[PATCH] x86/nestedhvm: don't give L2 instructions L1 did not enable

[Mahmoud Abumandour <mam47@xxxxxx>]

From: Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>

nvmx_update_secondary_exec_control() ORs Xen's own secondary controls
for L1 into those L2 runs with, among them "enable RDTSCP", "enable
INVPCID" and "enable XSAVES", which L1 is not offered. L2 then executes
these instructions where L1's VMCS makes them raise #UD, and when L1 sets
"INVLPG exiting", L2's INVPCID exits with reason 58, which
nvmx_n2_vmexit_handler() does not handle. Xen crashes L1's domain.

Fixes: 729186073765 ("Nested VMX: Extend VMCS control fields for n2 guest")
Signed-off-by: Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>
---
 xen/arch/x86/hvm/vmx/vvmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 29e48387a1..79f5c00ba6 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -650,6 +650,13 @@ void nvmx_update_secondary_exec_control(struct vcpu *v,
 
     host_cntrl &= ~apicv_bit;
     host_cntrl &= ~SECONDARY_EXEC_ENABLE_VMCS_SHADOWING;
+    /*
+     * Whether L2 may execute RDTSCP, INVPCID and XSAVES is L1's choice. L2
+     * gets #UD as on hardware.
+     */
+    host_cntrl &= ~(SECONDARY_EXEC_ENABLE_RDTSCP |
+                    SECONDARY_EXEC_ENABLE_INVPCID |
+                    SECONDARY_EXEC_XSAVES);
     shadow_cntrl = get_vvmcs(v, SECONDARY_VM_EXEC_CONTROL);
 
     /* No vAPIC-v support, so it shouldn't be set in vmcs12. */
-- 
2.25.1