From: Kai Huang <kai.huang@linux.intel.com>
To: Sean Christopherson <sean.j.christopherson@intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
x86@kernel.org
Cc: "H. Peter Anvin" <hpa@zytor.com>,
"Peter Zijlstra" <peterz@infradead.org>,
"Arnaldo Carvalho de Melo" <acme@kernel.org>,
"Mark Rutland" <mark.rutland@arm.com>,
"Alexander Shishkin" <alexander.shishkin@linux.intel.com>,
"Jiri Olsa" <jolsa@redhat.com>,
"Namhyung Kim" <namhyung@kernel.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Radim Krčmář" <rkrcmar@redhat.com>,
"Vitaly Kuznetsov" <vkuznets@redhat.com>,
"Wanpeng Li" <wanpengli@tencent.com>,
"Jim Mattson" <jmattson@google.com>,
"Joerg Roedel" <joro@8bytes.org>,
"Tony Luck" <tony.luck@intel.com>,
"Tony W Wang-oc" <TonyWWang-oc@zhaoxin.com>,
"Shuah Khan" <shuah@kernel.org>,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
linux-edac@vger.kernel.org, linux-kselftest@vger.kernel.org,
"Borislav Petkov" <bp@suse.de>,
"Jarkko Sakkinen" <jarkko.sakkinen@linux.intel.com>
Subject: Re: [PATCH v3 04/19] x86/intel: Initialize IA32_FEATURE_CONTROL MSR at boot
Date: Tue, 19 Nov 2019 17:41:49 +1300 [thread overview]
Message-ID: <17a1831a3a72fb87ce2a35689e07ff517c4bdf99.camel@linux.intel.com> (raw)
In-Reply-To: <20191119031240.7779-5-sean.j.christopherson@intel.com>
On Mon, 2019-11-18 at 19:12 -0800, Sean Christopherson wrote:
> Opportunistically initialize IA32_FEATURE_CONTROL MSR to enable VMX when
> the MSR is left unlocked by BIOS. Configuring IA32_FEATURE_CONTROL at
> boot time paves the way for similar enabling of other features, e.g.
> Software Guard Extensions (SGX).
>
> Temporarily leave equivalent KVM code in place in order to avoid
> introducing a regression on Centaur and Zhaoxin CPUs, e.g. removing
> KVM's code would leave the MSR unlocked on those CPUs and would break
> existing functionality if people are loading kvm_intel on Centaur and/or
> Zhaoxin. Defer enablement of the boot-time configuration on Centaur and
> Zhaoxin to future patches to aid bisection.
>
> Note, Local Machine Check Exceptions (LMCE) are also supported by the
> kernel and enabled via IA32_FEATURE_CONTROL, but the kernel currently
> uses LMCE if and and only if the feature is explicitly enabled by BIOS.
> Keep the current behavior to avoid introducing bugs, future patches can
> opt in to opportunistic enabling if it's deemed desirable to do so.
>
> Always lock IA32_FEATURE_CONTROL if it exists, even if the CPU doesn't
> support VMX, so that other existing and future kernel code that queries
> IA32_FEATURE_CONTROL can assume it's locked.
>
> Start from a clean slate when constructing the value to write to
> IA32_FEATURE_CONTROL, i.e. ignore whatever value BIOS left in the MSR so
> as not to enable random features or fault on the WRMSR.
>
> Suggested-by: Borislav Petkov <bp@suse.de>
> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> ---
> arch/x86/Kconfig.cpu | 4 +++
> arch/x86/kernel/cpu/Makefile | 1 +
> arch/x86/kernel/cpu/cpu.h | 4 +++
> arch/x86/kernel/cpu/feature_control.c | 35 +++++++++++++++++++++++++++
> arch/x86/kernel/cpu/intel.c | 2 ++
> 5 files changed, 46 insertions(+)
> create mode 100644 arch/x86/kernel/cpu/feature_control.c
>
> diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
> index af9c967782f6..aafc14a0abf7 100644
> --- a/arch/x86/Kconfig.cpu
> +++ b/arch/x86/Kconfig.cpu
> @@ -387,6 +387,10 @@ config X86_DEBUGCTLMSR
> def_bool y
> depends on !(MK6 || MWINCHIPC6 || MWINCHIP3D || MCYRIXIII || M586MMX ||
> M586TSC || M586 || M486SX || M486) && !UML
>
> +config X86_FEATURE_CONTROL_MSR
> + def_bool y
> + depends on CPU_SUP_INTEL
> +
> menuconfig PROCESSOR_SELECT
> bool "Supported processor vendors" if EXPERT
> ---help---
> diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
> index 890f60083eca..84e35e762f76 100644
> --- a/arch/x86/kernel/cpu/Makefile
> +++ b/arch/x86/kernel/cpu/Makefile
> @@ -29,6 +29,7 @@ obj-y += umwait.o
> obj-$(CONFIG_PROC_FS) += proc.o
> obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
>
> +obj-$(CONFIG_X86_FEATURE_CONTROL_MSR) += feature_control.o
> ifdef CONFIG_CPU_SUP_INTEL
> obj-y += intel.o intel_pconfig.o tsx.o
> obj-$(CONFIG_PM) += intel_epb.o
> diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
> index 38ab6e115eac..a58e80866a3f 100644
> --- a/arch/x86/kernel/cpu/cpu.h
> +++ b/arch/x86/kernel/cpu/cpu.h
> @@ -80,4 +80,8 @@ extern void x86_spec_ctrl_setup_ap(void);
>
> extern u64 x86_read_arch_cap_msr(void);
>
> +#ifdef CONFIG_X86_FEATURE_CONTROL_MSR
> +void init_feature_control_msr(struct cpuinfo_x86 *c);
> +#endif
> +
> #endif /* ARCH_X86_CPU_H */
> diff --git a/arch/x86/kernel/cpu/feature_control.c
> b/arch/x86/kernel/cpu/feature_control.c
> new file mode 100644
> index 000000000000..33c9444dda52
> --- /dev/null
> +++ b/arch/x86/kernel/cpu/feature_control.c
> @@ -0,0 +1,35 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/tboot.h>
> +
> +#include <asm/cpufeature.h>
> +#include <asm/msr-index.h>
> +#include <asm/processor.h>
> +
> +void init_feature_control_msr(struct cpuinfo_x86 *c)
> +{
> + u64 msr;
> +
> + if (rdmsrl_safe(MSR_IA32_FEATURE_CONTROL, &msr))
> + return;
> +
> + if (msr & FEAT_CTL_LOCKED)
> + return;
> +
> + /*
> + * Ignore whatever value BIOS left in the MSR to avoid enabling random
> + * features or faulting on the WRMSR.
> + */
> + msr = FEAT_CTL_LOCKED;
> +
> + /*
> + * Enable VMX if and only if the kernel may do VMXON at some point,
> + * i.e. KVM is enabled, to avoid unnecessarily adding an attack vector
> + * for the kernel, e.g. using VMX to hide malicious code.
> + */
> + if (cpu_has(c, X86_FEATURE_VMX) && IS_ENABLED(CONFIG_KVM)) {
> + msr |= FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX;
> + if (tboot_enabled())
> + msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
> + }
Why not also take this chance to enable SGX? Or it will come with SGX patch
series?
> + wrmsrl(MSR_IA32_FEATURE_CONTROL, msr);
> +}
> diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
> index 4a900804a023..b7c6ed0b40b6 100644
> --- a/arch/x86/kernel/cpu/intel.c
> +++ b/arch/x86/kernel/cpu/intel.c
> @@ -755,6 +755,8 @@ static void init_intel(struct cpuinfo_x86 *c)
> /* Work around errata */
> srat_detect_node(c);
>
> + init_feature_control_msr(c);
Will this compile if you disable CONFIG_X86_FEATURE_CONTROL_MSR?
Provide an empty one in cpu.h if the config is not enabled?
Thanks,
-Kai
> +
> if (cpu_has(c, X86_FEATURE_VMX))
> detect_vmx_virtcap(c);
>
next prev parent reply other threads:[~2019-11-19 4:42 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 3:12 [PATCH v3 00/19] x86/cpu: Clean up handling of VMX features Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 01/19] x86/msr-index: Clean up bit defines for IA32_FEATURE_CONTROL MSR Sean Christopherson
2019-11-19 11:15 ` Borislav Petkov
2019-11-19 23:18 ` Sean Christopherson
2019-11-20 17:48 ` Borislav Petkov
2019-11-21 9:46 ` Jarkko Sakkinen
2019-11-21 22:14 ` Sean Christopherson
2019-11-29 21:06 ` Jarkko Sakkinen
2019-11-29 21:11 ` Jarkko Sakkinen
2019-11-19 3:12 ` [PATCH v3 02/19] selftests: kvm: Replace manual MSR defs with common msr-index.h Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 03/19] tools arch x86: Sync msr-index.h from kernel sources Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 04/19] x86/intel: Initialize IA32_FEATURE_CONTROL MSR at boot Sean Christopherson
2019-11-19 4:41 ` Kai Huang [this message]
2019-11-19 5:03 ` Sean Christopherson
2019-11-21 10:39 ` Jarkko Sakkinen
2019-11-21 10:41 ` Jarkko Sakkinen
2019-11-21 11:05 ` Borislav Petkov
2019-11-21 22:12 ` Sean Christopherson
2019-11-22 12:34 ` Borislav Petkov
2019-11-19 3:12 ` [PATCH v3 05/19] x86/mce: WARN once if IA32_FEATURE_CONTROL MSR is left unlocked Sean Christopherson
2019-11-21 10:45 ` Jarkko Sakkinen
2019-11-19 3:12 ` [PATCH v3 06/19] x86/centaur: Use common IA32_FEATURE_CONTROL MSR initialization Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 07/19] x86/zhaoxin: " Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 08/19] KVM: VMX: Drop initialization of IA32_FEATURE_CONTROL MSR Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 09/19] x86/cpu: Clear VMX feature flag if VMX is not fully enabled Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 10/19] KVM: VMX: Use VMX feature flag to query BIOS enabling Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 11/19] KVM: VMX: Check for full VMX support when verifying CPU compatibility Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 12/19] x86/vmx: Introduce VMX_FEATURES_* Sean Christopherson
2019-11-21 16:52 ` Borislav Petkov
2019-11-21 21:50 ` Sean Christopherson
2019-11-22 18:36 ` Borislav Petkov
2019-11-22 19:09 ` Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 13/19] x86/cpu: Detect VMX features on Intel, Centaur and Zhaoxin CPUs Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 14/19] x86/cpu: Print VMX flags in /proc/cpuinfo using VMX_FEATURES_* Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 15/19] x86/cpufeatures: Drop synthetic VMX feature flags Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 16/19] KVM: VMX: Use VMX_FEATURE_* flags to define VMCS control bits Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 17/19] x86/cpufeatures: Clean up synthetic virtualization flags Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 18/19] perf/x86: Provide stubs of KVM helpers for non-Intel CPUs Sean Christopherson
2019-11-19 3:12 ` [PATCH v3 19/19] KVM: VMX: Allow KVM_INTEL when building for Centaur and/or Zhaoxin CPUs Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17a1831a3a72fb87ce2a35689e07ff517c4bdf99.camel@linux.intel.com \
--to=kai.huang@linux.intel.com \
--cc=TonyWWang-oc@zhaoxin.com \
--cc=acme@kernel.org \
--cc=alexander.shishkin@linux.intel.com \
--cc=bp@alien8.de \
--cc=bp@suse.de \
--cc=hpa@zytor.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jmattson@google.com \
--cc=jolsa@redhat.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=rkrcmar@redhat.com \
--cc=sean.j.christopherson@intel.com \
--cc=shuah@kernel.org \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).