Re: [PULL v4 35/43] Kconfig: Add CONFIG_SGX support

["Philippe Mathieu-Daudé" <philmd@redhat.com>]

On 9/8/21 12:04 PM, Paolo Bonzini wrote:
> From: Yang Zhong <yang.zhong@intel.com>
> 
> Add new CONFIG_SGX for sgx support in the Qemu, and the Kconfig
> default enable sgx in the i386 platform.
> 
> Signed-off-by: Yang Zhong <yang.zhong@intel.com>
> Message-Id: <20210719112136.57018-32-yang.zhong@intel.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  backends/meson.build                     |  2 +-
>  configs/devices/i386-softmmu/default.mak |  1 +
>  hw/i386/Kconfig                          |  5 +++++
>  hw/i386/meson.build                      |  4 ++--
>  hw/i386/sgx-stub.c                       | 13 +++++++++++++
>  5 files changed, 22 insertions(+), 3 deletions(-)
>  create mode 100644 hw/i386/sgx-stub.c
> 
> diff --git a/backends/meson.build b/backends/meson.build
> index 46fd16b269..6e68945528 100644
> --- a/backends/meson.build
> +++ b/backends/meson.build
> @@ -16,6 +16,6 @@ softmmu_ss.add(when: ['CONFIG_VHOST_USER', 'CONFIG_VIRTIO'], if_true: files('vho
>  softmmu_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('cryptodev-vhost.c'))
>  softmmu_ss.add(when: ['CONFIG_VIRTIO_CRYPTO', 'CONFIG_VHOST_CRYPTO'], if_true: files('cryptodev-vhost-user.c'))
>  softmmu_ss.add(when: 'CONFIG_GIO', if_true: [files('dbus-vmstate.c'), gio])
> -softmmu_ss.add(when: 'CONFIG_LINUX', if_true: files('hostmem-epc.c'))
> +softmmu_ss.add(when: 'CONFIG_SGX', if_true: files('hostmem-epc.c'))
>  
>  subdir('tpm')
> diff --git a/configs/devices/i386-softmmu/default.mak b/configs/devices/i386-softmmu/default.mak
> index 84d1a2487c..598c6646df 100644
> --- a/configs/devices/i386-softmmu/default.mak
> +++ b/configs/devices/i386-softmmu/default.mak
> @@ -22,6 +22,7 @@
>  #CONFIG_TPM_CRB=n
>  #CONFIG_TPM_TIS_ISA=n
>  #CONFIG_VTD=n
> +#CONFIG_SGX=n
>  
>  # Boards:
>  #
> diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
> index ddedcef0b2..962d2c981b 100644
> --- a/hw/i386/Kconfig
> +++ b/hw/i386/Kconfig
> @@ -6,6 +6,10 @@ config SEV
>      select X86_FW_OVMF
>      depends on KVM
>  
> +config SGX
> +    bool
> +    depends on KVM
> +
>  config PC
>      bool
>      imply APPLESMC
> @@ -21,6 +25,7 @@ config PC
>      imply PVPANIC_ISA
>      imply QXL
>      imply SEV
> +    imply SGX
>      imply SGA
>      imply TEST_DEVICES
>      imply TPM_CRB
> diff --git a/hw/i386/meson.build b/hw/i386/meson.build
> index fefce9e4ba..c502965219 100644
> --- a/hw/i386/meson.build
> +++ b/hw/i386/meson.build
> @@ -5,8 +5,6 @@ i386_ss.add(files(
>    'e820_memory_layout.c',
>    'multiboot.c',
>    'x86.c',
> -  'sgx-epc.c',
> -  'sgx.c'
>  ))
>  
>  i386_ss.add(when: 'CONFIG_X86_IOMMU', if_true: files('x86-iommu.c'),
> @@ -18,6 +16,8 @@ i386_ss.add(when: 'CONFIG_Q35', if_true: files('pc_q35.c'))
>  i386_ss.add(when: 'CONFIG_VMMOUSE', if_true: files('vmmouse.c'))
>  i386_ss.add(when: 'CONFIG_VMPORT', if_true: files('vmport.c'))
>  i386_ss.add(when: 'CONFIG_VTD', if_true: files('intel_iommu.c'))
> +i386_ss.add(when: 'CONFIG_SGX', if_true: files('sgx-epc.c','sgx.c'),
> +                                if_false: files('sgx-stub.c'))
>  
>  i386_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-common.c'))
>  i386_ss.add(when: 'CONFIG_ACPI_HW_REDUCED', if_true: files('generic_event_device_x86.c'))
> diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
> new file mode 100644
> index 0000000000..edf17c3309
> --- /dev/null
> +++ b/hw/i386/sgx-stub.c

Ah, here comes the stub.

> @@ -0,0 +1,13 @@
> +#include "qemu/osdep.h"
> +#include "hw/i386/pc.h"
> +#include "hw/i386/sgx-epc.h"
> +
> +void pc_machine_init_sgx_epc(PCMachineState *pcms)
> +{
> +    return;

Nack.

If an user tries to use sgx-epc.0.memdev=memid with a build with SGX
not built in, you silently ignore the security request and keep booting
the machine... Use something like:

    error_report("Support for SGX EPC not built-in");
    exit(EXIT_FAILURE);

Or better pass an Error* argument to pc_machine_init_sgx_epc() to
propagate the error.

> +}
> +
> +int sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size)
> +{
> +    return 1;

No, this code is unreachable:

       g_assert_not_reached();

> +}
>