Do not allow HVM save/restore of a dying domain.

It's not a sensible thing to do, and it is easier than auditing all
state save/restore functions for safety (most importantly, racing
against domain_relinquish_resources).

Also place a spin_barrier on domain_lock after asserting d->is_dying,
allowing critical regions under the domain_lock to safely check
is_dying and avoid races with domain_relinquish_resources().

Signed-off-by: Keir Fraser <keir.fraser@citrix.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/xen/common/hvm/save.c b/xen/common/hvm/save.c
index 3079363676..cb3cf66885 100644
--- a/xen/common/hvm/save.c
+++ b/xen/common/hvm/save.c
@@ -84,6 +84,9 @@ int hvm_save(struct domain *d, hvm_domain_context_t *h)
     hvm_save_handler handler;
     uint16_t i;
 
+    if ( d->is_dying )
+        return -EINVAL;
+
     hdr.magic = HVM_FILE_MAGIC;
     hdr.version = HVM_FILE_VERSION;
 
@@ -140,6 +143,9 @@ int hvm_load(struct domain *d, hvm_domain_context_t *h)
     hvm_load_handler handler;
     struct vcpu *v;
     
+    if ( d->is_dying )
+        return -EINVAL;
+
     /* Read the save header, which must be first */
     if ( hvm_load_entry(HEADER, h, &hdr) != 0 ) 
         return -1;