Re: [Xen-devel] XSA-254 SP2 for ARM (was Re: [PATCH 1/5] xen/arm: Introduce enable callback to enable a capabilities on each online CPU)

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Thu, 18 Jan 2018, Julien Grall wrote:
> (+ Security team)
> 
> Hi Stefano,
> 
> On 17/01/18 21:47, Stefano Stabellini wrote:
> > On Wed, 17 Jan 2018, Stefano Stabellini wrote:
> > > On Wed, 17 Jan 2018, Lars Kurth wrote:
> > > >        Regarding README.source, this is covering file and contain the
> > > > same mention as in the commit message. As this is a single function.
> > > > Isn't the commit message
> > > >        enough?
> > > > 
> > > > 
> > > >  From a legal viewpoint it is enough.
> > > 
> > > If that is enough from a legal viewpoint, then it is enough for me.
> > > 
> > > However, from a legal viewpoint, I thought we needed to explicitly
> > > mention all the original signed-off-bys because Julien is not actually
> > > the copyright holder for that function, hence, we need to add the
> > > signed-off-bys of all the missing copyright holders.
> > 
> > Actually, reading again the Developer’s Certificate of Origin, it
> > states:
> > 
> > "The contribution is based upon previous work that, to the best of my
> > knowledge, is covered under an appropriate open source license and I have
> > the right under that license to submit that work with modifications, whether
> > created in whole or in part by me, under the same open source license
> > (unless I am permitted to submit under a different license), as indicated in
> > the file"
> > 
> > so I think Lars is right. In that case, there is no need to resubmit
> > this series, I'll commit to staging as is. If tests go well, I'll
> > backport it to the stable trees.
> Thank you! I have created branches with patches backported up to Xen 4.8. With
> minor changes:
> 
>    - Xen 4.10: No changes
>    - Xen 4.9:
>       * minor conflict in some files
>       * compilation failure in cpuerrata.c (__virt_to_mfn does not exist)
>    - Xen 4.8:
>       * conflict in some files (one medium as the number of "features" is
> different)
>       * compilation failure in cpuerrata.c (__virt_to_mfn does not exist)
>       
> The branches can be found on xenbits [1] : xsa-254-sp2-X.XX where X.XX is the
> version of Xen.
> 
> Xen 4.7 and earlier does not have cpufeature/cpuerrata infrastructure and will
> require backport. The only difficulty here should be finding the list of
> commits required.
> 
> Also, we probably want to update the XSA pointing to the patches. So if
> someone wants to backport to Xen 4.7 (or earlier) they can. Any opinions?

These are the commits for the XSA 254 mitigation for the arm64
architecture:

staging-4.10
b829d42829c1ff626a02756acae4dd482fc20c9a
0f7a4faafb2d79920cc63457cfca3e03990af4cc
d1f4283a1d8405a480b4121e1efcfaec8bbdbffa
cae6e1572f39a1906be0fc3bdaf49fe514c6a9c0
928112900e5b4a92ccebb2eea11665fd76aa0f0d
728fadb586a2a14a244dabd70463bcc1654ecc85

staging-4.9
2ec7ccbffc6b788f65e55498e4347c1ee3a44b01
50450c1f33dc72f2138a671d738934f796be3318
3790833ef16b95653424ec9b145e460ec1a56d16
fba48eff18c02d716c95b92df804a755620be82e
9f79e8d846e8413c828f5fc7cc6ac733728dff00
a2567d6b54b7b187ecc0165021b6dd07dafaf06a

staging-4.8
946dd2eefae2faeecbeb9662e66935c8070f64f5
85990bf53addcdb0ce8e458a3d8fad199710ac59
cf0b584c8c5030588bc47a3614ad860af7482c53
44139fed7c794eb4e47a9bb93061e325bd57fe8c
6f6786ef0d7f7025860d360f6b1267193ffd1b27

For staging-4.7, I made the backports and tested them as well. They look
correct. However, given that it was more complex than initially though,
I would appreciate if you could give it a look as well (I haven't pushed
it staging-4.7 yet):

  git://xenbits.xen.org/people/sstabellini/xen-unstable.git staging-4.7-xsa254

Thanks!

- Stefano

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel