@@ -3668,6 +3668,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
SECONDARY_EXEC_SHADOW_VMCS |
SECONDARY_EXEC_XSAVES |
SECONDARY_EXEC_RDSEED |
+ SECONDARY_EXEC_RDRAND |
SECONDARY_EXEC_ENABLE_PML |
SECONDARY_EXEC_TSC_SCALING |
SECONDARY_EXEC_ENABLE_VMFUNC;
@@ -5304,6 +5305,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDSEED))
exec_control &= ~SECONDARY_EXEC_RDSEED;
+ if (guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDRAND))
+ exec_control &= ~SECONDARY_EXEC_RDRAND;
+
return exec_control;
}
@@ -8058,6 +8062,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
[EXIT_REASON_INVEPT] = handle_invept,
[EXIT_REASON_INVVPID] = handle_invvpid,
[EXIT_REASON_RDSEED] = handle_invalid_op,
+ [EXIT_REASON_RDRAND] = handle_invalid_op,
[EXIT_REASON_XSAVES] = handle_xsaves,
[EXIT_REASON_XRSTORS] = handle_xrstors,
[EXIT_REASON_PML_FULL] = handle_pml_full,
@@ -8992,6 +8997,12 @@ static bool vmx_rdseed_supported(void)
SECONDARY_EXEC_RDSEED;
}
+static bool vmx_rdrand_supported(void)
+{
+ return vmcs_config.cpu_based_2nd_exec_ctrl &
+ SECONDARY_EXEC_RDRAND;
+}
+
static bool vmx_xsaves_supported(void)
{
return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -9690,6 +9701,12 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
secondary_exec_ctl |= SECONDARY_EXEC_RDSEED;
}
+ if (vmx_rdrand_supported() &&
+ !guest_cpuid_has(vcpu, X86_FEATURE_RDRAND)) {
+ nested_vmx_secondary_ctrls_clear(vcpu, SECONDARY_EXEC_RDRAND);
+ secondary_exec_ctl |= SECONDARY_EXEC_RDRAND;
+ }
+
if (cpu_has_secondary_exec_ctrls())
vmcs_set_secondary_exec_control(secondary_exec_ctl);
A guest may not be configured to support RDRAND, even when the host does. If the guest does not support RDRAND, intercept the instruction and synthesize #UD. Also clear the "allowed-1" bit for RDRAND exiting in the IA32_VMX_PROCBASED_CTLS2 MSR. Signed-off-by: Jim Mattson <jmattson@google.com> --- arch/x86/kvm/vmx.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)