From 542f4fed39d01d6eca4bfac3b024c322308ef21d Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Thu, 4 Jun 2026 14:29:42 +1000
Subject: [PATCH] xen: patch with XSA-493

ARM-only issue. Despite us not supporting Aarch64 Xen on NixOS, it costs us
nothing to add the patches.

              Xen Security Advisory CVE-2025-10263 / XSA-493
                                 version 2

 Arm: Completion of memory accesses not guaranteed by completion of a TLBI

A hardware issue has been identified in certain Arm CPU designs.  A
broadcast TLBI on one PE may complete before affected memory accesses
on another PE are globally observed.  This may permit bypass of Stage 1
translation, Stage 2 translation, or GPT protection.

The erratum occurs when all of the following conditions are met:

 - A PE (PEx) executes a store.
 - Another PE (PEy) executes a TLBI instruction which applies to
   Stage 1 only information, Stage 1 and 2 information, or GPT
   information (but not Stage 2 only information), applies to the
   Inner Shareable or Outer Shareable domain containing PEx, and
   affects at least one of the bytes accessed by PEx's store.
 - PEy executes a DSB instruction which is sufficient to complete the
   TLBI instruction.
 - Complex micro-architectural conditions occur.

When all conditions are met, PEy's DSB may complete before the global
observation of a portion of PEx's store which was affected by the TLB
invalidation.  This store may complete at a later time, after memory
accesses which are ordered after the DSB.

The relevant TLB entries are invalidated correctly before the
completion of the DSB.  This erratum does not affect reads.

For more details, please refer to the Arm Security Center:
  https://developer.arm.com/Arm%20Security%20Center

A malicious guest may be able to write to memory it no longer has
permission to write to, after Xen has modified Stage 2 translation to
forbid writes to that location.  This could allow a guest to escalate
its privileges to that of the hypervisor.

https://xenbits.xen.org/xsa/advisory-493.html

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/xe/xen/package.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 4c44eddedc39..7dff5b98e7a7 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -296,6 +296,28 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-qNWe3iw+bYDtvBZ2KVfcy4VKu/waOyhoKZ0L8bqLdNc=";
     })
 
+    # XSA #493
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-01.patch";
+      hash = "sha256-SvAj+9CIyedpFENCB/lQTJUB4kpVkGh+z+NNk82lQqM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-02.patch";
+      hash = "sha256-4fajBBBKMnMTy7mvFSUghwkRbYo833s3jATeGfiOrjc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-03.patch";
+      hash = "sha256-/AI9gtd60UWf89NNd7+Zx1g+KyAIM2wCih/07LN5zt4=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-04.patch";
+      hash = "sha256-qvXQG9VZkgca/za3bx1zTDkmRz5lFT3JPkbdI1mlBGY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-05.patch";
+      hash = "sha256-6pGjjPjalw6TY0n9TInE3nCXNmt6BUxwy1r1xf55U7k=";
+    })
+
     # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";