mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-25 20:05:39 +00:00
3c0c2ad1ae
Add support for handling VM-Exits that originate from a guest SGX
enclave. In SGX, an "enclave" is a new CPL3-only execution environment,
wherein the CPU and memory state is protected by hardware to make the
state inaccesible to code running outside of the enclave. When exiting
an enclave due to an asynchronous event (from the perspective of the
enclave), e.g. exceptions, interrupts, and VM-Exits, the enclave's state
is automatically saved and scrubbed (the CPU loads synthetic state), and
then reloaded when re-entering the enclave. E.g. after an instruction
based VM-Exit from an enclave, vmcs.GUEST_RIP will not contain the RIP
of the enclave instruction that trigered VM-Exit, but will instead point
to a RIP in the enclave's untrusted runtime (the guest userspace code
that coordinates entry/exit to/from the enclave).
To help a VMM recognize and handle exits from enclaves, SGX adds bits to
existing VMCS fields, VM_EXIT_REASON.VMX_EXIT_REASON_FROM_ENCLAVE and
GUEST_INTERRUPTIBILITY_INFO.GUEST_INTR_STATE_ENCLAVE_INTR. Define the
new architectural bits, and add a boolean to struct vcpu_vmx to cache
VMX_EXIT_REASON_FROM_ENCLAVE. Clear the bit in exit_reason so that
checks against exit_reason do not need to account for SGX, e.g.
"if (exit_reason == EXIT_REASON_EXCEPTION_NMI)" continues to work.
KVM is a largely a passive observer of the new bits, e.g. KVM needs to
account for the bits when propagating information to a nested VMM, but
otherwise doesn't need to act differently for the majority of VM-Exits
from enclaves.
The one scenario that is directly impacted is emulation, which is for
all intents and purposes impossible[1] since KVM does not have access to
the RIP or instruction stream that triggered the VM-Exit. The inability
to emulate is a non-issue for KVM, as most instructions that might
trigger VM-Exit unconditionally #UD in an enclave (before the VM-Exit
check. For the few instruction that conditionally #UD, KVM either never
sets the exiting control, e.g. PAUSE_EXITING[2], or sets it if and only
if the feature is not exposed to the guest in order to inject a #UD,
e.g. RDRAND_EXITING.
But, because it is still possible for a guest to trigger emulation,
e.g. MMIO, inject a #UD if KVM ever attempts emulation after a VM-Exit
from an enclave. This is architecturally accurate for instruction
VM-Exits, and for MMIO it's the least bad choice, e.g. it's preferable
to killing the VM. In practice, only broken or particularly stupid
guests should ever encounter this behavior.
Add a WARN in skip_emulated_instruction to detect any attempt to
modify the guest's RIP during an SGX enclave VM-Exit as all such flows
should either be unreachable or must handle exits from enclaves before
getting to skip_emulated_instruction.
[1] Impossible for all practical purposes. Not truly impossible
since KVM could implement some form of para-virtualization scheme.
[2] PAUSE_LOOP_EXITING only affects CPL0 and enclaves exist only at
CPL3, so we also don't need to worry about that interaction.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Kai Huang <kai.huang@intel.com>
Message-Id: <315f54a8507d09c292463ef29104e1d4c62e9090.1618196135.git.kai.huang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
165 lines
7.2 KiB
C
165 lines
7.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
/*
|
|
* vmx.h: VMX Architecture related definitions
|
|
* Copyright (c) 2004, Intel Corporation.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms and conditions of the GNU General Public License,
|
|
* version 2, as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along with
|
|
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
|
* Place - Suite 330, Boston, MA 02111-1307 USA.
|
|
*
|
|
* A few random additions are:
|
|
* Copyright (C) 2006 Qumranet
|
|
* Avi Kivity <avi@qumranet.com>
|
|
* Yaniv Kamay <yaniv@qumranet.com>
|
|
*
|
|
*/
|
|
#ifndef _UAPIVMX_H
|
|
#define _UAPIVMX_H
|
|
|
|
|
|
#define VMX_EXIT_REASONS_FAILED_VMENTRY 0x80000000
|
|
#define VMX_EXIT_REASONS_SGX_ENCLAVE_MODE 0x08000000
|
|
|
|
#define EXIT_REASON_EXCEPTION_NMI 0
|
|
#define EXIT_REASON_EXTERNAL_INTERRUPT 1
|
|
#define EXIT_REASON_TRIPLE_FAULT 2
|
|
#define EXIT_REASON_INIT_SIGNAL 3
|
|
#define EXIT_REASON_SIPI_SIGNAL 4
|
|
|
|
#define EXIT_REASON_INTERRUPT_WINDOW 7
|
|
#define EXIT_REASON_NMI_WINDOW 8
|
|
#define EXIT_REASON_TASK_SWITCH 9
|
|
#define EXIT_REASON_CPUID 10
|
|
#define EXIT_REASON_HLT 12
|
|
#define EXIT_REASON_INVD 13
|
|
#define EXIT_REASON_INVLPG 14
|
|
#define EXIT_REASON_RDPMC 15
|
|
#define EXIT_REASON_RDTSC 16
|
|
#define EXIT_REASON_VMCALL 18
|
|
#define EXIT_REASON_VMCLEAR 19
|
|
#define EXIT_REASON_VMLAUNCH 20
|
|
#define EXIT_REASON_VMPTRLD 21
|
|
#define EXIT_REASON_VMPTRST 22
|
|
#define EXIT_REASON_VMREAD 23
|
|
#define EXIT_REASON_VMRESUME 24
|
|
#define EXIT_REASON_VMWRITE 25
|
|
#define EXIT_REASON_VMOFF 26
|
|
#define EXIT_REASON_VMON 27
|
|
#define EXIT_REASON_CR_ACCESS 28
|
|
#define EXIT_REASON_DR_ACCESS 29
|
|
#define EXIT_REASON_IO_INSTRUCTION 30
|
|
#define EXIT_REASON_MSR_READ 31
|
|
#define EXIT_REASON_MSR_WRITE 32
|
|
#define EXIT_REASON_INVALID_STATE 33
|
|
#define EXIT_REASON_MSR_LOAD_FAIL 34
|
|
#define EXIT_REASON_MWAIT_INSTRUCTION 36
|
|
#define EXIT_REASON_MONITOR_TRAP_FLAG 37
|
|
#define EXIT_REASON_MONITOR_INSTRUCTION 39
|
|
#define EXIT_REASON_PAUSE_INSTRUCTION 40
|
|
#define EXIT_REASON_MCE_DURING_VMENTRY 41
|
|
#define EXIT_REASON_TPR_BELOW_THRESHOLD 43
|
|
#define EXIT_REASON_APIC_ACCESS 44
|
|
#define EXIT_REASON_EOI_INDUCED 45
|
|
#define EXIT_REASON_GDTR_IDTR 46
|
|
#define EXIT_REASON_LDTR_TR 47
|
|
#define EXIT_REASON_EPT_VIOLATION 48
|
|
#define EXIT_REASON_EPT_MISCONFIG 49
|
|
#define EXIT_REASON_INVEPT 50
|
|
#define EXIT_REASON_RDTSCP 51
|
|
#define EXIT_REASON_PREEMPTION_TIMER 52
|
|
#define EXIT_REASON_INVVPID 53
|
|
#define EXIT_REASON_WBINVD 54
|
|
#define EXIT_REASON_XSETBV 55
|
|
#define EXIT_REASON_APIC_WRITE 56
|
|
#define EXIT_REASON_RDRAND 57
|
|
#define EXIT_REASON_INVPCID 58
|
|
#define EXIT_REASON_VMFUNC 59
|
|
#define EXIT_REASON_ENCLS 60
|
|
#define EXIT_REASON_RDSEED 61
|
|
#define EXIT_REASON_PML_FULL 62
|
|
#define EXIT_REASON_XSAVES 63
|
|
#define EXIT_REASON_XRSTORS 64
|
|
#define EXIT_REASON_UMWAIT 67
|
|
#define EXIT_REASON_TPAUSE 68
|
|
#define EXIT_REASON_BUS_LOCK 74
|
|
|
|
#define VMX_EXIT_REASONS \
|
|
{ EXIT_REASON_EXCEPTION_NMI, "EXCEPTION_NMI" }, \
|
|
{ EXIT_REASON_EXTERNAL_INTERRUPT, "EXTERNAL_INTERRUPT" }, \
|
|
{ EXIT_REASON_TRIPLE_FAULT, "TRIPLE_FAULT" }, \
|
|
{ EXIT_REASON_INIT_SIGNAL, "INIT_SIGNAL" }, \
|
|
{ EXIT_REASON_SIPI_SIGNAL, "SIPI_SIGNAL" }, \
|
|
{ EXIT_REASON_INTERRUPT_WINDOW, "INTERRUPT_WINDOW" }, \
|
|
{ EXIT_REASON_NMI_WINDOW, "NMI_WINDOW" }, \
|
|
{ EXIT_REASON_TASK_SWITCH, "TASK_SWITCH" }, \
|
|
{ EXIT_REASON_CPUID, "CPUID" }, \
|
|
{ EXIT_REASON_HLT, "HLT" }, \
|
|
{ EXIT_REASON_INVD, "INVD" }, \
|
|
{ EXIT_REASON_INVLPG, "INVLPG" }, \
|
|
{ EXIT_REASON_RDPMC, "RDPMC" }, \
|
|
{ EXIT_REASON_RDTSC, "RDTSC" }, \
|
|
{ EXIT_REASON_VMCALL, "VMCALL" }, \
|
|
{ EXIT_REASON_VMCLEAR, "VMCLEAR" }, \
|
|
{ EXIT_REASON_VMLAUNCH, "VMLAUNCH" }, \
|
|
{ EXIT_REASON_VMPTRLD, "VMPTRLD" }, \
|
|
{ EXIT_REASON_VMPTRST, "VMPTRST" }, \
|
|
{ EXIT_REASON_VMREAD, "VMREAD" }, \
|
|
{ EXIT_REASON_VMRESUME, "VMRESUME" }, \
|
|
{ EXIT_REASON_VMWRITE, "VMWRITE" }, \
|
|
{ EXIT_REASON_VMOFF, "VMOFF" }, \
|
|
{ EXIT_REASON_VMON, "VMON" }, \
|
|
{ EXIT_REASON_CR_ACCESS, "CR_ACCESS" }, \
|
|
{ EXIT_REASON_DR_ACCESS, "DR_ACCESS" }, \
|
|
{ EXIT_REASON_IO_INSTRUCTION, "IO_INSTRUCTION" }, \
|
|
{ EXIT_REASON_MSR_READ, "MSR_READ" }, \
|
|
{ EXIT_REASON_MSR_WRITE, "MSR_WRITE" }, \
|
|
{ EXIT_REASON_INVALID_STATE, "INVALID_STATE" }, \
|
|
{ EXIT_REASON_MSR_LOAD_FAIL, "MSR_LOAD_FAIL" }, \
|
|
{ EXIT_REASON_MWAIT_INSTRUCTION, "MWAIT_INSTRUCTION" }, \
|
|
{ EXIT_REASON_MONITOR_TRAP_FLAG, "MONITOR_TRAP_FLAG" }, \
|
|
{ EXIT_REASON_MONITOR_INSTRUCTION, "MONITOR_INSTRUCTION" }, \
|
|
{ EXIT_REASON_PAUSE_INSTRUCTION, "PAUSE_INSTRUCTION" }, \
|
|
{ EXIT_REASON_MCE_DURING_VMENTRY, "MCE_DURING_VMENTRY" }, \
|
|
{ EXIT_REASON_TPR_BELOW_THRESHOLD, "TPR_BELOW_THRESHOLD" }, \
|
|
{ EXIT_REASON_APIC_ACCESS, "APIC_ACCESS" }, \
|
|
{ EXIT_REASON_EOI_INDUCED, "EOI_INDUCED" }, \
|
|
{ EXIT_REASON_GDTR_IDTR, "GDTR_IDTR" }, \
|
|
{ EXIT_REASON_LDTR_TR, "LDTR_TR" }, \
|
|
{ EXIT_REASON_EPT_VIOLATION, "EPT_VIOLATION" }, \
|
|
{ EXIT_REASON_EPT_MISCONFIG, "EPT_MISCONFIG" }, \
|
|
{ EXIT_REASON_INVEPT, "INVEPT" }, \
|
|
{ EXIT_REASON_RDTSCP, "RDTSCP" }, \
|
|
{ EXIT_REASON_PREEMPTION_TIMER, "PREEMPTION_TIMER" }, \
|
|
{ EXIT_REASON_INVVPID, "INVVPID" }, \
|
|
{ EXIT_REASON_WBINVD, "WBINVD" }, \
|
|
{ EXIT_REASON_XSETBV, "XSETBV" }, \
|
|
{ EXIT_REASON_APIC_WRITE, "APIC_WRITE" }, \
|
|
{ EXIT_REASON_RDRAND, "RDRAND" }, \
|
|
{ EXIT_REASON_INVPCID, "INVPCID" }, \
|
|
{ EXIT_REASON_VMFUNC, "VMFUNC" }, \
|
|
{ EXIT_REASON_ENCLS, "ENCLS" }, \
|
|
{ EXIT_REASON_RDSEED, "RDSEED" }, \
|
|
{ EXIT_REASON_PML_FULL, "PML_FULL" }, \
|
|
{ EXIT_REASON_XSAVES, "XSAVES" }, \
|
|
{ EXIT_REASON_XRSTORS, "XRSTORS" }, \
|
|
{ EXIT_REASON_UMWAIT, "UMWAIT" }, \
|
|
{ EXIT_REASON_TPAUSE, "TPAUSE" }, \
|
|
{ EXIT_REASON_BUS_LOCK, "BUS_LOCK" }
|
|
|
|
#define VMX_EXIT_REASON_FLAGS \
|
|
{ VMX_EXIT_REASONS_FAILED_VMENTRY, "FAILED_VMENTRY" }
|
|
|
|
#define VMX_ABORT_SAVE_GUEST_MSR_FAIL 1
|
|
#define VMX_ABORT_LOAD_HOST_PDPTE_FAIL 2
|
|
#define VMX_ABORT_LOAD_HOST_MSR_FAIL 4
|
|
|
|
#endif /* _UAPIVMX_H */
|