diff --git a/535a34eb-VT-d-suppress-UR-signaling-for-server-chipsets.patch b/535a34eb-VT-d-suppress-UR-signaling-for-server-chipsets.patch new file mode 100644 index 0000000..76c92bc --- /dev/null +++ b/535a34eb-VT-d-suppress-UR-signaling-for-server-chipsets.patch @@ -0,0 +1,215 @@ +References: bnc#826717 CVE-2013-3495 XSA-59 + +# Commit d061d200eb92bcb1d86f9b55c6de73e35ce63fdf +# Date 2014-04-25 12:11:55 +0200 +# Author Jan Beulich +# Committer Jan Beulich +VT-d: suppress UR signaling for server chipsets + +Unsupported Requests can be signaled for malformed writes to the MSI +address region, e.g. due to buggy or malicious DMA set up to that +region. These should normally result in IOMMU faults, but don't on +the server chipsets dealt with here. + +IDs 0xe00, 0xe01, and 0xe04 ... 0xe0b (Ivytown) aren't needed here - +Intel confirmed the issue to be fixed in hardware there. + +This is CVE-2013-3495 / XSA-59. + +Signed-off-by: Jan Beulich +Reviewed-by: Andrew Cooper +Acked-by: Don Dugger +Acked-by: Tim Deegan +Acked-by: Xiantao Zhang + +--- a/xen/drivers/passthrough/vtd/quirks.c ++++ b/xen/drivers/passthrough/vtd/quirks.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -390,12 +391,68 @@ void __init pci_vtd_quirk(struct pci_dev + int bus = pdev->bus; + int dev = PCI_SLOT(pdev->devfn); + int func = PCI_FUNC(pdev->devfn); +- int id, val; ++ int pos; ++ u32 val; + +- id = pci_conf_read32(seg, bus, dev, func, 0); +- if ( id == 0x342e8086 || id == 0x3c288086 ) ++ if ( pci_conf_read16(seg, bus, dev, func, PCI_VENDOR_ID) != ++ PCI_VENDOR_ID_INTEL ) ++ return; ++ ++ switch ( pci_conf_read16(seg, bus, dev, func, PCI_DEVICE_ID) ) + { ++ case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */ ++ case 0x3c28: /* Sandybridge */ + val = pci_conf_read32(seg, bus, dev, func, 0x1AC); + pci_conf_write32(seg, bus, dev, func, 0x1AC, val | (1 << 31)); ++ break; ++ ++ /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */ ++ case 0x3400 ... 0x3407: /* host bridges */ ++ case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */ ++ /* JasperForest (Intel Xeon Processor C5500/C3500 */ ++ case 0x3700 ... 0x370f: /* host bridges */ ++ case 0x3720 ... 0x3724: /* root ports */ ++ /* Sandybridge-EP (Romley) */ ++ case 0x3c00: /* host bridge */ ++ case 0x3c01 ... 0x3c0b: /* root ports */ ++ pos = pci_find_ext_capability(seg, bus, pdev->devfn, ++ PCI_EXT_CAP_ID_ERR); ++ if ( !pos ) ++ { ++ pos = pci_find_ext_capability(seg, bus, pdev->devfn, ++ PCI_EXT_CAP_ID_VNDR); ++ while ( pos ) ++ { ++ val = pci_conf_read32(seg, bus, dev, func, pos + PCI_VNDR_HEADER); ++ if ( PCI_VNDR_HEADER_ID(val) == 4 && PCI_VNDR_HEADER_REV(val) == 1 ) ++ { ++ pos += PCI_VNDR_HEADER; ++ break; ++ } ++ pos = pci_find_next_ext_capability(seg, bus, pdev->devfn, pos, ++ PCI_EXT_CAP_ID_VNDR); ++ } ++ } ++ if ( !pos ) ++ { ++ printk(XENLOG_WARNING "%04x:%02x:%02x.%u without AER capability?\n", ++ seg, bus, dev, func); ++ break; ++ } ++ ++ val = pci_conf_read32(seg, bus, dev, func, pos + PCI_ERR_UNCOR_MASK); ++ pci_conf_write32(seg, bus, dev, func, pos + PCI_ERR_UNCOR_MASK, ++ val | PCI_ERR_UNC_UNSUP); ++ val = pci_conf_read32(seg, bus, dev, func, pos + PCI_ERR_COR_MASK); ++ pci_conf_write32(seg, bus, dev, func, pos + PCI_ERR_COR_MASK, ++ val | PCI_ERR_COR_ADV_NFAT); ++ ++ /* XPUNCERRMSK Send Completion with Unsupported Request */ ++ val = pci_conf_read32(seg, bus, dev, func, 0x20c); ++ pci_conf_write32(seg, bus, dev, func, 0x20c, val | (1 << 4)); ++ ++ printk(XENLOG_INFO "Masked UR signaling on %04x:%02x:%02x.%u\n", ++ seg, bus, dev, func); ++ break; + } + } +--- a/xen/drivers/pci/pci.c ++++ b/xen/drivers/pci/pci.c +@@ -66,23 +66,33 @@ int pci_find_next_cap(u16 seg, u8 bus, u + + /** + * pci_find_ext_capability - Find an extended capability +- * @dev: PCI device to query ++ * @seg/@bus/@devfn: PCI device to query + * @cap: capability code + * + * Returns the address of the requested extended capability structure + * within the device's PCI configuration space or 0 if the device does +- * not support it. Possible values for @cap: +- * +- * %PCI_EXT_CAP_ID_ERR Advanced Error Reporting +- * %PCI_EXT_CAP_ID_VC Virtual Channel +- * %PCI_EXT_CAP_ID_DSN Device Serial Number +- * %PCI_EXT_CAP_ID_PWR Power Budgeting ++ * not support it. + */ + int pci_find_ext_capability(int seg, int bus, int devfn, int cap) + { ++ return pci_find_next_ext_capability(seg, bus, devfn, 0, cap); ++} ++ ++/** ++ * pci_find_next_ext_capability - Find another extended capability ++ * @seg/@bus/@devfn: PCI device to query ++ * @pos: starting position ++ * @cap: capability code ++ * ++ * Returns the address of the requested extended capability structure ++ * within the device's PCI configuration space or 0 if the device does ++ * not support it. ++ */ ++int pci_find_next_ext_capability(int seg, int bus, int devfn, int start, int cap) ++{ + u32 header; + int ttl = 480; /* 3840 bytes, minimum 8 bytes per capability */ +- int pos = 0x100; ++ int pos = max(start, 0x100); + + header = pci_conf_read32(seg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn), pos); + +@@ -92,9 +102,10 @@ int pci_find_ext_capability(int seg, int + */ + if ( (header == 0) || (header == -1) ) + return 0; ++ ASSERT(start != pos || PCI_EXT_CAP_ID(header) == cap); + + while ( ttl-- > 0 ) { +- if ( PCI_EXT_CAP_ID(header) == cap ) ++ if ( PCI_EXT_CAP_ID(header) == cap && pos != start ) + return pos; + pos = PCI_EXT_CAP_NEXT(header); + if ( pos < 0x100 ) +--- a/xen/include/xen/pci.h ++++ b/xen/include/xen/pci.h +@@ -140,6 +140,7 @@ int pci_mmcfg_write(unsigned int seg, un + int pci_find_cap_offset(u16 seg, u8 bus, u8 dev, u8 func, u8 cap); + int pci_find_next_cap(u16 seg, u8 bus, unsigned int devfn, u8 pos, int cap); + int pci_find_ext_capability(int seg, int bus, int devfn, int cap); ++int pci_find_next_ext_capability(int seg, int bus, int devfn, int pos, int cap); + const char *parse_pci(const char *, unsigned int *seg, unsigned int *bus, + unsigned int *dev, unsigned int *func); + +--- /dev/null ++++ b/xen/include/xen/pci_ids.h +@@ -0,0 +1,9 @@ ++#define PCI_VENDOR_ID_AMD 0x1022 ++ ++#define PCI_VENDOR_ID_NVIDIA 0x10de ++ ++#define PCI_VENDOR_ID_OXSEMI 0x1415 ++ ++#define PCI_VENDOR_ID_BROADCOM 0x14e4 ++ ++#define PCI_VENDOR_ID_INTEL 0x8086 +--- a/xen/include/xen/pci_regs.h ++++ b/xen/include/xen/pci_regs.h +@@ -431,6 +431,7 @@ + #define PCI_EXT_CAP_ID_VC 2 + #define PCI_EXT_CAP_ID_DSN 3 + #define PCI_EXT_CAP_ID_PWR 4 ++#define PCI_EXT_CAP_ID_VNDR 11 + #define PCI_EXT_CAP_ID_ACS 13 + #define PCI_EXT_CAP_ID_ARI 14 + #define PCI_EXT_CAP_ID_ATS 15 +@@ -459,6 +460,7 @@ + #define PCI_ERR_COR_BAD_DLLP 0x00000080 /* Bad DLLP Status */ + #define PCI_ERR_COR_REP_ROLL 0x00000100 /* REPLAY_NUM Rollover */ + #define PCI_ERR_COR_REP_TIMER 0x00001000 /* Replay Timer Timeout */ ++#define PCI_ERR_COR_ADV_NFAT 0x00002000 /* Advisory Non-Fatal */ + #define PCI_ERR_COR_MASK 20 /* Correctable Error Mask */ + /* Same bits as above */ + #define PCI_ERR_CAP 24 /* Advanced Error Capabilities */ +@@ -510,6 +512,12 @@ + #define PCI_PWR_CAP 12 /* Capability */ + #define PCI_PWR_CAP_BUDGET(x) ((x) & 1) /* Included in system budget */ + ++/* Vendor-Specific (VSEC, PCI_EXT_CAP_ID_VNDR) */ ++#define PCI_VNDR_HEADER 4 /* Vendor-Specific Header */ ++#define PCI_VNDR_HEADER_ID(x) ((x) & 0xffff) ++#define PCI_VNDR_HEADER_REV(x) (((x) >> 16) & 0xf) ++#define PCI_VNDR_HEADER_LEN(x) (((x) >> 20) & 0xfff) ++ + /* + * Hypertransport sub capability types + * diff --git a/535a3516-VT-d-suppress-UR-signaling-for-desktop-chipsets.patch b/535a3516-VT-d-suppress-UR-signaling-for-desktop-chipsets.patch new file mode 100644 index 0000000..6e2e580 --- /dev/null +++ b/535a3516-VT-d-suppress-UR-signaling-for-desktop-chipsets.patch @@ -0,0 +1,66 @@ +References: bnc#826717 CVE-2013-3495 XSA-59 + +# Commit d6cb14b34ffc2a830022d059f1aa22bf19dcf55f +# Date 2014-04-25 12:12:38 +0200 +# Author Jan Beulich +# Committer Jan Beulich +VT-d: suppress UR signaling for desktop chipsets + +Unsupported Requests can be signaled for malformed writes to the MSI +address region, e.g. due to buggy or malicious DMA set up to that +region. These should normally result in IOMMU faults, but don't on +the desktop chipsets dealt with here. + +This is CVE-2013-3495 / XSA-59. + +Signed-off-by: Jan Beulich +Reviewed-by: Andrew Cooper +Acked-by: Don Dugger +Acked-by: Tim Deegan +Acked-by: Xiantao Zhang + +--- a/xen/drivers/passthrough/vtd/quirks.c ++++ b/xen/drivers/passthrough/vtd/quirks.c +@@ -393,6 +393,8 @@ void __init pci_vtd_quirk(struct pci_dev + int func = PCI_FUNC(pdev->devfn); + int pos; + u32 val; ++ u64 bar; ++ paddr_t pa; + + if ( pci_conf_read16(seg, bus, dev, func, PCI_VENDOR_ID) != + PCI_VENDOR_ID_INTEL ) +@@ -454,5 +456,33 @@ void __init pci_vtd_quirk(struct pci_dev + printk(XENLOG_INFO "Masked UR signaling on %04x:%02x:%02x.%u\n", + seg, bus, dev, func); + break; ++ ++ case 0x100: case 0x104: case 0x108: /* Sandybridge */ ++ case 0x150: case 0x154: case 0x158: /* Ivybridge */ ++ case 0xa04: /* Haswell ULT */ ++ case 0xc00: case 0xc04: case 0xc08: /* Haswell */ ++ bar = pci_conf_read32(seg, bus, dev, func, 0x6c); ++ bar = (bar << 32) | pci_conf_read32(seg, bus, dev, func, 0x68); ++ pa = bar & 0x7fffff000; /* bits 12...38 */ ++ if ( (bar & 1) && pa && ++ page_is_ram_type(paddr_to_pfn(pa), RAM_TYPE_RESERVED) ) ++ { ++ u32 __iomem *va = ioremap(pa, PAGE_SIZE); ++ ++ if ( va ) ++ { ++ __set_bit(0x1c8 * 8 + 20, va); ++ iounmap(va); ++ printk(XENLOG_INFO "Masked UR signaling on %04x:%02x:%02x.%u\n", ++ seg, bus, dev, func); ++ } ++ else ++ printk(XENLOG_ERR "Could not map %"PRIpaddr" for %04x:%02x:%02x.%u\n", ++ pa, seg, bus, dev, func); ++ } ++ else ++ printk(XENLOG_WARNING "Bogus DMIBAR %#"PRIx64" on %04x:%02x:%02x.%u\n", ++ bar, seg, bus, dev, func); ++ break; + } + } diff --git a/535a354b-passthrough-allow-to-suppress-SERR-and-PERR-signaling.patch b/535a354b-passthrough-allow-to-suppress-SERR-and-PERR-signaling.patch new file mode 100644 index 0000000..198f64f --- /dev/null +++ b/535a354b-passthrough-allow-to-suppress-SERR-and-PERR-signaling.patch @@ -0,0 +1,187 @@ +# Commit 1a2a390a560e8319a6be98c7ab6cfaebd230f67e +# Date 2014-04-25 12:13:31 +0200 +# Author Jan Beulich +# Committer Jan Beulich +passthrough: allow to suppress SERR and PERR signaling altogether + +This is just to have a workaround at hand in case other chipsets (not +covered by the previous two patches) also have similar issues. + +Signed-off-by: Jan Beulich +Reviewed-by: Andrew Cooper +Acked-by: Don Dugger +Acked-by: Tim Deegan +Acked-by: Xiantao Zhang + +--- a/docs/misc/xen-command-line.markdown ++++ b/docs/misc/xen-command-line.markdown +@@ -772,6 +772,14 @@ Defaults to booting secondary processors + + Default: `on` + ++### pci ++> `= {no-}serr | {no-}perr` ++ ++Disable signaling of SERR (system errors) and/or PERR (parity errors) ++on all PCI devices. ++ ++Default: Signaling left as set by firmware. ++ + ### pci-phantom + > `=[:]:,` + +--- a/xen/drivers/passthrough/pci.c ++++ b/xen/drivers/passthrough/pci.c +@@ -154,6 +154,115 @@ static void __init parse_phantom_dev(cha + } + custom_param("pci-phantom", parse_phantom_dev); + ++static u16 __read_mostly command_mask; ++static u16 __read_mostly bridge_ctl_mask; ++ ++/* ++ * The 'pci' parameter controls certain PCI device aspects. ++ * Optional comma separated value may contain: ++ * ++ * serr don't suppress system errors (default) ++ * no-serr suppress system errors ++ * perr don't suppress parity errors (default) ++ * no-perr suppress parity errors ++ */ ++static void __init parse_pci_param(char *s) ++{ ++ char *ss; ++ ++ do { ++ bool_t on = !!strncmp(s, "no-", 3); ++ u16 cmd_mask = 0, brctl_mask = 0; ++ ++ if ( !on ) ++ s += 3; ++ ++ ss = strchr(s, ','); ++ if ( ss ) ++ *ss = '\0'; ++ ++ if ( !strcmp(s, "serr") ) ++ { ++ cmd_mask = PCI_COMMAND_SERR; ++ brctl_mask = PCI_BRIDGE_CTL_SERR | PCI_BRIDGE_CTL_DTMR_SERR; ++ } ++ else if ( !strcmp(s, "perr") ) ++ { ++ cmd_mask = PCI_COMMAND_PARITY; ++ brctl_mask = PCI_BRIDGE_CTL_PARITY; ++ } ++ ++ if ( on ) ++ { ++ command_mask &= ~cmd_mask; ++ bridge_ctl_mask &= ~brctl_mask; ++ } ++ else ++ { ++ command_mask |= cmd_mask; ++ bridge_ctl_mask |= brctl_mask; ++ } ++ ++ s = ss + 1; ++ } while ( ss ); ++} ++custom_param("pci", parse_pci_param); ++ ++static void check_pdev(const struct pci_dev *pdev) ++{ ++#define PCI_STATUS_CHECK \ ++ (PCI_STATUS_PARITY | PCI_STATUS_SIG_TARGET_ABORT | \ ++ PCI_STATUS_REC_TARGET_ABORT | PCI_STATUS_REC_MASTER_ABORT | \ ++ PCI_STATUS_SIG_SYSTEM_ERROR | PCI_STATUS_DETECTED_PARITY) ++ u16 seg = pdev->seg; ++ u8 bus = pdev->bus; ++ u8 dev = PCI_SLOT(pdev->devfn); ++ u8 func = PCI_FUNC(pdev->devfn); ++ u16 val; ++ ++ if ( command_mask ) ++ { ++ val = pci_conf_read16(seg, bus, dev, func, PCI_COMMAND); ++ if ( val & command_mask ) ++ pci_conf_write16(seg, bus, dev, func, PCI_COMMAND, ++ val & ~command_mask); ++ val = pci_conf_read16(seg, bus, dev, func, PCI_STATUS); ++ if ( val & PCI_STATUS_CHECK ) ++ { ++ printk(XENLOG_INFO "%04x:%02x:%02x.%u status %04x -> %04x\n", ++ seg, bus, dev, func, val, val & ~PCI_STATUS_CHECK); ++ pci_conf_write16(seg, bus, dev, func, PCI_STATUS, ++ val & PCI_STATUS_CHECK); ++ } ++ } ++ ++ switch ( pci_conf_read8(seg, bus, dev, func, PCI_HEADER_TYPE) & 0x7f ) ++ { ++ case PCI_HEADER_TYPE_BRIDGE: ++ if ( !bridge_ctl_mask ) ++ break; ++ val = pci_conf_read16(seg, bus, dev, func, PCI_BRIDGE_CONTROL); ++ if ( val & bridge_ctl_mask ) ++ pci_conf_write16(seg, bus, dev, func, PCI_BRIDGE_CONTROL, ++ val & ~bridge_ctl_mask); ++ val = pci_conf_read16(seg, bus, dev, func, PCI_SEC_STATUS); ++ if ( val & PCI_STATUS_CHECK ) ++ { ++ printk(XENLOG_INFO ++ "%04x:%02x:%02x.%u secondary status %04x -> %04x\n", ++ seg, bus, dev, func, val, val & ~PCI_STATUS_CHECK); ++ pci_conf_write16(seg, bus, dev, func, PCI_SEC_STATUS, ++ val & PCI_STATUS_CHECK); ++ } ++ break; ++ ++ case PCI_HEADER_TYPE_CARDBUS: ++ /* TODO */ ++ break; ++ } ++#undef PCI_STATUS_CHECK ++} ++ + static struct pci_dev *alloc_pdev(struct pci_seg *pseg, u8 bus, u8 devfn) + { + struct pci_dev *pdev; +@@ -252,6 +361,8 @@ static struct pci_dev *alloc_pdev(struct + break; + } + ++ check_pdev(pdev); ++ + return pdev; + } + +@@ -566,6 +677,8 @@ int pci_add_device(u16 seg, u8 bus, u8 d + seg, bus, slot, func, ctrl); + } + ++ check_pdev(pdev); ++ + ret = 0; + if ( !pdev->domain ) + { +--- a/xen/include/xen/pci_regs.h ++++ b/xen/include/xen/pci_regs.h +@@ -125,7 +125,7 @@ + #define PCI_IO_RANGE_TYPE_16 0x00 + #define PCI_IO_RANGE_TYPE_32 0x01 + #define PCI_IO_RANGE_MASK (~0x0fUL) +-#define PCI_SEC_STATUS 0x1e /* Secondary status register, only bit 14 used */ ++#define PCI_SEC_STATUS 0x1e /* Secondary status register */ + #define PCI_MEMORY_BASE 0x20 /* Memory range behind */ + #define PCI_MEMORY_LIMIT 0x22 + #define PCI_MEMORY_RANGE_TYPE_MASK 0x0fUL +@@ -152,6 +152,7 @@ + #define PCI_BRIDGE_CTL_MASTER_ABORT 0x20 /* Report master aborts */ + #define PCI_BRIDGE_CTL_BUS_RESET 0x40 /* Secondary bus reset */ + #define PCI_BRIDGE_CTL_FAST_BACK 0x80 /* Fast Back2Back enabled on secondary interface */ ++#define PCI_BRIDGE_CTL_DTMR_SERR 0x800 /* SERR upon discard timer expiry */ + + /* Header type 2 (CardBus bridges) */ + #define PCI_CB_CAPABILITY_LIST 0x14 diff --git a/535e31bc-x86-HVM-correct-the-SMEP-logic-for-HVM_CR0_GUEST_RESERVED_BITS.patch b/535e31bc-x86-HVM-correct-the-SMEP-logic-for-HVM_CR0_GUEST_RESERVED_BITS.patch new file mode 100644 index 0000000..39d8864 --- /dev/null +++ b/535e31bc-x86-HVM-correct-the-SMEP-logic-for-HVM_CR0_GUEST_RESERVED_BITS.patch @@ -0,0 +1,43 @@ +# Commit 31ee951a3bee6e7cc21f94f900fe989e3701a79a +# Date 2014-04-28 12:47:24 +0200 +# Author Feng Wu +# Committer Jan Beulich +x86/HVM: correct the SMEP logic for HVM_CR0_GUEST_RESERVED_BITS + +When checking the SMEP feature for HVM guests, we should check the +VCPU instead of the host CPU. + +Signed-off-by: Feng Wu +Reviewed-by: Andrew Cooper + +--- a/xen/include/asm-x86/hvm/hvm.h ++++ b/xen/include/asm-x86/hvm/hvm.h +@@ -347,6 +347,19 @@ static inline int hvm_event_pending(stru + return hvm_funcs.event_pending(v); + } + ++static inline bool_t hvm_vcpu_has_smep(void) ++{ ++ unsigned int eax, ebx; ++ ++ hvm_cpuid(0, &eax, NULL, NULL, NULL); ++ ++ if ( eax < 7 ) ++ return 0; ++ ++ hvm_cpuid(7, NULL, &ebx, NULL, NULL); ++ return !!(ebx & cpufeat_mask(X86_FEATURE_SMEP)); ++} ++ + /* These reserved bits in lower 32 remain 0 after any load of CR0 */ + #define HVM_CR0_GUEST_RESERVED_BITS \ + (~((unsigned long) \ +@@ -366,7 +379,7 @@ static inline int hvm_event_pending(stru + X86_CR4_DE | X86_CR4_PSE | X86_CR4_PAE | \ + X86_CR4_MCE | X86_CR4_PGE | X86_CR4_PCE | \ + X86_CR4_OSFXSR | X86_CR4_OSXMMEXCPT | \ +- (cpu_has_smep ? X86_CR4_SMEP : 0) | \ ++ (hvm_vcpu_has_smep() ? X86_CR4_SMEP : 0) | \ + (cpu_has_fsgsbase ? X86_CR4_FSGSBASE : 0) | \ + ((nestedhvm_enabled((_v)->domain) && cpu_has_vmx)\ + ? X86_CR4_VMXE : 0) | \ diff --git a/xsa92.patch b/535fa503-x86-HVM-restrict-HVMOP_set_mem_type.patch similarity index 84% rename from xsa92.patch rename to 535fa503-x86-HVM-restrict-HVMOP_set_mem_type.patch index 2969992..8988d48 100644 --- a/xsa92.patch +++ b/535fa503-x86-HVM-restrict-HVMOP_set_mem_type.patch @@ -1,3 +1,9 @@ +References: bnc#875668 CVE-2014-3124 XSA-92 + +# Commit 83bb5eb4d340acebf27b34108fb1dae062146a68 +# Date 2014-04-29 15:11:31 +0200 +# Author Jan Beulich +# Committer Jan Beulich x86/HVM: restrict HVMOP_set_mem_type Permitting arbitrary type changes here has the potential of creating @@ -12,7 +18,7 @@ message. Afaict the similar operation in p2m_set_mem_access() is safe. -This is XSA-92. +This is CVE-2014-3124 / XSA-92. Signed-off-by: Jan Beulich Reviewed-by: Tim Deegan diff --git a/53636978-hvm_set_ioreq_page-releases-wrong-page-in-error-path.patch b/53636978-hvm_set_ioreq_page-releases-wrong-page-in-error-path.patch new file mode 100644 index 0000000..b1e4d28 --- /dev/null +++ b/53636978-hvm_set_ioreq_page-releases-wrong-page-in-error-path.patch @@ -0,0 +1,27 @@ +# Commit 16e2a7596e9fc86881c73cef57602b2c88155528 +# Date 2014-05-02 11:46:32 +0200 +# Author Paul Durrant +# Committer Jan Beulich +hvm_set_ioreq_page() releases wrong page in error path + +The function calls prepare_ring_for_helper() to acquire a mapping for the +given gmfn, then checks (under lock) to see if the ioreq page is already +set up but, if it is, the function then releases the in-use ioreq page +mapping on the error path rather than the one it just acquired. This patch +fixes this bug. + +Signed-off-by: Paul Durrant +Reviewed-by: Jan Beulich +Reviewed-by: Andrew Cooper + +--- a/xen/arch/x86/hvm/hvm.c ++++ b/xen/arch/x86/hvm/hvm.c +@@ -478,7 +478,7 @@ static int hvm_set_ioreq_page( + + if ( (iorp->va != NULL) || d->is_dying ) + { +- destroy_ring_for_helper(&iorp->va, iorp->page); ++ destroy_ring_for_helper(&va, page); + spin_unlock(&iorp->lock); + return -EINVAL; + } diff --git a/53636ebf-x86-fix-guest-CPUID-handling.patch b/53636ebf-x86-fix-guest-CPUID-handling.patch new file mode 100644 index 0000000..206f9d9 --- /dev/null +++ b/53636ebf-x86-fix-guest-CPUID-handling.patch @@ -0,0 +1,81 @@ +# Commit 4c0ff6bd54b5a67f8f820f9ed0a89a79f1a26a1c +# Date 2014-05-02 12:09:03 +0200 +# Author Jan Beulich +# Committer Jan Beulich +x86: fix guest CPUID handling + +The way XEN_DOMCTL_set_cpuid got handled so far allowed for surprises +to the caller. With this set of operations +- set leaf A (using array index 0) +- set leaf B (using array index 1) +- clear leaf A (clearing array index 0) +- set leaf B (using array index 0) +- clear leaf B (clearing array index 0) +the entry for leaf B at array index 1 would still be in place, while +the caller would expect it to be cleared. + +While looking at the use sites of d->arch.cpuid[] I also noticed that +the allocation of the array needlessly uses the zeroing form - the +relevant fields of the array elements get set in a loop immediately +following the allocation. + +Signed-off-by: Jan Beulich +Reviewed-by: Andrew Cooper +Reviewed-by: Tim Deegan + +--- a/xen/arch/x86/domain.c ++++ b/xen/arch/x86/domain.c +@@ -553,7 +553,7 @@ int arch_domain_create(struct domain *d, + + if ( !is_idle_domain(d) ) + { +- d->arch.cpuids = xzalloc_array(cpuid_input_t, MAX_CPUID_INPUT); ++ d->arch.cpuids = xmalloc_array(cpuid_input_t, MAX_CPUID_INPUT); + rc = -ENOMEM; + if ( d->arch.cpuids == NULL ) + goto fail; +--- a/xen/arch/x86/domctl.c ++++ b/xen/arch/x86/domctl.c +@@ -920,7 +920,7 @@ long arch_do_domctl( + case XEN_DOMCTL_set_cpuid: + { + xen_domctl_cpuid_t *ctl = &domctl->u.cpuid; +- cpuid_input_t *cpuid = NULL; ++ cpuid_input_t *cpuid, *unused = NULL; + int i; + + for ( i = 0; i < MAX_CPUID_INPUT; i++ ) +@@ -928,7 +928,11 @@ long arch_do_domctl( + cpuid = &d->arch.cpuids[i]; + + if ( cpuid->input[0] == XEN_CPUID_INPUT_UNUSED ) +- break; ++ { ++ if ( !unused ) ++ unused = cpuid; ++ continue; ++ } + + if ( (cpuid->input[0] == ctl->input[0]) && + ((cpuid->input[1] == XEN_CPUID_INPUT_UNUSED) || +@@ -936,15 +940,12 @@ long arch_do_domctl( + break; + } + +- if ( i == MAX_CPUID_INPUT ) +- { +- ret = -ENOENT; +- } ++ if ( i < MAX_CPUID_INPUT ) ++ *cpuid = *ctl; ++ else if ( unused ) ++ *unused = *ctl; + else +- { +- memcpy(cpuid, ctl, sizeof(cpuid_input_t)); +- ret = 0; +- } ++ ret = -ENOENT; + } + break; + diff --git a/libxl.add-option-for-discard-support-to-xl-disk-conf.patch b/libxl.add-option-for-discard-support-to-xl-disk-conf.patch index 8b1a050..aca3f65 100644 --- a/libxl.add-option-for-discard-support-to-xl-disk-conf.patch +++ b/libxl.add-option-for-discard-support-to-xl-disk-conf.patch @@ -54,7 +54,7 @@ Index: xen-4.4.0-testing/tools/libxl/libxl.c =================================================================== --- xen-4.4.0-testing.orig/tools/libxl/libxl.c +++ xen-4.4.0-testing/tools/libxl/libxl.c -@@ -2213,6 +2213,8 @@ static void device_disk_add(libxl__egc * +@@ -2480,6 +2480,8 @@ static void device_disk_add(libxl__egc * flexarray_append(back, disk->readwrite ? "w" : "r"); flexarray_append(back, "device-type"); flexarray_append(back, disk->is_cdrom ? "cdrom" : "disk"); diff --git a/libxl.pvscsi.patch b/libxl.pvscsi.patch new file mode 100644 index 0000000..31e759f --- /dev/null +++ b/libxl.pvscsi.patch @@ -0,0 +1,1189 @@ +* local-fate316613-pvscsi-staging-4.4 + git://github.com/olafhering/xen.git : local-fate316613-pvscsi-staging-4.4 + +Implement pvscsi in xl/libxl +fate#316613 , https://fate.suse.com/316613 + +10bd594 pvscsi: move parse_vscsi_config code block to avoid fuzz +06914e1 Merge pull request #4 from aaannz/pvscsi +fe65eb3 define SUSE PVSCSI extension for 3rd party use +8a34a98 pvscsi: check null pointer in libxl__add_vscsis +09fa151 pvscsi: avoid double assignment of host devices +aa88928 pvscsi: fix double free in scsi-attach +2de1507 pvscsi: update comments about libxl.so ABI +483f7e9 Merge pull request #3 from aaannz/pvscsi +d98458c Xen4.2 ABI compat +73744a5 preserve Xen4.2 ABI, WIP +0f8e701 fix minor memory leaks +1b1c55d pvscsi: correct comment for DEFINE_DEVICES_ADD +6f50972 pvscsi: move libxl__add_vscsis call +6fd1327 pvscsi: add comment for DEFINE_DEVICES_ADD +e4bf1fd pvscsi: fix DEFINE_DEVICE_REMOVE destroy +51b63a6 pvscsi: man pages +e461042 pvscsi: implememnt single device scsi-detach +540e524 Merge pull request #2 from aaannz/pvscsi +919a851 implement vscsi-attach +e07db68 fix indentation +b087b9d pvscsi: implement simple scsi-detach +824f286 pvscsi: simplify sysfs parsing in parse_vscsi_config +977d81d pvscsi: include stddef in xl_cmdimpl.c to get offsetof +ee2e7e5 Merge pull request #1 from aaannz/pvscsi +7de6f49 support character devices too +c84381b allow /dev/sda as scsi devspec +f11e3a2 pvscsi +Index: xen-4.4.0-testing/docs/man/xl.cfg.pod.5 +=================================================================== +--- xen-4.4.0-testing.orig/docs/man/xl.cfg.pod.5 ++++ xen-4.4.0-testing/docs/man/xl.cfg.pod.5 +@@ -380,6 +380,36 @@ value is optional if this is a guest dom + + =back + ++=item B ++ ++Specifies the PVSCSI devices to be provided to the guest. PVSCSI passes ++dom0 SCSI devices as-is to the guest. ++ ++Each B is a mapping from dom0 SCSI devices to guest visible ++SCSI devices, like 'pvdev,vdev[,option]'. Example: '/dev/sdm,3:0:4:5,feature-host' ++ ++=over 4 ++ ++=item C ++ ++Specifies the dom0 visible SCSI device. The string can be either a device path ++like to a block device like /dev/disk/by-id/scsi-XYZ. Or it can be a device path ++to a char device like /dev/sg5. Or it can be specified in the SCSI notation ++HOST:CHANNEL:TARGET:LUN. Note that the latter format is unreliable because ++the HOST value can change across dom0 reboots. ++ ++=item C ++ ++Specifies how the SCSI device is mapped into the guest. The notation is in ++SCSI notation HOST:CHANNEL:TARGET:LUN. HOST in this case means a virthal ++SCSI host within the guest. ++ ++=item C