File 5b56feb1-hvm-Disallow-unknown-MSR_EFER-bits.patch of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 5b56feb1-hvm-Disallow-unknown-MSR_EFER-bits.patch of Package xen (Revision d680694e5ae0f4acd2f51771c78504e2)

Currently displaying revision d680694e5ae0f4acd2f51771c78504e2 , Show latest

Subject: x86/hvm: Disallow unknown MSR_EFER bits
From: Andrew Cooper andrew.cooper3@citrix.com Mon Jul 30 11:29:39 2018 +0200
Date: Mon Jul 30 11:29:39 2018 +0200:
Git: 7de21555730367497eb01edf6e9e9530224105e7

It turns out that nothing ever prevented HVM guests from trying to set unknown
EFER bits.  Generally, this results in a vmentry failure.

For Intel hardware, all implemented bits are covered by the checks.

For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
(which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
in CPUID, but it isn't a security problem to have TCE unexpected enabled in
guest context.

Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
any vmentry failures for guests, yielding #GP instead.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
master commit: ef0269c6215d642a709866f04ba1a1f9f13f3614
master date: 2018-07-24 11:25:53 +0100

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index d544720876..4cbb688c05 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -907,6 +907,9 @@ const char *hvm_efer_valid(const struct vcpu *v, uint64_t value,
     else
         p = &host_cpuid_policy;
 
+    if ( value & ~EFER_KNOWN_MASK )
+        return "Unknown bits set";
+
     if ( (value & EFER_SCE) && !p->extd.syscall )
         return "SCE without feature";

Places

File 5b56feb1-hvm-Disallow-unknown-MSR_EFER-bits.patch of Package xen (Revision d680694e5ae0f4acd2f51771c78504e2)

Places