From: Andrew Cooper Date: Fri, 20 Jul 2018 15:42:04 +0000 (+0000) Subject: x86/hvm: Disallow unknown MSR_EFER bits X-Git-Tag: 4.12.0-rc1~917 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=ef0269c6215d642a709866f04ba1a1f9f13f3614;p=xen.git x86/hvm: Disallow unknown MSR_EFER bits It turns out that nothing ever prevented HVM guests from trying to set unknown EFER bits. Generally, this results in a vmentry failure. For Intel hardware, all implemented bits are covered by the checks. For AMD hardware, the only EFER bit which isn't covered by the checks is TCE (which AFAICT is specific to AMD Fam15/16 hardware). We never advertise TCE in CPUID, but it isn't a security problem to have TCE unexpected enabled in guest context. Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents any vmentry failures for guests, yielding #GP instead. Signed-off-by: Andrew Cooper Reviewed-by: Roger Pau Monné Reviewed-by: Wei Liu Acked-by: Jan Beulich --- diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 1816faa9b3..c099c617e8 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -907,6 +907,9 @@ const char *hvm_efer_valid(const struct vcpu *v, uint64_t value, else p = &host_cpuid_policy; + if ( value & ~EFER_KNOWN_MASK ) + return "Unknown bits set"; + if ( (value & EFER_SCE) && !p->extd.syscall ) return "SCE without feature";