xen: update port and apply security fixes

 * Apply the following Xen security fixes (XSAs): 167, 168, 170.
 * Update SeaBIOS version to 1.8.2, and apply build fix so it builds with
   ELF toolchain objcopy [0].
 * Perform the backport of two functional changes to the Xen kernel in order
   to improve PVH Dom0 hardware support [1].

Security:		CVE-2016-1570
Security:		CVE-2016-1571
Security:		CVE-2016-2271
Sponsored by:		Citrix Systems R&D
Requested by:		Gustau Pérez <gperez@entel.upc.edu> [1]
PR:			207170 [0]
Approved by:		bapt
Differential revision:	https://reviews.freebsd.org/D5420

6 files changed, 439 insertions, 2 deletions

diff --git a/emulators/xen-kernel/Makefile b/emulators/xen-kernel/Makefile
index 0beaeb325168..87d5d0111598 100644
--- a/emulators/xen-kernel/Makefile
+++ b/emulators/xen-kernel/Makefile
@@ -3,7 +3,7 @@
 PORTNAME=	xen
 PKGNAMESUFFIX=	-kernel
 PORTVERSION=	4.5.2
-PORTREVISION=   1
+PORTREVISION=   2
 CATEGORIES=	emulators
 MASTER_SITES=	http://bits.xensource.com/oss-xen/release/${PORTVERSION}/
 
@@ -31,10 +31,15 @@ EXTRA_PATCHES=	${FILESDIR}/0001-introduce-a-helper-to-allocate-non-contiguous-me
 		${FILESDIR}/0005-x86-rework-paging_log_dirty_op-to-work-with-hvm-gues.patch:-p2 \
 		${FILESDIR}/0006-xen-pvh-enable-mmu_update-hypercall.patch:-p2 \
 		${FILESDIR}/0007-iommu-fix-usage-of-shared-EPT-IOMMU-page-tables-on-P.patch:-p2 \
+		${FILESDIR}/0001-x86-pvh-use-a-custom-IO-bitmap-for-PVH-hardware-doma.patch:-p2 \
+		${FILESDIR}/0002-x86-pvh-trap-access-to-sensitive-IO-ports.patch:-p2 \
 		${FILESDIR}/xsa156-4.5.patch:-p2 \
 		${FILESDIR}/xsa159.patch:-p2 \
 		${FILESDIR}/xsa165-4.5.patch:-p2 \
-		${FILESDIR}/xsa166-4.5.patch:-p2
+		${FILESDIR}/xsa166-4.5.patch:-p2 \
+		${FILESDIR}/xsa167-4.6.patch:-p2 \
+		${FILESDIR}/xsa168.patch:-p2 \
+		${FILESDIR}/xsa170-4.5.patch:-p2
 
 
 .include <bsd.port.options.mk>
diff --git a/emulators/xen-kernel/files/0001-x86-pvh-use-a-custom-IO-bitmap-for-PVH-hardware-doma.patch b/emulators/xen-kernel/files/0001-x86-pvh-use-a-custom-IO-bitmap-for-PVH-hardware-doma.patch
new file mode 100644
index 000000000000..85899ea7dbf1
--- /dev/null
+++ b/emulators/xen-kernel/files/0001-x86-pvh-use-a-custom-IO-bitmap-for-PVH-hardware-doma.patch
@@ -0,0 +1,197 @@
+From 8ddb99287cd18da99a95a9f70904a97b52893599 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Wed, 20 May 2015 13:26:43 +0200
+Subject: [PATCH 1/2] x86/pvh: use a custom IO bitmap for PVH hardware domains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since a PVH hardware domain has access to the physical hardware create a
+custom more permissive IO bitmap. The permissions set on the bitmap are
+populated based on the contents of the ioports rangeset.
+
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+---
+ xen/arch/x86/hvm/hvm.c           | 24 ++++++++++++++++++++++--
+ xen/arch/x86/hvm/svm/vmcb.c      |  2 +-
+ xen/arch/x86/hvm/vmx/vmcs.c      |  4 ++--
+ xen/arch/x86/setup.c             | 28 ++++++++++++++++++++++++++++
+ xen/common/domain.c              |  3 +++
+ xen/include/asm-x86/hvm/domain.h |  2 ++
+ xen/include/asm-x86/setup.h      |  1 +
+ 7 files changed, 59 insertions(+), 5 deletions(-)
+
+diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
+index 689e402..89423fa 100644
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -77,9 +77,13 @@ integer_param("hvm_debug", opt_hvm_debug_level);
+ 
+ struct hvm_function_table hvm_funcs __read_mostly;
+ 
+-/* I/O permission bitmap is globally shared by all HVM guests. */
++/*
++ * The I/O permission bitmap is globally shared by all HVM guests except
++ * the hardware domain which needs a more permissive one.
++ */
++#define HVM_IOBITMAP_SIZE (3 * PAGE_SIZE)
+ unsigned long __attribute__ ((__section__ (".bss.page_aligned")))
+-    hvm_io_bitmap[3*PAGE_SIZE/BYTES_PER_LONG];
++    hvm_io_bitmap[HVM_IOBITMAP_SIZE / BYTES_PER_LONG];
+ 
+ /* Xen command-line option to enable HAP */
+ static bool_t __initdata opt_hap_enabled = 1;
+@@ -1461,6 +1465,20 @@ int hvm_domain_initialise(struct domain *d)
+         goto fail1;
+     d->arch.hvm_domain.io_handler->num_slot = 0;
+ 
++    /* Set the default IO Bitmap. */
++    if ( is_hardware_domain(d) )
++    {
++        d->arch.hvm_domain.io_bitmap = _xmalloc(HVM_IOBITMAP_SIZE, PAGE_SIZE);
++        if ( d->arch.hvm_domain.io_bitmap == NULL )
++        {
++            rc = -ENOMEM;
++            goto fail1;
++        }
++        memset(d->arch.hvm_domain.io_bitmap, ~0, HVM_IOBITMAP_SIZE);
++    }
++    else
++        d->arch.hvm_domain.io_bitmap = hvm_io_bitmap;
++
+     if ( is_pvh_domain(d) )
+     {
+         register_portio_handler(d, 0, 0x10003, handle_pvh_io);
+@@ -1496,6 +1514,8 @@ int hvm_domain_initialise(struct domain *d)
+     stdvga_deinit(d);
+     vioapic_deinit(d);
+  fail1:
++    if ( is_hardware_domain(d) )
++        xfree(d->arch.hvm_domain.io_bitmap);
+     xfree(d->arch.hvm_domain.io_handler);
+     xfree(d->arch.hvm_domain.params);
+  fail0:
+diff --git a/xen/arch/x86/hvm/svm/vmcb.c b/xen/arch/x86/hvm/svm/vmcb.c
+index 21292bb..6339d2a 100644
+--- a/xen/arch/x86/hvm/svm/vmcb.c
++++ b/xen/arch/x86/hvm/svm/vmcb.c
+@@ -118,7 +118,7 @@ static int construct_vmcb(struct vcpu *v)
+         svm_disable_intercept_for_msr(v, MSR_AMD64_LWP_CBADDR);
+ 
+     vmcb->_msrpm_base_pa = (u64)virt_to_maddr(arch_svm->msrpm);
+-    vmcb->_iopm_base_pa  = (u64)virt_to_maddr(hvm_io_bitmap);
++    vmcb->_iopm_base_pa = __pa(v->domain->arch.hvm_domain.io_bitmap);
+ 
+     /* Virtualise EFLAGS.IF and LAPIC TPR (CR8). */
+     vmcb->_vintr.fields.intr_masking = 1;
+diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
+index 3123706..355d1b5 100644
+--- a/xen/arch/x86/hvm/vmx/vmcs.c
++++ b/xen/arch/x86/hvm/vmx/vmcs.c
+@@ -1032,8 +1032,8 @@ static int construct_vmcs(struct vcpu *v)
+     }
+ 
+     /* I/O access bitmap. */
+-    __vmwrite(IO_BITMAP_A, virt_to_maddr((char *)hvm_io_bitmap + 0));
+-    __vmwrite(IO_BITMAP_B, virt_to_maddr((char *)hvm_io_bitmap + PAGE_SIZE));
++    __vmwrite(IO_BITMAP_A, __pa(d->arch.hvm_domain.io_bitmap));
++    __vmwrite(IO_BITMAP_B, __pa(d->arch.hvm_domain.io_bitmap) + PAGE_SIZE);
+ 
+     if ( cpu_has_vmx_virtual_intr_delivery )
+     {
+diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
+index 2b9787a..cd333f9 100644
+--- a/xen/arch/x86/setup.c
++++ b/xen/arch/x86/setup.c
+@@ -1446,6 +1446,8 @@ void __init noreturn __start_xen(unsigned long mbi_p)
+ 
+     dmi_end_boot();
+ 
++    setup_io_bitmap(dom0);
++
+     system_state = SYS_STATE_active;
+ 
+     domain_unpause_by_systemcontroller(dom0);
+@@ -1509,6 +1511,32 @@ int __hwdom_init xen_in_range(unsigned long mfn)
+     return 0;
+ }
+ 
++static int __hwdom_init io_bitmap_cb(unsigned long s, unsigned long e,
++                                     void *ctx)
++{
++    struct domain *d = ctx;
++    unsigned int i;
++
++    ASSERT(e <= INT_MAX);
++    for ( i = s; i <= e; i++ )
++        __clear_bit(i, d->arch.hvm_domain.io_bitmap);
++
++    return 0;
++}
++
++void __hwdom_init setup_io_bitmap(struct domain *d)
++{
++    int rc;
++
++    if ( has_hvm_container_domain(d) )
++    {
++        bitmap_fill(d->arch.hvm_domain.io_bitmap, 0x10000);
++        rc = rangeset_report_ranges(d->arch.ioport_caps, 0, 0x10000,
++                                    io_bitmap_cb, d);
++        BUG_ON(rc);
++    }
++}
++
+ /*
+  * Local variables:
+  * mode: C
+diff --git a/xen/common/domain.c b/xen/common/domain.c
+index 6803c4d..b0e83f5 100644
+--- a/xen/common/domain.c
++++ b/xen/common/domain.c
+@@ -42,6 +42,7 @@
+ #include <xsm/xsm.h>
+ #include <xen/trace.h>
+ #include <xen/tmem.h>
++#include <asm/setup.h>
+ 
+ /* Linux config option: propageted to domain0 */
+ /* xen_processor_pmbits: xen control Cx, Px, ... */
+@@ -219,6 +220,8 @@ static int late_hwdom_init(struct domain *d)
+     rangeset_swap(d->iomem_caps, dom0->iomem_caps);
+ #ifdef CONFIG_X86
+     rangeset_swap(d->arch.ioport_caps, dom0->arch.ioport_caps);
++    setup_io_bitmap(d);
++    setup_io_bitmap(dom0);
+ #endif
+ 
+     rcu_unlock_domain(dom0);
+diff --git a/xen/include/asm-x86/hvm/domain.h b/xen/include/asm-x86/hvm/domain.h
+index 0f8b19a..bdab45d 100644
+--- a/xen/include/asm-x86/hvm/domain.h
++++ b/xen/include/asm-x86/hvm/domain.h
+@@ -141,6 +141,8 @@ struct hvm_domain {
+      */
+     uint64_t sync_tsc;
+ 
++    unsigned long *io_bitmap;
++
+     union {
+         struct vmx_domain vmx;
+         struct svm_domain svm;
+diff --git a/xen/include/asm-x86/setup.h b/xen/include/asm-x86/setup.h
+index 08bc23a..381d9f8 100644
+--- a/xen/include/asm-x86/setup.h
++++ b/xen/include/asm-x86/setup.h
+@@ -32,6 +32,7 @@ int construct_dom0(
+     module_t *initrd,
+     void *(*bootstrap_map)(const module_t *),
+     char *cmdline);
++void setup_io_bitmap(struct domain *d);
+ 
+ unsigned long initial_images_nrpages(nodeid_t node);
+ void discard_initial_images(void);
+-- 
+2.5.4 (Apple Git-61)
+
diff --git a/emulators/xen-kernel/files/0002-x86-pvh-trap-access-to-sensitive-IO-ports.patch b/emulators/xen-kernel/files/0002-x86-pvh-trap-access-to-sensitive-IO-ports.patch
new file mode 100644
index 000000000000..9ff23290678d
--- /dev/null
+++ b/emulators/xen-kernel/files/0002-x86-pvh-trap-access-to-sensitive-IO-ports.patch
@@ -0,0 +1,52 @@
+From 72d5acdc1d5b83107066e25054f9119e7771cf70 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
+Date: Wed, 20 May 2015 13:27:23 +0200
+Subject: [PATCH 2/2] x86/pvh: trap access to sensitive IO ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is needed so Xen can properly trap 4 byte accesses to 0xcf8 in order to
+keep consistency with accesses to 0xcfc.
+
+The access to RTC ports also needs to be trapped in order to keep
+consistency, this includes RTC_PORT(0) and RTC_PORT(1) (0x70 and 0x71
+respectively).
+
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+---
+ xen/arch/x86/setup.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
+index cd333f9..2cc9185 100644
+--- a/xen/arch/x86/setup.c
++++ b/xen/arch/x86/setup.c
+@@ -49,6 +49,7 @@
+ #include <xen/cpu.h>
+ #include <asm/nmi.h>
+ #include <asm/alternative.h>
++#include <asm/mc146818rtc.h>
+ 
+ /* opt_nosmp: If true, secondary processors are ignored. */
+ static bool_t __initdata opt_nosmp;
+@@ -1534,6 +1535,16 @@ void __hwdom_init setup_io_bitmap(struct domain *d)
+         rc = rangeset_report_ranges(d->arch.ioport_caps, 0, 0x10000,
+                                     io_bitmap_cb, d);
+         BUG_ON(rc);
++        /*
++         * NB: we need to trap accesses to 0xcf8 in order to intercept
++         * 4 byte accesses, that need to be handled by Xen in order to
++         * keep consistency.
++         * Access to 1 byte RTC ports also needs to be trapped in order
++         * to keep consistency with PV.
++         */
++        __set_bit(0xcf8, d->arch.hvm_domain.io_bitmap);
++        __set_bit(RTC_PORT(0), d->arch.hvm_domain.io_bitmap);
++        __set_bit(RTC_PORT(1), d->arch.hvm_domain.io_bitmap);
+     }
+ }
+ 
+-- 
+2.5.4 (Apple Git-61)
+
diff --git a/emulators/xen-kernel/files/xsa167-4.6.patch b/emulators/xen-kernel/files/xsa167-4.6.patch
new file mode 100644
index 000000000000..05fe35b3c769
--- /dev/null
+++ b/emulators/xen-kernel/files/xsa167-4.6.patch
@@ -0,0 +1,77 @@
+x86/mm: PV superpage handling lacks sanity checks
+
+MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before
+dereferencing pointers into the superpage frame table.
+
+get_superpage() has a similar issue.
+
+This is XSA-167.
+
+Reported-by: Qinghao Tang <luodalongde@gmail.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+
+--- a/xen/arch/x86/mm.c
++++ b/xen/arch/x86/mm.c
+@@ -2624,6 +2624,9 @@ int get_superpage(unsigned long mfn, str
+ 
+     ASSERT(opt_allow_superpage);
+ 
++    if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
++        return -EINVAL;
++
+     spage = mfn_to_spage(mfn);
+     y = spage->type_info;
+     do {
+@@ -3401,42 +3404,26 @@ long do_mmuext_op(
+         }
+ 
+         case MMUEXT_MARK_SUPER:
++        case MMUEXT_UNMARK_SUPER:
+         {
+             unsigned long mfn = op.arg1.mfn;
+ 
+-            if ( unlikely(d != pg_owner) )
+-                rc = -EPERM;
+-            else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
+-            {
+-                MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
+-                okay = 0;
+-            }
+-            else if ( !opt_allow_superpage )
++            if ( !opt_allow_superpage )
+             {
+                 MEM_LOG("Superpages disallowed");
+                 rc = -ENOSYS;
+             }
+-            else
+-                rc = mark_superpage(mfn_to_spage(mfn), d);
+-            break;
+-        }
+-
+-        case MMUEXT_UNMARK_SUPER:
+-        {
+-            unsigned long mfn = op.arg1.mfn;
+-
+-            if ( unlikely(d != pg_owner) )
++            else if ( unlikely(d != pg_owner) )
+                 rc = -EPERM;
+-            else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
++            else if ( mfn & (L1_PAGETABLE_ENTRIES - 1) )
+             {
+                 MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
+-                okay = 0;
+-            }
+-            else if ( !opt_allow_superpage )
+-            {
+-                MEM_LOG("Superpages disallowed");
+-                rc = -ENOSYS;
++                rc = -EINVAL;
+             }
++            else if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
++                rc = -EINVAL;
++            else if ( op.cmd == MMUEXT_MARK_SUPER )
++                rc = mark_superpage(mfn_to_spage(mfn), d);
+             else
+                 rc = unmark_superpage(mfn_to_spage(mfn));
+             break;
diff --git a/emulators/xen-kernel/files/xsa168.patch b/emulators/xen-kernel/files/xsa168.patch
new file mode 100644
index 000000000000..856f02e6fc93
--- /dev/null
+++ b/emulators/xen-kernel/files/xsa168.patch
@@ -0,0 +1,27 @@
+x86/VMX: prevent INVVPID failure due to non-canonical guest address
+
+While INVLPG (and on SVM INVLPGA) don't fault on non-canonical
+addresses, INVVPID fails (in the "individual address" case) when passed
+such an address.
+
+Since such intercepted INVLPG are effectively no-ops anyway, don't fix
+this in vmx_invlpg_intercept(), but instead have paging_invlpg() never
+return true in such a case.
+
+This is XSA-168.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+
+--- a/xen/include/asm-x86/paging.h
++++ b/xen/include/asm-x86/paging.h
+@@ -245,7 +245,7 @@ paging_fault(unsigned long va, struct cp
+  * or 0 if it's safe not to do so. */
+ static inline int paging_invlpg(struct vcpu *v, unsigned long va)
+ {
+-    return paging_get_hostmode(v)->invlpg(v, va);
++    return is_canonical_address(va) && paging_get_hostmode(v)->invlpg(v, va);
+ }
+ 
+ /* Translate a guest virtual address to the frame number that the
diff --git a/emulators/xen-kernel/files/xsa170-4.5.patch b/emulators/xen-kernel/files/xsa170-4.5.patch
new file mode 100644
index 000000000000..00045c209cd7
--- /dev/null
+++ b/emulators/xen-kernel/files/xsa170-4.5.patch
@@ -0,0 +1,79 @@
+x86/VMX: sanitize rIP before re-entering guest
+
+... to prevent guest user mode arranging for a guest crash (due to
+failed VM entry). (On the AMD system I checked, hardware is doing
+exactly the canonicalization being added here.)
+
+Note that fixing this in an architecturally correct way would be quite
+a bit more involved: Making the x86 instruction emulator check all
+branch targets for validity, plus dealing with invalid rIP resulting
+from update_guest_eip() or incoming directly during a VM exit. The only
+way to get the latter right would be by not having hardware do the
+injection.
+
+Note further that there are a two early returns from
+vmx_vmexit_handler(): One (through vmx_failed_vmentry()) leads to
+domain_crash() anyway, and the other covers real mode only and can
+neither occur with a non-canonical rIP nor result in an altered rIP,
+so we don't need to force those paths through the checking logic.
+
+This is XSA-170.
+
+Reported-by: 刘令 <liuling-it@360.cn>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+--- a/xen/arch/x86/hvm/vmx/vmx.c
++++ b/xen/arch/x86/hvm/vmx/vmx.c
+@@ -2675,7 +2675,7 @@ void vmx_handle_EOI_induced_exit(struct
+ void vmx_vmexit_handler(struct cpu_user_regs *regs)
+ {
+     unsigned long exit_qualification, exit_reason, idtv_info, intr_info = 0;
+-    unsigned int vector = 0;
++    unsigned int vector = 0, mode;
+     struct vcpu *v = current;
+ 
+     __vmread(GUEST_RIP,    &regs->rip);
+@@ -3219,6 +3219,41 @@ void vmx_vmexit_handler(struct cpu_user_
+ out:
+     if ( nestedhvm_vcpu_in_guestmode(v) )
+         nvmx_idtv_handling();
++
++    /*
++     * VM entry will fail (causing the guest to get crashed) if rIP (and
++     * rFLAGS, but we don't have an issue there) doesn't meet certain
++     * criteria. As we must not allow less than fully privileged mode to have
++     * such an effect on the domain, we correct rIP in that case (accepting
++     * this not being architecturally correct behavior, as the injected #GP
++     * fault will then not see the correct [invalid] return address).
++     * And since we know the guest will crash, we crash it right away if it
++     * already is in most privileged mode.
++     */
++    mode = vmx_guest_x86_mode(v);
++    if ( mode == 8 ? !is_canonical_address(regs->rip)
++                   : regs->rip != regs->_eip )
++    {
++        struct segment_register ss;
++
++        gdprintk(XENLOG_WARNING, "Bad rIP %lx for mode %u\n", regs->rip, mode);
++
++        vmx_get_segment_register(v, x86_seg_ss, &ss);
++        if ( ss.attr.fields.dpl )
++        {
++            __vmread(VM_ENTRY_INTR_INFO, &intr_info);
++            if ( !(intr_info & INTR_INFO_VALID_MASK) )
++                hvm_inject_hw_exception(TRAP_gp_fault, 0);
++            /* Need to fix rIP nevertheless. */
++            if ( mode == 8 )
++                regs->rip = (long)(regs->rip << (64 - VADDR_BITS)) >>
++                            (64 - VADDR_BITS);
++            else
++                regs->rip = regs->_eip;
++        }
++        else
++            domain_crash(v->domain);
++    }
+ }
+ 
+ void vmx_vmenter_helper(const struct cpu_user_regs *regs)