summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTomáš Mózes <tomas.mozes@gmail.com>2024-10-02 07:59:17 +0200
committerTomáš Mózes <tomas.mozes@gmail.com>2024-10-02 07:59:17 +0200
commitbefc038ba7247e93c8b224942fcca2c4a9e32717 (patch)
tree950eaff689ddf97a580c2969891a193643bce8fb
parentXen 4.18.3-pre-patchset-0 (diff)
downloadxen-upstream-patches-main.tar.gz
xen-upstream-patches-main.tar.bz2
xen-upstream-patches-main.zip
Xen 4.19.1-pre-patchset-0HEAD4.19.1-pre-patchset-0main
Signed-off-by: Tomáš Mózes <tomas.mozes@gmail.com>
-rw-r--r--0001-update-Xen-version-to-4.19.1-pre.patch164
-rw-r--r--0001-x86-entry-Fix-build-with-older-toolchains.patch32
-rw-r--r--0002-altcall-fix-__alt_call_maybe_initdata-so-it-s-safe-f.patch49
-rw-r--r--0002-bunzip2-fix-rare-decompression-failure.patch39
-rw-r--r--0003-XSM-domctl-Fix-permission-checks-on-XEN_DOMCTL_creat.patch150
-rw-r--r--0003-x86-rtc-Avoid-UIP-flag-being-set-for-longer-than-exp.patch57
-rw-r--r--0004-x86-MTRR-correct-inadvertently-inverted-WC-check.patch36
-rw-r--r--0004-x86-dom0-fix-restoring-cr3-and-the-mapcache-override.patch38
-rw-r--r--0005-x86-altcall-further-refine-clang-workaround.patch73
-rw-r--r--0005-x86-spec-fix-reporting-of-BHB-clearing-usage-from-gu.patch69
-rw-r--r--0006-x86-spec-adjust-logic-that-elides-lfence.patch75
-rw-r--r--0006-xen-sched-fix-error-handling-in-cpu_schedule_up.patch113
-rw-r--r--0007-xen-hvm-Don-t-skip-MSR_READ-trace-record.patch40
-rw-r--r--0007-xen-xsm-Wire-up-get_dom0_console.patch66
-rw-r--r--0008-tools-lsevtchn-Use-errno-macro-to-handle-hypercall-e.patch75
-rw-r--r--0008-xen-x86-Fix-Syntax-warning-in-gen-cpuid.py.patch41
-rw-r--r--0009-9pfsd-fix-release-build-with-old-gcc.patch33
-rw-r--r--0009-VT-d-correct-ATS-checking-for-root-complex-integrate.patch63
-rw-r--r--0010-tools-libxs-Open-dev-xen-xenbus-fds-as-O_CLOEXEC.patch47
-rw-r--r--0010-x86-emul-Fix-misaligned-IO-breakpoint-behaviour-in-P.patch41
-rw-r--r--0011-x86-IOMMU-move-tracking-in-iommu_identity_mapping.patch111
-rw-r--r--0011-x86-cpu-policy-Fix-migration-from-Ice-Lake-to-Cascad.patch92
-rw-r--r--0012-x86-pass-through-documents-as-security-unsupported-w.patch42
-rw-r--r--0012-x86-ucode-Distinguish-ucode-already-up-to-date.patch58
-rw-r--r--0013-automation-disable-Yocto-jobs.patch48
-rw-r--r--0013-libxl-fix-population-of-the-online-vCPU-bitmap-for-P.patch61
-rw-r--r--0014-automation-use-expect-to-run-QEMU.patch362
-rw-r--r--0014-libxl-Fix-handling-XenStore-errors-in-device-creatio.patch191
-rw-r--r--0015-x86-vLAPIC-prevent-undue-recursion-of-vlapic_error.patch57
-rw-r--r--0015-xen-sched-set-all-sched_resource-data-inside-locked-.patch84
-rw-r--r--0016-Arm-correct-FIXADDR_TOP.patch58
-rw-r--r--0016-x86-respect-mapcache_domain_init-failing.patch38
-rw-r--r--0017-tools-xentop-Fix-cpu-sort-order.patch76
-rw-r--r--0017-xl-fix-incorrect-output-in-help-command.patch36
-rw-r--r--0018-x86-mtrr-avoid-system-wide-rendezvous-when-setting-A.patch60
-rw-r--r--0018-x86emul-correct-UD-check-for-AVX512-FP16-complex-mul.patch37
-rw-r--r--0019-update-Xen-version-to-4.18.3-pre.patch25
-rw-r--r--0019-x86-pv-Introduce-x86_merge_dr6-and-fix-do_debug.patch140
-rw-r--r--0020-x86-pv-Fix-merging-of-new-status-bits-into-dr6.patch222
-rw-r--r--0020-x86-ucode-Further-fixes-to-identify-ucode-already-up.patch92
-rw-r--r--0021-x86-msi-prevent-watchdog-triggering-when-dumping-MSI.patch44
-rw-r--r--0021-x86-pv-Address-Coverity-complaint-in-check_guest_io_.patch112
-rw-r--r--0022-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when-a.patch44
-rw-r--r--0022-x86emul-always-set-operand-size-for-AVX-VNNI-INT8-in.patch36
-rw-r--r--0023-CI-Update-FreeBSD-to-13.3.patch33
-rw-r--r--0023-x86emul-set-fake-operand-size-for-AVX512CD-broadcast.patch35
-rw-r--r--0024-x86-smp-do-not-use-shorthand-IPI-destinations-in-CPU.patch98
-rw-r--r--0024-x86-x2APIC-correct-cluster-tracking-upon-CPUs-going-.patch52
-rw-r--r--0025-x86-dom0-disable-SMAP-for-PV-domain-building-only.patch145
-rw-r--r--0025-x86-irq-limit-interrupt-movement-done-by-fixup_irqs.patch104
-rw-r--r--0026-x86-EPT-correct-special-page-checking-in-epte_get_en.patch46
-rw-r--r--0026-x86-HVM-correct-partial-HPET_STATUS-write-emulation.patch37
-rw-r--r--0027-Arm64-adjust-__irq_to_desc-to-fix-build-with-gcc14.patch61
-rw-r--r--0027-x86-EPT-avoid-marking-non-present-entries-for-re-con.patch85
-rw-r--r--0028-libxl-Fix-nul-termination-of-the-return-value-of-lib.patch100
-rw-r--r--0028-x86-EPT-drop-questionable-mfn_valid-from-epte_get_en.patch47
-rw-r--r--0029-SUPPORT.md-split-XSM-from-Flask.patch66
-rw-r--r--0029-x86-Intel-unlock-CPUID-earlier-for-the-BSP.patch105
-rw-r--r--0030-x86-fix-UP-build-with-gcc14.patch63
-rw-r--r--0030-x86-irq-deal-with-old_cpu_mask-for-interrupts-in-mov.patch84
-rw-r--r--0031-x86-irq-handle-moving-interrupts-in-_assign_irq_vect.patch172
-rw-r--r--0031-x86emul-test-fix-build-with-gas-2.43.patch86
-rw-r--r--0032-x86-HVM-properly-reject-indirect-VRAM-writes.patch45
-rw-r--r--0032-xen-ubsan-Fix-UB-in-type_descriptor-declaration.patch39
-rw-r--r--0033-x86-xstate-Fix-initialisation-of-XSS-cache.patch74
-rw-r--r--0033-xen-x86-pvh-handle-ACPI-RSDT-table-in-PVH-Dom0-build.patch63
-rw-r--r--0034-blkif-reconcile-protocol-specification-with-in-use-i.patch183
-rw-r--r--0034-x86-cpuid-Fix-handling-of-XSAVE-dynamic-leaves.patch72
-rw-r--r--0035-x86-irq-forward-pending-interrupts-to-new-destinatio.patch143
-rw-r--r--0035-xen-ucode-Fix-buffer-under-run-when-parsing-AMD-cont.patch62
-rw-r--r--0036-x86-re-run-exception-from-stub-recovery-selftests-wi.patch84
-rw-r--r--0037-tools-tests-don-t-let-test-xenstore-write-nodes-exce.patch41
-rw-r--r--0038-tools-tests-let-test-xenstore-exit-with-non-0-status.patch57
-rw-r--r--0039-LICENSES-Add-MIT-0-MIT-No-Attribution.patch58
-rw-r--r--0040-tools-Import-stand-alone-sd_notify-implementation-fr.patch130
-rw-r--r--0041-tools-c-o-xenstored-Don-t-link-against-libsystemd.patch87
-rw-r--r--0042-tools-Drop-libsystemd-as-a-dependency.patch648
-rw-r--r--0043-x86-ioapic-Fix-signed-shifts-in-io_apic.c.patch46
-rw-r--r--0044-tools-xl-Open-xldevd.log-with-O_CLOEXEC.patch53
-rw-r--r--0045-pirq_cleanup_check-leaks.patch84
-rw-r--r--0046-tools-dombuilder-Correct-the-length-calculation-in-x.patch44
-rw-r--r--0047-tools-libxs-Fix-CLOEXEC-handling-in-get_dev.patch95
-rw-r--r--0048-tools-libxs-Fix-CLOEXEC-handling-in-get_socket.patch60
-rw-r--r--0049-tools-libxs-Fix-CLOEXEC-handling-in-xs_fileno.patch109
-rw-r--r--0050-cmdline-document-and-enforce-extra_guest_irqs-upper-.patch156
-rw-r--r--0051-x86-entry-don-t-clear-DF-when-raising-UD-for-lack-of.patch58
-rw-r--r--0052-evtchn-build-fix-for-Arm.patch43
-rw-r--r--0053-x86-IRQ-avoid-double-unlock-in-map_domain_pirq.patch53
-rw-r--r--0054-x86-physdev-Return-pirq-that-irq-was-already-mapped-.patch38
-rw-r--r--0055-tools-libxs-Fix-fcntl-invocation-in-set_cloexec.patch57
-rw-r--r--0056-x86-altcall-fix-clang-code-gen-when-using-altcall-in.patch85
-rw-r--r--info.txt6
92 files changed, 3028 insertions, 4591 deletions
diff --git a/0001-update-Xen-version-to-4.19.1-pre.patch b/0001-update-Xen-version-to-4.19.1-pre.patch
new file mode 100644
index 0000000..8801862
--- /dev/null
+++ b/0001-update-Xen-version-to-4.19.1-pre.patch
@@ -0,0 +1,164 @@
+From f97db9b3bc3deac4eead160106a3f6de2ccce81d Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Thu, 8 Aug 2024 13:43:19 +0200
+Subject: [PATCH 01/35] update Xen version to 4.19.1-pre
+
+---
+ Config.mk | 2 -
+ MAINTAINERS | 106 +++++----------------------------------------------
+ xen/Makefile | 2 +-
+ 3 files changed, 10 insertions(+), 100 deletions(-)
+
+diff --git a/Config.mk b/Config.mk
+index ac8fb847ce..03a89624c7 100644
+--- a/Config.mk
++++ b/Config.mk
+@@ -234,8 +234,6 @@ ETHERBOOT_NICS ?= rtl8139 8086100e
+
+ QEMU_TRADITIONAL_URL ?= https://xenbits.xen.org/git-http/qemu-xen-traditional.git
+ QEMU_TRADITIONAL_REVISION ?= xen-4.19.0
+-# Wed Jul 15 10:01:40 2020 +0100
+-# qemu-trad: remove Xen path dependencies
+
+ # Specify which qemu-dm to use. This may be `ioemu' to use the old
+ # Mercurial in-tree version, or a local directory, or a git URL.
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 2b0c894527..fe81ed63ad 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -54,6 +54,15 @@ list. Remember to copy the appropriate stable branch maintainer who
+ will be listed in this section of the MAINTAINERS file in the
+ appropriate branch.
+
++The maintainer for this branch is:
++
++ Jan Beulich <jbeulich@suse.com>
++
++Tools backport requests should also be copied to:
++
++       Anthony Perard <anthony.perard@citrix.com>
++
++
+ Unstable Subsystem Maintainers
+ ==============================
+
+@@ -104,103 +113,6 @@ Descriptions of section entries:
+ xen-maintainers-<version format number of this file>
+
+
+- Check-in policy
+- ===============
+-
+-In order for a patch to be checked in, in general, several conditions
+-must be met:
+-
+-1. In order to get a change to a given file committed, it must have
+- the approval of at least one maintainer of that file.
+-
+- A patch of course needs Acks from the maintainers of each file that
+- it changes; so a patch which changes xen/arch/x86/traps.c,
+- xen/arch/x86/mm/p2m.c, and xen/arch/x86/mm/shadow/multi.c would
+- require an Ack from each of the three sets of maintainers.
+-
+- See below for rules on nested maintainership.
+-
+-2. Each change must have appropriate approval from someone other than
+- the person who wrote it. This can be either:
+-
+- a. An Acked-by from a maintainer of the code being touched (a
+- co-maintainer if available, or a more general level maintainer if
+- not available; see the secton on nested maintainership)
+-
+- b. A Reviewed-by by anyone of suitable stature in the community
+-
+-3. Sufficient time must have been given for anyone to respond. This
+- depends in large part upon the urgency and nature of the patch.
+- For a straightforward uncontroversial patch, a day or two may be
+- sufficient; for a controversial patch, a week or two may be better.
+-
+-4. There must be no "open" objections.
+-
+-In a case where one person submits a patch and a maintainer gives an
+-Ack, the Ack stands in for both the approval requirement (#1) and the
+-Acked-by-non-submitter requirement (#2).
+-
+-In a case where a maintainer themselves submits a patch, the
+-Signed-off-by meets the approval requirement (#1); so a Review
+-from anyone in the community suffices for requirement #2.
+-
+-Before a maintainer checks in their own patch with another community
+-member's R-b but no co-maintainer Ack, it is especially important to
+-give their co-maintainer opportunity to give feedback, perhaps
+-declaring their intention to check it in without their co-maintainers
+-ack a day before doing so.
+-
+-In the case where two people collaborate on a patch, at least one of
+-whom is a maintainer -- typically where one maintainer will do an
+-early version of the patch, and another maintainer will pick it up and
+-revise it -- there should be two Signed-off-by's and one Acked-by or
+-Reviewed-by; with the maintainer who did the most recent change
+-sending the patch, and an Acked-by or Reviewed-by coming from the
+-maintainer who did not most recently edit the patch. This satisfies
+-the requirement #2 because a) the Signed-off-by of the sender approves
+-the final version of the patch; including all parts of the patch that
+-the sender did not write b) the Reviewed-by approves the final version
+-of the patch, including all patches that the reviewer did not write.
+-Thus all code in the patch has been approved by someone who did not
+-write it.
+-
+-Maintainers may choose to override non-maintainer objections in the
+-case that consensus can't be reached.
+-
+-As always, no policy can cover all possible situations. In
+-exceptional circumstances, committers may commit a patch in absence of
+-one or more of the above requirements, if they are reasonably
+-confident that the other maintainers will approve of their decision in
+-retrospect.
+-
+- The meaning of nesting
+- ======================
+-
+-Many maintainership areas are "nested": for example, there are entries
+-for xen/arch/x86 as well as xen/arch/x86/mm, and even
+-xen/arch/x86/mm/shadow; and there is a section at the end called "THE
+-REST" which lists all committers. The meaning of nesting is that:
+-
+-1. Under normal circumstances, the Ack of the most specific maintainer
+-is both necessary and sufficient to get a change to a given file
+-committed. So a change to xen/arch/x86/mm/shadow/multi.c requires the
+-the Ack of the xen/arch/x86/mm/shadow maintainer for that part of the
+-patch, but would not require the Ack of the xen/arch/x86 maintainer or
+-the xen/arch/x86/mm maintainer.
+-
+-2. In unusual circumstances, a more general maintainer's Ack can stand
+-in for or even overrule a specific maintainer's Ack. Unusual
+-circumstances might include:
+- - The patch is fixing a high-priority issue causing immediate pain,
+- and the more specific maintainer is not available.
+- - The more specific maintainer has not responded either to the
+- original patch, nor to "pings", within a reasonable amount of time.
+- - The more general maintainer wants to overrule the more specific
+- maintainer on some issue. (This should be exceptional.)
+- - In the case of a disagreement between maintainers, THE REST can
+- settle the matter by majority vote. (This should be very exceptional
+- indeed.)
+-
+
+ Maintainers List (try to look for most precise areas first)
+
+diff --git a/xen/Makefile b/xen/Makefile
+index 16055101fb..59dac504b3 100644
+--- a/xen/Makefile
++++ b/xen/Makefile
+@@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST))
+ # All other places this is stored (eg. compile.h) should be autogenerated.
+ export XEN_VERSION = 4
+ export XEN_SUBVERSION = 19
+-export XEN_EXTRAVERSION ?= .0$(XEN_VENDORVERSION)
++export XEN_EXTRAVERSION ?= .1-pre$(XEN_VENDORVERSION)
+ export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION)
+ -include xen-version
+
+--
+2.46.1
+
diff --git a/0001-x86-entry-Fix-build-with-older-toolchains.patch b/0001-x86-entry-Fix-build-with-older-toolchains.patch
deleted file mode 100644
index ad6e76a..0000000
--- a/0001-x86-entry-Fix-build-with-older-toolchains.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 2d38302c33b117aa9a417056db241aefc840c2f0 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Tue, 9 Apr 2024 21:39:51 +0100
-Subject: [PATCH 01/56] x86/entry: Fix build with older toolchains
-
-Binutils older than 2.29 doesn't know INCSSPD.
-
-Fixes: 8e186f98ce0e ("x86: Use indirect calls in reset-stack infrastructure")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-(cherry picked from commit a9fa82500818a8d8ce5f2843f1577bd2c29d088e)
----
- xen/arch/x86/x86_64/entry.S | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
-index ad7dd3b23b..054fcb225f 100644
---- a/xen/arch/x86/x86_64/entry.S
-+++ b/xen/arch/x86/x86_64/entry.S
-@@ -643,7 +643,9 @@ ENTRY(continue_pv_domain)
- * JMPed to. Drop the return address.
- */
- add $8, %rsp
-+#ifdef CONFIG_XEN_SHSTK
- ALTERNATIVE "", "mov $2, %eax; incsspd %eax", X86_FEATURE_XEN_SHSTK
-+#endif
-
- call check_wakeup_from_wait
- ret_from_intr:
---
-2.45.2
-
diff --git a/0002-altcall-fix-__alt_call_maybe_initdata-so-it-s-safe-f.patch b/0002-altcall-fix-__alt_call_maybe_initdata-so-it-s-safe-f.patch
deleted file mode 100644
index 05ecd83..0000000
--- a/0002-altcall-fix-__alt_call_maybe_initdata-so-it-s-safe-f.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 8bdcb0b98b53140102031ceca0611f22190227fd Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:35:21 +0200
-Subject: [PATCH 02/56] altcall: fix __alt_call_maybe_initdata so it's safe for
- livepatch
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Setting alternative call variables as __init is not safe for use with
-livepatch, as livepatches can rightfully introduce new alternative calls to
-structures marked as __alt_call_maybe_initdata (possibly just indirectly due to
-replacing existing functions that use those). Attempting to resolve those
-alternative calls then results in page faults as the variable that holds the
-function pointer address has been freed.
-
-When livepatch is supported use the __ro_after_init attribute instead of
-__initdata for __alt_call_maybe_initdata.
-
-Fixes: f26bb285949b ('xen: Implement xen/alternative-call.h for use in common code')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: af4cd0a6a61cdb03bc1afca9478b05b0c9703599
-master date: 2024-04-11 18:51:36 +0100
----
- xen/include/xen/alternative-call.h | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/xen/include/xen/alternative-call.h b/xen/include/xen/alternative-call.h
-index 5c6b9a562b..10f7d7637e 100644
---- a/xen/include/xen/alternative-call.h
-+++ b/xen/include/xen/alternative-call.h
-@@ -50,7 +50,12 @@
-
- #include <asm/alternative.h>
-
--#define __alt_call_maybe_initdata __initdata
-+#ifdef CONFIG_LIVEPATCH
-+/* Must keep for livepatches to resolve alternative calls. */
-+# define __alt_call_maybe_initdata __ro_after_init
-+#else
-+# define __alt_call_maybe_initdata __initdata
-+#endif
-
- #else
-
---
-2.45.2
-
diff --git a/0002-bunzip2-fix-rare-decompression-failure.patch b/0002-bunzip2-fix-rare-decompression-failure.patch
new file mode 100644
index 0000000..79e8339
--- /dev/null
+++ b/0002-bunzip2-fix-rare-decompression-failure.patch
@@ -0,0 +1,39 @@
+From e54077cbca7149c8fa856535b69a4c70dfd48cd2 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Thu, 8 Aug 2024 13:44:26 +0200
+Subject: [PATCH 02/35] bunzip2: fix rare decompression failure
+
+The decompression code parses a huffman tree and counts the number of
+symbols for a given bit length. In rare cases, there may be >= 256
+symbols with a given bit length, causing the unsigned char to overflow.
+This causes a decompression failure later when the code tries and fails to
+find the bit length for a given symbol.
+
+Since the maximum number of symbols is 258, use unsigned short instead.
+
+Fixes: ab77e81f6521 ("x86/dom0: support bzip2 and lzma compressed bzImage payloads")
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Acked-by: Jan Beulich <jbeulich@suse.com>
+master commit: 303d3ff85c90ee4af4bad4e3b1d4932fa2634d64
+master date: 2024-07-30 11:55:56 +0200
+---
+ xen/common/bunzip2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/xen/common/bunzip2.c b/xen/common/bunzip2.c
+index 4466426941..79f17162b1 100644
+--- a/xen/common/bunzip2.c
++++ b/xen/common/bunzip2.c
+@@ -221,7 +221,8 @@ static int __init get_next_block(struct bunzip_data *bd)
+ RUNB) */
+ symCount = symTotal+2;
+ for (j = 0; j < groupCount; j++) {
+- unsigned char length[MAX_SYMBOLS], temp[MAX_HUFCODE_BITS+1];
++ unsigned char length[MAX_SYMBOLS];
++ unsigned short temp[MAX_HUFCODE_BITS+1];
+ int minLen, maxLen, pp;
+ /* Read Huffman code lengths for each symbol. They're
+ stored in a way similar to mtf; record a starting
+--
+2.46.1
+
diff --git a/0003-XSM-domctl-Fix-permission-checks-on-XEN_DOMCTL_creat.patch b/0003-XSM-domctl-Fix-permission-checks-on-XEN_DOMCTL_creat.patch
new file mode 100644
index 0000000..ccdb369
--- /dev/null
+++ b/0003-XSM-domctl-Fix-permission-checks-on-XEN_DOMCTL_creat.patch
@@ -0,0 +1,150 @@
+From d2ecc1f231b90d4e54394e25a9aef9be42c0d196 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Thu, 8 Aug 2024 13:44:56 +0200
+Subject: [PATCH 03/35] XSM/domctl: Fix permission checks on
+ XEN_DOMCTL_createdomain
+
+The XSM checks for XEN_DOMCTL_createdomain are problematic. There's a split
+between xsm_domctl() called early, and flask_domain_create() called quite late
+during domain construction.
+
+All XSM implementations except Flask have a simple IS_PRIV check in
+xsm_domctl(), and operate as expected when an unprivileged domain tries to
+make a hypercall.
+
+Flask however foregoes any action in xsm_domctl() and defers everything,
+including the simple "is the caller permitted to create a domain" check, to
+flask_domain_create().
+
+As a consequence, when XSM Flask is active, and irrespective of the policy
+loaded, all domains irrespective of privilege can:
+
+ * Mutate the global 'rover' variable, used to track the next free domid.
+ Therefore, all domains can cause a domid wraparound, and combined with a
+ voluntary reboot, choose their own domid.
+
+ * Cause a reasonable amount of a domain to be constructed before ultimately
+ failing for permission reasons, including the use of settings outside of
+ supported limits.
+
+In order to remediate this, pass the ssidref into xsm_domctl() and at least
+check that the calling domain privileged enough to create domains.
+
+Take the opportunity to also fix the sign of the cmd parameter to be unsigned.
+
+This issue has not been assigned an XSA, because Flask is experimental and not
+security supported.
+
+Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+master commit: ee32b9b29af449d38aad0a1b3a81aaae586f5ea7
+master date: 2024-07-30 17:42:17 +0100
+---
+ xen/arch/x86/mm/paging.c | 2 +-
+ xen/common/domctl.c | 4 +++-
+ xen/include/xsm/dummy.h | 2 +-
+ xen/include/xsm/xsm.h | 7 ++++---
+ xen/xsm/flask/hooks.c | 14 ++++++++++++--
+ 5 files changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
+index bca320fffa..dd47bde5ce 100644
+--- a/xen/arch/x86/mm/paging.c
++++ b/xen/arch/x86/mm/paging.c
+@@ -767,7 +767,7 @@ long do_paging_domctl_cont(
+ if ( d == NULL )
+ return -ESRCH;
+
+- ret = xsm_domctl(XSM_OTHER, d, op.cmd);
++ ret = xsm_domctl(XSM_OTHER, d, op.cmd, 0 /* SSIDref not applicable */);
+ if ( !ret )
+ {
+ if ( domctl_lock_acquire() )
+diff --git a/xen/common/domctl.c b/xen/common/domctl.c
+index 2c0331bb05..ea16b75910 100644
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -322,7 +322,9 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
+ break;
+ }
+
+- ret = xsm_domctl(XSM_OTHER, d, op->cmd);
++ ret = xsm_domctl(XSM_OTHER, d, op->cmd,
++ /* SSIDRef only applicable for cmd == createdomain */
++ op->u.createdomain.ssidref);
+ if ( ret )
+ goto domctl_out_unlock_domonly;
+
+diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
+index 00d2cbebf2..7956f27a29 100644
+--- a/xen/include/xsm/dummy.h
++++ b/xen/include/xsm/dummy.h
+@@ -162,7 +162,7 @@ static XSM_INLINE int cf_check xsm_set_target(
+ }
+
+ static XSM_INLINE int cf_check xsm_domctl(
+- XSM_DEFAULT_ARG struct domain *d, int cmd)
++ XSM_DEFAULT_ARG struct domain *d, unsigned int cmd, uint32_t ssidref)
+ {
+ XSM_ASSERT_ACTION(XSM_OTHER);
+ switch ( cmd )
+diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
+index 8dad03fd3d..627c0d2731 100644
+--- a/xen/include/xsm/xsm.h
++++ b/xen/include/xsm/xsm.h
+@@ -60,7 +60,7 @@ struct xsm_ops {
+ int (*domctl_scheduler_op)(struct domain *d, int op);
+ int (*sysctl_scheduler_op)(int op);
+ int (*set_target)(struct domain *d, struct domain *e);
+- int (*domctl)(struct domain *d, int cmd);
++ int (*domctl)(struct domain *d, unsigned int cmd, uint32_t ssidref);
+ int (*sysctl)(int cmd);
+ int (*readconsole)(uint32_t clear);
+
+@@ -248,9 +248,10 @@ static inline int xsm_set_target(
+ return alternative_call(xsm_ops.set_target, d, e);
+ }
+
+-static inline int xsm_domctl(xsm_default_t def, struct domain *d, int cmd)
++static inline int xsm_domctl(xsm_default_t def, struct domain *d,
++ unsigned int cmd, uint32_t ssidref)
+ {
+- return alternative_call(xsm_ops.domctl, d, cmd);
++ return alternative_call(xsm_ops.domctl, d, cmd, ssidref);
+ }
+
+ static inline int xsm_sysctl(xsm_default_t def, int cmd)
+diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
+index 5e88c71b8e..278ad38c2a 100644
+--- a/xen/xsm/flask/hooks.c
++++ b/xen/xsm/flask/hooks.c
+@@ -663,12 +663,22 @@ static int cf_check flask_set_target(struct domain *d, struct domain *t)
+ return rc;
+ }
+
+-static int cf_check flask_domctl(struct domain *d, int cmd)
++static int cf_check flask_domctl(struct domain *d, unsigned int cmd,
++ uint32_t ssidref)
+ {
+ switch ( cmd )
+ {
+- /* These have individual XSM hooks (common/domctl.c) */
+ case XEN_DOMCTL_createdomain:
++ /*
++ * There is a later hook too, but at this early point simply check
++ * that the calling domain is privileged enough to create a domain.
++ *
++ * Note that d is NULL because we haven't even allocated memory for it
++ * this early in XEN_DOMCTL_createdomain.
++ */
++ return avc_current_has_perm(ssidref, SECCLASS_DOMAIN, DOMAIN__CREATE, NULL);
++
++ /* These have individual XSM hooks (common/domctl.c) */
+ case XEN_DOMCTL_getdomaininfo:
+ case XEN_DOMCTL_scheduler_op:
+ case XEN_DOMCTL_irq_permission:
+--
+2.46.1
+
diff --git a/0003-x86-rtc-Avoid-UIP-flag-being-set-for-longer-than-exp.patch b/0003-x86-rtc-Avoid-UIP-flag-being-set-for-longer-than-exp.patch
deleted file mode 100644
index 8307630..0000000
--- a/0003-x86-rtc-Avoid-UIP-flag-being-set-for-longer-than-exp.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From af0e9ba44a58c87d6d135d8ffbf468b4ceac0a41 Mon Sep 17 00:00:00 2001
-From: Ross Lagerwall <ross.lagerwall@citrix.com>
-Date: Mon, 29 Apr 2024 09:36:04 +0200
-Subject: [PATCH 03/56] x86/rtc: Avoid UIP flag being set for longer than
- expected
-
-In a test, OVMF reported an error initializing the RTC without
-indicating the precise nature of the error. The only plausible
-explanation I can find is as follows:
-
-As part of the initialization, OVMF reads register C and then reads
-register A repatedly until the UIP flag is not set. If this takes longer
-than 100 ms, OVMF fails and reports an error. This may happen with the
-following sequence of events:
-
-At guest time=0s, rtc_init() calls check_update_timer() which schedules
-update_timer for t=(1 - 244us).
-
-At t=1s, the update_timer function happens to have been called >= 244us
-late. In the timer callback, it sets the UIP flag and schedules
-update_timer2 for t=1s.
-
-Before update_timer2 runs, the guest reads register C which calls
-check_update_timer(). check_update_timer() stops the scheduled
-update_timer2 and since the guest time is now outside of the update
-cycle, it schedules update_timer for t=(2 - 244us).
-
-The UIP flag will therefore be set for a whole second from t=1 to t=2
-while the guest repeatedly reads register A waiting for the UIP flag to
-clear. Fix it by clearing the UIP flag when scheduling update_timer.
-
-I was able to reproduce this issue with a synthetic test and this
-resolves the issue.
-
-Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 43a07069863b419433dee12c9b58c1f7ce70aa97
-master date: 2024-04-23 14:09:18 +0200
----
- xen/arch/x86/hvm/rtc.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c
-index 206b4296e9..4839374352 100644
---- a/xen/arch/x86/hvm/rtc.c
-+++ b/xen/arch/x86/hvm/rtc.c
-@@ -202,6 +202,7 @@ static void check_update_timer(RTCState *s)
- }
- else
- {
-+ s->hw.cmos_data[RTC_REG_A] &= ~RTC_UIP;
- next_update_time = (USEC_PER_SEC - guest_usec - 244) * NS_PER_USEC;
- expire_time = NOW() + next_update_time;
- s->next_update_time = expire_time;
---
-2.45.2
-
diff --git a/0004-x86-MTRR-correct-inadvertently-inverted-WC-check.patch b/0004-x86-MTRR-correct-inadvertently-inverted-WC-check.patch
deleted file mode 100644
index ed7754d..0000000
--- a/0004-x86-MTRR-correct-inadvertently-inverted-WC-check.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From eb7059767c82d833ebecdf8106e96482b04f3c40 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Mon, 29 Apr 2024 09:36:37 +0200
-Subject: [PATCH 04/56] x86/MTRR: correct inadvertently inverted WC check
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The ! clearly got lost by mistake.
-
-Fixes: e9e0eb30d4d6 ("x86/MTRR: avoid several indirect calls")
-Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 77e25f0e30ddd11e043e6fce84bf108ce7de5b6f
-master date: 2024-04-23 14:13:48 +0200
----
- xen/arch/x86/cpu/mtrr/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/cpu/mtrr/main.c b/xen/arch/x86/cpu/mtrr/main.c
-index 55a4da54a7..90b235f57e 100644
---- a/xen/arch/x86/cpu/mtrr/main.c
-+++ b/xen/arch/x86/cpu/mtrr/main.c
-@@ -316,7 +316,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
- }
-
- /* If the type is WC, check that this processor supports it */
-- if ((type == X86_MT_WC) && mtrr_have_wrcomb()) {
-+ if ((type == X86_MT_WC) && !mtrr_have_wrcomb()) {
- printk(KERN_WARNING
- "mtrr: your processor doesn't support write-combining\n");
- return -EOPNOTSUPP;
---
-2.45.2
-
diff --git a/0004-x86-dom0-fix-restoring-cr3-and-the-mapcache-override.patch b/0004-x86-dom0-fix-restoring-cr3-and-the-mapcache-override.patch
new file mode 100644
index 0000000..40dbb9f
--- /dev/null
+++ b/0004-x86-dom0-fix-restoring-cr3-and-the-mapcache-override.patch
@@ -0,0 +1,38 @@
+From adf1939b51a0a2fa596f7acca0989bfe56cab307 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Thu, 8 Aug 2024 13:45:28 +0200
+Subject: [PATCH 04/35] x86/dom0: fix restoring %cr3 and the mapcache override
+ on PV build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+One of the error paths in the PV dom0 builder section that runs on the guest
+page-tables wasn't restoring the Xen value of %cr3, neither removing the
+mapcache override.
+
+Fixes: 079ff2d32c3d ('libelf-loader: introduce elf_load_image')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 1fc3f77113dd43b14fa7ef5936dcdba120c0b63f
+master date: 2024-07-31 12:41:02 +0200
+---
+ xen/arch/x86/pv/dom0_build.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/xen/arch/x86/pv/dom0_build.c b/xen/arch/x86/pv/dom0_build.c
+index d8043fa58a..57e58a02e7 100644
+--- a/xen/arch/x86/pv/dom0_build.c
++++ b/xen/arch/x86/pv/dom0_build.c
+@@ -825,6 +825,8 @@ int __init dom0_construct_pv(struct domain *d,
+ rc = elf_load_binary(&elf);
+ if ( rc < 0 )
+ {
++ mapcache_override_current(NULL);
++ switch_cr3_cr4(current->arch.cr3, read_cr4());
+ printk("Failed to load the kernel binary\n");
+ goto out;
+ }
+--
+2.46.1
+
diff --git a/0005-x86-altcall-further-refine-clang-workaround.patch b/0005-x86-altcall-further-refine-clang-workaround.patch
new file mode 100644
index 0000000..7107099
--- /dev/null
+++ b/0005-x86-altcall-further-refine-clang-workaround.patch
@@ -0,0 +1,73 @@
+From ee032f29972b8c58db9fcf96650f9cbc083edca8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Thu, 8 Aug 2024 13:45:58 +0200
+Subject: [PATCH 05/35] x86/altcall: further refine clang workaround
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The current code in ALT_CALL_ARG() won't successfully workaround the clang
+code-generation issue if the arg parameter has a size that's not a power of 2.
+While there are no such sized parameters at the moment, improve the workaround
+to also be effective when such sizes are used.
+
+Instead of using a union with a long use an unsigned long that's first
+initialized to 0 and afterwards set to the argument value.
+
+Reported-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
+Suggested-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 561cba38ff551383a628dc93e64ab0691cfc92bf
+master date: 2024-07-31 12:41:22 +0200
+---
+ xen/arch/x86/include/asm/alternative.h | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/xen/arch/x86/include/asm/alternative.h b/xen/arch/x86/include/asm/alternative.h
+index e63b459276..a86eadfaec 100644
+--- a/xen/arch/x86/include/asm/alternative.h
++++ b/xen/arch/x86/include/asm/alternative.h
+@@ -169,27 +169,25 @@ extern void alternative_branches(void);
+
+ #ifdef CONFIG_CC_IS_CLANG
+ /*
+- * Use a union with an unsigned long in order to prevent clang from
+- * skipping a possible truncation of the value. By using the union any
+- * truncation is carried before the call instruction, in turn covering
+- * for ABI-non-compliance in that the necessary clipping / extension of
+- * the value is supposed to be carried out in the callee.
++ * Clang doesn't follow the psABI and doesn't truncate parameter values at the
++ * callee. This can lead to bad code being generated when using alternative
++ * calls.
+ *
+- * Note this behavior is not mandated by the standard, and hence could
+- * stop being a viable workaround, or worse, could cause a different set
+- * of code-generation issues in future clang versions.
++ * Workaround it by using a temporary intermediate variable that's zeroed
++ * before being assigned the parameter value, as that forces clang to zero the
++ * register at the caller.
+ *
+ * This has been reported upstream:
+ * https://github.com/llvm/llvm-project/issues/12579
+ * https://github.com/llvm/llvm-project/issues/82598
+ */
+ #define ALT_CALL_ARG(arg, n) \
+- register union { \
+- typeof(arg) e[sizeof(long) / sizeof(arg)]; \
+- unsigned long r; \
+- } a ## n ## _ asm ( ALT_CALL_arg ## n ) = { \
+- .e[0] = ({ BUILD_BUG_ON(sizeof(arg) > sizeof(void *)); (arg); })\
+- }
++ register unsigned long a ## n ## _ asm ( ALT_CALL_arg ## n ) = ({ \
++ unsigned long tmp = 0; \
++ BUILD_BUG_ON(sizeof(arg) > sizeof(unsigned long)); \
++ *(typeof(arg) *)&tmp = (arg); \
++ tmp; \
++ })
+ #else
+ #define ALT_CALL_ARG(arg, n) \
+ register typeof(arg) a ## n ## _ asm ( ALT_CALL_arg ## n ) = \
+--
+2.46.1
+
diff --git a/0005-x86-spec-fix-reporting-of-BHB-clearing-usage-from-gu.patch b/0005-x86-spec-fix-reporting-of-BHB-clearing-usage-from-gu.patch
deleted file mode 100644
index bad0428..0000000
--- a/0005-x86-spec-fix-reporting-of-BHB-clearing-usage-from-gu.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 0b0c7dca70d64c35c86e5d503f67366ebe2b9138 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:37:04 +0200
-Subject: [PATCH 05/56] x86/spec: fix reporting of BHB clearing usage from
- guest entry points
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reporting whether the BHB clearing on entry is done for the different domains
-types based on cpu_has_bhb_seq is unhelpful, as that variable signals whether
-there's a BHB clearing sequence selected, but that alone doesn't imply that
-such sequence is used from the PV and/or HVM entry points.
-
-Instead use opt_bhb_entry_{pv,hvm} which do signal whether BHB clearing is
-performed on entry from PV/HVM.
-
-Fixes: 689ad48ce9cf ('x86/spec-ctrl: Wire up the Native-BHI software sequences')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 049ab0b2c9f1f5edb54b505fef0bc575787dafe9
-master date: 2024-04-25 16:35:56 +0200
----
- xen/arch/x86/spec_ctrl.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
-index ba4349a024..8c67d6256a 100644
---- a/xen/arch/x86/spec_ctrl.c
-+++ b/xen/arch/x86/spec_ctrl.c
-@@ -634,7 +634,7 @@ static void __init print_details(enum ind_thunk thunk)
- (boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ||
- boot_cpu_has(X86_FEATURE_SC_RSB_HVM) ||
- boot_cpu_has(X86_FEATURE_IBPB_ENTRY_HVM) ||
-- cpu_has_bhb_seq || amd_virt_spec_ctrl ||
-+ opt_bhb_entry_hvm || amd_virt_spec_ctrl ||
- opt_eager_fpu || opt_verw_hvm) ? "" : " None",
- boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ? " MSR_SPEC_CTRL" : "",
- (boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ||
-@@ -643,7 +643,7 @@ static void __init print_details(enum ind_thunk thunk)
- opt_eager_fpu ? " EAGER_FPU" : "",
- opt_verw_hvm ? " VERW" : "",
- boot_cpu_has(X86_FEATURE_IBPB_ENTRY_HVM) ? " IBPB-entry" : "",
-- cpu_has_bhb_seq ? " BHB-entry" : "");
-+ opt_bhb_entry_hvm ? " BHB-entry" : "");
-
- #endif
- #ifdef CONFIG_PV
-@@ -651,14 +651,14 @@ static void __init print_details(enum ind_thunk thunk)
- (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
- boot_cpu_has(X86_FEATURE_SC_RSB_PV) ||
- boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV) ||
-- cpu_has_bhb_seq ||
-+ opt_bhb_entry_pv ||
- opt_eager_fpu || opt_verw_pv) ? "" : " None",
- boot_cpu_has(X86_FEATURE_SC_MSR_PV) ? " MSR_SPEC_CTRL" : "",
- boot_cpu_has(X86_FEATURE_SC_RSB_PV) ? " RSB" : "",
- opt_eager_fpu ? " EAGER_FPU" : "",
- opt_verw_pv ? " VERW" : "",
- boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV) ? " IBPB-entry" : "",
-- cpu_has_bhb_seq ? " BHB-entry" : "");
-+ opt_bhb_entry_pv ? " BHB-entry" : "");
-
- printk(" XPTI (64-bit PV only): Dom0 %s, DomU %s (with%s PCID)\n",
- opt_xpti_hwdom ? "enabled" : "disabled",
---
-2.45.2
-
diff --git a/0006-x86-spec-adjust-logic-that-elides-lfence.patch b/0006-x86-spec-adjust-logic-that-elides-lfence.patch
deleted file mode 100644
index 6da96c4..0000000
--- a/0006-x86-spec-adjust-logic-that-elides-lfence.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From f0ff1d9cb96041a84a24857a6464628240deed4f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Mon, 29 Apr 2024 09:37:29 +0200
-Subject: [PATCH 06/56] x86/spec: adjust logic that elides lfence
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-It's currently too restrictive by just checking whether there's a BHB clearing
-sequence selected. It should instead check whether BHB clearing is used on
-entry from PV or HVM specifically.
-
-Switch to use opt_bhb_entry_{pv,hvm} instead, and then remove cpu_has_bhb_seq
-since it no longer has any users.
-
-Reported-by: Jan Beulich <jbeulich@suse.com>
-Fixes: 954c983abcee ('x86/spec-ctrl: Software BHB-clearing sequences')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 656ae8f1091bcefec9c46ec3ea3ac2118742d4f6
-master date: 2024-04-25 16:37:01 +0200
----
- xen/arch/x86/include/asm/cpufeature.h | 3 ---
- xen/arch/x86/spec_ctrl.c | 6 +++---
- 2 files changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/xen/arch/x86/include/asm/cpufeature.h b/xen/arch/x86/include/asm/cpufeature.h
-index 7a312c485e..3c57f55de0 100644
---- a/xen/arch/x86/include/asm/cpufeature.h
-+++ b/xen/arch/x86/include/asm/cpufeature.h
-@@ -228,9 +228,6 @@ static inline bool boot_cpu_has(unsigned int feat)
- #define cpu_bug_fpu_ptrs boot_cpu_has(X86_BUG_FPU_PTRS)
- #define cpu_bug_null_seg boot_cpu_has(X86_BUG_NULL_SEG)
-
--#define cpu_has_bhb_seq (boot_cpu_has(X86_SPEC_BHB_TSX) || \
-- boot_cpu_has(X86_SPEC_BHB_LOOPS))
--
- enum _cache_type {
- CACHE_TYPE_NULL = 0,
- CACHE_TYPE_DATA = 1,
-diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
-index 8c67d6256a..12c19b7eca 100644
---- a/xen/arch/x86/spec_ctrl.c
-+++ b/xen/arch/x86/spec_ctrl.c
-@@ -2328,7 +2328,7 @@ void __init init_speculation_mitigations(void)
- * unconditional WRMSR. If we do have it, or we're not using any
- * prior conditional block, then it's safe to drop the LFENCE.
- */
-- if ( !cpu_has_bhb_seq &&
-+ if ( !opt_bhb_entry_pv &&
- (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
- !boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV)) )
- setup_force_cpu_cap(X86_SPEC_NO_LFENCE_ENTRY_PV);
-@@ -2344,7 +2344,7 @@ void __init init_speculation_mitigations(void)
- * active in the block that is skipped when interrupting guest
- * context, then it's safe to drop the LFENCE.
- */
-- if ( !cpu_has_bhb_seq &&
-+ if ( !opt_bhb_entry_pv &&
- (boot_cpu_has(X86_FEATURE_SC_MSR_PV) ||
- (!boot_cpu_has(X86_FEATURE_IBPB_ENTRY_PV) &&
- !boot_cpu_has(X86_FEATURE_SC_RSB_PV))) )
-@@ -2356,7 +2356,7 @@ void __init init_speculation_mitigations(void)
- * A BHB sequence, if used, is the only conditional action, so if we
- * don't have it, we don't need the safety LFENCE.
- */
-- if ( !cpu_has_bhb_seq )
-+ if ( !opt_bhb_entry_hvm )
- setup_force_cpu_cap(X86_SPEC_NO_LFENCE_ENTRY_VMX);
- }
-
---
-2.45.2
-
diff --git a/0006-xen-sched-fix-error-handling-in-cpu_schedule_up.patch b/0006-xen-sched-fix-error-handling-in-cpu_schedule_up.patch
new file mode 100644
index 0000000..86189a6
--- /dev/null
+++ b/0006-xen-sched-fix-error-handling-in-cpu_schedule_up.patch
@@ -0,0 +1,113 @@
+From b37580d5e984770266783b639552a97c36ecb58a Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 8 Aug 2024 13:46:21 +0200
+Subject: [PATCH 06/35] xen/sched: fix error handling in cpu_schedule_up()
+
+In case cpu_schedule_up() is failing, it needs to undo all externally
+visible changes it has done before.
+
+Reason is that cpu_schedule_callback() won't be called with the
+CPU_UP_CANCELED notifier in case cpu_schedule_up() did fail.
+
+Fixes: 207589dbacd4 ("xen/sched: move per cpu scheduler private data into struct sched_resource")
+Reported-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 44a7d4f0a5e9eae41a44a162e54ff6d2ebe5b7d6
+master date: 2024-07-31 14:50:18 +0200
+---
+ xen/common/sched/core.c | 63 +++++++++++++++++++++--------------------
+ 1 file changed, 33 insertions(+), 30 deletions(-)
+
+diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
+index d84b65f197..c466711e9e 100644
+--- a/xen/common/sched/core.c
++++ b/xen/common/sched/core.c
+@@ -2755,6 +2755,36 @@ static struct sched_resource *sched_alloc_res(void)
+ return sr;
+ }
+
++static void cf_check sched_res_free(struct rcu_head *head)
++{
++ struct sched_resource *sr = container_of(head, struct sched_resource, rcu);
++
++ free_cpumask_var(sr->cpus);
++ if ( sr->sched_unit_idle )
++ sched_free_unit_mem(sr->sched_unit_idle);
++ xfree(sr);
++}
++
++static void cpu_schedule_down(unsigned int cpu)
++{
++ struct sched_resource *sr;
++
++ rcu_read_lock(&sched_res_rculock);
++
++ sr = get_sched_res(cpu);
++
++ kill_timer(&sr->s_timer);
++
++ cpumask_clear_cpu(cpu, &sched_res_mask);
++ set_sched_res(cpu, NULL);
++
++ /* Keep idle unit. */
++ sr->sched_unit_idle = NULL;
++ call_rcu(&sr->rcu, sched_res_free);
++
++ rcu_read_unlock(&sched_res_rculock);
++}
++
+ static int cpu_schedule_up(unsigned int cpu)
+ {
+ struct sched_resource *sr;
+@@ -2794,7 +2824,10 @@ static int cpu_schedule_up(unsigned int cpu)
+ idle_vcpu[cpu]->sched_unit->res = sr;
+
+ if ( idle_vcpu[cpu] == NULL )
++ {
++ cpu_schedule_down(cpu);
+ return -ENOMEM;
++ }
+
+ idle_vcpu[cpu]->sched_unit->rendezvous_in_cnt = 0;
+
+@@ -2812,36 +2845,6 @@ static int cpu_schedule_up(unsigned int cpu)
+ return 0;
+ }
+
+-static void cf_check sched_res_free(struct rcu_head *head)
+-{
+- struct sched_resource *sr = container_of(head, struct sched_resource, rcu);
+-
+- free_cpumask_var(sr->cpus);
+- if ( sr->sched_unit_idle )
+- sched_free_unit_mem(sr->sched_unit_idle);
+- xfree(sr);
+-}
+-
+-static void cpu_schedule_down(unsigned int cpu)
+-{
+- struct sched_resource *sr;
+-
+- rcu_read_lock(&sched_res_rculock);
+-
+- sr = get_sched_res(cpu);
+-
+- kill_timer(&sr->s_timer);
+-
+- cpumask_clear_cpu(cpu, &sched_res_mask);
+- set_sched_res(cpu, NULL);
+-
+- /* Keep idle unit. */
+- sr->sched_unit_idle = NULL;
+- call_rcu(&sr->rcu, sched_res_free);
+-
+- rcu_read_unlock(&sched_res_rculock);
+-}
+-
+ void sched_rm_cpu(unsigned int cpu)
+ {
+ int rc;
+--
+2.46.1
+
diff --git a/0007-xen-hvm-Don-t-skip-MSR_READ-trace-record.patch b/0007-xen-hvm-Don-t-skip-MSR_READ-trace-record.patch
new file mode 100644
index 0000000..0649616
--- /dev/null
+++ b/0007-xen-hvm-Don-t-skip-MSR_READ-trace-record.patch
@@ -0,0 +1,40 @@
+From 97a15007c9606d4c53109754bb21fd593bca589b Mon Sep 17 00:00:00 2001
+From: George Dunlap <george.dunlap@cloud.com>
+Date: Thu, 8 Aug 2024 13:47:02 +0200
+Subject: [PATCH 07/35] xen/hvm: Don't skip MSR_READ trace record
+
+Commit 37f074a3383 ("x86/msr: introduce guest_rdmsr()") introduced a
+function to combine the MSR_READ handling between PV and HVM.
+Unfortunately, by returning directly, it skipped the trace generation,
+leading to gaps in the trace record, as well as xenalyze errors like
+this:
+
+hvm_generic_postprocess: d2v0 Strange, exit 7c(VMEXIT_MSR) missing a handler
+
+Replace the `return` with `goto out`.
+
+Fixes: 37f074a3383 ("x86/msr: introduce guest_rdmsr()")
+Signed-off-by: George Dunlap <george.dunlap@cloud.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: bc8a43fff61ae4162a95d84f4e148d6773667cd2
+master date: 2024-08-02 08:42:09 +0200
+---
+ xen/arch/x86/hvm/hvm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
+index 7f4b627b1f..0fe2b85b16 100644
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -3557,7 +3557,7 @@ int hvm_msr_read_intercept(unsigned int msr, uint64_t *msr_content)
+ fixed_range_base = (uint64_t *)v->arch.hvm.mtrr.fixed_ranges;
+
+ if ( (ret = guest_rdmsr(v, msr, msr_content)) != X86EMUL_UNHANDLEABLE )
+- return ret;
++ goto out;
+
+ ret = X86EMUL_OKAY;
+
+--
+2.46.1
+
diff --git a/0007-xen-xsm-Wire-up-get_dom0_console.patch b/0007-xen-xsm-Wire-up-get_dom0_console.patch
deleted file mode 100644
index 540541c..0000000
--- a/0007-xen-xsm-Wire-up-get_dom0_console.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 026542c8577ab6af7c1dbc7446547bdc2bc705fd Mon Sep 17 00:00:00 2001
-From: Jason Andryuk <jason.andryuk@amd.com>
-Date: Tue, 21 May 2024 10:19:43 +0200
-Subject: [PATCH 07/56] xen/xsm: Wire up get_dom0_console
-
-An XSM hook for get_dom0_console is currently missing. Using XSM with
-a PVH dom0 shows:
-(XEN) FLASK: Denying unknown platform_op: 64.
-
-Wire up the hook, and allow it for dom0.
-
-Fixes: 4dd160583c ("x86/platform: introduce hypercall to get initial video console settings")
-Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
-Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
-master commit: 647f7e50ebeeb8152974cad6a12affe474c74513
-master date: 2024-04-30 08:33:41 +0200
----
- tools/flask/policy/modules/dom0.te | 2 +-
- xen/xsm/flask/hooks.c | 4 ++++
- xen/xsm/flask/policy/access_vectors | 2 ++
- 3 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te
-index f1dcff48e2..16b8c9646d 100644
---- a/tools/flask/policy/modules/dom0.te
-+++ b/tools/flask/policy/modules/dom0.te
-@@ -16,7 +16,7 @@ allow dom0_t xen_t:xen {
- allow dom0_t xen_t:xen2 {
- resource_op psr_cmt_op psr_alloc pmu_ctrl get_symbol
- get_cpu_levelling_caps get_cpu_featureset livepatch_op
-- coverage_op
-+ coverage_op get_dom0_console
- };
-
- # Allow dom0 to use all XENVER_ subops that have checks.
-diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
-index 78225f68c1..5e88c71b8e 100644
---- a/xen/xsm/flask/hooks.c
-+++ b/xen/xsm/flask/hooks.c
-@@ -1558,6 +1558,10 @@ static int cf_check flask_platform_op(uint32_t op)
- return avc_has_perm(domain_sid(current->domain), SECINITSID_XEN,
- SECCLASS_XEN2, XEN2__GET_SYMBOL, NULL);
-
-+ case XENPF_get_dom0_console:
-+ return avc_has_perm(domain_sid(current->domain), SECINITSID_XEN,
-+ SECCLASS_XEN2, XEN2__GET_DOM0_CONSOLE, NULL);
-+
- default:
- return avc_unknown_permission("platform_op", op);
- }
-diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
-index 4e6710a63e..a35e3d4c51 100644
---- a/xen/xsm/flask/policy/access_vectors
-+++ b/xen/xsm/flask/policy/access_vectors
-@@ -99,6 +99,8 @@ class xen2
- livepatch_op
- # XEN_SYSCTL_coverage_op
- coverage_op
-+# XENPF_get_dom0_console
-+ get_dom0_console
- }
-
- # Classes domain and domain2 consist of operations that a domain performs on
---
-2.45.2
-
diff --git a/0008-tools-lsevtchn-Use-errno-macro-to-handle-hypercall-e.patch b/0008-tools-lsevtchn-Use-errno-macro-to-handle-hypercall-e.patch
new file mode 100644
index 0000000..76bb65e
--- /dev/null
+++ b/0008-tools-lsevtchn-Use-errno-macro-to-handle-hypercall-e.patch
@@ -0,0 +1,75 @@
+From e0e84771b61ed985809d105d8f116d4c520542b0 Mon Sep 17 00:00:00 2001
+From: Matthew Barnes <matthew.barnes@cloud.com>
+Date: Thu, 8 Aug 2024 13:47:30 +0200
+Subject: [PATCH 08/35] tools/lsevtchn: Use errno macro to handle hypercall
+ error cases
+
+Currently, lsevtchn aborts its event channel enumeration when it hits
+an event channel that is owned by Xen.
+
+lsevtchn does not distinguish between different hypercall errors, which
+results in lsevtchn missing potential relevant event channels with
+higher port numbers.
+
+Use the errno macro to distinguish between hypercall errors, and
+continue event channel enumeration if the hypercall error is not
+critical to enumeration.
+
+Signed-off-by: Matthew Barnes <matthew.barnes@cloud.com>
+Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
+master commit: e92a453c8db8bba62d6be3006079e2b9990c3978
+master date: 2024-08-02 08:43:57 +0200
+---
+ tools/xcutils/lsevtchn.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/tools/xcutils/lsevtchn.c b/tools/xcutils/lsevtchn.c
+index d1710613dd..30c8d847b8 100644
+--- a/tools/xcutils/lsevtchn.c
++++ b/tools/xcutils/lsevtchn.c
+@@ -3,6 +3,7 @@
+ #include <stdint.h>
+ #include <string.h>
+ #include <stdio.h>
++#include <errno.h>
+
+ #include <xenctrl.h>
+
+@@ -24,7 +25,23 @@ int main(int argc, char **argv)
+ status.port = port;
+ rc = xc_evtchn_status(xch, &status);
+ if ( rc < 0 )
+- break;
++ {
++ switch ( errno )
++ {
++ case EACCES: /* Xen-owned evtchn */
++ continue;
++
++ case EINVAL: /* Port enumeration has ended */
++ rc = 0;
++ break;
++
++ default:
++ perror("xc_evtchn_status");
++ rc = 1;
++ break;
++ }
++ goto out;
++ }
+
+ if ( status.status == EVTCHNSTAT_closed )
+ continue;
+@@ -58,7 +75,8 @@ int main(int argc, char **argv)
+ printf("\n");
+ }
+
++ out:
+ xc_interface_close(xch);
+
+- return 0;
++ return rc;
+ }
+--
+2.46.1
+
diff --git a/0008-xen-x86-Fix-Syntax-warning-in-gen-cpuid.py.patch b/0008-xen-x86-Fix-Syntax-warning-in-gen-cpuid.py.patch
deleted file mode 100644
index 7c04f23..0000000
--- a/0008-xen-x86-Fix-Syntax-warning-in-gen-cpuid.py.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 47cf06c09a2fa1ee92ea3e7718c8f8e0f1450d88 Mon Sep 17 00:00:00 2001
-From: Jason Andryuk <jason.andryuk@amd.com>
-Date: Tue, 21 May 2024 10:20:06 +0200
-Subject: [PATCH 08/56] xen/x86: Fix Syntax warning in gen-cpuid.py
-
-Python 3.12.2 warns:
-
-xen/tools/gen-cpuid.py:50: SyntaxWarning: invalid escape sequence '\s'
- "\s+([\s\d]+\*[\s\d]+\+[\s\d]+)\)"
-xen/tools/gen-cpuid.py:51: SyntaxWarning: invalid escape sequence '\s'
- "\s+/\*([\w!]*) .*$")
-
-Specify the strings as raw strings so '\s' is read as literal '\' + 's'.
-This avoids escaping all the '\'s in the strings.
-
-Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 08e79bba73d74a85d3ce6ff0f91c5205f1e05eda
-master date: 2024-04-30 08:34:37 +0200
----
- xen/tools/gen-cpuid.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/xen/tools/gen-cpuid.py b/xen/tools/gen-cpuid.py
-index 02dd45a5ed..415d644db5 100755
---- a/xen/tools/gen-cpuid.py
-+++ b/xen/tools/gen-cpuid.py
-@@ -47,8 +47,8 @@ def parse_definitions(state):
- """
- feat_regex = re.compile(
- r"^XEN_CPUFEATURE\(([A-Z0-9_]+),"
-- "\s+([\s\d]+\*[\s\d]+\+[\s\d]+)\)"
-- "\s+/\*([\w!]*) .*$")
-+ r"\s+([\s\d]+\*[\s\d]+\+[\s\d]+)\)"
-+ r"\s+/\*([\w!]*) .*$")
-
- word_regex = re.compile(
- r"^/\* .* word (\d*) \*/$")
---
-2.45.2
-
diff --git a/0009-9pfsd-fix-release-build-with-old-gcc.patch b/0009-9pfsd-fix-release-build-with-old-gcc.patch
new file mode 100644
index 0000000..6d6f2ef
--- /dev/null
+++ b/0009-9pfsd-fix-release-build-with-old-gcc.patch
@@ -0,0 +1,33 @@
+From 8ad5a8c5c36add2eee70a7253da4098ebffdb79b Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Thu, 8 Aug 2024 13:47:44 +0200
+Subject: [PATCH 09/35] 9pfsd: fix release build with old gcc
+
+Being able to recognize that "par" is reliably initialized on the 1st
+loop iteration requires not overly old compilers.
+
+Fixes: 7809132b1a1d ("tools/xen-9pfsd: add 9pfs response generation support")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+master commit: 984cb316cb27b53704c607e640a7dd2763b898ab
+master date: 2024-08-02 08:44:22 +0200
+---
+ tools/9pfsd/io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/9pfsd/io.c b/tools/9pfsd/io.c
+index df1be3df7d..468e0241f5 100644
+--- a/tools/9pfsd/io.c
++++ b/tools/9pfsd/io.c
+@@ -196,7 +196,7 @@ static void fill_buffer_at(void **data, const char *fmt, ...);
+ static void vfill_buffer_at(void **data, const char *fmt, va_list ap)
+ {
+ const char *f;
+- const void *par;
++ const void *par = NULL; /* old gcc */
+ const char *str_val;
+ const struct p9_qid *qid;
+ const struct p9_stat *stat;
+--
+2.46.1
+
diff --git a/0009-VT-d-correct-ATS-checking-for-root-complex-integrate.patch b/0009-VT-d-correct-ATS-checking-for-root-complex-integrate.patch
deleted file mode 100644
index 2d2dc91..0000000
--- a/0009-VT-d-correct-ATS-checking-for-root-complex-integrate.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From a4c5bbb9db07b27e66f7c47676b1c888e1bece20 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Tue, 21 May 2024 10:20:58 +0200
-Subject: [PATCH 09/56] VT-d: correct ATS checking for root complex integrated
- devices
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Spec version 4.1 says
-
-"The ATSR structures identifies PCI Express Root-Ports supporting
- Address Translation Services (ATS) transactions. Software must enable
- ATS on endpoint devices behind a Root Port only if the Root Port is
- reported as supporting ATS transactions."
-
-Clearly root complex integrated devices aren't "behind root ports",
-matching my observation on a SapphireRapids system having an ATS-
-capable root complex integrated device. Hence for such devices we
-shouldn't try to locate a corresponding ATSR.
-
-Since both pci_find_ext_capability() and pci_find_cap_offset() return
-"unsigned int", change "pos" to that type at the same time.
-
-Fixes: 903b93211f56 ("[VTD] laying the ground work for ATS")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 04e31583bab97e5042a44a1d00fce2760272635f
-master date: 2024-05-06 09:22:45 +0200
----
- xen/drivers/passthrough/vtd/x86/ats.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/xen/drivers/passthrough/vtd/x86/ats.c b/xen/drivers/passthrough/vtd/x86/ats.c
-index 1f5913bed9..61052ef580 100644
---- a/xen/drivers/passthrough/vtd/x86/ats.c
-+++ b/xen/drivers/passthrough/vtd/x86/ats.c
-@@ -44,7 +44,7 @@ struct acpi_drhd_unit *find_ats_dev_drhd(struct vtd_iommu *iommu)
- int ats_device(const struct pci_dev *pdev, const struct acpi_drhd_unit *drhd)
- {
- struct acpi_drhd_unit *ats_drhd;
-- int pos;
-+ unsigned int pos, expfl = 0;
-
- if ( !ats_enabled || !iommu_qinval )
- return 0;
-@@ -53,7 +53,12 @@ int ats_device(const struct pci_dev *pdev, const struct acpi_drhd_unit *drhd)
- !ecap_dev_iotlb(drhd->iommu->ecap) )
- return 0;
-
-- if ( !acpi_find_matched_atsr_unit(pdev) )
-+ pos = pci_find_cap_offset(pdev->sbdf, PCI_CAP_ID_EXP);
-+ if ( pos )
-+ expfl = pci_conf_read16(pdev->sbdf, pos + PCI_EXP_FLAGS);
-+
-+ if ( MASK_EXTR(expfl, PCI_EXP_FLAGS_TYPE) != PCI_EXP_TYPE_RC_END &&
-+ !acpi_find_matched_atsr_unit(pdev) )
- return 0;
-
- ats_drhd = find_ats_dev_drhd(drhd->iommu);
---
-2.45.2
-
diff --git a/0010-tools-libxs-Open-dev-xen-xenbus-fds-as-O_CLOEXEC.patch b/0010-tools-libxs-Open-dev-xen-xenbus-fds-as-O_CLOEXEC.patch
deleted file mode 100644
index 9f9cdd7..0000000
--- a/0010-tools-libxs-Open-dev-xen-xenbus-fds-as-O_CLOEXEC.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 2bc52041cacb33a301ebf939d69a021597941186 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Tue, 21 May 2024 10:21:47 +0200
-Subject: [PATCH 10/56] tools/libxs: Open /dev/xen/xenbus fds as O_CLOEXEC
-
-The header description for xs_open() goes as far as to suggest that the fd is
-O_CLOEXEC, but it isn't actually.
-
-`xl devd` has been observed leaking /dev/xen/xenbus into children.
-
-Link: https://github.com/QubesOS/qubes-issues/issues/8292
-Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-master commit: f4f2f3402b2f4985d69ffc0d46f845d05fd0b60f
-master date: 2024-05-07 15:18:36 +0100
----
- tools/libs/store/xs.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/tools/libs/store/xs.c b/tools/libs/store/xs.c
-index 140b9a2839..1498515073 100644
---- a/tools/libs/store/xs.c
-+++ b/tools/libs/store/xs.c
-@@ -54,6 +54,10 @@ struct xs_stored_msg {
- #include <dlfcn.h>
- #endif
-
-+#ifndef O_CLOEXEC
-+#define O_CLOEXEC 0
-+#endif
-+
- struct xs_handle {
- /* Communications channel to xenstore daemon. */
- int fd;
-@@ -227,7 +231,7 @@ error:
- static int get_dev(const char *connect_to)
- {
- /* We cannot open read-only because requests are writes */
-- return open(connect_to, O_RDWR);
-+ return open(connect_to, O_RDWR | O_CLOEXEC);
- }
-
- static int all_restrict_cb(Xentoolcore__Active_Handle *ah, domid_t domid) {
---
-2.45.2
-
diff --git a/0010-x86-emul-Fix-misaligned-IO-breakpoint-behaviour-in-P.patch b/0010-x86-emul-Fix-misaligned-IO-breakpoint-behaviour-in-P.patch
new file mode 100644
index 0000000..07b592a
--- /dev/null
+++ b/0010-x86-emul-Fix-misaligned-IO-breakpoint-behaviour-in-P.patch
@@ -0,0 +1,41 @@
+From 033060ee6e05f9e86ef1a51674864b55dc15e62c Mon Sep 17 00:00:00 2001
+From: Matthew Barnes <matthew.barnes@cloud.com>
+Date: Thu, 8 Aug 2024 13:48:03 +0200
+Subject: [PATCH 10/35] x86/emul: Fix misaligned IO breakpoint behaviour in PV
+ guests
+
+When hardware breakpoints are configured on misaligned IO ports, the
+hardware will mask the addresses based on the breakpoint width during
+comparison.
+
+For PV guests, misaligned IO breakpoints do not behave the same way, and
+therefore yield different results.
+
+This patch tweaks the emulation of IO breakpoints for PV guests such
+that they reproduce the same behaviour as hardware.
+
+Fixes: bec9e3205018 ("x86: emulate I/O port access breakpoints")
+Signed-off-by: Matthew Barnes <matthew.barnes@cloud.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 08aacc392d86d4c7dbebdb5e664060ae2af72057
+master date: 2024-08-08 13:27:50 +0200
+---
+ xen/arch/x86/pv/emul-priv-op.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c
+index f101510a1b..aa11ecadaa 100644
+--- a/xen/arch/x86/pv/emul-priv-op.c
++++ b/xen/arch/x86/pv/emul-priv-op.c
+@@ -346,6 +346,8 @@ static unsigned int check_guest_io_breakpoint(struct vcpu *v,
+ case DR_LEN_8: width = 8; break;
+ }
+
++ start &= ~(width - 1UL);
++
+ if ( (start < (port + len)) && ((start + width) > port) )
+ match |= 1u << i;
+ }
+--
+2.46.1
+
diff --git a/0011-x86-IOMMU-move-tracking-in-iommu_identity_mapping.patch b/0011-x86-IOMMU-move-tracking-in-iommu_identity_mapping.patch
new file mode 100644
index 0000000..930ea55
--- /dev/null
+++ b/0011-x86-IOMMU-move-tracking-in-iommu_identity_mapping.patch
@@ -0,0 +1,111 @@
+From c61d4264d26d1ffb26563bfb6dc2f0b06cd72128 Mon Sep 17 00:00:00 2001
+From: Teddy Astie <teddy.astie@vates.tech>
+Date: Tue, 13 Aug 2024 16:47:19 +0200
+Subject: [PATCH 11/35] x86/IOMMU: move tracking in iommu_identity_mapping()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If for some reason xmalloc() fails after having mapped the reserved
+regions, an error is reported, but the regions remain mapped in the P2M.
+
+Similarly if an error occurs during set_identity_p2m_entry() (except on
+the first call), the partial mappings of the region would be retained
+without being tracked anywhere, and hence without there being a way to
+remove them again from the domain's P2M.
+
+Move the setting up of the list entry ahead of trying to map the region.
+In cases other than the first mapping failing, keep record of the full
+region, such that a subsequent unmapping request can be properly torn
+down.
+
+To compensate for the potentially excess unmapping requests, don't log a
+warning from p2m_remove_identity_entry() when there really was nothing
+mapped at a given GFN.
+
+This is XSA-460 / CVE-2024-31145.
+
+Fixes: 2201b67b9128 ("VT-d: improve RMRR region handling")
+Fixes: c0e19d7c6c42 ("IOMMU: generalize VT-d's tracking of mapped RMRR regions")
+Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+master commit: beadd68b5490ada053d72f8a9ce6fd696d626596
+master date: 2024-08-13 16:36:40 +0200
+---
+ xen/arch/x86/mm/p2m.c | 8 +++++---
+ xen/drivers/passthrough/x86/iommu.c | 30 ++++++++++++++++++++---------
+ 2 files changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
+index e7e327d6a6..1739133fc2 100644
+--- a/xen/arch/x86/mm/p2m.c
++++ b/xen/arch/x86/mm/p2m.c
+@@ -1267,9 +1267,11 @@ int p2m_remove_identity_entry(struct domain *d, unsigned long gfn_l)
+ else
+ {
+ gfn_unlock(p2m, gfn, 0);
+- printk(XENLOG_G_WARNING
+- "non-identity map d%d:%lx not cleared (mapped to %lx)\n",
+- d->domain_id, gfn_l, mfn_x(mfn));
++ if ( (p2mt != p2m_invalid && p2mt != p2m_mmio_dm) ||
++ a != p2m_access_n || !mfn_eq(mfn, INVALID_MFN) )
++ printk(XENLOG_G_WARNING
++ "non-identity map %pd:%lx not cleared (mapped to %lx)\n",
++ d, gfn_l, mfn_x(mfn));
+ ret = 0;
+ }
+
+diff --git a/xen/drivers/passthrough/x86/iommu.c b/xen/drivers/passthrough/x86/iommu.c
+index cc0062b027..8b1e0596b8 100644
+--- a/xen/drivers/passthrough/x86/iommu.c
++++ b/xen/drivers/passthrough/x86/iommu.c
+@@ -267,24 +267,36 @@ int iommu_identity_mapping(struct domain *d, p2m_access_t p2ma,
+ if ( p2ma == p2m_access_x )
+ return -ENOENT;
+
+- while ( base_pfn < end_pfn )
+- {
+- int err = set_identity_p2m_entry(d, base_pfn, p2ma, flag);
+-
+- if ( err )
+- return err;
+- base_pfn++;
+- }
+-
+ map = xmalloc(struct identity_map);
+ if ( !map )
+ return -ENOMEM;
++
+ map->base = base;
+ map->end = end;
+ map->access = p2ma;
+ map->count = 1;
++
++ /*
++ * Insert into list ahead of mapping, so the range can be found when
++ * trying to clean up.
++ */
+ list_add_tail(&map->list, &hd->arch.identity_maps);
+
++ for ( ; base_pfn < end_pfn; ++base_pfn )
++ {
++ int err = set_identity_p2m_entry(d, base_pfn, p2ma, flag);
++
++ if ( !err )
++ continue;
++
++ if ( (map->base >> PAGE_SHIFT_4K) == base_pfn )
++ {
++ list_del(&map->list);
++ xfree(map);
++ }
++ return err;
++ }
++
+ return 0;
+ }
+
+--
+2.46.1
+
diff --git a/0011-x86-cpu-policy-Fix-migration-from-Ice-Lake-to-Cascad.patch b/0011-x86-cpu-policy-Fix-migration-from-Ice-Lake-to-Cascad.patch
deleted file mode 100644
index 26eb3ec..0000000
--- a/0011-x86-cpu-policy-Fix-migration-from-Ice-Lake-to-Cascad.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 0673eae8e53de5007dba35149527579819428323 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Tue, 21 May 2024 10:22:08 +0200
-Subject: [PATCH 11/56] x86/cpu-policy: Fix migration from Ice Lake to Cascade
- Lake
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Ever since Xen 4.14, there has been a latent bug with migration.
-
-While some toolstacks can level the features properly, they don't shink
-feat.max_subleaf when all features have been dropped. This is because
-we *still* have not completed the toolstack side work for full CPU Policy
-objects.
-
-As a consequence, even when properly feature levelled, VMs can't migrate
-"backwards" across hardware which reduces feat.max_subleaf. One such example
-is Ice Lake (max_subleaf=2 for INTEL_PSFD) to Cascade Lake (max_subleaf=0).
-
-Extend the max policies feat.max_subleaf to the hightest number Xen knows
-about, but leave the default policies matching the host. This will allow VMs
-with a higher feat.max_subleaf than strictly necessary to migrate in.
-
-Eventually we'll manage to teach the toolstack how to avoid creating such VMs
-in the first place, but there's still more work to do there.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: a2330b51df267e20e66bbba6c5bf08f0570ed58b
-master date: 2024-05-07 16:56:46 +0100
----
- xen/arch/x86/cpu-policy.c | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/xen/arch/x86/cpu-policy.c b/xen/arch/x86/cpu-policy.c
-index a822800f52..1aba6ed4ca 100644
---- a/xen/arch/x86/cpu-policy.c
-+++ b/xen/arch/x86/cpu-policy.c
-@@ -603,6 +603,13 @@ static void __init calculate_pv_max_policy(void)
- unsigned int i;
-
- *p = host_cpu_policy;
-+
-+ /*
-+ * Some VMs may have a larger-than-necessary feat max_subleaf. Allow them
-+ * to migrate in.
-+ */
-+ p->feat.max_subleaf = ARRAY_SIZE(p->feat.raw) - 1;
-+
- x86_cpu_policy_to_featureset(p, fs);
-
- for ( i = 0; i < ARRAY_SIZE(fs); ++i )
-@@ -643,6 +650,10 @@ static void __init calculate_pv_def_policy(void)
- unsigned int i;
-
- *p = pv_max_cpu_policy;
-+
-+ /* Default to the same max_subleaf as the host. */
-+ p->feat.max_subleaf = host_cpu_policy.feat.max_subleaf;
-+
- x86_cpu_policy_to_featureset(p, fs);
-
- for ( i = 0; i < ARRAY_SIZE(fs); ++i )
-@@ -679,6 +690,13 @@ static void __init calculate_hvm_max_policy(void)
- const uint32_t *mask;
-
- *p = host_cpu_policy;
-+
-+ /*
-+ * Some VMs may have a larger-than-necessary feat max_subleaf. Allow them
-+ * to migrate in.
-+ */
-+ p->feat.max_subleaf = ARRAY_SIZE(p->feat.raw) - 1;
-+
- x86_cpu_policy_to_featureset(p, fs);
-
- mask = hvm_hap_supported() ?
-@@ -780,6 +798,10 @@ static void __init calculate_hvm_def_policy(void)
- const uint32_t *mask;
-
- *p = hvm_max_cpu_policy;
-+
-+ /* Default to the same max_subleaf as the host. */
-+ p->feat.max_subleaf = host_cpu_policy.feat.max_subleaf;
-+
- x86_cpu_policy_to_featureset(p, fs);
-
- mask = hvm_hap_supported() ?
---
-2.45.2
-
diff --git a/0012-x86-pass-through-documents-as-security-unsupported-w.patch b/0012-x86-pass-through-documents-as-security-unsupported-w.patch
new file mode 100644
index 0000000..a83553c
--- /dev/null
+++ b/0012-x86-pass-through-documents-as-security-unsupported-w.patch
@@ -0,0 +1,42 @@
+From 3e8a2217f211d49dd771f7918d72df057121109f Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 13 Aug 2024 16:48:13 +0200
+Subject: [PATCH 12/35] x86/pass-through: documents as security-unsupported
+ when sharing resources
+
+When multiple devices share resources and one of them is to be passed
+through to a guest, security of the entire system and of respective
+guests individually cannot really be guaranteed without knowing
+internals of any of the involved guests. Therefore such a configuration
+cannot really be security-supported, yet making that explicit was so far
+missing.
+
+This is XSA-461 / CVE-2024-31146.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+master commit: 9c94eda1e3790820699a6de3f6a7c959ecf30600
+master date: 2024-08-13 16:37:25 +0200
+---
+ SUPPORT.md | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/SUPPORT.md b/SUPPORT.md
+index 8b998d9bc7..1d8b38cbd0 100644
+--- a/SUPPORT.md
++++ b/SUPPORT.md
+@@ -841,6 +841,11 @@ This feature is not security supported: see https://xenbits.xen.org/xsa/advisory
+
+ Only systems using IOMMUs are supported.
+
++Passing through of devices sharing resources with another device is not
++security supported. Such sharing could e.g. be the same line interrupt being
++used by multiple devices, one of which is to be passed through, or two such
++devices having memory BARs within the same 4k page.
++
+ Not compatible with migration, populate-on-demand, altp2m,
+ introspection, memory sharing, or memory paging.
+
+--
+2.46.1
+
diff --git a/0012-x86-ucode-Distinguish-ucode-already-up-to-date.patch b/0012-x86-ucode-Distinguish-ucode-already-up-to-date.patch
deleted file mode 100644
index dd2f91a..0000000
--- a/0012-x86-ucode-Distinguish-ucode-already-up-to-date.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From a42c83b202cc034c43c723cf363dbbabac61b1af Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Tue, 21 May 2024 10:22:52 +0200
-Subject: [PATCH 12/56] x86/ucode: Distinguish "ucode already up to date"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Right now, Xen returns -ENOENT for both "the provided blob isn't correct for
-this CPU", and "the blob isn't newer than what's loaded".
-
-This in turn causes xen-ucode to exit with an error, when "nothing to do" is
-more commonly a success condition.
-
-Handle EEXIST specially and exit cleanly.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 648db37a155aca6f66d4cf3bb118417a728c3579
-master date: 2024-05-09 18:19:49 +0100
----
- tools/misc/xen-ucode.c | 5 ++++-
- xen/arch/x86/cpu/microcode/core.c | 2 +-
- 2 files changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/tools/misc/xen-ucode.c b/tools/misc/xen-ucode.c
-index c6ae6498d6..390969db3d 100644
---- a/tools/misc/xen-ucode.c
-+++ b/tools/misc/xen-ucode.c
-@@ -125,8 +125,11 @@ int main(int argc, char *argv[])
- exit(1);
- }
-
-+ errno = 0;
- ret = xc_microcode_update(xch, buf, len);
-- if ( ret )
-+ if ( ret == -1 && errno == EEXIST )
-+ printf("Microcode already up to date\n");
-+ else if ( ret )
- {
- fprintf(stderr, "Failed to update microcode. (err: %s)\n",
- strerror(errno));
-diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c
-index 4e011cdc41..d5338ad345 100644
---- a/xen/arch/x86/cpu/microcode/core.c
-+++ b/xen/arch/x86/cpu/microcode/core.c
-@@ -640,7 +640,7 @@ static long cf_check microcode_update_helper(void *data)
- "microcode: couldn't find any newer%s revision in the provided blob!\n",
- opt_ucode_allow_same ? " (or the same)" : "");
- microcode_free_patch(patch);
-- ret = -ENOENT;
-+ ret = -EEXIST;
-
- goto put;
- }
---
-2.45.2
-
diff --git a/0013-automation-disable-Yocto-jobs.patch b/0013-automation-disable-Yocto-jobs.patch
new file mode 100644
index 0000000..72fda13
--- /dev/null
+++ b/0013-automation-disable-Yocto-jobs.patch
@@ -0,0 +1,48 @@
+From 51ae51301f2b4bccd365353f78510c1bdac522c9 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+Date: Fri, 9 Aug 2024 23:59:18 -0700
+Subject: [PATCH 13/35] automation: disable Yocto jobs
+
+The Yocto jobs take a long time to run. We are changing Gitlab ARM64
+runners and the new runners might not be able to finish the Yocto jobs
+in a reasonable time.
+
+For now, disable the Yocto jobs by turning them into "manual" trigger
+(they need to be manually executed.)
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Reviewed-by: Michal Orzel <michal.orzel@amd.com>
+master commit: 1c24bca387136d73f88f46ce3db82d34411702e8
+master date: 2024-08-09 23:59:18 -0700
+---
+ automation/gitlab-ci/build.yaml | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
+index 7ce88d38e7..09895d1fbd 100644
+--- a/automation/gitlab-ci/build.yaml
++++ b/automation/gitlab-ci/build.yaml
+@@ -470,17 +470,20 @@ yocto-qemuarm64:
+ extends: .yocto-test-arm64
+ variables:
+ YOCTO_BOARD: qemuarm64
++ when: manual
+
+ yocto-qemuarm:
+ extends: .yocto-test-arm64
+ variables:
+ YOCTO_BOARD: qemuarm
+ YOCTO_OUTPUT: --copy-output
++ when: manual
+
+ yocto-qemux86-64:
+ extends: .yocto-test-x86-64
+ variables:
+ YOCTO_BOARD: qemux86-64
++ when: manual
+
+ # Cppcheck analysis jobs
+
+--
+2.46.1
+
diff --git a/0013-libxl-fix-population-of-the-online-vCPU-bitmap-for-P.patch b/0013-libxl-fix-population-of-the-online-vCPU-bitmap-for-P.patch
deleted file mode 100644
index e5fb285..0000000
--- a/0013-libxl-fix-population-of-the-online-vCPU-bitmap-for-P.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 9966e5413133157a630f7462518005fb898e582a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Tue, 21 May 2024 10:23:27 +0200
-Subject: [PATCH 13/56] libxl: fix population of the online vCPU bitmap for PVH
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-libxl passes some information to libacpi to create the ACPI table for a PVH
-guest, and among that information it's a bitmap of which vCPUs are online
-which can be less than the maximum number of vCPUs assigned to the domain.
-
-While the population of the bitmap is done correctly for HVM based on the
-number of online vCPUs, for PVH the population of the bitmap is done based on
-the number of maximum vCPUs allowed. This leads to all local APIC entries in
-the MADT being set as enabled, which contradicts the data in xenstore if vCPUs
-is different than maximum vCPUs.
-
-Fix by copying the internal libxl bitmap that's populated based on the vCPUs
-parameter.
-
-Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
-Link: https://gitlab.com/libvirt/libvirt/-/issues/399
-Reported-by: Leigh Brown <leigh@solinno.co.uk>
-Fixes: 14c0d328da2b ('libxl/acpi: Build ACPI tables for HVMlite guests')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Tested-by: Leigh Brown <leigh@solinno.co.uk>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 5cc7347b04b2d0a3133754c7a9b936f614ec656a
-master date: 2024-05-11 00:13:43 +0100
----
- tools/libs/light/libxl_x86_acpi.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/tools/libs/light/libxl_x86_acpi.c b/tools/libs/light/libxl_x86_acpi.c
-index 620f3c700c..5cf261bd67 100644
---- a/tools/libs/light/libxl_x86_acpi.c
-+++ b/tools/libs/light/libxl_x86_acpi.c
-@@ -89,7 +89,7 @@ static int init_acpi_config(libxl__gc *gc,
- uint32_t domid = dom->guest_domid;
- xc_domaininfo_t info;
- struct hvm_info_table *hvminfo;
-- int i, r, rc;
-+ int r, rc;
-
- config->dsdt_anycpu = config->dsdt_15cpu = dsdt_pvh;
- config->dsdt_anycpu_len = config->dsdt_15cpu_len = dsdt_pvh_len;
-@@ -138,8 +138,8 @@ static int init_acpi_config(libxl__gc *gc,
- hvminfo->nr_vcpus = info.max_vcpu_id + 1;
- }
-
-- for (i = 0; i < hvminfo->nr_vcpus; i++)
-- hvminfo->vcpu_online[i / 8] |= 1 << (i & 7);
-+ memcpy(hvminfo->vcpu_online, b_info->avail_vcpus.map,
-+ b_info->avail_vcpus.size);
-
- config->hvminfo = hvminfo;
-
---
-2.45.2
-
diff --git a/0014-automation-use-expect-to-run-QEMU.patch b/0014-automation-use-expect-to-run-QEMU.patch
new file mode 100644
index 0000000..90e2c62
--- /dev/null
+++ b/0014-automation-use-expect-to-run-QEMU.patch
@@ -0,0 +1,362 @@
+From 0918434e0fbee48c9dccc5fe262de5a81e380c15 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+Date: Fri, 9 Aug 2024 23:59:20 -0700
+Subject: [PATCH 14/35] automation: use expect to run QEMU
+
+Use expect to invoke QEMU so that we can terminate the test as soon as
+we get the right string in the output instead of waiting until the
+final timeout.
+
+For timeout, instead of an hardcoding the value, use a Gitlab CI
+variable "QEMU_TIMEOUT" that can be changed depending on the latest
+status of the Gitlab CI runners.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Reviewed-by: Michal Orzel <michal.orzel@amd.com>
+master commit: c36efb7fcea6ef9f31a20e60ec79ed3ae293feee
+master date: 2024-08-09 23:59:20 -0700
+---
+ automation/scripts/qemu-alpine-x86_64.sh | 16 +++----
+ automation/scripts/qemu-key.exp | 45 +++++++++++++++++++
+ automation/scripts/qemu-smoke-dom0-arm32.sh | 16 +++----
+ automation/scripts/qemu-smoke-dom0-arm64.sh | 16 +++----
+ .../scripts/qemu-smoke-dom0less-arm32.sh | 18 ++++----
+ .../scripts/qemu-smoke-dom0less-arm64.sh | 16 +++----
+ automation/scripts/qemu-smoke-ppc64le.sh | 13 +++---
+ automation/scripts/qemu-smoke-riscv64.sh | 13 +++---
+ automation/scripts/qemu-smoke-x86-64.sh | 15 ++++---
+ automation/scripts/qemu-xtf-dom0less-arm64.sh | 15 +++----
+ 10 files changed, 112 insertions(+), 71 deletions(-)
+ create mode 100755 automation/scripts/qemu-key.exp
+
+diff --git a/automation/scripts/qemu-alpine-x86_64.sh b/automation/scripts/qemu-alpine-x86_64.sh
+index 8e398dcea3..5359e0820b 100755
+--- a/automation/scripts/qemu-alpine-x86_64.sh
++++ b/automation/scripts/qemu-alpine-x86_64.sh
+@@ -77,18 +77,16 @@ EOF
+ # Run the test
+ rm -f smoke.serial
+ set +e
+-timeout -k 1 720 \
+-qemu-system-x86_64 \
++export QEMU_CMD="qemu-system-x86_64 \
+ -cpu qemu64,+svm \
+ -m 2G -smp 2 \
+ -monitor none -serial stdio \
+ -nographic \
+ -device virtio-net-pci,netdev=n0 \
+- -netdev user,id=n0,tftp=binaries,bootfile=/pxelinux.0 |& \
+- # Remove carriage returns from the stdout output, as gitlab
+- # interface chokes on them
+- tee smoke.serial | sed 's/\r//'
++ -netdev user,id=n0,tftp=binaries,bootfile=/pxelinux.0"
+
+-set -e
+-(grep -q "Domain-0" smoke.serial && grep -q "BusyBox" smoke.serial) || exit 1
+-exit 0
++export QEMU_LOG="smoke.serial"
++export LOG_MSG="Domain-0"
++export PASSED="BusyBox"
++
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-key.exp b/automation/scripts/qemu-key.exp
+new file mode 100755
+index 0000000000..35eb903a31
+--- /dev/null
++++ b/automation/scripts/qemu-key.exp
+@@ -0,0 +1,45 @@
++#!/usr/bin/expect -f
++
++set timeout $env(QEMU_TIMEOUT)
++
++log_file -a $env(QEMU_LOG)
++
++match_max 10000
++
++eval spawn $env(QEMU_CMD)
++
++expect_after {
++ -re "(.*)\r" {
++ exp_continue
++ }
++ timeout {send_error "ERROR-Timeout!\n"; exit 1}
++ eof {send_error "ERROR-EOF!\n"; exit 1}
++}
++
++if {[info exists env(UBOOT_CMD)]} {
++ expect "=>"
++
++ send "$env(UBOOT_CMD)\r"
++}
++
++if {[info exists env(LOG_MSG)]} {
++ expect {
++ "$env(PASSED)" {
++ expect "$env(LOG_MSG)"
++ exit 0
++ }
++ "$env(LOG_MSG)" {
++ expect "$env(PASSED)"
++ exit 0
++ }
++ }
++}
++
++expect {
++ "$env(PASSED)" {
++ exit 0
++ }
++}
++
++expect eof
++
+diff --git a/automation/scripts/qemu-smoke-dom0-arm32.sh b/automation/scripts/qemu-smoke-dom0-arm32.sh
+index 31c05cc840..bab66bfe44 100755
+--- a/automation/scripts/qemu-smoke-dom0-arm32.sh
++++ b/automation/scripts/qemu-smoke-dom0-arm32.sh
+@@ -78,9 +78,7 @@ bash imagebuilder/scripts/uboot-script-gen -t tftp -d . -c config
+
+ rm -f ${serial_log}
+ set +e
+-echo " virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"| \
+-timeout -k 1 720 \
+-./qemu-system-arm \
++export QEMU_CMD="./qemu-system-arm \
+ -machine virt \
+ -machine virtualization=true \
+ -smp 4 \
+@@ -91,9 +89,11 @@ timeout -k 1 720 \
+ -no-reboot \
+ -device virtio-net-pci,netdev=n0 \
+ -netdev user,id=n0,tftp=./ \
+- -bios /usr/lib/u-boot/qemu_arm/u-boot.bin |& \
+- tee ${serial_log} | sed 's/\r//'
++ -bios /usr/lib/u-boot/qemu_arm/u-boot.bin"
++
++export UBOOT_CMD="virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"
++export QEMU_LOG="${serial_log}"
++export LOG_MSG="Domain-0"
++export PASSED="/ #"
+
+-set -e
+-(grep -q "Domain-0" ${serial_log} && grep -q "^/ #" ${serial_log}) || exit 1
+-exit 0
++../automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-dom0-arm64.sh b/automation/scripts/qemu-smoke-dom0-arm64.sh
+index 352963a741..0094bfc8e1 100755
+--- a/automation/scripts/qemu-smoke-dom0-arm64.sh
++++ b/automation/scripts/qemu-smoke-dom0-arm64.sh
+@@ -94,9 +94,7 @@ bash imagebuilder/scripts/uboot-script-gen -t tftp -d binaries/ -c binaries/conf
+ # Run the test
+ rm -f smoke.serial
+ set +e
+-echo " virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"| \
+-timeout -k 1 720 \
+-./binaries/qemu-system-aarch64 \
++export QEMU_CMD="./binaries/qemu-system-aarch64 \
+ -machine virtualization=true \
+ -cpu cortex-a57 -machine type=virt \
+ -m 2048 -monitor none -serial stdio \
+@@ -104,9 +102,11 @@ timeout -k 1 720 \
+ -no-reboot \
+ -device virtio-net-pci,netdev=n0 \
+ -netdev user,id=n0,tftp=binaries \
+- -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin |& \
+- tee smoke.serial | sed 's/\r//'
++ -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin"
++
++export UBOOT_CMD="virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"
++export QEMU_LOG="smoke.serial"
++export LOG_MSG="Domain-0"
++export PASSED="BusyBox"
+
+-set -e
+-(grep -q "Domain-0" smoke.serial && grep -q "BusyBox" smoke.serial) || exit 1
+-exit 0
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-dom0less-arm32.sh b/automation/scripts/qemu-smoke-dom0less-arm32.sh
+index c027c8c5c8..68ffbabdb8 100755
+--- a/automation/scripts/qemu-smoke-dom0less-arm32.sh
++++ b/automation/scripts/qemu-smoke-dom0less-arm32.sh
+@@ -5,7 +5,7 @@ set -ex
+ test_variant=$1
+
+ # Prompt to grep for to check if dom0 booted successfully
+-dom0_prompt="^/ #"
++dom0_prompt="/ #"
+
+ serial_log="$(pwd)/smoke.serial"
+
+@@ -131,9 +131,7 @@ bash imagebuilder/scripts/uboot-script-gen -t tftp -d . -c config
+ # Run the test
+ rm -f ${serial_log}
+ set +e
+-echo " virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"| \
+-timeout -k 1 240 \
+-./qemu-system-arm \
++export QEMU_CMD="./qemu-system-arm \
+ -machine virt \
+ -machine virtualization=true \
+ -smp 4 \
+@@ -144,9 +142,11 @@ timeout -k 1 240 \
+ -no-reboot \
+ -device virtio-net-pci,netdev=n0 \
+ -netdev user,id=n0,tftp=./ \
+- -bios /usr/lib/u-boot/qemu_arm/u-boot.bin |& \
+- tee ${serial_log} | sed 's/\r//'
++ -bios /usr/lib/u-boot/qemu_arm/u-boot.bin"
++
++export UBOOT_CMD="virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"
++export QEMU_LOG="${serial_log}"
++export LOG_MSG="${dom0_prompt}"
++export PASSED="${passed}"
+
+-set -e
+-(grep -q "${dom0_prompt}" ${serial_log} && grep -q "${passed}" ${serial_log}) || exit 1
+-exit 0
++../automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-dom0less-arm64.sh b/automation/scripts/qemu-smoke-dom0less-arm64.sh
+index 15258692d5..eb25c4af4b 100755
+--- a/automation/scripts/qemu-smoke-dom0less-arm64.sh
++++ b/automation/scripts/qemu-smoke-dom0less-arm64.sh
+@@ -205,9 +205,7 @@ bash imagebuilder/scripts/uboot-script-gen -t tftp -d binaries/ -c binaries/conf
+ # Run the test
+ rm -f smoke.serial
+ set +e
+-echo " virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"| \
+-timeout -k 1 240 \
+-./binaries/qemu-system-aarch64 \
++export QEMU_CMD="./binaries/qemu-system-aarch64 \
+ -machine virtualization=true \
+ -cpu cortex-a57 -machine type=virt,gic-version=$gic_version \
+ -m 2048 -monitor none -serial stdio \
+@@ -215,9 +213,11 @@ timeout -k 1 240 \
+ -no-reboot \
+ -device virtio-net-pci,netdev=n0 \
+ -netdev user,id=n0,tftp=binaries \
+- -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin |& \
+- tee smoke.serial | sed 's/\r//'
++ -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin"
++
++export UBOOT_CMD="virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"
++export QEMU_LOG="smoke.serial"
++export LOG_MSG="Welcome to Alpine Linux"
++export PASSED="${passed}"
+
+-set -e
+-(grep -q "^Welcome to Alpine Linux" smoke.serial && grep -q "${passed}" smoke.serial) || exit 1
+-exit 0
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-ppc64le.sh b/automation/scripts/qemu-smoke-ppc64le.sh
+index 9088881b73..ccb4a576f4 100755
+--- a/automation/scripts/qemu-smoke-ppc64le.sh
++++ b/automation/scripts/qemu-smoke-ppc64le.sh
+@@ -11,8 +11,7 @@ machine=$1
+ rm -f ${serial_log}
+ set +e
+
+-timeout -k 1 20 \
+-qemu-system-ppc64 \
++export QEMU_CMD="qemu-system-ppc64 \
+ -bios skiboot.lid \
+ -M $machine \
+ -m 2g \
+@@ -21,9 +20,9 @@ qemu-system-ppc64 \
+ -monitor none \
+ -nographic \
+ -serial stdio \
+- -kernel binaries/xen \
+- |& tee ${serial_log} | sed 's/\r//'
++ -kernel binaries/xen"
+
+-set -e
+-(grep -q "Hello, ppc64le!" ${serial_log}) || exit 1
+-exit 0
++export QEMU_LOG="${serial_log}"
++export PASSED="Hello, ppc64le!"
++
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-riscv64.sh b/automation/scripts/qemu-smoke-riscv64.sh
+index f90df3c051..0355c075b7 100755
+--- a/automation/scripts/qemu-smoke-riscv64.sh
++++ b/automation/scripts/qemu-smoke-riscv64.sh
+@@ -6,15 +6,14 @@ set -ex
+ rm -f smoke.serial
+ set +e
+
+-timeout -k 1 2 \
+-qemu-system-riscv64 \
++export QEMU_CMD="qemu-system-riscv64 \
+ -M virt \
+ -smp 1 \
+ -nographic \
+ -m 2g \
+- -kernel binaries/xen \
+- |& tee smoke.serial | sed 's/\r//'
++ -kernel binaries/xen"
+
+-set -e
+-(grep -q "All set up" smoke.serial) || exit 1
+-exit 0
++export QEMU_LOG="smoke.serial"
++export PASSED="All set up"
++
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-smoke-x86-64.sh b/automation/scripts/qemu-smoke-x86-64.sh
+index 3014d07314..37ac10e068 100755
+--- a/automation/scripts/qemu-smoke-x86-64.sh
++++ b/automation/scripts/qemu-smoke-x86-64.sh
+@@ -16,11 +16,12 @@ esac
+
+ rm -f smoke.serial
+ set +e
+-timeout -k 1 30 \
+-qemu-system-x86_64 -nographic -kernel binaries/xen \
++export QEMU_CMD="qemu-system-x86_64 -nographic -kernel binaries/xen \
+ -initrd xtf/tests/example/$k \
+- -append "loglvl=all console=com1 noreboot console_timestamps=boot $extra" \
+- -m 512 -monitor none -serial file:smoke.serial
+-set -e
+-grep -q 'Test result: SUCCESS' smoke.serial || exit 1
+-exit 0
++ -append \"loglvl=all console=com1 noreboot console_timestamps=boot $extra\" \
++ -m 512 -monitor none -serial stdio"
++
++export QEMU_LOG="smoke.serial"
++export PASSED="Test result: SUCCESS"
++
++./automation/scripts/qemu-key.exp
+diff --git a/automation/scripts/qemu-xtf-dom0less-arm64.sh b/automation/scripts/qemu-xtf-dom0less-arm64.sh
+index b08c2d44fb..0666f6363e 100755
+--- a/automation/scripts/qemu-xtf-dom0less-arm64.sh
++++ b/automation/scripts/qemu-xtf-dom0less-arm64.sh
+@@ -51,9 +51,7 @@ bash imagebuilder/scripts/uboot-script-gen -t tftp -d binaries/ -c binaries/conf
+ # Run the test
+ rm -f smoke.serial
+ set +e
+-echo " virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"| \
+-timeout -k 1 120 \
+-./binaries/qemu-system-aarch64 \
++export QEMU_CMD="./binaries/qemu-system-aarch64 \
+ -machine virtualization=true \
+ -cpu cortex-a57 -machine type=virt \
+ -m 2048 -monitor none -serial stdio \
+@@ -61,9 +59,10 @@ timeout -k 1 120 \
+ -no-reboot \
+ -device virtio-net-pci,netdev=n0 \
+ -netdev user,id=n0,tftp=binaries \
+- -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin |& \
+- tee smoke.serial | sed 's/\r//'
++ -bios /usr/lib/u-boot/qemu_arm64/u-boot.bin"
++
++export UBOOT_CMD="virtio scan; dhcp; tftpb 0x40000000 boot.scr; source 0x40000000"
++export QEMU_LOG="smoke.serial"
++export PASSED="${passed}"
+
+-set -e
+-(grep -q "${passed}" smoke.serial) || exit 1
+-exit 0
++./automation/scripts/qemu-key.exp
+--
+2.46.1
+
diff --git a/0014-libxl-Fix-handling-XenStore-errors-in-device-creatio.patch b/0014-libxl-Fix-handling-XenStore-errors-in-device-creatio.patch
deleted file mode 100644
index ac28521..0000000
--- a/0014-libxl-Fix-handling-XenStore-errors-in-device-creatio.patch
+++ /dev/null
@@ -1,191 +0,0 @@
-From 8271f0e8f23b63199caf0edcfe85ebc1c1412d1b Mon Sep 17 00:00:00 2001
-From: Demi Marie Obenour <demi@invisiblethingslab.com>
-Date: Tue, 21 May 2024 10:23:52 +0200
-Subject: [PATCH 14/56] libxl: Fix handling XenStore errors in device creation
-
-If xenstored runs out of memory it is possible for it to fail operations
-that should succeed. libxl wasn't robust against this, and could fail
-to ensure that the TTY path of a non-initial console was created and
-read-only for guests. This doesn't qualify for an XSA because guests
-should not be able to run xenstored out of memory, but it still needs to
-be fixed.
-
-Add the missing error checks to ensure that all errors are properly
-handled and that at no point can a guest make the TTY path of its
-frontend directory writable.
-
-Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-master commit: 531d3bea5e9357357eaf6d40f5784a1b4c29b910
-master date: 2024-05-11 00:13:43 +0100
----
- tools/libs/light/libxl_console.c | 11 ++---
- tools/libs/light/libxl_device.c | 72 ++++++++++++++++++++------------
- tools/libs/light/libxl_xshelp.c | 13 ++++--
- 3 files changed, 60 insertions(+), 36 deletions(-)
-
-diff --git a/tools/libs/light/libxl_console.c b/tools/libs/light/libxl_console.c
-index cd7412a327..a563c9d3c7 100644
---- a/tools/libs/light/libxl_console.c
-+++ b/tools/libs/light/libxl_console.c
-@@ -351,11 +351,10 @@ int libxl__device_console_add(libxl__gc *gc, uint32_t domid,
- flexarray_append(front, "protocol");
- flexarray_append(front, LIBXL_XENCONSOLE_PROTOCOL);
- }
-- libxl__device_generic_add(gc, XBT_NULL, device,
-- libxl__xs_kvs_of_flexarray(gc, back),
-- libxl__xs_kvs_of_flexarray(gc, front),
-- libxl__xs_kvs_of_flexarray(gc, ro_front));
-- rc = 0;
-+ rc = libxl__device_generic_add(gc, XBT_NULL, device,
-+ libxl__xs_kvs_of_flexarray(gc, back),
-+ libxl__xs_kvs_of_flexarray(gc, front),
-+ libxl__xs_kvs_of_flexarray(gc, ro_front));
- out:
- return rc;
- }
-@@ -665,6 +664,8 @@ int libxl_device_channel_getinfo(libxl_ctx *ctx, uint32_t domid,
- */
- if (!val) val = "/NO-SUCH-PATH";
- channelinfo->u.pty.path = strdup(val);
-+ if (channelinfo->u.pty.path == NULL)
-+ abort();
- break;
- default:
- break;
-diff --git a/tools/libs/light/libxl_device.c b/tools/libs/light/libxl_device.c
-index 13da6e0573..3035501f2c 100644
---- a/tools/libs/light/libxl_device.c
-+++ b/tools/libs/light/libxl_device.c
-@@ -177,8 +177,13 @@ int libxl__device_generic_add(libxl__gc *gc, xs_transaction_t t,
- ro_frontend_perms[1].perms = backend_perms[1].perms = XS_PERM_READ;
-
- retry_transaction:
-- if (create_transaction)
-+ if (create_transaction) {
- t = xs_transaction_start(ctx->xsh);
-+ if (t == XBT_NULL) {
-+ LOGED(ERROR, device->domid, "xs_transaction_start failed");
-+ return ERROR_FAIL;
-+ }
-+ }
-
- /* FIXME: read frontend_path and check state before removing stuff */
-
-@@ -195,42 +200,55 @@ retry_transaction:
- if (rc) goto out;
- }
-
-- /* xxx much of this function lacks error checks! */
--
- if (fents || ro_fents) {
-- xs_rm(ctx->xsh, t, frontend_path);
-- xs_mkdir(ctx->xsh, t, frontend_path);
-+ if (!xs_rm(ctx->xsh, t, frontend_path) && errno != ENOENT)
-+ goto out;
-+ if (!xs_mkdir(ctx->xsh, t, frontend_path))
-+ goto out;
- /* Console 0 is a special case. It doesn't use the regular PV
- * state machine but also the frontend directory has
- * historically contained other information, such as the
- * vnc-port, which we don't want the guest fiddling with.
- */
- if ((device->kind == LIBXL__DEVICE_KIND_CONSOLE && device->devid == 0) ||
-- (device->kind == LIBXL__DEVICE_KIND_VUART))
-- xs_set_permissions(ctx->xsh, t, frontend_path,
-- ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms));
-- else
-- xs_set_permissions(ctx->xsh, t, frontend_path,
-- frontend_perms, ARRAY_SIZE(frontend_perms));
-- xs_write(ctx->xsh, t, GCSPRINTF("%s/backend", frontend_path),
-- backend_path, strlen(backend_path));
-- if (fents)
-- libxl__xs_writev_perms(gc, t, frontend_path, fents,
-- frontend_perms, ARRAY_SIZE(frontend_perms));
-- if (ro_fents)
-- libxl__xs_writev_perms(gc, t, frontend_path, ro_fents,
-- ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms));
-+ (device->kind == LIBXL__DEVICE_KIND_VUART)) {
-+ if (!xs_set_permissions(ctx->xsh, t, frontend_path,
-+ ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms)))
-+ goto out;
-+ } else {
-+ if (!xs_set_permissions(ctx->xsh, t, frontend_path,
-+ frontend_perms, ARRAY_SIZE(frontend_perms)))
-+ goto out;
-+ }
-+ if (!xs_write(ctx->xsh, t, GCSPRINTF("%s/backend", frontend_path),
-+ backend_path, strlen(backend_path)))
-+ goto out;
-+ if (fents) {
-+ rc = libxl__xs_writev_perms(gc, t, frontend_path, fents,
-+ frontend_perms, ARRAY_SIZE(frontend_perms));
-+ if (rc) goto out;
-+ }
-+ if (ro_fents) {
-+ rc = libxl__xs_writev_perms(gc, t, frontend_path, ro_fents,
-+ ro_frontend_perms, ARRAY_SIZE(ro_frontend_perms));
-+ if (rc) goto out;
-+ }
- }
-
- if (bents) {
- if (!libxl_only) {
-- xs_rm(ctx->xsh, t, backend_path);
-- xs_mkdir(ctx->xsh, t, backend_path);
-- xs_set_permissions(ctx->xsh, t, backend_path, backend_perms,
-- ARRAY_SIZE(backend_perms));
-- xs_write(ctx->xsh, t, GCSPRINTF("%s/frontend", backend_path),
-- frontend_path, strlen(frontend_path));
-- libxl__xs_writev(gc, t, backend_path, bents);
-+ if (!xs_rm(ctx->xsh, t, backend_path) && errno != ENOENT)
-+ goto out;
-+ if (!xs_mkdir(ctx->xsh, t, backend_path))
-+ goto out;
-+ if (!xs_set_permissions(ctx->xsh, t, backend_path, backend_perms,
-+ ARRAY_SIZE(backend_perms)))
-+ goto out;
-+ if (!xs_write(ctx->xsh, t, GCSPRINTF("%s/frontend", backend_path),
-+ frontend_path, strlen(frontend_path)))
-+ goto out;
-+ rc = libxl__xs_writev(gc, t, backend_path, bents);
-+ if (rc) goto out;
- }
-
- /*
-@@ -276,7 +294,7 @@ retry_transaction:
- out:
- if (create_transaction && t)
- libxl__xs_transaction_abort(gc, &t);
-- return rc;
-+ return rc != 0 ? rc : ERROR_FAIL;
- }
-
- typedef struct {
-diff --git a/tools/libs/light/libxl_xshelp.c b/tools/libs/light/libxl_xshelp.c
-index 751cd942d9..a6e34ab10f 100644
---- a/tools/libs/light/libxl_xshelp.c
-+++ b/tools/libs/light/libxl_xshelp.c
-@@ -60,10 +60,15 @@ int libxl__xs_writev_perms(libxl__gc *gc, xs_transaction_t t,
- for (i = 0; kvs[i] != NULL; i += 2) {
- path = GCSPRINTF("%s/%s", dir, kvs[i]);
- if (path && kvs[i + 1]) {
-- int length = strlen(kvs[i + 1]);
-- xs_write(ctx->xsh, t, path, kvs[i + 1], length);
-- if (perms)
-- xs_set_permissions(ctx->xsh, t, path, perms, num_perms);
-+ size_t length = strlen(kvs[i + 1]);
-+ if (length > UINT_MAX)
-+ return ERROR_FAIL;
-+ if (!xs_write(ctx->xsh, t, path, kvs[i + 1], length))
-+ return ERROR_FAIL;
-+ if (perms) {
-+ if (!xs_set_permissions(ctx->xsh, t, path, perms, num_perms))
-+ return ERROR_FAIL;
-+ }
- }
- }
- return 0;
---
-2.45.2
-
diff --git a/0015-x86-vLAPIC-prevent-undue-recursion-of-vlapic_error.patch b/0015-x86-vLAPIC-prevent-undue-recursion-of-vlapic_error.patch
new file mode 100644
index 0000000..ce66fe7
--- /dev/null
+++ b/0015-x86-vLAPIC-prevent-undue-recursion-of-vlapic_error.patch
@@ -0,0 +1,57 @@
+From 9358a7fad7f0427e7d1666da0c78cef341ee9072 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:27:03 +0200
+Subject: [PATCH 15/35] x86/vLAPIC: prevent undue recursion of vlapic_error()
+
+With the error vector set to an illegal value, the function invoking
+vlapic_set_irq() would bring execution back here, with the non-recursive
+lock already held. Avoid the call in this case, merely further updating
+ESR (if necessary).
+
+This is XSA-462 / CVE-2024-45817.
+
+Fixes: 5f32d186a8b1 ("x86/vlapic: don't silently accept bad vectors")
+Reported-by: Federico Serafini <federico.serafini@bugseng.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: c42d9ec61f6d11e25fa77bd44dd11dad1edda268
+master date: 2024-09-24 14:23:29 +0200
+---
+ xen/arch/x86/hvm/vlapic.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c
+index 9cfc82666a..46ff758904 100644
+--- a/xen/arch/x86/hvm/vlapic.c
++++ b/xen/arch/x86/hvm/vlapic.c
+@@ -112,9 +112,24 @@ static void vlapic_error(struct vlapic *vlapic, unsigned int errmask)
+ if ( (esr & errmask) != errmask )
+ {
+ uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR);
++ bool inj = false;
+
+- vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
+ if ( !(lvterr & APIC_LVT_MASKED) )
++ {
++ /*
++ * If LVTERR is unmasked and has an illegal vector, vlapic_set_irq()
++ * will end up back here. Break the cycle by only injecting LVTERR
++ * if it will succeed, and folding in RECVILL otherwise.
++ */
++ if ( (lvterr & APIC_VECTOR_MASK) >= 16 )
++ inj = true;
++ else
++ errmask |= APIC_ESR_RECVILL;
++ }
++
++ vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
++
++ if ( inj )
+ vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0);
+ }
+ spin_unlock_irqrestore(&vlapic->esr_lock, flags);
+--
+2.46.1
+
diff --git a/0015-xen-sched-set-all-sched_resource-data-inside-locked-.patch b/0015-xen-sched-set-all-sched_resource-data-inside-locked-.patch
deleted file mode 100644
index a8090d4..0000000
--- a/0015-xen-sched-set-all-sched_resource-data-inside-locked-.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 3999b675cad5b717274d6493899b0eea8896f4d7 Mon Sep 17 00:00:00 2001
-From: Juergen Gross <jgross@suse.com>
-Date: Tue, 21 May 2024 10:24:26 +0200
-Subject: [PATCH 15/56] xen/sched: set all sched_resource data inside locked
- region for new cpu
-
-When adding a cpu to a scheduler, set all data items of struct
-sched_resource inside the locked region, as otherwise a race might
-happen (e.g. when trying to access the cpupool of the cpu):
-
- (XEN) ----[ Xen-4.19.0-1-d x86_64 debug=y Tainted: H ]----
- (XEN) CPU: 45
- (XEN) RIP: e008:[<ffff82d040244cbf>] common/sched/credit.c#csched_load_balance+0x41/0x877
- (XEN) RFLAGS: 0000000000010092 CONTEXT: hypervisor
- (XEN) rax: ffff82d040981618 rbx: ffff82d040981618 rcx: 0000000000000000
- (XEN) rdx: 0000003ff68cd000 rsi: 000000000000002d rdi: ffff83103723d450
- (XEN) rbp: ffff83207caa7d48 rsp: ffff83207caa7b98 r8: 0000000000000000
- (XEN) r9: ffff831037253cf0 r10: ffff83103767c3f0 r11: 0000000000000009
- (XEN) r12: ffff831037237990 r13: ffff831037237990 r14: ffff831037253720
- (XEN) r15: 0000000000000000 cr0: 000000008005003b cr4: 0000000000f526e0
- (XEN) cr3: 000000005bc2f000 cr2: 0000000000000010
- (XEN) fsb: 0000000000000000 gsb: 0000000000000000 gss: 0000000000000000
- (XEN) ds: 0000 es: 0000 fs: 0000 gs: 0000 ss: 0000 cs: e008
- (XEN) Xen code around <ffff82d040244cbf> (common/sched/credit.c#csched_load_balance+0x41/0x877):
- (XEN) 48 8b 0c 10 48 8b 49 08 <48> 8b 79 10 48 89 bd b8 fe ff ff 49 8b 4e 28 48
- <snip>
- (XEN) Xen call trace:
- (XEN) [<ffff82d040244cbf>] R common/sched/credit.c#csched_load_balance+0x41/0x877
- (XEN) [<ffff82d040245a18>] F common/sched/credit.c#csched_schedule+0x36a/0x69f
- (XEN) [<ffff82d040252644>] F common/sched/core.c#do_schedule+0xe8/0x433
- (XEN) [<ffff82d0402572dd>] F common/sched/core.c#schedule+0x2e5/0x2f9
- (XEN) [<ffff82d040232f35>] F common/softirq.c#__do_softirq+0x94/0xbe
- (XEN) [<ffff82d040232fc8>] F do_softirq+0x13/0x15
- (XEN) [<ffff82d0403075ef>] F arch/x86/domain.c#idle_loop+0x92/0xe6
- (XEN)
- (XEN) Pagetable walk from 0000000000000010:
- (XEN) L4[0x000] = 000000103ff61063 ffffffffffffffff
- (XEN) L3[0x000] = 000000103ff60063 ffffffffffffffff
- (XEN) L2[0x000] = 0000001033dff063 ffffffffffffffff
- (XEN) L1[0x000] = 0000000000000000 ffffffffffffffff
- (XEN)
- (XEN) ****************************************
- (XEN) Panic on CPU 45:
- (XEN) FATAL PAGE FAULT
- (XEN) [error_code=0000]
- (XEN) Faulting linear address: 0000000000000010
- (XEN) ****************************************
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Fixes: a8c6c623192e ("sched: clarify use cases of schedule_cpu_switch()")
-Signed-off-by: Juergen Gross <jgross@suse.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: d104a07524ffc92ae7a70dfe192c291de2a563cc
-master date: 2024-05-15 19:59:52 +0100
----
- xen/common/sched/core.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
-index 34ad39b9ad..3c2403ebcf 100644
---- a/xen/common/sched/core.c
-+++ b/xen/common/sched/core.c
-@@ -3179,6 +3179,8 @@ int schedule_cpu_add(unsigned int cpu, struct cpupool *c)
-
- sr->scheduler = new_ops;
- sr->sched_priv = ppriv;
-+ sr->granularity = cpupool_get_granularity(c);
-+ sr->cpupool = c;
-
- /*
- * Reroute the lock to the per pCPU lock as /last/ thing. In fact,
-@@ -3191,8 +3193,6 @@ int schedule_cpu_add(unsigned int cpu, struct cpupool *c)
- /* _Not_ pcpu_schedule_unlock(): schedule_lock has changed! */
- spin_unlock_irqrestore(old_lock, flags);
-
-- sr->granularity = cpupool_get_granularity(c);
-- sr->cpupool = c;
- /* The cpu is added to a pool, trigger it to go pick up some work */
- cpu_raise_softirq(cpu, SCHEDULE_SOFTIRQ);
-
---
-2.45.2
-
diff --git a/0016-Arm-correct-FIXADDR_TOP.patch b/0016-Arm-correct-FIXADDR_TOP.patch
new file mode 100644
index 0000000..244e873
--- /dev/null
+++ b/0016-Arm-correct-FIXADDR_TOP.patch
@@ -0,0 +1,58 @@
+From 46a2ce35212c9b35c4818ca9eec918aa4a45cb48 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:28:22 +0200
+Subject: [PATCH 16/35] Arm: correct FIXADDR_TOP
+
+While reviewing a RISC-V patch cloning the Arm code, I noticed an
+off-by-1 here: FIX_PMAP_{BEGIN,END} being an inclusive range and
+FIX_LAST being the same as FIX_PMAP_END, FIXADDR_TOP cannot derive from
+FIX_LAST alone, or else the BUG_ON() in virt_to_fix() would trigger if
+FIX_PMAP_END ended up being used.
+
+While touching this area also add a check for fixmap and boot FDT area
+to not only not overlap, but to have at least one (unmapped) page in
+between.
+
+Fixes: 4f17357b52f6 ("xen/arm: add Persistent Map (PMAP) infrastructure")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Michal Orzel <michal.orzel@amd.com>
+master commit: fe3412ab83cc53c2bf2c497be3794bc09751efa5
+master date: 2024-08-13 21:50:55 +0100
+---
+ xen/arch/arm/include/asm/fixmap.h | 2 +-
+ xen/arch/arm/mmu/setup.c | 6 ++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/xen/arch/arm/include/asm/fixmap.h b/xen/arch/arm/include/asm/fixmap.h
+index a823456ecb..0cb5d54d1c 100644
+--- a/xen/arch/arm/include/asm/fixmap.h
++++ b/xen/arch/arm/include/asm/fixmap.h
+@@ -18,7 +18,7 @@
+ #define FIX_LAST FIX_PMAP_END
+
+ #define FIXADDR_START FIXMAP_ADDR(0)
+-#define FIXADDR_TOP FIXMAP_ADDR(FIX_LAST)
++#define FIXADDR_TOP FIXMAP_ADDR(FIX_LAST + 1)
+
+ #ifndef __ASSEMBLY__
+
+diff --git a/xen/arch/arm/mmu/setup.c b/xen/arch/arm/mmu/setup.c
+index f4bb424c3c..57042ed57b 100644
+--- a/xen/arch/arm/mmu/setup.c
++++ b/xen/arch/arm/mmu/setup.c
+@@ -128,6 +128,12 @@ static void __init __maybe_unused build_assertions(void)
+
+ #undef CHECK_SAME_SLOT
+ #undef CHECK_DIFFERENT_SLOT
++
++ /*
++ * Fixmaps must not overlap with boot FDT mapping area. Make sure there's
++ * at least one guard page in between.
++ */
++ BUILD_BUG_ON(FIXADDR_TOP >= BOOT_FDT_VIRT_START);
+ }
+
+ lpae_t __init pte_of_xenaddr(vaddr_t va)
+--
+2.46.1
+
diff --git a/0016-x86-respect-mapcache_domain_init-failing.patch b/0016-x86-respect-mapcache_domain_init-failing.patch
deleted file mode 100644
index db7ddfe..0000000
--- a/0016-x86-respect-mapcache_domain_init-failing.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From dfabab2cd9461ef9d21a708461f35d2ae4b55220 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Tue, 21 May 2024 10:25:08 +0200
-Subject: [PATCH 16/56] x86: respect mapcache_domain_init() failing
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The function itself properly handles and hands onwards failure from
-create_perdomain_mapping(). Therefore its caller should respect possible
-failure, too.
-
-Fixes: 4b28bf6ae90b ("x86: re-introduce map_domain_page() et al")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 7270fdc7a0028d4b7b26fd1b36c6b9e97abcf3da
-master date: 2024-05-15 19:59:52 +0100
----
- xen/arch/x86/domain.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
-index 307446273a..5feb0d0679 100644
---- a/xen/arch/x86/domain.c
-+++ b/xen/arch/x86/domain.c
-@@ -850,7 +850,8 @@ int arch_domain_create(struct domain *d,
- }
- else if ( is_pv_domain(d) )
- {
-- mapcache_domain_init(d);
-+ if ( (rc = mapcache_domain_init(d)) != 0 )
-+ goto fail;
-
- if ( (rc = pv_domain_initialise(d)) != 0 )
- goto fail;
---
-2.45.2
-
diff --git a/0017-tools-xentop-Fix-cpu-sort-order.patch b/0017-tools-xentop-Fix-cpu-sort-order.patch
deleted file mode 100644
index de19ddc..0000000
--- a/0017-tools-xentop-Fix-cpu-sort-order.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From f3d20dd31770a70971f4f85521eec1e741d38695 Mon Sep 17 00:00:00 2001
-From: Leigh Brown <leigh@solinno.co.uk>
-Date: Tue, 21 May 2024 10:25:30 +0200
-Subject: [PATCH 17/56] tools/xentop: Fix cpu% sort order
-
-In compare_cpu_pct(), there is a double -> unsigned long long converion when
-calling compare(). In C, this discards the fractional part, resulting in an
-out-of order sorting such as:
-
- NAME STATE CPU(sec) CPU(%)
- xendd --b--- 4020 5.7
- icecream --b--- 2600 3.8
- Domain-0 -----r 1060 1.5
- neon --b--- 827 1.1
- cheese --b--- 225 0.7
- pizza --b--- 359 0.5
- cassini --b--- 490 0.4
- fusilli --b--- 159 0.2
- bob --b--- 502 0.2
- blender --b--- 121 0.2
- bread --b--- 69 0.1
- chickpea --b--- 67 0.1
- lentil --b--- 67 0.1
-
-Introduce compare_dbl() function and update compare_cpu_pct() to call it.
-
-Fixes: 49839b535b78 ("Add xenstat framework.")
-Signed-off-by: Leigh Brown <leigh@solinno.co.uk>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: e27fc7d15eab79e604e8b8728778594accc23cf1
-master date: 2024-05-15 19:59:52 +0100
----
- tools/xentop/xentop.c | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/tools/xentop/xentop.c b/tools/xentop/xentop.c
-index 545bd5e96d..c2a311befe 100644
---- a/tools/xentop/xentop.c
-+++ b/tools/xentop/xentop.c
-@@ -85,6 +85,7 @@ static void set_delay(const char *value);
- static void set_prompt(const char *new_prompt, void (*func)(const char *));
- static int handle_key(int);
- static int compare(unsigned long long, unsigned long long);
-+static int compare_dbl(double, double);
- static int compare_domains(xenstat_domain **, xenstat_domain **);
- static unsigned long long tot_net_bytes( xenstat_domain *, int);
- static bool tot_vbd_reqs(xenstat_domain *, int, unsigned long long *);
-@@ -422,6 +423,16 @@ static int compare(unsigned long long i1, unsigned long long i2)
- return 0;
- }
-
-+/* Compares two double precision numbers, returning -1,0,1 for <,=,> */
-+static int compare_dbl(double d1, double d2)
-+{
-+ if (d1 < d2)
-+ return -1;
-+ if (d1 > d2)
-+ return 1;
-+ return 0;
-+}
-+
- /* Comparison function for use with qsort. Compares two domains using the
- * current sort field. */
- static int compare_domains(xenstat_domain **domain1, xenstat_domain **domain2)
-@@ -523,7 +534,7 @@ static double get_cpu_pct(xenstat_domain *domain)
-
- static int compare_cpu_pct(xenstat_domain *domain1, xenstat_domain *domain2)
- {
-- return -compare(get_cpu_pct(domain1), get_cpu_pct(domain2));
-+ return -compare_dbl(get_cpu_pct(domain1), get_cpu_pct(domain2));
- }
-
- /* Prints cpu percentage statistic */
---
-2.45.2
-
diff --git a/0017-xl-fix-incorrect-output-in-help-command.patch b/0017-xl-fix-incorrect-output-in-help-command.patch
new file mode 100644
index 0000000..f2ab58a
--- /dev/null
+++ b/0017-xl-fix-incorrect-output-in-help-command.patch
@@ -0,0 +1,36 @@
+From e12998a9db8d0ac14477557d09b437783a999ea4 Mon Sep 17 00:00:00 2001
+From: "John E. Krokes" <mag@netherworld.org>
+Date: Tue, 24 Sep 2024 14:29:26 +0200
+Subject: [PATCH 17/35] xl: fix incorrect output in "help" command
+
+In "xl help", the output includes this line:
+
+ vsnd-list List virtual display devices for a domain
+
+This should obviously say "sound devices" instead of "display devices".
+
+Signed-off-by: John E. Krokes <mag@netherworld.org>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Acked-by: Anthony PERARD <anthony.perard@vates.tech>
+master commit: 09226d165b57d919150458044c5b594d3d1dc23a
+master date: 2024-08-14 08:49:44 +0200
+---
+ tools/xl/xl_cmdtable.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/xl/xl_cmdtable.c b/tools/xl/xl_cmdtable.c
+index 42751228c1..53fc22d344 100644
+--- a/tools/xl/xl_cmdtable.c
++++ b/tools/xl/xl_cmdtable.c
+@@ -433,7 +433,7 @@ const struct cmd_spec cmd_table[] = {
+ },
+ { "vsnd-list",
+ &main_vsndlist, 0, 0,
+- "List virtual display devices for a domain",
++ "List virtual sound devices for a domain",
+ "<Domain(s)>",
+ },
+ { "vsnd-detach",
+--
+2.46.1
+
diff --git a/0018-x86-mtrr-avoid-system-wide-rendezvous-when-setting-A.patch b/0018-x86-mtrr-avoid-system-wide-rendezvous-when-setting-A.patch
deleted file mode 100644
index a57775d..0000000
--- a/0018-x86-mtrr-avoid-system-wide-rendezvous-when-setting-A.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 7cdb1fa2ab0b5e11f66cada0370770404153c824 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Tue, 21 May 2024 10:25:39 +0200
-Subject: [PATCH 18/56] x86/mtrr: avoid system wide rendezvous when setting AP
- MTRRs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There's no point in forcing a system wide update of the MTRRs on all processors
-when there are no changes to be propagated. On AP startup it's only the AP
-that needs to write the system wide MTRR values in order to match the rest of
-the already online CPUs.
-
-We have occasionally seen the watchdog trigger during `xen-hptool cpu-online`
-in one Intel Cascade Lake box with 448 CPUs due to the re-setting of the MTRRs
-on all the CPUs in the system.
-
-While there adjust the comment to clarify why the system-wide resetting of the
-MTRR registers is not needed for the purposes of mtrr_ap_init().
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Release-acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: abd00b037da5ffa4e8c4508a5df0cd6eabb805a4
-master date: 2024-05-15 19:59:52 +0100
----
- xen/arch/x86/cpu/mtrr/main.c | 15 ++++++++-------
- 1 file changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/xen/arch/x86/cpu/mtrr/main.c b/xen/arch/x86/cpu/mtrr/main.c
-index 90b235f57e..0a44ebbcb0 100644
---- a/xen/arch/x86/cpu/mtrr/main.c
-+++ b/xen/arch/x86/cpu/mtrr/main.c
-@@ -573,14 +573,15 @@ void mtrr_ap_init(void)
- if (!mtrr_if || hold_mtrr_updates_on_aps)
- return;
- /*
-- * Ideally we should hold mtrr_mutex here to avoid mtrr entries changed,
-- * but this routine will be called in cpu boot time, holding the lock
-- * breaks it. This routine is called in two cases: 1.very earily time
-- * of software resume, when there absolutely isn't mtrr entry changes;
-- * 2.cpu hotadd time. We let mtrr_add/del_page hold cpuhotplug lock to
-- * prevent mtrr entry changes
-+ * hold_mtrr_updates_on_aps takes care of preventing unnecessary MTRR
-+ * updates when batch starting the CPUs (see
-+ * mtrr_aps_sync_{begin,end}()).
-+ *
-+ * Otherwise just apply the current system wide MTRR values to this AP.
-+ * Note this doesn't require synchronization with the other CPUs, as
-+ * there are strictly no modifications of the current MTRR values.
- */
-- set_mtrr(~0U, 0, 0, 0);
-+ mtrr_set_all();
- }
-
- /**
---
-2.45.2
-
diff --git a/0018-x86emul-correct-UD-check-for-AVX512-FP16-complex-mul.patch b/0018-x86emul-correct-UD-check-for-AVX512-FP16-complex-mul.patch
new file mode 100644
index 0000000..cdbc59e
--- /dev/null
+++ b/0018-x86emul-correct-UD-check-for-AVX512-FP16-complex-mul.patch
@@ -0,0 +1,37 @@
+From e2f29f7bad59c4be53363c8c0d2933982a22d0de Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:30:04 +0200
+Subject: [PATCH 18/35] x86emul: correct #UD check for AVX512-FP16 complex
+ multiplications
+
+avx512_vlen_check()'s argument was inverted, while the surrounding
+conditional wrongly forced the EVEX.L'L check for the scalar forms when
+embedded rounding was in effect.
+
+Fixes: d14c52cba0f5 ("x86emul: handle AVX512-FP16 complex multiplication insns")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: a30d438ce58b70c5955f5d37f776086ab8f88623
+master date: 2024-08-19 15:32:31 +0200
+---
+ xen/arch/x86/x86_emulate/x86_emulate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
+index 2d5c1de8ec..16557385bf 100644
+--- a/xen/arch/x86/x86_emulate/x86_emulate.c
++++ b/xen/arch/x86/x86_emulate/x86_emulate.c
+@@ -7984,8 +7984,8 @@ x86_emulate(
+ generate_exception_if(modrm_reg == src1 ||
+ (ea.type != OP_MEM && modrm_reg == modrm_rm),
+ X86_EXC_UD);
+- if ( ea.type != OP_REG || (b & 1) || !evex.brs )
+- avx512_vlen_check(!(b & 1));
++ if ( ea.type != OP_REG || !evex.brs )
++ avx512_vlen_check(b & 1);
+ goto simd_zmm;
+ }
+
+--
+2.46.1
+
diff --git a/0019-update-Xen-version-to-4.18.3-pre.patch b/0019-update-Xen-version-to-4.18.3-pre.patch
deleted file mode 100644
index 34f2b33..0000000
--- a/0019-update-Xen-version-to-4.18.3-pre.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 01f7a3c792241d348a4e454a30afdf6c0d6cd71c Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Tue, 21 May 2024 11:52:11 +0200
-Subject: [PATCH 19/56] update Xen version to 4.18.3-pre
-
----
- xen/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xen/Makefile b/xen/Makefile
-index 657f6fa4e3..786ab61600 100644
---- a/xen/Makefile
-+++ b/xen/Makefile
-@@ -6,7 +6,7 @@ this-makefile := $(call lastword,$(MAKEFILE_LIST))
- # All other places this is stored (eg. compile.h) should be autogenerated.
- export XEN_VERSION = 4
- export XEN_SUBVERSION = 18
--export XEN_EXTRAVERSION ?= .2$(XEN_VENDORVERSION)
-+export XEN_EXTRAVERSION ?= .3-pre$(XEN_VENDORVERSION)
- export XEN_FULLVERSION = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION)
- -include xen-version
-
---
-2.45.2
-
diff --git a/0019-x86-pv-Introduce-x86_merge_dr6-and-fix-do_debug.patch b/0019-x86-pv-Introduce-x86_merge_dr6-and-fix-do_debug.patch
new file mode 100644
index 0000000..87690da
--- /dev/null
+++ b/0019-x86-pv-Introduce-x86_merge_dr6-and-fix-do_debug.patch
@@ -0,0 +1,140 @@
+From de924e4dbac80ac7d94a2e86c37eecccaa1bc677 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Tue, 24 Sep 2024 14:30:49 +0200
+Subject: [PATCH 19/35] x86/pv: Introduce x86_merge_dr6() and fix do_debug()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Pretty much everywhere in Xen the logic to update %dr6 when injecting #DB is
+buggy. Introduce a new x86_merge_dr6() helper, and start fixing the mess by
+adjusting the dr6 merge in do_debug(). Also correct the comment.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 54ef601a66e8d812a6a6a308f02524e81201825e
+master date: 2024-08-21 23:59:19 +0100
+---
+ xen/arch/x86/debug.c | 40 ++++++++++++++++++++++++++++
+ xen/arch/x86/include/asm/debugreg.h | 7 +++++
+ xen/arch/x86/include/asm/x86-defns.h | 7 +++++
+ xen/arch/x86/traps.c | 11 +++++---
+ 4 files changed, 62 insertions(+), 3 deletions(-)
+
+diff --git a/xen/arch/x86/debug.c b/xen/arch/x86/debug.c
+index 127fe83021..b10f1f12b6 100644
+--- a/xen/arch/x86/debug.c
++++ b/xen/arch/x86/debug.c
+@@ -2,12 +2,52 @@
+ /*
+ * Copyright (C) 2023 XenServer.
+ */
++#include <xen/bug.h>
+ #include <xen/kernel.h>
+
+ #include <xen/lib/x86/cpu-policy.h>
+
+ #include <asm/debugreg.h>
+
++/*
++ * Merge new bits into dr6. 'new' is always given in positive polarity,
++ * matching the Intel VMCS PENDING_DBG semantics.
++ *
++ * At the time of writing (August 2024), on the subject of %dr6 updates the
++ * manuals are either vague (Intel "certain exceptions may clear bits 0-3"),
++ * or disputed (AMD makes statements which don't match observed behaviour).
++ *
++ * The only debug exception I can find which doesn't clear the breakpoint bits
++ * is ICEBP(/INT1) on AMD systems. This is also the one source of #DB that
++ * doesn't have an explicit status bit, meaning we can't easily identify this
++ * case either (AMD systems don't virtualise PENDING_DBG and only provide a
++ * post-merge %dr6 value).
++ *
++ * Treat %dr6 merging as unconditionally writing the breakpoint bits.
++ *
++ * We can't really manage any better, and guest kernels handling #DB as
++ * instructed by the SDM/APM (i.e. reading %dr6 then resetting it back to
++ * default) wont notice.
++ */
++unsigned int x86_merge_dr6(const struct cpu_policy *p, unsigned int dr6,
++ unsigned int new)
++{
++ /* Flip dr6 to have positive polarity. */
++ dr6 ^= X86_DR6_DEFAULT;
++
++ /* Sanity check that only known values are passed in. */
++ ASSERT(!(dr6 & ~X86_DR6_KNOWN_MASK));
++ ASSERT(!(new & ~X86_DR6_KNOWN_MASK));
++
++ /* Breakpoint bits overridden. All others accumulate. */
++ dr6 = (dr6 & ~X86_DR6_BP_MASK) | new;
++
++ /* Flip dr6 back to having default polarity. */
++ dr6 ^= X86_DR6_DEFAULT;
++
++ return x86_adj_dr6_rsvd(p, dr6);
++}
++
+ unsigned int x86_adj_dr6_rsvd(const struct cpu_policy *p, unsigned int dr6)
+ {
+ unsigned int ones = X86_DR6_DEFAULT;
+diff --git a/xen/arch/x86/include/asm/debugreg.h b/xen/arch/x86/include/asm/debugreg.h
+index 96c406ad53..6baa725441 100644
+--- a/xen/arch/x86/include/asm/debugreg.h
++++ b/xen/arch/x86/include/asm/debugreg.h
+@@ -108,4 +108,11 @@ struct cpu_policy;
+ unsigned int x86_adj_dr6_rsvd(const struct cpu_policy *p, unsigned int dr6);
+ unsigned int x86_adj_dr7_rsvd(const struct cpu_policy *p, unsigned int dr7);
+
++/*
++ * Merge new bits into dr6. 'new' is always given in positive polarity,
++ * matching the Intel VMCS PENDING_DBG semantics.
++ */
++unsigned int x86_merge_dr6(const struct cpu_policy *p, unsigned int dr6,
++ unsigned int new);
++
+ #endif /* _X86_DEBUGREG_H */
+diff --git a/xen/arch/x86/include/asm/x86-defns.h b/xen/arch/x86/include/asm/x86-defns.h
+index 3bcdbaccd3..caa92829ea 100644
+--- a/xen/arch/x86/include/asm/x86-defns.h
++++ b/xen/arch/x86/include/asm/x86-defns.h
+@@ -132,6 +132,13 @@
+ #define X86_DR6_ZEROS _AC(0x00001000, UL) /* %dr6 bits forced to 0 */
+ #define X86_DR6_DEFAULT _AC(0xffff0ff0, UL) /* Default %dr6 value */
+
++#define X86_DR6_BP_MASK \
++ (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3)
++
++#define X86_DR6_KNOWN_MASK \
++ (X86_DR6_BP_MASK | X86_DR6_BLD | X86_DR6_BD | X86_DR6_BS | \
++ X86_DR6_BT | X86_DR6_RTM)
++
+ /*
+ * Debug control flags in DR7.
+ */
+diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
+index ee91fc56b1..78e83f6fc1 100644
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -2017,9 +2017,14 @@ void asmlinkage do_debug(struct cpu_user_regs *regs)
+ return;
+ }
+
+- /* Save debug status register where guest OS can peek at it */
+- v->arch.dr6 |= (dr6 & ~X86_DR6_DEFAULT);
+- v->arch.dr6 &= (dr6 | ~X86_DR6_DEFAULT);
++ /*
++ * Update the guest's dr6 so the debugger can peek at it.
++ *
++ * TODO: This should be passed out-of-band, so guest state is not modified
++ * by debugging actions completed behind it's back.
++ */
++ v->arch.dr6 = x86_merge_dr6(v->domain->arch.cpu_policy,
++ v->arch.dr6, dr6 ^ X86_DR6_DEFAULT);
+
+ if ( guest_kernel_mode(v, regs) && v->domain->debugger_attached )
+ {
+--
+2.46.1
+
diff --git a/0020-x86-pv-Fix-merging-of-new-status-bits-into-dr6.patch b/0020-x86-pv-Fix-merging-of-new-status-bits-into-dr6.patch
new file mode 100644
index 0000000..b9be372
--- /dev/null
+++ b/0020-x86-pv-Fix-merging-of-new-status-bits-into-dr6.patch
@@ -0,0 +1,222 @@
+From b74a5ea8399d1a0466c55332f557863acdae21b6 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Tue, 24 Sep 2024 14:34:30 +0200
+Subject: [PATCH 20/35] x86/pv: Fix merging of new status bits into %dr6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+All #DB exceptions result in an update of %dr6, but this isn't captured in
+Xen's handling, and is buggy just about everywhere.
+
+To begin resolving this issue, add a new pending_dbg field to x86_event
+(unioned with cr2 to avoid taking any extra space, adjusting users to avoid
+old-GCC bugs with anonymous unions), and introduce pv_inject_DB() to replace
+the current callers using pv_inject_hw_exception().
+
+Push the adjustment of v->arch.dr6 into pv_inject_event(), and use the new
+x86_merge_dr6() rather than the current incorrect logic.
+
+A key property is that pending_dbg is taken with positive polarity to deal
+with RTM/BLD sensibly. Most callers pass in a constant, but callers passing
+in a hardware %dr6 value need to XOR the value with X86_DR6_DEFAULT to flip to
+positive polarity.
+
+This fixes the behaviour of the breakpoint status bits; that any left pending
+are generally discarded when a new #DB is raised. In principle it would fix
+RTM/BLD too, except PV guests can't turn these capabilities on to start with.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: db39fa4b27ea470902d4625567cb6fa24030ddfa
+master date: 2024-08-21 23:59:19 +0100
+---
+ xen/arch/x86/include/asm/domain.h | 18 ++++++++++++++++--
+ xen/arch/x86/include/asm/hvm/hvm.h | 3 ++-
+ xen/arch/x86/pv/emul-priv-op.c | 5 +----
+ xen/arch/x86/pv/emulate.c | 9 +++++++--
+ xen/arch/x86/pv/ro-page-fault.c | 2 +-
+ xen/arch/x86/pv/traps.c | 16 ++++++++++++----
+ xen/arch/x86/traps.c | 2 +-
+ xen/arch/x86/x86_emulate/x86_emulate.h | 5 ++++-
+ 8 files changed, 44 insertions(+), 16 deletions(-)
+
+diff --git a/xen/arch/x86/include/asm/domain.h b/xen/arch/x86/include/asm/domain.h
+index f5daeb182b..5d92891e6f 100644
+--- a/xen/arch/x86/include/asm/domain.h
++++ b/xen/arch/x86/include/asm/domain.h
+@@ -731,15 +731,29 @@ static inline void pv_inject_hw_exception(unsigned int vector, int errcode)
+ pv_inject_event(&event);
+ }
+
++static inline void pv_inject_DB(unsigned long pending_dbg)
++{
++ struct x86_event event = {
++ .vector = X86_EXC_DB,
++ .type = X86_EVENTTYPE_HW_EXCEPTION,
++ .error_code = X86_EVENT_NO_EC,
++ };
++
++ event.pending_dbg = pending_dbg;
++
++ pv_inject_event(&event);
++}
++
+ static inline void pv_inject_page_fault(int errcode, unsigned long cr2)
+ {
+- const struct x86_event event = {
++ struct x86_event event = {
+ .vector = X86_EXC_PF,
+ .type = X86_EVENTTYPE_HW_EXCEPTION,
+ .error_code = errcode,
+- .cr2 = cr2,
+ };
+
++ event.cr2 = cr2;
++
+ pv_inject_event(&event);
+ }
+
+diff --git a/xen/arch/x86/include/asm/hvm/hvm.h b/xen/arch/x86/include/asm/hvm/hvm.h
+index 1c01e22c8e..238eece0cf 100644
+--- a/xen/arch/x86/include/asm/hvm/hvm.h
++++ b/xen/arch/x86/include/asm/hvm/hvm.h
+@@ -525,9 +525,10 @@ static inline void hvm_inject_page_fault(int errcode, unsigned long cr2)
+ .vector = X86_EXC_PF,
+ .type = X86_EVENTTYPE_HW_EXCEPTION,
+ .error_code = errcode,
+- .cr2 = cr2,
+ };
+
++ event.cr2 = cr2;
++
+ hvm_inject_event(&event);
+ }
+
+diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c
+index aa11ecadaa..15c83b9d23 100644
+--- a/xen/arch/x86/pv/emul-priv-op.c
++++ b/xen/arch/x86/pv/emul-priv-op.c
+@@ -1366,10 +1366,7 @@ int pv_emulate_privileged_op(struct cpu_user_regs *regs)
+ ctxt.bpmatch |= DR_STEP;
+
+ if ( ctxt.bpmatch )
+- {
+- curr->arch.dr6 |= ctxt.bpmatch | DR_STATUS_RESERVED_ONE;
+- pv_inject_hw_exception(X86_EXC_DB, X86_EVENT_NO_EC);
+- }
++ pv_inject_DB(ctxt.bpmatch);
+
+ /* fall through */
+ case X86EMUL_RETRY:
+diff --git a/xen/arch/x86/pv/emulate.c b/xen/arch/x86/pv/emulate.c
+index e7a1c0a2cc..8c44dea123 100644
+--- a/xen/arch/x86/pv/emulate.c
++++ b/xen/arch/x86/pv/emulate.c
+@@ -71,10 +71,15 @@ void pv_emul_instruction_done(struct cpu_user_regs *regs, unsigned long rip)
+ {
+ regs->rip = rip;
+ regs->eflags &= ~X86_EFLAGS_RF;
++
+ if ( regs->eflags & X86_EFLAGS_TF )
+ {
+- current->arch.dr6 |= DR_STEP | DR_STATUS_RESERVED_ONE;
+- pv_inject_hw_exception(X86_EXC_DB, X86_EVENT_NO_EC);
++ /*
++ * TODO: this should generally use TF from the start of the
++ * instruction. It's only a latent bug for now, as this path isn't
++ * used for any instruction which modifies eflags.
++ */
++ pv_inject_DB(X86_DR6_BS);
+ }
+ }
+
+diff --git a/xen/arch/x86/pv/ro-page-fault.c b/xen/arch/x86/pv/ro-page-fault.c
+index cad28ef928..d0fe07e3a1 100644
+--- a/xen/arch/x86/pv/ro-page-fault.c
++++ b/xen/arch/x86/pv/ro-page-fault.c
+@@ -390,7 +390,7 @@ int pv_ro_page_fault(unsigned long addr, struct cpu_user_regs *regs)
+ /* Fallthrough */
+ case X86EMUL_OKAY:
+ if ( ctxt.retire.singlestep )
+- pv_inject_hw_exception(X86_EXC_DB, X86_EVENT_NO_EC);
++ pv_inject_DB(X86_DR6_BS);
+
+ /* Fallthrough */
+ case X86EMUL_RETRY:
+diff --git a/xen/arch/x86/pv/traps.c b/xen/arch/x86/pv/traps.c
+index 83e84e2762..5a7341abf0 100644
+--- a/xen/arch/x86/pv/traps.c
++++ b/xen/arch/x86/pv/traps.c
+@@ -12,6 +12,7 @@
+ #include <xen/lib.h>
+ #include <xen/softirq.h>
+
++#include <asm/debugreg.h>
+ #include <asm/pv/trace.h>
+ #include <asm/shared.h>
+ #include <asm/traps.h>
+@@ -50,9 +51,9 @@ void pv_inject_event(const struct x86_event *event)
+ tb->cs = ti->cs;
+ tb->eip = ti->address;
+
+- if ( event->type == X86_EVENTTYPE_HW_EXCEPTION &&
+- vector == X86_EXC_PF )
++ switch ( vector | -(event->type == X86_EVENTTYPE_SW_INTERRUPT) )
+ {
++ case X86_EXC_PF:
+ curr->arch.pv.ctrlreg[2] = event->cr2;
+ arch_set_cr2(curr, event->cr2);
+
+@@ -62,9 +63,16 @@ void pv_inject_event(const struct x86_event *event)
+ error_code |= PFEC_user_mode;
+
+ trace_pv_page_fault(event->cr2, error_code);
+- }
+- else
++ break;
++
++ case X86_EXC_DB:
++ curr->arch.dr6 = x86_merge_dr6(curr->domain->arch.cpu_policy,
++ curr->arch.dr6, event->pending_dbg);
++ fallthrough;
++ default:
+ trace_pv_trap(vector, regs->rip, use_error_code, error_code);
++ break;
++ }
+
+ if ( use_error_code )
+ {
+diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
+index 78e83f6fc1..8e2df3e719 100644
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -2032,7 +2032,7 @@ void asmlinkage do_debug(struct cpu_user_regs *regs)
+ return;
+ }
+
+- pv_inject_hw_exception(X86_EXC_DB, X86_EVENT_NO_EC);
++ pv_inject_DB(0 /* N/A, already merged */);
+ }
+
+ void asmlinkage do_entry_CP(struct cpu_user_regs *regs)
+diff --git a/xen/arch/x86/x86_emulate/x86_emulate.h b/xen/arch/x86/x86_emulate/x86_emulate.h
+index d92be69d84..e8a0e57228 100644
+--- a/xen/arch/x86/x86_emulate/x86_emulate.h
++++ b/xen/arch/x86/x86_emulate/x86_emulate.h
+@@ -78,7 +78,10 @@ struct x86_event {
+ uint8_t type; /* X86_EVENTTYPE_* */
+ uint8_t insn_len; /* Instruction length */
+ int32_t error_code; /* X86_EVENT_NO_EC if n/a */
+- unsigned long cr2; /* Only for X86_EXC_PF h/w exception */
++ union {
++ unsigned long cr2; /* #PF */
++ unsigned long pending_dbg; /* #DB (new DR6 bits, positive polarity) */
++ };
+ };
+
+ /*
+--
+2.46.1
+
diff --git a/0020-x86-ucode-Further-fixes-to-identify-ucode-already-up.patch b/0020-x86-ucode-Further-fixes-to-identify-ucode-already-up.patch
deleted file mode 100644
index c00dce2..0000000
--- a/0020-x86-ucode-Further-fixes-to-identify-ucode-already-up.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From cd873f00bedca2f1afeaf13a78f70e719c5b1398 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 26 Jun 2024 13:36:13 +0200
-Subject: [PATCH 20/56] x86/ucode: Further fixes to identify "ucode already up
- to date"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When the revision in hardware is newer than anything Xen has to hand,
-'microcode_cache' isn't set up. Then, `xen-ucode` initiates the update
-because it doesn't know whether the revisions across the system are symmetric
-or not. This involves the patch getting all the way into the
-apply_microcode() hooks before being found to be too old.
-
-This is all a giant mess and needs an overhaul, but in the short term simply
-adjust the apply_microcode() to return -EEXIST.
-
-Also, unconditionally print the preexisting microcode revision on boot. It's
-relevant information which is otherwise unavailable if Xen doesn't find new
-microcode to use.
-
-Fixes: 648db37a155a ("x86/ucode: Distinguish "ucode already up to date"")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 977d98e67c2e929c62aa1f495fc4c6341c45abb5
-master date: 2024-05-16 13:59:11 +0100
----
- xen/arch/x86/cpu/microcode/amd.c | 7 +++++--
- xen/arch/x86/cpu/microcode/core.c | 2 ++
- xen/arch/x86/cpu/microcode/intel.c | 7 +++++--
- 3 files changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
-index 75fc84e445..d8f7646e88 100644
---- a/xen/arch/x86/cpu/microcode/amd.c
-+++ b/xen/arch/x86/cpu/microcode/amd.c
-@@ -222,12 +222,15 @@ static int cf_check apply_microcode(const struct microcode_patch *patch)
- uint32_t rev, old_rev = sig->rev;
- enum microcode_match_result result = microcode_fits(patch);
-
-+ if ( result == MIS_UCODE )
-+ return -EINVAL;
-+
- /*
- * Allow application of the same revision to pick up SMT-specific changes
- * even if the revision of the other SMT thread is already up-to-date.
- */
-- if ( result != NEW_UCODE && result != SAME_UCODE )
-- return -EINVAL;
-+ if ( result == OLD_UCODE )
-+ return -EEXIST;
-
- if ( check_final_patch_levels(sig) )
- {
-diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c
-index d5338ad345..8a47f4471f 100644
---- a/xen/arch/x86/cpu/microcode/core.c
-+++ b/xen/arch/x86/cpu/microcode/core.c
-@@ -887,6 +887,8 @@ int __init early_microcode_init(unsigned long *module_map,
-
- ucode_ops.collect_cpu_info();
-
-+ printk(XENLOG_INFO "BSP microcode revision: 0x%08x\n", this_cpu(cpu_sig).rev);
-+
- /*
- * Some hypervisors deliberately report a microcode revision of -1 to
- * mean that they will not accept microcode updates.
-diff --git a/xen/arch/x86/cpu/microcode/intel.c b/xen/arch/x86/cpu/microcode/intel.c
-index 060c529a6e..a2d88e3ac0 100644
---- a/xen/arch/x86/cpu/microcode/intel.c
-+++ b/xen/arch/x86/cpu/microcode/intel.c
-@@ -294,10 +294,13 @@ static int cf_check apply_microcode(const struct microcode_patch *patch)
-
- result = microcode_update_match(patch);
-
-- if ( result != NEW_UCODE &&
-- !(opt_ucode_allow_same && result == SAME_UCODE) )
-+ if ( result == MIS_UCODE )
- return -EINVAL;
-
-+ if ( result == OLD_UCODE ||
-+ (result == SAME_UCODE && !opt_ucode_allow_same) )
-+ return -EEXIST;
-+
- wbinvd();
-
- wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)patch->data);
---
-2.45.2
-
diff --git a/0021-x86-msi-prevent-watchdog-triggering-when-dumping-MSI.patch b/0021-x86-msi-prevent-watchdog-triggering-when-dumping-MSI.patch
deleted file mode 100644
index 8bcc63f..0000000
--- a/0021-x86-msi-prevent-watchdog-triggering-when-dumping-MSI.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 1ffb29d132600e6a7965c2885505615a6fd6c647 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:36:52 +0200
-Subject: [PATCH 21/56] x86/msi: prevent watchdog triggering when dumping MSI
- state
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Use the same check that's used in dump_irqs().
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 594b22ca5be681ec1b42c34f321cc2600d582210
-master date: 2024-05-20 14:29:44 +0100
----
- xen/arch/x86/msi.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c
-index a78367d7cf..3eaeffd1e0 100644
---- a/xen/arch/x86/msi.c
-+++ b/xen/arch/x86/msi.c
-@@ -17,6 +17,7 @@
- #include <xen/param.h>
- #include <xen/pci.h>
- #include <xen/pci_regs.h>
-+#include <xen/softirq.h>
- #include <xen/iocap.h>
- #include <xen/keyhandler.h>
- #include <xen/pfn.h>
-@@ -1405,6 +1406,9 @@ static void cf_check dump_msi(unsigned char key)
- unsigned long flags;
- const char *type = "???";
-
-+ if ( !(irq & 0x1f) )
-+ process_pending_softirqs();
-+
- if ( !irq_desc_initialized(desc) )
- continue;
-
---
-2.45.2
-
diff --git a/0021-x86-pv-Address-Coverity-complaint-in-check_guest_io_.patch b/0021-x86-pv-Address-Coverity-complaint-in-check_guest_io_.patch
new file mode 100644
index 0000000..b951fb1
--- /dev/null
+++ b/0021-x86-pv-Address-Coverity-complaint-in-check_guest_io_.patch
@@ -0,0 +1,112 @@
+From cb6c3cfc5f8aa8bd8aae1abffea0574b02a04840 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Tue, 24 Sep 2024 14:36:25 +0200
+Subject: [PATCH 21/35] x86/pv: Address Coverity complaint in
+ check_guest_io_breakpoint()
+
+Commit 08aacc392d86 ("x86/emul: Fix misaligned IO breakpoint behaviour in PV
+guests") caused a Coverity INTEGER_OVERFLOW complaint based on the reasoning
+that width could be 0.
+
+It can't, but digging into the code generation, GCC 8 and later (bisected on
+godbolt) choose to emit a CSWITCH lookup table, and because the range (bottom
+2 bits clear), it's a 16-entry lookup table.
+
+So Coverity is understandable, given that GCC did emit a (dead) logic path
+where width stayed 0.
+
+Rewrite the logic. Introduce x86_bp_width() which compiles to a single basic
+block, which replaces the switch() statement. Take the opportunity to also
+make start and width be loop-scope variables.
+
+No practical change, but it should compile better and placate Coverity.
+
+Fixes: 08aacc392d86 ("x86/emul: Fix misaligned IO breakpoint behaviour in PV guests")
+Coverity-ID: 1616152
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: 6d41a9d8a12ff89adabdc286e63e9391a0481699
+master date: 2024-08-21 23:59:19 +0100
+---
+ xen/arch/x86/include/asm/debugreg.h | 25 +++++++++++++++++++++++++
+ xen/arch/x86/pv/emul-priv-op.c | 21 ++++++---------------
+ 2 files changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/xen/arch/x86/include/asm/debugreg.h b/xen/arch/x86/include/asm/debugreg.h
+index 6baa725441..23aa592e40 100644
+--- a/xen/arch/x86/include/asm/debugreg.h
++++ b/xen/arch/x86/include/asm/debugreg.h
+@@ -115,4 +115,29 @@ unsigned int x86_adj_dr7_rsvd(const struct cpu_policy *p, unsigned int dr7);
+ unsigned int x86_merge_dr6(const struct cpu_policy *p, unsigned int dr6,
+ unsigned int new);
+
++/*
++ * Calculate the width of a breakpoint from its dr7 encoding.
++ *
++ * The LEN encoding in dr7 is 2 bits wide per breakpoint and encoded as a X-1
++ * (0, 1 and 3) for widths of 1, 2 and 4 respectively in the 32bit days.
++ *
++ * In 64bit, the unused value (2) was given a meaning of width 8, which is
++ * great for efficiency but less great for nicely calculating the width.
++ */
++static inline unsigned int x86_bp_width(unsigned int dr7, unsigned int bp)
++{
++ unsigned int raw = (dr7 >> (DR_CONTROL_SHIFT +
++ DR_CONTROL_SIZE * bp + 2)) & 3;
++
++ /*
++ * If the top bit is set (i.e. we've got an 4 or 8 byte wide breakpoint),
++ * flip the bottom to reverse their order, making them sorted properly.
++ * Then it's a simple shift to calculate the width.
++ */
++ if ( raw & 2 )
++ raw ^= 1;
++
++ return 1U << raw;
++}
++
+ #endif /* _X86_DEBUGREG_H */
+diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c
+index 15c83b9d23..b90f745c75 100644
+--- a/xen/arch/x86/pv/emul-priv-op.c
++++ b/xen/arch/x86/pv/emul-priv-op.c
+@@ -323,30 +323,21 @@ static unsigned int check_guest_io_breakpoint(struct vcpu *v,
+ unsigned int port,
+ unsigned int len)
+ {
+- unsigned int width, i, match = 0;
+- unsigned long start;
++ unsigned int i, match = 0;
+
+ if ( !v->arch.pv.dr7_emul || !(v->arch.pv.ctrlreg[4] & X86_CR4_DE) )
+ return 0;
+
+ for ( i = 0; i < 4; i++ )
+ {
++ unsigned long start;
++ unsigned int width;
++
+ if ( !(v->arch.pv.dr7_emul & (3 << (i * DR_ENABLE_SIZE))) )
+ continue;
+
+- start = v->arch.dr[i];
+- width = 0;
+-
+- switch ( (v->arch.dr7 >>
+- (DR_CONTROL_SHIFT + i * DR_CONTROL_SIZE)) & 0xc )
+- {
+- case DR_LEN_1: width = 1; break;
+- case DR_LEN_2: width = 2; break;
+- case DR_LEN_4: width = 4; break;
+- case DR_LEN_8: width = 8; break;
+- }
+-
+- start &= ~(width - 1UL);
++ width = x86_bp_width(v->arch.dr7, i);
++ start = v->arch.dr[i] & ~(width - 1UL);
+
+ if ( (start < (port + len)) && ((start + width) > port) )
+ match |= 1u << i;
+--
+2.46.1
+
diff --git a/0022-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when-a.patch b/0022-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when-a.patch
deleted file mode 100644
index 28fec3e..0000000
--- a/0022-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when-a.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 52e16bf065cb42b79d14ac74d701d1f9d8506430 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:37:20 +0200
-Subject: [PATCH 22/56] x86/irq: remove offline CPUs from old CPU mask when
- adjusting move_cleanup_count
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When adjusting move_cleanup_count to account for CPUs that are offline also
-adjust old_cpu_mask, otherwise further calls to fixup_irqs() could subtract
-those again and create an imbalance in move_cleanup_count.
-
-Fixes: 472e0b74c5c4 ('x86/IRQ: deal with move cleanup count state in fixup_irqs()')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: e63209d3ba2fd1b2f232babd14c9c679ffa7b09a
-master date: 2024-06-10 10:33:22 +0200
----
- xen/arch/x86/irq.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index e07006391a..db14df93db 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2576,6 +2576,14 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- desc->arch.move_cleanup_count -= cpumask_weight(affinity);
- if ( !desc->arch.move_cleanup_count )
- release_old_vec(desc);
-+ else
-+ /*
-+ * Adjust old_cpu_mask to account for the offline CPUs,
-+ * otherwise further calls to fixup_irqs() could subtract those
-+ * again and possibly underflow the counter.
-+ */
-+ cpumask_andnot(desc->arch.old_cpu_mask, desc->arch.old_cpu_mask,
-+ affinity);
- }
-
- if ( !desc->action || cpumask_subset(desc->affinity, mask) )
---
-2.45.2
-
diff --git a/0022-x86emul-always-set-operand-size-for-AVX-VNNI-INT8-in.patch b/0022-x86emul-always-set-operand-size-for-AVX-VNNI-INT8-in.patch
new file mode 100644
index 0000000..cf37c99
--- /dev/null
+++ b/0022-x86emul-always-set-operand-size-for-AVX-VNNI-INT8-in.patch
@@ -0,0 +1,36 @@
+From 1e68200487e662e9f8720d508a1d6b3d3e2c72b9 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:37:08 +0200
+Subject: [PATCH 22/35] x86emul: always set operand size for AVX-VNNI-INT8
+ insns
+
+Unlike for AVX-VNNI-INT16 I failed to notice that op_bytes may still be
+zero when reaching the respective case block: With the ext0f38_table[]
+entries having simd_packed_int, the defaulting at the bottom of
+x86emul_decode() won't set the field to non-zero for F3- or F2-prefixed
+insns.
+
+Fixes: 842acaa743a5 ("x86emul: support AVX-VNNI-INT8")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: d45687cca2450bfebe1dfbddb22f4f03c6fbc9cb
+master date: 2024-08-23 09:11:15 +0200
+---
+ xen/arch/x86/x86_emulate/x86_emulate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
+index 16557385bf..4d9649a2af 100644
+--- a/xen/arch/x86/x86_emulate/x86_emulate.c
++++ b/xen/arch/x86/x86_emulate/x86_emulate.c
+@@ -6075,6 +6075,7 @@ x86_emulate(
+ case X86EMUL_OPC_VEX_F2(0x0f38, 0x51): /* vpdpbssds [xy]mm/mem,[xy]mm,[xy]mm */
+ host_and_vcpu_must_have(avx_vnni_int8);
+ generate_exception_if(vex.w, X86_EXC_UD);
++ op_bytes = 16 << vex.l;
+ goto simd_0f_ymm;
+
+ case X86EMUL_OPC_VEX_66(0x0f38, 0x50): /* vpdpbusd [xy]mm/mem,[xy]mm,[xy]mm */
+--
+2.46.1
+
diff --git a/0023-CI-Update-FreeBSD-to-13.3.patch b/0023-CI-Update-FreeBSD-to-13.3.patch
deleted file mode 100644
index 6a6e7ae..0000000
--- a/0023-CI-Update-FreeBSD-to-13.3.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 80f2d2c2a515a6b9a4ea1b128267c6e1b5085002 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 26 Jun 2024 13:37:58 +0200
-Subject: [PATCH 23/56] CI: Update FreeBSD to 13.3
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-Acked-by: Stefano Stabellini <sstabellini@kernel.org>
-master commit: 5ea7f2c9d7a1334b3b2bd5f67fab4d447b60613d
-master date: 2024-06-11 17:00:10 +0100
----
- .cirrus.yml | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/.cirrus.yml b/.cirrus.yml
-index 63f3afb104..e961877881 100644
---- a/.cirrus.yml
-+++ b/.cirrus.yml
-@@ -17,7 +17,7 @@ freebsd_template: &FREEBSD_TEMPLATE
- task:
- name: 'FreeBSD 13'
- freebsd_instance:
-- image_family: freebsd-13-2
-+ image_family: freebsd-13-3
- << : *FREEBSD_TEMPLATE
-
- task:
---
-2.45.2
-
diff --git a/0023-x86emul-set-fake-operand-size-for-AVX512CD-broadcast.patch b/0023-x86emul-set-fake-operand-size-for-AVX512CD-broadcast.patch
new file mode 100644
index 0000000..d94f56e
--- /dev/null
+++ b/0023-x86emul-set-fake-operand-size-for-AVX512CD-broadcast.patch
@@ -0,0 +1,35 @@
+From a0d6b75b832d2f7c54429de1a550fe122bcd6881 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:37:52 +0200
+Subject: [PATCH 23/35] x86emul: set (fake) operand size for AVX512CD broadcast
+ insns
+
+Back at the time I failed to pay attention to op_bytes still being zero
+when reaching the respective case block: With the ext0f38_table[]
+entries having simd_packed_int, the defaulting at the bottom of
+x86emul_decode() won't set the field to non-zero for F3-prefixed insns.
+
+Fixes: 37ccca740c26 ("x86emul: support AVX512CD insns")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: 6fa6b7feaafd622db3a2f3436750cf07782f4c12
+master date: 2024-08-23 09:12:24 +0200
+---
+ xen/arch/x86/x86_emulate/x86_emulate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
+index 4d9649a2af..305f4286bf 100644
+--- a/xen/arch/x86/x86_emulate/x86_emulate.c
++++ b/xen/arch/x86/x86_emulate/x86_emulate.c
+@@ -5928,6 +5928,7 @@ x86_emulate(
+ evex.w == ((b >> 4) & 1)),
+ X86_EXC_UD);
+ d |= TwoOp;
++ op_bytes = 1; /* fake */
+ /* fall through */
+ case X86EMUL_OPC_EVEX_66(0x0f38, 0xc4): /* vpconflict{d,q} [xyz]mm/mem,[xyz]mm{k} */
+ fault_suppression = false;
+--
+2.46.1
+
diff --git a/0024-x86-smp-do-not-use-shorthand-IPI-destinations-in-CPU.patch b/0024-x86-smp-do-not-use-shorthand-IPI-destinations-in-CPU.patch
deleted file mode 100644
index b69c88c..0000000
--- a/0024-x86-smp-do-not-use-shorthand-IPI-destinations-in-CPU.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 98238d49ecb149a5ac07cb8032817904c404ac2b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:38:36 +0200
-Subject: [PATCH 24/56] x86/smp: do not use shorthand IPI destinations in CPU
- hot{,un}plug contexts
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Due to the current rwlock logic, if the CPU calling get_cpu_maps() does
-so from a cpu_hotplug_{begin,done}() region the function will still
-return success, because a CPU taking the rwlock in read mode after
-having taken it in write mode is allowed. Such corner case makes using
-get_cpu_maps() alone not enough to prevent using the shorthand in CPU
-hotplug regions.
-
-Introduce a new helper to detect whether the current caller is between a
-cpu_hotplug_{begin,done}() region and use it in send_IPI_mask() to restrict
-shorthand usage.
-
-Fixes: 5500d265a2a8 ('x86/smp: use APIC ALLBUT destination shorthand when possible')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 171c52fba5d94e050d704770480dcb983490d0ad
-master date: 2024-06-12 14:29:31 +0200
----
- xen/arch/x86/smp.c | 2 +-
- xen/common/cpu.c | 5 +++++
- xen/include/xen/cpu.h | 10 ++++++++++
- xen/include/xen/rwlock.h | 2 ++
- 4 files changed, 18 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c
-index 3a331cbdbc..340fcafb46 100644
---- a/xen/arch/x86/smp.c
-+++ b/xen/arch/x86/smp.c
-@@ -88,7 +88,7 @@ void send_IPI_mask(const cpumask_t *mask, int vector)
- * the system have been accounted for.
- */
- if ( system_state > SYS_STATE_smp_boot &&
-- !unaccounted_cpus && !disabled_cpus &&
-+ !unaccounted_cpus && !disabled_cpus && !cpu_in_hotplug_context() &&
- /* NB: get_cpu_maps lock requires enabled interrupts. */
- local_irq_is_enabled() && (cpus_locked = get_cpu_maps()) &&
- (park_offline_cpus ||
-diff --git a/xen/common/cpu.c b/xen/common/cpu.c
-index 8709db4d29..6e35b114c0 100644
---- a/xen/common/cpu.c
-+++ b/xen/common/cpu.c
-@@ -68,6 +68,11 @@ void cpu_hotplug_done(void)
- write_unlock(&cpu_add_remove_lock);
- }
-
-+bool cpu_in_hotplug_context(void)
-+{
-+ return rw_is_write_locked_by_me(&cpu_add_remove_lock);
-+}
-+
- static NOTIFIER_HEAD(cpu_chain);
-
- void __init register_cpu_notifier(struct notifier_block *nb)
-diff --git a/xen/include/xen/cpu.h b/xen/include/xen/cpu.h
-index e1d4eb5967..6bf5786750 100644
---- a/xen/include/xen/cpu.h
-+++ b/xen/include/xen/cpu.h
-@@ -13,6 +13,16 @@ void put_cpu_maps(void);
- void cpu_hotplug_begin(void);
- void cpu_hotplug_done(void);
-
-+/*
-+ * Returns true when the caller CPU is between a cpu_hotplug_{begin,done}()
-+ * region.
-+ *
-+ * This is required to safely identify hotplug contexts, as get_cpu_maps()
-+ * would otherwise succeed because a caller holding the lock in write mode is
-+ * allowed to acquire the same lock in read mode.
-+ */
-+bool cpu_in_hotplug_context(void);
-+
- /* Receive notification of CPU hotplug events. */
- void register_cpu_notifier(struct notifier_block *nb);
-
-diff --git a/xen/include/xen/rwlock.h b/xen/include/xen/rwlock.h
-index 9e35ee2edf..dc74d1c057 100644
---- a/xen/include/xen/rwlock.h
-+++ b/xen/include/xen/rwlock.h
-@@ -309,6 +309,8 @@ static always_inline void write_lock_irq(rwlock_t *l)
-
- #define rw_is_locked(l) _rw_is_locked(l)
- #define rw_is_write_locked(l) _rw_is_write_locked(l)
-+#define rw_is_write_locked_by_me(l) \
-+ lock_evaluate_nospec(_is_write_locked_by_me(atomic_read(&(l)->cnts)))
-
-
- typedef struct percpu_rwlock percpu_rwlock_t;
---
-2.45.2
-
diff --git a/0024-x86-x2APIC-correct-cluster-tracking-upon-CPUs-going-.patch b/0024-x86-x2APIC-correct-cluster-tracking-upon-CPUs-going-.patch
new file mode 100644
index 0000000..a85c858
--- /dev/null
+++ b/0024-x86-x2APIC-correct-cluster-tracking-upon-CPUs-going-.patch
@@ -0,0 +1,52 @@
+From 404fb9b745dd3f1ca17c3e957e43e3f95ab2613a Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:38:27 +0200
+Subject: [PATCH 24/35] x86/x2APIC: correct cluster tracking upon CPUs going
+ down for S3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Downing CPUs for S3 is somewhat special: Since we can expect the system
+to come back up in exactly the same hardware configuration, per-CPU data
+for the secondary CPUs isn't de-allocated (and then cleared upon re-
+allocation when the CPUs are being brought back up). Therefore the
+cluster_cpus per-CPU pointer will retain its value for all CPUs other
+than the final one in a cluster (i.e. in particular for all CPUs in the
+same cluster as CPU0). That, however, is in conflict with the assertion
+early in init_apic_ldr_x2apic_cluster().
+
+Note that the issue is avoided on Intel hardware, where we park CPUs
+instead of bringing them down.
+
+Extend the bypassing of the freeing to the suspend case, thus making
+suspend/resume also a tiny bit faster.
+
+Fixes: 2e6c8f182c9c ("x86: distinguish CPU offlining from CPU removal")
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: ad3ff7b4279d16c91c23cda6e8be5bc670b25c9a
+master date: 2024-08-26 10:30:40 +0200
+---
+ xen/arch/x86/genapic/x2apic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/genapic/x2apic.c b/xen/arch/x86/genapic/x2apic.c
+index 371dd100c7..d531035fa4 100644
+--- a/xen/arch/x86/genapic/x2apic.c
++++ b/xen/arch/x86/genapic/x2apic.c
+@@ -228,7 +228,8 @@ static int cf_check update_clusterinfo(
+ case CPU_UP_CANCELED:
+ case CPU_DEAD:
+ case CPU_REMOVE:
+- if ( park_offline_cpus == (action != CPU_REMOVE) )
++ if ( park_offline_cpus == (action != CPU_REMOVE) ||
++ system_state == SYS_STATE_suspend )
+ break;
+ if ( per_cpu(cluster_cpus, cpu) )
+ {
+--
+2.46.1
+
diff --git a/0025-x86-dom0-disable-SMAP-for-PV-domain-building-only.patch b/0025-x86-dom0-disable-SMAP-for-PV-domain-building-only.patch
new file mode 100644
index 0000000..f431756
--- /dev/null
+++ b/0025-x86-dom0-disable-SMAP-for-PV-domain-building-only.patch
@@ -0,0 +1,145 @@
+From 743af916723eb4f1197719fc0aebd4460bafb5bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Tue, 24 Sep 2024 14:39:23 +0200
+Subject: [PATCH 25/35] x86/dom0: disable SMAP for PV domain building only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move the logic that disables SMAP so it's only performed when building a PV
+dom0, PVH dom0 builder doesn't require disabling SMAP.
+
+The fixes tag is to account for the wrong usage of cpu_has_smap in
+create_dom0(), it should instead have used
+boot_cpu_has(X86_FEATURE_XEN_SMAP). Fix while moving the logic to apply to PV
+only.
+
+While there also make cr4_pv32_mask __ro_after_init.
+
+Fixes: 493ab190e5b1 ('xen/sm{e, a}p: allow disabling sm{e, a}p for Xen itself')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: fb1658221a31ec1db33253a80001191391e73b17
+master date: 2024-08-28 19:59:07 +0100
+---
+ xen/arch/x86/include/asm/setup.h | 2 ++
+ xen/arch/x86/pv/dom0_build.c | 40 ++++++++++++++++++++++++++++----
+ xen/arch/x86/setup.c | 20 +---------------
+ 3 files changed, 38 insertions(+), 24 deletions(-)
+
+diff --git a/xen/arch/x86/include/asm/setup.h b/xen/arch/x86/include/asm/setup.h
+index d75589178b..8f7dfefb4d 100644
+--- a/xen/arch/x86/include/asm/setup.h
++++ b/xen/arch/x86/include/asm/setup.h
+@@ -64,6 +64,8 @@ extern bool opt_dom0_verbose;
+ extern bool opt_dom0_cpuid_faulting;
+ extern bool opt_dom0_msr_relaxed;
+
++extern unsigned long cr4_pv32_mask;
++
+ #define max_init_domid (0)
+
+ #endif
+diff --git a/xen/arch/x86/pv/dom0_build.c b/xen/arch/x86/pv/dom0_build.c
+index 57e58a02e7..07e9594493 100644
+--- a/xen/arch/x86/pv/dom0_build.c
++++ b/xen/arch/x86/pv/dom0_build.c
+@@ -354,11 +354,11 @@ static struct page_info * __init alloc_chunk(struct domain *d,
+ return page;
+ }
+
+-int __init dom0_construct_pv(struct domain *d,
+- const module_t *image,
+- unsigned long image_headroom,
+- module_t *initrd,
+- const char *cmdline)
++static int __init dom0_construct(struct domain *d,
++ const module_t *image,
++ unsigned long image_headroom,
++ module_t *initrd,
++ const char *cmdline)
+ {
+ int i, rc, order, machine;
+ bool compatible, compat;
+@@ -1051,6 +1051,36 @@ out:
+ return rc;
+ }
+
++int __init dom0_construct_pv(struct domain *d,
++ const module_t *image,
++ unsigned long image_headroom,
++ module_t *initrd,
++ const char *cmdline)
++{
++ int rc;
++
++ /*
++ * Clear SMAP in CR4 to allow user-accesses in construct_dom0(). This
++ * prevents us needing to rewrite construct_dom0() in terms of
++ * copy_{to,from}_user().
++ */
++ if ( boot_cpu_has(X86_FEATURE_XEN_SMAP) )
++ {
++ cr4_pv32_mask &= ~X86_CR4_SMAP;
++ write_cr4(read_cr4() & ~X86_CR4_SMAP);
++ }
++
++ rc = dom0_construct(d, image, image_headroom, initrd, cmdline);
++
++ if ( boot_cpu_has(X86_FEATURE_XEN_SMAP) )
++ {
++ write_cr4(read_cr4() | X86_CR4_SMAP);
++ cr4_pv32_mask |= X86_CR4_SMAP;
++ }
++
++ return rc;
++}
++
+ /*
+ * Local variables:
+ * mode: C
+diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
+index eee20bb175..f1076c7203 100644
+--- a/xen/arch/x86/setup.c
++++ b/xen/arch/x86/setup.c
+@@ -79,8 +79,7 @@ bool __read_mostly use_invpcid;
+ int8_t __initdata opt_probe_port_aliases = -1;
+ boolean_param("probe-port-aliases", opt_probe_port_aliases);
+
+-/* Only used in asm code and within this source file */
+-unsigned long asmlinkage __read_mostly cr4_pv32_mask;
++unsigned long __ro_after_init cr4_pv32_mask;
+
+ /* **** Linux config option: propagated to domain0. */
+ /* "acpi=off": Sisables both ACPI table parsing and interpreter. */
+@@ -955,26 +954,9 @@ static struct domain *__init create_dom0(const module_t *image,
+ }
+ }
+
+- /*
+- * Temporarily clear SMAP in CR4 to allow user-accesses in construct_dom0().
+- * This saves a large number of corner cases interactions with
+- * copy_from_user().
+- */
+- if ( cpu_has_smap )
+- {
+- cr4_pv32_mask &= ~X86_CR4_SMAP;
+- write_cr4(read_cr4() & ~X86_CR4_SMAP);
+- }
+-
+ if ( construct_dom0(d, image, headroom, initrd, cmdline) != 0 )
+ panic("Could not construct domain 0\n");
+
+- if ( cpu_has_smap )
+- {
+- write_cr4(read_cr4() | X86_CR4_SMAP);
+- cr4_pv32_mask |= X86_CR4_SMAP;
+- }
+-
+ return d;
+ }
+
+--
+2.46.1
+
diff --git a/0025-x86-irq-limit-interrupt-movement-done-by-fixup_irqs.patch b/0025-x86-irq-limit-interrupt-movement-done-by-fixup_irqs.patch
deleted file mode 100644
index 7c40bba..0000000
--- a/0025-x86-irq-limit-interrupt-movement-done-by-fixup_irqs.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From ce0a0cb0a74a909abf988f242aa228acdd2917fe Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:39:11 +0200
-Subject: [PATCH 25/56] x86/irq: limit interrupt movement done by fixup_irqs()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The current check used in fixup_irqs() to decide whether to move around
-interrupts is based on the affinity mask, but such mask can have all bits set,
-and hence is unlikely to be a subset of the input mask. For example if an
-interrupt has an affinity mask of all 1s, any input to fixup_irqs() that's not
-an all set CPU mask would cause that interrupt to be shuffled around
-unconditionally.
-
-What fixup_irqs() care about is evacuating interrupts from CPUs not set on the
-input CPU mask, and for that purpose it should check whether the interrupt is
-assigned to a CPU not present in the input mask. Assume that ->arch.cpu_mask
-is a subset of the ->affinity mask, and keep the current logic that resets the
-->affinity mask if the interrupt has to be shuffled around.
-
-Doing the affinity movement based on ->arch.cpu_mask requires removing the
-special handling to ->arch.cpu_mask done for high priority vectors, otherwise
-the adjustment done to cpu_mask makes them always skip the CPU interrupt
-movement.
-
-While there also adjust the comment as to the purpose of fixup_irqs().
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: c7564d7366d865cc407e3d64bca816d07edee174
-master date: 2024-06-12 14:30:40 +0200
----
- xen/arch/x86/include/asm/irq.h | 2 +-
- xen/arch/x86/irq.c | 21 +++++++++++----------
- 2 files changed, 12 insertions(+), 11 deletions(-)
-
-diff --git a/xen/arch/x86/include/asm/irq.h b/xen/arch/x86/include/asm/irq.h
-index d7fb8ec7e8..71d4a8fc56 100644
---- a/xen/arch/x86/include/asm/irq.h
-+++ b/xen/arch/x86/include/asm/irq.h
-@@ -132,7 +132,7 @@ void free_domain_pirqs(struct domain *d);
- int map_domain_emuirq_pirq(struct domain *d, int pirq, int emuirq);
- int unmap_domain_pirq_emuirq(struct domain *d, int pirq);
-
--/* Reset irq affinities to match the given CPU mask. */
-+/* Evacuate interrupts assigned to CPUs not present in the input CPU mask. */
- void fixup_irqs(const cpumask_t *mask, bool verbose);
- void fixup_eoi(void);
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index db14df93db..566331bec1 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2529,7 +2529,7 @@ static int __init cf_check setup_dump_irqs(void)
- }
- __initcall(setup_dump_irqs);
-
--/* Reset irq affinities to match the given CPU mask. */
-+/* Evacuate interrupts assigned to CPUs not present in the input CPU mask. */
- void fixup_irqs(const cpumask_t *mask, bool verbose)
- {
- unsigned int irq;
-@@ -2553,19 +2553,15 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
-
- vector = irq_to_vector(irq);
- if ( vector >= FIRST_HIPRIORITY_VECTOR &&
-- vector <= LAST_HIPRIORITY_VECTOR )
-+ vector <= LAST_HIPRIORITY_VECTOR &&
-+ desc->handler == &no_irq_type )
- {
-- cpumask_and(desc->arch.cpu_mask, desc->arch.cpu_mask, mask);
--
- /*
- * This can in particular happen when parking secondary threads
- * during boot and when the serial console wants to use a PCI IRQ.
- */
-- if ( desc->handler == &no_irq_type )
-- {
-- spin_unlock(&desc->lock);
-- continue;
-- }
-+ spin_unlock(&desc->lock);
-+ continue;
- }
-
- if ( desc->arch.move_cleanup_count )
-@@ -2586,7 +2582,12 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- affinity);
- }
-
-- if ( !desc->action || cpumask_subset(desc->affinity, mask) )
-+ /*
-+ * Avoid shuffling the interrupt around as long as current target CPUs
-+ * are a subset of the input mask. What fixup_irqs() cares about is
-+ * evacuating interrupts from CPUs not in the input mask.
-+ */
-+ if ( !desc->action || cpumask_subset(desc->arch.cpu_mask, mask) )
- {
- spin_unlock(&desc->lock);
- continue;
---
-2.45.2
-
diff --git a/0026-x86-EPT-correct-special-page-checking-in-epte_get_en.patch b/0026-x86-EPT-correct-special-page-checking-in-epte_get_en.patch
deleted file mode 100644
index c94728a..0000000
--- a/0026-x86-EPT-correct-special-page-checking-in-epte_get_en.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 6e647efaf2b02ce92bcf80bec47c18cca5084f8a Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 26 Jun 2024 13:39:44 +0200
-Subject: [PATCH 26/56] x86/EPT: correct special page checking in
- epte_get_entry_emt()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-mfn_valid() granularity is (currently) 256Mb. Therefore the start of a
-1Gb page passing the test doesn't necessarily mean all parts of such a
-range would also pass. Yet using the result of mfn_to_page() on an MFN
-which doesn't pass mfn_valid() checking is liable to result in a crash
-(the invocation of mfn_to_page() alone is presumably "just" UB in such a
-case).
-
-Fixes: ca24b2ffdbd9 ("x86/hvm: set 'ipat' in EPT for special pages")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 5540b94e8191059eb9cbbe98ac316232a42208f6
-master date: 2024-06-13 16:53:34 +0200
----
- xen/arch/x86/mm/p2m-ept.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
-index 85c4e8e54f..1aa6bbc771 100644
---- a/xen/arch/x86/mm/p2m-ept.c
-+++ b/xen/arch/x86/mm/p2m-ept.c
-@@ -518,8 +518,12 @@ int epte_get_entry_emt(struct domain *d, gfn_t gfn, mfn_t mfn,
- }
-
- for ( special_pgs = i = 0; i < (1ul << order); i++ )
-- if ( is_special_page(mfn_to_page(mfn_add(mfn, i))) )
-+ {
-+ mfn_t cur = mfn_add(mfn, i);
-+
-+ if ( mfn_valid(cur) && is_special_page(mfn_to_page(cur)) )
- special_pgs++;
-+ }
-
- if ( special_pgs )
- {
---
-2.45.2
-
diff --git a/0026-x86-HVM-correct-partial-HPET_STATUS-write-emulation.patch b/0026-x86-HVM-correct-partial-HPET_STATUS-write-emulation.patch
new file mode 100644
index 0000000..3b79d84
--- /dev/null
+++ b/0026-x86-HVM-correct-partial-HPET_STATUS-write-emulation.patch
@@ -0,0 +1,37 @@
+From 6e96dee93c60af4ee446f5e0fddf3b424824de18 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:40:03 +0200
+Subject: [PATCH 26/35] x86/HVM: correct partial HPET_STATUS write emulation
+
+For partial writes the non-written parts of registers are folded into
+the full 64-bit value from what they're presently set to. That's wrong
+to do though when the behavior is write-1-to-clear: Writes not
+including to low 3 bits would unconditionally clear all ISR bits which
+are presently set. Re-calculate the value to use.
+
+Fixes: be07023be115 ("x86/vhpet: add support for level triggered interrupts")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: 41d358d2f9607ba37c216effa39b9f1bc58de69d
+master date: 2024-08-29 10:02:20 +0200
+---
+ xen/arch/x86/hvm/hpet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c
+index 87642575f9..f0e5f877f4 100644
+--- a/xen/arch/x86/hvm/hpet.c
++++ b/xen/arch/x86/hvm/hpet.c
+@@ -404,7 +404,8 @@ static int cf_check hpet_write(
+ break;
+
+ case HPET_STATUS:
+- /* write 1 to clear. */
++ /* Write 1 to clear. Therefore don't use new_val directly here. */
++ new_val = val << ((addr & 7) * 8);
+ while ( new_val )
+ {
+ bool active;
+--
+2.46.1
+
diff --git a/0027-Arm64-adjust-__irq_to_desc-to-fix-build-with-gcc14.patch b/0027-Arm64-adjust-__irq_to_desc-to-fix-build-with-gcc14.patch
new file mode 100644
index 0000000..a95c549
--- /dev/null
+++ b/0027-Arm64-adjust-__irq_to_desc-to-fix-build-with-gcc14.patch
@@ -0,0 +1,61 @@
+From ee826bc490d6036ed9b637ada014a2d59d151f79 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:40:34 +0200
+Subject: [PATCH 27/35] Arm64: adjust __irq_to_desc() to fix build with gcc14
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+With the original code I observe
+
+In function ‘__irq_to_desc’,
+ inlined from ‘route_irq_to_guest’ at arch/arm/irq.c:465:12:
+arch/arm/irq.c:54:16: error: array subscript -2 is below array bounds of ‘irq_desc_t[32]’ {aka ‘struct irq_desc[32]’} [-Werror=array-bounds=]
+ 54 | return &this_cpu(local_irq_desc)[irq];
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+which looks pretty bogus: How in the world does the compiler arrive at
+-2 when compiling route_irq_to_guest()? Yet independent of that the
+function's parameter wants to be of unsigned type anyway, as shown by
+a vast majority of callers (others use plain int when they really mean
+non-negative quantities). With that adjustment the code compiles fine
+again.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Michal Orzel <michal.orzel@amd.com>
+master commit: 99f942f3d410059dc223ee0a908827e928ef3592
+master date: 2024-08-29 10:03:53 +0200
+---
+ xen/arch/arm/include/asm/irq.h | 2 +-
+ xen/arch/arm/irq.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xen/arch/arm/include/asm/irq.h b/xen/arch/arm/include/asm/irq.h
+index ec437add09..88e060bf29 100644
+--- a/xen/arch/arm/include/asm/irq.h
++++ b/xen/arch/arm/include/asm/irq.h
+@@ -56,7 +56,7 @@ extern const unsigned int nr_irqs;
+ struct irq_desc;
+ struct irqaction;
+
+-struct irq_desc *__irq_to_desc(int irq);
++struct irq_desc *__irq_to_desc(unsigned int irq);
+
+ #define irq_to_desc(irq) __irq_to_desc(irq)
+
+diff --git a/xen/arch/arm/irq.c b/xen/arch/arm/irq.c
+index 6b89f64fd1..b9757d7ad3 100644
+--- a/xen/arch/arm/irq.c
++++ b/xen/arch/arm/irq.c
+@@ -48,7 +48,7 @@ void irq_end_none(struct irq_desc *irq)
+ static irq_desc_t irq_desc[NR_IRQS];
+ static DEFINE_PER_CPU(irq_desc_t[NR_LOCAL_IRQS], local_irq_desc);
+
+-struct irq_desc *__irq_to_desc(int irq)
++struct irq_desc *__irq_to_desc(unsigned int irq)
+ {
+ if ( irq < NR_LOCAL_IRQS )
+ return &this_cpu(local_irq_desc)[irq];
+--
+2.46.1
+
diff --git a/0027-x86-EPT-avoid-marking-non-present-entries-for-re-con.patch b/0027-x86-EPT-avoid-marking-non-present-entries-for-re-con.patch
deleted file mode 100644
index 23e8946..0000000
--- a/0027-x86-EPT-avoid-marking-non-present-entries-for-re-con.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From d31385be5c8e8bc5efb6f8848057bd0c69e8274a Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 26 Jun 2024 13:40:11 +0200
-Subject: [PATCH 27/56] x86/EPT: avoid marking non-present entries for
- re-configuring
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-For non-present entries EMT, like most other fields, is meaningless to
-hardware. Make the logic in ept_set_entry() setting the field (and iPAT)
-conditional upon dealing with a present entry, leaving the value at 0
-otherwise. This has two effects for epte_get_entry_emt() which we'll
-want to leverage subsequently:
-1) The call moved here now won't be issued with INVALID_MFN anymore (a
- respective BUG_ON() is being added).
-2) Neither of the other two calls could now be issued with a truncated
- form of INVALID_MFN anymore (as long as there's no bug anywhere
- marking an entry present when that was populated using INVALID_MFN).
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 777c71d31325bc55ba1cc3f317d4155fe519ab0b
-master date: 2024-06-13 16:54:17 +0200
----
- xen/arch/x86/mm/p2m-ept.c | 29 ++++++++++++++++++-----------
- 1 file changed, 18 insertions(+), 11 deletions(-)
-
-diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
-index 1aa6bbc771..641d61b350 100644
---- a/xen/arch/x86/mm/p2m-ept.c
-+++ b/xen/arch/x86/mm/p2m-ept.c
-@@ -649,6 +649,8 @@ static int cf_check resolve_misconfig(struct p2m_domain *p2m, unsigned long gfn)
- if ( e.emt != MTRR_NUM_TYPES )
- break;
-
-+ ASSERT(is_epte_present(&e));
-+
- if ( level == 0 )
- {
- for ( gfn -= i, i = 0; i < EPT_PAGETABLE_ENTRIES; ++i )
-@@ -914,17 +916,6 @@ ept_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn,
-
- if ( mfn_valid(mfn) || p2m_allows_invalid_mfn(p2mt) )
- {
-- bool ipat;
-- int emt = epte_get_entry_emt(p2m->domain, _gfn(gfn), mfn,
-- i * EPT_TABLE_ORDER, &ipat,
-- p2mt);
--
-- if ( emt >= 0 )
-- new_entry.emt = emt;
-- else /* ept_handle_misconfig() will need to take care of this. */
-- new_entry.emt = MTRR_NUM_TYPES;
--
-- new_entry.ipat = ipat;
- new_entry.sp = !!i;
- new_entry.sa_p2mt = p2mt;
- new_entry.access = p2ma;
-@@ -940,6 +931,22 @@ ept_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn,
- need_modify_vtd_table = 0;
-
- ept_p2m_type_to_flags(p2m, &new_entry);
-+
-+ if ( is_epte_present(&new_entry) )
-+ {
-+ bool ipat;
-+ int emt = epte_get_entry_emt(p2m->domain, _gfn(gfn), mfn,
-+ i * EPT_TABLE_ORDER, &ipat,
-+ p2mt);
-+
-+ BUG_ON(mfn_eq(mfn, INVALID_MFN));
-+
-+ if ( emt >= 0 )
-+ new_entry.emt = emt;
-+ else /* ept_handle_misconfig() will need to take care of this. */
-+ new_entry.emt = MTRR_NUM_TYPES;
-+ new_entry.ipat = ipat;
-+ }
- }
-
- if ( sve != -1 )
---
-2.45.2
-
diff --git a/0028-libxl-Fix-nul-termination-of-the-return-value-of-lib.patch b/0028-libxl-Fix-nul-termination-of-the-return-value-of-lib.patch
new file mode 100644
index 0000000..7f43c74
--- /dev/null
+++ b/0028-libxl-Fix-nul-termination-of-the-return-value-of-lib.patch
@@ -0,0 +1,100 @@
+From c18635fd69fc2da238f00a26ab707f1b2a50bf64 Mon Sep 17 00:00:00 2001
+From: Javi Merino <javi.merino@cloud.com>
+Date: Tue, 24 Sep 2024 14:41:06 +0200
+Subject: [PATCH 28/35] libxl: Fix nul-termination of the return value of
+ libxl_xen_console_read_line()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When built with ASAN, "xl dmesg" crashes in the "printf("%s", line)"
+call in main_dmesg(). ASAN reports a heap buffer overflow: an
+off-by-one access to cr->buffer.
+
+The readconsole sysctl copies up to count characters into the buffer,
+but it does not add a null character at the end. Despite the
+documentation of libxl_xen_console_read_line(), line_r is not
+nul-terminated if 16384 characters were copied to the buffer.
+
+Fix this by asking xc_readconsolering() to fill the buffer up to size
+- 1. As the number of characters in the buffer is only needed in
+libxl_xen_console_read_line(), make it a local variable there instead
+of part of the libxl__xen_console_reader struct.
+
+Fixes: 4024bae739cc ("xl: Add subcommand 'xl dmesg'")
+Reported-by: Edwin Török <edwin.torok@cloud.com>
+Signed-off-by: Javi Merino <javi.merino@cloud.com>
+Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
+master commit: bb03169bcb6ecccf372de1f6b9285cd519a26bb8
+master date: 2024-09-03 10:53:44 +0100
+---
+ tools/libs/light/libxl_console.c | 19 +++++++++++++++----
+ tools/libs/light/libxl_internal.h | 1 -
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/tools/libs/light/libxl_console.c b/tools/libs/light/libxl_console.c
+index a563c9d3c7..9f736b8913 100644
+--- a/tools/libs/light/libxl_console.c
++++ b/tools/libs/light/libxl_console.c
+@@ -774,12 +774,17 @@ libxl_xen_console_reader *
+ {
+ GC_INIT(ctx);
+ libxl_xen_console_reader *cr;
+- unsigned int size = 16384;
++ /*
++ * We want xen to fill the buffer in as few hypercalls as
++ * possible, but xen will not nul-terminate it. The default size
++ * of Xen's console buffer is 16384. Leave one byte at the end
++ * for the null character.
++ */
++ unsigned int size = 16384 + 1;
+
+ cr = libxl__zalloc(NOGC, sizeof(libxl_xen_console_reader));
+ cr->buffer = libxl__zalloc(NOGC, size);
+ cr->size = size;
+- cr->count = size;
+ cr->clear = clear;
+ cr->incremental = 1;
+
+@@ -800,10 +805,16 @@ int libxl_xen_console_read_line(libxl_ctx *ctx,
+ char **line_r)
+ {
+ int ret;
++ /*
++ * Number of chars to copy into the buffer. xc_readconsolering()
++ * does not add a null character at the end, so leave a space for
++ * us to add it.
++ */
++ unsigned int nr_chars = cr->size - 1;
+ GC_INIT(ctx);
+
+ memset(cr->buffer, 0, cr->size);
+- ret = xc_readconsolering(ctx->xch, cr->buffer, &cr->count,
++ ret = xc_readconsolering(ctx->xch, cr->buffer, &nr_chars,
+ cr->clear, cr->incremental, &cr->index);
+ if (ret < 0) {
+ LOGE(ERROR, "reading console ring buffer");
+@@ -811,7 +822,7 @@ int libxl_xen_console_read_line(libxl_ctx *ctx,
+ return ERROR_FAIL;
+ }
+ if (!ret) {
+- if (cr->count) {
++ if (nr_chars) {
+ *line_r = cr->buffer;
+ ret = 1;
+ } else {
+diff --git a/tools/libs/light/libxl_internal.h b/tools/libs/light/libxl_internal.h
+index 3b58bb2d7f..96d14f5746 100644
+--- a/tools/libs/light/libxl_internal.h
++++ b/tools/libs/light/libxl_internal.h
+@@ -2077,7 +2077,6 @@ _hidden char *libxl__uuid2string(libxl__gc *gc, const libxl_uuid uuid);
+ struct libxl__xen_console_reader {
+ char *buffer;
+ unsigned int size;
+- unsigned int count;
+ unsigned int clear;
+ unsigned int incremental;
+ unsigned int index;
+--
+2.46.1
+
diff --git a/0028-x86-EPT-drop-questionable-mfn_valid-from-epte_get_en.patch b/0028-x86-EPT-drop-questionable-mfn_valid-from-epte_get_en.patch
deleted file mode 100644
index ee495d4..0000000
--- a/0028-x86-EPT-drop-questionable-mfn_valid-from-epte_get_en.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 3b777c2ce4ea8cf67b79a5496e51201145606798 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 26 Jun 2024 13:40:35 +0200
-Subject: [PATCH 28/56] x86/EPT: drop questionable mfn_valid() from
- epte_get_entry_emt()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-mfn_valid() is RAM-focused; it will often return false for MMIO. Yet
-access to actual MMIO space should not generally be restricted to UC
-only; especially video frame buffer accesses are unduly affected by such
-a restriction.
-
-Since, as of 777c71d31325 ("x86/EPT: avoid marking non-present entries
-for re-configuring"), the function won't be called with INVALID_MFN or,
-worse, truncated forms thereof anymore, we call fully drop that check.
-
-Fixes: 81fd0d3ca4b2 ("x86/hvm: simplify 'mmio_direct' check in epte_get_entry_emt()")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 4fdd8d75566fdad06667a79ec0ce6f43cc466c54
-master date: 2024-06-13 16:55:22 +0200
----
- xen/arch/x86/mm/p2m-ept.c | 6 ------
- 1 file changed, 6 deletions(-)
-
-diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
-index 641d61b350..d325424e97 100644
---- a/xen/arch/x86/mm/p2m-ept.c
-+++ b/xen/arch/x86/mm/p2m-ept.c
-@@ -500,12 +500,6 @@ int epte_get_entry_emt(struct domain *d, gfn_t gfn, mfn_t mfn,
- return -1;
- }
-
-- if ( !mfn_valid(mfn) )
-- {
-- *ipat = true;
-- return X86_MT_UC;
-- }
--
- /*
- * Conditional must be kept in sync with the code in
- * {iomem,ioports}_{permit,deny}_access().
---
-2.45.2
-
diff --git a/0029-SUPPORT.md-split-XSM-from-Flask.patch b/0029-SUPPORT.md-split-XSM-from-Flask.patch
new file mode 100644
index 0000000..4cf9adb
--- /dev/null
+++ b/0029-SUPPORT.md-split-XSM-from-Flask.patch
@@ -0,0 +1,66 @@
+From 3ceb79ceabab58305a0f35aed0117537f7a6b922 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:41:51 +0200
+Subject: [PATCH 29/35] SUPPORT.md: split XSM from Flask
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+XSM is a generic framework, which in particular is also used by SILO.
+With this it can't really be experimental: Arm mandates SILO for having
+a security supported configuration.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+master commit: d7c18b8720824d7efc39ffa7296751e1812865a9
+master date: 2024-09-04 16:05:03 +0200
+---
+ SUPPORT.md | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/SUPPORT.md b/SUPPORT.md
+index 1d8b38cbd0..ba6052477b 100644
+--- a/SUPPORT.md
++++ b/SUPPORT.md
+@@ -768,13 +768,21 @@ Compile time disabled for ARM by default.
+
+ Status, x86: Supported, not security supported
+
+-### XSM & FLASK
++### XSM (Xen Security Module) Framework
++
++XSM is a security policy framework. The dummy implementation is covered by this
++statement, and implements a policy whereby dom0 is all powerful. See below for
++alternative modules (FLASK, SILO).
++
++ Status: Supported
++
++### FLASK XSM Module
+
+ Status: Experimental
+
+ Compile time disabled by default.
+
+-Also note that using XSM
++Also note that using FLASK
+ to delegate various domain control hypercalls
+ to particular other domains, rather than only permitting use by dom0,
+ is also specifically excluded from security support for many hypercalls.
+@@ -787,6 +795,13 @@ Please see XSA-77 for more details.
+ The default policy includes FLASK labels and roles for a "typical" Xen-based system
+ with dom0, driver domains, stub domains, domUs, and so on.
+
++### SILO XSM Module
++
++SILO extends the dummy policy by enforcing that DomU-s can only communicate
++with Dom0, yet not with each other.
++
++ Status: Supported
++
+ ## Virtual Hardware, Hypervisor
+
+ ### x86/Nested PV
+--
+2.46.1
+
diff --git a/0029-x86-Intel-unlock-CPUID-earlier-for-the-BSP.patch b/0029-x86-Intel-unlock-CPUID-earlier-for-the-BSP.patch
deleted file mode 100644
index 6722508..0000000
--- a/0029-x86-Intel-unlock-CPUID-earlier-for-the-BSP.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From c4b284912695a5802433512b913e968eda01544f Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 26 Jun 2024 13:41:05 +0200
-Subject: [PATCH 29/56] x86/Intel: unlock CPUID earlier for the BSP
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Intel CPUs have a MSR bit to limit CPUID enumeration to leaf two. If
-this bit is set by the BIOS then CPUID evaluation does not work when
-data from any leaf greater than two is needed; early_cpu_init() in
-particular wants to collect leaf 7 data.
-
-Cure this by unlocking CPUID right before evaluating anything which
-depends on the maximum CPUID leaf being greater than two.
-
-Inspired by (and description cloned from) Linux commit 0c2f6d04619e
-("x86/topology/intel: Unlock CPUID before evaluating anything").
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: fa4d026737a47cd1d66ffb797a29150b4453aa9f
-master date: 2024-06-18 15:12:44 +0200
----
- xen/arch/x86/cpu/common.c | 3 ++-
- xen/arch/x86/cpu/cpu.h | 2 ++
- xen/arch/x86/cpu/intel.c | 29 +++++++++++++++++------------
- 3 files changed, 21 insertions(+), 13 deletions(-)
-
-diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c
-index 26eed2ade1..edec0a2546 100644
---- a/xen/arch/x86/cpu/common.c
-+++ b/xen/arch/x86/cpu/common.c
-@@ -336,7 +336,8 @@ void __init early_cpu_init(bool verbose)
-
- c->x86_vendor = x86_cpuid_lookup_vendor(ebx, ecx, edx);
- switch (c->x86_vendor) {
-- case X86_VENDOR_INTEL: actual_cpu = intel_cpu_dev; break;
-+ case X86_VENDOR_INTEL: intel_unlock_cpuid_leaves(c);
-+ actual_cpu = intel_cpu_dev; break;
- case X86_VENDOR_AMD: actual_cpu = amd_cpu_dev; break;
- case X86_VENDOR_CENTAUR: actual_cpu = centaur_cpu_dev; break;
- case X86_VENDOR_SHANGHAI: actual_cpu = shanghai_cpu_dev; break;
-diff --git a/xen/arch/x86/cpu/cpu.h b/xen/arch/x86/cpu/cpu.h
-index e3d06278b3..8be65e975a 100644
---- a/xen/arch/x86/cpu/cpu.h
-+++ b/xen/arch/x86/cpu/cpu.h
-@@ -24,3 +24,5 @@ void amd_init_lfence(struct cpuinfo_x86 *c);
- void amd_init_ssbd(const struct cpuinfo_x86 *c);
- void amd_init_spectral_chicken(void);
- void detect_zen2_null_seg_behaviour(void);
-+
-+void intel_unlock_cpuid_leaves(struct cpuinfo_x86 *c);
-diff --git a/xen/arch/x86/cpu/intel.c b/xen/arch/x86/cpu/intel.c
-index deb7b70464..0dc7c27601 100644
---- a/xen/arch/x86/cpu/intel.c
-+++ b/xen/arch/x86/cpu/intel.c
-@@ -303,10 +303,24 @@ static void __init noinline intel_init_levelling(void)
- ctxt_switch_masking = intel_ctxt_switch_masking;
- }
-
--static void cf_check early_init_intel(struct cpuinfo_x86 *c)
-+/* Unmask CPUID levels if masked. */
-+void intel_unlock_cpuid_leaves(struct cpuinfo_x86 *c)
- {
-- u64 misc_enable, disable;
-+ uint64_t misc_enable, disable;
-+
-+ rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
-+
-+ disable = misc_enable & MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
-+ if (disable) {
-+ wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable & ~disable);
-+ bootsym(trampoline_misc_enable_off) |= disable;
-+ c->cpuid_level = cpuid_eax(0);
-+ printk(KERN_INFO "revised cpuid level: %u\n", c->cpuid_level);
-+ }
-+}
-
-+static void cf_check early_init_intel(struct cpuinfo_x86 *c)
-+{
- /* Netburst reports 64 bytes clflush size, but does IO in 128 bytes */
- if (c->x86 == 15 && c->x86_cache_alignment == 64)
- c->x86_cache_alignment = 128;
-@@ -315,16 +329,7 @@ static void cf_check early_init_intel(struct cpuinfo_x86 *c)
- bootsym(trampoline_misc_enable_off) & MSR_IA32_MISC_ENABLE_XD_DISABLE)
- printk(KERN_INFO "re-enabled NX (Execute Disable) protection\n");
-
-- /* Unmask CPUID levels and NX if masked: */
-- rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
--
-- disable = misc_enable & MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
-- if (disable) {
-- wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable & ~disable);
-- bootsym(trampoline_misc_enable_off) |= disable;
-- printk(KERN_INFO "revised cpuid level: %d\n",
-- cpuid_eax(0));
-- }
-+ intel_unlock_cpuid_leaves(c);
-
- /* CPUID workaround for Intel 0F33/0F34 CPU */
- if (boot_cpu_data.x86 == 0xF && boot_cpu_data.x86_model == 3 &&
---
-2.45.2
-
diff --git a/0030-x86-fix-UP-build-with-gcc14.patch b/0030-x86-fix-UP-build-with-gcc14.patch
new file mode 100644
index 0000000..bdb7dbe
--- /dev/null
+++ b/0030-x86-fix-UP-build-with-gcc14.patch
@@ -0,0 +1,63 @@
+From d625c4e9fb46ef1b81a5b32d8fe1774c432cddd6 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:41:59 +0200
+Subject: [PATCH 30/35] x86: fix UP build with gcc14
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The complaint is:
+
+In file included from ././include/xen/config.h:17,
+ from <command-line>:
+arch/x86/smpboot.c: In function ‘link_thread_siblings.constprop’:
+./include/asm-generic/percpu.h:16:51: error: array subscript [0, 0] is outside array bounds of ‘long unsigned int[1]’ [-Werror=array-bounds=]
+ 16 | (*RELOC_HIDE(&per_cpu__##var, __per_cpu_offset[cpu]))
+./include/xen/compiler.h:140:29: note: in definition of macro ‘RELOC_HIDE’
+ 140 | (typeof(ptr)) (__ptr + (off)); })
+ | ^~~
+arch/x86/smpboot.c:238:27: note: in expansion of macro ‘per_cpu’
+ 238 | cpumask_set_cpu(cpu2, per_cpu(cpu_sibling_mask, cpu1));
+ | ^~~~~~~
+In file included from ./arch/x86/include/generated/asm/percpu.h:1,
+ from ./include/xen/percpu.h:30,
+ from ./arch/x86/include/asm/cpuid.h:9,
+ from ./arch/x86/include/asm/cpufeature.h:11,
+ from ./arch/x86/include/asm/system.h:6,
+ from ./include/xen/list.h:11,
+ from ./include/xen/mm.h:68,
+ from arch/x86/smpboot.c:12:
+./include/asm-generic/percpu.h:12:22: note: while referencing ‘__per_cpu_offset’
+ 12 | extern unsigned long __per_cpu_offset[NR_CPUS];
+ | ^~~~~~~~~~~~~~~~
+
+Which I consider bogus in the first place ("array subscript [0, 0]" vs a
+1-element array). Yet taking the experience from 99f942f3d410 ("Arm64:
+adjust __irq_to_desc() to fix build with gcc14") I guessed that
+switching function parameters to unsigned int (which they should have
+been anyway) might help. And voilà ...
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: a2de7dc4d845738e734b10fce6550c89c6b1092c
+master date: 2024-09-04 16:09:28 +0200
+---
+ xen/arch/x86/smpboot.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
+index 8aa621533f..0a89f22a39 100644
+--- a/xen/arch/x86/smpboot.c
++++ b/xen/arch/x86/smpboot.c
+@@ -226,7 +226,7 @@ static int booting_cpu;
+ /* CPUs for which sibling maps can be computed. */
+ static cpumask_t cpu_sibling_setup_map;
+
+-static void link_thread_siblings(int cpu1, int cpu2)
++static void link_thread_siblings(unsigned int cpu1, unsigned int cpu2)
+ {
+ cpumask_set_cpu(cpu1, per_cpu(cpu_sibling_mask, cpu2));
+ cpumask_set_cpu(cpu2, per_cpu(cpu_sibling_mask, cpu1));
+--
+2.46.1
+
diff --git a/0030-x86-irq-deal-with-old_cpu_mask-for-interrupts-in-mov.patch b/0030-x86-irq-deal-with-old_cpu_mask-for-interrupts-in-mov.patch
deleted file mode 100644
index 785df10..0000000
--- a/0030-x86-irq-deal-with-old_cpu_mask-for-interrupts-in-mov.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 39a6170c15bf369a2b26c855ea7621387ed4070b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:41:35 +0200
-Subject: [PATCH 30/56] x86/irq: deal with old_cpu_mask for interrupts in
- movement in fixup_irqs()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Given the current logic it's possible for ->arch.old_cpu_mask to get out of
-sync: if a CPU set in old_cpu_mask is offlined and then onlined
-again without old_cpu_mask having been updated the data in the mask will no
-longer be accurate, as when brought back online the CPU will no longer have
-old_vector configured to handle the old interrupt source.
-
-If there's an interrupt movement in progress, and the to be offlined CPU (which
-is the call context) is in the old_cpu_mask, clear it and update the mask, so
-it doesn't contain stale data.
-
-Note that when the system is going down fixup_irqs() will be called by
-smp_send_stop() from CPU 0 with a mask with only CPU 0 on it, effectively
-asking to move all interrupts to the current caller (CPU 0) which is the only
-CPU to remain online. In that case we don't care to migrate interrupts that
-are in the process of being moved, as it's likely we won't be able to move all
-interrupts to CPU 0 due to vector shortage anyway.
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 817d1cd627be668c358d038f0fadbf7d24d417d3
-master date: 2024-06-18 15:14:49 +0200
----
- xen/arch/x86/irq.c | 29 ++++++++++++++++++++++++++++-
- 1 file changed, 28 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index 566331bec1..f877327975 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2539,7 +2539,7 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- for ( irq = 0; irq < nr_irqs; irq++ )
- {
- bool break_affinity = false, set_affinity = true;
-- unsigned int vector;
-+ unsigned int vector, cpu = smp_processor_id();
- cpumask_t *affinity = this_cpu(scratch_cpumask);
-
- if ( irq == 2 )
-@@ -2582,6 +2582,33 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- affinity);
- }
-
-+ if ( desc->arch.move_in_progress &&
-+ /*
-+ * Only attempt to adjust the mask if the current CPU is going
-+ * offline, otherwise the whole system is going down and leaving
-+ * stale data in the masks is fine.
-+ */
-+ !cpu_online(cpu) &&
-+ cpumask_test_cpu(cpu, desc->arch.old_cpu_mask) )
-+ {
-+ /*
-+ * This CPU is going offline, remove it from ->arch.old_cpu_mask
-+ * and possibly release the old vector if the old mask becomes
-+ * empty.
-+ *
-+ * Note cleaning ->arch.old_cpu_mask is required if the CPU is
-+ * brought offline and then online again, as when re-onlined the
-+ * per-cpu vector table will no longer have ->arch.old_vector
-+ * setup, and hence ->arch.old_cpu_mask would be stale.
-+ */
-+ cpumask_clear_cpu(cpu, desc->arch.old_cpu_mask);
-+ if ( cpumask_empty(desc->arch.old_cpu_mask) )
-+ {
-+ desc->arch.move_in_progress = 0;
-+ release_old_vec(desc);
-+ }
-+ }
-+
- /*
- * Avoid shuffling the interrupt around as long as current target CPUs
- * are a subset of the input mask. What fixup_irqs() cares about is
---
-2.45.2
-
diff --git a/0031-x86-irq-handle-moving-interrupts-in-_assign_irq_vect.patch b/0031-x86-irq-handle-moving-interrupts-in-_assign_irq_vect.patch
deleted file mode 100644
index 96e87cd..0000000
--- a/0031-x86-irq-handle-moving-interrupts-in-_assign_irq_vect.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 3a8f4ec75d8ed8da6370deac95c341cbada96802 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:42:05 +0200
-Subject: [PATCH 31/56] x86/irq: handle moving interrupts in
- _assign_irq_vector()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Currently there's logic in fixup_irqs() that attempts to prevent
-_assign_irq_vector() from failing, as fixup_irqs() is required to evacuate all
-interrupts from the CPUs not present in the input mask. The current logic in
-fixup_irqs() is incomplete, as it doesn't deal with interrupts that have
-move_cleanup_count > 0 and a non-empty ->arch.old_cpu_mask field.
-
-Instead of attempting to fixup the interrupt descriptor in fixup_irqs() so that
-_assign_irq_vector() cannot fail, introduce logic in _assign_irq_vector()
-to deal with interrupts that have either move_{in_progress,cleanup_count} set
-and no remaining online CPUs in ->arch.cpu_mask.
-
-If _assign_irq_vector() is requested to move an interrupt in the state
-described above, first attempt to see if ->arch.old_cpu_mask contains any valid
-CPUs that could be used as fallback, and if that's the case do move the
-interrupt back to the previous destination. Note this is easier because the
-vector hasn't been released yet, so there's no need to allocate and setup a new
-vector on the destination.
-
-Due to the logic in fixup_irqs() that clears offline CPUs from
-->arch.old_cpu_mask (and releases the old vector if the mask becomes empty) it
-shouldn't be possible to get into _assign_irq_vector() with
-->arch.move_{in_progress,cleanup_count} set but no online CPUs in
-->arch.old_cpu_mask.
-
-However if ->arch.move_{in_progress,cleanup_count} is set and the interrupt has
-also changed affinity, it's possible the members of ->arch.old_cpu_mask are no
-longer part of the affinity set, move the interrupt to a different CPU part of
-the provided mask and keep the current ->arch.old_{cpu_mask,vector} for the
-pending interrupt movement to be completed.
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 369558924a642bbb0cb731e9a3375958867cb17b
-master date: 2024-06-18 15:15:10 +0200
----
- xen/arch/x86/irq.c | 97 ++++++++++++++++++++++++++++++++--------------
- 1 file changed, 68 insertions(+), 29 deletions(-)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index f877327975..13ef61a5b7 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -553,7 +553,58 @@ static int _assign_irq_vector(struct irq_desc *desc, const cpumask_t *mask)
- }
-
- if ( desc->arch.move_in_progress || desc->arch.move_cleanup_count )
-- return -EAGAIN;
-+ {
-+ /*
-+ * If the current destination is online refuse to shuffle. Retry after
-+ * the in-progress movement has finished.
-+ */
-+ if ( cpumask_intersects(desc->arch.cpu_mask, &cpu_online_map) )
-+ return -EAGAIN;
-+
-+ /*
-+ * Due to the logic in fixup_irqs() that clears offlined CPUs from
-+ * ->arch.old_cpu_mask it shouldn't be possible to get here with
-+ * ->arch.move_{in_progress,cleanup_count} set and no online CPUs in
-+ * ->arch.old_cpu_mask.
-+ */
-+ ASSERT(valid_irq_vector(desc->arch.old_vector));
-+ ASSERT(cpumask_intersects(desc->arch.old_cpu_mask, &cpu_online_map));
-+
-+ if ( cpumask_intersects(desc->arch.old_cpu_mask, mask) )
-+ {
-+ /*
-+ * Fallback to the old destination if moving is in progress and the
-+ * current destination is to be offlined. This is only possible if
-+ * the CPUs in old_cpu_mask intersect with the affinity mask passed
-+ * in the 'mask' parameter.
-+ */
-+ desc->arch.vector = desc->arch.old_vector;
-+ cpumask_and(desc->arch.cpu_mask, desc->arch.old_cpu_mask, mask);
-+
-+ /* Undo any possibly done cleanup. */
-+ for_each_cpu(cpu, desc->arch.cpu_mask)
-+ per_cpu(vector_irq, cpu)[desc->arch.vector] = irq;
-+
-+ /* Cancel the pending move and release the current vector. */
-+ desc->arch.old_vector = IRQ_VECTOR_UNASSIGNED;
-+ cpumask_clear(desc->arch.old_cpu_mask);
-+ desc->arch.move_in_progress = 0;
-+ desc->arch.move_cleanup_count = 0;
-+ if ( desc->arch.used_vectors )
-+ {
-+ ASSERT(test_bit(old_vector, desc->arch.used_vectors));
-+ clear_bit(old_vector, desc->arch.used_vectors);
-+ }
-+
-+ return 0;
-+ }
-+
-+ /*
-+ * There's an interrupt movement in progress but the destination(s) in
-+ * ->arch.old_cpu_mask are not suitable given the 'mask' parameter, go
-+ * through the full logic to find a new vector in a suitable CPU.
-+ */
-+ }
-
- err = -ENOSPC;
-
-@@ -609,7 +660,22 @@ next:
- current_vector = vector;
- current_offset = offset;
-
-- if ( valid_irq_vector(old_vector) )
-+ if ( desc->arch.move_in_progress || desc->arch.move_cleanup_count )
-+ {
-+ ASSERT(!cpumask_intersects(desc->arch.cpu_mask, &cpu_online_map));
-+ /*
-+ * Special case when evacuating an interrupt from a CPU to be
-+ * offlined and the interrupt was already in the process of being
-+ * moved. Leave ->arch.old_{vector,cpu_mask} as-is and just
-+ * replace ->arch.{cpu_mask,vector} with the new destination.
-+ * Cleanup will be done normally for the old fields, just release
-+ * the current vector here.
-+ */
-+ if ( desc->arch.used_vectors &&
-+ !test_and_clear_bit(old_vector, desc->arch.used_vectors) )
-+ ASSERT_UNREACHABLE();
-+ }
-+ else if ( valid_irq_vector(old_vector) )
- {
- cpumask_and(desc->arch.old_cpu_mask, desc->arch.cpu_mask,
- &cpu_online_map);
-@@ -2620,33 +2686,6 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- continue;
- }
-
-- /*
-- * In order for the affinity adjustment below to be successful, we
-- * need _assign_irq_vector() to succeed. This in particular means
-- * clearing desc->arch.move_in_progress if this would otherwise
-- * prevent the function from succeeding. Since there's no way for the
-- * flag to get cleared anymore when there's no possible destination
-- * left (the only possibility then would be the IRQs enabled window
-- * after this loop), there's then also no race with us doing it here.
-- *
-- * Therefore the logic here and there need to remain in sync.
-- */
-- if ( desc->arch.move_in_progress &&
-- !cpumask_intersects(mask, desc->arch.cpu_mask) )
-- {
-- unsigned int cpu;
--
-- cpumask_and(affinity, desc->arch.old_cpu_mask, &cpu_online_map);
--
-- spin_lock(&vector_lock);
-- for_each_cpu(cpu, affinity)
-- per_cpu(vector_irq, cpu)[desc->arch.old_vector] = ~irq;
-- spin_unlock(&vector_lock);
--
-- release_old_vec(desc);
-- desc->arch.move_in_progress = 0;
-- }
--
- if ( !cpumask_intersects(mask, desc->affinity) )
- {
- break_affinity = true;
---
-2.45.2
-
diff --git a/0031-x86emul-test-fix-build-with-gas-2.43.patch b/0031-x86emul-test-fix-build-with-gas-2.43.patch
new file mode 100644
index 0000000..fe30e10
--- /dev/null
+++ b/0031-x86emul-test-fix-build-with-gas-2.43.patch
@@ -0,0 +1,86 @@
+From 78d412f8bc3d78458cd868ba375ad30175194d91 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:42:39 +0200
+Subject: [PATCH 31/35] x86emul/test: fix build with gas 2.43
+
+Drop explicit {evex} pseudo-prefixes. New gas (validly) complains when
+they're used on things other than instructions. Our use was potentially
+ahead of macro invocations - see simd.h's "override" macro.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: 3c09288298af881ea1bb568740deb2d2a06bcd41
+master date: 2024-09-06 08:41:18 +0200
+---
+ tools/tests/x86_emulator/simd.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tools/tests/x86_emulator/simd.c b/tools/tests/x86_emulator/simd.c
+index 263cea662d..d68a7364c2 100644
+--- a/tools/tests/x86_emulator/simd.c
++++ b/tools/tests/x86_emulator/simd.c
+@@ -333,7 +333,7 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # if FLOAT_SIZE == 4
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vbroadcastss %1, %0" \
++ asm ( "vbroadcastss %1, %0" \
+ : "=v" (t_) : "m" (*(float[1]){ x }) ); \
+ t_; \
+ })
+@@ -401,14 +401,14 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # if VEC_SIZE >= 32
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vbroadcastsd %1, %0" : "=v" (t_) \
++ asm ( "vbroadcastsd %1, %0" : "=v" (t_) \
+ : "m" (*(double[1]){ x }) ); \
+ t_; \
+ })
+ # else
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vpbroadcastq %1, %0" \
++ asm ( "vpbroadcastq %1, %0" \
+ : "=v" (t_) : "m" (*(double[1]){ x }) ); \
+ t_; \
+ })
+@@ -601,7 +601,7 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # if INT_SIZE == 4 || UINT_SIZE == 4
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vpbroadcastd %1, %0" \
++ asm ( "vpbroadcastd %1, %0" \
+ : "=v" (t_) : "m" (*(int[1]){ x }) ); \
+ t_; \
+ })
+@@ -649,7 +649,7 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # elif INT_SIZE == 8 || UINT_SIZE == 8
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vpbroadcastq %1, %0" \
++ asm ( "vpbroadcastq %1, %0" \
+ : "=v" (t_) : "m" (*(long long[1]){ x }) ); \
+ t_; \
+ })
+@@ -716,7 +716,7 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # if INT_SIZE == 1 || UINT_SIZE == 1
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vpbroadcastb %1, %0" \
++ asm ( "vpbroadcastb %1, %0" \
+ : "=v" (t_) : "m" (*(char[1]){ x }) ); \
+ t_; \
+ })
+@@ -745,7 +745,7 @@ static inline vec_t movlhps(vec_t x, vec_t y) {
+ # elif INT_SIZE == 2 || UINT_SIZE == 2
+ # define broadcast(x) ({ \
+ vec_t t_; \
+- asm ( "%{evex%} vpbroadcastw %1, %0" \
++ asm ( "vpbroadcastw %1, %0" \
+ : "=v" (t_) : "m" (*(short[1]){ x }) ); \
+ t_; \
+ })
+--
+2.46.1
+
diff --git a/0032-x86-HVM-properly-reject-indirect-VRAM-writes.patch b/0032-x86-HVM-properly-reject-indirect-VRAM-writes.patch
new file mode 100644
index 0000000..79652e7
--- /dev/null
+++ b/0032-x86-HVM-properly-reject-indirect-VRAM-writes.patch
@@ -0,0 +1,45 @@
+From ec3999e205ccadbeb8ab1f8420dea02fee2b5a5d Mon Sep 17 00:00:00 2001
+From: Jan Beulich <jbeulich@suse.com>
+Date: Tue, 24 Sep 2024 14:43:02 +0200
+Subject: [PATCH 32/35] x86/HVM: properly reject "indirect" VRAM writes
+
+While ->count will only be different from 1 for "indirect" (data in
+guest memory) accesses, it being 1 does not exclude the request being an
+"indirect" one. Check both to be on the safe side, and bring the ->count
+part also in line with what ioreq_send_buffered() actually refuses to
+handle.
+
+Fixes: 3bbaaec09b1b ("x86/hvm: unify stdvga mmio intercept with standard mmio intercept")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+master commit: eb7cd0593d88c4b967a24bca8bd30591966676cd
+master date: 2024-09-12 09:13:04 +0200
+---
+ xen/arch/x86/hvm/stdvga.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/xen/arch/x86/hvm/stdvga.c b/xen/arch/x86/hvm/stdvga.c
+index b16c59f772..5f02d88615 100644
+--- a/xen/arch/x86/hvm/stdvga.c
++++ b/xen/arch/x86/hvm/stdvga.c
+@@ -530,14 +530,14 @@ static bool cf_check stdvga_mem_accept(
+
+ spin_lock(&s->lock);
+
+- if ( p->dir == IOREQ_WRITE && p->count > 1 )
++ if ( p->dir == IOREQ_WRITE && (p->data_is_ptr || p->count != 1) )
+ {
+ /*
+ * We cannot return X86EMUL_UNHANDLEABLE on anything other then the
+ * first cycle of an I/O. So, since we cannot guarantee to always be
+ * able to send buffered writes, we have to reject any multi-cycle
+- * I/O and, since we are rejecting an I/O, we must invalidate the
+- * cache.
++ * or "indirect" I/O and, since we are rejecting an I/O, we must
++ * invalidate the cache.
+ * Single-cycle write transactions are accepted even if the cache is
+ * not active since we can assert, when in stdvga mode, that writes
+ * to VRAM have no side effect and thus we can try to buffer them.
+--
+2.46.1
+
diff --git a/0032-xen-ubsan-Fix-UB-in-type_descriptor-declaration.patch b/0032-xen-ubsan-Fix-UB-in-type_descriptor-declaration.patch
deleted file mode 100644
index c7c0968..0000000
--- a/0032-xen-ubsan-Fix-UB-in-type_descriptor-declaration.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 5397ab9995f7354e7f8122a8a91c810256afa3d1 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 26 Jun 2024 13:42:30 +0200
-Subject: [PATCH 32/56] xen/ubsan: Fix UB in type_descriptor declaration
-
-struct type_descriptor is arranged with a NUL terminated string following the
-kind/info fields.
-
-The only reason this doesn't trip UBSAN detection itself (on more modern
-compilers at least) is because struct type_descriptor is only referenced in
-suppressed regions.
-
-Switch the declaration to be a real flexible member. No functional change.
-
-Fixes: 00fcf4dd8eb4 ("xen/ubsan: Import ubsan implementation from Linux 4.13")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: bd59af99700f075d06a6d47a16f777c9519928e0
-master date: 2024-06-18 14:55:04 +0100
----
- xen/common/ubsan/ubsan.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xen/common/ubsan/ubsan.h b/xen/common/ubsan/ubsan.h
-index a3159040fe..3db42e75b1 100644
---- a/xen/common/ubsan/ubsan.h
-+++ b/xen/common/ubsan/ubsan.h
-@@ -10,7 +10,7 @@ enum {
- struct type_descriptor {
- u16 type_kind;
- u16 type_info;
-- char type_name[1];
-+ char type_name[];
- };
-
- struct source_location {
---
-2.45.2
-
diff --git a/0033-x86-xstate-Fix-initialisation-of-XSS-cache.patch b/0033-x86-xstate-Fix-initialisation-of-XSS-cache.patch
deleted file mode 100644
index 1a8c724..0000000
--- a/0033-x86-xstate-Fix-initialisation-of-XSS-cache.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 4ee1df89d9c92609e5fff3c9b261ce4b1bb88e42 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 26 Jun 2024 13:43:19 +0200
-Subject: [PATCH 33/56] x86/xstate: Fix initialisation of XSS cache
-
-The clobbering of this_cpu(xcr0) and this_cpu(xss) to architecturally invalid
-values is to force the subsequent set_xcr0() and set_msr_xss() to reload the
-hardware register.
-
-While XCR0 is reloaded in xstate_init(), MSR_XSS isn't. This causes
-get_msr_xss() to return the invalid value, and logic of the form:
-
- old = get_msr_xss();
- set_msr_xss(new);
- ...
- set_msr_xss(old);
-
-to try and restore said invalid value.
-
-The architecturally invalid value must be purged from the cache, meaning the
-hardware register must be written at least once. This in turn highlights that
-the invalid value must only be used in the case that the hardware register is
-available.
-
-Fixes: f7f4a523927f ("x86/xstate: reset cached register values on resume")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 9e6dbbe8bf400aacb99009ddffa91d2a0c312b39
-master date: 2024-06-19 13:00:06 +0100
----
- xen/arch/x86/xstate.c | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/xen/arch/x86/xstate.c b/xen/arch/x86/xstate.c
-index f442610fc5..ca76f98fe2 100644
---- a/xen/arch/x86/xstate.c
-+++ b/xen/arch/x86/xstate.c
-@@ -641,13 +641,6 @@ void xstate_init(struct cpuinfo_x86 *c)
- return;
- }
-
-- /*
-- * Zap the cached values to make set_xcr0() and set_msr_xss() really
-- * write it.
-- */
-- this_cpu(xcr0) = 0;
-- this_cpu(xss) = ~0;
--
- cpuid_count(XSTATE_CPUID, 0, &eax, &ebx, &ecx, &edx);
- feature_mask = (((u64)edx << 32) | eax) & XCNTXT_MASK;
- BUG_ON(!valid_xcr0(feature_mask));
-@@ -657,8 +650,19 @@ void xstate_init(struct cpuinfo_x86 *c)
- * Set CR4_OSXSAVE and run "cpuid" to get xsave_cntxt_size.
- */
- set_in_cr4(X86_CR4_OSXSAVE);
-+
-+ /*
-+ * Zap the cached values to make set_xcr0() and set_msr_xss() really write
-+ * the hardware register.
-+ */
-+ this_cpu(xcr0) = 0;
- if ( !set_xcr0(feature_mask) )
- BUG();
-+ if ( cpu_has_xsaves )
-+ {
-+ this_cpu(xss) = ~0;
-+ set_msr_xss(0);
-+ }
-
- if ( bsp )
- {
---
-2.45.2
-
diff --git a/0033-xen-x86-pvh-handle-ACPI-RSDT-table-in-PVH-Dom0-build.patch b/0033-xen-x86-pvh-handle-ACPI-RSDT-table-in-PVH-Dom0-build.patch
new file mode 100644
index 0000000..d5d65b8
--- /dev/null
+++ b/0033-xen-x86-pvh-handle-ACPI-RSDT-table-in-PVH-Dom0-build.patch
@@ -0,0 +1,63 @@
+From d0ea9b319d4ca04e29ef533db0c3655a78dec315 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+Date: Tue, 24 Sep 2024 14:43:24 +0200
+Subject: [PATCH 33/35] xen/x86/pvh: handle ACPI RSDT table in PVH Dom0 build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Xen always generates an XSDT table even if the firmware only provided an
+RSDT table. Copy the RSDT header from the firmware table, adjusting the
+signature, for the XSDT table when not provided by the firmware.
+
+This is necessary to run Xen on QEMU.
+
+Fixes: 1d74282c455f ('x86: setup PVHv2 Dom0 ACPI tables')
+Suggested-by: Roger Pau Monné <roger.pau@citrix.com>
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+master commit: 6e7f7a0c16c4d406bda6d4a900252ff63a7c5fad
+master date: 2024-09-12 09:18:25 +0200
+---
+ xen/arch/x86/hvm/dom0_build.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/hvm/dom0_build.c b/xen/arch/x86/hvm/dom0_build.c
+index f3eddb6846..3dd913bdb0 100644
+--- a/xen/arch/x86/hvm/dom0_build.c
++++ b/xen/arch/x86/hvm/dom0_build.c
+@@ -1078,7 +1078,16 @@ static int __init pvh_setup_acpi_xsdt(struct domain *d, paddr_t madt_addr,
+ rc = -EINVAL;
+ goto out;
+ }
+- xsdt_paddr = rsdp->xsdt_physical_address;
++ /*
++ * Note the header is the same for both RSDT and XSDT, so it's fine to
++ * copy the native RSDT header to the Xen crafted XSDT if no native
++ * XSDT is available.
++ */
++ if ( rsdp->revision > 1 && rsdp->xsdt_physical_address )
++ xsdt_paddr = rsdp->xsdt_physical_address;
++ else
++ xsdt_paddr = rsdp->rsdt_physical_address;
++
+ acpi_os_unmap_memory(rsdp, sizeof(*rsdp));
+ table = acpi_os_map_memory(xsdt_paddr, sizeof(*table));
+ if ( !table )
+@@ -1090,6 +1099,12 @@ static int __init pvh_setup_acpi_xsdt(struct domain *d, paddr_t madt_addr,
+ xsdt->header = *table;
+ acpi_os_unmap_memory(table, sizeof(*table));
+
++ /*
++ * In case the header is an RSDT copy, unconditionally ensure it has
++ * an XSDT sig.
++ */
++ xsdt->header.signature[0] = 'X';
++
+ /* Add the custom MADT. */
+ xsdt->table_offset_entry[0] = madt_addr;
+
+--
+2.46.1
+
diff --git a/0034-blkif-reconcile-protocol-specification-with-in-use-i.patch b/0034-blkif-reconcile-protocol-specification-with-in-use-i.patch
new file mode 100644
index 0000000..baa2b49
--- /dev/null
+++ b/0034-blkif-reconcile-protocol-specification-with-in-use-i.patch
@@ -0,0 +1,183 @@
+From 933416b13966a3fa2a37b1f645c23afbd8fb6d09 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Tue, 24 Sep 2024 14:43:50 +0200
+Subject: [PATCH 34/35] blkif: reconcile protocol specification with in-use
+ implementations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Current blkif implementations (both backends and frontends) have all slight
+differences about how they handle the 'sector-size' xenstore node, and how
+other fields are derived from this value or hardcoded to be expressed in units
+of 512 bytes.
+
+To give some context, this is an excerpt of how different implementations use
+the value in 'sector-size' as the base unit for to other fields rather than
+just to set the logical sector size of the block device:
+
+ │ sectors xenbus node │ requests sector_number │ requests {first,last}_sect
+────────────────────────┼─────────────────────┼────────────────────────┼───────────────────────────
+FreeBSD blk{front,back} │ sector-size │ sector-size │ 512
+────────────────────────┼─────────────────────┼────────────────────────┼───────────────────────────
+Linux blk{front,back} │ 512 │ 512 │ 512
+────────────────────────┼─────────────────────┼────────────────────────┼───────────────────────────
+QEMU blkback │ sector-size │ sector-size │ sector-size
+────────────────────────┼─────────────────────┼────────────────────────┼───────────────────────────
+Windows blkfront │ sector-size │ sector-size │ sector-size
+────────────────────────┼─────────────────────┼────────────────────────┼───────────────────────────
+MiniOS │ sector-size │ 512 │ 512
+
+An attempt was made by 67e1c050e36b in order to change the base units of the
+request fields and the xenstore 'sectors' node. That however only lead to more
+confusion, as the specification now clearly diverged from the reference
+implementation in Linux. Such change was only implemented for QEMU Qdisk
+and Windows PV blkfront.
+
+Partially revert to the state before 67e1c050e36b while adjusting the
+documentation for 'sectors' to match what it used to be previous to
+2fa701e5346d:
+
+ * Declare 'feature-large-sector-size' deprecated. Frontends should not expose
+ the node, backends should not make decisions based on its presence.
+
+ * Clarify that 'sectors' xenstore node and the requests fields are always in
+ 512-byte units, like it was previous to 2fa701e5346d and 67e1c050e36b.
+
+All base units for the fields used in the protocol are 512-byte based, the
+xenbus 'sector-size' field is only used to signal the logic block size. When
+'sector-size' is greater than 512, blkfront implementations must make sure that
+the offsets and sizes (despite being expressed in 512-byte units) are aligned
+to the logical block size specified in 'sector-size', otherwise the backend
+will fail to process the requests.
+
+This will require changes to some of the frontends and backends in order to
+properly support 'sector-size' nodes greater than 512.
+
+Fixes: 2fa701e5346d ('blkif.h: Provide more complete documentation of the blkif interface')
+Fixes: 67e1c050e36b ('public/io/blkif.h: try to fix the semantics of sector based quantities')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
+master commit: 221f2748e8dabe8361b8cdfcffbeab9102c4c899
+master date: 2024-09-12 14:04:56 +0200
+---
+ xen/include/public/io/blkif.h | 52 ++++++++++++++++++++++++++---------
+ 1 file changed, 39 insertions(+), 13 deletions(-)
+
+diff --git a/xen/include/public/io/blkif.h b/xen/include/public/io/blkif.h
+index 22f1eef0c0..9b00d633d3 100644
+--- a/xen/include/public/io/blkif.h
++++ b/xen/include/public/io/blkif.h
+@@ -237,12 +237,16 @@
+ * sector-size
+ * Values: <uint32_t>
+ *
+- * The logical block size, in bytes, of the underlying storage. This
+- * must be a power of two with a minimum value of 512.
++ * The logical block size, in bytes, of the underlying storage. This must
++ * be a power of two with a minimum value of 512. The sector size should
++ * only be used for request segment length and alignment.
+ *
+- * NOTE: Because of implementation bugs in some frontends this must be
+- * set to 512, unless the frontend advertizes a non-zero value
+- * in its "feature-large-sector-size" xenbus node. (See below).
++ * When exposing a device that uses a logical sector size of 4096, the
++ * only difference xenstore wise will be that 'sector-size' (and possibly
++ * 'physical-sector-size' if supported by the backend) will be 4096, but
++ * the 'sectors' node will still be calculated using 512 byte units. The
++ * sector base units in the ring requests fields will all be 512 byte
++ * based despite the logical sector size exposed in 'sector-size'.
+ *
+ * physical-sector-size
+ * Values: <uint32_t>
+@@ -254,9 +258,9 @@
+ * sectors
+ * Values: <uint64_t>
+ *
+- * The size of the backend device, expressed in units of "sector-size".
+- * The product of "sector-size" and "sectors" must also be an integer
+- * multiple of "physical-sector-size", if that node is present.
++ * The size of the backend device, expressed in units of 512b. The
++ * product of "sectors" * 512 must also be an integer multiple of
++ * "physical-sector-size", if that node is present.
+ *
+ *****************************************************************************
+ * Frontend XenBus Nodes
+@@ -338,6 +342,7 @@
+ * feature-large-sector-size
+ * Values: 0/1 (boolean)
+ * Default Value: 0
++ * Notes: DEPRECATED, 12
+ *
+ * A value of "1" indicates that the frontend will correctly supply and
+ * interpret all sector-based quantities in terms of the "sector-size"
+@@ -411,6 +416,11 @@
+ *(10) The discard-secure property may be present and will be set to 1 if the
+ * backing device supports secure discard.
+ *(11) Only used by Linux and NetBSD.
++ *(12) Possibly only ever implemented by the QEMU Qdisk backend and the Windows
++ * PV block frontend. Other backends and frontends supported 'sector-size'
++ * values greater than 512 before such feature was added. Frontends should
++ * not expose this node, neither should backends make any decisions based
++ * on it being exposed by the frontend.
+ */
+
+ /*
+@@ -619,11 +629,14 @@
+ #define BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST 8
+
+ /*
+- * NB. 'first_sect' and 'last_sect' in blkif_request_segment, as well as
+- * 'sector_number' in blkif_request, blkif_request_discard and
+- * blkif_request_indirect are sector-based quantities. See the description
+- * of the "feature-large-sector-size" frontend xenbus node above for
+- * more information.
++ * NB. 'first_sect' and 'last_sect' in blkif_request_segment are all in units
++ * of 512 bytes, despite the 'sector-size' xenstore node possibly having a
++ * value greater than 512.
++ *
++ * The value in 'first_sect' and 'last_sect' fields must be setup so that the
++ * resulting segment offset and size is aligned to the logical sector size
++ * reported by the 'sector-size' xenstore node, see 'Backend Device Properties'
++ * section.
+ */
+ struct blkif_request_segment {
+ grant_ref_t gref; /* reference to I/O buffer frame */
+@@ -634,6 +647,10 @@ struct blkif_request_segment {
+
+ /*
+ * Starting ring element for any I/O request.
++ *
++ * The 'sector_number' field is in units of 512b, despite the value of the
++ * 'sector-size' xenstore node. Note however that the offset in
++ * 'sector_number' must be aligned to 'sector-size'.
+ */
+ struct blkif_request {
+ uint8_t operation; /* BLKIF_OP_??? */
+@@ -648,6 +665,10 @@ typedef struct blkif_request blkif_request_t;
+ /*
+ * Cast to this structure when blkif_request.operation == BLKIF_OP_DISCARD
+ * sizeof(struct blkif_request_discard) <= sizeof(struct blkif_request)
++ *
++ * The 'sector_number' field is in units of 512b, despite the value of the
++ * 'sector-size' xenstore node. Note however that the offset in
++ * 'sector_number' must be aligned to 'sector-size'.
+ */
+ struct blkif_request_discard {
+ uint8_t operation; /* BLKIF_OP_DISCARD */
+@@ -660,6 +681,11 @@ struct blkif_request_discard {
+ };
+ typedef struct blkif_request_discard blkif_request_discard_t;
+
++/*
++ * The 'sector_number' field is in units of 512b, despite the value of the
++ * 'sector-size' xenstore node. Note however that the offset in
++ * 'sector_number' must be aligned to 'sector-size'.
++ */
+ struct blkif_request_indirect {
+ uint8_t operation; /* BLKIF_OP_INDIRECT */
+ uint8_t indirect_op; /* BLKIF_OP_{READ/WRITE} */
+--
+2.46.1
+
diff --git a/0034-x86-cpuid-Fix-handling-of-XSAVE-dynamic-leaves.patch b/0034-x86-cpuid-Fix-handling-of-XSAVE-dynamic-leaves.patch
deleted file mode 100644
index 1905728..0000000
--- a/0034-x86-cpuid-Fix-handling-of-XSAVE-dynamic-leaves.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 9b43092d54b5f9e9d39d9f20393671e303b19e81 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Wed, 26 Jun 2024 13:43:44 +0200
-Subject: [PATCH 34/56] x86/cpuid: Fix handling of XSAVE dynamic leaves
-
-[ This is a minimal backport of commit 71cacfb035f4 ("x86/cpuid: Fix handling
- of XSAVE dynamic leaves") to fix the bugs without depending on the large
- rework of XSTATE handling in Xen 4.19 ]
-
-First, if XSAVE is available in hardware but not visible to the guest, the
-dynamic leaves shouldn't be filled in.
-
-Second, the comment concerning XSS state is wrong. VT-x doesn't manage
-host/guest state automatically, but there is provision for "host only" bits to
-be set, so the implications are still accurate.
-
-In Xen 4.18, no XSS states are supported, so it's safe to keep deferring to
-real hardware.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 71cacfb035f4a78ee10970dc38a3baa04d387451
-master date: 2024-06-19 13:00:06 +0100
----
- xen/arch/x86/cpuid.c | 30 +++++++++++++-----------------
- 1 file changed, 13 insertions(+), 17 deletions(-)
-
-diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c
-index 455a09b2dd..f6fd6cc6b3 100644
---- a/xen/arch/x86/cpuid.c
-+++ b/xen/arch/x86/cpuid.c
-@@ -330,24 +330,20 @@ void guest_cpuid(const struct vcpu *v, uint32_t leaf,
- case XSTATE_CPUID:
- switch ( subleaf )
- {
-- case 1:
-- if ( p->xstate.xsavec || p->xstate.xsaves )
-- {
-- /*
-- * TODO: Figure out what to do for XSS state. VT-x manages
-- * host vs guest MSR_XSS automatically, so as soon as we start
-- * supporting any XSS states, the wrong XSS will be in
-- * context.
-- */
-- BUILD_BUG_ON(XSTATE_XSAVES_ONLY != 0);
--
-- /*
-- * Read CPUID[0xD,0/1].EBX from hardware. They vary with
-- * enabled XSTATE, and appropraite XCR0|XSS are in context.
-- */
-+ /*
-+ * Read CPUID[0xd,0/1].EBX from hardware. They vary with enabled
-+ * XSTATE, and the appropriate XCR0 is in context.
-+ */
- case 0:
-- res->b = cpuid_count_ebx(leaf, subleaf);
-- }
-+ if ( p->basic.xsave )
-+ res->b = cpuid_count_ebx(0xd, 0);
-+ break;
-+
-+ case 1:
-+ /* This only works because Xen doesn't support XSS states yet. */
-+ BUILD_BUG_ON(XSTATE_XSAVES_ONLY != 0);
-+ if ( p->xstate.xsavec )
-+ res->b = cpuid_count_ebx(0xd, 1);
- break;
- }
- break;
---
-2.45.2
-
diff --git a/0035-x86-irq-forward-pending-interrupts-to-new-destinatio.patch b/0035-x86-irq-forward-pending-interrupts-to-new-destinatio.patch
deleted file mode 100644
index f05b09e..0000000
--- a/0035-x86-irq-forward-pending-interrupts-to-new-destinatio.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From e95d30f9e5eed0c5d9dbf72d4cc3ae373152ab10 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Wed, 26 Jun 2024 13:44:08 +0200
-Subject: [PATCH 35/56] x86/irq: forward pending interrupts to new destination
- in fixup_irqs()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-fixup_irqs() is used to evacuate interrupts from to be offlined CPUs. Given
-the CPU is to become offline, the normal migration logic used by Xen where the
-vector in the previous target(s) is left configured until the interrupt is
-received on the new destination is not suitable.
-
-Instead attempt to do as much as possible in order to prevent loosing
-interrupts. If fixup_irqs() is called from the CPU to be offlined (as is
-currently the case for CPU hot unplug) attempt to forward pending vectors when
-interrupts that target the current CPU are migrated to a different destination.
-
-Additionally, for interrupts that have already been moved from the current CPU
-prior to the call to fixup_irqs() but that haven't been delivered to the new
-destination (iow: interrupts with move_in_progress set and the current CPU set
-in ->arch.old_cpu_mask) also check whether the previous vector is pending and
-forward it to the new destination.
-
-This allows us to remove the window with interrupts enabled at the bottom of
-fixup_irqs(). Such window wasn't safe anyway: references to the CPU to become
-offline are removed from interrupts masks, but the per-CPU vector_irq[] array
-is not updated to reflect those changes (as the CPU is going offline anyway).
-
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: e2bb28d621584fce15c907002ddc7c6772644b64
-master date: 2024-06-20 12:09:32 +0200
----
- xen/arch/x86/include/asm/apic.h | 5 ++++
- xen/arch/x86/irq.c | 46 ++++++++++++++++++++++++++++-----
- 2 files changed, 45 insertions(+), 6 deletions(-)
-
-diff --git a/xen/arch/x86/include/asm/apic.h b/xen/arch/x86/include/asm/apic.h
-index 7625c0ecd6..ad8d7cc054 100644
---- a/xen/arch/x86/include/asm/apic.h
-+++ b/xen/arch/x86/include/asm/apic.h
-@@ -145,6 +145,11 @@ static __inline bool_t apic_isr_read(u8 vector)
- (vector & 0x1f)) & 1;
- }
-
-+static inline bool apic_irr_read(unsigned int vector)
-+{
-+ return apic_read(APIC_IRR + (vector / 32 * 0x10)) & (1U << (vector % 32));
-+}
-+
- static __inline u32 get_apic_id(void) /* Get the physical APIC id */
- {
- u32 id = apic_read(APIC_ID);
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index 13ef61a5b7..290f8d26e7 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2604,7 +2604,7 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
-
- for ( irq = 0; irq < nr_irqs; irq++ )
- {
-- bool break_affinity = false, set_affinity = true;
-+ bool break_affinity = false, set_affinity = true, check_irr = false;
- unsigned int vector, cpu = smp_processor_id();
- cpumask_t *affinity = this_cpu(scratch_cpumask);
-
-@@ -2657,6 +2657,25 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- !cpu_online(cpu) &&
- cpumask_test_cpu(cpu, desc->arch.old_cpu_mask) )
- {
-+ /*
-+ * This to be offlined CPU was the target of an interrupt that's
-+ * been moved, and the new destination target hasn't yet
-+ * acknowledged any interrupt from it.
-+ *
-+ * We know the interrupt is configured to target the new CPU at
-+ * this point, so we can check IRR for any pending vectors and
-+ * forward them to the new destination.
-+ *
-+ * Note that for the other case of an interrupt movement being in
-+ * progress (move_cleanup_count being non-zero) we know the new
-+ * destination has already acked at least one interrupt from this
-+ * source, and hence there's no need to forward any stale
-+ * interrupts.
-+ */
-+ if ( apic_irr_read(desc->arch.old_vector) )
-+ send_IPI_mask(cpumask_of(cpumask_any(desc->arch.cpu_mask)),
-+ desc->arch.vector);
-+
- /*
- * This CPU is going offline, remove it from ->arch.old_cpu_mask
- * and possibly release the old vector if the old mask becomes
-@@ -2697,6 +2716,14 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- if ( desc->handler->disable )
- desc->handler->disable(desc);
-
-+ /*
-+ * If the current CPU is going offline and is (one of) the target(s) of
-+ * the interrupt, signal to check whether there are any pending vectors
-+ * to be handled in the local APIC after the interrupt has been moved.
-+ */
-+ if ( !cpu_online(cpu) && cpumask_test_cpu(cpu, desc->arch.cpu_mask) )
-+ check_irr = true;
-+
- if ( desc->handler->set_affinity )
- desc->handler->set_affinity(desc, affinity);
- else if ( !(warned++) )
-@@ -2707,6 +2734,18 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
-
- cpumask_copy(affinity, desc->affinity);
-
-+ if ( check_irr && apic_irr_read(vector) )
-+ /*
-+ * Forward pending interrupt to the new destination, this CPU is
-+ * going offline and otherwise the interrupt would be lost.
-+ *
-+ * Do the IRR check as late as possible before releasing the irq
-+ * desc in order for any in-flight interrupts to be delivered to
-+ * the lapic.
-+ */
-+ send_IPI_mask(cpumask_of(cpumask_any(desc->arch.cpu_mask)),
-+ desc->arch.vector);
-+
- spin_unlock(&desc->lock);
-
- if ( !verbose )
-@@ -2718,11 +2757,6 @@ void fixup_irqs(const cpumask_t *mask, bool verbose)
- printk("Broke affinity for IRQ%u, new: %*pb\n",
- irq, CPUMASK_PR(affinity));
- }
--
-- /* That doesn't seem sufficient. Give it 1ms. */
-- local_irq_enable();
-- mdelay(1);
-- local_irq_disable();
- }
-
- void fixup_eoi(void)
---
-2.45.2
-
diff --git a/0035-xen-ucode-Fix-buffer-under-run-when-parsing-AMD-cont.patch b/0035-xen-ucode-Fix-buffer-under-run-when-parsing-AMD-cont.patch
new file mode 100644
index 0000000..221f55b
--- /dev/null
+++ b/0035-xen-ucode-Fix-buffer-under-run-when-parsing-AMD-cont.patch
@@ -0,0 +1,62 @@
+From 2c61ab407172682e1382204a8305107f19e2951b Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Tue, 24 Sep 2024 14:44:10 +0200
+Subject: [PATCH 35/35] xen/ucode: Fix buffer under-run when parsing AMD
+ containers
+
+The AMD container format has no formal spec. It is, at best, precision
+guesswork based on AMD's prior contributions to open source projects. The
+Equivalence Table has both an explicit length, and an expectation of having a
+NULL entry at the end.
+
+Xen was sanity checking the NULL entry, but without confirming that an entry
+was present, resulting in a read off the front of the buffer. With some
+manual debugging/annotations this manifests as:
+
+ (XEN) *** Buf ffff83204c00b19c, eq ffff83204c00b194
+ (XEN) *** eq: 0c 00 00 00 44 4d 41 00 00 00 00 00 00 00 00 00 aa aa aa aa
+ ^-Actual buffer-------------------^
+ (XEN) *** installed_cpu: 000c
+ (XEN) microcode: Bad equivalent cpu table
+ (XEN) Parsing microcode blob error -22
+
+When loaded by hypercall, the 4 bytes interpreted as installed_cpu happen to
+be the containing struct ucode_buf's len field, and luckily will be nonzero.
+
+When loaded at boot, it's possible for the access to #PF if the module happens
+to have been placed on a 2M boundary by the bootloader. Under Linux, it will
+commonly be the end of the CPIO header.
+
+Drop the probe of the NULL entry; Nothing else cares. A container without one
+is well formed, insofar that we can still parse it correctly. With this
+dropped, the same container results in:
+
+ (XEN) microcode: couldn't find any matching ucode in the provided blob!
+
+Fixes: 4de936a38aa9 ("x86/ucode/amd: Rework parsing logic in cpu_request_microcode()")
+Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+master commit: a8bf14f6f331d4f428010b4277b67c33f561ed19
+master date: 2024-09-13 15:23:30 +0100
+---
+ xen/arch/x86/cpu/microcode/amd.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
+index f76a563c8b..9fe6e29751 100644
+--- a/xen/arch/x86/cpu/microcode/amd.c
++++ b/xen/arch/x86/cpu/microcode/amd.c
+@@ -336,8 +336,7 @@ static struct microcode_patch *cf_check cpu_request_microcode(
+ if ( size < sizeof(*et) ||
+ (et = buf)->type != UCODE_EQUIV_CPU_TABLE_TYPE ||
+ size - sizeof(*et) < et->len ||
+- et->len % sizeof(et->eq[0]) ||
+- et->eq[(et->len / sizeof(et->eq[0])) - 1].installed_cpu )
++ et->len % sizeof(et->eq[0]) )
+ {
+ printk(XENLOG_ERR "microcode: Bad equivalent cpu table\n");
+ error = -EINVAL;
+--
+2.46.1
+
diff --git a/0036-x86-re-run-exception-from-stub-recovery-selftests-wi.patch b/0036-x86-re-run-exception-from-stub-recovery-selftests-wi.patch
deleted file mode 100644
index a552e9c..0000000
--- a/0036-x86-re-run-exception-from-stub-recovery-selftests-wi.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 5ac3cbbf83e1f955aeaf5d0f503099f5249b5c25 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Thu, 4 Jul 2024 14:06:19 +0200
-Subject: [PATCH 36/56] x86: re-run exception-from-stub recovery selftests with
- CET-SS enabled
-
-On the BSP, shadow stacks are enabled only relatively late in the
-booting process. They in particular aren't active yet when initcalls are
-run. Keep the testing there, but invoke that testing a 2nd time when
-shadow stacks are active, to make sure we won't regress that case after
-addressing XSA-451.
-
-While touching this code, switch the guard from NDEBUG to CONFIG_DEBUG,
-such that IS_ENABLED() can validly be used at the new call site.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: cfe3ad67127b86e1b1c06993b86422673a51b050
-master date: 2024-02-27 13:49:52 +0100
----
- xen/arch/x86/extable.c | 8 +++++---
- xen/arch/x86/include/asm/setup.h | 2 ++
- xen/arch/x86/setup.c | 4 ++++
- 3 files changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/xen/arch/x86/extable.c b/xen/arch/x86/extable.c
-index 8ffcd346d7..12cc9935d8 100644
---- a/xen/arch/x86/extable.c
-+++ b/xen/arch/x86/extable.c
-@@ -128,10 +128,11 @@ search_exception_table(const struct cpu_user_regs *regs, unsigned long *stub_ra)
- return 0;
- }
-
--#ifndef NDEBUG
-+#ifdef CONFIG_DEBUG
-+#include <asm/setup.h>
- #include <asm/traps.h>
-
--static int __init cf_check stub_selftest(void)
-+int __init cf_check stub_selftest(void)
- {
- static const struct {
- uint8_t opc[8];
-@@ -155,7 +156,8 @@ static int __init cf_check stub_selftest(void)
- unsigned int i;
- bool fail = false;
-
-- printk("Running stub recovery selftests...\n");
-+ printk("%s stub recovery selftests...\n",
-+ system_state < SYS_STATE_active ? "Running" : "Re-running");
-
- for ( i = 0; i < ARRAY_SIZE(tests); ++i )
- {
-diff --git a/xen/arch/x86/include/asm/setup.h b/xen/arch/x86/include/asm/setup.h
-index 9a460e4db8..14d15048eb 100644
---- a/xen/arch/x86/include/asm/setup.h
-+++ b/xen/arch/x86/include/asm/setup.h
-@@ -38,6 +38,8 @@ void *bootstrap_map(const module_t *mod);
-
- int xen_in_range(unsigned long mfn);
-
-+int cf_check stub_selftest(void);
-+
- extern uint8_t kbd_shift_flags;
-
- #ifdef NDEBUG
-diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
-index 25017b5d96..f2592c3dc9 100644
---- a/xen/arch/x86/setup.c
-+++ b/xen/arch/x86/setup.c
-@@ -738,6 +738,10 @@ static void noreturn init_done(void)
-
- system_state = SYS_STATE_active;
-
-+ /* Re-run stub recovery self-tests with CET-SS active. */
-+ if ( IS_ENABLED(CONFIG_DEBUG) && cpu_has_xen_shstk )
-+ stub_selftest();
-+
- domain_unpause_by_systemcontroller(dom0);
-
- /* MUST be done prior to removing .init data. */
---
-2.45.2
-
diff --git a/0037-tools-tests-don-t-let-test-xenstore-write-nodes-exce.patch b/0037-tools-tests-don-t-let-test-xenstore-write-nodes-exce.patch
deleted file mode 100644
index cc7e47d..0000000
--- a/0037-tools-tests-don-t-let-test-xenstore-write-nodes-exce.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 0ebfa35965257343ba3d8377be91ad8512a9c749 Mon Sep 17 00:00:00 2001
-From: Juergen Gross <jgross@suse.com>
-Date: Thu, 4 Jul 2024 14:06:54 +0200
-Subject: [PATCH 37/56] tools/tests: don't let test-xenstore write nodes
- exceeding default size
-
-Today test-xenstore will write nodes with 3000 bytes node data. This
-size is exceeding the default quota for the allowed node size. While
-working in dom0 with C-xenstored, OCAML-xenstored does not like that.
-
-Use a size of 2000 instead, which is lower than the allowed default
-node size of 2048.
-
-Fixes: 3afc5e4a5b75 ("tools/tests: add xenstore testing framework")
-Signed-off-by: Juergen Gross <jgross@suse.com>
-Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: 642005e310483c490b0725fab4672f2b77fdf2ba
-master date: 2024-05-02 18:15:31 +0100
----
- tools/tests/xenstore/test-xenstore.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/tests/xenstore/test-xenstore.c b/tools/tests/xenstore/test-xenstore.c
-index d491dac53b..73a7011d21 100644
---- a/tools/tests/xenstore/test-xenstore.c
-+++ b/tools/tests/xenstore/test-xenstore.c
-@@ -408,9 +408,9 @@ static int test_ta3_deinit(uintptr_t par)
- #define TEST(s, f, p, l) { s, f ## _init, f, f ## _deinit, (uintptr_t)(p), l }
- struct test tests[] = {
- TEST("read 1", test_read, 1, "Read node with 1 byte data"),
--TEST("read 3000", test_read, 3000, "Read node with 3000 bytes data"),
-+TEST("read 2000", test_read, 2000, "Read node with 2000 bytes data"),
- TEST("write 1", test_write, 1, "Write node with 1 byte data"),
--TEST("write 3000", test_write, 3000, "Write node with 3000 bytes data"),
-+TEST("write 2000", test_write, 2000, "Write node with 2000 bytes data"),
- TEST("dir", test_dir, 0, "List directory"),
- TEST("rm node", test_rm, 0, "Remove single node"),
- TEST("rm dir", test_rm, WRITE_BUFFERS_N, "Remove node with sub-nodes"),
---
-2.45.2
-
diff --git a/0038-tools-tests-let-test-xenstore-exit-with-non-0-status.patch b/0038-tools-tests-let-test-xenstore-exit-with-non-0-status.patch
deleted file mode 100644
index ee0a497..0000000
--- a/0038-tools-tests-let-test-xenstore-exit-with-non-0-status.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 22f623622cc60571be9cccc323a1d17749683667 Mon Sep 17 00:00:00 2001
-From: Juergen Gross <jgross@suse.com>
-Date: Thu, 4 Jul 2024 14:07:12 +0200
-Subject: [PATCH 38/56] tools/tests: let test-xenstore exit with non-0 status
- in case of error
-
-In case a test is failing in test-xenstore, let the tool exit with an
-exit status other than 0.
-
-Fix a typo in an error message.
-
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Fixes: 3afc5e4a5b75 ("tools/tests: add xenstore testing framework")
-Signed-off-by: Juergen Gross <jgross@suse.com>
-master commit: 2d4ba205591ba64f31149ae31051678159ee9e11
-master date: 2024-05-02 18:15:46 +0100
----
- tools/tests/xenstore/test-xenstore.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/tools/tests/xenstore/test-xenstore.c b/tools/tests/xenstore/test-xenstore.c
-index 73a7011d21..7a9bd9afb3 100644
---- a/tools/tests/xenstore/test-xenstore.c
-+++ b/tools/tests/xenstore/test-xenstore.c
-@@ -506,14 +506,14 @@ int main(int argc, char *argv[])
- stop = time(NULL) + randtime;
- srandom((unsigned int)stop);
-
-- while ( time(NULL) < stop )
-+ while ( time(NULL) < stop && !ret )
- {
- t = random() % ARRAY_SIZE(tests);
- ret = call_test(tests + t, iters, true);
- }
- }
- else
-- for ( t = 0; t < ARRAY_SIZE(tests); t++ )
-+ for ( t = 0; t < ARRAY_SIZE(tests) && !ret; t++ )
- {
- if ( !test || !strcmp(test, tests[t].name) )
- ret = call_test(tests + t, iters, false);
-@@ -525,10 +525,10 @@ int main(int argc, char *argv[])
- xs_close(xsh);
-
- if ( ta_loops )
-- printf("Exhaustive transaction retries (%d) occurrred %d times.\n",
-+ printf("Exhaustive transaction retries (%d) occurred %d times.\n",
- MAX_TA_LOOPS, ta_loops);
-
-- return 0;
-+ return ret ? 3 : 0;
- }
-
- /*
---
-2.45.2
-
diff --git a/0039-LICENSES-Add-MIT-0-MIT-No-Attribution.patch b/0039-LICENSES-Add-MIT-0-MIT-No-Attribution.patch
deleted file mode 100644
index 8b2c4ec..0000000
--- a/0039-LICENSES-Add-MIT-0-MIT-No-Attribution.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 75b4f9474a1aa33a6f9e0986b51c390f9b38ae5a Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:08:11 +0200
-Subject: [PATCH 39/56] LICENSES: Add MIT-0 (MIT No Attribution)
-
-We are about to import code licensed under MIT-0. It's compatible for us to
-use, so identify it as a permitted license.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Acked-by: Christian Lindig <christian.lindig@cloud.com>
-master commit: 219cdff3fb7b4a03ab14869584f111e0f623b330
-master date: 2024-05-23 15:04:40 +0100
----
- LICENSES/MIT-0 | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
- create mode 100644 LICENSES/MIT-0
-
-diff --git a/LICENSES/MIT-0 b/LICENSES/MIT-0
-new file mode 100644
-index 0000000000..70fb90ee34
---- /dev/null
-+++ b/LICENSES/MIT-0
-@@ -0,0 +1,31 @@
-+Valid-License-Identifier: MIT-0
-+
-+SPDX-URL: https://spdx.org/licenses/MIT-0.html
-+
-+Usage-Guide:
-+
-+ To use the MIT-0 License put the following SPDX tag/value pair into a
-+ comment according to the placement guidelines in the licensing rules
-+ documentation:
-+ SPDX-License-Identifier: MIT-0
-+
-+License-Text:
-+
-+MIT No Attribution
-+
-+Copyright <year> <copyright holder>
-+
-+Permission is hereby granted, free of charge, to any person obtaining a copy
-+of this software and associated documentation files (the "Software"), to deal
-+in the Software without restriction, including without limitation the rights
-+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+copies of the Software, and to permit persons to whom the Software is
-+furnished to do so.
-+
-+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+SOFTWARE.
---
-2.45.2
-
diff --git a/0040-tools-Import-stand-alone-sd_notify-implementation-fr.patch b/0040-tools-Import-stand-alone-sd_notify-implementation-fr.patch
deleted file mode 100644
index 990158d..0000000
--- a/0040-tools-Import-stand-alone-sd_notify-implementation-fr.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 1743102a92479834c8e17b20697129e05b7c8313 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:10:10 +0200
-Subject: [PATCH 40/56] tools: Import stand-alone sd_notify() implementation
- from systemd
-
-... in order to avoid linking against the whole of libsystemd.
-
-Only minimal changes to the upstream copy, to function as a drop-in
-replacement for sd_notify() and as a header-only library.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Christian Lindig <christian.lindig@cloud.com>
-master commit: 78510f3a1522f2856330ffa429e0e35f8aab4277
-master date: 2024-05-23 15:04:40 +0100
-master commit: 78510f3a1522f2856330ffa429e0e35f8aab4277
-master date: 2024-05-23 15:04:40 +0100
----
- tools/include/xen-sd-notify.h | 98 +++++++++++++++++++++++++++++++++++
- 1 file changed, 98 insertions(+)
- create mode 100644 tools/include/xen-sd-notify.h
-
-diff --git a/tools/include/xen-sd-notify.h b/tools/include/xen-sd-notify.h
-new file mode 100644
-index 0000000000..28c9b20f15
---- /dev/null
-+++ b/tools/include/xen-sd-notify.h
-@@ -0,0 +1,98 @@
-+/* SPDX-License-Identifier: MIT-0 */
-+
-+/*
-+ * Implement the systemd notify protocol without external dependencies.
-+ * Supports both readiness notification on startup and on reloading,
-+ * according to the protocol defined at:
-+ * https://www.freedesktop.org/software/systemd/man/latest/sd_notify.html
-+ * This protocol is guaranteed to be stable as per:
-+ * https://systemd.io/PORTABILITY_AND_STABILITY/
-+ *
-+ * Differences from the upstream copy:
-+ * - Rename/rework as a drop-in replacement for systemd/sd-daemon.h
-+ * - Only take the subset Xen cares about
-+ * - Respect -Wdeclaration-after-statement
-+ */
-+
-+#ifndef XEN_SD_NOTIFY
-+#define XEN_SD_NOTIFY
-+
-+#include <errno.h>
-+#include <stddef.h>
-+#include <stdlib.h>
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <unistd.h>
-+
-+static inline void xen_sd_closep(int *fd) {
-+ if (!fd || *fd < 0)
-+ return;
-+
-+ close(*fd);
-+ *fd = -1;
-+}
-+
-+static inline int xen_sd_notify(const char *message) {
-+ union sockaddr_union {
-+ struct sockaddr sa;
-+ struct sockaddr_un sun;
-+ } socket_addr = {
-+ .sun.sun_family = AF_UNIX,
-+ };
-+ size_t path_length, message_length;
-+ ssize_t written;
-+ const char *socket_path;
-+ int __attribute__((cleanup(xen_sd_closep))) fd = -1;
-+
-+ /* Verify the argument first */
-+ if (!message)
-+ return -EINVAL;
-+
-+ message_length = strlen(message);
-+ if (message_length == 0)
-+ return -EINVAL;
-+
-+ /* If the variable is not set, the protocol is a noop */
-+ socket_path = getenv("NOTIFY_SOCKET");
-+ if (!socket_path)
-+ return 0; /* Not set? Nothing to do */
-+
-+ /* Only AF_UNIX is supported, with path or abstract sockets */
-+ if (socket_path[0] != '/' && socket_path[0] != '@')
-+ return -EAFNOSUPPORT;
-+
-+ path_length = strlen(socket_path);
-+ /* Ensure there is room for NUL byte */
-+ if (path_length >= sizeof(socket_addr.sun.sun_path))
-+ return -E2BIG;
-+
-+ memcpy(socket_addr.sun.sun_path, socket_path, path_length);
-+
-+ /* Support for abstract socket */
-+ if (socket_addr.sun.sun_path[0] == '@')
-+ socket_addr.sun.sun_path[0] = 0;
-+
-+ fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
-+ if (fd < 0)
-+ return -errno;
-+
-+ if (connect(fd, &socket_addr.sa, offsetof(struct sockaddr_un, sun_path) + path_length) != 0)
-+ return -errno;
-+
-+ written = write(fd, message, message_length);
-+ if (written != (ssize_t) message_length)
-+ return written < 0 ? -errno : -EPROTO;
-+
-+ return 1; /* Notified! */
-+}
-+
-+static inline int sd_notify(int unset_environment, const char *message) {
-+ int r = xen_sd_notify(message);
-+
-+ if (unset_environment)
-+ unsetenv("NOTIFY_SOCKET");
-+
-+ return r;
-+}
-+
-+#endif /* XEN_SD_NOTIFY */
---
-2.45.2
-
diff --git a/0041-tools-c-o-xenstored-Don-t-link-against-libsystemd.patch b/0041-tools-c-o-xenstored-Don-t-link-against-libsystemd.patch
deleted file mode 100644
index 5bf3f98..0000000
--- a/0041-tools-c-o-xenstored-Don-t-link-against-libsystemd.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 77cf215157d267a7776f3c4ec32e89064dcd84cd Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:10:29 +0200
-Subject: [PATCH 41/56] tools/{c,o}xenstored: Don't link against libsystemd
-
-Use the local freestanding wrapper instead.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Christian Lindig <christian.lindig@cloud.com>
-master commit: caf864482689a5dd6a945759b6372bb260d49665
-master date: 2024-05-23 15:04:40 +0100
----
- tools/ocaml/xenstored/Makefile | 3 +--
- tools/ocaml/xenstored/systemd_stubs.c | 2 +-
- tools/xenstored/Makefile | 5 -----
- tools/xenstored/core.c | 4 ++--
- 4 files changed, 4 insertions(+), 10 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/Makefile b/tools/ocaml/xenstored/Makefile
-index e8aaecf2e6..fa45305d8c 100644
---- a/tools/ocaml/xenstored/Makefile
-+++ b/tools/ocaml/xenstored/Makefile
-@@ -4,8 +4,7 @@ include $(OCAML_TOPLEVEL)/common.make
-
- # Include configure output (config.h)
- CFLAGS += -include $(XEN_ROOT)/tools/config.h
--CFLAGS-$(CONFIG_SYSTEMD) += $(SYSTEMD_CFLAGS)
--LDFLAGS-$(CONFIG_SYSTEMD) += $(SYSTEMD_LIBS)
-+CFLAGS-$(CONFIG_SYSTEMD) += $(CFLAGS_xeninclude)
-
- CFLAGS += $(CFLAGS-y)
- CFLAGS += $(APPEND_CFLAGS)
-diff --git a/tools/ocaml/xenstored/systemd_stubs.c b/tools/ocaml/xenstored/systemd_stubs.c
-index f4c875075a..7dbbdd35bf 100644
---- a/tools/ocaml/xenstored/systemd_stubs.c
-+++ b/tools/ocaml/xenstored/systemd_stubs.c
-@@ -25,7 +25,7 @@
-
- #if defined(HAVE_SYSTEMD)
-
--#include <systemd/sd-daemon.h>
-+#include <xen-sd-notify.h>
-
- CAMLprim value ocaml_sd_notify_ready(value ignore)
- {
-diff --git a/tools/xenstored/Makefile b/tools/xenstored/Makefile
-index e0897ed1ba..09adfe1d50 100644
---- a/tools/xenstored/Makefile
-+++ b/tools/xenstored/Makefile
-@@ -9,11 +9,6 @@ xenstored: LDLIBS += $(LDLIBS_libxenctrl)
- xenstored: LDLIBS += -lrt
- xenstored: LDLIBS += $(SOCKET_LIBS)
-
--ifeq ($(CONFIG_SYSTEMD),y)
--$(XENSTORED_OBJS-y): CFLAGS += $(SYSTEMD_CFLAGS)
--xenstored: LDLIBS += $(SYSTEMD_LIBS)
--endif
--
- TARGETS := xenstored
-
- .PHONY: all
-diff --git a/tools/xenstored/core.c b/tools/xenstored/core.c
-index edd07711db..dfe98e7bfc 100644
---- a/tools/xenstored/core.c
-+++ b/tools/xenstored/core.c
-@@ -61,7 +61,7 @@
- #endif
-
- #if defined(XEN_SYSTEMD_ENABLED)
--#include <systemd/sd-daemon.h>
-+#include <xen-sd-notify.h>
- #endif
-
- extern xenevtchn_handle *xce_handle; /* in domain.c */
-@@ -3000,7 +3000,7 @@ int main(int argc, char *argv[])
- #if defined(XEN_SYSTEMD_ENABLED)
- if (!live_update) {
- sd_notify(1, "READY=1");
-- fprintf(stderr, SD_NOTICE "xenstored is ready\n");
-+ fprintf(stderr, "xenstored is ready\n");
- }
- #endif
-
---
-2.45.2
-
diff --git a/0042-tools-Drop-libsystemd-as-a-dependency.patch b/0042-tools-Drop-libsystemd-as-a-dependency.patch
deleted file mode 100644
index 168680e..0000000
--- a/0042-tools-Drop-libsystemd-as-a-dependency.patch
+++ /dev/null
@@ -1,648 +0,0 @@
-From 7967bd358e93ed83e01813a8d0dfd68aa67f5780 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:10:40 +0200
-Subject: [PATCH 42/56] tools: Drop libsystemd as a dependency
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There are no more users, and we want to disuade people from introducing new
-users just for sd_notify() and friends. Drop the dependency.
-
-We still want the overall --with{,out}-systemd to gate the generation of the
-service/unit/mount/etc files.
-
-Rerun autogen.sh, and mark the dependency as removed in the build containers.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Christian Lindig <christian.lindig@cloud.com>
-
-tools: (Actually) drop libsystemd as a dependency
-
-When reinstating some of systemd.m4 between v1 and v2, I reintroduced a little
-too much. While {c,o}xenstored are indeed no longer linked against
-libsystemd, ./configure still looks for it.
-
-Drop this too.
-
-Fixes: ae26101f6bfc ("tools: Drop libsystemd as a dependency")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: ae26101f6bfc8185adcdb9165d469bdc467780db
-master date: 2024-05-23 15:04:40 +0100
-master commit: 6ef4fa1e7fe78c1dae07b451292b07facfce4902
-master date: 2024-05-30 12:15:25 +0100
----
- CHANGELOG.md | 7 +-
- config/Tools.mk.in | 2 -
- m4/systemd.m4 | 17 --
- tools/configure | 485 +--------------------------------------------
- 4 files changed, 7 insertions(+), 504 deletions(-)
-
-diff --git a/CHANGELOG.md b/CHANGELOG.md
-index fa54d59df1..ceca12eb5f 100644
---- a/CHANGELOG.md
-+++ b/CHANGELOG.md
-@@ -4,7 +4,12 @@ Notable changes to Xen will be documented in this file.
-
- The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
-
--## [4.18.2](https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.18.2)
-+## [4.18.3](https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.18.3)
-+
-+### Changed
-+ - When building with Systemd support (./configure --enable-systemd), remove
-+ libsystemd as a build dependency. Systemd Notify support is retained, now
-+ using a standalone library implementation.
-
- ## [4.18.1](https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.18.1)
-
-diff --git a/config/Tools.mk.in b/config/Tools.mk.in
-index b54ab21f96..50fbef841f 100644
---- a/config/Tools.mk.in
-+++ b/config/Tools.mk.in
-@@ -52,8 +52,6 @@ CONFIG_PYGRUB := @pygrub@
- CONFIG_LIBFSIMAGE := @libfsimage@
-
- CONFIG_SYSTEMD := @systemd@
--SYSTEMD_CFLAGS := @SYSTEMD_CFLAGS@
--SYSTEMD_LIBS := @SYSTEMD_LIBS@
- XEN_SYSTEMD_DIR := @SYSTEMD_DIR@
- XEN_SYSTEMD_MODULES_LOAD := @SYSTEMD_MODULES_LOAD@
- CONFIG_9PFS := @ninepfs@
-diff --git a/m4/systemd.m4 b/m4/systemd.m4
-index 112dc11b5e..ab12ea313d 100644
---- a/m4/systemd.m4
-+++ b/m4/systemd.m4
-@@ -41,15 +41,6 @@ AC_DEFUN([AX_ALLOW_SYSTEMD_OPTS], [
- ])
-
- AC_DEFUN([AX_CHECK_SYSTEMD_LIBS], [
-- PKG_CHECK_MODULES([SYSTEMD], [libsystemd-daemon],,
-- [PKG_CHECK_MODULES([SYSTEMD], [libsystemd >= 209])]
-- )
-- dnl pkg-config older than 0.24 does not set these for
-- dnl PKG_CHECK_MODULES() worth also noting is that as of version 208
-- dnl of systemd pkg-config --cflags currently yields no extra flags yet.
-- AC_SUBST([SYSTEMD_CFLAGS])
-- AC_SUBST([SYSTEMD_LIBS])
--
- AS_IF([test "x$SYSTEMD_DIR" = x], [
- dnl In order to use the line below we need to fix upstream systemd
- dnl to properly ${prefix} for child variables in
-@@ -95,13 +86,6 @@ AC_DEFUN([AX_CHECK_SYSTEMD], [
- ],[systemd=n])
- ])
-
--AC_DEFUN([AX_CHECK_SYSTEMD_ENABLE_AVAILABLE], [
-- PKG_CHECK_MODULES([SYSTEMD], [libsystemd-daemon], [systemd="y"],[
-- PKG_CHECK_MODULES([SYSTEMD], [libsystemd >= 209],
-- [systemd="y"],[systemd="n"])
-- ])
--])
--
- dnl Enables systemd by default and requires a --disable-systemd option flag
- dnl to configure if you want to disable.
- AC_DEFUN([AX_ENABLE_SYSTEMD], [
-@@ -121,6 +105,5 @@ dnl to have systemd build libraries it will be enabled. You can always force
- dnl disable with --disable-systemd
- AC_DEFUN([AX_AVAILABLE_SYSTEMD], [
- AX_ALLOW_SYSTEMD_OPTS()
-- AX_CHECK_SYSTEMD_ENABLE_AVAILABLE()
- AX_CHECK_SYSTEMD()
- ])
-diff --git a/tools/configure b/tools/configure
-index 38c0808d3a..7bb935d23b 100755
---- a/tools/configure
-+++ b/tools/configure
-@@ -626,8 +626,6 @@ ac_subst_vars='LTLIBOBJS
- LIBOBJS
- pvshim
- ninepfs
--SYSTEMD_LIBS
--SYSTEMD_CFLAGS
- SYSTEMD_MODULES_LOAD
- SYSTEMD_DIR
- systemd
-@@ -864,9 +862,7 @@ pixman_LIBS
- libzstd_CFLAGS
- libzstd_LIBS
- LIBNL3_CFLAGS
--LIBNL3_LIBS
--SYSTEMD_CFLAGS
--SYSTEMD_LIBS'
-+LIBNL3_LIBS'
-
-
- # Initialize some variables set by options.
-@@ -1621,10 +1617,6 @@ Some influential environment variables:
- LIBNL3_CFLAGS
- C compiler flags for LIBNL3, overriding pkg-config
- LIBNL3_LIBS linker flags for LIBNL3, overriding pkg-config
-- SYSTEMD_CFLAGS
-- C compiler flags for SYSTEMD, overriding pkg-config
-- SYSTEMD_LIBS
-- linker flags for SYSTEMD, overriding pkg-config
-
- Use these variables to override the choices made by `configure' or to help
- it to find libraries and programs with nonstandard names/locations.
-@@ -3889,8 +3881,6 @@ esac
-
-
-
--
--
-
-
-
-@@ -9540,223 +9530,6 @@ fi
-
-
-
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd-daemon" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd-daemon" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
--
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
-- systemd="n"
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
-- systemd="n"
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
-- systemd="y"
--fi
--
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
-- systemd="n"
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
-- systemd="n"
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
-- systemd="y"
--fi
--
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
-- systemd="y"
--fi
--
--
- if test "x$enable_systemd" != "xno"; then :
-
- if test "x$systemd" = "xy" ; then :
-@@ -9766,262 +9539,6 @@ $as_echo "#define HAVE_SYSTEMD 1" >>confdefs.h
-
- systemd=y
-
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd-daemon" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd-daemon" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
-- as_fn_error $? "Package requirements (libsystemd >= 209) were not met:
--
--$SYSTEMD_PKG_ERRORS
--
--Consider adjusting the PKG_CONFIG_PATH environment variable if you
--installed software in a non-standard prefix.
--
--Alternatively, you may set the environment variables SYSTEMD_CFLAGS
--and SYSTEMD_LIBS to avoid the need to call pkg-config.
--See the pkg-config man page for more details." "$LINENO" 5
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
--$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
--as_fn_error $? "The pkg-config script could not be found or is too old. Make sure it
--is in your PATH or set the PKG_CONFIG environment variable to the full
--path to pkg-config.
--
--Alternatively, you may set the environment variables SYSTEMD_CFLAGS
--and SYSTEMD_LIBS to avoid the need to call pkg-config.
--See the pkg-config man page for more details.
--
--To get pkg-config, see <http://pkg-config.freedesktop.org/>.
--See \`config.log' for more details" "$LINENO" 5; }
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
--
--fi
--
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--pkg_failed=no
--{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
--$as_echo_n "checking for SYSTEMD... " >&6; }
--
--if test -n "$SYSTEMD_CFLAGS"; then
-- pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--if test -n "$SYSTEMD_LIBS"; then
-- pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
-- elif test -n "$PKG_CONFIG"; then
-- if test -n "$PKG_CONFIG" && \
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd >= 209\""; } >&5
-- ($PKG_CONFIG --exists --print-errors "libsystemd >= 209") 2>&5
-- ac_status=$?
-- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-- test $ac_status = 0; }; then
-- pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd >= 209" 2>/dev/null`
-- test "x$?" != "x0" && pkg_failed=yes
--else
-- pkg_failed=yes
--fi
-- else
-- pkg_failed=untried
--fi
--
--
--
--if test $pkg_failed = yes; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
--
--if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-- _pkg_short_errors_supported=yes
--else
-- _pkg_short_errors_supported=no
--fi
-- if test $_pkg_short_errors_supported = yes; then
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- else
-- SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd >= 209" 2>&1`
-- fi
-- # Put the nasty error message in config.log where it belongs
-- echo "$SYSTEMD_PKG_ERRORS" >&5
--
-- as_fn_error $? "Package requirements (libsystemd >= 209) were not met:
--
--$SYSTEMD_PKG_ERRORS
--
--Consider adjusting the PKG_CONFIG_PATH environment variable if you
--installed software in a non-standard prefix.
--
--Alternatively, you may set the environment variables SYSTEMD_CFLAGS
--and SYSTEMD_LIBS to avoid the need to call pkg-config.
--See the pkg-config man page for more details." "$LINENO" 5
--elif test $pkg_failed = untried; then
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
--$as_echo "no" >&6; }
-- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
--$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
--as_fn_error $? "The pkg-config script could not be found or is too old. Make sure it
--is in your PATH or set the PKG_CONFIG environment variable to the full
--path to pkg-config.
--
--Alternatively, you may set the environment variables SYSTEMD_CFLAGS
--and SYSTEMD_LIBS to avoid the need to call pkg-config.
--See the pkg-config man page for more details.
--
--To get pkg-config, see <http://pkg-config.freedesktop.org/>.
--See \`config.log' for more details" "$LINENO" 5; }
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
--
--fi
--
--else
-- SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
-- SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
--
--fi
--
--
--
- if test "x$SYSTEMD_DIR" = x; then :
-
- SYSTEMD_DIR="\$(prefix)/lib/systemd/system/"
---
-2.45.2
-
diff --git a/0043-x86-ioapic-Fix-signed-shifts-in-io_apic.c.patch b/0043-x86-ioapic-Fix-signed-shifts-in-io_apic.c.patch
deleted file mode 100644
index c368c1d..0000000
--- a/0043-x86-ioapic-Fix-signed-shifts-in-io_apic.c.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 0dc5fbee17cd2bcb1aa6a1cf420dd80381587de8 Mon Sep 17 00:00:00 2001
-From: Matthew Barnes <matthew.barnes@cloud.com>
-Date: Thu, 4 Jul 2024 14:11:03 +0200
-Subject: [PATCH 43/56] x86/ioapic: Fix signed shifts in io_apic.c
-
-There exists bitshifts in the IOAPIC code where signed integers are
-shifted to the left by up to 31 bits, which is undefined behaviour.
-
-This patch fixes this by changing the integers from signed to unsigned.
-
-Signed-off-by: Matthew Barnes <matthew.barnes@cloud.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: c5746b021e573184fb92b601a0e93a295485054e
-master date: 2024-06-21 15:09:26 +0100
----
- xen/arch/x86/io_apic.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c
-index 0ef61fb2f1..c5342789e8 100644
---- a/xen/arch/x86/io_apic.c
-+++ b/xen/arch/x86/io_apic.c
-@@ -1692,7 +1692,8 @@ static void cf_check mask_and_ack_level_ioapic_irq(struct irq_desc *desc)
- !io_apic_level_ack_pending(desc->irq))
- move_masked_irq(desc);
-
-- if ( !(v & (1 << (i & 0x1f))) ) {
-+ if ( !(v & (1U << (i & 0x1f))) )
-+ {
- spin_lock(&ioapic_lock);
- __edge_IO_APIC_irq(desc->irq);
- __level_IO_APIC_irq(desc->irq);
-@@ -1756,7 +1757,8 @@ static void cf_check end_level_ioapic_irq_new(struct irq_desc *desc, u8 vector)
- !io_apic_level_ack_pending(desc->irq) )
- move_native_irq(desc);
-
-- if (!(v & (1 << (i & 0x1f)))) {
-+ if ( !(v & (1U << (i & 0x1f))) )
-+ {
- spin_lock(&ioapic_lock);
- __mask_IO_APIC_irq(desc->irq);
- __edge_IO_APIC_irq(desc->irq);
---
-2.45.2
-
diff --git a/0044-tools-xl-Open-xldevd.log-with-O_CLOEXEC.patch b/0044-tools-xl-Open-xldevd.log-with-O_CLOEXEC.patch
deleted file mode 100644
index 39dc3eb..0000000
--- a/0044-tools-xl-Open-xldevd.log-with-O_CLOEXEC.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 2b3bf02c4f5e44d7d7bd3636530c9ebc837dea87 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:11:36 +0200
-Subject: [PATCH 44/56] tools/xl: Open xldevd.log with O_CLOEXEC
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-`xl devd` has been observed leaking /var/log/xldevd.log into children.
-
-Note this is specifically safe; dup2() leaves O_CLOEXEC disabled on newfd, so
-after setting up stdout/stderr, it's only the logfile fd which will close on
-exec().
-
-Link: https://github.com/QubesOS/qubes-issues/issues/8292
-Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
-Reviewed-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: ba52b3b624e4a1a976908552364eba924ca45430
-master date: 2024-06-24 16:22:59 +0100
----
- tools/xl/xl_utils.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/tools/xl/xl_utils.c b/tools/xl/xl_utils.c
-index 17489d1829..b0d23b2cdb 100644
---- a/tools/xl/xl_utils.c
-+++ b/tools/xl/xl_utils.c
-@@ -27,6 +27,10 @@
- #include "xl.h"
- #include "xl_utils.h"
-
-+#ifndef O_CLOEXEC
-+#define O_CLOEXEC 0
-+#endif
-+
- void dolog(const char *file, int line, const char *func, const char *fmt, ...)
- {
- va_list ap;
-@@ -270,7 +274,7 @@ int do_daemonize(const char *name, const char *pidfile)
- exit(-1);
- }
-
-- CHK_SYSCALL(logfile = open(fullname, O_WRONLY|O_CREAT|O_APPEND, 0644));
-+ CHK_SYSCALL(logfile = open(fullname, O_WRONLY | O_CREAT | O_APPEND | O_CLOEXEC, 0644));
- free(fullname);
- assert(logfile >= 3);
-
---
-2.45.2
-
diff --git a/0045-pirq_cleanup_check-leaks.patch b/0045-pirq_cleanup_check-leaks.patch
deleted file mode 100644
index dcf96c7..0000000
--- a/0045-pirq_cleanup_check-leaks.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From c9f50d2c5f29b630603e2b95f29e5b6e416a6187 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Thu, 4 Jul 2024 14:11:57 +0200
-Subject: [PATCH 45/56] pirq_cleanup_check() leaks
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Its original introduction had two issues: For one the "common" part of
-the checks (carried out in the macro) was inverted. And then after
-removal from the radix tree the structure wasn't scheduled for freeing.
-(All structures still left in the radix tree would be freed upon domain
-destruction, though.)
-
-For the freeing to be safe even if it didn't use RCU (i.e. to avoid use-
-after-free), re-arrange checks/operations in evtchn_close(), such that
-the pointer wouldn't be used anymore after calling pirq_cleanup_check()
-(noting that unmap_domain_pirq_emuirq() itself calls the function in the
-success case).
-
-Fixes: c24536b636f2 ("replace d->nr_pirqs sized arrays with radix tree")
-Fixes: 79858fee307c ("xen: fix hvm_domain_use_pirq's behavior")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: daa90dfea9175c07f13d1a2d901857b2dd14d080
-master date: 2024-07-02 08:35:56 +0200
----
- xen/arch/x86/irq.c | 1 +
- xen/common/event_channel.c | 11 ++++++++---
- xen/include/xen/irq.h | 2 +-
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index 290f8d26e7..00be3b88e8 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -1413,6 +1413,7 @@ void (pirq_cleanup_check)(struct pirq *pirq, struct domain *d)
-
- if ( radix_tree_delete(&d->pirq_tree, pirq->pirq) != pirq )
- BUG();
-+ free_pirq_struct(pirq);
- }
-
- /* Flush all ready EOIs from the top of this CPU's pending-EOI stack. */
-diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
-index 66f924a7b0..b1a6215c37 100644
---- a/xen/common/event_channel.c
-+++ b/xen/common/event_channel.c
-@@ -705,11 +705,16 @@ int evtchn_close(struct domain *d1, int port1, bool guest)
- if ( !is_hvm_domain(d1) )
- pirq_guest_unbind(d1, pirq);
- pirq->evtchn = 0;
-- pirq_cleanup_check(pirq, d1);
- #ifdef CONFIG_X86
-- if ( is_hvm_domain(d1) && domain_pirq_to_irq(d1, pirq->pirq) > 0 )
-- unmap_domain_pirq_emuirq(d1, pirq->pirq);
-+ if ( !is_hvm_domain(d1) ||
-+ domain_pirq_to_irq(d1, pirq->pirq) <= 0 ||
-+ unmap_domain_pirq_emuirq(d1, pirq->pirq) < 0 )
-+ /*
-+ * The successful path of unmap_domain_pirq_emuirq() will have
-+ * called pirq_cleanup_check() already.
-+ */
- #endif
-+ pirq_cleanup_check(pirq, d1);
- }
- unlink_pirq_port(chn1, d1->vcpu[chn1->notify_vcpu_id]);
- break;
-diff --git a/xen/include/xen/irq.h b/xen/include/xen/irq.h
-index 65083135e1..5dcd2d8f0c 100644
---- a/xen/include/xen/irq.h
-+++ b/xen/include/xen/irq.h
-@@ -180,7 +180,7 @@ extern struct pirq *pirq_get_info(struct domain *d, int pirq);
- void pirq_cleanup_check(struct pirq *pirq, struct domain *d);
-
- #define pirq_cleanup_check(pirq, d) \
-- ((pirq)->evtchn ? pirq_cleanup_check(pirq, d) : (void)0)
-+ (!(pirq)->evtchn ? pirq_cleanup_check(pirq, d) : (void)0)
-
- extern void pirq_guest_eoi(struct pirq *pirq);
- extern void desc_guest_eoi(struct irq_desc *desc, struct pirq *pirq);
---
-2.45.2
-
diff --git a/0046-tools-dombuilder-Correct-the-length-calculation-in-x.patch b/0046-tools-dombuilder-Correct-the-length-calculation-in-x.patch
deleted file mode 100644
index b25f15d..0000000
--- a/0046-tools-dombuilder-Correct-the-length-calculation-in-x.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 8e51c8f1d45fad242a315fa17ba3582c02e66840 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:12:31 +0200
-Subject: [PATCH 46/56] tools/dombuilder: Correct the length calculation in
- xc_dom_alloc_segment()
-
-xc_dom_alloc_segment() is passed a size in bytes, calculates a size in pages
-from it, then fills in the new segment information with a bytes value
-re-calculated from the number of pages.
-
-This causes the module information given to the guest (MB, or PVH) to have
-incorrect sizes; specifically, sizes rounded up to the next page.
-
-This in turn is problematic for Xen. When Xen finds a gzipped module, it
-peeks at the end metadata to judge the decompressed size, which is a -4
-backreference from the reported end of the module.
-
-Fill in seg->vend using the correct number of bytes.
-
-Fixes: ea7c8a3d0e82 ("libxc: reorganize domain builder guest memory allocator")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: 4c3a618b0adaa0cd59e0fa0898bb60978b8b3a5f
-master date: 2024-07-02 10:50:18 +0100
----
- tools/libs/guest/xg_dom_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/libs/guest/xg_dom_core.c b/tools/libs/guest/xg_dom_core.c
-index c4f4e7f3e2..f5521d528b 100644
---- a/tools/libs/guest/xg_dom_core.c
-+++ b/tools/libs/guest/xg_dom_core.c
-@@ -601,7 +601,7 @@ int xc_dom_alloc_segment(struct xc_dom_image *dom,
- memset(ptr, 0, pages * page_size);
-
- seg->vstart = start;
-- seg->vend = dom->virt_alloc_end;
-+ seg->vend = start + size;
-
- DOMPRINTF("%-20s: %-12s : 0x%" PRIx64 " -> 0x%" PRIx64
- " (pfn 0x%" PRIpfn " + 0x%" PRIpfn " pages)",
---
-2.45.2
-
diff --git a/0047-tools-libxs-Fix-CLOEXEC-handling-in-get_dev.patch b/0047-tools-libxs-Fix-CLOEXEC-handling-in-get_dev.patch
deleted file mode 100644
index aabae58..0000000
--- a/0047-tools-libxs-Fix-CLOEXEC-handling-in-get_dev.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From d1b3bbb46402af77089906a97c413c14ed1740d2 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:13:10 +0200
-Subject: [PATCH 47/56] tools/libxs: Fix CLOEXEC handling in get_dev()
-
-Move the O_CLOEXEC compatibility outside of an #ifdef USE_PTHREAD block.
-
-Introduce set_cloexec() to wrap fcntl() setting FD_CLOEXEC. It will be reused
-for other CLOEXEC fixes too.
-
-Use set_cloexec() when O_CLOEXEC isn't available as a best-effort fallback.
-
-Fixes: f4f2f3402b2f ("tools/libxs: Open /dev/xen/xenbus fds as O_CLOEXEC")
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: bf7c1464706adfa903f1e7d59383d042c3a88e39
-master date: 2024-07-02 10:51:06 +0100
----
- tools/libs/store/xs.c | 38 ++++++++++++++++++++++++++++++++------
- 1 file changed, 32 insertions(+), 6 deletions(-)
-
-diff --git a/tools/libs/store/xs.c b/tools/libs/store/xs.c
-index 1498515073..037e79d98b 100644
---- a/tools/libs/store/xs.c
-+++ b/tools/libs/store/xs.c
-@@ -40,6 +40,10 @@
- #include <xentoolcore_internal.h>
- #include <xen_list.h>
-
-+#ifndef O_CLOEXEC
-+#define O_CLOEXEC 0
-+#endif
-+
- struct xs_stored_msg {
- XEN_TAILQ_ENTRY(struct xs_stored_msg) list;
- struct xsd_sockmsg hdr;
-@@ -54,10 +58,6 @@ struct xs_stored_msg {
- #include <dlfcn.h>
- #endif
-
--#ifndef O_CLOEXEC
--#define O_CLOEXEC 0
--#endif
--
- struct xs_handle {
- /* Communications channel to xenstore daemon. */
- int fd;
-@@ -176,6 +176,16 @@ static bool setnonblock(int fd, int nonblock) {
- return true;
- }
-
-+static bool set_cloexec(int fd)
-+{
-+ int flags = fcntl(fd, F_GETFL);
-+
-+ if (flags < 0)
-+ return false;
-+
-+ return fcntl(fd, flags | FD_CLOEXEC) >= 0;
-+}
-+
- int xs_fileno(struct xs_handle *h)
- {
- char c = 0;
-@@ -230,8 +240,24 @@ error:
-
- static int get_dev(const char *connect_to)
- {
-- /* We cannot open read-only because requests are writes */
-- return open(connect_to, O_RDWR | O_CLOEXEC);
-+ int fd, saved_errno;
-+
-+ fd = open(connect_to, O_RDWR | O_CLOEXEC);
-+ if (fd < 0)
-+ return -1;
-+
-+ /* Compat for non-O_CLOEXEC environments. Racy. */
-+ if (!O_CLOEXEC && !set_cloexec(fd))
-+ goto error;
-+
-+ return fd;
-+
-+error:
-+ saved_errno = errno;
-+ close(fd);
-+ errno = saved_errno;
-+
-+ return -1;
- }
-
- static int all_restrict_cb(Xentoolcore__Active_Handle *ah, domid_t domid) {
---
-2.45.2
-
diff --git a/0048-tools-libxs-Fix-CLOEXEC-handling-in-get_socket.patch b/0048-tools-libxs-Fix-CLOEXEC-handling-in-get_socket.patch
deleted file mode 100644
index e01a6b4..0000000
--- a/0048-tools-libxs-Fix-CLOEXEC-handling-in-get_socket.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From d689bb4d2cd3ccdb0067b0ca953cccbc5ab375ae Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:13:18 +0200
-Subject: [PATCH 48/56] tools/libxs: Fix CLOEXEC handling in get_socket()
-
-get_socket() opens a socket, then uses fcntl() to set CLOEXEC. This is racy
-with exec().
-
-Open the socket with SOCK_CLOEXEC. Use the same compatibility strategy as
-O_CLOEXEC on ancient versions of Linux.
-
-Reported-by: Frediano Ziglio <frediano.ziglio@cloud.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: 1957dd6aff931877fc22699d8f2d4be8728014ba
-master date: 2024-07-02 10:51:11 +0100
----
- tools/libs/store/xs.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/tools/libs/store/xs.c b/tools/libs/store/xs.c
-index 037e79d98b..11a766c508 100644
---- a/tools/libs/store/xs.c
-+++ b/tools/libs/store/xs.c
-@@ -44,6 +44,10 @@
- #define O_CLOEXEC 0
- #endif
-
-+#ifndef SOCK_CLOEXEC
-+#define SOCK_CLOEXEC 0
-+#endif
-+
- struct xs_stored_msg {
- XEN_TAILQ_ENTRY(struct xs_stored_msg) list;
- struct xsd_sockmsg hdr;
-@@ -207,16 +211,14 @@ int xs_fileno(struct xs_handle *h)
- static int get_socket(const char *connect_to)
- {
- struct sockaddr_un addr;
-- int sock, saved_errno, flags;
-+ int sock, saved_errno;
-
-- sock = socket(PF_UNIX, SOCK_STREAM, 0);
-+ sock = socket(PF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
- if (sock < 0)
- return -1;
-
-- if ((flags = fcntl(sock, F_GETFD)) < 0)
-- goto error;
-- flags |= FD_CLOEXEC;
-- if (fcntl(sock, F_SETFD, flags) < 0)
-+ /* Compat for non-SOCK_CLOEXEC environments. Racy. */
-+ if (!SOCK_CLOEXEC && !set_cloexec(sock))
- goto error;
-
- addr.sun_family = AF_UNIX;
---
-2.45.2
-
diff --git a/0049-tools-libxs-Fix-CLOEXEC-handling-in-xs_fileno.patch b/0049-tools-libxs-Fix-CLOEXEC-handling-in-xs_fileno.patch
deleted file mode 100644
index 564cece..0000000
--- a/0049-tools-libxs-Fix-CLOEXEC-handling-in-xs_fileno.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From 26b8ff1861a870e01456b31bf999f25df5538ebf Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 4 Jul 2024 14:13:30 +0200
-Subject: [PATCH 49/56] tools/libxs: Fix CLOEXEC handling in xs_fileno()
-
-xs_fileno() opens a pipe on first use to communicate between the watch thread
-and the main thread. Nothing ever sets CLOEXEC on the file descriptors.
-
-Check for the availability of the pipe2() function with configure. Despite
-starting life as Linux-only, FreeBSD and NetBSD have gained it.
-
-When pipe2() isn't available, try our best with pipe() and set_cloexec().
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: a2ff677852f0ce05fa335e8e5682bf2ae0c916ee
-master date: 2024-07-02 10:52:59 +0100
----
- tools/config.h.in | 3 +++
- tools/configure | 12 ++++++++++++
- tools/configure.ac | 2 ++
- tools/libs/store/xs.c | 16 +++++++++++++++-
- 4 files changed, 32 insertions(+), 1 deletion(-)
-
-diff --git a/tools/config.h.in b/tools/config.h.in
-index 0bb2fe08a1..50ad60fcb0 100644
---- a/tools/config.h.in
-+++ b/tools/config.h.in
-@@ -39,6 +39,9 @@
- /* Define to 1 if you have the <memory.h> header file. */
- #undef HAVE_MEMORY_H
-
-+/* Define to 1 if you have the `pipe2' function. */
-+#undef HAVE_PIPE2
-+
- /* pygrub enabled */
- #undef HAVE_PYGRUB
-
-diff --git a/tools/configure b/tools/configure
-index 7bb935d23b..e35112b5c5 100755
---- a/tools/configure
-+++ b/tools/configure
-@@ -9751,6 +9751,18 @@ if test "$ax_found" = "0"; then :
- fi
-
-
-+for ac_func in pipe2
-+do :
-+ ac_fn_c_check_func "$LINENO" "pipe2" "ac_cv_func_pipe2"
-+if test "x$ac_cv_func_pipe2" = xyes; then :
-+ cat >>confdefs.h <<_ACEOF
-+#define HAVE_PIPE2 1
-+_ACEOF
-+
-+fi
-+done
-+
-+
- cat >confcache <<\_ACEOF
- # This file is a shell script that caches the results of configure
- # tests run on this system so they can be shared between configure
-diff --git a/tools/configure.ac b/tools/configure.ac
-index 618ef8c63f..53ac20af1e 100644
---- a/tools/configure.ac
-+++ b/tools/configure.ac
-@@ -543,4 +543,6 @@ AS_IF([test "x$pvshim" = "xy"], [
-
- AX_FIND_HEADER([INCLUDE_ENDIAN_H], [endian.h sys/endian.h])
-
-+AC_CHECK_FUNCS([pipe2])
-+
- AC_OUTPUT()
-diff --git a/tools/libs/store/xs.c b/tools/libs/store/xs.c
-index 11a766c508..c8845b69e2 100644
---- a/tools/libs/store/xs.c
-+++ b/tools/libs/store/xs.c
-@@ -190,13 +190,27 @@ static bool set_cloexec(int fd)
- return fcntl(fd, flags | FD_CLOEXEC) >= 0;
- }
-
-+static int pipe_cloexec(int fds[2])
-+{
-+#if HAVE_PIPE2
-+ return pipe2(fds, O_CLOEXEC);
-+#else
-+ if (pipe(fds) < 0)
-+ return -1;
-+ /* Best effort to set CLOEXEC. Racy. */
-+ set_cloexec(fds[0]);
-+ set_cloexec(fds[1]);
-+ return 0;
-+#endif
-+}
-+
- int xs_fileno(struct xs_handle *h)
- {
- char c = 0;
-
- mutex_lock(&h->watch_mutex);
-
-- if ((h->watch_pipe[0] == -1) && (pipe(h->watch_pipe) != -1)) {
-+ if ((h->watch_pipe[0] == -1) && (pipe_cloexec(h->watch_pipe) != -1)) {
- /* Kick things off if the watch list is already non-empty. */
- if (!XEN_TAILQ_EMPTY(&h->watch_list))
- while (write(h->watch_pipe[1], &c, 1) != 1)
---
-2.45.2
-
diff --git a/0050-cmdline-document-and-enforce-extra_guest_irqs-upper-.patch b/0050-cmdline-document-and-enforce-extra_guest_irqs-upper-.patch
deleted file mode 100644
index f7f61e8..0000000
--- a/0050-cmdline-document-and-enforce-extra_guest_irqs-upper-.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From 30c695ddaf067cbe7a98037474e7910109238807 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Thu, 4 Jul 2024 14:14:16 +0200
-Subject: [PATCH 50/56] cmdline: document and enforce "extra_guest_irqs" upper
- bounds
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-PHYSDEVOP_pirq_eoi_gmfn_v<N> accepting just a single GFN implies that no
-more than 32k pIRQ-s can be used by a domain on x86. Document this upper
-bound.
-
-To also enforce the limit, (ab)use both arch_hwdom_irqs() (changing its
-parameter type) and setup_system_domains(). This is primarily to avoid
-exposing the two static variables or introducing yet further arch hooks.
-
-While touching arch_hwdom_irqs() also mark it hwdom-init.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Acked-by: Roger Pau Monné <roger.pau@citrix.com>
-
-amend 'cmdline: document and enforce "extra_guest_irqs" upper bounds'
-
-Address late review comments for what is now commit 17f6d398f765:
-- bound max_irqs right away against nr_irqs
-- introduce a #define for a constant used twice
-
-Requested-by: Roger Pau Monné <roger.pau@citrix.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 17f6d398f76597f8009ec0530842fb8705ece7ba
-master date: 2024-07-02 12:00:27 +0200
-master commit: 1f56accba33ffea0abf7d1c6384710823d10cbd6
-master date: 2024-07-03 14:03:27 +0200
----
- docs/misc/xen-command-line.pandoc | 3 ++-
- xen/arch/x86/io_apic.c | 17 ++++++++++-------
- xen/common/domain.c | 24 ++++++++++++++++++++++--
- xen/include/xen/irq.h | 3 ++-
- 4 files changed, 36 insertions(+), 11 deletions(-)
-
-diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
-index 10a09bbf23..d857bd0f89 100644
---- a/docs/misc/xen-command-line.pandoc
-+++ b/docs/misc/xen-command-line.pandoc
-@@ -1175,7 +1175,8 @@ common for all domUs, while the optional second number (preceded by a comma)
- is for dom0. Changing the setting for domU has no impact on dom0 and vice
- versa. For example to change dom0 without changing domU, use
- `extra_guest_irqs=,512`. The default value for Dom0 and an eventual separate
--hardware domain is architecture dependent.
-+hardware domain is architecture dependent. The upper limit for both values on
-+x86 is such that the resulting total number of IRQs can't be higher than 32768.
- Note that specifying zero as domU value means zero, while for dom0 it means
- to use the default.
-
-diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c
-index c5342789e8..f7591fd091 100644
---- a/xen/arch/x86/io_apic.c
-+++ b/xen/arch/x86/io_apic.c
-@@ -2664,18 +2664,21 @@ void __init ioapic_init(void)
- nr_irqs_gsi, nr_irqs - nr_irqs_gsi);
- }
-
--unsigned int arch_hwdom_irqs(domid_t domid)
-+unsigned int __hwdom_init arch_hwdom_irqs(const struct domain *d)
- {
- unsigned int n = fls(num_present_cpus());
-+ /* Bounding by the domain pirq EOI bitmap capacity. */
-+ const unsigned int max_irqs = min_t(unsigned int, nr_irqs,
-+ PAGE_SIZE * BITS_PER_BYTE);
-
-- if ( !domid )
-- n = min(n, dom0_max_vcpus());
-- n = min(nr_irqs_gsi + n * NR_DYNAMIC_VECTORS, nr_irqs);
-+ if ( is_system_domain(d) )
-+ return max_irqs;
-
-- /* Bounded by the domain pirq eoi bitmap gfn. */
-- n = min_t(unsigned int, n, PAGE_SIZE * BITS_PER_BYTE);
-+ if ( !d->domain_id )
-+ n = min(n, dom0_max_vcpus());
-+ n = min(nr_irqs_gsi + n * NR_DYNAMIC_VECTORS, max_irqs);
-
-- printk("Dom%d has maximum %u PIRQs\n", domid, n);
-+ printk("%pd has maximum %u PIRQs\n", d, n);
-
- return n;
- }
-diff --git a/xen/common/domain.c b/xen/common/domain.c
-index 003f4ab125..62832a5860 100644
---- a/xen/common/domain.c
-+++ b/xen/common/domain.c
-@@ -351,7 +351,8 @@ static int late_hwdom_init(struct domain *d)
- }
-
- static unsigned int __read_mostly extra_hwdom_irqs;
--static unsigned int __read_mostly extra_domU_irqs = 32;
-+#define DEFAULT_EXTRA_DOMU_IRQS 32U
-+static unsigned int __read_mostly extra_domU_irqs = DEFAULT_EXTRA_DOMU_IRQS;
-
- static int __init cf_check parse_extra_guest_irqs(const char *s)
- {
-@@ -688,7 +689,7 @@ struct domain *domain_create(domid_t domid,
- d->nr_pirqs = nr_static_irqs + extra_domU_irqs;
- else
- d->nr_pirqs = extra_hwdom_irqs ? nr_static_irqs + extra_hwdom_irqs
-- : arch_hwdom_irqs(domid);
-+ : arch_hwdom_irqs(d);
- d->nr_pirqs = min(d->nr_pirqs, nr_irqs);
-
- radix_tree_init(&d->pirq_tree);
-@@ -812,6 +813,25 @@ void __init setup_system_domains(void)
- if ( IS_ERR(dom_xen) )
- panic("Failed to create d[XEN]: %ld\n", PTR_ERR(dom_xen));
-
-+#ifdef CONFIG_HAS_PIRQ
-+ /* Bound-check values passed via "extra_guest_irqs=". */
-+ {
-+ unsigned int n = max(arch_hwdom_irqs(dom_xen), nr_static_irqs);
-+
-+ if ( extra_hwdom_irqs > n - nr_static_irqs )
-+ {
-+ extra_hwdom_irqs = n - nr_static_irqs;
-+ printk(XENLOG_WARNING "hwdom IRQs bounded to %u\n", n);
-+ }
-+ if ( extra_domU_irqs >
-+ max(DEFAULT_EXTRA_DOMU_IRQS, n - nr_static_irqs) )
-+ {
-+ extra_domU_irqs = n - nr_static_irqs;
-+ printk(XENLOG_WARNING "domU IRQs bounded to %u\n", n);
-+ }
-+ }
-+#endif
-+
- /*
- * Initialise our DOMID_IO domain.
- * This domain owns I/O pages that are within the range of the page_info
-diff --git a/xen/include/xen/irq.h b/xen/include/xen/irq.h
-index 5dcd2d8f0c..bef170bcb6 100644
---- a/xen/include/xen/irq.h
-+++ b/xen/include/xen/irq.h
-@@ -196,8 +196,9 @@ extern struct irq_desc *pirq_spin_lock_irq_desc(
-
- unsigned int set_desc_affinity(struct irq_desc *desc, const cpumask_t *mask);
-
-+/* When passed a system domain, this returns the maximum permissible value. */
- #ifndef arch_hwdom_irqs
--unsigned int arch_hwdom_irqs(domid_t domid);
-+unsigned int arch_hwdom_irqs(const struct domain *d);
- #endif
-
- #ifndef arch_evtchn_bind_pirq
---
-2.45.2
-
diff --git a/0051-x86-entry-don-t-clear-DF-when-raising-UD-for-lack-of.patch b/0051-x86-entry-don-t-clear-DF-when-raising-UD-for-lack-of.patch
deleted file mode 100644
index acefc8e..0000000
--- a/0051-x86-entry-don-t-clear-DF-when-raising-UD-for-lack-of.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 7e636b8a16412d4f0d94b2b24d7ebcd2c749afff Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Thu, 4 Jul 2024 14:14:49 +0200
-Subject: [PATCH 51/56] x86/entry: don't clear DF when raising #UD for lack of
- syscall handler
-
-While doing so is intentional when invoking the actual callback, to
-mimic a hard-coded SYCALL_MASK / FMASK MSR, the same should not be done
-when no handler is available and hence #UD is raised.
-
-Fixes: ca6fcf4321b3 ("x86/pv: Inject #UD for missing SYSCALL callbacks")
-Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-master commit: d2fe9ab3048d503869ec81bc49db07e55a4a2386
-master date: 2024-07-02 12:01:21 +0200
----
- xen/arch/x86/x86_64/entry.S | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
-index 054fcb225f..d3def49ea3 100644
---- a/xen/arch/x86/x86_64/entry.S
-+++ b/xen/arch/x86/x86_64/entry.S
-@@ -38,6 +38,14 @@ switch_to_kernel:
- setc %cl
- leal (,%rcx,TBF_INTERRUPT),%ecx
-
-+ /*
-+ * The PV ABI hardcodes the (guest-inaccessible and virtual)
-+ * SYSCALL_MASK MSR such that DF (and nothing else) would be cleared.
-+ * Note that the equivalent of IF (VGCF_syscall_disables_events) is
-+ * dealt with separately above.
-+ */
-+ mov $~X86_EFLAGS_DF, %esi
-+
- test %rax, %rax
- UNLIKELY_START(z, syscall_no_callback) /* TB_eip == 0 => #UD */
- mov VCPU_trap_ctxt(%rbx), %rdi
-@@ -47,12 +55,14 @@ UNLIKELY_START(z, syscall_no_callback) /* TB_eip == 0 => #UD */
- testb $4, X86_EXC_UD * TRAPINFO_sizeof + TRAPINFO_flags(%rdi)
- setnz %cl
- lea TBF_EXCEPTION(, %rcx, TBF_INTERRUPT), %ecx
-+ or $~0, %esi /* Don't clear DF */
- UNLIKELY_END(syscall_no_callback)
-
- movq %rax,TRAPBOUNCE_eip(%rdx)
- movb %cl,TRAPBOUNCE_flags(%rdx)
- call create_bounce_frame
-- andl $~X86_EFLAGS_DF,UREGS_eflags(%rsp)
-+ /* Conditionally clear DF */
-+ and %esi, UREGS_eflags(%rsp)
- /* %rbx: struct vcpu */
- test_all_events:
- ASSERT_NOT_IN_ATOMIC
---
-2.45.2
-
diff --git a/0052-evtchn-build-fix-for-Arm.patch b/0052-evtchn-build-fix-for-Arm.patch
deleted file mode 100644
index 6cbeb10..0000000
--- a/0052-evtchn-build-fix-for-Arm.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 45c5333935628e7c80de0bd5a9d9eff50b305b16 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Thu, 4 Jul 2024 16:57:29 +0200
-Subject: [PATCH 52/56] evtchn: build fix for Arm
-
-When backporting daa90dfea917 ("pirq_cleanup_check() leaks") I neglected
-to pay attention to it depending on 13a7b0f9f747 ("restrict concept of
-pIRQ to x86"). That one doesn't want backporting imo, so use / adjust
-custom #ifdef-ary to address the immediate issue of pirq_cleanup_check()
-not being available on Arm.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
----
- xen/common/event_channel.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
-index b1a6215c37..e6ec556603 100644
---- a/xen/common/event_channel.c
-+++ b/xen/common/event_channel.c
-@@ -643,7 +643,9 @@ static int evtchn_bind_pirq(evtchn_bind_pirq_t *bind)
- if ( rc != 0 )
- {
- info->evtchn = 0;
-+#ifdef CONFIG_X86
- pirq_cleanup_check(info, d);
-+#endif
- goto out;
- }
-
-@@ -713,8 +715,8 @@ int evtchn_close(struct domain *d1, int port1, bool guest)
- * The successful path of unmap_domain_pirq_emuirq() will have
- * called pirq_cleanup_check() already.
- */
--#endif
- pirq_cleanup_check(pirq, d1);
-+#endif
- }
- unlink_pirq_port(chn1, d1->vcpu[chn1->notify_vcpu_id]);
- break;
---
-2.45.2
-
diff --git a/0053-x86-IRQ-avoid-double-unlock-in-map_domain_pirq.patch b/0053-x86-IRQ-avoid-double-unlock-in-map_domain_pirq.patch
deleted file mode 100644
index 686e142..0000000
--- a/0053-x86-IRQ-avoid-double-unlock-in-map_domain_pirq.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From d46a1ce3175dc45e97a8c9b89b0d0ff46145ae64 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Tue, 16 Jul 2024 14:14:43 +0200
-Subject: [PATCH 53/56] x86/IRQ: avoid double unlock in map_domain_pirq()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Forever since its introduction the main loop in the function dealing
-with multi-vector MSI had error exit points ("break") with different
-properties: In one case no IRQ descriptor lock is being held.
-Nevertheless the subsequent error cleanup path assumed such a lock would
-uniformly need releasing. Identify the case by setting "desc" to NULL,
-thus allowing the unlock to be skipped as necessary.
-
-This is CVE-2024-31143 / XSA-458.
-
-Coverity ID: 1605298
-Fixes: d1b6d0a02489 ("x86: enable multi-vector MSI")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-master commit: 57338346f29cea7b183403561bdc5f407163b846
-master date: 2024-07-16 14:09:14 +0200
----
- xen/arch/x86/irq.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index 00be3b88e8..5dae8bd1b9 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2287,6 +2287,7 @@ int map_domain_pirq(
-
- set_domain_irq_pirq(d, irq, info);
- spin_unlock_irqrestore(&desc->lock, flags);
-+ desc = NULL;
-
- info = NULL;
- irq = create_irq(NUMA_NO_NODE, true);
-@@ -2322,7 +2323,9 @@ int map_domain_pirq(
-
- if ( ret )
- {
-- spin_unlock_irqrestore(&desc->lock, flags);
-+ if ( desc )
-+ spin_unlock_irqrestore(&desc->lock, flags);
-+
- pci_disable_msi(msi_desc);
- if ( nr )
- {
---
-2.45.2
-
diff --git a/0054-x86-physdev-Return-pirq-that-irq-was-already-mapped-.patch b/0054-x86-physdev-Return-pirq-that-irq-was-already-mapped-.patch
deleted file mode 100644
index 5e245f9..0000000
--- a/0054-x86-physdev-Return-pirq-that-irq-was-already-mapped-.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From f9f3062f11e144438fac9e9da6aa4cb41a6009b1 Mon Sep 17 00:00:00 2001
-From: Jiqian Chen <Jiqian.Chen@amd.com>
-Date: Thu, 25 Jul 2024 16:20:17 +0200
-Subject: [PATCH 54/56] x86/physdev: Return pirq that irq was already mapped to
-
-Fix bug introduced by 0762e2502f1f ("x86/physdev: factor out the code to allocate and
-map a pirq"). After that re-factoring, when pirq<0 and current_pirq>0, it means
-caller want to allocate a free pirq for irq but irq already has a mapped pirq, then
-it returns the negative pirq, so it fails. However, the logic before that
-re-factoring is different, it should return the current_pirq that irq was already
-mapped to and make the call success.
-
-Fixes: 0762e2502f1f ("x86/physdev: factor out the code to allocate and map a pirq")
-Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
-Signed-off-by: Huang Rui <ray.huang@amd.com>
-Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: 0d2b87b5adfc19e87e9027d996db204c66a47f30
-master date: 2024-07-08 14:46:12 +0100
----
- xen/arch/x86/irq.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
-index 5dae8bd1b9..6b1f338eae 100644
---- a/xen/arch/x86/irq.c
-+++ b/xen/arch/x86/irq.c
-@@ -2914,6 +2914,7 @@ static int allocate_pirq(struct domain *d, int index, int pirq, int irq,
- d->domain_id, index, pirq, current_pirq);
- if ( current_pirq < 0 )
- return -EBUSY;
-+ pirq = current_pirq;
- }
- else if ( type == MAP_PIRQ_TYPE_MULTI_MSI )
- {
---
-2.45.2
-
diff --git a/0055-tools-libxs-Fix-fcntl-invocation-in-set_cloexec.patch b/0055-tools-libxs-Fix-fcntl-invocation-in-set_cloexec.patch
deleted file mode 100644
index e4cc09e..0000000
--- a/0055-tools-libxs-Fix-fcntl-invocation-in-set_cloexec.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 81f1e807fadb8111d71b78191e01ca688d74eac7 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Thu, 25 Jul 2024 16:20:53 +0200
-Subject: [PATCH 55/56] tools/libxs: Fix fcntl() invocation in set_cloexec()
-
-set_cloexec() had a bit too much copy&pate from setnonblock(), and
-insufficient testing on ancient versions of Linux...
-
-As written (emulating ancient linux by undef'ing O_CLOEXEC), strace shows:
-
- open("/dev/xen/xenbus", O_RDWR) = 3
- fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
- fcntl(3, 0x8003 /* F_??? */, 0x7ffe4a771d90) = -1 EINVAL (Invalid argument)
- close(3) = 0
-
-which is obviously nonsense.
-
-Switch F_GETFL -> F_GETFD, and fix the second invocation to use F_SETFD. With
-this, strace is rather happer:
-
- open("/dev/xen/xenbus", O_RDWR) = 3
- fcntl(3, F_GETFD) = 0
- fcntl(3, F_SETFD, FD_CLOEXEC) = 0
-
-Fixes: bf7c1464706a ("tools/libxs: Fix CLOEXEC handling in get_dev()")
-Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>
-Reviewed-by: Juergen Gross <jgross@suse.com>
-master commit: 37810b52d003f8a04af41d7b1f85eff24af9f804
-master date: 2024-07-09 15:32:18 +0100
----
- tools/libs/store/xs.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/libs/store/xs.c b/tools/libs/store/xs.c
-index c8845b69e2..38a6ce3cf2 100644
---- a/tools/libs/store/xs.c
-+++ b/tools/libs/store/xs.c
-@@ -182,12 +182,12 @@ static bool setnonblock(int fd, int nonblock) {
-
- static bool set_cloexec(int fd)
- {
-- int flags = fcntl(fd, F_GETFL);
-+ int flags = fcntl(fd, F_GETFD);
-
- if (flags < 0)
- return false;
-
-- return fcntl(fd, flags | FD_CLOEXEC) >= 0;
-+ return fcntl(fd, F_SETFD, flags | FD_CLOEXEC) >= 0;
- }
-
- static int pipe_cloexec(int fds[2])
---
-2.45.2
-
diff --git a/0056-x86-altcall-fix-clang-code-gen-when-using-altcall-in.patch b/0056-x86-altcall-fix-clang-code-gen-when-using-altcall-in.patch
deleted file mode 100644
index c94c516..0000000
--- a/0056-x86-altcall-fix-clang-code-gen-when-using-altcall-in.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From d078d0aa86e9e3b937f673dc89306b3afd09d560 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
-Date: Thu, 25 Jul 2024 16:21:17 +0200
-Subject: [PATCH 56/56] x86/altcall: fix clang code-gen when using altcall in
- loop constructs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Yet another clang code generation issue when using altcalls.
-
-The issue this time is with using loop constructs around alternative_{,v}call
-instances using parameter types smaller than the register size.
-
-Given the following example code:
-
-static void bar(bool b)
-{
- unsigned int i;
-
- for ( i = 0; i < 10; i++ )
- {
- int ret_;
- register union {
- bool e;
- unsigned long r;
- } di asm("rdi") = { .e = b };
- register unsigned long si asm("rsi");
- register unsigned long dx asm("rdx");
- register unsigned long cx asm("rcx");
- register unsigned long r8 asm("r8");
- register unsigned long r9 asm("r9");
- register unsigned long r10 asm("r10");
- register unsigned long r11 asm("r11");
-
- asm volatile ( "call %c[addr]"
- : "+r" (di), "=r" (si), "=r" (dx),
- "=r" (cx), "=r" (r8), "=r" (r9),
- "=r" (r10), "=r" (r11), "=a" (ret_)
- : [addr] "i" (&(func)), "g" (func)
- : "memory" );
- }
-}
-
-See: https://godbolt.org/z/qvxMGd84q
-
-Clang will generate machine code that only resets the low 8 bits of %rdi
-between loop calls, leaving the rest of the register possibly containing
-garbage from the use of %rdi inside the called function. Note also that clang
-doesn't truncate the input parameters at the callee, thus breaking the psABI.
-
-Fix this by turning the `e` element in the anonymous union into an array that
-consumes the same space as an unsigned long, as this forces clang to reset the
-whole %rdi register instead of just the low 8 bits.
-
-Fixes: 2ce562b2a413 ('x86/altcall: use a union as register type for function parameters on clang')
-Suggested-by: Jan Beulich <jbeulich@suse.com>
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-master commit: d51b2f5ea1915fe058f730b0ec542cf84254fca0
-master date: 2024-07-23 13:59:30 +0200
----
- xen/arch/x86/include/asm/alternative.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/xen/arch/x86/include/asm/alternative.h b/xen/arch/x86/include/asm/alternative.h
-index 0d3697f1de..e63b459276 100644
---- a/xen/arch/x86/include/asm/alternative.h
-+++ b/xen/arch/x86/include/asm/alternative.h
-@@ -185,10 +185,10 @@ extern void alternative_branches(void);
- */
- #define ALT_CALL_ARG(arg, n) \
- register union { \
-- typeof(arg) e; \
-+ typeof(arg) e[sizeof(long) / sizeof(arg)]; \
- unsigned long r; \
- } a ## n ## _ asm ( ALT_CALL_arg ## n ) = { \
-- .e = ({ BUILD_BUG_ON(sizeof(arg) > sizeof(void *)); (arg); }) \
-+ .e[0] = ({ BUILD_BUG_ON(sizeof(arg) > sizeof(void *)); (arg); })\
- }
- #else
- #define ALT_CALL_ARG(arg, n) \
---
-2.45.2
-
diff --git a/info.txt b/info.txt
index ccc4d4e..eaab4bc 100644
--- a/info.txt
+++ b/info.txt
@@ -1,6 +1,6 @@
-Xen upstream patchset #0 for 4.18.3-pre
+Xen upstream patchset #0 for 4.19.1-pre
Containing patches from
-RELEASE-4.18.2 (844f9931c6c207588a70f897262c628cd542f75a)
+RELEASE-4.19.0 (0ef126c163d99932c9d7142e2bd130633c5c4844)
to
-staging-4.18 (d078d0aa86e9e3b937f673dc89306b3afd09d560)
+staging-4.19 (2c61ab407172682e1382204a8305107f19e2951b)