KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses (df7e8818) · Commits · 戴 / test

Userspace that does not know about the AMD_IBRS bit might still allow the guest to protect itself with MSR_IA32_SPEC_CTRL using the Intel SPEC_CTRL bit. However, svm.c disallows this and will cause a #GP in the guest when writing to the MSR. Fix this by loosening the test and allowing the Intel CPUID bit, and in fact allow the AMD_STIBP bit as well since it allows writing to MSR_IA32_SPEC_CTRL too. Reported-by:

Zhiyi Guo <zhguo@redhat.com> Analyzed-by:

Dr. David Alan Gilbert <dgilbert@redhat.com> Analyzed-by:

Laszlo Ersek <lersek@redhat.com> Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/kvm/svm.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -4225,6 +4225,8 @@ static int svm_get_msr(struct kvm_vcpu vcpu, struct msr_data msr_info)
		break;
		case MSR_IA32_SPEC_CTRL:
		if (!msr_info->host_initiated &&
		!guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
		return 1;
		@@ -4310,6 +4312,8 @@ static int svm_set_msr(struct kvm_vcpu vcpu, struct msr_data msr)
		break;
		case MSR_IA32_SPEC_CTRL:
		if (!msr->host_initiated &&
		!guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
		!guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
		return 1;

Admin message