[PATCH] x86/hvm: Disallow unknown MSR_EFER bits

[PATCH] x86/hvm: Disallow unknown MSR_EFER bits

[Andrew Cooper]

It turns out that nothing ever prevented HVM guests from trying to set unknown
EFER bits.  Generally, this results in a vmentry failure.

For Intel hardware, all implemented bits are covered by the checks.

For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
(which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
in CPUID, but it isn't a security problem to have TCE unexpected enabled in
guest context.

Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
any vmentry failures for guests, yielding #GP instead.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Sergey Dyasli <sergey.dyasli@citrix.com>

Note: On AMD hardware, bits 7:1 are Reserved write-discard rather than
yielding #GP.  Implementing this doesn't seem worthwhile (no software will try
to set these bits, because they are strictly reserved on Intel hardware), and
would require rather more complicated changes to hvm_efer_valid() to feed back
a modified efer value.
---
 xen/arch/x86/hvm/hvm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 1816faa..c099c61 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -907,6 +907,9 @@ const char *hvm_efer_valid(const struct vcpu *v, uint64_t value,
     else
         p = &host_cpuid_policy;
 
+    if ( value & ~EFER_KNOWN_MASK )
+        return "Unknown bits set";
+
     if ( (value & EFER_SCE) && !p->extd.syscall )
         return "SCE without feature";
 
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

[Roger Pau Monné]

On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
> It turns out that nothing ever prevented HVM guests from trying to set unknown
> EFER bits.  Generally, this results in a vmentry failure.
> 
> For Intel hardware, all implemented bits are covered by the checks.
> 
> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
> guest context.
> 
> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
> any vmentry failures for guests, yielding #GP instead.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

[Jan Beulich]

>>> On 23.07.18 at 16:11, <roger.pau@citrix.com> wrote:
> On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
>> It turns out that nothing ever prevented HVM guests from trying to set 
> unknown
>> EFER bits.  Generally, this results in a vmentry failure.
>> 
>> For Intel hardware, all implemented bits are covered by the checks.
>> 
>> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
>> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
>> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
>> guest context.
>> 
>> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
>> any vmentry failures for guests, yielding #GP instead.
>> 
>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> 
> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

Acked-by: Jan Beulich <jbeulich@suse.com>


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] x86/hvm: Disallow unknown MSR_EFER bits

[Wei Liu]

On Mon, Jul 23, 2018 at 02:49:50PM +0100, Andrew Cooper wrote:
> It turns out that nothing ever prevented HVM guests from trying to set unknown
> EFER bits.  Generally, this results in a vmentry failure.
> 
> For Intel hardware, all implemented bits are covered by the checks.
> 
> For AMD hardware, the only EFER bit which isn't covered by the checks is TCE
> (which AFAICT is specific to AMD Fam15/16 hardware).  We never advertise TCE
> in CPUID, but it isn't a security problem to have TCE unexpected enabled in
> guest context.
> 
> Disallow the setting of bits outside of the EFER_KNOWN_MASK, which prevents
> any vmentry failures for guests, yielding #GP instead.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Wei Liu <wei.liu2@citrix.com>

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel