Commit 6126bc55 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/sstabellini/tags/xsa155' into staging 



XSA-155 fixes

# gpg: Signature made Fri 18 Dec 2015 15:16:18 GMT using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

* remotes/sstabellini/tags/xsa155:
  xenfb: avoid reading twice the same fields from the shared page
  xen/blkif: Avoid double access to src->nr_segments

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 18f49881 7ea11bf3

hw/block/xen_blkif.h

+8 −4
Original line number Diff line number Diff line
@@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque 
		d->nr_sectors = s->nr_sectors;

		return;

	}

	if (n > src->nr_segments)

		n = src->nr_segments;

	/* prevent the compiler from optimizing the code and using src->nr_segments instead */

	barrier();

	if (n > dst->nr_segments)

		n = dst->nr_segments;

	for (i = 0; i < n; i++)

		dst->seg[i] = src->seg[i];

}
@@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque 
		d->nr_sectors = s->nr_sectors;

		return;

	}

	if (n > src->nr_segments)

		n = src->nr_segments;

	/* prevent the compiler from optimizing the code and using src->nr_segments instead */

	barrier();

	if (n > dst->nr_segments)

		n = dst->nr_segments;

	for (i = 0; i < n; i++)

		dst->seg[i] = src->seg[i];

}

hw/display/xenfb.c

+6 −4
Original line number Diff line number Diff line
@@ -784,18 +784,20 @@ static void xenfb_invalidate(void *opaque) 


static void xenfb_handle_events(struct XenFB *xenfb)

{

    uint32_t prod, cons;

    uint32_t prod, cons, out_cons;

    struct xenfb_page *page = xenfb->c.page;



    prod = page->out_prod;

    if (prod == page->out_cons)

    out_cons = page->out_cons;

    if (prod == out_cons)

	return;

    xen_rmb();		/* ensure we see ring contents up to prod */

    for (cons = page->out_cons; cons != prod; cons++) {

    for (cons = out_cons; cons != prod; cons++) {

	union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);

        uint8_t type = event->type;

	int x, y, w, h;



	switch (event->type) {

	switch (type) {

	case XENFB_TYPE_UPDATE:

	    if (xenfb->up_count == UP_QUEUE)

		xenfb->up_fullscreen = 1;