On 24.08.2017 15:37, Paolo Bonzini wrote: > From: Jim Mattson <[email protected]> > > A guest may not be configured to support RDRAND, even when the host > does. If the guest does not support RDRAND, intercept the instruction > and synthesize #UD. Also clear the "allowed-1" bit for RDRAND exiting > in the IA32_VMX_PROCBASED_CTLS2 MSR. > > Signed-off-by: Jim Mattson <[email protected]> > Signed-off-by: Paolo Bonzini <[email protected]> > --- > arch/x86/kvm/vmx.c | 31 ++++++++++++++++++++++++++++++- > 1 file changed, 30 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index 08381a5d8879..1f2c69de7872 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -2818,7 +2818,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx > *vmx) > vmx->nested.nested_vmx_secondary_ctls_high); > vmx->nested.nested_vmx_secondary_ctls_low = 0; > vmx->nested.nested_vmx_secondary_ctls_high &= > - SECONDARY_EXEC_RDRAND | SECONDARY_EXEC_RDSEED | > + SECONDARY_EXEC_RDSEED | > SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | > SECONDARY_EXEC_DESC | > SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE | > @@ -3671,6 +3671,7 @@ static __init int setup_vmcs_config(struct vmcs_config > *vmcs_conf) > SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | > SECONDARY_EXEC_SHADOW_VMCS | > SECONDARY_EXEC_XSAVES | > + SECONDARY_EXEC_RDRAND | > SECONDARY_EXEC_ENABLE_PML | > SECONDARY_EXEC_TSC_SCALING | > SECONDARY_EXEC_ENABLE_VMFUNC; > @@ -5273,6 +5274,12 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx) > return exec_control; > } > > +static bool vmx_rdrand_supported(void) > +{ > + return vmcs_config.cpu_based_2nd_exec_ctrl & > + SECONDARY_EXEC_RDRAND; > +} > + > static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx) > { > struct kvm_vcpu *vcpu = &vmx->vcpu; > @@ -5342,6 +5349,21 @@ static void vmx_compute_secondary_exec_control(struct > vcpu_vmx *vmx) > } > } > > + if (vmx_rdrand_supported()) { > + bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND); > + if (rdrand_enabled) > + exec_control &= ~SECONDARY_EXEC_RDRAND; > + > + if (nested) { > + if (rdrand_enabled) > + vmx->nested.nested_vmx_secondary_ctls_high |= > + SECONDARY_EXEC_RDRAND; > + else > + vmx->nested.nested_vmx_secondary_ctls_high &= > + ~SECONDARY_EXEC_RDRAND; > + } > + } > + > vmx->secondary_exec_control = exec_control; > } > > @@ -6847,6 +6869,12 @@ static int handle_mwait(struct kvm_vcpu *vcpu) > return handle_nop(vcpu); > } > > +static int handle_invalid_op(struct kvm_vcpu *vcpu) > +{ > + kvm_queue_exception(vcpu, UD_VECTOR); > + return 1; > +} > + > static int handle_monitor_trap(struct kvm_vcpu *vcpu) > { > return 1; > @@ -8090,6 +8118,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct > kvm_vcpu *vcpu) = { > [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor, > [EXIT_REASON_INVEPT] = handle_invept, > [EXIT_REASON_INVVPID] = handle_invvpid, > + [EXIT_REASON_RDRAND] = handle_invalid_op, > [EXIT_REASON_XSAVES] = handle_xsaves, > [EXIT_REASON_XRSTORS] = handle_xrstors, > [EXIT_REASON_PML_FULL] = handle_pml_full, >
Reviewed-by: David Hildenbrand <[email protected]> -- Thanks, David
