Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754043AbdHXUlb (ORCPT ); Thu, 24 Aug 2017 16:41:31 -0400 Received: from mail-wr0-f173.google.com ([209.85.128.173]:36023 "EHLO mail-wr0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753314AbdHXUl3 (ORCPT ); Thu, 24 Aug 2017 16:41:29 -0400 X-Google-Smtp-Source: ADKCNb62z85ExIf56VlGFEvA4ALaEzZt2pov0/TOGLB4yvvhuTx/d+P9A7sMbtO7cKUG4BqhQb0PqY4h1SGlibmRvfI= MIME-Version: 1.0 In-Reply-To: <1503590999-45126-1-git-send-email-pbonzini@redhat.com> References: <1503590999-45126-1-git-send-email-pbonzini@redhat.com> From: Jim Mattson Date: Thu, 24 Aug 2017 13:41:27 -0700 Message-ID: Subject: Re: [PATCH v8 4/4] kvm: vmx: Raise #UD on unsupported XSAVES/XRSTORS To: Paolo Bonzini Cc: LKML , kvm list Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3469 Lines: 77 Reviewed-by: Jim Mattson On Thu, Aug 24, 2017 at 9:09 AM, Paolo Bonzini wrote: > A guest may not be configured to support XSAVES/XRSTORS, even when the host > does. If the guest does not support XSAVES/XRSTORS, clear the secondary > execution control so that the processor will raise #UD. > > Also clear the "allowed-1" bit for XSAVES/XRSTORS exiting in the > IA32_VMX_PROCBASED_CTLS2 MSR, and pass through VMCS12's control in > the VMCS02. > > Signed-off-by: Paolo Bonzini > --- > arch/x86/kvm/vmx.c | 26 ++++++++++++++++++++++---- > 1 file changed, 22 insertions(+), 4 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index 954e26079cd6..08bfeb8c32ea 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -1358,8 +1358,7 @@ static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12) > > static inline bool nested_cpu_has_xsaves(struct vmcs12 *vmcs12) > { > - return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES) && > - vmx_xsaves_supported(); > + return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES); > } > > static inline bool nested_cpu_has_pml(struct vmcs12 *vmcs12) > @@ -2823,8 +2822,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) > SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE | > SECONDARY_EXEC_APIC_REGISTER_VIRT | > SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | > - SECONDARY_EXEC_WBINVD_EXITING | > - SECONDARY_EXEC_XSAVES; > + SECONDARY_EXEC_WBINVD_EXITING; > > if (enable_ept) { > /* nested EPT: emulate EPT also to L1 */ > @@ -5319,6 +5317,25 @@ static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx) > if (!enable_pml) > exec_control &= ~SECONDARY_EXEC_ENABLE_PML; > > + if (vmx_xsaves_supported()) { > + /* Exposing XSAVES only when XSAVE is exposed */ > + bool xsaves_enabled = > + guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) && > + guest_cpuid_has(vcpu, X86_FEATURE_XSAVES); > + > + if (!xsaves_enabled) > + exec_control &= ~SECONDARY_EXEC_XSAVES; > + > + if (nested) { > + if (xsaves_enabled) > + vmx->nested.nested_vmx_secondary_ctls_high |= > + SECONDARY_EXEC_XSAVES; > + else > + vmx->nested.nested_vmx_secondary_ctls_high &= > + ~SECONDARY_EXEC_XSAVES; > + } > + } > + > if (vmx_rdtscp_supported()) { > bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP); > if (!rdtscp_enabled) > @@ -10421,6 +10438,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, > exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | > SECONDARY_EXEC_ENABLE_INVPCID | > SECONDARY_EXEC_RDTSCP | > + SECONDARY_EXEC_XSAVES | > SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | > SECONDARY_EXEC_APIC_REGISTER_VIRT | > SECONDARY_EXEC_ENABLE_VMFUNC); > -- > 1.8.3.1 >