mirror of
https://github.com/Stichting-MINIX-Research-Foundation/pkgsrc-ng.git
synced 2025-09-09 20:40:13 -04:00
92 lines
3.5 KiB
Plaintext
92 lines
3.5 KiB
Plaintext
$NetBSD: patch-XSA-182,v 1.1 2016/07/26 15:38:00 bouyer Exp $
|
|
|
|
backported from:
|
|
|
|
From 798c1498f764bfaa7b0b955bab40b01b0610d372 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
Date: Mon, 11 Jul 2016 14:32:03 +0100
|
|
Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
|
|
|
|
All changes in writeability and cacheability must go through full
|
|
re-validation.
|
|
|
|
Rework the logic as a whitelist, to make it clearer to follow.
|
|
|
|
This is XSA-182
|
|
|
|
--- xen/arch/x86/mm.c.orig 2016-07-26 16:33:46.000000000 +0200
|
|
+++ xen/arch/x86/mm.c 2016-07-26 16:37:14.000000000 +0200
|
|
@@ -1860,6 +1860,14 @@
|
|
_t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \
|
|
(_m), (_v), (_ad))
|
|
|
|
+/*
|
|
+ * PTE flags that a guest may change without re-validating the PTE.
|
|
+ * All other bits affect translation, caching, or Xen's safety.
|
|
+ */
|
|
+#define FASTPATH_FLAG_WHITELIST \
|
|
+ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \
|
|
+ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER)
|
|
+
|
|
/* Update the L1 entry at pl1e to new value nl1e. */
|
|
static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
|
|
unsigned long gl1mfn, int preserve_ad,
|
|
@@ -1900,8 +1908,8 @@
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping, r/w and presence. */
|
|
- if ( !l1e_has_changed(ol1e, nl1e, _PAGE_RW | _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings.*/
|
|
+ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l1e(nl1e, pt_dom);
|
|
if ( UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu,
|
|
@@ -1982,11 +1990,8 @@
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l2e_has_changed(ol2e, nl2e,
|
|
- unlikely(opt_allow_superpage)
|
|
- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
|
|
- : _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l2e(nl2e, d);
|
|
if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
|
|
@@ -2051,8 +2056,8 @@
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l3e(nl3e, d);
|
|
rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad);
|
|
@@ -2121,8 +2126,8 @@
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l4e(nl4e, d);
|
|
rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad);
|
|
|
|
--- xen/include/asm-x86/page.h.orig 2014-09-02 08:22:57.000000000 +0200
|
|
+++ xen/include/asm-x86/page.h 2016-07-26 16:39:51.000000000 +0200
|
|
@@ -332,6 +332,7 @@
|
|
#define _PAGE_AVAIL2 0x800U
|
|
#define _PAGE_AVAIL 0xE00U
|
|
#define _PAGE_PSE_PAT 0x1000U
|
|
+#define _PAGE_AVAIL_HIGH (0x7ffU << 12)
|
|
#define _PAGE_PAGED 0x2000U
|
|
#define _PAGE_SHARED 0x4000U
|
|
|