[PATCH v5 0/6] Support query and use SGX

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This patch series provides support for enabling Intel's Software Guard Extensions (SGX) feature in guest VM.
 
Giving the SGX support in QEMU is still pending for reviewing, this 
patch series is not submmited for code review, but only describe the 
SGX enabling solution design that contains changes to virConnectGetDomainCapabilities API response and domain definition. All comments/suggestions would be highly appreciated.
  
Intel Software Guard Extensions (Intel® SGX) is a set of instructions 
that increases the security of application code and data, giving them 
more protection from disclosure or modification. Developers can partition sensitive information into enclaves, which are areas of execution in memory with more security protection.
  
The typical flow looks below at very high level:
  
1. Calls virConnectGetDomainCapabilities API to domain capabilities that includes the following SGX information.
 
 <feature>
 ...
   <sgx supported='yes'> 
     <epc_size unit=’KiB’>N</epc_size>
   </sgx>
 </feature>
  
2. User requests to start a guest calling virCreateXML() with SGX requirement. 
 It should contain
  
 <launchSecurity type='sgx'>
   <epc_size unit='KiB'>N</epc_size>
 </launchSecurity>

Haibin Huang (4):
  Support to query SGX capability
  Add guest use sgx document
  Add create guest unit test
  Add get qemu and domain capabilities unit test

Lin Yang (2):
  conf: Introduce SGX related element into domain xml
  qemu: Add command-line to generate SGX EPC memory backend

 docs/formatdomain.rst                         |    28 +-
 docs/schemas/domaincaps.rng                   |    20 +
 docs/schemas/domaincommon.rng                 |    62 +-
 src/conf/domain_capabilities.c                |    29 +
 src/conf/domain_capabilities.h                |    13 +
 src/conf/domain_conf.c                        |   128 +-
 src/conf/domain_conf.h                        |    10 +
 src/conf/virconftypes.h                       |     3 +
 src/libvirt_private.syms                      |     1 +
 src/qemu/qemu_capabilities.c                  |   139 +
 src/qemu/qemu_capabilities.h                  |     6 +
 src/qemu/qemu_command.c                       |    23 +
 src/qemu/qemu_monitor.c                       |    10 +
 src/qemu/qemu_monitor.h                       |     3 +
 src/qemu/qemu_monitor_json.c                  |    87 +
 src/qemu/qemu_monitor_json.h                  |     3 +
 tests/domaincapsdata/bhyve_basic.x86_64.xml   |     1 +
 tests/domaincapsdata/bhyve_fbuf.x86_64.xml    |     1 +
 tests/domaincapsdata/bhyve_uefi.x86_64.xml    |     1 +
 tests/domaincapsdata/empty.xml                |     1 +
 tests/domaincapsdata/libxl-xenfv.xml          |     1 +
 tests/domaincapsdata/libxl-xenpv.xml          |     1 +
 .../domaincapsdata/qemu_1.5.3-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_1.5.3-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_1.5.3.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_1.6.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_1.6.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_1.6.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_1.7.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_1.7.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_1.7.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.1.1-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.1.1-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.1.1.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.10.0-q35.x86_64.xml |     1 +
 .../domaincapsdata/qemu_2.10.0-tcg.x86_64.xml |     1 +
 .../qemu_2.10.0-virt.aarch64.xml              |     1 +
 tests/domaincapsdata/qemu_2.10.0.aarch64.xml  |     1 +
 tests/domaincapsdata/qemu_2.10.0.ppc64.xml    |     1 +
 tests/domaincapsdata/qemu_2.10.0.s390x.xml    |     1 +
 tests/domaincapsdata/qemu_2.10.0.x86_64.xml   |     1 +
 .../domaincapsdata/qemu_2.11.0-q35.x86_64.xml |     1 +
 .../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml |     1 +
 tests/domaincapsdata/qemu_2.11.0.s390x.xml    |     1 +
 tests/domaincapsdata/qemu_2.11.0.x86_64.xml   |     1 +
 .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml |     1 +
 .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml |     1 +
 .../qemu_2.12.0-virt.aarch64.xml              |     1 +
 tests/domaincapsdata/qemu_2.12.0.aarch64.xml  |     1 +
 tests/domaincapsdata/qemu_2.12.0.ppc64.xml    |     1 +
 tests/domaincapsdata/qemu_2.12.0.s390x.xml    |     1 +
 tests/domaincapsdata/qemu_2.12.0.x86_64.xml   |     1 +
 .../domaincapsdata/qemu_2.4.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.4.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.5.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.5.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.6.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml  |     1 +
 .../qemu_2.6.0-virt.aarch64.xml               |     1 +
 tests/domaincapsdata/qemu_2.6.0.aarch64.xml   |     1 +
 tests/domaincapsdata/qemu_2.6.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_2.6.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.7.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.7.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_2.7.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.8.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.8.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_2.8.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_2.9.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_2.9.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_2.9.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_2.9.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_3.0.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_3.0.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_3.0.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_3.0.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_3.1.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_3.1.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_3.1.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_4.0.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml  |     1 +
 .../qemu_4.0.0-virt.aarch64.xml               |     1 +
 tests/domaincapsdata/qemu_4.0.0.aarch64.xml   |     1 +
 tests/domaincapsdata/qemu_4.0.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_4.0.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_4.0.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_4.1.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_4.1.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml  |     1 +
 .../qemu_4.2.0-virt.aarch64.xml               |     1 +
 tests/domaincapsdata/qemu_4.2.0.aarch64.xml   |     1 +
 tests/domaincapsdata/qemu_4.2.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_4.2.0.s390x.xml     |     1 +
 tests/domaincapsdata/qemu_4.2.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml  |     1 +
 .../qemu_5.0.0-virt.aarch64.xml               |     1 +
 tests/domaincapsdata/qemu_5.0.0.aarch64.xml   |     1 +
 tests/domaincapsdata/qemu_5.0.0.ppc64.xml     |     1 +
 tests/domaincapsdata/qemu_5.0.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml  |     1 +
 .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml  |     1 +
 tests/domaincapsdata/qemu_5.1.0.x86_64.xml    |     1 +
 .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml  |   210 +
 .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml  |   204 +
 tests/domaincapsdata/qemu_5.2.0.x86_64.xml    |   210 +
 .../launch-security-sgx.xml                   |    20 +
 tests/genericxml2xmltest.c                    |     1 +
 .../caps_5.2.0.x86_64.replies                 | 29694 ++++++++++++++++
 .../caps_5.2.0.x86_64.xml                     |  3194 ++
 .../launch-security-sgx.x86_64-5.1.0.args     |    40 +
 .../qemuxml2argvdata/launch-security-sgx.xml  |    34 +
 tests/qemuxml2argvtest.c                      |     1 +
 122 files changed, 34214 insertions(+), 55 deletions(-)
 create mode 100644 tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml
 create mode 100644 tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml
 create mode 100644 tests/domaincapsdata/qemu_5.2.0.x86_64.xml
 create mode 100644 tests/genericxml2xmlindata/launch-security-sgx.xml
 create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.replies
 create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml
 create mode 100644 tests/qemuxml2argvdata/launch-security-sgx.x86_64-5.1.0.args
 create mode 100644 tests/qemuxml2argvdata/launch-security-sgx.xml

-- 
2.17.1




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux