Explicitly disallow setting EFER.SVME and EFER.LSMLE if nested virtualization is disabled on SVM, to prevent the bits remaining allowed if kvm_amd is loaded with nested=1 and then reloaded with nested=0. This is a minimal fix for the benefit of stable backports, which will be followed by a more systematic fix (moving efer_reserved_bits to kvm_caps). Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/msrs.c | 8 +++++++- arch/x86/kvm/msrs.h | 1 + arch/x86/kvm/svm/svm.c | 3 +++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/msrs.c b/arch/x86/kvm/msrs.c index c230b18d87e38..45170df0ce40b 100644 --- a/arch/x86/kvm/msrs.c +++ b/arch/x86/kvm/msrs.c @@ -660,10 +660,16 @@ static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info) void kvm_enable_efer_bits(u64 mask) { - efer_reserved_bits &= ~mask; + efer_reserved_bits &= ~mask; } EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_enable_efer_bits); +void kvm_disable_efer_bits(u64 mask) +{ + efer_reserved_bits |= mask; +} +EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_disable_efer_bits); + bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type) { struct kvm_x86_msr_filter *msr_filter; diff --git a/arch/x86/kvm/msrs.h b/arch/x86/kvm/msrs.h index b698983e37fb6..89f10447cdddf 100644 --- a/arch/x86/kvm/msrs.h +++ b/arch/x86/kvm/msrs.h @@ -59,6 +59,7 @@ int kvm_get_reg_list(struct kvm_vcpu *vcpu, struct kvm_reg_list __user *user_list); void kvm_enable_efer_bits(u64); +void kvm_disable_efer_bits(u64); bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer); int kvm_emulate_msr_read(struct kvm_vcpu *vcpu, u32 index, u64 *data); int kvm_emulate_msr_write(struct kvm_vcpu *vcpu, u32 index, u64 data); diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index ef69a51ab27f9..1d51500238462 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5645,6 +5645,9 @@ static __init int svm_hardware_setup(void) r = nested_svm_init_msrpm_merge_offsets(); if (r) return r; + } else { + kvm_disable_efer_bits(EFER_SVME); + kvm_disable_efer_bits(EFER_LMSLE); } /* -- 2.55.0.rc0.799.gd6f94ed593-goog