KVM: VMX: enable VMXON check with SMX enabled (Intel TXT)

Per document, for feature control MSR:

  Bit 1 enables VMXON in SMX operation. If the bit is clear, execution
        of VMXON in SMX operation causes a general-protection exception.
  Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution
        of VMXON outside SMX operation causes a general-protection exception.

This patch is to enable this kind of check with SMX for VMXON in KVM.

Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

1 files changed, 21 insertions, 11 deletions

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c4f3955c64e..d2a47aefdee 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -27,6 +27,7 @@
 #include <linux/moduleparam.h>
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
+#include <linux/tboot.h>
 #include "kvm_cache_regs.h"
 #include "x86.h"
 
@@ -1272,9 +1273,16 @@ static __init int vmx_disabled_by_bios(void)
         u64 msr;
 
         rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
-        return (msr & (FEATURE_CONTROL_LOCKED |
-                       FEATURE_CONTROL_VMXON_ENABLED))
-            == FEATURE_CONTROL_LOCKED;
+        if (msr & FEATURE_CONTROL_LOCKED) {
+                if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
+                        && tboot_enabled())
+                        return 1;
+                if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
+                        && !tboot_enabled())
+                        return 1;
+        }
+
+        return 0;
         /* locked but not enabled */
 }
 
@@ -1282,21 +1290,23 @@ static int hardware_enable(void *garbage)
 {
         int cpu = raw_smp_processor_id();
         u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
-        u64 old;
+        u64 old, test_bits;
 
         if (read_cr4() & X86_CR4_VMXE)
                 return -EBUSY;
 
         INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu));
         rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
-        if ((old & (FEATURE_CONTROL_LOCKED |
-                    FEATURE_CONTROL_VMXON_ENABLED))
-            != (FEATURE_CONTROL_LOCKED |
-                FEATURE_CONTROL_VMXON_ENABLED))
+
+        test_bits = FEATURE_CONTROL_LOCKED;
+        test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+        if (tboot_enabled())
+                test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
+
+        if ((old & test_bits) != test_bits) {
                 /* enable and lock */
-                wrmsrl(MSR_IA32_FEATURE_CONTROL, old |
-                       FEATURE_CONTROL_LOCKED |
-                       FEATURE_CONTROL_VMXON_ENABLED);
+                wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
+        }
         write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */
         asm volatile (ASM_VMX_VMXON_RAX
                       : : "a"(&phys_addr), "m"(phys_addr)