[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

>>> On 23.07.18 at 16:11, <roger.pau@xxxxxxxxxx> wrote:
> On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
>> It turns out that nothing ever prevented HVM guests from trying to set 
> unknown
>> EFER bits.  Generally, this results in a vmentry failure.
>> For Intel hardware, all implemented bits are covered by the checks.
>> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
>> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
>> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
>> guest context.
>> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
>> any vmentry failures for guests, yielding #GP instead.
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>

Acked-by: Jan Beulich <jbeulich@xxxxxxxx>

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.