diff options
author | Jim Mattson <jmattson@google.com> | 2018-01-03 17:31:38 -0500 |
---|---|---|
committer | Paolo Bonzini <pbonzini@redhat.com> | 2018-01-05 10:48:40 -0500 |
commit | 0cb5b30698fdc8f6b4646012e3acb4ddce430788 (patch) | |
tree | 5d4f85bedfcc2fcd851597303960de5cffaebd81 | |
parent | aa12f594f97efe50223611dbd13ecca4e8dafee6 (diff) |
kvm: vmx: Scrub hardware GPRs at VM-exit
Guest GPR values are live in the hardware GPRs at VM-exit. Do not
leave any guest values in hardware GPRs after the guest GPR values are
saved to the vcpu_vmx structure.
This is a partial mitigation for CVE 2017-5715 and CVE 2017-5753.
Specifically, it defeats the Project Zero PoC for CVE 2017-5715.
Suggested-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Eric Northup <digitaleric@google.com>
Reviewed-by: Benjamin Serebrin <serebrin@google.com>
Reviewed-by: Andrew Honig <ahonig@google.com>
[Paolo: Add AMD bits, Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-rw-r--r-- | arch/x86/kvm/svm.c | 19 | ||||
-rw-r--r-- | arch/x86/kvm/vmx.c | 14 |
2 files changed, 32 insertions, 1 deletions
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index eb714f1cdf7e..bb31c801f1fc 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c | |||
@@ -4986,6 +4986,25 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) | |||
4986 | "mov %%r14, %c[r14](%[svm]) \n\t" | 4986 | "mov %%r14, %c[r14](%[svm]) \n\t" |
4987 | "mov %%r15, %c[r15](%[svm]) \n\t" | 4987 | "mov %%r15, %c[r15](%[svm]) \n\t" |
4988 | #endif | 4988 | #endif |
4989 | /* | ||
4990 | * Clear host registers marked as clobbered to prevent | ||
4991 | * speculative use. | ||
4992 | */ | ||
4993 | "xor %%" _ASM_BX ", %%" _ASM_BX " \n\t" | ||
4994 | "xor %%" _ASM_CX ", %%" _ASM_CX " \n\t" | ||
4995 | "xor %%" _ASM_DX ", %%" _ASM_DX " \n\t" | ||
4996 | "xor %%" _ASM_SI ", %%" _ASM_SI " \n\t" | ||
4997 | "xor %%" _ASM_DI ", %%" _ASM_DI " \n\t" | ||
4998 | #ifdef CONFIG_X86_64 | ||
4999 | "xor %%r8, %%r8 \n\t" | ||
5000 | "xor %%r9, %%r9 \n\t" | ||
5001 | "xor %%r10, %%r10 \n\t" | ||
5002 | "xor %%r11, %%r11 \n\t" | ||
5003 | "xor %%r12, %%r12 \n\t" | ||
5004 | "xor %%r13, %%r13 \n\t" | ||
5005 | "xor %%r14, %%r14 \n\t" | ||
5006 | "xor %%r15, %%r15 \n\t" | ||
5007 | #endif | ||
4989 | "pop %%" _ASM_BP | 5008 | "pop %%" _ASM_BP |
4990 | : | 5009 | : |
4991 | : [svm]"a"(svm), | 5010 | : [svm]"a"(svm), |
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 8eba631c4dbd..c1e7ed371259 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c | |||
@@ -9415,6 +9415,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) | |||
9415 | /* Save guest registers, load host registers, keep flags */ | 9415 | /* Save guest registers, load host registers, keep flags */ |
9416 | "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t" | 9416 | "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t" |
9417 | "pop %0 \n\t" | 9417 | "pop %0 \n\t" |
9418 | "setbe %c[fail](%0)\n\t" | ||
9418 | "mov %%" _ASM_AX ", %c[rax](%0) \n\t" | 9419 | "mov %%" _ASM_AX ", %c[rax](%0) \n\t" |
9419 | "mov %%" _ASM_BX ", %c[rbx](%0) \n\t" | 9420 | "mov %%" _ASM_BX ", %c[rbx](%0) \n\t" |
9420 | __ASM_SIZE(pop) " %c[rcx](%0) \n\t" | 9421 | __ASM_SIZE(pop) " %c[rcx](%0) \n\t" |
@@ -9431,12 +9432,23 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) | |||
9431 | "mov %%r13, %c[r13](%0) \n\t" | 9432 | "mov %%r13, %c[r13](%0) \n\t" |
9432 | "mov %%r14, %c[r14](%0) \n\t" | 9433 | "mov %%r14, %c[r14](%0) \n\t" |
9433 | "mov %%r15, %c[r15](%0) \n\t" | 9434 | "mov %%r15, %c[r15](%0) \n\t" |
9435 | "xor %%r8d, %%r8d \n\t" | ||
9436 | "xor %%r9d, %%r9d \n\t" | ||
9437 | "xor %%r10d, %%r10d \n\t" | ||
9438 | "xor %%r11d, %%r11d \n\t" | ||
9439 | "xor %%r12d, %%r12d \n\t" | ||
9440 | "xor %%r13d, %%r13d \n\t" | ||
9441 | "xor %%r14d, %%r14d \n\t" | ||
9442 | "xor %%r15d, %%r15d \n\t" | ||
9434 | #endif | 9443 | #endif |
9435 | "mov %%cr2, %%" _ASM_AX " \n\t" | 9444 | "mov %%cr2, %%" _ASM_AX " \n\t" |
9436 | "mov %%" _ASM_AX ", %c[cr2](%0) \n\t" | 9445 | "mov %%" _ASM_AX ", %c[cr2](%0) \n\t" |
9437 | 9446 | ||
9447 | "xor %%eax, %%eax \n\t" | ||
9448 | "xor %%ebx, %%ebx \n\t" | ||
9449 | "xor %%esi, %%esi \n\t" | ||
9450 | "xor %%edi, %%edi \n\t" | ||
9438 | "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t" | 9451 | "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t" |
9439 | "setbe %c[fail](%0) \n\t" | ||
9440 | ".pushsection .rodata \n\t" | 9452 | ".pushsection .rodata \n\t" |
9441 | ".global vmx_return \n\t" | 9453 | ".global vmx_return \n\t" |
9442 | "vmx_return: " _ASM_PTR " 2b \n\t" | 9454 | "vmx_return: " _ASM_PTR " 2b \n\t" |