[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[RESEND PATCH 14/32] i386: kvm: Add support for exposing PROVISIONKEY to
From: |
Yang Zhong |
Subject: |
[RESEND PATCH 14/32] i386: kvm: Add support for exposing PROVISIONKEY to guest |
Date: |
Fri, 30 Apr 2021 14:24:37 +0800 |
From: Sean Christopherson <sean.j.christopherson@intel.com>
If the guest want to fully use SGX, the guest needs to be able to
access provisioning key. Add a new KVM_CAP_SGX_ATTRIBUTE to KVM to
support provisioning key to KVM guests.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Yang Zhong <yang.zhong@intel.com>
---
target/i386/cpu.c | 5 ++++-
target/i386/kvm/kvm.c | 29 +++++++++++++++++++++++++++++
target/i386/kvm/kvm_i386.h | 2 ++
3 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index e630e57f03..63253bf606 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6015,7 +6015,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index,
uint32_t count,
*ecx |= XSTATE_FP_MASK | XSTATE_SSE_MASK;
/* Access to PROVISIONKEY requires additional credentials. */
- *eax &= ~(1U << 4);
+ if ((*eax & (1U << 4)) &&
+ !kvm_enable_sgx_provisioning(cs->kvm_state)) {
+ *eax &= ~(1U << 4);
+ }
}
#endif
break;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index fa495a6f9e..c2fba39bd4 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -4555,6 +4555,35 @@ void kvm_arch_update_guest_debug(CPUState *cpu, struct
kvm_guest_debug *dbg)
}
}
+static bool has_sgx_provisioning;
+
+static bool __kvm_enable_sgx_provisioning(KVMState *s)
+{
+ int fd, ret;
+
+ if (!kvm_vm_check_extension(s, KVM_CAP_SGX_ATTRIBUTE)) {
+ return false;
+ }
+
+ fd = qemu_open_old("/dev/sgx_provision", O_RDONLY);
+ if (fd < 0) {
+ return false;
+ }
+
+ ret = kvm_vm_enable_cap(s, KVM_CAP_SGX_ATTRIBUTE, 0, fd);
+ if (ret) {
+ error_report("Could not enable SGX PROVISIONKEY: %s", strerror(-ret));
+ exit(1);
+ }
+ close(fd);
+ return true;
+}
+
+bool kvm_enable_sgx_provisioning(KVMState *s)
+{
+ return MEMORIZE(__kvm_enable_sgx_provisioning(s), has_sgx_provisioning);
+}
+
static bool host_supports_vmx(void)
{
uint32_t ecx, unused;
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index dc72508389..7bab91aecb 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -50,4 +50,6 @@ bool kvm_hv_vpindex_settable(void);
uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address);
+bool kvm_enable_sgx_provisioning(KVMState *s);
+
#endif
--
2.29.2.334.gfaefdd61ec
- [RESEND PATCH 08/32] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EBX, (continued)
- [RESEND PATCH 08/32] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EBX, Yang Zhong, 2021/04/30
- [RESEND PATCH 04/32] i386: Add 'sgx-epc' device to expose EPC sections to guest, Yang Zhong, 2021/04/30
- [RESEND PATCH 06/32] i386: Add primary SGX CPUID and MSR defines, Yang Zhong, 2021/04/30
- [RESEND PATCH 05/32] vl: Add "sgx-epc" option to expose SGX EPC sections to guest, Yang Zhong, 2021/04/30
- [RESEND PATCH 11/32] i386: Add feature control MSR dependency when SGX is enabled, Yang Zhong, 2021/04/30
- [RESEND PATCH 13/32] linux-headers: Add placeholder for KVM_CAP_SGX_ATTRIBUTE, Yang Zhong, 2021/04/30
- [RESEND PATCH 12/32] i386: Update SGX CPUID info according to hardware/KVM/user input, Yang Zhong, 2021/04/30
- [RESEND PATCH 07/32] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX, Yang Zhong, 2021/04/30
- [RESEND PATCH 09/32] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX, Yang Zhong, 2021/04/30
- [RESEND PATCH 10/32] i386: Add get/set/migrate support for SGX_LEPUBKEYHASH MSRs, Yang Zhong, 2021/04/30
- [RESEND PATCH 14/32] i386: kvm: Add support for exposing PROVISIONKEY to guest,
Yang Zhong <=
- [RESEND PATCH 15/32] i386: Propagate SGX CPUID sub-leafs to KVM, Yang Zhong, 2021/04/30
- [RESEND PATCH 17/32] hw/i386/fw_cfg: Set SGX bits in feature control fw_cfg accordingly, Yang Zhong, 2021/04/30
- [RESEND PATCH 16/32] Adjust min CPUID level to 0x12 when SGX is enabled, Yang Zhong, 2021/04/30
- [RESEND PATCH 18/32] hw/i386/pc: Account for SGX EPC sections when calculating device memory, Yang Zhong, 2021/04/30
- [RESEND PATCH 19/32] i386/pc: Add e820 entry for SGX EPC section(s), Yang Zhong, 2021/04/30
- [RESEND PATCH 20/32] i386: acpi: Add SGX EPC entry to ACPI tables, Yang Zhong, 2021/04/30
- [RESEND PATCH 21/32] q35: Add support for SGX EPC, Yang Zhong, 2021/04/30
- [RESEND PATCH 22/32] i440fx: Add support for SGX EPC, Yang Zhong, 2021/04/30
- [RESEND PATCH 23/32] hostmem: Add the reset interface for EPC backend reset, Yang Zhong, 2021/04/30
- [RESEND PATCH 24/32] sgx-epc: Add the reset interface for sgx-epc virt device, Yang Zhong, 2021/04/30