From b6c741b796952008d3147e1901107ff836013f0f Mon Sep 17 00:00:00 2001 From: Jun Nakajima Date: Wed, 20 Dec 2017 08:04:54 -0800 Subject: [PATCH] Clear the host registers after setbe The original patch cleared the host registers before setbe doing XOR, and it set a false flag as VM enry failure. Orabug: 27344012 CVE: CVE-2017-5715 Signed-off-by: Jun Nakajima Signed-off-by: Konrad Rzeszutek Wilk Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- arch/x86/kvm/vmx.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index cd15ec76602f4..74f3e9eb3b8a1 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -8253,10 +8253,15 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) "mov %%r14, %c[r14](%0) \n\t" "mov %%r15, %c[r15](%0) \n\t" #endif + "mov %%cr2, %%" _ASM_AX " \n\t" + "mov %%" _ASM_AX ", %c[cr2](%0) \n\t" + + "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t" + "setbe %c[fail](%0) \n\t" /* - * Clear host registers marked as clobbered to prevent - * speculative use. - */ + * Clear host registers marked as clobbered to prevent + * speculative use. + */ "xor %%" _ASM_BX ", %%" _ASM_BX " \n\t" "xor %%" _ASM_SI ", %%" _ASM_SI " \n\t" "xor %%" _ASM_DI ", %%" _ASM_DI " \n\t" @@ -8270,11 +8275,6 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) "xor %%r14, %%r14 \n\t" "xor %%r15, %%r15 \n\t" #endif - "mov %%cr2, %%" _ASM_AX " \n\t" - "mov %%" _ASM_AX ", %c[cr2](%0) \n\t" - - "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t" - "setbe %c[fail](%0) \n\t" ".pushsection .rodata \n\t" ".global vmx_return \n\t" "vmx_return: " _ASM_PTR " 2b \n\t" -- 2.50.1