From 37d5dc5877794ee763bce0b6bcd35e7942528858 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@gmail.com>
Date: Fri, 1 Apr 2022 15:19:26 -0700
Subject: [PATCH] platform/kvm: dont' set MPX bits in the XCR register

We don't expect that runsc uses MPX . MPX was deprecated and its support
has been removed from the Linux Kernel.

We have seen when the host XCR has these bits, but a KVM VM doesn't
support MPX and xsetbv generates #GP.

COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/7366 from avagin:gvisor-vs-mpx 9cd6a27048cbcd0c01dbecd7697e2c4619b29f28
PiperOrigin-RevId: 438922868
---
 pkg/ring0/kernel_amd64.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/ring0/kernel_amd64.go b/pkg/ring0/kernel_amd64.go
index 4a07d453c..e2e9f88c0 100644
--- a/pkg/ring0/kernel_amd64.go
+++ b/pkg/ring0/kernel_amd64.go
@@ -21,6 +21,7 @@ import (
 	"encoding/binary"
 	"reflect"
 
+	"gvisor.dev/gvisor/pkg/cpuid"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 )
@@ -293,7 +294,10 @@ func startGo(c *CPU) {
 	// Need to sync XCR0 with the host, because xsave and xrstor can be
 	// called from different contexts.
 	if hasXSAVE {
-		xsetbv(0, localXCR0)
+		// Exclude MPX bits. MPX has been deprecated and we have seen
+		// cases when it isn't supported in VM.
+		xcr0 := localXCR0 &^ (cpuid.XSAVEFeatureBNDCSR | cpuid.XSAVEFeatureBNDREGS)
+		xsetbv(0, xcr0)
 	}
 
 	// Set the syscall target.