8f102445d4
Emulate the four Launch Enclave public key hash MSRs (LE hash MSRs) that exist on CPUs that support SGX Launch Control (LC). SGX LC modifies the behavior of ENCLS[EINIT] to use the LE hash MSRs when verifying the key used to sign an enclave. On CPUs without LC support, the LE hash is hardwired into the CPU to an Intel controlled key (the Intel key is also the reset value of the LE hash MSRs). Track the guest's desired hash so that a future patch can stuff the hash into the hardware MSRs when executing EINIT on behalf of the guest, when those MSRs are writable in host. Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Co-developed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Kai Huang <kai.huang@intel.com> Message-Id: <c58ef601ddf88f3a113add837969533099b1364a.1618196135.git.kai.huang@intel.com> [Add a comment regarding the MSRs being available until SGX is locked. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
22 lines
523 B
C
22 lines
523 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __KVM_X86_SGX_H
|
|
#define __KVM_X86_SGX_H
|
|
|
|
#include <linux/kvm_host.h>
|
|
|
|
#ifdef CONFIG_X86_SGX_KVM
|
|
extern bool __read_mostly enable_sgx;
|
|
|
|
int handle_encls(struct kvm_vcpu *vcpu);
|
|
|
|
void setup_default_sgx_lepubkeyhash(void);
|
|
void vcpu_setup_sgx_lepubkeyhash(struct kvm_vcpu *vcpu);
|
|
#else
|
|
#define enable_sgx 0
|
|
|
|
static inline void setup_default_sgx_lepubkeyhash(void) { }
|
|
static inline void vcpu_setup_sgx_lepubkeyhash(struct kvm_vcpu *vcpu) { }
|
|
#endif
|
|
|
|
#endif /* __KVM_X86_SGX_H */
|