From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jim Mattson Subject: [PATCH v3] kvm: vmx: Raise #UD on unsupported RDSEED Date: Mon, 21 Aug 2017 09:38:58 -0700 Message-ID: <20170821163858.64280-1-jmattson@google.com> References: <551fa98c-2898-87a7-5e8b-96f2f463f182@redhat.com> Cc: Jim Mattson To: David Hildenbrand , kvm@vger.kernel.org Return-path: Received: from mail-pg0-f49.google.com ([74.125.83.49]:37734 "EHLO mail-pg0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753726AbdHUQjQ (ORCPT ); Mon, 21 Aug 2017 12:39:16 -0400 Received: by mail-pg0-f49.google.com with SMTP id y129so102885474pgy.4 for ; Mon, 21 Aug 2017 09:39:16 -0700 (PDT) In-Reply-To: <551fa98c-2898-87a7-5e8b-96f2f463f182@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: A guest may not be configured to support RDSEED, even when the host does. If the guest does not support RDSEED, intercept the instruction and synthesize #UD. Also clear the "allowed-1" bit for RDSEED exiting in the IA32_VMX_PROCBASED_CTLS2 MSR. Signed-off-by: Jim Mattson --- arch/x86/kvm/vmx.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index ed1074e98b8e..482f4130c43f 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -3662,6 +3662,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf) SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | SECONDARY_EXEC_SHADOW_VMCS | SECONDARY_EXEC_XSAVES | + SECONDARY_EXEC_RDSEED | SECONDARY_EXEC_ENABLE_PML | SECONDARY_EXEC_TSC_SCALING | SECONDARY_EXEC_ENABLE_VMFUNC; @@ -5298,6 +5299,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx) if (!enable_pml) exec_control &= ~SECONDARY_EXEC_ENABLE_PML; + if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDSEED)) + exec_control &= ~SECONDARY_EXEC_RDSEED; + return exec_control; } @@ -6806,6 +6810,12 @@ static int handle_mwait(struct kvm_vcpu *vcpu) return handle_nop(vcpu); } +static int handle_invalid_op(struct kvm_vcpu *vcpu) +{ + kvm_queue_exception(vcpu, UD_VECTOR); + return 1; +} + static int handle_monitor_trap(struct kvm_vcpu *vcpu) { return 1; @@ -8050,6 +8060,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor, [EXIT_REASON_INVEPT] = handle_invept, [EXIT_REASON_INVVPID] = handle_invvpid, + [EXIT_REASON_RDSEED] = handle_invalid_op, [EXIT_REASON_XSAVES] = handle_xsaves, [EXIT_REASON_XRSTORS] = handle_xrstors, [EXIT_REASON_PML_FULL] = handle_pml_full, @@ -9665,6 +9676,10 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu) } } + if (!guest_cpuid_has(vcpu, X86_FEATURE_RDSEED)) + vmx->nested.nested_vmx_secondary_ctls_high &= + ~SECONDARY_EXEC_RDSEED; + if (cpu_has_secondary_exec_ctrls()) vmcs_set_secondary_exec_control(secondary_exec_ctl); -- 2.14.1.480.gb18f417b89-goog