Xen Test Framework
PV FSGSBASE behaviour

Tests for the behaviour of FSGSBASE handling in PV guests.

Before XSA-293, Xen had a bug whereby a PV guest could set and clear FSGSBASE in its view of %cr4, but Xen left the feature actually enabled in hardware.

This in practice leaves the {RD,WR}{FS,GS}BASE instructions usable behind the back of the guest kernel, and can cause state corruption on task switch if the guest kernel is expecting these instructions to be unusable.

Another awkward point is that at the time of writing, Xen doesn't raise #GP faults for bad %cr4 updates, opting instead to discard bits it doesn't like.

This test tries to cross-reference the architectural behaviour between the FSGSBASE CPUID bit, the enable bit in %cr4, and whether the instructions are actually usable.

In addition, it checks that #GP faults are raised appropriately for trying to write non-canonical addresses. This is anticipated to be a problem when Xen supports LA57 mode.

See also