Commit c469268c authored Aug 24, 2017 by Paolo Bonzini

KVM: x86: block guest protection keys unless the host has them enabled



If the host has protection keys disabled, we cannot read and write the
guest PKRU---RDPKRU and WRPKRU fail with #GP(0) if CR4.PKE=0.  Block
the PKU cpuid bit in that case.

This ensures that guest_CR4.PKE=1 implies host_CR4.PKE=1.

Fixes: 1be0e61c
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent bb9b52bd

arch/x86/kvm/cpuid.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -469,7 +469,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
		entry->ecx &= kvm_cpuid_7_0_ecx_x86_features;
		cpuid_mask(&entry->ecx, CPUID_7_ECX);
		/* PKU is not yet implemented for shadow paging. */
		if (!tdp_enabled)
		if (!tdp_enabled \|\| !boot_cpu_has(X86_FEATURE_OSPKE))
		entry->ecx &= ~F(PKU);
		entry->edx &= kvm_cpuid_7_0_edx_x86_features;
		entry->edx &= get_scattered_cpuid_leaf(7, 0, CPUID_EDX);

Admin message