From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Eduardo Habkost <ehabkost@redhat.com>,
Igor Mammedov <imammedo@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
Marcel Apfelbaum <marcel.apfelbaum@gmail.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Richard Henderson <rth@twiddle.net>,
Cornelia Huck <cohuck@redhat.com>, Eric Blake <eblake@redhat.com>,
Markus Armbruster <armbru@redhat.com>,
Marcelo Tosatti <mtosatti@redhat.com>
Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org
Subject: [RFC PATCH 01/20] hostmem: Add hostmem-epc as a backend for SGX EPC
Date: Tue, 6 Aug 2019 11:56:30 -0700 [thread overview]
Message-ID: <20190806185649.2476-2-sean.j.christopherson@intel.com> (raw)
In-Reply-To: <20190806185649.2476-1-sean.j.christopherson@intel.com>
EPC (Enclave Page Cache) is a specialized type of memory used by Intel
SGX (Software Guard Extensions). The SDM desribes EPC as:
The Enclave Page Cache (EPC) is the secure storage used to store
enclave pages when they are a part of an executing enclave. For an
EPC page, hardware performs additional access control checks to
restrict access to the page. After the current page access checks
and translations are performed, the hardware checks that the EPC
page is accessible to the program currently executing. Generally an
EPC page is only accessed by the owner of the executing enclave or
an instruction which is setting up an EPC page.
Because of its unique requirements, Linux manages EPC separately from
normal memory. Similar to memfd, the device /dev/sgx/virt_epc can be
opened to obtain a file descriptor which can in turn be used to mmap()
EPC memory.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
backends/Makefile.objs | 1 +
backends/hostmem-epc.c | 91 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 92 insertions(+)
create mode 100644 backends/hostmem-epc.c
diff --git a/backends/Makefile.objs b/backends/Makefile.objs
index 981e8e122f..6e96549c5e 100644
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -17,3 +17,4 @@ endif
common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_VIRTIO)) += vhost-user.o
common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
+common-obj-$(CONFIG_LINUX) += hostmem-epc.o
diff --git a/backends/hostmem-epc.c b/backends/hostmem-epc.c
new file mode 100644
index 0000000000..24a22dede5
--- /dev/null
+++ b/backends/hostmem-epc.c
@@ -0,0 +1,91 @@
+/*
+ * QEMU host SGX EPC memory backend
+ *
+ * Copyright (C) 2019 Intel Corporation
+ *
+ * Authors:
+ * Sean Christopherson <sean.j.christopherson@intel.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include <sys/ioctl.h>
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qom/object_interfaces.h"
+#include "qapi/error.h"
+#include "sysemu/hostmem.h"
+
+#define TYPE_MEMORY_BACKEND_EPC "memory-backend-epc"
+
+#define MEMORY_BACKEND_EPC(obj) \
+ OBJECT_CHECK(HostMemoryBackendEpc, (obj), TYPE_MEMORY_BACKEND_EPC)
+
+typedef struct HostMemoryBackendEpc HostMemoryBackendEpc;
+
+struct HostMemoryBackendEpc {
+ HostMemoryBackend parent_obj;
+};
+
+static void
+sgx_epc_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
+{
+ char *name;
+ int fd;
+
+ if (!backend->size) {
+ error_setg(errp, "can't create backend with size 0");
+ return;
+ }
+ backend->force_prealloc = mem_prealloc;
+
+ fd = open("/dev/sgx/virt_epc", O_RDWR);
+ if (fd < 0) {
+ error_setg_errno(errp, errno,
+ "failed to open /dev/sgx/virt_epc to alloc SGX EPC");
+ return;
+ }
+
+ name = object_get_canonical_path(OBJECT(backend));
+ memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
+ name, backend->size,
+ backend->share, fd, errp);
+ g_free(name);
+}
+
+static void sgx_epc_backend_instance_init(Object *obj)
+{
+ HostMemoryBackend *m = MEMORY_BACKEND(obj);
+
+ m->share = true;
+ m->merge = false;
+ m->dump = false;
+}
+
+static void sgx_epc_backend_class_init(ObjectClass *oc, void *data)
+{
+ HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
+
+ bc->alloc = sgx_epc_backend_memory_alloc;
+}
+
+static const TypeInfo sgx_epc_backed_info = {
+ .name = TYPE_MEMORY_BACKEND_EPC,
+ .parent = TYPE_MEMORY_BACKEND,
+ .instance_init = sgx_epc_backend_instance_init,
+ .class_init = sgx_epc_backend_class_init,
+ .instance_size = sizeof(HostMemoryBackendEpc),
+};
+
+static void register_types(void)
+{
+ int fd = open("/dev/sgx/virt_epc", O_RDWR);
+ if (fd >= 0) {
+ close(fd);
+
+ type_register_static(&sgx_epc_backed_info);
+ }
+}
+
+type_init(register_types);
--
2.22.0
next prev parent reply other threads:[~2019-08-06 18:57 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-06 18:56 [RFC PATCH 00/20] i386: Add support for Intel SGX Sean Christopherson
2019-08-06 18:56 ` Sean Christopherson [this message]
2019-08-06 18:56 ` [RFC PATCH 02/20] i386: Add 'sgx-epc' device to expose EPC sections to guest Sean Christopherson
2019-08-07 5:57 ` [Qemu-devel] " Markus Armbruster
2019-08-06 18:56 ` [RFC PATCH 03/20] vl: Add "sgx-epc" option to expose SGX " Sean Christopherson
2019-09-06 21:49 ` [Qemu-devel] " Larry Dewey
2019-09-10 19:45 ` Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 04/20] i386: Add primary SGX CPUID and MSR defines Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 05/20] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 06/20] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 07/20] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EBX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 08/20] i386: Add get/set/migrate support for SGX LE public key hash MSRs Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 09/20] i386: Add feature control MSR dependency when SGX is enabled Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 10/20] i386: Update SGX CPUID info according to hardware/KVM/user input Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 11/20] linux-headers: Add temporary placeholder for KVM_CAP_SGX_ATTRIBUTE Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 12/20] i386: kvm: Add support for exposing PROVISIONKEY to guest Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 13/20] i386: Propagate SGX CPUID sub-leafs to KVM Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 14/20] i386: Adjust min CPUID level to 0x12 when SGX is enabled Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 15/20] hw/i386/pc: Set SGX bits in feature control fw_cfg accordingly Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 16/20] hw/i386/pc: Account for SGX EPC sections when calculating device memory Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 17/20] i386/pc: Add e820 entry for SGX EPC section(s) Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 18/20] i386: acpi: Add SGX EPC entry to ACPI tables Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 19/20] q35: Add support for SGX EPC Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 20/20] i440fx: " Sean Christopherson
2019-08-06 19:28 ` [Qemu-devel] [RFC PATCH 00/20] i386: Add support for Intel SGX no-reply
2019-08-06 20:48 ` no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190806185649.2476-2-sean.j.christopherson@intel.com \
--to=sean.j.christopherson@intel.com \
--cc=armbru@redhat.com \
--cc=cohuck@redhat.com \
--cc=eblake@redhat.com \
--cc=ehabkost@redhat.com \
--cc=imammedo@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=marcel.apfelbaum@gmail.com \
--cc=mst@redhat.com \
--cc=mtosatti@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).