Since Sean Christopherson has left Intel and i am responsible for Qemu SGX
upstream work. His @intel.com address will be bouncing and his new email(
sea...@google.com) is also in CC lists.
This series is Qemu SGX virtualization implementation rebased on latest
Qemu release.
You can find Qemu repo here:
https://github.com/intel/qemu-sgx.git upstream
If you want to try sgx, you can also get the kernel/kvm code from upstream
branch of kvm-sgx repo on github:
https://github.com/intel/kvm-sgx.git upstream
Notice: The kvm SGX patch series has been queued by Paolo in 4/17. This Qemu
series still depend on above kvm-sgx upstream branch, so the
KVM_CAP_SGX_ATTRIBUTE
will be changed to 196 once the linux release merge all kvm SGX series.
To simplify, you'd better install kvm-sgx on host and guest, which can support
SGX on host and guest kernel. And to me, use below reference command to boot
SGX guest:
#qemu-system-x86_64 \
...... \
-cpu host,+sgx_provisionkey \
-sgx-epc id=epc1,memdev=mem1 \
-object memory-backend-epc,id=mem1,size=64M,prealloc=on
Overview
========
Intel Software Guard eXtensions (SGX) is a set of instructions and mechanisms
for memory accesses in order to provide security accesses for sensitive
applications and data. SGX allows an application to use it's pariticular
address space as an *enclave*, which is a protected area provides
confidentiality
and integrity even in the presence of privileged malware. Accesses to the
enclave memory area from any software not resident in the enclave are prevented,
including those from privileged software.
SGX virtaulization
==================
The KVM SGX creates one new misc device, sgx_vepc, and Qemu will open
'/dev/sgx_vepc'
device node to mmap() host EPC memory to guest. The Qemu also adds 'sgx-epc'
device
to expose EPC sections to guest through CPUID and ACPI table. The Qemu SGX also
supports multiple virtual EPC sections to guest, we just put them together
physically
contiguous for the sake of simplicity. The kernel SGX NUMA has been merged into
Linux
tip tree, we will support this function in the next phase.
Although the current host SGX subsystem can not support SGX2 feature, the
KVM/Qemu
implementation still expose this feature to guest. Guest SGX2 support doesn't
have
interaction with host kernel SGX driver, the SGX guest can normally use those
new
instructions.
As for SGX virtualization detailed infomation, please reference
docs/intel-sgx.txt
docuement(patch 32).
Sean Christopherson (22):
memory: Add RAM_PROTECTED flag to skip IOMMU mappings
hostmem: Add hostmem-epc as a backend for SGX EPC
i386: Add 'sgx-epc' device to expose EPC sections to guest
vl: Add "sgx-epc" option to expose SGX EPC sections to guest
i386: Add primary SGX CPUID and MSR defines
i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX
i386: Add SGX CPUID leaf FEAT_SGX_12_0_EBX
i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX
i386: Add get/set/migrate support for SGX_LEPUBKEYHASH MSRs
i386: Add feature control MSR dependency when SGX is enabled
i386: Update SGX CPUID info according to hardware/KVM/user input
linux-headers: Add placeholder for KVM_CAP_SGX_ATTRIBUTE
i386: kvm: Add support for exposing PROVISIONKEY to guest
i386: Propagate SGX CPUID sub-leafs to KVM
Adjust min CPUID level to 0x12 when SGX is enabled
hw/i386/fw_cfg: Set SGX bits in feature control fw_cfg accordingly
hw/i386/pc: Account for SGX EPC sections when calculating device
memory
i386/pc: Add e820 entry for SGX EPC section(s)
i386: acpi: Add SGX EPC entry to ACPI tables
q35: Add support for SGX EPC
i440fx: Add support for SGX EPC
doc: Add the SGX doc
Yang Zhong (10):
qom: Add memory-backend-epc ObjectOptions support
hostmem: Add the reset interface for EPC backend reset
sgx-epc: Add the reset interface for sgx-epc virt device
qmp: Add query-sgx command
hmp: Add 'info sgx' command
i386: Add sgx_get_info() interface
bitops: Support 32 and 64 bit mask macro
qmp: Add the qmp_query_sgx_capabilities()
Kconfig: Add CONFIG_SGX support
sgx-epc: Add the fill_device_info() callback support
backends/hostmem-epc.c | 106 ++++++
backends/hostmem-memfd.c | 2 +-
backends/meson.build | 1 +
default-configs/devices/i386-softmmu.mak | 1 +
docs/intel-sgx.txt | 173 +++++++++
hmp-commands-info.hx | 15 +
hw/i386/Kconfig | 5 +
hw/i386/acpi-build.c | 22 ++
hw/i386/fw_cfg.c | 10 +-
hw/i386/meson.build | 1 +
hw/i386/pc.c | 15 +-
hw/i386/pc_piix.c | 4 +
hw/i386/pc_q35.c | 3 +
hw/i386/sgx-epc.c | 451 +++++++++++++++++++++++
hw/i386/sgx-stub.c | 13 +
hw/misc/ivshmem.c | 2 +-
hw/remote/memory.c | 2 +-
hw/vfio/common.c | 1 +
include/exec/memory.h | 15 +
include/hw/i386/pc.h | 10 +
include/hw/i386/sgx-epc.h | 70 ++++
include/monitor/hmp.h | 1 +
include/qemu/bitops.h | 7 +
linux-headers/linux/kvm.h | 1 +
monitor/hmp-cmds.c | 32 ++
monitor/qmp-cmds.c | 19 +
qapi/machine.json | 26 +-
qapi/misc.json | 61 +++
qapi/qom.json | 2 +
qemu-options.hx | 8 +
softmmu/globals.c | 1 +
softmmu/memory.c | 12 +-
softmmu/physmem.c | 2 +-
softmmu/vl.c | 9 +
stubs/meson.build | 1 +
stubs/sgx-stub.c | 12 +
target/i386/cpu.c | 168 ++++++++-
target/i386/cpu.h | 16 +
target/i386/kvm/kvm.c | 75 ++++
target/i386/kvm/kvm_i386.h | 2 +
target/i386/machine.c | 20 +
tests/qtest/qmp-cmd-test.c | 2 +
42 files changed, 1387 insertions(+), 12 deletions(-)
create mode 100644 backends/hostmem-epc.c
create mode 100644 docs/intel-sgx.txt
create mode 100644 hw/i386/sgx-epc.c
create mode 100644 hw/i386/sgx-stub.c
create mode 100644 include/hw/i386/sgx-epc.h
create mode 100644 stubs/sgx-stub.c
--
2.29.2.334.gfaefdd61ec
