linux.git/arch/x86/kernel/cpu/feat_ctl.c, branch v6.2

x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype

2022-09-26T15:06:27+00:00

Include the header containing the prototype of init_ia32_feat_ctl(),
solving the following warning:

  $ make W=1 arch/x86/kernel/cpu/feat_ctl.o
  arch/x86/kernel/cpu/feat_ctl.c:112:6: warning: no previous prototype for ‘init_ia32_feat_ctl’ [-Wmissing-prototypes]
    112 | void init_ia32_feat_ctl(struct cpuinfo_x86 *c)

This warning appeared after commit

  5d5103595e9e5 ("x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup")

had moved the function init_ia32_feat_ctl()'s prototype from
arch/x86/kernel/cpu/cpu.h to arch/x86/include/asm/cpu.h.

Note that, before the commit mentioned above, the header include "cpu.h"
(arch/x86/kernel/cpu/cpu.h) was added by commit

  0e79ad863df43 ("x86/cpu: Fix a -Wmissing-prototypes warning for init_ia32_feat_ctl()")

solely to fix init_ia32_feat_ctl()'s missing prototype. So, the header
include "cpu.h" is no longer necessary.

  [ bp: Massage commit message. ]

Fixes: 5d5103595e9e5 ("x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup")
Signed-off-by: Luciano Leão 
Signed-off-by: Borislav Petkov 
Reviewed-by: Nícolas F. R. A. Prado 
Link: https://lore.kernel.org/r/20220922200053.1357470-1-lucianorsleao@gmail.com

x86/cpu: Add new VMX feature, Tertiary VM-Execution control

2022-06-08T08:47:13+00:00

A new 64-bit control field "tertiary processor-based VM-execution
controls", is defined [1]. It's controlled by bit 17 of the primary
processor-based VM-execution controls.

Different from its brother VM-execution fields, this tertiary VM-
execution controls field is 64 bit. So it occupies 2 vmx_feature_leafs,
TERTIARY_CTLS_LOW and TERTIARY_CTLS_HIGH.

Its companion VMX capability reporting MSR,MSR_IA32_VMX_PROCBASED_CTLS3
(0x492), is also semantically different from its brothers, whose 64 bits
consist of all allow-1, rather than 32-bit allow-0 and 32-bit allow-1 [1][2].
Therefore, its init_vmx_capabilities() is a little different from others.

[1] ISE 6.2 "VMCS Changes"
https://www.intel.com/content/www/us/en/develop/download/intel-architecture-instruction-set-extensions-programming-reference.html

[2] SDM Vol3. Appendix A.3

Reviewed-by: Sean Christopherson 
Reviewed-by: Maxim Levitsky 
Signed-off-by: Robert Hoo 
Signed-off-by: Zeng Guang 
Message-Id: <20220419153240.11549-1-guang.zeng@intel.com>
Signed-off-by: Paolo Bonzini

x86/cpu/intel: Allow SGX virtualization without Launch Control support

2021-04-06T07:43:41+00:00

The kernel will currently disable all SGX support if the hardware does
not support launch control.  Make it more permissive to allow SGX
virtualization on systems without Launch Control support.  This will
allow KVM to expose SGX to guests that have less-strict requirements on
the availability of flexible launch control.

Improve error message to distinguish between three cases.  There are two
cases where SGX support is completely disabled:
1) SGX has been disabled completely by the BIOS
2) SGX LC is locked by the BIOS.  Bare-metal support is disabled because
   of LC unavailability.  SGX virtualization is unavailable (because of
   Kconfig).
One where it is partially available:
3) SGX LC is locked by the BIOS.  Bare-metal support is disabled because
   of LC unavailability.  SGX virtualization is supported.

Signed-off-by: Sean Christopherson 
Co-developed-by: Kai Huang 
Signed-off-by: Kai Huang 
Signed-off-by: Borislav Petkov 
Acked-by: Jarkko Sakkinen 
Acked-by: Dave Hansen 
Link: https://lkml.kernel.org/r/b3329777076509b3b601550da288c8f3c406a865.1616136308.git.kai.huang@intel.com

x86/cpufeatures: Make SGX_LC feature bit depend on SGX bit

2021-03-25T16:33:11+00:00

Move SGX_LC feature bit to CPUID dependency table to make clearing all
SGX feature bits easier. Also remove clear_sgx_caps() since it is just
a wrapper of setup_clear_cpu_cap(X86_FEATURE_SGX) now.

Suggested-by: Sean Christopherson 
Signed-off-by: Kai Huang 
Signed-off-by: Borislav Petkov 
Reviewed-by: Sean Christopherson 
Acked-by: Dave Hansen 
Acked-by: Jarkko Sakkinen 
Link: https://lkml.kernel.org/r/5d4220fd0a39f52af024d3fa166231c1d498dd10.1616136308.git.kai.huang@intel.com

x86/cpu/intel: Add a nosgx kernel parameter

2020-11-17T13:36:13+00:00

Add a kernel parameter to disable SGX kernel support and document it.

 [ bp: Massage. ]

Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Borislav Petkov 
Reviewed-by: Sean Christopherson 
Acked-by: Jethro Beekman 
Tested-by: Sean Christopherson 
Link: https://lkml.kernel.org/r/20201112220135.165028-9-jarkko@kernel.org

x86/cpu/intel: Detect SGX support

2020-11-17T13:36:13+00:00

Kernel support for SGX is ultimately decided by the state of the launch
control bits in the feature control MSR (MSR_IA32_FEAT_CTL).  If the
hardware supports SGX, but neglects to support flexible launch control, the
kernel will not enable SGX.

Enable SGX at feature control MSR initialization and update the associated
X86_FEATURE flags accordingly.  Disable X86_FEATURE_SGX (and all
derivatives) if the kernel is not able to establish itself as the authority
over SGX Launch Control.

All checks are performed for each logical CPU (not just boot CPU) in order
to verify that MSR_IA32_FEATURE_CONTROL is correctly configured on all
CPUs. All SGX code in this series expects the same configuration from all
CPUs.

This differs from VMX where X86_FEATURE_VMX is intentionally cleared only
for the current CPU so that KVM can provide additional information if KVM
fails to load like which CPU doesn't support VMX.  There’s not much the
kernel or an administrator can do to fix the situation, so SGX neglects to
convey additional details about these kinds of failures if they occur.

Signed-off-by: Sean Christopherson 
Co-developed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Borislav Petkov 
Acked-by: Jethro Beekman 
Link: https://lkml.kernel.org/r/20201112220135.165028-8-jarkko@kernel.org

x86/cpu: Fix a -Wmissing-prototypes warning for init_ia32_feat_ctl()

2020-03-23T11:01:59+00:00

Add a missing include in order to fix -Wmissing-prototypes warning:

  arch/x86/kernel/cpu/feat_ctl.c:95:6: warning: no previous prototype for ‘init_ia32_feat_ctl’ [-Wmissing-prototypes]
     95 | void init_ia32_feat_ctl(struct cpuinfo_x86 *c)

Signed-off-by: Benjamin Thiel 
Signed-off-by: Borislav Petkov 
Link: https://lkml.kernel.org/r/20200323105934.26597-1-b.thiel@posteo.de

x86/cpu: Print "VMX disabled" error message iff KVM is enabled

2020-01-15T12:26:50+00:00

Don't print an error message about VMX being disabled by BIOS if KVM,
the sole user of VMX, is disabled. E.g. if KVM is disabled and the MSR
is unlocked, the kernel will intentionally disable VMX when locking
feature control and then complain that "BIOS" disabled VMX.

Fixes: ef4d3bf19855 ("x86/cpu: Clear VMX feature flag if VMX is not fully enabled")
Signed-off-by: Sean Christopherson 
Signed-off-by: Borislav Petkov 
Link: https://lkml.kernel.org/r/20200114202545.20296-1-sean.j.christopherson@intel.com

x86/cpufeatures: Add flag to track whether MSR IA32_FEAT_CTL is configured

2020-01-13T17:49:00+00:00

Add a new feature flag, X86_FEATURE_MSR_IA32_FEAT_CTL, to track whether
IA32_FEAT_CTL has been initialized.  This will allow KVM, and any future
subsystems that depend on IA32_FEAT_CTL, to rely purely on cpufeatures
to query platform support, e.g. allows a future patch to remove KVM's
manual IA32_FEAT_CTL MSR checks.

Various features (on platforms that support IA32_FEAT_CTL) are dependent
on IA32_FEAT_CTL being configured and locked, e.g. VMX and LMCE.  The
MSR is always configured during boot, but only if the CPU vendor is
recognized by the kernel.  Because CPUID doesn't incorporate the current
IA32_FEAT_CTL value in its reporting of relevant features, it's possible
for a feature to be reported as supported in cpufeatures but not truly
enabled, e.g. if the CPU supports VMX but the kernel doesn't recognize
the CPU.

As a result, without the flag, KVM would see VMX as supported even if
IA32_FEAT_CTL hasn't been initialized, and so would need to manually
read the MSR and check the various enabling bits to avoid taking an
unexpected #GP on VMXON.

Signed-off-by: Sean Christopherson 
Signed-off-by: Borislav Petkov 
Link: https://lkml.kernel.org/r/20191221044513.21680-14-sean.j.christopherson@intel.com

x86/cpu: Set synthetic VMX cpufeatures during init_ia32_feat_ctl()

2020-01-13T17:43:19+00:00

Set the synthetic VMX cpufeatures, which need to be kept to preserve
/proc/cpuinfo's ABI, in the common IA32_FEAT_CTL initialization code.
Remove the vendor code that manually sets the synthetic flags.

Signed-off-by: Sean Christopherson 
Signed-off-by: Borislav Petkov 
Link: https://lkml.kernel.org/r/20191221044513.21680-13-sean.j.christopherson@intel.com