All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v4 00/33] Qemu SGX virtualization
@ 2021-07-19 11:21 Yang Zhong
  2021-07-19 11:21 ` [PATCH v4 01/33] memory: Add RAM_PROTECTED flag to skip IOMMU mappings Yang Zhong
                   ` (35 more replies)
  0 siblings, 36 replies; 61+ messages in thread
From: Yang Zhong @ 2021-07-19 11:21 UTC (permalink / raw)
  To: qemu-devel; +Cc: yang.zhong, seanjc, kai.huang, jarkko, pbonzini, eblake

Since Sean Christopherson has left Intel and i am responsible for Qemu SGX
upstream work. His @intel.com address will be bouncing and his new email(
seanjc@google.com) is also in CC lists.

This series is Qemu SGX virtualization implementation rebased on latest
Qemu release. The numa support for SGX will be sent in another patchset
once this basic SGX patchset are merged.

You can find Qemu repo here:

    https://github.com/intel/qemu-sgx.git upstream

If you want to try SGX, you can directly install the linux release(at least 5.13.0-rc1+)
since kvm SGX has been merged into linux release.

    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

To simplify, you'd better install linux on host and guest, which can support
SGX on host and guest kernel. And to me, use below reference command to boot
SGX guest:

    #qemu-system-x86_64 \
        ...... \
        -cpu host,+sgx-provisionkey \
        -object memory-backend-epc,id=mem1,size=64M,prealloc=on \
        -object memory-backend-epc,id=mem2,size=28M \
        -M sgx-epc.0.memdev=mem1,sgx-epc.1.memdev=mem2

Overview
========

Intel Software Guard eXtensions (SGX) is a set of instructions and mechanisms
for memory accesses in order to provide security accesses for sensitive
applications and data. SGX allows an application to use it's pariticular
address space as an *enclave*, which is a protected area provides confidentiality
and integrity even in the presence of privileged malware. Accesses to the
enclave memory area from any software not resident in the enclave are prevented,
including those from privileged software.

SGX virtaulization
==================

The KVM SGX creates one new misc device, sgx_vepc, and Qemu will open '/dev/sgx_vepc'
device node to mmap() host EPC memory to guest. The Qemu also adds 'sgx-epc' device
to expose EPC sections to guest through CPUID and ACPI table.  The Qemu SGX also
supports multiple virtual EPC sections to guest, we just put them together physically
contiguous for the sake of simplicity. The kernel SGX NUMA has been merged into Linux
tip tree, we will support this function in the next phase.

Although the current host SGX subsystem can not support SGX2 feature, the KVM/Qemu
implementation still expose this feature to guest. Guest SGX2 support doesn't have
interaction with host kernel SGX driver, the SGX guest can normally use those new
instructions.

As for SGX virtualization detailed infomation, please reference docs/intel-sgx.txt
docuement(patch 33).

Changelog:
=========

(Changelog here is for global changes, please see each patch's changelog for changes
made to specific patch.)

v3-->v4:
   - Rebased the sgx patches into latest Qemu release.
   - Moved sgx compound property setter/getter from MachineState to X86MachineState(Paolo).
   - Re-defined struct SgxEPC, removed 'id' property and added struct SgxEPCList for
     sgx-epc.0.{memdev}(Paolo).
   - Removed g_malloc0(), and changed the 'SGXEPCState *sgx_epc' to 'SGXEPCState sgx_epc'
     in struct PCMachineState(Paolo).
   - Changed the SGX compound property cmdline from sgx-epc.{memdev}.0 to
     sgx-epc.0.{memdev}(Paolo).
   - Removed the signature from the 'git format-patch' command(Jarkko).

v2-->v3:
   - Rebased the sgx patches into latest Qemu release.
   - Implemented the compound property for SGX, ref patch5, the command from '-sgx-epc'
     to '-M'(Paolo).
   - Moved the sgx common code from sgx-epc.c to sgx.c. The sgx-epc.c is
     only responsible for virtual epc device.
   - Removed the previous patch13(linux-headers: Add placeholder for KVM_CAP_SGX_ATTRIBUTE)
     because ehabkost@redhat.com updated Linux headers to 5.13-rc4 with commit 278f064e452.
   - Updated the patch1 because ram_flags were changed by David Hildenbra.
   - Added one patch24, which avoid reset operation caused by bios reset.
   - Added one patch25, which make prealloc property consistent with Qemu cmdline during VM
     reset.

v1-->v2:
   - Rebased the sgx patches into latest Qemu release.
   - Unified the "share" and "protected" arguments with ram_flags in the
     memory_region_init_ram_from_fd()(Paolo).
   - Added the new MemoryBackendEpcProperties and related documents(Eric Blake).
   - Changed the KVM_CAP_SGX_ATTRIBUTE from 195 to 196(Kai).
   - Changed the version and some grammar issues(Eric Blake).

Sean Christopherson (21):
  memory: Add RAM_PROTECTED flag to skip IOMMU mappings
  hostmem: Add hostmem-epc as a backend for SGX EPC
  i386: Add 'sgx-epc' device to expose EPC sections to guest
  vl: Add sgx compound properties to expose SGX EPC sections to guest
  i386: Add primary SGX CPUID and MSR defines
  i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX
  i386: Add SGX CPUID leaf FEAT_SGX_12_0_EBX
  i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX
  i386: Add get/set/migrate support for SGX_LEPUBKEYHASH MSRs
  i386: Add feature control MSR dependency when SGX is enabled
  i386: Update SGX CPUID info according to hardware/KVM/user input
  i386: kvm: Add support for exposing PROVISIONKEY to guest
  i386: Propagate SGX CPUID sub-leafs to KVM
  Adjust min CPUID level to 0x12 when SGX is enabled
  hw/i386/fw_cfg: Set SGX bits in feature control fw_cfg accordingly
  hw/i386/pc: Account for SGX EPC sections when calculating device
    memory
  i386/pc: Add e820 entry for SGX EPC section(s)
  i386: acpi: Add SGX EPC entry to ACPI tables
  q35: Add support for SGX EPC
  i440fx: Add support for SGX EPC
  doc: Add the SGX doc

Yang Zhong (12):
  qom: Add memory-backend-epc ObjectOptions support
  hostmem-epc: Add the reset interface for EPC backend reset
  sgx-epc: Add the reset interface for sgx-epc virt device
  sgx-epc: Avoid bios reset during sgx epc initialization
  hostmem-epc: Make prealloc consistent with qemu cmdline during reset
  qmp: Add query-sgx command
  hmp: Add 'info sgx' command
  i386: Add sgx_get_info() interface
  bitops: Support 32 and 64 bit mask macro
  qmp: Add the qmp_query_sgx_capabilities()
  Kconfig: Add CONFIG_SGX support
  sgx-epc: Add the fill_device_info() callback support

 backends/hostmem-epc.c                   | 118 ++++++++++
 backends/meson.build                     |   1 +
 configs/devices/i386-softmmu/default.mak |   1 +
 docs/intel-sgx.txt                       | 167 ++++++++++++++
 hmp-commands-info.hx                     |  15 ++
 hw/i386/Kconfig                          |   5 +
 hw/i386/acpi-build.c                     |  22 ++
 hw/i386/fw_cfg.c                         |  10 +-
 hw/i386/meson.build                      |   2 +
 hw/i386/pc.c                             |  15 +-
 hw/i386/pc_piix.c                        |   4 +
 hw/i386/pc_q35.c                         |   3 +
 hw/i386/sgx-epc.c                        | 265 +++++++++++++++++++++++
 hw/i386/sgx-stub.c                       |  13 ++
 hw/i386/sgx.c                            | 170 +++++++++++++++
 hw/i386/x86.c                            |  29 +++
 hw/vfio/common.c                         |   1 +
 include/exec/memory.h                    |  15 +-
 include/hw/i386/pc.h                     |  10 +
 include/hw/i386/sgx-epc.h                |  68 ++++++
 include/hw/i386/x86.h                    |   1 +
 include/monitor/hmp.h                    |   1 +
 include/qemu/bitops.h                    |   7 +
 monitor/hmp-cmds.c                       |  32 +++
 monitor/qmp-cmds.c                       |  19 ++
 qapi/machine.json                        |  52 ++++-
 qapi/misc.json                           |  61 ++++++
 qapi/qom.json                            |  19 ++
 qemu-options.hx                          |  10 +-
 softmmu/memory.c                         |   5 +
 softmmu/physmem.c                        |   3 +-
 stubs/meson.build                        |   1 +
 stubs/sgx-stub.c                         |  12 +
 target/i386/cpu.c                        | 168 +++++++++++++-
 target/i386/cpu.h                        |  16 ++
 target/i386/kvm/kvm.c                    |  75 +++++++
 target/i386/kvm/kvm_i386.h               |   2 +
 target/i386/machine.c                    |  20 ++
 tests/qtest/qmp-cmd-test.c               |   2 +
 39 files changed, 1430 insertions(+), 10 deletions(-)
 create mode 100644 backends/hostmem-epc.c
 create mode 100644 docs/intel-sgx.txt
 create mode 100644 hw/i386/sgx-epc.c
 create mode 100644 hw/i386/sgx-stub.c
 create mode 100644 hw/i386/sgx.c
 create mode 100644 include/hw/i386/sgx-epc.h
 create mode 100644 stubs/sgx-stub.c



^ permalink raw reply	[flat|nested] 61+ messages in thread

end of thread, other threads:[~2021-09-16  6:36 UTC | newest]

Thread overview: 61+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-19 11:21 [PATCH v4 00/33] Qemu SGX virtualization Yang Zhong
2021-07-19 11:21 ` [PATCH v4 01/33] memory: Add RAM_PROTECTED flag to skip IOMMU mappings Yang Zhong
2021-07-19 11:21 ` [PATCH v4 02/33] hostmem: Add hostmem-epc as a backend for SGX EPC Yang Zhong
2021-07-19 11:21 ` [PATCH v4 03/33] qom: Add memory-backend-epc ObjectOptions support Yang Zhong
2021-07-19 11:21 ` [PATCH v4 04/33] i386: Add 'sgx-epc' device to expose EPC sections to guest Yang Zhong
2021-09-14  6:36   ` Philippe Mathieu-Daudé
2021-09-16  1:29     ` Yang Zhong
2021-07-19 11:21 ` [PATCH v4 05/33] vl: Add sgx compound properties to expose SGX " Yang Zhong
2021-07-19 11:21 ` [PATCH v4 06/33] i386: Add primary SGX CPUID and MSR defines Yang Zhong
2021-07-19 11:21 ` [PATCH v4 07/33] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX Yang Zhong
2021-07-19 11:21 ` [PATCH v4 08/33] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EBX Yang Zhong
2021-07-19 11:21 ` [PATCH v4 09/33] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX Yang Zhong
2021-07-19 11:21 ` [PATCH v4 10/33] i386: Add get/set/migrate support for SGX_LEPUBKEYHASH MSRs Yang Zhong
2021-09-14  6:38   ` Philippe Mathieu-Daudé
2021-09-16  6:08     ` Yang Zhong
2021-09-16  6:35       ` Philippe Mathieu-Daudé
2021-07-19 11:21 ` [PATCH v4 11/33] i386: Add feature control MSR dependency when SGX is enabled Yang Zhong
2021-07-19 11:21 ` [PATCH v4 12/33] i386: Update SGX CPUID info according to hardware/KVM/user input Yang Zhong
2021-07-19 11:21 ` [PATCH v4 13/33] i386: kvm: Add support for exposing PROVISIONKEY to guest Yang Zhong
2021-07-19 11:21 ` [PATCH v4 14/33] i386: Propagate SGX CPUID sub-leafs to KVM Yang Zhong
2021-07-19 11:21 ` [PATCH v4 15/33] Adjust min CPUID level to 0x12 when SGX is enabled Yang Zhong
2021-07-19 11:21 ` [PATCH v4 16/33] hw/i386/fw_cfg: Set SGX bits in feature control fw_cfg accordingly Yang Zhong
2021-07-19 11:21 ` [PATCH v4 17/33] hw/i386/pc: Account for SGX EPC sections when calculating device memory Yang Zhong
2021-07-19 11:21 ` [PATCH v4 18/33] i386/pc: Add e820 entry for SGX EPC section(s) Yang Zhong
2021-07-19 11:21 ` [PATCH v4 19/33] i386: acpi: Add SGX EPC entry to ACPI tables Yang Zhong
2021-07-19 11:21 ` [PATCH v4 20/33] q35: Add support for SGX EPC Yang Zhong
2021-07-19 11:21 ` [PATCH v4 21/33] i440fx: " Yang Zhong
2021-07-19 11:21 ` [PATCH v4 22/33] hostmem-epc: Add the reset interface for EPC backend reset Yang Zhong
2021-09-10 15:10   ` Paolo Bonzini
2021-09-10 15:34     ` Sean Christopherson
2021-09-10 17:09       ` Paolo Bonzini
2021-09-10 17:34         ` Sean Christopherson
2021-09-10 19:51           ` Paolo Bonzini
2021-09-10 20:21             ` Sean Christopherson
2021-09-10 20:57               ` Paolo Bonzini
2021-09-13 20:17     ` Jarkko Sakkinen
2021-09-13 20:37       ` Sean Christopherson
2021-09-13 21:23         ` Jarkko Sakkinen
2021-07-19 11:21 ` [PATCH v4 23/33] sgx-epc: Add the reset interface for sgx-epc virt device Yang Zhong
2021-09-10 15:13   ` Paolo Bonzini
2021-09-14  6:53   ` Philippe Mathieu-Daudé
2021-09-15 11:33     ` Yang Zhong
2021-07-19 11:21 ` [PATCH v4 24/33] sgx-epc: Avoid bios reset during sgx epc initialization Yang Zhong
2021-07-19 11:21 ` [PATCH v4 25/33] hostmem-epc: Make prealloc consistent with qemu cmdline during reset Yang Zhong
2021-07-19 11:21 ` [PATCH v4 26/33] qmp: Add query-sgx command Yang Zhong
2021-07-19 11:21 ` [PATCH v4 27/33] hmp: Add 'info sgx' command Yang Zhong
2021-07-19 11:21 ` [PATCH v4 28/33] i386: Add sgx_get_info() interface Yang Zhong
2021-07-19 11:21 ` [PATCH v4 29/33] bitops: Support 32 and 64 bit mask macro Yang Zhong
2021-07-19 11:21 ` [PATCH v4 30/33] qmp: Add the qmp_query_sgx_capabilities() Yang Zhong
2021-07-19 11:21 ` [PATCH v4 31/33] Kconfig: Add CONFIG_SGX support Yang Zhong
2021-07-19 11:21 ` [PATCH v4 32/33] sgx-epc: Add the fill_device_info() callback support Yang Zhong
2021-07-19 11:21 ` [PATCH v4 33/33] doc: Add the SGX doc Yang Zhong
2021-07-28 15:57 ` [PATCH v4 00/33] Qemu SGX virtualization Paolo Bonzini
2021-07-29 12:27   ` Yang Zhong
2021-09-06 13:13 ` Paolo Bonzini
2021-09-07  2:24   ` Yang Zhong
2021-09-07  9:51   ` Yang Zhong
2021-09-07 13:35     ` Jarkko Sakkinen
2021-09-08  6:00     ` Paolo Bonzini
2021-09-14  6:51 ` Philippe Mathieu-Daudé
2021-09-15 12:24   ` Yang Zhong

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.