From owner-svn-ports-all@freebsd.org Wed Dec 14 09:55:10 2016 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2EDD1C76B5A; Wed, 14 Dec 2016 09:55:10 +0000 (UTC) (envelope-from royger@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 098821B21; Wed, 14 Dec 2016 09:55:09 +0000 (UTC) (envelope-from royger@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uBE9t9nM040030; Wed, 14 Dec 2016 09:55:09 GMT (envelope-from royger@FreeBSD.org) Received: (from royger@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uBE9t9Vk040028; Wed, 14 Dec 2016 09:55:09 GMT (envelope-from royger@FreeBSD.org) Message-Id: <201612140955.uBE9t9Vk040028@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: royger set sender to royger@FreeBSD.org using -f From: =?UTF-8?Q?Roger_Pau_Monn=c3=a9?= Date: Wed, 14 Dec 2016 09:55:09 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r428553 - in branches/2016Q4/emulators/xen-kernel: . files X-SVN-Group: ports-branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 09:55:10 -0000 Author: royger (src committer) Date: Wed Dec 14 09:55:08 2016 New Revision: 428553 URL: https://svnweb.freebsd.org/changeset/ports/428553 Log: -n MFH: -n r428496 xen: apply XSA-200 Approved by: bapt Sponsored by: Citrix Systems R&D Approved by: ports-secteam (junovitch) Added: branches/2016Q4/emulators/xen-kernel/files/xsa200-4.7.patch - copied unchanged from r428496, head/emulators/xen-kernel/files/xsa200-4.7.patch Modified: branches/2016Q4/emulators/xen-kernel/Makefile Directory Properties: branches/2016Q4/ (props changed) Modified: branches/2016Q4/emulators/xen-kernel/Makefile ============================================================================== --- branches/2016Q4/emulators/xen-kernel/Makefile Wed Dec 14 09:27:17 2016 (r428552) +++ branches/2016Q4/emulators/xen-kernel/Makefile Wed Dec 14 09:55:08 2016 (r428553) @@ -3,7 +3,7 @@ PORTNAME= xen PKGNAMESUFFIX= -kernel PORTVERSION= 4.7.1 -PORTREVISION= 0 +PORTREVISION= 1 CATEGORIES= emulators MASTER_SITES= http://downloads.xenproject.org/release/xen/${PORTVERSION}/ @@ -44,7 +44,8 @@ EXTRA_PATCHES= ${FILESDIR}/0001-xen-logd ${FILESDIR}/xsa192.patch \ ${FILESDIR}/xsa193-4.7.patch \ ${FILESDIR}/xsa194.patch \ - ${FILESDIR}/xsa195.patch + ${FILESDIR}/xsa195.patch \ + ${FILESDIR}/xsa200-4.7.patch .include Copied: branches/2016Q4/emulators/xen-kernel/files/xsa200-4.7.patch (from r428496, head/emulators/xen-kernel/files/xsa200-4.7.patch) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2016Q4/emulators/xen-kernel/files/xsa200-4.7.patch Wed Dec 14 09:55:08 2016 (r428553, copy of r428496, head/emulators/xen-kernel/files/xsa200-4.7.patch) @@ -0,0 +1,55 @@ +From: Jan Beulich +Subject: x86emul: CMPXCHG8B ignores operand size prefix + +Otherwise besides mis-handling the instruction, the comparison failure +case would result in uninitialized stack data being handed back to the +guest in rDX:rAX (32 bits leaked for 32-bit guests, 96 bits for 64-bit +ones). + +This is XSA-200. + +Signed-off-by: Jan Beulich + +--- a/tools/tests/x86_emulator/test_x86_emulator.c ++++ b/tools/tests/x86_emulator/test_x86_emulator.c +@@ -435,6 +435,24 @@ int main(int argc, char **argv) + goto fail; + printf("okay\n"); + ++ printf("%-40s", "Testing cmpxchg8b (%edi) [opsize]..."); ++ instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0xc7; instr[3] = 0x0f; ++ res[0] = 0x12345678; ++ res[1] = 0x87654321; ++ regs.eflags = 0x200; ++ regs.eip = (unsigned long)&instr[0]; ++ regs.edi = (unsigned long)res; ++ rc = x86_emulate(&ctxt, &emulops); ++ if ( (rc != X86EMUL_OKAY) || ++ (res[0] != 0x12345678) || ++ (res[1] != 0x87654321) || ++ (regs.eax != 0x12345678) || ++ (regs.edx != 0x87654321) || ++ ((regs.eflags&0x240) != 0x200) || ++ (regs.eip != (unsigned long)&instr[4]) ) ++ goto fail; ++ printf("okay\n"); ++ + printf("%-40s", "Testing movsxbd (%%eax),%%ecx..."); + instr[0] = 0x0f; instr[1] = 0xbe; instr[2] = 0x08; + regs.eflags = 0x200; +--- a/xen/arch/x86/x86_emulate/x86_emulate.c ++++ b/xen/arch/x86/x86_emulate/x86_emulate.c +@@ -4775,8 +4775,12 @@ x86_emulate( + generate_exception_if((modrm_reg & 7) != 1, EXC_UD, -1); + generate_exception_if(ea.type != OP_MEM, EXC_UD, -1); + if ( op_bytes == 8 ) ++ { + host_and_vcpu_must_have(cx16); +- op_bytes *= 2; ++ op_bytes = 16; ++ } ++ else ++ op_bytes = 8; + + /* Get actual old value. */ + if ( (rc = ops->read(ea.mem.seg, ea.mem.off, old, op_bytes,