mirror of
https://github.com/torvalds/linux.git
synced 2024-12-15 15:41:58 +00:00
540745ddbc
Add a misc device /dev/sgx_vepc to allow userspace to allocate "raw"
Enclave Page Cache (EPC) without an associated enclave. The intended
and only known use case for raw EPC allocation is to expose EPC to a
KVM guest, hence the 'vepc' moniker, virt.{c,h} files and X86_SGX_KVM
Kconfig.
The SGX driver uses the misc device /dev/sgx_enclave to support
userspace in creating an enclave. Each file descriptor returned from
opening /dev/sgx_enclave represents an enclave. Unlike the SGX driver,
KVM doesn't control how the guest uses the EPC, therefore EPC allocated
to a KVM guest is not associated with an enclave, and /dev/sgx_enclave
is not suitable for allocating EPC for a KVM guest.
Having separate device nodes for the SGX driver and KVM virtual EPC also
allows separate permission control for running host SGX enclaves and KVM
SGX guests.
To use /dev/sgx_vepc to allocate a virtual EPC instance with particular
size, the hypervisor opens /dev/sgx_vepc, and uses mmap() with the
intended size to get an address range of virtual EPC. Then it may use
the address range to create one KVM memory slot as virtual EPC for
a guest.
Implement the "raw" EPC allocation in the x86 core-SGX subsystem via
/dev/sgx_vepc rather than in KVM. Doing so has two major advantages:
- Does not require changes to KVM's uAPI, e.g. EPC gets handled as
just another memory backend for guests.
- EPC management is wholly contained in the SGX subsystem, e.g. SGX
does not have to export any symbols, changes to reclaim flows don't
need to be routed through KVM, SGX's dirty laundry doesn't have to
get aired out for the world to see, and so on and so forth.
The virtual EPC pages allocated to guests are currently not reclaimable.
Reclaiming an EPC page used by enclave requires a special reclaim
mechanism separate from normal page reclaim, and that mechanism is not
supported for virutal EPC pages. Due to the complications of handling
reclaim conflicts between guest and host, reclaiming virtual EPC pages
is significantly more complex than basic support for SGX virtualization.
[ bp:
- Massage commit message and comments
- use cpu_feature_enabled()
- vertically align struct members init
- massage Virtual EPC clarification text
- move Kconfig prompt to Virtualization ]
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Co-developed-by: Kai Huang <kai.huang@intel.com>
Signed-off-by: Kai Huang <kai.huang@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lkml.kernel.org/r/0c38ced8c8e5a69872db4d6a1c0dabd01e07cad7.1616136308.git.kai.huang@intel.com
135 lines
3.6 KiB
Plaintext
135 lines
3.6 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# KVM configuration
|
|
#
|
|
|
|
source "virt/kvm/Kconfig"
|
|
|
|
menuconfig VIRTUALIZATION
|
|
bool "Virtualization"
|
|
depends on HAVE_KVM || X86
|
|
default y
|
|
help
|
|
Say Y here to get to see options for using your Linux host to run other
|
|
operating systems inside virtual machines (guests).
|
|
This option alone does not add any kernel code.
|
|
|
|
If you say N, all options in this submenu will be skipped and disabled.
|
|
|
|
if VIRTUALIZATION
|
|
|
|
config KVM
|
|
tristate "Kernel-based Virtual Machine (KVM) support"
|
|
depends on HAVE_KVM
|
|
depends on HIGH_RES_TIMERS
|
|
# for TASKSTATS/TASK_DELAY_ACCT:
|
|
depends on NET && MULTIUSER
|
|
depends on X86_LOCAL_APIC
|
|
select PREEMPT_NOTIFIERS
|
|
select MMU_NOTIFIER
|
|
select HAVE_KVM_IRQCHIP
|
|
select HAVE_KVM_IRQFD
|
|
select IRQ_BYPASS_MANAGER
|
|
select HAVE_KVM_IRQ_BYPASS
|
|
select HAVE_KVM_IRQ_ROUTING
|
|
select HAVE_KVM_EVENTFD
|
|
select KVM_ASYNC_PF
|
|
select USER_RETURN_NOTIFIER
|
|
select KVM_MMIO
|
|
select TASKSTATS
|
|
select TASK_DELAY_ACCT
|
|
select PERF_EVENTS
|
|
select HAVE_KVM_MSI
|
|
select HAVE_KVM_CPU_RELAX_INTERCEPT
|
|
select HAVE_KVM_NO_POLL
|
|
select KVM_XFER_TO_GUEST_WORK
|
|
select KVM_GENERIC_DIRTYLOG_READ_PROTECT
|
|
select KVM_VFIO
|
|
select SRCU
|
|
help
|
|
Support hosting fully virtualized guest machines using hardware
|
|
virtualization extensions. You will need a fairly recent
|
|
processor equipped with virtualization extensions. You will also
|
|
need to select one or more of the processor modules below.
|
|
|
|
This module provides access to the hardware capabilities through
|
|
a character device node named /dev/kvm.
|
|
|
|
To compile this as a module, choose M here: the module
|
|
will be called kvm.
|
|
|
|
If unsure, say N.
|
|
|
|
config KVM_WERROR
|
|
bool "Compile KVM with -Werror"
|
|
# KASAN may cause the build to fail due to larger frames
|
|
default y if X86_64 && !KASAN
|
|
# We use the dependency on !COMPILE_TEST to not be enabled
|
|
# blindly in allmodconfig or allyesconfig configurations
|
|
depends on KVM
|
|
depends on (X86_64 && !KASAN) || !COMPILE_TEST
|
|
depends on EXPERT
|
|
help
|
|
Add -Werror to the build flags for KVM.
|
|
|
|
If in doubt, say "N".
|
|
|
|
config KVM_INTEL
|
|
tristate "KVM for Intel (and compatible) processors support"
|
|
depends on KVM && IA32_FEAT_CTL
|
|
help
|
|
Provides support for KVM on processors equipped with Intel's VT
|
|
extensions, a.k.a. Virtual Machine Extensions (VMX).
|
|
|
|
To compile this as a module, choose M here: the module
|
|
will be called kvm-intel.
|
|
|
|
config X86_SGX_KVM
|
|
bool "Software Guard eXtensions (SGX) Virtualization"
|
|
depends on X86_SGX && KVM_INTEL
|
|
help
|
|
|
|
Enables KVM guests to create SGX enclaves.
|
|
|
|
This includes support to expose "raw" unreclaimable enclave memory to
|
|
guests via a device node, e.g. /dev/sgx_vepc.
|
|
|
|
If unsure, say N.
|
|
|
|
config KVM_AMD
|
|
tristate "KVM for AMD processors support"
|
|
depends on KVM
|
|
help
|
|
Provides support for KVM on AMD processors equipped with the AMD-V
|
|
(SVM) extensions.
|
|
|
|
To compile this as a module, choose M here: the module
|
|
will be called kvm-amd.
|
|
|
|
config KVM_AMD_SEV
|
|
def_bool y
|
|
bool "AMD Secure Encrypted Virtualization (SEV) support"
|
|
depends on KVM_AMD && X86_64
|
|
depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m)
|
|
help
|
|
Provides support for launching Encrypted VMs (SEV) and Encrypted VMs
|
|
with Encrypted State (SEV-ES) on AMD processors.
|
|
|
|
config KVM_XEN
|
|
bool "Support for Xen hypercall interface"
|
|
depends on KVM
|
|
help
|
|
Provides KVM support for the hosting Xen HVM guests and
|
|
passing Xen hypercalls to userspace.
|
|
|
|
If in doubt, say "N".
|
|
|
|
config KVM_MMU_AUDIT
|
|
bool "Audit KVM MMU"
|
|
depends on KVM && TRACEPOINTS
|
|
help
|
|
This option adds a R/W kVM module parameter 'mmu_audit', which allows
|
|
auditing of KVM MMU events at runtime.
|
|
|
|
endif # VIRTUALIZATION
|