From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jim Mattson Subject: [PATCH v6 1/2] kvm: vmx: Raise #UD on unsupported RDSEED Date: Wed, 23 Aug 2017 16:32:03 -0700 Message-ID: <20170823233204.101113-1-jmattson@google.com> References: Cc: Jim Mattson To: Paolo Bonzini , David Hildenbrand , kvm list Return-path: Received: from mail-pg0-f51.google.com ([74.125.83.51]:34740 "EHLO mail-pg0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751146AbdHWXcn (ORCPT ); Wed, 23 Aug 2017 19:32:43 -0400 Received: by mail-pg0-f51.google.com with SMTP id s14so7051539pgs.1 for ; Wed, 23 Aug 2017 16:32:43 -0700 (PDT) In-Reply-To: Sender: kvm-owner@vger.kernel.org List-ID: A guest may not be configured to support RDSEED, even when the host does. If the guest does not support RDSEED, intercept the instruction and synthesize #UD. Also clear the "allowed-1" bit for RDSEED exiting in the IA32_VMX_PROCBASED_CTLS2 MSR. Signed-off-by: Jim Mattson --- arch/x86/kvm/vmx.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 19aa69af7c2d..9dd8637c3392 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -3667,6 +3667,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf) SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | SECONDARY_EXEC_SHADOW_VMCS | SECONDARY_EXEC_XSAVES | + SECONDARY_EXEC_RDSEED | SECONDARY_EXEC_ENABLE_PML | SECONDARY_EXEC_TSC_SCALING | SECONDARY_EXEC_ENABLE_VMFUNC; @@ -5300,6 +5301,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx) if (!enable_pml) exec_control &= ~SECONDARY_EXEC_ENABLE_PML; + if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDSEED)) + exec_control &= ~SECONDARY_EXEC_RDSEED; + return exec_control; } @@ -6804,6 +6808,12 @@ static int handle_mwait(struct kvm_vcpu *vcpu) return handle_nop(vcpu); } +static int handle_invalid_op(struct kvm_vcpu *vcpu) +{ + kvm_queue_exception(vcpu, UD_VECTOR); + return 1; +} + static int handle_monitor_trap(struct kvm_vcpu *vcpu) { return 1; @@ -8047,6 +8057,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor, [EXIT_REASON_INVEPT] = handle_invept, [EXIT_REASON_INVVPID] = handle_invvpid, + [EXIT_REASON_RDSEED] = handle_invalid_op, [EXIT_REASON_XSAVES] = handle_xsaves, [EXIT_REASON_XRSTORS] = handle_xrstors, [EXIT_REASON_PML_FULL] = handle_pml_full, @@ -8975,6 +8986,12 @@ static bool vmx_mpx_supported(void) (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS); } +static bool vmx_rdseed_supported(void) +{ + return vmcs_config.cpu_based_2nd_exec_ctrl & + SECONDARY_EXEC_RDSEED; +} + static bool vmx_xsaves_supported(void) { return vmcs_config.cpu_based_2nd_exec_ctrl & @@ -9620,6 +9637,12 @@ static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu) #undef cr4_fixed1_update } +static void nested_vmx_secondary_ctrls_clear(struct kvm_vcpu *vcpu, u32 mask) +{ + if (nested) + to_vmx(vcpu)->nested.nested_vmx_secondary_ctls_high &= ~mask; +} + static void vmx_cpuid_update(struct kvm_vcpu *vcpu) { struct vcpu_vmx *vmx = to_vmx(vcpu); @@ -9661,6 +9684,12 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu) } } + if (vmx_rdseed_supported() && + !guest_cpuid_has(vcpu, X86_FEATURE_RDSEED)) { + nested_vmx_secondary_ctrls_clear(vcpu, SECONDARY_EXEC_RDSEED); + secondary_exec_ctl |= SECONDARY_EXEC_RDSEED; + } + if (cpu_has_secondary_exec_ctrls()) vmcs_set_secondary_exec_control(secondary_exec_ctl); -- 2.14.1.342.g6490525c54-goog