From patchwork Wed Mar 30 15:47:32 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Durrant X-Patchwork-Id: 8699311 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6D0429F39A for ; Wed, 30 Mar 2016 16:15:23 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7E83520394 for ; Wed, 30 Mar 2016 16:15:21 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 60F452038E for ; Wed, 30 Mar 2016 16:15:20 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1alIjx-0001sQ-H0; Wed, 30 Mar 2016 16:13:05 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1alIjx-0001s6-1L for xen-devel@lists.xenproject.org; Wed, 30 Mar 2016 16:13:05 +0000 Received: from [193.109.254.147] by server-13.bemta-14.messagelabs.com id 2F/B5-02874-01BFBF65; Wed, 30 Mar 2016 16:13:04 +0000 X-Env-Sender: prvs=890aa2445=Paul.Durrant@citrix.com X-Msg-Ref: server-7.tower-27.messagelabs.com!1459354382!34597926!1 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 8.11; banners=-,-,- X-VirusChecked: Checked Received: (qmail 39674 invoked from network); 30 Mar 2016 16:13:03 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-7.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 30 Mar 2016 16:13:03 -0000 X-IronPort-AV: E=Sophos;i="5.24,417,1454976000"; d="scan'208";a="350135410" From: Paul Durrant To: Date: Wed, 30 Mar 2016 16:47:32 +0100 Message-ID: <1459352852-1708-1-git-send-email-paul.durrant@citrix.com> X-Mailer: git-send-email 2.1.4 MIME-Version: 1.0 X-DLP: MIA1 Cc: Andrew Cooper , Paul Durrant , Keir Fraser , Jan Beulich Subject: [Xen-devel] [PATCH v4] x86/hvm/viridian: zero and check vcpu context __pad field X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 57844631 "save APIC assist vector" added an extra field to the viridian vcpu context save record. This field was only a uint8_t and so an extra __pad field was also added to pad up to the next 64-bit boundary. This patch makes sure that __pad field is zeroed on save and checked for zero on restore. This prevents a potential leak of information from the stack and a compatibility check against future use of the space occupied by the __pad field. The __pad field is zeroed as a side effect of making use of a C99 struct initializer for the other fields. This patch also modifies the domain context save code to use the same mechanism. Signed-off-by: Paul Durrant Cc: Keir Fraser Cc: Jan Beulich Cc: Andrew Cooper --- v4: - use c99 struct initializer - re-work zero_page extern v3: - make zero_page accessible outside mm.c v2: - drop is_zero() helper an use memcmp against zero_page instead. - add memset to viridian_save_domain_ctxt() to reduce potential for information leakage in future. --- xen/arch/x86/hvm/viridian.c | 23 +++++++++++++---------- xen/arch/x86/mm.c | 2 +- xen/include/asm-x86/mm.h | 2 ++ 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/xen/arch/x86/hvm/viridian.c b/xen/arch/x86/hvm/viridian.c index 5c76c1a..8253fd0 100644 --- a/xen/arch/x86/hvm/viridian.c +++ b/xen/arch/x86/hvm/viridian.c @@ -780,16 +780,16 @@ out: static int viridian_save_domain_ctxt(struct domain *d, hvm_domain_context_t *h) { - struct hvm_viridian_domain_context ctxt; + struct hvm_viridian_domain_context ctxt = { + .time_ref_count = d->arch.hvm_domain.viridian.time_ref_count.val, + .hypercall_gpa = d->arch.hvm_domain.viridian.hypercall_gpa.raw, + .guest_os_id = d->arch.hvm_domain.viridian.guest_os_id.raw, + .reference_tsc = d->arch.hvm_domain.viridian.reference_tsc.raw, + }; if ( !is_viridian_domain(d) ) return 0; - ctxt.time_ref_count = d->arch.hvm_domain.viridian.time_ref_count.val; - ctxt.hypercall_gpa = d->arch.hvm_domain.viridian.hypercall_gpa.raw; - ctxt.guest_os_id = d->arch.hvm_domain.viridian.guest_os_id.raw; - ctxt.reference_tsc = d->arch.hvm_domain.viridian.reference_tsc.raw; - return (hvm_save_entry(VIRIDIAN_DOMAIN, 0, h, &ctxt) != 0); } @@ -822,10 +822,10 @@ static int viridian_save_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) return 0; for_each_vcpu( d, v ) { - struct hvm_viridian_vcpu_context ctxt; - - ctxt.apic_assist_msr = v->arch.hvm_vcpu.viridian.apic_assist.msr.raw; - ctxt.apic_assist_vector = v->arch.hvm_vcpu.viridian.apic_assist.vector; + struct hvm_viridian_vcpu_context ctxt = { + .apic_assist_msr = v->arch.hvm_vcpu.viridian.apic_assist.msr.raw, + .apic_assist_vector = v->arch.hvm_vcpu.viridian.apic_assist.vector, + }; if ( hvm_save_entry(VIRIDIAN_VCPU, v->vcpu_id, h, &ctxt) != 0 ) return 1; @@ -851,6 +851,9 @@ static int viridian_load_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) if ( hvm_load_entry_zeroextend(VIRIDIAN_VCPU, h, &ctxt) != 0 ) return -EINVAL; + if ( memcmp(&ctxt._pad, zero_page, sizeof(ctxt._pad)) ) + return -EINVAL; + v->arch.hvm_vcpu.viridian.apic_assist.msr.raw = ctxt.apic_assist_msr; if ( v->arch.hvm_vcpu.viridian.apic_assist.msr.fields.enabled ) initialize_apic_assist(v); diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index c997b53..bca7532 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -589,7 +589,7 @@ static inline void guest_get_eff_kern_l1e(struct vcpu *v, unsigned long addr, TOGGLE_MODE(); } -static const char __section(".bss.page_aligned.const") zero_page[PAGE_SIZE]; +const char __section(".bss.page_aligned.const") zero_page[PAGE_SIZE]; static void invalidate_shadow_ldt(struct vcpu *v, int flush) { diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h index b25942b..b781495 100644 --- a/xen/include/asm-x86/mm.h +++ b/xen/include/asm-x86/mm.h @@ -595,4 +595,6 @@ typedef struct mm_rwlock { &(d)->xenpage_list : &(d)->page_list, \ &(d)->arch.relmem_list) +extern const char zero_page[]; + #endif /* __ASM_X86_MM_H__ */