1 files changed, 10 insertions, 2 deletions

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f5e8dce8046c..f7b61687bd79 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3622,8 +3622,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 
 static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
-        unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
-                    KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+        /*
+         * Pass through host's Machine Check Enable value to hw_cr4, which
+         * is in force while we are in guest mode.  Do not let guests control
+         * this bit, even if host CR4.MCE == 0.
+         */
+        unsigned long hw_cr4 =
+                (cr4_read_shadow() & X86_CR4_MCE) |
+                (cr4 & ~X86_CR4_MCE) |
+                (to_vmx(vcpu)->rmode.vm86_active ?
+                 KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
 
         if (cr4 & X86_CR4_VMXE) {
                 /*