On Sun, Mar 26, 2023 at 03:16:15PM +0000, Michael Kelley (LINUX) wrote: > From: Saurabh Sengar <ssengar@xxxxxxxxxxxxxxxxxxx> Sent: Monday, March 20, 2023 3:04 AM > > > > Add HYPERV_VTL_MODE Kconfig flag for VTL mode. > > > > Signed-off-by: Saurabh Sengar <ssengar@xxxxxxxxxxxxxxxxxxx> > > --- > > arch/x86/Kconfig | 24 ++++++++++++++++++++++++ > > arch/x86/hyperv/Makefile | 1 + > > 2 files changed, 25 insertions(+) > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > > index 453f462f6c9c..c3faaaea1e31 100644 > > --- a/arch/x86/Kconfig > > +++ b/arch/x86/Kconfig > > @@ -782,6 +782,30 @@ menuconfig HYPERVISOR_GUEST > > > > if HYPERVISOR_GUEST > > > > +config HYPERV_VTL_MODE > > + bool "Enable Linux to boot in VTL context" > > + depends on X86_64 && HYPERV > > + default n > > + help > > + Virtual Secure Mode (VSM) is a set of hypervisor capabilities and > > + enlightenments offered to host and guest partitions which enables > > + the creation and management of new security boundaries within > > + operating system software. > > + > > + VSM achieves and maintains isolation through Virtual Trust Levels > > + (VTLs). Virtual Trust Levels are hierarchical, with higher levels > > + being more privileged than lower levels. VTL0 is the least privileged > > + level, and currently only other level supported is VTL2. > > + > > + Select this option to build a Linux kernel to run at a VTL other than > > + the normal VTL0, which currently is only VTL2. This option > > + initializes the x86 platform for VTL2, and adds the ability to boot > > + secondary CPUs directly into 64-bit context as required for VTLs other > > + than 0. A kernel built with this option must run at VTL2, and will > > + not run as a normal guest. > > + > > + If unsure, say N > > + > > Is there a reason for putting this in arch/x86/Kconfig instead of in > drivers/hv/Kconfig under the "Microsoft Hyper-V guest support" > menu with the other Hyper-V settings? It seems like grouping > this with the other Hyper-V settings would make it easier to find, > unless there's some reason that doesn't work. As all the code dependent on this flag is in arch/x86/hyperv, and all other kernel flags used in arch/x86/hyperv/Makefile are define in arch/x86/Kconfig, arch/x86/Kconfig was my default choice. But your suggestion makes perfect sense, I will move it to drivers/hv/Kconfig Regards, Saurabh > > Michael > > > config PARAVIRT > > bool "Enable paravirtualization code" > > depends on HAVE_STATIC_CALL > > diff --git a/arch/x86/hyperv/Makefile b/arch/x86/hyperv/Makefile > > index 5d2de10809ae..3a1548054b48 100644 > > --- a/arch/x86/hyperv/Makefile > > +++ b/arch/x86/hyperv/Makefile > > @@ -1,6 +1,7 @@ > > # SPDX-License-Identifier: GPL-2.0-only > > obj-y := hv_init.o mmu.o nested.o irqdomain.o ivm.o > > obj-$(CONFIG_X86_64) += hv_apic.o hv_proc.o > > +obj-$(CONFIG_HYPERV_VTL_MODE) += hv_vtl.o > > > > ifdef CONFIG_X86_64 > > obj-$(CONFIG_PARAVIRT_SPINLOCKS) += hv_spinlock.o > > -- > > 2.34.1
