Re: [Xen-devel] [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 23.07.18 at 16:11, <roger.pau@xxxxxxxxxx> wrote:
> On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
>> It turns out that nothing ever prevented HVM guests from trying to set 
> unknown
>> EFER bits.  Generally, this results in a vmentry failure.
>> 
>> For Intel hardware, all implemented bits are covered by the checks.
>> 
>> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
>> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
>> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
>> guest context.
>> 
>> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
>> any vmentry failures for guests, yielding #GP instead.
>> 
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> 
> Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>

Acked-by: Jan Beulich <jbeulich@xxxxxxxx>


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel