Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75f4fc8d authored by Jim Mattson's avatar Jim Mattson Committed by Paolo Bonzini
Browse files

kvm: vmx: Raise #UD on unsupported RDSEED 



A guest may not be configured to support RDSEED, even when the host
does. If the guest does not support RDSEED, intercept the instruction
and synthesize #UD. Also clear the "allowed-1" bit for RDSEED exiting
in the IA32_VMX_PROCBASED_CTLS2 MSR.

Signed-off-by: default avatarJim Mattson <jmattson@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 45ec368c

arch/x86/kvm/vmx.c

+23 −1
Original line number Diff line number Diff line
@@ -2818,7 +2818,6 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) 
		vmx->nested.nested_vmx_secondary_ctls_high);

	vmx->nested.nested_vmx_secondary_ctls_low = 0;

	vmx->nested.nested_vmx_secondary_ctls_high &=

		SECONDARY_EXEC_RDSEED |

		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |

		SECONDARY_EXEC_DESC |

		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
@@ -3671,6 +3670,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf) 
			SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |

			SECONDARY_EXEC_SHADOW_VMCS |

			SECONDARY_EXEC_XSAVES |

			SECONDARY_EXEC_RDSEED |

			SECONDARY_EXEC_RDRAND |

			SECONDARY_EXEC_ENABLE_PML |

			SECONDARY_EXEC_TSC_SCALING |
@@ -5280,6 +5280,12 @@ static bool vmx_rdrand_supported(void) 
		SECONDARY_EXEC_RDRAND;

}



static bool vmx_rdseed_supported(void)

{

	return vmcs_config.cpu_based_2nd_exec_ctrl &

		SECONDARY_EXEC_RDSEED;

}



static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)

{

	struct kvm_vcpu *vcpu = &vmx->vcpu;
@@ -5364,6 +5370,21 @@ static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx) 
		}

	}



	if (vmx_rdseed_supported()) {

		bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);

		if (rdseed_enabled)

			exec_control &= ~SECONDARY_EXEC_RDSEED;



		if (nested) {

			if (rdseed_enabled)

				vmx->nested.nested_vmx_secondary_ctls_high |=

					SECONDARY_EXEC_RDSEED;

			else

				vmx->nested.nested_vmx_secondary_ctls_high &=

					~SECONDARY_EXEC_RDSEED;

		}

	}



	vmx->secondary_exec_control = exec_control;

}
@@ -8119,6 +8140,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { 
	[EXIT_REASON_INVEPT]                  = handle_invept,

	[EXIT_REASON_INVVPID]                 = handle_invvpid,

	[EXIT_REASON_RDRAND]                  = handle_invalid_op,

	[EXIT_REASON_RDSEED]                  = handle_invalid_op,

	[EXIT_REASON_XSAVES]                  = handle_xsaves,

	[EXIT_REASON_XRSTORS]                 = handle_xrstors,

	[EXIT_REASON_PML_FULL]		      = handle_pml_full,