x86/cpu: Clear VMX feature flag if VMX is not fully enabled

Now that IA32_FEAT_CTL is always configured and locked for CPUs that are
known to support VMX[*], clear the VMX capability flag if the MSR is
unsupported or BIOS disabled VMX, i.e. locked IA32_FEAT_CTL and didn't
set the appropriate VMX enable bit.

[*] Because init_ia32_feat_ctl() is called from vendors ->c_init(), it's
    still possible for IA32_FEAT_CTL to be left unlocked when VMX is
    supported by the CPU.  This is not fatal, and will be addressed in a
    future patch.

Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20191221044513.21680-9-sean.j.christopherson@intel.com

diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index c4f8f767853b4217cc3e8685b9300f1d55a3c0bb..a46c9e46f93785396551866c3ffb569ff571df1d 100644 (file)
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -5,15 +5,21 @@
 #include <asm/msr-index.h>
 #include <asm/processor.h>
 
+#undef pr_fmt
+#define pr_fmt(fmt)    "x86/cpu: " fmt
+
 void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
 {
+       bool tboot = tboot_enabled();
        u64 msr;
 
-       if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr))
+       if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
+               clear_cpu_cap(c, X86_FEATURE_VMX);
                return;
+       }
 
        if (msr & FEAT_CTL_LOCKED)
-               return;
+               goto update_caps;
 
        /*
         * Ignore whatever value BIOS left in the MSR to avoid enabling random
@@ -29,9 +35,20 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
        if (cpu_has(c, X86_FEATURE_VMX) && IS_ENABLED(CONFIG_KVM_INTEL)) {
                msr |= FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX;
 
-               if (tboot_enabled())
+               if (tboot)
                        msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
        }
 
        wrmsrl(MSR_IA32_FEAT_CTL, msr);
+
+update_caps:
+       if (!cpu_has(c, X86_FEATURE_VMX))
+               return;
+
+       if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
+           (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
+               pr_err_once("VMX (%s TXT) disabled by BIOS\n",
+                           tboot ? "inside" : "outside");
+               clear_cpu_cap(c, X86_FEATURE_VMX);
+       }
 }