1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/tboot.h>
3 
4 #include <asm/cpu.h>
5 #include <asm/cpufeature.h>
6 #include <asm/msr-index.h>
7 #include <asm/processor.h>
8 #include <asm/vmx.h>
9 
10 #undef pr_fmt
11 #define pr_fmt(fmt)	"x86/cpu: " fmt
12 
13 #ifdef CONFIG_X86_VMX_FEATURE_NAMES
14 enum vmx_feature_leafs {
15 	MISC_FEATURES = 0,
16 	PRIMARY_CTLS,
17 	SECONDARY_CTLS,
18 	TERTIARY_CTLS_LOW,
19 	TERTIARY_CTLS_HIGH,
20 	NR_VMX_FEATURE_WORDS,
21 };
22 
23 #define VMX_F(x) BIT(VMX_FEATURE_##x & 0x1f)
24 
init_vmx_capabilities(struct cpuinfo_x86 * c)25 static void init_vmx_capabilities(struct cpuinfo_x86 *c)
26 {
27 	u32 supported, funcs, ept, vpid, ign, low, high;
28 
29 	BUILD_BUG_ON(NVMXINTS != NR_VMX_FEATURE_WORDS);
30 
31 	/*
32 	 * The high bits contain the allowed-1 settings, i.e. features that can
33 	 * be turned on.  The low bits contain the allowed-0 settings, i.e.
34 	 * features that can be turned off.  Ignore the allowed-0 settings,
35 	 * if a feature can be turned on then it's supported.
36 	 *
37 	 * Use raw rdmsr() for primary processor controls and pin controls MSRs
38 	 * as they exist on any CPU that supports VMX, i.e. we want the WARN if
39 	 * the RDMSR faults.
40 	 */
41 	rdmsr(MSR_IA32_VMX_PROCBASED_CTLS, ign, supported);
42 	c->vmx_capability[PRIMARY_CTLS] = supported;
43 
44 	rdmsr_safe(MSR_IA32_VMX_PROCBASED_CTLS2, &ign, &supported);
45 	c->vmx_capability[SECONDARY_CTLS] = supported;
46 
47 	/* All 64 bits of tertiary controls MSR are allowed-1 settings. */
48 	rdmsr_safe(MSR_IA32_VMX_PROCBASED_CTLS3, &low, &high);
49 	c->vmx_capability[TERTIARY_CTLS_LOW] = low;
50 	c->vmx_capability[TERTIARY_CTLS_HIGH] = high;
51 
52 	rdmsr(MSR_IA32_VMX_PINBASED_CTLS, ign, supported);
53 	rdmsr_safe(MSR_IA32_VMX_VMFUNC, &ign, &funcs);
54 
55 	/*
56 	 * Except for EPT+VPID, which enumerates support for both in a single
57 	 * MSR, low for EPT, high for VPID.
58 	 */
59 	rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, &ept, &vpid);
60 
61 	/* Pin, EPT, VPID and VM-Func are merged into a single word. */
62 	WARN_ON_ONCE(supported >> 16);
63 	WARN_ON_ONCE(funcs >> 4);
64 	c->vmx_capability[MISC_FEATURES] = (supported & 0xffff) |
65 					   ((vpid & 0x1) << 16) |
66 					   ((funcs & 0xf) << 28);
67 
68 	/* EPT bits are full on scattered and must be manually handled. */
69 	if (ept & VMX_EPT_EXECUTE_ONLY_BIT)
70 		c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_EXECUTE_ONLY);
71 	if (ept & VMX_EPT_AD_BIT)
72 		c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_AD);
73 	if (ept & VMX_EPT_1GB_PAGE_BIT)
74 		c->vmx_capability[MISC_FEATURES] |= VMX_F(EPT_1GB);
75 
76 	/* Synthetic APIC features that are aggregates of multiple features. */
77 	if ((c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR)) &&
78 	    (c->vmx_capability[SECONDARY_CTLS] & VMX_F(VIRT_APIC_ACCESSES)))
79 		c->vmx_capability[MISC_FEATURES] |= VMX_F(FLEXPRIORITY);
80 
81 	if ((c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR)) &&
82 	    (c->vmx_capability[SECONDARY_CTLS] & VMX_F(APIC_REGISTER_VIRT)) &&
83 	    (c->vmx_capability[SECONDARY_CTLS] & VMX_F(VIRT_INTR_DELIVERY)) &&
84 	    (c->vmx_capability[MISC_FEATURES] & VMX_F(POSTED_INTR)))
85 		c->vmx_capability[MISC_FEATURES] |= VMX_F(APICV);
86 
87 	/* Set the synthetic cpufeatures to preserve /proc/cpuinfo's ABI. */
88 	if (c->vmx_capability[PRIMARY_CTLS] & VMX_F(VIRTUAL_TPR))
89 		set_cpu_cap(c, X86_FEATURE_TPR_SHADOW);
90 	if (c->vmx_capability[MISC_FEATURES] & VMX_F(FLEXPRIORITY))
91 		set_cpu_cap(c, X86_FEATURE_FLEXPRIORITY);
92 	if (c->vmx_capability[MISC_FEATURES] & VMX_F(VIRTUAL_NMIS))
93 		set_cpu_cap(c, X86_FEATURE_VNMI);
94 	if (c->vmx_capability[SECONDARY_CTLS] & VMX_F(EPT))
95 		set_cpu_cap(c, X86_FEATURE_EPT);
96 	if (c->vmx_capability[MISC_FEATURES] & VMX_F(EPT_AD))
97 		set_cpu_cap(c, X86_FEATURE_EPT_AD);
98 	if (c->vmx_capability[MISC_FEATURES] & VMX_F(VPID))
99 		set_cpu_cap(c, X86_FEATURE_VPID);
100 }
101 #endif /* CONFIG_X86_VMX_FEATURE_NAMES */
102 
nosgx(char * str)103 static int __init nosgx(char *str)
104 {
105 	setup_clear_cpu_cap(X86_FEATURE_SGX);
106 
107 	return 0;
108 }
109 
110 early_param("nosgx", nosgx);
111 
init_ia32_feat_ctl(struct cpuinfo_x86 * c)112 void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
113 {
114 	bool enable_sgx_kvm = false, enable_sgx_driver = false;
115 	bool tboot = tboot_enabled();
116 	bool enable_vmx;
117 	u64 msr;
118 
119 	if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
120 		clear_cpu_cap(c, X86_FEATURE_VMX);
121 		clear_cpu_cap(c, X86_FEATURE_SGX);
122 		return;
123 	}
124 
125 	enable_vmx = cpu_has(c, X86_FEATURE_VMX) &&
126 		     IS_ENABLED(CONFIG_KVM_INTEL);
127 
128 	if (cpu_has(c, X86_FEATURE_SGX) && IS_ENABLED(CONFIG_X86_SGX)) {
129 		/*
130 		 * Separate out SGX driver enabling from KVM.  This allows KVM
131 		 * guests to use SGX even if the kernel SGX driver refuses to
132 		 * use it.  This happens if flexible Launch Control is not
133 		 * available.
134 		 */
135 		enable_sgx_driver = cpu_has(c, X86_FEATURE_SGX_LC);
136 		enable_sgx_kvm = enable_vmx && IS_ENABLED(CONFIG_X86_SGX_KVM);
137 	}
138 
139 	if (msr & FEAT_CTL_LOCKED)
140 		goto update_caps;
141 
142 	/*
143 	 * Ignore whatever value BIOS left in the MSR to avoid enabling random
144 	 * features or faulting on the WRMSR.
145 	 */
146 	msr = FEAT_CTL_LOCKED;
147 
148 	/*
149 	 * Enable VMX if and only if the kernel may do VMXON at some point,
150 	 * i.e. KVM is enabled, to avoid unnecessarily adding an attack vector
151 	 * for the kernel, e.g. using VMX to hide malicious code.
152 	 */
153 	if (enable_vmx) {
154 		msr |= FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX;
155 
156 		if (tboot)
157 			msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
158 	}
159 
160 	if (enable_sgx_kvm || enable_sgx_driver) {
161 		msr |= FEAT_CTL_SGX_ENABLED;
162 		if (enable_sgx_driver)
163 			msr |= FEAT_CTL_SGX_LC_ENABLED;
164 	}
165 
166 	wrmsrl(MSR_IA32_FEAT_CTL, msr);
167 
168 update_caps:
169 	set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);
170 
171 	if (!cpu_has(c, X86_FEATURE_VMX))
172 		goto update_sgx;
173 
174 	if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
175 	    (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
176 		if (IS_ENABLED(CONFIG_KVM_INTEL))
177 			pr_err_once("VMX (%s TXT) disabled by BIOS\n",
178 				    tboot ? "inside" : "outside");
179 		clear_cpu_cap(c, X86_FEATURE_VMX);
180 	} else {
181 #ifdef CONFIG_X86_VMX_FEATURE_NAMES
182 		init_vmx_capabilities(c);
183 #endif
184 	}
185 
186 update_sgx:
187 	if (!(msr & FEAT_CTL_SGX_ENABLED)) {
188 		if (enable_sgx_kvm || enable_sgx_driver)
189 			pr_err_once("SGX disabled by BIOS.\n");
190 		clear_cpu_cap(c, X86_FEATURE_SGX);
191 		return;
192 	}
193 
194 	/*
195 	 * VMX feature bit may be cleared due to being disabled in BIOS,
196 	 * in which case SGX virtualization cannot be supported either.
197 	 */
198 	if (!cpu_has(c, X86_FEATURE_VMX) && enable_sgx_kvm) {
199 		pr_err_once("SGX virtualization disabled due to lack of VMX.\n");
200 		enable_sgx_kvm = 0;
201 	}
202 
203 	if (!(msr & FEAT_CTL_SGX_LC_ENABLED) && enable_sgx_driver) {
204 		if (!enable_sgx_kvm) {
205 			pr_err_once("SGX Launch Control is locked. Disable SGX.\n");
206 			clear_cpu_cap(c, X86_FEATURE_SGX);
207 		} else {
208 			pr_err_once("SGX Launch Control is locked. Support SGX virtualization only.\n");
209 			clear_cpu_cap(c, X86_FEATURE_SGX_LC);
210 		}
211 	}
212 }
213