diff options
| author | Sean Christopherson <sean.j.christopherson@intel.com> | 2021-04-12 16:21:42 +1200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-04-20 04:18:56 -0400 |
| commit | 72add915fbd5bf5c57deee3da5b2605e966ac199 (patch) | |
| tree | 3fb3e6b1d2fc27878f62414b53fc95839f3fa47b /arch/x86/kvm/vmx/nested.h | |
| parent | b6f084ca553845135ccade79ce6548035e52884a (diff) | |
| download | linux-stable-72add915fbd5bf5c57deee3da5b2605e966ac199.tar.gz linux-stable-72add915fbd5bf5c57deee3da5b2605e966ac199.tar.bz2 linux-stable-72add915fbd5bf5c57deee3da5b2605e966ac199.zip | |
KVM: VMX: Enable SGX virtualization for SGX1, SGX2 and LC
Enable SGX virtualization now that KVM has the VM-Exit handlers needed
to trap-and-execute ENCLS to ensure correctness and/or enforce the CPU
model exposed to the guest. Add a KVM module param, "sgx", to allow an
admin to disable SGX virtualization independent of the kernel.
When supported in hardware and the kernel, advertise SGX1, SGX2 and SGX
LC to userspace via CPUID and wire up the ENCLS_EXITING bitmap based on
the guest's SGX capabilities, i.e. to allow ENCLS to be executed in an
SGX-enabled guest. With the exception of the provision key, all SGX
attribute bits may be exposed to the guest. Guest access to the
provision key, which is controlled via securityfs, will be added in a
future patch.
Note, KVM does not yet support exposing ENCLS_C leafs or ENCLV leafs.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Kai Huang <kai.huang@intel.com>
Message-Id: <a99e9c23310c79f2f4175c1af4c4cbcef913c3e5.1618196135.git.kai.huang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch/x86/kvm/vmx/nested.h')
| -rw-r--r-- | arch/x86/kvm/vmx/nested.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/arch/x86/kvm/vmx/nested.h b/arch/x86/kvm/vmx/nested.h index 197148d76b8f..184418baeb3c 100644 --- a/arch/x86/kvm/vmx/nested.h +++ b/arch/x86/kvm/vmx/nested.h @@ -244,6 +244,11 @@ static inline bool nested_exit_on_intr(struct kvm_vcpu *vcpu) PIN_BASED_EXT_INTR_MASK; } +static inline bool nested_cpu_has_encls_exit(struct vmcs12 *vmcs12) +{ + return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENCLS_EXITING); +} + /* * if fixed0[i] == 1: val[i] must be 1 * if fixed1[i] == 0: val[i] must be 0 |