,15 @@ static const uint16_t _3dnow_ext_table[16] = { [0xb] = (1 << 0xb) /* pswapd */, }; +#endif /* !X86EMUL_NO_MMX */ + +#ifndef X86EMUL_NO_SIMD + /* Shift values between src and dst sizes of pmov{s,z}x{b,w,d}{w,d,q}. */ static const uint8_t pmov_convert_delta[] = { 1, 2, 3, 1, 2, 1 }; +#endif /* !X86EMUL_NO_SIMD */ + static const uint8_t sse_prefix[] = { 0x66, 0xf3, 0xf2 }; #ifdef __x86_64__ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 08:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 08:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363533.1615107 (Exim 4.92) (envelope-from ) id 1wkHWr-000581-Li; Thu, 16 Jul 2026 08:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363533.1615107; Thu, 16 Jul 2026 08:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHWr-00057t-J7; Thu, 16 Jul 2026 08:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1363533; Thu, 16 Jul 2026 08:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHWq-00057n-U6 for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkHWr-009G0u-0Z for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkHWq-0026GK-2S for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7EK7eQk8Jr79R3BKU/h9A5rTHA/WyOss8LhOWZn+NSQ=; b=MATgUfctm1f1R5CgR0ILMi6rFh p4gGbwVO0E/owdh51L97QI8JFoseb7dOnEN6ES/29sTcevX1SoLABT7FCZOgl7RjvMrSRhHPfi6XK wXZBOYCT3yMHb45FgTIDTtUbMYDMDP/DP3yZYHYh7DQWIj4kBOEAn7+9M9eLkba3IvxM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86: put x86_emulate/ early in $(obj-y) Message-Id: Date: Thu, 16 Jul 2026 08:33:12 +0000 commit c363ac025cada08d2872c08825e6694f527f9b46 Author: Jan Beulich AuthorDate: Thu Jul 16 09:18:01 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:01 2026 +0200 x86: put x86_emulate/ early in $(obj-y) ... such that in parallel builds make would schedule it early. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- xen/arch/x86/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile index eac4c08c1d..b14eca98bf 100644 --- a/xen/arch/x86/Makefile +++ b/xen/arch/x86/Makefile @@ -1,3 +1,7 @@ +# Put this ahead of the sorted list below, as it takes long to build and hence +# we'd like parallel make to schedule its building early. +obj-y += x86_emulate/ + obj-y += acpi/ obj-y += boot/ obj-y += cpu/ @@ -9,7 +13,6 @@ obj-y += lib/ obj-y += mm/ obj-$(CONFIG_PV) += pv/ obj-y += x86_64/ -obj-y += x86_emulate/ obj-y += alternative.o obj-y += apic.o -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 08:33:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 08:33:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363535.1615111 (Exim 4.92) (envelope-from ) id 1wkHX2-0005AR-N6; Thu, 16 Jul 2026 08:33:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363535.1615111; Thu, 16 Jul 2026 08:33:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHX2-0005AJ-KX; Thu, 16 Jul 2026 08:33:24 +0000 Received: by outflank-mailman (input) for mailman id 1363535; Thu, 16 Jul 2026 08:33:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHX1-0005AB-4H for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkHX1-009G10-1B for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkHX1-0026bF-09 for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rL5EUCUTFaXi/+EH8Hyk2iArgrvyKgPpT0wlkI9kx0c=; b=ylBcw1bckqd2ZdvFomhvwiO3vK 8HX3lT7IQkYBJunMby0QI9AJ/KbPvZZKGQDWbJQgjb+BBK05HukTLhEiyEkX/29/06/jcIPzH54C5 LgjIZFAveA3tgGM/idGqBZH8m4xRO47aW2Kd761t/JY87f92Wx3Cbgg4RxSNE8xwI9Yo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/console: promote conring{,_size} to __ro_after_init Message-Id: Date: Thu, 16 Jul 2026 08:33:23 +0000 commit 185847d0b6100ee09b2fa642f42449dc6d278a4d Author: Denis Mukhin AuthorDate: Thu Jul 16 09:18:26 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:26 2026 +0200 xen/console: promote conring{,_size} to __ro_after_init Both conring{,_size} should be RO after initialization is completed. Change the conring integer parameters type to `unsigned int` as required by CODING_STYLE. Suggested-by: Andrew Cooper Signed-off-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/console.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index dbda7f2596..5ebbbf63c0 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -340,15 +340,15 @@ static void cf_check do_dec_thresh(unsigned char key, bool unused) */ /* conring_size: allows a larger console ring than default (16kB). */ -static uint32_t __initdata opt_conring_size; +static unsigned int __initdata opt_conring_size; size_param("conring_size", opt_conring_size); #define _CONRING_SIZE 16384 #define CONRING_IDX_MASK(i) ((i)&(conring_size-1)) static char __initdata _conring[_CONRING_SIZE]; -static char *__read_mostly conring = _conring; -static uint32_t __read_mostly conring_size = _CONRING_SIZE; -static uint32_t conringc, conringp; +static char *__ro_after_init conring = _conring; +static unsigned int __ro_after_init conring_size = _CONRING_SIZE; +static unsigned int conringc, conringp; static void cf_check conring_notify(void *unused) { -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 08:33:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 08:33:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363536.1615114 (Exim 4.92) (envelope-from ) id 1wkHXC-0005CQ-Oh; Thu, 16 Jul 2026 08:33:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363536.1615114; Thu, 16 Jul 2026 08:33:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHXC-0005CI-Lt; Thu, 16 Jul 2026 08:33:34 +0000 Received: by outflank-mailman (input) for mailman id 1363536; Thu, 16 Jul 2026 08:33:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkHXB-0005CA-7O for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkHXB-009G16-1X for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkHXB-0027Ac-0T for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 08:33:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=MVWA6EykLT1FR7K7LRV7MCXKMejXkvez/vVxVAmIc1s=; b=uEBuIOInWwU9WKVfQCihT6bczr HfGssYxDkRYiRmKgivac+AubfleuNM7JEfg8X8HVAdo1Y+sLdAjyRRgNXKJxdXNQtiUew+orSP3qZ f4zkSxC5saQhuEa7fzdL86heoqKDip2TFqrHLqlNsnxurYiBwkLY/gS0PPRvXkUuRrjI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/console: use memcpy() in console_init_ring() Message-Id: Date: Thu, 16 Jul 2026 08:33:33 +0000 commit a7fd7d4cbd5e793d31d61c25e08526b330edd7f8 Author: Denis Mukhin AuthorDate: Thu Jul 16 09:18:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:43 2026 +0200 xen/console: use memcpy() in console_init_ring() Make console_init_ring() more efficient by using memcpy()'s, rather than copying the ring a byte at a time. No functional change intended. Suggested-by: Andrew Cooper Signed-off-by: Denis Mukhin Acked-by: Roger Pau Monne --- xen/drivers/char/console.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 5ebbbf63c0..37ea844031 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -463,7 +463,8 @@ static void cf_check conring_dump_keyhandler(unsigned char key) void __init console_init_ring(void) { char *ring; - unsigned int i, order, memflags; + XENCONS_RING_IDX done, size, n; + unsigned int order, memflags; unsigned long flags; if ( !opt_conring_size ) @@ -479,8 +480,19 @@ void __init console_init_ring(void) opt_conring_size = PAGE_SIZE << order; nrspin_lock_irqsave(&console_lock, flags); - for ( i = conringc ; i != conringp; i++ ) - ring[i & (opt_conring_size - 1)] = conring[i & (conring_size - 1)]; + + size = conringp - conringc; + for ( done = 0; done < size; done += n ) + { + XENCONS_RING_IDX src = (conringc + done) & (conring_size - 1); + XENCONS_RING_IDX dst = (conringc + done) & (opt_conring_size - 1); + + n = min(opt_conring_size - dst, conring_size - src); + n = min(size - done, n); + + memcpy(&ring[dst], &conring[src], n); + } + conring = ring; smp_wmb(); /* Allow users of console_force_unlock() to see larger buffer. */ conring_size = opt_conring_size; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 09:44:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 09:44:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363694.1615236 (Exim 4.92) (envelope-from ) id 1wkIdO-0005bQ-UF; Thu, 16 Jul 2026 09:44:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363694.1615236; Thu, 16 Jul 2026 09:44:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdO-0005bJ-Rh; Thu, 16 Jul 2026 09:44:02 +0000 Received: by outflank-mailman (input) for mailman id 1363694; Thu, 16 Jul 2026 09:44:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdN-0005b9-Mq for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkIdN-009HLY-2z for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkIdN-004F4N-1n for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=SwpZeaW2jYEg/CLYeynfmRbLYq8XNMmBD7LYAgKYhZk=; b=JrJk2Y9RTjTbP4gCMY9/s1lrzD IvGSJ1Ad4snxtC7CFqdiQyOZpdjZRpDXEwrMikR5M3yqlYkvtSnHzHfY04olXXOzKdGbwNe/VGao3 LpvMPKtY6G0OQ5QuTNk8NfDFwWRjsJbFLKmRsLi4Vjxm8xXJnZ7qIfyOmxGnGjoB79Hc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: drop wrapper C file Message-Id: Date: Thu, 16 Jul 2026 09:44:01 +0000 commit c5b4ba49a3a5e45937e94a22567ed620d1d77906 Author: Jan Beulich AuthorDate: Thu Jul 16 09:17:23 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:17:23 2026 +0200 x86emul: drop wrapper C file Move the little bit that's still left in x86/x86_emulate.c into a __XEN__ conditional in x86/x86_emulate/x86_emulate.c. Move what are roughly the test/fuzzing harness counterparts from there into the corresponding #else. Interestingly more recent gcc takes issue with three static const arrays which are unused when HVM=n (noticeable in particular in the shim build). Apparently such are diagnosed only when present in the top-level file, but not when living in an #include-d one. Requested-by: Andrew Cooper Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- tools/tests/x86_emulator/x86-emulate.c | 21 -------------- xen/arch/x86/Makefile | 8 ------ xen/arch/x86/x86_emulate.c | 37 ------------------------- xen/arch/x86/x86_emulate/Makefile | 11 ++++++++ xen/arch/x86/x86_emulate/x86_emulate.c | 50 ++++++++++++++++++++++++++++++++++ 5 files changed, 61 insertions(+), 66 deletions(-) diff --git a/tools/tests/x86_emulator/x86-emulate.c b/tools/tests/x86_emulator/x86-emulate.c index b22c7d6add..e2fbeb52e7 100644 --- a/tools/tests/x86_emulator/x86-emulate.c +++ b/tools/tests/x86_emulator/x86-emulate.c @@ -3,27 +3,6 @@ #include #include -/* See gcc bug 100680, but here don't bother making this version dependent. */ -#define gcc11_wrap(x) ({ \ - unsigned long x_; \ - __asm__ ( "" : "=g" (x_) : "0" (x) ); \ - (typeof(x))x_; \ -}) - -#define cpu_has_amd_erratum(nr) 0 -#define cpu_has_mpx false -#define read_bndcfgu() 0 -#define xstate_set_init(what) - -/* For generic assembly code: use macros to define operation/operand sizes. */ -#ifdef __i386__ -# define __OS "l" /* Operation Suffix */ -# define __OP "e" /* Operand Prefix */ -#else -# define __OS "q" /* Operation Suffix */ -# define __OP "r" /* Operand Prefix */ -#endif - uint32_t mxcsr_mask = 0x0000ffbf; struct cpu_policy cpu_policy; diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile index 1474b2121e..eac4c08c1d 100644 --- a/xen/arch/x86/Makefile +++ b/xen/arch/x86/Makefile @@ -69,7 +69,6 @@ obj-y += traps-setup.o obj-y += traps.o obj-$(CONFIG_INTEL) += tsx.o obj-$(CONFIG_VM_EVENT) += vm_event.o -obj-y += x86_emulate.o obj-y += xstate.o ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y) @@ -86,13 +85,6 @@ hostprogs-y += efi/mkreloc $(obj)/efi/mkreloc: HOSTCFLAGS += -I$(srctree)/include -ifneq ($(CONFIG_HVM),y) -$(obj)/x86_emulate.o: CFLAGS-y += -Wno-unused-label -endif -ifeq ($(CONFIG_CONDITION_COVERAGE)$(CONFIG_CC_IS_GCC),yy) -$(obj)/x86_emulate.o: CFLAGS-y += -Wno-error=coverage-too-many-conditions -endif - efi-y := $(shell if [ ! -r $(objtree)/include/xen/compile.h -o \ -O $(objtree)/include/xen/compile.h ]; then \ echo '$(TARGET).efi'; fi) \ diff --git a/xen/arch/x86/x86_emulate.c b/xen/arch/x86/x86_emulate.c deleted file mode 100644 index 5f614bd691..0000000000 --- a/xen/arch/x86/x86_emulate.c +++ /dev/null @@ -1,37 +0,0 @@ -/****************************************************************************** - * x86_emulate.c - * - * Wrapper for generic x86 instruction decoder and emulator. - * - * Copyright (c) 2008, Citrix Systems, Inc. - * - * Authors: - * Keir Fraser - */ - -#include - -#include -#include /* current_cpu_info */ -#include -#include /* cpu_has_amd_erratum() */ - -/* Avoid namespace pollution. */ -#undef cmpxchg -#undef cpuid -#undef wbinvd - -#define cpu_has_amd_erratum(nr) \ - cpu_has_amd_erratum(¤t_cpu_data, AMD_ERRATUM_##nr) - -#include "x86_emulate/x86_emulate.c" - -/* - * Local variables: - * mode: C - * c-file-style: "BSD" - * c-basic-offset: 4 - * tab-width: 4 - * indent-tabs-mode: nil - * End: - */ diff --git a/xen/arch/x86/x86_emulate/Makefile b/xen/arch/x86/x86_emulate/Makefile index 2e20d65d78..295e602f6b 100644 --- a/xen/arch/x86/x86_emulate/Makefile +++ b/xen/arch/x86/x86_emulate/Makefile @@ -1,3 +1,14 @@ +# Put this ahead of the sorted list below, as it takes long to build and hence +# we'd like parallel make to schedule its building early. +obj-y += x86_emulate.o + +ifneq ($(CONFIG_HVM),y) +$(obj)/x86_emulate.o: CFLAGS-y += -Wno-unused-label +endif +ifeq ($(CONFIG_CONDITION_COVERAGE)$(CONFIG_CC_IS_GCC),yy) +$(obj)/x86_emulate.o: CFLAGS-y += -Wno-error=coverage-too-many-conditions +endif + obj-y += 0f01.o obj-y += 0fae.o obj-y += 0fc7.o diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 364e6c092d..71546095d4 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -8,8 +8,52 @@ * Copyright (c) 2005-2007 XenSource Inc. */ +#ifdef __XEN__ + +# include + +# include /* cpu_has_amd_erratum() */ +# include /* current_cpu_info */ +# include +# include + +/* Avoid namespace pollution. */ +# undef cmpxchg +# undef cpuid +# undef wbinvd + +# define cpu_has_amd_erratum(nr) \ + cpu_has_amd_erratum(¤t_cpu_data, AMD_ERRATUM_##nr) + +#else /* !__XEN__ */ + +/* See gcc bug 100680, but here don't bother making this version dependent. */ +# define gcc11_wrap(x) ({ \ + unsigned long x_; \ + __asm__ ( "" : "=g" (x_) : "0" (x) ); \ + (typeof(x))x_; \ +}) + +# define cpu_has_amd_erratum(nr) 0 +# define cpu_has_mpx false +# define read_bndcfgu() 0 +# define xstate_set_init(what) + +/* For generic assembly code: use macros to define operation/operand sizes. */ +# ifdef __i386__ +# define __OS "l" /* Operation Suffix */ +# define __OP "e" /* Operand Prefix */ +# else +# define __OS "q" /* Operation Suffix */ +# define __OP "r" /* Operand Prefix */ +# endif + +#endif /* __XEN__ */ + #include "private.h" +#ifndef X86EMUL_NO_MMX + /* * The next two tables are indexed by high opcode extension byte (the one * that's encoded like an immediate) nibble, with each table element then @@ -45,9 +89,15 @@ static const uint16_t _3dnow_ext_table[16] = { [0xb] = (1 << 0xb) /* pswapd */, }; +#endif /* !X86EMUL_NO_MMX */ + +#ifndef X86EMUL_NO_SIMD + /* Shift values between src and dst sizes of pmov{s,z}x{b,w,d}{w,d,q}. */ static const uint8_t pmov_convert_delta[] = { 1, 2, 3, 1, 2, 1 }; +#endif /* !X86EMUL_NO_SIMD */ + static const uint8_t sse_prefix[] = { 0x66, 0xf3, 0xf2 }; #ifdef __x86_64__ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 09:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 09:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363695.1615239 (Exim 4.92) (envelope-from ) id 1wkIdY-0005d9-Vz; Thu, 16 Jul 2026 09:44:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363695.1615239; Thu, 16 Jul 2026 09:44:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdY-0005d0-TG; Thu, 16 Jul 2026 09:44:12 +0000 Received: by outflank-mailman (input) for mailman id 1363695; Thu, 16 Jul 2026 09:44:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdX-0005co-Pf for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkIdY-009HLf-06 for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkIdX-004FBH-2H for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Sjbphz6sPhIInimpEQ5hILktb05B4KP5ySrxBhFqitc=; b=VldXu9iXr3zA5HAZ7eUkdJ4Ui4 kzgsZxvAUWjLeCZRhHIjQ+m+SOUy2UxmUC/svL2xGgXSwRJOIsN6q7bhJc/gPRBEKsYzCyrzSmJlv aRCN2Rv6JVHEML4G8GCtf2ysZbdNq3qZVuZx4aQK7QB47VlxJ4hTwjj7Xdr96lIbqnnU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86: put x86_emulate/ early in $(obj-y) Message-Id: Date: Thu, 16 Jul 2026 09:44:11 +0000 commit c363ac025cada08d2872c08825e6694f527f9b46 Author: Jan Beulich AuthorDate: Thu Jul 16 09:18:01 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:01 2026 +0200 x86: put x86_emulate/ early in $(obj-y) ... such that in parallel builds make would schedule it early. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Reviewed-by: Teddy Astie --- xen/arch/x86/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile index eac4c08c1d..b14eca98bf 100644 --- a/xen/arch/x86/Makefile +++ b/xen/arch/x86/Makefile @@ -1,3 +1,7 @@ +# Put this ahead of the sorted list below, as it takes long to build and hence +# we'd like parallel make to schedule its building early. +obj-y += x86_emulate/ + obj-y += acpi/ obj-y += boot/ obj-y += cpu/ @@ -9,7 +13,6 @@ obj-y += lib/ obj-y += mm/ obj-$(CONFIG_PV) += pv/ obj-y += x86_64/ -obj-y += x86_emulate/ obj-y += alternative.o obj-y += apic.o -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 09:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 09:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363696.1615243 (Exim 4.92) (envelope-from ) id 1wkIdj-0005fJ-0p; Thu, 16 Jul 2026 09:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363696.1615243; Thu, 16 Jul 2026 09:44:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdi-0005fB-Ua; Thu, 16 Jul 2026 09:44:22 +0000 Received: by outflank-mailman (input) for mailman id 1363696; Thu, 16 Jul 2026 09:44:21 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdh-0005f4-Sm for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:21 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkIdi-009HLj-0R for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:21 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkIdh-004FHo-2c for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JTH3nkeshuegdDgVoXT1iOB0zJEFnB8/MOvDWeRk2kA=; b=QwwElGL3M2/9rHBi5nXtjukaff VEbLGrdx3Hu4ai2Y0f9nXdxXhEIsPK90I5kyuQjroSTY3NWv23nVPiDPFJpz0rTYzYY5ZTO2KtNJW sjK9bedia5NOMuQ9pu53SWeDqmOrqCeJiK7AsgjmTV3NC2Dw0N6v4SHqsYIsZv/BZ088=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/console: promote conring{,_size} to __ro_after_init Message-Id: Date: Thu, 16 Jul 2026 09:44:21 +0000 commit 185847d0b6100ee09b2fa642f42449dc6d278a4d Author: Denis Mukhin AuthorDate: Thu Jul 16 09:18:26 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:26 2026 +0200 xen/console: promote conring{,_size} to __ro_after_init Both conring{,_size} should be RO after initialization is completed. Change the conring integer parameters type to `unsigned int` as required by CODING_STYLE. Suggested-by: Andrew Cooper Signed-off-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/console.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index dbda7f2596..5ebbbf63c0 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -340,15 +340,15 @@ static void cf_check do_dec_thresh(unsigned char key, bool unused) */ /* conring_size: allows a larger console ring than default (16kB). */ -static uint32_t __initdata opt_conring_size; +static unsigned int __initdata opt_conring_size; size_param("conring_size", opt_conring_size); #define _CONRING_SIZE 16384 #define CONRING_IDX_MASK(i) ((i)&(conring_size-1)) static char __initdata _conring[_CONRING_SIZE]; -static char *__read_mostly conring = _conring; -static uint32_t __read_mostly conring_size = _CONRING_SIZE; -static uint32_t conringc, conringp; +static char *__ro_after_init conring = _conring; +static unsigned int __ro_after_init conring_size = _CONRING_SIZE; +static unsigned int conringc, conringp; static void cf_check conring_notify(void *unused) { -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 16 09:44:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 16 Jul 2026 09:44:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1363697.1615248 (Exim 4.92) (envelope-from ) id 1wkIdu-0005h8-3E; Thu, 16 Jul 2026 09:44:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1363697.1615248; Thu, 16 Jul 2026 09:44:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIdt-0005gz-Vx; Thu, 16 Jul 2026 09:44:33 +0000 Received: by outflank-mailman (input) for mailman id 1363697; Thu, 16 Jul 2026 09:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wkIds-0005gt-BW for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wkIds-009HLn-1t for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wkIds-004FmC-0c for xen-changelog@lists.xenproject.org; Thu, 16 Jul 2026 09:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PtM2LyNYg7xlhiE6I8I/UlMxux+LzY/CPuaY2qj350s=; b=a+WYVGX2BIPq9lEbv7XQkAIQwk o37x7AVbJNDTJf8U87HrzrBBB1MirGjG16VsqR5416jUxPMfrU+CEqo6J6cDgW95oPHHPfQvC8jsp nahtAkLZKsCYpMego4K0zcOB03SFPEfwnpMFYGBjwoGfuG+KfcZFfvTGlfoXyXR6GqUE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/console: use memcpy() in console_init_ring() Message-Id: Date: Thu, 16 Jul 2026 09:44:32 +0000 commit a7fd7d4cbd5e793d31d61c25e08526b330edd7f8 Author: Denis Mukhin AuthorDate: Thu Jul 16 09:18:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 16 09:18:43 2026 +0200 xen/console: use memcpy() in console_init_ring() Make console_init_ring() more efficient by using memcpy()'s, rather than copying the ring a byte at a time. No functional change intended. Suggested-by: Andrew Cooper Signed-off-by: Denis Mukhin Acked-by: Roger Pau Monne --- xen/drivers/char/console.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 5ebbbf63c0..37ea844031 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -463,7 +463,8 @@ static void cf_check conring_dump_keyhandler(unsigned char key) void __init console_init_ring(void) { char *ring; - unsigned int i, order, memflags; + XENCONS_RING_IDX done, size, n; + unsigned int order, memflags; unsigned long flags; if ( !opt_conring_size ) @@ -479,8 +480,19 @@ void __init console_init_ring(void) opt_conring_size = PAGE_SIZE << order; nrspin_lock_irqsave(&console_lock, flags); - for ( i = conringc ; i != conringp; i++ ) - ring[i & (opt_conring_size - 1)] = conring[i & (conring_size - 1)]; + + size = conringp - conringc; + for ( done = 0; done < size; done += n ) + { + XENCONS_RING_IDX src = (conringc + done) & (conring_size - 1); + XENCONS_RING_IDX dst = (conringc + done) & (opt_conring_size - 1); + + n = min(opt_conring_size - dst, conring_size - src); + n = min(size - done, n); + + memcpy(&ring[dst], &conring[src], n); + } + conring = ring; smp_wmb(); /* Allow users of console_force_unlock() to see larger buffer. */ conring_size = opt_conring_size; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 08:55:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 08:55:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366304.1616184 (Exim 4.92) (envelope-from ) id 1wljmC-0007Yk-52; Mon, 20 Jul 2026 08:55:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366304.1616184; Mon, 20 Jul 2026 08:55:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wljmC-0007Yc-2W; Mon, 20 Jul 2026 08:55:04 +0000 Received: by outflank-mailman (input) for mailman id 1366304; Mon, 20 Jul 2026 08:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wljmA-0007YG-SK for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wljmB-00GKQO-0B for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wljmA-00FMMd-2C for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=il4LU3STmJOO0M7EKkK8UndMvRWqfSf2gS3VVZ3T6iU=; b=RUPjfpW8dDc84pjUEXV1tseAp9 J5WxpdT4lN+v5ps7geBXSRmizTeCBeGPw0iyvrDszZlk8D2U8aYr/YBZwj5/wZCaEllnahOXpbi+6 rGCxfHXkIl6cQTRV1Q1Cw5EZf3gHAJ/AsdSrs7p5PyNOOjr/gXiLXjKFxvdyJF3kTA9A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/console: use bool as return value from printk_ratelimit() Message-Id: Date: Mon, 20 Jul 2026 08:55:02 +0000 commit 05edb693a2c69fe11df7d5d2ebc9c92fa6f296c5 Author: Denis Mukhin AuthorDate: Mon Jul 20 09:49:23 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 09:49:23 2026 +0200 xen/console: use bool as return value from printk_ratelimit() {__,}printk_ratelimit() are predicates. Make that pronounced by updating the return value to boolean. Not a functional change. Signed-off-by: Denis Mukhin Acked-by: Jan Beulich Reviewed-by: Teddy Astie --- xen/drivers/char/console.c | 9 +++++---- xen/include/xen/lib.h | 6 +++--- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 37ea844031..ea4e3ff341 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -1282,7 +1282,8 @@ void console_end_sync(void) * This enforces a rate limit: not more than one kernel message * every printk_ratelimit_ms (millisecs). */ -int __printk_ratelimit(unsigned int ratelimit_ms, unsigned int ratelimit_burst) +bool __printk_ratelimit(unsigned int ratelimit_ms, + unsigned int ratelimit_burst) { static DEFINE_SPINLOCK(ratelimit_lock); static unsigned long toks = 10 * 5 * 1000; @@ -1321,11 +1322,11 @@ int __printk_ratelimit(unsigned int ratelimit_ms, unsigned int ratelimit_burst) rspin_unlock(&console_lock); } local_irq_restore(flags); - return 1; + return true; } missed++; spin_unlock_irqrestore(&ratelimit_lock, flags); - return 0; + return false; } /* Minimum time in ms between messages */ @@ -1334,7 +1335,7 @@ static const unsigned int printk_ratelimit_ms = 5 * 1000; /* Number of messages we send before ratelimiting */ static const unsigned int printk_ratelimit_burst = 10; -int printk_ratelimit(void) +bool printk_ratelimit(void) { return __printk_ratelimit(printk_ratelimit_ms, printk_ratelimit_burst); } diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index bb0fd446b4..3c545ff33c 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -82,9 +82,9 @@ extern void guest_printk(const struct domain *d, const char *fmt, ...) __attribute__ ((format (printf, 2, 3))); extern void noreturn panic(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); -extern int __printk_ratelimit(unsigned int ratelimit_ms, - unsigned int ratelimit_burst); -extern int printk_ratelimit(void); +extern bool __printk_ratelimit(unsigned int ratelimit_ms, + unsigned int ratelimit_burst); +extern bool printk_ratelimit(void); #define gprintk(lvl, fmt, args...) \ printk(XENLOG_GUEST lvl "%pv " fmt, current, ## args) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 08:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 08:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366306.1616197 (Exim 4.92) (envelope-from ) id 1wljmL-0007n1-CI; Mon, 20 Jul 2026 08:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366306.1616197; Mon, 20 Jul 2026 08:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wljmL-0007mt-9Z; Mon, 20 Jul 2026 08:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1366306; Mon, 20 Jul 2026 08:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wljmK-0007ks-Tp for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wljmL-00GKSi-0W for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wljmK-00FMnh-2l for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 08:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=f6hmyXn8xh5nCYCG4R6tKVp1nZ4qpt4IRn91pwfJpK0=; b=YqSIwEX/z7MEc4+Yj+NFb/qBdd 9mfNLbPiznvuB8wfGoQLIwEnSwdtiBA3/5jNOtc8W1XnHfJ7r1iuftHbRXMiBVGuT0+rEUKeJbwsK 8D2rTRI70+XCBvVDgtKCcvAV/o6qZKuvtMgNtBAH0aTCUXj8Mruj6VzCDVHSLQjG6Jx4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 08:55:12 +0000 commit cf90c8a48af2694d0653f754996a41672a153de4 Author: Jan Beulich AuthorDate: Mon Jul 20 09:50:00 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 09:50:00 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index 8ff2653895..84717d3ebe 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1946,7 +1946,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 71546095d4..38e5c349f5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6236,9 +6236,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 09:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 09:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366401.1616283 (Exim 4.92) (envelope-from ) id 1wlkXb-0003ur-OI; Mon, 20 Jul 2026 09:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366401.1616283; Mon, 20 Jul 2026 09:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlkXb-0003uj-Li; Mon, 20 Jul 2026 09:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1366401; Mon, 20 Jul 2026 09:44:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlkXZ-0003ud-QI for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlkXZ-00GLXT-34 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlkXZ-00H58R-1v for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jKVihq6YJGcfH6m9OY8FxQ5ElSD+bDbebVTB3cHoCxA=; b=Zgq66KWBfsTafT5H+dwCONmC1p qubgjOJmE/8sEph6gOLf9f6xIZlrHSW7ExowP55fmtS5A/ffFjcWQqJGCrhrvJcLJ+IyLHpc+QaOU XFhfaf1UYVBZ/zpxXa2fobjZefvYXakEEfIaZPLQCwQ9a+BQZEU4uMIk0hUwCGepKO/M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/console: use bool as return value from printk_ratelimit() Message-Id: Date: Mon, 20 Jul 2026 09:44:01 +0000 commit 05edb693a2c69fe11df7d5d2ebc9c92fa6f296c5 Author: Denis Mukhin AuthorDate: Mon Jul 20 09:49:23 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 09:49:23 2026 +0200 xen/console: use bool as return value from printk_ratelimit() {__,}printk_ratelimit() are predicates. Make that pronounced by updating the return value to boolean. Not a functional change. Signed-off-by: Denis Mukhin Acked-by: Jan Beulich Reviewed-by: Teddy Astie --- xen/drivers/char/console.c | 9 +++++---- xen/include/xen/lib.h | 6 +++--- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 37ea844031..ea4e3ff341 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -1282,7 +1282,8 @@ void console_end_sync(void) * This enforces a rate limit: not more than one kernel message * every printk_ratelimit_ms (millisecs). */ -int __printk_ratelimit(unsigned int ratelimit_ms, unsigned int ratelimit_burst) +bool __printk_ratelimit(unsigned int ratelimit_ms, + unsigned int ratelimit_burst) { static DEFINE_SPINLOCK(ratelimit_lock); static unsigned long toks = 10 * 5 * 1000; @@ -1321,11 +1322,11 @@ int __printk_ratelimit(unsigned int ratelimit_ms, unsigned int ratelimit_burst) rspin_unlock(&console_lock); } local_irq_restore(flags); - return 1; + return true; } missed++; spin_unlock_irqrestore(&ratelimit_lock, flags); - return 0; + return false; } /* Minimum time in ms between messages */ @@ -1334,7 +1335,7 @@ static const unsigned int printk_ratelimit_ms = 5 * 1000; /* Number of messages we send before ratelimiting */ static const unsigned int printk_ratelimit_burst = 10; -int printk_ratelimit(void) +bool printk_ratelimit(void) { return __printk_ratelimit(printk_ratelimit_ms, printk_ratelimit_burst); } diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index bb0fd446b4..3c545ff33c 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -82,9 +82,9 @@ extern void guest_printk(const struct domain *d, const char *fmt, ...) __attribute__ ((format (printf, 2, 3))); extern void noreturn panic(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); -extern int __printk_ratelimit(unsigned int ratelimit_ms, - unsigned int ratelimit_burst); -extern int printk_ratelimit(void); +extern bool __printk_ratelimit(unsigned int ratelimit_ms, + unsigned int ratelimit_burst); +extern bool printk_ratelimit(void); #define gprintk(lvl, fmt, args...) \ printk(XENLOG_GUEST lvl "%pv " fmt, current, ## args) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 09:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 09:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366402.1616286 (Exim 4.92) (envelope-from ) id 1wlkXl-0003x0-Pm; Mon, 20 Jul 2026 09:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366402.1616286; Mon, 20 Jul 2026 09:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlkXl-0003wt-N1; Mon, 20 Jul 2026 09:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1366402; Mon, 20 Jul 2026 09:44:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlkXj-0003wh-RH for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlkXk-00GLXo-0I for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlkXj-00H5q6-2S for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 09:44:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=uabY5oJslw3a56iEfn4arT3x3CmgO+PCx4XD4hgVVhw=; b=moraK4tHAbUTEzoGLNostG1QKB BQyH0L9/LdrWKrEO7W7n/AAF/xeGAvXeedcomH/kNgU5bfCTh+ORLvj5JsbLlJmynA9hoelp1jifc IYvuATsKwmWGfKdoQX5mnKm73JS3Idg5XuJP6FHTTnk04bGWbQ4l5Ry7fhyq17YjiOV8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 09:44:11 +0000 commit cf90c8a48af2694d0653f754996a41672a153de4 Author: Jan Beulich AuthorDate: Mon Jul 20 09:50:00 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 09:50:00 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index 8ff2653895..84717d3ebe 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1946,7 +1946,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 71546095d4..38e5c349f5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6236,9 +6236,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 10:33:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 10:33:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366493.1616380 (Exim 4.92) (envelope-from ) id 1wllJ1-0007Z2-Dz; Mon, 20 Jul 2026 10:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366493.1616380; Mon, 20 Jul 2026 10:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wllJ1-0007Yu-BT; Mon, 20 Jul 2026 10:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1366493; Mon, 20 Jul 2026 10:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wllJ0-0007Yo-0E for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wllJ0-00GMtG-0W for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wllIz-001Dix-2g for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PWk5SUs8gxxz6tP35FhF/hhj/E0y9HvLfEG6eAcfZxI=; b=kBKbzhzej60naAe2RoGaSS+Rcm egseFUAW/jzWr3S+Ph3Nmhpt5Q9UQotvYnKIHVQbFOng1qaffWQoVez6oI+54IpQ+KAkt8YrqO7mV hG4Xu9O9BxEeaR+7pdG4c3vkvnUUx7jXwQgbaXfpgU2j/UB1+AEIkKIJtu6xtNZZZ2e0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 10:33:01 +0000 commit bedbc17d8407c456c7fbe126c0df55610559d8c6 Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 11:11:37 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 11:11:37 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie Release-acked-by: Oleksii Kurochko --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 4252339978..53a86ba373 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1255,6 +1255,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 07f712a0a4..3ea4c650ee 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1481,6 +1481,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 10:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 10:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366512.1616403 (Exim 4.92) (envelope-from ) id 1wllTf-0001Tl-IE; Mon, 20 Jul 2026 10:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366512.1616403; Mon, 20 Jul 2026 10:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wllTf-0001Td-Fk; Mon, 20 Jul 2026 10:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1366512; Mon, 20 Jul 2026 10:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wllTe-0001TX-Bp for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wllTe-00GNW2-1s for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wllTe-001bzv-0n for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 10:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sp00UKDcYpDMrO79nSk4T6hMrn80WkBnClh9P3aj03Q=; b=YIlqY0yklmLtGFAv/BAnm7LdbQ vTgBBsA2tjHo2AX4YvBT96VrftP6dHS/1KlBUn9f/EW9iF6yfykZWowEthTY6flPk40qq4S0Irus+ AIiOqgwZzfmTn1CKyi5zE3SBevp4KST1Pw4R2z/war40VxVdE+gScqASFCT1lYfqwPl8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 10:44:02 +0000 commit 2a36c6edc9e90d5b0287ba54cd8ad7e611ea055d Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 11:11:37 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 12:31:16 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie Release-acked-by: Oleksii Kurochko --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 1d458f1372..ba7244ccc5 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1255,6 +1255,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 07f712a0a4..3ea4c650ee 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1481,6 +1481,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:22:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:22:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366533.1616424 (Exim 4.92) (envelope-from ) id 1wlm4Q-0007fq-Ix; Mon, 20 Jul 2026 11:22:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366533.1616424; Mon, 20 Jul 2026 11:22:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlm4Q-0007fi-GR; Mon, 20 Jul 2026 11:22:02 +0000 Received: by outflank-mailman (input) for mailman id 1366533; Mon, 20 Jul 2026 11:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlm4P-0007fc-Ly for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlm4P-00GOpU-2Y for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlm4P-002yS3-1U for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dQ9dCdIg3GAltXoHsPXv2Pjmg9xPIhb9zLIema4S714=; b=HOx12PnyByGdMLtMAnkWwBrEjr frnKXJuus0E1UNhvTI6d6REWGh7ncESjUpL6xK/nmLydIIWGa9KewU5Mlmo41d2UUhnPpZDnJnWzK RQkoaLGysWhBDhf9ZC1OwzR6Ykw24YdkABE0/pMXgzpGAH8eiw83qMs2oj9B7RW0g+7Y=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 11:22:01 +0000 commit bedbc17d8407c456c7fbe126c0df55610559d8c6 Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 11:11:37 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 11:11:37 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie Release-acked-by: Oleksii Kurochko --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 4252339978..53a86ba373 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1255,6 +1255,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 07f712a0a4..3ea4c650ee 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1481,6 +1481,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366534.1616429 (Exim 4.92) (envelope-from ) id 1wlm4b-0007iV-Ly; Mon, 20 Jul 2026 11:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366534.1616429; Mon, 20 Jul 2026 11:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlm4b-0007iL-J8; Mon, 20 Jul 2026 11:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1366534; Mon, 20 Jul 2026 11:22:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlm4Z-0007i4-Ts for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlm4a-00GOpv-0Y for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlm4Z-002yxK-2l for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:22:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+nHPxuqKSZxuA5d4sJ4r5ntiHg1HYDCsZJjGC5kPymk=; b=530g6e7ZX2gih7pq7CZgYUXSo0 nBlj+kVJjnYwEbb1PR5QXdxL33SJXYQMUNTbca445z5tToMgF0/Eht+gp/pcs0BLwNMJrIIGGaVPI cDNfHZXhAQHgFgW6sCFzaNr2xIkXO5ZJR/t35vNL0la7jsOUMxRuECYl40GnY8812N4E=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/domctl: Reorder user_regs accesses for efficiency Message-Id: Date: Mon, 20 Jul 2026 11:22:11 +0000 commit 50e7b8a32dcb1360dbe9e0fa8b81a3ad02d0b670 Author: Andrew Cooper AuthorDate: Mon Jul 20 10:12:13 2026 +0100 Commit: Andrew Cooper CommitDate: Mon Jul 20 12:05:36 2026 +0100 x86/domctl: Reorder user_regs accesses for efficiency The current order is derived from expanding XLAT_cpu_user_regs() which used the x86_32 cpu_user_regs order. This is correct for one the blocks, but not the others. In order to work with the prefetcher, rather than against it, loads want to be in field order. Make this so for the three paths reading an x86_64 cpu_user_regs. No functional change. Reported-by: Jan Beulich Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Frediano Ziglio Reviewed-by: Teddy Astie --- xen/arch/x86/domain.c | 6 +++--- xen/arch/x86/domctl.c | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 53a86ba373..996b50af7a 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1259,17 +1259,17 @@ int arch_set_info_guest( v->arch.user_regs.r14 = c.nat->user_regs.r14; v->arch.user_regs.r13 = c.nat->user_regs.r13; v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.rbp = c.nat->user_regs.rbp; + v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.r11 = c.nat->user_regs.r11; v->arch.user_regs.r10 = c.nat->user_regs.r10; v->arch.user_regs.r9 = c.nat->user_regs.r9; v->arch.user_regs.r8 = c.nat->user_regs.r8; - v->arch.user_regs.rbx = c.nat->user_regs.rbx; + v->arch.user_regs.rax = c.nat->user_regs.rax; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; v->arch.user_regs.rsi = c.nat->user_regs.rsi; v->arch.user_regs.rdi = c.nat->user_regs.rdi; - v->arch.user_regs.rbp = c.nat->user_regs.rbp; - v->arch.user_regs.rax = c.nat->user_regs.rax; v->arch.user_regs.rip = c.nat->user_regs.rip; v->arch.user_regs.cs = c.nat->user_regs.cs; v->arch.user_regs.rflags = (c.nat->user_regs.rflags & X86_EFLAGS_ALL) | X86_EFLAGS_MBS; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 3ea4c650ee..2ecd81d89b 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1485,17 +1485,17 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) c.nat->user_regs.r14 = v->arch.user_regs.r14; c.nat->user_regs.r13 = v->arch.user_regs.r13; c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.rbp = v->arch.user_regs.rbp; + c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.r11 = v->arch.user_regs.r11; c.nat->user_regs.r10 = v->arch.user_regs.r10; c.nat->user_regs.r9 = v->arch.user_regs.r9; c.nat->user_regs.r8 = v->arch.user_regs.r8; - c.nat->user_regs.rbx = v->arch.user_regs.rbx; + c.nat->user_regs.rax = v->arch.user_regs.rax; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; c.nat->user_regs.rsi = v->arch.user_regs.rsi; c.nat->user_regs.rdi = v->arch.user_regs.rdi; - c.nat->user_regs.rbp = v->arch.user_regs.rbp; - c.nat->user_regs.rax = v->arch.user_regs.rax; c.nat->user_regs.rip = v->arch.user_regs.rip; c.nat->user_regs.cs = v->arch.user_regs.cs; c.nat->user_regs.rflags = v->arch.user_regs.rflags; @@ -1514,13 +1514,13 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) else { /* Backing memory is pre-zeroed. */ + c.cmp->user_regs.ebp = v->arch.user_regs.ebp; c.cmp->user_regs.ebx = v->arch.user_regs.ebx; + c.cmp->user_regs.eax = v->arch.user_regs.eax; c.cmp->user_regs.ecx = v->arch.user_regs.ecx; c.cmp->user_regs.edx = v->arch.user_regs.edx; c.cmp->user_regs.esi = v->arch.user_regs.esi; c.cmp->user_regs.edi = v->arch.user_regs.edi; - c.cmp->user_regs.ebp = v->arch.user_regs.ebp; - c.cmp->user_regs.eax = v->arch.user_regs.eax; c.cmp->user_regs.eip = v->arch.user_regs.eip; c.cmp->user_regs.cs = v->arch.user_regs.cs; c.cmp->user_regs.eflags = v->arch.user_regs.eflags; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366537.1616432 (Exim 4.92) (envelope-from ) id 1wlmPj-0001fz-0N; Mon, 20 Jul 2026 11:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366537.1616432; Mon, 20 Jul 2026 11:44:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmPi-0001fr-U4; Mon, 20 Jul 2026 11:44:02 +0000 Received: by outflank-mailman (input) for mailman id 1366537; Mon, 20 Jul 2026 11:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmPi-0001fl-0Z for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmPi-00GPLT-0n for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmPh-003ley-2y for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GqiLyFSUzfGsLzv/J9/YpjhcnN2NLys6R6D/EBiUpyc=; b=JBYBPPQqXjbCP4jAG/EO9svY9Q cQi1yAr6o5Ti8VgoVle6G7PoM4Yz5/fWK/NmLanezNxyUaAhaeX4UKm3HSQUI6KvqCOqUJCTINJYC UTdys926824iVvzVnUnr9TLa9pHgwVFvBR2bQqzSIfoDc48TcdidCuQX4+EajL8Gup9U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/numa: fix setup of non-aligned memory affinity ranges Message-Id: Date: Mon, 20 Jul 2026 11:44:01 +0000 commit 94fa7e1626fd755a4cf70904ca463ed068eea6f1 Author: Roger Pau Monné AuthorDate: Mon Jul 20 13:29:16 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:29:16 2026 +0200 xen/numa: fix setup of non-aligned memory affinity ranges The logic to populate memnodemap in populate_memnodemap() assumes that all ranges are aligned to the hash shift, this however is only true for the first address in a memory affinity node. Any subsequent ranges belonging to the same node might not be aligned to the hash shift value. Such lack of alignment causes issues to the logic in populate_memnodemap(), as then the tail of the range might not be properly accounted for and setup in memnodemap. Fix this by forcing the start address of all regions to be aligned to the hash shift; if such alignment causes a region overlap it would always be between regions on the same node, and hence will never cause setup issues of the memnodemap array. Fixes: 1666086b0044 ("x86/NUMA: improve memnode_shift calculation for multi node system") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: 188d5305297f4e842511d1374c7121ac8a37c169 master date: 2026-06-05 19:13:47 +0200 --- xen/common/numa.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/numa.c b/xen/common/numa.c index ad75955a16..e2c89bf55b 100644 --- a/xen/common/numa.c +++ b/xen/common/numa.c @@ -403,6 +403,12 @@ static int __init populate_memnodemap(const struct node *nodes, if ( (epdx >> shift) >= memnodemapsize ) return 0; + /* + * Round down start address: if start is not aligned to the memnodemap + * chunk size the tail remainder might not be added. Overlaps created + * by rounding will fall into the same NUMA region. + */ + spdx = ROUNDDOWN(spdx, 1UL << shift); do { if ( memnodemap[spdx >> shift] != NUMA_NO_NODE && (!nodeids || memnodemap[spdx >> shift] != nodeids[i]) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366538.1616437 (Exim 4.92) (envelope-from ) id 1wlmPt-0001i3-1e; Mon, 20 Jul 2026 11:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366538.1616437; Mon, 20 Jul 2026 11:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmPs-0001hv-VN; Mon, 20 Jul 2026 11:44:12 +0000 Received: by outflank-mailman (input) for mailman id 1366538; Mon, 20 Jul 2026 11:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmPs-0001hh-3x for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmPs-00GPLs-1A for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmPs-003lvz-07 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hpvwmRj4aTjFZvmlnv41LTcTlE53eb2PL245O95Plpg=; b=M+dxhzoCwZom4sKLi7tV6cwFEJ sTCbyYnwygtsLMkm3UQfxq6QtQv1TireMPWFJN2TxXdIWe8dNzTnBs3Uwn1/Xr+yjzEGp5ZLLNtiY Wxw3bGT9y8Di4cmgf2rEpCL7LjU6QigfuZmRuqWZKdjKMLpxVOr2SJra85n+M3PgGN0A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Mon, 20 Jul 2026 11:44:12 +0000 commit 5dd8f03f8fb4d26ea84ae12edb347d49c0f82098 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:29:39 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:29:39 2026 +0200 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie master commit: 7d48ef45b6df0cf8985b84305e02b7440de8f50f master date: 2026-07-10 19:35:49 +0100 --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 7ce97c4726..52a4a76797 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -775,12 +775,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366539.1616441 (Exim 4.92) (envelope-from ) id 1wlmQ3-0001kB-2z; Mon, 20 Jul 2026 11:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366539.1616441; Mon, 20 Jul 2026 11:44:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQ3-0001k3-0P; Mon, 20 Jul 2026 11:44:23 +0000 Received: by outflank-mailman (input) for mailman id 1366539; Mon, 20 Jul 2026 11:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQ2-0001jx-6l for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQ2-00GPLw-1T for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQ2-003m70-0R for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PjqYNW69cUneze/3gWGq+Ph+LCUWcUPoac+TIf/3lII=; b=ab5/tu0LO0IOtp0pHjT/DSPfTr OfGqIEjancEPs2yIF9btkpU+H6t3Ff0UlhWIy3D+jmoIpdJjLrMFWgUsQWi6GmA9r+WPgQx5fqVS3 3qJX4euoiE/ZLmvNeVNlXqUcJAg1BKTrcwxAQhLy5sx5vgpzzjsxXebdtdZtwHHPBjHY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Mon, 20 Jul 2026 11:44:22 +0000 commit 16b79fbf28ad721a42f7e97970ef78c4121dc0a9 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:30:07 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:07 2026 +0200 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 master date: 2026-07-14 17:31:08 +0100 --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 187f5f6a3e..c8533361e1 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -52,7 +52,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -87,9 +87,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366540.1616445 (Exim 4.92) (envelope-from ) id 1wlmQE-0001m5-4R; Mon, 20 Jul 2026 11:44:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366540.1616445; Mon, 20 Jul 2026 11:44:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQE-0001lx-1p; Mon, 20 Jul 2026 11:44:34 +0000 Received: by outflank-mailman (input) for mailman id 1366540; Mon, 20 Jul 2026 11:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQC-0001lr-Fb for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQC-00GPM2-2L for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQC-003mOH-1F for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=713buAvneAoDM8LEG/fUbvQ7FCwxOGKA6+oLiFb/1xQ=; b=oRfrEtwQelGOSHZu9IE1HZCp0u 81ZoZhqCspEC5mf6qFDerwFvDaUs/FFSiMrBNgvE1AzLvqU3GZ4ooouI1CTW1p5I+RRdkxg+jK7yV hS0sIei2jTmpcXinqJDkIIYJ82EplHEi+q36Tk5RSsGDfHTi9OBtrO7y+Agckk+fbyQQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 11:44:32 +0000 commit 7c27efebfc8cf2d0bbb19cd35edc82881c5240c2 Author: Jan Beulich AuthorDate: Mon Jul 20 13:30:29 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:29 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: cf90c8a48af2694d0653f754996a41672a153de4 master date: 2026-07-20 09:50:00 +0200 --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index afe2e297d9..f194c209ed 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1945,7 +1945,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 2aedd4d155..c9cf30b443 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6174,9 +6174,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366541.1616449 (Exim 4.92) (envelope-from ) id 1wlmQO-0001ny-5u; Mon, 20 Jul 2026 11:44:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366541.1616449; Mon, 20 Jul 2026 11:44:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQO-0001nq-3G; Mon, 20 Jul 2026 11:44:44 +0000 Received: by outflank-mailman (input) for mailman id 1366541; Mon, 20 Jul 2026 11:44:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQM-0001nk-RJ for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQN-00GPMA-0G for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQM-003mpY-2D for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=15IpYy3pw448Uoiy2ea9G6YQAY2q6ISvcJsRUTbsvE0=; b=XntLqw5jpLxxeGYm59j093wZBL dh6Z5WMuZfimBUBG5HUsm3MlBBRJ4Y+pv9kGluSm/SkjgFxsqXtoqH57w/OoQoRLgICBL7n2V+bvK nb3bdmo04YNSy7fe/phyZLWz28ME+mOTOXBA0c75nm0Rou/r5NgrWAlKHewFA9Z1RzZo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 11:44:42 +0000 commit d5ad2233bb43a6bdc84ccb2c9134bece2e2ec94c Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 13:30:52 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:52 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie master commit: bedbc17d8407c456c7fbe126c0df55610559d8c6 master date: 2026-07-20 11:11:37 +0200 --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 9af833b6da..893ebaa13a 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1280,6 +1280,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index b8bc0caaf2..40f4cb049c 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1440,6 +1440,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:44:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:44:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366542.1616452 (Exim 4.92) (envelope-from ) id 1wlmQZ-0001pv-7S; Mon, 20 Jul 2026 11:44:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366542.1616452; Mon, 20 Jul 2026 11:44:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQZ-0001pn-4v; Mon, 20 Jul 2026 11:44:55 +0000 Received: by outflank-mailman (input) for mailman id 1366542; Mon, 20 Jul 2026 11:44:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQX-0001ph-Eh for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQX-00GPMM-2H for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQX-003nNQ-1H for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:44:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rCWqo1oY2r9hYrKww0KB+4jRm/sJYWr8aGReA4oCoFA=; b=VWkvFGBOOuaeK10dsK7FZpnjMe R0D0+NMs3GphmIFGU9OZ60OHCRO2sC3hEzdCFhC6W5d6PiXhED3sTEDKQLGe1PNCAxSnKndmuVmV+ B+Mf7w4TXNnu53ZJw/GWBoOUqkXRXhNJX0xkJk3LeA/azRqLIcQpksC5aHsP9N2gkNwo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/numa: fix setup of non-aligned memory affinity ranges Message-Id: Date: Mon, 20 Jul 2026 11:44:53 +0000 commit 2a6a75fc03d9ae8badd6966758c912660a406685 Author: Roger Pau Monné AuthorDate: Mon Jul 20 13:31:29 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:31:29 2026 +0200 xen/numa: fix setup of non-aligned memory affinity ranges The logic to populate memnodemap in populate_memnodemap() assumes that all ranges are aligned to the hash shift, this however is only true for the first address in a memory affinity node. Any subsequent ranges belonging to the same node might not be aligned to the hash shift value. Such lack of alignment causes issues to the logic in populate_memnodemap(), as then the tail of the range might not be properly accounted for and setup in memnodemap. Fix this by forcing the start address of all regions to be aligned to the hash shift; if such alignment causes a region overlap it would always be between regions on the same node, and hence will never cause setup issues of the memnodemap array. Fixes: 1666086b0044 ("x86/NUMA: improve memnode_shift calculation for multi node system") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: 188d5305297f4e842511d1374c7121ac8a37c169 master date: 2026-06-05 19:13:47 +0200 --- xen/common/numa.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/numa.c b/xen/common/numa.c index ad75955a16..e2c89bf55b 100644 --- a/xen/common/numa.c +++ b/xen/common/numa.c @@ -403,6 +403,12 @@ static int __init populate_memnodemap(const struct node *nodes, if ( (epdx >> shift) >= memnodemapsize ) return 0; + /* + * Round down start address: if start is not aligned to the memnodemap + * chunk size the tail remainder might not be added. Overlaps created + * by rounding will fall into the same NUMA region. + */ + spdx = ROUNDDOWN(spdx, 1UL << shift); do { if ( memnodemap[spdx >> shift] != NUMA_NO_NODE && (!nodeids || memnodemap[spdx >> shift] != nodeids[i]) ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:45:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:45:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366543.1616458 (Exim 4.92) (envelope-from ) id 1wlmQj-0001sN-BT; Mon, 20 Jul 2026 11:45:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366543.1616458; Mon, 20 Jul 2026 11:45:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQj-0001sD-8T; Mon, 20 Jul 2026 11:45:05 +0000 Received: by outflank-mailman (input) for mailman id 1366543; Mon, 20 Jul 2026 11:45:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQh-0001s4-I5 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQh-00GPMq-2b for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQh-003nqe-1a for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ML6mRq8glgAspbSWhIUW6rktVa0VvfhcXyWdeVL2DQQ=; b=go7pSEVlhjMSNVyKiICNtvEdRG H8ZlZQTtJ2QxMfyhjS74xffydrUwliVLWCyYv84U78SWYh7B+OpphKeh4zk/AejunFHcuzkt7UUvZ K7RwNNoKu4tPEBkPtdG9QS90SAKhqjC+fgHK729ho3rzk4LiolnH/+FlqCenF9lKhbC8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Mon, 20 Jul 2026 11:45:03 +0000 commit c87190b87934e984d94f71aa4d531a7eeabd0fec Author: Andrew Cooper AuthorDate: Mon Jul 20 13:31:54 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:31:54 2026 +0200 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie master commit: 7d48ef45b6df0cf8985b84305e02b7440de8f50f master date: 2026-07-10 19:35:49 +0100 --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 7ce97c4726..52a4a76797 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -775,12 +775,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:45:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:45:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366544.1616461 (Exim 4.92) (envelope-from ) id 1wlmQt-0001uU-CZ; Mon, 20 Jul 2026 11:45:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366544.1616461; Mon, 20 Jul 2026 11:45:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQt-0001uM-9s; Mon, 20 Jul 2026 11:45:15 +0000 Received: by outflank-mailman (input) for mailman id 1366544; Mon, 20 Jul 2026 11:45:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmQr-0001uF-KZ for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmQr-00GPP1-2s for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmQr-003oII-1t for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=f2phJ/nRMWea5UWJvRIwcMMtHJLeBC3L5gZo60Pvai4=; b=RPwbnklm/FDk1aTwJYHHHEOkSJ 1oXRXzBFwYpEm2PGhP9BNfLL1LItRiU2nzz/bek1jVodiNfwJbBXkYF6m8SCAsl87DmUlpXoUYj+b hYKrhco3xLFGsV32Zwvxx58MbehcRYVeOVHCPqZOB2rU4pekjjsRea9KYnk7sIdrB9JY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Mon, 20 Jul 2026 11:45:13 +0000 commit 0ef8e9b3715d23d85bbf3e9e0113037ce1d3e377 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:32:11 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:32:11 2026 +0200 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 master date: 2026-07-14 17:31:08 +0100 --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 187f5f6a3e..c8533361e1 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -52,7 +52,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -87,9 +87,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 11:45:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 11:45:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366545.1616465 (Exim 4.92) (envelope-from ) id 1wlmR3-0001wN-Dm; Mon, 20 Jul 2026 11:45:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366545.1616465; Mon, 20 Jul 2026 11:45:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmR3-0001wF-B9; Mon, 20 Jul 2026 11:45:25 +0000 Received: by outflank-mailman (input) for mailman id 1366545; Mon, 20 Jul 2026 11:45:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlmR2-0001w9-0q for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlmR2-00GPQi-0t for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlmR1-003oZX-2x for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 11:45:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=909zwQMVwMysXb9TC+EIR/KAWqt05uViBpmUgECOjL0=; b=k7gN64BYSKDP4gZCtVke54+3UW d9UVlCFiHcJNYDyai7zkDHeO8Xl1T82abL3El2Nybhz3v3ejsRoCFBdNHx2lNRfsZHAkcA5UWPZKA 5J285CSNxPqP0/qnMsrG2LVNfV1WgOSNw3N70z5eYz6vkUZtl0LagD56VmKsTbn94UuY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 11:45:23 +0000 commit bd07ad2a08287006960049a8a6fffac1530e1b20 Author: Jan Beulich AuthorDate: Mon Jul 20 13:32:30 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:32:30 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: cf90c8a48af2694d0653f754996a41672a153de4 master date: 2026-07-20 09:50:00 +0200 --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index afe2e297d9..f194c209ed 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1945,7 +1945,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index eafa4fa85a..1e74dea9a5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6172,9 +6172,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 12:22:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 12:22:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366552.1616468 (Exim 4.92) (envelope-from ) id 1wln0V-0006bt-VJ; Mon, 20 Jul 2026 12:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366552.1616468; Mon, 20 Jul 2026 12:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wln0V-0006bl-SJ; Mon, 20 Jul 2026 12:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1366552; Mon, 20 Jul 2026 12:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wln0T-0006bf-Rw for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 12:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wln0T-00GQL5-2W for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 12:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wln0T-0054DR-1S for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 12:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=knS4T4mYGSu6tLxjB1fnR/uYYSxmizj2dBaoM7++jAw=; b=qWzb/ZbZdYOvB5GFdwzfvcnbpJ I1V5P6mr2a7Sjui1j0ZyZEmdUy8w2KTaBwO5QeleBYjeRFK28OpyI+ynInKj6OYuni0+wi5DoKz6e LKoJa0XYiZjPIgycwRwgxAa8rvy/Tlg+bTKb/WoCrhMZw7fwtcLZi2X9TU2f4tU6y9+c=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 12:22:01 +0000 commit 2a36c6edc9e90d5b0287ba54cd8ad7e611ea055d Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 11:11:37 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 12:31:16 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie Release-acked-by: Oleksii Kurochko --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 1d458f1372..ba7244ccc5 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1255,6 +1255,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 07f712a0a4..3ea4c650ee 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1481,6 +1481,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:00:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:00:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366563.1616482 (Exim 4.92) (envelope-from ) id 1wlnbG-0002Ra-OY; Mon, 20 Jul 2026 13:00:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366563.1616482; Mon, 20 Jul 2026 13:00:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlnbG-0002RB-Lt; Mon, 20 Jul 2026 13:00:02 +0000 Received: by outflank-mailman (input) for mailman id 1366563; Mon, 20 Jul 2026 13:00:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlnbF-0002Fk-N2 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:00:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlnbF-00GRD1-2x for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:00:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlnbF-006NDr-1w for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:00:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HdYRbmWJx5pEy2goGBgBVYf9JcCQu3/FGSYKE4R6oxE=; b=2Hvxr54Ku4k9vq92+4BwmGlAFQ jsJuw31fBteUzOKbSxr4GaoQ4UvldNpwfhIEn4Sw7VZGOjVNyiuJOLpgxbFzbJydpoFOG06WYHCpA 63P1OoUfqNUsV0XnksFVAiMEHZ8k0BuyQM1k8GnsADd2iYgvFSsYiVGLqLETU2hSmrkM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/domctl: Reorder user_regs accesses for efficiency Message-Id: Date: Mon, 20 Jul 2026 13:00:01 +0000 commit 50e7b8a32dcb1360dbe9e0fa8b81a3ad02d0b670 Author: Andrew Cooper AuthorDate: Mon Jul 20 10:12:13 2026 +0100 Commit: Andrew Cooper CommitDate: Mon Jul 20 12:05:36 2026 +0100 x86/domctl: Reorder user_regs accesses for efficiency The current order is derived from expanding XLAT_cpu_user_regs() which used the x86_32 cpu_user_regs order. This is correct for one the blocks, but not the others. In order to work with the prefetcher, rather than against it, loads want to be in field order. Make this so for the three paths reading an x86_64 cpu_user_regs. No functional change. Reported-by: Jan Beulich Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Frediano Ziglio Reviewed-by: Teddy Astie --- xen/arch/x86/domain.c | 6 +++--- xen/arch/x86/domctl.c | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 53a86ba373..996b50af7a 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1259,17 +1259,17 @@ int arch_set_info_guest( v->arch.user_regs.r14 = c.nat->user_regs.r14; v->arch.user_regs.r13 = c.nat->user_regs.r13; v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.rbp = c.nat->user_regs.rbp; + v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.r11 = c.nat->user_regs.r11; v->arch.user_regs.r10 = c.nat->user_regs.r10; v->arch.user_regs.r9 = c.nat->user_regs.r9; v->arch.user_regs.r8 = c.nat->user_regs.r8; - v->arch.user_regs.rbx = c.nat->user_regs.rbx; + v->arch.user_regs.rax = c.nat->user_regs.rax; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; v->arch.user_regs.rsi = c.nat->user_regs.rsi; v->arch.user_regs.rdi = c.nat->user_regs.rdi; - v->arch.user_regs.rbp = c.nat->user_regs.rbp; - v->arch.user_regs.rax = c.nat->user_regs.rax; v->arch.user_regs.rip = c.nat->user_regs.rip; v->arch.user_regs.cs = c.nat->user_regs.cs; v->arch.user_regs.rflags = (c.nat->user_regs.rflags & X86_EFLAGS_ALL) | X86_EFLAGS_MBS; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 3ea4c650ee..2ecd81d89b 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1485,17 +1485,17 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) c.nat->user_regs.r14 = v->arch.user_regs.r14; c.nat->user_regs.r13 = v->arch.user_regs.r13; c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.rbp = v->arch.user_regs.rbp; + c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.r11 = v->arch.user_regs.r11; c.nat->user_regs.r10 = v->arch.user_regs.r10; c.nat->user_regs.r9 = v->arch.user_regs.r9; c.nat->user_regs.r8 = v->arch.user_regs.r8; - c.nat->user_regs.rbx = v->arch.user_regs.rbx; + c.nat->user_regs.rax = v->arch.user_regs.rax; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; c.nat->user_regs.rsi = v->arch.user_regs.rsi; c.nat->user_regs.rdi = v->arch.user_regs.rdi; - c.nat->user_regs.rbp = v->arch.user_regs.rbp; - c.nat->user_regs.rax = v->arch.user_regs.rax; c.nat->user_regs.rip = v->arch.user_regs.rip; c.nat->user_regs.cs = v->arch.user_regs.cs; c.nat->user_regs.rflags = v->arch.user_regs.rflags; @@ -1514,13 +1514,13 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) else { /* Backing memory is pre-zeroed. */ + c.cmp->user_regs.ebp = v->arch.user_regs.ebp; c.cmp->user_regs.ebx = v->arch.user_regs.ebx; + c.cmp->user_regs.eax = v->arch.user_regs.eax; c.cmp->user_regs.ecx = v->arch.user_regs.ecx; c.cmp->user_regs.edx = v->arch.user_regs.edx; c.cmp->user_regs.esi = v->arch.user_regs.esi; c.cmp->user_regs.edi = v->arch.user_regs.edi; - c.cmp->user_regs.ebp = v->arch.user_regs.ebp; - c.cmp->user_regs.eax = v->arch.user_regs.eax; c.cmp->user_regs.eip = v->arch.user_regs.eip; c.cmp->user_regs.cs = v->arch.user_regs.cs; c.cmp->user_regs.eflags = v->arch.user_regs.eflags; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:33:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:33:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366567.1616486 (Exim 4.92) (envelope-from ) id 1wlo7C-0006iJ-Su; Mon, 20 Jul 2026 13:33:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366567.1616486; Mon, 20 Jul 2026 13:33:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7C-0006iB-QH; Mon, 20 Jul 2026 13:33:02 +0000 Received: by outflank-mailman (input) for mailman id 1366567; Mon, 20 Jul 2026 13:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7C-0006i5-6j for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlo7C-00GS0m-1P for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlo7C-007cSl-0O for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=DAlqTF9iniGdGBo5dixNjCKoEoxhcBLaSsTt4vCmvdo=; b=PlairyZgkSdJlQhr2xFrbwybEw 21kirDadeCVnNHAZBTcbVQZqeP9VmLPn8D24IkYR9gDcxS/K6hg07Kv+R+jM2TdTS/jaUhaI0XNXe UcKElBXxrbThz41znkvMp+/FShLPXqD+tJ1gB6IsbdFf4rYtERDdzYFqAKyqtHJT3hw8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/numa: fix setup of non-aligned memory affinity ranges Message-Id: Date: Mon, 20 Jul 2026 13:33:02 +0000 commit 94fa7e1626fd755a4cf70904ca463ed068eea6f1 Author: Roger Pau Monné AuthorDate: Mon Jul 20 13:29:16 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:29:16 2026 +0200 xen/numa: fix setup of non-aligned memory affinity ranges The logic to populate memnodemap in populate_memnodemap() assumes that all ranges are aligned to the hash shift, this however is only true for the first address in a memory affinity node. Any subsequent ranges belonging to the same node might not be aligned to the hash shift value. Such lack of alignment causes issues to the logic in populate_memnodemap(), as then the tail of the range might not be properly accounted for and setup in memnodemap. Fix this by forcing the start address of all regions to be aligned to the hash shift; if such alignment causes a region overlap it would always be between regions on the same node, and hence will never cause setup issues of the memnodemap array. Fixes: 1666086b0044 ("x86/NUMA: improve memnode_shift calculation for multi node system") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: 188d5305297f4e842511d1374c7121ac8a37c169 master date: 2026-06-05 19:13:47 +0200 --- xen/common/numa.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/numa.c b/xen/common/numa.c index ad75955a16..e2c89bf55b 100644 --- a/xen/common/numa.c +++ b/xen/common/numa.c @@ -403,6 +403,12 @@ static int __init populate_memnodemap(const struct node *nodes, if ( (epdx >> shift) >= memnodemapsize ) return 0; + /* + * Round down start address: if start is not aligned to the memnodemap + * chunk size the tail remainder might not be added. Overlaps created + * by rounding will fall into the same NUMA region. + */ + spdx = ROUNDDOWN(spdx, 1UL << shift); do { if ( memnodemap[spdx >> shift] != NUMA_NO_NODE && (!nodeids || memnodemap[spdx >> shift] != nodeids[i]) ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366568.1616490 (Exim 4.92) (envelope-from ) id 1wlo7N-0006k9-U7; Mon, 20 Jul 2026 13:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366568.1616490; Mon, 20 Jul 2026 13:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7N-0006k1-Re; Mon, 20 Jul 2026 13:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1366568; Mon, 20 Jul 2026 13:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7M-0006jr-Ie for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlo7M-00GS1C-2f for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlo7M-007dAJ-1P for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=pUnuxAURfkPOGZdrLr3BBFdlzfQKKcFgtDXZzw07TTo=; b=qWzXkCJPr7UwrqslUzo1l5yBNM R+38W3omMK9hDKGfTvjf+aT4DCQDP/xSSZZzAV7Tf2fi6DSvJmwTMuVl1GSeJQwPjBV7lFDBQmBHx UvVV4GgU6xiYo/qMR08rYEjdi3BB6/wwJQ5IdmF0bloONzNW+HKApxOhrupVw34IFafU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Mon, 20 Jul 2026 13:33:12 +0000 commit 5dd8f03f8fb4d26ea84ae12edb347d49c0f82098 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:29:39 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:29:39 2026 +0200 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie master commit: 7d48ef45b6df0cf8985b84305e02b7440de8f50f master date: 2026-07-10 19:35:49 +0100 --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 7ce97c4726..52a4a76797 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -775,12 +775,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:33:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:33:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366569.1616494 (Exim 4.92) (envelope-from ) id 1wlo7X-0006mR-Vk; Mon, 20 Jul 2026 13:33:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366569.1616494; Mon, 20 Jul 2026 13:33:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7X-0006mH-T1; Mon, 20 Jul 2026 13:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1366569; Mon, 20 Jul 2026 13:33:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7X-0006mA-0l for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlo7X-00GS1K-0p for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlo7W-007dh3-2m for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JSbj6ttObpMwujOFPBJ5ywEgMsP5xkY3yX7kqH0Ecls=; b=x76JFesMGwC63EgU38JpkPO7bI Ti8CrOi7i6eB+OQeIyU/v3uFacigLBKxvwyOdWQkIpKd72bfwO1ZuZetSCH8pSjAQ9XXwX32LMHe5 g/EZVhMvCcfye4oDCb3WEgR+6fbghlQxs2sL9wt1Kt23EanZOm8C+vxBrSDM7cHM4oqk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Mon, 20 Jul 2026 13:33:22 +0000 commit 16b79fbf28ad721a42f7e97970ef78c4121dc0a9 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:30:07 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:07 2026 +0200 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 master date: 2026-07-14 17:31:08 +0100 --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 187f5f6a3e..c8533361e1 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -52,7 +52,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -87,9 +87,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:33:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:33:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366570.1616498 (Exim 4.92) (envelope-from ) id 1wlo7i-0006oL-0z; Mon, 20 Jul 2026 13:33:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366570.1616498; Mon, 20 Jul 2026 13:33:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7h-0006oE-UN; Mon, 20 Jul 2026 13:33:33 +0000 Received: by outflank-mailman (input) for mailman id 1366570; Mon, 20 Jul 2026 13:33:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7h-0006o8-5x for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlo7h-00GS1O-1O for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlo7h-007dxT-0N for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xTo/0dGlO4yyORElB75B2DVTQIUo6+Ctw6NPL+lFrfU=; b=F0fUNrVLijCnOAvdd/4hqFEMnX BRRYlq5MMhuy34iLXL6xw9gpwiu8djgkXrU5oo5f0o7VIs2orphPa3mu1ep1GVj2p+tJosron1U4b uL+hbRr5EHtXLx1nSJ/m5ExlmnixnWG+Cgzl9i2ifnnLj5CxB7OIVh0XvUhbT5uSorT8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 13:33:33 +0000 commit 7c27efebfc8cf2d0bbb19cd35edc82881c5240c2 Author: Jan Beulich AuthorDate: Mon Jul 20 13:30:29 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:29 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: cf90c8a48af2694d0653f754996a41672a153de4 master date: 2026-07-20 09:50:00 +0200 --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index afe2e297d9..f194c209ed 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1945,7 +1945,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 2aedd4d155..c9cf30b443 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6174,9 +6174,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 13:33:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 13:33:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366571.1616502 (Exim 4.92) (envelope-from ) id 1wlo7s-0006qL-2O; Mon, 20 Jul 2026 13:33:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366571.1616502; Mon, 20 Jul 2026 13:33:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7r-0006qD-W3; Mon, 20 Jul 2026 13:33:43 +0000 Received: by outflank-mailman (input) for mailman id 1366571; Mon, 20 Jul 2026 13:33:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlo7r-0006q7-9n for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlo7r-00GS1W-1m for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlo7r-007e7P-0m for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 13:33:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dvxDutA4GfILuBROWy1gpC5gjB9+Y0nVDxtb5HY+CrY=; b=1926pTl25o4USfAaFVeAy8YFnx DmZxfY/+JfnVbx+78riWFJ5+H2mGopkpZ8qUf8xQdPVL1XZ8Uf8JNjqd136Unyb/n0E/BITnx5ORB +B3XGdOnFmrWoenkbiyfQlUzuDgveXZsIYZVzxAkC2pOtf2f3fg9r3nUGnJAnj0irUak=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/domctl: restore all registers in arch_{get,set}_info_guest() Message-Id: Date: Mon, 20 Jul 2026 13:33:43 +0000 commit d5ad2233bb43a6bdc84ccb2c9134bece2e2ec94c Author: Marek Marczykowski-Górecki AuthorDate: Mon Jul 20 13:30:52 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:30:52 2026 +0200 x86/domctl: restore all registers in arch_{get,set}_info_guest() Commit 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") converted memcpy() of the cpu_user_regs structure to explicit copy of its fields. In the compat case, it intentionally missed few of them, named in the commit message. But the 64bit case missed also r8-r15 registers, which was not intentional. This, at least, caused Linux 6.18.x crash when resuming PVH domU. Fix it by adding missing assignments. Fixes: 9f892f84c279 ("x86/domctl: Stop using XLAT_cpu_user_regs()") Signed-off-by: Marek Marczykowski-Górecki Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Teddy Astie master commit: bedbc17d8407c456c7fbe126c0df55610559d8c6 master date: 2026-07-20 11:11:37 +0200 --- xen/arch/x86/domain.c | 8 ++++++++ xen/arch/x86/domctl.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 9af833b6da..893ebaa13a 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1280,6 +1280,14 @@ int arch_set_info_guest( if ( !compat ) { + v->arch.user_regs.r15 = c.nat->user_regs.r15; + v->arch.user_regs.r14 = c.nat->user_regs.r14; + v->arch.user_regs.r13 = c.nat->user_regs.r13; + v->arch.user_regs.r12 = c.nat->user_regs.r12; + v->arch.user_regs.r11 = c.nat->user_regs.r11; + v->arch.user_regs.r10 = c.nat->user_regs.r10; + v->arch.user_regs.r9 = c.nat->user_regs.r9; + v->arch.user_regs.r8 = c.nat->user_regs.r8; v->arch.user_regs.rbx = c.nat->user_regs.rbx; v->arch.user_regs.rcx = c.nat->user_regs.rcx; v->arch.user_regs.rdx = c.nat->user_regs.rdx; diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index b8bc0caaf2..40f4cb049c 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1440,6 +1440,14 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c) if ( !compat ) { /* Backing memory is pre-zeroed. */ + c.nat->user_regs.r15 = v->arch.user_regs.r15; + c.nat->user_regs.r14 = v->arch.user_regs.r14; + c.nat->user_regs.r13 = v->arch.user_regs.r13; + c.nat->user_regs.r12 = v->arch.user_regs.r12; + c.nat->user_regs.r11 = v->arch.user_regs.r11; + c.nat->user_regs.r10 = v->arch.user_regs.r10; + c.nat->user_regs.r9 = v->arch.user_regs.r9; + c.nat->user_regs.r8 = v->arch.user_regs.r8; c.nat->user_regs.rbx = v->arch.user_regs.rbx; c.nat->user_regs.rcx = v->arch.user_regs.rcx; c.nat->user_regs.rdx = v->arch.user_regs.rdx; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 14:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 14:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366625.1616561 (Exim 4.92) (envelope-from ) id 1wlose-0007P0-LW; Mon, 20 Jul 2026 14:22:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366625.1616561; Mon, 20 Jul 2026 14:22:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlose-0007Os-IW; Mon, 20 Jul 2026 14:22:04 +0000 Received: by outflank-mailman (input) for mailman id 1366625; Mon, 20 Jul 2026 14:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlosc-0007Ok-Q0 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlosd-00GTEU-03 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlosc-009NG0-2A for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KeuLKSxbdjFPRNxMMGjy2Lmtm/r0G2mi+1iX8CaPhUI=; b=fD6EVo6JA+1wvhCU9HGFxjMjma iVm84SYiJbSOeaMdeg/EJBKHOUq5Ojc3Fdd0IZvc+o70CJKHy2cLwYxeLLiLuxIjoQcNXzdi3b0Dt 5Ulu2ayvz7gvAP0e5CLpWrQr7CscFppGTE80+9Br1w4FHk4ez2VtwozcnYxtcNRhOjE8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/numa: fix setup of non-aligned memory affinity ranges Message-Id: Date: Mon, 20 Jul 2026 14:22:02 +0000 commit 2a6a75fc03d9ae8badd6966758c912660a406685 Author: Roger Pau Monné AuthorDate: Mon Jul 20 13:31:29 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:31:29 2026 +0200 xen/numa: fix setup of non-aligned memory affinity ranges The logic to populate memnodemap in populate_memnodemap() assumes that all ranges are aligned to the hash shift, this however is only true for the first address in a memory affinity node. Any subsequent ranges belonging to the same node might not be aligned to the hash shift value. Such lack of alignment causes issues to the logic in populate_memnodemap(), as then the tail of the range might not be properly accounted for and setup in memnodemap. Fix this by forcing the start address of all regions to be aligned to the hash shift; if such alignment causes a region overlap it would always be between regions on the same node, and hence will never cause setup issues of the memnodemap array. Fixes: 1666086b0044 ("x86/NUMA: improve memnode_shift calculation for multi node system") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: 188d5305297f4e842511d1374c7121ac8a37c169 master date: 2026-06-05 19:13:47 +0200 --- xen/common/numa.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/numa.c b/xen/common/numa.c index ad75955a16..e2c89bf55b 100644 --- a/xen/common/numa.c +++ b/xen/common/numa.c @@ -403,6 +403,12 @@ static int __init populate_memnodemap(const struct node *nodes, if ( (epdx >> shift) >= memnodemapsize ) return 0; + /* + * Round down start address: if start is not aligned to the memnodemap + * chunk size the tail remainder might not be added. Overlaps created + * by rounding will fall into the same NUMA region. + */ + spdx = ROUNDDOWN(spdx, 1UL << shift); do { if ( memnodemap[spdx >> shift] != NUMA_NO_NODE && (!nodeids || memnodemap[spdx >> shift] != nodeids[i]) ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 14:22:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 14:22:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366626.1616563 (Exim 4.92) (envelope-from ) id 1wloso-0007RG-MR; Mon, 20 Jul 2026 14:22:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366626.1616563; Mon, 20 Jul 2026 14:22:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wloso-0007R8-Jx; Mon, 20 Jul 2026 14:22:14 +0000 Received: by outflank-mailman (input) for mailman id 1366626; Mon, 20 Jul 2026 14:22:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlosm-0007R2-Vo for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlosn-00GTEo-0k for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlosm-009Nfm-2w for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+mcV8D2F8s9h/kyH6OhjJFNiW6JiMBM4/hViu3apbmM=; b=wW6f6pfuUK0ieLMQupRbQewHMq gsPcO2QjLJvjS8n93gs5TWoJUBVgrqIejL06XmdjChhOD/badA8mwj/s6clouDHUgQ3tH7qRlbLkS oYOb/Lh5T475NYiUaZzZPjhHYcFO4p/Ps/uGmNHRCawB+hkGpLBDbHOgOXKVQaI8V4mY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86/emul: Adjust handling of CR8_LEGACY Message-Id: Date: Mon, 20 Jul 2026 14:22:12 +0000 commit c87190b87934e984d94f71aa4d531a7eeabd0fec Author: Andrew Cooper AuthorDate: Mon Jul 20 13:31:54 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:31:54 2026 +0200 x86/emul: Adjust handling of CR8_LEGACY The APM description of the AltMovCR8 feature bit is: "LOCK MOV CR0 means MOV CR8" Adjust the decode logic to behave like this. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Teddy Astie master commit: 7d48ef45b6df0cf8985b84305e02b7440de8f50f master date: 2026-07-10 19:35:49 +0100 --- xen/arch/x86/x86_emulate/decode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 7ce97c4726..52a4a76797 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -775,12 +775,12 @@ decode_twobyte(struct x86_emulate_state *s, break; case 0x20: case 0x22: /* mov to/from cr */ - if ( s->lock_prefix && vcpu_has_cr8_legacy() ) + if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 ) { - s->modrm_reg += 8; + s->modrm_reg = 8; s->lock_prefix = false; } - /* fall through */ + fallthrough; case 0x21: case 0x23: /* mov to/from dr */ ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */ generate_exception_if(s->lock_prefix, X86_EXC_UD); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 14:22:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 14:22:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366627.1616567 (Exim 4.92) (envelope-from ) id 1wlosy-0007TC-Nf; Mon, 20 Jul 2026 14:22:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366627.1616567; Mon, 20 Jul 2026 14:22:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlosy-0007T4-LD; Mon, 20 Jul 2026 14:22:24 +0000 Received: by outflank-mailman (input) for mailman id 1366627; Mon, 20 Jul 2026 14:22:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlosx-0007Sx-2q for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlosx-00GTEu-14 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlosx-009OEl-03 for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=H2BAkw0pD8FdqB0VBu5vjefUPw8j7buaJUWuPZ+KSrg=; b=F1d4pMneIl7bzYo75b3DdpnddA iWWyJI1DzkbV3c9ww9PiE4h0E+lia622FFwMOAGXcu3gfxtxa71LSMCcxNiLVbtgGJxuRPplSh/Cp N1iDrHmEbjnlazeqs/cUFuMx6mFp0FrmJGkKaWw8eqVI8gnyXdLQ/M2KNcgdV11LAW5c=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() Message-Id: Date: Mon, 20 Jul 2026 14:22:23 +0000 commit 0ef8e9b3715d23d85bbf3e9e0113037ce1d3e377 Author: Andrew Cooper AuthorDate: Mon Jul 20 13:32:11 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:32:11 2026 +0200 x86/pv: Only use the guest frame in pv_map_ldt_shadow_page() pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, then installs it into Xen's pagetables. It has had this behaviour ever since LDT support was added in 2003. However, it allows the guest to control the software available bits and cacheability. This happens to be benign right now, but is bad form. Use only the guest frame, and construct the mapping as regular RW frame, and notably includes NX. This is how the GDT logic already works. Fixes: 005c2723972f ("Finished virtualisation of x86 LDT") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58 master date: 2026-07-14 17:31:08 +0100 --- xen/arch/x86/pv/mm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c index 187f5f6a3e..c8533361e1 100644 --- a/xen/arch/x86/pv/mm.c +++ b/xen/arch/x86/pv/mm.c @@ -52,7 +52,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset) struct vcpu *curr = current; struct domain *currd = curr->domain; struct page_info *page; - l1_pgentry_t gl1e, *pl1e; + l1_pgentry_t gl1e, *pl1e, nl1e; unsigned long linear = curr->arch.pv.ldt_base + offset; BUG_ON(in_irq()); @@ -87,9 +87,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset) } pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT]; - l1e_add_flags(gl1e, _PAGE_RW); + nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW); - l1e_write(pl1e, gl1e); + l1e_write(pl1e, nl1e); return true; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Mon Jul 20 14:22:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 20 Jul 2026 14:22:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1366629.1616581 (Exim 4.92) (envelope-from ) id 1wlot9-0007kH-3D; Mon, 20 Jul 2026 14:22:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1366629.1616581; Mon, 20 Jul 2026 14:22:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlot9-0007k7-0I; Mon, 20 Jul 2026 14:22:35 +0000 Received: by outflank-mailman (input) for mailman id 1366629; Mon, 20 Jul 2026 14:22:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlot7-0007jU-HB for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wlot7-00GTF5-2W for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wlot7-009Og3-1A for xen-changelog@lists.xenproject.org; Mon, 20 Jul 2026 14:22:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=awfzuCGspKXgVarUc9zspUOqHh5ySML8myxElaoZF7M=; b=XXqcgN60//yjbnbAcYAOCfqwNc plqfrWnDa7/Ta51uK3XLZB5nby2HIHC5GgDXt/6LyD4J7r+r4bfKt1E+HKNo2wC3p672Ctl9QMiqL 4Gu3OGn86qqCLLkF4TG2dWH+vtJvrkMssNu0qeSVbXbreqxNbXsdG8tIY544kpBYCTy8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion Message-Id: Date: Mon, 20 Jul 2026 14:22:33 +0000 commit bd07ad2a08287006960049a8a6fffac1530e1b20 Author: Jan Beulich AuthorDate: Mon Jul 20 13:32:30 2026 +0200 Commit: Jan Beulich CommitDate: Mon Jul 20 13:32:30 2026 +0200 x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: cf90c8a48af2694d0653f754996a41672a153de4 master date: 2026-07-20 09:50:00 +0200 --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index afe2e297d9..f194c209ed 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1945,7 +1945,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index eafa4fa85a..1e74dea9a5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6172,9 +6172,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:22:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:22:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367661.1617383 (Exim 4.92) (envelope-from ) id 1wm6fr-0005Yh-QZ; Tue, 21 Jul 2026 09:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367661.1617383; Tue, 21 Jul 2026 09:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6fr-0005YZ-Nn; Tue, 21 Jul 2026 09:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1367661; Tue, 21 Jul 2026 09:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6fp-0005YT-W3 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm6fq-000aBf-0g for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm6fp-00ErAW-2r for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Mrvo71fbGDDQTZLLSdNfcwl5Wto3TmjKAxtjW/J251Q=; b=o84SWLYkaORbNRNj3bQzUd8aPm ivhvGffaf+CMC91XCDFmSzMeEsQjVBjAiDrCun/ouS3nrFxrvnRquRdKSU/tdy62jKZmOBrydgp9/ RuSwcMA/udWaU/7LLMZ2IlS22cUlmG7CA1D8DsnStD2CcjRlB4hHedLlPEcvgXxe0eCg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: drop dead conditional from decode Message-Id: Date: Tue, 21 Jul 2026 09:22:01 +0000 commit 42c0972e9b47a456e050a8c18845438c1363ef7c Author: Jan Beulich AuthorDate: Tue Jul 21 09:46:01 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:46:01 2026 +0200 x86emul: drop dead conditional from decode We know that opcode_table[0x0f] is 0, there's no need to check that. Up until ab082ffa87d5 ("x86emul: generate and make use of a canonical opcode representation") or maybe already c4e7a67e3a10 ("x86emul: drop SrcInvalid") this may have been justified, but it no longer is. This eliminates a Misra C:2012 rule 2.2 ("There shall be no dead code") violation. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/x86_emulate/decode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 57f6baffb0..d1665e6eb3 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -1082,7 +1082,7 @@ int x86emul_decode(struct x86_emulate_state *s, /* Opcode byte(s). */ d = opcode_table[b]; - if ( d == 0 && b == 0x0f ) + if ( b == 0x0f ) { /* Two-byte opcode. */ b = insn_fetch_type(uint8_t); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367662.1617387 (Exim 4.92) (envelope-from ) id 1wm6g1-0005ba-S6; Tue, 21 Jul 2026 09:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367662.1617387; Tue, 21 Jul 2026 09:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6g1-0005bS-PC; Tue, 21 Jul 2026 09:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1367662; Tue, 21 Jul 2026 09:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6g0-0005bK-F4 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm6g0-000aBl-2I for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm6g0-00ErUI-0e for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=e4EE0L/vtfvsvb2qvaiUIXujnznHcIMngEJj2L/OL40=; b=SYtb2yWKwqOeqvfGvK4I1N1IGZ zFdsctEF5o6n34u4+ucUSSsjs126/orcokziUBVyXK7RKo6YrkBtO1lFM6uLRvvweBzrb7/gJMa2W sC8fJ2PKxGoFXrN3vj2Q1KhJ3NTtI3UqpAyGTs9gD7i4crVLSDdNoffcUrq0hVWcwQrw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/serial: drop stale SERIAL_NEVER_DROP_CHARS Message-Id: Date: Tue, 21 Jul 2026 09:22:12 +0000 commit e2c8e9e62df31fb4bd51ba049de5959ba72fa444 Author: Denis Mukhin AuthorDate: Tue Jul 21 09:46:40 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:46:40 2026 +0200 xen/serial: drop stale SERIAL_NEVER_DROP_CHARS Left over from 275485700163 ("Bring back console_start_log_everything() as a milder alternative to"), which dropped the sole use only a few weeks after its introduction. Signed-off-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/serial.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/xen/drivers/char/serial.c b/xen/drivers/char/serial.c index bbbe758788..e3c3564089 100644 --- a/xen/drivers/char/serial.c +++ b/xen/drivers/char/serial.c @@ -15,9 +15,6 @@ #include -/* Never drop characters, even if the async transmit buffer fills. */ -/* #define SERIAL_NEVER_DROP_CHARS 1 */ - unsigned int __ro_after_init serial_txbufsz = CONFIG_SERIAL_TX_BUFSIZE; size_param("serial_tx_buffer", serial_txbufsz); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367663.1617393 (Exim 4.92) (envelope-from ) id 1wm6gB-0005f3-To; Tue, 21 Jul 2026 09:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367663.1617393; Tue, 21 Jul 2026 09:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gB-0005ev-Qa; Tue, 21 Jul 2026 09:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1367663; Tue, 21 Jul 2026 09:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gA-0005ep-L5 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm6gA-000aBq-2t for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm6gA-00Es4v-1s for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LwbEgX6FDHsYMwMVRw13N8L+slK/oQjFYviQQh/Be0w=; b=hhkm/wBN6fXTzc9PuOLpPxkO5T 3RYT+W7GosatbOJbuAbZVwJtN49KhlSMeS2FtIyVr2p6dO6biF/cqIKhP92C1CiTOSFfn80j1WkiU DbQFrW8FqAbkDo0W1qJ9GG5kWEY53gQB6h8kb1cICdNe18oV6JTOrqizHh4rxKmjqTlU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/sched: rt: fix NULL cpupool dereference in move_repl_timer() Message-Id: Date: Tue, 21 Jul 2026 09:22:22 +0000 commit f294e3abe40cda37618d9fbad8cde86bbae0d1c6 Author: Oleksii Moisieiev AuthorDate: Tue Jul 21 09:47:36 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:47:36 2026 +0200 xen/sched: rt: fix NULL cpupool dereference in move_repl_timer() schedule_cpu_rm() clears the cpupool pointer of the scheduling resource before calling sched_deinit_pdata(): sr->cpupool = NULL; ... sched_deinit_pdata(data->old_ops, data->ppriv_old, cpu); For RTDS, rt_deinit_pdata() calls move_repl_timer() when the replenishment timer lives on the cpu being removed, and move_repl_timer() dereferences get_sched_res(old_cpu)->cpupool without checking it for NULL. Removing a pCPU owning the timer from an RTDS cpupool therefore dereferences NULL + 0x10 (the res_valid member) and panics: (XEN) Data Abort Trap. Syndrome=0x1c28005 (XEN) Walking Hypervisor VA 0x10 on CPU0 via TTBR ... (XEN) Xen call trace: (XEN) [<...>] find_next_bit+0x74/0xa8 (PC) (XEN) [<...>] rt.c#move_repl_timer+0xb8/0xec (LR) (XEN) (XEN) Panic on CPU 0: (XEN) CPU0: Unexpected Trap: Data Abort Reproducer, on any host with at least 2 pCPUs and RTDS compiled in (observed on arm64, but the path is common code): xl cpupool-create name="test" sched="rtds" xl cpupool-cpu-remove Pool-0 1 xl cpupool-cpu-add test 1 xl cpupool-cpu-remove test 1 The last command moves the RTDS replenishment timer to cpu1 (first and only cpu of the pool) and then removes cpu1, hitting the NULL dereference in the sched_deinit_pdata() callback. Use the cpupool back-pointer of the scheduler instead of the one of the scheduling resource. It is set by cpupool_create() before any pCPU can be assigned to the pool and stays valid for the whole lifetime of the scheduler, so it is still available when rt_deinit_pdata() runs. Other schedulers already rely on it the same way, e.g. credit2 in cpu_add_to_runqueue(). Fixes: b6f5334aeaca ("sched: fix cpu offlining with core scheduling") Signed-off-by: Oleksii Moisieiev Reviewed-by: Juergen Gross --- xen/common/sched/rt.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c index 75d65e28ad..744f214173 100644 --- a/xen/common/sched/rt.c +++ b/xen/common/sched/rt.c @@ -762,10 +762,16 @@ rt_switch_sched(struct scheduler *new_ops, unsigned int cpu, return &prv->lock; } -static void move_repl_timer(struct rt_private *prv, unsigned int old_cpu) +static void move_repl_timer(const struct scheduler *ops, unsigned int old_cpu) { - cpumask_t *online = get_sched_res(old_cpu)->cpupool->res_valid; - unsigned int new_cpu = cpumask_cycle(old_cpu, online); + struct rt_private *prv = rt_priv(ops); + /* + * Use the cpupool of the scheduler: the one of the scheduling resource + * is already cleared when this is called from rt_deinit_pdata(). + */ + const struct cpupool *c = ops->cpupool; + unsigned int new_cpu = c ? cpumask_cycle(old_cpu, c->res_valid) + : nr_cpu_ids; /* * Make sure the timer run on one of the cpus that are still available @@ -792,7 +798,7 @@ rt_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) spin_lock_irqsave(&prv->lock, flags); if ( prv->repl_timer.cpu == cpu ) - move_repl_timer(prv, cpu); + move_repl_timer(ops, cpu); spin_unlock_irqrestore(&prv->lock, flags); } @@ -810,7 +816,7 @@ rt_move_timers(const struct scheduler *ops, struct sched_resource *sr) if ( prv->repl_timer.status != TIMER_STATUS_invalid && prv->repl_timer.status != TIMER_STATUS_killed && !cpumask_test_cpu(old_cpu, sr->cpupool->res_valid) ) - move_repl_timer(prv, old_cpu); + move_repl_timer(ops, old_cpu); spin_unlock_irqrestore(&prv->lock, flags); } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367664.1617394 (Exim 4.92) (envelope-from ) id 1wm6gL-0005gy-Um; Tue, 21 Jul 2026 09:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367664.1617394; Tue, 21 Jul 2026 09:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gL-0005gq-Rz; Tue, 21 Jul 2026 09:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1367664; Tue, 21 Jul 2026 09:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gK-0005gj-O8 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm6gK-000aCE-3D for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm6gK-00EsQJ-2D for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=h3d8j4FMjoqI3UfV5trMEIaTmmk21V1uXxMS1/aKNck=; b=qro0YSnrSN6WbCQ1Up4sbjQnZU FchrFP1aMyVkRocAGJDmWH2RAluSjTU2JP8iFrSzttkBUnAxPK7g3A3sgTWxCn4qNcnYUpuO2GkWh lZ/xo/MjmHEfANed5bmmhvjE1AdCgTwCDoNCfrRQ35GNQzyMzdC7woPbxMrsrK7LyALk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: prune an excess EVEX.Z check Message-Id: Date: Tue, 21 Jul 2026 09:22:32 +0000 commit 66a9aa12e70a1479d5b7f202539093adb94e7b31 Author: Jan Beulich AuthorDate: Tue Jul 21 09:48:04 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:48:04 2026 +0200 x86emul: prune an excess EVEX.Z check DstMem processing early in x86_emulate() raises #UD when EVEX.Z is set with a memory destination. Open-coded checks like this one are therefore dead / unreachable code, violating Misra rules. Fixes: 4037a62ef93e ("x86emul: support AVX512F floating-point conversion insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/x86_emulate/x86_emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 38e5c349f5..a4ba22ffb5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -7350,7 +7350,7 @@ x86_emulate( if ( evex_encoded() ) { generate_exception_if((evex.w || evex.reg != 0xf || !evex.RX || - (ea.type != OP_REG && (evex.z || evex.brs))), + (ea.type != OP_REG && evex.brs)), X86_EXC_UD); host_and_vcpu_must_have(avx512f); avx512_vlen_check(false); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:22:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:22:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367665.1617399 (Exim 4.92) (envelope-from ) id 1wm6gW-0005kv-29; Tue, 21 Jul 2026 09:22:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367665.1617399; Tue, 21 Jul 2026 09:22:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gV-0005kl-VI; Tue, 21 Jul 2026 09:22:43 +0000 Received: by outflank-mailman (input) for mailman id 1367665; Tue, 21 Jul 2026 09:22:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm6gU-0005kf-Rl for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm6gV-000aCI-0G for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm6gU-00Esec-2T for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:22:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+QLbNuUx1k89n7kprvsdcPS75z89nc0QOYyEyON3Ljk=; b=iAu5au0u2CPvZOBT24PqyEPfQ8 jSRyifKwZ0wNnDg8sRRoah4R+wDQx3zN8XrXCOIKZU2GI4j9a/v0jjJC6oMPmFfD0rSS5BFZV9Tmk Kk9F8OSrcAuOX8iqC1bUBUSiJt80sgYYCErQW2XnYanblhlugGArF2EAHMcaZcPDC+cQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/riscv: do a 4th linking pass if necessary Message-Id: Date: Tue, 21 Jul 2026 09:22:42 +0000 commit 1bca40c1896235e3bdda79746887a957aefd2b55 Author: Oleksii Kurochko AuthorDate: Tue Jul 21 09:48:37 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:48:37 2026 +0200 xen/riscv: do a 4th linking pass if necessary Embedding the symbol table can shift sections and flip relaxation decisions, changing code size and thus the set of emitted tools/symbols (e.g. gap end markers). Re-link with a regenerated table when its size differs from the previous pass. This takes the same remedy as commit 35de7285d508 ("Arm: do a 4th linking pass if necessary"), though the underlying cause differs: here no symbol (dis)appears from the ELF symbol table; instead the set of end markers emitted by tools/symbols legitimately changes, because want_symbol_end() depends on code layout, and layout differs between passes due to linker relaxation. Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/Makefile | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile index 8f7fd625dd..4c7d4e5af5 100644 --- a/xen/arch/riscv/Makefile +++ b/xen/arch/riscv/Makefile @@ -46,9 +46,21 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds | $(objtree)/tools/symbols $(all_symbols) --sysv --sort \ > $(dot-target).2.S $(MAKE) $(build)=$(@D) $(dot-target).2.o - $(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o) + if ! { $(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o) >/dev/null; }; \ + then \ + set -e; \ + $(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \ + $(dot-target).2.o -o $(dot-target).2; \ + $(NM) -pa --format=sysv $(dot-target).2 \ + | $(objtree)/tools/symbols $(all_symbols) --sysv --sort \ + > $(dot-target).3.S; \ + $(MAKE) $(build)=$(@D) $(dot-target).3.o; \ + $(call compare-symbol-tables, $(dot-target).2.o, $(dot-target).3.o); \ + else \ + ln -sf $(dot-target).2.o $(dot-target).3.o; \ + fi $(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \ - $(dot-target).2.o -o $@ + $(dot-target).3.o -o $@ $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 09:55:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 09:55:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367700.1617412 (Exim 4.92) (envelope-from ) id 1wm7Bn-0003n0-EK; Tue, 21 Jul 2026 09:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367700.1617412; Tue, 21 Jul 2026 09:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Bn-0003ms-Bh; Tue, 21 Jul 2026 09:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1367700; Tue, 21 Jul 2026 09:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Bm-0003mm-A6 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7Bm-000asc-1f for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7Bm-00G04y-0d for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 09:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JVAa4cbUSNg9rpF9YJ+rEHPIGCFyXY10O19i4tcjkJw=; b=Kb6xST4UcuReTg9x2aCn11OUqT gTiQoQH8xicb4Bvh7EQxG4tRhCHiCHNWVh4lzSS5v48CSV83XwkKx+HCp+r4+Ts1jH/OuucGb8D5N SPOqQLNHCFBXLUXxr/QdrPM5BDdgP9TRCzZQ6r8UGnqo5Pszl/x87Y29VZZx+Our1aKs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] MAINTAINERS: update my email address Message-Id: Date: Tue, 21 Jul 2026 09:55:02 +0000 commit ed3df2522ac7855e320e2e1c5f2bfc485d7455a8 Author: Roger Pau Monne AuthorDate: Tue Jul 21 10:05:46 2026 +0200 Commit: Roger Pau Monne CommitDate: Tue Jul 21 11:44:07 2026 +0200 MAINTAINERS: update my email address Signed-off-by: Roger Pau Monné Acked-by: Jan Beulich --- MAINTAINERS | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index d37adf18ab..6bb0662116 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -223,7 +223,7 @@ F: tools/libacpi/ AMD IOMMU M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Jason Andryuk R: Teddy Astie S: Supported @@ -232,7 +232,7 @@ F: xen/drivers/passthrough/amd/ AMD SVM M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Jason Andryuk R: Teddy Astie S: Supported @@ -379,7 +379,7 @@ F: xen/arch/x86/tboot.c IOMMU VENDOR INDEPENDENT CODE M: Jan Beulich -R: Roger Pau Monné +R: Roger Pau Monné S: Supported F: xen/drivers/passthrough/ X: xen/drivers/passthrough/amd/ @@ -426,7 +426,7 @@ F: tools/include/xentoollog.h F: tools/libs/ LIVEPATCH -M: Roger Pau Monné +M: Roger Pau Monné M: Ross Lagerwall S: Supported F: docs/misc/livepatch.pandoc @@ -589,7 +589,7 @@ F: xen/include/*/monitor.h F: xen/include/*/vm_event.h VPCI -M: Roger Pau Monné +M: Roger Pau Monné R: Stewart Hildebrand S: Supported F: tools/tests/vpci/ @@ -609,7 +609,7 @@ F: docs/misc/vtpm-platforms.txt X86 ARCHITECTURE M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Teddy Astie S: Supported L: xen-devel@lists.xenproject.org @@ -694,7 +694,7 @@ M: Anthony PERARD M: Michal Orzel M: Jan Beulich M: Julien Grall -M: Roger Pau Monné +M: Roger Pau Monné M: Stefano Stabellini L: xen-devel@lists.xenproject.org S: Supported -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 10:11:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 10:11:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367709.1617416 (Exim 4.92) (envelope-from ) id 1wm7RH-0006RF-Iw; Tue, 21 Jul 2026 10:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367709.1617416; Tue, 21 Jul 2026 10:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7RH-0006R7-G3; Tue, 21 Jul 2026 10:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1367709; Tue, 21 Jul 2026 10:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7RG-0006R1-CC for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7RG-000bML-1s for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7RG-00Gadx-0q for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=d7RYV3YTgCd8S+lqHdf0XM/V8IYTL7lUtAO/c6m5Mx0=; b=tXFi7Wwye6W5DOpl98d+ZBknLH DTKvUD4DMxOE+iCY7dXWU/mapv55ObMGfNnRptUoM9+Uixf4d7Nc1Jh9IUzSJphl6JK+yK7J/W4X0 8XVCggfQq+PL4tQ43uWtnvgMdF3AouNITJSSQdNyLNoDyaF8/uSWkyFaBYIVYfaI/TnY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: drop dead conditional from decode Message-Id: Date: Tue, 21 Jul 2026 10:11:02 +0000 commit 42c0972e9b47a456e050a8c18845438c1363ef7c Author: Jan Beulich AuthorDate: Tue Jul 21 09:46:01 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:46:01 2026 +0200 x86emul: drop dead conditional from decode We know that opcode_table[0x0f] is 0, there's no need to check that. Up until ab082ffa87d5 ("x86emul: generate and make use of a canonical opcode representation") or maybe already c4e7a67e3a10 ("x86emul: drop SrcInvalid") this may have been justified, but it no longer is. This eliminates a Misra C:2012 rule 2.2 ("There shall be no dead code") violation. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/x86_emulate/decode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index 57f6baffb0..d1665e6eb3 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -1082,7 +1082,7 @@ int x86emul_decode(struct x86_emulate_state *s, /* Opcode byte(s). */ d = opcode_table[b]; - if ( d == 0 && b == 0x0f ) + if ( b == 0x0f ) { /* Two-byte opcode. */ b = insn_fetch_type(uint8_t); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 10:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 10:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367710.1617420 (Exim 4.92) (envelope-from ) id 1wm7RR-0006T4-KY; Tue, 21 Jul 2026 10:11:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367710.1617420; Tue, 21 Jul 2026 10:11:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7RR-0006Sw-HW; Tue, 21 Jul 2026 10:11:13 +0000 Received: by outflank-mailman (input) for mailman id 1367710; Tue, 21 Jul 2026 10:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7RQ-0006Sl-OY for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7RR-000bMP-02 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7RQ-00Gb2h-1x for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=YQXAFPe96NIlfd3U/e9D1ml4IsfXNh6TNQFWjLYxSAc=; b=sqKCLbq32ajOKxVBeFYTs9OPeD UYxSSUegYB+WVY2RSe8aSyB53502U/eCvpw8+DSLTNmUgWu7ClOYSQH5S3+f5gPGZZP38vXs0Aj5u GVb02jW9gbdYao7m3tP9EvqlpBdsMs7IRL6OzD92ddcbwny2o3fW4vZg2IuPnxonHhSg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/serial: drop stale SERIAL_NEVER_DROP_CHARS Message-Id: Date: Tue, 21 Jul 2026 10:11:12 +0000 commit e2c8e9e62df31fb4bd51ba049de5959ba72fa444 Author: Denis Mukhin AuthorDate: Tue Jul 21 09:46:40 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:46:40 2026 +0200 xen/serial: drop stale SERIAL_NEVER_DROP_CHARS Left over from 275485700163 ("Bring back console_start_log_everything() as a milder alternative to"), which dropped the sole use only a few weeks after its introduction. Signed-off-by: Denis Mukhin Acked-by: Jan Beulich --- xen/drivers/char/serial.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/xen/drivers/char/serial.c b/xen/drivers/char/serial.c index bbbe758788..e3c3564089 100644 --- a/xen/drivers/char/serial.c +++ b/xen/drivers/char/serial.c @@ -15,9 +15,6 @@ #include -/* Never drop characters, even if the async transmit buffer fills. */ -/* #define SERIAL_NEVER_DROP_CHARS 1 */ - unsigned int __ro_after_init serial_txbufsz = CONFIG_SERIAL_TX_BUFSIZE; size_param("serial_tx_buffer", serial_txbufsz); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 10:11:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 10:11:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367711.1617424 (Exim 4.92) (envelope-from ) id 1wm7Rb-0006VJ-Le; Tue, 21 Jul 2026 10:11:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367711.1617424; Tue, 21 Jul 2026 10:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Rb-0006VB-Iq; Tue, 21 Jul 2026 10:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1367711; Tue, 21 Jul 2026 10:11:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Ra-0006V5-VL for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7Rb-000bMY-0h for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7Ra-00Gbaf-2u for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OBdBSLMuQm5so0JlKpJ9t21nOOgRmlU1x2fjuxRTKVY=; b=EuomFJ7cQrL7/8IQA8qVn3mMW6 TewLAB00rGne893c0bO86u9r74TA08mdr1QHUjs/eilcXUCDKQsrjTJrgVQMr3M3IaoseIvbFK+01 162wu+wQszm6LY2VCNcw7C6X3u+i5dIQk7ZNW/SM5dVc0R/j/Xvfg9N/sNf6+9L8LuM8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/sched: rt: fix NULL cpupool dereference in move_repl_timer() Message-Id: Date: Tue, 21 Jul 2026 10:11:22 +0000 commit f294e3abe40cda37618d9fbad8cde86bbae0d1c6 Author: Oleksii Moisieiev AuthorDate: Tue Jul 21 09:47:36 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:47:36 2026 +0200 xen/sched: rt: fix NULL cpupool dereference in move_repl_timer() schedule_cpu_rm() clears the cpupool pointer of the scheduling resource before calling sched_deinit_pdata(): sr->cpupool = NULL; ... sched_deinit_pdata(data->old_ops, data->ppriv_old, cpu); For RTDS, rt_deinit_pdata() calls move_repl_timer() when the replenishment timer lives on the cpu being removed, and move_repl_timer() dereferences get_sched_res(old_cpu)->cpupool without checking it for NULL. Removing a pCPU owning the timer from an RTDS cpupool therefore dereferences NULL + 0x10 (the res_valid member) and panics: (XEN) Data Abort Trap. Syndrome=0x1c28005 (XEN) Walking Hypervisor VA 0x10 on CPU0 via TTBR ... (XEN) Xen call trace: (XEN) [<...>] find_next_bit+0x74/0xa8 (PC) (XEN) [<...>] rt.c#move_repl_timer+0xb8/0xec (LR) (XEN) (XEN) Panic on CPU 0: (XEN) CPU0: Unexpected Trap: Data Abort Reproducer, on any host with at least 2 pCPUs and RTDS compiled in (observed on arm64, but the path is common code): xl cpupool-create name="test" sched="rtds" xl cpupool-cpu-remove Pool-0 1 xl cpupool-cpu-add test 1 xl cpupool-cpu-remove test 1 The last command moves the RTDS replenishment timer to cpu1 (first and only cpu of the pool) and then removes cpu1, hitting the NULL dereference in the sched_deinit_pdata() callback. Use the cpupool back-pointer of the scheduler instead of the one of the scheduling resource. It is set by cpupool_create() before any pCPU can be assigned to the pool and stays valid for the whole lifetime of the scheduler, so it is still available when rt_deinit_pdata() runs. Other schedulers already rely on it the same way, e.g. credit2 in cpu_add_to_runqueue(). Fixes: b6f5334aeaca ("sched: fix cpu offlining with core scheduling") Signed-off-by: Oleksii Moisieiev Reviewed-by: Juergen Gross --- xen/common/sched/rt.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c index 75d65e28ad..744f214173 100644 --- a/xen/common/sched/rt.c +++ b/xen/common/sched/rt.c @@ -762,10 +762,16 @@ rt_switch_sched(struct scheduler *new_ops, unsigned int cpu, return &prv->lock; } -static void move_repl_timer(struct rt_private *prv, unsigned int old_cpu) +static void move_repl_timer(const struct scheduler *ops, unsigned int old_cpu) { - cpumask_t *online = get_sched_res(old_cpu)->cpupool->res_valid; - unsigned int new_cpu = cpumask_cycle(old_cpu, online); + struct rt_private *prv = rt_priv(ops); + /* + * Use the cpupool of the scheduler: the one of the scheduling resource + * is already cleared when this is called from rt_deinit_pdata(). + */ + const struct cpupool *c = ops->cpupool; + unsigned int new_cpu = c ? cpumask_cycle(old_cpu, c->res_valid) + : nr_cpu_ids; /* * Make sure the timer run on one of the cpus that are still available @@ -792,7 +798,7 @@ rt_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) spin_lock_irqsave(&prv->lock, flags); if ( prv->repl_timer.cpu == cpu ) - move_repl_timer(prv, cpu); + move_repl_timer(ops, cpu); spin_unlock_irqrestore(&prv->lock, flags); } @@ -810,7 +816,7 @@ rt_move_timers(const struct scheduler *ops, struct sched_resource *sr) if ( prv->repl_timer.status != TIMER_STATUS_invalid && prv->repl_timer.status != TIMER_STATUS_killed && !cpumask_test_cpu(old_cpu, sr->cpupool->res_valid) ) - move_repl_timer(prv, old_cpu); + move_repl_timer(ops, old_cpu); spin_unlock_irqrestore(&prv->lock, flags); } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 10:11:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 10:11:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367712.1617429 (Exim 4.92) (envelope-from ) id 1wm7Rl-0006XH-Oj; Tue, 21 Jul 2026 10:11:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367712.1617429; Tue, 21 Jul 2026 10:11:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Rl-0006X5-KG; Tue, 21 Jul 2026 10:11:33 +0000 Received: by outflank-mailman (input) for mailman id 1367712; Tue, 21 Jul 2026 10:11:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Rl-0006Wy-2U for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7Rl-000bMv-13 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7Rl-00Gc27-01 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7cfskP2ZzIhVilnVx3AHusN+g2nqaZYrGOcHhfZP3LU=; b=KtRT0EZs0gJINdaDeK7UJrMsAV NLbsYGN2UlmkEjUEFeAgc5aErxviNWKDemtIlrLe43p5JewRqpMoo2Qs8igqxXJ3HB2LLvSK/AOuK 45VBbhClZcaH/Ux5Si3BXMh4iOhPO/5Q+GomMcyy978qKQQAJZR6kFCSP+z+duxL5xQ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: prune an excess EVEX.Z check Message-Id: Date: Tue, 21 Jul 2026 10:11:33 +0000 commit 66a9aa12e70a1479d5b7f202539093adb94e7b31 Author: Jan Beulich AuthorDate: Tue Jul 21 09:48:04 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:48:04 2026 +0200 x86emul: prune an excess EVEX.Z check DstMem processing early in x86_emulate() raises #UD when EVEX.Z is set with a memory destination. Open-coded checks like this one are therefore dead / unreachable code, violating Misra rules. Fixes: 4037a62ef93e ("x86emul: support AVX512F floating-point conversion insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/x86_emulate/x86_emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 38e5c349f5..a4ba22ffb5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -7350,7 +7350,7 @@ x86_emulate( if ( evex_encoded() ) { generate_exception_if((evex.w || evex.reg != 0xf || !evex.RX || - (ea.type != OP_REG && (evex.z || evex.brs))), + (ea.type != OP_REG && evex.brs)), X86_EXC_UD); host_and_vcpu_must_have(avx512f); avx512_vlen_check(false); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 10:11:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 10:11:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367713.1617432 (Exim 4.92) (envelope-from ) id 1wm7Rw-0006ZA-OX; Tue, 21 Jul 2026 10:11:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367713.1617432; Tue, 21 Jul 2026 10:11:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Rw-0006Z2-Lu; Tue, 21 Jul 2026 10:11:44 +0000 Received: by outflank-mailman (input) for mailman id 1367713; Tue, 21 Jul 2026 10:11:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm7Rv-0006Yw-6i for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm7Rv-000bMz-1T for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm7Rv-00GcNw-0K for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 10:11:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=muj/GrhkGFRl8mKhMc2O3YSgh60glc/lrhrxLiZqcEs=; b=Jm1g3lvMMlDonLmhzp4/G0BffS vltnErG5mqS0v2mruVH9o0XKhRMj0B5zcE0kGHeDVXmXDUra5pmVv/CVXzq6MIzXvkcu22ZNoUcWG Kb5jF9YvQqQ3+GvmTz3FneiVPDPA8ClsdJPkXrnnxNN1GZRhonMceCBwQ1bsx9dDVFWM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/riscv: do a 4th linking pass if necessary Message-Id: Date: Tue, 21 Jul 2026 10:11:43 +0000 commit 1bca40c1896235e3bdda79746887a957aefd2b55 Author: Oleksii Kurochko AuthorDate: Tue Jul 21 09:48:37 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 21 09:48:37 2026 +0200 xen/riscv: do a 4th linking pass if necessary Embedding the symbol table can shift sections and flip relaxation decisions, changing code size and thus the set of emitted tools/symbols (e.g. gap end markers). Re-link with a regenerated table when its size differs from the previous pass. This takes the same remedy as commit 35de7285d508 ("Arm: do a 4th linking pass if necessary"), though the underlying cause differs: here no symbol (dis)appears from the ELF symbol table; instead the set of end markers emitted by tools/symbols legitimately changes, because want_symbol_end() depends on code layout, and layout differs between passes due to linker relaxation. Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/Makefile | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile index 8f7fd625dd..4c7d4e5af5 100644 --- a/xen/arch/riscv/Makefile +++ b/xen/arch/riscv/Makefile @@ -46,9 +46,21 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds | $(objtree)/tools/symbols $(all_symbols) --sysv --sort \ > $(dot-target).2.S $(MAKE) $(build)=$(@D) $(dot-target).2.o - $(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o) + if ! { $(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o) >/dev/null; }; \ + then \ + set -e; \ + $(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \ + $(dot-target).2.o -o $(dot-target).2; \ + $(NM) -pa --format=sysv $(dot-target).2 \ + | $(objtree)/tools/symbols $(all_symbols) --sysv --sort \ + > $(dot-target).3.S; \ + $(MAKE) $(build)=$(@D) $(dot-target).3.o; \ + $(call compare-symbol-tables, $(dot-target).2.o, $(dot-target).3.o); \ + else \ + ln -sf $(dot-target).2.o $(dot-target).3.o; \ + fi $(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \ - $(dot-target).2.o -o $@ + $(dot-target).3.o -o $@ $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 21 11:33:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 21 Jul 2026 11:33:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1367743.1617437 (Exim 4.92) (envelope-from ) id 1wm8if-0005hA-1j; Tue, 21 Jul 2026 11:33:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1367743.1617437; Tue, 21 Jul 2026 11:33:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm8ie-0005h2-Ue; Tue, 21 Jul 2026 11:33:04 +0000 Received: by outflank-mailman (input) for mailman id 1367743; Tue, 21 Jul 2026 11:33:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wm8id-0005gw-F5 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 11:33:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wm8id-000d8K-28 for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 11:33:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wm8id-002IZQ-0k for xen-changelog@lists.xenproject.org; Tue, 21 Jul 2026 11:33:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UgEXKyuwxjrWYE3hlfGAtbU3xmLt4uyXzq/iZVYalU8=; b=ES1YAfBYOilpb37Cqj7EPAfRKk 1w+/idxRiPF/w6sqMAE+M3TuQytw7pdSvfpxKc9Ks3ASk7kgy+1mFD2IOftg37sbgvo/+iDQT+/1l n/03w8zNAAJfNTdJ+hqcfeiCtKaxu4087JiQNHqafCVxUlvZfj/4SplupZaZ5o+ecKPc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] MAINTAINERS: update my email address Message-Id: Date: Tue, 21 Jul 2026 11:33:03 +0000 commit ed3df2522ac7855e320e2e1c5f2bfc485d7455a8 Author: Roger Pau Monne AuthorDate: Tue Jul 21 10:05:46 2026 +0200 Commit: Roger Pau Monne CommitDate: Tue Jul 21 11:44:07 2026 +0200 MAINTAINERS: update my email address Signed-off-by: Roger Pau Monné Acked-by: Jan Beulich --- MAINTAINERS | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index d37adf18ab..6bb0662116 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -223,7 +223,7 @@ F: tools/libacpi/ AMD IOMMU M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Jason Andryuk R: Teddy Astie S: Supported @@ -232,7 +232,7 @@ F: xen/drivers/passthrough/amd/ AMD SVM M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Jason Andryuk R: Teddy Astie S: Supported @@ -379,7 +379,7 @@ F: xen/arch/x86/tboot.c IOMMU VENDOR INDEPENDENT CODE M: Jan Beulich -R: Roger Pau Monné +R: Roger Pau Monné S: Supported F: xen/drivers/passthrough/ X: xen/drivers/passthrough/amd/ @@ -426,7 +426,7 @@ F: tools/include/xentoollog.h F: tools/libs/ LIVEPATCH -M: Roger Pau Monné +M: Roger Pau Monné M: Ross Lagerwall S: Supported F: docs/misc/livepatch.pandoc @@ -589,7 +589,7 @@ F: xen/include/*/monitor.h F: xen/include/*/vm_event.h VPCI -M: Roger Pau Monné +M: Roger Pau Monné R: Stewart Hildebrand S: Supported F: tools/tests/vpci/ @@ -609,7 +609,7 @@ F: docs/misc/vtpm-platforms.txt X86 ARCHITECTURE M: Jan Beulich M: Andrew Cooper -M: Roger Pau Monné +M: Roger Pau Monné R: Teddy Astie S: Supported L: xen-devel@lists.xenproject.org @@ -694,7 +694,7 @@ M: Anthony PERARD M: Michal Orzel M: Jan Beulich M: Julien Grall -M: Roger Pau Monné +M: Roger Pau Monné M: Stefano Stabellini L: xen-devel@lists.xenproject.org S: Supported -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 08:55:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 08:55:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368237.1617685 (Exim 4.92) (envelope-from ) id 1wmSjH-0000rK-RR; Wed, 22 Jul 2026 08:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368237.1617685; Wed, 22 Jul 2026 08:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjH-0000rC-OE; Wed, 22 Jul 2026 08:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1368237; Wed, 22 Jul 2026 08:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjF-0000r6-V8 for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmSjG-002NiV-0Y for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmSjF-0083Jb-2h for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jNd/e6/G23jzEtCddk0W370sLdW3ZnI8UH1FB3brmbs=; b=fechDqopdnvV5jFkQhqVg0Wa15 kmCxcdWHTC6z4GNsTF3QXFZLEyp9RGHgz/JTcumQx9wAb0x1x3v0SIxsalwk5U8xBMC9qo/b8WO6g jHBLawGSx/rQRfb9/68QzgV3h3Bz5QlSS2kemAHM+RMoM1qBivncMdFLXLU39y/XZjgA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] non-x86: sync tidying logic at end of linking Message-Id: Date: Wed, 22 Jul 2026 08:55:01 +0000 commit 388497e5f94f8bee1ba49515ed64bb0fcf8ac621 Author: Jan Beulich AuthorDate: Wed Jul 22 09:26:36 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:26:36 2026 +0200 non-x86: sync tidying logic at end of linking Mirror what 761bb575ce97 ("x86: fix build race when generating temporary object files") did there to other ports: These ..*.cmd files aren't useful to have/keep. Signed-off-by: Jan Beulich Reviewed-by: Oleksii Kurochko # riscv Reviewed-by: Jason Andryuk Reviewed-by: Michal Orzel --- xen/arch/arm/Makefile | 2 +- xen/arch/ppc/Makefile | 2 +- xen/arch/riscv/Makefile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/Makefile b/xen/arch/arm/Makefile index 84c4062b30..b7afd3e58c 100644 --- a/xen/arch/arm/Makefile +++ b/xen/arch/arm/Makefile @@ -117,7 +117,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* .PHONY: include include: diff --git a/xen/arch/ppc/Makefile b/xen/arch/ppc/Makefile index fea39ae732..75215e07a8 100644 --- a/xen/arch/ppc/Makefile +++ b/xen/arch/ppc/Makefile @@ -32,7 +32,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* $(obj)/xen.lds: $(src)/xen.lds.S FORCE $(call if_changed_dep,cpp_lds_S) diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile index 4c7d4e5af5..4fcdcf9e24 100644 --- a/xen/arch/riscv/Makefile +++ b/xen/arch/riscv/Makefile @@ -64,7 +64,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* $(obj)/xen.lds: $(src)/xen.lds.S FORCE $(call if_changed_dep,cpp_lds_S) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 08:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 08:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368238.1617689 (Exim 4.92) (envelope-from ) id 1wmSjR-0000t1-S8; Wed, 22 Jul 2026 08:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368238.1617689; Wed, 22 Jul 2026 08:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjR-0000su-PX; Wed, 22 Jul 2026 08:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1368238; Wed, 22 Jul 2026 08:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjQ-0000sl-18 for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmSjQ-002NjL-0u for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmSjP-0083dY-34 for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CHh9ZT9nOuF2tG1g3WWaihXKaVVJeRDTRks20+uGSQY=; b=g2IyVcl7m7irVclB+5a2Kj81eR +gv9xWvSPEaYV8armSq6a2rW+k0Sm3Je23uzJykZlOhVgT++nteDCVuRO+0C60Ok/dhmAoiRZDn4f S/hxk6Zf7He+Cg2egRD+0wa83qWFnGahvR5ePQaMonBDJp35ejn7eF/ug6deItsPHEio=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/domctl: don't imply I/O port permissions from I/O port mapping Message-Id: Date: Wed, 22 Jul 2026 08:55:11 +0000 commit 3845d3854d699feabf637580f0aa9701f209b6a7 Author: Jan Beulich AuthorDate: Wed Jul 22 09:29:09 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:29:09 2026 +0200 x86/domctl: don't imply I/O port permissions from I/O port mapping Rather than granting permissions when mapping (an operation that DM-s are allowed to carry out, while they can't invoke ioport-permission), check whether permissions actually were granted when adding a mapping. This then also allows relaxing the necessary locking. While no longer granting permissions upon mapping is "only" at risk of breaking guests, no longer revoking permissions upon unmapping strictly requires callers to additionally invoke XEN_DOMCTL_ioport_permission. Or else a security issue would arise. In-tree code already does so. While there switch to using %pd in the two log messages. Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru") Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Acked-by: Oleksii Kurochko --- CHANGELOG.md | 5 +++++ xen/arch/x86/domctl.c | 61 ++++++++++++++++++++++----------------------------- 2 files changed, 31 insertions(+), 35 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 356be88351..1d3d7e0d87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ### Changed - XEN_DOMCTL_DEV_DT's, FLASK_[GS]ETBOOL's, and FLASK_DEVICETREE_LABEL's input string sizes need to include the nul terminator. + - On x86: + - XEN_DOMCTL_ioport_mapping no longer implicitly grants or revokes + permissions for the port range in question. + XEN_DOMCTL_ioport_permission now needs invoking up front / + afterwards. ### Added diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 2ecd81d89b..3100f4283c 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -714,15 +714,35 @@ long arch_do_domctl( break; hvm = &d->arch.hvm; - iocaps_double_lock(d, true); + /* + * NB: The double lock isn't really needed when !add, but is used anyway + * to keep things simple. + */ + iocaps_double_lock(d, false); if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) ) ret = -EPERM; - else if ( add ) + else if ( !add ) { printk(XENLOG_G_INFO - "ioport_map:add: dom%d gport=%x mport=%x nr=%x\n", - d->domain_id, fgp, fmp, np); + "ioport_map:remove: %pd gport=%x mport=%x nr=%x\n", + d, fgp, fmp, np); + + write_lock(&hvm->g2m_ioport_lock); + list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) + if ( g2m_ioport->mport == fmp ) + { + list_del(&g2m_ioport->list); + xfree(g2m_ioport); + break; + } + write_unlock(&hvm->g2m_ioport_lock); + } + else if ( ioports_access_permitted(d, fmp, fmp + np - 1) ) + { + printk(XENLOG_G_INFO + "ioport_map:add: %pd gport=%x mport=%x nr=%x\n", + d, fgp, fmp, np); write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) @@ -747,40 +767,11 @@ long arch_do_domctl( list_add_tail(&g2m_ioport->list, &hvm->g2m_ioport_list); } write_unlock(&hvm->g2m_ioport_lock); - if ( !ret ) - ret = ioports_permit_access(d, fmp, fmp + np - 1); - if ( ret && !found && g2m_ioport ) - { - write_lock(&hvm->g2m_ioport_lock); - list_del(&g2m_ioport->list); - write_unlock(&hvm->g2m_ioport_lock); - xfree(g2m_ioport); - } } else - { - printk(XENLOG_G_INFO - "ioport_map:remove: dom%d gport=%x mport=%x nr=%x\n", - d->domain_id, fgp, fmp, np); - - write_lock(&hvm->g2m_ioport_lock); - list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if ( g2m_ioport->mport == fmp ) - { - list_del(&g2m_ioport->list); - xfree(g2m_ioport); - break; - } - write_unlock(&hvm->g2m_ioport_lock); - - ret = ioports_deny_access(d, fmp, fmp + np - 1); - if ( ret && is_hardware_domain(currd) ) - printk(XENLOG_ERR - "ioport_map: error %ld denying dom%d access to [%x,%x]\n", - ret, d->domain_id, fmp, fmp + np - 1); - } + ret = -EPERM; - iocaps_double_unlock(d, true); + iocaps_double_unlock(d, false); break; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 08:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 08:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368239.1617692 (Exim 4.92) (envelope-from ) id 1wmSjb-0000v6-TI; Wed, 22 Jul 2026 08:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368239.1617692; Wed, 22 Jul 2026 08:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjb-0000uy-Qu; Wed, 22 Jul 2026 08:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1368239; Wed, 22 Jul 2026 08:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSja-0000ur-8w for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmSja-002NmC-1g for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmSja-00847X-0Y for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rQM9jL9IkHrUI2PksN54u7inKdTiZHJBksNjnZstfwg=; b=FVWkpIwqiVxTTSbRjSKl8OrJm4 yJxoZaMjImzD+nUo+DEPnxoj7gWyaayfkl76lqtU4z0qj92ImM9k04ui0EH5gcCvfrRPK3WYZs4Q+ C3ojXse0UTjc+z20e+Lzl0nvwt0io16aAdlhXv+ZfkMXCeHKeS71ghz4ih5g1aINF6yk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/HVM: more checking for XEN_DOMCTL_ioport_mapping Message-Id: Date: Wed, 22 Jul 2026 08:55:22 +0000 commit fa61af950bb468c1f2ffe879991316e78c7921e0 Author: Jan Beulich AuthorDate: Wed Jul 22 09:29:48 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:29:48 2026 +0200 x86/HVM: more checking for XEN_DOMCTL_ioport_mapping When adding ranges, only alter existing ones when there is an exact match. Don't accept ranges overlapping existing ones. When removing ranges, only remove a range if there's an exact match. Return an error when the range isn't found. Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru") Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné --- xen/arch/x86/domctl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 3100f4283c..f26990208d 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -728,12 +728,14 @@ long arch_do_domctl( "ioport_map:remove: %pd gport=%x mport=%x nr=%x\n", d, fgp, fmp, np); + ret = -ENOENT; write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if ( g2m_ioport->mport == fmp ) + if ( g2m_ioport->mport == fmp && g2m_ioport->np == np ) { list_del(&g2m_ioport->list); xfree(g2m_ioport); + ret = 0; break; } write_unlock(&hvm->g2m_ioport_lock); @@ -746,14 +748,21 @@ long arch_do_domctl( write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if (g2m_ioport->mport == fmp ) + { + if ( g2m_ioport->mport == fmp && g2m_ioport->np == np ) { g2m_ioport->gport = fgp; - g2m_ioport->np = np; found = 1; break; } - if ( !found ) + if ( fmp + np >= g2m_ioport->mport && + g2m_ioport->mport + g2m_ioport->np >= fmp ) + { + ret = -EBUSY; + break; + } + } + if ( !found && !ret ) { g2m_ioport = xmalloc(struct g2m_ioport); if ( !g2m_ioport ) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 08:55:32 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 08:55:32 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368240.1617697 (Exim 4.92) (envelope-from ) id 1wmSjk-0000x0-Ug; Wed, 22 Jul 2026 08:55:32 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368240.1617697; Wed, 22 Jul 2026 08:55:32 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjk-0000ws-SB; Wed, 22 Jul 2026 08:55:32 +0000 Received: by outflank-mailman (input) for mailman id 1368240; Wed, 22 Jul 2026 08:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmSjk-0000wm-GS for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmSjk-002NmG-2Q for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmSjk-0084wC-1L for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 08:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=9SbLiGV/bOMbYsuAN1UUNwSLlsodXY0mP7F1hKibaOk=; b=1rBdxN2nTZ0gtslZsYK+UvBkxk i/Qj0ugxUo+EjkoRhDVE7u7LzKoCPnR+itCN5CAx+N7M0YdKCSZ00XEAaVD6AQvmjwNxoGcJDyiA1 mbb1l45/h12V3wTzCQD/16yxDODtEhxhkpKzJKo+CUSnxuWNx3C3YJuSsSLfNgpMAyTM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/acpi: Import PPTT definitions from Linux Message-Id: Date: Wed, 22 Jul 2026 08:55:32 +0000 commit 99794c8a8ff8b1d277c09d4736384fd5bb94f2d6 Author: Hirokazu Takahashi AuthorDate: Wed Jul 22 09:30:18 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:30:18 2026 +0200 xen/acpi: Import PPTT definitions from Linux Import the Processor Properties Topology Table (PPTT) definitions from the Linux kernel header (include/acpi/actbl2.h) into Xen. Signed-off-by: Hirokazu Takahashi Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git b8355bcac253 Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git e62f8227851d Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 091c4af3562d Acked-by: Jan Beulich --- xen/include/acpi/actbl2.h | 113 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) diff --git a/xen/include/acpi/actbl2.h b/xen/include/acpi/actbl2.h index ee96e990d6..4398d98e00 100644 --- a/xen/include/acpi/actbl2.h +++ b/xen/include/acpi/actbl2.h @@ -72,6 +72,7 @@ #define ACPI_SIG_IVRS "IVRS" /* I/O Virtualization Reporting Structure */ #define ACPI_SIG_MCFG "MCFG" /* PCI Memory Mapped Configuration table */ #define ACPI_SIG_MCHI "MCHI" /* Management Controller Host Interface table */ +#define ACPI_SIG_PPTT "PPTT" /* Processor Properties Topology Table */ #define ACPI_SIG_SLIC "SLIC" /* Software Licensing Description Table */ #define ACPI_SIG_SPCR "SPCR" /* Serial Port Console Redirection table */ #define ACPI_SIG_SPMI "SPMI" /* Server Platform Management Interface table */ @@ -937,6 +938,118 @@ struct acpi_table_mchi { u8 pci_function; }; +/******************************************************************************* + * + * PPTT - Processor Properties Topology Table (ACPI 6.2) + * Version 1 + * + ******************************************************************************/ + +struct acpi_table_pptt { + struct acpi_table_header header; /* Common ACPI table header */ +}; + +/* Values for Type field above */ + +enum acpi_pptt_type { + ACPI_PPTT_TYPE_PROCESSOR = 0, + ACPI_PPTT_TYPE_CACHE = 1, + ACPI_PPTT_TYPE_ID = 2, + ACPI_PPTT_TYPE_RESERVED = 3 +}; + +/* 0: Processor Hierarchy Node Structure */ + +struct acpi_pptt_processor { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 parent; + u32 acpi_processor_id; + u32 number_of_priv_resources; +}; + +/* Flags */ + +#define ACPI_PPTT_PHYSICAL_PACKAGE (1) +#define ACPI_PPTT_ACPI_PROCESSOR_ID_VALID (1<<1) +#define ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD (1<<2) /* ACPI 6.3 */ +#define ACPI_PPTT_ACPI_LEAF_NODE (1<<3) /* ACPI 6.3 */ +#define ACPI_PPTT_ACPI_IDENTICAL (1<<4) /* ACPI 6.3 */ + +/* 1: Cache Type Structure */ + +struct acpi_pptt_cache { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 next_level_of_cache; + u32 size; + u32 number_of_sets; + u8 associativity; + u8 attributes; + u16 line_size; +}; + +/* 1: Cache Type Structure for PPTT version 3 */ + +struct acpi_pptt_cache_v1 { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 next_level_of_cache; + u32 size; + u32 number_of_sets; + u8 associativity; + u8 attributes; + u16 line_size; + u32 cache_id; +}; + +/* Flags */ + +#define ACPI_PPTT_SIZE_PROPERTY_VALID (1) /* Physical property valid */ +#define ACPI_PPTT_NUMBER_OF_SETS_VALID (1<<1) /* Number of sets valid */ +#define ACPI_PPTT_ASSOCIATIVITY_VALID (1<<2) /* Associativity valid */ +#define ACPI_PPTT_ALLOCATION_TYPE_VALID (1<<3) /* Allocation type valid */ +#define ACPI_PPTT_CACHE_TYPE_VALID (1<<4) /* Cache type valid */ +#define ACPI_PPTT_WRITE_POLICY_VALID (1<<5) /* Write policy valid */ +#define ACPI_PPTT_LINE_SIZE_VALID (1<<6) /* Line size valid */ +#define ACPI_PPTT_CACHE_ID_VALID (1<<7) /* Cache ID valid */ + +/* Masks for Attributes */ + +#define ACPI_PPTT_MASK_ALLOCATION_TYPE (0x03) /* Allocation type */ +#define ACPI_PPTT_MASK_CACHE_TYPE (0x0C) /* Cache type */ +#define ACPI_PPTT_MASK_WRITE_POLICY (0x10) /* Write policy */ + +/* Attributes describing cache */ +#define ACPI_PPTT_CACHE_READ_ALLOCATE (0x0) /* Cache line is allocated on read */ +#define ACPI_PPTT_CACHE_WRITE_ALLOCATE (0x01) /* Cache line is allocated on write */ +#define ACPI_PPTT_CACHE_RW_ALLOCATE (0x02) /* Cache line is allocated on read and write */ +#define ACPI_PPTT_CACHE_RW_ALLOCATE_ALT (0x03) /* Alternate representation of above */ + +#define ACPI_PPTT_CACHE_TYPE_DATA (0x0) /* Data cache */ +#define ACPI_PPTT_CACHE_TYPE_INSTR (1<<2) /* Instruction cache */ +#define ACPI_PPTT_CACHE_TYPE_UNIFIED (2<<2) /* Unified I & D cache */ +#define ACPI_PPTT_CACHE_TYPE_UNIFIED_ALT (3<<2) /* Alternate representation of above */ + +#define ACPI_PPTT_CACHE_POLICY_WB (0x0) /* Cache is write back */ +#define ACPI_PPTT_CACHE_POLICY_WT (1<<4) /* Cache is write through */ + +/* 2: ID Structure */ + +struct acpi_pptt_id { + struct acpi_subtable_header header; + u16 reserved; + u32 vendor_id; + u64 level1_id; + u64 level2_id; + u16 major_rev; + u16 minor_rev; + u16 spin_rev; +}; + /******************************************************************************* * * SLIC - Software Licensing Description Table -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 09:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 09:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368277.1617719 (Exim 4.92) (envelope-from ) id 1wmTUh-0000fQ-OK; Wed, 22 Jul 2026 09:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368277.1617719; Wed, 22 Jul 2026 09:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTUh-0000fI-Lh; Wed, 22 Jul 2026 09:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1368277; Wed, 22 Jul 2026 09:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTUg-0000fC-66 for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmTUg-002Opa-1G for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmTUg-009ey9-0B for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=atLL4QHALiaJxqjG3WS2VQZqPtycu1CmvxZPmlth2iY=; b=urcf/mOVP586w6C6QdZRlSLSWS AYL37Vr7Ndai2YAloUGqHqtqz7Gg1BSdMzQEi/1zx+/TUMfNVcjGzbCf7Arh3L2KHVRUHGsnPsmrW PKKs0CZwePC64zdgRnnBVumBveHayP5SN8vI5ncN81K/RbtqpRkhbAgurK+Q6dvIw6Vg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] non-x86: sync tidying logic at end of linking Message-Id: Date: Wed, 22 Jul 2026 09:44:02 +0000 commit 388497e5f94f8bee1ba49515ed64bb0fcf8ac621 Author: Jan Beulich AuthorDate: Wed Jul 22 09:26:36 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:26:36 2026 +0200 non-x86: sync tidying logic at end of linking Mirror what 761bb575ce97 ("x86: fix build race when generating temporary object files") did there to other ports: These ..*.cmd files aren't useful to have/keep. Signed-off-by: Jan Beulich Reviewed-by: Oleksii Kurochko # riscv Reviewed-by: Jason Andryuk Reviewed-by: Michal Orzel --- xen/arch/arm/Makefile | 2 +- xen/arch/ppc/Makefile | 2 +- xen/arch/riscv/Makefile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/arm/Makefile b/xen/arch/arm/Makefile index 84c4062b30..b7afd3e58c 100644 --- a/xen/arch/arm/Makefile +++ b/xen/arch/arm/Makefile @@ -117,7 +117,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* .PHONY: include include: diff --git a/xen/arch/ppc/Makefile b/xen/arch/ppc/Makefile index fea39ae732..75215e07a8 100644 --- a/xen/arch/ppc/Makefile +++ b/xen/arch/ppc/Makefile @@ -32,7 +32,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* $(obj)/xen.lds: $(src)/xen.lds.S FORCE $(call if_changed_dep,cpp_lds_S) diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile index 4c7d4e5af5..4fcdcf9e24 100644 --- a/xen/arch/riscv/Makefile +++ b/xen/arch/riscv/Makefile @@ -64,7 +64,7 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds $(NM) -pa --format=sysv $@ \ | $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \ > $@.map - rm -f $(@D)/.$(@F).[0-9]* + rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]* $(obj)/xen.lds: $(src)/xen.lds.S FORCE $(call if_changed_dep,cpp_lds_S) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 09:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 09:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368278.1617724 (Exim 4.92) (envelope-from ) id 1wmTUr-0000hD-Qe; Wed, 22 Jul 2026 09:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368278.1617724; Wed, 22 Jul 2026 09:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTUr-0000h5-N4; Wed, 22 Jul 2026 09:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1368278; Wed, 22 Jul 2026 09:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTUq-0000gu-GT for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmTUq-002Oph-2P for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmTUq-009f8z-1E for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TtHS7MZdgfDhXdZNqx0m8EMnwmHscYzZMDfh//HJFak=; b=enOJ623iPUh4D03VvdyI4bhKe/ vg1mQbWI4xhF/iavKs7Tt+aI0YNK3vpgKFNSg2mZ+tq6L72pm+rqnS3fulEQPpMH/pf6D18u+QdPC B1omk1qKQhriYN80drwJUxCv+i4n+eYGarivUX8V5ERY1tjVi2H3Kc1sd7lJVjcaejSo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/domctl: don't imply I/O port permissions from I/O port mapping Message-Id: Date: Wed, 22 Jul 2026 09:44:12 +0000 commit 3845d3854d699feabf637580f0aa9701f209b6a7 Author: Jan Beulich AuthorDate: Wed Jul 22 09:29:09 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:29:09 2026 +0200 x86/domctl: don't imply I/O port permissions from I/O port mapping Rather than granting permissions when mapping (an operation that DM-s are allowed to carry out, while they can't invoke ioport-permission), check whether permissions actually were granted when adding a mapping. This then also allows relaxing the necessary locking. While no longer granting permissions upon mapping is "only" at risk of breaking guests, no longer revoking permissions upon unmapping strictly requires callers to additionally invoke XEN_DOMCTL_ioport_permission. Or else a security issue would arise. In-tree code already does so. While there switch to using %pd in the two log messages. Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru") Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Acked-by: Oleksii Kurochko --- CHANGELOG.md | 5 +++++ xen/arch/x86/domctl.c | 61 ++++++++++++++++++++++----------------------------- 2 files changed, 31 insertions(+), 35 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 356be88351..1d3d7e0d87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) ### Changed - XEN_DOMCTL_DEV_DT's, FLASK_[GS]ETBOOL's, and FLASK_DEVICETREE_LABEL's input string sizes need to include the nul terminator. + - On x86: + - XEN_DOMCTL_ioport_mapping no longer implicitly grants or revokes + permissions for the port range in question. + XEN_DOMCTL_ioport_permission now needs invoking up front / + afterwards. ### Added diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 2ecd81d89b..3100f4283c 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -714,15 +714,35 @@ long arch_do_domctl( break; hvm = &d->arch.hvm; - iocaps_double_lock(d, true); + /* + * NB: The double lock isn't really needed when !add, but is used anyway + * to keep things simple. + */ + iocaps_double_lock(d, false); if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) ) ret = -EPERM; - else if ( add ) + else if ( !add ) { printk(XENLOG_G_INFO - "ioport_map:add: dom%d gport=%x mport=%x nr=%x\n", - d->domain_id, fgp, fmp, np); + "ioport_map:remove: %pd gport=%x mport=%x nr=%x\n", + d, fgp, fmp, np); + + write_lock(&hvm->g2m_ioport_lock); + list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) + if ( g2m_ioport->mport == fmp ) + { + list_del(&g2m_ioport->list); + xfree(g2m_ioport); + break; + } + write_unlock(&hvm->g2m_ioport_lock); + } + else if ( ioports_access_permitted(d, fmp, fmp + np - 1) ) + { + printk(XENLOG_G_INFO + "ioport_map:add: %pd gport=%x mport=%x nr=%x\n", + d, fgp, fmp, np); write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) @@ -747,40 +767,11 @@ long arch_do_domctl( list_add_tail(&g2m_ioport->list, &hvm->g2m_ioport_list); } write_unlock(&hvm->g2m_ioport_lock); - if ( !ret ) - ret = ioports_permit_access(d, fmp, fmp + np - 1); - if ( ret && !found && g2m_ioport ) - { - write_lock(&hvm->g2m_ioport_lock); - list_del(&g2m_ioport->list); - write_unlock(&hvm->g2m_ioport_lock); - xfree(g2m_ioport); - } } else - { - printk(XENLOG_G_INFO - "ioport_map:remove: dom%d gport=%x mport=%x nr=%x\n", - d->domain_id, fgp, fmp, np); - - write_lock(&hvm->g2m_ioport_lock); - list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if ( g2m_ioport->mport == fmp ) - { - list_del(&g2m_ioport->list); - xfree(g2m_ioport); - break; - } - write_unlock(&hvm->g2m_ioport_lock); - - ret = ioports_deny_access(d, fmp, fmp + np - 1); - if ( ret && is_hardware_domain(currd) ) - printk(XENLOG_ERR - "ioport_map: error %ld denying dom%d access to [%x,%x]\n", - ret, d->domain_id, fmp, fmp + np - 1); - } + ret = -EPERM; - iocaps_double_unlock(d, true); + iocaps_double_unlock(d, false); break; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 09:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 09:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368279.1617727 (Exim 4.92) (envelope-from ) id 1wmTV1-0000jo-SO; Wed, 22 Jul 2026 09:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368279.1617727; Wed, 22 Jul 2026 09:44:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTV1-0000je-Pk; Wed, 22 Jul 2026 09:44:23 +0000 Received: by outflank-mailman (input) for mailman id 1368279; Wed, 22 Jul 2026 09:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTV0-0000jW-Ot for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmTV1-002Opl-04 for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmTV0-009fas-2G for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LVCi1sSAaCcnwwsQi43OLFglNOKLKKSTEIoc5Cszwl4=; b=dnp+vkC5LkaT3iBeq5zaEFIvQh vb4ZacKTB3iQ4l4bF3JugCfvoxI9l9Xs6iH4c95WUWGM2aGcm0BrrpGVXaFjZW6/1s44v4oSJjacQ UVExpjbOd9T1wpQ11CE6cmxqitDr1Wyq1ePuhg/LGmIR4mqYFtWpoTrTCbM3GA3U2G08=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/HVM: more checking for XEN_DOMCTL_ioport_mapping Message-Id: Date: Wed, 22 Jul 2026 09:44:22 +0000 commit fa61af950bb468c1f2ffe879991316e78c7921e0 Author: Jan Beulich AuthorDate: Wed Jul 22 09:29:48 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:29:48 2026 +0200 x86/HVM: more checking for XEN_DOMCTL_ioport_mapping When adding ranges, only alter existing ones when there is an exact match. Don't accept ranges overlapping existing ones. When removing ranges, only remove a range if there's an exact match. Return an error when the range isn't found. Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru") Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné --- xen/arch/x86/domctl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 3100f4283c..f26990208d 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -728,12 +728,14 @@ long arch_do_domctl( "ioport_map:remove: %pd gport=%x mport=%x nr=%x\n", d, fgp, fmp, np); + ret = -ENOENT; write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if ( g2m_ioport->mport == fmp ) + if ( g2m_ioport->mport == fmp && g2m_ioport->np == np ) { list_del(&g2m_ioport->list); xfree(g2m_ioport); + ret = 0; break; } write_unlock(&hvm->g2m_ioport_lock); @@ -746,14 +748,21 @@ long arch_do_domctl( write_lock(&hvm->g2m_ioport_lock); list_for_each_entry(g2m_ioport, &hvm->g2m_ioport_list, list) - if (g2m_ioport->mport == fmp ) + { + if ( g2m_ioport->mport == fmp && g2m_ioport->np == np ) { g2m_ioport->gport = fgp; - g2m_ioport->np = np; found = 1; break; } - if ( !found ) + if ( fmp + np >= g2m_ioport->mport && + g2m_ioport->mport + g2m_ioport->np >= fmp ) + { + ret = -EBUSY; + break; + } + } + if ( !found && !ret ) { g2m_ioport = xmalloc(struct g2m_ioport); if ( !g2m_ioport ) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 22 09:44:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 22 Jul 2026 09:44:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368280.1617731 (Exim 4.92) (envelope-from ) id 1wmTVB-0000lf-Ti; Wed, 22 Jul 2026 09:44:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368280.1617731; Wed, 22 Jul 2026 09:44:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTVB-0000lX-RA; Wed, 22 Jul 2026 09:44:33 +0000 Received: by outflank-mailman (input) for mailman id 1368280; Wed, 22 Jul 2026 09:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmTVA-0000lQ-TF for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmTVB-002Opp-0U for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmTVA-009fo6-2i for xen-changelog@lists.xenproject.org; Wed, 22 Jul 2026 09:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=f+6CT9BsnCJkj8/icHB135mCaoCIRlsKgCQb3iCCD0Q=; b=QMrty4AZbtydgWV1/2XVnTpjqO N//QAShxsN4UL7VLDkii+i6eSyKefitCD9mj1+CQ9My21fvTtwvVawm7Fl+Yq8BQCwO0w531fHOJC d0IAG3xBhh58JduMO2tlfvuye99a/LrWj5b95mQYFE+7bvPS7+5GYNygbFeasbN6tSIU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/acpi: Import PPTT definitions from Linux Message-Id: Date: Wed, 22 Jul 2026 09:44:32 +0000 commit 99794c8a8ff8b1d277c09d4736384fd5bb94f2d6 Author: Hirokazu Takahashi AuthorDate: Wed Jul 22 09:30:18 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 22 09:30:18 2026 +0200 xen/acpi: Import PPTT definitions from Linux Import the Processor Properties Topology Table (PPTT) definitions from the Linux kernel header (include/acpi/actbl2.h) into Xen. Signed-off-by: Hirokazu Takahashi Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git b8355bcac253 Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git e62f8227851d Origin: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 091c4af3562d Acked-by: Jan Beulich --- xen/include/acpi/actbl2.h | 113 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) diff --git a/xen/include/acpi/actbl2.h b/xen/include/acpi/actbl2.h index ee96e990d6..4398d98e00 100644 --- a/xen/include/acpi/actbl2.h +++ b/xen/include/acpi/actbl2.h @@ -72,6 +72,7 @@ #define ACPI_SIG_IVRS "IVRS" /* I/O Virtualization Reporting Structure */ #define ACPI_SIG_MCFG "MCFG" /* PCI Memory Mapped Configuration table */ #define ACPI_SIG_MCHI "MCHI" /* Management Controller Host Interface table */ +#define ACPI_SIG_PPTT "PPTT" /* Processor Properties Topology Table */ #define ACPI_SIG_SLIC "SLIC" /* Software Licensing Description Table */ #define ACPI_SIG_SPCR "SPCR" /* Serial Port Console Redirection table */ #define ACPI_SIG_SPMI "SPMI" /* Server Platform Management Interface table */ @@ -937,6 +938,118 @@ struct acpi_table_mchi { u8 pci_function; }; +/******************************************************************************* + * + * PPTT - Processor Properties Topology Table (ACPI 6.2) + * Version 1 + * + ******************************************************************************/ + +struct acpi_table_pptt { + struct acpi_table_header header; /* Common ACPI table header */ +}; + +/* Values for Type field above */ + +enum acpi_pptt_type { + ACPI_PPTT_TYPE_PROCESSOR = 0, + ACPI_PPTT_TYPE_CACHE = 1, + ACPI_PPTT_TYPE_ID = 2, + ACPI_PPTT_TYPE_RESERVED = 3 +}; + +/* 0: Processor Hierarchy Node Structure */ + +struct acpi_pptt_processor { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 parent; + u32 acpi_processor_id; + u32 number_of_priv_resources; +}; + +/* Flags */ + +#define ACPI_PPTT_PHYSICAL_PACKAGE (1) +#define ACPI_PPTT_ACPI_PROCESSOR_ID_VALID (1<<1) +#define ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD (1<<2) /* ACPI 6.3 */ +#define ACPI_PPTT_ACPI_LEAF_NODE (1<<3) /* ACPI 6.3 */ +#define ACPI_PPTT_ACPI_IDENTICAL (1<<4) /* ACPI 6.3 */ + +/* 1: Cache Type Structure */ + +struct acpi_pptt_cache { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 next_level_of_cache; + u32 size; + u32 number_of_sets; + u8 associativity; + u8 attributes; + u16 line_size; +}; + +/* 1: Cache Type Structure for PPTT version 3 */ + +struct acpi_pptt_cache_v1 { + struct acpi_subtable_header header; + u16 reserved; + u32 flags; + u32 next_level_of_cache; + u32 size; + u32 number_of_sets; + u8 associativity; + u8 attributes; + u16 line_size; + u32 cache_id; +}; + +/* Flags */ + +#define ACPI_PPTT_SIZE_PROPERTY_VALID (1) /* Physical property valid */ +#define ACPI_PPTT_NUMBER_OF_SETS_VALID (1<<1) /* Number of sets valid */ +#define ACPI_PPTT_ASSOCIATIVITY_VALID (1<<2) /* Associativity valid */ +#define ACPI_PPTT_ALLOCATION_TYPE_VALID (1<<3) /* Allocation type valid */ +#define ACPI_PPTT_CACHE_TYPE_VALID (1<<4) /* Cache type valid */ +#define ACPI_PPTT_WRITE_POLICY_VALID (1<<5) /* Write policy valid */ +#define ACPI_PPTT_LINE_SIZE_VALID (1<<6) /* Line size valid */ +#define ACPI_PPTT_CACHE_ID_VALID (1<<7) /* Cache ID valid */ + +/* Masks for Attributes */ + +#define ACPI_PPTT_MASK_ALLOCATION_TYPE (0x03) /* Allocation type */ +#define ACPI_PPTT_MASK_CACHE_TYPE (0x0C) /* Cache type */ +#define ACPI_PPTT_MASK_WRITE_POLICY (0x10) /* Write policy */ + +/* Attributes describing cache */ +#define ACPI_PPTT_CACHE_READ_ALLOCATE (0x0) /* Cache line is allocated on read */ +#define ACPI_PPTT_CACHE_WRITE_ALLOCATE (0x01) /* Cache line is allocated on write */ +#define ACPI_PPTT_CACHE_RW_ALLOCATE (0x02) /* Cache line is allocated on read and write */ +#define ACPI_PPTT_CACHE_RW_ALLOCATE_ALT (0x03) /* Alternate representation of above */ + +#define ACPI_PPTT_CACHE_TYPE_DATA (0x0) /* Data cache */ +#define ACPI_PPTT_CACHE_TYPE_INSTR (1<<2) /* Instruction cache */ +#define ACPI_PPTT_CACHE_TYPE_UNIFIED (2<<2) /* Unified I & D cache */ +#define ACPI_PPTT_CACHE_TYPE_UNIFIED_ALT (3<<2) /* Alternate representation of above */ + +#define ACPI_PPTT_CACHE_POLICY_WB (0x0) /* Cache is write back */ +#define ACPI_PPTT_CACHE_POLICY_WT (1<<4) /* Cache is write through */ + +/* 2: ID Structure */ + +struct acpi_pptt_id { + struct acpi_subtable_header header; + u16 reserved; + u32 vendor_id; + u64 level1_id; + u64 level2_id; + u16 major_rev; + u16 minor_rev; + u16 spin_rev; +}; + /******************************************************************************* * * SLIC - Software Licensing Description Table -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 07:44:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 07:44:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1368944.1617981 (Exim 4.92) (envelope-from ) id 1wmo68-0001nR-ML; Thu, 23 Jul 2026 07:44:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1368944.1617981; Thu, 23 Jul 2026 07:44:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmo68-0001nJ-Jn; Thu, 23 Jul 2026 07:44:04 +0000 Received: by outflank-mailman (input) for mailman id 1368944; Thu, 23 Jul 2026 07:44:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmo67-0001nD-UW for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 07:44:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmo68-004Aqp-0H for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 07:44:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmo67-00Bi89-2B for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 07:44:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=64dV4RW2Izf+zDGv5snP8M9mEnfTDsuKLs+pxKRHK50=; b=3dNYRhE5WG7mHidy3aNoMrVG7p 3ej4UiXMnrhw2eO8SVh/NehBB8DYKevoLp32L7eOfwdCvBuT5aaD7PWNrIy5/z0vLydfvx1S+jjwJ Cv1OGpfiLVr9Vc63Gb6wW6Xl8ywPzP7Cqf3LWNjBoh4hnh/UtQxwq1kJCq30nWG5iILk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Thu, 23 Jul 2026 07:44:03 +0000 commit f795a9c491a704b6cd6ca0381b033e6beb692cb3 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 09:03:17 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 65aea71c43..751f2f42fb 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -191,20 +191,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -213,7 +218,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -222,13 +227,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 09:55:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 09:55:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369018.1617985 (Exim 4.92) (envelope-from ) id 1wmq8t-0000Sm-K8; Thu, 23 Jul 2026 09:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369018.1617985; Thu, 23 Jul 2026 09:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq8t-0000Se-Hf; Thu, 23 Jul 2026 09:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1369018; Thu, 23 Jul 2026 09:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq8s-0000SY-KC for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmq8s-004EJX-2i for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmq8s-00FDyj-1f for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3XSpDnLpejNwru+a2EC+4kdZ+8QUAsSeBiykRkjhYsU=; b=00UlYMnr3KBkdoFiGSOEDk9Ol/ 4/bfEDfXu8rzdtWP7ImwdVw0jwLxWwAsLkg2eKxibxwyEq71HjnyzLmqcyO/RsV1/v8XMLYIA+5gp sUfwIVL2Ga/L1lqAmc6T1v3aS3plqG2LPYMTbIFmcSvirgtI4bQeqpSPAjt9mhFZ8Kjs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/mm: reset PFN_ORDER for offlined buddy heads Message-Id: Date: Thu, 23 Jul 2026 09:55:02 +0000 commit 14c05f26f89d2c1244b02b8071cf22ad7e7208d9 Author: Bernhard Kaindl AuthorDate: Thu Jul 23 10:19:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:19:43 2026 +0200 xen/mm: reset PFN_ORDER for offlined buddy heads Ensure offlined buddy head pages are annotated as order-0 pages. When a buddy containing pages marked for offlining is processed, reserve_offlined_page() rebuilds any surviving healthy buddies and moves the offlined subpages onto the offlined lists. If the buddy head itself is offlined it was previously left annotated with the original buddy order even though it has been split into a single page. This has no functional impact as the order of an offlined page is not used for any decision making and onlining, but it is misleading when inspecting the page's metadata. Set PFN_ORDER(cur_head) to 0 for all pages moved to the lists of offlined and broken pages so the page's stored order reflects its actual size. Signed-off-by: Bernhard Kaindl Reviewed-by: Jan Beulich --- xen/common/page_alloc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 40b0f73563..40fdb5fb98 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1251,6 +1251,12 @@ static int reserve_offlined_page(struct page_info *head) ASSERT(total_avail_pages > 0); total_avail_pages--; + /* + * All offlined pages are standalone pages: If this offlined page was + * the head of a higher-order buddy, reset its order to 0. + */ + PFN_ORDER(cur_head) = 0; + page_list_add_tail(cur_head, test_bit(_PGC_broken, &cur_head->count_info) ? &page_broken_list : &page_offlined_list); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 09:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 09:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369019.1617989 (Exim 4.92) (envelope-from ) id 1wmq93-0000UM-Ll; Thu, 23 Jul 2026 09:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369019.1617989; Thu, 23 Jul 2026 09:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq93-0000UE-JA; Thu, 23 Jul 2026 09:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1369019; Thu, 23 Jul 2026 09:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq92-0000U5-MK for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmq92-004ELh-31 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmq92-00FE7V-22 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GfFhimb6aN/ybAMHLExI5shj8Awk3IQuoUT0MXL7H88=; b=LOutKyzF1tjhxNKURG/6uxSxQq VXpt1/0kjHEz+sCjTKQMNPYBMdHC6Cxpnxz55jeZdwV1Lvln/TKTLyCwdD/PLwZ0Gz0+zulZHzN/E LUvUteP3snJA6mLI7UtdG3BuzrlWr778roA2K4R02ocOosLMI2E6wkJ+Z8Qy85Ds15pg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/xentrace: decode RTDS priority in repl_budget records Message-Id: Date: Thu, 23 Jul 2026 09:55:12 +0000 commit 2fe6a869da52031a7726bf888e6c5c189750124f Author: Ryoji Okamoto AuthorDate: Thu Jul 23 10:20:08 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:08 2026 +0200 tools/xentrace: decode RTDS priority in repl_budget records The RTDS repl_budget trace record now contains the vCPU priority level. Update xenalyze to account for the additional field and print it when dumping the trace event. Without this change, xenalyze interprets the record using the old layout, causing the deadline and budget fields to be decoded from the wrong offsets. Fixes: 463b95831778 ("xen:rtds: towards work conserving RTDS") Signed-off-by: Ryoji Okamoto Reviewed-by: Teddy Astie Reviewed-by: Anthony PERARD --- tools/xentrace/xenalyze.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/xentrace/xenalyze.c b/tools/xentrace/xenalyze.c index 42feeb282e..439066e352 100644 --- a/tools/xentrace/xenalyze.c +++ b/tools/xentrace/xenalyze.c @@ -8039,12 +8039,13 @@ void sched_process(struct pcpu_info *p) if(opt.dump_all) { struct { unsigned int vcpuid:16, domid:16; + uint32_t priority_level; uint64_t cur_dl, cur_bg; } __attribute__((packed)) *r = (typeof(r))ri->d; printf(" %s rtds:repl_budget d%uv%u, deadline = %"PRIu64", " - "budget = %"PRIu64"\n", ri->dump_header, - r->domid, r->vcpuid, r->cur_dl, r->cur_bg); + "budget = %"PRIu64", priority = %u\n", ri->dump_header, + r->domid, r->vcpuid, r->cur_dl, r->cur_bg, r->priority_level); } break; case TRC_SCHED_CLASS_EVT(RTDS, 5): /* SCHED_TASKLET */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 09:55:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 09:55:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369020.1617993 (Exim 4.92) (envelope-from ) id 1wmq9E-0000WY-N1; Thu, 23 Jul 2026 09:55:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369020.1617993; Thu, 23 Jul 2026 09:55:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq9E-0000WQ-KV; Thu, 23 Jul 2026 09:55:24 +0000 Received: by outflank-mailman (input) for mailman id 1369020; Thu, 23 Jul 2026 09:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq9C-0000WJ-QI for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmq9D-004ENO-0A for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmq9C-00FEHm-2M for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NwqfMTdo+nlcEJ0QyqgZVPTagyIsrf5U0SphanPyqYY=; b=0Fy1S+0AwLqEQeh2uMOOBd1Rgm qC/YygzewJDNf+nMGJc8ybNCAMCFE2w+KG2D8ymLVi8CWVfuidYdYVjunRwbXp4gntjg8KpI5pG9N YGcjh8oATlZ1vPlgKs9HKkEAgrE3fAJ/Pg8vnyn5NVnUmL1cyYJzm5B7+dN/GVx+oLIQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] MAINTAINERS: add xenstore related docs to the Xenstore entry Message-Id: Date: Thu, 23 Jul 2026 09:55:22 +0000 commit 251e43c932c73b036aa805b9d64a263ade66d155 Author: Juergen Gross AuthorDate: Thu Jul 23 10:20:34 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:34 2026 +0200 MAINTAINERS: add xenstore related docs to the Xenstore entry Xenstore related docs should be covered by the Xenstore MAINTAINERS entry. Signed-off-by: Juergen Gross Acked-by: Jan Beulich --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 6bb0662116..ed0ffa608f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -659,6 +659,7 @@ XENSTORE M: Juergen Gross R: Julien Grall S: Supported +F: docs/*/xenstore* F: tools/helpers/init-xenstore-domain.c F: tools/include/xenstore-compat/ F: tools/include/xenstore.h -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 09:55:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 09:55:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369021.1617997 (Exim 4.92) (envelope-from ) id 1wmq9O-0000YS-OJ; Thu, 23 Jul 2026 09:55:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369021.1617997; Thu, 23 Jul 2026 09:55:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq9O-0000YK-Lp; Thu, 23 Jul 2026 09:55:34 +0000 Received: by outflank-mailman (input) for mailman id 1369021; Thu, 23 Jul 2026 09:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmq9M-0000YD-Sq for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmq9N-004ENS-0S for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmq9M-00FEXx-2g for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 09:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=40bSqqIXMmJL57DN76n42PKO2Xpx89ztLn9J7s62VFE=; b=ck9sDqiijyEU8B6f0EDesSJTGP 3quUq3TBq9xFKJcs3bq1weI3jIJIreLbphWW5kpWtJCmvMXusaOh+R1nke14DI+bFs24bgLiRXKKz MiLQaYdaEkONPvkwoe9o/NZyhl3oj72sxm7M2QnoO/zaOUIRRvGtSqGWKjmqcIhRZVXU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xenstore-paths: Specify ipvX/$INDEX/prefix Message-Id: Date: Thu, 23 Jul 2026 09:55:32 +0000 commit 644ea6f84510af27ee1847e981df945a94068479 Author: Tu Dinh AuthorDate: Thu Jul 23 10:20:45 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:45 2026 +0200 xenstore-paths: Specify ipvX/$INDEX/prefix In the guest-reported IP address in xenstore, it's useful to know which subnet it belongs to. Add a specification for a subkey of each IP address, containing that address's subnet prefix. Signed-off-by: Tu Dinh Reviewed-by: Juergen Gross --- docs/misc/xenstore-paths.pandoc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/misc/xenstore-paths.pandoc b/docs/misc/xenstore-paths.pandoc index 4994194e2b..b8b02e007a 100644 --- a/docs/misc/xenstore-paths.pandoc +++ b/docs/misc/xenstore-paths.pandoc @@ -564,6 +564,16 @@ address written in one of these paths to, for example, establish a VNC session to the guest (although clearly some level of trust is placed in the value supplied by the guest in this case). +#### ~/attr/vif/$DEVID/ipv4/$INDEX/prefix = INTEGER [w] +#### ~/attr/vif/$DEVID/ipv6/$INDEX/prefix = INTEGER [w] + +Paths of this form may be written by the guest to indicate the network +prefix length of the IP address at the corresponding $INDEX. + +An IPv4 prefix value can be in the range of 0 to 32. + +An IPv6 prefix value can be in the range of 0 to 128. + #### ~/error [w] A domain writable path used by some PV drivers to pass error messages -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 11:11:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 11:11:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369054.1618002 (Exim 4.92) (envelope-from ) id 1wmrKS-0001Hc-L1; Thu, 23 Jul 2026 11:11:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369054.1618002; Thu, 23 Jul 2026 11:11:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKS-0001HU-Hr; Thu, 23 Jul 2026 11:11:04 +0000 Received: by outflank-mailman (input) for mailman id 1369054; Thu, 23 Jul 2026 11:11:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKR-0001HO-KF for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmrKR-004G87-2d for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmrKR-00HLYZ-1L for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ymUmJ4+lESFP5/PDj+5n2SWrPvQGkMH4Ey6M1cLA7/0=; b=DvD13ZzkO/ahwW3+m+YeqGGY73 N8n10/9zRGQa2htKK1eSOhkiDQV1fSCGWqIVLqedZz61kQJ8PAPk/O91QtqWBoMIWS7HeIv2qq4E5 b8pW+VxbBHL76iCxm9TbDW+9wZjDUssGrDZqnDnwKK6x5rcNfEY72n/uChfKUxMaP0UM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Thu, 23 Jul 2026 11:11:03 +0000 commit f795a9c491a704b6cd6ca0381b033e6beb692cb3 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 09:03:17 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 65aea71c43..751f2f42fb 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -191,20 +191,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -213,7 +218,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -222,13 +227,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 11:11:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 11:11:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369055.1618005 (Exim 4.92) (envelope-from ) id 1wmrKd-0001JG-M2; Thu, 23 Jul 2026 11:11:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369055.1618005; Thu, 23 Jul 2026 11:11:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKd-0001J6-JF; Thu, 23 Jul 2026 11:11:15 +0000 Received: by outflank-mailman (input) for mailman id 1369055; Thu, 23 Jul 2026 11:11:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKb-0001Is-PE for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmrKc-004G8R-06 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmrKb-00HMD8-2K for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NFPvMyF3hQD6zTByiBiZdPY/SJMSHpJIkbshTIrlOXA=; b=uQBQEFevh14YF2bug6bQ9YLqCF 7X0meaxdf63H+Bf5xfojaqCZdcVeVasQjVC2YOSpRRkL511zZW0fxt3p53ggUswWxTbLOt17Tv56s V1oanxBV2oF7a+olcK/swq+FAXj5xViNOqp7kusP/GSsHr9h/gzB5z+1QTroj1vRTc9A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/mm: reset PFN_ORDER for offlined buddy heads Message-Id: Date: Thu, 23 Jul 2026 11:11:13 +0000 commit 14c05f26f89d2c1244b02b8071cf22ad7e7208d9 Author: Bernhard Kaindl AuthorDate: Thu Jul 23 10:19:43 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:19:43 2026 +0200 xen/mm: reset PFN_ORDER for offlined buddy heads Ensure offlined buddy head pages are annotated as order-0 pages. When a buddy containing pages marked for offlining is processed, reserve_offlined_page() rebuilds any surviving healthy buddies and moves the offlined subpages onto the offlined lists. If the buddy head itself is offlined it was previously left annotated with the original buddy order even though it has been split into a single page. This has no functional impact as the order of an offlined page is not used for any decision making and onlining, but it is misleading when inspecting the page's metadata. Set PFN_ORDER(cur_head) to 0 for all pages moved to the lists of offlined and broken pages so the page's stored order reflects its actual size. Signed-off-by: Bernhard Kaindl Reviewed-by: Jan Beulich --- xen/common/page_alloc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 40b0f73563..40fdb5fb98 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1251,6 +1251,12 @@ static int reserve_offlined_page(struct page_info *head) ASSERT(total_avail_pages > 0); total_avail_pages--; + /* + * All offlined pages are standalone pages: If this offlined page was + * the head of a higher-order buddy, reset its order to 0. + */ + PFN_ORDER(cur_head) = 0; + page_list_add_tail(cur_head, test_bit(_PGC_broken, &cur_head->count_info) ? &page_broken_list : &page_offlined_list); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 11:11:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 11:11:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369056.1618009 (Exim 4.92) (envelope-from ) id 1wmrKn-0001LO-No; Thu, 23 Jul 2026 11:11:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369056.1618009; Thu, 23 Jul 2026 11:11:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKn-0001LG-Kh; Thu, 23 Jul 2026 11:11:25 +0000 Received: by outflank-mailman (input) for mailman id 1369056; Thu, 23 Jul 2026 11:11:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKl-0001L9-So for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmrKm-004G8Z-0R for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmrKl-00HMKT-2e for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AVs73ooOhQiUxYwZJgLlwab+5nF+UM8LMP8Pph9Kek0=; b=017MqSeYmelD0lFdLtkyIjjF9u P6wB+lAAR3i2wAxzZ7+dVGpfRQDPYDxkfn0PW0iBs5c51SbvOMi3XQpxK0zd82XUfblQDgsmwhjU1 o442PsCNCcCbFn4xJGOsNaDeYBoh7SYceIEM/tjdW8InlntRbnVykhrpExmeatoHyhco=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/xentrace: decode RTDS priority in repl_budget records Message-Id: Date: Thu, 23 Jul 2026 11:11:23 +0000 commit 2fe6a869da52031a7726bf888e6c5c189750124f Author: Ryoji Okamoto AuthorDate: Thu Jul 23 10:20:08 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:08 2026 +0200 tools/xentrace: decode RTDS priority in repl_budget records The RTDS repl_budget trace record now contains the vCPU priority level. Update xenalyze to account for the additional field and print it when dumping the trace event. Without this change, xenalyze interprets the record using the old layout, causing the deadline and budget fields to be decoded from the wrong offsets. Fixes: 463b95831778 ("xen:rtds: towards work conserving RTDS") Signed-off-by: Ryoji Okamoto Reviewed-by: Teddy Astie Reviewed-by: Anthony PERARD --- tools/xentrace/xenalyze.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/xentrace/xenalyze.c b/tools/xentrace/xenalyze.c index 42feeb282e..439066e352 100644 --- a/tools/xentrace/xenalyze.c +++ b/tools/xentrace/xenalyze.c @@ -8039,12 +8039,13 @@ void sched_process(struct pcpu_info *p) if(opt.dump_all) { struct { unsigned int vcpuid:16, domid:16; + uint32_t priority_level; uint64_t cur_dl, cur_bg; } __attribute__((packed)) *r = (typeof(r))ri->d; printf(" %s rtds:repl_budget d%uv%u, deadline = %"PRIu64", " - "budget = %"PRIu64"\n", ri->dump_header, - r->domid, r->vcpuid, r->cur_dl, r->cur_bg); + "budget = %"PRIu64", priority = %u\n", ri->dump_header, + r->domid, r->vcpuid, r->cur_dl, r->cur_bg, r->priority_level); } break; case TRC_SCHED_CLASS_EVT(RTDS, 5): /* SCHED_TASKLET */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 11:11:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 11:11:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369057.1618013 (Exim 4.92) (envelope-from ) id 1wmrKx-0001Ns-Qc; Thu, 23 Jul 2026 11:11:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369057.1618013; Thu, 23 Jul 2026 11:11:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKx-0001Nh-No; Thu, 23 Jul 2026 11:11:35 +0000 Received: by outflank-mailman (input) for mailman id 1369057; Thu, 23 Jul 2026 11:11:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrKw-0001Na-27 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmrKw-004G8d-10 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmrKv-00HMYB-35 for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zkjQlBICJLMm3tsF2rAzlHd+B1S83BeuJsizpqcyaF0=; b=j15k9z2yN/m+eXlepTuNLFBep3 bImDBnzJkuzP42Bx3aCPL5+qqYrg9I7m56WIQbgU4mShmrwIbe99W5d4ANXENZl/d06Zz96Se7+8t h5Rop15/A+Ud5LV1qvBM6g39igO6Qve919ROel/SYU+16jAt9AAvwiW1NOCQp4ldMR6M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] MAINTAINERS: add xenstore related docs to the Xenstore entry Message-Id: Date: Thu, 23 Jul 2026 11:11:33 +0000 commit 251e43c932c73b036aa805b9d64a263ade66d155 Author: Juergen Gross AuthorDate: Thu Jul 23 10:20:34 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:34 2026 +0200 MAINTAINERS: add xenstore related docs to the Xenstore entry Xenstore related docs should be covered by the Xenstore MAINTAINERS entry. Signed-off-by: Juergen Gross Acked-by: Jan Beulich --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 6bb0662116..ed0ffa608f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -659,6 +659,7 @@ XENSTORE M: Juergen Gross R: Julien Grall S: Supported +F: docs/*/xenstore* F: tools/helpers/init-xenstore-domain.c F: tools/include/xenstore-compat/ F: tools/include/xenstore.h -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Thu Jul 23 11:11:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 23 Jul 2026 11:11:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369058.1618017 (Exim 4.92) (envelope-from ) id 1wmrL7-0001Pi-Rw; Thu, 23 Jul 2026 11:11:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369058.1618017; Thu, 23 Jul 2026 11:11:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrL7-0001Pa-P7; Thu, 23 Jul 2026 11:11:45 +0000 Received: by outflank-mailman (input) for mailman id 1369058; Thu, 23 Jul 2026 11:11:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wmrL6-0001PU-5p for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wmrL6-004G8h-1L for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wmrL6-00HMoT-0I for xen-changelog@lists.xenproject.org; Thu, 23 Jul 2026 11:11:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hYTu/zIs+1RtgY40fNWGL2fgKbwaj/Ww2e0gWMjOxcM=; b=5rsMfM2I2cwgOPYcKgkOnD2gcU VyyjrMZpfN+EHokN1Bx60WX1jP8zNsui0y+YRm0x5aeQp/ziuTrhax1QMxibuqp6u7EqF6/Rnhbbn qKECmStI6UYx0UnkD9+wXYWTRBvQimK4qk6pZeFydzOjOkaCtq1c2dq8qsJRg5ilejvo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xenstore-paths: Specify ipvX/$INDEX/prefix Message-Id: Date: Thu, 23 Jul 2026 11:11:44 +0000 commit 644ea6f84510af27ee1847e981df945a94068479 Author: Tu Dinh AuthorDate: Thu Jul 23 10:20:45 2026 +0200 Commit: Jan Beulich CommitDate: Thu Jul 23 10:20:45 2026 +0200 xenstore-paths: Specify ipvX/$INDEX/prefix In the guest-reported IP address in xenstore, it's useful to know which subnet it belongs to. Add a specification for a subkey of each IP address, containing that address's subnet prefix. Signed-off-by: Tu Dinh Reviewed-by: Juergen Gross --- docs/misc/xenstore-paths.pandoc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/misc/xenstore-paths.pandoc b/docs/misc/xenstore-paths.pandoc index 4994194e2b..b8b02e007a 100644 --- a/docs/misc/xenstore-paths.pandoc +++ b/docs/misc/xenstore-paths.pandoc @@ -564,6 +564,16 @@ address written in one of these paths to, for example, establish a VNC session to the guest (although clearly some level of trust is placed in the value supplied by the guest in this case). +#### ~/attr/vif/$DEVID/ipv4/$INDEX/prefix = INTEGER [w] +#### ~/attr/vif/$DEVID/ipv6/$INDEX/prefix = INTEGER [w] + +Paths of this form may be written by the guest to indicate the network +prefix length of the IP address at the corresponding $INDEX. + +An IPv4 prefix value can be in the range of 0 to 32. + +An IPv6 prefix value can be in the range of 0 to 128. + #### ~/error [w] A domain writable path used by some PV drivers to pass error messages -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Fri Jul 24 10:22:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 24 Jul 2026 10:22:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369940.1618391 (Exim 4.92) (envelope-from ) id 1wnD2Y-0000Ab-V0; Fri, 24 Jul 2026 10:22:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369940.1618391; Fri, 24 Jul 2026 10:22:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2Y-0000AT-Rg; Fri, 24 Jul 2026 10:22:02 +0000 Received: by outflank-mailman (input) for mailman id 1369940; Fri, 24 Jul 2026 10:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2X-0000AN-O9 for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wnD2X-0063de-3B for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wnD2X-004uDD-1x for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=j30tzhanHd1QDXPwHQu2qwEtEYNuVbMCcgiABT2x7tQ=; b=rdcXnQ0EX1tNQQmFmt7s/McJH5 dLm4am3M4sjLaNxw0XlMqA5TqqYEV4ZuCkGqrnCKilBd+dyK4oOlMM8rbCQI5Qs8pgM2a1lDitJ+m 0ZnKEouHEbYSk3EY3esD082rZAi5YPtvsSpc4WiEF+Kox5ud0l1UoUBlu2EAprJiHxn8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Fri, 24 Jul 2026 10:22:01 +0000 commit c8e99384ac8e4389ec5776f767899961521f10a9 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:19:37 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 65aea71c43..751f2f42fb 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -191,20 +191,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -213,7 +218,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -222,13 +227,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Fri Jul 24 10:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 24 Jul 2026 10:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369941.1618394 (Exim 4.92) (envelope-from ) id 1wnD2i-0000Cc-Vn; Fri, 24 Jul 2026 10:22:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369941.1618394; Fri, 24 Jul 2026 10:22:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2i-0000CV-T4; Fri, 24 Jul 2026 10:22:12 +0000 Received: by outflank-mailman (input) for mailman id 1369941; Fri, 24 Jul 2026 10:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2i-0000CM-67 for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wnD2i-0063di-1O for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wnD2i-004ubw-0L for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=h5yZXIONuIAU9OGTrYleKfKGPdSE9vQQCagHv4WuRZQ=; b=C1+Nzzw7o0f2iruI+CXkI0tOqF 2qShLPUr0ay1JogCwikZ5dDePbYjIux5kn7POop+5jE4FMf7NQDKRTGEsvNl/rHVBYh3D0hh5PeOB EGsgbNapu4CuaBPub2Y/foeQI+nhf5DTVA4IrxeAqzJd9ZlNzpKMmL4qNiEO/1bAm4OA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Fri, 24 Jul 2026 10:22:12 +0000 commit ade0c357771e1eccc08c0c459d23fb19ff4933a9 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:19:48 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 9281dc8330..a60a9e6f4a 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -149,20 +149,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -171,7 +176,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -180,13 +185,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Fri Jul 24 10:22:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 24 Jul 2026 10:22:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369942.1618398 (Exim 4.92) (envelope-from ) id 1wnD2u-0000GA-1K; Fri, 24 Jul 2026 10:22:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369942.1618398; Fri, 24 Jul 2026 10:22:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2t-0000G1-Ua; Fri, 24 Jul 2026 10:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1369942; Fri, 24 Jul 2026 10:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnD2s-0000Fv-SS for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wnD2t-0063dm-0N for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wnD2s-004uws-2T for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 10:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/+eaZkD6iIT4ilcmH/Y3DrZSeLdAEouL8jtha8XTlkg=; b=ZtcucFcPS1LECIkEqaB4D7OEoS QO2JjOc7GHBVX8gPqlWrM6TYZpEiXoFiHjpLNQj2U58XyGxkCb3TFb6tV+8HagldP7WEPtdp9n5y7 GUh7kE+m8S2x2Yh9ruwji5QyDFGWsGzjdqdQ+GWPICJ4MVUCLzRWtfO8V0qjjuWKu/QI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Fri, 24 Jul 2026 10:22:22 +0000 commit 35b75699a12aa47e56049c87ad56c3a3c2dc67b2 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:20:00 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 4b391ac612..b9b641bf88 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -134,20 +134,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -156,7 +161,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -165,13 +170,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Fri Jul 24 11:44:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 24 Jul 2026 11:44:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1369974.1618411 (Exim 4.92) (envelope-from ) id 1wnEJw-0002Z8-Lw; Fri, 24 Jul 2026 11:44:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1369974.1618411; Fri, 24 Jul 2026 11:44:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnEJw-0002Z0-J5; Fri, 24 Jul 2026 11:44:04 +0000 Received: by outflank-mailman (input) for mailman id 1369974; Fri, 24 Jul 2026 11:44:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnEJv-0002Yu-6P for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 11:44:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wnEJv-0065QR-1E for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 11:44:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wnEJu-007201-36 for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 11:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=x+Yb1N6kDJrYj6TrRjnqXst0VIftphyCqsrF7qofwvc=; b=FqIfuTjdMTWkoA3Z7psubsbw9Q bKvXcnmjz1kfoGkNtEyF7K+mhJ80j4Z+7xpm1oNE7E0DcuYr44yBL2HEjsp1AtX1kn63AFfJ/PeoP udGHDT7iJgaId+XZyjxcjn4KEe2oa2SWwDHTeJqhP49aAN0jIg4bkhEUk6x093v0bYyc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Fri, 24 Jul 2026 11:44:02 +0000 commit c8e99384ac8e4389ec5776f767899961521f10a9 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:19:37 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 65aea71c43..751f2f42fb 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -191,20 +191,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -213,7 +218,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -222,13 +227,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Fri Jul 24 12:44:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 24 Jul 2026 12:44:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1370002.1618424 (Exim 4.92) (envelope-from ) id 1wnFG0-0004Df-0L; Fri, 24 Jul 2026 12:44:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1370002.1618424; Fri, 24 Jul 2026 12:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnFFz-0004DV-Tk; Fri, 24 Jul 2026 12:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1370002; Fri, 24 Jul 2026 12:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wnFFy-0004CK-BN for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 12:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wnFFy-0066mX-1q for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 12:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wnFFy-007XXC-0i for xen-changelog@lists.xenproject.org; Fri, 24 Jul 2026 12:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PNUGlv5G5SsSQfrowUvGE0qMqX9culwQCrb4h1Y+rEk=; b=P68+32QTccC88ij3l/uB0Uy+fa 4Mfmqac+XGk/f3rtFpyyeJcbF7l7JNndzH5dRJCUeYenwswVeSUl/W2dF8UgMwza0v8XNkenykFfx Mo2PoYkvNxvRvpuq19PpPAaqkhhCklTaos4pcHhumVYfbi4YP09kcyYYKShYDr8xeziM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Fri, 24 Jul 2026 12:44:02 +0000 commit ade0c357771e1eccc08c0c459d23fb19ff4933a9 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:19:48 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 9281dc8330..a60a9e6f4a 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -149,20 +149,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -171,7 +176,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -180,13 +185,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Mon Jul 27 06:11:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Mon, 27 Jul 2026 06:11:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1371427.1618944 (Exim 4.92) (envelope-from ) id 1woEYJ-0008BV-3K; Mon, 27 Jul 2026 06:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1371427.1618944; Mon, 27 Jul 2026 06:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woEYJ-0008BM-0e; Mon, 27 Jul 2026 06:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1371427; Mon, 27 Jul 2026 06:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woEYI-0008BG-Hb for xen-changelog@lists.xenproject.org; Mon, 27 Jul 2026 06:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woEYI-00BQ2r-1q for xen-changelog@lists.xenproject.org; Mon, 27 Jul 2026 06:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woEYI-00EeSS-0i for xen-changelog@lists.xenproject.org; Mon, 27 Jul 2026 06:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XcEWlcVbOQBzdjEgxD2PH+a9X2RvvHvDVVfo0xFXYOo=; b=UastETKbnLeWWjuTBuSL1IFqvC kHpIP5cjO8QYio8t7+a8xl72IbK6XHl3pX9tBCqA5TIqkyNcnh5j+19PcoAOJHLaF+bLBBuercVPF KXOJRNQAlCpfiuNNy5YhG/ytIRLTzBExf+iIjYFlMotVU3Jy4WvxmsufFXJqYhptxmf8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() Message-Id: Date: Mon, 27 Jul 2026 06:11:02 +0000 commit 35b75699a12aa47e56049c87ad56c3a3c2dc67b2 Author: Oleksandr Tyshchenko AuthorDate: Tue Jul 14 19:16:56 2026 +0000 Commit: Michal Orzel CommitDate: Thu Jul 23 14:20:00 2026 +0200 xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one() A privileged domain on Arm64 can trigger a data abort in the hypervisor by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO. get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then attempts to walk dom_io's P2M table, which is not initialized for pseudo-domains, resulting in a data abort in p2m_get_entry() when it dereferences the invalid pointer returned by p2m_get_root_pointer(). Replace get_pg_owner() with explicit domain lookup logic matching the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen), and resolve all other domain IDs via rcu_lock_remote_domain_by_id(), which rejects pseudo-domains (DOMID_IO, etc.) that are not present in the domain hash, returning -ESRCH before any P2M access occurs. Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Michal Orzel Release-Acked-by: Oleksii Kurochko (cherry picked from commit f795a9c491a704b6cd6ca0381b033e6beb692cb3) --- xen/arch/arm/mm.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 4b391ac612..b9b641bf88 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -134,20 +134,25 @@ int xenmem_add_to_physmap_one( struct domain *od; p2m_type_t p2mt; - od = get_pg_owner(extra.foreign_domid); - if ( od == NULL ) - return -ESRCH; - - if ( od == d ) + if ( extra.foreign_domid == DOMID_XEN ) + od = rcu_lock_domain(dom_xen); + else { - put_pg_owner(od); - return -EINVAL; + rc = rcu_lock_remote_domain_by_id(extra.foreign_domid, &od); + if ( rc ) + return rc; + + if ( od == d ) + { + rcu_unlock_domain(od); + return -EINVAL; + } } rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); if ( rc ) { - put_pg_owner(od); + rcu_unlock_domain(od); return rc; } @@ -156,7 +161,7 @@ int xenmem_add_to_physmap_one( page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC); if ( !page ) { - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } @@ -165,13 +170,13 @@ int xenmem_add_to_physmap_one( else { put_page(page); - put_pg_owner(od); + rcu_unlock_domain(od); return -EINVAL; } mfn = page_to_mfn(page); - put_pg_owner(od); + rcu_unlock_domain(od); break; } case XENMAPSPACE_dev_mmio: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 09:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 09:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372301.1619658 (Exim 4.92) (envelope-from ) id 1woeBM-00030w-3U; Tue, 28 Jul 2026 09:33:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372301.1619658; Tue, 28 Jul 2026 09:33:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBM-00030o-0Y; Tue, 28 Jul 2026 09:33:04 +0000 Received: by outflank-mailman (input) for mailman id 1372301; Tue, 28 Jul 2026 09:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBK-00030i-Sg for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woeBK-00DLbW-2C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woeBK-002jLF-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lzKws7bmY+tpINQFlEuxycbJ6VPQpgFD8U1euaZ0THc=; b=y9qfUvdQTS4e1b5xhwWSOs09EI C9aZdAtys+iDXMJvtaYvOBj9nLQKvLeH7k+wY2K+jqva24vRkpaXxB7354vopF6GoW4zTitxgIxW6 xCvOL3cZVp2Kp/tTafnNkT7l4ITdXcsmgdDOTY38BpSZzJDRn0+izWyfv3qvAGZM7j/M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: support non-SIMD MOVRS Message-Id: Date: Tue, 28 Jul 2026 09:33:02 +0000 commit 59b18eb757dbed47764926ab9adf2ce630b60de2 Author: Jan Beulich AuthorDate: Tue Jul 28 10:07:13 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:07:13 2026 +0200 x86emul: support non-SIMD MOVRS As we ignore cachability aspects of insns, they're treated like simple MOVs. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- tools/tests/x86_emulator/predicates.c | 3 +++ tools/tests/x86_emulator/test_x86_emulator.c | 23 +++++++++++++++++++++++ xen/arch/x86/x86_emulate/decode.c | 10 +++++++++- xen/arch/x86/x86_emulate/private.h | 1 + xen/arch/x86/x86_emulate/x86_emulate.c | 10 ++++++++++ xen/include/public/arch-x86/cpufeatureset.h | 1 + xen/tools/gen-cpuid.py | 2 +- 7 files changed, 48 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index 84717d3ebe..6c6d0f386c 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -841,6 +841,9 @@ static const struct { { { 0x80 }, { 2, 2 }, T, R, pfx_66 }, /* invept */ { { 0x81 }, { 2, 2 }, T, R, pfx_66 }, /* invvpid */ { { 0x82 }, { 2, 2 }, T, R, pfx_66 }, /* invpcid */ + { { 0x8a }, { 2, 2 }, T, R, pfx_no }, /* movrsb */ + { { 0x8b }, { 2, 2 }, T, R, pfx_no }, /* movrs{d,q} */ + { { 0x8b }, { 2, 2 }, T, R, pfx_66 }, /* movrsw */ { { 0xc8 }, { 2, 2 }, T, R, pfx_no }, /* sha1nexte */ { { 0xc9 }, { 2, 2 }, T, R, pfx_no }, /* sha1msg1 */ { { 0xca }, { 2, 2 }, T, R, pfx_no }, /* sha1msg2 */ diff --git a/tools/tests/x86_emulator/test_x86_emulator.c b/tools/tests/x86_emulator/test_x86_emulator.c index af29b106f1..31391f1bf7 100644 --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -1704,6 +1704,29 @@ int main(int argc, char **argv) } else printf("skipped\n"); + + { + /* For the non-SIMD forms the emulator doesn't itself use MOVRS. */ + bool movrs = cpu_policy.feat.movrs; + + cpu_policy.feat.movrs = true; + + printf("%-40s", "Testing movrs 6(%rdi),%si..."); + instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0x38; + instr[3] = 0x8b; instr[4] = 0x77; instr[5] = 0x06; + regs.rip = (unsigned long)&instr[0]; + regs.rsi = 0x8888777766665555UL; + regs.rdi = (unsigned long)res; + res[1] = 0x88777788U; + rc = x86_emulate(&ctxt, &emulops); + if ( (rc != X86EMUL_OKAY) || + (regs.rip != (unsigned long)&instr[6]) || + (regs.rsi != 0x8888777766668877UL) ) + goto fail; + printf("okay\n"); + + cpu_policy.feat.movrs = movrs; + } #endif /* x86-64 */ printf("%-40s", "Testing shld $1,%ecx,(%edx)..."); diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index d1665e6eb3..48e8c79964 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -902,7 +902,8 @@ decode_0f38(struct x86_emulate_state *s, { switch ( ctxt->opcode & X86EMUL_OPC_MASK ) { - case 0x00 ... 0xef: + case 0x00 ... 0x89: + case 0x8c ... 0xef: case 0xf2 ... 0xf5: case 0xf7 ... 0xf8: case 0xfa ... 0xff: @@ -913,6 +914,13 @@ decode_0f38(struct x86_emulate_state *s, ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK); break; + case 0x8a ... 0x8b: /* movrs */ + s->desc = DstReg | SrcMem | Mov; + if ( !(ctxt->opcode & 1) ) + s->desc |= ByteOp; + s->simd_size = simd_none; + break; + case X86EMUL_OPC_VEX_66(0, 0x2d): /* vmaskmovpd */ s->simd_size = simd_packed_fp; break; diff --git a/xen/arch/x86/x86_emulate/private.h b/xen/arch/x86/x86_emulate/private.h index 6c96f72327..1b06c60248 100644 --- a/xen/arch/x86/x86_emulate/private.h +++ b/xen/arch/x86/x86_emulate/private.h @@ -612,6 +612,7 @@ amd_like(const struct x86_emulate_ctxt *ctxt) #define vcpu_has_lkgs() (ctxt->cpuid->feat.lkgs) #define vcpu_has_wrmsrns() (ctxt->cpuid->feat.wrmsrns) #define vcpu_has_avx_ifma() (ctxt->cpuid->feat.avx_ifma) +#define vcpu_has_movrs() (ctxt->cpuid->feat.movrs) #define vcpu_has_avx_vnni_int8() (ctxt->cpuid->feat.avx_vnni_int8) #define vcpu_has_avx_ne_convert() (ctxt->cpuid->feat.avx_ne_convert) #define vcpu_has_avx_vnni_int16() (ctxt->cpuid->feat.avx_vnni_int16) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index a4ba22ffb5..80742e50d4 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6375,6 +6375,16 @@ x86_emulate( fault_suppression = false; goto avx512f_no_sae; +#endif /* !X86EMUL_NO_SIMD */ + + case X86EMUL_OPC(0x0f38, 0x8a) + ... X86EMUL_OPC(0x0f38, 0x8b): /* movrs */ + vcpu_must_have(movrs); + dst.val = src.val; + break; + +#ifndef X86EMUL_NO_SIMD + case X86EMUL_OPC_VEX_66(0x0f38, 0x8c): /* vpmaskmov{d,q} mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x8e): /* vpmaskmov{d,q} {x,y}mm,{x,y}mm,mem */ generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h index ce4a7982a5..72c1bde7e6 100644 --- a/xen/include/public/arch-x86/cpufeatureset.h +++ b/xen/include/public/arch-x86/cpufeatureset.h @@ -319,6 +319,7 @@ XEN_CPUFEATURE(AVX_IFMA, 10*32+23) /*A AVX-IFMA Instructions */ XEN_CPUFEATURE(LAM, 10*32+26) /* Linear Address Masking */ XEN_CPUFEATURE(MSRLIST, 10*32+27) /* {RD,WR}MSRLIST instructions */ XEN_CPUFEATURE(NO_INVD, 10*32+30) /* INVD instruction unusable */ +XEN_CPUFEATURE(MOVRS, 10*32+31) /*a MOV-read-shared instructions */ /* AMD-defined CPU features, CPUID level 0x80000021.eax, word 11 */ XEN_CPUFEATURE(NO_NEST_BP, 11*32+ 0) /*A No Nested Data Breakpoints */ diff --git a/xen/tools/gen-cpuid.py b/xen/tools/gen-cpuid.py index a30c68b40a..749d3f4e09 100755 --- a/xen/tools/gen-cpuid.py +++ b/xen/tools/gen-cpuid.py @@ -283,7 +283,7 @@ def crunch_numbers(state): # NO_LMSL indicates the absense of Long Mode Segment Limits, which # have been dropped in hardware. LM: [CX16, PCID, LAHF_LM, PAGE1GB, PKU, NO_LMSL, AMX_TILE, CMPCCXADD, - LKGS], + LKGS, MOVRS], # AMD K6-2+ and K6-III processors shipped with 3DNow+, beyond the # standard 3DNow in the earlier K6 processors. -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 09:33:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 09:33:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372303.1619662 (Exim 4.92) (envelope-from ) id 1woeBW-00032s-4l; Tue, 28 Jul 2026 09:33:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372303.1619662; Tue, 28 Jul 2026 09:33:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBW-00032k-1t; Tue, 28 Jul 2026 09:33:14 +0000 Received: by outflank-mailman (input) for mailman id 1372303; Tue, 28 Jul 2026 09:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBU-00032K-HS for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woeBU-00DLba-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woeBU-002jLd-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=w1999VXBskqkru5XArmccRWRd0Wr2PyX32t50IqZd2c=; b=NJqhKbnixvr7mDvwdWWUbDY0Ja BC7wgJ+EgLBH2zd1Zzx9gJkPd9k5z1oak++opXtsytSrzAo+8LQHUL42j4wrtClpohTZBDNaugLB3 GkTCYOqmYrqivFn+v7h4qtHRqp6gdRpbZDn/aJiNeljZPeVPmyWDIT1hjLAaAc7PWdrM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/riscv: manage IRQ_DISABLED flag in APLIC irq enable/disable callbacks Message-Id: Date: Tue, 28 Jul 2026 09:33:12 +0000 commit 78607876a2e7858ea8e8586cc98b1abedbe4b631 Author: Oleksii Kurochko AuthorDate: Tue Jul 28 10:08:02 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:08:02 2026 +0200 xen/riscv: manage IRQ_DISABLED flag in APLIC irq enable/disable callbacks desc->status is only set once during setup_irq(), but interrupts can be enabled/disabled at runtime, so update it in the corresponding callbacks. For the purposes of the FENCE instruction, CSR read accesses are classified as device input (I) and CSR write accesses as device output (O), while the barriers used by spin locks (fence rw,rw) only order normal memory accesses. An explicit wmb() (fence ow,ow) is therefore added in aplic_irq_{enable,disable}() to order the desc->status update with respect to the IMSIC CSR write. Fixes: d4676a1398bc5 ("xen/riscv: implementation of aplic and imsic operations") Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/aplic.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c index 6a1255c5f4..9f023db5d5 100644 --- a/xen/arch/riscv/aplic.c +++ b/xen/arch/riscv/aplic.c @@ -134,6 +134,15 @@ static void cf_check aplic_irq_enable(struct irq_desc *desc) spin_lock(&aplic.lock); + desc->status &= ~IRQ_DISABLED; + /* + * wmb() (fence ow,ow) orders the ->status memory write (w) before the + * CSR write inside imsic_irq_enable() (device output, o on RISC-V). + * arch_lock_release_barrier() uses fence rw,rw which does not cover + * device output (o), so wmb() is required to close that gap. + */ + wmb(); + /* Enable interrupt in IMSIC */ imsic_irq_enable(desc->irq); @@ -161,6 +170,16 @@ static void cf_check aplic_irq_disable(struct irq_desc *desc) /* Disable interrupt in IMSIC */ imsic_irq_disable(desc->irq); + /* + * wmb() (fence ow,ow) ensures the CSR write (device output, o) inside + * imsic_irq_disable() is globally visible before ->status is marked + * IRQ_DISABLED. imsic_irq_disable()'s spin_unlock uses fence rw,rw + * which does not order device output (o) writes before subsequent + * memory writes (w), so an explicit wmb() is needed here. + */ + wmb(); + + desc->status |= IRQ_DISABLED; spin_unlock(&aplic.lock); } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 09:33:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 09:33:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372304.1619666 (Exim 4.92) (envelope-from ) id 1woeBg-000357-6E; Tue, 28 Jul 2026 09:33:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372304.1619666; Tue, 28 Jul 2026 09:33:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBg-000350-3M; Tue, 28 Jul 2026 09:33:24 +0000 Received: by outflank-mailman (input) for mailman id 1372304; Tue, 28 Jul 2026 09:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woeBe-00034t-Lh for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woeBe-00DLbg-2x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woeBe-002jM0-1t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 09:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=clTjg9kjFxWFNxGK1wqO32nZbCNrIv8CZ/1qyyaX53U=; b=k3FTgEgzDMI40nCBCyRHjrd94o lfzPQEq3crhODRumwifwcfta5d5V3R7s4A1Of8Qbjixxb3RBv3fxNLhfXuLDfcYabNDE7cIYhuB2f WnsrOtfN4sra6a/EuyiOaFpmufrd0cUTWtpMB2z/02ii/dbmGyXlj4mkPw9L9HJAkiX4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86emul: drop host_and_vcpu_must_have() Message-Id: Date: Tue, 28 Jul 2026 09:33:22 +0000 commit 25cf3956b2c631508554b77707dbfe12ebe3c80e Author: Jan Beulich AuthorDate: Tue Jul 28 10:16:00 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:16:00 2026 +0200 x86emul: drop host_and_vcpu_must_have() With CPU policy dependency logic now properly in place and working, and with us never enabling ISA bits in guest policies which the underlying hardware doesn't support, the dual checks aren't needed anymore. In turn, a number of cpu_has_* can then also go away, when their only user was the emulator code. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/include/asm/cpufeature.h | 51 ---- xen/arch/x86/x86_emulate/0f01.c | 2 +- xen/arch/x86/x86_emulate/0fc7.c | 6 +- xen/arch/x86/x86_emulate/fpu.c | 24 +- xen/arch/x86/x86_emulate/private.h | 20 -- xen/arch/x86/x86_emulate/x86_emulate.c | 410 ++++++++++++++++----------------- 6 files changed, 221 insertions(+), 292 deletions(-) diff --git a/xen/arch/x86/include/asm/cpufeature.h b/xen/arch/x86/include/asm/cpufeature.h index dcd223d84f..4933ad234f 100644 --- a/xen/arch/x86/include/asm/cpufeature.h +++ b/xen/arch/x86/include/asm/cpufeature.h @@ -126,28 +126,18 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_pge 1 #define cpu_has_pse36 boot_cpu_has(X86_FEATURE_PSE36) #define cpu_has_clflush boot_cpu_has(X86_FEATURE_CLFLUSH) -#define cpu_has_mmx 1 #define cpu_has_htt boot_cpu_has(X86_FEATURE_HTT) /* CPUID level 0x00000001.ecx */ -#define cpu_has_sse3 boot_cpu_has(X86_FEATURE_SSE3) -#define cpu_has_pclmulqdq boot_cpu_has(X86_FEATURE_PCLMULQDQ) #define cpu_has_monitor boot_cpu_has(X86_FEATURE_MONITOR) #define cpu_has_vmx boot_cpu_has(X86_FEATURE_VMX) #define cpu_has_eist boot_cpu_has(X86_FEATURE_EIST) -#define cpu_has_ssse3 boot_cpu_has(X86_FEATURE_SSSE3) -#define cpu_has_fma boot_cpu_has(X86_FEATURE_FMA) #define cpu_has_cx16 boot_cpu_has(X86_FEATURE_CX16) #define cpu_has_pdcm boot_cpu_has(X86_FEATURE_PDCM) #define cpu_has_pcid boot_cpu_has(X86_FEATURE_PCID) -#define cpu_has_sse4_1 boot_cpu_has(X86_FEATURE_SSE4_1) -#define cpu_has_sse4_2 boot_cpu_has(X86_FEATURE_SSE4_2) #define cpu_has_x2apic boot_cpu_has(X86_FEATURE_X2APIC) -#define cpu_has_popcnt boot_cpu_has(X86_FEATURE_POPCNT) -#define cpu_has_aesni boot_cpu_has(X86_FEATURE_AESNI) #define cpu_has_xsave boot_cpu_has(X86_FEATURE_XSAVE) #define cpu_has_avx boot_cpu_has(X86_FEATURE_AVX) -#define cpu_has_f16c boot_cpu_has(X86_FEATURE_F16C) #define cpu_has_rdrand boot_cpu_has(X86_FEATURE_RDRAND) #define cpu_has_hypervisor boot_cpu_has(X86_FEATURE_HYPERVISOR) @@ -156,17 +146,11 @@ static inline bool boot_cpu_has(unsigned int feat) boot_cpu_has(X86_FEATURE_NX)) #define cpu_has_page1gb boot_cpu_has(X86_FEATURE_PAGE1GB) #define cpu_has_rdtscp boot_cpu_has(X86_FEATURE_RDTSCP) -#define cpu_has_3dnow_ext boot_cpu_has(X86_FEATURE_3DNOWEXT) -#define cpu_has_3dnow boot_cpu_has(X86_FEATURE_3DNOW) /* CPUID level 0x80000001.ecx */ #define cpu_has_cmp_legacy boot_cpu_has(X86_FEATURE_CMP_LEGACY) #define cpu_has_svm boot_cpu_has(X86_FEATURE_SVM) -#define cpu_has_sse4a boot_cpu_has(X86_FEATURE_SSE4A) -#define cpu_has_xop boot_cpu_has(X86_FEATURE_XOP) #define cpu_has_skinit boot_cpu_has(X86_FEATURE_SKINIT) -#define cpu_has_fma4 boot_cpu_has(X86_FEATURE_FMA4) -#define cpu_has_tbm boot_cpu_has(X86_FEATURE_TBM) /* CPUID level 0x00000006.eax */ #define cpu_has_turbo_boost host_cpu_policy.basic.turbo_boost @@ -190,43 +174,23 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_xsaves boot_cpu_has(X86_FEATURE_XSAVES) /* CPUID level 0x00000007:0.ebx */ -#define cpu_has_bmi1 boot_cpu_has(X86_FEATURE_BMI1) #define cpu_has_hle boot_cpu_has(X86_FEATURE_HLE) -#define cpu_has_avx2 boot_cpu_has(X86_FEATURE_AVX2) #define cpu_has_smep boot_cpu_has(X86_FEATURE_SMEP) -#define cpu_has_bmi2 boot_cpu_has(X86_FEATURE_BMI2) #define cpu_has_invpcid boot_cpu_has(X86_FEATURE_INVPCID) #define cpu_has_rtm boot_cpu_has(X86_FEATURE_RTM) #define cpu_has_pqe boot_cpu_has(X86_FEATURE_PQE) #define cpu_has_fpu_sel (!boot_cpu_has(X86_FEATURE_NO_FPU_SEL)) #define cpu_has_mpx boot_cpu_has(X86_FEATURE_MPX) #define cpu_has_avx512f boot_cpu_has(X86_FEATURE_AVX512F) -#define cpu_has_avx512dq boot_cpu_has(X86_FEATURE_AVX512DQ) -#define cpu_has_rdseed boot_cpu_has(X86_FEATURE_RDSEED) #define cpu_has_smap boot_cpu_has(X86_FEATURE_SMAP) -#define cpu_has_avx512_ifma boot_cpu_has(X86_FEATURE_AVX512_IFMA) #define cpu_has_clflushopt boot_cpu_has(X86_FEATURE_CLFLUSHOPT) #define cpu_has_clwb boot_cpu_has(X86_FEATURE_CLWB) -#define cpu_has_avx512cd boot_cpu_has(X86_FEATURE_AVX512CD) #define cpu_has_proc_trace boot_cpu_has(X86_FEATURE_PROC_TRACE) -#define cpu_has_sha boot_cpu_has(X86_FEATURE_SHA) #define cpu_has_avx512bw boot_cpu_has(X86_FEATURE_AVX512BW) -#define cpu_has_avx512vl boot_cpu_has(X86_FEATURE_AVX512VL) /* CPUID level 0x00000007:0.ecx */ -#define cpu_has_avx512_vbmi boot_cpu_has(X86_FEATURE_AVX512_VBMI) #define cpu_has_pku boot_cpu_has(X86_FEATURE_PKU) -#define cpu_has_avx512_vbmi2 boot_cpu_has(X86_FEATURE_AVX512_VBMI2) -#define cpu_has_gfni boot_cpu_has(X86_FEATURE_GFNI) -#define cpu_has_vaes boot_cpu_has(X86_FEATURE_VAES) -#define cpu_has_vpclmulqdq boot_cpu_has(X86_FEATURE_VPCLMULQDQ) -#define cpu_has_avx512_vnni boot_cpu_has(X86_FEATURE_AVX512_VNNI) -#define cpu_has_avx512_bitalg boot_cpu_has(X86_FEATURE_AVX512_BITALG) -#define cpu_has_avx512_vpopcntdq boot_cpu_has(X86_FEATURE_AVX512_VPOPCNTDQ) #define cpu_has_rdpid boot_cpu_has(X86_FEATURE_RDPID) -#define cpu_has_movdiri boot_cpu_has(X86_FEATURE_MOVDIRI) -#define cpu_has_movdir64b boot_cpu_has(X86_FEATURE_MOVDIR64B) -#define cpu_has_enqcmd boot_cpu_has(X86_FEATURE_ENQCMD) #define cpu_has_pks boot_cpu_has(X86_FEATURE_PKS) /* CPUID level 0x80000007.edx */ @@ -241,38 +205,23 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_auto_ibrs boot_cpu_has(X86_FEATURE_AUTO_IBRS) /* CPUID level 0x00000007:0.edx */ -#define cpu_has_avx512_vp2intersect boot_cpu_has(X86_FEATURE_AVX512_VP2INTERSECT) #define cpu_has_srbds_ctrl boot_cpu_has(X86_FEATURE_SRBDS_CTRL) #define cpu_has_md_clear boot_cpu_has(X86_FEATURE_MD_CLEAR) #define cpu_has_rtm_always_abort boot_cpu_has(X86_FEATURE_RTM_ALWAYS_ABORT) #define cpu_has_tsx_force_abort boot_cpu_has(X86_FEATURE_TSX_FORCE_ABORT) -#define cpu_has_serialize boot_cpu_has(X86_FEATURE_SERIALIZE) #define cpu_has_hybrid boot_cpu_has(X86_FEATURE_HYBRID) -#define cpu_has_avx512_fp16 boot_cpu_has(X86_FEATURE_AVX512_FP16) #define cpu_has_arch_caps boot_cpu_has(X86_FEATURE_ARCH_CAPS) /* CPUID level 0x00000007:1.eax */ -#define cpu_has_sha512 boot_cpu_has(X86_FEATURE_SHA512) -#define cpu_has_sm3 boot_cpu_has(X86_FEATURE_SM3) -#define cpu_has_sm4 boot_cpu_has(X86_FEATURE_SM4) -#define cpu_has_avx_vnni boot_cpu_has(X86_FEATURE_AVX_VNNI) -#define cpu_has_avx512_bf16 boot_cpu_has(X86_FEATURE_AVX512_BF16) -#define cpu_has_cmpccxadd boot_cpu_has(X86_FEATURE_CMPCCXADD) #define cpu_has_fred boot_cpu_has(X86_FEATURE_FRED) #define cpu_has_lkgs boot_cpu_has(X86_FEATURE_LKGS) #define cpu_has_nmi_src boot_cpu_has(X86_FEATURE_NMI_SRC) -#define cpu_has_avx_ifma boot_cpu_has(X86_FEATURE_AVX_IFMA) /* CPUID level 0x80000021.eax */ #define cpu_has_lfence_dispatch boot_cpu_has(X86_FEATURE_LFENCE_DISPATCH) #define cpu_has_verw_clear boot_cpu_has(X86_FEATURE_VERW_CLEAR) #define cpu_has_nscb boot_cpu_has(X86_FEATURE_NSCB) -/* CPUID level 0x00000007:1.edx */ -#define cpu_has_avx_vnni_int8 boot_cpu_has(X86_FEATURE_AVX_VNNI_INT8) -#define cpu_has_avx_ne_convert boot_cpu_has(X86_FEATURE_AVX_NE_CONVERT) -#define cpu_has_avx_vnni_int16 boot_cpu_has(X86_FEATURE_AVX_VNNI_INT16) - /* MSR_ARCH_CAPS */ #define cpu_has_rdcl_no boot_cpu_has(X86_FEATURE_RDCL_NO) #define cpu_has_eibrs boot_cpu_has(X86_FEATURE_EIBRS) diff --git a/xen/arch/x86/x86_emulate/0f01.c b/xen/arch/x86/x86_emulate/0f01.c index 87d338f0c7..36a8881410 100644 --- a/xen/arch/x86/x86_emulate/0f01.c +++ b/xen/arch/x86/x86_emulate/0f01.c @@ -121,7 +121,7 @@ int x86emul_0f01(struct x86_emulate_state *s, switch ( s->vex.pfx ) { case vex_none: /* serialize */ - host_and_vcpu_must_have(serialize); + vcpu_must_have(serialize); asm volatile ( ".byte 0x0f, 0x01, 0xe8" ); /* Binutils >= 2.34, Clang >= 11 */ break; case vex_f2: /* xsusldtrk */ diff --git a/xen/arch/x86/x86_emulate/0fc7.c b/xen/arch/x86/x86_emulate/0fc7.c index 58c8f79501..2d9c4e0e56 100644 --- a/xen/arch/x86/x86_emulate/0fc7.c +++ b/xen/arch/x86/x86_emulate/0fc7.c @@ -33,7 +33,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, case 6: /* rdrand */ generate_exception_if(s->vex.pfx >= vex_f3, X86_EXC_UD); - host_and_vcpu_must_have(rdrand); + vcpu_must_have(rdrand); *dst = s->ea; switch ( s->op_bytes ) { @@ -75,7 +75,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, } generate_exception_if(s->vex.pfx >= vex_f3, X86_EXC_UD); - host_and_vcpu_must_have(rdseed); + vcpu_must_have(rdseed); *dst = s->ea; switch ( s->op_bytes ) { @@ -112,7 +112,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, fail_if(!ops->cmpxchg); if ( s->rex_prefix & REX_W ) { - host_and_vcpu_must_have(cx16); + vcpu_must_have(cx16); generate_exception_if(!is_aligned(s->ea.mem.seg, s->ea.mem.off, 16, ctxt, ops), X86_EXC_GP, 0); diff --git a/xen/arch/x86/x86_emulate/fpu.c b/xen/arch/x86/x86_emulate/fpu.c index 9cc37a1d8e..88df238981 100644 --- a/xen/arch/x86/x86_emulate/fpu.c +++ b/xen/arch/x86/x86_emulate/fpu.c @@ -96,13 +96,13 @@ int x86emul_fpu(struct x86_emulate_state *s, unsigned long dummy; case 0x9b: /* wait/fwait */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_wait); emulate_fpu_insn_stub(b); break; case 0xd8: /* FPU 0xd8 */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -128,7 +128,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xd9: /* FPU 0xd9 */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -229,7 +229,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xda: /* FPU 0xda */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -250,7 +250,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdb: /* FPU 0xdb */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -279,7 +279,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fild m32i */ goto fpu_memsrc32; case 1: /* fisttp m32i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fist m32i */ case 3: /* fistp m32i */ @@ -308,7 +308,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdc: /* FPU 0xdc */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -334,7 +334,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdd: /* FPU 0xdd */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -353,7 +353,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fld m64fp */; goto fpu_memsrc64; case 1: /* fisttp m64i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fst m64fp */ case 3: /* fstp m64fp */ @@ -399,7 +399,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xde: /* FPU 0xde */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -421,7 +421,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdf: /* FPU 0xdf */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -451,7 +451,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fild m16i */ goto fpu_memsrc16; case 1: /* fisttp m16i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fist m16i */ case 3: /* fistp m16i */ diff --git a/xen/arch/x86/x86_emulate/private.h b/xen/arch/x86/x86_emulate/private.h index 1b06c60248..2d69c24b86 100644 --- a/xen/arch/x86/x86_emulate/private.h +++ b/xen/arch/x86/x86_emulate/private.h @@ -620,26 +620,6 @@ amd_like(const struct x86_emulate_ctxt *ctxt) #define vcpu_must_have(feat) \ generate_exception_if(!vcpu_has_##feat(), X86_EXC_UD) -#ifdef __XEN__ -/* - * Note the difference between vcpu_must_have() and - * host_and_vcpu_must_have(): The latter needs to be used when - * emulation code is using the same instruction class for carrying out - * the actual operation. - */ -# define host_and_vcpu_must_have(feat) ({ \ - generate_exception_if(!cpu_has_##feat, X86_EXC_UD); \ - vcpu_must_have(feat); \ -}) -#else -/* - * For the test harness both are fine to be used interchangeably, i.e. - * features known to always be available (e.g. SSE/SSE2) to (64-bit) Xen - * may be checked for by just vcpu_must_have(). - */ -# define host_and_vcpu_must_have(feat) vcpu_must_have(feat) -#endif - /* * Instruction emulation: * Most instructions are emulated directly via a fragment of inline assembly diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 80742e50d4..587e836d56 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1211,7 +1211,7 @@ static unsigned long *decode_vex_gpr( break; \ case 0: case 1: \ if ( !(lig) ) \ - host_and_vcpu_must_have(avx512vl); \ + vcpu_must_have(avx512vl); \ break; \ } \ } while ( false ) @@ -3269,15 +3269,15 @@ x86_emulate( #ifndef X86EMUL_NO_MMX case X86EMUL_OPC(0x0f, 0x0e): /* femms */ - host_and_vcpu_must_have(3dnow); + vcpu_must_have(3dnow); asm volatile ( "femms" ); break; case X86EMUL_OPC(0x0f, 0x0f): /* 3DNow! */ if ( _3dnow_table[(imm1 >> 4) & 0xf] & (1 << (imm1 & 0xf)) ) - host_and_vcpu_must_have(3dnow); + vcpu_must_have(3dnow); else if ( _3dnow_ext_table[(imm1 >> 4) & 0xf] & (1 << (imm1 & 0xf)) ) - host_and_vcpu_must_have(3dnow_ext); + vcpu_must_have(3dnow_ext); else generate_exception(X86_EXC_UD); @@ -3354,7 +3354,7 @@ x86_emulate( #endif CASE_SIMD_SCALAR_FP(, 0x0f, 0x2b): /* movnts{s,d} xmm,mem */ - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); /* fall through */ CASE_SIMD_PACKED_FP_VEX(0x0f, 0x2b): /* movntp{s,d} xmm,m128 */ /* vmovntp{s,d} {x,y}mm,mem */ @@ -3425,7 +3425,7 @@ x86_emulate( if ( (b & ~1) == 0x10 && ea.type == OP_MEM ) d |= TwoOp; simd_0f_avx: - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); simd_0f_ymm: get_fpu(X86EMUL_FPU_ymm); } @@ -3473,7 +3473,7 @@ x86_emulate( (ea.type != OP_REG && evex.brs && (evex.pfx & VEX_PREFIX_SCALAR_MASK))), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); simd_zmm: @@ -3529,7 +3529,7 @@ x86_emulate( generate_exception_if((evex.lr || evex.opmsk || evex.brs || evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( (d & DstMask) != DstMem ) d &= ~TwoOp; op_bytes = 8; @@ -3547,7 +3547,7 @@ x86_emulate( simd_0f_sse3_avx: if ( vex.opcx != vex_none ) goto simd_0f_avx; - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); goto simd_0f_xmm; case X86EMUL_OPC_EVEX_F3(0x0f, 0x12): /* vmovsldup [xyz]mm/mem,[xyz]mm{k} */ @@ -3556,7 +3556,7 @@ x86_emulate( generate_exception_if((evex.brs || evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); d |= TwoOp; op_bytes = !(evex.pfx & VEX_PREFIX_DOUBLE_MASK) || evex.lr @@ -3593,7 +3593,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x64): /* vpblendm{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x65): /* vblendmp{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ avx512f_no_sae: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_MEM && evex.brs, X86_EXC_UD); avx512_vlen_check(false); goto simd_zmm; @@ -3634,7 +3634,7 @@ x86_emulate( case X86EMUL_OPC(0x0f, 0x2a): /* cvtpi2ps mm/m64,xmm */ CASE_SIMD_PACKED_FP(, 0x0f, 0x2c): /* cvttp{s,d}2pi xmm/mem,mm */ CASE_SIMD_PACKED_FP(, 0x0f, 0x2d): /* cvtp{s,d}2pi xmm/mem,mm */ - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); } op_bytes = (b & 4) && (vex.pfx & VEX_PREFIX_DOUBLE_MASK) ? 16 : 8; goto simd_0f_fp; @@ -3652,7 +3652,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -3673,13 +3673,13 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x2a): /* vcvtsi2sh r/m,xmm,xmm */ case X86EMUL_OPC_EVEX_F3(5, 0x7b): /* vcvtusi2sh r/m,xmm,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); /* fall through */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2a): /* vcvtsi2s{s,d} r/m,xmm,xmm */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x7b): /* vcvtusi2s{s,d} r/m,xmm,xmm */ generate_exception_if(evex.opmsk || (ea.type != OP_REG && evex.brs), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -3734,7 +3734,7 @@ x86_emulate( else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); /* Work around erratum BT230. */ @@ -3792,7 +3792,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x2d): /* vcvtsh2si xmm/mem,reg */ case X86EMUL_OPC_EVEX_F3(5, 0x78): /* vcvttsh2usi xmm/mem,reg */ case X86EMUL_OPC_EVEX_F3(5, 0x79): /* vcvtsh2usi xmm/mem,reg */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); /* fall through */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2c): /* vcvtts{s,d}2si xmm/mem,reg */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2d): /* vcvts{s,d}2si xmm/mem,reg */ @@ -3802,7 +3802,7 @@ x86_emulate( evex.opmsk || (ea.type != OP_REG && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -3822,7 +3822,7 @@ x86_emulate( else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -3868,7 +3868,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(5, 0x2e): /* vucomish xmm/m16,xmm */ case X86EMUL_OPC_EVEX(5, 0x2f): /* vcomish xmm/m16,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ CASE_SIMD_PACKED_FP(_EVEX, 0x0f, 0x2e): /* vucomis{s,d} xmm/mem,xmm */ @@ -3877,7 +3877,7 @@ x86_emulate( (ea.type != OP_REG && evex.brs) || evex.w != evex.pfx), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -4021,7 +4021,7 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x4a): /* kadd{w,q} k,k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_VEX(0x0f, 0x41): /* kand{w,q} k,k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x41): /* kand{b,d} k,k,k */ @@ -4037,11 +4037,11 @@ x86_emulate( generate_exception_if(!vex.l, X86_EXC_UD); opmask_basic: if ( vex.w ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); opmask_common: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(!vex.r || (mode_64bit() && !(vex.reg & 8)) || ea.type != OP_REG, X86_EXC_UD); @@ -4066,7 +4066,7 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x4b): /* kunpck{w,d}{d,q} k,k,k */ generate_exception_if(!vex.l, X86_EXC_UD); - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); goto opmask_common; case X86EMUL_OPC_VEX_66(0x0f, 0x4b): /* kunpckbw k,k,k */ @@ -4101,7 +4101,7 @@ x86_emulate( { if ( b != 0x50 ) { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); } else @@ -4116,9 +4116,9 @@ x86_emulate( { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); if ( b == 0x50 || !vex.l ) - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); else - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); get_fpu(X86EMUL_FPU_ymm); } @@ -4138,7 +4138,7 @@ x86_emulate( generate_exception_if((evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK) || (ea.type != OP_MEM && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); avx512_vlen_check(false); goto simd_zmm; @@ -4177,12 +4177,12 @@ x86_emulate( case X86EMUL_OPC_EVEX_F2(0x0f, 0x7a): /* vcvtudq2ps [xyz]mm/mem,[xyz]mm{k} */ /* vcvtuqq2ps [xyz]mm/mem,{x,y}mm{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else { case X86EMUL_OPC_EVEX(0x0f, 0x78): /* vcvttp{s,d}2udq [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX(0x0f, 0x79): /* vcvtp{s,d}2udq [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); } if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -4348,14 +4348,14 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x45): /* vpsrlv{d,q} {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x47): /* vpsllv{d,q} {x,y}mm/mem,{x,y}mm,{x,y}mm */ simd_0f_avx2: - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); goto simd_0f_ymm; } if ( vex.pfx ) goto simd_0f_sse2; #endif /* !X86EMUL_NO_SIMD */ simd_0f_mmx: - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); goto simd_0f_common; @@ -4399,7 +4399,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x0b): /* vpmulhrsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x1c): /* vpabsb [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x1d): /* vpabsw [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << (b & 1); goto avx512f_no_sae; @@ -4431,7 +4431,7 @@ x86_emulate( generate_exception_if(b != 0x27 && evex.w != (b & 1), X86_EXC_UD); goto avx512f_no_sae; } - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << (ext == ext_0f ? b & 1 : evex.w); avx512_vlen_check(false); @@ -4462,7 +4462,7 @@ x86_emulate( if ( vex.opcx != vex_none ) { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -4472,7 +4472,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4504,7 +4504,7 @@ x86_emulate( dst.bytes = 2; /* fall through */ case X86EMUL_OPC_EVEX_66(5, 0x6e): /* vmovw r/m16,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f, 0x6e): /* vmov{d,q} r/m,xmm */ @@ -4512,7 +4512,7 @@ x86_emulate( generate_exception_if((evex.lr || evex.opmsk || evex.brs || evex.reg != 0xf || !evex.RX), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); opc = init_evex(stub); @@ -4570,7 +4570,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F2(0x0f, 0x6f): /* vmovdqu{8,16} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_F2(0x0f, 0x7f): /* vmovdqu{8,16} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); elem_bytes = 1 << evex.w; goto vmovdqa; @@ -4608,7 +4608,7 @@ x86_emulate( if ( vex.l ) { simd_0f_imm8_avx2: - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); } else { @@ -4622,7 +4622,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x40): /* vdpps $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ #endif simd_0f_imm8_avx: - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); } simd_0f_imm8_ymm: get_fpu(X86EMUL_FPU_ymm); @@ -4635,7 +4635,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); get_fpu(X86EMUL_FPU_mmx); } @@ -4663,7 +4663,7 @@ x86_emulate( generate_exception_if(evex.w, X86_EXC_UD); else { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); } d = (d & ~SrcMask) | SrcMem | TwoOp; @@ -4693,9 +4693,9 @@ x86_emulate( if ( vex.opcx != vex_none ) { if ( vex.l ) - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); else - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -4705,7 +4705,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4815,7 +4815,7 @@ x86_emulate( if ( vex.opcx != vex_none ) { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); #ifdef __x86_64__ @@ -4856,7 +4856,7 @@ x86_emulate( else #endif /* !X86EMUL_NO_SIMD */ { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4882,7 +4882,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f, 0x78): /* insertq $imm8,$imm8,xmm,xmm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); get_fpu(X86EMUL_FPU_xmm); opc = init_prefixes(stub); @@ -4896,7 +4896,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f, 0x79): /* extrq xmm,xmm */ case X86EMUL_OPC_F2(0x0f, 0x79): /* insertq xmm,xmm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); op_bytes = 8; goto simd_0f_xmm; @@ -4909,7 +4909,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f, 0xe6): /* vcvtdq2pd {x,y}mm/mem,[xyz]mm{k} */ /* vcvtqq2pd [xyz]mm/mem,[xyz]mm{k} */ if ( evex.pfx != vex_f3 ) - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); else if ( evex.w ) { case X86EMUL_OPC_EVEX_66(0x0f, 0x78): /* vcvttps2uqq {x,y}mm/mem,[xyz]mm{k} */ @@ -4920,11 +4920,11 @@ x86_emulate( /* vcvttpd2qq [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0x7b): /* vcvtps2qq {x,y}mm/mem,[xyz]mm{k} */ /* vcvtpd2qq [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } else { - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); /* * While SDM version 085 has explicit wording towards embedded * rounding being ignored, it's still not entirely unambiguous with @@ -4971,7 +4971,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f, 0xd6): /* vmovq xmm,xmm/m64 */ generate_exception_if(evex.lr || !evex.w || evex.opmsk || evex.brs, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); d |= TwoOp; op_bytes = 8; goto simd_zmm; @@ -4997,15 +4997,15 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x90): /* kmov{w,q} k/mem,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x90): /* kmov{b,d} k/mem,k */ generate_exception_if(vex.l || !vex.r, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.w ) { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); op_bytes = 4 << !vex.pfx; } else if ( vex.pfx ) { - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); op_bytes = 1; } else @@ -5031,14 +5031,14 @@ x86_emulate( generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.pfx == vex_f2 ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else { generate_exception_if(vex.w, X86_EXC_UD); if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } get_fpu(X86EMUL_FPU_opmask); @@ -5070,10 +5070,10 @@ x86_emulate( dst = ea; dst.reg = decode_gpr(&_regs, modrm_reg); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.pfx == vex_f2 ) { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); dst.bytes = 4 << (mode_64bit() && vex.w); } else @@ -5081,7 +5081,7 @@ x86_emulate( generate_exception_if(vex.w, X86_EXC_UD); dst.bytes = 4; if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } get_fpu(X86EMUL_FPU_opmask); @@ -5105,18 +5105,18 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x99): /* ktest{w,q} k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_VEX(0x0f, 0x98): /* kortest{w,q} k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x98): /* kortest{b,d} k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x99): /* ktest{b,d} k,k */ generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.w ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); get_fpu(X86EMUL_FPU_opmask); @@ -5306,7 +5306,7 @@ x86_emulate( break; case X86EMUL_OPC_F3(0x0f, 0xb8): /* popcnt r/m,r */ - host_and_vcpu_must_have(popcnt); + vcpu_must_have(popcnt); asm ( "popcnt %1,%0" : "=r" (dst.val) : "rm" (src.val) ); _regs.eflags &= ~EFLAGS_MASK; if ( !dst.val ) @@ -5403,7 +5403,7 @@ x86_emulate( (evex.pfx & VEX_PREFIX_SCALAR_MASK)) || !evex.r || !evex.R || evex.z), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); simd_imm8_zmm: @@ -5447,9 +5447,9 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x22): /* vpinsr{d,q} $imm8,r/m,xmm,xmm */ generate_exception_if(evex.lr || evex.opmsk || evex.brs, X86_EXC_UD); if ( b & 2 ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); if ( !mode_64bit() ) evex.w = 0; memcpy(mmvalp, &src.val, src.bytes); @@ -5486,7 +5486,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x25): /* vpternlog{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ avx512f_imm8_no_sae: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_MEM && evex.brs, X86_EXC_UD); avx512_vlen_check(false); goto simd_imm8_zmm; @@ -5556,7 +5556,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f, 0xd6): /* movdq2q xmm,mm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); op_bytes = 8; - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); goto simd_0f_int; #endif /* !X86EMUL_NO_MMX && !X86EMUL_NO_SIMD */ @@ -5585,7 +5585,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f, 0xe4): /* vpmulhuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0xea): /* vpminsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0xee): /* vpmaxsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = b & 0x10 ? 1 : 2; goto avx512f_no_sae; @@ -5608,7 +5608,7 @@ x86_emulate( { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); d |= TwoOp; - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -5618,7 +5618,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); get_fpu(X86EMUL_FPU_mmx); } @@ -5680,7 +5680,7 @@ x86_emulate( CASE_SIMD_PACKED_INT(0x0f38, 0x1c): /* pabsb {,x}mm/mem,{,x}mm */ CASE_SIMD_PACKED_INT(0x0f38, 0x1d): /* pabsw {,x}mm/mem,{,x}mm */ CASE_SIMD_PACKED_INT(0x0f38, 0x1e): /* pabsd {,x}mm/mem,{,x}mm */ - host_and_vcpu_must_have(ssse3); + vcpu_must_have(ssse3); if ( vex.pfx ) { simd_0f38_common: @@ -5688,7 +5688,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } opc = init_prefixes(stub); @@ -5715,7 +5715,7 @@ x86_emulate( if ( ea.type != OP_MEM ) { generate_exception_if(b & 2, X86_EXC_UD); - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); } /* fall through */ case X86EMUL_OPC_VEX_66(0x0f38, 0x0c): /* vpermilps {x,y}mm/mem,{x,y}mm,{x,y}mm */ @@ -5731,13 +5731,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x17): /* vptest {x,y}mm/mem,{x,y}mm */ if ( vex.opcx == vex_none ) { - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); get_fpu(X86EMUL_FPU_xmm); } else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -5804,13 +5804,13 @@ x86_emulate( case X86EMUL_OPC_66(0x0f38, 0x3f): /* pmaxud xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f38, 0x40): /* pmulld xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f38, 0x41): /* phminposuw xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); goto simd_0f38_common; case X86EMUL_OPC_EVEX_66(0x0f38, 0x10): /* vpsrlvw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x11): /* vpsravw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x12): /* vpsllvw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(!evex.w || evex.brs, X86_EXC_UD); elem_bytes = 2; goto avx512f_no_sae; @@ -5820,7 +5820,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f38, 0x20): /* vpmovswb [xyz]mm,{x,y}mm/mem{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x30): /* vpmovzxbw {x,y}mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x30): /* vpmovwb [xyz]mm,{x,y}mm/mem{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); if ( evex.pfx != vex_f3 ) { case X86EMUL_OPC_EVEX_66(0x0f38, 0x21): /* vpmovsxbd xmm/mem,[xyz]mm{k} */ @@ -5862,13 +5862,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x13): /* vcvtph2ps xmm/mem,{x,y}mm */ generate_exception_if(vex.w, X86_EXC_UD); - host_and_vcpu_must_have(f16c); + vcpu_must_have(f16c); op_bytes = 8 << vex.l; goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0x13): /* vcvtph2ps {x,y}mm/mem,[xyz]mm{k} */ generate_exception_if(evex.w || (ea.type != OP_REG && evex.brs), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(false); op_bytes = 8 << evex.lr; @@ -5922,7 +5922,7 @@ x86_emulate( op_bytes = 8; generate_exception_if(evex.brs, X86_EXC_UD); if ( !evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512_broadcast; case X86EMUL_OPC_EVEX_66(0x0f38, 0x1a): /* vbroadcastf32x4 m128,{y,z}mm{k} */ @@ -5932,7 +5932,7 @@ x86_emulate( generate_exception_if(ea.type != OP_MEM || !evex.lr || evex.brs, X86_EXC_UD); if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512_broadcast; case X86EMUL_OPC_VEX_66(0x0f38, 0x20): /* vpmovsxbw xmm/mem,{x,y}mm */ @@ -5957,9 +5957,9 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f38, 0x28): /* vpmovm2{b,w} k,[xyz]mm */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x38): /* vpmovm2{d,q} k,[xyz]mm */ if ( b & 0x10 ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.opmsk || ea.type != OP_REG, X86_EXC_UD); d |= TwoOp; op_bytes = 16 << evex.lr; @@ -6002,7 +6002,7 @@ x86_emulate( fault_suppression = false; /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x44): /* vplzcnt{d,q} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512cd); + vcpu_must_have(avx512cd); goto avx512f_no_sae; case X86EMUL_OPC_VEX_66(0x0f38, 0x2c): /* vmaskmovps mem,{x,y}mm,{x,y}mm */ @@ -6013,7 +6013,7 @@ x86_emulate( typeof(vex) *pvex; generate_exception_if(ea.type != OP_MEM || vex.w, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); elem_bytes = 4 << (b & 1); vmaskmov: get_fpu(X86EMUL_FPU_ymm); @@ -6078,7 +6078,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0xba): /* vfmsub231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbc): /* vfnmadd231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbe): /* vfnmsub231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); goto simd_zmm; @@ -6097,28 +6097,28 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0xbb): /* vfmsub231s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbd): /* vfnmadd231s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbf): /* vfnmsub231s{s,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); goto simd_zmm; case X86EMUL_OPC_66(0x0f38, 0x37): /* pcmpgtq xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); goto simd_0f38_common; case X86EMUL_OPC_EVEX_66(0x0f38, 0x38): /* vpminsb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3a): /* vpminuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3c): /* vpmaxsb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3e): /* vpmaxuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = b & 2 ?: 1; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x40): /* vpmull{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512f_no_sae; case X86EMUL_OPC_66(0x0f38, 0xdb): /* aesimc xmm/m128,xmm */ @@ -6127,7 +6127,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f38, 0xdd): /* aesenclast xmm/m128,xmm,xmm */ case X86EMUL_OPC_66(0x0f38, 0xde): /* aesdec xmm/m128,xmm,xmm */ case X86EMUL_OPC_66(0x0f38, 0xdf): /* aesdeclast xmm/m128,xmm,xmm */ - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); if ( vex.opcx == vex_none ) goto simd_0f38_common; /* fall through */ @@ -6141,7 +6141,7 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0x51): /* vpdpbuuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0x51): /* vpdpbsuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0x51): /* vpdpbssds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni_int8); + vcpu_must_have(avx_vnni_int8); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6150,7 +6150,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x51): /* vpdpbusds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x52): /* vpdpwssd [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x53): /* vpdpwssds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni); + vcpu_must_have(avx_vnni); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_ymm; @@ -6158,7 +6158,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x51): /* vpdpbusds [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x52): /* vpdpwssd [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x53): /* vpdpwssds [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vnni); + vcpu_must_have(avx512_vnni); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_no_sae; @@ -6170,7 +6170,7 @@ x86_emulate( d |= TwoOp; /* fall through */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x52): /* vdpbf16ps [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_bf16); + vcpu_must_have(avx512_bf16); generate_exception_if(evex.w, X86_EXC_UD); op_bytes = 16 << evex.lr; goto avx512f_no_sae; @@ -6187,7 +6187,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x4d): /* vrcp14s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x4f): /* vrsqrt14s{s,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.brs, X86_EXC_UD); avx512_vlen_check(true); goto simd_zmm; @@ -6196,16 +6196,16 @@ x86_emulate( generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x54): /* vpopcnt{b,w} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_bitalg); + vcpu_must_have(avx512_bitalg); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x66): /* vpblendm{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << evex.w; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x55): /* vpopcnt{d,q} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vpopcntdq); + vcpu_must_have(avx512_vpopcntdq); goto avx512f_no_sae; case X86EMUL_OPC_VEX_66(0x0f38, 0x5a): /* vbroadcasti128 m128,ymm */ @@ -6214,14 +6214,14 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x62): /* vpexpand{b,w} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x63): /* vpcompress{b,w} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); elem_bytes = 1 << evex.w; /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x88): /* vexpandp{s,d} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x89): /* vpexpand{d,q} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8a): /* vcompressp{s,d} [xyz]mm,[xyz]mm/mem{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8b): /* vpcompress{d,q} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.brs, X86_EXC_UD); avx512_vlen_check(false); /* @@ -6245,7 +6245,7 @@ x86_emulate( goto simd_zmm; case X86EMUL_OPC_EVEX_F2(0x0f38, 0x68): /* vp2intersect{d,q} [xyz]mm/mem,[xyz]mm,k+1 */ - host_and_vcpu_must_have(avx512_vp2intersect); + vcpu_must_have(avx512_vp2intersect); generate_exception_if(evex.opmsk || !evex.r || !evex.R, X86_EXC_UD); op_bytes = 16 << evex.lr; goto avx512f_no_sae; @@ -6257,7 +6257,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x71): /* vpshldv{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x73): /* vpshrdv{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); goto avx512f_no_sae; case X86EMUL_OPC_VEX (0x0f38, 0xb0): /* vcvtneoph2ps mem,[xy]mm */ @@ -6267,7 +6267,7 @@ x86_emulate( generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_VEX_F3(0x0f38, 0x72): /* vcvtneps2bf16 [xy]mm/mem,xmm */ - host_and_vcpu_must_have(avx_ne_convert); + vcpu_must_have(avx_ne_convert); generate_exception_if(vex.w, X86_EXC_UD); d |= TwoOp; op_bytes = 16 << vex.l; @@ -6277,16 +6277,16 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x7d): /* vpermt2{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8d): /* vperm{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ if ( !evex.w ) - host_and_vcpu_must_have(avx512_vbmi); + vcpu_must_have(avx512_vbmi); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); fault_suppression = false; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x78): /* vpbroadcastb xmm/m8,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x79): /* vpbroadcastw xmm/m16,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); op_bytes = elem_bytes = 1 << (b & 1); /* See the comment at the avx512_broadcast label. */ @@ -6295,14 +6295,14 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x7a): /* vpbroadcastb r32,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x7b): /* vpbroadcastw r32,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x7c): /* vpbroadcast{d,q} reg,[xyz]mm{k} */ generate_exception_if((ea.type != OP_REG || evex.brs || evex.reg != 0xf || !evex.RX), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); get_fpu(X86EMUL_FPU_zmm); @@ -6371,7 +6371,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x83): /* vpmultishiftqb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ generate_exception_if(!evex.w, X86_EXC_UD); - host_and_vcpu_must_have(avx512_vbmi); + vcpu_must_have(avx512_vbmi); fault_suppression = false; goto avx512f_no_sae; @@ -6388,7 +6388,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x8c): /* vpmaskmov{d,q} mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x8e): /* vpmaskmov{d,q} {x,y}mm,{x,y}mm,mem */ generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); elem_bytes = 4 << vex.w; goto vmaskmov; @@ -6530,7 +6530,7 @@ x86_emulate( modrm_reg == state->sib_index), X86_EXC_UD); avx512_vlen_check(false); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); /* Read destination and index registers. */ @@ -6670,7 +6670,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xbd): /* vfnmadd231s{s,d} xmm/mem,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xbe): /* vfnmsub231p{s,d} {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xbf): /* vfnmsub231s{s,d} xmm/mem,xmm,xmm */ - host_and_vcpu_must_have(fma); + vcpu_must_have(fma); goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0xa0): /* vpscatterd{d,q} [xyz]mm,mem{k} */ @@ -6692,7 +6692,7 @@ x86_emulate( modrm_reg == state->sib_index), X86_EXC_UD); avx512_vlen_check(false); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); /* Read source and index registers. */ @@ -6795,20 +6795,20 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xb1): /* vbcstnesh2ps mem,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0xb1): /* vbcstnebf162ps mem,[xy]mm */ - host_and_vcpu_must_have(avx_ne_convert); + vcpu_must_have(avx_ne_convert); generate_exception_if(vex.w || ea.type != OP_MEM, X86_EXC_UD); op_bytes = 2; goto simd_0f_ymm; case X86EMUL_OPC_VEX_66(0x0f38, 0xb4): /* vpmadd52luq [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xb5): /* vpmadd52huq [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_ifma); + vcpu_must_have(avx_ifma); generate_exception_if(!vex.w, X86_EXC_UD); goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0xb4): /* vpmadd52luq [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xb5): /* vpmadd52huq [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_ifma); + vcpu_must_have(avx512_ifma); generate_exception_if(!evex.w, X86_EXC_UD); goto avx512f_no_sae; @@ -6818,29 +6818,29 @@ x86_emulate( case X86EMUL_OPC(0x0f38, 0xcb): /* sha256rnds2 XMM0,xmm/m128,xmm */ case X86EMUL_OPC(0x0f38, 0xcc): /* sha256msg1 xmm/m128,xmm */ case X86EMUL_OPC(0x0f38, 0xcd): /* sha256msg2 xmm/m128,xmm */ - host_and_vcpu_must_have(sha); + vcpu_must_have(sha); op_bytes = 16; goto simd_0f38_common; case X86EMUL_OPC_VEX_F2(0x0f38, 0xcb): /* vsha512rnds2 xmm,ymm,ymm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xcc): /* vsha512msg1 xmm,ymm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xcd): /* vsha512msg2 ymm,ymm */ - host_and_vcpu_must_have(sha512); + vcpu_must_have(sha512); generate_exception_if(ea.type != OP_REG || vex.w || !vex.l, X86_EXC_UD); op_bytes = 32; goto simd_0f_ymm; case X86EMUL_OPC_66(0x0f38, 0xcf): /* gf2p8mulb xmm/m128,xmm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); goto simd_0f38_common; case X86EMUL_OPC_VEX_66(0x0f38, 0xcf): /* vgf2p8mulb {x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_avx; case X86EMUL_OPC_EVEX_66(0x0f38, 0xcf): /* vgf2p8mulb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); elem_bytes = 1; goto avx512f_no_sae; @@ -6851,7 +6851,7 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0xd3): /* vpdpwuuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xd3): /* vpdpwusds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0xd3): /* vpdpwsuds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni_int16); + vcpu_must_have(avx_vnni_int16); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6859,12 +6859,12 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0xda): /* vsm3msg1 xmm/mem,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xda): /* vsm3msg2 xmm/mem,xmm,xmm */ generate_exception_if(vex.w || vex.l, X86_EXC_UD); - host_and_vcpu_must_have(sm3); + vcpu_must_have(sm3); goto simd_0f_ymm; case X86EMUL_OPC_VEX_F3(0x0f38, 0xda): /* vsm4key4 [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xda): /* vsm4rnds4 [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(sm4); + vcpu_must_have(sm4); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6874,16 +6874,16 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xde): /* vaesdec {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xdf): /* vaesdeclast {x,y}mm/mem,{x,y}mm,{x,y}mm */ if ( !vex.l ) - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); else - host_and_vcpu_must_have(vaes); + vcpu_must_have(vaes); goto simd_0f_avx; case X86EMUL_OPC_EVEX_66(0x0f38, 0xdc): /* vaesenc [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xdd): /* vaesenclast [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xde): /* vaesdec [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xdf): /* vaesdeclast [xyz]mm/mem,[xyz]mm,[xyz]mm */ - host_and_vcpu_must_have(vaes); + vcpu_must_have(vaes); generate_exception_if(evex.brs || evex.opmsk, X86_EXC_UD); goto avx512f_no_sae; @@ -6893,7 +6893,7 @@ x86_emulate( X86EMUL_OPC_VEX_66(0x0f38, 0xef): /* cmpxadd r,r,m */ generate_exception_if(!mode_64bit() || dst.type != OP_MEM || vex.l, X86_EXC_UD); - host_and_vcpu_must_have(cmpccxadd); + vcpu_must_have(cmpccxadd); fail_if(!ops->rmw); state->rmw = rmw_cmpccxadd; break; @@ -6925,7 +6925,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f38, 0xf0): /* crc32 r/m8, r{32,64} */ case X86EMUL_OPC_F2(0x0f38, 0xf1): /* crc32 r/m{16,32,64}, r{32,64} */ - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); dst.bytes = rex_prefix & REX_W ? 8 : 4; switch ( op_bytes ) { @@ -6965,9 +6965,9 @@ x86_emulate( typeof(vex) *pvex = container_of(buf + 1, typeof(vex), raw[0]); if ( b == 0xf5 || vex.pfx ) - host_and_vcpu_must_have(bmi2); + vcpu_must_have(bmi2); else - host_and_vcpu_must_have(bmi1); + vcpu_must_have(bmi1); generate_exception_if(vex.l, X86_EXC_UD); buf[0] = 0xc4; @@ -6998,7 +6998,7 @@ x86_emulate( case 1: /* blsr r,r/m */ case 2: /* blsmsk r,r/m */ case 3: /* blsi r,r/m */ - host_and_vcpu_must_have(bmi1); + vcpu_must_have(bmi1); break; default: goto unrecognized_insn; @@ -7070,7 +7070,7 @@ x86_emulate( break; case X86EMUL_OPC_66(0x0f38, 0xf8): /* movdir64b r,m512 */ - host_and_vcpu_must_have(movdir64b); + vcpu_must_have(movdir64b); generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); src.val = truncate_ea(*dst.reg); generate_exception_if(!is_aligned(x86_seg_es, src.val, 64, ctxt, ops), @@ -7088,7 +7088,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f38, 0xf8): /* enqcmd r,m512 */ case X86EMUL_OPC_F3(0x0f38, 0xf8): /* enqcmds r,m512 */ - host_and_vcpu_must_have(enqcmd); + vcpu_must_have(enqcmd); generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); generate_exception_if(vex.pfx != vex_f2 && !mode_ring0(), X86_EXC_GP, 0); src.val = truncate_ea(*dst.reg); @@ -7119,7 +7119,7 @@ x86_emulate( break; case X86EMUL_OPC(0x0f38, 0xf9): /* movdiri mem,r */ - host_and_vcpu_must_have(movdiri); + vcpu_must_have(movdiri); generate_exception_if(dst.type != OP_MEM, X86_EXC_UD); fail_if(!ops->blk); state->blk = blk_movdir; @@ -7177,7 +7177,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x40): /* dpps $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x41): /* dppd $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x42): /* mpsadbw $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); goto simd_0f3a_common; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x0a): /* vrndscaless $imm8,xmm/mem,xmm,xmm{k} */ @@ -7186,7 +7186,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x08): /* vrndscaleps $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x09): /* vrndscalepd $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.w != (b & 1), X86_EXC_UD); avx512_vlen_check(b & 2); goto simd_imm8_zmm; @@ -7195,7 +7195,7 @@ x86_emulate( generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX(0x0f3a, 0x08): /* vrndscaleph $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); avx512_vlen_check(b & 2); goto simd_imm8_zmm; @@ -7203,7 +7203,7 @@ x86_emulate( #endif /* X86EMUL_NO_SIMD */ CASE_SIMD_PACKED_INT(0x0f3a, 0x0f): /* palignr $imm8,{,x}mm/mem,{,x}mm */ - host_and_vcpu_must_have(ssse3); + vcpu_must_have(ssse3); if ( vex.pfx ) { simd_0f3a_common: @@ -7211,7 +7211,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } opc = init_prefixes(stub); @@ -7242,7 +7242,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x15): /* pextrw $imm8,xmm,r/m */ case X86EMUL_OPC_66(0x0f3a, 0x16): /* pextr{d,q} $imm8,xmm,r/m */ case X86EMUL_OPC_66(0x0f3a, 0x17): /* extractps $imm8,xmm,r/m */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); get_fpu(X86EMUL_FPU_xmm); opc = init_prefixes(stub); @@ -7281,7 +7281,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x16): /* vpextr{d,q} $imm8,xmm,r/m */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x17): /* vextractps $imm8,xmm,r/m */ generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); /* Work around erratum BT41. */ @@ -7308,11 +7308,11 @@ x86_emulate( evex.opmsk || evex.brs), X86_EXC_UD); if ( !(b & 2) ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( !(b & 1) ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); opc = init_evex(stub); goto pextr; @@ -7326,7 +7326,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x39): /* vextracti32x4 $imm8,{y,z}mm,xmm/m128{k} */ /* vextracti64x2 $imm8,{y,z}mm,xmm/m128{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x23): /* vshuff32x4 $imm8,{y,z}mm/mem,{y,z}mm,{y,z}mm{k} */ @@ -7346,7 +7346,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x3b): /* vextracti32x8 $imm8,zmm,ymm/m256{k} */ /* vextracti64x4 $imm8,zmm,ymm/m256{k} */ if ( !evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(evex.lr != 2 || evex.brs, X86_EXC_UD); fault_suppression = false; goto avx512f_imm8_no_sae; @@ -7362,14 +7362,14 @@ x86_emulate( generate_exception_if((evex.w || evex.reg != 0xf || !evex.RX || (ea.type != OP_REG && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); opc = init_evex(stub); } else { generate_exception_if(vex.w || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(f16c); + vcpu_must_have(f16c); opc = init_prefixes(stub); } @@ -7454,7 +7454,7 @@ x86_emulate( if ( !(b & 0x20) ) goto avx512f_imm8_no_sae; avx512bw_imm: - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << evex.w; avx512_vlen_check(false); @@ -7462,7 +7462,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x20): /* pinsrb $imm8,r32/m8,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x22): /* pinsr{d,q} $imm8,r/m,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); memcpy(mmvalp, &src.val, src.bytes); ea.type = OP_MEM; d = SrcMem16; /* Fake for the common SIMD code below. */ @@ -7481,7 +7481,7 @@ x86_emulate( goto simd_0f_int_imm8; case X86EMUL_OPC_66(0x0f3a, 0x21): /* insertps $imm8,xmm/m32,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); op_bytes = 4; goto simd_0f3a_common; @@ -7493,7 +7493,7 @@ x86_emulate( goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x21): /* vinsertps $imm8,xmm/m32,xmm,xmm */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.lr || evex.w || evex.opmsk || evex.brs, X86_EXC_UD); op_bytes = 4; @@ -7501,18 +7501,18 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x50): /* vrangep{s,d} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x56): /* vreducep{s,d} $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x26): /* vgetmantp{s,d} $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x54): /* vfixupimmp{s,d} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); goto simd_imm8_zmm; case X86EMUL_OPC_EVEX(0x0f3a, 0x26): /* vgetmantph $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x56): /* vreduceph $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7520,11 +7520,11 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x51): /* vranges{s,d} $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x57): /* vreduces{s,d} $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x27): /* vgetmants{s,d} $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x55): /* vfixupimms{s,d} $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); @@ -7532,7 +7532,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(0x0f3a, 0x27): /* vgetmantsh $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x57): /* vreducesh $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); @@ -7543,31 +7543,31 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x30): /* kshiftr{b,w} $imm8,k,k */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x32): /* kshiftl{b,w} $imm8,k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); opmask_shift_imm: generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_opmask); op_bytes = 1; /* Any non-zero value will do. */ goto simd_0f_imm8; case X86EMUL_OPC_VEX_66(0x0f3a, 0x31): /* kshiftr{d,q} $imm8,k,k */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x33): /* kshiftl{d,q} $imm8,k,k */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); goto opmask_shift_imm; case X86EMUL_OPC_66(0x0f3a, 0x44): /* pclmulqdq $imm8,xmm/m128,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x44): /* vpclmulqdq $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(pclmulqdq); + vcpu_must_have(pclmulqdq); if ( vex.opcx == vex_none ) goto simd_0f3a_common; if ( vex.l ) - host_and_vcpu_must_have(vpclmulqdq); + vcpu_must_have(vpclmulqdq); goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x44): /* vpclmulqdq $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm */ - host_and_vcpu_must_have(vpclmulqdq); + vcpu_must_have(vpclmulqdq); generate_exception_if(evex.brs || evex.opmsk, X86_EXC_UD); goto avx512f_imm8_no_sae; @@ -7575,7 +7575,7 @@ x86_emulate( /* vpermil2ps $imm,{x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x49): /* vpermil2pd $imm,{x,y}mm/mem,{x,y}mm,{x,y}mm,{x,y}mm */ /* vpermil2pd $imm,{x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_imm8_ymm; case X86EMUL_OPC_VEX_66(0x0f3a, 0x4a): /* vblendvps {x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ @@ -7627,7 +7627,7 @@ x86_emulate( /* vfnmsubss xmm/m32,xmm,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x7f): /* vfnmsubsd xmm,xmm/m64,xmm,xmm */ /* vfnmsubsd xmm/m64,xmm,xmm,xmm */ - host_and_vcpu_must_have(fma4); + vcpu_must_have(fma4); goto simd_0f_imm8_ymm; case X86EMUL_OPC_66(0x0f3a, 0x60): /* pcmpestrm $imm8,xmm/m128,xmm */ @@ -7640,13 +7640,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x63): /* vpcmpistri $imm8,xmm/m128,xmm */ if ( vex.opcx == vex_none ) { - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); get_fpu(X86EMUL_FPU_xmm); } else { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -7695,7 +7695,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x66): /* vfpclassp{s,d} $imm8,[xyz]mm/mem,k{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x67): /* vfpclasss{s,d} $imm8,xmm/mem,k{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(!evex.r || !evex.R || evex.z, X86_EXC_UD); if ( !(b & 1) ) goto avx512f_imm8_no_sae; @@ -7705,7 +7705,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(0x0f3a, 0x66): /* vfpclassph $imm8,[xyz]mm/mem,k{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x67): /* vfpclasssh $imm8,xmm/mem,k{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); if ( !(b & 1) ) goto avx512f_imm8_no_sae; @@ -7720,51 +7720,51 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x71): /* vpshld{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x73): /* vpshrd{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); goto avx512f_imm8_no_sae; case X86EMUL_OPC_EVEX_F3(0x0f3a, 0xc2): /* vcmpsh $imm8,xmm/mem,xmm,k{k} */ generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX(0x0f3a, 0xc2): /* vcmpph $imm8,[xyz]mm/mem,[xyz]mm,k{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); goto simd_imm8_zmm; case X86EMUL_OPC(0x0f3a, 0xcc): /* sha1rnds4 $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(sha); + vcpu_must_have(sha); op_bytes = 16; goto simd_0f3a_common; case X86EMUL_OPC_66(0x0f3a, 0xce): /* gf2p8affineqb $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0xcf): /* gf2p8affineinvqb $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); goto simd_0f3a_common; case X86EMUL_OPC_VEX_66(0x0f3a, 0xce): /* vgf2p8affineqb $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0xcf): /* vgf2p8affineinvqb $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(!vex.w, X86_EXC_UD); goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0xce): /* vgf2p8affineqb $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0xcf): /* vgf2p8affineinvqb $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(!evex.w, X86_EXC_UD); fault_suppression = false; goto avx512f_imm8_no_sae; case X86EMUL_OPC_VEX_66(0x0f3a, 0xde): /* vsm3rnds2 $imm8,xmm/mem,xmm,xmm */ - host_and_vcpu_must_have(sm3); + vcpu_must_have(sm3); generate_exception_if(vex.w || vex.l, X86_EXC_UD); op_bytes = 16; goto simd_0f_imm8_ymm; case X86EMUL_OPC_66(0x0f3a, 0xdf): /* aeskeygenassist $imm8,xmm/m128,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0xdf): /* vaeskeygenassist $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); if ( vex.opcx == vex_none ) goto simd_0f3a_common; generate_exception_if(vex.l, X86_EXC_UD); @@ -7803,13 +7803,13 @@ x86_emulate( CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5d): /* vmin{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5e): /* vdiv{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5f): /* vmax{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_all_fp; CASE_SIMD_ALL_FP(_EVEX, 5, 0x5a): /* vcvtp{h,d}2p{h,d} [xyz]mm/mem,[xyz]mm{k} */ /* vcvts{h,d}2s{h,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); if ( vex.pfx & VEX_PREFIX_SCALAR_MASK ) d &= ~TwoOp; op_bytes = 2 << (((evex.pfx & VEX_PREFIX_SCALAR_MASK) ? 0 : 1 + evex.lr) + @@ -7820,7 +7820,7 @@ x86_emulate( /* vcvtqq2ph [xyz]mm/mem,xmm{k} */ case X86EMUL_OPC_EVEX_F2(5, 0x7a): /* vcvtudq2ph [xyz]mm/mem,[xy]mm{k} */ /* vcvtuqq2ph [xyz]mm/mem,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); op_bytes = 16 << evex.lr; @@ -7830,7 +7830,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x5b): /* vcvttph2dq [xy]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX (5, 0x78): /* vcvttph2udq [xy]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX (5, 0x79): /* vcvtph2udq [xy]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7841,7 +7841,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(5, 0x79): /* vcvtph2uqq xmm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(5, 0x7a): /* vcvttph2qq xmm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(5, 0x7b): /* vcvtph2qq xmm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7878,7 +7878,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0xba): /* vfmsub231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbc): /* vfnmadd231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbe): /* vfnmsub231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7900,7 +7900,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0xbb): /* vfmsub231sh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbd): /* vfnmadd231sh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbf): /* vfnmsub231sh xmm/m16,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || (ea.type != OP_REG && evex.brs), X86_EXC_UD); if ( !evex.brs ) @@ -7909,13 +7909,13 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0x4c): /* vrcpph [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0x4e): /* vrsqrtph [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(6, 0x4d): /* vrcpsh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0x4f): /* vrsqrtsh xmm/m16,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); avx512_vlen_check(true); goto simd_zmm; @@ -7933,7 +7933,7 @@ x86_emulate( { unsigned int src1 = ~evex.reg; - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || ((b & 1) && ea.type != OP_REG && evex.brs), X86_EXC_UD); if ( mode_64bit() ) @@ -7993,7 +7993,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_XOP(08, 0xa2): /* vpcmov {x,y}mm/mem,{x,y}mm,{x,y}mm,{x,y}mm */ /* vpcmov {x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_imm8_ymm; #endif /* X86EMUL_NO_SIMD */ @@ -8008,7 +8008,7 @@ x86_emulate( case 5: /* blcic r/m,r */ case 6: /* blsic r/m,r */ case 7: /* t1mskc r/m,r */ - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); break; default: goto unrecognized_insn; @@ -8042,7 +8042,7 @@ x86_emulate( { case 1: /* blcmsk r/m,r */ case 6: /* blci r/m,r */ - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); goto xop_09_rm_rv; } goto unrecognized_insn; @@ -8065,7 +8065,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_XOP(09, 0x80): /* vfrczps {x,y}mm/mem,{x,y}mm */ case X86EMUL_OPC_XOP(09, 0x81): /* vfrczpd {x,y}mm/mem,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_ymm; @@ -8111,7 +8111,7 @@ x86_emulate( case X86EMUL_OPC_XOP(09, 0x9b): /* vpshaq xmm/m128,xmm,xmm */ /* vpshaq xmm,xmm/m128,xmm */ generate_exception_if(vex.l, X86_EXC_UD); - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_ymm; #endif /* X86EMUL_NO_SIMD */ @@ -8121,7 +8121,7 @@ x86_emulate( uint8_t *buf = get_stub(stub); typeof(vex) *pxop = container_of(buf + 1, typeof(vex), raw[0]); - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); if ( ea.type == OP_REG ) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 10:44:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 10:44:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372358.1619715 (Exim 4.92) (envelope-from ) id 1wofI3-0007Yh-1M; Tue, 28 Jul 2026 10:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372358.1619715; Tue, 28 Jul 2026 10:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofI2-0007YZ-Ug; Tue, 28 Jul 2026 10:44:02 +0000 Received: by outflank-mailman (input) for mailman id 1372358; Tue, 28 Jul 2026 10:44:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofI1-0007YT-Td for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wofI1-00DNFw-35 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wofI1-002sP6-1t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rhVd1OD7+cpzAQcMfiGUYRrzYSTMzcFwYc95FLw/1tI=; b=CdVEn9irjiEpVfnG8mdLep54PE sxSBP17A+ylFU47l6FYkrFZYTxlmsQb1mNaABtNgc//GLiwn0jKnTy0fT2EUK1YANaL0zZXfWHiqg wwdPdvEp51zxVq/bv/PfRglPL9fxc0PVF1UBSDIFjhUBjhhlnp4GJpj8n6N01bkwYcOQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: support non-SIMD MOVRS Message-Id: Date: Tue, 28 Jul 2026 10:44:01 +0000 commit 59b18eb757dbed47764926ab9adf2ce630b60de2 Author: Jan Beulich AuthorDate: Tue Jul 28 10:07:13 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:07:13 2026 +0200 x86emul: support non-SIMD MOVRS As we ignore cachability aspects of insns, they're treated like simple MOVs. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- tools/tests/x86_emulator/predicates.c | 3 +++ tools/tests/x86_emulator/test_x86_emulator.c | 23 +++++++++++++++++++++++ xen/arch/x86/x86_emulate/decode.c | 10 +++++++++- xen/arch/x86/x86_emulate/private.h | 1 + xen/arch/x86/x86_emulate/x86_emulate.c | 10 ++++++++++ xen/include/public/arch-x86/cpufeatureset.h | 1 + xen/tools/gen-cpuid.py | 2 +- 7 files changed, 48 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index 84717d3ebe..6c6d0f386c 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -841,6 +841,9 @@ static const struct { { { 0x80 }, { 2, 2 }, T, R, pfx_66 }, /* invept */ { { 0x81 }, { 2, 2 }, T, R, pfx_66 }, /* invvpid */ { { 0x82 }, { 2, 2 }, T, R, pfx_66 }, /* invpcid */ + { { 0x8a }, { 2, 2 }, T, R, pfx_no }, /* movrsb */ + { { 0x8b }, { 2, 2 }, T, R, pfx_no }, /* movrs{d,q} */ + { { 0x8b }, { 2, 2 }, T, R, pfx_66 }, /* movrsw */ { { 0xc8 }, { 2, 2 }, T, R, pfx_no }, /* sha1nexte */ { { 0xc9 }, { 2, 2 }, T, R, pfx_no }, /* sha1msg1 */ { { 0xca }, { 2, 2 }, T, R, pfx_no }, /* sha1msg2 */ diff --git a/tools/tests/x86_emulator/test_x86_emulator.c b/tools/tests/x86_emulator/test_x86_emulator.c index af29b106f1..31391f1bf7 100644 --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -1704,6 +1704,29 @@ int main(int argc, char **argv) } else printf("skipped\n"); + + { + /* For the non-SIMD forms the emulator doesn't itself use MOVRS. */ + bool movrs = cpu_policy.feat.movrs; + + cpu_policy.feat.movrs = true; + + printf("%-40s", "Testing movrs 6(%rdi),%si..."); + instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0x38; + instr[3] = 0x8b; instr[4] = 0x77; instr[5] = 0x06; + regs.rip = (unsigned long)&instr[0]; + regs.rsi = 0x8888777766665555UL; + regs.rdi = (unsigned long)res; + res[1] = 0x88777788U; + rc = x86_emulate(&ctxt, &emulops); + if ( (rc != X86EMUL_OKAY) || + (regs.rip != (unsigned long)&instr[6]) || + (regs.rsi != 0x8888777766668877UL) ) + goto fail; + printf("okay\n"); + + cpu_policy.feat.movrs = movrs; + } #endif /* x86-64 */ printf("%-40s", "Testing shld $1,%ecx,(%edx)..."); diff --git a/xen/arch/x86/x86_emulate/decode.c b/xen/arch/x86/x86_emulate/decode.c index d1665e6eb3..48e8c79964 100644 --- a/xen/arch/x86/x86_emulate/decode.c +++ b/xen/arch/x86/x86_emulate/decode.c @@ -902,7 +902,8 @@ decode_0f38(struct x86_emulate_state *s, { switch ( ctxt->opcode & X86EMUL_OPC_MASK ) { - case 0x00 ... 0xef: + case 0x00 ... 0x89: + case 0x8c ... 0xef: case 0xf2 ... 0xf5: case 0xf7 ... 0xf8: case 0xfa ... 0xff: @@ -913,6 +914,13 @@ decode_0f38(struct x86_emulate_state *s, ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK); break; + case 0x8a ... 0x8b: /* movrs */ + s->desc = DstReg | SrcMem | Mov; + if ( !(ctxt->opcode & 1) ) + s->desc |= ByteOp; + s->simd_size = simd_none; + break; + case X86EMUL_OPC_VEX_66(0, 0x2d): /* vmaskmovpd */ s->simd_size = simd_packed_fp; break; diff --git a/xen/arch/x86/x86_emulate/private.h b/xen/arch/x86/x86_emulate/private.h index 6c96f72327..1b06c60248 100644 --- a/xen/arch/x86/x86_emulate/private.h +++ b/xen/arch/x86/x86_emulate/private.h @@ -612,6 +612,7 @@ amd_like(const struct x86_emulate_ctxt *ctxt) #define vcpu_has_lkgs() (ctxt->cpuid->feat.lkgs) #define vcpu_has_wrmsrns() (ctxt->cpuid->feat.wrmsrns) #define vcpu_has_avx_ifma() (ctxt->cpuid->feat.avx_ifma) +#define vcpu_has_movrs() (ctxt->cpuid->feat.movrs) #define vcpu_has_avx_vnni_int8() (ctxt->cpuid->feat.avx_vnni_int8) #define vcpu_has_avx_ne_convert() (ctxt->cpuid->feat.avx_ne_convert) #define vcpu_has_avx_vnni_int16() (ctxt->cpuid->feat.avx_vnni_int16) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index a4ba22ffb5..80742e50d4 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6375,6 +6375,16 @@ x86_emulate( fault_suppression = false; goto avx512f_no_sae; +#endif /* !X86EMUL_NO_SIMD */ + + case X86EMUL_OPC(0x0f38, 0x8a) + ... X86EMUL_OPC(0x0f38, 0x8b): /* movrs */ + vcpu_must_have(movrs); + dst.val = src.val; + break; + +#ifndef X86EMUL_NO_SIMD + case X86EMUL_OPC_VEX_66(0x0f38, 0x8c): /* vpmaskmov{d,q} mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x8e): /* vpmaskmov{d,q} {x,y}mm,{x,y}mm,mem */ generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h index ce4a7982a5..72c1bde7e6 100644 --- a/xen/include/public/arch-x86/cpufeatureset.h +++ b/xen/include/public/arch-x86/cpufeatureset.h @@ -319,6 +319,7 @@ XEN_CPUFEATURE(AVX_IFMA, 10*32+23) /*A AVX-IFMA Instructions */ XEN_CPUFEATURE(LAM, 10*32+26) /* Linear Address Masking */ XEN_CPUFEATURE(MSRLIST, 10*32+27) /* {RD,WR}MSRLIST instructions */ XEN_CPUFEATURE(NO_INVD, 10*32+30) /* INVD instruction unusable */ +XEN_CPUFEATURE(MOVRS, 10*32+31) /*a MOV-read-shared instructions */ /* AMD-defined CPU features, CPUID level 0x80000021.eax, word 11 */ XEN_CPUFEATURE(NO_NEST_BP, 11*32+ 0) /*A No Nested Data Breakpoints */ diff --git a/xen/tools/gen-cpuid.py b/xen/tools/gen-cpuid.py index a30c68b40a..749d3f4e09 100755 --- a/xen/tools/gen-cpuid.py +++ b/xen/tools/gen-cpuid.py @@ -283,7 +283,7 @@ def crunch_numbers(state): # NO_LMSL indicates the absense of Long Mode Segment Limits, which # have been dropped in hardware. LM: [CX16, PCID, LAHF_LM, PAGE1GB, PKU, NO_LMSL, AMX_TILE, CMPCCXADD, - LKGS], + LKGS, MOVRS], # AMD K6-2+ and K6-III processors shipped with 3DNow+, beyond the # standard 3DNow in the earlier K6 processors. -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 10:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 10:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372359.1619719 (Exim 4.92) (envelope-from ) id 1wofID-0007as-2U; Tue, 28 Jul 2026 10:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372359.1619719; Tue, 28 Jul 2026 10:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofIC-0007ak-W7; Tue, 28 Jul 2026 10:44:12 +0000 Received: by outflank-mailman (input) for mailman id 1372359; Tue, 28 Jul 2026 10:44:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofIB-0007ae-RR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wofIC-00DNGD-0H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wofIB-002sRT-2N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6eiZ9Z9Rr0HInQ1VtpzXZHSyLenVtrF/BVmCWGj3+UY=; b=p3UToc53J7opws/BYySHFvzEif iiB3JDrKc+DMNIf9enOOP8NY2ay987ia+cSVYGrRzsLizG/TpJqu3q8UCiDzTQcfIxwz/ZQwNdXqs hHKwNGSY1hVko8T8yZRghS+/zVy9GpZPebWUtf5bud9wwRQPYKWCP7Lz5QxLfl9gEzR8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/riscv: manage IRQ_DISABLED flag in APLIC irq enable/disable callbacks Message-Id: Date: Tue, 28 Jul 2026 10:44:11 +0000 commit 78607876a2e7858ea8e8586cc98b1abedbe4b631 Author: Oleksii Kurochko AuthorDate: Tue Jul 28 10:08:02 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:08:02 2026 +0200 xen/riscv: manage IRQ_DISABLED flag in APLIC irq enable/disable callbacks desc->status is only set once during setup_irq(), but interrupts can be enabled/disabled at runtime, so update it in the corresponding callbacks. For the purposes of the FENCE instruction, CSR read accesses are classified as device input (I) and CSR write accesses as device output (O), while the barriers used by spin locks (fence rw,rw) only order normal memory accesses. An explicit wmb() (fence ow,ow) is therefore added in aplic_irq_{enable,disable}() to order the desc->status update with respect to the IMSIC CSR write. Fixes: d4676a1398bc5 ("xen/riscv: implementation of aplic and imsic operations") Signed-off-by: Oleksii Kurochko Acked-by: Jan Beulich --- xen/arch/riscv/aplic.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c index 6a1255c5f4..9f023db5d5 100644 --- a/xen/arch/riscv/aplic.c +++ b/xen/arch/riscv/aplic.c @@ -134,6 +134,15 @@ static void cf_check aplic_irq_enable(struct irq_desc *desc) spin_lock(&aplic.lock); + desc->status &= ~IRQ_DISABLED; + /* + * wmb() (fence ow,ow) orders the ->status memory write (w) before the + * CSR write inside imsic_irq_enable() (device output, o on RISC-V). + * arch_lock_release_barrier() uses fence rw,rw which does not cover + * device output (o), so wmb() is required to close that gap. + */ + wmb(); + /* Enable interrupt in IMSIC */ imsic_irq_enable(desc->irq); @@ -161,6 +170,16 @@ static void cf_check aplic_irq_disable(struct irq_desc *desc) /* Disable interrupt in IMSIC */ imsic_irq_disable(desc->irq); + /* + * wmb() (fence ow,ow) ensures the CSR write (device output, o) inside + * imsic_irq_disable() is globally visible before ->status is marked + * IRQ_DISABLED. imsic_irq_disable()'s spin_unlock uses fence rw,rw + * which does not order device output (o) writes before subsequent + * memory writes (w), so an explicit wmb() is needed here. + */ + wmb(); + + desc->status |= IRQ_DISABLED; spin_unlock(&aplic.lock); } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 10:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 10:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1372360.1619723 (Exim 4.92) (envelope-from ) id 1wofIN-0007dv-3x; Tue, 28 Jul 2026 10:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1372360.1619723; Tue, 28 Jul 2026 10:44:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofIN-0007do-1M; Tue, 28 Jul 2026 10:44:23 +0000 Received: by outflank-mailman (input) for mailman id 1372360; Tue, 28 Jul 2026 10:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wofIM-0007dh-0Z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wofIM-00DNGH-0g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:21 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wofIL-002sTs-2s for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 10:44:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=uMmsz7BMXClWpnCU58Mb95IEb068fKrZVH8QItR3bKw=; b=pedv3ghPD/ilKc+HIJjVgfjkaq LhPDMhjyu+/3ZizkD2yOFaopKghsZvv28vWP83bgPm8s297TI7QlGUO4PzCSSZh0Zx3DkQ6FAKm3d PVaLhlqA2lnptI0cnw5ZDwIe2qGmuoVlTwgVFQZ8+XD63iT7X+ecvEbUdggYnKm/1Lkw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86emul: drop host_and_vcpu_must_have() Message-Id: Date: Tue, 28 Jul 2026 10:44:21 +0000 commit 25cf3956b2c631508554b77707dbfe12ebe3c80e Author: Jan Beulich AuthorDate: Tue Jul 28 10:16:00 2026 +0200 Commit: Jan Beulich CommitDate: Tue Jul 28 10:16:00 2026 +0200 x86emul: drop host_and_vcpu_must_have() With CPU policy dependency logic now properly in place and working, and with us never enabling ISA bits in guest policies which the underlying hardware doesn't support, the dual checks aren't needed anymore. In turn, a number of cpu_has_* can then also go away, when their only user was the emulator code. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- xen/arch/x86/include/asm/cpufeature.h | 51 ---- xen/arch/x86/x86_emulate/0f01.c | 2 +- xen/arch/x86/x86_emulate/0fc7.c | 6 +- xen/arch/x86/x86_emulate/fpu.c | 24 +- xen/arch/x86/x86_emulate/private.h | 20 -- xen/arch/x86/x86_emulate/x86_emulate.c | 410 ++++++++++++++++----------------- 6 files changed, 221 insertions(+), 292 deletions(-) diff --git a/xen/arch/x86/include/asm/cpufeature.h b/xen/arch/x86/include/asm/cpufeature.h index dcd223d84f..4933ad234f 100644 --- a/xen/arch/x86/include/asm/cpufeature.h +++ b/xen/arch/x86/include/asm/cpufeature.h @@ -126,28 +126,18 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_pge 1 #define cpu_has_pse36 boot_cpu_has(X86_FEATURE_PSE36) #define cpu_has_clflush boot_cpu_has(X86_FEATURE_CLFLUSH) -#define cpu_has_mmx 1 #define cpu_has_htt boot_cpu_has(X86_FEATURE_HTT) /* CPUID level 0x00000001.ecx */ -#define cpu_has_sse3 boot_cpu_has(X86_FEATURE_SSE3) -#define cpu_has_pclmulqdq boot_cpu_has(X86_FEATURE_PCLMULQDQ) #define cpu_has_monitor boot_cpu_has(X86_FEATURE_MONITOR) #define cpu_has_vmx boot_cpu_has(X86_FEATURE_VMX) #define cpu_has_eist boot_cpu_has(X86_FEATURE_EIST) -#define cpu_has_ssse3 boot_cpu_has(X86_FEATURE_SSSE3) -#define cpu_has_fma boot_cpu_has(X86_FEATURE_FMA) #define cpu_has_cx16 boot_cpu_has(X86_FEATURE_CX16) #define cpu_has_pdcm boot_cpu_has(X86_FEATURE_PDCM) #define cpu_has_pcid boot_cpu_has(X86_FEATURE_PCID) -#define cpu_has_sse4_1 boot_cpu_has(X86_FEATURE_SSE4_1) -#define cpu_has_sse4_2 boot_cpu_has(X86_FEATURE_SSE4_2) #define cpu_has_x2apic boot_cpu_has(X86_FEATURE_X2APIC) -#define cpu_has_popcnt boot_cpu_has(X86_FEATURE_POPCNT) -#define cpu_has_aesni boot_cpu_has(X86_FEATURE_AESNI) #define cpu_has_xsave boot_cpu_has(X86_FEATURE_XSAVE) #define cpu_has_avx boot_cpu_has(X86_FEATURE_AVX) -#define cpu_has_f16c boot_cpu_has(X86_FEATURE_F16C) #define cpu_has_rdrand boot_cpu_has(X86_FEATURE_RDRAND) #define cpu_has_hypervisor boot_cpu_has(X86_FEATURE_HYPERVISOR) @@ -156,17 +146,11 @@ static inline bool boot_cpu_has(unsigned int feat) boot_cpu_has(X86_FEATURE_NX)) #define cpu_has_page1gb boot_cpu_has(X86_FEATURE_PAGE1GB) #define cpu_has_rdtscp boot_cpu_has(X86_FEATURE_RDTSCP) -#define cpu_has_3dnow_ext boot_cpu_has(X86_FEATURE_3DNOWEXT) -#define cpu_has_3dnow boot_cpu_has(X86_FEATURE_3DNOW) /* CPUID level 0x80000001.ecx */ #define cpu_has_cmp_legacy boot_cpu_has(X86_FEATURE_CMP_LEGACY) #define cpu_has_svm boot_cpu_has(X86_FEATURE_SVM) -#define cpu_has_sse4a boot_cpu_has(X86_FEATURE_SSE4A) -#define cpu_has_xop boot_cpu_has(X86_FEATURE_XOP) #define cpu_has_skinit boot_cpu_has(X86_FEATURE_SKINIT) -#define cpu_has_fma4 boot_cpu_has(X86_FEATURE_FMA4) -#define cpu_has_tbm boot_cpu_has(X86_FEATURE_TBM) /* CPUID level 0x00000006.eax */ #define cpu_has_turbo_boost host_cpu_policy.basic.turbo_boost @@ -190,43 +174,23 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_xsaves boot_cpu_has(X86_FEATURE_XSAVES) /* CPUID level 0x00000007:0.ebx */ -#define cpu_has_bmi1 boot_cpu_has(X86_FEATURE_BMI1) #define cpu_has_hle boot_cpu_has(X86_FEATURE_HLE) -#define cpu_has_avx2 boot_cpu_has(X86_FEATURE_AVX2) #define cpu_has_smep boot_cpu_has(X86_FEATURE_SMEP) -#define cpu_has_bmi2 boot_cpu_has(X86_FEATURE_BMI2) #define cpu_has_invpcid boot_cpu_has(X86_FEATURE_INVPCID) #define cpu_has_rtm boot_cpu_has(X86_FEATURE_RTM) #define cpu_has_pqe boot_cpu_has(X86_FEATURE_PQE) #define cpu_has_fpu_sel (!boot_cpu_has(X86_FEATURE_NO_FPU_SEL)) #define cpu_has_mpx boot_cpu_has(X86_FEATURE_MPX) #define cpu_has_avx512f boot_cpu_has(X86_FEATURE_AVX512F) -#define cpu_has_avx512dq boot_cpu_has(X86_FEATURE_AVX512DQ) -#define cpu_has_rdseed boot_cpu_has(X86_FEATURE_RDSEED) #define cpu_has_smap boot_cpu_has(X86_FEATURE_SMAP) -#define cpu_has_avx512_ifma boot_cpu_has(X86_FEATURE_AVX512_IFMA) #define cpu_has_clflushopt boot_cpu_has(X86_FEATURE_CLFLUSHOPT) #define cpu_has_clwb boot_cpu_has(X86_FEATURE_CLWB) -#define cpu_has_avx512cd boot_cpu_has(X86_FEATURE_AVX512CD) #define cpu_has_proc_trace boot_cpu_has(X86_FEATURE_PROC_TRACE) -#define cpu_has_sha boot_cpu_has(X86_FEATURE_SHA) #define cpu_has_avx512bw boot_cpu_has(X86_FEATURE_AVX512BW) -#define cpu_has_avx512vl boot_cpu_has(X86_FEATURE_AVX512VL) /* CPUID level 0x00000007:0.ecx */ -#define cpu_has_avx512_vbmi boot_cpu_has(X86_FEATURE_AVX512_VBMI) #define cpu_has_pku boot_cpu_has(X86_FEATURE_PKU) -#define cpu_has_avx512_vbmi2 boot_cpu_has(X86_FEATURE_AVX512_VBMI2) -#define cpu_has_gfni boot_cpu_has(X86_FEATURE_GFNI) -#define cpu_has_vaes boot_cpu_has(X86_FEATURE_VAES) -#define cpu_has_vpclmulqdq boot_cpu_has(X86_FEATURE_VPCLMULQDQ) -#define cpu_has_avx512_vnni boot_cpu_has(X86_FEATURE_AVX512_VNNI) -#define cpu_has_avx512_bitalg boot_cpu_has(X86_FEATURE_AVX512_BITALG) -#define cpu_has_avx512_vpopcntdq boot_cpu_has(X86_FEATURE_AVX512_VPOPCNTDQ) #define cpu_has_rdpid boot_cpu_has(X86_FEATURE_RDPID) -#define cpu_has_movdiri boot_cpu_has(X86_FEATURE_MOVDIRI) -#define cpu_has_movdir64b boot_cpu_has(X86_FEATURE_MOVDIR64B) -#define cpu_has_enqcmd boot_cpu_has(X86_FEATURE_ENQCMD) #define cpu_has_pks boot_cpu_has(X86_FEATURE_PKS) /* CPUID level 0x80000007.edx */ @@ -241,38 +205,23 @@ static inline bool boot_cpu_has(unsigned int feat) #define cpu_has_auto_ibrs boot_cpu_has(X86_FEATURE_AUTO_IBRS) /* CPUID level 0x00000007:0.edx */ -#define cpu_has_avx512_vp2intersect boot_cpu_has(X86_FEATURE_AVX512_VP2INTERSECT) #define cpu_has_srbds_ctrl boot_cpu_has(X86_FEATURE_SRBDS_CTRL) #define cpu_has_md_clear boot_cpu_has(X86_FEATURE_MD_CLEAR) #define cpu_has_rtm_always_abort boot_cpu_has(X86_FEATURE_RTM_ALWAYS_ABORT) #define cpu_has_tsx_force_abort boot_cpu_has(X86_FEATURE_TSX_FORCE_ABORT) -#define cpu_has_serialize boot_cpu_has(X86_FEATURE_SERIALIZE) #define cpu_has_hybrid boot_cpu_has(X86_FEATURE_HYBRID) -#define cpu_has_avx512_fp16 boot_cpu_has(X86_FEATURE_AVX512_FP16) #define cpu_has_arch_caps boot_cpu_has(X86_FEATURE_ARCH_CAPS) /* CPUID level 0x00000007:1.eax */ -#define cpu_has_sha512 boot_cpu_has(X86_FEATURE_SHA512) -#define cpu_has_sm3 boot_cpu_has(X86_FEATURE_SM3) -#define cpu_has_sm4 boot_cpu_has(X86_FEATURE_SM4) -#define cpu_has_avx_vnni boot_cpu_has(X86_FEATURE_AVX_VNNI) -#define cpu_has_avx512_bf16 boot_cpu_has(X86_FEATURE_AVX512_BF16) -#define cpu_has_cmpccxadd boot_cpu_has(X86_FEATURE_CMPCCXADD) #define cpu_has_fred boot_cpu_has(X86_FEATURE_FRED) #define cpu_has_lkgs boot_cpu_has(X86_FEATURE_LKGS) #define cpu_has_nmi_src boot_cpu_has(X86_FEATURE_NMI_SRC) -#define cpu_has_avx_ifma boot_cpu_has(X86_FEATURE_AVX_IFMA) /* CPUID level 0x80000021.eax */ #define cpu_has_lfence_dispatch boot_cpu_has(X86_FEATURE_LFENCE_DISPATCH) #define cpu_has_verw_clear boot_cpu_has(X86_FEATURE_VERW_CLEAR) #define cpu_has_nscb boot_cpu_has(X86_FEATURE_NSCB) -/* CPUID level 0x00000007:1.edx */ -#define cpu_has_avx_vnni_int8 boot_cpu_has(X86_FEATURE_AVX_VNNI_INT8) -#define cpu_has_avx_ne_convert boot_cpu_has(X86_FEATURE_AVX_NE_CONVERT) -#define cpu_has_avx_vnni_int16 boot_cpu_has(X86_FEATURE_AVX_VNNI_INT16) - /* MSR_ARCH_CAPS */ #define cpu_has_rdcl_no boot_cpu_has(X86_FEATURE_RDCL_NO) #define cpu_has_eibrs boot_cpu_has(X86_FEATURE_EIBRS) diff --git a/xen/arch/x86/x86_emulate/0f01.c b/xen/arch/x86/x86_emulate/0f01.c index 87d338f0c7..36a8881410 100644 --- a/xen/arch/x86/x86_emulate/0f01.c +++ b/xen/arch/x86/x86_emulate/0f01.c @@ -121,7 +121,7 @@ int x86emul_0f01(struct x86_emulate_state *s, switch ( s->vex.pfx ) { case vex_none: /* serialize */ - host_and_vcpu_must_have(serialize); + vcpu_must_have(serialize); asm volatile ( ".byte 0x0f, 0x01, 0xe8" ); /* Binutils >= 2.34, Clang >= 11 */ break; case vex_f2: /* xsusldtrk */ diff --git a/xen/arch/x86/x86_emulate/0fc7.c b/xen/arch/x86/x86_emulate/0fc7.c index 58c8f79501..2d9c4e0e56 100644 --- a/xen/arch/x86/x86_emulate/0fc7.c +++ b/xen/arch/x86/x86_emulate/0fc7.c @@ -33,7 +33,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, case 6: /* rdrand */ generate_exception_if(s->vex.pfx >= vex_f3, X86_EXC_UD); - host_and_vcpu_must_have(rdrand); + vcpu_must_have(rdrand); *dst = s->ea; switch ( s->op_bytes ) { @@ -75,7 +75,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, } generate_exception_if(s->vex.pfx >= vex_f3, X86_EXC_UD); - host_and_vcpu_must_have(rdseed); + vcpu_must_have(rdseed); *dst = s->ea; switch ( s->op_bytes ) { @@ -112,7 +112,7 @@ int x86emul_0fc7(struct x86_emulate_state *s, fail_if(!ops->cmpxchg); if ( s->rex_prefix & REX_W ) { - host_and_vcpu_must_have(cx16); + vcpu_must_have(cx16); generate_exception_if(!is_aligned(s->ea.mem.seg, s->ea.mem.off, 16, ctxt, ops), X86_EXC_GP, 0); diff --git a/xen/arch/x86/x86_emulate/fpu.c b/xen/arch/x86/x86_emulate/fpu.c index 9cc37a1d8e..88df238981 100644 --- a/xen/arch/x86/x86_emulate/fpu.c +++ b/xen/arch/x86/x86_emulate/fpu.c @@ -96,13 +96,13 @@ int x86emul_fpu(struct x86_emulate_state *s, unsigned long dummy; case 0x9b: /* wait/fwait */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_wait); emulate_fpu_insn_stub(b); break; case 0xd8: /* FPU 0xd8 */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -128,7 +128,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xd9: /* FPU 0xd9 */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -229,7 +229,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xda: /* FPU 0xda */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -250,7 +250,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdb: /* FPU 0xdb */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -279,7 +279,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fild m32i */ goto fpu_memsrc32; case 1: /* fisttp m32i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fist m32i */ case 3: /* fistp m32i */ @@ -308,7 +308,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdc: /* FPU 0xdc */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -334,7 +334,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdd: /* FPU 0xdd */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -353,7 +353,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fld m64fp */; goto fpu_memsrc64; case 1: /* fisttp m64i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fst m64fp */ case 3: /* fstp m64fp */ @@ -399,7 +399,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xde: /* FPU 0xde */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -421,7 +421,7 @@ int x86emul_fpu(struct x86_emulate_state *s, break; case 0xdf: /* FPU 0xdf */ - host_and_vcpu_must_have(fpu); + vcpu_must_have(fpu); get_fpu(X86EMUL_FPU_fpu); switch ( s->modrm ) { @@ -451,7 +451,7 @@ int x86emul_fpu(struct x86_emulate_state *s, case 0: /* fild m16i */ goto fpu_memsrc16; case 1: /* fisttp m16i */ - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); /* fall through */ case 2: /* fist m16i */ case 3: /* fistp m16i */ diff --git a/xen/arch/x86/x86_emulate/private.h b/xen/arch/x86/x86_emulate/private.h index 1b06c60248..2d69c24b86 100644 --- a/xen/arch/x86/x86_emulate/private.h +++ b/xen/arch/x86/x86_emulate/private.h @@ -620,26 +620,6 @@ amd_like(const struct x86_emulate_ctxt *ctxt) #define vcpu_must_have(feat) \ generate_exception_if(!vcpu_has_##feat(), X86_EXC_UD) -#ifdef __XEN__ -/* - * Note the difference between vcpu_must_have() and - * host_and_vcpu_must_have(): The latter needs to be used when - * emulation code is using the same instruction class for carrying out - * the actual operation. - */ -# define host_and_vcpu_must_have(feat) ({ \ - generate_exception_if(!cpu_has_##feat, X86_EXC_UD); \ - vcpu_must_have(feat); \ -}) -#else -/* - * For the test harness both are fine to be used interchangeably, i.e. - * features known to always be available (e.g. SSE/SSE2) to (64-bit) Xen - * may be checked for by just vcpu_must_have(). - */ -# define host_and_vcpu_must_have(feat) vcpu_must_have(feat) -#endif - /* * Instruction emulation: * Most instructions are emulated directly via a fragment of inline assembly diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 80742e50d4..587e836d56 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1211,7 +1211,7 @@ static unsigned long *decode_vex_gpr( break; \ case 0: case 1: \ if ( !(lig) ) \ - host_and_vcpu_must_have(avx512vl); \ + vcpu_must_have(avx512vl); \ break; \ } \ } while ( false ) @@ -3269,15 +3269,15 @@ x86_emulate( #ifndef X86EMUL_NO_MMX case X86EMUL_OPC(0x0f, 0x0e): /* femms */ - host_and_vcpu_must_have(3dnow); + vcpu_must_have(3dnow); asm volatile ( "femms" ); break; case X86EMUL_OPC(0x0f, 0x0f): /* 3DNow! */ if ( _3dnow_table[(imm1 >> 4) & 0xf] & (1 << (imm1 & 0xf)) ) - host_and_vcpu_must_have(3dnow); + vcpu_must_have(3dnow); else if ( _3dnow_ext_table[(imm1 >> 4) & 0xf] & (1 << (imm1 & 0xf)) ) - host_and_vcpu_must_have(3dnow_ext); + vcpu_must_have(3dnow_ext); else generate_exception(X86_EXC_UD); @@ -3354,7 +3354,7 @@ x86_emulate( #endif CASE_SIMD_SCALAR_FP(, 0x0f, 0x2b): /* movnts{s,d} xmm,mem */ - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); /* fall through */ CASE_SIMD_PACKED_FP_VEX(0x0f, 0x2b): /* movntp{s,d} xmm,m128 */ /* vmovntp{s,d} {x,y}mm,mem */ @@ -3425,7 +3425,7 @@ x86_emulate( if ( (b & ~1) == 0x10 && ea.type == OP_MEM ) d |= TwoOp; simd_0f_avx: - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); simd_0f_ymm: get_fpu(X86EMUL_FPU_ymm); } @@ -3473,7 +3473,7 @@ x86_emulate( (ea.type != OP_REG && evex.brs && (evex.pfx & VEX_PREFIX_SCALAR_MASK))), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); simd_zmm: @@ -3529,7 +3529,7 @@ x86_emulate( generate_exception_if((evex.lr || evex.opmsk || evex.brs || evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( (d & DstMask) != DstMem ) d &= ~TwoOp; op_bytes = 8; @@ -3547,7 +3547,7 @@ x86_emulate( simd_0f_sse3_avx: if ( vex.opcx != vex_none ) goto simd_0f_avx; - host_and_vcpu_must_have(sse3); + vcpu_must_have(sse3); goto simd_0f_xmm; case X86EMUL_OPC_EVEX_F3(0x0f, 0x12): /* vmovsldup [xyz]mm/mem,[xyz]mm{k} */ @@ -3556,7 +3556,7 @@ x86_emulate( generate_exception_if((evex.brs || evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); d |= TwoOp; op_bytes = !(evex.pfx & VEX_PREFIX_DOUBLE_MASK) || evex.lr @@ -3593,7 +3593,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x64): /* vpblendm{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x65): /* vblendmp{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ avx512f_no_sae: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_MEM && evex.brs, X86_EXC_UD); avx512_vlen_check(false); goto simd_zmm; @@ -3634,7 +3634,7 @@ x86_emulate( case X86EMUL_OPC(0x0f, 0x2a): /* cvtpi2ps mm/m64,xmm */ CASE_SIMD_PACKED_FP(, 0x0f, 0x2c): /* cvttp{s,d}2pi xmm/mem,mm */ CASE_SIMD_PACKED_FP(, 0x0f, 0x2d): /* cvtp{s,d}2pi xmm/mem,mm */ - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); } op_bytes = (b & 4) && (vex.pfx & VEX_PREFIX_DOUBLE_MASK) ? 16 : 8; goto simd_0f_fp; @@ -3652,7 +3652,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -3673,13 +3673,13 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x2a): /* vcvtsi2sh r/m,xmm,xmm */ case X86EMUL_OPC_EVEX_F3(5, 0x7b): /* vcvtusi2sh r/m,xmm,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); /* fall through */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2a): /* vcvtsi2s{s,d} r/m,xmm,xmm */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x7b): /* vcvtusi2s{s,d} r/m,xmm,xmm */ generate_exception_if(evex.opmsk || (ea.type != OP_REG && evex.brs), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -3734,7 +3734,7 @@ x86_emulate( else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); /* Work around erratum BT230. */ @@ -3792,7 +3792,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x2d): /* vcvtsh2si xmm/mem,reg */ case X86EMUL_OPC_EVEX_F3(5, 0x78): /* vcvttsh2usi xmm/mem,reg */ case X86EMUL_OPC_EVEX_F3(5, 0x79): /* vcvtsh2usi xmm/mem,reg */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); /* fall through */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2c): /* vcvtts{s,d}2si xmm/mem,reg */ CASE_SIMD_SCALAR_FP(_EVEX, 0x0f, 0x2d): /* vcvts{s,d}2si xmm/mem,reg */ @@ -3802,7 +3802,7 @@ x86_emulate( evex.opmsk || (ea.type != OP_REG && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -3822,7 +3822,7 @@ x86_emulate( else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -3868,7 +3868,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(5, 0x2e): /* vucomish xmm/m16,xmm */ case X86EMUL_OPC_EVEX(5, 0x2f): /* vcomish xmm/m16,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ CASE_SIMD_PACKED_FP(_EVEX, 0x0f, 0x2e): /* vucomis{s,d} xmm/mem,xmm */ @@ -3877,7 +3877,7 @@ x86_emulate( (ea.type != OP_REG && evex.brs) || evex.w != evex.pfx), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(true); get_fpu(X86EMUL_FPU_zmm); @@ -4021,7 +4021,7 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x4a): /* kadd{w,q} k,k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_VEX(0x0f, 0x41): /* kand{w,q} k,k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x41): /* kand{b,d} k,k,k */ @@ -4037,11 +4037,11 @@ x86_emulate( generate_exception_if(!vex.l, X86_EXC_UD); opmask_basic: if ( vex.w ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); opmask_common: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(!vex.r || (mode_64bit() && !(vex.reg & 8)) || ea.type != OP_REG, X86_EXC_UD); @@ -4066,7 +4066,7 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x4b): /* kunpck{w,d}{d,q} k,k,k */ generate_exception_if(!vex.l, X86_EXC_UD); - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); goto opmask_common; case X86EMUL_OPC_VEX_66(0x0f, 0x4b): /* kunpckbw k,k,k */ @@ -4101,7 +4101,7 @@ x86_emulate( { if ( b != 0x50 ) { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); } else @@ -4116,9 +4116,9 @@ x86_emulate( { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); if ( b == 0x50 || !vex.l ) - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); else - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); get_fpu(X86EMUL_FPU_ymm); } @@ -4138,7 +4138,7 @@ x86_emulate( generate_exception_if((evex.w != (evex.pfx & VEX_PREFIX_DOUBLE_MASK) || (ea.type != OP_MEM && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); avx512_vlen_check(false); goto simd_zmm; @@ -4177,12 +4177,12 @@ x86_emulate( case X86EMUL_OPC_EVEX_F2(0x0f, 0x7a): /* vcvtudq2ps [xyz]mm/mem,[xyz]mm{k} */ /* vcvtuqq2ps [xyz]mm/mem,{x,y}mm{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else { case X86EMUL_OPC_EVEX(0x0f, 0x78): /* vcvttp{s,d}2udq [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX(0x0f, 0x79): /* vcvtp{s,d}2udq [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); } if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -4348,14 +4348,14 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x45): /* vpsrlv{d,q} {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x47): /* vpsllv{d,q} {x,y}mm/mem,{x,y}mm,{x,y}mm */ simd_0f_avx2: - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); goto simd_0f_ymm; } if ( vex.pfx ) goto simd_0f_sse2; #endif /* !X86EMUL_NO_SIMD */ simd_0f_mmx: - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); goto simd_0f_common; @@ -4399,7 +4399,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x0b): /* vpmulhrsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x1c): /* vpabsb [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x1d): /* vpabsw [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << (b & 1); goto avx512f_no_sae; @@ -4431,7 +4431,7 @@ x86_emulate( generate_exception_if(b != 0x27 && evex.w != (b & 1), X86_EXC_UD); goto avx512f_no_sae; } - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << (ext == ext_0f ? b & 1 : evex.w); avx512_vlen_check(false); @@ -4462,7 +4462,7 @@ x86_emulate( if ( vex.opcx != vex_none ) { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -4472,7 +4472,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4504,7 +4504,7 @@ x86_emulate( dst.bytes = 2; /* fall through */ case X86EMUL_OPC_EVEX_66(5, 0x6e): /* vmovw r/m16,xmm */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f, 0x6e): /* vmov{d,q} r/m,xmm */ @@ -4512,7 +4512,7 @@ x86_emulate( generate_exception_if((evex.lr || evex.opmsk || evex.brs || evex.reg != 0xf || !evex.RX), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); opc = init_evex(stub); @@ -4570,7 +4570,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F2(0x0f, 0x6f): /* vmovdqu{8,16} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_F2(0x0f, 0x7f): /* vmovdqu{8,16} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); elem_bytes = 1 << evex.w; goto vmovdqa; @@ -4608,7 +4608,7 @@ x86_emulate( if ( vex.l ) { simd_0f_imm8_avx2: - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); } else { @@ -4622,7 +4622,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x40): /* vdpps $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ #endif simd_0f_imm8_avx: - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); } simd_0f_imm8_ymm: get_fpu(X86EMUL_FPU_ymm); @@ -4635,7 +4635,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); get_fpu(X86EMUL_FPU_mmx); } @@ -4663,7 +4663,7 @@ x86_emulate( generate_exception_if(evex.w, X86_EXC_UD); else { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); } d = (d & ~SrcMask) | SrcMem | TwoOp; @@ -4693,9 +4693,9 @@ x86_emulate( if ( vex.opcx != vex_none ) { if ( vex.l ) - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); else - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -4705,7 +4705,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4815,7 +4815,7 @@ x86_emulate( if ( vex.opcx != vex_none ) { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); #ifdef __x86_64__ @@ -4856,7 +4856,7 @@ x86_emulate( else #endif /* !X86EMUL_NO_SIMD */ { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } @@ -4882,7 +4882,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f, 0x78): /* insertq $imm8,$imm8,xmm,xmm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); get_fpu(X86EMUL_FPU_xmm); opc = init_prefixes(stub); @@ -4896,7 +4896,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f, 0x79): /* extrq xmm,xmm */ case X86EMUL_OPC_F2(0x0f, 0x79): /* insertq xmm,xmm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(sse4a); + vcpu_must_have(sse4a); op_bytes = 8; goto simd_0f_xmm; @@ -4909,7 +4909,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f, 0xe6): /* vcvtdq2pd {x,y}mm/mem,[xyz]mm{k} */ /* vcvtqq2pd [xyz]mm/mem,[xyz]mm{k} */ if ( evex.pfx != vex_f3 ) - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); else if ( evex.w ) { case X86EMUL_OPC_EVEX_66(0x0f, 0x78): /* vcvttps2uqq {x,y}mm/mem,[xyz]mm{k} */ @@ -4920,11 +4920,11 @@ x86_emulate( /* vcvttpd2qq [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0x7b): /* vcvtps2qq {x,y}mm/mem,[xyz]mm{k} */ /* vcvtpd2qq [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } else { - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); /* * While SDM version 085 has explicit wording towards embedded * rounding being ignored, it's still not entirely unambiguous with @@ -4971,7 +4971,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f, 0xd6): /* vmovq xmm,xmm/m64 */ generate_exception_if(evex.lr || !evex.w || evex.opmsk || evex.brs, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); d |= TwoOp; op_bytes = 8; goto simd_zmm; @@ -4997,15 +4997,15 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x90): /* kmov{w,q} k/mem,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x90): /* kmov{b,d} k/mem,k */ generate_exception_if(vex.l || !vex.r, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.w ) { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); op_bytes = 4 << !vex.pfx; } else if ( vex.pfx ) { - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); op_bytes = 1; } else @@ -5031,14 +5031,14 @@ x86_emulate( generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.pfx == vex_f2 ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else { generate_exception_if(vex.w, X86_EXC_UD); if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } get_fpu(X86EMUL_FPU_opmask); @@ -5070,10 +5070,10 @@ x86_emulate( dst = ea; dst.reg = decode_gpr(&_regs, modrm_reg); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.pfx == vex_f2 ) { - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); dst.bytes = 4 << (mode_64bit() && vex.w); } else @@ -5081,7 +5081,7 @@ x86_emulate( generate_exception_if(vex.w, X86_EXC_UD); dst.bytes = 4; if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); } get_fpu(X86EMUL_FPU_opmask); @@ -5105,18 +5105,18 @@ x86_emulate( case X86EMUL_OPC_VEX(0x0f, 0x99): /* ktest{w,q} k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_VEX(0x0f, 0x98): /* kortest{w,q} k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x98): /* kortest{b,d} k,k */ case X86EMUL_OPC_VEX_66(0x0f, 0x99): /* ktest{b,d} k,k */ generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( vex.w ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( vex.pfx ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); get_fpu(X86EMUL_FPU_opmask); @@ -5306,7 +5306,7 @@ x86_emulate( break; case X86EMUL_OPC_F3(0x0f, 0xb8): /* popcnt r/m,r */ - host_and_vcpu_must_have(popcnt); + vcpu_must_have(popcnt); asm ( "popcnt %1,%0" : "=r" (dst.val) : "rm" (src.val) ); _regs.eflags &= ~EFLAGS_MASK; if ( !dst.val ) @@ -5403,7 +5403,7 @@ x86_emulate( (evex.pfx & VEX_PREFIX_SCALAR_MASK)) || !evex.r || !evex.R || evex.z), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); simd_imm8_zmm: @@ -5447,9 +5447,9 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x22): /* vpinsr{d,q} $imm8,r/m,xmm,xmm */ generate_exception_if(evex.lr || evex.opmsk || evex.brs, X86_EXC_UD); if ( b & 2 ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); if ( !mode_64bit() ) evex.w = 0; memcpy(mmvalp, &src.val, src.bytes); @@ -5486,7 +5486,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x25): /* vpternlog{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ avx512f_imm8_no_sae: - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_MEM && evex.brs, X86_EXC_UD); avx512_vlen_check(false); goto simd_imm8_zmm; @@ -5556,7 +5556,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f, 0xd6): /* movdq2q xmm,mm */ generate_exception_if(ea.type != OP_REG, X86_EXC_UD); op_bytes = 8; - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); goto simd_0f_int; #endif /* !X86EMUL_NO_MMX && !X86EMUL_NO_SIMD */ @@ -5585,7 +5585,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f, 0xe4): /* vpmulhuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0xea): /* vpminsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f, 0xee): /* vpmaxsw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = b & 0x10 ? 1 : 2; goto avx512f_no_sae; @@ -5608,7 +5608,7 @@ x86_emulate( { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); d |= TwoOp; - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } else if ( vex.pfx ) @@ -5618,7 +5618,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); vcpu_must_have(mmxext); get_fpu(X86EMUL_FPU_mmx); } @@ -5680,7 +5680,7 @@ x86_emulate( CASE_SIMD_PACKED_INT(0x0f38, 0x1c): /* pabsb {,x}mm/mem,{,x}mm */ CASE_SIMD_PACKED_INT(0x0f38, 0x1d): /* pabsw {,x}mm/mem,{,x}mm */ CASE_SIMD_PACKED_INT(0x0f38, 0x1e): /* pabsd {,x}mm/mem,{,x}mm */ - host_and_vcpu_must_have(ssse3); + vcpu_must_have(ssse3); if ( vex.pfx ) { simd_0f38_common: @@ -5688,7 +5688,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } opc = init_prefixes(stub); @@ -5715,7 +5715,7 @@ x86_emulate( if ( ea.type != OP_MEM ) { generate_exception_if(b & 2, X86_EXC_UD); - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); } /* fall through */ case X86EMUL_OPC_VEX_66(0x0f38, 0x0c): /* vpermilps {x,y}mm/mem,{x,y}mm,{x,y}mm */ @@ -5731,13 +5731,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x17): /* vptest {x,y}mm/mem,{x,y}mm */ if ( vex.opcx == vex_none ) { - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); get_fpu(X86EMUL_FPU_xmm); } else { generate_exception_if(vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -5804,13 +5804,13 @@ x86_emulate( case X86EMUL_OPC_66(0x0f38, 0x3f): /* pmaxud xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f38, 0x40): /* pmulld xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f38, 0x41): /* phminposuw xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); goto simd_0f38_common; case X86EMUL_OPC_EVEX_66(0x0f38, 0x10): /* vpsrlvw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x11): /* vpsravw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x12): /* vpsllvw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(!evex.w || evex.brs, X86_EXC_UD); elem_bytes = 2; goto avx512f_no_sae; @@ -5820,7 +5820,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f38, 0x20): /* vpmovswb [xyz]mm,{x,y}mm/mem{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x30): /* vpmovzxbw {x,y}mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x30): /* vpmovwb [xyz]mm,{x,y}mm/mem{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); if ( evex.pfx != vex_f3 ) { case X86EMUL_OPC_EVEX_66(0x0f38, 0x21): /* vpmovsxbd xmm/mem,[xyz]mm{k} */ @@ -5862,13 +5862,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x13): /* vcvtph2ps xmm/mem,{x,y}mm */ generate_exception_if(vex.w, X86_EXC_UD); - host_and_vcpu_must_have(f16c); + vcpu_must_have(f16c); op_bytes = 8 << vex.l; goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0x13): /* vcvtph2ps {x,y}mm/mem,[xyz]mm{k} */ generate_exception_if(evex.w || (ea.type != OP_REG && evex.brs), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( !evex.brs ) avx512_vlen_check(false); op_bytes = 8 << evex.lr; @@ -5922,7 +5922,7 @@ x86_emulate( op_bytes = 8; generate_exception_if(evex.brs, X86_EXC_UD); if ( !evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512_broadcast; case X86EMUL_OPC_EVEX_66(0x0f38, 0x1a): /* vbroadcastf32x4 m128,{y,z}mm{k} */ @@ -5932,7 +5932,7 @@ x86_emulate( generate_exception_if(ea.type != OP_MEM || !evex.lr || evex.brs, X86_EXC_UD); if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512_broadcast; case X86EMUL_OPC_VEX_66(0x0f38, 0x20): /* vpmovsxbw xmm/mem,{x,y}mm */ @@ -5957,9 +5957,9 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(0x0f38, 0x28): /* vpmovm2{b,w} k,[xyz]mm */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x38): /* vpmovm2{d,q} k,[xyz]mm */ if ( b & 0x10 ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.opmsk || ea.type != OP_REG, X86_EXC_UD); d |= TwoOp; op_bytes = 16 << evex.lr; @@ -6002,7 +6002,7 @@ x86_emulate( fault_suppression = false; /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x44): /* vplzcnt{d,q} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512cd); + vcpu_must_have(avx512cd); goto avx512f_no_sae; case X86EMUL_OPC_VEX_66(0x0f38, 0x2c): /* vmaskmovps mem,{x,y}mm,{x,y}mm */ @@ -6013,7 +6013,7 @@ x86_emulate( typeof(vex) *pvex; generate_exception_if(ea.type != OP_MEM || vex.w, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); elem_bytes = 4 << (b & 1); vmaskmov: get_fpu(X86EMUL_FPU_ymm); @@ -6078,7 +6078,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0xba): /* vfmsub231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbc): /* vfnmadd231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbe): /* vfnmsub231p{s,d} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); goto simd_zmm; @@ -6097,28 +6097,28 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0xbb): /* vfmsub231s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbd): /* vfnmadd231s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xbf): /* vfnmsub231s{s,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); goto simd_zmm; case X86EMUL_OPC_66(0x0f38, 0x37): /* pcmpgtq xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); goto simd_0f38_common; case X86EMUL_OPC_EVEX_66(0x0f38, 0x38): /* vpminsb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3a): /* vpminuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3c): /* vpmaxsb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x3e): /* vpmaxuw [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = b & 2 ?: 1; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x40): /* vpmull{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); goto avx512f_no_sae; case X86EMUL_OPC_66(0x0f38, 0xdb): /* aesimc xmm/m128,xmm */ @@ -6127,7 +6127,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f38, 0xdd): /* aesenclast xmm/m128,xmm,xmm */ case X86EMUL_OPC_66(0x0f38, 0xde): /* aesdec xmm/m128,xmm,xmm */ case X86EMUL_OPC_66(0x0f38, 0xdf): /* aesdeclast xmm/m128,xmm,xmm */ - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); if ( vex.opcx == vex_none ) goto simd_0f38_common; /* fall through */ @@ -6141,7 +6141,7 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0x51): /* vpdpbuuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0x51): /* vpdpbsuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0x51): /* vpdpbssds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni_int8); + vcpu_must_have(avx_vnni_int8); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6150,7 +6150,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x51): /* vpdpbusds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x52): /* vpdpwssd [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x53): /* vpdpwssds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni); + vcpu_must_have(avx_vnni); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_ymm; @@ -6158,7 +6158,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x51): /* vpdpbusds [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x52): /* vpdpwssd [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x53): /* vpdpwssds [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vnni); + vcpu_must_have(avx512_vnni); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_no_sae; @@ -6170,7 +6170,7 @@ x86_emulate( d |= TwoOp; /* fall through */ case X86EMUL_OPC_EVEX_F3(0x0f38, 0x52): /* vdpbf16ps [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_bf16); + vcpu_must_have(avx512_bf16); generate_exception_if(evex.w, X86_EXC_UD); op_bytes = 16 << evex.lr; goto avx512f_no_sae; @@ -6187,7 +6187,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x4d): /* vrcp14s{s,d} xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x4f): /* vrsqrt14s{s,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.brs, X86_EXC_UD); avx512_vlen_check(true); goto simd_zmm; @@ -6196,16 +6196,16 @@ x86_emulate( generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x54): /* vpopcnt{b,w} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_bitalg); + vcpu_must_have(avx512_bitalg); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x66): /* vpblendm{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << evex.w; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x55): /* vpopcnt{d,q} [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vpopcntdq); + vcpu_must_have(avx512_vpopcntdq); goto avx512f_no_sae; case X86EMUL_OPC_VEX_66(0x0f38, 0x5a): /* vbroadcasti128 m128,ymm */ @@ -6214,14 +6214,14 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x62): /* vpexpand{b,w} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x63): /* vpcompress{b,w} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); elem_bytes = 1 << evex.w; /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x88): /* vexpandp{s,d} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x89): /* vpexpand{d,q} [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8a): /* vcompressp{s,d} [xyz]mm,[xyz]mm/mem{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8b): /* vpcompress{d,q} [xyz]mm,[xyz]mm/mem{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.brs, X86_EXC_UD); avx512_vlen_check(false); /* @@ -6245,7 +6245,7 @@ x86_emulate( goto simd_zmm; case X86EMUL_OPC_EVEX_F2(0x0f38, 0x68): /* vp2intersect{d,q} [xyz]mm/mem,[xyz]mm,k+1 */ - host_and_vcpu_must_have(avx512_vp2intersect); + vcpu_must_have(avx512_vp2intersect); generate_exception_if(evex.opmsk || !evex.r || !evex.R, X86_EXC_UD); op_bytes = 16 << evex.lr; goto avx512f_no_sae; @@ -6257,7 +6257,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x71): /* vpshldv{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x73): /* vpshrdv{d,q} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); goto avx512f_no_sae; case X86EMUL_OPC_VEX (0x0f38, 0xb0): /* vcvtneoph2ps mem,[xy]mm */ @@ -6267,7 +6267,7 @@ x86_emulate( generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_VEX_F3(0x0f38, 0x72): /* vcvtneps2bf16 [xy]mm/mem,xmm */ - host_and_vcpu_must_have(avx_ne_convert); + vcpu_must_have(avx_ne_convert); generate_exception_if(vex.w, X86_EXC_UD); d |= TwoOp; op_bytes = 16 << vex.l; @@ -6277,16 +6277,16 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x7d): /* vpermt2{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x8d): /* vperm{b,w} [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ if ( !evex.w ) - host_and_vcpu_must_have(avx512_vbmi); + vcpu_must_have(avx512_vbmi); else - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); fault_suppression = false; goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(0x0f38, 0x78): /* vpbroadcastb xmm/m8,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x79): /* vpbroadcastw xmm/m16,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); op_bytes = elem_bytes = 1 << (b & 1); /* See the comment at the avx512_broadcast label. */ @@ -6295,14 +6295,14 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x7a): /* vpbroadcastb r32,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x7b): /* vpbroadcastw r32,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.w, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f38, 0x7c): /* vpbroadcast{d,q} reg,[xyz]mm{k} */ generate_exception_if((ea.type != OP_REG || evex.brs || evex.reg != 0xf || !evex.RX), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); get_fpu(X86EMUL_FPU_zmm); @@ -6371,7 +6371,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f38, 0x83): /* vpmultishiftqb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ generate_exception_if(!evex.w, X86_EXC_UD); - host_and_vcpu_must_have(avx512_vbmi); + vcpu_must_have(avx512_vbmi); fault_suppression = false; goto avx512f_no_sae; @@ -6388,7 +6388,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0x8c): /* vpmaskmov{d,q} mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0x8e): /* vpmaskmov{d,q} {x,y}mm,{x,y}mm,mem */ generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); - host_and_vcpu_must_have(avx2); + vcpu_must_have(avx2); elem_bytes = 4 << vex.w; goto vmaskmov; @@ -6530,7 +6530,7 @@ x86_emulate( modrm_reg == state->sib_index), X86_EXC_UD); avx512_vlen_check(false); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); /* Read destination and index registers. */ @@ -6670,7 +6670,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xbd): /* vfnmadd231s{s,d} xmm/mem,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xbe): /* vfnmsub231p{s,d} {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xbf): /* vfnmsub231s{s,d} xmm/mem,xmm,xmm */ - host_and_vcpu_must_have(fma); + vcpu_must_have(fma); goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0xa0): /* vpscatterd{d,q} [xyz]mm,mem{k} */ @@ -6692,7 +6692,7 @@ x86_emulate( modrm_reg == state->sib_index), X86_EXC_UD); avx512_vlen_check(false); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); /* Read source and index registers. */ @@ -6795,20 +6795,20 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xb1): /* vbcstnesh2ps mem,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0xb1): /* vbcstnebf162ps mem,[xy]mm */ - host_and_vcpu_must_have(avx_ne_convert); + vcpu_must_have(avx_ne_convert); generate_exception_if(vex.w || ea.type != OP_MEM, X86_EXC_UD); op_bytes = 2; goto simd_0f_ymm; case X86EMUL_OPC_VEX_66(0x0f38, 0xb4): /* vpmadd52luq [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xb5): /* vpmadd52huq [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_ifma); + vcpu_must_have(avx_ifma); generate_exception_if(!vex.w, X86_EXC_UD); goto simd_0f_ymm; case X86EMUL_OPC_EVEX_66(0x0f38, 0xb4): /* vpmadd52luq [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xb5): /* vpmadd52huq [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_ifma); + vcpu_must_have(avx512_ifma); generate_exception_if(!evex.w, X86_EXC_UD); goto avx512f_no_sae; @@ -6818,29 +6818,29 @@ x86_emulate( case X86EMUL_OPC(0x0f38, 0xcb): /* sha256rnds2 XMM0,xmm/m128,xmm */ case X86EMUL_OPC(0x0f38, 0xcc): /* sha256msg1 xmm/m128,xmm */ case X86EMUL_OPC(0x0f38, 0xcd): /* sha256msg2 xmm/m128,xmm */ - host_and_vcpu_must_have(sha); + vcpu_must_have(sha); op_bytes = 16; goto simd_0f38_common; case X86EMUL_OPC_VEX_F2(0x0f38, 0xcb): /* vsha512rnds2 xmm,ymm,ymm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xcc): /* vsha512msg1 xmm,ymm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xcd): /* vsha512msg2 ymm,ymm */ - host_and_vcpu_must_have(sha512); + vcpu_must_have(sha512); generate_exception_if(ea.type != OP_REG || vex.w || !vex.l, X86_EXC_UD); op_bytes = 32; goto simd_0f_ymm; case X86EMUL_OPC_66(0x0f38, 0xcf): /* gf2p8mulb xmm/m128,xmm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); goto simd_0f38_common; case X86EMUL_OPC_VEX_66(0x0f38, 0xcf): /* vgf2p8mulb {x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_avx; case X86EMUL_OPC_EVEX_66(0x0f38, 0xcf): /* vgf2p8mulb [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); elem_bytes = 1; goto avx512f_no_sae; @@ -6851,7 +6851,7 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0xd3): /* vpdpwuuds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xd3): /* vpdpwusds [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F3(0x0f38, 0xd3): /* vpdpwsuds [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(avx_vnni_int16); + vcpu_must_have(avx_vnni_int16); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6859,12 +6859,12 @@ x86_emulate( case X86EMUL_OPC_VEX (0x0f38, 0xda): /* vsm3msg1 xmm/mem,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xda): /* vsm3msg2 xmm/mem,xmm,xmm */ generate_exception_if(vex.w || vex.l, X86_EXC_UD); - host_and_vcpu_must_have(sm3); + vcpu_must_have(sm3); goto simd_0f_ymm; case X86EMUL_OPC_VEX_F3(0x0f38, 0xda): /* vsm4key4 [xy]mm/mem,[xy]mm,[xy]mm */ case X86EMUL_OPC_VEX_F2(0x0f38, 0xda): /* vsm4rnds4 [xy]mm/mem,[xy]mm,[xy]mm */ - host_and_vcpu_must_have(sm4); + vcpu_must_have(sm4); generate_exception_if(vex.w, X86_EXC_UD); op_bytes = 16 << vex.l; goto simd_0f_ymm; @@ -6874,16 +6874,16 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f38, 0xde): /* vaesdec {x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f38, 0xdf): /* vaesdeclast {x,y}mm/mem,{x,y}mm,{x,y}mm */ if ( !vex.l ) - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); else - host_and_vcpu_must_have(vaes); + vcpu_must_have(vaes); goto simd_0f_avx; case X86EMUL_OPC_EVEX_66(0x0f38, 0xdc): /* vaesenc [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xdd): /* vaesenclast [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xde): /* vaesdec [xyz]mm/mem,[xyz]mm,[xyz]mm */ case X86EMUL_OPC_EVEX_66(0x0f38, 0xdf): /* vaesdeclast [xyz]mm/mem,[xyz]mm,[xyz]mm */ - host_and_vcpu_must_have(vaes); + vcpu_must_have(vaes); generate_exception_if(evex.brs || evex.opmsk, X86_EXC_UD); goto avx512f_no_sae; @@ -6893,7 +6893,7 @@ x86_emulate( X86EMUL_OPC_VEX_66(0x0f38, 0xef): /* cmpxadd r,r,m */ generate_exception_if(!mode_64bit() || dst.type != OP_MEM || vex.l, X86_EXC_UD); - host_and_vcpu_must_have(cmpccxadd); + vcpu_must_have(cmpccxadd); fail_if(!ops->rmw); state->rmw = rmw_cmpccxadd; break; @@ -6925,7 +6925,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f38, 0xf0): /* crc32 r/m8, r{32,64} */ case X86EMUL_OPC_F2(0x0f38, 0xf1): /* crc32 r/m{16,32,64}, r{32,64} */ - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); dst.bytes = rex_prefix & REX_W ? 8 : 4; switch ( op_bytes ) { @@ -6965,9 +6965,9 @@ x86_emulate( typeof(vex) *pvex = container_of(buf + 1, typeof(vex), raw[0]); if ( b == 0xf5 || vex.pfx ) - host_and_vcpu_must_have(bmi2); + vcpu_must_have(bmi2); else - host_and_vcpu_must_have(bmi1); + vcpu_must_have(bmi1); generate_exception_if(vex.l, X86_EXC_UD); buf[0] = 0xc4; @@ -6998,7 +6998,7 @@ x86_emulate( case 1: /* blsr r,r/m */ case 2: /* blsmsk r,r/m */ case 3: /* blsi r,r/m */ - host_and_vcpu_must_have(bmi1); + vcpu_must_have(bmi1); break; default: goto unrecognized_insn; @@ -7070,7 +7070,7 @@ x86_emulate( break; case X86EMUL_OPC_66(0x0f38, 0xf8): /* movdir64b r,m512 */ - host_and_vcpu_must_have(movdir64b); + vcpu_must_have(movdir64b); generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); src.val = truncate_ea(*dst.reg); generate_exception_if(!is_aligned(x86_seg_es, src.val, 64, ctxt, ops), @@ -7088,7 +7088,7 @@ x86_emulate( case X86EMUL_OPC_F2(0x0f38, 0xf8): /* enqcmd r,m512 */ case X86EMUL_OPC_F3(0x0f38, 0xf8): /* enqcmds r,m512 */ - host_and_vcpu_must_have(enqcmd); + vcpu_must_have(enqcmd); generate_exception_if(ea.type != OP_MEM, X86_EXC_UD); generate_exception_if(vex.pfx != vex_f2 && !mode_ring0(), X86_EXC_GP, 0); src.val = truncate_ea(*dst.reg); @@ -7119,7 +7119,7 @@ x86_emulate( break; case X86EMUL_OPC(0x0f38, 0xf9): /* movdiri mem,r */ - host_and_vcpu_must_have(movdiri); + vcpu_must_have(movdiri); generate_exception_if(dst.type != OP_MEM, X86_EXC_UD); fail_if(!ops->blk); state->blk = blk_movdir; @@ -7177,7 +7177,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x40): /* dpps $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x41): /* dppd $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x42): /* mpsadbw $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); goto simd_0f3a_common; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x0a): /* vrndscaless $imm8,xmm/mem,xmm,xmm{k} */ @@ -7186,7 +7186,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x08): /* vrndscaleps $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x09): /* vrndscalepd $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.w != (b & 1), X86_EXC_UD); avx512_vlen_check(b & 2); goto simd_imm8_zmm; @@ -7195,7 +7195,7 @@ x86_emulate( generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX(0x0f3a, 0x08): /* vrndscaleph $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); avx512_vlen_check(b & 2); goto simd_imm8_zmm; @@ -7203,7 +7203,7 @@ x86_emulate( #endif /* X86EMUL_NO_SIMD */ CASE_SIMD_PACKED_INT(0x0f3a, 0x0f): /* palignr $imm8,{,x}mm/mem,{,x}mm */ - host_and_vcpu_must_have(ssse3); + vcpu_must_have(ssse3); if ( vex.pfx ) { simd_0f3a_common: @@ -7211,7 +7211,7 @@ x86_emulate( } else { - host_and_vcpu_must_have(mmx); + vcpu_must_have(mmx); get_fpu(X86EMUL_FPU_mmx); } opc = init_prefixes(stub); @@ -7242,7 +7242,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x15): /* pextrw $imm8,xmm,r/m */ case X86EMUL_OPC_66(0x0f3a, 0x16): /* pextr{d,q} $imm8,xmm,r/m */ case X86EMUL_OPC_66(0x0f3a, 0x17): /* extractps $imm8,xmm,r/m */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); get_fpu(X86EMUL_FPU_xmm); opc = init_prefixes(stub); @@ -7281,7 +7281,7 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x16): /* vpextr{d,q} $imm8,xmm,r/m */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x17): /* vextractps $imm8,xmm,r/m */ generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); /* Work around erratum BT41. */ @@ -7308,11 +7308,11 @@ x86_emulate( evex.opmsk || evex.brs), X86_EXC_UD); if ( !(b & 2) ) - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); else if ( !(b & 1) ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); else - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_zmm); opc = init_evex(stub); goto pextr; @@ -7326,7 +7326,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x39): /* vextracti32x4 $imm8,{y,z}mm,xmm/m128{k} */ /* vextracti64x2 $imm8,{y,z}mm,xmm/m128{k} */ if ( evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x23): /* vshuff32x4 $imm8,{y,z}mm/mem,{y,z}mm,{y,z}mm{k} */ @@ -7346,7 +7346,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x3b): /* vextracti32x8 $imm8,zmm,ymm/m256{k} */ /* vextracti64x4 $imm8,zmm,ymm/m256{k} */ if ( !evex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(evex.lr != 2 || evex.brs, X86_EXC_UD); fault_suppression = false; goto avx512f_imm8_no_sae; @@ -7362,14 +7362,14 @@ x86_emulate( generate_exception_if((evex.w || evex.reg != 0xf || !evex.RX || (ea.type != OP_REG && evex.brs)), X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); avx512_vlen_check(false); opc = init_evex(stub); } else { generate_exception_if(vex.w || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(f16c); + vcpu_must_have(f16c); opc = init_prefixes(stub); } @@ -7454,7 +7454,7 @@ x86_emulate( if ( !(b & 0x20) ) goto avx512f_imm8_no_sae; avx512bw_imm: - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); generate_exception_if(evex.brs, X86_EXC_UD); elem_bytes = 1 << evex.w; avx512_vlen_check(false); @@ -7462,7 +7462,7 @@ x86_emulate( case X86EMUL_OPC_66(0x0f3a, 0x20): /* pinsrb $imm8,r32/m8,xmm */ case X86EMUL_OPC_66(0x0f3a, 0x22): /* pinsr{d,q} $imm8,r/m,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); memcpy(mmvalp, &src.val, src.bytes); ea.type = OP_MEM; d = SrcMem16; /* Fake for the common SIMD code below. */ @@ -7481,7 +7481,7 @@ x86_emulate( goto simd_0f_int_imm8; case X86EMUL_OPC_66(0x0f3a, 0x21): /* insertps $imm8,xmm/m32,xmm */ - host_and_vcpu_must_have(sse4_1); + vcpu_must_have(sse4_1); op_bytes = 4; goto simd_0f3a_common; @@ -7493,7 +7493,7 @@ x86_emulate( goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x21): /* vinsertps $imm8,xmm/m32,xmm,xmm */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(evex.lr || evex.w || evex.opmsk || evex.brs, X86_EXC_UD); op_bytes = 4; @@ -7501,18 +7501,18 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x50): /* vrangep{s,d} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x56): /* vreducep{s,d} $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x26): /* vgetmantp{s,d} $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x54): /* vfixupimmp{s,d} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); goto simd_imm8_zmm; case X86EMUL_OPC_EVEX(0x0f3a, 0x26): /* vgetmantph $imm8,[xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x56): /* vreduceph $imm8,[xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7520,11 +7520,11 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x51): /* vranges{s,d} $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x57): /* vreduces{s,d} $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x27): /* vgetmants{s,d} $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x55): /* vfixupimms{s,d} $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); @@ -7532,7 +7532,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(0x0f3a, 0x27): /* vgetmantsh $imm8,xmm/mem,xmm,xmm{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x57): /* vreducesh $imm8,xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( !evex.brs ) avx512_vlen_check(true); @@ -7543,31 +7543,31 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x30): /* kshiftr{b,w} $imm8,k,k */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x32): /* kshiftl{b,w} $imm8,k,k */ if ( !vex.w ) - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); opmask_shift_imm: generate_exception_if(vex.l || !vex.r || vex.reg != 0xf || ea.type != OP_REG, X86_EXC_UD); - host_and_vcpu_must_have(avx512f); + vcpu_must_have(avx512f); get_fpu(X86EMUL_FPU_opmask); op_bytes = 1; /* Any non-zero value will do. */ goto simd_0f_imm8; case X86EMUL_OPC_VEX_66(0x0f3a, 0x31): /* kshiftr{d,q} $imm8,k,k */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x33): /* kshiftl{d,q} $imm8,k,k */ - host_and_vcpu_must_have(avx512bw); + vcpu_must_have(avx512bw); goto opmask_shift_imm; case X86EMUL_OPC_66(0x0f3a, 0x44): /* pclmulqdq $imm8,xmm/m128,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x44): /* vpclmulqdq $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(pclmulqdq); + vcpu_must_have(pclmulqdq); if ( vex.opcx == vex_none ) goto simd_0f3a_common; if ( vex.l ) - host_and_vcpu_must_have(vpclmulqdq); + vcpu_must_have(vpclmulqdq); goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0x44): /* vpclmulqdq $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm */ - host_and_vcpu_must_have(vpclmulqdq); + vcpu_must_have(vpclmulqdq); generate_exception_if(evex.brs || evex.opmsk, X86_EXC_UD); goto avx512f_imm8_no_sae; @@ -7575,7 +7575,7 @@ x86_emulate( /* vpermil2ps $imm,{x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x49): /* vpermil2pd $imm,{x,y}mm/mem,{x,y}mm,{x,y}mm,{x,y}mm */ /* vpermil2pd $imm,{x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_imm8_ymm; case X86EMUL_OPC_VEX_66(0x0f3a, 0x4a): /* vblendvps {x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ @@ -7627,7 +7627,7 @@ x86_emulate( /* vfnmsubss xmm/m32,xmm,xmm,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0x7f): /* vfnmsubsd xmm,xmm/m64,xmm,xmm */ /* vfnmsubsd xmm/m64,xmm,xmm,xmm */ - host_and_vcpu_must_have(fma4); + vcpu_must_have(fma4); goto simd_0f_imm8_ymm; case X86EMUL_OPC_66(0x0f3a, 0x60): /* pcmpestrm $imm8,xmm/m128,xmm */ @@ -7640,13 +7640,13 @@ x86_emulate( case X86EMUL_OPC_VEX_66(0x0f3a, 0x63): /* vpcmpistri $imm8,xmm/m128,xmm */ if ( vex.opcx == vex_none ) { - host_and_vcpu_must_have(sse4_2); + vcpu_must_have(sse4_2); get_fpu(X86EMUL_FPU_xmm); } else { generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); - host_and_vcpu_must_have(avx); + vcpu_must_have(avx); get_fpu(X86EMUL_FPU_ymm); } @@ -7695,7 +7695,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(0x0f3a, 0x66): /* vfpclassp{s,d} $imm8,[xyz]mm/mem,k{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x67): /* vfpclasss{s,d} $imm8,xmm/mem,k{k} */ - host_and_vcpu_must_have(avx512dq); + vcpu_must_have(avx512dq); generate_exception_if(!evex.r || !evex.R || evex.z, X86_EXC_UD); if ( !(b & 1) ) goto avx512f_imm8_no_sae; @@ -7705,7 +7705,7 @@ x86_emulate( case X86EMUL_OPC_EVEX(0x0f3a, 0x66): /* vfpclassph $imm8,[xyz]mm/mem,k{k} */ case X86EMUL_OPC_EVEX(0x0f3a, 0x67): /* vfpclasssh $imm8,xmm/mem,k{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); if ( !(b & 1) ) goto avx512f_imm8_no_sae; @@ -7720,51 +7720,51 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x71): /* vpshld{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0x73): /* vpshrd{d,q} $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_vbmi2); + vcpu_must_have(avx512_vbmi2); goto avx512f_imm8_no_sae; case X86EMUL_OPC_EVEX_F3(0x0f3a, 0xc2): /* vcmpsh $imm8,xmm/mem,xmm,k{k} */ generate_exception_if(ea.type != OP_REG && evex.brs, X86_EXC_UD); /* fall through */ case X86EMUL_OPC_EVEX(0x0f3a, 0xc2): /* vcmpph $imm8,[xyz]mm/mem,[xyz]mm,k{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || !evex.r || !evex.R || evex.z, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(evex.pfx & VEX_PREFIX_SCALAR_MASK); goto simd_imm8_zmm; case X86EMUL_OPC(0x0f3a, 0xcc): /* sha1rnds4 $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(sha); + vcpu_must_have(sha); op_bytes = 16; goto simd_0f3a_common; case X86EMUL_OPC_66(0x0f3a, 0xce): /* gf2p8affineqb $imm8,xmm/m128,xmm */ case X86EMUL_OPC_66(0x0f3a, 0xcf): /* gf2p8affineinvqb $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); goto simd_0f3a_common; case X86EMUL_OPC_VEX_66(0x0f3a, 0xce): /* vgf2p8affineqb $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0xcf): /* vgf2p8affineinvqb $imm8,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(!vex.w, X86_EXC_UD); goto simd_0f_imm8_avx; case X86EMUL_OPC_EVEX_66(0x0f3a, 0xce): /* vgf2p8affineqb $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(0x0f3a, 0xcf): /* vgf2p8affineinvqb $imm8,[xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(gfni); + vcpu_must_have(gfni); generate_exception_if(!evex.w, X86_EXC_UD); fault_suppression = false; goto avx512f_imm8_no_sae; case X86EMUL_OPC_VEX_66(0x0f3a, 0xde): /* vsm3rnds2 $imm8,xmm/mem,xmm,xmm */ - host_and_vcpu_must_have(sm3); + vcpu_must_have(sm3); generate_exception_if(vex.w || vex.l, X86_EXC_UD); op_bytes = 16; goto simd_0f_imm8_ymm; case X86EMUL_OPC_66(0x0f3a, 0xdf): /* aeskeygenassist $imm8,xmm/m128,xmm */ case X86EMUL_OPC_VEX_66(0x0f3a, 0xdf): /* vaeskeygenassist $imm8,xmm/m128,xmm */ - host_and_vcpu_must_have(aesni); + vcpu_must_have(aesni); if ( vex.opcx == vex_none ) goto simd_0f3a_common; generate_exception_if(vex.l, X86_EXC_UD); @@ -7803,13 +7803,13 @@ x86_emulate( CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5d): /* vmin{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5e): /* vdiv{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ CASE_SIMD_SINGLE_FP(_EVEX, 5, 0x5f): /* vmax{p,s}h [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_all_fp; CASE_SIMD_ALL_FP(_EVEX, 5, 0x5a): /* vcvtp{h,d}2p{h,d} [xyz]mm/mem,[xyz]mm{k} */ /* vcvts{h,d}2s{h,d} xmm/mem,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); if ( vex.pfx & VEX_PREFIX_SCALAR_MASK ) d &= ~TwoOp; op_bytes = 2 << (((evex.pfx & VEX_PREFIX_SCALAR_MASK) ? 0 : 1 + evex.lr) + @@ -7820,7 +7820,7 @@ x86_emulate( /* vcvtqq2ph [xyz]mm/mem,xmm{k} */ case X86EMUL_OPC_EVEX_F2(5, 0x7a): /* vcvtudq2ph [xyz]mm/mem,[xy]mm{k} */ /* vcvtuqq2ph [xyz]mm/mem,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); op_bytes = 16 << evex.lr; @@ -7830,7 +7830,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_F3(5, 0x5b): /* vcvttph2dq [xy]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX (5, 0x78): /* vcvttph2udq [xy]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX (5, 0x79): /* vcvtph2udq [xy]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7841,7 +7841,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(5, 0x79): /* vcvtph2uqq xmm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(5, 0x7a): /* vcvttph2qq xmm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(5, 0x7b): /* vcvtph2qq xmm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7878,7 +7878,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0xba): /* vfmsub231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbc): /* vfnmadd231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbe): /* vfnmsub231ph [xyz]mm/mem,[xyz]mm,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); if ( ea.type != OP_REG || !evex.brs ) avx512_vlen_check(false); @@ -7900,7 +7900,7 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0xbb): /* vfmsub231sh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbd): /* vfnmadd231sh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0xbf): /* vfnmsub231sh xmm/m16,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || (ea.type != OP_REG && evex.brs), X86_EXC_UD); if ( !evex.brs ) @@ -7909,13 +7909,13 @@ x86_emulate( case X86EMUL_OPC_EVEX_66(6, 0x4c): /* vrcpph [xyz]mm/mem,[xyz]mm{k} */ case X86EMUL_OPC_EVEX_66(6, 0x4e): /* vrsqrtph [xyz]mm/mem,[xyz]mm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w, X86_EXC_UD); goto avx512f_no_sae; case X86EMUL_OPC_EVEX_66(6, 0x4d): /* vrcpsh xmm/m16,xmm,xmm{k} */ case X86EMUL_OPC_EVEX_66(6, 0x4f): /* vrsqrtsh xmm/m16,xmm,xmm{k} */ - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || evex.brs, X86_EXC_UD); avx512_vlen_check(true); goto simd_zmm; @@ -7933,7 +7933,7 @@ x86_emulate( { unsigned int src1 = ~evex.reg; - host_and_vcpu_must_have(avx512_fp16); + vcpu_must_have(avx512_fp16); generate_exception_if(evex.w || ((b & 1) && ea.type != OP_REG && evex.brs), X86_EXC_UD); if ( mode_64bit() ) @@ -7993,7 +7993,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_XOP(08, 0xa2): /* vpcmov {x,y}mm/mem,{x,y}mm,{x,y}mm,{x,y}mm */ /* vpcmov {x,y}mm,{x,y}mm/mem,{x,y}mm,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_imm8_ymm; #endif /* X86EMUL_NO_SIMD */ @@ -8008,7 +8008,7 @@ x86_emulate( case 5: /* blcic r/m,r */ case 6: /* blsic r/m,r */ case 7: /* t1mskc r/m,r */ - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); break; default: goto unrecognized_insn; @@ -8042,7 +8042,7 @@ x86_emulate( { case 1: /* blcmsk r/m,r */ case 6: /* blci r/m,r */ - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); goto xop_09_rm_rv; } goto unrecognized_insn; @@ -8065,7 +8065,7 @@ x86_emulate( /* fall through */ case X86EMUL_OPC_XOP(09, 0x80): /* vfrczps {x,y}mm/mem,{x,y}mm */ case X86EMUL_OPC_XOP(09, 0x81): /* vfrczpd {x,y}mm/mem,{x,y}mm */ - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); generate_exception_if(vex.w, X86_EXC_UD); goto simd_0f_ymm; @@ -8111,7 +8111,7 @@ x86_emulate( case X86EMUL_OPC_XOP(09, 0x9b): /* vpshaq xmm/m128,xmm,xmm */ /* vpshaq xmm,xmm/m128,xmm */ generate_exception_if(vex.l, X86_EXC_UD); - host_and_vcpu_must_have(xop); + vcpu_must_have(xop); goto simd_0f_ymm; #endif /* X86EMUL_NO_SIMD */ @@ -8121,7 +8121,7 @@ x86_emulate( uint8_t *buf = get_stub(stub); typeof(vex) *pxop = container_of(buf + 1, typeof(vex), raw[0]); - host_and_vcpu_must_have(tbm); + vcpu_must_have(tbm); generate_exception_if(vex.l || vex.reg != 0xf, X86_EXC_UD); if ( ea.type == OP_REG ) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373535.1620300 (Exim 4.92) (envelope-from ) id 1wogeG-0005gj-31; Tue, 28 Jul 2026 12:11:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373535.1620300; Tue, 28 Jul 2026 12:11:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeG-0005gc-0K; Tue, 28 Jul 2026 12:11:04 +0000 Received: by outflank-mailman (input) for mailman id 1373535; Tue, 28 Jul 2026 12:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeE-0005fU-4S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogeE-00DPPC-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogeE-003FTk-09 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=opp/66NU990sh6yndJBTeBSN01e5o6YMH0Uctd+W+qY=; b=RrV4PVZjuSnGpJ4sbwQrBBcq0f NWvmk+x73Hu+9W4HIgnII+7rLNurrAO5iOQh4f5SCkfSHfjiuzifNfiRkuft775ygfT41X+RJsg2y CoTNGwTMoOvlv2Hn5Cn8uLdiBIwAdCizypyFgB20FmhRHjBzsXBzCe3NMzJDCatHxxkQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:11:02 +0000 commit f2cac32029e639a0974ca6752fbc3fafdd4f139a Author: Jan Beulich AuthorDate: Wed Jul 15 16:45:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/analyze.yaml | 2 +- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 +++- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 021264908c..55f2b0d102 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/analyze.yaml b/automation/gitlab-ci/analyze.yaml index 3f7532ee1d..c650ed61c4 100644 --- a/automation/gitlab-ci/analyze.yaml +++ b/automation/gitlab-ci/analyze.yaml @@ -59,6 +59,7 @@ eclair-x86_64-allcode: CONFIG_PERF_ARRAYS=y CONFIG_PERF_COUNTERS=y CONFIG_PV32=y + CONFIG_SHADOW_PAGING=y CONFIG_UNSUPPORTED=y CONFIG_XEN_GUEST=y CONFIG_XHCI=y @@ -91,7 +92,6 @@ eclair-x86_64-amd: CONFIG_PV=n CONFIG_XEN_IBT=n CONFIG_XEN_SHSTK=n - CONFIG_SHADOW_PAGING=n CONFIG_HVM_FEP=n CONFIG_TBOOT=n CONFIG_HYPFS=n diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index d5929e34ec..27eefec5f9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -296,12 +296,16 @@ debian-13-x86_64-gcc-debug: <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86_64-build-debug <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 2ce4747f6e..3ce0774b8d 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -145,7 +145,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help Shadow paging is a software alternative to hardware paging support @@ -160,6 +159,9 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. + config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373545.1620305 (Exim 4.92) (envelope-from ) id 1wogeQ-0005pS-57; Tue, 28 Jul 2026 12:11:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373545.1620305; Tue, 28 Jul 2026 12:11:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeQ-0005pH-2D; Tue, 28 Jul 2026 12:11:14 +0000 Received: by outflank-mailman (input) for mailman id 1373545; Tue, 28 Jul 2026 12:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeO-0005o4-6n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogeO-00DPPG-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogeO-003FWm-0S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=N52I8wTvwFuAonaYfR7LBUVLA0lSkXiNdWIyu7V4dPk=; b=xVc5hEc45ChcOTpZhY3NUyOV0E DFFJogo+hBh12b1Lt0lvGtCS+D2zIXGDDRhEvBoAO9ZJpkitWsVZRptN/QAVvdPXTXkozqeRHB8nc W+8AhmBnDQBrujbZsrt5AuxsdyQuY6Sjg34JB3LkKY5mEoizdEfQq95resgL5I/4wxQ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 12:11:12 +0000 commit 40c59b6c29b1317707a94194f8121c0d7445b89c Author: Grygorii Strashko AuthorDate: Wed Jul 15 16:59:28 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index a3d18bc464..a7f9cc5fe0 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373553.1620308 (Exim 4.92) (envelope-from ) id 1wogea-0005tY-6g; Tue, 28 Jul 2026 12:11:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373553.1620308; Tue, 28 Jul 2026 12:11:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogea-0005tQ-3r; Tue, 28 Jul 2026 12:11:24 +0000 Received: by outflank-mailman (input) for mailman id 1373553; Tue, 28 Jul 2026 12:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeY-0005se-9j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogeY-00DPPO-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogeY-003FZF-0l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=URZoJhkCFlnJvqEWiReAbtj0lPChG0aaBvymTIZPq0o=; b=cFsM784QQXcdDPLSRSiY3n+xgy PitcNzx8jr6TT/424qeTif0SwhzW0LrPZrgCADubJSJf5aZcckPUAF97cdd1wQxfjEQd40Xs3ow3E ry7z/yu/iNXSrTsxRQARaDUgZN3hOR9c0ZtdwgiL8onbaCc9GCl5gDkhxqnALNBEMcgk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:11:22 +0000 commit fd11acab3db4e9162a284169956099490c32e919 Author: Syed Abdul Khaliq AuthorDate: Wed Jul 15 17:00:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373557.1620313 (Exim 4.92) (envelope-from ) id 1wogek-000648-8C; Tue, 28 Jul 2026 12:11:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373557.1620313; Tue, 28 Jul 2026 12:11:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogek-00063x-5G; Tue, 28 Jul 2026 12:11:34 +0000 Received: by outflank-mailman (input) for mailman id 1373557; Tue, 28 Jul 2026 12:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogei-00062W-Cz for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogei-00DPPS-25 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogei-003Fca-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=I08Vff2i5z6ZK1nOLiVWtJJVoPOaPdPeq1z3d0cb2YE=; b=U3qzosay0MHQhDOxS+tRd5j0rM PVuDHu0lEzNtLFDx1U6ItfZe3lJBy8PdRTIc9V+lVjXFuY8yN7Z51g3AVYrDo0X6rGHZQxTnKmPfS C7XB3LchjAhg8Lm96EpLO+oaYRUeDGHinW1HxgnMgZTDmWSRZ4w/R4C0GuuIhAXNPnBo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:11:32 +0000 commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 0431f875af..6dee4922f3 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -735,10 +735,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -761,10 +757,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -789,20 +781,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index cc799273f5..5633c02c4b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1207,6 +1207,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1216,6 +1217,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1536,12 +1538,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373569.1620316 (Exim 4.92) (envelope-from ) id 1wogeu-0006C5-9C; Tue, 28 Jul 2026 12:11:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373569.1620316; Tue, 28 Jul 2026 12:11:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogeu-0006Bx-6Y; Tue, 28 Jul 2026 12:11:44 +0000 Received: by outflank-mailman (input) for mailman id 1373569; Tue, 28 Jul 2026 12:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woges-0006AY-G3 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woges-00DPPW-2P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woges-003Fg3-1P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xTfepP6BrVpqg3ty2Hw/8CD7ayI+rjBekdE9dRJNqVc=; b=18JUrBVTvJdfBePz0lJz0tPCAV WyVnxTX5aoVj56ISuqYd78ZVEQWxg8pJtfow2IceEUqpZcyDSI7sXS7A8CWtj41e1VImOD6i7PL1K jQ+f08D2Uh35isTKU5a0tdQzLQ9cV66wG7idAVKT/Ms6pKK70xNnq73OdEZjGxR59x14=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:11:42 +0000 commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 74b1c0ed39..2d49e99b3c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 89823abbf8..48ca5fd3f5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -251,9 +251,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5633c02c4b..a8b9cf442f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -872,9 +872,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -942,7 +942,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:11:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:11:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373580.1620321 (Exim 4.92) (envelope-from ) id 1wogf3-0006HC-Cb; Tue, 28 Jul 2026 12:11:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373580.1620321; Tue, 28 Jul 2026 12:11:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogf3-0006H5-9z; Tue, 28 Jul 2026 12:11:53 +0000 Received: by outflank-mailman (input) for mailman id 1373580; Tue, 28 Jul 2026 12:11:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogf2-0006Gg-JE for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogf2-00DPPt-2j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogf2-003Fhs-1j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:11:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RAx+pM8VwozfbwEvaDuvbm9hsCgPTfssEFnOm8a85PA=; b=K5JPDG0kXLYu/ko8eCtjuoUkKd 6/70jlLloUKEmRW66gVkUi5wMavLw7BgNpGMnC9xO7WB7nDZVjidObJBnzfpTRauC8SdogQabqcpH Z16e7i72FxpAVFBRLNxVHEoma1+xtbCKXlIP6KC1HB5CzoGREBm5vzu/T0j2X//frFAE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:11:52 +0000 commit 751e371c913ca87d0a66304dfa6837158835cac5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 3609721426..55b71301cf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2122,10 +2122,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2d49e99b3c..30a6f86e70 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 48ca5fd3f5..4e2cae51f0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -231,13 +228,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 6c17bbff3a..98bf9a73eb 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a8b9cf442f..57b2e1b287 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -606,7 +606,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -880,7 +880,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -916,6 +915,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,9 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373583.1620325 (Exim 4.92) (envelope-from ) id 1wogfD-0006KO-EK; Tue, 28 Jul 2026 12:12:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373583.1620325; Tue, 28 Jul 2026 12:12:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfD-0006KF-Ba; Tue, 28 Jul 2026 12:12:03 +0000 Received: by outflank-mailman (input) for mailman id 1373583; Tue, 28 Jul 2026 12:12:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfC-0006K7-Mb for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogfC-00DPQ8-33 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogfC-003FkS-24 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=SVqBBRtd35OeLrp6YUg0d70de/wE9vHOMHNtaBCJsv4=; b=10ixiQdmjGmJOcaKmQ9pJzfiwu 5xWGX1uLiSmmCXWnnE+DDm1ZOvniRbMcts3zvR+HXvHEH10qolT0JF24ppHstFaqfm1TgNkkFPPjs KmKW8aZF4i29z5wNqjfPaO4p1+mE1xUxgUtIzINQLuyCXWPp4nf07omcqg75YISesqQo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:12:02 +0000 commit 3179bf29311f9ed54b931bc95782b061afec5897 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 57b2e1b287..4e5b75dfaf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -878,7 +878,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -925,6 +924,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373595.1620329 (Exim 4.92) (envelope-from ) id 1wogfN-0006PS-Fa; Tue, 28 Jul 2026 12:12:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373595.1620329; Tue, 28 Jul 2026 12:12:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfN-0006PL-D0; Tue, 28 Jul 2026 12:12:13 +0000 Received: by outflank-mailman (input) for mailman id 1373595; Tue, 28 Jul 2026 12:12:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfM-0006PE-Pv for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogfN-00DPQC-0A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogfM-003Fnp-2M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=h6X1zgEQPSuM7ptSXKk1CP8+06dzghhLY/GSwWUDtmg=; b=5hBUlnk4NJRHsUBQ3/k81ieGqw IGDyA/GmC5Pq5dBCBnMMWGeQIFYTpuDh7yy4RN+4P1xmKzVt7EV8KBSKJawx9DaucF+aJOlZshWQJ 3LI/u+B3Dc7WesXQZGp8gLFvlUe/u9ZQ64zrkdVivIdD8ztW9dNIy1mxnNQPgTktoh7U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:12:12 +0000 commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 30a6f86e70..1cc248d710 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 4e2cae51f0..7609c4c5db 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -245,11 +244,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 98bf9a73eb..89d37b6537 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4e5b75dfaf..b37d4bf2a2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -877,13 +877,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -949,16 +954,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1903,7 +1898,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373599.1620334 (Exim 4.92) (envelope-from ) id 1wogfX-0006SD-Hp; Tue, 28 Jul 2026 12:12:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373599.1620334; Tue, 28 Jul 2026 12:12:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfX-0006S4-Ea; Tue, 28 Jul 2026 12:12:23 +0000 Received: by outflank-mailman (input) for mailman id 1373599; Tue, 28 Jul 2026 12:12:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfW-0006Rs-St for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogfX-00DPQG-0S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogfW-003Fq9-2g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=a5cK/JgmUpfVQXX+QkMhYbPlltrhVltWkmPZjoH0oms=; b=WrCt++qT4rsj9jLeuXpQswS5fO eplb15xDSfjeIbFcOKZIiU80w5I+3YcnYYgWdwFufaSuf/62llNzFdEHmpDcji+gUpUGfZFLPlmgJ 2nwtLFLS4KAL+I+9jclOtwBTlGuTXJubHYbyhqRac0im9IV3KdCOxzgPNu93TBTI8VRM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:12:22 +0000 commit 0501e1dc047768cba2a458b25f5e9214726c33c8 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 0fbbdd8b28..6bd4e191a7 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1cc248d710..1fd66ee947 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -390,18 +390,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 7609c4c5db..397d578c8b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -512,16 +510,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 89d37b6537..a6157a3cf8 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b37d4bf2a2..d495446ec0 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -55,6 +55,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -878,9 +883,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -932,6 +934,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1207,12 +1226,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1948,8 +1967,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373603.1620337 (Exim 4.92) (envelope-from ) id 1wogfh-0006WY-Ie; Tue, 28 Jul 2026 12:12:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373603.1620337; Tue, 28 Jul 2026 12:12:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfh-0006WQ-Fw; Tue, 28 Jul 2026 12:12:33 +0000 Received: by outflank-mailman (input) for mailman id 1373603; Tue, 28 Jul 2026 12:12:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfg-0006WJ-W3 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogfh-00DPQN-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogfg-003FsO-2z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GQhGuoxarAhssiK93uL8bCnXZucQXNleOiPllGAMMHk=; b=QsH8TxK4cxKzeCNnA0ukIJeVL4 L5eNC3WV4tjQt1ZEKlvQX7RlzQI5wbLf7Bsbgow3EAFIM1HFEqLeNZnQulorxrvvyNCasYtyyV9NL drbHhEkR01LKwIpZcV9qyvnmm/qE0Q6J0nx+u4/cOQUx6ZoQU4bCLCpSywAUSkPXNr3Y=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:12:32 +0000 commit 299de2aedabe545092b4225c3335701290bd953a Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1fd66ee947..50ef246467 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -423,12 +423,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 397d578c8b..852eac7d20 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,9 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -526,13 +523,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index a6157a3cf8..2d02655703 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,9 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d495446ec0..a6cef9d2a5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -60,6 +60,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -881,10 +885,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -915,6 +915,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1307,23 +1324,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1973,9 +1973,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373606.1620342 (Exim 4.92) (envelope-from ) id 1wogfr-0006at-LZ; Tue, 28 Jul 2026 12:12:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373606.1620342; Tue, 28 Jul 2026 12:12:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfr-0006ak-IT; Tue, 28 Jul 2026 12:12:43 +0000 Received: by outflank-mailman (input) for mailman id 1373606; Tue, 28 Jul 2026 12:12:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogfr-0006ad-3V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogfr-00DPQV-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogfr-003Fuk-09 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=U49ZEP0dOSN0ZsmQlV9PIAsffQXERk61cS0QoamJHQE=; b=fW2j4Kf0ah5yjQHF9tcTQfMQRu p7ehmbTbaw9Y3HkK2ak3OXm++kivja90973+79NFX6CObvoQbeBrDl+7SF3ZxM6FJglB8p2JbVhip j2A3uecAZH+Al82d9FDMeOGSWZPXrFzB3I+i/KtqaY1CBfOuw/blLC0i8N17NtWSz8LU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:12:43 +0000 commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e Author: Jan Beulich AuthorDate: Wed Jul 15 17:04:21 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 17e1af9fcf..b83dd7bc2a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2804,6 +2804,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:12:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:12:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373615.1620345 (Exim 4.92) (envelope-from ) id 1wogg1-0006dt-MO; Tue, 28 Jul 2026 12:12:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373615.1620345; Tue, 28 Jul 2026 12:12:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogg1-0006dl-Jl; Tue, 28 Jul 2026 12:12:53 +0000 Received: by outflank-mailman (input) for mailman id 1373615; Tue, 28 Jul 2026 12:12:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogg1-0006df-6Z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogg1-00DPQr-1S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogg1-003FxN-0T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:12:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CXxZU2HkfHujRN1B6XMyicz88d5WACiQTxOOV8i4msw=; b=uEW29HCPi24y/eS8Fk/SzQIAmb WYkV0LVxOJ5e2DUUkMmU+MlblC7w1KxIRLibFjmpGQIZhPb2OJuhDP2YMrE7Ca8PracsWcQt6XP6m pKxd/PBJGwCWivG7lMUBxGVqZfoByTVP+ky4ai4VX+4AhHPziP8QXkqLK5EHd01ZXG3g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:12:53 +0000 commit 96dfeb41774ab50c74a01483726db8bb17a31a69 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index b83dd7bc2a..33ef5f651b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2196,14 +2217,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2248,8 +2269,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2274,7 +2298,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2414,14 +2438,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2433,7 +2457,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2453,7 +2477,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2473,6 +2503,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2501,28 +2532,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2541,6 +2571,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2672,8 +2705,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2687,6 +2722,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2723,6 +2759,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2749,6 +2787,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2803,6 +2843,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3232,7 +3275,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373620.1620349 (Exim 4.92) (envelope-from ) id 1woggC-0006gH-OI; Tue, 28 Jul 2026 12:13:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373620.1620349; Tue, 28 Jul 2026 12:13:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggC-0006g9-LU; Tue, 28 Jul 2026 12:13:04 +0000 Received: by outflank-mailman (input) for mailman id 1373620; Tue, 28 Jul 2026 12:13:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggB-0006g2-9l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woggB-00DPRF-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggB-003Fzr-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=k+HpwQ3+p2YZjOgSzOt95mJL3bxTiS9XqwJcPWF8j8s=; b=J+Vbk3nFTmPf37exo6LrMN5YOG 5/2rcL3DPON+UO3oiNlv3RezG1PwyIlYP2S96utj1VzLFarDPTQRcb89tOc7TUBm4UHRfBHaGTi4Q nE4QTm2rp9XnVtFq9nQl2tSrz7mvBDup9YmKZT6NGv6qu9xcgdhtXYO8ieDmUxDgolSo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:13:03 +0000 commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3 Author: Jan Beulich AuthorDate: Mon Jul 20 16:27:39 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 53ac1d6c40..0df008f72d 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1320,7 +1320,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index e30b38a337..227313e62b 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -140,7 +140,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -152,6 +152,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -895,12 +908,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 2ca7723e50..e245b160d4 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1922,12 +1922,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index a095190fc7..aeb8b36ad1 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -193,9 +193,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif #ifdef CONFIG_VMTRACE -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373625.1620353 (Exim 4.92) (envelope-from ) id 1woggM-0006k1-Pf; Tue, 28 Jul 2026 12:13:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373625.1620353; Tue, 28 Jul 2026 12:13:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggM-0006jt-Mw; Tue, 28 Jul 2026 12:13:14 +0000 Received: by outflank-mailman (input) for mailman id 1373625; Tue, 28 Jul 2026 12:13:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggL-0006jW-Db for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woggL-00DPRJ-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggL-003G2Q-16 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=T/JfTBHuo84RCiKQGcs8mLANaSRrw/nfyBtYC0IvqSI=; b=6vpBc5sXuMNKmSY/bfdVIgYBGj y8FcYoELayqwbVl4qYdVbMM49+UZGXR/uDsZp4GRSfuBNeDO4aVztGx2Jx7FLbHHkPwNRIOFirvut a+0tyWj2OljEyFsaIUYWbUs23lBpMCk9Bb/pKcIDTqF3VAVvjhY4jNOvrwd7jHN/1wIw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:13:13 +0000 commit 52350da92619a77472ebb87f20f6a1fea49eebfd Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 4ba5881b24..65b3b79f1e 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373627.1620356 (Exim 4.92) (envelope-from ) id 1woggW-0006nE-RO; Tue, 28 Jul 2026 12:13:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373627.1620356; Tue, 28 Jul 2026 12:13:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggW-0006n6-OM; Tue, 28 Jul 2026 12:13:24 +0000 Received: by outflank-mailman (input) for mailman id 1373627; Tue, 28 Jul 2026 12:13:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggV-0006mz-Gi for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woggV-00DPRP-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggV-003G5K-1U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=f7PXeAklEQ5iWBhrlISx0o7eU3QFk7+gHhGGQ9WgjvA=; b=KokY8BsYizYg5aMMXdO6jnO8Ko 1tELL7XazX4NbfrPUJ13DRkaPPnmwhc9x7kfvh60R9GEjnEhfFKOAYurSZUbnUFahc6xWlWHV6xTg tiA3eaFnOnNJP7pEG2j+ESM4V3cdYNowhJkWQ8ubY0SlQ/jNu/c/9VzLH63QMMl6OUcs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:13:23 +0000 commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373628.1620363 (Exim 4.92) (envelope-from ) id 1woggg-0006qu-Uf; Tue, 28 Jul 2026 12:13:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373628.1620363; Tue, 28 Jul 2026 12:13:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggg-0006ql-RV; Tue, 28 Jul 2026 12:13:34 +0000 Received: by outflank-mailman (input) for mailman id 1373628; Tue, 28 Jul 2026 12:13:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggf-0006qb-JO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woggf-00DPRT-2k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggf-003G7c-1l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tR6kuX3s5rv4qSg0sdrRTFTE2qKlOaePHfYzfDUFtak=; b=FaoCIGxCMNZEd7Izoq0MWki11c LScj0wj1TpgbEkdsfDIrmKJvnqQVshgmARCb6mHISVQcm2ozd8dWi3ecPG+kZJMi1kDm5mXWBGTxj li22SQJbMBGLc29hbvHIof2jCFAD12R+OFo7/EJ1xMXiuu1OF+rmJmNRrorHTfjhLmWA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:13:33 +0000 commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878 Author: Roger Pau Monne AuthorDate: Wed Jul 15 17:32:07 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373630.1620364 (Exim 4.92) (envelope-from ) id 1woggq-0006tG-VK; Tue, 28 Jul 2026 12:13:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373630.1620364; Tue, 28 Jul 2026 12:13:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggq-0006t8-Sp; Tue, 28 Jul 2026 12:13:44 +0000 Received: by outflank-mailman (input) for mailman id 1373630; Tue, 28 Jul 2026 12:13:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggp-0006st-ME for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woggp-00DPRY-32 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggp-003GAz-23 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qW8hKXvJjQ80AiR98i9YEu80l4l7n3iABeJlGGVh6Ho=; b=Bk8KElR1ajlkVbp0aA1Zl8o3EL 8LVKeFdnvV8jb6sAdBi9TuA1TAIzZWBAl0pgJEDABq4/SEI/m8942JNQyPkMcd94UdJu4E3Vu7zik huk2SrhiFXXt/UwipErEz+wKCWHToEtiKhBjr551AXhA3UZzBEqONqhX+la2ZFIQrAlM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:13:43 +0000 commit aef948a300da3f10ca5d033177dbd794afc45e2b Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:13:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:13:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373634.1620368 (Exim 4.92) (envelope-from ) id 1wogh1-0006vo-0P; Tue, 28 Jul 2026 12:13:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373634.1620368; Tue, 28 Jul 2026 12:13:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogh0-0006vg-U8; Tue, 28 Jul 2026 12:13:54 +0000 Received: by outflank-mailman (input) for mailman id 1373634; Tue, 28 Jul 2026 12:13:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woggz-0006vT-Pa for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogh0-00DPRv-09 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woggz-003GF3-2K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:13:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RwlbgPGnknKYB330VuhxfHu8zwwcAhF0L/9os+QQA+A=; b=NYqUIclzedFdSKBkH07sfdoury 1P2Kvpsn0GoY31wZE7k6N68Ikm7416pWJEbfz+rs1Uki+meH/tUhv7C6IQV3rVLeW67/baYc7FIq4 ZCpK3XXzB8vLqb1h6gQMGbb1aYMOSOfhMspkcnhqV+Zl5o21/bb/VSQIqrJ/9uKN2AKw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:13:53 +0000 commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 7a0bebd2d3..4602c32cff 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373637.1620373 (Exim 4.92) (envelope-from ) id 1woghB-0006yY-3y; Tue, 28 Jul 2026 12:14:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373637.1620373; Tue, 28 Jul 2026 12:14:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghA-0006y7-VX; Tue, 28 Jul 2026 12:14:04 +0000 Received: by outflank-mailman (input) for mailman id 1373637; Tue, 28 Jul 2026 12:14:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogh9-0006xz-SM for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghA-00DPSD-0Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogh9-003GIU-2f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HzXXXWX0kGmk0BXbON5JrPxQ4Ph7s3eaJ65BLRwBhdY=; b=h6CZMx6WJprDhA8mkx/5M+t6Af zUF3OmLNzYO8EtlSZ7qL1pj/13xiUj+JMqVQx90f/6RcN15Dh7ccVFcucWHVGsxmUmzZz3XI3sROq 18L2uG91LxaOnxNOwUkRXwNVxtJVk82f1RvQGDDIxZ/SmsOBy1MBLCkcc22bSJeII2iE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:14:03 +0000 commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 55f2b0d102..eb07332462 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373649.1620378 (Exim 4.92) (envelope-from ) id 1woghM-00072z-4W; Tue, 28 Jul 2026 12:14:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373649.1620378; Tue, 28 Jul 2026 12:14:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghM-00072o-17; Tue, 28 Jul 2026 12:14:16 +0000 Received: by outflank-mailman (input) for mailman id 1373649; Tue, 28 Jul 2026 12:14:14 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghK-00072f-JK for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:14 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghK-00DPSI-2j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woghK-003GOF-1k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qZ9k8aJYI+Rk51TDV4bIxLl9pzvBSX+GfgSmjlxSu/A=; b=fysXywx5jY0ofB85sK/5jFk0os NCqJtx6cx9D4d6yKSwINFW0bYnWEOduSSiizMS/mH53kfUKSH/Rt3b3/yI8a6koVbHgZC0FRQuWhQ FIsPNxFPMY+/VuB5ScTV9It3G01QGE/YFB2zoyfy3P61zSc1aSZjrZFbzmBnokUU1A0Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:14:14 +0000 commit bd630bbdd4ff5586f06caceab8541589d06a1132 Author: Jan Beulich AuthorDate: Mon Jul 20 16:36:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/analyze.yaml | 2 +- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 +++- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index abc7beac5b..f49934f35d 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/analyze.yaml b/automation/gitlab-ci/analyze.yaml index 3f7532ee1d..c650ed61c4 100644 --- a/automation/gitlab-ci/analyze.yaml +++ b/automation/gitlab-ci/analyze.yaml @@ -59,6 +59,7 @@ eclair-x86_64-allcode: CONFIG_PERF_ARRAYS=y CONFIG_PERF_COUNTERS=y CONFIG_PV32=y + CONFIG_SHADOW_PAGING=y CONFIG_UNSUPPORTED=y CONFIG_XEN_GUEST=y CONFIG_XHCI=y @@ -91,7 +92,6 @@ eclair-x86_64-amd: CONFIG_PV=n CONFIG_XEN_IBT=n CONFIG_XEN_SHSTK=n - CONFIG_SHADOW_PAGING=n CONFIG_HVM_FEP=n CONFIG_TBOOT=n CONFIG_HYPFS=n diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index d5929e34ec..27eefec5f9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -296,12 +296,16 @@ debian-13-x86_64-gcc-debug: <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86_64-build-debug <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 2ce4747f6e..3ce0774b8d 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -145,7 +145,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help Shadow paging is a software alternative to hardware paging support @@ -160,6 +159,9 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. + config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373651.1620382 (Exim 4.92) (envelope-from ) id 1woghW-00076J-5t; Tue, 28 Jul 2026 12:14:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373651.1620382; Tue, 28 Jul 2026 12:14:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghW-00076B-2R; Tue, 28 Jul 2026 12:14:26 +0000 Received: by outflank-mailman (input) for mailman id 1373651; Tue, 28 Jul 2026 12:14:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghU-000761-MF for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghU-00DPSM-32 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woghU-003GRA-23 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=P3z0FNJd+hHYI3MEPs7mN3XkPZFpoKjY58+ql34Kfgc=; b=I7m2CB9iF9A1el/xcUnLJF1i/g Yc2vDjgszKAgFAE9fe6/R0gKNMGGGtp2Yv1cWjQGVzcUG1KF864EYPpVJi1GUYfhB2bppe7YpcfZs 9OBhXvWwdbz7kjpgY6M/Hfw9AD2be9khjQ69oT6niBexLvJ7mSIBmkgVDk1nG4he00Bw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 12:14:24 +0000 commit 2bb6ed064daf7f1e455c44592234e5e875181a57 Author: Grygorii Strashko AuthorDate: Mon Jul 20 16:37:01 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 40c59b6c29b1317707a94194f8121c0d7445b89c) --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index a3d18bc464..a7f9cc5fe0 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373655.1620385 (Exim 4.92) (envelope-from ) id 1woghg-00078W-7N; Tue, 28 Jul 2026 12:14:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373655.1620385; Tue, 28 Jul 2026 12:14:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghg-00078O-3t; Tue, 28 Jul 2026 12:14:36 +0000 Received: by outflank-mailman (input) for mailman id 1373655; Tue, 28 Jul 2026 12:14:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghe-00078H-PA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghf-00DPSS-06 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woghe-003GVc-2L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:34 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AOf/EabybkdaCNM43ZiOrJBdeFdNUTxE4vlJh7cCp0E=; b=BNMmEd+46a7IRq7vzHfI8tSSZ4 wzcCfXODgFsz7K6su+gr9hRStrgGYo/Wyy1B2DUR3FU5LGDKKS/+HzQwNr76bwY8DYW4liHNCOVzH 1oO868muiD1aeH7svVwt9xfvkhmu+4j5ylb4j/RNlFIMCmtrUuNYIA5h5VqfXaisgYNU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:14:34 +0000 commit 0d731707830ada6b117e1b895ef0336f5c32d3d0 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:37:08 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373656.1620389 (Exim 4.92) (envelope-from ) id 1woghq-0007C2-9c; Tue, 28 Jul 2026 12:14:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373656.1620389; Tue, 28 Jul 2026 12:14:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghq-0007Bu-6v; Tue, 28 Jul 2026 12:14:46 +0000 Received: by outflank-mailman (input) for mailman id 1373656; Tue, 28 Jul 2026 12:14:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogho-0007Bh-SJ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghp-00DPSZ-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogho-003GXo-2e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=oU3fD264HP2hhI7TXr+W2GcXymsxGrIMLGnDNA0Thsg=; b=1DKgYrHhFnajzNzswA/249K094 hlSX2xEmH0lCPcbu9OLhvsp7RIq9dRTUMC+isgI6QhCfJmzpL411ceEeI3Ho7iVdUQzO9puvHyN9R sznjGpK801yko6TEUUdS44HQlQItVba5K4/yN/nBfgHky3pIn1vGJRqpFzCW64UulRxY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:14:44 +0000 commit 7285f1d9408829a352dd50766b7739dadfb5a0e3 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 0431f875af..6dee4922f3 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -735,10 +735,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -761,10 +757,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -789,20 +781,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index cc799273f5..5633c02c4b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1207,6 +1207,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1216,6 +1217,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1536,12 +1538,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:14:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:14:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373658.1620392 (Exim 4.92) (envelope-from ) id 1wogi0-0007Dz-BB; Tue, 28 Jul 2026 12:14:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373658.1620392; Tue, 28 Jul 2026 12:14:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogi0-0007Dq-8O; Tue, 28 Jul 2026 12:14:56 +0000 Received: by outflank-mailman (input) for mailman id 1373658; Tue, 28 Jul 2026 12:14:55 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woghy-0007Dj-Vm for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woghz-00DPSt-0l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woghy-003GaQ-30 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:14:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=k6QQ7wsU2dtfcVKVGkT4tYrXj+zUzmiif1mJwUybSXE=; b=kkG136qpB7UuXUNNqVkAhPnHZ/ 3ZXxiIJD4Vrrdsr2ieCBWjJhtSEPkva59vLKtGq4INX5vr//iA1GFiZoEZ/1CHgEge9sKNwg53uiJ T0qc1SoXlYAYoZ/F6na8FNV85XXqBztvTkgq0YaA8EoDYEhMqC6XR/lLO4uSPu5gYJY4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:14:54 +0000 commit d1eec3dc18de5fd7140357b74c64be092a4d185a Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 74b1c0ed39..2d49e99b3c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 89823abbf8..48ca5fd3f5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -251,9 +251,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5633c02c4b..a8b9cf442f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -872,9 +872,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -942,7 +942,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373668.1620397 (Exim 4.92) (envelope-from ) id 1wogiA-0007Gq-Cb; Tue, 28 Jul 2026 12:15:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373668.1620397; Tue, 28 Jul 2026 12:15:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiA-0007Gh-9l; Tue, 28 Jul 2026 12:15:06 +0000 Received: by outflank-mailman (input) for mailman id 1373668; Tue, 28 Jul 2026 12:15:05 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogi9-0007Ga-2f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:05 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogi9-00DPTK-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:05 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogi9-003Gdq-06 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:05 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jGIezRXD5VPmm1sXScx5mBXpDKwtCIpHFA4qcKrdGGA=; b=XBHdqx6WDB9rHvD7OPzlDsLxHa BxDMgoOodCFzNb/JRfECT0iuxnPkR0CbYWmaiEoE+Ikvbh9yiwlS/Cpdp/sTYBAyRH3hd9LfmgXj9 gmRD2qnvRMUeJkRwI/Bz6Ri3GsyPzgb7debOvrsYLHrrzg53+EQNn6YTE+4FQVATbU+M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:15:05 +0000 commit 0a58e3a70e7dfbe4adf801525d30d77e41bbe0fe Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 3609721426..55b71301cf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2122,10 +2122,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2d49e99b3c..30a6f86e70 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 48ca5fd3f5..4e2cae51f0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -231,13 +228,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 6c17bbff3a..98bf9a73eb 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a8b9cf442f..57b2e1b287 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -606,7 +606,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -880,7 +880,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -916,6 +915,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,9 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373686.1620401 (Exim 4.92) (envelope-from ) id 1wogiK-0007N2-Dp; Tue, 28 Jul 2026 12:15:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373686.1620401; Tue, 28 Jul 2026 12:15:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiK-0007Mt-BC; Tue, 28 Jul 2026 12:15:16 +0000 Received: by outflank-mailman (input) for mailman id 1373686; Tue, 28 Jul 2026 12:15:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiJ-0007MQ-5j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogiJ-00DPWG-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:15 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogiJ-003GhU-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:15 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ENvA8pMFhyDkM3WEi0UbZYZ5M2mz6yZR2UW/SrSACU4=; b=r4EujEON8mcvfA7QpvOuJdNu1U elNkvsF4hysVAMN8FLbLvcxG3ZlmNUUK0K/7YIqqKbm4WNxLB47/xRamGT1CIOt4PfKd2QGfpSUWD 8D/pHEyQCg1IJFRJXDWzwkRL5oTAANfn3LNUxWWeQpoMNEtPPwTSISnYGhUBTljVmYgI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:15:15 +0000 commit 69a59f4389019edb62e926c928362249e4c54166 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 57b2e1b287..4e5b75dfaf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -878,7 +878,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -925,6 +924,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373700.1620405 (Exim 4.92) (envelope-from ) id 1wogiU-0007R0-FJ; Tue, 28 Jul 2026 12:15:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373700.1620405; Tue, 28 Jul 2026 12:15:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiU-0007Qr-CV; Tue, 28 Jul 2026 12:15:26 +0000 Received: by outflank-mailman (input) for mailman id 1373700; Tue, 28 Jul 2026 12:15:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiT-0007Qk-AJ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogiT-00DPWt-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogiT-003Go0-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RSe3u3f8yyV6MyB65MAN3pRsS+zi44+It7KnRnQcF0Y=; b=tzUrM342aiS9Ict//OobzFRo3S saeL/UV/9rNngzXZ6QAUpjdHTiP+1BmIV8BwhtIzKWjhyPBSgPshfsCscGT7RlmIeVXciSWSWR+mK jFRRSdHmsGL4L4wI/uPbCnmHz3W0lnwGBcGoRC3A3F47vq2tfDdWqbWS1w+loC+cVsR4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:15:25 +0000 commit ac31d94a08fa3768a60b4762381cee136a05f148 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 30a6f86e70..1cc248d710 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 4e2cae51f0..7609c4c5db 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -245,11 +244,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 98bf9a73eb..89d37b6537 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4e5b75dfaf..b37d4bf2a2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -877,13 +877,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -949,16 +954,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1903,7 +1898,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373701.1620410 (Exim 4.92) (envelope-from ) id 1wogie-0007V5-Hh; Tue, 28 Jul 2026 12:15:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373701.1620410; Tue, 28 Jul 2026 12:15:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogie-0007Uv-Dp; Tue, 28 Jul 2026 12:15:36 +0000 Received: by outflank-mailman (input) for mailman id 1373701; Tue, 28 Jul 2026 12:15:35 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogid-0007Un-DW for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogid-00DPX1-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogid-003GrO-1B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=26LBySGJsNEYxHAxTRUNkdYXgM0A7FGzsVUQRlW8wfE=; b=ErQ68SFLJn8XDWa7x1tRxxZ1n2 aC8hPw2uILfyt3vMZ5eza0SvqamdfnaY7tRrpYV+CNOfLV7qrlyDXA6ppViqn6n/9JRzc3UrQq5a2 JmPbII9QUfrpg8i/k0Od19eZ7GI8bYSLTmOUBs3Nl3rinHAjGove22MUMhN8rdRscZTU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:15:35 +0000 commit 525221a02ca4543146b571752049a7c7784b86df Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 0fbbdd8b28..6bd4e191a7 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1cc248d710..1fd66ee947 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -390,18 +390,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 7609c4c5db..397d578c8b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -512,16 +510,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 89d37b6537..a6157a3cf8 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b37d4bf2a2..d495446ec0 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -55,6 +55,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -878,9 +883,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -932,6 +934,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1207,12 +1226,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1948,8 +1967,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373713.1620413 (Exim 4.92) (envelope-from ) id 1wogio-0007Ym-JO; Tue, 28 Jul 2026 12:15:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373713.1620413; Tue, 28 Jul 2026 12:15:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogio-0007Yb-GT; Tue, 28 Jul 2026 12:15:46 +0000 Received: by outflank-mailman (input) for mailman id 1373713; Tue, 28 Jul 2026 12:15:45 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogin-0007YE-Gy for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:45 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogin-00DPX7-2V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:45 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogin-003GuI-1W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:45 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tbqhRiwbccwyRlPffhYxCw9hLQDwgveRkZGcDMNqoRU=; b=XD+jXZ7gkF+el+L49kwCBeDM4E SwyssMwi/QHq/AAoY6Lk+5na4BRKDwcvgjbIaegHxWq8/xeSupViOHkw5hl7iaLwIRrjZjlxGg+eE kTQ7wswNdOKzcbfqlh90TQV9I9bds7r2sonTBgt9C7pcNihuabSihBEmxMS4qeeXSYV8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:15:45 +0000 commit f06a68009c0689dfb8d1072a3457439f1a1e667c Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:31 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1fd66ee947..50ef246467 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -423,12 +423,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 397d578c8b..852eac7d20 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,9 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -526,13 +523,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index a6157a3cf8..2d02655703 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,9 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d495446ec0..a6cef9d2a5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -60,6 +60,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -881,10 +885,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -915,6 +915,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1307,23 +1324,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1973,9 +1973,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:15:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:15:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373724.1620417 (Exim 4.92) (envelope-from ) id 1wogiy-0007bV-KS; Tue, 28 Jul 2026 12:15:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373724.1620417; Tue, 28 Jul 2026 12:15:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogiy-0007bN-Hq; Tue, 28 Jul 2026 12:15:56 +0000 Received: by outflank-mailman (input) for mailman id 1373724; Tue, 28 Jul 2026 12:15:55 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogix-0007bF-KR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:55 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogix-00DPXU-2q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:55 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogix-003Gy9-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:15:55 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qwfGUl5GR9gtWVxIvC9PrHkivHeOrxo5Cq/YWn0JpyY=; b=cHpEMJvrYlcee1z21y65hvsErf tlMeJifV59F7sKENqnqjSV9GCWVUsUYrnw6ddhJOSdLYpTtd7cLwyVg4AZ2ycIGP0Cx4SqhlIX3YS mo5kfKhLS0QSP3aYd9oFNQ1Sh3EQt4GXCSSzqcZ6VclL9DN8mPokP6sR4++iMYoRgjD4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:15:55 +0000 commit 52239dd76f77b93a77602b7363644a5eb8edd028 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:36 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 17e1af9fcf..b83dd7bc2a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2804,6 +2804,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373730.1620421 (Exim 4.92) (envelope-from ) id 1wogj9-0007du-Ly; Tue, 28 Jul 2026 12:16:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373730.1620421; Tue, 28 Jul 2026 12:16:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogj9-0007dn-JF; Tue, 28 Jul 2026 12:16:07 +0000 Received: by outflank-mailman (input) for mailman id 1373730; Tue, 28 Jul 2026 12:16:05 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogj7-0007df-P0 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:05 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogj7-00DPXj-38 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:05 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogj7-003H3I-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:05 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xHKw1p5M6VTZnKUJe5X1QeBIW5PQDJudmlvfljPklWM=; b=5QON3Kxdwq+INHq+WyZyIBDUNR /L4qXXy+MQ8xGhmkuoFXxruEbxdIek/GpNrbpN8RxmGdIIAqBoILnXXjuWw09JYNjGEGN/DR5QW9d 3U0a6W+Ze7v4IrHDXRiq2OEw1c/6uJshl3EA2SUewOHhfbt9G9i/FGzXbXLbLnlWT5ko=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:16:05 +0000 commit f8fa2b21f84cb9caa894d5e1f29cc20794ef96af Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index b83dd7bc2a..33ef5f651b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2196,14 +2217,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2248,8 +2269,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2274,7 +2298,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2414,14 +2438,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2433,7 +2457,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2453,7 +2477,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2473,6 +2503,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2501,28 +2532,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2541,6 +2571,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2672,8 +2705,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2687,6 +2722,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2723,6 +2759,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2749,6 +2787,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2803,6 +2843,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3232,7 +3275,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:17 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:17 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373731.1620425 (Exim 4.92) (envelope-from ) id 1wogjJ-0007hC-OQ; Tue, 28 Jul 2026 12:16:17 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373731.1620425; Tue, 28 Jul 2026 12:16:17 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjJ-0007h4-L3; Tue, 28 Jul 2026 12:16:17 +0000 Received: by outflank-mailman (input) for mailman id 1373731; Tue, 28 Jul 2026 12:16:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjH-0007gx-Qk for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogjI-00DPXn-0G for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:15 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogjH-003H7G-2U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:15 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KnoHWVVx9VvpxtXxlyaGp4/pjKK83R+Agv+dX37WC6A=; b=1ZPSqU+1RbmAmVzE8x6mJON0MO EPyqNt5/8IbuHV51X0ho+z6XuYBKT0eJhbXTxk7eI98OkT4OxvUDZd8yvMbchQdWruqQ3WUxyCJ64 6yNenVX9czE9wyd9qKPJ/CLBt6XHooRJYZXYDGuCGvWJQcJGipszIgCWt5463k8W2zPA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:16:15 +0000 commit 14a99bce7464990e09ed38c2bfa5806eff3b7bed Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:45 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 8f2bfcae28..9289f78bd1 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1320,7 +1320,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index e30b38a337..227313e62b 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -140,7 +140,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -152,6 +152,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -895,12 +908,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 2ca7723e50..e245b160d4 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1922,12 +1922,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index a095190fc7..aeb8b36ad1 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -193,9 +193,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif #ifdef CONFIG_VMTRACE -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:27 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:27 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373733.1620429 (Exim 4.92) (envelope-from ) id 1wogjT-0007ko-QU; Tue, 28 Jul 2026 12:16:27 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373733.1620429; Tue, 28 Jul 2026 12:16:27 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjT-0007kf-Nm; Tue, 28 Jul 2026 12:16:27 +0000 Received: by outflank-mailman (input) for mailman id 1373733; Tue, 28 Jul 2026 12:16:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjR-0007kY-Th for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogjS-00DPXv-0Y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogjR-003HAY-2n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=MlWjbfnAdE3k722WlHzlclv4/H4NbEQWy5jwLrcXBrY=; b=Jnt9rbLar8YG9JwEwnsM4nOjSn 8Ve0GpYE/dCppapUWTwQEnZpcuc+1cja5jVQ87fZLnG9FfpUDFLFFxnpA7pTxf2StylQSLqprYL2L 0KWN/Q3Odktd8NxL612uCPn1vYEcW7WP1g94iLTfXSs7F5kihThsjZUPt60tNGFBRi10=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:16:25 +0000 commit f755242d6083a428263aad77e8872c58597bd47a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:37 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373734.1620433 (Exim 4.92) (envelope-from ) id 1wogjd-0007no-Ro; Tue, 28 Jul 2026 12:16:37 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373734.1620433; Tue, 28 Jul 2026 12:16:37 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjd-0007nf-P4; Tue, 28 Jul 2026 12:16:37 +0000 Received: by outflank-mailman (input) for mailman id 1373734; Tue, 28 Jul 2026 12:16:36 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjc-0007nY-0O for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:36 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogjc-00DPXz-0q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogjb-003HCi-35 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=aCX0QoSFkuZD7NWCQ4lsl9oooMhoJigASTATaLPSPbY=; b=7GF9JBsBuVrbzv2JkL3uJBGk4D pL+xF2JkxHBVenAalXuo+H6mkYmcgKexBN2ePE4YO+m1lsgwP+IU8ZfEmxOH06BYR6m1y+rjaM+2A y+kE0dpiyrcemvaYDIhrR4Vfo1n/BEzvvIuGX318x72voFPs6Fc9mAGGqUomHMr/tsmQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:16:35 +0000 commit 8e54ad2c8cd2740d1567a30b90ddb946afa88f60 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:47 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:47 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373735.1620439 (Exim 4.92) (envelope-from ) id 1wogjn-0007ph-Tr; Tue, 28 Jul 2026 12:16:47 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373735.1620439; Tue, 28 Jul 2026 12:16:47 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjn-0007pZ-QR; Tue, 28 Jul 2026 12:16:47 +0000 Received: by outflank-mailman (input) for mailman id 1373735; Tue, 28 Jul 2026 12:16:46 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjm-0007pS-3N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:46 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogjm-00DPY3-18 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:46 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogjm-003HFf-08 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:46 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=nnv/U8iMxAnrKVXAyki0aKJJM1aA9lMbkW3KGoPx9zs=; b=YQ/YPDqPffxCC6YRarnBhxcQBt M+FxLSszCnzk177NHEAyW8B76zLYrKzdFZ3pq2MhvAMgI6575FGvVtAx+GspA2JGVuAe6HiIMh36y unksHc38TW/b45ithoyy77IdaQdTdn2w9MbqE2+9lg9XXbuv9VJPTiNPX5ral1FNqQZ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:16:46 +0000 commit ca00e870e35734e9011825f0d9a191ef711af51a Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:38:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:16:57 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:16:57 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373736.1620441 (Exim 4.92) (envelope-from ) id 1wogjx-0007rb-UM; Tue, 28 Jul 2026 12:16:57 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373736.1620441; Tue, 28 Jul 2026 12:16:57 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjx-0007rT-Rn; Tue, 28 Jul 2026 12:16:57 +0000 Received: by outflank-mailman (input) for mailman id 1373736; Tue, 28 Jul 2026 12:16:56 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogjw-0007rM-6b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:56 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogjw-00DPYN-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:56 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogjw-003HIF-0R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:16:56 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=edMO90iiWC+EJ7FMvI93vMad1eyqHOKTKiCdcMBdf0c=; b=jvePjmXUTNunmNRJaYrsisXRFi wxMAeF0HbwjKGp4kwYEEHqC4qTP7x1ZivwIuXAVkkzvh7VjEXHX7SJ2NYpExV/+x6RLkQOhlQE2na eXmve/lVY9AvcG6VGt5J7Fvl8OL1aLI66AHox2BCY7oNvdn0DpRwoSXxp306vmJOQG8g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:16:56 +0000 commit 0bb5c62e39dc4fafcbbcb90ade07afafc845a674 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373737.1620445 (Exim 4.92) (envelope-from ) id 1wogk7-0007td-VY; Tue, 28 Jul 2026 12:17:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373737.1620445; Tue, 28 Jul 2026 12:17:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogk7-0007tV-T5; Tue, 28 Jul 2026 12:17:07 +0000 Received: by outflank-mailman (input) for mailman id 1373737; Tue, 28 Jul 2026 12:17:06 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogk6-0007tO-9Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:06 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogk6-00DPYc-1k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:06 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogk6-003HKM-0l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:06 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=4zqltdjyxx4iPvzQcrsuxkuIUJw6wQGuW9WhrHTGGAM=; b=607XO5kP99TtMh911MtoCru9i8 28Dl1PMcoB3WbZEZiHdP4TyjP3g22Bqh3Y1RrpWSUJ+aXi9ZSUBwddkf/rTNQL1l581YsrSxlJqtx K1JuyPethGxh06dlifabGw7LkjodQaL/9/vKHs9djxEnM3XrgcwIQF715T5hRcFBbm7E=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:17:06 +0000 commit 195a09c97140cb8179f0aea6128f0d107e0fd335 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 7a0bebd2d3..4602c32cff 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:18 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:18 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373738.1620448 (Exim 4.92) (envelope-from ) id 1wogkI-0007wt-0j; Tue, 28 Jul 2026 12:17:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373738.1620448; Tue, 28 Jul 2026 12:17:17 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkH-0007wl-UP; Tue, 28 Jul 2026 12:17:17 +0000 Received: by outflank-mailman (input) for mailman id 1373738; Tue, 28 Jul 2026 12:17:16 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkG-0007we-Co for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:16 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogkG-00DPYi-25 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:16 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogkG-003HNR-13 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:16 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=10IRGbDbKM990P+dNm5/LgdTYd2iyoCqXcDNICDld3A=; b=HfIcTZMYqXJTr2S0Dx1BrgxzDu vEavI4YYoIBAW+7I02d9M7qX6gmQg7OD5bbHxtilMJOdMuybo+u2ekjiOf9U65F/SlNSumgNxOQi1 s7RfK+f9CMr2kS3HfF9uwNaAAcEA4MFi7DtkA30GgqavF6M5ju8J8Kd9jqRl/7lQn6fE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:17:16 +0000 commit eb4905ec4e75e8a1c6a2d2da49e46c730272f7ec Author: Jan Beulich AuthorDate: Mon Jul 20 16:38:09 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index f49934f35d..7c42de4c16 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:29 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:29 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373739.1620454 (Exim 4.92) (envelope-from ) id 1wogkT-0007zs-3A; Tue, 28 Jul 2026 12:17:29 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373739.1620454; Tue, 28 Jul 2026 12:17:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkS-0007zk-Vt; Tue, 28 Jul 2026 12:17:28 +0000 Received: by outflank-mailman (input) for mailman id 1373739; Tue, 28 Jul 2026 12:17:27 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkR-0007yZ-1f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:27 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogkR-00DPYm-0x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:27 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogkQ-003HRY-3C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:26 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mOQIHxjJWXPZ5O3o0Gri7+aYBWrbsAUUWYk/k1Rs2YI=; b=YKJfVpYMCIoQiygbDin1bYDWw5 S0D32U7YDUO8biKvx3702yNDazqTHQCKhXDs1Arl/YoeaCYgPUnOTSGSyV0KbqrsAPHXg8xGA7eNm XAiCVgZssaKEWWo6y73v70+DR70VPYh+CrtTO9oyfKH3UI0p7qfvoydsCPEhQ7ll/SPo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:17:26 +0000 commit 49af80b3e025b6f95cc2e8f9c25f5fa4dce38aff Author: Jan Beulich AuthorDate: Mon Jul 20 16:38:45 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 4ba562eaf0..fa20ad629c 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 4cb52fe597..51105ebbe9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -313,11 +313,15 @@ debian-13-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 3f0f3a0f3a..06bf926976 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -144,7 +144,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -160,7 +159,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:38 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:38 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373740.1620457 (Exim 4.92) (envelope-from ) id 1wogkc-000887-5S; Tue, 28 Jul 2026 12:17:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373740.1620457; Tue, 28 Jul 2026 12:17:38 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkc-00087u-2S; Tue, 28 Jul 2026 12:17:38 +0000 Received: by outflank-mailman (input) for mailman id 1373740; Tue, 28 Jul 2026 12:17:37 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkb-00086x-4y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:37 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogkb-00DPYt-1J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:37 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogkb-003HU8-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:37 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qjhn47MZvxRTdBWdaBUa5m0zdfZorHcAeE4Ce1UPq2w=; b=cwPY30J7PxeAMs8TP7sttIj8FF bQTMCJPGgFhwiXf7SGFEsteRgwFIOpeXmCwq12Ei/5BQ1lYQo9htjvODVBsW5E71nHow80Pv9zMej ZrDkT647VLCBlwTrXtuHTrZK54gbKuOed8AhNovr5DqRthnAMCr82PXrCh7VfYFEe2iI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 12:17:37 +0000 commit d836145598f0ab01e33e7718d6b6ac9a768ab9d4 Author: Grygorii Strashko AuthorDate: Mon Jul 20 16:38:49 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 40c59b6c29b1317707a94194f8121c0d7445b89c) --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index 67700b050a..4ae7308699 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373742.1620462 (Exim 4.92) (envelope-from ) id 1wogkm-0008Eg-6s; Tue, 28 Jul 2026 12:17:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373742.1620462; Tue, 28 Jul 2026 12:17:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkm-0008EY-3y; Tue, 28 Jul 2026 12:17:48 +0000 Received: by outflank-mailman (input) for mailman id 1373742; Tue, 28 Jul 2026 12:17:47 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkl-0008ES-8F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:47 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogkl-00DPYx-1c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:47 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogkl-003HWp-0c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:47 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ngcLs13o/ysFxwWBx/rNUHMcbQdbqcRxIT7XlLPcpuU=; b=gGsR51hh0tr1MOWYlVfhDTBpAS AxmZLzF+gDRFeMjImbhnHRFfY4ztoNVSBX5jao0dyWHZxEQ9/FkiDVbMh1b7EfgbqEuhPiq2AiqQA rv7F1dSdj4FwAH/uv7sjR2VYFOd34ZMiKTPbzivQBo51rFX1bgaRDdRfyc3T0xuGRuZ0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:17:47 +0000 commit 4b52dc2021690a64fd7408cd7f0bdf3e1285e571 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:38:55 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:17:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:17:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373744.1620466 (Exim 4.92) (envelope-from ) id 1wogkw-0008Jg-8Q; Tue, 28 Jul 2026 12:17:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373744.1620466; Tue, 28 Jul 2026 12:17:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkw-0008JY-5I; Tue, 28 Jul 2026 12:17:58 +0000 Received: by outflank-mailman (input) for mailman id 1373744; Tue, 28 Jul 2026 12:17:57 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogkv-0008JA-BQ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:57 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogkv-00DPZM-1x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:57 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogkv-003HZE-0y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:17:57 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=E9Te1Dxi0+PchM9jjma+c/Eo6VV0fZF3o1AvFL8VbV8=; b=NA6YMEK4+HTctCPLj8FeCcl2US XG17xIyiEXol/jh3dJ0+ku8iwDt3Qr3xseEdtjC66WQVaO9sahtkb3iYG3zQkh4XSrBfPbihB1/6W dL9kiCds8Pv3zxRRS7lGE4lJti0tnw1aQCfKL7+NM6P0oTk6rHTJqWXbR7tphqO44PJ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:17:57 +0000 commit 42d062839d10992b303521ba14a0a8d038ab9e43 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 79bb99e0b6..40783a8d53 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -706,10 +706,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -732,10 +728,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -760,20 +752,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index ae33e324bd..953297c959 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1244,6 +1244,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1253,6 +1254,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1573,12 +1575,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373745.1620469 (Exim 4.92) (envelope-from ) id 1wogl6-0008Tk-9Q; Tue, 28 Jul 2026 12:18:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373745.1620469; Tue, 28 Jul 2026 12:18:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogl6-0008Tc-6e; Tue, 28 Jul 2026 12:18:08 +0000 Received: by outflank-mailman (input) for mailman id 1373745; Tue, 28 Jul 2026 12:18:07 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogl5-0008SG-E7 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:07 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogl5-00DPZk-2D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:07 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogl5-003HcE-1F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:07 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Gf+XRP02/luahFpsxZEUkyLUveynln0Bdpvz573zKgA=; b=rxzKJ9VH5coTO8IjecVq2LSypP xqXTHpqCD6p1GZnBnhBB577ki6T41gHmjAEJoQmReoKNVZIqYqkMvrJ7QIgPGHCINvias53PJjsxH dxRVs8rWRTRHKM6DV0BT8qT7H19QndcF4VebuhLl29bitCDsa2QJ9zedy3ykpp73Eup0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:18:07 +0000 commit 36a22b6145d1fcf6667f7a04099b521c2bf843a1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index d45d8b64fc..c00453be56 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5325e912e..555e68bd55 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -253,9 +253,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 953297c959..9014c1e82e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -905,9 +905,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -979,7 +979,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:18 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:18 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373746.1620473 (Exim 4.92) (envelope-from ) id 1woglG-00007x-BK; Tue, 28 Jul 2026 12:18:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373746.1620473; Tue, 28 Jul 2026 12:18:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglG-00007p-81; Tue, 28 Jul 2026 12:18:18 +0000 Received: by outflank-mailman (input) for mailman id 1373746; Tue, 28 Jul 2026 12:18:17 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglF-00007j-HB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:17 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woglF-00DPZo-2W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:17 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woglF-003HeN-1X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:17 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8cs4Ve8A4LaxMRgJchdJ6BLAu/+KpWDdIjJq4KFZ0F8=; b=vroBbHdbIpAqMngBzzs7fgJikF /IvNrIsG2sCS1yjrj52jXEB1uXT7mNfqzJLbpnqSnqfRVrpChRmTj54wA8Ht6yyQ18N6MnhxVIQSS NUt/qoqSrneC5L/MItfvpDbEUW6mW4qvAz0Ks5t5J00HqONooT1xOrYCPvJUlYQfBvHM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:18:17 +0000 commit 2881e008a7abea91b064a319f2b3e95b8e012a13 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 4a4c36c291..2488243c74 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2104,10 +2104,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index c00453be56..dc6f0c7ee3 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 555e68bd55..ff4cb8065c 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -233,13 +230,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 860233e4be..fa7c406553 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 9014c1e82e..de214f948b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -639,7 +639,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -913,7 +913,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -949,6 +948,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1932,9 +1934,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373747.1620477 (Exim 4.92) (envelope-from ) id 1woglQ-0000Es-Du; Tue, 28 Jul 2026 12:18:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373747.1620477; Tue, 28 Jul 2026 12:18:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglQ-0000Ek-B8; Tue, 28 Jul 2026 12:18:28 +0000 Received: by outflank-mailman (input) for mailman id 1373747; Tue, 28 Jul 2026 12:18:27 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglP-0000Ed-K7 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:27 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woglP-00DPZu-2o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:27 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woglP-003HgF-1o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:27 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=YMwUBNND5yJPyrdFJKz/ivGqmDg14ivd9raAcxgYie4=; b=2Ld9+I+pu/vF2hhQeoh92ss3yd HZlga0v9lA+3SIz6CvnOgKvdB1iDzCHF6G9/y9yp+wcnspJVFNdolPOSDpSTPt0btfVFO8726ebcJ 30RtdL83XpstjaF1Drzqp0BLth5hviUdMf1iHoSEWgicQUO1LVl048k1d0MtUmaCxMlo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:18:27 +0000 commit 1ef3886a184ac8bbea55658326ecbf4c19bfd547 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index de214f948b..e7fb1b417f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -911,7 +911,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -958,6 +957,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:38 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:38 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373748.1620481 (Exim 4.92) (envelope-from ) id 1wogla-0000Gu-FE; Tue, 28 Jul 2026 12:18:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373748.1620481; Tue, 28 Jul 2026 12:18:38 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogla-0000Gk-CW; Tue, 28 Jul 2026 12:18:38 +0000 Received: by outflank-mailman (input) for mailman id 1373748; Tue, 28 Jul 2026 12:18:37 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglZ-0000Gd-Ng for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:37 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woglZ-00DPZz-3B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:37 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woglZ-003HiX-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:37 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=o2qay2H23i3PqjvHEYEhllMMnDqjwRvzl6DVXcWpEYw=; b=DS1lENytVDIqqFx1TnxFDqXmVD nZGpBqlaXaRDazPywfhBeusr4UUEGPp94bujTIwSszy5hSoa3ymLnnOgFnP32sW4n67euLAUFimFa DHI5zeMdh/xT4inksIKeDK8W3HYh1tUF8dNlPPoWPQ7o1s+x8gOLjdWC/+kS7nSMQmWk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:18:37 +0000 commit 53d73787d84f864c63b6d8fd8d92522ef50cd903 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index dc6f0c7ee3..7bf1f85a87 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index ff4cb8065c..f175acfb38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -247,11 +246,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index fa7c406553..bade92f43b 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e7fb1b417f..6e8ded5e41 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -910,13 +910,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -986,16 +991,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1940,7 +1935,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373749.1620485 (Exim 4.92) (envelope-from ) id 1woglk-0000K9-GZ; Tue, 28 Jul 2026 12:18:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373749.1620485; Tue, 28 Jul 2026 12:18:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglk-0000K2-Ds; Tue, 28 Jul 2026 12:18:48 +0000 Received: by outflank-mailman (input) for mailman id 1373749; Tue, 28 Jul 2026 12:18:47 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglj-0000Jw-Rf for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:47 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woglk-00DPa3-0L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:47 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woglj-003HlK-2Y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:47 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=heLmd1YFUYZa64AL8ggASXt00wUnqCHNzhhsPl5kp7o=; b=rDC5VDasUZn2qRG1KtveohRAjv fuQ7Kk4gRuZoL/0XmD2vaCCavaO9GCzODzMWTCmXYELtu3kODCx7xlRz/agshIpe7pscjGTGse4uW EiKhPL+FgkC2zQmRhZKPAYVLPo7cMYA7bXrBpSV5OXeXsSDvfMZn5Vg27YKDbzWBtYi0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:18:47 +0000 commit c957b9a21b8e11526ca97c7b6fd719c10d04dba7 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1b04947516..43e00e78cc 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 7bf1f85a87..005e50ae3a 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -397,18 +397,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index f175acfb38..80f6a91771 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -124,8 +124,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -519,16 +517,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bade92f43b..c8faf6da50 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -79,8 +79,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6e8ded5e41..7ada71143f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -911,9 +916,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -965,6 +967,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1244,12 +1263,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1987,8 +2006,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:18:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:18:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373750.1620489 (Exim 4.92) (envelope-from ) id 1woglu-0000Pq-I5; Tue, 28 Jul 2026 12:18:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373750.1620489; Tue, 28 Jul 2026 12:18:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglu-0000Pi-FR; Tue, 28 Jul 2026 12:18:58 +0000 Received: by outflank-mailman (input) for mailman id 1373750; Tue, 28 Jul 2026 12:18:58 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woglt-0000Pc-VB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:57 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woglu-00DPaU-0h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:57 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woglt-003HqP-2v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:18:57 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=beC2KHm2Oo1bNwoHsniiYDLTsB3TIaVtJXX0jLO8vTA=; b=1z/GgBdvV1gbFVLwgrOoIVXCJN IoLpRq1ELGgJOM2dpNtlTF5UX0TQ7V0pZksRJfQcdk7Wds/VuNuvGjt8CyXY1QR9Ca7gEAp4kQRih FcV/kPQuUO6x+3CYVtNF30n7ufxN6+mkETJlI8GvXYzfupES1W+uHzKt7Kyz7k3IgJE4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:18:57 +0000 commit 853343502a51c761e77fe2030f9fda54cc732ba5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 005e50ae3a..084b5d7769 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -430,12 +430,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 80f6a91771..b918c435fc 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -130,9 +130,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -533,13 +530,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index c8faf6da50..360b362be6 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -85,9 +85,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 7ada71143f..fc211028c5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -61,6 +61,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -914,10 +918,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -948,6 +948,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1344,23 +1361,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -2012,9 +2012,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373751.1620493 (Exim 4.92) (envelope-from ) id 1wogm5-0000Zt-JX; Tue, 28 Jul 2026 12:19:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373751.1620493; Tue, 28 Jul 2026 12:19:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogm5-0000Zk-Gp; Tue, 28 Jul 2026 12:19:09 +0000 Received: by outflank-mailman (input) for mailman id 1373751; Tue, 28 Jul 2026 12:19:08 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogm4-0000ZV-2D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:08 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogm4-00DPak-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:08 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogm4-003HtR-00 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:08 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=I/xaINlnrTLla5+N+oT0nb1F+QS/OJP0FqKYbxOMrm8=; b=cGnGqADwwUAedj01KTFNEMIZDL 2pJNmGWz1J2btrxnTm72m7EmX7pSvmXpOiJfaT/Otko/D+UzG4+qa2GmPV1tt6rn5iW3K6XVoo4i+ PBnJqLs6BGXOD+XZXdUMv1H3278LH4Bp3j0+QWUjNlVPG6gyowgqNv16D0ljl+XHjWcg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:19:08 +0000 commit 14558d435ff90c71027fb7f9dcef2be159e93b21 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 5e09027821..5577b321d2 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2805,6 +2805,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:19 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:19 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373752.1620496 (Exim 4.92) (envelope-from ) id 1wogmF-0000gF-Lw; Tue, 28 Jul 2026 12:19:19 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373752.1620496; Tue, 28 Jul 2026 12:19:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmF-0000g7-JU; Tue, 28 Jul 2026 12:19:19 +0000 Received: by outflank-mailman (input) for mailman id 1373752; Tue, 28 Jul 2026 12:19:18 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmE-0000ee-5D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:18 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogmE-00DPao-1K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:18 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogmE-003HwB-0K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:18 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=elPUy3cZGdFKqlxO86a5c6UAnITR58+MVTdQ2kYyJug=; b=tpCIlPvBhaUpEa9s2WHg/2iqGX fqW+eOhk99omRB5/FN/BDUkPJGVDJ0zYwyNAN80qiDHBtRRfR59Aee2Wbw+oqbIoY04JWjCdzUfad Jf7b89uWJMQuGG355kc0Js29/SVptlcGOdHa7sujxoDTvuxBavyYmAWTXweLWVgMYKBk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:19:18 +0000 commit 060c68ab1df49c3a12eaa313002bd8f66f6c9459 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 5577b321d2..75433f260e 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2197,14 +2218,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2249,8 +2270,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2275,7 +2299,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2415,14 +2439,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2434,7 +2458,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2454,7 +2478,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2474,6 +2504,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2502,28 +2533,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2542,6 +2572,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2673,8 +2706,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2688,6 +2723,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2724,6 +2760,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2750,6 +2788,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2804,6 +2844,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3233,7 +3276,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:29 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:29 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373753.1620502 (Exim 4.92) (envelope-from ) id 1wogmP-0000nm-Nt; Tue, 28 Jul 2026 12:19:29 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373753.1620502; Tue, 28 Jul 2026 12:19:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmP-0000ne-Ky; Tue, 28 Jul 2026 12:19:29 +0000 Received: by outflank-mailman (input) for mailman id 1373753; Tue, 28 Jul 2026 12:19:28 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmO-0000nW-8S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:28 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogmO-00DPas-1e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:28 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogmO-003Hz6-0e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:28 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=kSGnGGr8KIBZsNEQJzLDUkKTW2wMuG60j65/N6ZQpO4=; b=sYg5xgXYtxbLYrtJM/UgqK+UHJ GyP8x9gwHj5JzZCMOTSkKdz9llhKNcS8tmf07uH+2H9DBkZd6ZTITH/KbiC0YSsLg+8xjKDcQKHyD 5Qcmnd/aTfkruHAfaFUiDllMy+UxCO+FMyiTp2UFIHAWhlN8X2MxcNx6S7cmbpmicurs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:19:28 +0000 commit bed5d12bd4f84bea9941eed5fec17685b7d2f5e5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:20 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 69fe1debcc..2a22cf5769 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1255,7 +1255,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 36ef760c2c..811e68b005 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -142,7 +142,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -154,6 +154,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -907,12 +920,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 3412c7fb4a..76a1bf1b11 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1804,12 +1804,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 613b5762b5..90a1777ff0 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -188,9 +188,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:39 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:39 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373754.1620505 (Exim 4.92) (envelope-from ) id 1wogmZ-0000zg-Op; Tue, 28 Jul 2026 12:19:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373754.1620505; Tue, 28 Jul 2026 12:19:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmZ-0000zY-MN; Tue, 28 Jul 2026 12:19:39 +0000 Received: by outflank-mailman (input) for mailman id 1373754; Tue, 28 Jul 2026 12:19:38 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmY-0000yC-B8 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:38 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogmY-00DPaw-1v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:38 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogmY-003I1y-0w for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:38 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=QQlBA9nusVzRO3Y+b5Ayd0AoKKB7JzQeOIzylq/Dup4=; b=ZGZPA960pUOpFA5l4jiJhO+o6Z +La/6wOABHxp7WrMWowp+EBG00q/r+44QbO1owZVc7B5ZytqS97x6dbsrlZ5II+pPUAm3L9whdsUG c9bMquZgWBh3JCBHjXS1HRsfXbtP/QUviYDhaePcMS9RmjSAeG9g6vvhusdbyCWI49HQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:19:38 +0000 commit e6be9150ea16584aa14ba8d05c8024b4514e574a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:49 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:49 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373755.1620510 (Exim 4.92) (envelope-from ) id 1wogmj-0001AZ-R0; Tue, 28 Jul 2026 12:19:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373755.1620510; Tue, 28 Jul 2026 12:19:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmj-0001AN-No; Tue, 28 Jul 2026 12:19:49 +0000 Received: by outflank-mailman (input) for mailman id 1373755; Tue, 28 Jul 2026 12:19:48 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmi-00019H-Dw for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:48 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogmi-00DPb2-2C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:48 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogmi-003I3r-1D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:48 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eHLNmBWiQIJz+ldTBUT0yTaORkSAJaFY/q1Iihf5TrE=; b=iF9LL2ct6i2AeyIVjFzzBSecus l6+s09xxJAFbfDzq7CPGLY9I2zeOY/HmJ2mkKJeZstUPSgQv/WWU0x0+rCpX455IpUwruEwtG4c77 p+hQqYym5RaFevbsvHEfuGyy99cYPkmL6MZDrgM4cqbYVViWp/29ekhNckpz/lXN/GC0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:19:48 +0000 commit 5177bee97672c93414ca67f7b9d75cb5e787a17c Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:19:59 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:19:59 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373756.1620513 (Exim 4.92) (envelope-from ) id 1wogmt-0001HC-Ro; Tue, 28 Jul 2026 12:19:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373756.1620513; Tue, 28 Jul 2026 12:19:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogmt-0001H2-PA; Tue, 28 Jul 2026 12:19:59 +0000 Received: by outflank-mailman (input) for mailman id 1373756; Tue, 28 Jul 2026 12:19:58 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogms-0001Fm-IB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:58 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogms-00DPbP-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:58 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogms-003I7i-1b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:19:58 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=05zDL2WgNHQS6NpdoEoErUhJLZyaba0Wfxg3/eEYqBE=; b=MJF8oZFnLoQiPnWu8MSKMzzyuM TLpQLNcplxkJZwmFCXdr4GFZNb6Vg6EjfOsRYY3OwrCLVVHqcs8V2C8SuI8IHNF8WhEeBEcnqVA9L AcobqASda9w4bH8QXD1QEUkTnaeTGbQoAnDwnM2ThBlC8v0GjVK4uwmld8cRpVjNUFYc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:19:58 +0000 commit 2541568df86535d966321461e4419774ad6d3836 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:39:49 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:20:09 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:20:09 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373757.1620518 (Exim 4.92) (envelope-from ) id 1wogn3-0002Qh-Up; Tue, 28 Jul 2026 12:20:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373757.1620518; Tue, 28 Jul 2026 12:20:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogn3-0002QN-Rm; Tue, 28 Jul 2026 12:20:09 +0000 Received: by outflank-mailman (input) for mailman id 1373757; Tue, 28 Jul 2026 12:20:08 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogn2-0002Q9-L4 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:08 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogn2-00DPbg-2v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:08 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogn2-003IBU-1w for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:08 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ao6G8gJ2HggHesdE3UFzT2CsVQ0BL8tmCN/Ih4mz1Jc=; b=uY0RD4rtyKNUHN9gugXXvy5V+G mcvUVLl0ucTbW2QVyk4oqvgaGUPHixBu3KnFpqYVrYyIoWWIOrMC/ckpbyJnWPJYyDLXvSDbo5JK2 /FfhV2GuM2GZYYhdz5ggjUdf2SMQ8DdWGSioAk/gpf8CCULnjCyLTeo654qxkQTtAK48=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:20:08 +0000 commit d00aad3b132fc21e263ac71bf74a4df7bd30aad5 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:20:20 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:20:20 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373758.1620521 (Exim 4.92) (envelope-from ) id 1wognD-0002Ys-W2; Tue, 28 Jul 2026 12:20:19 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373758.1620521; Tue, 28 Jul 2026 12:20:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognD-0002Yj-TI; Tue, 28 Jul 2026 12:20:19 +0000 Received: by outflank-mailman (input) for mailman id 1373758; Tue, 28 Jul 2026 12:20:18 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognC-0002YW-OJ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:18 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wognD-00DPfB-00 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:18 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wognC-003IDu-2E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:18 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6d8pVl/SrceZ9wRg/SmNHYeGJb9jew9IfdzV0FEVnxg=; b=2+Ge41gwJ1pTmiUxq61qmX7tYx NzevGOnrqH38vGOq+cmt/V+pyFerDAkfnUych0Zi6tvIThVVf8r6tGAHKsIWnv886yipCGfKn6WYZ Qn9XUFSNskhZK2Ca+CaDXwYAgU447GjMGPuhgtXNM8iw/wjfmiDydkPZoD9h8MQhEI5Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:20:18 +0000 commit f719630bd6fb7a717d5b2077799164a28e940cfc Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 22dde913cc..f3744496e9 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:20:30 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:20:30 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373759.1620524 (Exim 4.92) (envelope-from ) id 1wognO-0002gh-0v; Tue, 28 Jul 2026 12:20:30 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373759.1620524; Tue, 28 Jul 2026 12:20:30 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognN-0002gZ-Ui; Tue, 28 Jul 2026 12:20:29 +0000 Received: by outflank-mailman (input) for mailman id 1373759; Tue, 28 Jul 2026 12:20:28 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognM-0002gR-R9 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:28 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wognN-00DPfF-0I for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:28 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wognM-003IKJ-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:28 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Ri9o66oKcMDKGmm2Wru4nsJxBZe8Ux/gQyQFYDTBTmA=; b=nzXxSG9ITq9fPbDDu9wZRU3lSh KsiHXxuJoLJzabXWKmXbPfnJQiAuINyReeN9HnZEevKulTeOFjQ7B1FqvBtaovjf3o1qzLCRXHh8b pK6hRJn8kPU6YgbeceUFIIeKD13X7McRQowKdvPz8vW0JNZ4bxWmLrMpNnIxZdrYvTLQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:20:28 +0000 commit 6deb5262dffd096463cd8c7655c2ab88f83debf5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index fa20ad629c..71741be60e 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:20:41 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:20:41 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373760.1620529 (Exim 4.92) (envelope-from ) id 1wognZ-0002jU-2c; Tue, 28 Jul 2026 12:20:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373760.1620529; Tue, 28 Jul 2026 12:20:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognY-0002jM-WC; Tue, 28 Jul 2026 12:20:40 +0000 Received: by outflank-mailman (input) for mailman id 1373760; Tue, 28 Jul 2026 12:20:39 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognX-0002jD-HK for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:39 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wognX-00DPfM-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:39 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wognX-003ION-1W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:39 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=BR+/3qW1/IjSF8pYF589R0axIWdFoi4j72qPS9Y+F4Y=; b=TD9ScR/r6zn84RnkwnOIoNiLBw QS+rwaKQs9JDGiwzkQozR0JgpdYUAtw51I0xEsbFmAoYG+q9BV99GB4pqEOuVLEMFjo7/m3yce+5p 65GJ0NyK6MFwC1S6DgvHZ7Q0LiHxJYpFZ/R0B/j9WD5Pg4CCpZckjetLyK2aO+nx08xE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:20:39 +0000 commit 36732dfc7d8f59062819dd170b49dfa8fad6d5cc Author: Jan Beulich AuthorDate: Mon Jul 20 16:40:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 67be5a5783..7db7ce9c3e 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -353,6 +353,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -485,7 +495,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 5f0acda942..9309e10ebb 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -312,11 +312,15 @@ debian-12-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 96fd1c3272..f63c55c783 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -177,7 +177,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -193,7 +192,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:20:51 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:20:51 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373761.1620533 (Exim 4.92) (envelope-from ) id 1wognj-0002pe-41; Tue, 28 Jul 2026 12:20:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373761.1620533; Tue, 28 Jul 2026 12:20:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognj-0002pU-1H; Tue, 28 Jul 2026 12:20:51 +0000 Received: by outflank-mailman (input) for mailman id 1373761; Tue, 28 Jul 2026 12:20:49 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognh-0002pI-K8 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:49 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wognh-00DPfQ-2o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:49 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wognh-003IQj-1p for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:49 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OQY1bxhS2uX2gaRBePKO0bH+sBJGoqBFnWD1ufLZRCk=; b=SR9Y+KoKYyBAHnkDeFL3KIuFf6 YT8qErBcC/CWks4tXFe6jnXmhHM+mIJ0yJ7qWcZZiXJVw7nvqG5t5FpeS0YcAstFHnHOL/sAUW/8J r8bKGp/L/tJ704z0cVUNfg49kOVzMmIes1wxVHIvQKYj85ldwz+ZlhB1CBU5vixHe3rI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:20:49 +0000 commit 44d2fe6ac7e13265908cb50c2bc07d21ea00030e Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:40:52 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:01 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:01 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373763.1620537 (Exim 4.92) (envelope-from ) id 1wognt-0002xp-5F; Tue, 28 Jul 2026 12:21:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373763.1620537; Tue, 28 Jul 2026 12:21:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognt-0002xh-2d; Tue, 28 Jul 2026 12:21:01 +0000 Received: by outflank-mailman (input) for mailman id 1373763; Tue, 28 Jul 2026 12:20:59 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wognr-0002wR-NR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:59 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wognr-00DPfk-39 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:59 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wognr-003IT7-28 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:20:59 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lkfkXJgOTrgc0KF8hkr5RoP3+0w6N0HzrPM7xZOftNM=; b=PgegFTZatacxycksPUH9+DndGj BwhIcbmx8u4Kb95y+BiQRLbjlbRpkicMyHEOPKzC9UD/6VyngDH0OK8wFH7fWCvVVpKllu0+9DN/M hPJHpyPlwUUulTkcyjwZvudxfYRtZkJSluCK6yCxJZKJmCsHRQTZlQbviJRm5R0WCy3g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:20:59 +0000 commit 5d170c81126feb5e855c0dfea88d6a2fe6e93c5f Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 4 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 67f851237d..07f8439a6d 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -682,10 +682,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -708,10 +704,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -736,20 +728,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2c3bab1d18..baba5c727a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1564,12 +1564,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373764.1620541 (Exim 4.92) (envelope-from ) id 1wogo3-00035R-81; Tue, 28 Jul 2026 12:21:11 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373764.1620541; Tue, 28 Jul 2026 12:21:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogo3-00035I-5T; Tue, 28 Jul 2026 12:21:11 +0000 Received: by outflank-mailman (input) for mailman id 1373764; Tue, 28 Jul 2026 12:21:09 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogo1-000354-RZ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:09 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogo2-00DPg2-0E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:09 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogo1-003IWX-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:09 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eq9F8LlH3b8vOqRrPFKuJ2oZUJLy9SfoKvUDHDTxVWA=; b=dKlq3jOXh/EQjNAl94uuJFEKid wC6DLl//2wEWzQYfcfzyRgtDjGw9LB6FocizmE20NjaggSJAg57BaiHvbr9TVVs8PFNRwPgBmafco qF6a7K+tPgYv7WNBo460o8Wc36kjT9Zg/tg+BF6vPBTuvSnOemCquOtPbnxB65Ly+reY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:21:09 +0000 commit 46fe95efa863db0e9da68a042e45bc4515cc555a Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index c2d99ae12e..bd61ca2d09 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index ec377ed9b2..0ae921f220 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,7 +179,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index c7b3f1f618..aa64202d92 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -59,7 +59,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -238,9 +238,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index baba5c727a..a20ef78185 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -901,9 +901,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -975,7 +975,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:21 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:21 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373765.1620544 (Exim 4.92) (envelope-from ) id 1wogoD-0003DO-9T; Tue, 28 Jul 2026 12:21:21 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373765.1620544; Tue, 28 Jul 2026 12:21:21 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoD-0003DG-6t; Tue, 28 Jul 2026 12:21:21 +0000 Received: by outflank-mailman (input) for mailman id 1373765; Tue, 28 Jul 2026 12:21:19 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoB-0003D9-Ta for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:19 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogoC-00DPgA-0X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:19 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogoB-003IZV-2n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:19 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=S4MDk+xm+rlTOV+uPH2iyTPhozeNR2Lc0dyq1gWMyNw=; b=yjTY3mZnYMnZheazd3S3JvzCH7 bYCHGYtBUC0s5+xQ4geXupLNsbkjjfLYmVEOT/HmyOH+l0seMX8fpBNoQE79gvJYhglYmH8nBK/+X OiW4Xrvu4sucIMKBf9jz+CHhWsxKqpKjK5gwYwplezIjgMXd9yQbWxxNsAf/IzKiWvlM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:21:19 +0000 commit edd856bb64b5abbe217b073cc2865b1106cae025 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 6041ab093e..2e97a5494c 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2085,10 +2085,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 0ae921f220..fb4201d555 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index aa64202d92..d68b418794 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,7 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -221,11 +220,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a20ef78185..4dc8679ca3 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -638,7 +638,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -909,7 +909,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -945,6 +944,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1916,7 +1918,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:31 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:31 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373766.1620549 (Exim 4.92) (envelope-from ) id 1wogoN-0003Hf-At; Tue, 28 Jul 2026 12:21:31 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373766.1620549; Tue, 28 Jul 2026 12:21:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoN-0003HX-8H; Tue, 28 Jul 2026 12:21:31 +0000 Received: by outflank-mailman (input) for mailman id 1373766; Tue, 28 Jul 2026 12:21:30 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoM-0003HQ-0d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:30 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogoM-00DPgE-0r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:29 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogoL-003Ibp-36 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:29 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=kOKT7fsFlSs7Q1qvx6ZROG+5GUsKfpTflBdeNzvFjKc=; b=BhCUO586IHgRg10qxmKYob3/sS PABCEnjLLGl/Jz2Dg6gmqlXE02+Eff+PqcsEjVbdrtu3/ePEtMHQMImJXgM++RSwjINlq9gernCKb rpp+VV8E1d7CPV7lTD1bmzRxLuySNT1RlvsIfGajoRsjHSXMK1Hre4xEv8R6d75VnMcs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:21:29 +0000 commit 5ddc8866620d12354c2469e95f86a0c9aeb1bc00 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index f7cf7c43c8..f996767535 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4dc8679ca3..934ed334c2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -907,7 +907,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -954,6 +953,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:41 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:41 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373768.1620553 (Exim 4.92) (envelope-from ) id 1wogoX-0003Jf-CJ; Tue, 28 Jul 2026 12:21:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373768.1620553; Tue, 28 Jul 2026 12:21:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoX-0003JX-9g; Tue, 28 Jul 2026 12:21:41 +0000 Received: by outflank-mailman (input) for mailman id 1373768; Tue, 28 Jul 2026 12:21:40 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoW-0003JR-3Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:40 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogoW-00DPgI-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:40 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogoW-003Ien-0A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:40 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IJMsHKels8r573091N07P1Xm8efZ7OsZZwXEJa1NbGs=; b=RKPEVDeFRvhoFEl608/I2R5oaS 5d76LHTts8oBKsLkvhJDlVz4V2sNBOy9EiZYQ1WqT+K8ErqglA2YIO89D8d45dB5kYu9zZLRTAypm lOuamCReNGTfMN1Yp3mFYGQJhJ+YUq5z9i0m8Zxm4tjaWkMuUkTtv6yRNziFu+edFHxE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:21:40 +0000 commit 0bb0f564f37d901678628a117fba82b85a83f80b Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index bd61ca2d09..a04f46d29f 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index fb4201d555..45c95f658d 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,12 +180,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index d68b418794..b09027dac5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -59,7 +59,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -237,11 +236,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 934ed334c2..6188f891d5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -906,13 +906,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -983,16 +988,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1923,7 +1918,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:21:51 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:21:51 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373770.1620557 (Exim 4.92) (envelope-from ) id 1wogoh-0003Lf-Dj; Tue, 28 Jul 2026 12:21:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373770.1620557; Tue, 28 Jul 2026 12:21:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoh-0003LX-B1; Tue, 28 Jul 2026 12:21:51 +0000 Received: by outflank-mailman (input) for mailman id 1373770; Tue, 28 Jul 2026 12:21:50 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogog-0003LQ-6n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:50 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogog-00DPgM-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:50 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogog-003IhU-0U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:21:50 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=3Ecp4SCXpBx7eXtbIWU7ggWE23HcguEpgiFfIO6svxg=; b=oR28yHNT6JbSdh/NkV1EHkQApo k4yo6c7l+H95MDnVX9IvRDApQ2PeK/zuVEAzlo59Cbid+c/juJUlJFIJXmfy0CaO/gEGCBbieapgv 11y3VNwngllKXl9VmHvjYrzec/nq2GD1e1f75KCOAPgZF4E0DTdXuqsGOKHBnM+oAaUo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:21:50 +0000 commit bfc1439cd00f44df13b91a9f3db731b9ee725b5e Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1b04947516..43e00e78cc 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 45c95f658d..f03ceee327 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -396,18 +396,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b09027dac5..2115819e66 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -507,16 +505,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6188f891d5..2d7d98cada 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -907,9 +910,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -961,6 +961,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1238,12 +1255,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1969,8 +1986,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:01 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:01 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373771.1620561 (Exim 4.92) (envelope-from ) id 1wogor-0003O4-Ge; Tue, 28 Jul 2026 12:22:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373771.1620561; Tue, 28 Jul 2026 12:22:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogor-0003Nw-De; Tue, 28 Jul 2026 12:22:01 +0000 Received: by outflank-mailman (input) for mailman id 1373771; Tue, 28 Jul 2026 12:22:00 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogoq-0003Nq-9y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:00 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogoq-00DPgj-1o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:00 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogoq-003IkB-0o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:00 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sJWfZEB6ttExvrqiHYr7JsV9cO24S+VvLBsxj4uu2eY=; b=O1HGBCynzZ7abyDg/7HRVe/k7L qiiqchlhR7+8S5vQEXYb+Y08pyYfPgMvUmwfGPyBevskeSybaNsYJHjkETC1sDEDE0RvVPl50h2mw gjWH7Zm6iEsRmvJnQ9mwiq1kDBfA8VqlDJhbUCR4vt2tQ13TsS7yGOU3ZUts+p9WdvN0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:22:00 +0000 commit 1e57ed1796a7d5a3aaa746e4a65dd0dd87f6feab Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index a04f46d29f..b2c45bc5d8 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index f03ceee327..248cb47648 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -429,12 +429,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 2115819e66..ce76aecb83 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,7 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -521,11 +520,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2d7d98cada..f23be0cecf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -908,10 +909,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -942,6 +939,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1333,21 +1347,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1992,7 +1991,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373772.1620564 (Exim 4.92) (envelope-from ) id 1wogp1-0003U6-HV; Tue, 28 Jul 2026 12:22:11 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373772.1620564; Tue, 28 Jul 2026 12:22:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogp1-0003Ty-F0; Tue, 28 Jul 2026 12:22:11 +0000 Received: by outflank-mailman (input) for mailman id 1373772; Tue, 28 Jul 2026 12:22:10 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogp0-0003Te-DR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:10 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogp0-00DPh4-29 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:10 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogp0-003InU-18 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:10 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6RkDtWEySmoZo1ap3zqNgp8Mh1pJFBJKEuskgq+Ajz8=; b=r1cEjW5vwrExHwS/H6NROxop8S sqIxfcP+z4tVg4iLyqgaUnyhqRqZ93Ozufn0ZLbczgf2cepgys+9nNY/A1fKvR/6dPGwV82dxVLcW j9zi39mmVlwHlnpK3kxbowhj6zQirEiNUIY65phG8zrlxy2jF2fg48oiFGNa1sLJChCs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:22:10 +0000 commit 42093dac70e8cd2b76412c1c478869cce9671e49 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:09 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 15262819e1..ed4388776a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2803,6 +2803,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373773.1620570 (Exim 4.92) (envelope-from ) id 1wogpC-0003Xe-JR; Tue, 28 Jul 2026 12:22:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373773.1620570; Tue, 28 Jul 2026 12:22:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpC-0003XW-GT; Tue, 28 Jul 2026 12:22:22 +0000 Received: by outflank-mailman (input) for mailman id 1373773; Tue, 28 Jul 2026 12:22:20 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpA-0003XL-Gu for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:20 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpA-00DPh8-2U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:20 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpA-003Iqb-1U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:20 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FGMqKSCaFrRpoUwPVP50yx0CasQrH3JYsub71B/SkqE=; b=aHo7ieJYCw0gjxtMDRYfNFzAEj 6nXKtdXT/bsb/ivEhledqN7aFeWN+l2Qq/RieoDbhFlGAnSVUApfP29sY2FrNGT73Bsy+QaUDnbyv B0OwQr2SFYmtqjDdb5V9nN7cHzHHgranFWWjeZjZw+SVbsLYO/XFvULV6FIRzFtuX1ls=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:22:20 +0000 commit 35e4a6ae4d54aa63880026dd9e3a88b52d2e61a9 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index ed4388776a..0a5c23ff1a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2195,14 +2216,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2247,8 +2268,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2273,7 +2297,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2413,14 +2437,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2432,7 +2456,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2452,7 +2476,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2472,6 +2502,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2500,28 +2531,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2540,6 +2570,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2671,8 +2704,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2686,6 +2721,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2722,6 +2758,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2748,6 +2786,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2802,6 +2842,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3231,7 +3274,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:32 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:32 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373774.1620573 (Exim 4.92) (envelope-from ) id 1wogpM-0003dt-Kf; Tue, 28 Jul 2026 12:22:32 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373774.1620573; Tue, 28 Jul 2026 12:22:32 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpM-0003dl-Ho; Tue, 28 Jul 2026 12:22:32 +0000 Received: by outflank-mailman (input) for mailman id 1373774; Tue, 28 Jul 2026 12:22:30 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpK-0003cP-KV for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:30 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpK-00DPhC-2q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:30 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpK-003IuE-1p for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:30 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=J3YL9CmWf7UaB3fyiDGEH2vcRwaFiowAsiU3pzJpfsc=; b=WwiKFL/7A/fbU8UReOCyFm1hDJ QcHJ+3WGnwfOmoFK+RdoMN9XocdabXzJlw43aD0PIp8hjoMVxbZAcVrSgQONKaFydHn/mSZlInwPg Oa2zwDQ+B3HVeQqSy7YMg8kcDbVKsh2xXNCWZBAkaY1inlX8mmtXGILe9JGleLNbcR1g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:22:30 +0000 commit 8a37bfe876248cc13cf19407ee04cf75a762e76b Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 96833c1715..c34dca2184 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1087,7 +1087,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index a186d145e8..56b4bf4227 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -154,7 +154,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -166,6 +166,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -916,12 +929,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 23bb159d9b..7a00bf95dd 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1802,12 +1802,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index ae2b72d5c6..f7a270229e 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -164,9 +164,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:42 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:42 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373775.1620577 (Exim 4.92) (envelope-from ) id 1wogpW-0003mb-NG; Tue, 28 Jul 2026 12:22:42 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373775.1620577; Tue, 28 Jul 2026 12:22:42 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpW-0003mR-Ki; Tue, 28 Jul 2026 12:22:42 +0000 Received: by outflank-mailman (input) for mailman id 1373775; Tue, 28 Jul 2026 12:22:40 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpU-0003m5-Nj for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:40 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpU-00DPhJ-3B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:40 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpU-003Iwr-29 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:40 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Xjml6oDjTMs7dnREhNVA4g6+fkppt4ZMxDnskE8zeyE=; b=G3AmYmcuLCw5BX6QbohXUgm2qS ukhNLJd5x3OanqjYu6SJeVRxenITf5bhL2ThFsnRsdQHhJ2tbpZbcE1X/pEDn/BT++jGwWz+LYzrW 0IpEFbajsvOb82R9GVVNO3QGGI1g3WGiTQXC74MAPDfoCsO0PWj3OHR+626iKETdu7mU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:22:40 +0000 commit 8ecf1dc3259a9594d0d2c4afbbed42e32c030b4a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:22:52 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:22:52 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373776.1620581 (Exim 4.92) (envelope-from ) id 1wogpg-0003sP-Ol; Tue, 28 Jul 2026 12:22:52 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373776.1620581; Tue, 28 Jul 2026 12:22:52 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpg-0003sG-M2; Tue, 28 Jul 2026 12:22:52 +0000 Received: by outflank-mailman (input) for mailman id 1373776; Tue, 28 Jul 2026 12:22:50 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpe-0003s9-Qd for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:50 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpf-00DPhN-0F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:50 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpe-003IzG-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:22:50 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=wCIvKI8MBxh6Bqb9HFDlgjIXd1lMBadzSfrODh5m4a8=; b=TDvL/AATaHSpwetd3Lho2ls3S+ DvC2T4ltJAt+e+E3u0h1MOkY2GyLb/lSjCgeyb3uw8yEER7Pb0r/LoVGBNj3kDtUiw2crSN8PUrUd AqlWua4zK0vL/HKwHQLoDquuM7B1Ca/DJVa3GpOUveSbycnOKz6mtZLPd7jDtTMEcmEo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:22:50 +0000 commit be02aa3f4ac8461f02c469cbb653f6b49673a336 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:01 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:01 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373777.1620585 (Exim 4.92) (envelope-from ) id 1wogpp-0003yk-QF; Tue, 28 Jul 2026 12:23:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373777.1620585; Tue, 28 Jul 2026 12:23:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpp-0003yc-NM; Tue, 28 Jul 2026 12:23:01 +0000 Received: by outflank-mailman (input) for mailman id 1373777; Tue, 28 Jul 2026 12:23:00 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpo-0003yM-Sy for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:00 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpp-00DPhs-0T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:00 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpo-003J1m-2j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:00 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Yk5EakKslVOaIiYnWUavwgFCRTgItMva+DrAiejF/i8=; b=q9toeRxBT/PoTwJ5cPFxk7PaBf rgLxuABYY2ptMi4PjucbAjJS2YaBepqxEx+UznbJm7fnOdKW0CvHNgl9PuNErLQgMt/y5H+6BKunN h9kr4t9CF7HYMtaVoG1zNimuUi7P2DlFtUCzgmbCIM4jppEntdlGc8BydlMbC1nbybbE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:23:00 +0000 commit 96f4c9df247a0bff1abd64314c90e60f66de8776 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:41:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373778.1620591 (Exim 4.92) (envelope-from ) id 1wogpz-00046U-T9; Tue, 28 Jul 2026 12:23:11 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373778.1620591; Tue, 28 Jul 2026 12:23:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpz-00046H-Oo; Tue, 28 Jul 2026 12:23:11 +0000 Received: by outflank-mailman (input) for mailman id 1373778; Tue, 28 Jul 2026 12:23:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogpy-00046B-VV for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:10 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogpz-00DPiA-0j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:10 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogpy-003J4v-2z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:10 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=oAdYSpWt8UYqgBIXFhdEHEZFDXIzft9Xglqsee69Qpc=; b=CAUHn0tL4SLoiMypY21btrNSjg OF+9vjB/XOQWkY22upH4NHiqX/kacFAnQhRqIV+atRVg2CkQsT14ydfYDMTkFXD8U+jrk6z0YesjF /woFRGvNnL2QTjviWRddpPkwG+5gUYkSZDq7aUC4Mk0EbSGylOJU15EK/QjIxQ06Aeos=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:23:10 +0000 commit d05f4c9832088eec1eaa144f15a01951d35452e6 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index b0d3082409..9dae1bc9ee 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -654,6 +660,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373780.1620602 (Exim 4.92) (envelope-from ) id 1wogqA-0004Mc-3b; Tue, 28 Jul 2026 12:23:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373780.1620602; Tue, 28 Jul 2026 12:23:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqA-0004MT-0c; Tue, 28 Jul 2026 12:23:22 +0000 Received: by outflank-mailman (input) for mailman id 1373780; Tue, 28 Jul 2026 12:23:21 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogq9-0004M2-2l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:21 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogq9-00DPiM-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:21 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogq9-003J9T-01 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LveRrUiJ4pUb3ZS6JLl+sIbhtmI02pY/bxbRTVbWX8k=; b=EeDTS0SZSheRrD4+PXsmkdo7hR LopZGxRmgnQfGRv13CqmBa6WQdziNRUM+GaQ3glY8HbEIY9qlJlyiI2833Tht1pvFr3ikDUTQglbq B6NCV0r7Db+lgFCk/4iFodGhihsYpNGP07A6yip92dLh8U0kidORgQUBZU0hHdIb13mg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:23:21 +0000 commit 4314e6ded0188200c2f1ec9df463f464350e302e Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index fa2b9a2728..a6a898e7b9 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:32 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:32 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373783.1620606 (Exim 4.92) (envelope-from ) id 1wogqK-0004YW-4r; Tue, 28 Jul 2026 12:23:32 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373783.1620606; Tue, 28 Jul 2026 12:23:32 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqK-0004YQ-1t; Tue, 28 Jul 2026 12:23:32 +0000 Received: by outflank-mailman (input) for mailman id 1373783; Tue, 28 Jul 2026 12:23:31 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqJ-0004XA-5J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:31 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogqJ-00DPie-1L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:31 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogqJ-003JKk-0M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:31 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PvjrFlc16NeOMkwAUyr4Ve8JRkSnHKkIVmrPdWLPm3s=; b=x4Z01kFMt/2qc88UI/z1tENxnf MdS0C1e8hGTU98Ln5Z6HuIacKa/FYkF45vPWfMJfi9C03m58Ie/WBjyj9jsRYQZG15EuMwL4uPBCl qs0yO/pFP34mAMf4pBaj6iHraQ8JdG5dkwVMn/YIyAUZjYjF37+vTcyjg5dEJnjoz1Ks=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:23:31 +0000 commit c42374a1052a20eac4ecfd38e32384b3b77eabd6 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:41 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 7db7ce9c3e..05822aec1d 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -275,6 +275,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373790.1620611 (Exim 4.92) (envelope-from ) id 1wogqV-0004mk-6M; Tue, 28 Jul 2026 12:23:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373790.1620611; Tue, 28 Jul 2026 12:23:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqV-0004ma-3C; Tue, 28 Jul 2026 12:23:43 +0000 Received: by outflank-mailman (input) for mailman id 1373790; Tue, 28 Jul 2026 12:23:41 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqT-0004l6-TA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:41 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogqU-00DPij-0U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:41 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogqT-003JSs-2k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:41 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bqupS+IppvXU/PVHt0egSkYpsnK9OuHUALOo4reStL4=; b=LDe1mYaysY3Y26jLjn+s26jVRk sTn+q4MnwIlHwNiWkBpbNVz9V41uDGTzCViIZ3cUt4FBQ4KgzJd8GkQJnbGhmQ4J7R+AmFtPUvH2K 7MLpX9E2c/bF/Hgf+FSnRFdka6ek+LNcCZtgqyMED6PKTv3y2phR5xYjWeNlpgtiqFHs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:23:41 +0000 commit 6cb914cb59d007ef87ca04ad13be35a118411b32 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:03 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index baee1d17fb..5df2252bba 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -351,6 +351,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -476,7 +486,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 781334d74f..90f6a4b395 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -307,11 +307,15 @@ debian-12-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 4542ea8408..8bdf6c9adc 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -155,7 +155,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -171,7 +170,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:23:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:23:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373794.1620615 (Exim 4.92) (envelope-from ) id 1wogqf-0004rA-8e; Tue, 28 Jul 2026 12:23:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373794.1620615; Tue, 28 Jul 2026 12:23:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqf-0004r2-5r; Tue, 28 Jul 2026 12:23:53 +0000 Received: by outflank-mailman (input) for mailman id 1373794; Tue, 28 Jul 2026 12:23:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqe-0004qr-00 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogqe-00DPj6-0o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:51 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogqd-003JVP-32 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:23:51 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Bkaq6dTBtxcQKpZUlJ1WWqGHO0qvSVSnnpAFn1RmcLA=; b=v87KIMc/jr84kFMrfpruUf4O7F bkeGc6pHe1rIDx2xc/Od8lrvzPebZf6swp7ZoNFyNFwgj+9qJ1HNRt5HVwBr5BniMVVW+TsriZnJO le1ZEVp7l6RnULiZKf2J+bMRTCSJgN7pakomqcqqgw5QWRVb+qc9vFCcN7+N7BKcdzH4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:23:51 +0000 commit 21e31cc315b449b187785429f29358ca329aa43e Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:42:06 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373795.1620618 (Exim 4.92) (envelope-from ) id 1wogqp-0004tQ-9l; Tue, 28 Jul 2026 12:24:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373795.1620618; Tue, 28 Jul 2026 12:24:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqp-0004tI-7D; Tue, 28 Jul 2026 12:24:03 +0000 Received: by outflank-mailman (input) for mailman id 1373795; Tue, 28 Jul 2026 12:24:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqo-0004t7-3V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogqo-00DPjO-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogqo-003JYQ-07 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OOn+BAAtqmQLLKovVKYgPLp99/mzXp0GCSl/0Xf7wu4=; b=Jk9qgVc3YbHtJLFfmPoBIhQoaC WE6FohEuC4ypLx15IAjgd6M4zP43S2gcYgsv1+4oiW2aUWQcIry3zN+ql44WqkSwkk6VSIUHOF1ep mYf28pPGIzuYxYQdpvypRc4+83ZM8n989oThD71aZ/pAJpvpTQLEj6S5a5LZG6siEakY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:24:02 +0000 commit 6e278ffe6207ed6da25eb11a0bf7c6707513e545 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 4 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 95467b88ab..71f47fd33f 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -669,10 +669,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -695,10 +691,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -723,20 +715,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 694c748694..09432fea92 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1557,12 +1557,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373796.1620621 (Exim 4.92) (envelope-from ) id 1wogqz-0004vs-B7; Tue, 28 Jul 2026 12:24:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373796.1620621; Tue, 28 Jul 2026 12:24:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqz-0004vk-8Z; Tue, 28 Jul 2026 12:24:13 +0000 Received: by outflank-mailman (input) for mailman id 1373796; Tue, 28 Jul 2026 12:24:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogqy-0004vZ-6d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogqy-00DPjT-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogqy-003JbJ-0U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Qzwi75rA8oRJ8/U+Ivbf2UGM/t7UXSzbnh9MoSGEslY=; b=xxRDmLFSrTaMM0QzWEi3/f4KnL mDJHq2ULiLssXlNQk1fPg2RvN+G4EtXFFmcX1C8zGGlYF8ZfB/TBSoiGPSt6Zd13Gk0q/Uo6fxOYi FgOEEdxqlJVAyhfighO1vJXv7Fp5Fh7cDBNboauh/GIQTB1l+EV6ytyemtOwm/5RsoXw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:24:12 +0000 commit 7592e51ca7f5928652e10a95c178433624a35bbb Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index c2d99ae12e..bd61ca2d09 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 95c73f9894..e50be97345 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bf6d4e9772..32f1fbb1ed 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -239,9 +239,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 09432fea92..5299d95c8a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -895,9 +895,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -969,7 +969,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373797.1620626 (Exim 4.92) (envelope-from ) id 1wogr9-0004ys-Co; Tue, 28 Jul 2026 12:24:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373797.1620626; Tue, 28 Jul 2026 12:24:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogr9-0004yk-9u; Tue, 28 Jul 2026 12:24:23 +0000 Received: by outflank-mailman (input) for mailman id 1373797; Tue, 28 Jul 2026 12:24:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogr8-0004ya-9p for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogr8-00DPja-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogr8-003Jf7-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ic76oYLtCZyatVeui2ofVdX+oF3hcezpsTCUKu152t8=; b=PIvgKjaZFujPyKKPkDjdScikRT yVz8b4UzF1zkPULqQjsZsmxDagFJ4DL8/1NLeh+38AKwsEbVLReAjZDB/CjhUrM6GtncCEfSGO0F7 NYG5NMwgUI8KxU0YZnPyUlOhvRaTpf0DVvj/3TP3CzYOZUPhlBfChUu44y4zw5omZUtk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:24:22 +0000 commit 4e7fdceee8bd619e997c7238bc54f262d886c529 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 08e3bf48fc..3a737d11ec 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2086,10 +2086,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index e50be97345..8a2a3785d5 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 32f1fbb1ed..25469378ae 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -222,11 +221,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5299d95c8a..e0cce78bec 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -903,7 +903,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -939,6 +938,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1905,7 +1907,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373799.1620631 (Exim 4.92) (envelope-from ) id 1wogrJ-000517-Eb; Tue, 28 Jul 2026 12:24:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373799.1620631; Tue, 28 Jul 2026 12:24:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrJ-00050z-BE; Tue, 28 Jul 2026 12:24:33 +0000 Received: by outflank-mailman (input) for mailman id 1373799; Tue, 28 Jul 2026 12:24:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrI-00050s-Dd for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogrI-00DPje-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogrI-003Jjf-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zCdSWjbxR0VPcqcLHPkzWYY9H0D5CYeSraFjeYkDqZA=; b=LAygD3PdQZd2U/n/frO67nUWfY EMIKxMFvowRW5GKACSmpgPYRaQWMEwXxlRqzXCgyjal2vSdXDzEnqyxhiRmjYTsMCsCyUNfSPTvvu SRW6K1GT0BYRImJxIlP4N7SzWtgd4OxZ59HWn7BDyotuXmEUc6R7zLrEf1MMS3a3tJhE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:24:32 +0000 commit 6159d36e767fd9e175830751de0c8c28bd3e553b Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index def60da883..c9f85545a4 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e0cce78bec..f9448b3deb 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -901,7 +901,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -948,6 +947,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373801.1620633 (Exim 4.92) (envelope-from ) id 1wogrT-00053m-Gn; Tue, 28 Jul 2026 12:24:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373801.1620633; Tue, 28 Jul 2026 12:24:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrT-00053e-EH; Tue, 28 Jul 2026 12:24:43 +0000 Received: by outflank-mailman (input) for mailman id 1373801; Tue, 28 Jul 2026 12:24:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrS-00053Y-HP for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogrS-00DPjm-2Y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogrS-003JmR-1V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hYbhNafZ+AGt3sJoW+C8BZ8ggz9BL5/RJdtZIvsamyc=; b=N9C2oFymvfqMFuhFUsFH7MA+gq kIhXvs/SrsnxC6ninD/KdPN6dkmBMVpx8yRrrP/7sl894iP/NM30GiKXHTVGEvYrKnC5+5RJy60PE Z93q9d+jZp4edLooPgf/22PRN28HSPYdNln0h8O1Xm1K5I574EjA/vp5lhlBQCFKy8VA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:24:42 +0000 commit f2c03a8606ec5cfd2d48d47d11cd006c4df2600e Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index bd61ca2d09..a04f46d29f 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8a2a3785d5..b3969c4f32 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 25469378ae..87e277aa38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -238,11 +237,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f9448b3deb..1704b7ae8a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -900,13 +900,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -977,16 +982,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1912,7 +1907,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:24:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:24:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373809.1620637 (Exim 4.92) (envelope-from ) id 1wogrd-00056Z-IR; Tue, 28 Jul 2026 12:24:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373809.1620637; Tue, 28 Jul 2026 12:24:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrd-00056S-Fl; Tue, 28 Jul 2026 12:24:53 +0000 Received: by outflank-mailman (input) for mailman id 1373809; Tue, 28 Jul 2026 12:24:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrc-00056M-KI for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogrc-00DPkG-2q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogrc-003JpU-1r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:24:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XVAldKrRjiYsc6SwlHj88DzajoVulqdX7mHWhoINoeg=; b=uqh5uDNrWtmhoydjTkkycXw4/o 5yASCZMgoVaezC9lCRRhbPG4/laPbz/JOY4ocVzZl+EHVAAFpvwTTZP1ch4D+rPoqsAbw3ANopA6l 738ubKUYcrXLDVV802oERRkBJl23WzrCXoNWKUAGyLyhL4Bg5u4WC3mTqWsj0yaWVHA0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:24:52 +0000 commit 628cd49525fa0889d68ed4c9cec22bf81846329f Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1d40d82c5a..1db996760e 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b3969c4f32..2dc41d7307 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 87e277aa38..b5d4e9fe43 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -123,8 +123,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -508,16 +506,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 1704b7ae8a..188187bd16 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -901,9 +904,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -955,6 +955,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1232,12 +1249,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1958,8 +1975,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373810.1620641 (Exim 4.92) (envelope-from ) id 1wogrn-00058g-Jv; Tue, 28 Jul 2026 12:25:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373810.1620641; Tue, 28 Jul 2026 12:25:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrn-00058Y-HH; Tue, 28 Jul 2026 12:25:03 +0000 Received: by outflank-mailman (input) for mailman id 1373810; Tue, 28 Jul 2026 12:25:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrm-00058S-NX for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogrm-00DPkZ-37 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogrm-003Jsc-29 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=jhp0rvKy/cajBr1WimKUtEbfbbQBM88YiR/US2OBBUM=; b=eJu/h22PQfLZfgINfGGAbBHTKN IcyKud+jhZfET7kTnhU82e06DHbUh5cMbucIhjT8dU/BHA5cCxPrqAtYzJcQtgWBmMkfth9qhGvdb 2Q+m43kyI0+L2ThcXvDfxpEPmSLMxzJrpEFtlgAIL6n0IasFSNPO2HJHgHUszyq0ZaAE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:25:02 +0000 commit fc159bcd70fb9a124ad230f1784f5fb747430d86 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index a04f46d29f..b2c45bc5d8 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2dc41d7307..fbc06919c8 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5d4e9fe43..193f68c88e 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -129,7 +129,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -522,11 +521,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 188187bd16..fe8104e6ce 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -902,10 +903,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -936,6 +933,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1327,21 +1341,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1981,7 +1980,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373811.1620645 (Exim 4.92) (envelope-from ) id 1wogrx-0005Ac-LL; Tue, 28 Jul 2026 12:25:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373811.1620645; Tue, 28 Jul 2026 12:25:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrx-0005AU-Ik; Tue, 28 Jul 2026 12:25:13 +0000 Received: by outflank-mailman (input) for mailman id 1373811; Tue, 28 Jul 2026 12:25:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogrw-0005AO-Po for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogrx-00DPmS-0A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogrw-003JvW-2Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IVuYV0wCIq74/kUbg4KCFJIHjBnW0SLcwQK/IoGXsaI=; b=jLoxmC4iRSct0N+6B31jQEEwpc VHa2+zccxupO22yG18lM/QHHLalOFbc5TnDr2cYSQ+ioo06PwwdxrOqSVf7kIuuReVH1BzRIpNV2F +4ojQfuwT+7uSShSl1mqWPtRJ9bYk2SglbFk07yM2iUUy2aSqFUoY5j1sHXkCksA7xp8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:25:12 +0000 commit 7dfed62794a535061fa96b966916e5bbdd6e144a Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:29 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 751b05efb6..357dcfed2b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2802,6 +2802,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373813.1620650 (Exim 4.92) (envelope-from ) id 1wogs7-0005ED-N3; Tue, 28 Jul 2026 12:25:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373813.1620650; Tue, 28 Jul 2026 12:25:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogs7-0005E2-KC; Tue, 28 Jul 2026 12:25:23 +0000 Received: by outflank-mailman (input) for mailman id 1373813; Tue, 28 Jul 2026 12:25:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogs6-0005Dw-TB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogs7-00DPo9-0V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogs6-003K1n-2i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=THmdKHhchIV8heTUjVGvxKSrEUaYkO5JdWbcIR46HsI=; b=ndDdWL/SLTAlAT++2z1sj6GQol FrxrHADZcSxG4wBegk034bRvCxBd79RGaNyKNaJs1J+dNreb03vs/l+W9KmnVFaGu8ZphB9oBXhpy vLdwCDQklJglB6U/rWopZsCARjBK+mb9yWa/qOqQKYvLIeOA8zg8vQfVFL+wEndvMLyM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:25:22 +0000 commit ee202319ef645637844abde68eb4be6d631aacf5 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 357dcfed2b..5805338774 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2194,14 +2215,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2246,8 +2267,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2272,7 +2296,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2412,14 +2436,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2431,7 +2455,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2451,7 +2475,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2471,6 +2501,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2499,28 +2530,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2539,6 +2569,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2670,8 +2703,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2685,6 +2720,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2721,6 +2757,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2747,6 +2785,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2801,6 +2841,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3229,7 +3272,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373814.1620654 (Exim 4.92) (envelope-from ) id 1wogsI-0005Hv-Po; Tue, 28 Jul 2026 12:25:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373814.1620654; Tue, 28 Jul 2026 12:25:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsI-0005Ho-N0; Tue, 28 Jul 2026 12:25:34 +0000 Received: by outflank-mailman (input) for mailman id 1373814; Tue, 28 Jul 2026 12:25:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsH-0005Hh-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogsH-00DPoL-0s for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogsG-003K6X-36 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+EpdIFmivDa/6BKw58QsAyy2qSlaLY1R3aL2JkYRDT4=; b=Tq5U1eumC3rufGAPuNM8+Zft31 +ikxqltkYzl1sn1o++wLglQwmr27O0qe1uMUfRbHSIgW4gtGs5zG8M9HlWlJOeL/ibHCBkuAvYg5H sJMeg5dPonnBRDqXj++pJlPCZbccfaJyi0kL8mpnrMhOWWDqi1MXE7xMTuK1cx08GZSM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:25:32 +0000 commit d1aebc7005c6ada289ab821585f9a94fca55879d Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:43 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 52a2139495..79135aadfa 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1020,7 +1020,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 9d5f55161b..f2e90ffb60 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -914,12 +927,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 9b23cd0bdb..723ab3c0da 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1764,12 +1764,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index ae2b72d5c6..f7a270229e 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -164,9 +164,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373816.1620658 (Exim 4.92) (envelope-from ) id 1wogsS-0005KR-R1; Tue, 28 Jul 2026 12:25:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373816.1620658; Tue, 28 Jul 2026 12:25:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsS-0005KJ-OW; Tue, 28 Jul 2026 12:25:44 +0000 Received: by outflank-mailman (input) for mailman id 1373816; Tue, 28 Jul 2026 12:25:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsR-0005Jt-3P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogsR-00DPoS-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogsR-003KA4-0B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dbXw30aShTnhr/SEaLbwmnQRIMgcOWE8LgIJMLGrgFQ=; b=WGocs4SMzvijMCMgeIuSLTyFWn lLuanpxG4ei+A+n569AOiNtRfaP/fnMMv7CBHwGPnwHG0SOYeHi6FbwT5PdnVLcWVYu/s7LU5ygWy HiM1Oq0Mt9Clqivhf4IBOTpGKN43lJfCRCpPdDC4IGKKIK81RdqawhGNulYC16AFjfCw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:25:43 +0000 commit ffe6e364c79e36615bc891acc1940057efff386b Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:25:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:25:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373822.1620663 (Exim 4.92) (envelope-from ) id 1wogsc-0005Ms-TJ; Tue, 28 Jul 2026 12:25:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373822.1620663; Tue, 28 Jul 2026 12:25:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsc-0005Mk-Pw; Tue, 28 Jul 2026 12:25:54 +0000 Received: by outflank-mailman (input) for mailman id 1373822; Tue, 28 Jul 2026 12:25:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsb-0005MN-6B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogsb-00DPor-1Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogsb-003KDF-0S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:25:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=2xOqxh9h8FWxKD6LU1GWzn5RnEB4xvh96cU03zSqCzk=; b=uQgHC9WdoHSnjUXTdgsWwXCTea ZenM7rUOiH4rOb8nOcrXfpzu194/cOfhhdzflE38eaS5tR13Dv+ALh4hUhUUuEAs+Ott+j62tSdOA +jZv9TccoLALlxDLiV12mDp4xw6yDEykxoFRDaoBGFsn7MQ0Si/CmiqXqEbIBqHbDT5k=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:25:53 +0000 commit ba2f7f33094689d8d1e27d70424b16d2dda7173e Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373830.1620666 (Exim 4.92) (envelope-from ) id 1wogsm-0005Ps-Tp; Tue, 28 Jul 2026 12:26:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373830.1620666; Tue, 28 Jul 2026 12:26:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsm-0005Pk-R9; Tue, 28 Jul 2026 12:26:04 +0000 Received: by outflank-mailman (input) for mailman id 1373830; Tue, 28 Jul 2026 12:26:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsl-0005PT-9j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogsl-00DPpG-1i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogsl-003KGA-0i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ZGY26Bj+zYUsSTZ/hhQXArMquPU0r5NXYaz23cTXYRY=; b=A/EbIVida4FM8n8ZGx/kPtEKj4 k6gd1ySXo/fwEMZELyZsgH+sn5xZrgUHBgibdHUMZ1obIHxCgJsnEWN8W2b8Zoq9UQBrr4sFNWGRr Roc0ZELVkIfpkyAznuQcUE2UKUZF4BFbcZMT58ngGQhbRRrSnV8F97/r6glzX62Mb+vg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:26:03 +0000 commit 011509a0c20809a3f1eb645a5109172bc847e8b6 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:42:53 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373836.1620670 (Exim 4.92) (envelope-from ) id 1wogsw-0005TU-V7; Tue, 28 Jul 2026 12:26:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373836.1620670; Tue, 28 Jul 2026 12:26:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsw-0005TL-SU; Tue, 28 Jul 2026 12:26:14 +0000 Received: by outflank-mailman (input) for mailman id 1373836; Tue, 28 Jul 2026 12:26:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogsv-0005Sv-Ej for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogsv-00DPpO-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogsv-003KIr-12 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Q4Sc2F4/K2jRrow2UjsMnu7vGGy3Dgt1r6VytSnrXrk=; b=bpC3dEl+LGI7hRy48J15CqgZY5 fwpaiCZ4z5Ww5Cf1+wKyCdgVO2fWm4pgZpDiyoCsU8zFvEw5JmKUJJilAARziSwJmyH/bJFVuQDUt HbmHpq1BwcP6ghJVcskEsbX2Gi5xkUdWDAG47j4QN7aLly9vlWNj8jibZva5A3L7zxuk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:26:13 +0000 commit 875c1baf3af78f8c46e3d4a9cc39a0ca748aa31b Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 462691f91d..58915ad0dc 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -650,6 +656,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373841.1620674 (Exim 4.92) (envelope-from ) id 1wogt7-0005Vp-0M; Tue, 28 Jul 2026 12:26:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373841.1620674; Tue, 28 Jul 2026 12:26:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogt6-0005Ve-To; Tue, 28 Jul 2026 12:26:24 +0000 Received: by outflank-mailman (input) for mailman id 1373841; Tue, 28 Jul 2026 12:26:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogt5-0005VU-FN for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogt5-00DPpW-2L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogt5-003KMH-1M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=F0Xt8x8KBhtwhhjh0zATDGoXoiynmYDsSQH79T/Y05E=; b=NvV8dX4XX/XM4/dL0APiX1U86t +dA9dYBIPofPhlqx/Op6JP0d+vsJLrilx/4iyk+6T8mYTQua0W2818BiuBXyt7x0vvOTH8+m3opHk EKcOIne+yGRUdlEYy0hwzp49IhxSzpoQfiz+sIFk3sCyHUdkmRZOVNno1Cyo+rb1Hchg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:26:23 +0000 commit 4c7248d1cf5607e9f1700815045c5a912d43f34b Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 8b2641dbbd..43ef92c0ec 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373843.1620678 (Exim 4.92) (envelope-from ) id 1wogtH-0005Xm-1l; Tue, 28 Jul 2026 12:26:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373843.1620678; Tue, 28 Jul 2026 12:26:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtG-0005Xe-VB; Tue, 28 Jul 2026 12:26:34 +0000 Received: by outflank-mailman (input) for mailman id 1373843; Tue, 28 Jul 2026 12:26:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtF-0005XX-I1 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogtF-00DPpd-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogtF-003KOh-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=waoYF51CxAhnb0jgCiC/J2PIabPYmRF7glDuozT2zis=; b=yGr109LBEIjecBKD1092uIXmsl r8NmUKAgLXEiVmrmzH2Y4l+g5d5QxB0r8Koiy1SvSlhtk7W/uuLuvptwOI8FjTUCFJ5aQjRyiQOqL Rjv0J3sCgAtT9/Bh5euvN4sMbUUOSp7+Y6KjA9tb0H4yoiJ4N10xL+6ajdzmAxJ+1krY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:26:33 +0000 commit 95d66a8910b56e623fc3589a8315c063ed526c9a Author: Jan Beulich AuthorDate: Mon Jul 20 16:43:01 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 5df2252bba..d28cd8dde9 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -273,6 +273,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373845.1620682 (Exim 4.92) (envelope-from ) id 1wogtS-0005aH-4H; Tue, 28 Jul 2026 12:26:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373845.1620682; Tue, 28 Jul 2026 12:26:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtS-0005a9-1c; Tue, 28 Jul 2026 12:26:46 +0000 Received: by outflank-mailman (input) for mailman id 1373845; Tue, 28 Jul 2026 12:26:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtQ-0005a3-92 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogtQ-00DPph-1i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogtQ-003KTD-0k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RGZ7KEQR1j/J6EAbupzj2Bwu8pYR7UVYh+efteXlsRs=; b=FZjEeZd3uOc3jlSYEzdAhhCXin froKXy4u8CTsZP/s3oa+0WA9x4Y0r0qKblrX6q5q60DAsdg0sXsFlQ5Kj2IxQv+AoRHphDq2uNJNJ RzBuPcA2x8S3a/Ok4TB8GX5G5wifhlHuBFJk4yw/F+TXhZcvXMHGzTkGZWMqWHlqA8fU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:26:44 +0000 commit 039ac56d18f67f2bc8943290e43b2fd08429a848 Author: Jan Beulich AuthorDate: Mon Jul 20 16:43:54 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 27209cab7d..39e550e7a3 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -315,6 +315,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -440,7 +450,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 201acbbffd..f22f149fe7 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -363,11 +363,15 @@ debian-stretch-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:stretch + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-bookworm-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:bookworm + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y # Arm32 cross-build diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 9611b80761..fb91ee4fa9 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -151,7 +151,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM ---help--- @@ -167,7 +166,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:26:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:26:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373847.1620686 (Exim 4.92) (envelope-from ) id 1wogtc-0005cV-5l; Tue, 28 Jul 2026 12:26:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373847.1620686; Tue, 28 Jul 2026 12:26:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtc-0005cL-2x; Tue, 28 Jul 2026 12:26:56 +0000 Received: by outflank-mailman (input) for mailman id 1373847; Tue, 28 Jul 2026 12:26:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogta-0005c3-CG for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogta-00DPq1-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogta-003KVV-12 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:26:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=DZfyqgC+XUUlB+8PlYrAnGGNQCx/sCVuXvyW5pICWFI=; b=3kHj+o7S1VMiOgpJo5yAl6xy1W mhgaC9Dhmg7Y3O+d44DGMbTKBbqc8iTshEpEheO8MJgvyW117cMEMKX8edtfB4UGBs4bQZNM2yLzs 4M/xtcXXQuPYAQg8g/54nnz6TgsUBoJg97F6FpFHIBegGvcVbyA46mnkwKfBAahR+/LE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:26:54 +0000 commit edf749b7c317b5491ae634899a06651c0a9165fc Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:43:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373850.1620690 (Exim 4.92) (envelope-from ) id 1wogtm-0005eS-7a; Tue, 28 Jul 2026 12:27:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373850.1620690; Tue, 28 Jul 2026 12:27:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtm-0005eL-4J; Tue, 28 Jul 2026 12:27:06 +0000 Received: by outflank-mailman (input) for mailman id 1373850; Tue, 28 Jul 2026 12:27:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtk-0005e8-FL for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogtk-00DPqG-2L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogtk-003KZ6-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tsxgyMspDVRrPq6I8oho9vczaHsFuCFeUlXEgPlFNp0=; b=5bQaI84gVK3hRb/lYNGuHUSanq jq6tCwqHs1Ro1tF09g9PYWtZ/FxQjUWfXGhej9Ie70uoc5lPMTkz1oPTROrHpicyFajkcDB+BYKJr rI5mWE5SkpOIzkUE5A3QpAr6kI6ZsIDXY7dWsOgoHYNtiqTf/2EhC3mme8xvux16Y1HQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:27:04 +0000 commit f1f45c8c32905fbecaddf0d08691dd7bf132a38f Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 18 +----------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 5 insertions(+), 20 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index f2fcd8afaf..8c4076b6a5 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -673,10 +673,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -699,10 +695,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -728,20 +720,12 @@ ret_t do_platform_op( break; case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); - break; + break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d8e2b12b14..6aebad3193 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1554,12 +1554,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373851.1620694 (Exim 4.92) (envelope-from ) id 1wogtw-0005hj-8D; Tue, 28 Jul 2026 12:27:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373851.1620694; Tue, 28 Jul 2026 12:27:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtw-0005hb-5c; Tue, 28 Jul 2026 12:27:16 +0000 Received: by outflank-mailman (input) for mailman id 1373851; Tue, 28 Jul 2026 12:27:14 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogtu-0005hU-IB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:14 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogtu-00DPqS-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogtu-003KcE-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=y/0imTN8lNACTEO82YCM6WPWBHWVFEDNa2QI2DS5pUA=; b=O+M7CMiYTemH0ysdPSF/uYA64d FNzEm8AO9MJEOxNG7GJG7f1bOpR1SMfloUxlOvyJb51P81tVP4mZKJJ6t6wwZUPjRNIokBQg2CEYJ xvvqZ+5xVieb1tHX2vjqUWS7VbCdAcWbUaqNJUaqRypS6jGe8SQ1/lVqKlgOOZXBD96A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:27:14 +0000 commit 9379292ea6e083f0784ab06dc04b47a6ae6bc45a Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2d04a9e161..5844c52056 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 718d3c4a2a..600b6c71e0 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bf6d4e9772..32f1fbb1ed 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -239,9 +239,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6aebad3193..7b324e115d 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -892,9 +892,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -966,7 +966,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373852.1620698 (Exim 4.92) (envelope-from ) id 1wogu6-0005je-A0; Tue, 28 Jul 2026 12:27:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373852.1620698; Tue, 28 Jul 2026 12:27:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogu6-0005jV-73; Tue, 28 Jul 2026 12:27:26 +0000 Received: by outflank-mailman (input) for mailman id 1373852; Tue, 28 Jul 2026 12:27:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogu4-0005jO-LK for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogu4-00DPqW-2v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogu4-003KeW-1x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PdR19xpJEMQLhuIwaQO7nmBpU1+qqz6SvoqIuHJxeMo=; b=rM9/w/t1G9UfKnci+7NX9JYbqW pGLEHoTgi7gkmTu0/Mtrsl0QGljommCifaJDagfGzs+Pa49uweFc4OLwAOEI50MLqU5mcNpqV3GCG g3Vj/vqiOb/PGrxJ5wXUDpTpwzcV86LU5J7eKmPksUHWYLoS9fNQgHIyP2eLhNIHc9IQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:27:24 +0000 commit 6e3958276720083e713c377e01e62d8a66572ed6 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 89de385a6f..e4b7228449 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 600b6c71e0..54b50e9a46 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 32f1fbb1ed..25469378ae 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -222,11 +221,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 7b324e115d..de0fdecb6e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -900,7 +900,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -936,6 +935,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1902,7 +1904,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373853.1620702 (Exim 4.92) (envelope-from ) id 1woguG-0005mH-Ci; Tue, 28 Jul 2026 12:27:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373853.1620702; Tue, 28 Jul 2026 12:27:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguG-0005mA-A0; Tue, 28 Jul 2026 12:27:36 +0000 Received: by outflank-mailman (input) for mailman id 1373853; Tue, 28 Jul 2026 12:27:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguE-0005m1-O7 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woguE-00DPqd-3D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woguE-003Kh6-2E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:34 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hx4z7iMCb56oPWBqMO/6+dn/OonsSBpenC9ohOVllY8=; b=xt/txfKaVGcs4J2zuL5P2ozrc8 zmCClfqbgXrlZgo3zq6hDflDKDXsrVnvSRiJqe2WjR1J8YWY7t16wh4MVq4nwWfe8Cx8wc6VurvZZ 0XyDO1iUuBkxeetEhcJvI/7ZjM5yCd9M/zT9m8A3dlIb/4qxOj9TRYpmHoXW5gbxvMGk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:27:34 +0000 commit ae8dbf96a322c0dac6d3a5bd41f5067cabb0acb1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ba9e91d302..b5adc7dd16 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index de0fdecb6e..b21f379a84 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -898,7 +898,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -945,6 +944,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373856.1620706 (Exim 4.92) (envelope-from ) id 1woguQ-0005rA-E2; Tue, 28 Jul 2026 12:27:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373856.1620706; Tue, 28 Jul 2026 12:27:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguQ-0005r2-BX; Tue, 28 Jul 2026 12:27:46 +0000 Received: by outflank-mailman (input) for mailman id 1373856; Tue, 28 Jul 2026 12:27:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguO-0005ql-Rj for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woguP-00DPqh-0K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woguO-003Kjj-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=QRR3LMaT/Ua+CpcaUD+LahgA02iNxsZvPIC7Bst6bBo=; b=7DSV2Q+osdkXhmESWUDZUeYtqR BftoWqGCd6EXOXCkMVM9c57JDYY3yAXQHZBoWIjWzkttiwrKIqa/Rf7tW7IUKNb6FtIo6oQoX/BcQ yVZikvW52NNRqUqVx6YJyjr8W6ZQkXaRJcxDnWD+TN694F6J71U8TpR8PqcQVx2GZtCU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:27:44 +0000 commit e40cb27ee4fb7b794e605cd881185cb33ce6cbd7 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5844c52056..011def5bb2 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 54b50e9a46..aacef701a9 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 25469378ae..87e277aa38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -238,11 +237,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b21f379a84..654b8afbea 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -897,13 +897,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -974,16 +979,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1909,7 +1904,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:27:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:27:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373859.1620710 (Exim 4.92) (envelope-from ) id 1woguZ-0005tE-FT; Tue, 28 Jul 2026 12:27:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373859.1620710; Tue, 28 Jul 2026 12:27:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguZ-0005t6-Cq; Tue, 28 Jul 2026 12:27:55 +0000 Received: by outflank-mailman (input) for mailman id 1373859; Tue, 28 Jul 2026 12:27:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguY-0005sz-Uf for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woguZ-00DPr6-0d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woguY-003KnM-2r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:27:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rZv0FcMYVkp4zC3Kc3Q4EStGslt4qiFGebeSKevN4+Q=; b=It0F+koWxTg9pgG5a92/dBNPic kApfW68LUI5YJwOgcyxkuV10+1LiDXunFcd6yYGw4CzeXuk9e9thUajPoO18jPPxneC35F7jF92W6 1z1RRtRd6rfvGTwMeil1WHLjE5kXGT2IQWP2MckbVma6uNFsa/C64Fgl/UuxOeXrpMFw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:27:54 +0000 commit 237dd170340bd9dd6d73ef8513fd5b017acb7b91 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index c107f40c62..2c6483d903 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index aacef701a9..b96483d0d8 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 87e277aa38..b5d4e9fe43 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -123,8 +123,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -508,16 +506,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 654b8afbea..03d9b8e60f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -898,9 +901,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -952,6 +952,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1229,12 +1246,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1955,8 +1972,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373860.1620714 (Exim 4.92) (envelope-from ) id 1woguj-0005vE-Gw; Tue, 28 Jul 2026 12:28:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373860.1620714; Tue, 28 Jul 2026 12:28:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguj-0005v6-EF; Tue, 28 Jul 2026 12:28:05 +0000 Received: by outflank-mailman (input) for mailman id 1373860; Tue, 28 Jul 2026 12:28:05 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woguj-0005v0-1J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:05 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woguj-00DPrU-0v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:05 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogui-003Kq3-3B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=seIoE3d2+JJlvD1r1gkR2WMWS+KPwKB5tHaAugEVJm8=; b=Zyd70jAcKmrgfw9mGuyrTso/aT ppzkEM5xQjnoHfkcZ1iypJCom8+9/HcWdv1pM8WxrKLl/ujG8/SWS2VpbeZ9euJuZIxXx1RsHNdmt OltHgaPhH4c8x+vyTN06DL1EFazyrfPWlEc1Kv/BDx6YHZlanweL1qqwtZj4S6mDbsTI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:28:04 +0000 commit c8d10a8e171ed675283246fe39dbb3b7331139e2 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 011def5bb2..95c66a70eb 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b96483d0d8..d5cea513c1 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5d4e9fe43..193f68c88e 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -129,7 +129,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -522,11 +521,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 03d9b8e60f..e3e94274ca 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -899,10 +900,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -933,6 +930,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1324,21 +1338,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1978,7 +1977,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373862.1620718 (Exim 4.92) (envelope-from ) id 1wogut-0005yq-IS; Tue, 28 Jul 2026 12:28:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373862.1620718; Tue, 28 Jul 2026 12:28:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogut-0005yi-Fd; Tue, 28 Jul 2026 12:28:15 +0000 Received: by outflank-mailman (input) for mailman id 1373862; Tue, 28 Jul 2026 12:28:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogut-0005yc-58 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogut-00DPrY-1J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:15 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogut-003Ksk-0I for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:15 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=68mX5cJb3FO/mC3t7z/5kUMV8HgzWC51uuRS5gOQmqg=; b=AKQ5dhnS1V3oY0ehKDNuIuL8Zo dWKf8HOcWC7iDwEHllXtRCzvOg2/CGYGZWaIy5xEBNLm58Th3go0DS3i3/+f0TP8WzCRMSZjnTRol dCmW6CmqjuJNhKfHPYDsy6QD6bn8MapJupUvz05jr154fWaDmga//6On+rIIXwpg8rmg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:28:15 +0000 commit 82b09c158e62c68c7fd701e1cd2592bfaf838cab Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:17 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 1b7ff1d316..7042768437 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2802,6 +2802,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373863.1620722 (Exim 4.92) (envelope-from ) id 1wogv3-00062R-Kv; Tue, 28 Jul 2026 12:28:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373863.1620722; Tue, 28 Jul 2026 12:28:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogv3-00062J-IB; Tue, 28 Jul 2026 12:28:25 +0000 Received: by outflank-mailman (input) for mailman id 1373863; Tue, 28 Jul 2026 12:28:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogv3-00062C-8n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogv3-00DPre-1g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogv3-003KwH-0h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=K6HRCK4wX4kT9qgyADcTarb4O58GzsxBxsFMmZGGPIQ=; b=g0AcD7eHD8yy2PwJ4iDydwwH/5 JJ0cscig0ttJ6cnr9S9vl7O1fr1r5QF4d4HYV4+yaZ+6Z9RV3zPKLG6XZgPsSnEjSIM+xtXwJvhs5 fC++Z0LiQWt9Tzy/oh/1dHBtcMJbyS+ys9bamANWCP+96m+wWI7i3uv8LZs4KxnAoJ9g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:28:25 +0000 commit 064877fc3ffb38cde12ca3deacd8b0427aedaf5e Author: Jan Beulich AuthorDate: Tue Jul 28 12:54:20 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 7042768437..21d7647a8f 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2194,14 +2215,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2246,8 +2267,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2272,7 +2296,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool_t okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2412,14 +2436,14 @@ gnttab_transfer( * pagelist. */ spin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2431,7 +2455,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); spin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2451,7 +2475,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2471,6 +2501,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2499,28 +2530,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2539,6 +2569,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2670,8 +2703,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2685,6 +2720,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2721,6 +2757,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2747,6 +2785,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2801,6 +2841,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3226,7 +3269,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:36 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:36 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373864.1620726 (Exim 4.92) (envelope-from ) id 1wogvE-00064O-MI; Tue, 28 Jul 2026 12:28:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373864.1620726; Tue, 28 Jul 2026 12:28:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvE-00064G-Jm; Tue, 28 Jul 2026 12:28:36 +0000 Received: by outflank-mailman (input) for mailman id 1373864; Tue, 28 Jul 2026 12:28:35 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvD-000649-CO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogvD-00DPri-22 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogvD-003Kyl-12 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bujvDiJEBXHRdaYTM1rp/E2qBzRdQ+1TxCTcbKHKXlc=; b=BdQE6qJlAupOm2Lrcz0AaJSe8A KXnj+t4eBTa4jQcFkVBt26qKXwNFV6HXU2YvslS9CB9du0OgW/UjgyU9kzktNLZc2OKt2eWH/72Ab Y9OmodgAsEtY7lJPf0ETqcKrk+KWLCLLGJMzX1NjOqTOPZQs8H0i7fYi8NJpmRen8Xmc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:28:35 +0000 commit d52507009519493b2fb3837dd6fcce125ea5d3d1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:26 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 68a5112283..c4d8b865ce 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1003,7 +1003,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; spin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index b0c1d905fe..38f37a4d2a 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -908,12 +921,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index ae801a66e6..5251ab3437 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1761,12 +1761,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 54d88bf5e3..caac793297 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -159,9 +159,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373865.1620730 (Exim 4.92) (envelope-from ) id 1wogvO-00066O-Nz; Tue, 28 Jul 2026 12:28:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373865.1620730; Tue, 28 Jul 2026 12:28:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvO-00066F-L8; Tue, 28 Jul 2026 12:28:46 +0000 Received: by outflank-mailman (input) for mailman id 1373865; Tue, 28 Jul 2026 12:28:45 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvN-000669-FO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:45 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogvN-00DPrn-2L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:45 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogvN-003L21-1L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:45 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=pkEZWLvjX56Clv2NaEwIudZnCVyrUZABwShEp1E5G6w=; b=POxVvVMfysXIBdZW0zf5z/EgHT ns83xjQeGxNx9jORe7PrK8jIp/bjlcfGOHa947j1Q0CGA8eyGHDohZGV/OdfO+z+W+hktSRhfxORo k8ZQCcbk4H75pF/cOIt4CwmEzX3DEcm5UEbFI+z5Y6dH1H8PpH4Kdrf3PWaTnb5I973Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:28:45 +0000 commit eb666059f0b0e1642cdbae7d05e9884699d0e3c2 Author: Roger Pau Monne AuthorDate: Wed Jul 15 12:44:37 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 4839374352..ad15825a1f 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,16 +647,24 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) +static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + if ( (addr & 1) == 0 ) - return 0xff; + return true; spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -696,7 +704,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -716,11 +726,8 @@ static int cf_check handle_rtc_io( if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) ) return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc, port); + else if ( rtc_ioport_read(vrtc, port, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:28:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:28:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373866.1620734 (Exim 4.92) (envelope-from ) id 1wogvY-00068H-P3; Tue, 28 Jul 2026 12:28:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373866.1620734; Tue, 28 Jul 2026 12:28:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvY-00068A-MS; Tue, 28 Jul 2026 12:28:56 +0000 Received: by outflank-mailman (input) for mailman id 1373866; Tue, 28 Jul 2026 12:28:55 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvX-000682-IO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:55 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogvX-00DPs7-2e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:55 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogvX-003L5Y-1f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:28:55 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hvZvq3PNt6XnrAmik0NX5EI/KYQUiTMnsIo9rgWGcq0=; b=gu2+feUJnMyysNveP5Vo3zyhsf 4sEpRJ4D5hHMfHUv1XAvBF45G+P9QcLHZHmgCxHRvC1yvhP2f2o9wSwCg64QMkwbbPyqamY6+t94W tWu4GurC4lDW5VELbgXIJBY+ltjtOCnoO9qWcu9TLKYcrJtD8wqsWY6FxCZwGGjQ0+0M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:28:55 +0000 commit 7b8806f2e711ae673dd212bad304e8cabb305502 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373867.1620738 (Exim 4.92) (envelope-from ) id 1wogvi-0006AG-RH; Tue, 28 Jul 2026 12:29:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373867.1620738; Tue, 28 Jul 2026 12:29:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvi-0006A7-Nz; Tue, 28 Jul 2026 12:29:06 +0000 Received: by outflank-mailman (input) for mailman id 1373867; Tue, 28 Jul 2026 12:29:05 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvh-0006A1-L9 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:05 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogvh-00DPsP-2v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:05 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogvh-003L8R-1w for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:05 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=z3fq8aBZ9A1Foiq/aitktUlED6Cjlv0yNBZCth2FoCc=; b=JWJ8jDsKOTWuSMtWh1k0s687LH PGvbNOilsc4YV+NtSHyNuDHYoUtEH5S74YKZ8BKGwwZd1Md7fIRT97ptnJrXCtXWEkMrvZdABTrd7 vM6taurnOTkavtsRKJRuSV95dnoDKHmTaF67cTej1Ja6/3ZHsdFXKAzu6fDxGYGmG4Hk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:29:05 +0000 commit a826f56089cee0e1cd2bec23184570a6454a929d Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:44:35 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 6cebc3868a..ea613cfdca 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:16 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373869.1620741 (Exim 4.92) (envelope-from ) id 1wogvs-0006E8-TB; Tue, 28 Jul 2026 12:29:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373869.1620741; Tue, 28 Jul 2026 12:29:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvs-0006E0-Qe; Tue, 28 Jul 2026 12:29:16 +0000 Received: by outflank-mailman (input) for mailman id 1373869; Tue, 28 Jul 2026 12:29:15 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogvr-0006Du-Ny for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:15 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogvr-00DPsU-3D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:15 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogvr-003LAx-2D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:15 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1sbMaO/P4haNhkO9cBf6QTUK0Tl7uYcnDrkDzcFpBuY=; b=f4V136UBuJSJsiX40kEUKebIWF gggegaHFEyVriVbf/bEucdfWzN+Behsie5kmf1EVxtgyG67Dk60iu775b/XRt3mFjLU1XzB6J66XL B7m+iGss67BlfoIEqbBhdD05mnomBNMQI1xVvGRP92fRBjiO0nxAWGi6oF6pqo9TjQSU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:29:15 +0000 commit 4de4c5cde70a8fc16e80aa500a6f8a4ae202c814 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 462691f91d..58915ad0dc 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -650,6 +656,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:26 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:26 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373870.1620746 (Exim 4.92) (envelope-from ) id 1wogw2-0006HA-UR; Tue, 28 Jul 2026 12:29:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373870.1620746; Tue, 28 Jul 2026 12:29:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogw2-0006H2-Rv; Tue, 28 Jul 2026 12:29:26 +0000 Received: by outflank-mailman (input) for mailman id 1373870; Tue, 28 Jul 2026 12:29:25 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogw1-0006Gw-R5 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:25 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogw2-00DPsY-0I for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:25 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogw1-003LD1-2W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:25 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hjnLIqh90HEaPaborno83IsSKaPC6P1T69sXFbc9S68=; b=qJszKjnqlNGBl57vNoXjk4orhx 7M4zOCF99e26S246mjkp6zWBGujRfYQAfsap+DUwO1m4fH4wgOmvNFRiYxM6QT1KnaeMr+37KX3J6 xZuJMBOYikDcc7J9/+WSTGG3IxH/tAMTPC2Y7OaAlkjIyYKQr+SxCZhFaiWsdPIlUm4Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:29:25 +0000 commit 23cb1f8f8d9c78d1b377785371ccb5413676d4d3 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 40a4be8315..1c355cbd4c 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -547,12 +547,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -655,6 +656,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:37 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373871.1620750 (Exim 4.92) (envelope-from ) id 1wogwC-0006J4-Vi; Tue, 28 Jul 2026 12:29:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373871.1620750; Tue, 28 Jul 2026 12:29:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwC-0006Iw-TD; Tue, 28 Jul 2026 12:29:36 +0000 Received: by outflank-mailman (input) for mailman id 1373871; Tue, 28 Jul 2026 12:29:35 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwB-0006Iq-US for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:35 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogwC-00DPsc-0c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:35 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogwB-003LEs-2p for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:35 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yHuOUHk4f+D4iEIQZGl9vIJoH9GOwvEuLjjcmCge8Mw=; b=1akNJsCCeVF2uZRrLgR7mwciBp LO+LThRJ4QEaKy8pcTBLECY7GRdkKbRvJM+4oMfqFp5RriYO4kZJcIkHfbe8Yxf7IVD6bTSeg7BRf MtD7ng4KdXVYiGHHBzxFSQf5RX9fJk3heEJ1PQ8U9YDzzGrCb06ZCgZGelmV0EsyYQ/Y=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:29:35 +0000 commit 69cc968847f6f459f923925d05f458aec3557781 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:43 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 39e550e7a3..e37528fade 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -237,6 +237,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373872.1620754 (Exim 4.92) (envelope-from ) id 1wogwO-0006Ky-18; Tue, 28 Jul 2026 12:29:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373872.1620754; Tue, 28 Jul 2026 12:29:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwN-0006Kq-Ua; Tue, 28 Jul 2026 12:29:47 +0000 Received: by outflank-mailman (input) for mailman id 1373872; Tue, 28 Jul 2026 12:29:46 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwM-0006Kk-IK for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:46 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogwM-00DPsi-2d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:46 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogwM-003LJI-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:46 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tTdVJL/sc2Zs6dVrNAIBrr0nL0cgh0cwFlaJP51M3+I=; b=VTm7nrRBZJkXSjTYI4P+SB12t4 OXZu4YTe8EWUxgG6DerRGdo5dHV0VZpDysxCh8BIbTQXxrcpHRHBvBAQOfhEYS5kKV8lf4591kz3u FHZIzVVCdCdQNNY5LFu9hWpSPRY3Wu13B0Ohoza7QMsHJLbgydq2YNIxBRUH4wjFBcg4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 12:29:46 +0000 commit 05e373691b9a377050a8a4aaf27f6a9a3adcd6d1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:10 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index a55910fcce..b040f95242 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -286,6 +286,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -411,7 +421,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 1b27e5c01b..34490488d0 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -238,6 +238,8 @@ debian-stretch-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:stretch + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-stretch-32-clang-debug: extends: .clang-x86-32-build-debug @@ -266,6 +268,8 @@ debian-bookworm-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:bookworm + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-bookworm-gcc: extends: .gcc-x86-64-build diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 370558756f..f4e38588c6 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -151,7 +151,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM ---help--- @@ -167,7 +166,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:29:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:29:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373873.1620758 (Exim 4.92) (envelope-from ) id 1wogwY-0006N0-2G; Tue, 28 Jul 2026 12:29:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373873.1620758; Tue, 28 Jul 2026 12:29:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwX-0006Ms-Vu; Tue, 28 Jul 2026 12:29:57 +0000 Received: by outflank-mailman (input) for mailman id 1373873; Tue, 28 Jul 2026 12:29:56 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwW-0006Mh-Kx for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:56 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogwW-00DPt5-2u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:56 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogwW-003LLS-1v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:29:56 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mNwtAC5mQKzEU9z8wS3I2Z75N5dZyrafbuGaVU5lF6E=; b=XKPWBsHuLiRXsH/DH5wCbpbz+A 5VBDX3NXnk2+eO+dYNRggsKvOwtgvqGE9a8UnBHYbI6BfvuEgWB/ICzAY5S760C08bfDrI+eA3Fy+ ZhPZu9P5YN52ANUw/hOAOMw7kKYbyru/GZNdbCgNEuglldFYPPPnQSxGU1JgsbpqhLyY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 12:29:56 +0000 commit a20f0bac271cf4f21fc0d9a24b1736fde36e1e25 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:45:13 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373874.1620761 (Exim 4.92) (envelope-from ) id 1wogwi-0007KR-3k; Tue, 28 Jul 2026 12:30:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373874.1620761; Tue, 28 Jul 2026 12:30:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwi-0007K1-16; Tue, 28 Jul 2026 12:30:08 +0000 Received: by outflank-mailman (input) for mailman id 1373874; Tue, 28 Jul 2026 12:30:06 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwg-0007I5-O9 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:06 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogwh-00DPtV-00 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:06 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogwg-003LQG-2D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:06 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1PQay2ZG1tXF+JuzMw6dejVXjgDcI3fd4Ud9QRm/PdU=; b=eWcNvlewjWmU97bE+5Ys8kFki5 FPqCsKhzIo5apKOuMQFX2Xp30PUC/dSt8fZiXikH6ev6FEZ0HBwR2LtlqlNsLybrtI2o9Ip4BcK5h chtMoXY5pAPW+QIHuCLRepiCEpYdDap7V/StdDgzx3irKvSBZIJabE5xGFcNNhomKCPg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 12:30:06 +0000 commit c5578563ff81891e82851d76639a2fc210f0f526 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 18 +----------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 5 insertions(+), 20 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 27a799161a..8e282f3caf 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -644,10 +644,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -670,10 +666,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -699,20 +691,12 @@ ret_t do_platform_op( break; case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); - break; + break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2df93b01b4..f6957d63e5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1551,12 +1551,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:18 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:18 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373875.1620765 (Exim 4.92) (envelope-from ) id 1wogws-0007RE-64; Tue, 28 Jul 2026 12:30:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373875.1620765; Tue, 28 Jul 2026 12:30:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogws-0007R6-3c; Tue, 28 Jul 2026 12:30:18 +0000 Received: by outflank-mailman (input) for mailman id 1373875; Tue, 28 Jul 2026 12:30:16 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogwq-0007Qx-Rp for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:16 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogwr-00DPx1-0M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:16 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogwq-003LV2-2b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:16 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bMfIQ5VXFDGcM/qKr6LqQ1mNwlFbYPE3HkW6Im9WCoc=; b=VJhV1r9FQx0FWsWzQ/QFXnitSv Y0wvWq9tMAsK4U03srTV8b9MiHCcRTmta2BBytjUXL1J8RNPx8IRl5siAskcbxtY7Woa1Q0Yb6Ueh 4C4zr498+iI2vestebr50PEzF7LitsovCFo6ODXqs8fX6BeiRSHqS7i6vvop52ExfQps=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 12:30:16 +0000 commit 59eefcbff2c75b5b816829793db9263f81b02016 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 4c7551c5d9..88a5b4a974 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8ed7c3dacf..485c324837 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 102880da9e..bafe7834a9 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -237,9 +237,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f6957d63e5..4eecd53f39 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -889,9 +889,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -963,7 +963,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373876.1620771 (Exim 4.92) (envelope-from ) id 1wogx2-0007TH-7v; Tue, 28 Jul 2026 12:30:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373876.1620771; Tue, 28 Jul 2026 12:30:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogx2-0007T9-4t; Tue, 28 Jul 2026 12:30:28 +0000 Received: by outflank-mailman (input) for mailman id 1373876; Tue, 28 Jul 2026 12:30:27 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogx0-0007T2-Vm for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:26 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogx1-00DPx5-0l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:26 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogx0-003Lc7-2y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:26 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=BeTiKQ4DAowexPLZEDikDMFOGm8x/riYPzHTmIN3IRU=; b=sye9YF6uD0WveVPe8E+ACEo2US LiyMxdyAGxZPyJaQy1wa7oSy9e0A4IFD58c3vxLQoT9pK858r+a1hcN3pCYUvEmAM9EbIGvlNtZ/p TWkXK2PytGA/9zjPqa+laygDiJOyaWDBmg1P+U1RnPZmj+f0/e4UsyiwSN6qHqkv6UMM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 12:30:26 +0000 commit a93453cd07ed555d3159975c3ea506d0ea78014f Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 87484361e8..cb8e7155b4 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 485c324837..8d4e94cc8e 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bafe7834a9..b42996f0c0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -220,11 +219,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 49598bf08a..d1caf13303 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4eecd53f39..a3a916999a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -897,7 +897,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -933,6 +932,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,7 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:38 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:38 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373877.1620774 (Exim 4.92) (envelope-from ) id 1wogxC-0007Xg-8p; Tue, 28 Jul 2026 12:30:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373877.1620774; Tue, 28 Jul 2026 12:30:38 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxC-0007XY-6C; Tue, 28 Jul 2026 12:30:38 +0000 Received: by outflank-mailman (input) for mailman id 1373877; Tue, 28 Jul 2026 12:30:37 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxB-0007XR-2G for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:37 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxB-00DPxA-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:37 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxB-003LfA-03 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:37 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=O/dlKfqWXarZ0RmNjIuM6czvWVKggINoCZKzJUM0X6s=; b=gAXlDGzgqnm+zV7EwHtnhFjaWv VwrgYC+SFYOSpF+gHGWoStBPyS9FHbd2o5msaqP8J0pEkLRUgOpXgi+nwnRycR9p3z3OGJ69hm4HP iXi29pGhpKWvG8LZGLEvH8DZ1H3A5DCrq19b1G0owPcMv2dSJxn5SZ93bw5LI5hg7aLU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 12:30:37 +0000 commit 7cfc2851173f2987905c2d4ed4df11a7766b1dd1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index 11c1562aa5..ef0d118b6a 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a3a916999a..fd5cbf6d7a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -895,7 +895,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -942,6 +941,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373878.1620778 (Exim 4.92) (envelope-from ) id 1wogxM-0007Zd-AI; Tue, 28 Jul 2026 12:30:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373878.1620778; Tue, 28 Jul 2026 12:30:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxM-0007ZV-7g; Tue, 28 Jul 2026 12:30:48 +0000 Received: by outflank-mailman (input) for mailman id 1373878; Tue, 28 Jul 2026 12:30:47 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxL-0007ZP-6H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:47 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxL-00DPxG-1R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:47 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxL-003Lie-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:47 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=F9slGgwMD+HH/oqzpGLeqdscqedNrW+1sGs12I19WD4=; b=z9IyNYtkMesiiJcS4BnMlwbmJ1 qZH5Tm4YdEwfSxB5sqcKfSOXxAMQIdPT8Yl7+AufaNwt2dykGsqNA7WVcYBbEpZaT5WNA3LuQhxoi +qVh28aHqjAQ0EgM/qmc3qDuo0TZCysXAwxCX/OunS/ZOmgZ28IKPBHIbs8O2+6sgjEU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 12:30:47 +0000 commit c59fe2017e75a08e575f6d2491301f3616ffb4cc Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 88a5b4a974..428c3a62a2 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8d4e94cc8e..a25436ab37 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b42996f0c0..0a147fdbe1 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -236,11 +235,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index d1caf13303..9a270bfd83 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fd5cbf6d7a..bf6befb880 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -894,13 +894,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -971,16 +976,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1902,7 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:30:58 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:30:58 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373879.1620781 (Exim 4.92) (envelope-from ) id 1wogxW-0007ba-Bs; Tue, 28 Jul 2026 12:30:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373879.1620781; Tue, 28 Jul 2026 12:30:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxW-0007bT-99; Tue, 28 Jul 2026 12:30:58 +0000 Received: by outflank-mailman (input) for mailman id 1373879; Tue, 28 Jul 2026 12:30:57 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxV-0007bM-9i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:57 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxV-00DPxa-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:57 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxV-003Lku-0m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:30:57 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=g/PfI2OHcBLbJo/O1VDgG4MH1PBjdbomxLRrxTZWa3s=; b=2jx+KbLv3SmEtv3PI45VttiwcA jsGG6zEMzNXflHMXZYXm363JC89XUecGwBdBQt3qMFaojQOnN6DFGHVtz7tIDk3k1QSWGVE25Cjfb sPh9b+5jQhavzmu2Eq4wbztgf6m6mubgYfCHRfnCueyVxIQYaVBA4z1XcVmnwopyPzSY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 12:30:57 +0000 commit 1d2ca59da701c00427e492960012e5afe10314e9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 42dc360ad6..385f75898f 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -118,20 +118,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -151,9 +148,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -161,10 +157,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index a25436ab37..4e9d719a74 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 0a147fdbe1..f2ea34d1cf 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -121,8 +121,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -500,16 +498,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 9a270bfd83..4e802da388 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -76,8 +76,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index bf6befb880..8198373969 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -895,9 +898,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -949,6 +949,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1226,12 +1243,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1947,8 +1964,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373880.1620786 (Exim 4.92) (envelope-from ) id 1wogxg-0007e2-En; Tue, 28 Jul 2026 12:31:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373880.1620786; Tue, 28 Jul 2026 12:31:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxg-0007du-C3; Tue, 28 Jul 2026 12:31:08 +0000 Received: by outflank-mailman (input) for mailman id 1373880; Tue, 28 Jul 2026 12:31:07 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxf-0007do-Cs for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:07 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxf-00DPxp-25 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:07 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxf-003Lo0-16 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:07 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ZC22KdVAw8+L6nL4aDfN+eRAjP+05ew34qZ+pDy7XkM=; b=VrkwbTacvPdZZkIQnMr0QCswm3 U6ze9DIlXlHc5w3NNkhOtuf5d7Vd9FSk/GKPVZ/3U4iLP1BMXTCkl0Qd/wOEX936vAv2xPoyFYJi2 ipzmGOwqY+qfUEl7RRjtKxh1lbO8bBOngRyzllFyEYx3Vdlao5ialsx9oKjO/17CLVTw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 12:31:07 +0000 commit 8e5a886dee84206d0b69c995a7b2fd818647c7f9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 428c3a62a2..4148b60570 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 4e9d719a74..2de09eb342 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index f2ea34d1cf..270e60d97b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -127,7 +127,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -514,11 +513,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 4e802da388..7019a1491c 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -82,7 +82,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 8198373969..2d75b592a4 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -896,10 +897,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -930,6 +927,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1321,21 +1335,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1970,7 +1969,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:20 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:20 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373881.1620790 (Exim 4.92) (envelope-from ) id 1wogxq-0007gB-G9; Tue, 28 Jul 2026 12:31:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373881.1620790; Tue, 28 Jul 2026 12:31:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxq-0007g4-DT; Tue, 28 Jul 2026 12:31:18 +0000 Received: by outflank-mailman (input) for mailman id 1373881; Tue, 28 Jul 2026 12:31:17 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxp-0007fy-J6 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:17 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxp-00DPxx-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:17 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxp-003Lqp-1T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:17 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Yo4IgdPdFDrrTLCRe7jRj3xp928EfX1vWhUzSbzwtdY=; b=YSyaWCrF58A7GVHWaR9/HXdSvg /no+DeHXUtSRT3YkZ0M479gIxPzcDiLKks6G12SqEok/QO/iXxjsi0tTZHu21zj2kmK45XReCHQ1X TpW6JyaVeg6pl8D7iG0mTgKTAsbOfNNVQq8veHvuS+4yNLs5AH4oyHHwJTn5shVNeNM0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 12:31:17 +0000 commit 49f1cd9478fca625fca48951348d1a36e4fa571d Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:31 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index cc7f2bd821..bf1b0d3677 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2755,6 +2755,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->trans_domain != td || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373882.1620794 (Exim 4.92) (envelope-from ) id 1wogy0-0007i6-Hk; Tue, 28 Jul 2026 12:31:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373882.1620794; Tue, 28 Jul 2026 12:31:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogy0-0007hy-Ey; Tue, 28 Jul 2026 12:31:28 +0000 Received: by outflank-mailman (input) for mailman id 1373882; Tue, 28 Jul 2026 12:31:27 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogxz-0007hr-L6 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:27 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogxz-00DPy1-2u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:27 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogxz-003Lvg-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:27 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6jpMpq/H7Mz8Vkifij3gov6TVvM90klBwriPhhyMFfs=; b=fsfdE9tPnWywgsoa9FfBmSz5XB ht7XIaFT4umtc2A6VGUbk8WCQXRJN4ISa0qqWIFTUzIQnDgmt2kno0+bTOzScVp0R78j/k59cVMVp BxA9CZ6tODluiFVyK6g2SYcnFSNmqVqi9j74ITT4YTcXgynev8pWdof99Cx93JHeONpk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 12:31:27 +0000 commit 1cc5e5babc1ab6f454d0a970ab52270c20402dc7 Author: Jan Beulich AuthorDate: Tue Jul 28 12:55:54 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index bf1b0d3677..b65979791c 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -918,6 +922,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1318,6 +1325,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1557,9 +1580,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1575,11 +1597,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2167,14 +2188,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2219,8 +2240,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2245,7 +2269,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool_t okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2385,14 +2409,14 @@ gnttab_transfer( * pagelist. */ spin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2404,7 +2428,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); spin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2424,7 +2448,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2444,6 +2474,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2472,28 +2503,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = act->trans_domain; trans_gref = act->trans_gref; } @@ -2511,6 +2541,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2623,8 +2656,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2638,6 +2673,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2674,6 +2710,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2700,6 +2738,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2754,6 +2794,9 @@ acquire_grant_for_copy( act->trans_domain = td; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->trans_domain != td || @@ -3173,7 +3216,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:39 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:39 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373883.1620798 (Exim 4.92) (envelope-from ) id 1wogyB-0007k1-JK; Tue, 28 Jul 2026 12:31:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373883.1620798; Tue, 28 Jul 2026 12:31:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyB-0007jt-GS; Tue, 28 Jul 2026 12:31:39 +0000 Received: by outflank-mailman (input) for mailman id 1373883; Tue, 28 Jul 2026 12:31:37 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogy9-0007jm-OX for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:37 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogyA-00DPy5-02 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:37 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogy9-003M01-2G for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:37 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=gYjhh51O0uEsMH18jto2iVjQw1qMh/v/QnzTmM16bIE=; b=yAZIwjTdFwHUpRMnPMdSYhQJSn lJtRsJvTax8vRJgCkz9yrNvtfI4qxBJH3tZ0tXd6bofJwTkYAa3TAwXRfhm24/rSR5x0oN7Wne8ge lmi8kfveckhhxFcy0FHnppaEjYgkeiNafn8EBpsRNhxe4okDtcIXajzC5n6P7J0n3zP4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 12:31:37 +0000 commit ae5c9e3be96802c20174fbe2a1b30bfaf9189448 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index a6dc665fa6..c0a325c827 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -961,7 +961,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; spin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index ce8f6aae61..8b15b6e172 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -938,12 +951,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index a15e5580f3..d063f649a1 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1759,12 +1759,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 0de9cbc169..ed7401e889 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -146,9 +146,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:49 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:49 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373885.1620812 (Exim 4.92) (envelope-from ) id 1wogyL-00081Q-TE; Tue, 28 Jul 2026 12:31:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373885.1620812; Tue, 28 Jul 2026 12:31:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyL-00081B-Q2; Tue, 28 Jul 2026 12:31:49 +0000 Received: by outflank-mailman (input) for mailman id 1373885; Tue, 28 Jul 2026 12:31:47 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyJ-000805-Ra for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:47 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogyK-00DPyD-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:47 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogyJ-003M4O-2Y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:47 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=o41Am4fBxyfDZe0GbRAtWtDgrgYl0/1gDrOR0q3ZUro=; b=gKgIi8s02mOMwrKaAsA2dKjoS5 Vmkag67zxMHL0kbfslhVyHyge0vzv4Qd82yTYNpzA3vCPJgEnAoSBv+YR4NBINMv3u/zvQAUvutVI VKuGSBVcgVbV2XiE8IQ4kJhNxoBYJfXj4fZ+unPuN8PM8c57y17kWzurwhEFjeIU7nls=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 12:31:47 +0000 commit f7152bdbb2149f7bc467cd04d61d28b385f50eec Author: Roger Pau Monne AuthorDate: Wed Jul 15 12:44:37 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index f582280637..8e77cf3915 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -645,16 +645,24 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) +static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + if ( (addr & 1) == 0 ) - return 0xff; + return true; spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -694,7 +702,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -714,11 +724,8 @@ static int cf_check handle_rtc_io( if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) ) return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc, port); + else if ( rtc_ioport_read(vrtc, port, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:31:59 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:31:59 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373887.1620815 (Exim 4.92) (envelope-from ) id 1wogyV-00086E-UC; Tue, 28 Jul 2026 12:31:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373887.1620815; Tue, 28 Jul 2026 12:31:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyV-000865-RK; Tue, 28 Jul 2026 12:31:59 +0000 Received: by outflank-mailman (input) for mailman id 1373887; Tue, 28 Jul 2026 12:31:58 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyT-00085b-VO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:57 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogyU-00DPya-0i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:57 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogyT-003M7t-2t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:31:57 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eOS/a0RFqM4tugapt9TVns/h3slcQ/jdPx9Rl55sdX8=; b=QvlJtiewHClwk8beE5oNpSr0e7 OtUMEMtF1f55kBrVO4kZYZ6s/ohNttZrkaIyPVDAdQdDVz9TfPs20wDKzKu3Vf3+4qPNhUz3WNHzp sLsvW56HZJ9dUwOO2/aNYRFD0M65H+gn7ROsE6C/XyCQgQrTDhuNcxj3f3yQVRTFMGXY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 12:31:57 +0000 commit 3fcf9565ae77d754b7f7656a736faa29cc4a28cf Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 3c94fb0814..0577707d12 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -156,6 +156,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -365,7 +373,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -576,6 +584,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:32:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:32:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373892.1620819 (Exim 4.92) (envelope-from ) id 1wogyf-0008EE-Vt; Tue, 28 Jul 2026 12:32:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373892.1620819; Tue, 28 Jul 2026 12:32:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyf-0008E4-Sq; Tue, 28 Jul 2026 12:32:09 +0000 Received: by outflank-mailman (input) for mailman id 1373892; Tue, 28 Jul 2026 12:32:08 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogye-0008Do-2H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:08 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogye-00DPys-12 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:08 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogye-003MB9-03 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:08 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=g8MnLZPGUxUZ1/paPqc81RKd5xfIWWvqPLy8M2ZNLmY=; b=DOdDkosSUPgjk02HtJvRS/tRrz 3Tg8bqZqLaM0P9bsEFqeNG4DwagotyM7Yn4tAuXsAwFkIh1llr1zriAtxBcmcDPfbd5DvCFixPDyx itmdCYWYKnKA8ETVCWeFTiiFYO0gsDwBHEaY6x04BuT5FibR6S0STSz5pCux84Utp454=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 12:32:08 +0000 commit 7b8ea878a93f0fa86a2e048e11f942aff3b5b0c5 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:45:51 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 6cebc3868a..ea613cfdca 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:32:20 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:32:20 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373894.1620824 (Exim 4.92) (envelope-from ) id 1wogyq-0008KW-1E; Tue, 28 Jul 2026 12:32:20 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373894.1620824; Tue, 28 Jul 2026 12:32:20 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyp-0008KO-UB; Tue, 28 Jul 2026 12:32:19 +0000 Received: by outflank-mailman (input) for mailman id 1373894; Tue, 28 Jul 2026 12:32:18 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyo-0008JK-4t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:18 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogyo-00DPyx-1J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:18 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogyo-003MDy-0K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:18 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=igCtqapNMVAp/juRvaZG7s0B12OB39I+Y8zJ9Bh1tAk=; b=SnpvdWtkqGdLncbwUyS4UNg+4o 3/933Y24ohcJEb6RLL1I/6s2nKqd03oFzJgc/RJbK4sp5iiZLXBIZFi445Zihzm8WiWqnkie/cSx9 N4nk72WEXGEcg8S8jflfBEJ7aODs1isAHkWibhNi9ZtmWCQLRj/FTxDQ/b82vMLJlT0Y=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 12:32:18 +0000 commit 4206d3febbde59dc91bb81bc3cac041a0e2d51b0 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index f8e6089870..90d1877197 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -504,6 +504,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -661,6 +667,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:32:30 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:32:30 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373896.1620826 (Exim 4.92) (envelope-from ) id 1wogz0-0008OL-25; Tue, 28 Jul 2026 12:32:30 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373896.1620826; Tue, 28 Jul 2026 12:32:30 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyz-0008OB-Vb; Tue, 28 Jul 2026 12:32:29 +0000 Received: by outflank-mailman (input) for mailman id 1373896; Tue, 28 Jul 2026 12:32:28 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogyy-0008Me-84 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:28 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogyy-00DPz2-1b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:28 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogyy-003MGC-0c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:28 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hPadBoTSV9FUaArM/XHJkRwFb7rTqOeC8dodk0Yh7WU=; b=XLfFOTyFXHmCzXwjeHxi5qUakq KmAflc/T90VsWwQwI1Fdvht9KbUEL9+HaoWtMwmo2y5CzPq+t1q1Z1KpL6/CIL5883NYj9r6aCVd6 /F3/jt4nPGNzlWYchyDt0TpPbu1sgxqswqgXbDQ8FWb6k439GIfg3kTQGXt/KgnYR2wk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 12:32:28 +0000 commit f07dd6360bfbc88b5c591c39d6fd5f0e0785b9c6 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index e903db9d93..380b69dba5 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -559,12 +559,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -667,6 +668,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 12:32:40 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 12:32:40 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373898.1620831 (Exim 4.92) (envelope-from ) id 1wogzA-0008Sl-3N; Tue, 28 Jul 2026 12:32:40 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373898.1620831; Tue, 28 Jul 2026 12:32:40 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogzA-0008Sa-0a; Tue, 28 Jul 2026 12:32:40 +0000 Received: by outflank-mailman (input) for mailman id 1373898; Tue, 28 Jul 2026 12:32:38 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogz8-0008S3-Ay for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:38 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogz8-00DPz9-1u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:38 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogz8-003MIe-0v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 12:32:38 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qzh3GhtSzO4XpYrZf20X0PGo+di1tKpKvnnvsBP/cGI=; b=mVg39RjOjPm2PGAD8UFI62wWTU b27xwF9OEvvUS9UXNusagfi1SQPPz+s1uTUDe3Q7y+UkkGmQ44xt27FpTdFG/Vks6IJNActFKSPQ5 9lBq1S1xwUQyVza/P5DrrklZAqbQ2BYLivt1wHp+u+OgkIrJMzoYcRCEUOtRijwy2NZQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 12:32:38 +0000 commit d0f5c188481653c71c4909e80959d714be2a7f7d Author: Jan Beulich AuthorDate: Mon Jul 20 16:46:06 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index b040f95242..78ba8d46c5 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -208,6 +208,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373977.1620880 (Exim 4.92) (envelope-from ) id 1wohPf-0007Np-8V; Tue, 28 Jul 2026 13:00:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373977.1620880; Tue, 28 Jul 2026 13:00:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPf-0007Nj-4q; Tue, 28 Jul 2026 13:00:03 +0000 Received: by outflank-mailman (input) for mailman id 1373977; Tue, 28 Jul 2026 13:00:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPe-0007Id-MG for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohPe-00DQaT-2o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohPe-003UBx-1k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xzuWUmK0dkf2ouob2rGGyGPswBl0idMCHIrFerdzW6k=; b=ylgdK0bdlXiJHZ25RiiGsinkvd 4Q4Fbdu2mwkYzk4uzlvUDWBa19KtaKqEi0meyzivtdRf/PmPumpaVSc7h2xV4gCracdE1rRZqSl1n 9uNHp0kDd5+Z7BeNnlrmCkF96sbRlu3nibCqRzpJ6Kg1DIKBZb+crrDAqHO9hPuHorRA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 13:00:02 +0000 commit f2cac32029e639a0974ca6752fbc3fafdd4f139a Author: Jan Beulich AuthorDate: Wed Jul 15 16:45:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/analyze.yaml | 2 +- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 +++- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 021264908c..55f2b0d102 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/analyze.yaml b/automation/gitlab-ci/analyze.yaml index 3f7532ee1d..c650ed61c4 100644 --- a/automation/gitlab-ci/analyze.yaml +++ b/automation/gitlab-ci/analyze.yaml @@ -59,6 +59,7 @@ eclair-x86_64-allcode: CONFIG_PERF_ARRAYS=y CONFIG_PERF_COUNTERS=y CONFIG_PV32=y + CONFIG_SHADOW_PAGING=y CONFIG_UNSUPPORTED=y CONFIG_XEN_GUEST=y CONFIG_XHCI=y @@ -91,7 +92,6 @@ eclair-x86_64-amd: CONFIG_PV=n CONFIG_XEN_IBT=n CONFIG_XEN_SHSTK=n - CONFIG_SHADOW_PAGING=n CONFIG_HVM_FEP=n CONFIG_TBOOT=n CONFIG_HYPFS=n diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index d5929e34ec..27eefec5f9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -296,12 +296,16 @@ debian-13-x86_64-gcc-debug: <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86_64-build-debug <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 2ce4747f6e..3ce0774b8d 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -145,7 +145,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help Shadow paging is a software alternative to hardware paging support @@ -160,6 +159,9 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. + config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373978.1620884 (Exim 4.92) (envelope-from ) id 1wohPp-00081n-A4; Tue, 28 Jul 2026 13:00:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373978.1620884; Tue, 28 Jul 2026 13:00:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPp-00081f-7V; Tue, 28 Jul 2026 13:00:13 +0000 Received: by outflank-mailman (input) for mailman id 1373978; Tue, 28 Jul 2026 13:00:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPo-00081X-Nl for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohPo-00DQcP-3A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohPo-003UEH-26 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6uCV29C4K8+rpzzc2T1kSOSsc/e3xTIqWITEYGlkNHk=; b=Y1bvkunAZ4PPs0javX47I90jYB wqDjIJrlfx+jduQ/7VEt8Mq/dj/n0mi0/ndDLydYfP5unUEuVWq3pNdy05f/m99PdD0lNEm1QTmn3 c0xZbeeiLH0llC8xTB/3ePZOE8k9g7OnPjy0Pw0KTR8MM7jZVpTXdDGAJzsaiIjhd+ns=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 13:00:12 +0000 commit 40c59b6c29b1317707a94194f8121c0d7445b89c Author: Grygorii Strashko AuthorDate: Wed Jul 15 16:59:28 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index a3d18bc464..a7f9cc5fe0 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373979.1620888 (Exim 4.92) (envelope-from ) id 1wohPz-000846-BR; Tue, 28 Jul 2026 13:00:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373979.1620888; Tue, 28 Jul 2026 13:00:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPz-00083x-8r; Tue, 28 Jul 2026 13:00:23 +0000 Received: by outflank-mailman (input) for mailman id 1373979; Tue, 28 Jul 2026 13:00:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohPy-00083r-Sq for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohPz-00DQe6-0S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohPy-003UIB-2U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=A1LLJjr4TZiiedrnUdAjJN5A6XAIFYoGSUMnluNqhfU=; b=2H+mAGXNqT0dmsqZ4twLWt6boJ a96QAGnhEHJda1+no9MS9GMyXzeqBTBpwt1mLbsMyw0NtZlXlzefyHwyXJa2dPZX8G91RZK37z9/9 YWgI7Fs73QiAeDpm/twDzmHEm3cfGYIy8spiN/XdLSYeGcOnzb6gTEx77SBkNg7ae5oM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 13:00:22 +0000 commit fd11acab3db4e9162a284169956099490c32e919 Author: Syed Abdul Khaliq AuthorDate: Wed Jul 15 17:00:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373980.1620892 (Exim 4.92) (envelope-from ) id 1wohQ9-000863-Cp; Tue, 28 Jul 2026 13:00:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373980.1620892; Tue, 28 Jul 2026 13:00:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQ9-00085v-AB; Tue, 28 Jul 2026 13:00:33 +0000 Received: by outflank-mailman (input) for mailman id 1373980; Tue, 28 Jul 2026 13:00:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQ8-00085o-W6 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQ9-00DQeA-0n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQ8-003UNR-30 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UgWtDA/19QPl0mBeLjkaS3e/mF1SFxhWbJe899pzAUE=; b=bu9DbS4EX+gnfvYGRTs7Qt1SX+ ZWd+yslZY1YxcqtRgRQoDosCB04h4ZqyadDWQhIholRrXKrwOvfzSCc/W/pOMAeH5tPqQERwp5VUQ cPSU+eXDYuwOcSPp6hDXcTmFEh7h9y/Ia+O6Gwou5yCR5CDFv+yp+HsqACi9cYYBE9jA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 13:00:32 +0000 commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 0431f875af..6dee4922f3 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -735,10 +735,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -761,10 +757,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -789,20 +781,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index cc799273f5..5633c02c4b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1207,6 +1207,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1216,6 +1217,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1536,12 +1538,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373981.1620896 (Exim 4.92) (envelope-from ) id 1wohQK-00087w-Ex; Tue, 28 Jul 2026 13:00:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373981.1620896; Tue, 28 Jul 2026 13:00:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQK-00087n-Bk; Tue, 28 Jul 2026 13:00:44 +0000 Received: by outflank-mailman (input) for mailman id 1373981; Tue, 28 Jul 2026 13:00:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQJ-00087d-3a for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQJ-00DQeH-16 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQJ-003UQa-07 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zXVCTy5Uc339fD7doW3gRwmp0Dq3CahlvbDrwcqFLyw=; b=5hZNwK+85fz+ikkjXixCvKbBRo XLRXxhow1cwVI/ofrozKN97iQE2Afbm7Pm6ObPaXh4CF97k82Qj0usz7w6GfBQlTB0KvQ3PVe1HFB fO3KbRPSDuQYZan2EOgEBWBNlK+0Kuj9ThbXn7J4MgatyRu6Xnx0clLe5KPze/LS5QZM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 13:00:43 +0000 commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 74b1c0ed39..2d49e99b3c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 89823abbf8..48ca5fd3f5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -251,9 +251,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5633c02c4b..a8b9cf442f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -872,9 +872,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -942,7 +942,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:00:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:00:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373982.1620900 (Exim 4.92) (envelope-from ) id 1wohQU-00089u-GC; Tue, 28 Jul 2026 13:00:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373982.1620900; Tue, 28 Jul 2026 13:00:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQU-00089n-DD; Tue, 28 Jul 2026 13:00:54 +0000 Received: by outflank-mailman (input) for mailman id 1373982; Tue, 28 Jul 2026 13:00:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQT-00089g-8a for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQT-00DQeb-1U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQT-003UT4-0R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:00:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/kfUgyJlSqdGM4AlFxBAMFH0jdCtknqam5o7sglXT5Y=; b=6/Q/9OOgVSm6de9V3pRrZdA3DX tmUTqrUrpsi07fNpnLAt2dZnS0CO4gBKaT0OdEJOE/fos8qb6cQz87j8m7coDIrRMAZelBeUZVvHn GO64Rix6CHYb8IHFMC+SEyr6OpYW+Ws65YLp/t9v3qkeHjHFhKdlp+6tcIf5shG4R2Ec=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 13:00:53 +0000 commit 751e371c913ca87d0a66304dfa6837158835cac5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 3609721426..55b71301cf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2122,10 +2122,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2d49e99b3c..30a6f86e70 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 48ca5fd3f5..4e2cae51f0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -231,13 +228,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 6c17bbff3a..98bf9a73eb 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a8b9cf442f..57b2e1b287 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -606,7 +606,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -880,7 +880,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -916,6 +915,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,9 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373983.1620904 (Exim 4.92) (envelope-from ) id 1wohQe-0008CL-JE; Tue, 28 Jul 2026 13:01:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373983.1620904; Tue, 28 Jul 2026 13:01:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQe-0008CD-Gc; Tue, 28 Jul 2026 13:01:04 +0000 Received: by outflank-mailman (input) for mailman id 1373983; Tue, 28 Jul 2026 13:01:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQd-0008C7-Bt for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQd-00DQeq-1o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQd-003UVr-0o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5YkBduUGtJcOdBR576Ww7FaIha3W4IJsjz/8VG62a0Q=; b=o/1GXD/HQf9CBtgo0ccyP6uD1I FDGYJiBvtRxEBUNAl9FbenDq3+LEBs2NterafMaWK7ZuLCR727NdNTEjYjuoDuud9C54fURQfmXfc uWaNSxa2/Z8O/p1WWqRlIMfKrf+qaeioV3tfG5QN8OYOZ64vhSkFWtUWLo411L8wGy5c=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 13:01:03 +0000 commit 3179bf29311f9ed54b931bc95782b061afec5897 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 57b2e1b287..4e5b75dfaf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -878,7 +878,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -925,6 +924,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373984.1620908 (Exim 4.92) (envelope-from ) id 1wohQo-0008EY-Kj; Tue, 28 Jul 2026 13:01:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373984.1620908; Tue, 28 Jul 2026 13:01:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQo-0008EO-Hz; Tue, 28 Jul 2026 13:01:14 +0000 Received: by outflank-mailman (input) for mailman id 1373984; Tue, 28 Jul 2026 13:01:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQn-0008Dy-Df for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQn-00DQeu-2A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQn-003UZP-16 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5fQgMH5YEN7iKTaGb3Mhnn/KnpPXJeuvIiiBgGdpORk=; b=uYGsCn2IoOUw2LUJbp8W/ahlDW nKVDfvA8jQEBG4k+IzEBsX7kDPDRbAUWEnXP5uisthkUbpsH1k2P8ZR5wMneOmnK5BsupDVmSR3It POO/G96R1pkCEItizYd9MVzOEeGmfGOZ7NJkSKiGxq77fGx+gvBFNXSwmYJBYj891iqw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 13:01:13 +0000 commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 30a6f86e70..1cc248d710 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 4e2cae51f0..7609c4c5db 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -245,11 +244,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 98bf9a73eb..89d37b6537 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4e5b75dfaf..b37d4bf2a2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -877,13 +877,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -949,16 +954,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1903,7 +1898,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373985.1620911 (Exim 4.92) (envelope-from ) id 1wohQy-0008GN-M2; Tue, 28 Jul 2026 13:01:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373985.1620911; Tue, 28 Jul 2026 13:01:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQy-0008GG-JO; Tue, 28 Jul 2026 13:01:24 +0000 Received: by outflank-mailman (input) for mailman id 1373985; Tue, 28 Jul 2026 13:01:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohQx-0008G9-HM for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohQx-00DQf3-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohQx-003Ubn-1U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FGQxacvrccVoG7QLp4tvqeI8OSNWiF/58RqlH5DjAm4=; b=sXMbfs6UyeDXhOr4B34v5bbtVw gxjvtmk8rKuDwGgY+yDll4fS5qGadIMW2y1EkHzJ9E47L8Ii7vsKbN6HN10HmASWwHNCMRshsGYPk O89RcCK/VCMqRs5YJP8kKwodxPk6JDFG9pdEajDQ6vfIBI5EwVdHXP/DkQcCZHK4cBec=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 13:01:23 +0000 commit 0501e1dc047768cba2a458b25f5e9214726c33c8 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 0fbbdd8b28..6bd4e191a7 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1cc248d710..1fd66ee947 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -390,18 +390,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 7609c4c5db..397d578c8b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -512,16 +510,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 89d37b6537..a6157a3cf8 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b37d4bf2a2..d495446ec0 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -55,6 +55,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -878,9 +883,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -932,6 +934,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1207,12 +1226,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1948,8 +1967,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373986.1620916 (Exim 4.92) (envelope-from ) id 1wohR8-0008IG-Nk; Tue, 28 Jul 2026 13:01:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373986.1620916; Tue, 28 Jul 2026 13:01:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohR8-0008I8-Ky; Tue, 28 Jul 2026 13:01:34 +0000 Received: by outflank-mailman (input) for mailman id 1373986; Tue, 28 Jul 2026 13:01:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohR7-0008I1-Kb for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohR7-00DQfA-2r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohR7-003Ue5-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Wtv9X4lqVgeoGxs4BviQ5aW+AA3gwD8BxtA3awxgIcU=; b=VII2kTUpAnfgga9OOMEs9N0KlC CYHKlDCkyyksxfYGNeNoJiXIXyCTvMguZfLwAZYsgKoR7MOI7BxiSsaB369AwFr+Inl8/up10OWl1 oenCtQv8ySBZzdDkwuqP+zCNNbp0nEj71Rv1y2Q/9gysDesllaK8lgSxutY+i5n+D9LU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 13:01:33 +0000 commit 299de2aedabe545092b4225c3335701290bd953a Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1fd66ee947..50ef246467 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -423,12 +423,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 397d578c8b..852eac7d20 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,9 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -526,13 +523,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index a6157a3cf8..2d02655703 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,9 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d495446ec0..a6cef9d2a5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -60,6 +60,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -881,10 +885,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -915,6 +915,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1307,23 +1324,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1973,9 +1973,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373987.1620920 (Exim 4.92) (envelope-from ) id 1wohRI-0008K2-Pv; Tue, 28 Jul 2026 13:01:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373987.1620920; Tue, 28 Jul 2026 13:01:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRI-0008Jr-MM; Tue, 28 Jul 2026 13:01:44 +0000 Received: by outflank-mailman (input) for mailman id 1373987; Tue, 28 Jul 2026 13:01:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRH-0008Jl-O1 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohRH-00DQfE-3D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohRH-003Uh9-2C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=uirQ4BWTrONhd9x0qFfgnhI8KHTlaR5SWy1qM/cIjqk=; b=d0IcfzWOqVfNUIOa01Z0q2rEXh NY2BPbQTL1ipI/9zJ664c+gqLzBNfbmjYJ626fFjbMCHrYX7oPYdJ+xCupmXCuAnPpdadeAohuj/2 mQO+eyn34d7LVYI3RMkMicV8Q10Fh1zhmO/5imN5gjtTqeO7LZxpe9UXGkY7in+XHjWw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 13:01:43 +0000 commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e Author: Jan Beulich AuthorDate: Wed Jul 15 17:04:21 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 17e1af9fcf..b83dd7bc2a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2804,6 +2804,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:01:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:01:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373988.1620923 (Exim 4.92) (envelope-from ) id 1wohRS-0008MY-SH; Tue, 28 Jul 2026 13:01:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373988.1620923; Tue, 28 Jul 2026 13:01:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRS-0008MQ-Ph; Tue, 28 Jul 2026 13:01:54 +0000 Received: by outflank-mailman (input) for mailman id 1373988; Tue, 28 Jul 2026 13:01:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRR-0008MJ-Ra for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohRS-00DQfb-0K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohRR-003Uj3-2V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:01:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IOgikeC40DnhnuWWotpk7b94Git11fjpQiP+swCNTLE=; b=diKk87KXdxwXQAes1zdDho8STZ SxtSkLpBS6CtshINhssCSud/IZ8QEyV5IH01TtbdvH1Gx0990SFpcHSatK3/KQ/tA2Z9svX5UbmjA kaGpEnWis4+eJCwVReMxCE/T0u0jSU41hRZhnsbL4zKu3aIDm9kZHjlOnK+RfUqWkZbU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 13:01:53 +0000 commit 96dfeb41774ab50c74a01483726db8bb17a31a69 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index b83dd7bc2a..33ef5f651b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2196,14 +2217,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2248,8 +2269,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2274,7 +2298,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2414,14 +2438,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2433,7 +2457,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2453,7 +2477,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2473,6 +2503,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2501,28 +2532,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2541,6 +2571,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2672,8 +2705,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2687,6 +2722,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2723,6 +2759,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2749,6 +2787,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2803,6 +2843,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3232,7 +3275,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373990.1620928 (Exim 4.92) (envelope-from ) id 1wohRc-0008OX-Tv; Tue, 28 Jul 2026 13:02:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373990.1620928; Tue, 28 Jul 2026 13:02:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRc-0008OP-RC; Tue, 28 Jul 2026 13:02:04 +0000 Received: by outflank-mailman (input) for mailman id 1373990; Tue, 28 Jul 2026 13:02:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRb-0008OJ-V3 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohRc-00DQfq-0g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohRb-003Uli-2v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FHkRObdS3qXeHhZJGfn186YWPJEAZHEzapAIsLiqvuk=; b=AG2ocbhPGJ8gZn43mdXOwXKkju 3wEqDF7Dmbx71tKRl8sgUt4SAEDiWB+tUD8R5IMuWU7USnt8NG6T64OATc5Phny9OivBO6AOsU5ah SpulNOUtI40ZKJLe4dl0LrE9bG4kACDYcHyuLUwBgBgUltCRyLNqf2uFid1avvMcjNXg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 13:02:03 +0000 commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3 Author: Jan Beulich AuthorDate: Mon Jul 20 16:27:39 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 53ac1d6c40..0df008f72d 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1320,7 +1320,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index e30b38a337..227313e62b 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -140,7 +140,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -152,6 +152,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -895,12 +908,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 2ca7723e50..e245b160d4 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1922,12 +1922,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index a095190fc7..aeb8b36ad1 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -193,9 +193,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif #ifdef CONFIG_VMTRACE -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373992.1620932 (Exim 4.92) (envelope-from ) id 1wohRm-0008S5-V8; Tue, 28 Jul 2026 13:02:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373992.1620932; Tue, 28 Jul 2026 13:02:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRm-0008Rx-Se; Tue, 28 Jul 2026 13:02:14 +0000 Received: by outflank-mailman (input) for mailman id 1373992; Tue, 28 Jul 2026 13:02:14 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRm-0008Ra-2O for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:14 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohRm-00DQfu-10 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:14 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohRl-003Uq4-3D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:14 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=r0ipNWXnJmUhojtLbsshe1cR2EwWkq1+dXMkp+poQ10=; b=f1pXOmcD6nh/zG8R86YmmTPahd b4PGEgOP1j/cMTVse7nOrsLMKTeRzUpW1oevVZXSSAu12pw0AC8nYsBKH35O+5SZc5bjPIXnSMVGS iXGiJ20K6TVjV8WpedzGrjhAsKl947Da8U4so6epDhP03IALWOjmFEvf5G+hKqWsrczc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 13:02:13 +0000 commit 52350da92619a77472ebb87f20f6a1fea49eebfd Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 4ba5881b24..65b3b79f1e 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373994.1620936 (Exim 4.92) (envelope-from ) id 1wohRx-0008U7-0N; Tue, 28 Jul 2026 13:02:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373994.1620936; Tue, 28 Jul 2026 13:02:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRw-0008Tz-U2; Tue, 28 Jul 2026 13:02:24 +0000 Received: by outflank-mailman (input) for mailman id 1373994; Tue, 28 Jul 2026 13:02:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohRw-0008Tt-5Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:24 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohRw-00DQfy-1L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:24 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohRw-003UsS-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:24 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=BWp3psSyPEpB+dSzC2iJDqOWuSh9tLnW1ZTeKe856eA=; b=WeFCkYzR1HeWFqJPaW4par+rX1 gCeVVUDKgVsSc2HMIwaOmoMrZG8wO51ZpkNoJdE6s4my+LCBNe5jvFdROm2I+y29gDWEyH7tY3Y1T 4ewvVgKHnZJ5gcfRyKkVia2B2RkTRrjl782Ll0tKLlLsQuwR0UvEzTZOtyrmugZqsGMQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 13:02:24 +0000 commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373995.1620940 (Exim 4.92) (envelope-from ) id 1wohS7-0008W5-2C; Tue, 28 Jul 2026 13:02:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373995.1620940; Tue, 28 Jul 2026 13:02:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohS6-0008Vx-Va; Tue, 28 Jul 2026 13:02:34 +0000 Received: by outflank-mailman (input) for mailman id 1373995; Tue, 28 Jul 2026 13:02:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohS6-0008Vr-8D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohS6-00DQg5-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohS6-003Uuq-0d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:34 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dwHyt/XZEUkJVtzS9ILynWyz9vfrrvG/2o2R1hwQXNw=; b=WaFUwTvOTIwLIkytjhHrtFfykt X3cUPoyuOxb8iPUJj3u5BPKHYxx9mIKeqk8ZNIzM0ncGtp8mjLy2Zg48DSVGzEGvys6gvlUCSh02T 9BeC+pzjzKEkmv0z+PDgBwJlJXGzFBM0O8va/gbzEyo/zIsweoOoYz7X89gcXVKrjcXw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 13:02:34 +0000 commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878 Author: Roger Pau Monne AuthorDate: Wed Jul 15 17:32:07 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:46 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:46 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373996.1620944 (Exim 4.92) (envelope-from ) id 1wohSI-00008h-52; Tue, 28 Jul 2026 13:02:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373996.1620944; Tue, 28 Jul 2026 13:02:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSI-00008Z-2T; Tue, 28 Jul 2026 13:02:46 +0000 Received: by outflank-mailman (input) for mailman id 1373996; Tue, 28 Jul 2026 13:02:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSG-00008S-BZ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohSG-00DQg9-1y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohSG-003UyW-0x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5KmMldHAScyWU3iHvyKoAk+tqn5Crce5+65RPrZdhbs=; b=jz1eE1FiYd5DD85QlXgJXnER4A WU2fCKY+f6OG97IZJvOeYuod82n/bl8yb2gkgfx2o4i10ZsdiWPImcVMnnLJOTxltrw/391WCJjeR EvMRvyZnlgJvbyMiMWb9QwtLqbQc6lWBr5rOKCkfhsLEV1lWsjmYQvkOo6LlKWTl5Y0w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 13:02:44 +0000 commit aef948a300da3f10ca5d033177dbd794afc45e2b Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:02:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:02:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373997.1620948 (Exim 4.92) (envelope-from ) id 1wohSS-0000Aq-6S; Tue, 28 Jul 2026 13:02:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373997.1620948; Tue, 28 Jul 2026 13:02:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSS-0000Ag-3m; Tue, 28 Jul 2026 13:02:56 +0000 Received: by outflank-mailman (input) for mailman id 1373997; Tue, 28 Jul 2026 13:02:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSQ-0000AZ-G0 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohSQ-00DQgV-2P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohSQ-003V2G-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:02:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zb1iLJRVcfBhHqycq8IUnev3togbrtcUrpXQdut+WE4=; b=3UAJvR6el0whTHEKUd0VOlq24F 7VoxFa8cfmNOder1sMRMSZh7WCivq2AKE2yl09D77RmTsBOE1YcA4Mb01AJBtJrzfVwQrHYzwU8D8 63iOqc15DkNP0XnaH3jan28v3V/y56S6+194aNK0/GmL7LbfIKF3z30qMbkEHqlAgx0Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 13:02:54 +0000 commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 7a0bebd2d3..4602c32cff 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:03:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:03:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1373998.1620951 (Exim 4.92) (envelope-from ) id 1wohSc-0000Ck-7n; Tue, 28 Jul 2026 13:03:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1373998.1620951; Tue, 28 Jul 2026 13:03:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSc-0000Cc-59; Tue, 28 Jul 2026 13:03:06 +0000 Received: by outflank-mailman (input) for mailman id 1373998; Tue, 28 Jul 2026 13:03:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohSa-0000CT-Iu for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:03:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohSa-00DQgt-2h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:03:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohSa-003V67-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:03:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KBS81CJyaSW9R15bJXBohCn0ycRpRZz5yr5MXOdIpJA=; b=DOWLslYiWRypeSQEa2XX3JLfP0 eHJlQAjxX80FmHCpTTYvKLQV2jFIMBwp805Ngsg6XZKrK/eki7wjtAp3YlHr02QX2hxwPInmldmC/ UzHdh+OWmyDvRm/vb9D8B99l5SBdrv1O4buGAUq7i8gX6nLb8E6PDAMdFlj9OLlKGpbU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 13:03:04 +0000 commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2 Author: Jan Beulich AuthorDate: Mon Jul 20 16:28:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 12:40:10 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 55f2b0d102..eb07332462 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374214.1621190 (Exim 4.92) (envelope-from ) id 1wohvb-0001Pm-Eb; Tue, 28 Jul 2026 13:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374214.1621190; Tue, 28 Jul 2026 13:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohvb-0001Pe-C6; Tue, 28 Jul 2026 13:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1374214; Tue, 28 Jul 2026 13:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohva-0001PY-6o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohva-00DRKW-1O for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohva-003cdf-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=u3Aons8eiNFIbz8tCm41DtRslLq0Es5mrsIPbeO/nDc=; b=lUdyQqXgJZTKubn6R8a7sA03L9 +KdoQtf0uCGQKW5O0WQVGynCLXyGJRvd3pt1Hhxg3+ld4WY0PlK0zG9mDMKFjv3WaMkLR+BeZ7U1W ExLVznmg9fF7QjJuFCz/aFPxKai+2yQEIrCqF/gspatiw37gS5c5S14TMnEFTsma/abk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 13:33:02 +0000 commit 05e373691b9a377050a8a4aaf27f6a9a3adcd6d1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:10 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index a55910fcce..b040f95242 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -286,6 +286,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -411,7 +421,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 1b27e5c01b..34490488d0 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -238,6 +238,8 @@ debian-stretch-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:stretch + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-stretch-32-clang-debug: extends: .clang-x86-32-build-debug @@ -266,6 +268,8 @@ debian-bookworm-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:bookworm + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-bookworm-gcc: extends: .gcc-x86-64-build diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 370558756f..f4e38588c6 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -151,7 +151,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM ---help--- @@ -167,7 +166,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374215.1621194 (Exim 4.92) (envelope-from ) id 1wohvl-0001Sh-GB; Tue, 28 Jul 2026 13:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374215.1621194; Tue, 28 Jul 2026 13:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohvl-0001SZ-DV; Tue, 28 Jul 2026 13:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1374215; Tue, 28 Jul 2026 13:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohvk-0001SQ-AT for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohvk-00DRKa-1p for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohvk-003cfv-0i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=F94eGE8Wgy9njYH0NB90vnlknYH0f5MW60vRLfGDx4I=; b=ih4/dUuV09DisP+MfRMlDT739t pBCxHs1DjMUmKRMkwQhpEk8k4VYAkDCACUEn8XfQFTPYm9M9csn8x4abiXUiYHeYPwPX/7b19+e0V ZfwgsP2keNCZUyYdltF2uuGZLKaBrM4T4AGJ35Fzlh0fXXLCUfIghzWeIBF1GRoeMKO8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 13:33:12 +0000 commit a20f0bac271cf4f21fc0d9a24b1736fde36e1e25 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:45:13 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374216.1621197 (Exim 4.92) (envelope-from ) id 1wohvw-0001Uv-IB; Tue, 28 Jul 2026 13:33:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374216.1621197; Tue, 28 Jul 2026 13:33:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohvw-0001Un-F4; Tue, 28 Jul 2026 13:33:24 +0000 Received: by outflank-mailman (input) for mailman id 1374216; Tue, 28 Jul 2026 13:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohvu-0001Uf-Ee for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohvu-00DRKg-2F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohvu-003ckF-1B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=azVIsoWcsjqtHIAk+bh4m5tsjH9pJPkgW3PBqi29+so=; b=rmLSjlYNAQZDH2YqwpuRh8KRF9 nR9mf6AIb23cHM7nS6qoeXsEOk39clnDOQ10EJ1Jdt/cw55Q5G6Pc82CPvFamlN9sO9E2kkBaR0KQ SNq6wgGoYOg96xwDWzNUr2dywCn+XUxdiRHP/Yu8wACbXLNBK6CnJNbSP5EX2kkKtDQw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 13:33:22 +0000 commit c5578563ff81891e82851d76639a2fc210f0f526 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 18 +----------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 5 insertions(+), 20 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 27a799161a..8e282f3caf 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -644,10 +644,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -670,10 +666,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -699,20 +691,12 @@ ret_t do_platform_op( break; case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); - break; + break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2df93b01b4..f6957d63e5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1551,12 +1551,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374217.1621202 (Exim 4.92) (envelope-from ) id 1wohw6-0001YT-Kg; Tue, 28 Jul 2026 13:33:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374217.1621202; Tue, 28 Jul 2026 13:33:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohw6-0001YJ-I6; Tue, 28 Jul 2026 13:33:34 +0000 Received: by outflank-mailman (input) for mailman id 1374217; Tue, 28 Jul 2026 13:33:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohw4-0001YC-IJ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohw4-00DRKk-2d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohw4-003coQ-1b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=fc+quClFpE4kNVQc2yrFxymuvJOb215BmYtCoLK+Kls=; b=K8mWRaLdtPpBUjnlGgDY1T0s1z 0z8o/uUs9XtEfbmPeW2CGKMPOPEfc5kVWNJ35FtTyKHvmVwluChEXoFWMrWp56KoA9bTvQR2oAfvQ r5w3oEIfVbGMnWqnNkT8ybWXGuRMMi38c7YrxOi5bNpCPQ/3rjQgRD/i50VkwxcSiZtI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 13:33:32 +0000 commit 59eefcbff2c75b5b816829793db9263f81b02016 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 4c7551c5d9..88a5b4a974 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8ed7c3dacf..485c324837 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 102880da9e..bafe7834a9 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -237,9 +237,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f6957d63e5..4eecd53f39 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -889,9 +889,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -963,7 +963,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374218.1621206 (Exim 4.92) (envelope-from ) id 1wohwG-0001aR-M6; Tue, 28 Jul 2026 13:33:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374218.1621206; Tue, 28 Jul 2026 13:33:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwG-0001aH-JP; Tue, 28 Jul 2026 13:33:44 +0000 Received: by outflank-mailman (input) for mailman id 1374218; Tue, 28 Jul 2026 13:33:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwE-0001aA-Ls for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohwE-00DRKp-2z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohwE-003cqb-1z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iNQ1drtjN+7Z9KUi5VDI9PIMqpdErTuRpD6TyaONbvw=; b=TQKXeRkFJ0qQwwYVg8rN1y/V7q OgVLw0dzpivlQvGT6537zt4OgHRr5Mipshc1ZNxNeiYI4JvJF7TvwshwlzJfQWdNf6/Z9UALEqT8I 7atYZAop7/AXsErfILFSuaECcYPP7GHqHm27k3VtsjOvtUFs54jnFZeXQo1JPVV5M34k=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 13:33:42 +0000 commit a93453cd07ed555d3159975c3ea506d0ea78014f Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 87484361e8..cb8e7155b4 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 485c324837..8d4e94cc8e 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bafe7834a9..b42996f0c0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -220,11 +219,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 49598bf08a..d1caf13303 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4eecd53f39..a3a916999a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -897,7 +897,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -933,6 +932,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,7 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:33:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:33:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374219.1621209 (Exim 4.92) (envelope-from ) id 1wohwQ-0001cM-NJ; Tue, 28 Jul 2026 13:33:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374219.1621209; Tue, 28 Jul 2026 13:33:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwQ-0001cE-Kj; Tue, 28 Jul 2026 13:33:54 +0000 Received: by outflank-mailman (input) for mailman id 1374219; Tue, 28 Jul 2026 13:33:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwO-0001c4-PV for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohwP-00DRLD-07 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohwO-003csx-2I for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:33:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=wi7AdU5tVIjJrOF6YdtQQsv1c8pA21XQOBnrF+8t2es=; b=ZnXxuTPIWLTnlLLADMHZYoqL2E fJT7ggnrH+JpbzHFj8p6kw64X8LLC8JYXbSgxHMMEewwnZvWZWqzr3pKDLXYJoTqYVKRyCDnCgdIm knM7T7c5AZ7x8WyGtMEusg3o5HRKDhM2kjH3nE+7NqKkY3VaLmsrebjmnukq30Q9alLw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 13:33:52 +0000 commit 7cfc2851173f2987905c2d4ed4df11a7766b1dd1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index 11c1562aa5..ef0d118b6a 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a3a916999a..fd5cbf6d7a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -895,7 +895,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -942,6 +941,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374220.1621213 (Exim 4.92) (envelope-from ) id 1wohwa-0001eK-Od; Tue, 28 Jul 2026 13:34:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374220.1621213; Tue, 28 Jul 2026 13:34:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwa-0001eC-M0; Tue, 28 Jul 2026 13:34:04 +0000 Received: by outflank-mailman (input) for mailman id 1374220; Tue, 28 Jul 2026 13:34:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwY-0001e5-Sh for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohwZ-00DRLV-0R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohwY-003cwc-2f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=kEw2VMEzfqALm9u8jEnbOGRADN5IxeSCk3g1tJOB29U=; b=XV5aNjY7X5A7etYzprKy6VarO1 mKjZnBYsZXQ+Yp6KBGg6LC2TrbCkqoQEb3+jJ13M/zn9N3idss2UGRfr6H2iL+MKPiA+vbP9LFY/3 Ft4LSzwj2+aeuCl95Cc6y1kYa7L0ivE9WkqZniKwpdFodk1cCfhs8eRust4Zj2BKjBlg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 13:34:02 +0000 commit c59fe2017e75a08e575f6d2491301f3616ffb4cc Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 88a5b4a974..428c3a62a2 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8d4e94cc8e..a25436ab37 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b42996f0c0..0a147fdbe1 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -236,11 +235,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index d1caf13303..9a270bfd83 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fd5cbf6d7a..bf6befb880 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -894,13 +894,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -971,16 +976,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1902,7 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374221.1621218 (Exim 4.92) (envelope-from ) id 1wohwj-0001hM-QA; Tue, 28 Jul 2026 13:34:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374221.1621218; Tue, 28 Jul 2026 13:34:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwj-0001hD-NL; Tue, 28 Jul 2026 13:34:13 +0000 Received: by outflank-mailman (input) for mailman id 1374221; Tue, 28 Jul 2026 13:34:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwi-0001h6-Vu for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohwj-00DRLa-0l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohwi-003d11-2y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=pnXqd8SHX5zPMcLzEnmyGgRBQkdUObDu99PjnEZHSxw=; b=NmDssELkJM19f4wGLawAKhk86j OGM77nPiX8+WYHeEaqKSMVH8S/CTSKOK9X5Xs5Bc6kwykGtmOKt0OJX5A1qmDLevtVXwxalPZ0kKK 8GSk5Pst1p/b9Fd9BkgLdWa9o2UFWvWVitUK9wALgT/b53K/s5GJOpfVLevWKt07YGh8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 13:34:12 +0000 commit 1d2ca59da701c00427e492960012e5afe10314e9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 42dc360ad6..385f75898f 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -118,20 +118,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -151,9 +148,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -161,10 +157,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index a25436ab37..4e9d719a74 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 0a147fdbe1..f2ea34d1cf 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -121,8 +121,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -500,16 +498,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 9a270bfd83..4e802da388 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -76,8 +76,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index bf6befb880..8198373969 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -895,9 +898,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -949,6 +949,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1226,12 +1243,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1947,8 +1964,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374222.1621222 (Exim 4.92) (envelope-from ) id 1wohwt-0001lA-St; Tue, 28 Jul 2026 13:34:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374222.1621222; Tue, 28 Jul 2026 13:34:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwt-0001l2-Q7; Tue, 28 Jul 2026 13:34:23 +0000 Received: by outflank-mailman (input) for mailman id 1374222; Tue, 28 Jul 2026 13:34:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohwt-0001kw-30 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohwt-00DRLe-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohwt-003d5V-05 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GDdQ+hTiONGMfHXqyfi+2wanerxFgeADQBpcKgO8MYo=; b=Mfer/iDQI8EvNjHKB5HFSCGicd 4epPLEWEQbmT18exJda5dOSZrjjif8yAw9XOQdsqFibZLJf01/Ldbmqk8Eh29urDaE7VbEctdmeVy IRbTavbC06EejGreXCcopjEI7cSJXVHis1px5xVZ5pHsZygQqpoGADKs6wc9m7QtsU8A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 13:34:23 +0000 commit 8e5a886dee84206d0b69c995a7b2fd818647c7f9 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:24 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 428c3a62a2..4148b60570 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 4e9d719a74..2de09eb342 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index f2ea34d1cf..270e60d97b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -127,7 +127,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -514,11 +513,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 4e802da388..7019a1491c 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -82,7 +82,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 8198373969..2d75b592a4 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -896,10 +897,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -930,6 +927,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1321,21 +1335,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1970,7 +1969,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374223.1621226 (Exim 4.92) (envelope-from ) id 1wohx3-0001o8-U9; Tue, 28 Jul 2026 13:34:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374223.1621226; Tue, 28 Jul 2026 13:34:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohx3-0001o0-RT; Tue, 28 Jul 2026 13:34:33 +0000 Received: by outflank-mailman (input) for mailman id 1374223; Tue, 28 Jul 2026 13:34:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohx3-0001nu-67 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohx3-00DRLi-1P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohx3-003d7a-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hN+sBR1ycW3weGGS92LNzbAKgnGSh9sZ+y3SDXu//7w=; b=NglyLT6q4o2fCtVtvxhxZ6uQOU +pVv1FfQQopRlN1fWPLRgR7bi83edY5rTqJXBZNySX3Bmt60vBfLufn3uQ18qmAUoTTQLcE7WLugb eaEhMKQTlkFI82Yp+AJThnitPJba2hI2nBVRFn5XqpcO/ILo0SqPYiKRZfJedTTcyhjw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 13:34:33 +0000 commit 49f1cd9478fca625fca48951348d1a36e4fa571d Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:31 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index cc7f2bd821..bf1b0d3677 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2755,6 +2755,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->trans_domain != td || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374224.1621230 (Exim 4.92) (envelope-from ) id 1wohxD-0001q0-VZ; Tue, 28 Jul 2026 13:34:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374224.1621230; Tue, 28 Jul 2026 13:34:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxD-0001pt-Sw; Tue, 28 Jul 2026 13:34:43 +0000 Received: by outflank-mailman (input) for mailman id 1374224; Tue, 28 Jul 2026 13:34:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxD-0001pn-8z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohxD-00DRLq-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohxD-003dAo-0i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CpFEp/Z9QH5f1MF5b25OCZa2aP7aWDYCLXwHVecoPcQ=; b=nsbfjAUbtEbkNKPat3ep9VkSEB n/D8OyxDE/TTMClisDXuTKwDYNowPSa9aWEQqUCoznQwJnvXxsQCBdn/IBSxe9v4qK8akW1GDZZFq walTp4rlM8cPgti4cH6Ncxw4pXqFfzHZU0tU/FLFuRSecSQl+pHx/Y4i/OjpdAZkLmQY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 13:34:43 +0000 commit 1cc5e5babc1ab6f454d0a970ab52270c20402dc7 Author: Jan Beulich AuthorDate: Tue Jul 28 12:55:54 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index bf1b0d3677..b65979791c 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -918,6 +922,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1318,6 +1325,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1557,9 +1580,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1575,11 +1597,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2167,14 +2188,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2219,8 +2240,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2245,7 +2269,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool_t okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2385,14 +2409,14 @@ gnttab_transfer( * pagelist. */ spin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2404,7 +2428,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); spin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2424,7 +2448,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2444,6 +2474,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2472,28 +2503,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = act->trans_domain; trans_gref = act->trans_gref; } @@ -2511,6 +2541,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2623,8 +2656,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2638,6 +2673,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2674,6 +2710,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2700,6 +2738,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2754,6 +2794,9 @@ acquire_grant_for_copy( act->trans_domain = td; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->trans_domain != td || @@ -3173,7 +3216,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:34:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:34:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374225.1621234 (Exim 4.92) (envelope-from ) id 1wohxO-0001s2-12; Tue, 28 Jul 2026 13:34:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374225.1621234; Tue, 28 Jul 2026 13:34:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxN-0001rt-UX; Tue, 28 Jul 2026 13:34:53 +0000 Received: by outflank-mailman (input) for mailman id 1374225; Tue, 28 Jul 2026 13:34:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxN-0001rn-CB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohxN-00DRMA-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohxN-003dD9-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:34:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=za6lK1a81bh/gnut1JR3//4SvbvKOBPeBHkh12tLaAs=; b=ovwCPCl3mdwLfvFmpouZ/qVKvZ FMqz1lKCn7eDW8lfQmK+F8WWLpTnlhg+G+XnOsNymdJt5u02atHE9vL8WeUm2sV75Atem2/+I+el6 3QvnF6AV/rRaPB2FzOfj9+VRQ1GqS4RQmZ4eUy0pEZuzzWp5JOVbGISZbZu3kovEC0Q8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 13:34:53 +0000 commit ae5c9e3be96802c20174fbe2a1b30bfaf9189448 Author: Jan Beulich AuthorDate: Mon Jul 20 16:45:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index a6dc665fa6..c0a325c827 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -961,7 +961,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; spin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index ce8f6aae61..8b15b6e172 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -938,12 +951,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index a15e5580f3..d063f649a1 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1759,12 +1759,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 0de9cbc169..ed7401e889 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -146,9 +146,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374226.1621238 (Exim 4.92) (envelope-from ) id 1wohxY-0001uP-3f; Tue, 28 Jul 2026 13:35:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374226.1621238; Tue, 28 Jul 2026 13:35:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxY-0001uH-0w; Tue, 28 Jul 2026 13:35:04 +0000 Received: by outflank-mailman (input) for mailman id 1374226; Tue, 28 Jul 2026 13:35:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxX-0001uB-FQ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohxX-00DRMP-2L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohxX-003dGW-1L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/Id3IVLjVTZQZAwFZa2eiXNQ/bTvvZJ0dTSn/vEpQkE=; b=h7O7MLTI3W2tGH2O8cvRoMp/6x i3n28E2hU7JxtJn1dClHQ54eLT8LTb1/taBHi6cM2p9yHJHTZofo4rSACZOkIEzp7PMyZR7c3MIas yp9Dj5wqExTHr5piQJfTgmDEGXwR6b4fArawJ/gJZ7CwmqVaxVdfds4dtE4wlXya33Xc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 13:35:03 +0000 commit f7152bdbb2149f7bc467cd04d61d28b385f50eec Author: Roger Pau Monne AuthorDate: Wed Jul 15 12:44:37 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index f582280637..8e77cf3915 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -645,16 +645,24 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) +static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + if ( (addr & 1) == 0 ) - return 0xff; + return true; spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -694,7 +702,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -714,11 +724,8 @@ static int cf_check handle_rtc_io( if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) ) return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc, port); + else if ( rtc_ioport_read(vrtc, port, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374227.1621242 (Exim 4.92) (envelope-from ) id 1wohxi-0001wM-5K; Tue, 28 Jul 2026 13:35:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374227.1621242; Tue, 28 Jul 2026 13:35:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxi-0001wC-2N; Tue, 28 Jul 2026 13:35:14 +0000 Received: by outflank-mailman (input) for mailman id 1374227; Tue, 28 Jul 2026 13:35:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxh-0001w6-I7 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohxh-00DROH-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohxh-003dJ6-1e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=YhXv4BaGAbFEBnAc2FqGGhADhjpMSnASHWjMKFhh83k=; b=Tu1SchGZNBWrLe1AQXlyazHHEm lR35BYV/jChuTLSzDkbZylNoGJM+zyS0Vf+Y8cewbLHjk6tmCYikeon/0ed0BFq5QYmKMgIwTxa23 Ljnd0A7qpfyZpezZaOWCTFkkSTkNMgW/21KU1MHUaxjPvyRsf1k71/PctcaAVv4OZsE8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 13:35:13 +0000 commit 3fcf9565ae77d754b7f7656a736faa29cc4a28cf Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 3c94fb0814..0577707d12 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -156,6 +156,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -365,7 +373,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -576,6 +584,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374228.1621245 (Exim 4.92) (envelope-from ) id 1wohxs-0001yU-6N; Tue, 28 Jul 2026 13:35:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374228.1621245; Tue, 28 Jul 2026 13:35:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxs-0001yM-3q; Tue, 28 Jul 2026 13:35:24 +0000 Received: by outflank-mailman (input) for mailman id 1374228; Tue, 28 Jul 2026 13:35:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohxr-0001yG-Kq for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohxr-00DRPy-2t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohxr-003dPE-1u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tCTuxsiz4nmSeo8ATTsdZrwLFVsP4+eh2Pq0XWNGs9I=; b=aT/upPivUGAEDDRoe0m81Bl3DY 5k5Lcc1P53saFccowPfVWzBqW2rPghq2ctWZH/nNYHuwQbpZoljevBDdC5mUpsdB0VdI7GrgCi9f6 2sn47AGiCCThwEPGQjJFDSgFe1pSASPpshIIEUPIYDDlKCcn+M4vBkKD9yKF25pa1oDE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 13:35:23 +0000 commit 7b8ea878a93f0fa86a2e048e11f942aff3b5b0c5 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:45:51 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 6cebc3868a..ea613cfdca 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374229.1621249 (Exim 4.92) (envelope-from ) id 1wohy3-00021U-7p; Tue, 28 Jul 2026 13:35:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374229.1621249; Tue, 28 Jul 2026 13:35:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohy3-00021M-5F; Tue, 28 Jul 2026 13:35:35 +0000 Received: by outflank-mailman (input) for mailman id 1374229; Tue, 28 Jul 2026 13:35:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohy1-00021G-Nw for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohy1-00DRQ2-3C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohy1-003dS7-2C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=09nTHq3vzoUagbPOPjPULe2LLGYL1C5ERSq5XDwMcP0=; b=xSrtRJsvbXKgOmKN3tqxOUoYr7 IMPzRi6GUb9CFRybVBCnjYmXMII+3oKBYuCdaj+q9lcI1ELnxvPlWA2Sj9b92j4V6xy6vp895Qam1 +uiTvLL0Q+oSi1uwDCg4xZKrBsU2sVqQQ+IkBdojt8KrTKUQnRSqd0nVE39KjYwlbFkU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 13:35:33 +0000 commit 4206d3febbde59dc91bb81bc3cac041a0e2d51b0 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index f8e6089870..90d1877197 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -504,6 +504,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -661,6 +667,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374230.1621253 (Exim 4.92) (envelope-from ) id 1wohyD-00023Q-97; Tue, 28 Jul 2026 13:35:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374230.1621253; Tue, 28 Jul 2026 13:35:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohyD-00023I-6W; Tue, 28 Jul 2026 13:35:45 +0000 Received: by outflank-mailman (input) for mailman id 1374230; Tue, 28 Jul 2026 13:35:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohyB-000239-Qo for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohyC-00DRQ9-0F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohyB-003dVR-2U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ckAXCPrkkeDJZ+scSPQZEFOwjdoQobvsrw3NNSresuk=; b=NnycaW+0lU/XcxCR4cPpf8MGkB 6ZH01o2x9FryOGQ+ANqWjLhmT7v1wFnpjEOhTbee9KOpwNFsw3u3Sjog7qXKh93RYGL8Z3k61BohQ tumP7enI9jQLvl0N5AgAHUkIgn3429PgmEo8K/uqdeTVS/CzvXCOkSShkJ1KxNPmwnYg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 13:35:43 +0000 commit f07dd6360bfbc88b5c591c39d6fd5f0e0785b9c6 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index e903db9d93..380b69dba5 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -559,12 +559,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -667,6 +668,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:35:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:35:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374231.1621258 (Exim 4.92) (envelope-from ) id 1wohyN-00025P-BE; Tue, 28 Jul 2026 13:35:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374231.1621258; Tue, 28 Jul 2026 13:35:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohyN-00025E-7z; Tue, 28 Jul 2026 13:35:55 +0000 Received: by outflank-mailman (input) for mailman id 1374231; Tue, 28 Jul 2026 13:35:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wohyL-000257-TQ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wohyM-00DRQW-0W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wohyL-003dXP-2m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:35:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=BUGgbzJI0TOKQ636K4MjO0/FMLQUdHrqwvOhtdfUjT0=; b=nOF53skwhvFDWnRZsi6oG/hUcI LxGQjrtpunazXSJhIg21E6ShNvhSfE1JGlyENFah57yml0J+pbvlkGUoEdI+0mYrUZfdyCQRn0BcV qAyr1qvE1TsHLnkfWAq3ZIFjucvvWp106aiZixnZk0HswUn1lvvLwnJFqFagyyEq3grQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 13:35:53 +0000 commit d0f5c188481653c71c4909e80959d714be2a7f7d Author: Jan Beulich AuthorDate: Mon Jul 20 16:46:06 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:38 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index b040f95242..78ba8d46c5 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -208,6 +208,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374298.1621334 (Exim 4.92) (envelope-from ) id 1woiGs-0002Bd-Kz; Tue, 28 Jul 2026 13:55:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374298.1621334; Tue, 28 Jul 2026 13:55:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiGs-0002BV-IH; Tue, 28 Jul 2026 13:55:02 +0000 Received: by outflank-mailman (input) for mailman id 1374298; Tue, 28 Jul 2026 13:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiGs-0002BP-71 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiGs-00DRqU-1M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiGs-004IIa-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=f1PKvjwXogEmmfgeOk3NwVT+Ded5rLkZ0ft3NE+wFHM=; b=Je1lHGjq2GESQsjkzU5NaJZoIn 81fXCkiP3xA9RPMMtEllQftJPsLTHe6QRRm3TxiNsS/iWoafaY2KlB9KxGCOET9gCJ89RNE174vBK o0w1G5JugTOCII3gt8ekpVxt+fUFxiaTrTfplmoOnQ+n/fDFTajT89eeE1J4ZJQujuOo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 13:55:02 +0000 commit bd630bbdd4ff5586f06caceab8541589d06a1132 Author: Jan Beulich AuthorDate: Mon Jul 20 16:36:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/analyze.yaml | 2 +- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 +++- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index abc7beac5b..f49934f35d 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/analyze.yaml b/automation/gitlab-ci/analyze.yaml index 3f7532ee1d..c650ed61c4 100644 --- a/automation/gitlab-ci/analyze.yaml +++ b/automation/gitlab-ci/analyze.yaml @@ -59,6 +59,7 @@ eclair-x86_64-allcode: CONFIG_PERF_ARRAYS=y CONFIG_PERF_COUNTERS=y CONFIG_PV32=y + CONFIG_SHADOW_PAGING=y CONFIG_UNSUPPORTED=y CONFIG_XEN_GUEST=y CONFIG_XHCI=y @@ -91,7 +92,6 @@ eclair-x86_64-amd: CONFIG_PV=n CONFIG_XEN_IBT=n CONFIG_XEN_SHSTK=n - CONFIG_SHADOW_PAGING=n CONFIG_HVM_FEP=n CONFIG_TBOOT=n CONFIG_HYPFS=n diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index d5929e34ec..27eefec5f9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -296,12 +296,16 @@ debian-13-x86_64-gcc-debug: <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86_64-build-debug <<: *build-test variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 2ce4747f6e..3ce0774b8d 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -145,7 +145,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help Shadow paging is a software alternative to hardware paging support @@ -160,6 +159,9 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. + config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374299.1621337 (Exim 4.92) (envelope-from ) id 1woiH2-0002E6-Nh; Tue, 28 Jul 2026 13:55:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374299.1621337; Tue, 28 Jul 2026 13:55:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiH2-0002Dw-Kw; Tue, 28 Jul 2026 13:55:12 +0000 Received: by outflank-mailman (input) for mailman id 1374299; Tue, 28 Jul 2026 13:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiH2-0002Do-A6 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiH2-00DRrI-1i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiH2-004IrY-0h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=gu59j4FWcksQpFY9DibRVgRaVHSEEQocdDA837ebapU=; b=hde0IUFMEXqbjGRcwdcymGSDgA sOTR9SbcaSmW9v8hZTsn90niXD7UoZdyAh2iUbUIoY5lxvrpHhZ+6GGbSyro3ohI+HhiwzcmocpS4 ZAphJpfzT+mvVB+tEfBSPvcwNTlRNdvLpc1oD9+EtsucY0NK9O/mxNRqtAvDERZ/n4q0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 13:55:12 +0000 commit 2bb6ed064daf7f1e455c44592234e5e875181a57 Author: Grygorii Strashko AuthorDate: Mon Jul 20 16:37:01 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 40c59b6c29b1317707a94194f8121c0d7445b89c) --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index a3d18bc464..a7f9cc5fe0 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374300.1621341 (Exim 4.92) (envelope-from ) id 1woiHC-0002HT-Oo; Tue, 28 Jul 2026 13:55:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374300.1621341; Tue, 28 Jul 2026 13:55:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHC-0002HL-MF; Tue, 28 Jul 2026 13:55:22 +0000 Received: by outflank-mailman (input) for mailman id 1374300; Tue, 28 Jul 2026 13:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHC-0002HF-CX for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiHC-00DRu7-23 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiHC-004JSh-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=tTEv05J6uwb9B7nv8S0Q93YfonVKz08Y+jVObZZOsMw=; b=ya6yH1OjuN8tBZrqeU1fRgiriO bHnWuh+Dos2oKGCxZJO2X1edWK+ey1+P8sI7CAW/fOgMGV7hKRR49Vurx1r4pdSlp02rAGTThhJvK hwTeRA3rpBIAIu8gNtd8fZ5yQo/mkG8OnHsOKhzU2cASWE0V4riUvvsQVS/S/aTqePfw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 13:55:22 +0000 commit 0d731707830ada6b117e1b895ef0336f5c32d3d0 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:37:08 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374301.1621346 (Exim 4.92) (envelope-from ) id 1woiHN-0002JN-QJ; Tue, 28 Jul 2026 13:55:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374301.1621346; Tue, 28 Jul 2026 13:55:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHN-0002JF-Ng; Tue, 28 Jul 2026 13:55:33 +0000 Received: by outflank-mailman (input) for mailman id 1374301; Tue, 28 Jul 2026 13:55:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHM-0002J9-G2 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiHM-00DRuB-2N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiHM-004K4I-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GT9dDQN2BSQvxy39tqMFuqbg40nPi1m5JuYXoY74ts0=; b=uxgVT05XgitB965bb0B6dNGXTR 2t1A3EyUqfkcrkSftSStNofV50ibD3mrWKolnC84y4wGLDX+ORRdm7ymxij+Ceio63zdlNkl4iEnH cjJl06jK7nTJ5iEDVLHyXCYwCGCILFpg/CWKdAbsgukhldzxKJU0BygbUZAC/KU9M0/0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 13:55:32 +0000 commit 7285f1d9408829a352dd50766b7739dadfb5a0e3 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 0431f875af..6dee4922f3 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -735,10 +735,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -761,10 +757,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -789,20 +781,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index cc799273f5..5633c02c4b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1207,6 +1207,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1216,6 +1217,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1536,12 +1538,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374302.1621350 (Exim 4.92) (envelope-from ) id 1woiHX-0002LG-Ru; Tue, 28 Jul 2026 13:55:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374302.1621350; Tue, 28 Jul 2026 13:55:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHX-0002L8-P6; Tue, 28 Jul 2026 13:55:43 +0000 Received: by outflank-mailman (input) for mailman id 1374302; Tue, 28 Jul 2026 13:55:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHW-0002L1-It for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiHW-00DRuI-2h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiHW-004KdR-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zNB7haZQnxv9uZcIj5WO91pVr0Sdnb8xhVEc/BsmZSc=; b=NaPf53VG3o2fr5YC2yNDo9xPb7 xScLsczk+f3TtKcQcamwravN2SYeb9fTBMWytAX2IBNy6FVIEZUiR2SH2+fHByY5QhwpgZC5gVKwe rk5rUunFyJqRosHO/U7oEr1U74d3UMwllcWb1rqL0/zIxLq6CXgubxKo+d5DHyy+b9IM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 13:55:42 +0000 commit d1eec3dc18de5fd7140357b74c64be092a4d185a Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 74b1c0ed39..2d49e99b3c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 89823abbf8..48ca5fd3f5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -251,9 +251,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5633c02c4b..a8b9cf442f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -872,9 +872,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -942,7 +942,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:55:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:55:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374303.1621354 (Exim 4.92) (envelope-from ) id 1woiHh-0002NG-TO; Tue, 28 Jul 2026 13:55:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374303.1621354; Tue, 28 Jul 2026 13:55:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHh-0002N6-QT; Tue, 28 Jul 2026 13:55:53 +0000 Received: by outflank-mailman (input) for mailman id 1374303; Tue, 28 Jul 2026 13:55:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHg-0002Mx-Md for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiHg-00DRuO-33 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiHg-004LB8-22 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:55:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UTd2PGy+Lh4eQnn9O379Cj5d/yjtrgUY0AscaWNNa4E=; b=V7DTZio223ddA4fLojNGExQIY2 iXdQ50tDTbf+lsQ26DykLPAYCC5PofUVkB5iE2o8P70t7dm/6eGMqFLIIwrMXatQCLtpiGSpnxy2u S2/XNRxmCo+NU9ORPKwONsdSwRYWZ1XcoQDhMcTz7+dBjT9U4qEp46Tbp8X9PBrJj+vQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 13:55:52 +0000 commit 0a58e3a70e7dfbe4adf801525d30d77e41bbe0fe Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 3609721426..55b71301cf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2122,10 +2122,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2d49e99b3c..30a6f86e70 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 48ca5fd3f5..4e2cae51f0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -231,13 +228,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 6c17bbff3a..98bf9a73eb 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a8b9cf442f..57b2e1b287 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -606,7 +606,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -880,7 +880,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -916,6 +915,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1895,9 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374304.1621357 (Exim 4.92) (envelope-from ) id 1woiHr-0002Pi-VW; Tue, 28 Jul 2026 13:56:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374304.1621357; Tue, 28 Jul 2026 13:56:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHr-0002Pa-T2; Tue, 28 Jul 2026 13:56:03 +0000 Received: by outflank-mailman (input) for mailman id 1374304; Tue, 28 Jul 2026 13:56:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiHq-0002PS-Po for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiHr-00DRuy-09 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiHq-004Lk2-2M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=0w7nOD6gaPEACRSwnaV5lFxtH/c31aBNG57bANZZ9oo=; b=NG+gziFDi80zRBVMgmd11Y77jO 52KGvKB+4VGrXHufkRMoWrU2+hBTvsIFMSqCUnTX9QFu2/oo21Ff1pEOM9VpisBjm931Ay5c0JmbV cQ4/3YFZSznvVwupmy0BiZ7CnFTropGKhMbn1yfsSszG99QY1gOezkuUfoiq7SWz05co=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 13:56:02 +0000 commit 69a59f4389019edb62e926c928362249e4c54166 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 57b2e1b287..4e5b75dfaf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -878,7 +878,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -925,6 +924,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374305.1621362 (Exim 4.92) (envelope-from ) id 1woiI2-0002Rb-0e; Tue, 28 Jul 2026 13:56:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374305.1621362; Tue, 28 Jul 2026 13:56:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiI1-0002RT-UL; Tue, 28 Jul 2026 13:56:13 +0000 Received: by outflank-mailman (input) for mailman id 1374305; Tue, 28 Jul 2026 13:56:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiI0-0002RN-Te for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiI1-00DRv2-0W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiI0-004MIj-2j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/bSlvyUhcM4fCd1UjrZ5zQpyPHakGOE6QE94zv3z6Vk=; b=JqbsLWBjh6hAeLwDNaRr0iylGX LrbIqjFxA/GfndlimhmihCVW0+ZVV757Hitp/1HWU9NIPRiY21AZej6ylqH+BLUmVyTR8y2e9DhvO 1AoI2sIV29ty1uiSBI6N1c1G+hh9vzlvMDC+TvHD0QX+AEmGUZUNKY6/6oTyvUEnTc7c=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 13:56:12 +0000 commit ac31d94a08fa3768a60b4762381cee136a05f148 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 30a6f86e70..1cc248d710 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 4e2cae51f0..7609c4c5db 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -245,11 +244,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 98bf9a73eb..89d37b6537 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4e5b75dfaf..b37d4bf2a2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -877,13 +877,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -949,16 +954,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1903,7 +1898,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374306.1621366 (Exim 4.92) (envelope-from ) id 1woiIC-0002Tn-28; Tue, 28 Jul 2026 13:56:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374306.1621366; Tue, 28 Jul 2026 13:56:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIB-0002Tf-Vq; Tue, 28 Jul 2026 13:56:23 +0000 Received: by outflank-mailman (input) for mailman id 1374306; Tue, 28 Jul 2026 13:56:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIB-0002TY-1C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIB-00DRvA-0u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIA-004Mrs-38 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KiQDIpXpQ81qZtI5lYxob4Or70Q8t+tsmfXsLJOk07c=; b=rTHg4Drjq+OmivMJQNSem2qUKD CpZUKy8QxoHHEGyJee1ZT1S8hQ6tWTFmhtqgWxDkVts8jDAxyfbwfLO95eJ/B8dsXb6N9IElmW4yS rRTTKAQe2opaXYuudB3KzyUXdVSj3VqmNUxGBjKwQ3J5zCkadRHYqS9GyG/DORMQRt20=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 13:56:22 +0000 commit 525221a02ca4543146b571752049a7c7784b86df Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:30 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 0fbbdd8b28..6bd4e191a7 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1cc248d710..1fd66ee947 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -390,18 +390,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 7609c4c5db..397d578c8b 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -512,16 +510,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 89d37b6537..a6157a3cf8 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b37d4bf2a2..d495446ec0 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -55,6 +55,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -878,9 +883,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -932,6 +934,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1207,12 +1226,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1948,8 +1967,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374307.1621369 (Exim 4.92) (envelope-from ) id 1woiIM-0002Vi-3Q; Tue, 28 Jul 2026 13:56:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374307.1621369; Tue, 28 Jul 2026 13:56:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIM-0002Va-0r; Tue, 28 Jul 2026 13:56:34 +0000 Received: by outflank-mailman (input) for mailman id 1374307; Tue, 28 Jul 2026 13:56:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIL-0002VU-4T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIL-00DRvE-1F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIL-004NRk-0E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=a8YvJkH+th2CgOGNbGvW150kSHdFjY/CppA38Yz9aRk=; b=wu2kYO/WivZqrG+ha6ZXJPHJUg 3FeH5wjAGnzGF2LJsyCSV0X0B5iu6/0jOZjdx1BQpTEqUqXrHoUQ9CqzqUgcz7eu68THc25L/B/Oi lHd+bJWqrjPxkoYLLiLc1e/db8vXC+yjoJDaXs2fijAmRHCwYQuJBjJJ6qThQO6rN8dI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 13:56:33 +0000 commit f06a68009c0689dfb8d1072a3457439f1a1e667c Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:31 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1fd66ee947..50ef246467 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -423,12 +423,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 397d578c8b..852eac7d20 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,9 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -526,13 +523,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index a6157a3cf8..2d02655703 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,9 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d495446ec0..a6cef9d2a5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -60,6 +60,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -881,10 +885,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -915,6 +915,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1307,23 +1324,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1973,9 +1973,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374308.1621375 (Exim 4.92) (envelope-from ) id 1woiIW-0002Xc-69; Tue, 28 Jul 2026 13:56:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374308.1621375; Tue, 28 Jul 2026 13:56:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIW-0002XT-2D; Tue, 28 Jul 2026 13:56:44 +0000 Received: by outflank-mailman (input) for mailman id 1374308; Tue, 28 Jul 2026 13:56:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIV-0002XM-86 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIV-00DRvI-1c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIV-004O1m-0c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=LMnVYiXzBgMLbp66iowJh3WyKUtnM0jqV/EC5cmY8qU=; b=xsOcKSaiD0fKa+AzS4IGj0zyBF rzDtOlCKamtCDFtC54j2r8rIFGn3NQ5ouHkwMT3wbViPzbhf9Xa86/7HRzj7qU8V40gK5wKWchrp/ bywpg4cvJIAfdXqXxfavj5y1nIZAIotBx0QiJeW4wiQ4HGBgul6pkZD0XYSGgBOezKCQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 13:56:43 +0000 commit 52239dd76f77b93a77602b7363644a5eb8edd028 Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:36 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:53 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 17e1af9fcf..b83dd7bc2a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2804,6 +2804,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:56:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:56:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374309.1621378 (Exim 4.92) (envelope-from ) id 1woiIg-0002a0-7N; Tue, 28 Jul 2026 13:56:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374309.1621378; Tue, 28 Jul 2026 13:56:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIg-0002Zs-4p; Tue, 28 Jul 2026 13:56:54 +0000 Received: by outflank-mailman (input) for mailman id 1374309; Tue, 28 Jul 2026 13:56:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIf-0002Zm-BY for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIf-00DRvc-1x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIf-004OcQ-0y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:56:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=liquqcuajwUXmt6uLMcNGLybIBiX/XW50wckFW8oIVo=; b=UUP5OkbmB2LhrhiE5kA0bj6OB6 beJlbyL5QMI/5TPA9zYPQDNkfxWnjo4h4JN4Y19DF21we2b+MXkdzjlut6zaSk9z3FJ4XBmT2V2Ek iIvbQN7gmk/zCJ1wNMh6w8n4enonJA8pqV0ix9PUnCjKzHIdKvnDPtznnV5qSKa69YTs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 13:56:53 +0000 commit f8fa2b21f84cb9caa894d5e1f29cc20794ef96af Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index b83dd7bc2a..33ef5f651b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2196,14 +2217,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2248,8 +2269,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2274,7 +2298,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2414,14 +2438,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2433,7 +2457,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2453,7 +2477,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2473,6 +2503,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2501,28 +2532,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2541,6 +2571,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2672,8 +2705,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2687,6 +2722,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2723,6 +2759,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2749,6 +2787,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2803,6 +2843,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3232,7 +3275,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374310.1621381 (Exim 4.92) (envelope-from ) id 1woiIq-0002bu-8i; Tue, 28 Jul 2026 13:57:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374310.1621381; Tue, 28 Jul 2026 13:57:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIq-0002bm-6A; Tue, 28 Jul 2026 13:57:04 +0000 Received: by outflank-mailman (input) for mailman id 1374310; Tue, 28 Jul 2026 13:57:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIp-0002bf-FA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIp-00DRvr-2J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIp-004PBj-1K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Sbomfqx4KrEDAcwZB2bLUlW6MSKeveoQn3So1i1oSWg=; b=AYkWWQgbB6PBfZYSswaaVsg0T/ Q/bmm9UmG2dTfGqHlpXWcNN9PpszKOREyWLS88hU7bc5CtJ9xDXlws2FOcl/1xzvn0Nr5RxHW5x16 jFyc+j5YjsMnZ1YoyumR99opmz3LoxL5wP9jftgIrxIisZ6UYo/fzXzsBL2d7E3ty1p8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 13:57:03 +0000 commit 14a99bce7464990e09ed38c2bfa5806eff3b7bed Author: Jan Beulich AuthorDate: Mon Jul 20 16:37:45 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 8f2bfcae28..9289f78bd1 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1320,7 +1320,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index e30b38a337..227313e62b 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -140,7 +140,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -152,6 +152,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -895,12 +908,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 2ca7723e50..e245b160d4 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1922,12 +1922,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index a095190fc7..aeb8b36ad1 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -193,9 +193,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif #ifdef CONFIG_VMTRACE -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374311.1621386 (Exim 4.92) (envelope-from ) id 1woiJ0-0002ez-AP; Tue, 28 Jul 2026 13:57:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374311.1621386; Tue, 28 Jul 2026 13:57:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJ0-0002er-7Z; Tue, 28 Jul 2026 13:57:14 +0000 Received: by outflank-mailman (input) for mailman id 1374311; Tue, 28 Jul 2026 13:57:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiIz-0002el-IA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiIz-00DRvv-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiIz-004PjF-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=MNcJUb8ACuII+7B/yrS8A8aQUMNcqyUqgnzmIrNM+RM=; b=t5RMnMeNi3epaLDMRrGF0tRfiN VPIt/35ByB3uFmHyXJxKKsLEI1ZvL5i8YZzlExcLFXkNjbD4o4ZPzf0HNnOLb2q+L9ChdsqpKVU00 Iw6g5LfOl+o7dz02XJ9cFzTefC/LIoum6hpTih5EyRo/T4RYgDSPOSeQweaIpZPol+AA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 13:57:13 +0000 commit f755242d6083a428263aad77e8872c58597bd47a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374312.1621389 (Exim 4.92) (envelope-from ) id 1woiJA-0002h9-BN; Tue, 28 Jul 2026 13:57:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374312.1621389; Tue, 28 Jul 2026 13:57:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJA-0002h1-8x; Tue, 28 Jul 2026 13:57:24 +0000 Received: by outflank-mailman (input) for mailman id 1374312; Tue, 28 Jul 2026 13:57:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJ9-0002gv-Kz for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiJ9-00DRw0-2t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiJ9-004QJR-1v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=w0YTIJxBT4F5jnAKhn3I8ertbgVkSB/Ou+Wwwcl9r88=; b=ktWmIfw6H6NUgrs/V86H9MhIe8 bUg5W1/BnqJqQfc3mosvlU2GT0xvHaZIu7Fk2yoSYyt3ChjnnNyJnZDeJWXvgKX14I5Xywt3KuOpu Ur7FwlI8AjeHGDlWkxvgolrnXaXv+drX0wBlyQDvhCficAgFii/IsZg5iikDc1iyids4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 13:57:23 +0000 commit 8e54ad2c8cd2740d1567a30b90ddb946afa88f60 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374313.1621394 (Exim 4.92) (envelope-from ) id 1woiJL-0002lb-DX; Tue, 28 Jul 2026 13:57:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374313.1621394; Tue, 28 Jul 2026 13:57:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJL-0002lT-AV; Tue, 28 Jul 2026 13:57:35 +0000 Received: by outflank-mailman (input) for mailman id 1374313; Tue, 28 Jul 2026 13:57:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJJ-0002lN-Nu for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiJJ-00DRw7-3B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiJJ-004QqY-2C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=0kHQqIHHoS2GXwAQ9vXFFx4HiPURvL5F3lxgTH/bgqc=; b=F7NLB+mvL2VUu1samtZIcfajGx N/Cr1LjnP3CytuE8m7myW4jLoUB7Q594LicG9CfjiJ/MXlasojYyP2pAk0OTAL0PKKYRd9J3ZWchw cuJXgu2eRy6qE2MMftlYfZnPkFNOyst8avtYObdZWxH4s3FGQBDKXljYfZQenf1NkRyo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 13:57:33 +0000 commit ca00e870e35734e9011825f0d9a191ef711af51a Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:38:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:48 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:48 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374314.1621398 (Exim 4.92) (envelope-from ) id 1woiJV-0002pf-Fz; Tue, 28 Jul 2026 13:57:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374314.1621398; Tue, 28 Jul 2026 13:57:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJV-0002pX-DA; Tue, 28 Jul 2026 13:57:45 +0000 Received: by outflank-mailman (input) for mailman id 1374314; Tue, 28 Jul 2026 13:57:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJT-0002pQ-Qv for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiJU-00DRwB-0H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiJT-004RQq-2U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=t8KwYu9qNDd+usO5RTNaYxGUkqqBAwJHQ4ps26lTwE8=; b=vZHHAEFnloGnceJy8B5m0otk1B by7a9VMX28fV1ab4gfiSPy0NympMJiF7U1/aWiL0clBVnuG5UL4PPnCT3SaGDl1Tp4cEVuEfxzcRK wRPQ+csf1UJlOFH0eqFixUfj7AcmIO+GpTUdKZJJ2KT3MJyzRmfvsdbznao9RLaJg7v4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 13:57:43 +0000 commit 0bb5c62e39dc4fafcbbcb90ade07afafc845a674 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:57:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:57:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374315.1621402 (Exim 4.92) (envelope-from ) id 1woiJf-0002rb-HA; Tue, 28 Jul 2026 13:57:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374315.1621402; Tue, 28 Jul 2026 13:57:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJf-0002rR-EV; Tue, 28 Jul 2026 13:57:55 +0000 Received: by outflank-mailman (input) for mailman id 1374315; Tue, 28 Jul 2026 13:57:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJd-0002rK-U1 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiJe-00DRwa-0a for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiJd-004RzP-2n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:57:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=leB7r0PYbMjp8Djqkr+4Tr5NhMMKprB1UZ3BdJfngG0=; b=YlSRjT72VeHLjd7b0SzXtiMP7n AP+rL4G4BXnDN4izQD2y1CWUVR9l1GTEpLYvfFDsONXGrZq0d/8F5AoxR/ETI70F0+P7N8fHMSZuO o57E9cLjiFWB93tQwsFZDMLQdNPZIcw0oHFpuIXoX46BGrd2M3QwegUabjwXHWZR6eV4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 13:57:53 +0000 commit 195a09c97140cb8179f0aea6128f0d107e0fd335 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 7a0bebd2d3..4602c32cff 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 13:58:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 13:58:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374316.1621406 (Exim 4.92) (envelope-from ) id 1woiJp-0002tT-IW; Tue, 28 Jul 2026 13:58:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374316.1621406; Tue, 28 Jul 2026 13:58:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJp-0002tL-Fn; Tue, 28 Jul 2026 13:58:05 +0000 Received: by outflank-mailman (input) for mailman id 1374316; Tue, 28 Jul 2026 13:58:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiJo-0002tE-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:58:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiJo-00DRwy-0u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:58:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiJn-004SYz-38 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 13:58:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/WZv/c6GjW0sipIPSRlYo6CGue8NLJgfxoTCMCYpiXY=; b=xkjnVjebN0FiWUVXWSiH38vzHj zuolwyCynsPPKU48x7OENeau8kwkHXBSIp7mTXxVHMIYFRlXjE/cGDrcMDRXnPyZz/6z23mnsp5kK ekHQpKb61sJ70XtfN6MFCWDgrk4B3HZoyk2PS/4TozEVJ9NvkdqRQaPmT3BCAwXBjSaM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 13:58:03 +0000 commit eb4905ec4e75e8a1c6a2d2da49e46c730272f7ec Author: Jan Beulich AuthorDate: Mon Jul 20 16:38:09 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:06:54 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index f49934f35d..7c42de4c16 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374324.1621419 (Exim 4.92) (envelope-from ) id 1woiWN-0006Ao-Lc; Tue, 28 Jul 2026 14:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374324.1621419; Tue, 28 Jul 2026 14:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWN-0006Ag-Il; Tue, 28 Jul 2026 14:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1374324; Tue, 28 Jul 2026 14:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWM-0006Aa-Br for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiWM-00DSLC-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiWM-005A3T-0g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=33bhUEYRJ1sjsUGnVpcBVMdoXohK308owdQXG0Mv1O0=; b=YTgWNbAFCV2RGsZ6SOsEzcya+B qE0wYjFB40HMRZjIcHHWrGxFp4AZZxumW9EJyt2PGIsoh+dEpQwpmCOu6A02ASO5RkaRJRjeIlr04 MsCBBHB/FuSqpgHqOhVXI0oQX5Z95QXbzk+TfwBH11SBznn85YiqbFu+jBj1BfGJTAFk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 14:11:02 +0000 commit 49af80b3e025b6f95cc2e8f9c25f5fa4dce38aff Author: Jan Beulich AuthorDate: Mon Jul 20 16:38:45 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 4ba562eaf0..fa20ad629c 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -498,7 +508,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 4cb52fe597..51105ebbe9 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -313,11 +313,15 @@ debian-13-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:13-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-13-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 3f0f3a0f3a..06bf926976 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -144,7 +144,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -160,7 +159,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config PAGING def_bool HVM || SHADOW_PAGING -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374325.1621422 (Exim 4.92) (envelope-from ) id 1woiWX-0006Dh-MW; Tue, 28 Jul 2026 14:11:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374325.1621422; Tue, 28 Jul 2026 14:11:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWX-0006DZ-K1; Tue, 28 Jul 2026 14:11:13 +0000 Received: by outflank-mailman (input) for mailman id 1374325; Tue, 28 Jul 2026 14:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWW-0006DR-Dq for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiWW-00DSLG-28 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiWW-005Ag2-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OpbbSwodtvZmc1bquQdMjtqc7avBkNfJskFEh40fxIk=; b=pxTBttUJYv9V2x6rSE33OoyIIY /83lRDdZTgIs65BTMi989NG14Y+SQZ4Qg/vnNrzqv+NvaDsBVsJZJVlxJT4m2K4bdLCSz5kQWknEY c6w+uK+0SMGXFtA+XnHgVe7COFfMXAZNCUQb54dn13w5E8Ib3LFGifVrtwujJ0qoLyr0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() Message-Id: Date: Tue, 28 Jul 2026 14:11:12 +0000 commit d836145598f0ab01e33e7718d6b6ac9a768ab9d4 Author: Grygorii Strashko AuthorDate: Mon Jul 20 16:38:49 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states() There is a corner case in the error path of evtchn_bind_virq() (handling EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to interfere with privileged ones: If an unprivileged domain allocates all available ports to reach "no more ports available" and then issues an EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG), domain_deinit_states() will be called despite not having called domain_init_states(). To fix the issue move domain_deinit_states(d) under the same condition as used for the domain_init_states() call. This is CVE-2026-42492 / XSA-496. Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes") Signed-off-by: Grygorii Strashko Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 40c59b6c29b1317707a94194f8121c0d7445b89c) --- xen/common/event_channel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index 67700b050a..4ae7308699 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, evtchn_port_t port) if ( rc < 0 ) { gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc); - domain_deinit_states(d); + if ( virq == VIRQ_DOM_EXC ) + domain_deinit_states(d); goto out; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374326.1621427 (Exim 4.92) (envelope-from ) id 1woiWh-0006Fu-OP; Tue, 28 Jul 2026 14:11:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374326.1621427; Tue, 28 Jul 2026 14:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWh-0006Fm-LI; Tue, 28 Jul 2026 14:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1374326; Tue, 28 Jul 2026 14:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWg-0006Ff-GN for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiWg-00DSLR-2R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiWg-005BIM-1R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=099TZJZlWyl4qSBX2BtAk2BfXl4vzi1aoVfVs1P5qgE=; b=SZc3DFUnmoDKTSQtKep4m3/C6S yXUaH15Yg+GKe4+CW18o3OhimyBHb+uRMjcho9Y2rqK5Fd96E4y7GPMnrISEJRvBfk26l+nUGa3lM bd9SnPpk7xQhyBdkwujJs/bPh2kKwzsb8TIkFgXIImSsSNOXhqay+vQSfvSqiagrWlS8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 14:11:22 +0000 commit 4b52dc2021690a64fd7408cd7f0bdf3e1285e571 Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:38:55 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374327.1621431 (Exim 4.92) (envelope-from ) id 1woiWr-0006IL-R4; Tue, 28 Jul 2026 14:11:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374327.1621431; Tue, 28 Jul 2026 14:11:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWr-0006ID-OS; Tue, 28 Jul 2026 14:11:33 +0000 Received: by outflank-mailman (input) for mailman id 1374327; Tue, 28 Jul 2026 14:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiWq-0006I6-K5 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiWq-00DSLV-2o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiWq-005Bdy-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=zdUVqasJ9EgNN4r8sO3soC7m1xPTS/40mwgh11iDbtM=; b=6kIIqPrSuS1Xs9sdWZcF+YLQFX 6Lv+UqfwhGs9q0nwEQYKHfGzmO0HXB8Fzyie6ioPCVIIcIafUwhBrzZKsiV7AiSXqd3SbaLzODqbg teN68mWoMeoSSPmWC1uIUnuj1rH3sFdI5eqvuF+K+uObo4SZPB8Ps3/Jrzny9ks3bYyQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 14:11:32 +0000 commit 42d062839d10992b303521ba14a0a8d038ab9e43 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 9 ++++++--- 2 files changed, 6 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 79bb99e0b6..40783a8d53 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -706,10 +706,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -732,10 +728,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -760,20 +752,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index ae33e324bd..953297c959 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1244,6 +1244,7 @@ static int cf_check flask_pci_config_permission( } +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); @@ -1253,6 +1254,7 @@ static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } +#endif /* CONFIG_SYSCTL || CONFIG_X86 */ #ifdef CONFIG_SYSCTL static int flask_resource_use_core(void) @@ -1573,12 +1575,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374328.1621436 (Exim 4.92) (envelope-from ) id 1woiX2-0006KJ-Sd; Tue, 28 Jul 2026 14:11:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374328.1621436; Tue, 28 Jul 2026 14:11:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiX2-0006K7-Pp; Tue, 28 Jul 2026 14:11:44 +0000 Received: by outflank-mailman (input) for mailman id 1374328; Tue, 28 Jul 2026 14:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiX0-0006K0-NT for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiX0-00DSLZ-38 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiX0-005CKB-27 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1zU+x+ky7jbzWKs5lU2UkMM63ue8GqWNoiWunimTKyM=; b=I/p9fNJ7d+8O11PwS3b7mIExKV Hlxm0FhXS8eJx8dl4UpRY8s8ADIYZZdQFW+lOon2iZfQnmbDy8ETMPZpovAx3mTJDmBZMRFafqjS6 KXd8fpkDYiBJUxaXJUwifY1zc2sX3PZhsjMlycmxwopO0GwvS0kVnLJYtnESKsnKYj0Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 14:11:42 +0000 commit 36a22b6145d1fcf6667f7a04099b521c2bf843a1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index d45d8b64fc..c00453be56 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5325e912e..555e68bd55 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -253,9 +253,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 953297c959..9014c1e82e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -905,9 +905,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -979,7 +979,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:11:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:11:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374330.1621439 (Exim 4.92) (envelope-from ) id 1woiXC-0006MD-Tl; Tue, 28 Jul 2026 14:11:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374330.1621439; Tue, 28 Jul 2026 14:11:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXC-0006M5-R9; Tue, 28 Jul 2026 14:11:54 +0000 Received: by outflank-mailman (input) for mailman id 1374330; Tue, 28 Jul 2026 14:11:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXA-0006Ly-SA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXB-00DSLd-0J for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXA-005Cvp-2V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:11:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7n6kud74N3y3UrMpx6ZvPCXWhf++0rB9/7SHOyil200=; b=dGeXr6Jzug6TeMV05zauTbtOc6 U6GWPIXsb9asbxYkuBSbiIBI7zMd2PBI3ir9rx2P/TaEgLZyPaTtq0ORcyjj0/tt1oeU8iaNBQI/6 c9+ppn6zJ92IFTY5Cb41kFbTozhNzSJnP2AoLS/jpkoIOqes7Psq5swg2258tAcj8M6Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 14:11:52 +0000 commit 2881e008a7abea91b064a319f2b3e95b8e012a13 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 9 ++++----- 5 files changed, 4 insertions(+), 28 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 4a4c36c291..2488243c74 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2104,10 +2104,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index c00453be56..dc6f0c7ee3 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 555e68bd55..ff4cb8065c 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,9 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); -#ifdef CONFIG_SYSCTL - int (*sysctl_scheduler_op)(int op); -#endif int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL @@ -233,13 +230,6 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.get_domain_state, d); } -#ifdef CONFIG_SYSCTL -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} -#endif - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 860233e4be..fa7c406553 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,9 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, -#endif .set_target = xsm_set_target, .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 9014c1e82e..de214f948b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -639,7 +639,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -913,7 +913,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -949,6 +948,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1932,9 +1934,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, -#ifdef CONFIG_SYSCTL - .sysctl_scheduler_op = flask_sysctl_scheduler_op, -#endif .set_target = flask_set_target, .domctl = flask_domctl, #ifdef CONFIG_SYSCTL -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374331.1621443 (Exim 4.92) (envelope-from ) id 1woiXM-0006OD-VF; Tue, 28 Jul 2026 14:12:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374331.1621443; Tue, 28 Jul 2026 14:12:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXM-0006O5-SU; Tue, 28 Jul 2026 14:12:04 +0000 Received: by outflank-mailman (input) for mailman id 1374331; Tue, 28 Jul 2026 14:12:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXL-0006Ns-0A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXL-00DSMB-0o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXK-005DYb-2q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=MkT70IXxJhOPD7IY+SKFlTHk0L//Y5B6R/yMvvOY7UQ=; b=hhq9H5ZH0u6uQbHGJTe3TTI2Dd yKS3T4GpBctntRez5cTX/v3W1ujtQmruU9D13+93UAY3xdibYYRUv5y2GZnWkOS1z/JE8YWs1ic9i HJ0vbJmq5qg/EOJGoERZwoy0PDsS+1FRUa6s+02r+YfovkChxZpmTwJEH3bEi/ZmG9zI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 14:12:02 +0000 commit 1ef3886a184ac8bbea55658326ecbf4c19bfd547 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c..5e366986e2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -150,6 +150,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index de214f948b..e7fb1b417f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -911,7 +911,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -958,6 +957,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374333.1621448 (Exim 4.92) (envelope-from ) id 1woiXX-0006QV-0V; Tue, 28 Jul 2026 14:12:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374333.1621448; Tue, 28 Jul 2026 14:12:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXW-0006QN-Tn; Tue, 28 Jul 2026 14:12:14 +0000 Received: by outflank-mailman (input) for mailman id 1374333; Tue, 28 Jul 2026 14:12:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXV-0006Px-3g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXV-00DSMF-1B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXV-005EA8-0B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rrczzqxUBxsqvNdJl3yCgNfUq8xckFCA1ycvx3AdprA=; b=KoAmJxp/jQ1C3F2Lbud0ultD00 ScZPLNHJLByAy9uxC16r8J74bp+Lj2sILaJ/LDu6pGwzhMzBv/8pezi3LAcDU+uiLXUCAxkF+4kgP 1Q+5Ul1nmfNkuwbP0J1mtTJ8jX1qqjlTbtedS1Om5H+4OUWhAIa/K2CAY4JeLFj4NmjY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 14:12:13 +0000 commit 53d73787d84f864c63b6d8fd8d92522ef50cd903 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2df2426762..ea5ad0efa9 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index dc6f0c7ee3..7bf1f85a87 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -181,12 +181,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index ff4cb8065c..f175acfb38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); #endif int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -247,11 +246,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { return alternative_call(xsm_ops.sysctl, op); } - -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} #endif static inline int xsm_evtchn_unbound( diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index fa7c406553..bade92f43b 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -22,7 +22,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .domctl = xsm_domctl, #ifdef CONFIG_SYSCTL .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, #endif .evtchn_unbound = xsm_evtchn_unbound, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e7fb1b417f..6e8ded5e41 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -910,13 +910,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -986,16 +991,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) return avc_unknown_permission("sysctl", op->cmd); } } - -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} #endif /* CONFIG_SYSCTL */ static inline uint32_t resource_to_perm(uint8_t access) @@ -1940,7 +1935,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .domctl = flask_domctl, #ifdef CONFIG_SYSCTL .sysctl = flask_sysctl, - .readconsole = flask_readconsole, #endif .evtchn_unbound = flask_evtchn_unbound, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374334.1621452 (Exim 4.92) (envelope-from ) id 1woiXh-0006SO-2D; Tue, 28 Jul 2026 14:12:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374334.1621452; Tue, 28 Jul 2026 14:12:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXg-0006SG-VD; Tue, 28 Jul 2026 14:12:24 +0000 Received: by outflank-mailman (input) for mailman id 1374334; Tue, 28 Jul 2026 14:12:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXf-0006S9-7B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXf-00DSMJ-1W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXf-005Ehs-0W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6fcoGyx/BuO+a1zcA1aIkbA2cB5lspRHuPTe0M4hL9s=; b=ZUYqpKHh+9wQESyoPNT4M8ApuS 1v37v2UjtmNtCreZJBahO1DWBcjMyB3APue/I7cYtBFz64mNAdyOBCQV7BlqdGk/JFcKdYjHYbxET /5525rRaMm6GQDsCq2oewncQQmZT5+dgfH5GlqgruATkRQxOStQY87l5IPiGyuc3eARA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 14:12:23 +0000 commit c957b9a21b8e11526ca97c7b6fd719c10d04dba7 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 31 ++++++++++++++++++++++++------- 5 files changed, 25 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1b04947516..43e00e78cc 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 7bf1f85a87..005e50ae3a 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -397,18 +397,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index f175acfb38..80f6a91771 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -124,8 +124,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -519,16 +517,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bade92f43b..c8faf6da50 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -79,8 +79,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6e8ded5e41..7ada71143f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,11 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -911,9 +916,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -965,6 +967,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1244,12 +1263,12 @@ static int cf_check flask_pci_config_permission( } #if defined(CONFIG_SYSCTL) || defined(CONFIG_X86) -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1987,8 +2006,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374335.1621455 (Exim 4.92) (envelope-from ) id 1woiXq-0006WM-57; Tue, 28 Jul 2026 14:12:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374335.1621455; Tue, 28 Jul 2026 14:12:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXq-0006WE-2T; Tue, 28 Jul 2026 14:12:34 +0000 Received: by outflank-mailman (input) for mailman id 1374335; Tue, 28 Jul 2026 14:12:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXp-0006W8-Ae for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXp-00DSMQ-1r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXp-005FDK-0r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=4LRmG/gSWKAwUhPLlS50xUom+BpMQuOZl0seuO3yGI0=; b=cZ0SR9TKoUp9sRI+1gqF/BRWgK Z/HOYDYAscfuqNSeiC7Aq47Xryz9b4jmDGwZfeSYyRPJwlYKhP+zAZhuD5/64QorzJ5zJzz/b6glT rnOo8jVfU0B2G+6YBSt2lsDZk7DnZqbsWkgRm7eWyjGet0Bp/SxmDJGDrLRdKtWYk7MQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 14:12:33 +0000 commit 853343502a51c761e77fe2030f9fda54cc732ba5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:05 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 10 ---------- xen/xsm/dummy.c | 3 --- xen/xsm/flask/hooks.c | 45 +++++++++++++++++++++------------------------ 5 files changed, 21 insertions(+), 47 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index ea5ad0efa9..8fb5ff0af3 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -189,10 +189,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 005e50ae3a..084b5d7769 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -430,12 +430,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 80f6a91771..b918c435fc 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -130,9 +130,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); -#ifdef CONFIG_SYSCTL - int (*page_offline)(uint32_t cmd); -#endif int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -533,13 +530,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -#ifdef CONFIG_SYSCTL -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} -#endif - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index c8faf6da50..360b362be6 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -85,9 +85,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = xsm_page_offline, -#endif .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 7ada71143f..fc211028c5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -61,6 +61,10 @@ static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); #endif +#ifdef CONFIG_SYSCTL +static int flask_resource_use_core(void); +#endif + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -914,10 +918,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -948,6 +948,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1344,23 +1361,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -#ifdef CONFIG_SYSCTL -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} -#endif /* CONFIG_SYSCTL */ - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -2012,9 +2012,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, -#ifdef CONFIG_SYSCTL - .page_offline = flask_page_offline, -#endif .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374336.1621460 (Exim 4.92) (envelope-from ) id 1woiY0-0006cA-6Y; Tue, 28 Jul 2026 14:12:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374336.1621460; Tue, 28 Jul 2026 14:12:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiY0-0006c2-3o; Tue, 28 Jul 2026 14:12:44 +0000 Received: by outflank-mailman (input) for mailman id 1374336; Tue, 28 Jul 2026 14:12:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiXz-0006bw-DP for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiXz-00DSMW-29 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiXz-005Fpe-1A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=m7TvghYDOFWsAeM9DXnYeIdouQbJuvWFENCcFpNNly4=; b=kAquxJSDl/adIYKcT/dVeMDWgZ /1kPhIKtPl0Q6G5N6kv0YQx/XVpA8/M/A24Ed3ohl6zgVlzJHOgyU4aBYP1+r40yvnWcgThXlGQjc Qo0TtVo2s0LkgVQCJGYJV7jewdZJFCZeXtcoTr36J79xK2MyrB5WlYtrRdr/4UrzFp58=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 14:12:43 +0000 commit 14558d435ff90c71027fb7f9dcef2be159e93b21 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 5e09027821..5577b321d2 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2805,6 +2805,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:12:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:12:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374337.1621463 (Exim 4.92) (envelope-from ) id 1woiYA-0006fp-81; Tue, 28 Jul 2026 14:12:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374337.1621463; Tue, 28 Jul 2026 14:12:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYA-0006fh-5H; Tue, 28 Jul 2026 14:12:54 +0000 Received: by outflank-mailman (input) for mailman id 1374337; Tue, 28 Jul 2026 14:12:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiY9-0006fb-GY for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiY9-00DSMu-2S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiY9-005GQk-1S for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:12:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RDThAVPBAR2ZpfTYVpKFEc/paEi+E5OaOCzcARjQj7o=; b=E6nSpkbiPeZhXx/8Vz3AzhJ0ob HKHXAOeeNXzGpuidIB/dY6SPTSU6q4fU+ITRFV3fAPITh/69zOpWp4/EEyMwIl8vhy9ZKCtuoqt+f /au9WhA1aM3kpPHrJj6U7VIVklfayYX9pir4nHW5AI827JMV+Y4y0eu4GDyqaIDAU/9A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 14:12:53 +0000 commit 060c68ab1df49c3a12eaa313002bd8f66f6c9459 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 5577b321d2..75433f260e 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1343,6 +1350,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1586,9 +1609,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1604,11 +1626,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2197,14 +2218,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2249,8 +2270,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2275,7 +2299,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2415,14 +2439,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2434,7 +2458,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2454,7 +2478,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2474,6 +2504,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2502,28 +2533,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2542,6 +2572,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2673,8 +2706,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2688,6 +2723,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2724,6 +2760,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2750,6 +2788,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2804,6 +2844,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3233,7 +3276,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374338.1621467 (Exim 4.92) (envelope-from ) id 1woiYK-0006hj-9u; Tue, 28 Jul 2026 14:13:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374338.1621467; Tue, 28 Jul 2026 14:13:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYK-0006hb-6v; Tue, 28 Jul 2026 14:13:04 +0000 Received: by outflank-mailman (input) for mailman id 1374338; Tue, 28 Jul 2026 14:13:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYJ-0006hU-Jd for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiYJ-00DSNK-2m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiYJ-005GzG-1m for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bm0v6YTQiydaU2R+l9pHNi4SZ9LA5f3/C1wvclsbbrc=; b=bALvH85Coqfdylwskm8ubg6g4o 3eLC4zyKQxkKtdYfkxZIOetnvd06G4I9aSCraAuUkKo6c6eC5Si2bLmHcMZqJNP6PB3/tOCcrWUof 4Hyx579JSGYEjnFDOz6e2E9IHll3dpHuwPzsA3n0HnUg+ceVIjDsNxUIDoY9tjVFN0lY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 14:13:03 +0000 commit bed5d12bd4f84bea9941eed5fec17685b7d2f5e5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:20 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 69fe1debcc..2a22cf5769 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1255,7 +1255,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 36ef760c2c..811e68b005 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -142,7 +142,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -154,6 +154,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -907,12 +920,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 3412c7fb4a..76a1bf1b11 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1804,12 +1804,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 613b5762b5..90a1777ff0 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -188,9 +188,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374339.1621471 (Exim 4.92) (envelope-from ) id 1woiYU-0006k8-DI; Tue, 28 Jul 2026 14:13:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374339.1621471; Tue, 28 Jul 2026 14:13:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYU-0006k0-Aa; Tue, 28 Jul 2026 14:13:14 +0000 Received: by outflank-mailman (input) for mailman id 1374339; Tue, 28 Jul 2026 14:13:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYT-0006ju-MR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiYT-00DSNP-33 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiYT-005HYO-24 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=oWyNJaMWyAr3Gu7/tbKyDJ/I+2tlM5oPGfkWEs4ESpE=; b=sCA0Astg9tw2z2uLV+lQ1lrnx7 pzk5/57X3Whn+UHmOFy/v7kLK1btJKMDowCw9OW9v/v0NkNMMVeye/+lOpseNaqwC6GyizgoiHgTg HjPd2seAsPbrelrdPVSPm8EthcYjs8Vvc3BMci2ux9d40MByV2O9iJU634kHwacBRJ68=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 14:13:13 +0000 commit e6be9150ea16584aa14ba8d05c8024b4514e574a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374340.1621475 (Exim 4.92) (envelope-from ) id 1woiYe-0006mN-EO; Tue, 28 Jul 2026 14:13:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374340.1621475; Tue, 28 Jul 2026 14:13:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYe-0006mF-Bu; Tue, 28 Jul 2026 14:13:24 +0000 Received: by outflank-mailman (input) for mailman id 1374340; Tue, 28 Jul 2026 14:13:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYd-0006m9-R9 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiYe-00DSNV-0H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiYd-005I8f-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=J2iXEkit/SpghE5sUpBsXzoY89MREYzS0tKv44o9bKI=; b=oXIN5fBJCZnfelMcBgh1PAjDoz oCvdrJkA0blobWfPlmrpYSZY6E0GgsrJGvmxi3Dtt+ICaK5DTk5ZLs4JGg1JKSdYP5YZWEt9X9Iok Twlew4Pip2rap5iSs2sTalU+YH5MP6zPFdeKKlXJp51zrVSCt5Xg1NaBfv5y8TYZ7PD4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 14:13:23 +0000 commit 5177bee97672c93414ca67f7b9d75cb5e787a17c Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374342.1621479 (Exim 4.92) (envelope-from ) id 1woiYo-0006oQ-GG; Tue, 28 Jul 2026 14:13:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374342.1621479; Tue, 28 Jul 2026 14:13:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYo-0006oI-DH; Tue, 28 Jul 2026 14:13:34 +0000 Received: by outflank-mailman (input) for mailman id 1374342; Tue, 28 Jul 2026 14:13:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYn-0006oC-Tc for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiYo-00DSNZ-0X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiYn-005IhA-2n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=mxAHcDLfj0VrHEKGU6PUf1CwHfA7XqyhBmh2JSfO16c=; b=4rTohwT+GWCRl5fqt8XoBoAwrv dQuVlQy6OcUS3giM2ZbplmmuTGYxtrc0Cszl41fooV36m0vGXFdgSKm2psEGefd5/L1ZnibzYOeCK QRgG4zGHEcC5pFaC49aPorlo8VsczPnTwN0KcTxZyXgR9FPGZIYC7zPJWdw6gc66aM4g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 14:13:33 +0000 commit 2541568df86535d966321461e4419774ad6d3836 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:39:49 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374343.1621483 (Exim 4.92) (envelope-from ) id 1woiYz-0006qP-HO; Tue, 28 Jul 2026 14:13:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374343.1621483; Tue, 28 Jul 2026 14:13:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYz-0006qH-Eg; Tue, 28 Jul 2026 14:13:45 +0000 Received: by outflank-mailman (input) for mailman id 1374343; Tue, 28 Jul 2026 14:13:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiYy-0006qB-0f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiYy-00DSNe-0s for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiYx-005JFE-36 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=FFiipKMUdQe7tG8+p0R01S5c4Ave1X079wnlmG5j85c=; b=qwFEUi+eYxUC/upN8vcHFh3wCC LdGHAHRF369k4e3Bz3c7g8FIXAHwaR+jxwLCgLmh2IizgXOEWQcbheggUswUmGKehnRPR27561NTQ IS3B0DfwiHV4NKEPG56jt5xWGEW5gMvjC5SBcdwwnLJff5CpYLU24YrNkImrn2yR6y6I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 14:13:43 +0000 commit d00aad3b132fc21e263ac71bf74a4df7bd30aad5 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 066498e07e..1f44fff12a 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -494,6 +494,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -655,6 +661,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:13:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:13:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374344.1621487 (Exim 4.92) (envelope-from ) id 1woiZ9-0006sJ-Ik; Tue, 28 Jul 2026 14:13:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374344.1621487; Tue, 28 Jul 2026 14:13:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiZ9-0006sB-G5; Tue, 28 Jul 2026 14:13:55 +0000 Received: by outflank-mailman (input) for mailman id 1374344; Tue, 28 Jul 2026 14:13:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiZ8-0006s4-3U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiZ8-00DSO1-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiZ8-005Jnv-0A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:13:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Ci/UI7RjXED1wO1wWTUjtcABzM09kugH9DluWZBdhmE=; b=jcfTL1KHRttggZaMcpuOC70Llw CWd+mMsrtU/6nWEZQ3VqyjxgqYOpBaAuianaS8U2lqRu6vXs/j9uQOHfjZ13ePW+PjLdzRajYFk7Q aq+HQrQ+ARlwImpvBZPPmZszlYMV8aKYSJ0ZX0T7HSpaJ5RGGCEcmUIKhuiYAp3ksWPo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 14:13:54 +0000 commit f719630bd6fb7a717d5b2077799164a28e940cfc Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 22dde913cc..f3744496e9 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 14:14:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 14:14:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374345.1621491 (Exim 4.92) (envelope-from ) id 1woiZJ-0006uG-K9; Tue, 28 Jul 2026 14:14:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374345.1621491; Tue, 28 Jul 2026 14:14:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiZJ-0006u8-HZ; Tue, 28 Jul 2026 14:14:05 +0000 Received: by outflank-mailman (input) for mailman id 1374345; Tue, 28 Jul 2026 14:14:04 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woiZI-0006u2-6C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:14:04 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woiZI-00DSOJ-1P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:14:04 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woiZI-005KJR-0Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 14:14:04 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Lw3XryBIWUg08eJ2vYwV3rky3u7c1dcK9DBXh5am8EE=; b=AGVRw4tiynhIHXai2iRojVSyuI 2iFI22tuvUq2kyHgNDsgsZl+fUe15eTkTClLpHCXWc0YyPk5TYNFT1seyHIciWXiIx0CFWJ0/Z7Cc ZaestVD1ykoqiZVzQ0aFLLhFIMm7W6zXTI5V71u0d9Lm5G9KgjJowKMiELBO+yQXuTPU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 14:14:04 +0000 commit 6deb5262dffd096463cd8c7655c2ab88f83debf5 Author: Jan Beulich AuthorDate: Mon Jul 20 16:39:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:07:36 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index fa20ad629c..71741be60e 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -288,6 +288,12 @@ or itself will not be regarded a security issue. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374816.1621994 (Exim 4.92) (envelope-from ) id 1wojSS-00067y-1D; Tue, 28 Jul 2026 15:11:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374816.1621994; Tue, 28 Jul 2026 15:11:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSR-00067q-Uh; Tue, 28 Jul 2026 15:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1374816; Tue, 28 Jul 2026 15:11:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSQ-00067k-BR for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojSQ-00DTy6-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojSQ-008LtV-0f for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=pGykDMUWnHEpKL1Vw2NKAinwfdt7C+Wd2j17TNOdEek=; b=d09Bnc05jJBkZfKgPHscxkJTGw hmcQbs1vShKfDtkjyqAHtWGAxx12K8K3Xb6ElRrZAcaRqPeCg3J83Ej3mpmFPHIaT7BXcGK59WUvG 7XkK4puebsksk0IaZP9p9Z85UQsaHAs2T8LvRVNM+Scc0Gv047q9jc26cni8m5kss9jc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 15:11:02 +0000 commit 6cb914cb59d007ef87ca04ad13be35a118411b32 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:03 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index baee1d17fb..5df2252bba 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -351,6 +351,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -476,7 +486,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 781334d74f..90f6a4b395 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -307,11 +307,15 @@ debian-12-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 4542ea8408..8bdf6c9adc 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -155,7 +155,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -171,7 +170,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374817.1621999 (Exim 4.92) (envelope-from ) id 1wojSc-0006AA-4j; Tue, 28 Jul 2026 15:11:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374817.1621999; Tue, 28 Jul 2026 15:11:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSc-0006A4-1Z; Tue, 28 Jul 2026 15:11:14 +0000 Received: by outflank-mailman (input) for mailman id 1374817; Tue, 28 Jul 2026 15:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSa-00069n-Db for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojSa-00DTyC-27 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojSa-008MW8-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Zl0HX3t45ta8lo6ymUftyNM6elMAHEqc7fuRzeYILmE=; b=Gacha6JSyMrCzmaZPDHl0j8tek 6AzMJOQczimlE/buhZqlESlCY+liPwFiNIWy2QEaLPUGg++AjinoqP4TmzkqTAT+/DersW3Add1Mj hWzWzFiVYK9hfMuWwEFv+M1UrXc5PN1SDJiC6X20gTLrkbqCLGSTB26TmUpp0IWGnr00=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 15:11:12 +0000 commit 21e31cc315b449b187785429f29358ca329aa43e Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:42:06 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374818.1622003 (Exim 4.92) (envelope-from ) id 1wojSm-0006CZ-5n; Tue, 28 Jul 2026 15:11:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374818.1622003; Tue, 28 Jul 2026 15:11:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSm-0006CR-2y; Tue, 28 Jul 2026 15:11:24 +0000 Received: by outflank-mailman (input) for mailman id 1374818; Tue, 28 Jul 2026 15:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSk-0006CK-Jd for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojSk-00DTyK-2l for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojSk-008N7D-1V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=C37CP1TRkstemKmfD6FZCIAWKTRjhLiizEbMYctMIpk=; b=xBuAH8jEoPeL57z8+blrrI2wxd JfCJHzO+sktc7Y89l7HBtWzo7wpDL7y6tkbfQm7fQLWse6Ckg1LReiqmyR+Q9gEz9tPltQuQNXT+Q eQ9w2lzoPVkPrRlyrJgX5nA5HLgMMqWtKUmgG6B37nu459wsbUv6AEs0Q5OV3eweg0yo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 15:11:22 +0000 commit 6e278ffe6207ed6da25eb11a0bf7c6707513e545 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 4 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 95467b88ab..71f47fd33f 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -669,10 +669,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -695,10 +691,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -723,20 +715,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 694c748694..09432fea92 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1557,12 +1557,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374819.1622007 (Exim 4.92) (envelope-from ) id 1wojSw-0006ET-76; Tue, 28 Jul 2026 15:11:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374819.1622007; Tue, 28 Jul 2026 15:11:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSw-0006EL-4H; Tue, 28 Jul 2026 15:11:34 +0000 Received: by outflank-mailman (input) for mailman id 1374819; Tue, 28 Jul 2026 15:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojSu-0006EE-My for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojSu-00DTyO-36 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojSu-008Njg-25 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1h+9QhYwgH21lpYtRjs922gPWntbqpfBEyWHMM4+5h8=; b=7GV4fsrhZh1OFE05LX7pKjwc7i 3/wzwwjOsw4MZYUILEM2unfzRU/71HMAybT2AN+6t0pZxphjsYl0HusmSF2DmcEZh/U8x5V4ET6lL Lph96BAWK7x/e51CE3JfMWKGXXGYd6cqxIYyYw52jcwBUeVO91bQrsWw8nbOOrbDu/G4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 15:11:32 +0000 commit 7592e51ca7f5928652e10a95c178433624a35bbb Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index c2d99ae12e..bd61ca2d09 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 95c73f9894..e50be97345 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bf6d4e9772..32f1fbb1ed 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -239,9 +239,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 09432fea92..5299d95c8a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -895,9 +895,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -969,7 +969,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374820.1622011 (Exim 4.92) (envelope-from ) id 1wojT6-0006GM-87; Tue, 28 Jul 2026 15:11:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374820.1622011; Tue, 28 Jul 2026 15:11:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojT6-0006GE-5a; Tue, 28 Jul 2026 15:11:44 +0000 Received: by outflank-mailman (input) for mailman id 1374820; Tue, 28 Jul 2026 15:11:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojT4-0006G6-RX for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojT5-00DTyS-0K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojT4-008OLY-2V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RgXJz5c+rdasiWEwaer6EF0BkhQ3pTITyshPngknjoM=; b=QtqzB0Q7aSJHzdobEroLp8rIxP QTN9dGycc2N3BL9bFbHwooWh48znwrbY8EDsdNF+RTyp27ieQz/iCRfLE09aT9zUfb4Y6qysjo3Ni D/JKeMNprbVzW2FNXfG/aU9wLd63PbghriJzYN3Wb+4Ny4MxGcQbdCCprBIMsNt/ejcA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 15:11:42 +0000 commit 4e7fdceee8bd619e997c7238bc54f262d886c529 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 08e3bf48fc..3a737d11ec 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2086,10 +2086,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index e50be97345..8a2a3785d5 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 32f1fbb1ed..25469378ae 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -222,11 +221,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5299d95c8a..e0cce78bec 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -903,7 +903,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -939,6 +938,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1905,7 +1907,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:11:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:11:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374821.1622015 (Exim 4.92) (envelope-from ) id 1wojTG-0006IF-9c; Tue, 28 Jul 2026 15:11:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374821.1622015; Tue, 28 Jul 2026 15:11:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTG-0006I7-6s; Tue, 28 Jul 2026 15:11:54 +0000 Received: by outflank-mailman (input) for mailman id 1374821; Tue, 28 Jul 2026 15:11:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTE-0006I0-V4 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojTF-00DTyW-0g for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojTE-008OwM-2u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:11:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=aAskdvZnerb+dOXStKAsd6Jxtg4+4lA7WgAXk3CYZeY=; b=rvsjIglgIsMTMhjaiR2cgxSLUe Frk8AmOM4RInPties1GyOpUzKw3vA5/ZFDL8gI/YlIrWukZFM36Pmf+eANXXVInnkoaDUzMswL5BV z1sVMi8zU9CVHyhyCgWZHYw5nnxLlsdnxLwWXTNkYVJj0baSphgFa9KDx9SA0GmAoBCM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 15:11:52 +0000 commit 6159d36e767fd9e175830751de0c8c28bd3e553b Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index def60da883..c9f85545a4 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e0cce78bec..f9448b3deb 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -901,7 +901,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -948,6 +947,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374822.1622019 (Exim 4.92) (envelope-from ) id 1wojTQ-0006Kb-C2; Tue, 28 Jul 2026 15:12:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374822.1622019; Tue, 28 Jul 2026 15:12:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTQ-0006KU-9Y; Tue, 28 Jul 2026 15:12:04 +0000 Received: by outflank-mailman (input) for mailman id 1374822; Tue, 28 Jul 2026 15:12:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTP-0006KN-3P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojTP-00DTz6-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojTP-008PXf-05 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sXDIT4kBDguyhCihRgdryLzjn+WYwP3f/roFnVzZBDU=; b=2XtLKx/9s7iMLv+p7B4Pg5W19C 0swG0T4ye6uMmZUPIFcslWn1bywlFhFHTUebqlEzLhkP4UlJnfwYv2D1TdGMz2CVLZXdZcZKv83in BqMhfxZyd5qDtt8sF3ETwf7FMT9r6o88yM3CkYTHbxXNl9CBj/+rVZbtq9Se33ujfcSU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 15:12:03 +0000 commit f2c03a8606ec5cfd2d48d47d11cd006c4df2600e Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index bd61ca2d09..a04f46d29f 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8a2a3785d5..b3969c4f32 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 25469378ae..87e277aa38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -238,11 +237,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f9448b3deb..1704b7ae8a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -900,13 +900,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -977,16 +982,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1912,7 +1907,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374823.1622022 (Exim 4.92) (envelope-from ) id 1wojTa-0006Md-DX; Tue, 28 Jul 2026 15:12:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374823.1622022; Tue, 28 Jul 2026 15:12:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTa-0006MV-B0; Tue, 28 Jul 2026 15:12:14 +0000 Received: by outflank-mailman (input) for mailman id 1374823; Tue, 28 Jul 2026 15:12:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTZ-0006MP-7D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojTZ-00DTzD-1W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojTZ-008Q7Q-0X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=uyaK7Bt+3NE8qrNEyy76H1Rn/H4p3W9IUY2Qgur4tKA=; b=Zl0kjVbqXS211NKTND8rMF5fAP 2Ul/y+pwlYyWKT5qGONqVnxN4mKSAIycftKiM3TQvr0A7BuRroZGk7ZqDAq4oJLoUz3R9k4pk2nBH AX3x6j2QwZXFR6gRqG7QaDCfm0xa4zfJJ9+/HrrWYfzKS3Bhr9sEtkHK8Guz2VBA2pmE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 15:12:13 +0000 commit 628cd49525fa0889d68ed4c9cec22bf81846329f Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1d40d82c5a..1db996760e 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b3969c4f32..2dc41d7307 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 87e277aa38..b5d4e9fe43 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -123,8 +123,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -508,16 +506,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 1704b7ae8a..188187bd16 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -901,9 +904,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -955,6 +955,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1232,12 +1249,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1958,8 +1975,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374824.1622027 (Exim 4.92) (envelope-from ) id 1wojTk-0006Or-FE; Tue, 28 Jul 2026 15:12:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374824.1622027; Tue, 28 Jul 2026 15:12:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTk-0006Oj-CW; Tue, 28 Jul 2026 15:12:24 +0000 Received: by outflank-mailman (input) for mailman id 1374824; Tue, 28 Jul 2026 15:12:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTj-0006Oc-B7 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojTj-00DTzH-1u for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojTj-008QhO-0q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=KmmR6iRiZh7KMdj336aNe6g+ogACh8+EGzaBAqTEnYY=; b=YByX6Ne+yBwZoiVWtIQhOehkGi c/3McLbqJJyx+HCHUWtapbOfKLK6FaicBwSaQUJdwKr8v7Huq6olEVyuQ2OXY8IxfPXf3/niReWjb 6VzVZIK8mii5xpZ3VXtt1QVRqNfr27YqMO3dBytxqP3+qqJ/Td5mtnJ1oPMmAWd1EbiQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 15:12:23 +0000 commit fc159bcd70fb9a124ad230f1784f5fb747430d86 Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:22 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index a04f46d29f..b2c45bc5d8 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 2dc41d7307..fbc06919c8 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5d4e9fe43..193f68c88e 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -129,7 +129,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -522,11 +521,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 188187bd16..fe8104e6ce 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -902,10 +903,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -936,6 +933,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1327,21 +1341,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1981,7 +1980,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374825.1622032 (Exim 4.92) (envelope-from ) id 1wojTv-0006S5-H6; Tue, 28 Jul 2026 15:12:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374825.1622032; Tue, 28 Jul 2026 15:12:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTv-0006Rw-Dt; Tue, 28 Jul 2026 15:12:35 +0000 Received: by outflank-mailman (input) for mailman id 1374825; Tue, 28 Jul 2026 15:12:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojTt-0006Rl-En for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojTt-00DTzQ-2H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojTt-008RHX-1F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bKb3qsjexrZPNBKJ7v+uRE0mxgEdSNsadLH71tI4YXs=; b=v7Rr5f1ii0HVTwig9Nfl289mZX RMpt+l2f7ZqE1ac5Ya/+s6gDjVNKNW+8YF3p7b9LxpFmNInoymo55+dWXuvZLBQxplYw8Ty5Y8cnb 94b+h1NEGahAYVQYdgBJfU4SQO9ScNq2faM7QWS3eKQX6JIxND/dsJhp3o9oiUXiSr9U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 15:12:33 +0000 commit 7dfed62794a535061fa96b966916e5bbdd6e144a Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:29 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 751b05efb6..357dcfed2b 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2802,6 +2802,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374826.1622035 (Exim 4.92) (envelope-from ) id 1wojU5-0006Xd-IM; Tue, 28 Jul 2026 15:12:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374826.1622035; Tue, 28 Jul 2026 15:12:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojU5-0006XW-FN; Tue, 28 Jul 2026 15:12:45 +0000 Received: by outflank-mailman (input) for mailman id 1374826; Tue, 28 Jul 2026 15:12:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojU3-0006XO-IA for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojU3-00DTzU-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojU3-008RtW-1d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AvrFC61d9lLDEYjWWIrZ70qK1Q3GcsMK1M4h+LXg2vA=; b=fCFSHggq5r/XHVrraNwbAZZyTN 9undLD8NKBg6OFJdiCFmp7aciV0ssRppt8M0PlhdyXYFNi7xdEBjgyPDf8yHsHH4YhQ05crpW+zlN 4pJo6VksY67EkjW5CQfOudgayQxLYz1JJQSItAanis1BDpp5SRRuJRn4Z2ZdnrH7qwLg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 15:12:43 +0000 commit ee202319ef645637844abde68eb4be6d631aacf5 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 357dcfed2b..5805338774 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2194,14 +2215,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2246,8 +2267,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2272,7 +2296,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2412,14 +2436,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2431,7 +2455,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2451,7 +2475,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2471,6 +2501,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2499,28 +2530,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2539,6 +2569,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2670,8 +2703,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2685,6 +2720,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2721,6 +2757,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2747,6 +2785,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2801,6 +2841,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3229,7 +3272,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:12:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:12:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374827.1622039 (Exim 4.92) (envelope-from ) id 1wojUF-0006dv-Lf; Tue, 28 Jul 2026 15:12:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374827.1622039; Tue, 28 Jul 2026 15:12:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUF-0006dn-J6; Tue, 28 Jul 2026 15:12:55 +0000 Received: by outflank-mailman (input) for mailman id 1374827; Tue, 28 Jul 2026 15:12:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUD-0006dg-Le for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojUD-00DTzc-2y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojUD-008SUL-1y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:12:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Y43Ly7OVU308CBJE60tucEhu2AT2RXruneZTrvGr+sc=; b=q6Ci10ILYspr7VMBFp3KdlJv4S N22O2dRycnFSm7LAxTcjP++WrZXuMxP2AmYtwGpFvf75qBvFUvyVKde9NTZdWp668Wg0+vdxncj8j L7UZ9QJP2bBvAAAXnIwLl/RdWD9Z/JvcRDpy13MO4dp1vu7Ymhg5JfAhL3HgZX/uNiA4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 15:12:53 +0000 commit d1aebc7005c6ada289ab821585f9a94fca55879d Author: Jan Beulich AuthorDate: Mon Jul 20 16:42:43 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 52a2139495..79135aadfa 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1020,7 +1020,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 9d5f55161b..f2e90ffb60 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -914,12 +927,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 9b23cd0bdb..723ab3c0da 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1764,12 +1764,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index ae2b72d5c6..f7a270229e 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -164,9 +164,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374828.1622043 (Exim 4.92) (envelope-from ) id 1wojUO-0006iO-Mu; Tue, 28 Jul 2026 15:13:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374828.1622043; Tue, 28 Jul 2026 15:13:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUO-0006iG-KR; Tue, 28 Jul 2026 15:13:04 +0000 Received: by outflank-mailman (input) for mailman id 1374828; Tue, 28 Jul 2026 15:13:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUN-0006iA-Og for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojUO-00DU0G-03 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojUN-008T7M-2H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RwI16znia4TPrhEk81yHd2FbxGOEBp+PZnW+sf9yTUo=; b=v/pftqa2t0IQyWoT9sFKOINGYp 4S1Uu8m/od3LUC+j8rxBL1KZMv8fyu87pkoYzERkOUlwSqo4hVMJHJaBsEeKhYWWJb2qqez9UmJTx BFK3Hy1d+nCy9Zt0sA/tG4XEBFOwzUEDpdE9WahNYicZB5HC4s7WTmW4ZYpuNSyakS1g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 15:13:03 +0000 commit ffe6e364c79e36615bc891acc1940057efff386b Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374829.1622047 (Exim 4.92) (envelope-from ) id 1wojUY-0006kN-OJ; Tue, 28 Jul 2026 15:13:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374829.1622047; Tue, 28 Jul 2026 15:13:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUY-0006kF-Lm; Tue, 28 Jul 2026 15:13:14 +0000 Received: by outflank-mailman (input) for mailman id 1374829; Tue, 28 Jul 2026 15:13:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUX-0006k9-Rf for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojUY-00DU0K-0L for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojUX-008Tkw-2b for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=s5vLaj3+7/pgPqh8KtFgYeHNBw8d2OkmGIeKwquiP+U=; b=h4u8BX10cX0HTvp5Rjy4DWPoeu bh2pzGUBNWqzxDklug9RLBzfqhJHD6LiVFfTxst1mW0bRA4wXMXYQ5lV7Fcip2xbSTyfHb4b3rE8M DYUM5p1h3BFpqY0sfO73JiiLiDu4+WVYANi1QXJDcwbTxsg3wP75g/2MFpoLu7sukTCM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 15:13:13 +0000 commit ba2f7f33094689d8d1e27d70424b16d2dda7173e Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374830.1622051 (Exim 4.92) (envelope-from ) id 1wojUi-0006nf-Pj; Tue, 28 Jul 2026 15:13:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374830.1622051; Tue, 28 Jul 2026 15:13:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUi-0006nX-N8; Tue, 28 Jul 2026 15:13:24 +0000 Received: by outflank-mailman (input) for mailman id 1374830; Tue, 28 Jul 2026 15:13:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUh-0006nR-Ub for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojUi-00DU0Q-0d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojUh-008UMG-2s for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iaoxGCMRmfmSx1Bcyi3Iq7eag18rDIZ7nQqX5PYtalE=; b=MY5B4viLEvoeNfyGbenYWbRHmo omw9k6MdPq0+jMnMo5NSD3EGkSK81I5I9Tvrn6SyhtR3vnkFLfAOeUVjYQjyw/6UnIfaXduIR5YOY Nlbp8eIfqEYWldt4z/I5jgof4VEHzInxVDB9XlOnqT1HdWEJgG8uzfNFtSanBrJFrwo4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 15:13:23 +0000 commit 011509a0c20809a3f1eb645a5109172bc847e8b6 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:42:53 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374831.1622055 (Exim 4.92) (envelope-from ) id 1wojUs-0006ql-R8; Tue, 28 Jul 2026 15:13:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374831.1622055; Tue, 28 Jul 2026 15:13:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUs-0006qd-Oc; Tue, 28 Jul 2026 15:13:34 +0000 Received: by outflank-mailman (input) for mailman id 1374831; Tue, 28 Jul 2026 15:13:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojUs-0006qX-27 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojUs-00DU0W-0w for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:34 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojUr-008Uxx-3A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=5OPKkY6p2CH/OPJyTXn3si/Uokc8w/p22XvYDhyKDWI=; b=4W2CUw5iRvVG9cDEQBiIweL3Jc XmVR4DYTpBq/IupNGWsy3LqZjSy2luk39k0gR6WykGWyGOE9tS3BzixYfmId9A6KuTgQHIni5qXMj eD/IB+3qD/mbRPG7i9OBrGsqWUKxcgcY2NyPcR7vBlMVw/rtMJhp5hOuClQH8bG58bI4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 15:13:33 +0000 commit 875c1baf3af78f8c46e3d4a9cc39a0ca748aa31b Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 462691f91d..58915ad0dc 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -650,6 +656,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374832.1622059 (Exim 4.92) (envelope-from ) id 1wojV2-0006sm-Sc; Tue, 28 Jul 2026 15:13:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374832.1622059; Tue, 28 Jul 2026 15:13:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojV2-0006sc-Pw; Tue, 28 Jul 2026 15:13:44 +0000 Received: by outflank-mailman (input) for mailman id 1374832; Tue, 28 Jul 2026 15:13:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojV2-0006sW-4B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojV2-00DU0b-1E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojV2-008VZ2-0F for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NEgcZyollurED0mxKyd880hC+U+xypEJGUhcBBr/2So=; b=fEPK9LzPi0K0O4IAonRD8FISlB pjFx2qiMuoUOdaIyrpqWm65IvVRA5Z6/VKKYN0lRJnMB7BtVsWRLO3gk9bsG46MbNINdhh450NuoH aWf+VS+C9t88iyXWwcZmi+mG/DtvT9JftZTR9ZUSusfwlro20/9GgwW2/9zQ9EhThF3w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 15:13:44 +0000 commit 4c7248d1cf5607e9f1700815045c5a912d43f34b Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 8b2641dbbd..43ef92c0ec 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:13:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:13:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374834.1622062 (Exim 4.92) (envelope-from ) id 1wojVC-0006uk-UG; Tue, 28 Jul 2026 15:13:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374834.1622062; Tue, 28 Jul 2026 15:13:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojVC-0006uc-RI; Tue, 28 Jul 2026 15:13:54 +0000 Received: by outflank-mailman (input) for mailman id 1374834; Tue, 28 Jul 2026 15:13:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojVC-0006uW-7U for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojVC-00DU0y-1Y for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojVC-008WBE-0X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:13:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Q0yiWSflayZHV/iiXIpbChzA28tCfr3B2OiINa5SgFE=; b=TjmiIEFyjxgc8fFJauBNVyQbKD s+U01NKU3LxtvMK/yngHbKyLNLm8kw7jl4ka5Ako+axH6pLjRj4qHkF0OkVCco5n4SLL+g2G+L/Tp ERejSN5w3jR2Xjk5inHP5/pNEeXSiCpe7nh16IeA2ZDp6Wz3b7n7ilyCrZS2Pu7m/thU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 15:13:54 +0000 commit 95d66a8910b56e623fc3589a8315c063ed526c9a Author: Jan Beulich AuthorDate: Mon Jul 20 16:43:01 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:52 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 5df2252bba..d28cd8dde9 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -273,6 +273,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374836.1622066 (Exim 4.92) (envelope-from ) id 1wojd5-0000oL-Hk; Tue, 28 Jul 2026 15:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374836.1622066; Tue, 28 Jul 2026 15:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojd5-0000oD-FE; Tue, 28 Jul 2026 15:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1374836; Tue, 28 Jul 2026 15:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojd4-0000o7-Ax for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojd4-00DUDP-1n for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojd4-008zEa-0i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=IphKaK97rnhv+39veYEHbXLzuu6PDI7FSBs5zdYJJcI=; b=RWinsQpN1rUNacKRbhgZyhHu/v 12+E8tSesxnyPeuXY6XKEQY3uOHUbNsh3uO+gw2Unr8vpF+BDQjKQnIbbwWhUgMDg8crQRDg9btWi YkUr82aUp0mjEFeZAnWcIVRg4RmiU8cugZkXRQQH3dKnAyYzcZQ7xqC8CydyHvZAELJ4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 15:22:02 +0000 commit 36732dfc7d8f59062819dd170b49dfa8fad6d5cc Author: Jan Beulich AuthorDate: Mon Jul 20 16:40:40 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 67be5a5783..7db7ce9c3e 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -353,6 +353,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -485,7 +495,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 5f0acda942..9309e10ebb 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -312,11 +312,15 @@ debian-12-x86_64-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-x86_64-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:12-x86_64 + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-12-ppc64le-gcc-debug: extends: .gcc-ppc64le-cross-build-debug diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 96fd1c3272..f63c55c783 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -177,7 +177,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM help @@ -193,7 +192,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374837.1622070 (Exim 4.92) (envelope-from ) id 1wojdF-0000qI-J5; Tue, 28 Jul 2026 15:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374837.1622070; Tue, 28 Jul 2026 15:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdF-0000qA-Ga; Tue, 28 Jul 2026 15:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1374837; Tue, 28 Jul 2026 15:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdE-0000q1-Dj for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojdE-00DUDV-2B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojdE-008zrg-19 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=64aa7dP2db6inFppnbgoH6ATKSclYCZht+Q9FiyocTc=; b=hhLt9gc+zK0kXP6WijVf3UZLJp rV0y4KhXYY+Hb76VKt5NNI5SIFPSESVqZSnCEI0Fmhf9td0jC2VrD504DPre5XOsgeAjxHbWOfyFd 7uh/m67jTNOahXQp7dSeMt4JPmgKIy064o+sK03xox9vVAItoPMdeUzztYPcA3ByK0tc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 15:22:12 +0000 commit 44d2fe6ac7e13265908cb50c2bc07d21ea00030e Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:40:52 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374838.1622075 (Exim 4.92) (envelope-from ) id 1wojdP-0000sX-KU; Tue, 28 Jul 2026 15:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374838.1622075; Tue, 28 Jul 2026 15:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdP-0000sP-I0; Tue, 28 Jul 2026 15:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1374838; Tue, 28 Jul 2026 15:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdO-0000sI-HO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojdO-00DUDZ-2X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojdO-0090W2-1X for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=NPCoTwX8NV/QUbX7G2XmqOcvkyI7j1N7i/9tSvTOuiQ=; b=1YU4dy8dOL9OJVVH2RqHpFpJzM c+xFdoq+6QeM8vcznjLDtO8DRgtmOyEdA8YzQMRIwunL+8VG6KSVt37FR2nyBmMXRnu+vtCOXNOzn T+XP/BQb9VhxL0Dz1u2h7NStqumEspMdqN5aOaiJUeKV9I5MSZywNIi205A2gvojVSdI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 15:22:22 +0000 commit 5d170c81126feb5e855c0dfea88d6a2fe6e93c5f Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 16 ---------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 4 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 67f851237d..07f8439a6d 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -682,10 +682,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -708,10 +704,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -736,20 +728,12 @@ ret_t do_platform_op( } case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2c3bab1d18..baba5c727a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1564,12 +1564,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374839.1622079 (Exim 4.92) (envelope-from ) id 1wojdZ-0000vY-MC; Tue, 28 Jul 2026 15:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374839.1622079; Tue, 28 Jul 2026 15:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdZ-0000vQ-JJ; Tue, 28 Jul 2026 15:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1374839; Tue, 28 Jul 2026 15:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdY-0000vK-Kz for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojdY-00DUDg-2t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojdY-00915q-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AvPopxY+ImgggXvBgc7XicvPhCE7jGxG0iXylHXWa8I=; b=WeqfnZ7GGSaRZUf7nER/L5szEB UDyhfNao5oLaJS7/3trZixSwcZpfWuvkWFjaCAUlC8thveIFs9PyWzfpepNHMAVvIdDHQWl7DAsLo ub+uCEC5YVhyk4L8Homrio9RZViGlF3zpmBigXRLEHDr9dlR0z8WuErr5x1pDaSzresQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 15:22:32 +0000 commit 46fe95efa863db0e9da68a042e45bc4515cc555a Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index c2d99ae12e..bd61ca2d09 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index ec377ed9b2..0ae921f220 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,7 +179,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index c7b3f1f618..aa64202d92 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -59,7 +59,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -238,9 +238,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index baba5c727a..a20ef78185 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -901,9 +901,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -975,7 +975,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374840.1622082 (Exim 4.92) (envelope-from ) id 1wojdj-0000z0-NP; Tue, 28 Jul 2026 15:22:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374840.1622082; Tue, 28 Jul 2026 15:22:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdj-0000ys-Kc; Tue, 28 Jul 2026 15:22:43 +0000 Received: by outflank-mailman (input) for mailman id 1374840; Tue, 28 Jul 2026 15:22:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdi-0000ym-Oq for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojdj-00DUDk-03 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojdi-0091iQ-2E for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=suFZEsqVS48xVfYt7GUgiUgTmRfWlmUY1hbmSl6sygY=; b=3r1AayeibzL0Ks73MS9wi7sm0L nXQJ/CX0XXL/CanE56tvn7IKgshVNEZJkTVccOkcTVccauUbzDcSV7Uy2w3ya0dzR2Q3cPprTzU9O XyM1EZ3H2CHUElydAQm7WmMeMuwzGmlG6mo8vv+bvTqtOn2DxRImmRV8mArb4HieFbNM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 15:22:42 +0000 commit edd856bb64b5abbe217b073cc2865b1106cae025 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 6041ab093e..2e97a5494c 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2085,10 +2085,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 0ae921f220..fb4201d555 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index aa64202d92..d68b418794 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -56,7 +56,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -221,11 +220,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index a20ef78185..4dc8679ca3 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -638,7 +638,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -909,7 +909,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -945,6 +944,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1916,7 +1918,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:22:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:22:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374841.1622087 (Exim 4.92) (envelope-from ) id 1wojdt-00011O-Pq; Tue, 28 Jul 2026 15:22:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374841.1622087; Tue, 28 Jul 2026 15:22:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojdt-00011G-NH; Tue, 28 Jul 2026 15:22:53 +0000 Received: by outflank-mailman (input) for mailman id 1374841; Tue, 28 Jul 2026 15:22:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojds-00011A-SM for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojdt-00DUDq-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojds-0092NW-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:22:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=C1dBnyUamP5ATSZr+c7/m6u3txAC72SqFooqErVnzag=; b=A17enCu6PHHz14FKbO8LElsZ9U B3u/MRkjldv63/nuu5praPAoMH1mYaPWjlhXAhjwQrwU2UppUgjMGImEjejxfoi44vVyJri2VhyIN h9fe7qxZE/9je2uuo+C94+zXQySogJ/DezKvvNiqNSGbfwitubCE4jViQ/DLQ6I0Cj7A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 15:22:52 +0000 commit 5ddc8866620d12354c2469e95f86a0c9aeb1bc00 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index f7cf7c43c8..f996767535 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4dc8679ca3..934ed334c2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -907,7 +907,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -954,6 +953,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374842.1622090 (Exim 4.92) (envelope-from ) id 1woje3-00013H-RE; Tue, 28 Jul 2026 15:23:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374842.1622090; Tue, 28 Jul 2026 15:23:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woje3-000139-Ol; Tue, 28 Jul 2026 15:23:03 +0000 Received: by outflank-mailman (input) for mailman id 1374842; Tue, 28 Jul 2026 15:23:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1woje2-000133-VU for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1woje3-00DUEZ-0j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1woje2-0092xt-2x for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=m6hiMx1PgAODEnxR3isvrn8B9xx4VB7nFYcg0gkR5Ic=; b=CDBxa4K+CEW6mz9VjiflEX+Fyw /ony5FcR9Euda75JsnqqDVLiR+BwaGUsCgxp+cV6OhhS8BM4WAOnFnd/9HH8DTUTSfCkD1NG2Ds6+ CI5Snh0FbUNik98dTOUr9GLijTPR+d53qLfwJYc2Upaplj2BAFAnhY66d+yN0bgxX+aU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 15:23:02 +0000 commit 0bb0f564f37d901678628a117fba82b85a83f80b Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index bd61ca2d09..a04f46d29f 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index fb4201d555..45c95f658d 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,12 +180,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index d68b418794..b09027dac5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -59,7 +59,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -237,11 +236,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 934ed334c2..6188f891d5 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -906,13 +906,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -983,16 +988,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1923,7 +1918,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374843.1622095 (Exim 4.92) (envelope-from ) id 1wojeD-00015C-Sp; Tue, 28 Jul 2026 15:23:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374843.1622095; Tue, 28 Jul 2026 15:23:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeD-000152-Q4; Tue, 28 Jul 2026 15:23:13 +0000 Received: by outflank-mailman (input) for mailman id 1374843; Tue, 28 Jul 2026 15:23:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeD-00014w-38 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojeD-00DUEi-17 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojeD-0093YX-06 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=AUqRb6Qrl7nqODzoZ7tVcpN+MuNySyi6edtLDKbK904=; b=e21A1FIQZ5ZBm9+fDj9E2fDfNk PikfpIfv+zsb9mISgi8r+Q90VTvlvwMuiv54gbMnUxWLWgYBBUFHogxfY9nX6RlESib6o3ekFgeZi GttXDrNyotgqvZmGbXSQVehRA/83bALlp2YQ48xdgRPsT5MeCLf17D3ZBg+Ir145RIDU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 15:23:13 +0000 commit bfc1439cd00f44df13b91a9f3db731b9ee725b5e Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1b04947516..43e00e78cc 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *data); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 45c95f658d..f03ceee327 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -396,18 +396,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b09027dac5..2115819e66 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -122,8 +122,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -507,16 +505,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6188f891d5..2d7d98cada 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -907,9 +910,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -961,6 +961,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1238,12 +1255,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1969,8 +1986,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374844.1622099 (Exim 4.92) (envelope-from ) id 1wojeN-00018R-UC; Tue, 28 Jul 2026 15:23:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374844.1622099; Tue, 28 Jul 2026 15:23:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeN-00018J-RV; Tue, 28 Jul 2026 15:23:23 +0000 Received: by outflank-mailman (input) for mailman id 1374844; Tue, 28 Jul 2026 15:23:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeN-00018C-6D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojeN-00DUEo-1Q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojeN-00949B-0R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eOlS2mE1xI+mgQNCa7vEyZFWo08cl9S8LJaEjYA/Wok=; b=KIyYzP5/6tNWlRzhD9W/90mQuP tubpJJ+3DCxswLu1rUWZ1qH8C7Vrqv3m7lOHRXHymFP/WymeNgv4YlYY1zdihl4iuJHLI00e9CU4x yNauypeI6lgh9Yl9a+3rDlmG3TB5Wpato/8z4gVgAIrLB46EgW3hKDoNx9yb/pVjV2SA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 15:23:23 +0000 commit 1e57ed1796a7d5a3aaa746e4a65dd0dd87f6feab Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:00 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index a04f46d29f..b2c45bc5d8 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index f03ceee327..248cb47648 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -429,12 +429,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 2115819e66..ce76aecb83 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -128,7 +128,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -521,11 +520,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2d7d98cada..f23be0cecf 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -908,10 +909,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -942,6 +939,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1333,21 +1347,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1992,7 +1991,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374845.1622104 (Exim 4.92) (envelope-from ) id 1wojeX-0001Ak-W3; Tue, 28 Jul 2026 15:23:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374845.1622104; Tue, 28 Jul 2026 15:23:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeX-0001Ac-Su; Tue, 28 Jul 2026 15:23:33 +0000 Received: by outflank-mailman (input) for mailman id 1374845; Tue, 28 Jul 2026 15:23:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeX-0001AV-9H for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojeX-00DUEs-1k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojeX-0094mz-0k for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Ymah+k10x0YfiOV22vYH3iRaoM30t8J7u7GO8YMHS2k=; b=magOeW98AegJv3ab4AutNMaxZS i6kRiD9GMAXpeybZm4Yf6wY/SOwBgUPEby3FC2uwSlAFb3dg1Bk1M4sCtL+elCMQ4pJZl0Cx+luqW WbBbTEml8EW/0kLTqMbq7sSUjx6fe4CxyyDt5CcMIAOK8gLhCl9I07p82Gggtc2itYmk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 15:23:33 +0000 commit 42093dac70e8cd2b76412c1c478869cce9671e49 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:09 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 15262819e1..ed4388776a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2803,6 +2803,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374846.1622107 (Exim 4.92) (envelope-from ) id 1wojej-0001DX-2Q; Tue, 28 Jul 2026 15:23:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374846.1622107; Tue, 28 Jul 2026 15:23:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojei-0001DP-Vw; Tue, 28 Jul 2026 15:23:44 +0000 Received: by outflank-mailman (input) for mailman id 1374846; Tue, 28 Jul 2026 15:23:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojeh-0001DJ-Cx for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojeh-00DUF1-26 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojeh-0095M3-15 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=VhQ15kOSvqFu9z51PzlaZ6QO+hGdeaS91Nb7y0/oM68=; b=XFtg2gyT28yzR4CRqRd0cCA5tp NPFyMQkPlmkDG2By7xsiFJE+6NbOHZboAT8X5yiD4jDpiB/V213OWa1+0q3IqtUfojC0h2nJDPrTT kkaaNcaSaGeRTFho8K4LI/50pTFXT2h0KNiRqoIluEn5gM9OhuOxTfgYFoFuhEVxabyk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 15:23:43 +0000 commit 35e4a6ae4d54aa63880026dd9e3a88b52d2e61a9 Author: Jan Beulich AuthorDate: Wed Jul 22 16:26:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index ed4388776a..0a5c23ff1a 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2195,14 +2216,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2247,8 +2268,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2273,7 +2297,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2413,14 +2437,14 @@ gnttab_transfer( * pagelist. */ nrspin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2432,7 +2456,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); nrspin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2452,7 +2476,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2472,6 +2502,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2500,28 +2531,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2540,6 +2570,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2671,8 +2704,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2686,6 +2721,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2722,6 +2758,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2748,6 +2786,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2802,6 +2842,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3231,7 +3274,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:23:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:23:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374847.1622111 (Exim 4.92) (envelope-from ) id 1wojet-0001Iw-3f; Tue, 28 Jul 2026 15:23:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374847.1622111; Tue, 28 Jul 2026 15:23:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojet-0001Io-15; Tue, 28 Jul 2026 15:23:55 +0000 Received: by outflank-mailman (input) for mailman id 1374847; Tue, 28 Jul 2026 15:23:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojer-0001Ie-Fy for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojer-00DUF5-2P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojer-0095zz-1P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:23:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=UUIkiIazNyU7ovtTScO1jXZYfWLVuzuunQKdF+HFZFQ=; b=QwA16yxmAvxikPMkYZuWw/pGJ5 vzjBxzyK9fNsFzLHxRPokE4dQXg7x0qwrakD9nGqhXOdO6Ij5CmH6yQrkDJ8aapXsVVoM6RQpz59Z 7m1a91NIxVk/oif64QvRrf6DOhv4IGI8l+jWXV5mB67pypTIfDAXyBIJnpcg1RCg7VrU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 15:23:53 +0000 commit 8a37bfe876248cc13cf19407ee04cf75a762e76b Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:18 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 96833c1715..c34dca2184 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1087,7 +1087,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; rspin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index a186d145e8..56b4bf4227 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -154,7 +154,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -166,6 +166,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -916,12 +929,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index 23bb159d9b..7a00bf95dd 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1802,12 +1802,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index ae2b72d5c6..f7a270229e 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -164,9 +164,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374848.1622114 (Exim 4.92) (envelope-from ) id 1wojf3-0001MP-5H; Tue, 28 Jul 2026 15:24:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374848.1622114; Tue, 28 Jul 2026 15:24:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojf3-0001MG-2a; Tue, 28 Jul 2026 15:24:05 +0000 Received: by outflank-mailman (input) for mailman id 1374848; Tue, 28 Jul 2026 15:24:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojf1-0001M9-J4 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojf1-00DUFi-2i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojf1-0096dc-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=p2RJ+12YfaBRW4MluuCmpwhZnM/Tcl3/D0yxCzqefoE=; b=2z0ofCaelM5oESamXRirul2jqw YLfp38Ufv+YKlcnObS+1xv2KcpLZQ/RDAzhGdaUppUHvnue35t+jn/vuOVeA5hyNDthPPIUi7KHkd ZCe/QOmuvtYmHu7xS3oYaKgCjWBAnSiAfyrTVVveU4huPsCoZSaf+djwahzZqQy3yfpw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 15:24:03 +0000 commit 8ecf1dc3259a9594d0d2c4afbbed42e32c030b4a Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:05:50 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index e33a8ec108..79ca3281e0 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374850.1622120 (Exim 4.92) (envelope-from ) id 1wojfD-0001Qo-7D; Tue, 28 Jul 2026 15:24:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374850.1622120; Tue, 28 Jul 2026 15:24:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfD-0001Qb-3v; Tue, 28 Jul 2026 15:24:15 +0000 Received: by outflank-mailman (input) for mailman id 1374850; Tue, 28 Jul 2026 15:24:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfB-0001QU-MB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojfB-00DUFn-31 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojfB-0097GU-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=sdh3C3RHy5XFu6W8hCStdEaIBrQDb1BNWzwLZBOi6qc=; b=Yo0D2jvmn6tLWDbCBtKeq9cMao gGee+GdH76a+SmE12wDDZjXJJITZ1CYpLzzwTrvNK2WZBq9dxKHV9AFZEc4D6hcFBk/kTrjleBJTH ubLyToAcP7Qrd0LboN8UkSufAhxz7KRViBNRUzBQkC8qCG5vOE4SKlQs/1jycqGC3xnk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 15:24:13 +0000 commit be02aa3f4ac8461f02c469cbb653f6b49673a336 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374852.1622123 (Exim 4.92) (envelope-from ) id 1wojfN-0001T8-7y; Tue, 28 Jul 2026 15:24:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374852.1622123; Tue, 28 Jul 2026 15:24:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfN-0001T0-5E; Tue, 28 Jul 2026 15:24:25 +0000 Received: by outflank-mailman (input) for mailman id 1374852; Tue, 28 Jul 2026 15:24:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfL-0001St-PD for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojfM-00DUFt-06 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojfL-0097vv-2K for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=R0UOO8sTUADijdyyN+bRlYN/WyJY4yrErDgiZpm0qis=; b=l9GHM9yvGLheCEN5yfS5c9BVFQ obWWC8VI/5hIFnJrcdP+dHwlfVYe4P2JkAeC8B4/5wvczvSeHo+E/7g8M7AFGkFFO4PADr+4w8IOT SDX4yI2kRmY4oYp/Ows3PTzNJ1EsJw7fImU2shoCRrAR9ZZBPwooFO8Z3za0LWY5detY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 15:24:23 +0000 commit 96f4c9df247a0bff1abd64314c90e60f66de8776 Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:41:32 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374853.1622128 (Exim 4.92) (envelope-from ) id 1wojfX-0001Vb-At; Tue, 28 Jul 2026 15:24:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374853.1622128; Tue, 28 Jul 2026 15:24:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfX-0001VS-7v; Tue, 28 Jul 2026 15:24:35 +0000 Received: by outflank-mailman (input) for mailman id 1374853; Tue, 28 Jul 2026 15:24:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfV-0001VL-SO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojfW-00DUFz-0P for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojfV-0098WC-2e for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=gHtU4BSX5frp0mbsNd/ku5Q0mNGcLJLlYKX5V6CrXkc=; b=mkBTL9p/G09/Ca/zVxdeCHkQIb jaLBVBks1u6EEiJI441OUs7FBFjNoPmkWJkFjRm8jnRC4LgSzGbGcqjd2Ob342fCs19Hx3oGOadID gYcSgQV75qLGjn2WlqHs9HqOfiS+vrGkUZKhURsyUA/toJW5Yq3M3RAkOWwQf7ugSx4Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 15:24:33 +0000 commit d05f4c9832088eec1eaa144f15a01951d35452e6 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index b0d3082409..9dae1bc9ee 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -654,6 +660,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374854.1622131 (Exim 4.92) (envelope-from ) id 1wojfh-0001XW-Bg; Tue, 28 Jul 2026 15:24:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374854.1622131; Tue, 28 Jul 2026 15:24:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfh-0001XM-8z; Tue, 28 Jul 2026 15:24:45 +0000 Received: by outflank-mailman (input) for mailman id 1374854; Tue, 28 Jul 2026 15:24:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojff-0001XF-VY for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojfg-00DUG8-0j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojff-00999l-2w for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XtuDtEXDtoK4L8fLZaymULwOZ8Xh79yF+/6m2v/iWgg=; b=bXOVqBWecJ9YKxWv8slhRv6grH +JPOp07qzI7+JAKtEtw5qpqf9cDddpWvH+ovMWfi10xYR80a7W2ikA+Kvs+bnnN9CZh1wGLSqW1qd bE8k/mNZQHtlaSWZq2FpB07escfCItVQpiKUDxLRh8Jh+l6yqNeJO45rD+Cq8+xCjAVg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 15:24:43 +0000 commit 4314e6ded0188200c2f1ec9df463f464350e302e Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index fa2b9a2728..a6a898e7b9 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:24:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:24:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374855.1622135 (Exim 4.92) (envelope-from ) id 1wojfr-0001ZT-D1; Tue, 28 Jul 2026 15:24:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374855.1622135; Tue, 28 Jul 2026 15:24:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfr-0001ZK-AN; Tue, 28 Jul 2026 15:24:55 +0000 Received: by outflank-mailman (input) for mailman id 1374855; Tue, 28 Jul 2026 15:24:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojfq-0001ZE-2c for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojfq-00DUGC-14 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojfq-0099m7-03 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:24:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=RdZwLoiRWu0BOGgzUadUYvozyPy0SF+6WfZowBMqU9A=; b=Db4PfLeif0F5hj03UWi9l0vEWp nDOGH4gMAb2k9LUD3NASF6dlTCj847mhQ8fEZrXO2rhemsSKOuaM7Dxsd5JXMusUxeDZSJcpwsa49 WC30zQy5ckHwa3JxnZfq/wgzArtnWBvBhKgjIcNrtWSTMfA/nYTZvx6JcfL0azPmYwmg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 15:24:54 +0000 commit c42374a1052a20eac4ecfd38e32384b3b77eabd6 Author: Jan Beulich AuthorDate: Mon Jul 20 16:41:41 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:08:27 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 7db7ce9c3e..05822aec1d 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -275,6 +275,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374888.1622175 (Exim 4.92) (envelope-from ) id 1wojyN-0007nP-K4; Tue, 28 Jul 2026 15:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374888.1622175; Tue, 28 Jul 2026 15:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyN-0007nH-HL; Tue, 28 Jul 2026 15:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1374888; Tue, 28 Jul 2026 15:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyM-0007nB-EO for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojyM-00DUhf-29 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojyM-00AJct-17 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8N7/RrXqLpTwt8xFZw6hjkdl+4pio+y8/ExPaBcp78g=; b=RTX0cwBWr0/fvstEwMXrk3NjiT XFL72UHEbqOD/Zu8gS7/zuk0LEXn5j9yVrQnIZzqvt/ulNh68ANGQwj+IFX60sh7JovWEJyq/kh02 ltZUmkz3o6LafOlqT0riWA6MLUAwaxUnwKmh7QNb14yB1FgTK2I2NK0IfnTbeDctFTkQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] x86: SHADOW_PAGING is deprecated Message-Id: Date: Tue, 28 Jul 2026 15:44:02 +0000 commit 039ac56d18f67f2bc8943290e43b2fd08429a848 Author: Jan Beulich AuthorDate: Mon Jul 20 16:43:54 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86: SHADOW_PAGING is deprecated Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run. Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed. This is CVE-2026-42493 / XSA-495. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit f2cac32029e639a0974ca6752fbc3fafdd4f139a) --- SUPPORT.md | 12 +++++++++++- automation/gitlab-ci/build.yaml | 4 ++++ xen/arch/x86/Kconfig | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 27209cab7d..39e550e7a3 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -315,6 +315,16 @@ This is typically done by a guest kernel agent known as a "balloon driver". Status: Supported +### Shadow paging + +Allows fully virtualized guests (HVM / PVH) to be run without (host side) page +translation support by hardware (AMD: NPT, Intel: EPT). + +It is also required to migrate PV guests, and to allow L1TF-vulnerable guests +to continue to run without compromising host security. + + Status: Supported, not security supported + ### Populate-on-demand memory This is a mechanism that allows normal operating systems with only a balloon driver @@ -440,7 +450,7 @@ This feature is independent of the ARM "page granularity" feature (see below). Status, x86 HVM/PVH, HAP: Supported - Status, x86 HVM/PVH, Shadow, 2MiB: Supported + Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported Status, ARM: Supported On x86 in shadow mode, only 2MiB (L2) superpages are available; diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml index 201acbbffd..f22f149fe7 100644 --- a/automation/gitlab-ci/build.yaml +++ b/automation/gitlab-ci/build.yaml @@ -363,11 +363,15 @@ debian-stretch-gcc-debug: extends: .gcc-x86-64-build-debug variables: CONTAINER: debian:stretch + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y debian-bookworm-clang-debug: extends: .clang-x86-64-build-debug variables: CONTAINER: debian:bookworm + EXTRA_XEN_CONFIG: | + CONFIG_SHADOW_PAGING=y # Arm32 cross-build diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index 9611b80761..fb91ee4fa9 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -151,7 +151,6 @@ config XEN_IBT config SHADOW_PAGING bool "Shadow Paging" - default !PV_SHIM_EXCLUSIVE depends on PV || HVM ---help--- @@ -167,7 +166,8 @@ config SHADOW_PAGING Under a small number of specific workloads, shadow paging may be deliberately used as a performance optimisation. - If unsure, say Y. + NOTE: This feature is now deprecated. It is in particular no longer + security supported. config BIGMEM bool "big memory support" -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374889.1622180 (Exim 4.92) (envelope-from ) id 1wojyX-0007qQ-Lp; Tue, 28 Jul 2026 15:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374889.1622180; Tue, 28 Jul 2026 15:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyX-0007qG-Ih; Tue, 28 Jul 2026 15:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1374889; Tue, 28 Jul 2026 15:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyW-0007q8-HC for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojyW-00DUhm-2V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojyW-00AKHC-1R for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=/c9BOHmP3Wivqdc2Mx1yNVx+NrHp/7+Hs/0EKhDqUEU=; b=bC4yyr5dObFvWQePo1AoR9q9OH FWFKJj7Y9oRSMdMOAUexRCa+00i3XQKiDYnjqQ99jZzAh52WdZrpOv3yBjbF6OQZga89YLRIuwa9E bOMLJl8ZF4Wl24Rz5CMZKVotMWOvNJqSJdxwIKv1Nl/PJ4TOpxB5AujS5CLiZcsn8vvs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths Message-Id: Date: Tue, 28 Jul 2026 15:44:12 +0000 commit edf749b7c317b5491ae634899a06651c0a9165fc Author: Syed Abdul Khaliq AuthorDate: Mon Jul 20 16:43:57 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths The directory and Rock Ridge / SUSP walk in iso9660_dir() derives several lengths directly from attacker-controlled on-disk fields without validating them. libfsimage is used by pygrub, which parses the filesystem of an untrusted guest disk image from dom0, so these are reachable across a trust boundary. Five related problems are addressed: * The directory record loop advances by idr = (char *)idr + idr->length.l and only stops on length.l == 0. A record whose length is smaller than the fixed part of the on-disk layout cannot hold its own mandatory fields, yet the body still reads name_len/extent/size and computes the System Use area length from it. Require length to cover at least the fixed record (sizeof(*idr) - sizeof(idr->name)) before entering the body. This is CVE-2026-42494. * The System Use area length is computed before the inner loop as rr_len = idr->length.l - idr->name_len.l - sizeof(struct iso_directory_record) + sizeof(idr->name); in unsigned arithmetic. If length.l is smaller than name_len.l plus the fixed record size, rr_len underflows to a huge value and the whole SUSP walk runs off the directory buffer. Guard the subtraction and treat such records as having no System Use area. This is CVE-2026-42495. * Inside the loop, each entry is consumed with rr_len -= rr_ptr.rr->len; rr_ptr.ptr += rr_ptr.rr->len; with no lower or upper bound on the entry's own len byte. A len of 0 spins forever; a len greater than the remaining rr_len underflows it and walks past the buffer. Validate 4 <= len <= rr_len at the top of the loop and stop on violation: a structurally broken entry stream cannot be advanced reliably, so continuing is not meaningful. This is CVE-2026-62423. * The NM handler subtracted the 5-byte SUSP/NM header from len without a lower-bound check, underflowing name_len (the original report). The generic check above only guarantees len >= 4; NM has an extra flags byte, so keep an NM-specific len >= 5 check. This is CVE-2026-62424. * The CE continuation resets rr_ptr/rr_len from ce.offset and ce.size, both image-controlled, into the fixed single-sector RRCONT_BUF with no bounds check. Reject a window that does not fit in the buffer. This is CVE-2026-62425. This is XSA-497. Signed-off-by: Syed Abdul Khaliq Reviewed-by: Jan Beulich (cherry picked from commit fd11acab3db4e9162a284169956099490c32e919) --- tools/libfsimage/iso9660/fsys_iso9660.c | 61 ++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 9 deletions(-) diff --git a/tools/libfsimage/iso9660/fsys_iso9660.c b/tools/libfsimage/iso9660/fsys_iso9660.c index 6e767357bf..b1e543afd3 100644 --- a/tools/libfsimage/iso9660/fsys_iso9660.c +++ b/tools/libfsimage/iso9660/fsys_iso9660.c @@ -180,7 +180,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) extent++; idr = (struct iso_directory_record *)DIRREC; - for (; idr->length.l > 0; + /* + * length is taken verbatim from the (untrusted) image. A record + * shorter than the fixed part of the on-disk layout cannot hold its + * own mandatory fields (name_len, extent, size, ...), which the loop + * body reads below; stop the walk rather than dereference past it. + */ + for (; idr->length.l >= sizeof(*idr) - sizeof(idr->name) + && idr->length.l + >= sizeof(*idr) - sizeof(idr->name) + idr->name_len.l; idr = (struct iso_directory_record *)((char *)idr + idr->length.l) ) { const char *name = (const char *)idr->name; @@ -201,21 +209,39 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) } /* - * Parse Rock-Ridge extension + * Parse Rock-Ridge extension. + * + * length and name_len are taken verbatim from the (untrusted) + * image. Reject a record whose name would already overrun the + * fixed on-disk layout, so that the System Use area length does + * not underflow to a huge value below. */ - rr_len = (idr->length.l - idr->name_len.l - - sizeof(struct iso_directory_record) - + sizeof(idr->name)); + if (idr->length.l < idr->name_len.l + + sizeof(struct iso_directory_record) - sizeof(idr->name)) + rr_len = 0; + else + rr_len = (idr->length.l - idr->name_len.l + - sizeof(struct iso_directory_record) + + sizeof(idr->name)); rr_ptr.ptr = ((char *)idr + idr->name_len.l + sizeof(struct iso_directory_record) - sizeof(idr->name)); - if (rr_ptr.i & 1) + if ((rr_ptr.i & 1) && rr_len) rr_ptr.i++, rr_len--; ce_ptr = NULL; rr_flag = RR_FLAG_NM | RR_FLAG_PX /*| RR_FLAG_SL*/; while (rr_len >= 4) { + /* + * A SUSP entry is at least 4 bytes (signature, length, + * version) and must fit in the remaining System Use area. + * A shorter or overlong len is unparseable: stop, rather + * than spin forever (len == 0) or underflow rr_len in the + * advance below (len > rr_len). + */ + if (rr_ptr.rr->len < 4 || rr_ptr.rr->len > rr_len) + break; if (rr_ptr.rr->version != 1) { #ifndef STAGE1_5 @@ -236,9 +262,17 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) rr_flag &= rr_ptr.rr->u.rr.flags.l; break; case RRMAGIC('N', 'M'): - name = (const char *)rr_ptr.rr->u.nm.name; - name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); - rr_flag &= ~RR_FLAG_NM; + /* + * The generic check above only guarantees len >= 4; + * NM additionally has a flags byte, so len must be at + * least 5 for name_len not to underflow. + */ + if (rr_ptr.rr->len >= (4+sizeof(struct NM))) + { + name = (const char *)rr_ptr.rr->u.nm.name; + name_len = rr_ptr.rr->len - (4+sizeof(struct NM)); + rr_flag &= ~RR_FLAG_NM; + } break; case RRMAGIC('P', 'X'): if (rr_ptr.rr->len >= (4+sizeof(struct PX))) @@ -339,6 +373,15 @@ iso9660_dir (fsi_file_t *ffi, char *dirname) memcpy(NAME_BUF, name, name_len); name = (const char *)NAME_BUF; } + /* + * offset and size are image-controlled; the loaded + * continuation lives in a single-sector buffer. Bail + * out if the referenced window does not fit inside it. + */ + if (ce_ptr->u.ce.offset.l >= ISO_SECTOR_SIZE + || ce_ptr->u.ce.size.l + > ISO_SECTOR_SIZE - ce_ptr->u.ce.offset.l) + break; rr_ptr.ptr = (char *)RRCONT_BUF + ce_ptr->u.ce.offset.l; rr_len = ce_ptr->u.ce.size.l; if (!iso9660_devread(ffi, ce_ptr->u.ce.extent.l, 0, ISO_SECTOR_SIZE, (char *)RRCONT_BUF)) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374890.1622185 (Exim 4.92) (envelope-from ) id 1wojyh-0007tl-NQ; Tue, 28 Jul 2026 15:44:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374890.1622185; Tue, 28 Jul 2026 15:44:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyh-0007td-K3; Tue, 28 Jul 2026 15:44:23 +0000 Received: by outflank-mailman (input) for mailman id 1374890; Tue, 28 Jul 2026 15:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyg-0007tW-Ki for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojyg-00DUhq-2r for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojyg-00AKte-1q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=6IaigzZ3RjRF/tTtmrVCgE3UYZlILJsVqQ/XAQ29r3A=; b=YZQrwOTOEK9GnIF00fBl4yGGLv jxiykC+WSOSwhBr9/YkStQSV+F2D7o8Gg5sRaMXbHDnoybiNmlnUotqfPdL3n8fVxfsUt8wojVf8P nGsCwfVBrhdu9g7wH92lobDyLLT+xmmZtozoD3kqc+afQPgluSgyPGmqFNKNAiw/GRC0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] platform-op/XSM: move resource-{,un}plug-core checks Message-Id: Date: Tue, 28 Jul 2026 15:44:22 +0000 commit f1f45c8c32905fbecaddf0d08691dd7bf132a38f Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 platform-op/XSM: move resource-{,un}plug-core checks Integrate the checking with flask_platform_op(); there never really was a need to defer these checks, as the sub-op has always been known to the function. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is CVE-2026-62427 / part of XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9) --- xen/arch/x86/platform_hypercall.c | 18 +----------------- xen/xsm/flask/hooks.c | 7 ++++--- 2 files changed, 5 insertions(+), 20 deletions(-) diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index f2fcd8afaf..8c4076b6a5 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -673,10 +673,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu >= nr_cpu_ids || !cpu_present(cpu) || clocksource_is_tsc() ) { @@ -699,10 +695,6 @@ ret_t do_platform_op( { int cpu = op->u.cpu_ol.cpuid; - ret = xsm_resource_unplug_core(XSM_HOOK); - if ( ret ) - break; - if ( cpu == 0 ) { ret = -EOPNOTSUPP; @@ -728,20 +720,12 @@ ret_t do_platform_op( break; case XENPF_cpu_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = cpu_add(op->u.cpu_add.apic_id, op->u.cpu_add.acpi_id, op->u.cpu_add.pxm); - break; + break; case XENPF_mem_hotadd: - ret = xsm_resource_plug_core(XSM_HOOK); - if ( ret ) - break; - ret = memory_add(op->u.mem_add.spfn, op->u.mem_add.epfn, op->u.mem_add.pxm); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d8e2b12b14..6aebad3193 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1554,12 +1554,13 @@ static int cf_check flask_platform_op(uint32_t op) switch ( op ) { #ifdef CONFIG_X86 - /* These operations have their own XSM hooks */ case XENPF_cpu_online: - case XENPF_cpu_offline: case XENPF_cpu_hotadd: case XENPF_mem_hotadd: - return 0; + return flask_resource_plug_core(); + + case XENPF_cpu_offline: + return flask_resource_unplug_core(); #endif case XENPF_settime32: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374891.1622188 (Exim 4.92) (envelope-from ) id 1wojyr-0007w9-Px; Tue, 28 Jul 2026 15:44:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374891.1622188; Tue, 28 Jul 2026 15:44:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyr-0007w1-Mk; Tue, 28 Jul 2026 15:44:33 +0000 Received: by outflank-mailman (input) for mailman id 1374891; Tue, 28 Jul 2026 15:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojyq-0007vv-Nu for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojyq-00DUhw-3B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojyq-00ALYh-2B for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dYWE3G06WGjG26Vg1pnrL3OGF8xFKOCgMcy0J+N1jxI=; b=UB3+WRMLGGUrIGpW09Sa3CuvO0 IBF8+ldHBRyY/0yqta+brZ1hA8SwH45Obc6Yk7tAJmCZaU8LrnyNAzbecS/SmWwtyYlfhYOJv1CGB gZg0cAVTU3jyyKcKAgcPpyr6slx8ABn9MSzeKYa6jzOLbS/igy2ANDISg5hjod7J9BSs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Message-Id: Date: Tue, 28 Jul 2026 15:44:32 +0000 commit 9379292ea6e083f0784ab06dc04b47a6ae6bc45a Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 2d04a9e161..5844c52056 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 718d3c4a2a..600b6c71e0 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index bf6d4e9772..32f1fbb1ed 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -239,9 +239,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6aebad3193..7b324e115d 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -892,9 +892,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -966,7 +966,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:43 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374892.1622192 (Exim 4.92) (envelope-from ) id 1wojz1-0007z9-Rq; Tue, 28 Jul 2026 15:44:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374892.1622192; Tue, 28 Jul 2026 15:44:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojz1-0007z1-O8; Tue, 28 Jul 2026 15:44:43 +0000 Received: by outflank-mailman (input) for mailman id 1374892; Tue, 28 Jul 2026 15:44:42 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojz0-0007yu-R9 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:42 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojz1-00DUi2-0I for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:42 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojz0-00AMDm-2W for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:42 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=csrVzguIbaAz6AjOrI1frCjFtKKjW9yLkFMS3stc/g0=; b=nDICpn1DloAp3c6BId4VPNjXCl JqW5cB2Bl27bEjzB5jUTA1tZWw7Z+lPfDrAsABX6NW19Yo5d7SjBY5BGrPwLIF50fj/N/WpraGC5A cWJfkba7LeRJiUTusEm3/UAhIZashcBmUBG/cThPN8NLUhKDsI+Zf2Jzp4LIE1KEszek=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/XSM: drop .scheduler_op() hook Message-Id: Date: Tue, 28 Jul 2026 15:44:42 +0000 commit 6e3958276720083e713c377e01e62d8a66572ed6 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .scheduler_op() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5) --- xen/common/sched/core.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 7 ++++--- 5 files changed, 4 insertions(+), 20 deletions(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 89de385a6f..e4b7228449 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op) struct cpupool *pool; int rc; - rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd); - if ( rc ) - return rc; - if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) && (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) ) return -EINVAL; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 600b6c71e0..54b50e9a46 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 32f1fbb1ed..25469378ae 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -57,7 +57,6 @@ struct xsm_ops { struct xen_domctl_getdomaininfo *info); int (*domain_create)(struct domain *d, uint32_t ssidref); int (*getdomaininfo)(struct domain *d); - int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); @@ -222,11 +221,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d) return alternative_call(xsm_ops.getdomaininfo, d); } -static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd) -{ - return alternative_call(xsm_ops.sysctl_scheduler_op, cmd); -} - static inline int xsm_set_target( xsm_default_t def, struct domain *d, struct domain *e) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 92fe9664a8..99c68e403a 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .security_domaininfo = xsm_security_domaininfo, .domain_create = xsm_domain_create, .getdomaininfo = xsm_getdomaininfo, - .sysctl_scheduler_op = xsm_sysctl_scheduler_op, .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 7b324e115d..de0fdecb6e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int cf_check flask_sysctl_scheduler_op(int op) +static int flask_sysctl_scheduler_op(unsigned int op) { switch ( op ) { @@ -900,7 +900,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_readconsole: case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: - case XEN_SYSCTL_scheduler_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif @@ -936,6 +935,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_cpupool_op: return domain_has_xen(current->domain, XEN__CPUPOOL_OP); + case XEN_SYSCTL_scheduler_op: + return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd); + case XEN_SYSCTL_physinfo: case XEN_SYSCTL_cputopoinfo: case XEN_SYSCTL_numainfo: @@ -1902,7 +1904,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, .getdomaininfo = flask_getdomaininfo, - .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:44:53 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:44:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374893.1622195 (Exim 4.92) (envelope-from ) id 1wojzB-000814-S5; Tue, 28 Jul 2026 15:44:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374893.1622195; Tue, 28 Jul 2026 15:44:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzB-00080w-PX; Tue, 28 Jul 2026 15:44:53 +0000 Received: by outflank-mailman (input) for mailman id 1374893; Tue, 28 Jul 2026 15:44:52 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzA-00080q-UZ for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:52 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzB-00DUiC-0d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:52 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzA-00AMqW-2q for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:44:52 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TdZAzysP8ymuRDlPu4HO3gJ9EZJ8rnEuvNeYro4c9gA=; b=K8M3sIcTi1xEc0gFt1C/Z7APT4 MoQLZkgWa/QETfg8bdCbebjQO/XDIOBwhk19Tm/ER/jL6LHV6VPZo/Q9z9fKyoaPdN02/wgSibK0c roV2EFmkxLkYM9Rqo6RF9P6k0eOwfvGNVoCEuWv+oNXwXJcf3nJM2NVFq7hxD14TClA4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist Message-Id: Date: Tue, 28 Jul 2026 15:44:52 +0000 commit ae8dbf96a322c0dac6d3a5bd41f5067cabb0acb1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ba9e91d302..b5adc7dd16 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index de0fdecb6e..b21f379a84 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -898,7 +898,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -945,6 +944,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374894.1622199 (Exim 4.92) (envelope-from ) id 1wojzM-000831-TP; Tue, 28 Jul 2026 15:45:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374894.1622199; Tue, 28 Jul 2026 15:45:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzM-00082t-Qp; Tue, 28 Jul 2026 15:45:04 +0000 Received: by outflank-mailman (input) for mailman id 1374894; Tue, 28 Jul 2026 15:45:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzL-00082k-2T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzL-00DUix-12 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzK-00ANU8-3D for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=R9SHjzrzsEbSXnlKrxcgXABhrIG0+X3duxVriRZGLCg=; b=fAappN6icv7BFMqo6SUJhJv1x2 vDk6tJESMtPdt1vHB/SS9McT9QTWKP5qtQkkYjum6sz1i4xNMyfcSzOgvqp1/SFIz6lxL97awvZ/N l7vZV8mn4z+uggeFlq0iOFLjtJgl7hKk1QUDe46RXKklxIOPa9+Cj+MR0nQPYt+L2p8Q=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/XSM: drop .readconsole() hook Message-Id: Date: Tue, 28 Jul 2026 15:45:02 +0000 commit e40cb27ee4fb7b794e605cd881185cb33ce6cbd7 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .readconsole() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 4b249cba4b25ad1b5c86bf3b2ff9cc685b47fa67) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 18 ++++++------------ 5 files changed, 6 insertions(+), 29 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5844c52056..011def5bb2 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -59,10 +59,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) switch ( op->cmd ) { case XEN_SYSCTL_readconsole: - ret = xsm_readconsole(XSM_HOOK, op->u.readconsole.clear); - if ( ret ) - break; - ret = read_console_ring(&op->u.readconsole); break; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 54b50e9a46..aacef701a9 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -179,12 +179,6 @@ static XSM_INLINE int cf_check xsm_sysctl( return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 25469378ae..87e277aa38 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,6 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); int (*sysctl)(const struct xen_sysctl *op); - int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1, @@ -238,11 +237,6 @@ static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) return alternative_call(xsm_ops.sysctl, op); } -static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) -{ - return alternative_call(xsm_ops.readconsole, clear); -} - static inline int xsm_evtchn_unbound( xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 99c68e403a..97c06ee522 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -21,7 +21,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .set_target = xsm_set_target, .domctl = xsm_domctl, .sysctl = xsm_sysctl, - .readconsole = xsm_readconsole, .evtchn_unbound = xsm_evtchn_unbound, .evtchn_interdomain = xsm_evtchn_interdomain, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b21f379a84..654b8afbea 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -897,13 +897,18 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) switch ( op->cmd ) { /* These have individual XSM hooks */ - case XEN_SYSCTL_readconsole: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: #endif return 0; + case XEN_SYSCTL_readconsole: + return domain_has_xen(current->domain, + XEN__READCONSOLE | + (op->u.readconsole.clear ? XEN__CLEARCONSOLE + : 0)); + case XEN_SYSCTL_tbuf_op: return domain_has_xen(current->domain, XEN__TBUFCONTROL); @@ -974,16 +979,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) } } -static int cf_check flask_readconsole(uint32_t clear) -{ - uint32_t perms = XEN__READCONSOLE; - - if ( clear ) - perms |= XEN__CLEARCONSOLE; - - return domain_has_xen(current->domain, perms); -} - static inline uint32_t resource_to_perm(uint8_t access) { if ( access ) @@ -1909,7 +1904,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .set_target = flask_set_target, .domctl = flask_domctl, .sysctl = flask_sysctl, - .readconsole = flask_readconsole, .evtchn_unbound = flask_evtchn_unbound, .evtchn_interdomain = flask_evtchn_interdomain, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374895.1622203 (Exim 4.92) (envelope-from ) id 1wojzW-000861-V9; Tue, 28 Jul 2026 15:45:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374895.1622203; Tue, 28 Jul 2026 15:45:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzW-00085u-SO; Tue, 28 Jul 2026 15:45:14 +0000 Received: by outflank-mailman (input) for mailman id 1374895; Tue, 28 Jul 2026 15:45:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzV-00085l-5t for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzV-00DUks-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzV-00AO3s-0N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=DZzyx8rgtsk0tY86ElfadSQbzkWOCHXt9daTOFwoblk=; b=fkqLZ5/q00QhgAVvRV+UKEqBiK 2jz3OSKo6JdHHvTP9C+utzLB2NuhHzIguYKeRf/Dwt4to8J4bF5Lqkmh0Dc1BuB+ZQtCZztamkj2E ktODGUtvBKp9TcUyozZTjwjHc+UlUeBgzCWj/dvLhomgIzGpt0l6vnx2nDeMYtICn4l8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/XSM: drop .resource_{,un}plug_core() hooks Message-Id: Date: Tue, 28 Jul 2026 15:45:13 +0000 commit 237dd170340bd9dd6d73ef8513fd5b017acb7b91 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .resource_{,un}plug_core() hooks Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. Note that these were x86- only, i.e. some dead/unreachable code gets eliminated for (in particular) Arm. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 0501e1dc047768cba2a458b25f5e9214726c33c8) --- xen/arch/x86/sysctl.c | 10 +--------- xen/include/xsm/dummy.h | 12 ------------ xen/include/xsm/xsm.h | 12 ------------ xen/xsm/dummy.c | 2 -- xen/xsm/flask/hooks.c | 29 ++++++++++++++++++++++------- 5 files changed, 23 insertions(+), 42 deletions(-) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index c107f40c62..2c6483d903 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -117,20 +117,17 @@ long arch_do_sysctl( { unsigned int cpu = sysctl->u.cpu_hotplug.cpu; unsigned int op = sysctl->u.cpu_hotplug.op; - bool plug; long (*fn)(void *); void *hcpu; switch ( op ) { case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: - plug = true; fn = cpu_up_helper; hcpu = _p(cpu); break; case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: - plug = false; fn = cpu_down_helper; hcpu = _p(cpu); break; @@ -150,9 +147,8 @@ long arch_do_sysctl( if ( CONFIG_NR_CPUS <= 1 ) /* Mimic behavior of smt_up_down_helper(). */ return 0; - plug = op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE; fn = smt_up_down_helper; - hcpu = _p(plug); + hcpu = _p(op == XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE); break; default: @@ -160,10 +156,6 @@ long arch_do_sysctl( break; } - if ( !ret ) - ret = plug ? xsm_resource_plug_core(XSM_HOOK) - : xsm_resource_unplug_core(XSM_HOOK); - if ( !ret ) ret = continue_hypercall_on_cpu(0, fn, hcpu); } diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index aacef701a9..b96483d0d8 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -395,18 +395,6 @@ static XSM_INLINE int cf_check xsm_get_device_group( } #endif /* HAS_PASSTHROUGH && HAS_PCI */ -static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - -static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 87e277aa38..b5d4e9fe43 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -123,8 +123,6 @@ struct xsm_ops { int (*get_device_group)(uint32_t machine_bdf); #endif - int (*resource_plug_core)(void); - int (*resource_unplug_core)(void); int (*resource_plug_pci)(uint32_t machine_bdf); int (*resource_unplug_pci)(uint32_t machine_bdf); int (*resource_setup_pci)(uint32_t machine_bdf); @@ -508,16 +506,6 @@ static inline int xsm_resource_unplug_pci( return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf); } -static inline int xsm_resource_plug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_plug_core); -} - -static inline int xsm_resource_unplug_core(xsm_default_t def) -{ - return alternative_call(xsm_ops.resource_unplug_core); -} - static inline int xsm_resource_setup_pci( xsm_default_t def, uint32_t machine_bdf) { diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 97c06ee522..bb38d6023d 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -77,8 +77,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .get_device_group = xsm_get_device_group, #endif - .resource_plug_core = xsm_resource_plug_core, - .resource_unplug_core = xsm_resource_unplug_core, .resource_plug_pci = xsm_resource_plug_pci, .resource_unplug_pci = xsm_resource_unplug_pci, .resource_setup_pci = xsm_resource_setup_pci, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 654b8afbea..03d9b8e60f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -56,6 +56,9 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); #endif #endif /* CONFIG_HAS_PASSTHROUGH */ +static int flask_resource_plug_core(void); +static int flask_resource_unplug_core(void); + static uint32_t domain_sid(const struct domain *dom) { struct domain_security_struct *dsec = dom->ssid; @@ -898,9 +901,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_page_offline_op: -#ifdef CONFIG_X86 - case XEN_SYSCTL_cpu_hotplug: -#endif return 0; case XEN_SYSCTL_readconsole: @@ -952,6 +952,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_getdomaininfolist: return flask_getdomaininfo(dom_xen); +#ifdef CONFIG_X86 + case XEN_SYSCTL_cpu_hotplug: + switch ( op->u.cpu_hotplug.op ) + { + case XEN_SYSCTL_CPU_HOTPLUG_ONLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_ENABLE: + return flask_resource_plug_core(); + + case XEN_SYSCTL_CPU_HOTPLUG_OFFLINE: + case XEN_SYSCTL_CPU_HOTPLUG_SMT_DISABLE: + return flask_resource_unplug_core(); + + default: + return avc_unknown_permission("cpu_hotplug", op->u.cpu_hotplug.op); + } +#endif + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); @@ -1229,12 +1246,12 @@ static int cf_check flask_pci_config_permission( } -static int cf_check flask_resource_plug_core(void) +static int flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int cf_check flask_resource_unplug_core(void) +static int flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1955,8 +1972,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .iomem_mapping_vpci = flask_iomem_mapping, .pci_config_permission = flask_pci_config_permission, - .resource_plug_core = flask_resource_plug_core, - .resource_unplug_core = flask_resource_unplug_core, .resource_plug_pci = flask_resource_plug_pci, .resource_unplug_pci = flask_resource_unplug_pci, .resource_setup_pci = flask_resource_setup_pci, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374896.1622206 (Exim 4.92) (envelope-from ) id 1wojzh-00089K-1q; Tue, 28 Jul 2026 15:45:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374896.1622206; Tue, 28 Jul 2026 15:45:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzg-00089C-VS; Tue, 28 Jul 2026 15:45:24 +0000 Received: by outflank-mailman (input) for mailman id 1374896; Tue, 28 Jul 2026 15:45:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzf-00088z-8z for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzf-00DUmZ-1h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzf-00AOm4-0h for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GJfuiIQmVldHWp2NdA0PkmTHzA2BssXJlYwp2p+BLnM=; b=Wy0XYsX9/bNzIAGVWlS8yt9fgi GdZo+FHmNV6g/FFsjZSLIdlAeswl2ggDgbjbXGqIXGRqCvIjJCaqtFB+GaG+fajPpyF77A+pZGSbN ActcLQFF0MzHnkz/7NeDDQtuKs6XmDljdjonRCKoVjcf8t44wCd9JlzaLpl4K35nXqZU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] sysctl/XSM: drop .page_offline() hook Message-Id: Date: Tue, 28 Jul 2026 15:45:23 +0000 commit c8d10a8e171ed675283246fe39dbb3b7331139e2 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:12 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 sysctl/XSM: drop .page_offline() hook Integrate the checking with xsm_sysctl(), now that it has the full op struct passed. As a positive side effect, permissions are then checked at the same early point with and without Flask. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-By: Daniel P. Smith (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a) --- xen/common/sysctl.c | 4 ---- xen/include/xsm/dummy.h | 6 ------ xen/include/xsm/xsm.h | 6 ------ xen/xsm/dummy.c | 1 - xen/xsm/flask/hooks.c | 38 ++++++++++++++++++-------------------- 5 files changed, 18 insertions(+), 37 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 011def5bb2..95c66a70eb 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->u.page_offline.end < op->u.page_offline.start ) break; - ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd); - if ( ret ) - break; - ptr = status = xmalloc_array(uint32_t, (op->u.page_offline.end - op->u.page_offline.start + 1)); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b96483d0d8..d5cea513c1 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -428,12 +428,6 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) -{ - XSM_ASSERT_ACTION(XSM_HOOK); - return xsm_default_action(action, current->domain, NULL); -} - static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index b5d4e9fe43..193f68c88e 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -129,7 +129,6 @@ struct xsm_ops { int (*resource_setup_gsi)(int gsi); int (*resource_setup_misc)(void); - int (*page_offline)(uint32_t cmd); int (*hypfs_op)(void); long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op); @@ -522,11 +521,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t def) return alternative_call(xsm_ops.resource_setup_misc); } -static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd) -{ - return alternative_call(xsm_ops.page_offline, cmd); -} - static inline int xsm_hypfs_op(xsm_default_t def) { return alternative_call(xsm_ops.hypfs_op); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index bb38d6023d..6cc38673d7 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = { .resource_setup_gsi = xsm_resource_setup_gsi, .resource_setup_misc = xsm_resource_setup_misc, - .page_offline = xsm_page_offline, .hypfs_op = xsm_hypfs_op, .hvm_param = xsm_hvm_param, .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm, diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 03d9b8e60f..e3e94274ca 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath); static int flask_resource_plug_core(void); static int flask_resource_unplug_core(void); +static int flask_resource_use_core(void); static uint32_t domain_sid(const struct domain *dom) { @@ -899,10 +900,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { switch ( op->cmd ) { - /* These have individual XSM hooks */ - case XEN_SYSCTL_page_offline_op: - return 0; - case XEN_SYSCTL_readconsole: return domain_has_xen(current->domain, XEN__READCONSOLE | @@ -933,6 +930,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_pm_op: return domain_has_xen(current->domain, XEN__PM_OP); + case XEN_SYSCTL_page_offline_op: + switch ( op->u.page_offline.cmd ) + { + case sysctl_page_offline: + return flask_resource_unplug_core(); + + case sysctl_page_online: + return flask_resource_plug_core(); + + case sysctl_query_page_offline: + return flask_resource_use_core(); + + default: + return avc_unknown_permission("page_offline", + op->u.page_offline.cmd); + } + case XEN_SYSCTL_lockprof_op: return domain_has_xen(current->domain, XEN__LOCKPROF); @@ -1324,21 +1338,6 @@ static int cf_check flask_resource_setup_misc(void) return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int cf_check flask_page_offline(uint32_t cmd) -{ - switch ( cmd ) - { - case sysctl_page_offline: - return flask_resource_unplug_core(); - case sysctl_page_online: - return flask_resource_plug_core(); - case sysctl_query_page_offline: - return flask_resource_use_core(); - default: - return avc_unknown_permission("page_offline", cmd); - } -} - static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); @@ -1978,7 +1977,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = { .resource_setup_gsi = flask_resource_setup_gsi, .resource_setup_misc = flask_resource_setup_misc, - .page_offline = flask_page_offline, .hypfs_op = flask_hypfs_op, .hvm_param = flask_hvm_param, .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374897.1622211 (Exim 4.92) (envelope-from ) id 1wojzr-0008Bw-3M; Tue, 28 Jul 2026 15:45:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374897.1622211; Tue, 28 Jul 2026 15:45:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzr-0008Bq-0X; Tue, 28 Jul 2026 15:45:35 +0000 Received: by outflank-mailman (input) for mailman id 1374897; Tue, 28 Jul 2026 15:45:33 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzp-0008BY-CB for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:33 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzp-00DUmd-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzp-00APR9-11 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7J1zLleVgjJSdQIk3iYsB8kCirhih6/hGfTmy+NSzQ8=; b=QWGRpC5b5EwCE0cfrwXY7ZsnXt f2zk3VCD4rnsKP+uWt4tJO/Onq2wICenhp1dK4Kudg7AmiiFQ6GrdCXyWjsYtv0puuVVFcIhmDAFB 9ws5AL+S0cj9/Z8C8WQWN3o1pUAU1m8+LzkfuNn80jEV+aJLsyva1U5T5KInlMGPPC74=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] gnttab: check values against active entry when copying an already-pinned one Message-Id: Date: Tue, 28 Jul 2026 15:45:33 +0000 commit 82b09c158e62c68c7fd701e1cd2592bfaf838cab Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:17 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 gnttab: check values against active entry when copying an already-pinned one acquire_grant_for_copy() passes to its caller both an MFN and a struct page_info *. The two really need to be in sync for the get_page() underlying get_paged_frame() and get_page_type() (both acting on the passed back struct page_info *) and the map_domain_page() (acting on the passed back MFN) to achieve the intended effect. Go further and also check other properties: GTF_transitive / GTF_sub_page may have been flipped in the shared entry, so respective fields / values also may not match. The one field which we can be sure does match (as it was checked earlier in the function) is ->domid. Add an assertion nevertheless. This is CVE-2026-62428 / XSA-500. Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of get_gfn()/put_gfn") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e) --- xen/common/grant_table.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 1b7ff1d316..7042768437 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2802,6 +2802,21 @@ acquire_grant_for_copy( act->trans_gref = trans_gref; act->mfn = grant_mfn; } + else if ( !mfn_eq(act->mfn, grant_mfn) || + act->src_domid != td->domain_id || + act->trans_gref != trans_gref || + (act->is_sub_page && + (!is_sub_page || + act->start != trans_page_off || + act->length != trans_length)) ) + { + put_page(*page); + *page = NULL; + rc = GNTST_general_error; + goto unlock_out_clear; + } + else + ASSERT(act->domid == ldom); } else { -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374898.1622215 (Exim 4.92) (envelope-from ) id 1wok01-0008ET-4g; Tue, 28 Jul 2026 15:45:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374898.1622215; Tue, 28 Jul 2026 15:45:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok01-0008EK-1p; Tue, 28 Jul 2026 15:45:45 +0000 Received: by outflank-mailman (input) for mailman id 1374898; Tue, 28 Jul 2026 15:45:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wojzz-0008E7-Fl for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wojzz-00DUmm-2O for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wojzz-00AQ6K-1N for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hIIKw68nTs/Hr2SwBXxN0QP3yBTfiBwN/+AXFVIS6Sw=; b=mX45ugZbeR2cyooD9GhzPaUMkF kmGbCXr1g56+xyUr9gJR6D0mdQQs4tb2J18AeNBxJkGxXsTb78WbdB6/V6oprHISJ5glmGeJ3YLva h28ttdNM4HfnTUdmvBTK9T20FC9xfSascT8BeKfzFnV97oAfGvBs6JYGDXdVok3JY2xI=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] gnttab: cope with version changes racing other operations Message-Id: Date: Tue, 28 Jul 2026 15:45:43 +0000 commit 064877fc3ffb38cde12ca3deacd8b0427aedaf5e Author: Jan Beulich AuthorDate: Tue Jul 28 12:54:20 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 gnttab: cope with version changes racing other operations Dropping and re-acquiring the grant table lock for a particular operation requires special care, as in the meantime the grant table version can change. During a v2 -> v1 change, status frames going away means that pre- calculated status pointers go stale, referencing freed (and possibly already re-used) memory. Record in-flight v2 operations, permitting the version change only when there are none of them. Recalculate "status" in the one place (map_grant_ref()'s error path) where it could be stale, but confine this to reserved entries. This is CVE-2026-62436. Reported-by: Mark Esler During a v1 -> v2 change, the number of shared table entries reduces, meaning that previously validated grant references may now be out of bounds. Because of the checking of pin counts in gnttab_set_version() (with the grant table lock held for writing), for now-out-of-bounds gref-s neither active mappings can exist, nor can there be in-progress copy operations. Nevertheless bounds checks are added there, just to be on the safe side. For gnttab_transfer(), to cover the gap between the lock being dropped by gnttab_prepare_for_transfer() and it being re-acquired, have the helper return the version it found, and fail the operation if the version turns out to have changed after re-acquiring the lock. Further avoid needless use of shared_entry_header(), as it involves pointer arithmetic which, when using an out-of-bounds ref, is UB. This is CVE-2026-62435. Everything together is XSA-501. Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure") Signed-off-by: Jan Beulich Tested-by: Mark Esler Reviewed-by: Andrew Cooper (cherry picked from commit 96dfeb41774ab50c74a01483726db8bb17a31a69) --- xen/common/grant_table.c | 93 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 20 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 7042768437..21d7647a8f 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -71,6 +71,10 @@ struct grant_table { unsigned int nr_grant_frames; /* Number of grant status frames shared with guest (for version 2) */ unsigned int nr_status_frames; + + /* Number of version 2 operations in progress. */ + atomic_t nr_v2_ops; + /* * Number of available maptrack entries. For cleanup purposes it is * important to realize that this field and @maptrack further down will @@ -933,6 +937,9 @@ static void reduce_status_for_pin(struct domain *rd, { unsigned int clear_flags = act->pin ? 0 : GTF_reading; + if ( unlikely(!status) ) + return; + if ( !readonly && !(act->pin & (GNTPIN_hstw_mask | GNTPIN_devw_mask)) ) clear_flags |= GTF_writing; @@ -1341,6 +1348,22 @@ map_grant_ref( grant_read_lock(rgt); + if ( unlikely(evaluate_nospec((rgt->gt_version == 1) != + (status == &shah->flags))) ) + { + /* + * After a v1 -> v2 change behind our backs "ref" may now be out of + * bounds. Recalculate it, but only for reserved entries. Others + * will have been cleared anyway by the version change. + */ + if ( ref < GNTTAB_NR_RESERVED_ENTRIES ) + status = evaluate_nospec(rgt->gt_version == 1) + ? &shah->flags + : &status_entry(rgt, ref); + else + status = NULL; + } + act = active_entry_acquire(rgt, op->ref); act->pin -= pin_incr; @@ -1584,9 +1607,8 @@ unmap_common_complete(struct gnttab_unmap_common *op) struct domain *ld, *rd = op->rd; struct grant_table *rgt; struct active_grant_entry *act; - grant_entry_header_t *sha; struct page_info *pg; - uint16_t *status; + uint16_t *status = NULL; if ( evaluate_nospec(!op->done) ) { @@ -1602,11 +1624,10 @@ unmap_common_complete(struct gnttab_unmap_common *op) grant_read_lock(rgt); act = active_entry_acquire(rgt, op->ref); - sha = shared_entry_header(rgt, op->ref); if ( evaluate_nospec(rgt->gt_version == 1) ) - status = &sha->flags; - else + status = &shared_entry_v1(rgt, op->ref).flags; + else if ( evaluate_nospec(op->ref < nr_grant_entries(rgt)) ) status = &status_entry(rgt, op->ref); pg = !is_iomem_page(act->mfn) ? mfn_to_page(op->mfn) : NULL; @@ -2194,14 +2215,14 @@ gnttab_query_size( * Check that the given grant reference (rd,ref) allows 'ld' to transfer * ownership of a page frame. If so, lock down the grant entry. */ -static int +static unsigned int gnttab_prepare_for_transfer( struct domain *rd, struct domain *ld, grant_ref_t ref) { struct grant_table *rgt = rd->grant_table; uint32_t *raw_shah; union grant_combo scombo; - int retries = 0; + unsigned int retries = 0, ver; grant_read_lock(rgt); @@ -2246,8 +2267,11 @@ gnttab_prepare_for_transfer( scombo = prev; } + ver = rgt->gt_version; + grant_read_unlock(rgt); - return 1; + + return ver; fail: grant_read_unlock(rgt); @@ -2272,7 +2296,7 @@ gnttab_transfer( for ( i = 0; i < count; i++ ) { - bool_t okay; + unsigned int ver; int rc; if ( i && hypercall_preempt_check() ) @@ -2412,14 +2436,14 @@ gnttab_transfer( * pagelist. */ spin_unlock(&e->page_alloc_lock); - okay = gnttab_prepare_for_transfer(e, d, gop.ref); + ver = gnttab_prepare_for_transfer(e, d, gop.ref); /* * Make sure the reference bound check in gnttab_prepare_for_transfer * is respected and speculative execution is blocked accordingly */ - if ( unlikely(!evaluate_nospec(okay)) || - unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) + if ( unlikely(!evaluate_nospec(ver)) || + unlikely(assign_pages(page, 1, e, MEMF_no_refcount)) ) { bool drop_dom_ref; @@ -2431,7 +2455,7 @@ gnttab_transfer( drop_dom_ref = !domain_adjust_tot_pages(e, -1); spin_unlock(&e->page_alloc_lock); - if ( okay /* i.e. e->is_dying due to the surrounding if() */ ) + if ( ver /* i.e. e->is_dying due to the surrounding if() */ ) gdprintk(XENLOG_INFO, "Transferee d%d is now dying\n", e->domain_id); @@ -2451,7 +2475,13 @@ gnttab_transfer( grant_read_lock(e->grant_table); act = active_entry_acquire(e->grant_table, gop.ref); - if ( evaluate_nospec(e->grant_table->gt_version == 1) ) + if ( unlikely(evaluate_nospec(e->grant_table->gt_version != ver)) ) + { + rc = -EILSEQ; + goto release; + } + + if ( evaluate_nospec(ver == 1) ) { grant_entry_v1_t *sha = &shared_entry_v1(e->grant_table, gop.ref); @@ -2471,6 +2501,7 @@ gnttab_transfer( shared_entry_header(e->grant_table, gop.ref)->flags |= GTF_transfer_completed; + release: active_entry_release(act); grant_read_unlock(e->grant_table); @@ -2499,28 +2530,27 @@ release_grant_for_copy( struct domain *rd, grant_ref_t gref, bool readonly) { struct grant_table *rgt = rd->grant_table; - grant_entry_header_t *sha; struct active_grant_entry *act; mfn_t mfn; - uint16_t *status; + uint16_t *status = NULL; grant_ref_t trans_gref; struct domain *td; grant_read_lock(rgt); act = active_entry_acquire(rgt, gref); - sha = shared_entry_header(rgt, gref); mfn = act->mfn; if ( evaluate_nospec(rgt->gt_version == 1) ) { - status = &sha->flags; + status = &shared_entry_v1(rgt, gref).flags; td = rd; trans_gref = gref; } else { - status = &status_entry(rgt, gref); + if ( evaluate_nospec(gref < nr_grant_entries(rgt)) ) + status = &status_entry(rgt, gref); td = (act->src_domid == rd->domain_id) ? rd : knownalive_domain_from_domid(act->src_domid); trans_gref = act->trans_gref; @@ -2539,6 +2569,9 @@ release_grant_for_copy( reduce_status_for_pin(rd, act, status, readonly); + if ( !act->pin && act->is_sub_page ) + atomic_dec(&rgt->nr_v2_ops); + active_entry_release(act); grant_read_unlock(rgt); @@ -2670,8 +2703,10 @@ acquire_grant_for_copy( /* * acquire_grant_for_copy() will take the lock on the remote table, - * so we have to drop the lock here and reacquire. + * so we have to drop the lock here and reacquire. Before doing so, + * record that a v2 operation is in progress. */ + atomic_inc(&rgt->nr_v2_ops); active_entry_release(act); grant_read_unlock(rgt); @@ -2685,6 +2720,7 @@ acquire_grant_for_copy( if ( rc != GNTST_okay ) { + atomic_dec(&rgt->nr_v2_ops); rcu_unlock_domain(td); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2721,6 +2757,8 @@ acquire_grant_for_copy( rcu_unlock_domain(td); grant_read_lock(rgt); + atomic_dec(&rgt->nr_v2_ops); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); @@ -2747,6 +2785,8 @@ acquire_grant_for_copy( */ act->is_sub_page = true; } + else + atomic_dec(&rgt->nr_v2_ops); } else if ( !old_pin || (!readonly && !(old_pin & (GNTPIN_devw_mask|GNTPIN_hstw_mask))) ) @@ -2801,6 +2841,9 @@ acquire_grant_for_copy( act->src_domid = td->domain_id; act->trans_gref = trans_gref; act->mfn = grant_mfn; + + if ( is_sub_page ) + atomic_inc(&rgt->nr_v2_ops); } else if ( !mfn_eq(act->mfn, grant_mfn) || act->src_domid != td->domain_id || @@ -3226,7 +3269,17 @@ gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t) uop) if ( res < 0) goto out_unlock; break; + case 2: + if ( atomic_read(>->nr_v2_ops) ) + { + gdprintk(XENLOG_WARNING, + "tried to change to grant table v1, but %d v2 operations still in progress\n", + atomic_read(>->nr_v2_ops)); + res = -EAGAIN; + goto out_unlock; + } + for ( i = 0; i < GNTTAB_NR_RESERVED_ENTRIES; i++ ) { switch ( shared_entry_v2(gt, i).hdr.flags & GTF_type_mask ) -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:45:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:45:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374899.1622219 (Exim 4.92) (envelope-from ) id 1wok0B-0008Gs-68; Tue, 28 Jul 2026 15:45:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374899.1622219; Tue, 28 Jul 2026 15:45:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0B-0008Gi-3C; Tue, 28 Jul 2026 15:45:55 +0000 Received: by outflank-mailman (input) for mailman id 1374899; Tue, 28 Jul 2026 15:45:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok09-0008GY-JF for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok09-00DUms-2j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok09-00AQh8-1j for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:45:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bkF/DpgdIvBD4tmGDalAGWwCnOvbw2pnBzyBRB3rQqo=; b=FMfpSWdxt8+wUP7c1v9cKdBNkk llLXTwzlvMv5CIu89f/fzN2tzXeXvqxZXi2KG6+qveK49dYx1/bMDJHPsoM2/Wqh+XEfqpeMVnP17 sxZIRY6pVT1vQMsl8oRM/onAx/ECZk+z68hb07MF2aJLaP4DKHRCUmINDBFsTYonkTqU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] vNUMA: close race window in domain cleanup Message-Id: Date: Tue, 28 Jul 2026 15:45:53 +0000 commit d52507009519493b2fb3837dd6fcce125ea5d3d1 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:26 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 vNUMA: close race window in domain cleanup Calling vnuma_destroy() without any locking can race the handling of both XENMEM_get_vnumainfo and XEN_DOMCTL_setvnumainfo. While the latter is, without Flask, strictly only exposed to the control domain, the former can also be invoked by a stubdom DM or a de-privileged DM running in the control domain. Isolate the logic used by XEN_DOMCTL_setvnumainfo into a new helper function, which then is also used from domain_kill(). While doing so also move the vnuma_destroy() invocation out of the locked region. With d->vnuma properly cleared by domain_kill(), XENMEM_get_vnumainfo now really only needs to check for the field being NULL. That check needs repeating, though, after re-acquiring the lock. This is CVE-2026-62429 / XSA-502. Fixes: 9695014966b5 ("xen: vnuma topology and subop hypercalls") Reported-by: Teddy Astie Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 2afa6fea9d9e31792e62a4ec42a8a070c7c9e8c3) --- xen/common/domain.c | 2 +- xen/common/domctl.c | 22 +++++++++++++++------- xen/common/memory.c | 16 ++++++++++++++-- xen/include/xen/domain.h | 5 +++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 68a5112283..c4d8b865ce 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1003,7 +1003,7 @@ int domain_kill(struct domain *d) d->is_dying = DOMDYING_dying; spin_barrier(&d->domain_lock); argo_destroy(d); - vnuma_destroy(d->vnuma); + vnuma_replace(d, NULL); domain_set_outstanding_pages(d, 0); /* fallthrough */ case DOMDYING_dying: diff --git a/xen/common/domctl.c b/xen/common/domctl.c index b0c1d905fe..38f37a4d2a 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -153,7 +153,7 @@ void domctl_lock_release(void) spin_unlock(¤t->domain->hypercall_deadlock_mutex); } -void vnuma_destroy(struct vnuma_info *vnuma) +static void vnuma_destroy(struct vnuma_info *vnuma) { if ( vnuma ) { @@ -165,6 +165,19 @@ void vnuma_destroy(struct vnuma_info *vnuma) } } +/* Overwrite (replace) vnuma topology for a domain. */ +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ + struct vnuma_info *old; + + write_lock(&d->vnuma_rwlock); + old = d->vnuma; + d->vnuma = vnuma; + write_unlock(&d->vnuma_rwlock); + + vnuma_destroy(old); +} + /* * Allocates memory for vNUMA, **vnuma should be NULL. * Caller has to make sure that domain has max_pages @@ -908,12 +921,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } - /* overwrite vnuma topology for domain. */ - write_lock(&d->vnuma_rwlock); - vnuma_destroy(d->vnuma); - d->vnuma = vnuma; - write_unlock(&d->vnuma_rwlock); - + vnuma_replace(d, vnuma); break; } diff --git a/xen/common/memory.c b/xen/common/memory.c index ae801a66e6..5251ab3437 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1761,12 +1761,24 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) goto vnumainfo_out; } + read_lock(&d->vnuma_rwlock); + + /* + * Check d->vnuma again after re-acquiring the lock as we can race + * with domain destruction. + */ + if ( !d->vnuma ) + { + ASSERT(d->is_dying); + read_unlock(&d->vnuma_rwlock); + rc = -ESRCH; + goto vnumainfo_out; + } + /* * Check if vnuma info has changed and if the allocated arrays * are not big enough. */ - read_lock(&d->vnuma_rwlock); - if ( dom_vnodes < d->vnuma->nr_vnodes || dom_vranges < d->vnuma->nr_vmemranges || dom_vcpus < d->max_vcpus ) diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 54d88bf5e3..caac793297 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -159,9 +159,10 @@ struct vnuma_info { }; #ifndef CONFIG_PV_SHIM_EXCLUSIVE -void vnuma_destroy(struct vnuma_info *vnuma); +void vnuma_replace(struct domain *d, struct vnuma_info *vnuma); #else -static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); } +static inline void vnuma_replace(struct domain *d, struct vnuma_info *vnuma) +{ ASSERT(!vnuma); } #endif extern bool vmtrace_available; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374900.1622224 (Exim 4.92) (envelope-from ) id 1wok0L-0008Jo-96; Tue, 28 Jul 2026 15:46:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374900.1622224; Tue, 28 Jul 2026 15:46:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0L-0008Jf-66; Tue, 28 Jul 2026 15:46:05 +0000 Received: by outflank-mailman (input) for mailman id 1374900; Tue, 28 Jul 2026 15:46:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0J-0008JU-Mc for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok0J-00DUnQ-32 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok0J-00ARLC-21 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=7bc1I/ZDYHKiYK4uRkbLizP3qzda3SikYv9A1AIN2NI=; b=NLTJorqJo1SjKDdQVyLBnf/ktC F1UZqKNHqWPbMnPugl+wUjfCCBpKemxYE2dRhxfMpof/zJXtwtansBEpRSO0Qs7dafOqHrwh+wM2r Jdw93ZlGYntnX72gXZkZakkeR52FL4fkGP8MFooq5wQrE9pkwsNZFHQq9N60Cvp3a/ck=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] x86/vrtc: fix race in CMOS index checking Message-Id: Date: Tue, 28 Jul 2026 15:46:03 +0000 commit eb666059f0b0e1642cdbae7d05e9884699d0e3c2 Author: Roger Pau Monne AuthorDate: Wed Jul 15 12:44:37 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/vrtc: fix race in CMOS index checking Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd) --- xen/arch/x86/hvm/rtc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 4839374352..ad15825a1f 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,16 +647,24 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) +static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + if ( (addr & 1) == 0 ) - return 0xff; + return true; spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -696,7 +704,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -716,11 +726,8 @@ static int cf_check handle_rtc_io( if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) ) return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc, port); + else if ( rtc_ioport_read(vrtc, port, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374901.1622227 (Exim 4.92) (envelope-from ) id 1wok0V-0008N4-9z; Tue, 28 Jul 2026 15:46:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374901.1622227; Tue, 28 Jul 2026 15:46:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0V-0008Mw-7O; Tue, 28 Jul 2026 15:46:15 +0000 Received: by outflank-mailman (input) for mailman id 1374901; Tue, 28 Jul 2026 15:46:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0T-0008Mn-QD for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok0U-00DUnU-0C for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok0T-00ARzp-2M for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=dDXlyIAQYO1ye4iD2wp8l3vVM1azxON+aA5Tt+sSQPk=; b=P5fTrXERBGj2REPX/Yeuz9d5M3 EY9uTa32No56utfffcXfpYCmZ4miS6XG5MVtafwYgj0MqESNAql2pH9/zwpTvuF8w+6zUMmSQU8Du kyafRo25vsjNzbn6lcDy9nYcgkk2AaUQZuSWznWSDQWCqnk4dOQSm22MyLw44d8yV2qM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] x86/viridian: ensure count is always set when starting a timer Message-Id: Date: Tue, 28 Jul 2026 15:46:13 +0000 commit 7b8806f2e711ae673dd212bad304e8cabb305502 Author: Roger Pau Monne AuthorDate: Fri Jul 10 15:18:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/viridian: ensure count is always set when starting a timer Otherwise in periodic mode a division by 0 would happen on the second call to start_stimer() when using periodic mode. Note that the HyperV specification states: "Writing the value zero to the Count register will stop the counter, thereby disabling the timer, independent of the setting of AutoEnable in the configuration register." so a timer with a 0 count should never be in the enabled state. This is XSA-504 / CVE-2026-62431. Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit ff7d9aa77e4d2126d0b1732627038f1438c7bccc) --- xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 9311858d63..15f629af0f 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs) printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v, stimerx); + if ( !vs->count ) + { + gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n"); + ASSERT_UNREACHABLE(); + domain_crash(v->domain); + return; + } + if ( vs->config.periodic ) { /* @@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val) vs->config.as_uint64 = val; - if ( !vs->config.sintx ) + if ( !vs->config.sintx || !vs->count ) vs->config.enable = 0; if ( vs->config.enable ) @@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt( vs->config.as_uint64 = ctxt->stimer_config_msr[i]; vs->count = ctxt->stimer_count_msr[i]; + if ( !vs->config.sintx || !vs->count ) + /* Reject enabling with a zero sintx or count fields. */ + vs->config.enable = 0; } } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374902.1622231 (Exim 4.92) (envelope-from ) id 1wok0f-0008Pp-BY; Tue, 28 Jul 2026 15:46:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374902.1622231; Tue, 28 Jul 2026 15:46:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0f-0008Ph-92; Tue, 28 Jul 2026 15:46:25 +0000 Received: by outflank-mailman (input) for mailman id 1374902; Tue, 28 Jul 2026 15:46:23 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0d-0008PP-Sr for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok0e-00DUnc-0T for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok0d-00ASdI-2i for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=W/9WzCQqp9t7suGzv3jULcPkoVZJE/31gUV75EsJ7bE=; b=t7P/dQLOI06JaCJlQW+tZOJVj1 vLPxGs9QdW0tM6MOVnuC9Ux0+EYax+I1RPN+fK9zRKfziSdrXQA2jvEYPeGdRwpXZUpGLN6hhdpS1 xjIqifM8l7/YRZOvIatrIRVFeEfO/CmyJwnKdXUV1rDdKEX0hD5OB1SQ4YPx95T/W5f0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] xen/evtchn: fix race between FIFO expand and reset operations Message-Id: Date: Tue, 28 Jul 2026 15:46:23 +0000 commit a826f56089cee0e1cd2bec23184570a6454a929d Author: Roger Pau Monne AuthorDate: Mon Jul 20 16:44:35 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 xen/evtchn: fix race between FIFO expand and reset operations evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 6cebc3868a..ea613cfdca 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:35 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374903.1622235 (Exim 4.92) (envelope-from ) id 1wok0p-0000B5-D3; Tue, 28 Jul 2026 15:46:35 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374903.1622235; Tue, 28 Jul 2026 15:46:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0p-0000Ad-AK; Tue, 28 Jul 2026 15:46:35 +0000 Received: by outflank-mailman (input) for mailman id 1374903; Tue, 28 Jul 2026 15:46:34 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0o-00007z-06 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:34 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok0o-00DUng-0o for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:33 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok0n-00ATEh-30 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:33 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=cFojb0j4QErLmLvAoVr1Zlwz6gPCZkcB7SZDftbis+w=; b=vq4jx3rOFodwHjhGzM+PfgZ4l0 HEA/t02VITqTZ+6AyRi93WEzhRSOBc2GOhKwWJyQp8+PkCYIgqvW7iVSnGUZqbRbbJsfaaJASOnaL OKDx0q73f40FcwttqomSuMsHS2CpCggI5jJQ8jAp474IOIP8lzJTnTefFtIFzElEVE2g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] xen/dmop: check number of input buffers Message-Id: Date: Tue, 28 Jul 2026 15:46:33 +0000 commit 4de4c5cde70a8fc16e80aa500a6f8a4ae202c814 Author: Roger Pau Monne AuthorDate: Tue Jul 14 13:13:12 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 xen/dmop: check number of input buffers The hypercall requires at least one input buffer, as both arch-specific implementations of dm_op() unconditionally assume ->buf[0] to be valid (and not stack rubble). Additionally, XEN_DMOP_modified_memory requires two input buffers, yet the code was assuming the second buffer to always be provided by the user when checking for the number of extents. In case the caller sets nr_bufs to 1, the code in modified_memory() will read stack garbage as the size of the buffer, thus allowing the caller some degree of insight on the contents of the stack by probing whether the hypercall returns -EINVAL or -EFAULT as a result of such bogus call. This is XSA-506 / CVE-2026-62433. Fixes: e3b93b3c5954 ("dmop: add xendevicemodel_modified_memory_bulk()") Fixes: 85cb15dfe4d1 ("x86/hvm/dmop: only copy what is needed to/from the guest") Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich (cherry picked from commit aef948a300da3f10ca5d033177dbd794afc45e2b) --- xen/arch/x86/hvm/dm.c | 9 +++++++++ xen/common/dm.c | 3 +++ 2 files changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index 462691f91d..58915ad0dc 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -493,6 +493,12 @@ int dm_op(const struct dmop_args *op_args) struct xen_dm_op_modified_memory *data = &op.u.modified_memory; + if ( op_args->nr_bufs != 2 ) + { + rc = -EINVAL; + break; + } + rc = modified_memory(d, op_args, data); const_op = !rc; break; @@ -650,6 +656,9 @@ int compat_dm_op( unsigned int i; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; diff --git a/xen/common/dm.c b/xen/common/dm.c index 201b652deb..8689728ab7 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -26,6 +26,9 @@ long do_dm_op( struct dmop_args args; int rc; + if ( !nr_bufs ) + return -ENODATA; + if ( nr_bufs > ARRAY_SIZE(args.buf) ) return -E2BIG; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:45 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:45 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374904.1622239 (Exim 4.92) (envelope-from ) id 1wok0z-0000IR-EZ; Tue, 28 Jul 2026 15:46:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374904.1622239; Tue, 28 Jul 2026 15:46:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0z-0000IJ-Bc; Tue, 28 Jul 2026 15:46:45 +0000 Received: by outflank-mailman (input) for mailman id 1374904; Tue, 28 Jul 2026 15:46:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok0y-0000IA-3d for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok0y-00DUno-1A for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:44 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok0y-00ATnQ-09 for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:44 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lKp4z/6+YXWvY7/ecCk4zW6rL9Di9Sm2NCGrz/yVBP4=; b=1250dQ7Ob530zWR/Q2ls5BK7r6 tkM5iRWZFVmacD2nCdiXKpIE4tZXJYn3betE0GY/YAZUBMooo4cCjckxGWB2CYX/UGI+GHN+3zhIP J6Bp6UWSLXmLUwchZZV/FX95641UIPxTZ/wiRdtzPJhzK1MxiydlWN4FpzBzKOGUe//U=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] x86/pod: do not reclaim special pages for PoD cache Message-Id: Date: Tue, 28 Jul 2026 15:46:44 +0000 commit 23cb1f8f8d9c78d1b377785371ccb5413676d4d3 Author: Roger Pau Monne AuthorDate: Tue Jul 14 17:05:45 2026 +0200 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 x86/pod: do not reclaim special pages for PoD cache When doing PoD cache reclaim as part of a decrease reservation call, avoid reclaiming special pages for the PoD cache. Otherwise such pages get moved from the domain ->xenpage_list to the ->page_list, while still being referenced in ->shared_info domain field. Prevent PoD cache from reclaiming special pages, as nothing good can come out of it. This is XSA-507 / CVE-2026-62434. Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd) --- xen/arch/x86/mm/p2m-pod.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c index 40a4be8315..1c355cbd4c 100644 --- a/xen/arch/x86/mm/p2m-pod.c +++ b/xen/arch/x86/mm/p2m-pod.c @@ -547,12 +547,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) p2m_access_t a; p2m_type_t t; unsigned int cur_order; + mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, + NULL); - p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL); n = 1UL << min(order, cur_order); if ( p2m_is_pod(t) ) pod += n; - else if ( p2m_is_ram(t) ) + else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) ) ram += n; } @@ -655,6 +656,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order) ASSERT(mfn_valid(mfn)); page = mfn_to_page(mfn); + if ( is_special_page(page) ) + /* Do not touch special pages, let generic code handle them. */ + continue; /* This shouldn't be able to fail */ if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order, -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Tue Jul 28 15:46:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 28 Jul 2026 15:46:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1374905.1622243 (Exim 4.92) (envelope-from ) id 1wok19-0000Qv-Ff; Tue, 28 Jul 2026 15:46:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1374905.1622243; Tue, 28 Jul 2026 15:46:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok19-0000Qo-Cv; Tue, 28 Jul 2026 15:46:55 +0000 Received: by outflank-mailman (input) for mailman id 1374905; Tue, 28 Jul 2026 15:46:54 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wok18-0000Qg-6v for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:54 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wok18-00DUns-1V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:54 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wok18-00AUMT-0V for xen-changelog@lists.xenproject.org; Tue, 28 Jul 2026 15:46:54 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=an+3TOls1zYSHO9LJDc0uC7MrOP2KHL0ujZVdbOKJ0s=; b=staOOUCLLTgxsxHj2NEP8F4KIR 2GcqICWopa6vWFY4dabqlWhFX2dDGHUI6UEf+wIbb9IIukRUf0g7rmB45ubwsNXerQsW8dDv/evO9 3f1znp+hynObh7XRIiG0ld4+AP9nI7R3oqDxfwC2lJp3SLh8/8BRAXRvdkqoKUQgPTeU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] pygrub: security-supported only when run de-privileged Message-Id: Date: Tue, 28 Jul 2026 15:46:54 +0000 commit 69cc968847f6f459f923925d05f458aec3557781 Author: Jan Beulich AuthorDate: Mon Jul 20 16:44:43 2026 +0100 Commit: Andrew Cooper CommitDate: Tue Jul 28 13:10:03 2026 +0100 pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 39e550e7a3..e37528fade 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -237,6 +237,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375788.1622835 (Exim 4.92) (envelope-from ) id 1wp3dj-0003qR-3L; Wed, 29 Jul 2026 12:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375788.1622835; Wed, 29 Jul 2026 12:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3dj-0003qJ-0p; Wed, 29 Jul 2026 12:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1375788; Wed, 29 Jul 2026 12:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3di-0003qD-CI for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3di-00FFHX-1s for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3di-002Dij-0n for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qi6s7PU70nCWWlLQ5b25yvZoy56O3T4WYjMtmu4jw4I=; b=Mg8Qkld0wwRiwRWc2reZLfGikA tSX02B+fn78AtW2YWeRpJPlVRuRHuGtLDh6EveuAKmnsA0WHMxX2pgqqbiTv+W7yAzQ95B2OSjYeg UMemOQECrwTOmmC8vNzxwHU81+RYoO4dF/iPbeUkXCDCrbF36DLRtIzr9DbRrDg2HrMk=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/vrtc: Use a real type for rtc_ioport_write() Message-Id: Date: Wed, 29 Jul 2026 12:44:02 +0000 commit 334eea78a988af6ca469bb24d6dc54461c9efbba Author: Andrew Cooper AuthorDate: Fri Jul 10 21:53:03 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 x86/vrtc: Use a real type for rtc_ioport_write() Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/rtc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 65b3b79f1e..9895dd570c 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -469,9 +469,8 @@ static void cf_check rtc_alarm_cb(void *opaque) spin_unlock(&s->lock); } -static int rtc_ioport_write(void *opaque, uint32_t addr, uint32_t data) +static int rtc_ioport_write(RTCState *s, uint32_t addr, uint32_t data) { - RTCState *s = opaque; struct domain *d = vrtc_domain(s); uint32_t orig; -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375789.1622839 (Exim 4.92) (envelope-from ) id 1wp3du-0003sW-4z; Wed, 29 Jul 2026 12:44:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375789.1622839; Wed, 29 Jul 2026 12:44:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3du-0003sP-2B; Wed, 29 Jul 2026 12:44:14 +0000 Received: by outflank-mailman (input) for mailman id 1375789; Wed, 29 Jul 2026 12:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3ds-0003sE-Fw for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3ds-00FFHv-2D for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3ds-002Dp0-1A for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lP2aSVL1wH6TDKEyLGNjtAE2GObQoCjxHleWsf7wcXw=; b=sIhtzjJbY3Z72w5Z0dDxDz1yyF QSETZjJ8ISXtYMg4E/1L7HMxJVvpPhfkbuHnXzkeKdD2qI7Zg4LLZBapoCjQ6JiDRO7GnEI5ZJcQs zHRnm23nWSKHS7wuKoW/fcDCrCGy2t6O7EhaDIoqL3hw4ou14QOkCzJ6SRqdo/D460Pg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] CHANGELOG: add Arm and RISC-V entries for 4.22 Message-Id: Date: Wed, 29 Jul 2026 12:44:12 +0000 commit 314958c1da1275977822275a1c05bb4dac3b8be0 Author: Oleksii Kurochko AuthorDate: Mon Jul 13 15:43:07 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 CHANGELOG: add Arm and RISC-V entries for 4.22 Signed-off-by: Oleksii Kurochko Reviewed-by: Bertrand Marquis --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d3d7e0d87..8994fb6b46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - On Arm: - Support for guest suspend and resume to/from RAM via vPSCI. Applies only to non-hardware domain guests. + - Continued Armv8-R MPU enablement. + - Drop ThumbEE support. + - FF-A v1.2 support. + + - On RISC-V: + - SSTC extension support for Xen (not for guest yet). + - Introduce domain build helpers (CONFIG_DOMAIN_BUILD_HELPERS) which allows + to load Linux kernel, initrd and allocation related things forfor device + tree-based domains, laying the groundwork for guest boot support. ### Removed - On x86: -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375790.1622843 (Exim 4.92) (envelope-from ) id 1wp3e4-0003up-6Q; Wed, 29 Jul 2026 12:44:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375790.1622843; Wed, 29 Jul 2026 12:44:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3e4-0003uh-3l; Wed, 29 Jul 2026 12:44:24 +0000 Received: by outflank-mailman (input) for mailman id 1375790; Wed, 29 Jul 2026 12:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3e2-0003uY-HS for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3e2-00FFI3-2X for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3e2-002DsY-1V for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Bku7sbilVoqKmv+Mu+1FL4NEbVAjEOIxeJRjuwm5UXE=; b=sMq+1v8SZ9IfhTyQ/4wK3HfvCg fcka+KqYzezaWuRZWZSBiNzFLdVKk7HA+AP35lP1r6U/yqskEkt7MCwdb0L6zVfbGnQXTON+yWXBF 1PkYdKvvSl8E6thbG7nTwRs8gEvd2T7Lk3gxfX5ZTS3Pj7UYozII0NWJqJjLpOVixKfE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 12:44:22 +0000 commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 7f6381cdd2..de66f5989a 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:34 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375791.1622847 (Exim 4.92) (envelope-from ) id 1wp3eE-0003x4-7k; Wed, 29 Jul 2026 12:44:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375791.1622847; Wed, 29 Jul 2026 12:44:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eE-0003ww-57; Wed, 29 Jul 2026 12:44:34 +0000 Received: by outflank-mailman (input) for mailman id 1375791; Wed, 29 Jul 2026 12:44:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eC-0003wp-LV for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3eC-00FFI7-2w for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3eC-002E4v-1p for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=VPoIUvZKMd88DRK4J9zDIL3f2d7x7yQfAxlVdF7vSUg=; b=fPOYXmAchQR78MuvFAiub4421c gwqB4rMmtU7OGOk8QgssyiJVjEOMG0K26uFRKKbhfyoXhtL5AB3Im8rqQyTHkA92bz9G7QbqVhhWM 1ptjqwp+X90i8dNUgoszV+K4RcjZT209kU4ht8aCLRXA2SMNG9amx5Ebzjqtu7MHg86s=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 12:44:32 +0000 commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index de66f5989a..4a45a31c28 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:44 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375792.1622852 (Exim 4.92) (envelope-from ) id 1wp3eO-0003zG-9e; Wed, 29 Jul 2026 12:44:44 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375792.1622852; Wed, 29 Jul 2026 12:44:44 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eO-0003z8-6V; Wed, 29 Jul 2026 12:44:44 +0000 Received: by outflank-mailman (input) for mailman id 1375792; Wed, 29 Jul 2026 12:44:43 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eN-0003yr-4z for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:43 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3eN-00FFIE-1I for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:43 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3eN-002EKn-0H for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:43 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+MiT7hoHKcoY8CrVBz3DR2ZjAYdJROaHgDA/CAFiHiQ=; b=TrmZHq1ho8acIjN9cnX3lw+/4B m4vjXR44LFLVgyvuDUE2+CPKBr63Dp9L0kIcWIuXBcJXcyjfNUI/H75EagEvkpKVtAk8SpqYaTM4b jsMS8qt4faUt5n60b1CY+4kxYiubzVxxXR1wyckNg5q/M+5ZEWR+vpI3kZ4QnrqNYEHs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 12:44:43 +0000 commit cd29f1c5dd84957683a8eae7fac019c83355c6d6 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 7f6381cdd2..de66f5989a 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:44:54 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:44:54 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375793.1622854 (Exim 4.92) (envelope-from ) id 1wp3eY-00041L-AI; Wed, 29 Jul 2026 12:44:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375793.1622854; Wed, 29 Jul 2026 12:44:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eY-00041E-7n; Wed, 29 Jul 2026 12:44:54 +0000 Received: by outflank-mailman (input) for mailman id 1375793; Wed, 29 Jul 2026 12:44:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eX-000416-8z for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3eX-00FFIK-1h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:53 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3eX-002EZT-0c for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:44:53 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=q6UKc9GlorL2gQhcgENzKvLnkFbZdXbLXBJZ4hvJP4Y=; b=O2Y1BGOdrSOFaLasKdKlG3ZNlG ZwVJAVL9/I9f8WyRFdlhDmYP08I4upW/9NKUeFrVsM+RxWYOeZfPIUhcIZLUkruEoO3fJua09v0Ce ydnM6yYtMNvR62WhX5tgSD+TP2EXHQ7xhAd8gYrEC2lg6zhzNk7RFCdREO/AAJlf0VVc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 12:44:53 +0000 commit ea59e89888db622552af35d93d89b74b12ffabe2 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index de66f5989a..4a45a31c28 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:45:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:45:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375794.1622859 (Exim 4.92) (envelope-from ) id 1wp3ei-00043I-Bl; Wed, 29 Jul 2026 12:45:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375794.1622859; Wed, 29 Jul 2026 12:45:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3ei-00043A-9I; Wed, 29 Jul 2026 12:45:04 +0000 Received: by outflank-mailman (input) for mailman id 1375794; Wed, 29 Jul 2026 12:45:03 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3eh-000434-C5 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:03 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3eh-00FFIk-20 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:03 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3eh-002Ekm-10 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:03 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=T6S6XnzC8v334CNqRnHO3VdImG6Yourruk8scEIme5o=; b=TgpA8iP53COv9HVEbpl2PNXLk8 tgcawp/diYvMQ5OgkhVUjHrHpIv8idw0fy58qqIIDGHyGoMeXS7yLKGMLjHT7PIjKzRozRPSFkCiQ Yo4qkXdxTBwSZZtkulKFTfm1Nppld6iJTyS3RmR7QnBvYphIMdADuj76Y3MfZw4BOk2g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] CHANGELOG: add Arm and RISC-V entries for 4.22 Message-Id: Date: Wed, 29 Jul 2026 12:45:03 +0000 commit 1e549d1248529c9ceb9e9f0c6faca52a5be1eb7e Author: Oleksii Kurochko AuthorDate: Mon Jul 13 15:43:07 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 CHANGELOG: add Arm and RISC-V entries for 4.22 Signed-off-by: Oleksii Kurochko Reviewed-by: Bertrand Marquis (cherry picked from commit 314958c1da1275977822275a1c05bb4dac3b8be0) --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6bb18fca75..1435855615 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - On Arm: - Support for guest suspend and resume to/from RAM via vPSCI. Applies only to non-hardware domain guests. + - Continued Armv8-R MPU enablement. + - Drop ThumbEE support. + - FF-A v1.2 support. + + - On RISC-V: + - SSTC extension support for Xen (not for guest yet). + - Introduce domain build helpers (CONFIG_DOMAIN_BUILD_HELPERS) which allows + to load Linux kernel, initrd and allocation related things forfor device + tree-based domains, laying the groundwork for guest boot support. ### Removed - On x86: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:45:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:45:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375795.1622863 (Exim 4.92) (envelope-from ) id 1wp3et-00045F-Do; Wed, 29 Jul 2026 12:45:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375795.1622863; Wed, 29 Jul 2026 12:45:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3et-000457-Ai; Wed, 29 Jul 2026 12:45:15 +0000 Received: by outflank-mailman (input) for mailman id 1375795; Wed, 29 Jul 2026 12:45:13 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3er-000450-Rp for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:13 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3es-00FFKx-0M for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:13 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3er-002ExH-2a for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:13 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=iDNe1m9RQFsGJYiEfxQhU7nGLNupZk+C9U6aavU9jiI=; b=UQrW+sTrBsp3eVCNJBJ6I+W2Tf nviqMAz3DO1Zn3sloBuy6lsew1q1unAwdtdS0lfRbD77q5SjAPlioKU04MVGAt5iCTbIk6TB/8Yi3 4vDmgEWXZWbv1O4/4D6JROENUPtMDz9wsjh+AC1VrQirCpzPr9RcLrN9j9N5bVrqt0Ck=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 12:45:13 +0000 commit fbfca3287498cbb28b762607ac69022221e32381 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:42:15 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index c55f73b265..1dd01c0f69 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:45:25 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:45:25 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375796.1622867 (Exim 4.92) (envelope-from ) id 1wp3f3-00047e-Gl; Wed, 29 Jul 2026 12:45:25 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375796.1622867; Wed, 29 Jul 2026 12:45:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3f3-00047W-E4; Wed, 29 Jul 2026 12:45:25 +0000 Received: by outflank-mailman (input) for mailman id 1375796; Wed, 29 Jul 2026 12:45:24 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3f1-00047P-Vj for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:23 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3f2-00FFMk-0k for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:23 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3f1-002F9N-2w for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:45:23 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=OI+kyyQPDBNf5incy4WKYi7DSRkqbEdFdDOu/T7epyQ=; b=UAzaq6HHUGoZ4d9Jm1NJcmQFYp 8Lc4ZPZk07xAawZEsPCQUv0RIDe3qfRElOq62MpGmcqkni8ajODWOtQTFK36iAozReHIWHHYPG216 T/Igp+KbzrlflthrztSWgKZO+pVRn5NJqK4Uo8kBaDL7XGXwNjEpj2dWeqmo75qvWEtw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 12:45:23 +0000 commit 7d9d7512ce1d8da3e63384991d7d855c9012a794 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:42:15 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 1dd01c0f69..e47e021b06 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375840.1622880 (Exim 4.92) (envelope-from ) id 1wp3oO-0006LJ-CI; Wed, 29 Jul 2026 12:55:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375840.1622880; Wed, 29 Jul 2026 12:55:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3oO-0006LC-9e; Wed, 29 Jul 2026 12:55:04 +0000 Received: by outflank-mailman (input) for mailman id 1375840; Wed, 29 Jul 2026 12:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3oM-0006L6-Ap for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3oM-00FFWa-10 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3oL-002L1j-3C for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=ZJbyAm9Lt0m+hb1yty14iT3Kk+1q6pak7jSMwEKHv8E=; b=S9wOd8ZslMbPIPUGYV1B0McA2z cM7dZcH57Dq1Ie624GSqgriYWJqVPsph3zngGU7l2dvoMij65y6Nz0c1LWPLdRuhFhezD7EXQZI/R OkmkUz6xjmFkEbJwqF/UWjOpz/A3OK46nLrPasUKPxS7ARAD222CpTQPWEEqgVY3P6tw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 12:55:01 +0000 commit 9f4431e6d1d3c3300d217389ec60fe2f92baf161 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:46:53 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 90353ec89d..4b8ba5b004 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -401,7 +401,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -431,6 +432,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -439,16 +443,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 12:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 12:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375841.1622884 (Exim 4.92) (envelope-from ) id 1wp3oX-0006N8-Dp; Wed, 29 Jul 2026 12:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375841.1622884; Wed, 29 Jul 2026 12:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3oX-0006My-Az; Wed, 29 Jul 2026 12:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1375841; Wed, 29 Jul 2026 12:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp3oW-0006Mo-5U for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp3oW-00FFXO-1L for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp3oW-002LBN-0I for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 12:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Q9AxBdmDem2jBy09h7WYe2AiaH6rsGqU9a1s0ZIuHdo=; b=C6yTnJRKx03Zu0145j9vKt3xi/ oHUuH1m0mZ4qJapEl2Nk2kU8KvNSivBJlt7oGWhPZlbA78AvH4JzCOj/7MlPZr4NQGeiTI7CrJqHr eR55oxppGAYJAt+em8dEnFA2HlJ2jGVIomkn5UTypwB5N55PldK+A1qo8Sxj9fv++5u4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 12:55:12 +0000 commit 1b917fef1a54e2844e097402f4dfd1cc27e3e7cf Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:46:53 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 4b8ba5b004..ce93bc65f0 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -431,7 +431,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:33:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:33:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375913.1622897 (Exim 4.92) (envelope-from ) id 1wp4P9-0004WD-5v; Wed, 29 Jul 2026 13:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375913.1622897; Wed, 29 Jul 2026 13:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4P9-0004W6-3H; Wed, 29 Jul 2026 13:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1375913; Wed, 29 Jul 2026 13:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4P8-0004Vo-3h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4P8-00FGQz-0f for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4P7-002kMM-2o for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=+WXnGjzAHq/RnmATYPTZGBTXsPfngurYm/524Ps8pqk=; b=CnvJJFZAvkmbGYtsZKbevI2hvp HzEZq7Tykny28aiskLuoFahrIK9K3isJfkcU2B8Pdo/QYTecGV69Ixkl10XtbATurAJKyjp6g5Eiy tGFYXc2CQ++gcXprHP5Jk4sH2hYIVFG6mlhGTtEQa59aTkJ7OUY9p45BJFLQbFjgDBKc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/vrtc: Use a real type for rtc_ioport_write() Message-Id: Date: Wed, 29 Jul 2026 13:33:01 +0000 commit 334eea78a988af6ca469bb24d6dc54461c9efbba Author: Andrew Cooper AuthorDate: Fri Jul 10 21:53:03 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 x86/vrtc: Use a real type for rtc_ioport_write() Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/rtc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 65b3b79f1e..9895dd570c 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -469,9 +469,8 @@ static void cf_check rtc_alarm_cb(void *opaque) spin_unlock(&s->lock); } -static int rtc_ioport_write(void *opaque, uint32_t addr, uint32_t data) +static int rtc_ioport_write(RTCState *s, uint32_t addr, uint32_t data) { - RTCState *s = opaque; struct domain *d = vrtc_domain(s); uint32_t orig; -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375915.1622901 (Exim 4.92) (envelope-from ) id 1wp4PJ-0004YP-7T; Wed, 29 Jul 2026 13:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375915.1622901; Wed, 29 Jul 2026 13:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4PJ-0004YH-4q; Wed, 29 Jul 2026 13:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1375915; Wed, 29 Jul 2026 13:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4PI-0004Y1-3l for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4PI-00FGR5-10 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4PH-002kV7-3D for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Xzw3t8oeLTNs6VUVzCQ7WerYTInVAVTu7qSODMka0F4=; b=jYnRSJeksC1drI1u+s5qA4/hDa klxjDkrE0CL/3unpoc++4TCKf+apZ+EubVDzq4ScaZXmjSMzIwZT2/1rMXDvHRvQcCGi+cWHZFFzA H3rBiGEI6GRXT13IXL9n8ZEGpVb3GG6gc1Tod9f/KeGGjyJwbLAzyIgJJmATn3jtz7tU=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] CHANGELOG: add Arm and RISC-V entries for 4.22 Message-Id: Date: Wed, 29 Jul 2026 13:33:11 +0000 commit 314958c1da1275977822275a1c05bb4dac3b8be0 Author: Oleksii Kurochko AuthorDate: Mon Jul 13 15:43:07 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 CHANGELOG: add Arm and RISC-V entries for 4.22 Signed-off-by: Oleksii Kurochko Reviewed-by: Bertrand Marquis --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d3d7e0d87..8994fb6b46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - On Arm: - Support for guest suspend and resume to/from RAM via vPSCI. Applies only to non-hardware domain guests. + - Continued Armv8-R MPU enablement. + - Drop ThumbEE support. + - FF-A v1.2 support. + + - On RISC-V: + - SSTC extension support for Xen (not for guest yet). + - Introduce domain build helpers (CONFIG_DOMAIN_BUILD_HELPERS) which allows + to load Linux kernel, initrd and allocation related things forfor device + tree-based domains, laying the groundwork for guest boot support. ### Removed - On x86: -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:33:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:33:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375917.1622905 (Exim 4.92) (envelope-from ) id 1wp4PT-0004af-8q; Wed, 29 Jul 2026 13:33:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375917.1622905; Wed, 29 Jul 2026 13:33:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4PT-0004aY-69; Wed, 29 Jul 2026 13:33:23 +0000 Received: by outflank-mailman (input) for mailman id 1375917; Wed, 29 Jul 2026 13:33:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4PS-0004aN-5E for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4PS-00FGRR-1J for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4PS-002kcY-0I for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PjvDu+QOjs9Pd+bpV8sAJ3lg47NMeGPlQHTECitKqHU=; b=TLBrdPLOB9jxN7FRw64AEuORBX HxLzfXzyJ0JDjTRI1acRwEdArPzil0KVI4YwN+IUSlzDF5AcMQ42As897UYtV4Onb+HSdA3VLdo+N F210Jy58dfXMkEuQwLqw+FtA3mmaMuSMBSLheTVPdowr0WUUoSQX//CWFGCOlOrW1HZE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 13:33:22 +0000 commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 7f6381cdd2..de66f5989a 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:33:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:33:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375918.1622909 (Exim 4.92) (envelope-from ) id 1wp4Pd-0004dg-Aa; Wed, 29 Jul 2026 13:33:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375918.1622909; Wed, 29 Jul 2026 13:33:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Pd-0004dY-7n; Wed, 29 Jul 2026 13:33:33 +0000 Received: by outflank-mailman (input) for mailman id 1375918; Wed, 29 Jul 2026 13:33:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Pc-0004dO-92 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4Pc-00FGRV-1h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4Pc-002kj3-0e for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:33:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=pjeazp9MtwRwK06GjuEHZZLYYLtO/2uXRCKfMuYFCng=; b=Gp7Iz0C8+i9HnOz8/US3NaIbsr y3XaXknFRfP0V807/d0+7N54aXBJOgU78chqy9SfwQRDQobDW99hospvX37/CAFlQ2Nbk6eyHoZ4z 2EAl4esZJ8yC4u2j/HM8P3v9fSHV9wnQOdWkJNrwlV0719YjSSJajfakBEJwq9x545RY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 13:33:32 +0000 commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:38:22 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index de66f5989a..4a45a31c28 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:44:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:44:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375948.1622940 (Exim 4.92) (envelope-from ) id 1wp4Zn-0007it-RP; Wed, 29 Jul 2026 13:44:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375948.1622940; Wed, 29 Jul 2026 13:44:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Zn-0007il-Oe; Wed, 29 Jul 2026 13:44:03 +0000 Received: by outflank-mailman (input) for mailman id 1375948; Wed, 29 Jul 2026 13:44:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Zm-0007if-5N for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4Zm-00FGfr-1B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4Zm-002pMw-0B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Hknd0VgshKumSkg09CA5nuxWgQnRpO4M46B3x8MyYmY=; b=dARZfUMNXb2L4JDCL1IsNkGVMl JtM2nEfYR4tBio4Kus6UD3xn5fWMD/9u1piQ7MWBm2ZFOQgUgcI8b/xReUcGVVr2icev+bpFb0P3g iY+ly9p0w2UYmvU20GD/ERScfsek/Olot1DOUOWsm8GamvAb0FM6i9HVfJjfS49O1XZQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.19] update Xen version to 4.19.6 Message-Id: Date: Wed, 29 Jul 2026 13:44:02 +0000 commit 54ee7c511ae7f5cac195cce271564a1a339ae99a Author: Jan Beulich AuthorDate: Wed Jul 29 15:34:38 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:34:38 2026 +0200 update Xen version to 4.19.6 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 683cb4bdac..dd9c8d3235 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 19 -export XEN_EXTRAVERSION ?= .5$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.19 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:44:14 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:44:14 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375949.1622944 (Exim 4.92) (envelope-from ) id 1wp4Zx-0007lQ-UW; Wed, 29 Jul 2026 13:44:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375949.1622944; Wed, 29 Jul 2026 13:44:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Zx-0007lI-Rd; Wed, 29 Jul 2026 13:44:13 +0000 Received: by outflank-mailman (input) for mailman id 1375949; Wed, 29 Jul 2026 13:44:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4Zw-0007l6-Dm for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4Zw-00FGfy-2B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4Zw-002pRD-18 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=crZchIHvPDysanoTD1KA+eVNbzqNteykLrGVnNzhlY4=; b=c+Qr85Wkvcs4Ys3Rt9d+JZNJoR p/OzxF5hQyCKBDSE0ZqT9Bf7puT4FdHHK07DaO6ZWq/u/ScbwWadT9IeAW1pFSGBiSH0iEK3OrlIp j70MLEZv+kBt4aqOrOzLxQJc5hLezdS85xNzjxcFtSO6V/9MBEjUnA9caB+4retdcw8g=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.18] update Xen version to 4.18.6 Message-Id: Date: Wed, 29 Jul 2026 13:44:12 +0000 commit c9355898f3b8e10ca49e87d50e335d682827c33b Author: Jan Beulich AuthorDate: Wed Jul 29 15:36:02 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:36:02 2026 +0200 update Xen version to 4.18.6 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 5fc7fe27da..965373f199 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 18 -export XEN_EXTRAVERSION ?= .5$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.18 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:44:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:44:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375951.1622947 (Exim 4.92) (envelope-from ) id 1wp4a6-0007oS-Vi; Wed, 29 Jul 2026 13:44:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375951.1622947; Wed, 29 Jul 2026 13:44:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4a6-0007oK-Su; Wed, 29 Jul 2026 13:44:22 +0000 Received: by outflank-mailman (input) for mailman id 1375951; Wed, 29 Jul 2026 13:44:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4a6-0007oE-Nb for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4a6-00FGgL-39 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4a6-002pUI-25 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:44:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=h8fFFR5aTEMeFDm92FCjm6WQVV/dcQfFqhEAp5XxLg0=; b=ZkeVvfVJxmUrkDFqq65Qk/stZh cQ1CrpdxFoxKnB0WKlw8Tuzs26k5LE+pZRD0WYJOecO2sexYg2mTjR1iv0aTVS6FLQYAUphaChFp6 zWQQZ1gNP0bBHuHCapRLcNAmyOTvTmGcqce+oiDORWmVLoNrK8T6mHcVFb7wIEYBejgM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.17] update Xen version to 4.17.7 Message-Id: Date: Wed, 29 Jul 2026 13:44:22 +0000 commit 9373a593c5a6ef57db1302eb1dca58cc3eb51c07 Author: Jan Beulich AuthorDate: Wed Jul 29 15:37:29 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:37:29 2026 +0200 update Xen version to 4.17.7 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 05e08f5457..09fc386843 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 17 -export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .7$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.17 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375963.1622952 (Exim 4.92) (envelope-from ) id 1wp4kR-00011P-Nj; Wed, 29 Jul 2026 13:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375963.1622952; Wed, 29 Jul 2026 13:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4kR-00011H-Kz; Wed, 29 Jul 2026 13:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1375963; Wed, 29 Jul 2026 13:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4kQ-00011B-FE for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4kQ-00FGuk-1Q for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4kQ-002w4s-0P for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=PMXPj0asM/YnSNDb2q8N3NOAC/w7Oe8o4/jWESxagUI=; b=W7iFGpQk3746sUDVfImPR2Ez0y IpnG6QFNkvmKr9H4160EoBW8XFQ+bX6OFlsfGoCIgqQdy9D+QyaQvyBKleHuY+TFwdFCfcKlM4Ek8 hdUnFUKdIXB13EeVPUrmOASw0u43Ys3Gk+9HUv4/EnqZ9AyVwXpea23ko9A8KdvUnJ58=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/credit: fix race with schedule_cpu_rm() in csched_timer() Message-Id: Date: Wed, 29 Jul 2026 13:55:02 +0000 commit ea1d785a5f660ec52ec70454a0410c2f7fb2930a Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:42 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:41:22 2026 +0100 xen/credit: fix race with schedule_cpu_rm() in csched_timer() When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer firing before being killed, so csched_timer() needs to test the per-cpu data being set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 328c802d0c..4dde2ede12 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1589,6 +1589,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc = CSCHED_PCPU(cpu); struct csched_private *prv = CSCHED_PRIV(sr->scheduler); + /* Handle race of timer disabling vs. firing when switching scheduler. */ + if ( !spc ) + return; + spc->tick++; /* -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:55:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:55:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375964.1622957 (Exim 4.92) (envelope-from ) id 1wp4ka-000139-PF; Wed, 29 Jul 2026 13:55:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375964.1622957; Wed, 29 Jul 2026 13:55:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4ka-000131-MJ; Wed, 29 Jul 2026 13:55:12 +0000 Received: by outflank-mailman (input) for mailman id 1375964; Wed, 29 Jul 2026 13:55:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4ka-00012t-A0 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4ka-00FGve-1k for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4ka-002w9p-0j for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=0kuSegvdjOriq3UCzWDwKIvDAOTTrl4TWZEJXdnGGgo=; b=t0q46/tH6PSmu/qhGy9xupRNp3 VhrNGJ9IdXkyk96CBExeTzCNpbIwmzfn2eTQUaMMi0GaHvmk9uzI7LSnS6ARtK/9gcQlvCUj+ahOc tX2awWB1zpEwLTQEaCF7mmxrp8BzL0qfbjyO34RGxaRDOryP6xwW2v3FxEQec04Xd5CY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/sched: fix schedule_dump() handling of free cpus Message-Id: Date: Wed, 29 Jul 2026 13:55:12 +0000 commit f38e8cb85aa7e04b737482b2f4eeb9d6d40a2e61 Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:43 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:41:22 2026 +0100 xen/sched: fix schedule_dump() handling of free cpus With the introduction of core scheduling, cpus not used by any cpupool have been switched to use the very simple idle scheduler instead of the default scheduler. Trying to obtain diagnostic scheduling data via the "r" debug key is scanning through all cpupools using the per-cpupool scheduler to print the related data. Unfortunately the switch to use the idle scheduler for free cpus wasn't reflected in schedule_dump(), causing the default scheduler's dump_cpu_state callback to be used for free cpus. This causes NULL dereferences in case the default scheduler is one of credit or null. Fix that by using the idle scheduler instead of the default scheduler for free cpus. Note that it is fine for a scheduler to have no dump_cpu_state callback. Fixes: f855dd962523 ("sched: add minimalistic idle scheduler for free cpus") Reported-by: Dietmar Hahn Tested-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper --- xen/common/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 55b71301cf..9ccf5811bf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -3452,7 +3452,7 @@ void schedule_dump(struct cpupool *c) } else { - sched = &operations; + sched = &sched_idle_ops; cpus = &cpupool_free_cpus; } -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 13:55:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 13:55:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375966.1622960 (Exim 4.92) (envelope-from ) id 1wp4kl-00015G-Q5; Wed, 29 Jul 2026 13:55:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375966.1622960; Wed, 29 Jul 2026 13:55:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4kl-000158-Ne; Wed, 29 Jul 2026 13:55:23 +0000 Received: by outflank-mailman (input) for mailman id 1375966; Wed, 29 Jul 2026 13:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4kk-000152-Nb for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4kk-00FGyb-37 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4kk-002wGP-20 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 13:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=bwZNNytDPH6Jhj15u5vbk/FdC5CAHpnJU3Npqco2rFw=; b=UVquUFm9cBItDLJr7AMzqqmwav gTPb0e7GixoL+/6uOUHKaY3/OIECw3XdUqiFvC/Hkgxp5rvHim52NFkmvad131COlQcksqG4HVf3T jWjdqKSrP3bq3Alk3Jj0QMsp63P4fto+kpIR5fDh7PvERVCJH0XcPkWEsdw/NOvWqIvA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] xen/credit: fix race with schedule_cpu_rm() in csched_timer() Message-Id: Date: Wed, 29 Jul 2026 13:55:22 +0000 commit dca917bff4a0253a57616b485a26d419615c4003 Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:42 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:51:51 2026 +0100 xen/credit: fix race with schedule_cpu_rm() in csched_timer() When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer firing before being killed, so csched_timer() needs to test the per-cpu data being set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko (cherry picked from commit ea1d785a5f660ec52ec70454a0410c2f7fb2930a) --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 07656a57e9..63ef0d1318 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1588,6 +1588,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc = CSCHED_PCPU(cpu); struct csched_private *prv = CSCHED_PRIV(sr->scheduler); + /* Handle race of timer disabling vs. firing when switching scheduler. */ + if ( !spc ) + return; + spc->tick++; /* -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:11:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:11:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375995.1622973 (Exim 4.92) (envelope-from ) id 1wp4zv-0004bx-2o; Wed, 29 Jul 2026 14:11:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375995.1622973; Wed, 29 Jul 2026 14:11:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4zu-0004bp-WE; Wed, 29 Jul 2026 14:11:03 +0000 Received: by outflank-mailman (input) for mailman id 1375995; Wed, 29 Jul 2026 14:11:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp4zt-0004bj-OR for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp4zt-00FHPA-2Q for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp4zt-0030WN-1O for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=hwd+/BVWDnYjbBS2XSO3haGE1WkJrG1674oZETAZziM=; b=x4diezfeffTLX7NIxwJMYR7JEg 3CKZ5AJJIBih2nf7+xPoM5O98aIphGtm5hjHSvkUt2Insve9MBhDIl/vFjMY+gqniYqVds0HbueGo rv0RW0NWIp7QFnzLngse/mJSDsCAqSyJL48IORcwwv6E0YQZ/dkcHKXT/Qh8U/YxFzP4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.17] update Xen version to 4.17.7 Message-Id: Date: Wed, 29 Jul 2026 14:11:01 +0000 commit 9373a593c5a6ef57db1302eb1dca58cc3eb51c07 Author: Jan Beulich AuthorDate: Wed Jul 29 15:37:29 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:37:29 2026 +0200 update Xen version to 4.17.7 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 05e08f5457..09fc386843 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 17 -export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .7$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.17 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:11:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:11:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375996.1622977 (Exim 4.92) (envelope-from ) id 1wp505-0004dm-41; Wed, 29 Jul 2026 14:11:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375996.1622977; Wed, 29 Jul 2026 14:11:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp505-0004de-1O; Wed, 29 Jul 2026 14:11:13 +0000 Received: by outflank-mailman (input) for mailman id 1375996; Wed, 29 Jul 2026 14:11:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp503-0004dV-RJ for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp504-00FHPP-0I for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp503-0030YE-2W for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vIDdA8NLgvn+c3SdgwJsHrnH5OKLSZrnO42ptEQNTG4=; b=NK0f3c6/jVdMbFpcjLx5EN7RM8 rrPS2Zk4T7P8ipukI2M4+1BDnGuh0N0mlD54z8ZEhJYsasOlyMV7oWrtB9ba07vuc94g6ataZ+lDs vfV1TH7VzepmtGO92rONl7xGWR024IA43QatXXdKLHOLvrY4qH/3eQTVZhTIMjCd1+bA=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] x86/cpu-policy: set up host policy earlier Message-Id: Date: Wed, 29 Jul 2026 14:11:11 +0000 commit aa2f6c99f3b7d2babbe21cdf81a6e5656583e242 Author: Jan Beulich AuthorDate: Wed Jul 29 16:02:31 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:02:31 2026 +0200 x86/cpu-policy: set up host policy earlier In order to use cpu_has_* expanding to host_cpu_policy.*, the host policy needs setting up alongside boot_cpu_data.x86_capability[]. Arrange for that towards the end of identify_cpu(). Then make sure .x86_capability[] and host policy remain in sync when setup_{force,clear}_cpu_cap() are used. Rename the function now it's no longer static. Fixes: 894bd7617924 ("x86/Intel: use host CPU policy for ARAT checking") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/cpu-policy.c | 11 ++++++++--- xen/arch/x86/cpu/common.c | 12 +++++++++++- xen/arch/x86/include/asm/cpu-policy.h | 6 ++++++ 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/cpu-policy.c b/xen/arch/x86/cpu-policy.c index 5273fe0ae4..eddcd9778f 100644 --- a/xen/arch/x86/cpu-policy.c +++ b/xen/arch/x86/cpu-policy.c @@ -359,11 +359,18 @@ void calculate_raw_cpu_policy(void) /* Was already added by probe_cpuid_faulting() */ } -static void __init calculate_host_policy(void) +void __init calculate_host_cpu_policy(void) { struct cpu_policy *p = &host_cpu_policy; unsigned int max_extd_leaf; + /* + * Bail if the raw policy wasn't set up yet. At least recalculate_xstate() + * can't be used yet in that case. + */ + if ( !raw_cpu_policy.basic.max_leaf ) + return; + *p = raw_cpu_policy; p->basic.max_leaf = @@ -904,8 +911,6 @@ static void __init calculate_hvm_def_policy(void) void __init init_guest_cpu_policies(void) { - calculate_host_policy(); - if ( IS_ENABLED(CONFIG_PV) ) { calculate_pv_max_policy(); diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index fe8a818c1b..771ec2cf86 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -66,8 +66,10 @@ void __init setup_clear_cpu_cap(unsigned int cap) __clear_bit(cap, boot_cpu_data.x86_capability); dfs = x86_cpu_policy_lookup_deep_deps(cap); - if (!dfs) + if (!dfs) { + calculate_host_cpu_policy(); return; + } for (i = 0; i < FSCAPINTS; ++i) { cleared_caps[i] |= dfs[i]; @@ -78,6 +80,8 @@ void __init setup_clear_cpu_cap(unsigned int cap) __builtin_return_address(0), i, forced_caps[i] & dfs[i]); } + + calculate_host_cpu_policy(); } void __init setup_force_cpu_cap(unsigned int cap) @@ -92,6 +96,10 @@ void __init setup_force_cpu_cap(unsigned int cap) } __set_bit(cap, boot_cpu_data.x86_capability); + + /* Don't recalculate when the bit isn't represented in the policy. */ + if (cap < FSCAPINTS * 32) + calculate_host_cpu_policy(); } bool __init is_forced_cpu_cap(unsigned int cap) @@ -586,6 +594,8 @@ void identify_cpu(struct cpuinfo_x86 *c) } /* Now the feature flags better reflect actual CPU features! */ + if (c == &boot_cpu_data) + calculate_host_cpu_policy(); xstate_init(c); diff --git a/xen/arch/x86/include/asm/cpu-policy.h b/xen/arch/x86/include/asm/cpu-policy.h index 99d5a8e67e..943407963a 100644 --- a/xen/arch/x86/include/asm/cpu-policy.h +++ b/xen/arch/x86/include/asm/cpu-policy.h @@ -30,4 +30,10 @@ void recalculate_cpuid_policy(struct domain *d); */ void calculate_raw_cpu_policy(void); +/* + * Collect the host CPU policy. Called after collecting enough CPUID output, + * and again after all feature overrides have been put in place. + */ +void calculate_host_cpu_policy(void); + #endif /* X86_CPU_POLICY_H */ -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:11:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:11:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1375997.1622981 (Exim 4.92) (envelope-from ) id 1wp50F-0004fj-5V; Wed, 29 Jul 2026 14:11:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1375997.1622981; Wed, 29 Jul 2026 14:11:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp50F-0004fb-2h; Wed, 29 Jul 2026 14:11:23 +0000 Received: by outflank-mailman (input) for mailman id 1375997; Wed, 29 Jul 2026 14:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp50E-0004fV-53 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp50E-00FHPn-1I for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp50E-0030Zi-0F for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=gy3mgHu7pus8ryDmlZXXVz4hpoESSrmwNR1EfegXqEc=; b=2zteBE4vkl8xkcgY6Tm9KagukP 7Y4Y6YTSFWmrr2QC+WkF7wR0jZH/w9yZ0EbNxocAoPoM5cn0mQeCoRWo2+finmjcFfChVOy9snr1C QqztrJ7ZlGSmOrJxGFwzt10P/qJ6WXV2SKHGcQHAGqy67gJg5bqPZ36CDGR6EAN8wYRo=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] x86/cpu-policy: set up host policy earlier Message-Id: Date: Wed, 29 Jul 2026 14:11:22 +0000 commit bdc4bf3b562470bfbbf770c87fb499198f2c4098 Author: Jan Beulich AuthorDate: Wed Jul 29 16:02:31 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:03:32 2026 +0200 x86/cpu-policy: set up host policy earlier In order to use cpu_has_* expanding to host_cpu_policy.*, the host policy needs setting up alongside boot_cpu_data.x86_capability[]. Arrange for that towards the end of identify_cpu(). Then make sure .x86_capability[] and host policy remain in sync when setup_{force,clear}_cpu_cap() are used. Rename the function now it's no longer static. Fixes: 894bd7617924 ("x86/Intel: use host CPU policy for ARAT checking") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/cpu-policy.c | 11 ++++++++--- xen/arch/x86/cpu/common.c | 12 +++++++++++- xen/arch/x86/include/asm/cpu-policy.h | 6 ++++++ 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/cpu-policy.c b/xen/arch/x86/cpu-policy.c index 5273fe0ae4..eddcd9778f 100644 --- a/xen/arch/x86/cpu-policy.c +++ b/xen/arch/x86/cpu-policy.c @@ -359,11 +359,18 @@ void calculate_raw_cpu_policy(void) /* Was already added by probe_cpuid_faulting() */ } -static void __init calculate_host_policy(void) +void __init calculate_host_cpu_policy(void) { struct cpu_policy *p = &host_cpu_policy; unsigned int max_extd_leaf; + /* + * Bail if the raw policy wasn't set up yet. At least recalculate_xstate() + * can't be used yet in that case. + */ + if ( !raw_cpu_policy.basic.max_leaf ) + return; + *p = raw_cpu_policy; p->basic.max_leaf = @@ -904,8 +911,6 @@ static void __init calculate_hvm_def_policy(void) void __init init_guest_cpu_policies(void) { - calculate_host_policy(); - if ( IS_ENABLED(CONFIG_PV) ) { calculate_pv_max_policy(); diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index fe8a818c1b..771ec2cf86 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -66,8 +66,10 @@ void __init setup_clear_cpu_cap(unsigned int cap) __clear_bit(cap, boot_cpu_data.x86_capability); dfs = x86_cpu_policy_lookup_deep_deps(cap); - if (!dfs) + if (!dfs) { + calculate_host_cpu_policy(); return; + } for (i = 0; i < FSCAPINTS; ++i) { cleared_caps[i] |= dfs[i]; @@ -78,6 +80,8 @@ void __init setup_clear_cpu_cap(unsigned int cap) __builtin_return_address(0), i, forced_caps[i] & dfs[i]); } + + calculate_host_cpu_policy(); } void __init setup_force_cpu_cap(unsigned int cap) @@ -92,6 +96,10 @@ void __init setup_force_cpu_cap(unsigned int cap) } __set_bit(cap, boot_cpu_data.x86_capability); + + /* Don't recalculate when the bit isn't represented in the policy. */ + if (cap < FSCAPINTS * 32) + calculate_host_cpu_policy(); } bool __init is_forced_cpu_cap(unsigned int cap) @@ -586,6 +594,8 @@ void identify_cpu(struct cpuinfo_x86 *c) } /* Now the feature flags better reflect actual CPU features! */ + if (c == &boot_cpu_data) + calculate_host_cpu_policy(); xstate_init(c); diff --git a/xen/arch/x86/include/asm/cpu-policy.h b/xen/arch/x86/include/asm/cpu-policy.h index 99d5a8e67e..943407963a 100644 --- a/xen/arch/x86/include/asm/cpu-policy.h +++ b/xen/arch/x86/include/asm/cpu-policy.h @@ -30,4 +30,10 @@ void recalculate_cpuid_policy(struct domain *d); */ void calculate_raw_cpu_policy(void); +/* + * Collect the host CPU policy. Called after collecting enough CPUID output, + * and again after all feature overrides have been put in place. + */ +void calculate_host_cpu_policy(void); + #endif /* X86_CPU_POLICY_H */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:22:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:22:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376038.1623013 (Exim 4.92) (envelope-from ) id 1wp5AZ-0007cc-OR; Wed, 29 Jul 2026 14:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376038.1623013; Wed, 29 Jul 2026 14:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5AZ-0007cU-La; Wed, 29 Jul 2026 14:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1376038; Wed, 29 Jul 2026 14:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5AY-0007c2-B4 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5AY-00FHds-0z for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5AX-0033E6-3B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=qOHQbSt/EFnsS3X0BMIJzzRtbCCOY5CxYgECpoJ7LaY=; b=qJFqcmdLrBRGf/pGK9I0GKQCCR bhIX9G6+Vs3MCI42v8rp+QzgO5+uLFsOdnkMK3jiNY+vPyJhJVq52qByV+dzko35PBc1CaUG5fwrx /yOOdQJFu2t4Zzn2bnTImrt5MXKjZyNleOHPm8T8cL4r0kr9WNfCqBN6Rq3T3OEoKq98=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 14:22:01 +0000 commit cd29f1c5dd84957683a8eae7fac019c83355c6d6 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 7f6381cdd2..de66f5989a 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:22:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:22:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376041.1623018 (Exim 4.92) (envelope-from ) id 1wp5Aj-0007kC-Ps; Wed, 29 Jul 2026 14:22:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376041.1623018; Wed, 29 Jul 2026 14:22:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5Aj-0007k4-Ms; Wed, 29 Jul 2026 14:22:13 +0000 Received: by outflank-mailman (input) for mailman id 1376041; Wed, 29 Jul 2026 14:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5Ai-0007iN-5Y for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5Ai-00FHdw-1M for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5Ai-0033Gr-0J for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lV20E+VxXps2sUvdQGjirw/ykyid7qVz3BcULuhkIMo=; b=VMmlqBtLZov1YYFgrBJEhTvZDb x4qBF6XiV8xWe0xTZlxmdVnOkqpibpeSbO/PbJr52fATpPbe6RuCZATuoxC4HWP7yhjIZq5oI7IAm 3ZUdJsdkW5MjHYpdyBKq0GUpYQr+ZAcAQN6xqTvTqlV8qerVqQ5Mo2quSUYXNi1sn+3w=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 14:22:12 +0000 commit ea59e89888db622552af35d93d89b74b12ffabe2 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index de66f5989a..4a45a31c28 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:22:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:22:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376045.1623019 (Exim 4.92) (envelope-from ) id 1wp5At-0007pk-Qd; Wed, 29 Jul 2026 14:22:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376045.1623019; Wed, 29 Jul 2026 14:22:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5At-0007pc-O9; Wed, 29 Jul 2026 14:22:23 +0000 Received: by outflank-mailman (input) for mailman id 1376045; Wed, 29 Jul 2026 14:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5As-0007pQ-9n for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5As-00FHeJ-1m for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5As-0033JQ-0i for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:22:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=xW/4h0nGhX7sG6VH/mJzNffXmQjfgfIDW+5pr6u75iE=; b=PdEC5Wx4qOYYbGllxevYXU/8fD SVYqr2Wa84iSneRitTDXxq5jjzqjT7mp7KbFwpsNYV9qRjg0wzViQDueUAVGnGwta0f3VzTgG7fjD fkXHGsBxdeXUkidGXG19St8sbU0xxUtX2wEsVThOnpywlObSBP0EK/eOOeTxCsda2Brg=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] CHANGELOG: add Arm and RISC-V entries for 4.22 Message-Id: Date: Wed, 29 Jul 2026 14:22:22 +0000 commit 1e549d1248529c9ceb9e9f0c6faca52a5be1eb7e Author: Oleksii Kurochko AuthorDate: Mon Jul 13 15:43:07 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:41:28 2026 +0100 CHANGELOG: add Arm and RISC-V entries for 4.22 Signed-off-by: Oleksii Kurochko Reviewed-by: Bertrand Marquis (cherry picked from commit 314958c1da1275977822275a1c05bb4dac3b8be0) --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6bb18fca75..1435855615 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - On Arm: - Support for guest suspend and resume to/from RAM via vPSCI. Applies only to non-hardware domain guests. + - Continued Armv8-R MPU enablement. + - Drop ThumbEE support. + - FF-A v1.2 support. + + - On RISC-V: + - SSTC extension support for Xen (not for guest yet). + - Introduce domain build helpers (CONFIG_DOMAIN_BUILD_HELPERS) which allows + to load Linux kernel, initrd and allocation related things forfor device + tree-based domains, laying the groundwork for guest boot support. ### Removed - On x86: -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:55:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:55:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376162.1623059 (Exim 4.92) (envelope-from ) id 1wp5gW-0006N5-2A; Wed, 29 Jul 2026 14:55:04 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376162.1623059; Wed, 29 Jul 2026 14:55:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5gV-0006Mx-Vw; Wed, 29 Jul 2026 14:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1376162; Wed, 29 Jul 2026 14:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5gU-0006Mr-08 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5gU-00FIKh-01 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5gT-003Cvd-29 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=rUlAS/z8X38YFY+G6+tQf1Noib1lnWxmaNe2rhh/eFE=; b=DcNRl38IovvVAZ259L5c59Swtf b92Q6RSxXRLhM62QhB0/eKt1GJw41K/E9zbCaempD8+Qr0WyBJYKtBFDIX5jeD/UL1PYzsStyf6vZ Kv63nmCRPDrFjZDlt+4V33sTY5MFNgg/N934I8+57QC52UI8Dgy2TckrVYy017mrwVpM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 14:55:01 +0000 commit fbfca3287498cbb28b762607ac69022221e32381 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:42:15 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index c55f73b265..1dd01c0f69 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -414,7 +414,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -444,6 +445,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -452,16 +456,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:55:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:55:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376163.1623064 (Exim 4.92) (envelope-from ) id 1wp5gf-0006Oz-44; Wed, 29 Jul 2026 14:55:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376163.1623064; Wed, 29 Jul 2026 14:55:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5gf-0006Oq-12; Wed, 29 Jul 2026 14:55:13 +0000 Received: by outflank-mailman (input) for mailman id 1376163; Wed, 29 Jul 2026 14:55:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5gd-0006Og-Sa for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5ge-00FILW-0Q for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5gd-003CxO-2c for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=JHj3fIyqMbjv0jCvJeaZW/N9pS9Dv7V80zI41G71ZbA=; b=G70seoWQat8rl0uCnx7hNGOoal 7kk0RYHJE477Kcyv7b1UCdhcl0o5Z7pT0vPF8LH9gmQA5IsrfKe0gMpsLe/dcAvkkUjhwTUABSHxP 0OXlWihRYk4FCF7Eq7JHp5Shf8wTzQ0wvVyfZUwlL4kR2KlGkM1kP3+fPpbbY+VVcs+A=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 14:55:11 +0000 commit 7d9d7512ce1d8da3e63384991d7d855c9012a794 Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:42:15 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 1dd01c0f69..e47e021b06 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -444,7 +444,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 14:55:24 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 14:55:24 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376164.1623067 (Exim 4.92) (envelope-from ) id 1wp5gq-0006Qz-5M; Wed, 29 Jul 2026 14:55:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376164.1623067; Wed, 29 Jul 2026 14:55:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5gq-0006Qs-2W; Wed, 29 Jul 2026 14:55:24 +0000 Received: by outflank-mailman (input) for mailman id 1376164; Wed, 29 Jul 2026 14:55:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp5go-0006Qh-AY for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp5go-00FIOc-1r for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp5go-003D1s-0n for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 14:55:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=2ArFJLlCD0Ao2Dq6hDN2JuIsz4gayX/R7UFClL3XHEo=; b=PZJAUTe77LINQR+G8QmNhazuZC 4uKwS2rtVQS5jxzyCbi1QjaT9lhnXEJfHnwrLCZgzXiDsF39KdsU+1nKZReXZzigmnLpDZ5rIeQJ5 x4fFVJBOpxZUe1Ts1SAblUxo7JgGeq6k3SiBvjISiCGbFVzrgHD+l8Zpb5uxBVMXMGfs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.21] update Xen version to 4.21.2 Message-Id: Date: Wed, 29 Jul 2026 14:55:22 +0000 commit 78c2a59f9edba7ee4da31c7c95ac52a003d56b91 Author: Jan Beulich AuthorDate: Wed Jul 29 16:46:42 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:46:42 2026 +0200 update Xen version to 4.21.2 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 8ffa719ab9..1d7c07d1fb 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 21 -export XEN_EXTRAVERSION ?= .2-pre$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .2$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 15:33:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 15:33:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376282.1623108 (Exim 4.92) (envelope-from ) id 1wp6HH-00062C-Cz; Wed, 29 Jul 2026 15:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376282.1623108; Wed, 29 Jul 2026 15:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp6HH-000624-AV; Wed, 29 Jul 2026 15:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1376282; Wed, 29 Jul 2026 15:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp6HF-00061w-VF for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:33:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp6HF-00FJEN-2k for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:33:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp6HF-003GXb-1g for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:33:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=l53zDImLbP9bAUmY7obTdXxi7VYhXPjm3MGUZvTK68k=; b=CvH816p8y/ooNO3uBlbNhlWHm/ jiCVSHjSqrmrL3YFUa4bLT7/zYGz4o5k/AtwOnBhIncCJnA23FVK92KkMZ7ZjqHUiExxDQpg3FHfo hwFn2jADUo6x3qa4iBZQBhmUzP6jxa2We8d5YCKMNd38reN3K0/giimGborTYgT8kuv4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.20] update Xen version to 4.20.4 Message-Id: Date: Wed, 29 Jul 2026 15:33:01 +0000 commit 9611e26eff425be128d4b9c7b48f2bc6b5d3498e Author: Jan Beulich AuthorDate: Wed Jul 29 17:18:52 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 17:18:52 2026 +0200 update Xen version to 4.20.4 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 3e4d636a15..d9df42b1bb 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 20 -export XEN_EXTRAVERSION ?= .4-pre$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .4$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 15:55:11 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 15:55:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376314.1623112 (Exim 4.92) (envelope-from ) id 1wp6cZ-0000pL-1j; Wed, 29 Jul 2026 15:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376314.1623112; Wed, 29 Jul 2026 15:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp6cY-0000pD-Uq; Wed, 29 Jul 2026 15:55:02 +0000 Received: by outflank-mailman (input) for mailman id 1376314; Wed, 29 Jul 2026 15:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp6cY-0000p7-3a for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp6cY-00FJg0-0n for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp6cX-003IGV-30 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 15:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=XZOw4kW9gDYTgXHNNmCgZT5Yh5DQGuq0/oM/E9dXpjY=; b=MK5NAbQqIxNTM3wh2LU5tsKcy/ hrN//j6xhTCyaAROMsxsxBPhD2MLYjkVX2/Hbj+YaQz+uTuqYoX3V1ByekLpF/w4Jq7VtE1z1WJn6 9jN8slM7rSUswmV/dWy6NUL3kOosqVz/qOFG2b46ptw2z5z8DUorIPbfbzq6qRJQ1eiM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.19] update Xen version to 4.19.6 Message-Id: Date: Wed, 29 Jul 2026 15:55:01 +0000 commit 54ee7c511ae7f5cac195cce271564a1a339ae99a Author: Jan Beulich AuthorDate: Wed Jul 29 15:34:38 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:34:38 2026 +0200 update Xen version to 4.19.6 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 683cb4bdac..dd9c8d3235 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 19 -export XEN_EXTRAVERSION ?= .5$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.19 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 16:22:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 16:22:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376391.1623143 (Exim 4.92) (envelope-from ) id 1wp72h-0007B8-JZ; Wed, 29 Jul 2026 16:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376391.1623143; Wed, 29 Jul 2026 16:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp72h-0007B0-Gt; Wed, 29 Jul 2026 16:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1376391; Wed, 29 Jul 2026 16:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp72g-0007Au-JM for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 16:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp72g-00FKp0-23 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 16:22:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp72g-003KL6-10 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 16:22:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=lmvIREH7f/NKlDVCvVPYTl1nfq+La5v933kPaw2dpms=; b=g+ria1ygG01mhUlvGhoJr7UInT EB+5vrvgF691NUwg539xlIbcdTC65jTOLjNDAqN1b6KDDfKeJgUxjOLHJkUZiaE5pY2cZ5zvecccI v2PfGbJl6KuGnGUn9qFltJiqOQP9LbdyZRIM4d0eZFhuwYu6EaluDgmZlffGHmJ7BB28=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.18] update Xen version to 4.18.6 Message-Id: Date: Wed, 29 Jul 2026 16:22:02 +0000 commit c9355898f3b8e10ca49e87d50e335d682827c33b Author: Jan Beulich AuthorDate: Wed Jul 29 15:36:02 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 15:36:02 2026 +0200 update Xen version to 4.18.6 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 5fc7fe27da..965373f199 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 18 -export XEN_EXTRAVERSION ?= .5$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .6$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 17:33:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 17:33:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376520.1623201 (Exim 4.92) (envelope-from ) id 1wp89P-0003jN-P6; Wed, 29 Jul 2026 17:33:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376520.1623201; Wed, 29 Jul 2026 17:33:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp89P-0003jE-LV; Wed, 29 Jul 2026 17:33:03 +0000 Received: by outflank-mailman (input) for mailman id 1376520; Wed, 29 Jul 2026 17:33:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp89O-0003j3-Dx for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp89O-00FMRE-1u for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp89O-003W9a-0i for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=yDqF+JyJr4eu13vG4z2VYSDNegpG5SDgYj/n60Q4CME=; b=388VTU/iagdtQDZUWvu2WsTNY6 clx7tW33SrvS7W7dzovgdBqelB1Ekg8SxETuU9QL9J2KDzioDac27xcNr+WkYmC0LPsclhI8h5Yhc 2YRzoJe9gzcVA1UeXaFkS79sbuN6pczIIdiiELFVOjG9bqzADscUC2qzW+JpAlH65BUs=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] xen/credit: fix race with schedule_cpu_rm() in csched_timer() Message-Id: Date: Wed, 29 Jul 2026 17:33:02 +0000 commit dca917bff4a0253a57616b485a26d419615c4003 Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:42 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:51:51 2026 +0100 xen/credit: fix race with schedule_cpu_rm() in csched_timer() When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer firing before being killed, so csched_timer() needs to test the per-cpu data being set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko (cherry picked from commit ea1d785a5f660ec52ec70454a0410c2f7fb2930a) --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 07656a57e9..63ef0d1318 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1588,6 +1588,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc = CSCHED_PCPU(cpu); struct csched_private *prv = CSCHED_PRIV(sr->scheduler); + /* Handle race of timer disabling vs. firing when switching scheduler. */ + if ( !spc ) + return; + spc->tick++; /* -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 17:33:13 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 17:33:13 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376522.1623205 (Exim 4.92) (envelope-from ) id 1wp89Z-0003lA-Pd; Wed, 29 Jul 2026 17:33:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376522.1623205; Wed, 29 Jul 2026 17:33:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp89Z-0003l2-My; Wed, 29 Jul 2026 17:33:13 +0000 Received: by outflank-mailman (input) for mailman id 1376522; Wed, 29 Jul 2026 17:33:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp89Y-0003ks-Ef for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp89Y-00FMRI-2F for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp89Y-003WAJ-1D for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 17:33:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=9B2MvjN3f5hmwOCVQoPPjR9nEf4yfA/Meiiq7d3RoXM=; b=3COOMpdmpkC9YbXdog4owt4D3H MbrxsZIM0VM1eSSMoyQy8wVukx30CkN0M9oVySn9bWafcEW6mvJwQHOUAywpUxuEu5Kls7kTMf4CT GZMfKWRXAB1D+t69SPOrJZ50fr0xH3l2JbKaYFJhQfbJF9LZasenohGwX7XkLozRx+q4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] x86/cpu-policy: set up host policy earlier Message-Id: Date: Wed, 29 Jul 2026 17:33:12 +0000 commit bdc4bf3b562470bfbbf770c87fb499198f2c4098 Author: Jan Beulich AuthorDate: Wed Jul 29 16:02:31 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:03:32 2026 +0200 x86/cpu-policy: set up host policy earlier In order to use cpu_has_* expanding to host_cpu_policy.*, the host policy needs setting up alongside boot_cpu_data.x86_capability[]. Arrange for that towards the end of identify_cpu(). Then make sure .x86_capability[] and host policy remain in sync when setup_{force,clear}_cpu_cap() are used. Rename the function now it's no longer static. Fixes: 894bd7617924 ("x86/Intel: use host CPU policy for ARAT checking") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/cpu-policy.c | 11 ++++++++--- xen/arch/x86/cpu/common.c | 12 +++++++++++- xen/arch/x86/include/asm/cpu-policy.h | 6 ++++++ 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/cpu-policy.c b/xen/arch/x86/cpu-policy.c index 5273fe0ae4..eddcd9778f 100644 --- a/xen/arch/x86/cpu-policy.c +++ b/xen/arch/x86/cpu-policy.c @@ -359,11 +359,18 @@ void calculate_raw_cpu_policy(void) /* Was already added by probe_cpuid_faulting() */ } -static void __init calculate_host_policy(void) +void __init calculate_host_cpu_policy(void) { struct cpu_policy *p = &host_cpu_policy; unsigned int max_extd_leaf; + /* + * Bail if the raw policy wasn't set up yet. At least recalculate_xstate() + * can't be used yet in that case. + */ + if ( !raw_cpu_policy.basic.max_leaf ) + return; + *p = raw_cpu_policy; p->basic.max_leaf = @@ -904,8 +911,6 @@ static void __init calculate_hvm_def_policy(void) void __init init_guest_cpu_policies(void) { - calculate_host_policy(); - if ( IS_ENABLED(CONFIG_PV) ) { calculate_pv_max_policy(); diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index fe8a818c1b..771ec2cf86 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -66,8 +66,10 @@ void __init setup_clear_cpu_cap(unsigned int cap) __clear_bit(cap, boot_cpu_data.x86_capability); dfs = x86_cpu_policy_lookup_deep_deps(cap); - if (!dfs) + if (!dfs) { + calculate_host_cpu_policy(); return; + } for (i = 0; i < FSCAPINTS; ++i) { cleared_caps[i] |= dfs[i]; @@ -78,6 +80,8 @@ void __init setup_clear_cpu_cap(unsigned int cap) __builtin_return_address(0), i, forced_caps[i] & dfs[i]); } + + calculate_host_cpu_policy(); } void __init setup_force_cpu_cap(unsigned int cap) @@ -92,6 +96,10 @@ void __init setup_force_cpu_cap(unsigned int cap) } __set_bit(cap, boot_cpu_data.x86_capability); + + /* Don't recalculate when the bit isn't represented in the policy. */ + if (cap < FSCAPINTS * 32) + calculate_host_cpu_policy(); } bool __init is_forced_cpu_cap(unsigned int cap) @@ -586,6 +594,8 @@ void identify_cpu(struct cpuinfo_x86 *c) } /* Now the feature flags better reflect actual CPU features! */ + if (c == &boot_cpu_data) + calculate_host_cpu_policy(); xstate_init(c); diff --git a/xen/arch/x86/include/asm/cpu-policy.h b/xen/arch/x86/include/asm/cpu-policy.h index 99d5a8e67e..943407963a 100644 --- a/xen/arch/x86/include/asm/cpu-policy.h +++ b/xen/arch/x86/include/asm/cpu-policy.h @@ -30,4 +30,10 @@ void recalculate_cpuid_policy(struct domain *d); */ void calculate_raw_cpu_policy(void); +/* + * Collect the host CPU policy. Called after collecting enough CPUID output, + * and again after all feature overrides have been put in place. + */ +void calculate_host_cpu_policy(void); + #endif /* X86_CPU_POLICY_H */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 18:11:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 18:11:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376547.1623218 (Exim 4.92) (envelope-from ) id 1wp8kA-00029i-NR; Wed, 29 Jul 2026 18:11:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376547.1623218; Wed, 29 Jul 2026 18:11:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8kA-00029a-Kf; Wed, 29 Jul 2026 18:11:02 +0000 Received: by outflank-mailman (input) for mailman id 1376547; Wed, 29 Jul 2026 18:11:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8k9-00029U-UL for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp8k9-00FNNU-2x for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp8k9-003dzT-1w for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=TJmSkfJt5kULBV869L1lGVDaO5Qb45M1UAXoQJUcCag=; b=qVtiZZpwYJfvgtmpX9qUHfET7J UuuBsOyrU4bVR5A49VQgtmEjd6hCGxsROuxgGzjiIGf+eKsoHnCJAu5zbhd4Wp1ijhtRwUZ8LPcd+ TI/e7LxFiFT/a8+eQUtvn6jx0YJvWQ6CO3HN6kn8zsCJKEMigEA2B3MxAvDyAt1bbXns=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.21] update Xen version to 4.21.2 Message-Id: Date: Wed, 29 Jul 2026 18:11:01 +0000 commit 78c2a59f9edba7ee4da31c7c95ac52a003d56b91 Author: Jan Beulich AuthorDate: Wed Jul 29 16:46:42 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:46:42 2026 +0200 update Xen version to 4.21.2 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 8ffa719ab9..1d7c07d1fb 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 21 -export XEN_EXTRAVERSION ?= .2-pre$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .2$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.21 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 18:11:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 18:11:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376548.1623222 (Exim 4.92) (envelope-from ) id 1wp8kK-0002BE-Of; Wed, 29 Jul 2026 18:11:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376548.1623222; Wed, 29 Jul 2026 18:11:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8kK-0002B6-Ly; Wed, 29 Jul 2026 18:11:12 +0000 Received: by outflank-mailman (input) for mailman id 1376548; Wed, 29 Jul 2026 18:11:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8kK-0002Ay-3P for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp8kK-00FNNk-14 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp8kK-003e2E-03 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=8PXyyeCnaKJ617ktcDWOkutepCG0p0VK5BqWyl40ZSg=; b=tdv8WjHRCyhC53EWsY1Z6PrveI aYn5NXEkVarTsHSLq3/ueTtoDVE36Ol9RsdbSWt52T0JDUSuPy7tm8ptaP0S193yx3IT3uvKtUPy5 4uTE5k8ecHN5Zx/PeuJ0q47dMieQxgxgfeG1SuAZeoOrWy2A6lm8TU4lZ7oxV5UkkX4M=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM Message-Id: Date: Wed, 29 Jul 2026 18:11:12 +0000 commit 9f4431e6d1d3c3300d217389ec60fe2f92baf161 Author: Andrew Cooper AuthorDate: Tue Jul 28 10:52:49 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:46:53 2026 +0100 tools/ocaml: Fix crash in Xenctrl.domain_getinfo{,list}() on ARM The Store_field(result, 16, arch_config) sits inside an #ifdef x86, meaning that on other architectures the pointer is not filled in. Ocaml code then falls over a NULL(ish) pointer (really the Val_unit used to initialise 'result') when the layout in the heap doesn't match the type system. Rearrange alloc_domaininfo() to avoid this. Similarly to physinfo_arch_caps(), raise an exception if the architecture code hasn't filled in an appropriate tag. Move the setup of arch_domainconfig to be common logic. In order to simplify the addition of other architectures, remove the arch_config variable (reusing tmp as it's touched exactly once), and rename x86_arch_config to be arch_config so each architecture can fill in a suitable one without needing more local variables. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Reported-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 365d2a5be3fa34b22c37ef4b6ff3efd3ce05b387) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 90353ec89d..4b8ba5b004 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -401,7 +401,8 @@ CAMLprim value stub_xc_domain_shutdown(value xch_val, value domid, value reason) static value alloc_domaininfo(xc_domaininfo_t * info) { CAMLparam0(); - CAMLlocal5(result, tmp, arch_config, x86_arch_config, emul_list); + CAMLlocal4(result, tmp, arch_config, emul_list); + int tag = -1; int i; result = caml_alloc_tuple(17); @@ -431,6 +432,9 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); #if defined(__i386__) || defined(__x86_64__) + + tag = 1; /* tag x86 */ + /* * emulation_flags: x86_arch_emulation_flags list; */ @@ -439,16 +443,17 @@ static value alloc_domaininfo(xc_domaininfo_t * info) (info->arch_config.emulation_flags); /* xen_x86_arch_domainconfig */ - x86_arch_config = caml_alloc_tuple(1); - Store_field(x86_arch_config, 0, emul_list); + arch_config = caml_alloc_tuple(1); + Field(arch_config, 0) = emul_list; - /* arch_config: arch_domainconfig */ - arch_config = caml_alloc_small(1, 1); - - Store_field(arch_config, 0, x86_arch_config); - - Store_field(result, 16, arch_config); #endif + if (tag < 0) + caml_failwith("Unimplemented architecture in alloc_domaininfo()"); + + /* arch_config: arch_domainconfig */ + tmp = caml_alloc_small(1, tag); + Field(tmp, 0) = arch_config; + Field(result, 16) = tmp; CAMLreturn(result); } -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 18:11:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 18:11:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376549.1623226 (Exim 4.92) (envelope-from ) id 1wp8kU-0002DP-Pk; Wed, 29 Jul 2026 18:11:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376549.1623226; Wed, 29 Jul 2026 18:11:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8kU-0002DI-NN; Wed, 29 Jul 2026 18:11:22 +0000 Received: by outflank-mailman (input) for mailman id 1376549; Wed, 29 Jul 2026 18:11:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8kU-0002DC-6T for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp8kU-00FNOB-1P for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp8kU-003e4j-0M for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:11:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vExcqLH7cjE5soFKmwLFpaNCY/I0p9xz1Mxx1zJo6KY=; b=KatzTUm3zxBxv+Ha/kgkCHX0uk VEa/A04GnRzcfVJZa8Fhbd/eSB/cM5ufeckvZPS9cJT/S1rZhqxUV/Hxee2bKRzjIzSHy4txaXqSF 44C2x/wINespx3E8C5znyXY3N0wejgtkxz0a14kaUPsShFoJy1VI49V7yI4VorCJTxdw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Message-Id: Date: Wed, 29 Jul 2026 18:11:22 +0000 commit 1b917fef1a54e2844e097402f4dfd1cc27e3e7cf Author: Julian Vetter AuthorDate: Mon Jul 27 11:11:29 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 13:46:53 2026 +0100 tools/ocaml: Fill arch_config for ARM in domain_getinfo{,list}() Add the missing ARM logic, populating xen_arm_arch_domainconfig from the raw xc_domaininfo_t the same way the x86 branch does for xen_x86_arch_domainconfig. Fixes: 9d683b5e375d ("tools/ocaml: Expose arch_config in domaininfo") Fixes: 81838c9067ab ("ocaml: fix arm build") Signed-off-by: Julian Vetter Signed-off-by: Andrew Cooper Reviewed-by: Teddy Astie Release-Acked-by: Oleksii Kurochko (cherry picked from commit 01b4b39e2eaf2991024190adcc0e015b3d77ec41) --- tools/ocaml/libs/xc/xenctrl_stubs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/ocaml/libs/xc/xenctrl_stubs.c b/tools/ocaml/libs/xc/xenctrl_stubs.c index 4b8ba5b004..ce93bc65f0 100644 --- a/tools/ocaml/libs/xc/xenctrl_stubs.c +++ b/tools/ocaml/libs/xc/xenctrl_stubs.c @@ -431,7 +431,19 @@ static value alloc_domaininfo(xc_domaininfo_t * info) Store_field(result, 15, tmp); -#if defined(__i386__) || defined(__x86_64__) +#if defined(__arm__) || defined(__aarch64__) + + tag = 0; /* tag ARM */ + + /* xen_arm_arch_domainconfig */ + arch_config = caml_alloc_tuple(3); + Field(arch_config, 0) = Val_int(info->arch_config.gic_version); + Field(arch_config, 1) = Val_int(info->arch_config.nr_spis); + + tmp = caml_copy_int32(info->arch_config.clock_frequency); + Field(arch_config, 2) = tmp; + +#elif defined(__i386__) || defined(__x86_64__) tag = 1; /* tag x86 */ -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 18:22:04 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 18:22:04 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376555.1623230 (Exim 4.92) (envelope-from ) id 1wp8uo-0003gp-I6; Wed, 29 Jul 2026 18:22:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376555.1623230; Wed, 29 Jul 2026 18:22:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8uo-0003gh-FU; Wed, 29 Jul 2026 18:22:02 +0000 Received: by outflank-mailman (input) for mailman id 1376555; Wed, 29 Jul 2026 18:22:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp8un-0003gb-OS for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:22:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp8un-00FNbu-2u for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp8un-003gdE-1r for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 18:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=r5KVVKjrY+I0KYAp0F2QtpTGn2z5D47h6TOSTg5xxP0=; b=1WXu6XKRGYqQW0zQ0z71IoMbI2 QfnLZF1+/rUaEghjSO0A3rtIXSLAqby6Jjbt1Y3ESMVsEGza2UUdPjjGA+RanGPouwzGjikJrig+N 7q92WmX1Ct6vJ8dcPYPAlONN3oKiBjbVnXPQ/BFmGYVwpigqH5/7Z3uyXFLX2SNnyPI4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] CHANGELOG: Set release date for 4.22 Message-Id: Date: Wed, 29 Jul 2026 18:22:01 +0000 commit d1aaf6358dd5518d0853710db078c07c822fb392 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:08:29 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:13:38 2026 +0100 CHANGELOG: Set release date for 4.22 Signed-off-by: Andrew Cooper --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8994fb6b46..aa1a777dd4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) affect Xen kexec support in the kexec-tools package. - The example stubdom "c-stubdom" has been removed. -## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD +## [4.22.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - 2026-07-30 ### Changed - Users of XEN_DOMCTL_createdomain/xc_domain_create() must now pass DOMID_ANY -- generated by git-patchbot for /home/xen/git/xen.git#staging From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:11:08 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:11:08 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376652.1623269 (Exim 4.92) (envelope-from ) id 1wp9gE-0005Ac-KE; Wed, 29 Jul 2026 19:11:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376652.1623269; Wed, 29 Jul 2026 19:11:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gE-0005AU-Hl; Wed, 29 Jul 2026 19:11:02 +0000 Received: by outflank-mailman (input) for mailman id 1376652; Wed, 29 Jul 2026 19:11:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gD-0005AO-U5 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9gD-00FOjg-37 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9gD-003raH-25 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=vDX/qZZJbTN5iFp8jOkKVkghWU2Ss02ij7FuKZ//LOo=; b=HNGVWCGuk6unDaCXiLzLkAy86h 1IBnbdqs/YLKUAeMtPVVt7NBXwtLAxomFvSMm7MxwuVPDngNtodBOPVepOTZJkRK+/xG38ZAt/Up9 Wox/lPwbwNcQoqmc2jBaxvQnv6ZyD21pNsJqaN9LF8qe5/hIN2rDuvHBI+K0eDIlCssY=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] CHANGELOG: Set release date for 4.22 Message-Id: Date: Wed, 29 Jul 2026 19:11:01 +0000 commit 2b638b908e2be631927179d4b29635742c87a157 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:08:29 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 CHANGELOG: Set release date for 4.22 Signed-off-by: Andrew Cooper Acked-by: Roger Pau Monné Acked-by: Oleksii Kurochko (cherry picked from commit d1aaf6358dd5518d0853710db078c07c822fb392) --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1435855615..6f879c9796 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ Notable changes to Xen will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) -## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD +## [4.22.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - 2026-07-30 ### Changed - Users of XEN_DOMCTL_createdomain/xc_domain_create() must now pass DOMID_ANY -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:11:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:11:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376653.1623274 (Exim 4.92) (envelope-from ) id 1wp9gO-0005Co-NO; Wed, 29 Jul 2026 19:11:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376653.1623274; Wed, 29 Jul 2026 19:11:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gO-0005Ce-KZ; Wed, 29 Jul 2026 19:11:12 +0000 Received: by outflank-mailman (input) for mailman id 1376653; Wed, 29 Jul 2026 19:11:11 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gN-0005CR-Q4 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9gO-00FOjw-0B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9gN-003rce-2O for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=CZZRNa6AYpnaJzt9BvwC0/N/1Rlk3C49HQStm4W5AqQ=; b=gFolg+KHd0XHWuA2hJMDlUfgIu vUdNYroPk+CiqI5+jNJKpHNb70Jow7Ix00qQ81WaP7MJj7xWV8+U1TtRZ8y4+TQBtjjlSRfiQHbcp u6K7zpGlW6HxVpmonXmKyAvgpe2XW7D0ron+5fa6vTG4KQrS6Dboe6k4UAlg0Jvqa/GQ=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] SUPPORT: Define support lifetime Message-Id: Date: Wed, 29 Jul 2026 19:11:11 +0000 commit 41f0cbc76580e75a8d14733844d16bd110ae6580 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:12:08 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 SUPPORT: Define support lifetime Signed-off-by: Andrew Cooper Acked-by: Roger Pau Monné Release-Acked-by: Oleksii Kurochko --- SUPPORT.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 7c42de4c16..b945fc83af 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -9,13 +9,13 @@ for the definitions of the support status levels etc. # Release Support - Xen-Version: 4.22-rc - Initial-Release: n/a - Supported-Until: TBD - Security-Support-Until: Unreleased - not yet security-supported + Xen-Version: 4.22 + Initial-Release: 2026-07-30 + Supported-Until: 2029-07-30 + Security-Support-Until: 2031-07-30 Release Notes -: RN +: RN # Feature Support -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:11:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:11:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376654.1623278 (Exim 4.92) (envelope-from ) id 1wp9gY-0005Eq-Og; Wed, 29 Jul 2026 19:11:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376654.1623278; Wed, 29 Jul 2026 19:11:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gY-0005Ei-Ls; Wed, 29 Jul 2026 19:11:22 +0000 Received: by outflank-mailman (input) for mailman id 1376654; Wed, 29 Jul 2026 19:11:21 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gX-0005Eb-TR for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:21 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9gY-00FOkK-0T for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:21 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9gX-003rfb-2g for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=l8BZrGrIm1aUUQ9rk/dgnkjAuovT1FhNhgTljT8tuDU=; b=gzIIdlbexPIcYZe77mRTdnwwmT P4Q/Eo9720M28TxixqfR3vrU2000ZF/H3wr1lVbxlZe3SoDBPmla782zub6YZZVAEpywTyVgiGQmt dkxjxymMo3Ivs7LCHoCA1KNNbNpqVmhYcRuD0/GBzAasydt674vsKHZ/Ya6clCkjjJCM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] Config.mk: Bump tags to final Message-Id: Date: Wed, 29 Jul 2026 19:11:21 +0000 commit 3e23992b765b27d5644e76f3c560ce02f84f2007 Author: Andrew Cooper AuthorDate: Wed Jul 29 19:29:21 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 Config.mk: Bump tags to final Signed-off-by: Andrew Cooper --- Config.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Config.mk b/Config.mk index bf0f30424c..5a3aa902c5 100644 --- a/Config.mk +++ b/Config.mk @@ -214,10 +214,10 @@ OVMF_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/ovmf.git OVMF_UPSTREAM_REVISION ?= ba91d0292e593df8528b66f99c1b0b14fadc8e16 QEMU_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/qemu-xen.git -QEMU_UPSTREAM_REVISION ?= 0edeb44c093bea39f0fe4d936ee363b99113ffe1 +QEMU_UPSTREAM_REVISION ?= qemu-xen-4.22.0 MINIOS_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/mini-os.git -MINIOS_UPSTREAM_REVISION ?= b6f79f5f44cf69044079c042b88fe9d75367642e +MINIOS_UPSTREAM_REVISION ?= xen-RELEASE-4.22.0 SEABIOS_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/seabios.git SEABIOS_UPSTREAM_REVISION ?= rel-1.17.0 -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:11:32 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:11:32 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376655.1623282 (Exim 4.92) (envelope-from ) id 1wp9gi-0005Gk-Pn; Wed, 29 Jul 2026 19:11:32 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376655.1623282; Wed, 29 Jul 2026 19:11:32 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gi-0005Gc-NE; Wed, 29 Jul 2026 19:11:32 +0000 Received: by outflank-mailman (input) for mailman id 1376655; Wed, 29 Jul 2026 19:11:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9gi-0005GW-02 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9gi-00FOkO-0n for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:31 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9gh-003rhs-2y for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:11:31 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=u6ISPRkw6sP7RVw3EdzcoUW7gdlDuXd+5L5HOOxrjuM=; b=OxlwbF/SB2+7vbUD5bi/C9jFDs vffzDeXd0Hd26vnmsZNA00DwbN0TZOWDbtDZOjzq0Sb/Bzr2+cvymFVVoBJDvshLiM3FeeToXEiYZ xylqsLYaBYq68UWesamSwEFtYOBJaJ98FxDwT4aMGoV5T1w2ErL1CRUaf2PwRC2OlcsM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging-4.22] Update to Xen 4.22 Message-Id: Date: Wed, 29 Jul 2026 19:11:31 +0000 commit d45d5687f1441495f4ee20d5e9940066c5fa5beb Author: Andrew Cooper AuthorDate: Wed Jul 29 19:30:13 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 Update to Xen 4.22 Signed-off-by: Andrew Cooper --- README | 12 ++++++------ xen/Makefile | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/README b/README index 3dcc00c4a4..ebe4893b65 100644 --- a/README +++ b/README @@ -1,11 +1,11 @@ -############################################################ +###################################### __ __ _ _ ____ ____ -\ \/ /___ _ __ | || | |___ \|___ \ _ __ ___ - \ // _ \ '_ \ | || |_ __) | __) |__| '__/ __| - / \ __/ | | | |__ _| / __/ / __/|__| | | (__ -/_/\_\___|_| |_| |_|(_)_____|_____| |_| \___| +\ \/ /___ _ __ | || | |___ \|___ \ + \ // _ \ '_ \ | || |_ __) | __) | + / \ __/ | | | |__ _| / __/ / __/| +/_/\_\___|_| |_| |_|(_)_____|_____| -############################################################ +###################################### https://www.xen.org/ diff --git a/xen/Makefile b/xen/Makefile index 8d4cfb737a..725f220ee6 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 22 -export XEN_EXTRAVERSION ?= .0-rc4$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .0$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:22:05 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:22:05 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376671.1623285 (Exim 4.92) (envelope-from ) id 1wp9qt-0006tp-Gy; Wed, 29 Jul 2026 19:22:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376671.1623285; Wed, 29 Jul 2026 19:22:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9qt-0006th-EO; Wed, 29 Jul 2026 19:22:03 +0000 Received: by outflank-mailman (input) for mailman id 1376671; Wed, 29 Jul 2026 19:22:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9qs-0006tb-9h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9qs-00FOxc-0B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9qr-003tkT-2O for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=WTDgfG3eMOAlm2njiu8qU1dM9AX1Ta7HzqPVG5dYw0c=; b=kG+HIjM6zz6yAd2a/vBjcBO7ji g52/ky9xsl19NjPnAJZNLZzM6CAPkY+FPz7ltAuzfl5DSfBL5Lgb/yaGNcHBV8cOKygUuhQDfydaK TrYapM4+pQyTDHHgn7Vpj80Lo80gk0yPOhldi0mlYdupRjvsw73iqhmDn0JWc1vLwfVw=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/credit: fix race with schedule_cpu_rm() in csched_timer() Message-Id: Date: Wed, 29 Jul 2026 19:22:01 +0000 commit ea1d785a5f660ec52ec70454a0410c2f7fb2930a Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:42 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:41:22 2026 +0100 xen/credit: fix race with schedule_cpu_rm() in csched_timer() When removing a CPU from a cpupool running the credit scheduler, a race might happen between schedule_cpu_rm() and csched_timer(), resulting in a NULL dereference. The timer associated with csched_timer() is killed only in csched_deinit_pdata(), which is called by schedule_cpu_rm() after setting the scheduler's per-cpu data to NULL AND after enabling interrupts again. This can result in the timer firing before being killed, so csched_timer() needs to test the per-cpu data being set before accessing it. Fixes: 78be3dbbfefa ("cpupools [1/6]: hypervisor changes") Reported-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/common/sched/credit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 328c802d0c..4dde2ede12 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -1589,6 +1589,10 @@ static void cf_check csched_tick(void *_cpu) struct csched_pcpu *spc = CSCHED_PCPU(cpu); struct csched_private *prv = CSCHED_PRIV(sr->scheduler); + /* Handle race of timer disabling vs. firing when switching scheduler. */ + if ( !spc ) + return; + spc->tick++; /* -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:22:12 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:22:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376672.1623289 (Exim 4.92) (envelope-from ) id 1wp9r2-0006vk-I8; Wed, 29 Jul 2026 19:22:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376672.1623289; Wed, 29 Jul 2026 19:22:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9r2-0006vc-Fe; Wed, 29 Jul 2026 19:22:12 +0000 Received: by outflank-mailman (input) for mailman id 1376672; Wed, 29 Jul 2026 19:22:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9r1-0006vV-V8 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:11 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9r2-00FOxg-0g for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:11 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9r1-003tmf-2h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:11 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=2AjLbs7+l64YL/QQHIQu8bfhDYsGrjIWwRGU/job4C8=; b=3zKvZJ9dwy9C8bJh9mFG4f1jcK WHq8YaBtyeifwQTG1LfgfR/TUuwgrfJiqCuD4ca1ipNmLVTJtt1TLpm0U8X5sJoj9AmY/OUbfUIg/ NOW1bcsMIsipqc6GoxgrbdJMf8am468ccq8mMwbzXzQo2ae4tEFnSsFN/g7blvIDGAXM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] xen/sched: fix schedule_dump() handling of free cpus Message-Id: Date: Wed, 29 Jul 2026 19:22:11 +0000 commit f38e8cb85aa7e04b737482b2f4eeb9d6d40a2e61 Author: Juergen Gross AuthorDate: Wed Jul 29 14:06:43 2026 +0200 Commit: Andrew Cooper CommitDate: Wed Jul 29 14:41:22 2026 +0100 xen/sched: fix schedule_dump() handling of free cpus With the introduction of core scheduling, cpus not used by any cpupool have been switched to use the very simple idle scheduler instead of the default scheduler. Trying to obtain diagnostic scheduling data via the "r" debug key is scanning through all cpupools using the per-cpupool scheduler to print the related data. Unfortunately the switch to use the idle scheduler for free cpus wasn't reflected in schedule_dump(), causing the default scheduler's dump_cpu_state callback to be used for free cpus. This causes NULL dereferences in case the default scheduler is one of credit or null. Fix that by using the idle scheduler instead of the default scheduler for free cpus. Note that it is fine for a scheduler to have no dump_cpu_state callback. Fixes: f855dd962523 ("sched: add minimalistic idle scheduler for free cpus") Reported-by: Dietmar Hahn Tested-by: Dietmar Hahn Signed-off-by: Juergen Gross Acked-by: Andrew Cooper --- xen/common/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 55b71301cf..9ccf5811bf 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -3452,7 +3452,7 @@ void schedule_dump(struct cpupool *c) } else { - sched = &operations; + sched = &sched_idle_ops; cpus = &cpupool_free_cpus; } -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:22:22 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:22:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376673.1623294 (Exim 4.92) (envelope-from ) id 1wp9rC-0006xg-JS; Wed, 29 Jul 2026 19:22:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376673.1623294; Wed, 29 Jul 2026 19:22:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9rC-0006xY-H2; Wed, 29 Jul 2026 19:22:22 +0000 Received: by outflank-mailman (input) for mailman id 1376673; Wed, 29 Jul 2026 19:22:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9rC-0006xS-2Q for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9rC-00FOy3-10 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9rB-003tof-3B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:21 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=T/IKb/0BZyZo/zsCfKrCktTjjWQaDRZvE0/AyUp30QY=; b=OajWSpXe9rPmChOBuxBgGKFQLi tTHIzO08yo69eI1m5boe6rw/MssRK1HZ8bNy/8uk6l1VIAsDY0MO5IqJHEOThKFlMKUSxxx508e2y 9MMBT+uSj+RDpUNMHxt6ZyNwgtwPN6uiOQi760uFxQniLTJrqFDBpT2FeCkbHJKTKjGM=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] x86/cpu-policy: set up host policy earlier Message-Id: Date: Wed, 29 Jul 2026 19:22:21 +0000 commit aa2f6c99f3b7d2babbe21cdf81a6e5656583e242 Author: Jan Beulich AuthorDate: Wed Jul 29 16:02:31 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 16:02:31 2026 +0200 x86/cpu-policy: set up host policy earlier In order to use cpu_has_* expanding to host_cpu_policy.*, the host policy needs setting up alongside boot_cpu_data.x86_capability[]. Arrange for that towards the end of identify_cpu(). Then make sure .x86_capability[] and host policy remain in sync when setup_{force,clear}_cpu_cap() are used. Rename the function now it's no longer static. Fixes: 894bd7617924 ("x86/Intel: use host CPU policy for ARAT checking") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/cpu-policy.c | 11 ++++++++--- xen/arch/x86/cpu/common.c | 12 +++++++++++- xen/arch/x86/include/asm/cpu-policy.h | 6 ++++++ 3 files changed, 25 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/cpu-policy.c b/xen/arch/x86/cpu-policy.c index 5273fe0ae4..eddcd9778f 100644 --- a/xen/arch/x86/cpu-policy.c +++ b/xen/arch/x86/cpu-policy.c @@ -359,11 +359,18 @@ void calculate_raw_cpu_policy(void) /* Was already added by probe_cpuid_faulting() */ } -static void __init calculate_host_policy(void) +void __init calculate_host_cpu_policy(void) { struct cpu_policy *p = &host_cpu_policy; unsigned int max_extd_leaf; + /* + * Bail if the raw policy wasn't set up yet. At least recalculate_xstate() + * can't be used yet in that case. + */ + if ( !raw_cpu_policy.basic.max_leaf ) + return; + *p = raw_cpu_policy; p->basic.max_leaf = @@ -904,8 +911,6 @@ static void __init calculate_hvm_def_policy(void) void __init init_guest_cpu_policies(void) { - calculate_host_policy(); - if ( IS_ENABLED(CONFIG_PV) ) { calculate_pv_max_policy(); diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index fe8a818c1b..771ec2cf86 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -66,8 +66,10 @@ void __init setup_clear_cpu_cap(unsigned int cap) __clear_bit(cap, boot_cpu_data.x86_capability); dfs = x86_cpu_policy_lookup_deep_deps(cap); - if (!dfs) + if (!dfs) { + calculate_host_cpu_policy(); return; + } for (i = 0; i < FSCAPINTS; ++i) { cleared_caps[i] |= dfs[i]; @@ -78,6 +80,8 @@ void __init setup_clear_cpu_cap(unsigned int cap) __builtin_return_address(0), i, forced_caps[i] & dfs[i]); } + + calculate_host_cpu_policy(); } void __init setup_force_cpu_cap(unsigned int cap) @@ -92,6 +96,10 @@ void __init setup_force_cpu_cap(unsigned int cap) } __set_bit(cap, boot_cpu_data.x86_capability); + + /* Don't recalculate when the bit isn't represented in the policy. */ + if (cap < FSCAPINTS * 32) + calculate_host_cpu_policy(); } bool __init is_forced_cpu_cap(unsigned int cap) @@ -586,6 +594,8 @@ void identify_cpu(struct cpuinfo_x86 *c) } /* Now the feature flags better reflect actual CPU features! */ + if (c == &boot_cpu_data) + calculate_host_cpu_policy(); xstate_init(c); diff --git a/xen/arch/x86/include/asm/cpu-policy.h b/xen/arch/x86/include/asm/cpu-policy.h index 99d5a8e67e..943407963a 100644 --- a/xen/arch/x86/include/asm/cpu-policy.h +++ b/xen/arch/x86/include/asm/cpu-policy.h @@ -30,4 +30,10 @@ void recalculate_cpuid_policy(struct domain *d); */ void calculate_raw_cpu_policy(void); +/* + * Collect the host CPU policy. Called after collecting enough CPUID output, + * and again after all feature overrides have been put in place. + */ +void calculate_host_cpu_policy(void); + #endif /* X86_CPU_POLICY_H */ -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:22:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:22:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376674.1623298 (Exim 4.92) (envelope-from ) id 1wp9rN-0006za-L3; Wed, 29 Jul 2026 19:22:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376674.1623298; Wed, 29 Jul 2026 19:22:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9rN-0006zS-IS; Wed, 29 Jul 2026 19:22:33 +0000 Received: by outflank-mailman (input) for mailman id 1376674; Wed, 29 Jul 2026 19:22:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wp9rM-0006zM-55 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wp9rM-00FOyD-1J for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wp9rM-003tqV-0H for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:22:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=16LQW166tAacx1gRkwBtr3q+pGeduGHtaa7+dRLpqDo=; b=a9LV1Mvdk+IWPh4xdTX9DII/o3 oMPlwy6rCASh6Hp665+kG9Y1TB5r3mXjqyOYusH6rlO9ldCSyVegdBb0T3Tmr1d1Wp0Y/Q0x4FNIg +LvrYNK5ZpDVMKOzmr7wTHYtTLzSjIN6K4KlSIQHikd5e8GYh7Me9L8YnaSkwqFl4J/8=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen master] CHANGELOG: Set release date for 4.22 Message-Id: Date: Wed, 29 Jul 2026 19:22:32 +0000 commit d1aaf6358dd5518d0853710db078c07c822fb392 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:08:29 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:13:38 2026 +0100 CHANGELOG: Set release date for 4.22 Signed-off-by: Andrew Cooper --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8994fb6b46..aa1a777dd4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) affect Xen kexec support in the kexec-tools package. - The example stubdom "c-stubdom" has been removed. -## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD +## [4.22.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - 2026-07-30 ### Changed - Users of XEN_DOMCTL_createdomain/xc_domain_create() must now pass DOMID_ANY -- generated by git-patchbot for /home/xen/git/xen.git#master From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 19:55:06 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 19:55:06 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376677.1623302 (Exim 4.92) (envelope-from ) id 1wpAMp-0002z4-Rw; Wed, 29 Jul 2026 19:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376677.1623302; Wed, 29 Jul 2026 19:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpAMp-0002yw-PL; Wed, 29 Jul 2026 19:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1376677; Wed, 29 Jul 2026 19:55:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpAMo-0002yq-Kp for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:55:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wpAMo-00FPdw-1e for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:55:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wpAMo-0040qF-0e for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 19:55:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=HZFYsmoAqeLNrCNDZrIIGHI+D7jiDTm3AkA/VYLXMcc=; b=hgf4gSePp9FS4O+nfa2MhrOUBJ QE8McIXWePF7Whzru3KevOQIFtscCiDdRHDk3oYSjXKzFUfI1mjmQQsrWZEwHrS5WEDlsWN7n0x1o Fw9eJJB8xSACz6n1vFWTTG8lJK5JQ1I5LfbRN0Rq1+rPfE8r8/mklF48URCq+OMT+V4I=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.20] update Xen version to 4.20.4 Message-Id: Date: Wed, 29 Jul 2026 19:55:02 +0000 commit 9611e26eff425be128d4b9c7b48f2bc6b5d3498e Author: Jan Beulich AuthorDate: Wed Jul 29 17:18:52 2026 +0200 Commit: Jan Beulich CommitDate: Wed Jul 29 17:18:52 2026 +0200 update Xen version to 4.20.4 --- xen/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/Makefile b/xen/Makefile index 3e4d636a15..d9df42b1bb 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 20 -export XEN_EXTRAVERSION ?= .4-pre$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .4$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.20 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 20:00:03 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 20:00:03 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376680.1623305 (Exim 4.92) (envelope-from ) id 1wpARf-0003sG-8j; Wed, 29 Jul 2026 20:00:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376680.1623305; Wed, 29 Jul 2026 20:00:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARf-0003sA-6F; Wed, 29 Jul 2026 20:00:03 +0000 Received: by outflank-mailman (input) for mailman id 1376680; Wed, 29 Jul 2026 20:00:02 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARe-0003f5-46 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:02 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wpARe-00FPqY-1B for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:02 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wpARe-0041py-09 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:02 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=GdzRfVbwNO9AFTQumJyAt+rpv9+A/kO7e7TfTiojFmU=; b=dYl+fO+QdOApDv/lSXzO7sbcpj jtyJ44L1A/RqyjlOdChPx5CkoeWbVNoDxwN3C97j/jOMsA6AAOOz6kDb1xPFZeYmTuEz2VoQVq6s7 YXro3li5KNdG7csgfHQNib4d5v4xoXkfa/bbrtowSHdKRJyqOLMdif1nb2gX/mibW/s4=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] CHANGELOG: Set release date for 4.22 Message-Id: Date: Wed, 29 Jul 2026 20:00:02 +0000 commit 2b638b908e2be631927179d4b29635742c87a157 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:08:29 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 CHANGELOG: Set release date for 4.22 Signed-off-by: Andrew Cooper Acked-by: Roger Pau Monné Acked-by: Oleksii Kurochko (cherry picked from commit d1aaf6358dd5518d0853710db078c07c822fb392) --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1435855615..6f879c9796 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ Notable changes to Xen will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) -## [4.22.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD +## [4.22.0](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - 2026-07-30 ### Changed - Users of XEN_DOMCTL_createdomain/xc_domain_create() must now pass DOMID_ANY -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 20:00:15 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 20:00:15 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376681.1623309 (Exim 4.92) (envelope-from ) id 1wpARp-0004Vd-A5; Wed, 29 Jul 2026 20:00:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376681.1623309; Wed, 29 Jul 2026 20:00:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARp-0004VU-7X; Wed, 29 Jul 2026 20:00:13 +0000 Received: by outflank-mailman (input) for mailman id 1376681; Wed, 29 Jul 2026 20:00:12 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARo-0004VM-HQ for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:12 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wpARo-00FPrM-1T for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:12 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wpARo-0041s0-0S for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:12 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=aXnoouiu3jy/TqNC+LJnASqJ7zvnQB/vxdAjd/vcezY=; b=HEuilEddjb1t36itf0X0FH32DG dwoLgIr9gwgcs6PMXyXjcwCsJ9+ylsMrtzttKbG2EWTgyYM6CRRy9+7rLW5kQ+nK+rbAnpBRPHAOi 7TJmi6A/z+2LrrlIdc8S9g3580B4HUcKE9jnn41j82Rs68Ks+/VB9vLqrElO7XeVBORc=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] SUPPORT: Define support lifetime Message-Id: Date: Wed, 29 Jul 2026 20:00:12 +0000 commit 41f0cbc76580e75a8d14733844d16bd110ae6580 Author: Andrew Cooper AuthorDate: Wed Jul 29 17:12:08 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 SUPPORT: Define support lifetime Signed-off-by: Andrew Cooper Acked-by: Roger Pau Monné Release-Acked-by: Oleksii Kurochko --- SUPPORT.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/SUPPORT.md b/SUPPORT.md index 7c42de4c16..b945fc83af 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -9,13 +9,13 @@ for the definitions of the support status levels etc. # Release Support - Xen-Version: 4.22-rc - Initial-Release: n/a - Supported-Until: TBD - Security-Support-Until: Unreleased - not yet security-supported + Xen-Version: 4.22 + Initial-Release: 2026-07-30 + Supported-Until: 2029-07-30 + Security-Support-Until: 2031-07-30 Release Notes -: RN +: RN # Feature Support -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 20:00:23 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 20:00:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376682.1623313 (Exim 4.92) (envelope-from ) id 1wpARz-0004Yb-BE; Wed, 29 Jul 2026 20:00:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376682.1623313; Wed, 29 Jul 2026 20:00:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARz-0004YT-8o; Wed, 29 Jul 2026 20:00:23 +0000 Received: by outflank-mailman (input) for mailman id 1376682; Wed, 29 Jul 2026 20:00:22 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpARy-0004XF-9h for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:22 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wpARy-00FPuV-1l for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:22 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wpARy-0041w1-0j for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:22 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=eVZSb5X1KM3ELECFBImaF30tuQvlbx4zIa1k6g8Pe6A=; b=gX8ZUMHH+g9RIN0d4BOzd2hLyS jaN4u7/9q70rR6pDbpNpEMvDuiWGC6ZG7R9otDg03DLa7StRQC3KIfJpfs8Hl9r4fpf1mfpk124nT 8Mp8rc0BjUD4hO6EikUj1AkwKt8q26/pp0+vvsbHeQp4ROtLYdsUyjL6pIKtmANMG8E0=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] Config.mk: Bump tags to final Message-Id: Date: Wed, 29 Jul 2026 20:00:22 +0000 commit 3e23992b765b27d5644e76f3c560ce02f84f2007 Author: Andrew Cooper AuthorDate: Wed Jul 29 19:29:21 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 Config.mk: Bump tags to final Signed-off-by: Andrew Cooper --- Config.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Config.mk b/Config.mk index bf0f30424c..5a3aa902c5 100644 --- a/Config.mk +++ b/Config.mk @@ -214,10 +214,10 @@ OVMF_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/ovmf.git OVMF_UPSTREAM_REVISION ?= ba91d0292e593df8528b66f99c1b0b14fadc8e16 QEMU_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/qemu-xen.git -QEMU_UPSTREAM_REVISION ?= 0edeb44c093bea39f0fe4d936ee363b99113ffe1 +QEMU_UPSTREAM_REVISION ?= qemu-xen-4.22.0 MINIOS_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/mini-os.git -MINIOS_UPSTREAM_REVISION ?= b6f79f5f44cf69044079c042b88fe9d75367642e +MINIOS_UPSTREAM_REVISION ?= xen-RELEASE-4.22.0 SEABIOS_UPSTREAM_URL ?= https://xenbits.xen.org/git-http/seabios.git SEABIOS_UPSTREAM_REVISION ?= rel-1.17.0 -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Wed Jul 29 20:00:33 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Wed, 29 Jul 2026 20:00:33 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1376683.1623318 (Exim 4.92) (envelope-from ) id 1wpAS9-0004aW-Cn; Wed, 29 Jul 2026 20:00:33 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1376683.1623318; Wed, 29 Jul 2026 20:00:33 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpAS9-0004aO-A6; Wed, 29 Jul 2026 20:00:33 +0000 Received: by outflank-mailman (input) for mailman id 1376683; Wed, 29 Jul 2026 20:00:32 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wpAS8-0004aI-DM for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:32 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wpAS8-00FPuZ-26 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:32 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wpAS8-0041zm-12 for xen-changelog@lists.xenproject.org; Wed, 29 Jul 2026 20:00:32 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=Lkyl52/qQWm3cj5O9MNylB1H00iNq/8sNMciZbl5R9w=; b=oQlmrEbsh0tJCKhSxOlyR+gzmd Gb0HubLIEm2VSVNiAivYHrTQlRpLnAcLspzErBIIuyjb7K/B77K8ok7Gg6HdJfRiYnS2oeYekjqQ/ ENXE1ue3Ac7d4egAled/tuewloBnL6vdfUqDDd+jZ2hjHfG+WkactVHkEEFRI18eHKow=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen stable-4.22] Update to Xen 4.22 Message-Id: Date: Wed, 29 Jul 2026 20:00:32 +0000 commit d45d5687f1441495f4ee20d5e9940066c5fa5beb Author: Andrew Cooper AuthorDate: Wed Jul 29 19:30:13 2026 +0100 Commit: Andrew Cooper CommitDate: Wed Jul 29 19:59:28 2026 +0100 Update to Xen 4.22 Signed-off-by: Andrew Cooper --- README | 12 ++++++------ xen/Makefile | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/README b/README index 3dcc00c4a4..ebe4893b65 100644 --- a/README +++ b/README @@ -1,11 +1,11 @@ -############################################################ +###################################### __ __ _ _ ____ ____ -\ \/ /___ _ __ | || | |___ \|___ \ _ __ ___ - \ // _ \ '_ \ | || |_ __) | __) |__| '__/ __| - / \ __/ | | | |__ _| / __/ / __/|__| | | (__ -/_/\_\___|_| |_| |_|(_)_____|_____| |_| \___| +\ \/ /___ _ __ | || | |___ \|___ \ + \ // _ \ '_ \ | || |_ __) | __) | + / \ __/ | | | |__ _| / __/ / __/| +/_/\_\___|_| |_| |_|(_)_____|_____| -############################################################ +###################################### https://www.xen.org/ diff --git a/xen/Makefile b/xen/Makefile index 8d4cfb737a..725f220ee6 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST)) # All other places this is stored (eg. compile.h) should be autogenerated. export XEN_VERSION = 4 export XEN_SUBVERSION = 22 -export XEN_EXTRAVERSION ?= .0-rc4$(XEN_VENDORVERSION) +export XEN_EXTRAVERSION ?= .0$(XEN_VENDORVERSION) export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION) -include xen-version -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.22 From xen-changelog-bounces@lists.xenproject.org Fri Jul 31 15:55:07 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 31 Jul 2026 15:55:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1379368.1624057 (Exim 4.92) (envelope-from ) id 1wppZf-0004wN-Ld; Fri, 31 Jul 2026 15:55:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1379368.1624057; Fri, 31 Jul 2026 15:55:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wppZf-0004wE-Iw; Fri, 31 Jul 2026 15:55:03 +0000 Received: by outflank-mailman (input) for mailman id 1379368; Fri, 31 Jul 2026 15:55:01 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wppZd-0004w8-Tn for xen-changelog@lists.xenproject.org; Fri, 31 Jul 2026 15:55:01 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wppZd-001MhK-31 for xen-changelog@lists.xenproject.org; Fri, 31 Jul 2026 15:55:01 +0000 Received: from xen by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wppZd-00A4LX-1z for xen-changelog@lists.xenproject.org; Fri, 31 Jul 2026 15:55:01 +0000 X-BeenThere: xen-changelog@lists.xenproject.org List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-changelog-bounces@lists.xenproject.org Precedence: list Sender: "Xen-changelog" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Date:Message-Id:Subject:Reply-To:To:From; bh=1k5OPCKg1gg4//E5vcB3afQjiNjGYknJGQG8ZLAsGgs=; b=DZWQpx16JG8U3MZDokLbjwK3Et z0MiGcuJWHjF3KGEkbpyq/e0T6DP4xzv0cWqQyZre1mi1DLsVg/w+EF6bhhzQ67985YfBRXlVKMHu pjQ1XmqWCj1OU//af3oCriwK+U9Y6BNvQFJQceRSPmV9kSDtEuF1txlwI++RqH5dvrgE=; From: patchbot@xen.org To: xen-changelog@lists.xenproject.org Reply-To: xen-devel@lists.xenproject.org Subject: [xen staging] xen/elfstructs: Fix includes Message-Id: Date: Fri, 31 Jul 2026 15:55:01 +0000 commit 7c77acd452fb6a3079661e75ebb5cf23ed985cc7 Author: Andrew Cooper AuthorDate: Fri Mar 7 14:40:27 2025 +0000 Commit: Andrew Cooper CommitDate: Fri Jul 31 16:49:15 2026 +0100 xen/elfstructs: Fix includes elfstructs.h needs the stdint.h types. Two headers arrange this manually, but elf.h and livepatch.h do not, which breaks source files whose headers are properly sorted. elfstructs.h is used by tools too, so use stdint directly outside of Xen. Clean up trailing whitespace. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich Reviewed-by: Ross Lagerwall --- xen/include/xen/elfstructs.h | 8 +++++++- xen/include/xen/livepatch_elf.h | 1 - xen/include/xen/version.h | 1 - 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/xen/include/xen/elfstructs.h b/xen/include/xen/elfstructs.h index 62225bb8a0..8ee0d5aa5b 100644 --- a/xen/include/xen/elfstructs.h +++ b/xen/include/xen/elfstructs.h @@ -26,6 +26,12 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +#ifdef __XEN__ +#include +#else +#include +#endif + typedef uint32_t Elf32_Addr; /* Unsigned program address */ typedef uint32_t Elf32_Off; /* Unsigned file offset */ typedef uint16_t Elf32_Half; /* Unsigned medium integer */ @@ -45,7 +51,7 @@ typedef uint64_t Elf64_Xword; /* * e_ident[] identification indexes - * See http://www.caldera.com/developers/gabi/2000-07-17/ch4.eheader.html + * See http://www.caldera.com/developers/gabi/2000-07-17/ch4.eheader.html */ #define EI_MAG0 0 /* file ID */ #define EI_MAG1 1 /* file ID */ diff --git a/xen/include/xen/livepatch_elf.h b/xen/include/xen/livepatch_elf.h index 842111e145..a8aafecd34 100644 --- a/xen/include/xen/livepatch_elf.h +++ b/xen/include/xen/livepatch_elf.h @@ -5,7 +5,6 @@ #ifndef __XEN_LIVEPATCH_ELF_H__ #define __XEN_LIVEPATCH_ELF_H__ -#include #include /* The following describes an Elf file as consumed by Xen Live Patch. */ diff --git a/xen/include/xen/version.h b/xen/include/xen/version.h index 6f5d9c9560..b9fa8d7052 100644 --- a/xen/include/xen/version.h +++ b/xen/include/xen/version.h @@ -1,7 +1,6 @@ #ifndef __XEN_VERSION_H__ #define __XEN_VERSION_H__ -#include #include const char *xen_compile_date(void); -- generated by git-patchbot for /home/xen/git/xen.git#staging