Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK)) by mollari.NetBSD.org (Postfix) with ESMTPS id E04087A1BC for ; Thu, 28 Jul 2016 14:09:16 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id 5567285EB3; Thu, 28 Jul 2016 14:09:16 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id DAFAB85E77 for ; Thu, 28 Jul 2016 14:09:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id jnEfKEbll30U for ; Thu, 28 Jul 2016 14:09:15 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 3AC1685E61 for ; Thu, 28 Jul 2016 14:09:15 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 35B52FBB5; Thu, 28 Jul 2016 14:09:15 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1469714955265120" MIME-Version: 1.0 Date: Thu, 28 Jul 2016 14:09:15 +0000 From: "S.P.Zeidler" Subject: CVS commit: [pkgsrc-2016Q2] pkgsrc/sysutils/xenkernel41 To: pkgsrc-changes@NetBSD.org Reply-To: spz@netbsd.org X-Mailer: log_accum Message-Id: <20160728140915.35B52FBB5@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk This is a multi-part message in MIME format. --_----------=_1469714955265120 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: spz Date: Thu Jul 28 14:09:15 UTC 2016 Modified Files: pkgsrc/sysutils/xenkernel41 [pkgsrc-2016Q2]: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel41/patches [pkgsrc-2016Q2]: patch-XSA-182 Log Message: Pullup ticket #5072 - requested by bouyer sysutils/xenkernel41: security patch Revisions pulled up: - sysutils/xenkernel41/Makefile 1.50 - sysutils/xenkernel41/distinfo 1.43 - sysutils/xenkernel41/patches/patch-XSA-182 1.1 ------------------------------------------------------------------- Module Name: pkgsrc Committed By: bouyer Date: Tue Jul 26 15:59:20 UTC 2016 Modified Files: pkgsrc/sysutils/xenkernel41: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel41/patches: patch-XSA-182 Log Message: Apply security patch from XSA-182. Bump PKGREVISION xen 4.2 is not vulnerable to XSA-183. To generate a diff of this commit: cvs rdiff -u -r1.49 -r1.50 pkgsrc/sysutils/xenkernel41/Makefile cvs rdiff -u -r1.42 -r1.43 pkgsrc/sysutils/xenkernel41/distinfo cvs rdiff -u -r0 -r1.1 pkgsrc/sysutils/xenkernel41/patches/patch-XSA-182 To generate a diff of this commit: cvs rdiff -u -r1.48 -r1.48.4.1 pkgsrc/sysutils/xenkernel41/Makefile cvs rdiff -u -r1.42 -r1.42.4.1 pkgsrc/sysutils/xenkernel41/distinfo cvs rdiff -u -r0 -r1.1.2.2 pkgsrc/sysutils/xenkernel41/patches/patch-XSA-182 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1469714955265120 Content-Disposition: inline Content-Length: 5688 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/sysutils/xenkernel41/Makefile diff -u pkgsrc/sysutils/xenkernel41/Makefile:1.48 pkgsrc/sysutils/xenkernel41/Makefile:1.48.4.1 --- pkgsrc/sysutils/xenkernel41/Makefile:1.48 Thu Jan 7 17:55:55 2016 +++ pkgsrc/sysutils/xenkernel41/Makefile Thu Jul 28 14:09:14 2016 @@ -1,9 +1,9 @@ -# $NetBSD: Makefile,v 1.48 2016/01/07 17:55:55 bouyer Exp $ +# $NetBSD: Makefile,v 1.48.4.1 2016/07/28 14:09:14 spz Exp $ VERSION= 4.1.6.1 DISTNAME= xen-${VERSION} PKGNAME= xenkernel41-${VERSION} -PKGREVISION= 18 +PKGREVISION= 19 CATEGORIES= sysutils MASTER_SITES= http://bits.xensource.com/oss-xen/release/${VERSION}/ Index: pkgsrc/sysutils/xenkernel41/distinfo diff -u pkgsrc/sysutils/xenkernel41/distinfo:1.42 pkgsrc/sysutils/xenkernel41/distinfo:1.42.4.1 --- pkgsrc/sysutils/xenkernel41/distinfo:1.42 Tue Mar 1 20:09:04 2016 +++ pkgsrc/sysutils/xenkernel41/distinfo Thu Jul 28 14:09:14 2016 @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.42 2016/03/01 20:09:04 joerg Exp $ +$NetBSD: distinfo,v 1.42.4.1 2016/07/28 14:09:14 spz Exp $ SHA1 (xen-4.1.6.1.tar.gz) = e5f15feb0821578817a65ede16110c6eac01abd0 RMD160 (xen-4.1.6.1.tar.gz) = bff11421fc44a26f2cc3156713267abcb36d7a19 @@ -37,6 +37,7 @@ SHA1 (patch-CVE-2015-7971) = 0d0d36ad99f SHA1 (patch-CVE-2015-8339) = e5485ab9e73fa9a63c566505b8de805530ac678e SHA1 (patch-Config.mk) = a43ed1b3304d6383dc093acd128a7f373d0ca266 SHA1 (patch-XSA-166) = 24fccf8e30ccf910a128e5e0365800191a90524c +SHA1 (patch-XSA-182) = 70a7a6175a4b87ffaf72cbc5a3932f076efa3f9c SHA1 (patch-xen_Makefile) = d1c7e4860221f93d90818f45a77748882486f92b SHA1 (patch-xen_arch_x86_Rules.mk) = 6b9b4bfa28924f7d3f6c793a389f1a7ac9d228e2 SHA1 (patch-xen_arch_x86_cpu_mcheck_vmce.c) = 5afd01780a13654f1d21bf1562f6431c8370be0b Added files: Index: pkgsrc/sysutils/xenkernel41/patches/patch-XSA-182 diff -u /dev/null pkgsrc/sysutils/xenkernel41/patches/patch-XSA-182:1.1.2.2 --- /dev/null Thu Jul 28 14:09:15 2016 +++ pkgsrc/sysutils/xenkernel41/patches/patch-XSA-182 Thu Jul 28 14:09:15 2016 @@ -0,0 +1,90 @@ +$NetBSD: patch-XSA-182,v 1.1.2.2 2016/07/28 14:09:15 spz Exp $ + +backported from: + +From 798c1498f764bfaa7b0b955bab40b01b0610d372 Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Mon, 11 Jul 2016 14:32:03 +0100 +Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath + +All changes in writeability and cacheability must go through full +re-validation. + +Rework the logic as a whitelist, to make it clearer to follow. + +This is XSA-182 + +--- xen/arch/x86/mm.c.orig 2016-07-26 16:51:13.000000000 +0200 ++++ xen/arch/x86/mm.c 2016-07-26 16:53:07.000000000 +0200 +@@ -1792,6 +1792,14 @@ + _t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \ + (_m), (_v), (_ad)) + ++/* ++ * PTE flags that a guest may change without re-validating the PTE. ++ * All other bits affect translation, caching, or Xen's safety. ++ */ ++#define FASTPATH_FLAG_WHITELIST \ ++ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \ ++ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER) ++ + /* Update the L1 entry at pl1e to new value nl1e. */ + static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e, + unsigned long gl1mfn, int preserve_ad, +@@ -1829,8 +1837,8 @@ + return 0; + } + +- /* Fast path for identical mapping, r/w and presence. */ +- if ( !l1e_has_changed(ol1e, nl1e, _PAGE_RW | _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings.*/ ++ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l1e(nl1e, pt_dom); + rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu, +@@ -1897,11 +1905,8 @@ + return 0; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l2e_has_changed(ol2e, nl2e, +- unlikely(opt_allow_superpage) +- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT +- : _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l2e(nl2e, d); + rc = UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad); +@@ -1965,8 +1970,8 @@ + return -EINVAL; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l3e(nl3e, d); + rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad); +@@ -2035,8 +2040,8 @@ + return -EINVAL; + } + +- /* Fast path for identical mapping and presence. */ +- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) ) ++ /* Fast path for sufficiently-similar mappings. */ ++ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) ) + { + adjust_guest_l4e(nl4e, d); + rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad); +--- xen/include/asm-x86/page.h.orig 2014-09-02 08:22:57.000000000 +0200 ++++ xen/include/asm-x86/page.h 2016-07-26 16:39:51.000000000 +0200 +@@ -332,6 +332,7 @@ + #define _PAGE_AVAIL2 0x800U + #define _PAGE_AVAIL 0xE00U + #define _PAGE_PSE_PAT 0x1000U ++#define _PAGE_AVAIL_HIGH (0x7ffU << 12) + #define _PAGE_PAGED 0x2000U + #define _PAGE_SHARED 0x4000U + --_----------=_1469714955265120--