[Xen-changelog] [xen stable-4.2] x86: fix guest CPUID handling

[patchbot@xxxxxxx]

commit 025500b9ae76fddd875aa981a2e8b767e390f6bb
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon May 12 17:43:00 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon May 12 17:43:00 2014 +0200

    x86: fix guest CPUID handling
    
    The way XEN_DOMCTL_set_cpuid got handled so far allowed for surprises
    to the caller. With this set of operations
    - set leaf A (using array index 0)
    - set leaf B (using array index 1)
    - clear leaf A (clearing array index 0)
    - set leaf B (using array index 0)
    - clear leaf B (clearing array index 0)
    the entry for leaf B at array index 1 would still be in place, while
    the caller would expect it to be cleared.
    
    While looking at the use sites of d->arch.cpuid[] I also noticed that
    the allocation of the array needlessly uses the zeroing form - the
    relevant fields of the array elements get set in a loop immediately
    following the allocation.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Tim Deegan <tim@xxxxxxx>
    master commit: 4c0ff6bd54b5a67f8f820f9ed0a89a79f1a26a1c
    master date: 2014-05-02 12:09:03 +0200
---
 xen/arch/x86/domain.c |    2 +-
 xen/arch/x86/domctl.c |   23 ++++++++++++-----------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index fdf550f..8f11473 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -609,7 +609,7 @@ int arch_domain_create(struct domain *d, unsigned int 
domcr_flags)
 
     if ( !is_idle_domain(d) )
     {
-        d->arch.cpuids = xzalloc_array(cpuid_input_t, MAX_CPUID_INPUT);
+        d->arch.cpuids = xmalloc_array(cpuid_input_t, MAX_CPUID_INPUT);
         rc = -ENOMEM;
         if ( d->arch.cpuids == NULL )
             goto fail;
diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 63e1987..099fb4b 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -1154,7 +1154,7 @@ long arch_do_domctl(
     {
         struct domain *d;
         xen_domctl_cpuid_t *ctl = &domctl->u.cpuid;
-        cpuid_input_t *cpuid = NULL; 
+        cpuid_input_t *cpuid, *unused = NULL;
         int i;
 
         ret = -ESRCH;
@@ -1162,12 +1162,16 @@ long arch_do_domctl(
         if ( d == NULL )
             break;
 
-        for ( i = 0; i < MAX_CPUID_INPUT; i++ )
+        for ( ret = i = 0; i < MAX_CPUID_INPUT; i++ )
         {
             cpuid = &d->arch.cpuids[i];
 
             if ( cpuid->input[0] == XEN_CPUID_INPUT_UNUSED )
-                break;
+            {
+                if ( !unused )
+                    unused = cpuid;
+                continue;
+            }
 
             if ( (cpuid->input[0] == ctl->input[0]) &&
                  ((cpuid->input[1] == XEN_CPUID_INPUT_UNUSED) ||
@@ -1175,15 +1179,12 @@ long arch_do_domctl(
                 break;
         }
         
-        if ( i == MAX_CPUID_INPUT )
-        {
-            ret = -ENOENT;
-        }
+        if ( i < MAX_CPUID_INPUT )
+            *cpuid = *ctl;
+        else if ( unused )
+            *unused = *ctl;
         else
-        {
-            memcpy(cpuid, ctl, sizeof(cpuid_input_t));
-            ret = 0;
-        }
+            ret = -ENOENT;
 
         rcu_unlock_domain(d);
     }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.2

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog