[PATCH] intel_txt: enable VMXON check with SMX in KVM
Per document, for feature control MSR Bit 1 enables VMXON in SMX operation. If the bit is clear, execution of VMXON in SMX operation causes a general-protection exception. Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution of VMXON outside SMX operation causes a general-protection exception. This patch is to enable this kind of check with SMX for VMXON in KVM. Signed-off-by: Shane Wang --- arch/x86/include/asm/msr-index.h |5 ++-- arch/x86/kernel/tboot.c |1 arch/x86/kvm/vmx.c | 32 +++-- include/linux/tboot.h|1 4 files changed, 26 insertions(+), 13 deletions(-) diff -r a96602743dbd arch/x86/include/asm/msr-index.h --- a/arch/x86/include/asm/msr-index.h Thu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/include/asm/msr-index.h Thu Apr 29 11:49:40 2010 -0400 @@ -202,8 +202,9 @@ #define MSR_IA32_EBL_CR_POWERON0x002a #define MSR_IA32_FEATURE_CONTROL0x003a -#define FEATURE_CONTROL_LOCKED (1<<0) -#define FEATURE_CONTROL_VMXON_ENABLED (1<<2) +#define FEATURE_CONTROL_LOCKED (1<<0) +#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) +#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) #define MSR_IA32_APICBASE 0x001b #define MSR_IA32_APICBASE_BSP (1<<8) diff -r a96602743dbd arch/x86/kernel/tboot.c --- a/arch/x86/kernel/tboot.c Thu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/kernel/tboot.c Thu Apr 29 11:49:40 2010 -0400 @@ -46,6 +46,7 @@ /* Global pointer to shared data; NULL means no measured launch. */ struct tboot *tboot __read_mostly; +EXPORT_SYMBOL(tboot); /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */ #define AP_WAIT_TIMEOUT1 diff -r a96602743dbd arch/x86/kvm/vmx.c --- a/arch/x86/kvm/vmx.cThu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/kvm/vmx.cThu Apr 29 11:49:40 2010 -0400 @@ -27,6 +27,7 @@ #include #include #include +#include #include "kvm_cache_regs.h" #include "x86.h" @@ -1176,9 +1177,16 @@ static __init int vmx_disabled_by_bios(v u64 msr; rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); - return (msr & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - == FEATURE_CONTROL_LOCKED; + if (!!(msr & FEATURE_CONTROL_LOCKED)) { + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && tboot_enabled()) + return 1; + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && !tboot_enabled()) + return 1; + } + + return 0; /* locked but not enabled */ } @@ -1186,21 +1194,23 @@ static int hardware_enable(void *garbage { int cpu = raw_smp_processor_id(); u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); - u64 old; + u64 old, test_bits; if (read_cr4() & X86_CR4_VMXE) return -EBUSY; INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu)); rdmsrl(MSR_IA32_FEATURE_CONTROL, old); - if ((old & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - != (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { /* enable and lock */ - wrmsrl(MSR_IA32_FEATURE_CONTROL, old | - FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED); + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */ asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr) diff -r a96602743dbd include/linux/tboot.h --- a/include/linux/tboot.h Thu Apr 29 11:49:08 2010 -0400 +++ b/include/linux/tboot.h Thu Apr 29 11:49:40 2010 -0400 @@ -150,6 +150,7 @@ extern int tboot_force_iommu(void); #else +#define tboot_enabled()0 #define tboot_probe() do { } while (0) #define tboot_shutdown(shutdown_type) do { } while (0) #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \ -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH][RESEND] intel_txt: enable SMX flag for VMXON in KVM
Per Intel SDM 3B 20.7, for IA32_FEATURE_CONTROL MSR Bit 1 enables VMXON in SMX operation. If the bit is clear, execution of VMXON in SMX operation causes a general-protection exception. Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution of VMXON outside SMX operation causes a general-protection exception. This patch is to check the correct in/outside-SMX flag when detecting if VMX is disabled by BIOS, and to set in-SMX flag for VMXON after Intel TXT is launched in KVM. Signed-off-by: Shane Wang --- arch/x86/include/asm/msr-index.h |5 ++-- arch/x86/kernel/tboot.c |1 arch/x86/kvm/vmx.c | 30 ++--- include/linux/tboot.h|1 4 files changed, 24 insertions(+), 13 deletions(-) diff -r a96602743dbd arch/x86/include/asm/msr-index.h --- a/arch/x86/include/asm/msr-index.h Thu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/include/asm/msr-index.h Wed May 05 06:28:36 2010 -0400 @@ -202,8 +202,9 @@ #define MSR_IA32_EBL_CR_POWERON0x002a #define MSR_IA32_FEATURE_CONTROL0x003a -#define FEATURE_CONTROL_LOCKED (1<<0) -#define FEATURE_CONTROL_VMXON_ENABLED (1<<2) +#define FEATURE_CONTROL_LOCKED (1<<0) +#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) +#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) #define MSR_IA32_APICBASE 0x001b #define MSR_IA32_APICBASE_BSP (1<<8) diff -r a96602743dbd arch/x86/kernel/tboot.c --- a/arch/x86/kernel/tboot.c Thu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/kernel/tboot.c Wed May 05 06:28:36 2010 -0400 @@ -46,6 +46,7 @@ /* Global pointer to shared data; NULL means no measured launch. */ struct tboot *tboot __read_mostly; +EXPORT_SYMBOL(tboot); /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */ #define AP_WAIT_TIMEOUT1 diff -r a96602743dbd arch/x86/kvm/vmx.c --- a/arch/x86/kvm/vmx.cThu Apr 29 11:49:08 2010 -0400 +++ b/arch/x86/kvm/vmx.cWed May 05 06:28:36 2010 -0400 @@ -27,6 +27,7 @@ #include #include #include +#include #include "kvm_cache_regs.h" #include "x86.h" @@ -1176,9 +1177,14 @@ static __init int vmx_disabled_by_bios(v u64 msr; rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); - return (msr & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - == FEATURE_CONTROL_LOCKED; + if (msr & FEATURE_CONTROL_LOCKED) { + if (!(msr & tboot_enabled() + ? FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX + : FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)) + return 1; + } + + return 0; /* locked but not enabled */ } @@ -1186,21 +1192,23 @@ static int hardware_enable(void *garbage { int cpu = raw_smp_processor_id(); u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); - u64 old; + u64 old, test_bits; if (read_cr4() & X86_CR4_VMXE) return -EBUSY; INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu)); rdmsrl(MSR_IA32_FEATURE_CONTROL, old); - if ((old & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - != (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { /* enable and lock */ - wrmsrl(MSR_IA32_FEATURE_CONTROL, old | - FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED); + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */ asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr) diff -r a96602743dbd include/linux/tboot.h --- a/include/linux/tboot.h Thu Apr 29 11:49:08 2010 -0400 +++ b/include/linux/tboot.h Wed May 05 06:28:36 2010 -0400 @@ -150,6 +150,7 @@ extern int tboot_force_iommu(void); #else +#define tboot_enabled()0 #define tboot_probe() do { } while (0) #define tboot_shutdown(shutdown_type) do { } while (0) #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \ -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH]KVM: VMX: Inform user about INTEL_TXT dependency
Inform user to either disable TXT in the BIOS or do TXT launch with tboot before enabling KVM since some BIOSes do not set FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX bit when TXT is enabled. Signed-off-by: Shane Wang --- arch/x86/kvm/vmx.c |5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff -r b1a2deff4c64 arch/x86/kvm/vmx.c --- a/arch/x86/kvm/vmx.cWed Nov 17 12:47:42 2010 -0500 +++ b/arch/x86/kvm/vmx.cWed Nov 17 12:49:52 2010 -0500 @@ -1306,8 +1306,11 @@ && tboot_enabled()) return 1; if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) - && !tboot_enabled()) + && !tboot_enabled()) { + printk(KERN_WARNING "kvm: disable TXT in the BIOS or " + " activate TXT before enabling KVM\n"); return 1; + } } return 0; -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html