Index: head/emulators/xen-kernel/Makefile
===================================================================
--- head/emulators/xen-kernel/Makefile	(revision 428495)
+++ head/emulators/xen-kernel/Makefile	(revision 428496)
@@ -1,75 +1,76 @@
 # $FreeBSD$
 
 PORTNAME=	xen
 PKGNAMESUFFIX=	-kernel
 PORTVERSION=	4.7.1
-PORTREVISION=   0
+PORTREVISION=   1
 CATEGORIES=	emulators
 MASTER_SITES=	http://downloads.xenproject.org/release/xen/${PORTVERSION}/
 
 MAINTAINER=	royger@FreeBSD.org
 COMMENT=	Hypervisor using a microkernel design
 
 LICENSE=	GPLv2
 
 ONLY_FOR_ARCHS=	amd64
 
 USES=		cpe gmake python:build
 
 # We need to use ld from ports because the version in base doesn't
 # support the '--build-id' switch that's needed for live hypervisor
 # hot-patching. Once the ld version in base supports this option the
 # dependency can be removed.
 #
 # GNU objcopy is used instead of elftc objcopy because of bug #533:
 # https://sourceforge.net/p/elftoolchain/tickets/533/
 # Once this is solved we should be able to switch to elfcopy.
 #
 # And finally we also need to use nm from binutils because the one
 # from base cannot deal with i386pep binary files which is the format
 # of the Xen EFI image (note that FreeBSD cannot yet boot as Dom0 from EFI,
 # but the image is built anyway). This is reported to elftc as bug #534:
 # https://sourceforge.net/p/elftoolchain/tickets/534/
 MAKE_ARGS=	clang=y PYTHON=${PYTHON_CMD} LD="${LD}" OBJCOPY="${OBJCOPY}" \
 		NM="${NM}"
 USE_BINUTILS=	yes
 NO_MTREE=	yes
 STRIP=		#
 PLIST_FILES=	/boot/xen \
 		/boot/xen.4th
 EXTRA_PATCHES=	${FILESDIR}/0001-xen-logdirty-prevent-preemption-if-finished.patch:-p1 \
 		${FILESDIR}/0002-xen-rework-paging_log_dirty_op-to-work-with-hvm-gues.patch:-p1 \
 		${FILESDIR}/kconf_arch.patch:-p1 \
 		${FILESDIR}/xsa191.patch \
 		${FILESDIR}/xsa192.patch \
 		${FILESDIR}/xsa193-4.7.patch \
 		${FILESDIR}/xsa194.patch \
-		${FILESDIR}/xsa195.patch
+		${FILESDIR}/xsa195.patch \
+		${FILESDIR}/xsa200-4.7.patch
 
 .include <bsd.port.options.mk>
 
 .if ${OPSYS} != FreeBSD
 IGNORE=		Only supported on FreeBSD
 .endif
 
 .if ${OSVERSION} < 1100055
 IGNORE=		Only supported on recent FreeBSD 11
 .endif
 
 pre-build:
 	${MAKE_CMD} -C ${WRKSRC}/xen defconfig ${MAKE_ARGS}
 	# Enable hypervisor hot-patching.
 	echo 'CONFIG_XSPLICE=y' >> ${WRKSRC}/xen/.config
 	echo 'CONFIG_FAST_SYMBOL_LOOKUP=y' >> ${WRKSRC}/xen/.config
 
 # The ports native 'build' target cannot be used because it sets
 # CFLAGS, and that breaks the Xen build system.
 do-build:
 	${MAKE_CMD} -j${MAKE_JOBS_NUMBER} -C ${WRKSRC}/xen build ${MAKE_ARGS}
 
 do-install:
 	${MKDIR} ${STAGEDIR}/boot
 	${INSTALL_PROGRAM} ${WRKSRC}/xen/xen ${STAGEDIR}/boot
 	${INSTALL_DATA} ${FILESDIR}/xen.4th ${STAGEDIR}/boot
 
 .include <bsd.port.mk>
Index: head/emulators/xen-kernel/files/xsa200-4.7.patch
===================================================================
--- head/emulators/xen-kernel/files/xsa200-4.7.patch	(nonexistent)
+++ head/emulators/xen-kernel/files/xsa200-4.7.patch	(revision 428496)
@@ -0,0 +1,55 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: x86emul: CMPXCHG8B ignores operand size prefix
+
+Otherwise besides mis-handling the instruction, the comparison failure
+case would result in uninitialized stack data being handed back to the
+guest in rDX:rAX (32 bits leaked for 32-bit guests, 96 bits for 64-bit
+ones).
+
+This is XSA-200.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+
+--- a/tools/tests/x86_emulator/test_x86_emulator.c
++++ b/tools/tests/x86_emulator/test_x86_emulator.c
+@@ -435,6 +435,24 @@ int main(int argc, char **argv)
+         goto fail;
+     printf("okay\n");
+ 
++    printf("%-40s", "Testing cmpxchg8b (%edi) [opsize]...");
++    instr[0] = 0x66; instr[1] = 0x0f; instr[2] = 0xc7; instr[3] = 0x0f;
++    res[0]      = 0x12345678;
++    res[1]      = 0x87654321;
++    regs.eflags = 0x200;
++    regs.eip    = (unsigned long)&instr[0];
++    regs.edi    = (unsigned long)res;
++    rc = x86_emulate(&ctxt, &emulops);
++    if ( (rc != X86EMUL_OKAY) ||
++         (res[0] != 0x12345678) ||
++         (res[1] != 0x87654321) ||
++         (regs.eax != 0x12345678) ||
++         (regs.edx != 0x87654321) ||
++         ((regs.eflags&0x240) != 0x200) ||
++         (regs.eip != (unsigned long)&instr[4]) )
++        goto fail;
++    printf("okay\n");
++
+     printf("%-40s", "Testing movsxbd (%%eax),%%ecx...");
+     instr[0] = 0x0f; instr[1] = 0xbe; instr[2] = 0x08;
+     regs.eflags = 0x200;
+--- a/xen/arch/x86/x86_emulate/x86_emulate.c
++++ b/xen/arch/x86/x86_emulate/x86_emulate.c
+@@ -4775,8 +4775,12 @@ x86_emulate(
+         generate_exception_if((modrm_reg & 7) != 1, EXC_UD, -1);
+         generate_exception_if(ea.type != OP_MEM, EXC_UD, -1);
+         if ( op_bytes == 8 )
++        {
+             host_and_vcpu_must_have(cx16);
+-        op_bytes *= 2;
++            op_bytes = 16;
++        }
++        else
++            op_bytes = 8;
+ 
+         /* Get actual old value. */
+         if ( (rc = ops->read(ea.mem.seg, ea.mem.off, old, op_bytes,

Property changes on: head/emulators/xen-kernel/files/xsa200-4.7.patch
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property