[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
> It turns out that nothing ever prevented HVM guests from trying to set unknown
> EFER bits.  Generally, this results in a vmentry failure.
> For Intel hardware, all implemented bits are covered by the checks.
> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
> guest context.
> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
> any vmentry failures for guests, yielding #GP instead.
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.