diff options
| author | Sean Christopherson <sean.j.christopherson@intel.com> | 2021-04-12 06:21:39 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-04-20 10:18:55 +0200 |
| commit | 70210c044b4ea8f05e93ec62abc30cab4233ec88 (patch) | |
| tree | 7bb3f6ae58f87e6074d1f5f134f361d10b86582e /arch/x86/include/asm | |
| parent | KVM: VMX: Frame in ENCLS handler for SGX virtualization (diff) | |
| download | linux-70210c044b4ea8f05e93ec62abc30cab4233ec88.tar.xz linux-70210c044b4ea8f05e93ec62abc30cab4233ec88.zip | |
KVM: VMX: Add SGX ENCLS[ECREATE] handler to enforce CPUID restrictions
Add an ECREATE handler that will be used to intercept ECREATE for the
purpose of enforcing and enclave's MISCSELECT, ATTRIBUTES and XFRM, i.e.
to allow userspace to restrict SGX features via CPUID. ECREATE will be
intercepted when any of the aforementioned masks diverges from hardware
in order to enforce the desired CPUID model, i.e. inject #GP if the
guest attempts to set a bit that hasn't been enumerated as allowed-1 in
CPUID.
Note, access to the PROVISIONKEY is not yet supported.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Co-developed-by: Kai Huang <kai.huang@intel.com>
Signed-off-by: Kai Huang <kai.huang@intel.com>
Message-Id: <c3a97684f1b71b4f4626a1fc3879472a95651725.1618196135.git.kai.huang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch/x86/include/asm')
| -rw-r--r-- | arch/x86/include/asm/kvm_host.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 6db2d4b1a714..c5c96386cc76 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1047,6 +1047,9 @@ struct kvm_arch { bool bus_lock_detection_enabled; + /* Guest can access the SGX PROVISIONKEY. */ + bool sgx_provisioning_allowed; + struct kvm_pmu_event_filter __rcu *pmu_event_filter; struct task_struct *nx_lpage_recovery_thread; |