Commit 3db13480 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

kvm: vmx: Raise #UD on unsupported XSAVES/XRSTORS 



A guest may not be configured to support XSAVES/XRSTORS, even when the host
does. If the guest does not support XSAVES/XRSTORS, clear the secondary
execution control so that the processor will raise #UD.

Also clear the "allowed-1" bit for XSAVES/XRSTORS exiting in the
IA32_VMX_PROCBASED_CTLS2 MSR, and pass through VMCS12's control in
the VMCS02.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 75f4fc8d

arch/x86/kvm/vmx.c

+22 −4
Original line number Diff line number Diff line
@@ -1358,8 +1358,7 @@ static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12) 


static inline bool nested_cpu_has_xsaves(struct vmcs12 *vmcs12)

{

	return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES) &&

		vmx_xsaves_supported();

	return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);

}



static inline bool nested_cpu_has_pml(struct vmcs12 *vmcs12)
@@ -2823,8 +2822,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) 
		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |

		SECONDARY_EXEC_APIC_REGISTER_VIRT |

		SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |

		SECONDARY_EXEC_WBINVD_EXITING |

		SECONDARY_EXEC_XSAVES;

		SECONDARY_EXEC_WBINVD_EXITING;



	if (enable_ept) {

		/* nested EPT: emulate EPT also to L1 */
@@ -5319,6 +5317,25 @@ static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx) 
	if (!enable_pml)

		exec_control &= ~SECONDARY_EXEC_ENABLE_PML;



	if (vmx_xsaves_supported()) {

		/* Exposing XSAVES only when XSAVE is exposed */

		bool xsaves_enabled =

			guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&

			guest_cpuid_has(vcpu, X86_FEATURE_XSAVES);



		if (!xsaves_enabled)

			exec_control &= ~SECONDARY_EXEC_XSAVES;



		if (nested) {

			if (xsaves_enabled)

				vmx->nested.nested_vmx_secondary_ctls_high |=

					SECONDARY_EXEC_XSAVES;

			else

				vmx->nested.nested_vmx_secondary_ctls_high &=

					~SECONDARY_EXEC_XSAVES;

		}

	}



	if (vmx_rdtscp_supported()) {

		bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP);

		if (!rdtscp_enabled)
@@ -10421,6 +10438,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, 
		exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |

				  SECONDARY_EXEC_ENABLE_INVPCID |

				  SECONDARY_EXEC_RDTSCP |

				  SECONDARY_EXEC_XSAVES |

				  SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |

				  SECONDARY_EXEC_APIC_REGISTER_VIRT |

				  SECONDARY_EXEC_ENABLE_VMFUNC);

CRA Git | Maintained and supported by SUSTech CRA and CCSE