mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-22 18:44:44 +08:00
72add915fb
Enable SGX virtualization now that KVM has the VM-Exit handlers needed to trap-and-execute ENCLS to ensure correctness and/or enforce the CPU model exposed to the guest. Add a KVM module param, "sgx", to allow an admin to disable SGX virtualization independent of the kernel. When supported in hardware and the kernel, advertise SGX1, SGX2 and SGX LC to userspace via CPUID and wire up the ENCLS_EXITING bitmap based on the guest's SGX capabilities, i.e. to allow ENCLS to be executed in an SGX-enabled guest. With the exception of the provision key, all SGX attribute bits may be exposed to the guest. Guest access to the provision key, which is controlled via securityfs, will be added in a future patch. Note, KVM does not yet support exposing ENCLS_C leafs or ENCLV leafs. Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by: Kai Huang <kai.huang@intel.com> Message-Id: <a99e9c23310c79f2f4175c1af4c4cbcef913c3e5.1618196135.git.kai.huang@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
35 lines
878 B
C
35 lines
878 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __KVM_X86_SGX_H
|
|
#define __KVM_X86_SGX_H
|
|
|
|
#include <linux/kvm_host.h>
|
|
|
|
#include "capabilities.h"
|
|
#include "vmx_ops.h"
|
|
|
|
#ifdef CONFIG_X86_SGX_KVM
|
|
extern bool __read_mostly enable_sgx;
|
|
|
|
int handle_encls(struct kvm_vcpu *vcpu);
|
|
|
|
void setup_default_sgx_lepubkeyhash(void);
|
|
void vcpu_setup_sgx_lepubkeyhash(struct kvm_vcpu *vcpu);
|
|
|
|
void vmx_write_encls_bitmap(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12);
|
|
#else
|
|
#define enable_sgx 0
|
|
|
|
static inline void setup_default_sgx_lepubkeyhash(void) { }
|
|
static inline void vcpu_setup_sgx_lepubkeyhash(struct kvm_vcpu *vcpu) { }
|
|
|
|
static inline void vmx_write_encls_bitmap(struct kvm_vcpu *vcpu,
|
|
struct vmcs12 *vmcs12)
|
|
{
|
|
/* Nothing to do if hardware doesn't support SGX */
|
|
if (cpu_has_vmx_encls_vmexit())
|
|
vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
|
|
}
|
|
#endif
|
|
|
|
#endif /* __KVM_X86_SGX_H */
|