x86/cpu: Clear VMX feature flag if VMX is not fully enabled (ef4d3bf1) · Commits · 戴 / test

Now that IA32_FEAT_CTL is always configured and locked for CPUs that are known to support VMX[*], clear the VMX capability flag if the MSR is unsupported or BIOS disabled VMX, i.e. locked IA32_FEAT_CTL and didn't set the appropriate VMX enable bit. [*] Because init_ia32_feat_ctl() is called from vendors ->c_init(), it's still possible for IA32_FEAT_CTL to be left unlocked when VMX is supported by the CPU. This is not fatal, and will be addressed in a future patch. Signed-off-by:

Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by:

Borislav Petkov <bp@suse.de> Link: https://lkml.kernel.org/r/20191221044513.21680-9-sean.j.christopherson@intel.com

arch/x86/kernel/cpu/feat_ctl.c

+20 −3

Original line number	Diff line number	Diff line
		@@ -5,15 +5,21 @@
		#include <asm/msr-index.h>
		#include <asm/processor.h>

		#undef pr_fmt
		#define pr_fmt(fmt) "x86/cpu: " fmt

		void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
		{
		bool tboot = tboot_enabled();
		u64 msr;

		if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr))
		if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
		clear_cpu_cap(c, X86_FEATURE_VMX);
		return;
		}

		if (msr & FEAT_CTL_LOCKED)
		return;
		goto update_caps;

		/*
		* Ignore whatever value BIOS left in the MSR to avoid enabling random
		@@ -29,9 +35,20 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
		if (cpu_has(c, X86_FEATURE_VMX) && IS_ENABLED(CONFIG_KVM_INTEL)) {
		msr \|= FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX;

		if (tboot_enabled())
		if (tboot)
		msr \|= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
		}

		wrmsrl(MSR_IA32_FEAT_CTL, msr);

		update_caps:
		if (!cpu_has(c, X86_FEATURE_VMX))
		return;

		if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) \|\|
		(!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
		pr_err_once("VMX (%s TXT) disabled by BIOS\n",
		tboot ? "inside" : "outside");
		clear_cpu_cap(c, X86_FEATURE_VMX);
		}
		}

Admin message