Add HYPERV_VTL_MODE Kconfig flag for VTL mode.
Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
---
arch/x86/Kconfig | 24 ++++++++++++++++++++++++
arch/x86/hyperv/Makefile | 1 +
2 files changed, 25 insertions(+)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 453f462f6c9c..c3faaaea1e31 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -782,6 +782,30 @@ menuconfig HYPERVISOR_GUEST
if HYPERVISOR_GUEST
+config HYPERV_VTL_MODE
+ bool "Enable Linux to boot in VTL context"
+ depends on X86_64 && HYPERV
+ default n
+ help
+ Virtual Secure Mode (VSM) is a set of hypervisor capabilities and
+ enlightenments offered to host and guest partitions which enables
+ the creation and management of new security boundaries within
+ operating system software.
+
+ VSM achieves and maintains isolation through Virtual Trust Levels
+ (VTLs). Virtual Trust Levels are hierarchical, with higher levels
+ being more privileged than lower levels. VTL0 is the least privileged
+ level, and currently only other level supported is VTL2.
+
+ Select this option to build a Linux kernel to run at a VTL other than
+ the normal VTL0, which currently is only VTL2. This option
+ initializes the x86 platform for VTL2, and adds the ability to boot
+ secondary CPUs directly into 64-bit context as required for VTLs other
+ than 0. A kernel built with this option must run at VTL2, and will
+ not run as a normal guest.
+
+ If unsure, say N
+
config PARAVIRT
bool "Enable paravirtualization code"
depends on HAVE_STATIC_CALL
diff --git a/arch/x86/hyperv/Makefile b/arch/x86/hyperv/Makefile
index 5d2de10809ae..3a1548054b48 100644
--- a/arch/x86/hyperv/Makefile
+++ b/arch/x86/hyperv/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
obj-y := hv_init.o mmu.o nested.o irqdomain.o ivm.o
obj-$(CONFIG_X86_64) += hv_apic.o hv_proc.o
+obj-$(CONFIG_HYPERV_VTL_MODE) += hv_vtl.o
ifdef CONFIG_X86_64
obj-$(CONFIG_PARAVIRT_SPINLOCKS) += hv_spinlock.o
--
2.34.1From: Saurabh Sengar <ssengar@linux.microsoft.com> Sent: Monday, March 20, 2023 3:04 AM > > Add HYPERV_VTL_MODE Kconfig flag for VTL mode. > > Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com> > --- > arch/x86/Kconfig | 24 ++++++++++++++++++++++++ > arch/x86/hyperv/Makefile | 1 + > 2 files changed, 25 insertions(+) > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index 453f462f6c9c..c3faaaea1e31 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -782,6 +782,30 @@ menuconfig HYPERVISOR_GUEST > > if HYPERVISOR_GUEST > > +config HYPERV_VTL_MODE > + bool "Enable Linux to boot in VTL context" > + depends on X86_64 && HYPERV > + default n > + help > + Virtual Secure Mode (VSM) is a set of hypervisor capabilities and > + enlightenments offered to host and guest partitions which enables > + the creation and management of new security boundaries within > + operating system software. > + > + VSM achieves and maintains isolation through Virtual Trust Levels > + (VTLs). Virtual Trust Levels are hierarchical, with higher levels > + being more privileged than lower levels. VTL0 is the least privileged > + level, and currently only other level supported is VTL2. > + > + Select this option to build a Linux kernel to run at a VTL other than > + the normal VTL0, which currently is only VTL2. This option > + initializes the x86 platform for VTL2, and adds the ability to boot > + secondary CPUs directly into 64-bit context as required for VTLs other > + than 0. A kernel built with this option must run at VTL2, and will > + not run as a normal guest. > + > + If unsure, say N > + Is there a reason for putting this in arch/x86/Kconfig instead of in drivers/hv/Kconfig under the "Microsoft Hyper-V guest support" menu with the other Hyper-V settings? It seems like grouping this with the other Hyper-V settings would make it easier to find, unless there's some reason that doesn't work. Michael > config PARAVIRT > bool "Enable paravirtualization code" > depends on HAVE_STATIC_CALL > diff --git a/arch/x86/hyperv/Makefile b/arch/x86/hyperv/Makefile > index 5d2de10809ae..3a1548054b48 100644 > --- a/arch/x86/hyperv/Makefile > +++ b/arch/x86/hyperv/Makefile > @@ -1,6 +1,7 @@ > # SPDX-License-Identifier: GPL-2.0-only > obj-y := hv_init.o mmu.o nested.o irqdomain.o ivm.o > obj-$(CONFIG_X86_64) += hv_apic.o hv_proc.o > +obj-$(CONFIG_HYPERV_VTL_MODE) += hv_vtl.o > > ifdef CONFIG_X86_64 > obj-$(CONFIG_PARAVIRT_SPINLOCKS) += hv_spinlock.o > -- > 2.34.1
On Sun, Mar 26, 2023 at 03:16:15PM +0000, Michael Kelley (LINUX) wrote: > From: Saurabh Sengar <ssengar@linux.microsoft.com> Sent: Monday, March 20, 2023 3:04 AM > > > > Add HYPERV_VTL_MODE Kconfig flag for VTL mode. > > > > Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com> > > --- > > arch/x86/Kconfig | 24 ++++++++++++++++++++++++ > > arch/x86/hyperv/Makefile | 1 + > > 2 files changed, 25 insertions(+) > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > > index 453f462f6c9c..c3faaaea1e31 100644 > > --- a/arch/x86/Kconfig > > +++ b/arch/x86/Kconfig > > @@ -782,6 +782,30 @@ menuconfig HYPERVISOR_GUEST > > > > if HYPERVISOR_GUEST > > > > +config HYPERV_VTL_MODE > > + bool "Enable Linux to boot in VTL context" > > + depends on X86_64 && HYPERV > > + default n > > + help > > + Virtual Secure Mode (VSM) is a set of hypervisor capabilities and > > + enlightenments offered to host and guest partitions which enables > > + the creation and management of new security boundaries within > > + operating system software. > > + > > + VSM achieves and maintains isolation through Virtual Trust Levels > > + (VTLs). Virtual Trust Levels are hierarchical, with higher levels > > + being more privileged than lower levels. VTL0 is the least privileged > > + level, and currently only other level supported is VTL2. > > + > > + Select this option to build a Linux kernel to run at a VTL other than > > + the normal VTL0, which currently is only VTL2. This option > > + initializes the x86 platform for VTL2, and adds the ability to boot > > + secondary CPUs directly into 64-bit context as required for VTLs other > > + than 0. A kernel built with this option must run at VTL2, and will > > + not run as a normal guest. > > + > > + If unsure, say N > > + > > Is there a reason for putting this in arch/x86/Kconfig instead of in > drivers/hv/Kconfig under the "Microsoft Hyper-V guest support" > menu with the other Hyper-V settings? It seems like grouping > this with the other Hyper-V settings would make it easier to find, > unless there's some reason that doesn't work. As all the code dependent on this flag is in arch/x86/hyperv, and all other kernel flags used in arch/x86/hyperv/Makefile are define in arch/x86/Kconfig, arch/x86/Kconfig was my default choice. But your suggestion makes perfect sense, I will move it to drivers/hv/Kconfig Regards, Saurabh > > Michael > > > config PARAVIRT > > bool "Enable paravirtualization code" > > depends on HAVE_STATIC_CALL > > diff --git a/arch/x86/hyperv/Makefile b/arch/x86/hyperv/Makefile > > index 5d2de10809ae..3a1548054b48 100644 > > --- a/arch/x86/hyperv/Makefile > > +++ b/arch/x86/hyperv/Makefile > > @@ -1,6 +1,7 @@ > > # SPDX-License-Identifier: GPL-2.0-only > > obj-y := hv_init.o mmu.o nested.o irqdomain.o ivm.o > > obj-$(CONFIG_X86_64) += hv_apic.o hv_proc.o > > +obj-$(CONFIG_HYPERV_VTL_MODE) += hv_vtl.o > > > > ifdef CONFIG_X86_64 > > obj-$(CONFIG_PARAVIRT_SPINLOCKS) += hv_spinlock.o > > -- > > 2.34.1
© 2016 - 2026 Red Hat, Inc.