Subject: [PATCH v3] KVM: nVMX: Advertise ENCLS_EXITING to L1 iff SGX is fully supported

Clear enable_sgx if ENCLS-exiting is not supported, i.e. if SGX cannot be
virtualized. This fixes a bug where KVM would advertise ENCLS-exiting to
L1 and propagate the control from vmcs12 to vmcs02 even if ENCLS-exiting
isn't supported in secondary execution controls, e.g. because SGX isn't
fully enabled, and thus induce an unexpected VM-Fail in L1.

Not updating enable_sgx is responsible for a second bug:
vmx_set_cpu_caps() doesn't clear the SGX bits when hardware support is
unavailable. This is a much less problematic bug as it only pops up
if SGX is soft-disabled (the case being handled by cpu_has_sgx()) or if
SGX is supported for bare metal but not in the VMCS (will never happen
when running on bare metal, but can theoertically happen when running in
a VM).

Last but not least, KVM should ideally have module params reflect KVM's
actual configuration.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2127128

Fixes: 72add915fbd5 ("KVM: VMX: Enable SGX virtualization for SGX1, SGX2 and LC")
Cc: [email protected]

Suggested-by: Sean Christopherson <[email protected]>
Suggested-by: Bandan Das <[email protected]>
Signed-off-by: Emanuele Giuseppe Esposito <[email protected]>
---
arch/x86/kvm/vmx/vmx.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 9dba04b6b019..ea0c65d3c08a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8263,6 +8263,11 @@ static __init int hardware_setup(void)
if (!cpu_has_virtual_nmis())
enable_vnmi = 0;

+ #ifdef CONFIG_X86_SGX_KVM
+ if (!cpu_has_vmx_encls_vmexit())
+ enable_sgx = false;
+ #endif
+
/*
* set_apic_access_page_addr() is used to reload apic access
* page upon invalidation. No need to do anything if not
--
2.31.1



2022-10-26 17:30:04

by Sean Christopherson

[permalink] [raw]
Subject: Re: [PATCH v3] KVM: nVMX: Advertise ENCLS_EXITING to L1 iff SGX is fully supported

On Wed, Oct 26, 2022, Emanuele Giuseppe Esposito wrote:
> Clear enable_sgx if ENCLS-exiting is not supported, i.e. if SGX cannot be
> virtualized. This fixes a bug where KVM would advertise ENCLS-exiting to
> L1 and propagate the control from vmcs12 to vmcs02 even if ENCLS-exiting
> isn't supported in secondary execution controls, e.g. because SGX isn't
> fully enabled, and thus induce an unexpected VM-Fail in L1.
>
> Not updating enable_sgx is responsible for a second bug:
> vmx_set_cpu_caps() doesn't clear the SGX bits when hardware support is
> unavailable. This is a much less problematic bug as it only pops up
> if SGX is soft-disabled (the case being handled by cpu_has_sgx()) or if
> SGX is supported for bare metal but not in the VMCS (will never happen
> when running on bare metal, but can theoertically happen when running in
> a VM).
>
> Last but not least, KVM should ideally have module params reflect KVM's
> actual configuration.
>
> RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2127128
>
> Fixes: 72add915fbd5 ("KVM: VMX: Enable SGX virtualization for SGX1, SGX2 and LC")
> Cc: [email protected]
>
> Suggested-by: Sean Christopherson <[email protected]>
> Suggested-by: Bandan Das <[email protected]>
> Signed-off-by: Emanuele Giuseppe Esposito <[email protected]>
> ---

Reviewed-by: Sean Christopherson <[email protected]>