[XEN] Fix x86/64 bug where a guest application can crash the

guest OS by setting AC flag in RFLAGS. This wasn't being
cleared on entry to the guest kernel, causing unwanted faults
because the kernel runs in ring 3 on Xen.
Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 65e4dc4b9c34f8f04ecb5f8f9a21012c826c9416..e94dc773e7704e99ab6d3c043eb3015e812abc39 100644 (file)
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -556,7 +556,8 @@ static void load_segments(struct vcpu *n)
             n->vcpu_info->evtchn_upcall_mask = 1;
 
         regs->entry_vector  = TRAP_syscall;
-        regs->rflags       &= 0xFFFCBEFFUL;
+        regs->rflags       &= ~(X86_EFLAGS_AC|X86_EFLAGS_VM|X86_EFLAGS_RF|
+                                X86_EFLAGS_NT|X86_EFLAGS_TF);
         regs->ss            = __GUEST_SS;
         regs->rsp           = (unsigned long)(rsp-11);
         regs->cs            = __GUEST_CS;

diff --git a/xen/arch/x86/x86_32/entry.S b/xen/arch/x86/x86_32/entry.S
index 6b9980fd7aacbb14e7d856fcf95fa7f5f2b9cf15..7dd8ae5310857dfdb61acfeb08e1b493eaf0b5ef 100644 (file)
--- a/xen/arch/x86/x86_32/entry.S
+++ b/xen/arch/x86/x86_32/entry.S
@@ -356,7 +356,8 @@ FLT25:  movl %eax,%gs:12(%esi)
         movl %eax,UREGS_gs+4(%esp)
 nvm86_3:/* Rewrite our stack frame and return to ring 1. */
         /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */
-        andl $0xfffcbeff,UREGS_eflags+4(%esp)
+        andl $~(X86_EFLAGS_VM|X86_EFLAGS_RF|\
+                X86_EFLAGS_NT|X86_EFLAGS_TF),UREGS_eflags+4(%esp)
         mov  %gs,UREGS_ss+4(%esp)
         movl %esi,UREGS_esp+4(%esp)
         movzwl TRAPBOUNCE_cs(%edx),%eax

diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
index 9680530f43ec59e2dda60be22bc27b49c4690a22..7fe86516398d46d4013458b15eb9ef20ef89cc0a 100644 (file)
--- a/xen/arch/x86/x86_64/entry.S
+++ b/xen/arch/x86/x86_64/entry.S
@@ -294,8 +294,10 @@ FLT12:  movq  %rax,8(%rsi)              # R11
 FLT13:  movq  %rax,(%rsi)               # RCX
         /* Rewrite our stack frame and return to guest-OS mode. */
         /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */
+        /* Also clear AC: alignment checks shouldn't trigger in kernel mode. */
         movl  $TRAP_syscall,UREGS_entry_vector+8(%rsp)
-        andl  $0xfffcbeff,UREGS_eflags+8(%rsp)
+        andl  $~(X86_EFLAGS_AC|X86_EFLAGS_VM|X86_EFLAGS_RF|\
+                 X86_EFLAGS_NT|X86_EFLAGS_TF),UREGS_eflags+8(%rsp)
         movq  $__GUEST_SS,UREGS_ss+8(%rsp)
         movq  %rsi,UREGS_rsp+8(%rsp)
         movq  $__GUEST_CS,UREGS_cs+8(%rsp)