On Thu, Dec 12, 2019 at 12:38:38PM +0100, Borislav Petkov wrote:
> On Wed, Nov 27, 2019 at 05:40:07PM -0800, Sean Christopherson wrote:
> > +static void init_vmx_capabilities(struct cpuinfo_x86 *c)
> > +{
> > + u32 supported, funcs, ept, vpid, ign;
> > +
> > + BUILD_BUG_ON(NVMXINTS != NR_VMX_FEATURE_WORDS);
> > +
> > + /*
> > + * The high bits contain the allowed-1 settings, i.e. features that can
> > + * be turned on. The low bits contain the allowed-0 settings, i.e.
> > + * features that can be turned off. Ignore the allowed-0 settings,
> > + * if a feature can be turned on then it's supported.
> > + */
> > + rdmsr(MSR_IA32_VMX_PROCBASED_CTLS, ign, supported);
> > + c->vmx_capability[PRIMARY_PROC_CTLS] = supported;
> > +
> > + rdmsr_safe(MSR_IA32_VMX_PROCBASED_CTLS2, &ign, &supported);
> > + c->vmx_capability[SECONDARY_PROC_CTLS] = supported;
> > +
> > + rdmsr(MSR_IA32_VMX_PINBASED_CTLS, ign, supported);
> > + rdmsr_safe(MSR_IA32_VMX_VMFUNC, &ign, &funcs);
> > +
> > + /*
> > + * Except for EPT+VPID, which enumerates support for both in a single
> > + * MSR, low for EPT, high for VPID.
> > + */
> > + rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, &ept, &vpid);
>
> Right, so this is a garden variety of rdmsr() and rdmsr_safe() and
> the safe variant's retval needs to be checked, strictly speaking. It
> probably doesn't matter here since you'll get 0s if it fails, which
> means feature not supported, so all good.
>
> But I guess you can still use rdmsr_safe() everywhere just so it doesn't
> cause head scratching in the future, when one looks at that code.
The reasoning behind using vanilla rdmsr() on PROC and PIN controls is that
those MSRs should exist on any CPU that supports VMX, i.e. we want the WARN.
The alternative would be to use rdmsr_safe() for everything and then
explicitly disable VMX if a fault on PROC or PIN occurs, but that circles
us back to the handling a fault on rdmsr(MSR_IA32_FEAT_CTL), i.e. is it
really worth gracefully handling a fault that should never occur?
>
> > +#endif /* CONFIG_X86_VMX_FEATURE_NAMES */
> >
> > #undef pr_fmt
> > #define pr_fmt(fmt) "x86/cpu: " fmt
> > @@ -50,5 +116,9 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
> > pr_err_once("VMX (%s TXT) disabled by BIOS\n",
> > tboot ? "inside" : "outside");
> > clear_cpu_cap(c, X86_FEATURE_VMX);
> > + } else {
> > +#ifdef CONFIG_X86_VMX_FEATURE_NAMES
> > + init_vmx_capabilities(c);
> > +#endif
>
> Can't say that I'm happy about all that ifdeffery but I guess we need
> to perpetuate this since X86_FEATURE_NAMES is there for embedded. In
> practice, probably no one disables it...
Ya, systemd wasn't happy when I tried booting without X86_FEATURE_NAMES.
