[RFC PATCH 59/73] x86/pti: Force enabling KPTI for PVM guest

[Lai Jiangshan]

From: Lai Jiangshan <jiangshan.ljs@xxxxxxxxxxxx>

For PVM, it needs the guest to provides two different
page tables directly to prevent usermode access to the kernel
address space. So force enabling KPTI for PVM guest.

Signed-off-by: Lai Jiangshan <jiangshan.ljs@xxxxxxxxxxxx>
Signed-off-by: Hou Wenlong <houwenlong.hwl@xxxxxxxxxxxx>
---
 arch/x86/Kconfig  | 1 +
 arch/x86/mm/pti.c | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ded687cc23ad..32a2ab49752b 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -854,6 +854,7 @@ config KVM_GUEST
 config PVM_GUEST
 	bool "PVM Guest support"
 	depends on X86_64 && KVM_GUEST && X86_PIE && !KASAN
+	select PAGE_TABLE_ISOLATION
 	select RANDOMIZE_MEMORY
 	select RELOCATABLE_UNCOMPRESSED_KERNEL
 	default n
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 5dd733944629..3b06faeca569 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -84,6 +84,13 @@ void __init pti_check_boottime_disable(void)
 		return;
 	}
 
+	if (boot_cpu_has(X86_FEATURE_KVM_PVM_GUEST)) {
+		pti_mode = PTI_FORCE_ON;
+		pti_print_if_insecure("force enabled on kvm pvm guest.");
+		setup_force_cpu_cap(X86_FEATURE_PTI);
+		return;
+	}
+
 	if (cpu_mitigations_off())
 		pti_mode = PTI_FORCE_OFF;
 	if (pti_mode == PTI_FORCE_OFF) {
-- 
2.19.1.6.gb485710b