From f2913de21711c3ba6bf2780564e25190bf3c97a8 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Wed, 5 Sep 2012 12:27:58 +0100 Subject: xen: prevent a 64 bit guest setting reserved bits in DR7 The upper 32 bits of this register are reserved and should be written as zero. This is XSA-12 / CVE-2012-3494 Signed-off-by: Jan Beulich Reviewed-by: Ian Campbell --- xen/include/asm-x86/debugreg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/include/asm-x86/debugreg.h b/xen/include/asm-x86/debugreg.h index 9b7e9717cb..24021b8734 100644 --- a/xen/include/asm-x86/debugreg.h +++ b/xen/include/asm-x86/debugreg.h @@ -58,7 +58,7 @@ We can slow the instruction pipeline for instructions coming via the gdt or the ldt if we want to. I am not sure why this is an advantage */ -#define DR_CONTROL_RESERVED_ZERO (0x0000d800ul) /* Reserved, read as zero */ +#define DR_CONTROL_RESERVED_ZERO (~0xffff27fful) /* Reserved, read as zero */ #define DR_CONTROL_RESERVED_ONE (0x00000400ul) /* Reserved, read as one */ #define DR_LOCAL_EXACT_ENABLE (0x00000100ul) /* Local exact enable */ #define DR_GLOBAL_EXACT_ENABLE (0x00000200ul) /* Global exact enable */ -- cgit v1.2.3