[RFC PATCH 59/73] x86/pti: Force enabling KPTI for PVM guest

Lai Jiangshan
2024-02-26T14:38:33Z

For PVM, it needs the guest to provides two different
page tables directly to prevent usermode access to the kernel
address space. So force enabling KPTI for PVM guest.

Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
---
arch/x86/Kconfig | 1 +
arch/x86/mm/pti.c | 7 +++++++
2 files changed, 8 insertions(+)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ded687cc23ad..32a2ab49752b 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -854,6 +854,7 @@ config KVM_GUEST
config PVM_GUEST
bool "PVM Guest support"
depends on X86_64 && KVM_GUEST && X86_PIE && !KASAN
+ select PAGE_TABLE_ISOLATION
select RANDOMIZE_MEMORY
select RELOCATABLE_UNCOMPRESSED_KERNEL
default n
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 5dd733944629..3b06faeca569 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -84,6 +84,13 @@ void __init pti_check_boottime_disable(void)
return;
}

+ if (boot_cpu_has(X86_FEATURE_KVM_PVM_GUEST)) {
+ pti_mode = PTI_FORCE_ON;
+ pti_print_if_insecure("force enabled on kvm pvm guest.");
+ setup_force_cpu_cap(X86_FEATURE_PTI);
+ return;
+ }
+
if (cpu_mitigations_off())
pti_mode = PTI_FORCE_OFF;
if (pti_mode == PTI_FORCE_OFF) {
--
2.19.1.6.gb485710b