Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c469268c authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: x86: block guest protection keys unless the host has them enabled 



If the host has protection keys disabled, we cannot read and write the
guest PKRU---RDPKRU and WRPKRU fail with #GP(0) if CR4.PKE=0.  Block
the PKU cpuid bit in that case.

This ensures that guest_CR4.PKE=1 implies host_CR4.PKE=1.

Fixes: 1be0e61c
Cc: stable@vger.kernel.org
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent bb9b52bd

arch/x86/kvm/cpuid.c

+1 −1
Original line number Diff line number Diff line
@@ -469,7 +469,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, 
			entry->ecx &= kvm_cpuid_7_0_ecx_x86_features;

			cpuid_mask(&entry->ecx, CPUID_7_ECX);

			/* PKU is not yet implemented for shadow paging. */

			if (!tdp_enabled)

			if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))

				entry->ecx &= ~F(PKU);

			entry->edx &= kvm_cpuid_7_0_edx_x86_features;

			entry->edx &= get_scattered_cpuid_leaf(7, 0, CPUID_EDX);