summaryrefslogtreecommitdiff
path: root/system/xen/xsa/xsa182-unstable.patch
diff options
context:
space:
mode:
Diffstat (limited to 'system/xen/xsa/xsa182-unstable.patch')
-rw-r--r--system/xen/xsa/xsa182-unstable.patch102
1 files changed, 102 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa182-unstable.patch b/system/xen/xsa/xsa182-unstable.patch
new file mode 100644
index 0000000000..3e40e8a530
--- /dev/null
+++ b/system/xen/xsa/xsa182-unstable.patch
@@ -0,0 +1,102 @@
+From 00593655e231ed5ea20704120037026e33b83fbb Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Mon, 11 Jul 2016 14:32:03 +0100
+Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
+
+All changes in writeability and cacheability must go through full
+re-validation.
+
+Rework the logic as a whitelist, to make it clearer to follow.
+
+This is XSA-182
+
+Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Tim Deegan <tim@xen.org>
+---
+ xen/arch/x86/mm.c | 28 ++++++++++++++++------------
+ xen/include/asm-x86/page.h | 1 +
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
+index dbcf6cb..56ca19f 100644
+--- a/xen/arch/x86/mm.c
++++ b/xen/arch/x86/mm.c
+@@ -1852,6 +1852,14 @@ static inline int update_intpte(intpte_t *p,
+ _t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \
+ (_m), (_v), (_ad))
+
++/*
++ * PTE flags that a guest may change without re-validating the PTE.
++ * All other bits affect translation, caching, or Xen's safety.
++ */
++#define FASTPATH_FLAG_WHITELIST \
++ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \
++ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER)
++
+ /* Update the L1 entry at pl1e to new value nl1e. */
+ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
+ unsigned long gl1mfn, int preserve_ad,
+@@ -1891,9 +1899,8 @@ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
+ nl1e = l1e_from_pfn(page_to_mfn(page), l1e_get_flags(nl1e));
+ }
+
+- /* Fast path for identical mapping, r/w, presence, and cachability. */
+- if ( !l1e_has_changed(ol1e, nl1e,
+- PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) )
++ /* Fast path for sufficiently-similar mappings. */
++ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) )
+ {
+ adjust_guest_l1e(nl1e, pt_dom);
+ rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu,
+@@ -1970,11 +1977,8 @@ static int mod_l2_entry(l2_pgentry_t *pl2e,
+ return -EINVAL;
+ }
+
+- /* Fast path for identical mapping and presence. */
+- if ( !l2e_has_changed(ol2e, nl2e,
+- unlikely(opt_allow_superpage)
+- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
+- : _PAGE_PRESENT) )
++ /* Fast path for sufficiently-similar mappings. */
++ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) )
+ {
+ adjust_guest_l2e(nl2e, d);
+ if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
+@@ -2039,8 +2043,8 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
+ return -EINVAL;
+ }
+
+- /* Fast path for identical mapping and presence. */
+- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) )
++ /* Fast path for sufficiently-similar mappings. */
++ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) )
+ {
+ adjust_guest_l3e(nl3e, d);
+ rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad);
+@@ -2103,8 +2107,8 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
+ return -EINVAL;
+ }
+
+- /* Fast path for identical mapping and presence. */
+- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) )
++ /* Fast path for sufficiently-similar mappings. */
++ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) )
+ {
+ adjust_guest_l4e(nl4e, d);
+ rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad);
+diff --git a/xen/include/asm-x86/page.h b/xen/include/asm-x86/page.h
+index 224852a..4ae387f 100644
+--- a/xen/include/asm-x86/page.h
++++ b/xen/include/asm-x86/page.h
+@@ -313,6 +313,7 @@ void efi_update_l4_pgtable(unsigned int l4idx, l4_pgentry_t);
+ #define _PAGE_AVAIL2 _AC(0x800,U)
+ #define _PAGE_AVAIL _AC(0xE00,U)
+ #define _PAGE_PSE_PAT _AC(0x1000,U)
++#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12)
+ #define _PAGE_NX (cpu_has_nx ? _PAGE_NX_BIT : 0)
+ /* non-architectural flags */
+ #define _PAGE_PAGED 0x2000U
+--
+2.1.4
+