From: Wei Wang <wei.w.wang@intel.com>
To: seanjc@google.com, pbonzini@redhat.com
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Wei Wang <wei.w.wang@intel.com>
Subject: [PATCH v1] KVM: x86: Validate values set to guest's MSR_IA32_ARCH_CAPABILITIES
Date: Mon, 22 Apr 2024 21:05:58 +0800 [thread overview]
Message-ID: <20240422130558.86965-1-wei.w.wang@intel.com> (raw)
If the bits set by userspace to the guest's MSR_IA32_ARCH_CAPABILITIES
are not supported by KVM, fails the write. This safeguards against the
launch of a guest with a feature set, enumerated via
MSR_IA32_ARCH_CAPABILITIES, that surpasses the capabilities supported by
KVM.
Fixes: 0cf9135b773b ("KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts")
Signed-off-by: Wei Wang <wei.w.wang@intel.com>
---
arch/x86/kvm/x86.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index ebcc12d1e1de..21d476e8e4b0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3808,6 +3808,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
case MSR_IA32_ARCH_CAPABILITIES:
if (!msr_info->host_initiated)
return 1;
+ if (data & ~kvm_get_arch_capabilities())
+ return 1;
+
vcpu->arch.arch_capabilities = data;
break;
case MSR_IA32_PERF_CAPABILITIES:
base-commit: 49ff3b4aec51e3abfc9369997cc603319b02af9a
prerequisite-patch-id: adcf6a23955e33796219e612d703ae107482d1a5
prerequisite-patch-id: dbb173ac5bdfc012168f13188de6fda47dd109ca
prerequisite-patch-id: b0fab89edfe2456f4e892d008eaac0648c420f5d
prerequisite-patch-id: 8371de5f48c05e346824364fb6155958d21b37df
prerequisite-patch-id: 05382cd95d03b5117dbab4affa4deb1f325af11b
prerequisite-patch-id: 4597cf183484342bf1ae96fccaab209a10fa0a5c
prerequisite-patch-id: a89dfcd6ce3748d297cbe338af9ccf4178bd6538
prerequisite-patch-id: 77189fb281d97a6ec63be83c7c0659dded09c046
prerequisite-patch-id: db39eb599599bdedaf6ce3565817b484f9190d83
prerequisite-patch-id: 840f990b7e127d2610ba2633a77b96b076e5b699
prerequisite-patch-id: b4934fe6c00e8794578e8e1c43784bdeac8fe7bb
prerequisite-patch-id: b2a88fe95fb4d57757798576af88d9b10ecf0b44
prerequisite-patch-id: d2b0f2992dba636908972d75a569f1294cc5dfb1
prerequisite-patch-id: e5a19717c15d8a1ff906dc5ea097b7a8392abf80
prerequisite-patch-id: 7fc7bedbde2814763e9860d65903f1987e61107e
prerequisite-patch-id: 15b1621fda294d8b486f19a514b733dc7de94a70
prerequisite-patch-id: 87b48657d42fd4b80ad3c74d6009c06048ad5c68
prerequisite-patch-id: f5020e37f76403b649908b3a6682db1330f1202c
prerequisite-patch-id: 44b3adbeab1096ab3093cbbb2a72c9fa837d8100
prerequisite-patch-id: 50821a9074c303f3cc8cf4aefb91fe39c7bbd2b4
prerequisite-patch-id: 1168a01580cf2a4dae5ea36e58f0633da5d624e1
prerequisite-patch-id: 912e431eee034bc19cae9bd4ec3cf2aa1b86e66f
prerequisite-patch-id: 8b410b87d9c4cd67e37b59af4800aed8640ae2b4
prerequisite-patch-id: 39d09da8c9dfde6fea0ebc313b41fcf50bad9e8f
prerequisite-patch-id: df2b2c3c5116d994c3d103ea7586e189c0a8b38f
prerequisite-patch-id: d9e8b09ef589e51e925182b66c20d53a6d42d074
prerequisite-patch-id: 50ede137eb3500592b91f7ac6ba741fb680bb8d1
prerequisite-patch-id: 50e770836f91502903de710da1649ca25d06adac
--
2.27.0
next reply other threads:[~2024-04-22 13:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-22 13:05 Wei Wang [this message]
2024-04-22 19:43 ` [PATCH v1] KVM: x86: Validate values set to guest's MSR_IA32_ARCH_CAPABILITIES Sean Christopherson
2024-04-23 3:20 ` Wang, Wei W
2024-04-23 14:37 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240422130558.86965-1-wei.w.wang@intel.com \
--to=wei.w.wang@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox