1.1 --- a/tools/libxc/xc_core.c	Wed Nov 21 09:12:06 2007 -0700
     1.2 +++ b/tools/libxc/xc_core.c	Thu Nov 22 10:44:54 2007 +0000
     1.3 @@ -107,17 +107,23 @@ xc_core_strtab_get(struct xc_core_strtab
     1.4      uint16_t ret = 0;
     1.5      uint16_t len = strlen(name) + 1;
     1.6  
     1.7 +    if ( strtab->current > UINT16_MAX - len )
     1.8 +    {
     1.9 +        PERROR("too long string table");
    1.10 +        errno = E2BIG;
    1.11 +        return ret;
    1.12 +    }
    1.13 +    
    1.14      if ( strtab->current + len > strtab->max )
    1.15      {
    1.16          char *tmp;
    1.17 -        if ( strtab->max * 2 < strtab->max )
    1.18 +        if ( strtab->max > UINT16_MAX / 2 )
    1.19          {
    1.20              PERROR("too long string table");
    1.21              errno = ENOMEM;
    1.22              return ret;
    1.23          }
    1.24  
    1.25 -
    1.26          tmp = realloc(strtab->strings, strtab->max * 2);
    1.27          if ( tmp == NULL )
    1.28          {
    1.29 @@ -143,8 +149,8 @@ struct xc_core_section_headers {
    1.30  
    1.31      Elf64_Shdr  *shdrs;
    1.32  };
    1.33 -#define SHDR_INIT       16
    1.34 -#define SHDR_INC        4U
    1.35 +#define SHDR_INIT       ((uint16_t)16)
    1.36 +#define SHDR_INC        ((uint16_t)4)
    1.37  
    1.38  static struct xc_core_section_headers*
    1.39  xc_core_shdr_init(void)
    1.40 @@ -180,7 +186,7 @@ xc_core_shdr_get(struct xc_core_section_
    1.41      if ( sheaders->num == sheaders->num_max )
    1.42      {
    1.43          Elf64_Shdr *shdrs;
    1.44 -        if ( sheaders->num_max + SHDR_INC < sheaders->num_max )
    1.45 +        if ( sheaders->num_max > UINT16_MAX - SHDR_INC )
    1.46          {
    1.47              errno = E2BIG;
    1.48              return NULL;

     2.1 --- a/tools/libxc/xc_core_x86.c	Wed Nov 21 09:12:06 2007 -0700
     2.2 +++ b/tools/libxc/xc_core_x86.c	Thu Nov 22 10:44:54 2007 +0000
     2.3 @@ -89,7 +89,7 @@ xc_core_arch_map_p2m(int xc_handle, xc_d
     2.4      }
     2.5  
     2.6      live_p2m_frame_list =
     2.7 -        xc_map_foreign_batch(xc_handle, dom, PROT_READ,
     2.8 +        xc_map_foreign_pages(xc_handle, dom, PROT_READ,
     2.9                               live_p2m_frame_list_list,
    2.10                               P2M_FLL_ENTRIES);
    2.11  
    2.12 @@ -99,7 +99,7 @@ xc_core_arch_map_p2m(int xc_handle, xc_d
    2.13          goto out;
    2.14      }
    2.15  
    2.16 -    *live_p2m = xc_map_foreign_batch(xc_handle, dom, PROT_READ,
    2.17 +    *live_p2m = xc_map_foreign_pages(xc_handle, dom, PROT_READ,
    2.18                                      live_p2m_frame_list,
    2.19                                      P2M_FL_ENTRIES);
    2.20  

     3.1 --- a/xen/arch/x86/hvm/svm/emulate.c	Wed Nov 21 09:12:06 2007 -0700
     3.2 +++ b/xen/arch/x86/hvm/svm/emulate.c	Thu Nov 22 10:44:54 2007 +0000
     3.3 @@ -348,8 +348,6 @@ MAKE_INSTR(WBINVD, 2, 0x0f, 0x09);
     3.4  MAKE_INSTR(CPUID,  2, 0x0f, 0xa2);
     3.5  MAKE_INSTR(RDMSR,  2, 0x0f, 0x32);
     3.6  MAKE_INSTR(WRMSR,  2, 0x0f, 0x30);
     3.7 -MAKE_INSTR(RDTSC,  2, 0x0f, 0x31);
     3.8 -MAKE_INSTR(RDTSCP, 3, 0x0f, 0x01, 0xf9);
     3.9  MAKE_INSTR(CLI,    1, 0xfa);
    3.10  MAKE_INSTR(STI,    1, 0xfb);
    3.11  MAKE_INSTR(RDPMC,  2, 0x0f, 0x33);
    3.12 @@ -383,8 +381,6 @@ static const u8 *opc_bytes[INSTR_MAX_COU
    3.13      [INSTR_CPUID]  = OPCODE_CPUID,
    3.14      [INSTR_RDMSR]  = OPCODE_RDMSR,
    3.15      [INSTR_WRMSR]  = OPCODE_WRMSR,
    3.16 -    [INSTR_RDTSC]  = OPCODE_RDTSC,
    3.17 -    [INSTR_RDTSCP] = OPCODE_RDTSCP,
    3.18      [INSTR_CLI]    = OPCODE_CLI,
    3.19      [INSTR_STI]    = OPCODE_STI,
    3.20      [INSTR_RDPMC]  = OPCODE_RDPMC,

     4.1 --- a/xen/arch/x86/hvm/svm/svm.c	Wed Nov 21 09:12:06 2007 -0700
     4.2 +++ b/xen/arch/x86/hvm/svm/svm.c	Thu Nov 22 10:44:54 2007 +0000
     4.3 @@ -996,6 +996,7 @@ static void svm_do_no_device_fault(struc
     4.4  /* Reserved bits EDX: [31:29], [27], [22:20], [18], [10] */
     4.5  #define SVM_VCPU_CPUID_L1_EDX_RESERVED 0xe8740400
     4.6  
     4.7 +#define bitmaskof(idx)  (1U << ((idx) & 31))
     4.8  static void svm_vmexit_do_cpuid(struct vmcb_struct *vmcb,
     4.9                                  struct cpu_user_regs *regs)
    4.10  {
    4.11 @@ -1022,32 +1023,23 @@ static void svm_vmexit_do_cpuid(struct v
    4.12          break;
    4.13  
    4.14      case 0x80000001:
    4.15 +        /* Filter features which are shared with 0x00000001:EDX. */
    4.16          if ( vlapic_hw_disabled(vcpu_vlapic(v)) )
    4.17              __clear_bit(X86_FEATURE_APIC & 31, &edx);
    4.18 -
    4.19  #if CONFIG_PAGING_LEVELS >= 3
    4.20          if ( !v->domain->arch.hvm_domain.params[HVM_PARAM_PAE_ENABLED] )
    4.21  #endif
    4.22              __clear_bit(X86_FEATURE_PAE & 31, &edx);
    4.23 -
    4.24          __clear_bit(X86_FEATURE_PSE36 & 31, &edx);
    4.25  
    4.26 -        /* Clear the Cmp_Legacy bit
    4.27 -         * This bit is supposed to be zero when HTT = 0.
    4.28 -         * See details on page 23 of AMD CPUID Specification.
    4.29 -         */
    4.30 -        __clear_bit(X86_FEATURE_CMP_LEGACY & 31, &ecx);
    4.31 -
    4.32 -        /* Make SVM feature invisible to the guest. */
    4.33 -        __clear_bit(X86_FEATURE_SVME & 31, &ecx);
    4.34 -        __clear_bit(X86_FEATURE_SKINIT & 31, &ecx);
    4.35 -
    4.36 -        __clear_bit(X86_FEATURE_OSVW & 31, &ecx);
    4.37 -        __clear_bit(X86_FEATURE_WDT & 31, &ecx);
    4.38 -
    4.39 -        /* So far, we do not support 3DNow for the guest. */
    4.40 -        __clear_bit(X86_FEATURE_3DNOW & 31, &edx);
    4.41 -        __clear_bit(X86_FEATURE_3DNOWEXT & 31, &edx);
    4.42 +        /* Filter all other features according to a whitelist. */
    4.43 +        edx &= (0x0183f3ff | /* features shared with 0x00000001:EDX */
    4.44 +                bitmaskof(X86_FEATURE_NX) |
    4.45 +                bitmaskof(X86_FEATURE_LM) |
    4.46 +                bitmaskof(X86_FEATURE_SYSCALL) |
    4.47 +                bitmaskof(X86_FEATURE_MP) |
    4.48 +                bitmaskof(X86_FEATURE_MMXEXT) |
    4.49 +                bitmaskof(X86_FEATURE_FFXSR));
    4.50          break;
    4.51  
    4.52      case 0x80000007:
    4.53 @@ -2293,6 +2285,7 @@ asmlinkage void svm_vmexit_handler(struc
    4.54          hvm_triple_fault();
    4.55          break;
    4.56  
    4.57 +    case VMEXIT_RDTSCP:
    4.58      case VMEXIT_MONITOR:
    4.59      case VMEXIT_MWAIT:
    4.60      case VMEXIT_VMRUN:

     5.1 --- a/xen/arch/x86/hvm/vmx/vmx.c	Wed Nov 21 09:12:06 2007 -0700
     5.2 +++ b/xen/arch/x86/hvm/vmx/vmx.c	Thu Nov 22 10:44:54 2007 +0000
     5.3 @@ -1298,6 +1298,14 @@ static void vmx_do_cpuid(struct cpu_user
     5.4      case 0x0000000A:
     5.5          eax = ebx = ecx = edx = 0;
     5.6          break;
     5.7 +
     5.8 +    case 0x80000001:
     5.9 +        /* Only a few features are advertised in Intel's 0x80000001. */
    5.10 +        ecx &= (bitmaskof(X86_FEATURE_LAHF_LM));
    5.11 +        edx &= (bitmaskof(X86_FEATURE_NX) |
    5.12 +                bitmaskof(X86_FEATURE_LM) |
    5.13 +                bitmaskof(X86_FEATURE_SYSCALL));
    5.14 +        break;
    5.15      }
    5.16  
    5.17      regs->eax = eax;

     6.1 --- a/xen/include/asm-x86/hvm/svm/emulate.h	Wed Nov 21 09:12:06 2007 -0700
     6.2 +++ b/xen/include/asm-x86/hvm/svm/emulate.h	Thu Nov 22 10:44:54 2007 +0000
     6.3 @@ -47,8 +47,6 @@ enum instruction_index {
     6.4      INSTR_CPUID,
     6.5      INSTR_RDMSR,
     6.6      INSTR_WRMSR,
     6.7 -    INSTR_RDTSC,
     6.8 -    INSTR_RDTSCP,
     6.9      INSTR_CLI,
    6.10      INSTR_STI,
    6.11      INSTR_RDPMC,