Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45ec368c authored by Jim Mattson's avatar Jim Mattson Committed by Paolo Bonzini
Browse files

kvm: vmx: Raise #UD on unsupported RDRAND 



A guest may not be configured to support RDRAND, even when the host
does. If the guest does not support RDRAND, intercept the instruction
and synthesize #UD. Also clear the "allowed-1" bit for RDRAND exiting
in the IA32_VMX_PROCBASED_CTLS2 MSR.

Signed-off-by: default avatarJim Mattson <jmattson@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 80154d77

arch/x86/kvm/vmx.c

+30 −1
Original line number Diff line number Diff line
@@ -2818,7 +2818,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) 
		vmx->nested.nested_vmx_secondary_ctls_high);

	vmx->nested.nested_vmx_secondary_ctls_low = 0;

	vmx->nested.nested_vmx_secondary_ctls_high &=

		SECONDARY_EXEC_RDRAND | SECONDARY_EXEC_RDSEED |

		SECONDARY_EXEC_RDSEED |

		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |

		SECONDARY_EXEC_DESC |

		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
@@ -3671,6 +3671,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf) 
			SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |

			SECONDARY_EXEC_SHADOW_VMCS |

			SECONDARY_EXEC_XSAVES |

			SECONDARY_EXEC_RDRAND |

			SECONDARY_EXEC_ENABLE_PML |

			SECONDARY_EXEC_TSC_SCALING |

			SECONDARY_EXEC_ENABLE_VMFUNC;
@@ -5273,6 +5274,12 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx) 
	return exec_control;

}



static bool vmx_rdrand_supported(void)

{

	return vmcs_config.cpu_based_2nd_exec_ctrl &

		SECONDARY_EXEC_RDRAND;

}



static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)

{

	struct kvm_vcpu *vcpu = &vmx->vcpu;
@@ -5342,6 +5349,21 @@ static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx) 
		}

	}



	if (vmx_rdrand_supported()) {

		bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);

		if (rdrand_enabled)

			exec_control &= ~SECONDARY_EXEC_RDRAND;



		if (nested) {

			if (rdrand_enabled)

				vmx->nested.nested_vmx_secondary_ctls_high |=

					SECONDARY_EXEC_RDRAND;

			else

				vmx->nested.nested_vmx_secondary_ctls_high &=

					~SECONDARY_EXEC_RDRAND;

		}

	}



	vmx->secondary_exec_control = exec_control;

}
@@ -6847,6 +6869,12 @@ static int handle_mwait(struct kvm_vcpu *vcpu) 
	return handle_nop(vcpu);

}



static int handle_invalid_op(struct kvm_vcpu *vcpu)

{

	kvm_queue_exception(vcpu, UD_VECTOR);

	return 1;

}



static int handle_monitor_trap(struct kvm_vcpu *vcpu)

{

	return 1;
@@ -8090,6 +8118,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { 
	[EXIT_REASON_MONITOR_INSTRUCTION]     = handle_monitor,

	[EXIT_REASON_INVEPT]                  = handle_invept,

	[EXIT_REASON_INVVPID]                 = handle_invvpid,

	[EXIT_REASON_RDRAND]                  = handle_invalid_op,

	[EXIT_REASON_XSAVES]                  = handle_xsaves,

	[EXIT_REASON_XRSTORS]                 = handle_xrstors,

	[EXIT_REASON_PML_FULL]		      = handle_pml_full,