[Xen-changelog] [xen stable-4.7] x86/entry: Erase guest GPR state on entry to Xen

[patchbot@xxxxxxx]

commit 3877c024ea4916ede177ef0067a081f73ee16c4d
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Feb 14 11:17:57 2018 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Feb 14 11:17:57 2018 +0100

    x86/entry: Erase guest GPR state on entry to Xen
    
    This reduces the number of code gadgets which can be attacked with arbitrary
    guest-controlled GPR values.
    
    This is part of XSA-254.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    master commit: 03bd8c3a70d101fc2f8f36f1e171b7594462a4cd
    master date: 2018-01-05 19:57:08 +0000
---
 xen/arch/x86/x86_64/compat/entry.S |  3 +--
 xen/arch/x86/x86_64/entry.S        |  2 +-
 xen/include/asm-x86/asm_defns.h    | 28 ++++++++++++++++++++++++----
 3 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/x86_64/compat/entry.S 
b/xen/arch/x86/x86_64/compat/entry.S
index f7e53fb..b5f087a 100644
--- a/xen/arch/x86/x86_64/compat/entry.S
+++ b/xen/arch/x86/x86_64/compat/entry.S
@@ -23,10 +23,9 @@ ENTRY(compat_hypercall)
 UNLIKELY_START(ne, msi_check)
         movl  $HYPERCALL_VECTOR,%edi
         call  check_for_unexpected_msi
-        LOAD_C_CLOBBERED compat=1 ax=0
 UNLIKELY_END(msi_check)
 
-        movl  UREGS_rax(%rsp),%eax
+        LOAD_C_CLOBBERED compat=1
         GET_CURRENT(bx)
 
         cmpl  $NR_hypercalls,%eax
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
index 2a56995..ed9eaee 100644
--- a/xen/arch/x86/x86_64/entry.S
+++ b/xen/arch/x86/x86_64/entry.S
@@ -159,7 +159,7 @@ ENTRY(lstar_enter)
         jz    switch_to_kernel
 
 /*hypercall:*/
-        movq  %r10,%rcx
+        LOAD_C_CLOBBERED cx=0
         cmpq  $NR_hypercalls,%rax
         jae   bad_hypercall
 #ifndef NDEBUG
diff --git a/xen/include/asm-x86/asm_defns.h b/xen/include/asm-x86/asm_defns.h
index e0e5836..9701008 100644
--- a/xen/include/asm-x86/asm_defns.h
+++ b/xen/include/asm-x86/asm_defns.h
@@ -232,7 +232,7 @@ static always_inline void stac(void)
 #endif
 
 #ifdef __ASSEMBLY__
-.macro SAVE_ALL op, compat=0
+.macro SAVE_ALL op, compat=0, clrargs=1
 .ifeqs "\op", "CLAC"
         ASM_CLAC
 .else
@@ -247,22 +247,34 @@ static always_inline void stac(void)
         addq  $-(UREGS_error_code-UREGS_r15), %rsp
         cld
         movq  %rdi,UREGS_rdi(%rsp)
+        xor   %edi, %edi
         movq  %rsi,UREGS_rsi(%rsp)
+        xor   %esi, %esi
         movq  %rdx,UREGS_rdx(%rsp)
+        xor   %edx, %edx
         movq  %rcx,UREGS_rcx(%rsp)
+        xor   %ecx, %ecx
         movq  %rax,UREGS_rax(%rsp)
+        xor   %eax, %eax
 .if !\compat
         movq  %r8,UREGS_r8(%rsp)
         movq  %r9,UREGS_r9(%rsp)
         movq  %r10,UREGS_r10(%rsp)
         movq  %r11,UREGS_r11(%rsp)
 .endif
+        xor   %r8, %r8
+        xor   %r9, %r9
+        xor   %r10, %r10
+        xor   %r11, %r11
         movq  %rbx,UREGS_rbx(%rsp)
+        xor   %ebx, %ebx
         movq  %rbp,UREGS_rbp(%rsp)
 #ifdef CONFIG_FRAME_POINTER
 /* Indicate special exception stack frame by inverting the frame pointer. */
         leaq  UREGS_rbp(%rsp), %rbp
         notq  %rbp
+#else
+        xor   %ebp, %ebp
 #endif
 .if !\compat
         movq  %r12,UREGS_r12(%rsp)
@@ -270,6 +282,10 @@ static always_inline void stac(void)
         movq  %r14,UREGS_r14(%rsp)
         movq  %r15,UREGS_r15(%rsp)
 .endif
+        xor   %r12, %r12
+        xor   %r13, %r13
+        xor   %r14, %r14
+        xor   %r15, %r15
 .endm
 
 #define LOAD_ONE_REG(reg, compat) \
@@ -286,17 +302,21 @@ static always_inline void stac(void)
  *
  * For the way it is used in RESTORE_ALL, this macro must preserve EFLAGS.ZF.
  */
-.macro LOAD_C_CLOBBERED compat=0 ax=1
+.macro LOAD_C_CLOBBERED compat=0 cx=1
 .if !\compat
         movq  UREGS_r11(%rsp),%r11
+.if \cx
         movq  UREGS_r10(%rsp),%r10
+.else
+        movq  UREGS_r10(%rsp),%rcx
+.endif
         movq  UREGS_r9(%rsp),%r9
         movq  UREGS_r8(%rsp),%r8
 .endif
-.if \ax
         LOAD_ONE_REG(ax, \compat)
-.endif
+.if \cx
         LOAD_ONE_REG(cx, \compat)
+.endif
         LOAD_ONE_REG(dx, \compat)
         LOAD_ONE_REG(si, \compat)
         LOAD_ONE_REG(di, \compat)
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog