[PATCH] nestedsvm: Ignore attempts to clear EFER.SVME from L2

[Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>]

The APM leaves it undefined what happens when the VMM doesn't intercept
writes to EFER and EFER.SVME is cleared. The current implementation in
Xen resets the nested state without doing a VMEXIT which is unexpected
and may potentially hit a BUG or assertion failure.

Therefore, implement the same behaviour as the APM documents for SEV-ES
guests; ignore the attempt to clear it.

Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
---

Another option here could be to fail VMRUN if L1 does not intercept
writes to EFER. However, this wouldn't match the behaviour of real
processors and may cause incomplete toy hypervisors to unexpectedly
fail.

 xen/arch/x86/hvm/hvm.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 71da15c0a4ed..f4155f523598 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2156,9 +2156,15 @@ int hvm_set_efer(uint64_t value)
        ((value & EFER_SVME) == 0 ) &&
        ((value ^ v->arch.hvm.guest_efer) & EFER_SVME) )
     {
-        /* Cleared EFER.SVME: Flush all nestedp2m tables */
-        p2m_flush_nestedp2m(v->domain);
-        nestedhvm_vcpu_reset(v);
+        if ( nestedhvm_vcpu_in_guestmode(v) )
+            /* Ignore attempts to clear EFER.SVME from L2 */
+            value |= EFER_SVME;
+        else
+        {
+            /* Cleared EFER.SVME: Flush all nestedp2m tables */
+            p2m_flush_nestedp2m(v->domain);
+            nestedhvm_vcpu_reset(v);
+        }
     }
 
     value |= v->arch.hvm.guest_efer & EFER_LMA;
-- 
2.56.0