1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/tboot.h>
3
4 #include <asm/cpu.h>
5 #include <asm/cpufeature.h>
6 #include <asm/msr-index.h>
7 #include <asm/processor.h>
8 #include <asm/vmx.h>
9
10 #undef pr_fmt
11 #define pr_fmt(fmt) "x86/cpu: " fmt
12
13 #ifdef CONFIG_X86_VMX_FEATURE_NAMES
14 enum vmx_feature_leafs {
15 MISC_FEATURES = 0,
16 PRIMARY_CTLS,
17 SECONDARY_CTLS,
18 TERTIARY_CTLS_LOW,
19 TERTIARY_CTLS_HIGH,
20 NR_VMX_FEATURE_WORDS,
21 };
22
23 #define VMX_F(x) BIT(VMX_FEATURE_##x & 0x1f)
24
25 static void init_vmx_capabilities(struct cpuinfo_x86 *c)
26 {
27 u32 supported, funcs, ept, vpid, ign, low, high;
28
29 BUILD_BUG_ON(NVMXINTS != NR_VMX_FEATURE_WORDS);
30
31 /*
32 * The high bits contain the allowed-1 settings, i.e. features that can
33 * be turned on. The low bits contain the allowed-0 settings, i.e.
34 * features that can be turned off. Ignore the allowed-0 settings,
35 * if a feature can be turned on then it's supported.
36 *
37 * Use raw rdmsr() for primary processor controls and pin controls MSRs
38 * as they exist on any CPU that supports VMX, i.e. we want the WARN if
39 * the RDMSR faults.
40 */
41 rdmsr(MSR_IA32_VMX_PROCBASED_CTLS, ign, supported);
42 c->vmx_capability[PRIMARY_CTLS] = supported;
43
44 rdmsr_safe(MSR_IA32_VMX_PROCBASED_CTLS2, &ign, &supported);
45 c->vmx_capability[SECONDARY_CTLS] = supported;
46
47 /* All 64 bits of tertiary controls MSR are allowed-1 settings. */
48 rdmsr_safe(MSR_IA32_VMX_PROCBASED_CTLS3, &low, &high);
49 c->vmx_capability[TERTIARY_CTLS_LOW] = low;
50 c->vmx_capability[TERTIARY_CTLS_HIGH] = high;
51
52 rdmsr(MSR_IA32_VMX_PINBASED_CTLS, ign, supported);
53 rdmsr_safe(MSR_IA32_VMX_VMFUNC, &ign, &funcs);
54
55 /*
56 * Except for EPT+VPID, which enumerates support for both in a single
57 * MSR, low for EPT, high for VPID.
58 */
59 rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, &ept, &vpid);
60
61 /* Pin, EPT, VPID and VM-Func are merged into a single word. */
62 WARN_ON_ONCE(supported >> 16);
63 WARN_ON_ONCE(funcs >> 4);
64 c->vmx_capability[MISC_FEATURES] = (supported & 0xffff) |
65 ((vpid & 0x1) << 16) |
66 ((funcs & 0xf) << 28);
67
68 /* EPT bits are full on scattered and must be manually handled. */
69 if (ept & VMX_EPT_EXECUTE_ONLY_BIT)
70 c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_EXECUTE_ONLY);
71 if (ept & VMX_EPT_AD_BIT)
72 c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_AD);
73 if (ept & VMX_EPT_1GB_PAGE_BIT)
74 c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_1GB);
75 if (ept & VMX_EPT_PAGE_WALK_5_BIT)
76 c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_5LEVEL);
77
78 /* Synthetic APIC features that are aggregates of multiple features. */
79 if ((c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR)) &&
80 (c->vmx_capability[SECONDARY_CTLS] & VMX_F(VIRT_APIC_ACCESSES)))
81 c->vmx_capability[MISC_FEATURES] |= VMX_F(FLEXPRIORITY);
82
83 if ((c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR)) &&
84 (c->vmx_capability[SECONDARY_CTLS] & VMX_F(APIC_REGISTER_VIRT)) &&
85 (c->vmx_capability[SECONDARY_CTLS] & VMX_F(VIRT_INTR_DELIVERY)) &&
86 (c->vmx_capability[MISC_FEATURES] & VMX_F(POSTED_INTR)))
87 c->vmx_capability[MISC_FEATURES] |= VMX_F(APICV);
88
89 /* Set the synthetic cpufeatures to preserve /proc/cpuinfo's ABI. */
90 if (c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR))
91 set_cpu_cap(c, X86_FEATURE_TPR_SHADOW);
92 if (c->vmx_capability[MISC_FEATURES] & VMX_F(FLEXPRIORITY))
93 set_cpu_cap(c, X86_FEATURE_FLEXPRIORITY);
94 if (c->vmx_capability[MISC_FEATURES] & VMX_F(VIRTUAL_NMIS))
95 set_cpu_cap(c, X86_FEATURE_VNMI);
96 if (c->vmx_capability[SECONDARY_CTLS] & VMX_F(EPT))
97 set_cpu_cap(c, X86_FEATURE_EPT);
98 if (c->vmx_capability[MISC_FEATURES] & VMX_F(EPT_AD))
99 set_cpu_cap(c, X86_FEATURE_EPT_AD);
100 if (c->vmx_capability[MISC_FEATURES] & VMX_F(VPID))
101 set_cpu_cap(c, X86_FEATURE_VPID);
102 }
103 #endif /* CONFIG_X86_VMX_FEATURE_NAMES */
104
105 static int __init nosgx(char *str)
106 {
107 setup_clear_cpu_cap(X86_FEATURE_SGX);
108
109 return 0;
110 }
111
112 early_param("nosgx", nosgx);
113
114 void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
115 {
116 bool enable_sgx_kvm = false, enable_sgx_driver = false;
117 bool tboot = tboot_enabled();
118 bool enable_vmx;
119 u64 msr;
120
121 if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
122 clear_cpu_cap(c, X86_FEATURE_VMX);
123 clear_cpu_cap(c, X86_FEATURE_SGX);
124 return;
125 }
126
127 enable_vmx = cpu_has(c, X86_FEATURE_VMX) &&
128 IS_ENABLED(CONFIG_KVM_INTEL);
129
130 if (cpu_has(c, X86_FEATURE_SGX) && IS_ENABLED(CONFIG_X86_SGX)) {
131 /*
132 * Separate out SGX driver enabling from KVM. This allows KVM
133 * guests to use SGX even if the kernel SGX driver refuses to
134 * use it. This happens if flexible Launch Control is not
135 * available.
136 */
137 enable_sgx_driver = cpu_has(c, X86_FEATURE_SGX_LC);
138 enable_sgx_kvm = enable_vmx && IS_ENABLED(CONFIG_X86_SGX_KVM);
139 }
140
141 if (msr & FEAT_CTL_LOCKED)
142 goto update_caps;
143
144 /*
145 * Ignore whatever value BIOS left in the MSR to avoid enabling random
146 * features or faulting on the WRMSR.
147 */
148 msr = FEAT_CTL_LOCKED;
149
150 /*
151 * Enable VMX if and only if the kernel may do VMXON at some point,
152 * i.e. KVM is enabled, to avoid unnecessarily adding an attack vector
153 * for the kernel, e.g. using VMX to hide malicious code.
154 */
155 if (enable_vmx) {
156 msr |= FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX;
157
158 if (tboot)
159 msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
160 }
161
162 if (enable_sgx_kvm || enable_sgx_driver) {
163 msr |= FEAT_CTL_SGX_ENABLED;
164 if (enable_sgx_driver)
165 msr |= FEAT_CTL_SGX_LC_ENABLED;
166 }
167
168 wrmsrl(MSR_IA32_FEAT_CTL, msr);
169
170 update_caps:
171 set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);
172
173 if (!cpu_has(c, X86_FEATURE_VMX))
174 goto update_sgx;
175
176 if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
177 (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
178 if (IS_ENABLED(CONFIG_KVM_INTEL))
179 pr_err_once("VMX (%s TXT) disabled by BIOS\n",
180 tboot ? "inside" : "outside");
181 clear_cpu_cap(c, X86_FEATURE_VMX);
182 } else {
183 #ifdef CONFIG_X86_VMX_FEATURE_NAMES
184 init_vmx_capabilities(c);
185 #endif
186 }
187
188 update_sgx:
189 if (!(msr & FEAT_CTL_SGX_ENABLED)) {
190 if (enable_sgx_kvm || enable_sgx_driver)
191 pr_err_once("SGX disabled by BIOS.\n");
192 clear_cpu_cap(c, X86_FEATURE_SGX);
193 return;
194 }
195
196 /*
197 * VMX feature bit may be cleared due to being disabled in BIOS,
198 * in which case SGX virtualization cannot be supported either.
199 */
200 if (!cpu_has(c, X86_FEATURE_VMX) && enable_sgx_kvm) {
201 pr_err_once("SGX virtualization disabled due to lack of VMX.\n");
202 enable_sgx_kvm = 0;
203 }
204
205 if (!(msr & FEAT_CTL_SGX_LC_ENABLED) && enable_sgx_driver) {
206 if (!enable_sgx_kvm) {
207 pr_err_once("SGX Launch Control is locked. Disable SGX.\n");
208 clear_cpu_cap(c, X86_FEATURE_SGX);
209 } else {
210 pr_err_once("SGX Launch Control is locked. Support SGX virtualization only.\n");
211 clear_cpu_cap(c, X86_FEATURE_SGX_LC);
212 }
213 }
214 }
215
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.