Commit 74a0e79d authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: SVM: Disallow guest from changing userspace's MSR_AMD64_DE_CFG value 



Inject a #GP if the guest attempts to change MSR_AMD64_DE_CFG from its
*current* value, not if the guest attempts to write a value other than
KVM's set of supported bits.  As per the comment and the changelog of the
original code, the intent is to effectively make MSR_AMD64_DE_CFG read-
only for the guest.

Opportunistically use a more conventional equality check instead of an
exclusive-OR check to detect attempts to change bits.

Fixes: d1d93fa9 ("KVM: SVM: Add MSR-based feature support for serializing LFENCE")
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20240802181935.292540-2-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent e0183a42

arch/x86/kvm/svm/svm.c

+7 −2
Original line number Diff line number Diff line
@@ -3189,8 +3189,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) 
		if (data & ~msr_entry.data)

			return 1;



		/* Don't allow the guest to change a bit, #GP */

		if (!msr->host_initiated && (data ^ msr_entry.data))

		/*

		 * Don't let the guest change the host-programmed value.  The

		 * MSR is very model specific, i.e. contains multiple bits that

		 * are completely unknown to KVM, and the one bit known to KVM

		 * is simply a reflection of hardware capabilities.

		 */

		if (!msr->host_initiated && data != svm->msr_decfg)

			return 1;



		svm->msr_decfg = data;