From: Paolo Bonzini <pbonzini@xxxxxxxxxx> commit d6174299365ddbbf491620c0b8c5ca1a6ef2eea5 upstream. While the guest runs, EFER.LME cannot change unless CR0.PG is clear, and therefore EFER.NX is the only bit that can affect the MMU role. However, set_efer accepts a host-initiated change to EFER.LME even with CR0.PG=1. In that case, the MMU has to be reset. Fixes: 11988499e62b ("KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes") Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Sean Christopherson <seanjc@xxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kvm/mmu.h | 1 + arch/x86/kvm/x86.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/mmu.h +++ b/arch/x86/kvm/mmu.h @@ -49,6 +49,7 @@ X86_CR4_LA57) #define KVM_MMU_CR0_ROLE_BITS (X86_CR0_PG | X86_CR0_WP) +#define KVM_MMU_EFER_ROLE_BITS (EFER_LME | EFER_NX) static __always_inline u64 rsvd_bits(int s, int e) { --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1605,8 +1605,7 @@ static int set_efer(struct kvm_vcpu *vcp return r; } - /* Update reserved bits */ - if ((efer ^ old_efer) & EFER_NX) + if ((efer ^ old_efer) & KVM_MMU_EFER_ROLE_BITS) kvm_mmu_reset_context(vcpu); return 0; Patches currently in stable-queue which might be from pbonzini@xxxxxxxxxx are queue-5.15/kvm-x86-mmu-zap-_all_-roots-when-unmapping-gfn-range-in-tdp-mmu.patch queue-5.15/kvm-x86-mmu-check-for-present-spte-when-clearing-dirty-bit-in-tdp-mmu.patch queue-5.15/kvm-x86-emulator-defer-not-present-segment-check-in-.patch queue-5.15/kvm-x86-hyper-v-drop-redundant-ex-parameter-from-kvm_hv_flush_tlb.patch queue-5.15/kvm-x86-hyper-v-hvcall_send_ipi_ex-is-an-xmm-fast-hypercall.patch queue-5.15/kvm-x86-hyper-v-fix-the-maximum-number-of-sparse-banks-for-xmm-fast-tlb-flush-hypercalls.patch queue-5.15/kvm-x86-reinitialize-context-if-host-userspace-toggles-efer.lme.patch queue-5.15/kvm-x86-fix-emulation-in-writing-cr8.patch queue-5.15/kvm-x86-hyper-v-drop-redundant-ex-parameter-from-kvm_hv_send_ipi.patch queue-5.15/virtio_blk-eliminate-anonymous-module_init-module_ex.patch queue-5.15/kvm-x86-mmu-move-invalid-check-out-of-kvm_tdp_mmu_get_root.patch