KVM: VMX: Inform user about INTEL_TXT dependency

PATCH In review Jan Kiszka 5 participants 9 messages Nov 14, 2010 – Nov 17, 2010

Subsystems (3)

x86 KVM KVM x86

lore

Share & tools

lore

Jan Kiszka

author

2010-11-14 09:18 UTC #0 lore raw

PATCH 1/1 KVM: VMX: Inform user about INTEL_TXT dependency

From: Jan Kiszka <[email protected]>

Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this dependency via a kernel log message.

Signed-off-by Jan Kiszka <[email protected]>

---
 arch/x86/kvm/vmx.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

arch/x86/kvm/vmx.c +6 -1

index 9367abc..ebafd57 100644
@@ -1306,8 +1306,13 @@ static __init int vmx_disabled_by_bios(void)
 			&& tboot_enabled())
 			return 1;
 		if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
-			&& !tboot_enabled())
+			&& !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+			printk(KERN_INFO "kvm: if TXT is enabled in the bios, "
+					 "kvm depends on CONFIG_INTEL_TXT\n");
+#endif
 			return 1;
+		}
 	}
 
 	return 0;

Signature · 1 line

1.7.1

Avi Kivity

2010-11-14 10:30 UTC #1 lore raw

Quoted 19 lines · Jan Kiszka

From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
  arch/x86/kvm/vmx.c |    7 ++++++-
  1 files changed, 6 insertions(+), 1 deletions(-)
arch/x86/kvm/vmx.c +0 -0
index 9367abc..ebafd57 100644
@@ -1306,8 +1306,13 @@ static __init int vmx_disabled_by_bios(void)
  			&&  tboot_enabled())
  			return 1;
  		if (!(msr&  FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)

arch/x86/kvm/vmx.c static __init int vmx_disabled_by_bios(void) · line 1317

Quoted 10 lines

arch/x86/kvm/vmx.c +6 -1

-			&&  !tboot_enabled())
+			&&  !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+			printk(KERN_INFO "kvm: if TXT is enabled in the bios, "
+					 "kvm depends on CONFIG_INTEL_TXT\n");
+#endif
  			return 1;
+		}
  	}

Maybe reword to an instruction?

Something like

kvm: TXT enabled in the bios. Either disable TXT in the bios, or
enable CONFIG_INTEL_TXT in your kernel.

Signature · 1 line

error compiling committee.c: too many arguments to function

Jan Kiszka

author

2010-11-14 10:41 UTC #2 lore raw

Quoted 33 lines · Avi Kivity

Quoted 19 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
  arch/x86/kvm/vmx.c |    7 ++++++-
  1 files changed, 6 insertions(+), 1 deletions(-)
arch/x86/kvm/vmx.c +0 -0
index 9367abc..ebafd57 100644
@@ -1306,8 +1306,13 @@ static __init int vmx_disabled_by_bios(void)
              &&  tboot_enabled())
              return 1;
          if (!(msr&  FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
arch/x86/kvm/vmx.c static __init int vmx_disabled_by_bios(void) · line 1317
Quoted 10 lines
arch/x86/kvm/vmx.c +6 -1
-            &&  !tboot_enabled())
+            &&  !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+            printk(KERN_INFO "kvm: if TXT is enabled in the bios, "
+                     "kvm depends on CONFIG_INTEL_TXT\n");
+#endif
              return 1;
+        }
      }
 
Maybe reword to an instruction?

Quoted 5 lines

Something like
kvm: TXT enabled in the bios. Either disable TXT in the bios, or
enable CONFIG_INTEL_TXT in your kernel.

I always get an aching head when thinking about these dependency: Does FEATURE_CONTROL_LOCKED && !FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX imply that the BIOS uses TXT? Or could it also mean that it just disabled VT-x explicitly? As CONFIG_INTEL_TXT is off, we do not know if tboot_enabled is off as well.

Jan

Avi Kivity

2010-11-14 11:03 UTC #3 lore raw

Quoted 36 lines · Jan Kiszka

Quoted 35 lines · Avi Kivity
Quoted 16 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int vmx_disabled_by_bios(void)
Quoted 13 lines
               &&   tboot_enabled())
               return 1;
           if (!(msr&   FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
 -&&   !tboot_enabled())
 +&&   !tboot_enabled()) {
 +#ifndef CONFIG_INTEL_TXT
 +            printk(KERN_INFO "kvm: if TXT is enabled in the bios, "
 +                     "kvm depends on CONFIG_INTEL_TXT\n");
 +#endif
               return 1;
 +        }
       }
Maybe reword to an instruction?
Something like

Quoted 8 lines

Quoted 3 lines
kvm: TXT enabled in the bios. Either disable TXT in the bios, or
enable CONFIG_INTEL_TXT in your kernel.
I always get an aching head when thinking about these dependency: Does FEATURE_CONTROL_LOCKED&& !FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX imply that the BIOS uses TXT? Or could it also mean that it just disabled VT-x explicitly?

Probably the latter, at least that's what we took it to mean before it was renamed to that long string.

Quoted 2 lines

As CONFIG_INTEL_TXT is off, we do not know if
tboot_enabled is off as well.

I guess, if FEATURE_CONTROL_VMXON_ENABLED_INSIDER_SMX_YADA_YADA_YADA is set, then the bios wants us to enable TXT. But if both bits are clear, the bios really doesn't want us to play with vmx. But it would be good to get Intel guidance before we pass our confusion on to users.

Signature · 1 line

error compiling committee.c: too many arguments to function

Wang, Shane

2010-11-16 04:48 UTC #4 lore raw

Quoted 14 lines · Avi Kivity

Quoted 13 lines · Jan Kiszka
Quoted 12 lines · Avi Kivity
Quoted 11 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this
dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)

Quoted 16 lines

Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int
               vmx_disabled_by_bios(void) &&   tboot_enabled())
               return 1;
           if (!(msr&   FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
-&& !tboot_enabled()) +&& !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+ printk(KERN_INFO "kvm: if TXT is enabled in the
bios, " + "kvm depends on
               CONFIG_INTEL_TXT\n");  +#endif return 1;
 +        }
       }

Why do we need this?
If TXT is enabled in the bios, it doesn't mean TXT is launched but TXT is available. tboot_enabled() = TXT is launched. And non-CONFIG_INTEL_TXT means tboot_enabled() = 0. If you enable VT in bios, FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is set.

Quoted 5 lines

Quoted 5 lines
Quoted 5 lines
Maybe reword to an instruction?
Something like

Quoted 8 lines

Quoted 8 lines
Quoted 3 lines
kvm: TXT enabled in the bios. Either disable TXT in the bios, or
enable CONFIG_INTEL_TXT in your kernel.
I always get an aching head when thinking about these dependency:
Does FEATURE_CONTROL_LOCKED&& !FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX imply that the BIOS uses TXT?

Or could it also mean that it just disabled VT-x explicitly?

Quoted 3 lines

Probably the latter, at least that's what we took it to mean before it was renamed to that long string.

Yes, it is.

Quoted 4 lines

Quoted 3 lines
As CONFIG_INTEL_TXT is off, we do not know if
tboot_enabled is off as well.

CONFIG_INTEL_TXT is off, tboot_enabled() must be off.

Quoted 2 lines

I guess, if FEATURE_CONTROL_VMXON_ENABLED_INSIDER_SMX_YADA_YADA_YADA is set, then the bios wants us to enable TXT.

Yes. In most cases if TXT is enabled in the bios, the bit is set, otherwise, it is clear.
FEATURE_CONTROL_VMXON_ENABLED_INSIDER_SMX and FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX can be set at the same time. It doesn't mean bios wants us to enable TXT. Here we just check the following logic in the spec for feature control MSR:

- Bit 1 enables VMXON in SMX operation. If this bit is clear, execution of VMXON in SMX operation causes a general-protection exception.
- Bit 2 enables VMXON outside SMX operation. If this bit is clear, execution of VMXON outside SMX operation causes a general-protection exception.

Quoted 2 lines

But if both bits are
clear, the bios really doesn't want us to play with vmx.

Yes it is.

Quoted 3 lines

But it
would be good to get Intel guidance before we pass our confusion on to users.

Thanks.
Shane

Jan Kiszka

2010-11-16 10:23 UTC #5 lore raw

Quoted 31 lines · Shane

Quoted 14 lines · Avi Kivity
Quoted 13 lines · Jan Kiszka
Quoted 12 lines · Avi Kivity
Quoted 11 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this
dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)
Quoted 16 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int
               vmx_disabled_by_bios(void) &&   tboot_enabled())
               return 1;
           if (!(msr&   FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
-&& !tboot_enabled()) +&& !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+ printk(KERN_INFO "kvm: if TXT is enabled in the
bios, " + "kvm depends on
               CONFIG_INTEL_TXT\n");  +#endif return 1;
 +        }
       }

Quoted 4 lines

Why do we need this?
If TXT is enabled in the bios, it doesn't mean TXT is launched but TXT is available. tboot_enabled() = TXT is launched. And non-CONFIG_INTEL_TXT means tboot_enabled() = 0. If you enable VT in bios, FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is set.

Probably, this patch is based on my semi-understanding of TXT. What I observe is that, when I enable TXT in the BIOS of my machine, kvm-intel does not load and report VT-x being disabled at BIOS level. As my kernels had CONFIG_INTEL_TXT disabled, I thought that was the reason.

However, it turned out that
A) FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is _not_ set here when TXT is enabled in the BIOS
B) enabling CONFIG_INTEL_TXT does not magically solve the issue, KVM still does not work

The latter appears to be related to the fact that I do not actually have a trust chain from the BIOS over the boot loader to the kernel. So tboot_addr is not set and tboot_enabled remains off. I guess I need some trusted grub or so to get this running, maybe even more. Still, I'm unsure if that will give me VT-x support back again. Can you comment on the requirements and mechanisms behind that?

In any case, what we should catch is the user mistake of enabling TXT in the BIOS blindly without actually needing it, disabling VT-x this way. How to express this?

Jan

Signature · 2 lines

Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

Cihula, Joseph

2010-11-16 13:02 UTC #6 lore raw

Quoted 51 lines

From: Jan Kiszka [mailto:[email protected]]
Sent: Tuesday, November 16, 2010 6:23 PM
Quoted 31 lines · Shane
Quoted 14 lines · Avi Kivity
Quoted 13 lines · Jan Kiszka
Quoted 12 lines · Avi Kivity
Quoted 11 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this
dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)
Quoted 16 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int
               vmx_disabled_by_bios(void) &&   tboot_enabled())
               return 1;
           if (!(msr&   FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
-&& !tboot_enabled()) +&& !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+ printk(KERN_INFO "kvm: if TXT is enabled in the
bios, " + "kvm depends on
               CONFIG_INTEL_TXT\n");  +#endif return 1;
 +        }
       }
Quoted 4 lines
Why do we need this?
If TXT is enabled in the bios, it doesn't mean TXT is launched but TXT is available. tboot_enabled() = TXT is launched. And non-CONFIG_INTEL_TXT means tboot_enabled() = 0. If you enable VT in bios, FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is set.
Probably, this patch is based on my semi-understanding of TXT. What I observe is that, when I enable TXT in the BIOS of my machine, kvm-intel does not load and report VT-x being disabled at BIOS level. As my kernels had CONFIG_INTEL_TXT disabled, I thought that was the reason.
However, it turned out that
A) FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is _not_ set here when TXT is enabled in the BIOS
B) enabling CONFIG_INTEL_TXT does not magically solve the issue, KVM still does not work

Quoted 6 lines

The latter appears to be related to the fact that I do not actually have a trust chain from the BIOS over the boot loader to the kernel. So tboot_addr is not set and tboot_enabled remains off. I guess I need some trusted grub or so to get this running, maybe even more. Still, I'm unsure if that will give me VT-x support back again. Can you comment on the requirements and mechanisms behind that?

The setting of the FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX when TXT is enabled is up to each OEM. Intel's original guidance was to clear this flag, to prevent a Blue Pill type of attack on an un-measured OS launch. Intel has since change our guidance to set this flag even when TXT is enabled, in order to allow for dual boot and late launch uses of TXT along with VT.

Quoted 3 lines

In any case, what we should catch is the user mistake of enabling TXT in the BIOS blindly without actually needing it, disabling VT-x this way. How to express this?

It is probably worth a warning/guidance message to the user that, if this condition is detected, they should either disable TXT in the BIOS or activate TXT before enabling KVM.

Quoted 6 lines

Jan
--
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

Jan Kiszka

2010-11-16 13:19 UTC #7 lore raw

Quoted 58 lines · Joseph

Quoted 51 lines
From: Jan Kiszka [mailto:[email protected]]
Sent: Tuesday, November 16, 2010 6:23 PM
Quoted 31 lines · Shane
Quoted 14 lines · Avi Kivity
Quoted 13 lines · Jan Kiszka
Quoted 12 lines · Avi Kivity
Quoted 11 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain this
dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)
Quoted 16 lines
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int
               vmx_disabled_by_bios(void) &&   tboot_enabled())
               return 1;
           if (!(msr&   FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
-&& !tboot_enabled()) +&& !tboot_enabled()) {
+#ifndef CONFIG_INTEL_TXT
+ printk(KERN_INFO "kvm: if TXT is enabled in the
bios, " + "kvm depends on
               CONFIG_INTEL_TXT\n");  +#endif return 1;
 +        }
       }
Quoted 4 lines
Why do we need this?
If TXT is enabled in the bios, it doesn't mean TXT is launched but TXT is available. tboot_enabled() = TXT is launched. And non-CONFIG_INTEL_TXT means tboot_enabled() = 0. If you enable VT in bios, FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is set.
Probably, this patch is based on my semi-understanding of TXT. What I observe is that, when I enable TXT in the BIOS of my machine, kvm-intel does not load and report VT-x being disabled at BIOS level. As my kernels had CONFIG_INTEL_TXT disabled, I thought that was the reason.
However, it turned out that
A) FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is _not_ set here when TXT is enabled in the BIOS
B) enabling CONFIG_INTEL_TXT does not magically solve the issue, KVM still does not work
Quoted 6 lines
The latter appears to be related to the fact that I do not actually have a trust chain from the BIOS over the boot loader to the kernel. So tboot_addr is not set and tboot_enabled remains off. I guess I need some trusted grub or so to get this running, maybe even more. Still, I'm unsure if that will give me VT-x support back again. Can you comment on the requirements and mechanisms behind that?

Quoted 7 lines

The setting of the FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX when TXT is enabled is up to each OEM. Intel's original guidance was to clear this flag, to prevent a Blue Pill type of attack on an un-measured OS launch. Intel has since change our guidance to set this flag even when TXT is enabled, in order to allow for dual boot and late launch uses of TXT along with VT.
Quoted 3 lines
In any case, what we should catch is the user mistake of enabling TXT in the BIOS blindly without actually needing it, disabling VT-x this way. How to express this?
It is probably worth a warning/guidance message to the user that, if this condition is detected, they should either disable TXT in the BIOS or activate TXT before enabling KVM.

So the condition to issue the warning is FEATURE_CONTROL_LOCKED && !FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX? Independent of tboot_enabled or precisely in that branch I targeted, just without CONFIG_INTEL_TXT?

Out of curiosity: Who would enable TXT, and how, so that VT-x becomes usable again? The trusted boot loader (like tboot)?

Jan

Signature · 2 lines

Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

Wang, Shane

2010-11-17 01:30 UTC #8 lore raw

Quoted 70 lines · Jan Kiszka

Quoted 69 lines · Joseph
Quoted 50 lines
From: Jan Kiszka [mailto:[email protected]]
Sent: Tuesday, November 16, 2010 6:23 PM
Quoted 29 lines · Shane
Quoted 14 lines · Avi Kivity
Quoted 13 lines · Jan Kiszka
Quoted 12 lines · Avi Kivity
Quoted 11 lines · Jan Kiszka
From: Jan Kiszka<[email protected]>
Without CONFIG_INTEL_TXT, the user must not enable this feature in the BIOS. Otherwise, KVM will not work. Explain
this dependency via a kernel log message.
Signed-off-by Jan Kiszka<[email protected]>
---
   arch/x86/kvm/vmx.c |    7 ++++++-
   1 files changed, 6 insertions(+), 1 deletions(-)
Quoted 14 lines
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9367abc..ebafd57 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1306,8 +1306,13 @@ static __init int
               vmx_disabled_by_bios(void) &&  
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
tboot_enabled()) return 1; if
(!(msr& FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) -&&
!tboot_enabled()) +&& !tboot_enabled()) { +#ifndef
CONFIG_INTEL_TXT + printk(KERN_INFO "kvm: if TXT
is enabled in the bios, " + "kvm depends
on CONFIG_INTEL_TXT\n"); +#endif return 1; +
} }
Quoted 5 lines
Why do we need this?
If TXT is enabled in the bios, it doesn't mean TXT is launched but TXT is available. tboot_enabled() = TXT is launched. And non-CONFIG_INTEL_TXT means tboot_enabled() = 0. If you enable VT in bios, FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is set.
Probably, this patch is based on my semi-understanding of TXT. What I observe is that, when I enable TXT in the BIOS of my machine, kvm-intel does not load and report VT-x being disabled at BIOS level. As my kernels had CONFIG_INTEL_TXT disabled, I thought that was the reason.
However, it turned out that
A) FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX is _not_ set here when
TXT is enabled in the BIOS B) enabling CONFIG_INTEL_TXT does not
magically solve the issue, KVM still does not work
Quoted 7 lines
The latter appears to be related to the fact that I do not actually have a trust chain from the BIOS over the boot loader to the kernel. So tboot_addr is not set and tboot_enabled remains off. I guess I need some trusted grub or so to get this running, maybe even more. Still, I'm unsure if that will give me VT-x support back again. Can you comment on the requirements and mechanisms behind that?
The setting of the FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX when TXT is enabled is up to each OEM. Intel's original guidance was to clear this flag, to prevent a Blue Pill type of attack on an un-measured OS launch. Intel has since change our guidance to set this flag even when TXT is enabled, in order to allow for dual boot and late launch uses of TXT along with VT.
Quoted 3 lines
In any case, what we should catch is the user mistake of enabling TXT in the BIOS blindly without actually needing it, disabling VT-x this way. How to express this?

Quoted 8 lines

Quoted 3 lines
It is probably worth a warning/guidance message to the user that, if this condition is detected, they should either disable TXT in the BIOS or activate TXT before enabling KVM.
So the condition to issue the warning is FEATURE_CONTROL_LOCKED && !FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX? Independent of tboot_enabled or precisely in that branch I targeted, just without CONFIG_INTEL_TXT?

For me, I prefer the branch you targeted. e.g., to add one more condition (if ENABLED_INSIDE_SMX) to check in the previous if-clause

                if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
                        && !tboot_enabled())
                        return 1;

Quoted 3 lines

Out of curiosity: Who would enable TXT, and how, so that VT-x becomes usable again? The trusted boot loader (like tboot)?

Yes, tboot. Please download tboot.gz and the corresponding SINIT for your platform from tboot.sourceforge.net. And modify your grub menu like

title Linux with tboot
kernel tboot.gz ...
module vmlinuz ...
module initrd.img ...
module sinit.bin

Quoted 2 lines

Jan

Shane