Add WARNs in the low level __cpuid_entry_get_reg() to assert that the
function and index of the CPUID entry and reverse CPUID entry match.
Wrap the WARNs in a new Kconfig, KVM_CPUID_AUDIT, as the checks add
almost no value in a production environment, i.e. will only detect
blatant KVM bugs and fatal hardware errors. Add a Kconfig instead of
simply wrapping the WARNs with an off-by-default #ifdef so that syzbot
and other automated testing can enable the auditing.
Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
---
arch/x86/kvm/Kconfig | 10 ++++++++++
arch/x86/kvm/cpuid.h | 5 +++++
2 files changed, 15 insertions(+)
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 840e12583b85..bbbc3258358e 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -96,6 +96,16 @@ config KVM_MMU_AUDIT
This option adds a R/W kVM module parameter 'mmu_audit', which allows
auditing of KVM MMU events at runtime.
+config KVM_CPUID_AUDIT
+ bool "Audit KVM reverse CPUID lookups"
+ depends on KVM
+ help
+ This option enables runtime checking of reverse CPUID lookups in KVM
+ to verify the function and index of the referenced X86_FEATURE_* match
+ the function and index of the CPUID entry being accessed.
+
+ If unsure, say N.
+
# OK, it's a little counter-intuitive to do this, but it puts it neatly under
# the virtualization menu.
source "drivers/vhost/Kconfig"
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 51f19eade5a0..41ff94a7d3e0 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -98,6 +98,11 @@ static __always_inline struct cpuid_reg x86_feature_cpuid(unsigned x86_feature)
static __always_inline u32 *__cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry,
const struct cpuid_reg *cpuid)
{
+#ifdef CONFIG_KVM_CPUID_AUDIT
+ WARN_ON_ONCE(entry->function != cpuid->function);
+ WARN_ON_ONCE(entry->index != cpuid->index);
+#endif
+
switch (cpuid->reg) {
case CPUID_EAX:
return &entry->eax;
--
2.24.1
