On Wed, Oct 26, 2022, Emanuele Giuseppe Esposito wrote:
Clear enable_sgx if ENCLS-exiting is not supported, i.e. if SGX cannot be virtualized. This fixes a bug where KVM would advertise ENCLS-exiting to L1 and propagate the control from vmcs12 to vmcs02 even if ENCLS-exiting isn't supported in secondary execution controls, e.g. because SGX isn't fully enabled, and thus induce an unexpected VM-Fail in L1.
Not updating enable_sgx is responsible for a second bug: vmx_set_cpu_caps() doesn't clear the SGX bits when hardware support is unavailable. This is a much less problematic bug as it only pops up if SGX is soft-disabled (the case being handled by cpu_has_sgx()) or if SGX is supported for bare metal but not in the VMCS (will never happen when running on bare metal, but can theoertically happen when running in a VM).
Last but not least, KVM should ideally have module params reflect KVM's actual configuration.
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2127128
Fixes: 72add915fbd5 ("KVM: VMX: Enable SGX virtualization for SGX1, SGX2 and LC") Cc: stable@vger.kernel.org
Suggested-by: Sean Christopherson seanjc@google.com Suggested-by: Bandan Das bsd@redhat.com Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com
Reviewed-by: Sean Christopherson seanjc@google.com