diff options
author | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:46:11 +0100 |
---|---|---|
committer | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:46:11 +0100 |
commit | 087ade3adfa5390f3ae068cf36e6a6f85130706e (patch) | |
tree | d0b206642298fbfb3b48fff94591abe2239e6df4 | |
parent | a5edee59689d6b4a0ca2ece6eb242ed7fd33bbe8 (diff) | |
download | xen-087ade3adfa5390f3ae068cf36e6a6f85130706e.tar.gz xen-087ade3adfa5390f3ae068cf36e6a6f85130706e.tar.bz2 xen-087ade3adfa5390f3ae068cf36e6a6f85130706e.zip |
x86-64: fix #GP generation in assembly code
When guest use of sysenter (64-bit PV guest) or syscall (32-bit PV
guest) gets converted into a GP fault (due to no callback having got
registered), we must
- honor the GP fault handler's request the keep enabled or mask event
delivery
- not allow TBF_EXCEPTION to remain set past the generation of the
(guest) exception in the vCPU's trap_bounce.flags, as that would
otherwise allow for the next exception occurring in guest mode,
should it happen to get handled in Xen itself, to nevertheless get
bounced to the guest kernel.
Also, just like compat mode syscall handling already did, native mode
sysenter handling should, when converting to #GP, subtract 2 from the
RIP present in the frame so that the guest's GP fault handler would
see the fault pointing to the offending instruction instead of past it.
Finally, since those exception generating code blocks needed to be
modified anyway, convert them to make use of UNLIKELY_{START,END}().
[ This bug is security vulnerability, XSA-8 / CVE-2012-0218. ]
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Committed-by: Jan Beulich <jbeulich@suse.com>
xen-unstable changeset: 25200:80f4113be500 25204:569d6f05e1ef
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
-rw-r--r-- | xen/arch/x86/x86_64/asm-offsets.c | 2 | ||||
-rw-r--r-- | xen/arch/x86/x86_64/compat/entry.S | 24 | ||||
-rw-r--r-- | xen/arch/x86/x86_64/entry.S | 21 |
3 files changed, 27 insertions, 20 deletions
diff --git a/xen/arch/x86/x86_64/asm-offsets.c b/xen/arch/x86/x86_64/asm-offsets.c index d8024bb169..d95739a182 100644 --- a/xen/arch/x86/x86_64/asm-offsets.c +++ b/xen/arch/x86/x86_64/asm-offsets.c @@ -90,6 +90,8 @@ void __dummy__(void) arch.guest_context.trap_ctxt[TRAP_gp_fault].address); OFFSET(VCPU_gp_fault_sel, struct vcpu, arch.guest_context.trap_ctxt[TRAP_gp_fault].cs); + OFFSET(VCPU_gp_fault_flags, struct vcpu, + arch.guest_context.trap_ctxt[TRAP_gp_fault].flags); OFFSET(VCPU_kernel_sp, struct vcpu, arch.guest_context.kernel_sp); OFFSET(VCPU_kernel_ss, struct vcpu, arch.guest_context.kernel_ss); OFFSET(VCPU_guest_context_flags, struct vcpu, arch.guest_context.flags); diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 8208b6b54f..85bf42f2fb 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -214,6 +214,7 @@ compat_failsafe_callback: ENTRY(compat_post_handle_exception) testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx) jz compat_test_all_events +.Lcompat_bounce_exception: call compat_create_bounce_frame movb $0,TRAPBOUNCE_flags(%rdx) jmp compat_test_all_events @@ -226,19 +227,20 @@ ENTRY(compat_syscall) leaq VCPU_trap_bounce(%rbx),%rdx testl $~3,%esi leal (,%rcx,TBF_INTERRUPT),%ecx - jz 2f -1: movq %rax,TRAPBOUNCE_eip(%rdx) - movw %si,TRAPBOUNCE_cs(%rdx) - movb %cl,TRAPBOUNCE_flags(%rdx) - call compat_create_bounce_frame - jmp compat_test_all_events -2: movl $TRAP_gp_fault,UREGS_entry_vector(%rsp) +UNLIKELY_START(z, compat_syscall_gpf) + movl $TRAP_gp_fault,UREGS_entry_vector(%rsp) subl $2,UREGS_rip(%rsp) - movq VCPU_gp_fault_addr(%rbx),%rax - movzwl VCPU_gp_fault_sel(%rbx),%esi - movb $(TBF_EXCEPTION|TBF_EXCEPTION_ERRCODE|TBF_INTERRUPT),%cl movl $0,TRAPBOUNCE_error_code(%rdx) - jmp 1b + movl VCPU_gp_fault_addr(%rbx),%eax + movzwl VCPU_gp_fault_sel(%rbx),%esi + testb $4,VCPU_gp_fault_flags(%rbx) + setnz %cl + leal TBF_EXCEPTION|TBF_EXCEPTION_ERRCODE(,%rcx,TBF_INTERRUPT),%ecx +UNLIKELY_END(compat_syscall_gpf) + movq %rax,TRAPBOUNCE_eip(%rdx) + movw %si,TRAPBOUNCE_cs(%rdx) + movb %cl,TRAPBOUNCE_flags(%rdx) + jmp .Lcompat_bounce_exception ENTRY(compat_sysenter) cmpl $TRAP_gp_fault,UREGS_entry_vector(%rsp) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index c8db00cb38..1f389fa502 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -289,19 +289,21 @@ sysenter_eflags_saved: leaq VCPU_trap_bounce(%rbx),%rdx testq %rax,%rax leal (,%rcx,TBF_INTERRUPT),%ecx - jz 2f -1: movq VCPU_domain(%rbx),%rdi +UNLIKELY_START(z, sysenter_gpf) + movl $TRAP_gp_fault,UREGS_entry_vector(%rsp) + subq $2,UREGS_rip(%rsp) + movl %eax,TRAPBOUNCE_error_code(%rdx) + movq VCPU_gp_fault_addr(%rbx),%rax + testb $4,VCPU_gp_fault_flags(%rbx) + setnz %cl + leal TBF_EXCEPTION|TBF_EXCEPTION_ERRCODE(,%rcx,TBF_INTERRUPT),%ecx +UNLIKELY_END(sysenter_gpf) + movq VCPU_domain(%rbx),%rdi movq %rax,TRAPBOUNCE_eip(%rdx) movb %cl,TRAPBOUNCE_flags(%rdx) testb $1,DOMAIN_is_32bit_pv(%rdi) jnz compat_sysenter - call create_bounce_frame - jmp test_all_events -2: movl %eax,TRAPBOUNCE_error_code(%rdx) - movq VCPU_gp_fault_addr(%rbx),%rax - movb $(TBF_EXCEPTION|TBF_EXCEPTION_ERRCODE|TBF_INTERRUPT),%cl - movl $TRAP_gp_fault,UREGS_entry_vector(%rsp) - jmp 1b + jmp .Lbounce_exception ENTRY(int80_direct_trap) pushq $0 @@ -493,6 +495,7 @@ handle_exception_saved: jnz compat_post_handle_exception testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx) jz test_all_events +.Lbounce_exception: call create_bounce_frame movb $0,TRAPBOUNCE_flags(%rdx) jmp test_all_events |