Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1718664 > unrolled thread
| Started by | Paolo Bonzini <pbonzini@redhat.com> |
|---|---|
| First post | 2017-08-23 23:40 +0200 |
| Last post | 2017-08-24 19:30 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] kvm: vmx: Raise #UD on unsupported RDRAND Paolo Bonzini <pbonzini@redhat.com> - 2017-08-23 23:40 +0200
Re: [PATCH] kvm: vmx: Raise #UD on unsupported RDRAND David Hildenbrand <david@redhat.com> - 2017-08-24 19:30 +0200
| From | Paolo Bonzini <pbonzini@redhat.com> |
|---|---|
| Date | 2017-08-23 23:40 +0200 |
| Subject | [PATCH] kvm: vmx: Raise #UD on unsupported RDRAND |
| Message-ID | <uhLxw-5QD-13@gated-at.bofh.it> |
A guest may not be configured to support RDRAND, even when the host
does. If the guest does not support RDRAND, intercept the instruction
and synthesize #UD. Also clear the "allowed-1" bit for RDRAND exiting
in the IA32_VMX_PROCBASED_CTLS2 MSR.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/vmx.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 8346fd53a42f..b13370381988 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3661,6 +3661,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
SECONDARY_EXEC_SHADOW_VMCS |
SECONDARY_EXEC_XSAVES |
+ SECONDARY_EXEC_RDRAND |
SECONDARY_EXEC_RDSEED |
SECONDARY_EXEC_ENABLE_PML |
SECONDARY_EXEC_TSC_SCALING |
@@ -5295,6 +5296,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
if (!enable_pml)
exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
+ if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDRAND))
+ exec_control &= ~SECONDARY_EXEC_RDRAND;
+
if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDSEED))
exec_control &= ~SECONDARY_EXEC_RDSEED;
@@ -8051,6 +8055,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
[EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
[EXIT_REASON_INVEPT] = handle_invept,
[EXIT_REASON_INVVPID] = handle_invvpid,
+ [EXIT_REASON_RDRAND] = handle_invalid_op,
[EXIT_REASON_RDSEED] = handle_invalid_op,
[EXIT_REASON_XSAVES] = handle_xsaves,
[EXIT_REASON_XRSTORS] = handle_xrstors,
@@ -8980,6 +8985,12 @@ static bool vmx_mpx_supported(void)
(vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
}
+static bool vmx_rdrand_supported(void)
+{
+ return vmcs_config.cpu_based_2nd_exec_ctrl &
+ SECONDARY_EXEC_RDRAND;
+}
+
static bool vmx_rdseed_supported(void)
{
return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -9735,6 +9746,24 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
}
}
+ if (vmx_rdrand_supported()) {
+ bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
+
+ if (rdrand_enabled)
+ secondary_exec_ctl &= ~SECONDARY_EXEC_RDRAND;
+ else
+ secondary_exec_ctl |= SECONDARY_EXEC_RDRAND;
+
+ if (nested) {
+ if (rdrand_enabled)
+ vmx->nested.nested_vmx_secondary_ctls_high |=
+ SECONDARY_EXEC_RDRAND;
+ else
+ vmx->nested.nested_vmx_secondary_ctls_high &=
+ ~SECONDARY_EXEC_RDRAND;
+ }
+ }
+
if (vmx_rdseed_supported()) {
bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
--
1.8.3.1
[toc] | [next] | [standalone]
| From | David Hildenbrand <david@redhat.com> |
|---|---|
| Date | 2017-08-24 19:30 +0200 |
| Message-ID | <ui478-14g-5@gated-at.bofh.it> |
| In reply to | #1718664 |
On 23.08.2017 23:39, Paolo Bonzini wrote:
> A guest may not be configured to support RDRAND, even when the host
> does. If the guest does not support RDRAND, intercept the instruction
> and synthesize #UD. Also clear the "allowed-1" bit for RDRAND exiting
> in the IA32_VMX_PROCBASED_CTLS2 MSR.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> arch/x86/kvm/vmx.c | 29 +++++++++++++++++++++++++++++
> 1 file changed, 29 insertions(+)
>
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 8346fd53a42f..b13370381988 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -3661,6 +3661,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
> SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
> SECONDARY_EXEC_SHADOW_VMCS |
> SECONDARY_EXEC_XSAVES |
> + SECONDARY_EXEC_RDRAND |
> SECONDARY_EXEC_RDSEED |
> SECONDARY_EXEC_ENABLE_PML |
> SECONDARY_EXEC_TSC_SCALING |
> @@ -5295,6 +5296,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
> if (!enable_pml)
> exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
>
> + if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDRAND))
> + exec_control &= ~SECONDARY_EXEC_RDRAND;
> +
> if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDSEED))
> exec_control &= ~SECONDARY_EXEC_RDSEED;
>
> @@ -8051,6 +8055,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
> [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
> [EXIT_REASON_INVEPT] = handle_invept,
> [EXIT_REASON_INVVPID] = handle_invvpid,
> + [EXIT_REASON_RDRAND] = handle_invalid_op,
> [EXIT_REASON_RDSEED] = handle_invalid_op,
> [EXIT_REASON_XSAVES] = handle_xsaves,
> [EXIT_REASON_XRSTORS] = handle_xrstors,
> @@ -8980,6 +8985,12 @@ static bool vmx_mpx_supported(void)
> (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
> }
>
> +static bool vmx_rdrand_supported(void)
> +{
> + return vmcs_config.cpu_based_2nd_exec_ctrl &
> + SECONDARY_EXEC_RDRAND;
> +}
> +
> static bool vmx_rdseed_supported(void)
> {
> return vmcs_config.cpu_based_2nd_exec_ctrl &
> @@ -9735,6 +9746,24 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
> }
> }
>
> + if (vmx_rdrand_supported()) {
> + bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
> +
> + if (rdrand_enabled)
> + secondary_exec_ctl &= ~SECONDARY_EXEC_RDRAND;
> + else
> + secondary_exec_ctl |= SECONDARY_EXEC_RDRAND;
> +
> + if (nested) {
> + if (rdrand_enabled)
> + vmx->nested.nested_vmx_secondary_ctls_high |=
> + SECONDARY_EXEC_RDRAND;
> + else
> + vmx->nested.nested_vmx_secondary_ctls_high &=
> + ~SECONDARY_EXEC_RDRAND;
> + }
> + }
> +
> if (vmx_rdseed_supported()) {
> bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
>
>
From what I can tell, this looks good to me.
Reviewed-by: David Hildenbrand <david@redhat.com>
--
Thanks,
David
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web