summary refs log tree commit diff stats
path: root/hw/i386/sgx-stub.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* qapi: make SGX commands unconditionally availableDaniel P. Berrangé2025-05-281-1/+1
| | | | | | | | | | | | | | | | | This removes the TARGET_I386 condition from the SGX confidential virtualization commands, moving them to the recently introduced misc-i386.json QAPI file, given they are inherantly i386 specific commands. Observe a pre-existing bug that the "SGXEPCSection" struct lacked a TARGET_I386 condition, despite its only usage being behind a TARGET_I386 condition. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250522190542.588267-6-pierrick.bouvier@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com>
* qapi/misc-target: Rename SGXInfo to SgxInfoZhao Liu2025-05-201-2/+2
| | | | | | | | | | | | QAPI requires strict PascalCase naming style, i.e., only the first letter of a single word is allowed to be uppercase, which could help with readability. Rename SGXInfo to SgxInfo. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250516091130.2374221-3-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386/cpu: Mask off SGX/SGX_LC feature words for non-PC machineZhao Liu2024-07-311-0/+5
| | | | | | | | | Only PC machine supports SGX, so mask off SGX related feature words for non-PC machine (microvm). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20240730045544.2516284-5-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: the sgx_epc_get_section stub is reachablePaolo Bonzini2023-12-311-1/+1
| | | | | | | | | | | | The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It should not assert, instead it should just return true just like the "real" sgx_epc_get_section does when SGX is disabled. Reported-by: Vladimír Beneš <vbenes@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20220201190941.106001-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* numa: Enable numa for SGX EPC sectionsYang Zhong2021-12-101-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The basic SGX did not enable numa for SGX EPC sections, which result in all EPC sections located in numa node 0. This patch enable SGX numa function in the guest and the EPC section can work with RAM as one numa node. The Guest kernel related log: [ 0.009981] ACPI: SRAT: Node 0 PXM 0 [mem 0x180000000-0x183ffffff] [ 0.009982] ACPI: SRAT: Node 1 PXM 1 [mem 0x184000000-0x185bfffff] The SRAT table can normally show SGX EPC sections menory info in different numa nodes. The SGX EPC numa related command: ...... -m 4G,maxmem=20G \ -smp sockets=2,cores=2 \ -cpu host,+sgx-provisionkey \ -object memory-backend-ram,size=2G,host-nodes=0,policy=bind,id=node0 \ -object memory-backend-epc,id=mem0,size=64M,prealloc=on,host-nodes=0,policy=bind \ -numa node,nodeid=0,cpus=0-1,memdev=node0 \ -object memory-backend-ram,size=2G,host-nodes=1,policy=bind,id=node1 \ -object memory-backend-epc,id=mem1,size=28M,prealloc=on,host-nodes=1,policy=bind \ -numa node,nodeid=1,cpus=2-3,memdev=node1 \ -M sgx-epc.0.memdev=mem0,sgx-epc.0.node=0,sgx-epc.1.memdev=mem1,sgx-epc.1.node=1 \ ...... Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20211101162009.62161-2-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386/sgx: Move qmp_query_sgx() and hmp_info_sgx() to hw/i386/sgx.cPhilippe Mathieu-Daudé2021-10-131-2/+8
| | | | | | | | | | | Move qmp_query_sgx() and hmp_info_sgx() from target/i386/monitor.c to hw/i386/sgx.c, removing the sgx_get_info() indirection and the "hw/i386/sgx.h" header. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211007175612.496366-5-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386/sgx: Move qmp_query_sgx_capabilities() to hw/i386/sgx.cPhilippe Mathieu-Daudé2021-10-131-1/+3
| | | | | | | | | | Move qmp_query_sgx_capabilities() from target/i386/monitor.c to hw/i386/sgx.c, removing the sgx_get_capabilities() indirection. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211007175612.496366-4-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386/sgx: Have sgx_epc_get_section() return a booleanPhilippe Mathieu-Daudé2021-10-131-1/+1
| | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211007175612.496366-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Add the query-sgx-capabilities QMP commandYang Zhong2021-09-301-0/+6
| | | | | | | | | Libvirt can use query-sgx-capabilities to get the host sgx capabilities to decide how to allocate SGX EPC size to VM. Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20210910102258.46648-3-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Add HMP and QMP interfaces for SGXYang Zhong2021-09-301-0/+7
| | | | | | | | | The QMP and HMP interfaces can be used by monitor or QMP tools to retrieve the SGX information from VM side when SGX is enabled on Intel platform. Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20210910102258.46648-2-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* i386: Update SGX CPUID info according to hardware/KVM/user inputSean Christopherson2021-09-301-0/+13
Expose SGX to the guest if and only if KVM is enabled and supports virtualization of SGX. While the majority of ENCLS can be emulated to some degree, because SGX uses a hardware-based root of trust, the attestation aspects of SGX cannot be emulated in software, i.e. ultimately emulation will fail as software cannot generate a valid quote/report. The complexity of partially emulating SGX in Qemu far outweighs the value added, e.g. an SGX specific simulator for userspace applications can emulate SGX for development and testing purposes. Note, access to the PROVISIONKEY is not yet advertised to the guest as KVM blocks access to the PROVISIONKEY by default and requires userspace to provide additional credentials (via ioctl()) to expose PROVISIONKEY. Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20210719112136.57018-13-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>