kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Eduardo Habkost <ehabkost@redhat.com>,
	Igor Mammedov <imammedo@redhat.com>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	Marcel Apfelbaum <marcel.apfelbaum@gmail.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	Richard Henderson <rth@twiddle.net>,
	Cornelia Huck <cohuck@redhat.com>, Eric Blake <eblake@redhat.com>,
	Markus Armbruster <armbru@redhat.com>,
	Marcelo Tosatti <mtosatti@redhat.com>
Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org
Subject: [RFC PATCH 01/20] hostmem: Add hostmem-epc as a backend for SGX EPC
Date: Tue,  6 Aug 2019 11:56:30 -0700	[thread overview]
Message-ID: <20190806185649.2476-2-sean.j.christopherson@intel.com> (raw)
In-Reply-To: <20190806185649.2476-1-sean.j.christopherson@intel.com>

EPC (Enclave Page Cache) is a specialized type of memory used by Intel
SGX (Software Guard Extensions).  The SDM desribes EPC as:

    The Enclave Page Cache (EPC) is the secure storage used to store
    enclave pages when they are a part of an executing enclave. For an
    EPC page, hardware performs additional access control checks to
    restrict access to the page. After the current page access checks
    and translations are performed, the hardware checks that the EPC
    page is accessible to the program currently executing. Generally an
    EPC page is only accessed by the owner of the executing enclave or
    an instruction which is setting up an EPC page.

Because of its unique requirements, Linux manages EPC separately from
normal memory.  Similar to memfd, the device /dev/sgx/virt_epc can be
opened to obtain a file descriptor which can in turn be used to mmap()
EPC memory.

Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
 backends/Makefile.objs |  1 +
 backends/hostmem-epc.c | 91 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 backends/hostmem-epc.c

diff --git a/backends/Makefile.objs b/backends/Makefile.objs
index 981e8e122f..6e96549c5e 100644
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -17,3 +17,4 @@ endif
 common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_VIRTIO)) += vhost-user.o
 
 common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
+common-obj-$(CONFIG_LINUX) += hostmem-epc.o
diff --git a/backends/hostmem-epc.c b/backends/hostmem-epc.c
new file mode 100644
index 0000000000..24a22dede5
--- /dev/null
+++ b/backends/hostmem-epc.c
@@ -0,0 +1,91 @@
+/*
+ * QEMU host SGX EPC memory backend
+ *
+ * Copyright (C) 2019 Intel Corporation
+ *
+ * Authors:
+ *   Sean Christopherson <sean.j.christopherson@intel.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include <sys/ioctl.h>
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qom/object_interfaces.h"
+#include "qapi/error.h"
+#include "sysemu/hostmem.h"
+
+#define TYPE_MEMORY_BACKEND_EPC "memory-backend-epc"
+
+#define MEMORY_BACKEND_EPC(obj)                                        \
+    OBJECT_CHECK(HostMemoryBackendEpc, (obj), TYPE_MEMORY_BACKEND_EPC)
+
+typedef struct HostMemoryBackendEpc HostMemoryBackendEpc;
+
+struct HostMemoryBackendEpc {
+    HostMemoryBackend parent_obj;
+};
+
+static void
+sgx_epc_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
+{
+    char *name;
+    int fd;
+
+    if (!backend->size) {
+        error_setg(errp, "can't create backend with size 0");
+        return;
+    }
+    backend->force_prealloc = mem_prealloc;
+
+    fd = open("/dev/sgx/virt_epc", O_RDWR);
+    if (fd < 0) {
+        error_setg_errno(errp, errno,
+                         "failed to open /dev/sgx/virt_epc to alloc SGX EPC");
+        return;
+    }
+
+    name = object_get_canonical_path(OBJECT(backend));
+    memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
+                                   name, backend->size,
+                                   backend->share, fd, errp);
+    g_free(name);
+}
+
+static void sgx_epc_backend_instance_init(Object *obj)
+{
+    HostMemoryBackend *m = MEMORY_BACKEND(obj);
+
+    m->share = true;
+    m->merge = false;
+    m->dump = false;
+}
+
+static void sgx_epc_backend_class_init(ObjectClass *oc, void *data)
+{
+    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
+
+    bc->alloc = sgx_epc_backend_memory_alloc;
+}
+
+static const TypeInfo sgx_epc_backed_info = {
+    .name = TYPE_MEMORY_BACKEND_EPC,
+    .parent = TYPE_MEMORY_BACKEND,
+    .instance_init = sgx_epc_backend_instance_init,
+    .class_init = sgx_epc_backend_class_init,
+    .instance_size = sizeof(HostMemoryBackendEpc),
+};
+
+static void register_types(void)
+{
+    int fd = open("/dev/sgx/virt_epc", O_RDWR);
+    if (fd >= 0) {
+        close(fd);
+
+        type_register_static(&sgx_epc_backed_info);
+    }
+}
+
+type_init(register_types);
-- 
2.22.0


  reply	other threads:[~2019-08-06 18:57 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-06 18:56 [RFC PATCH 00/20] i386: Add support for Intel SGX Sean Christopherson
2019-08-06 18:56 ` Sean Christopherson [this message]
2019-08-06 18:56 ` [RFC PATCH 02/20] i386: Add 'sgx-epc' device to expose EPC sections to guest Sean Christopherson
2019-08-07  5:57   ` [Qemu-devel] " Markus Armbruster
2019-08-06 18:56 ` [RFC PATCH 03/20] vl: Add "sgx-epc" option to expose SGX " Sean Christopherson
2019-09-06 21:49   ` [Qemu-devel] " Larry Dewey
2019-09-10 19:45     ` Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 04/20] i386: Add primary SGX CPUID and MSR defines Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 05/20] i386: Add SGX CPUID leaf FEAT_SGX_12_0_EAX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 06/20] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EAX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 07/20] i386: Add SGX CPUID leaf FEAT_SGX_12_1_EBX Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 08/20] i386: Add get/set/migrate support for SGX LE public key hash MSRs Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 09/20] i386: Add feature control MSR dependency when SGX is enabled Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 10/20] i386: Update SGX CPUID info according to hardware/KVM/user input Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 11/20] linux-headers: Add temporary placeholder for KVM_CAP_SGX_ATTRIBUTE Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 12/20] i386: kvm: Add support for exposing PROVISIONKEY to guest Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 13/20] i386: Propagate SGX CPUID sub-leafs to KVM Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 14/20] i386: Adjust min CPUID level to 0x12 when SGX is enabled Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 15/20] hw/i386/pc: Set SGX bits in feature control fw_cfg accordingly Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 16/20] hw/i386/pc: Account for SGX EPC sections when calculating device memory Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 17/20] i386/pc: Add e820 entry for SGX EPC section(s) Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 18/20] i386: acpi: Add SGX EPC entry to ACPI tables Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 19/20] q35: Add support for SGX EPC Sean Christopherson
2019-08-06 18:56 ` [RFC PATCH 20/20] i440fx: " Sean Christopherson
2019-08-06 19:28 ` [Qemu-devel] [RFC PATCH 00/20] i386: Add support for Intel SGX no-reply
2019-08-06 20:48 ` no-reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190806185649.2476-2-sean.j.christopherson@intel.com \
    --to=sean.j.christopherson@intel.com \
    --cc=armbru@redhat.com \
    --cc=cohuck@redhat.com \
    --cc=eblake@redhat.com \
    --cc=ehabkost@redhat.com \
    --cc=imammedo@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=marcel.apfelbaum@gmail.com \
    --cc=mst@redhat.com \
    --cc=mtosatti@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=rth@twiddle.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).