From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1759997AbcLPJel (ORCPT <rfc822;w@1wt.eu>);
        Fri, 16 Dec 2016 04:34:41 -0500
Received: from ppsw-33.csi.cam.ac.uk ([131.111.8.133]:44143 "EHLO
        ppsw-33.csi.cam.ac.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1757353AbcLPJe3 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 16 Dec 2016 04:34:29 -0500
X-Greylist: delayed 1160 seconds by postgrey-1.27 at vger.kernel.org; Fri, 16 Dec 2016 04:34:29 EST
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Subject: Re: [Xen-devel] Can't boot as Xen dom0 due to commit fe055896
To: Borislav Petkov <bp@suse.de>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>
References: <20161215171755.xpfuax7a6q3jofet@pd.tnic>
 <d92fb691-6671-63c9-ba42-f8a2d411cb1e@oracle.com>
 <20161215173609.ornfok6lk5oro2pj@pd.tnic>
 <385ac3cd-7a3f-4c4d-69bb-8feee235fb7e@oracle.com>
 <20161215192305.dlgyrmteirgzop4y@pd.tnic>
 <399c758a-a94b-8aa1-efbb-79a0161b8020@oracle.com>
 <20161215200324.6ju7o5e3aiirrycf@pd.tnic>
 <51f0a58d-a5bc-aae4-22b2-f45bf7164088@oracle.com>
 <20161215230433.m52cs2gef662c2s7@pd.tnic>
 <539c1b43-009d-9a59-0c80-7b1e552ab0ed@oracle.com>
 <20161216090100.cekw347kly3qd7c6@pd.tnic>
Cc: Juergen Gross <jgross@suse.com>,
        xen-devel <xen-devel@lists.xenproject.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
From: Andrew Cooper <andrew.cooper3@citrix.com>
Message-ID: <ec94b33a-2658-f5c7-306e-9926c4112d78@citrix.com>
Date: Fri, 16 Dec 2016 09:14:15 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.5.1
MIME-Version: 1.0
In-Reply-To: <20161216090100.cekw347kly3qd7c6@pd.tnic>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 16/12/2016 09:01, Borislav Petkov wrote:
> @@ -91,6 +92,17 @@ static bool __init check_loader_disabled_bsp(void)
>  	if (cmdline_find_option_bool(cmdline, option))
>  		*res = true;
>  
> +	if (!have_cpuid_p())
> +		*res = true;
> +
> +	a = 1;
> +	c = 0;
> +	native_cpuid(&a, &b, &c, &d);
> +
> +	/* CPUID(1).ECX[31]: reserved for hypervisor use */
> +	if (c & BIT(31))
> +		*res = true;

This will work for any VT-x/SVM based virt, but won't work for ring
de-privileging based virt such as Xen PV and lguest.  Without CPUID
Faulting, this will still get the real hardware CPUID without the
hypervisor bit set.

How about an additional cpl check here, which should cover all the ring
de-privileging methods in a virt-neutral way?

~Andrew