From nobody Tue Feb 10 01:20:16 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=intel.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1644359901362284.7640651067984; Tue, 8 Feb 2022 14:38:21 -0800 (PST) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-303-eRliRz04Ow6IVH6yeLOCkQ-1; Tue, 08 Feb 2022 17:38:14 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C18FE1091DA2; Tue, 8 Feb 2022 22:38:07 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7CD1F5ED29; Tue, 8 Feb 2022 22:38:07 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 4BC76473D6; Tue, 8 Feb 2022 22:38:07 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 2185LZDa014435 for ; Tue, 8 Feb 2022 00:21:35 -0500 Received: by smtp.corp.redhat.com (Postfix) id 69673C01784; Tue, 8 Feb 2022 05:21:35 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast08.extmail.prod.ext.rdu2.redhat.com [10.11.55.24]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 65977C15E6F for ; Tue, 8 Feb 2022 05:21:35 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4CF1F3804527 for ; Tue, 8 Feb 2022 05:21:35 +0000 (UTC) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-272-uEBpO4NUODaAAo61v7gX8Q-3; Tue, 08 Feb 2022 00:21:32 -0500 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Feb 2022 21:21:32 -0800 Received: from sse-tme-qnx-01.jf.intel.com ([10.54.34.46]) by orsmga001.jf.intel.com with ESMTP; 07 Feb 2022 21:21:32 -0800 X-MC-Unique: eRliRz04Ow6IVH6yeLOCkQ-1 X-MC-Unique: uEBpO4NUODaAAo61v7gX8Q-3 X-IronPort-AV: E=McAfee;i="6200,9189,10251"; a="248638137" X-IronPort-AV: E=Sophos;i="5.88,351,1635231600"; d="scan'208";a="248638137" X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.88,351,1635231600"; d="scan'208";a="567729247" From: Haibin Huang To: libvir-list@redhat.com, haibin.huang@intel.com, berrange@redhat.com, jian-feng.ding@intel.com, lin.a.yang@intel.com, lianhao.lu@intel.com Subject: [libvirt][PATCH RESEND v10 2/5] conf: expose SGX feature in domain capabilities Date: Mon, 7 Feb 2022 21:21:17 -0800 Message-Id: <20220208052120.14239-3-haibin.huang@intel.com> In-Reply-To: <20220208052120.14239-1-haibin.huang@intel.com> References: <20220208052120.14239-1-haibin.huang@intel.com> X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 2 X-Mimecast-Originator: redhat.com X-ZM-MESSAGEID: 1644359903096100001 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Extend hypervisor capabilities to include sgx feature. When available, the hypervisor supports launching an VM with SGX on Intel platfrom. The SGX feature tag privides additional details like section size and sgx1 or sgx2. Signed-off-by: Haibin Huang --- docs/formatdomaincaps.html.in | 26 ++++++++++++++++++++++++++ docs/schemas/domaincaps.rng | 22 +++++++++++++++++++++- src/conf/domain_capabilities.c | 21 +++++++++++++++++++++ src/qemu/qemu_capabilities.c | 24 ++++++++++++++++++++++++ 4 files changed, 92 insertions(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.html.in b/docs/formatdomaincaps.html.in index 35b8bf3def..d932e6df80 100644 --- a/docs/formatdomaincaps.html.in +++ b/docs/formatdomaincaps.html.in @@ -598,6 +598,10 @@ <cbitpos>47</cbitpos> <reduced-phys-bits>1</reduced-phys-bits> </sev> + <sgx> + <flc>no</flc> + <epc_size>1</epc_size> + </sgx> </features> </domainCapabilities> @@ -689,5 +693,27 @@ This value may be configurable in the firmware for some hosts. =20 +

SGX capabilities

+ +

Intel Software Guard Extensions (Intel SGX) capabilities are expose= d under + the sgx element. + Intel SGX helps protect data in use via unique application isolation t= echnology. + Protect selected code and data from modification using hardened enclav= es with + Intel SGX.

+ +

+ For more details on the SGX feature, please follow resources in the + SGX developer's document store. In order to use SGX with libvirt have + a look at SGX in domain= XML +

+ +
+
flc
+
FLC (Flexible Launch Control), not strictly part of SGX2, but wa= s not part + of original SGX hardware either.
+
epc_size
+
The size of the SGX enclave page cache (called EPC).
+
+ diff --git a/docs/schemas/domaincaps.rng b/docs/schemas/domaincaps.rng index 9cbc2467ab..5ace30ae0d 100644 --- a/docs/schemas/domaincaps.rng +++ b/docs/schemas/domaincaps.rng @@ -270,6 +270,9 @@ + + + =20 @@ -330,7 +333,24 @@ =20 - + + + + + + + + + + KiB + + + + + + + + diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c index 1170fd26df..2e9f0ec225 100644 --- a/src/conf/domain_capabilities.c +++ b/src/conf/domain_capabilities.c @@ -100,6 +100,7 @@ virDomainCapsDispose(void *obj) virObjectUnref(caps->cpu.custom); virCPUDefFree(caps->cpu.hostModel); virSEVCapabilitiesFree(caps->sev); + virSGXCapabilitiesFree(caps->sgx); =20 values =3D &caps->os.loader.values; for (i =3D 0; i < values->nvalues; i++) @@ -618,6 +619,25 @@ virDomainCapsFeatureSEVFormat(virBuffer *buf, return; } =20 +static void +virDomainCapsFeatureSGXFormat(virBuffer *buf, + const virSGXCapability *sgx) +{ + if (!sgx) { + return; // will delete in test patch + virBufferAddLit(buf, "\n"); + } else { + return; // will delete in test patch + virBufferAddLit(buf, "\n"); + virBufferAdjustIndent(buf, 2); + virBufferAsprintf(buf, "%s\n", sgx->flc ? "yes" : "no"); + virBufferAsprintf(buf, "%d\n", s= gx->epc_size); + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "\n"); + } + + return; +} =20 static void virDomainCapsFormatFeatures(const virDomainCaps *caps, @@ -638,6 +658,7 @@ virDomainCapsFormatFeatures(const virDomainCaps *caps, } =20 virDomainCapsFeatureSEVFormat(&childBuf, caps->sev); + virDomainCapsFeatureSGXFormat(&childBuf, caps->sgx); =20 virXMLFormatElement(buf, "features", NULL, &childBuf); } diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 0e43dd2466..745d203241 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6632,6 +6632,29 @@ virQEMUCapsFillDomainFeatureS390PVCaps(virQEMUCaps *= qemuCaps, } } =20 +/** + * virQEMUCapsFillDomainFeatureiSGXCaps: + * @qemuCaps: QEMU capabilities + * @domCaps: domain capabilities + * + * Take the information about SGX capabilities that has been obtained + * using the 'query-sgx-capabilities' QMP command and stored in @qemuCaps + * and convert it to a form suitable for @domCaps. + */ +static void +virQEMUCapsFillDomainFeatureSGXCaps(virQEMUCaps *qemuCaps, + virDomainCaps *domCaps) +{ + virSGXCapability *cap =3D qemuCaps->sgxCapabilities; + + if (!cap) + return; + + domCaps->sgx =3D g_new0(virSGXCapability, 1); + + domCaps->sgx->flc =3D cap->flc; + domCaps->sgx->epc_size =3D cap->epc_size; +} =20 int virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps, @@ -6684,6 +6707,7 @@ virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps, virQEMUCapsFillDomainFeatureGICCaps(qemuCaps, domCaps); virQEMUCapsFillDomainFeatureSEVCaps(qemuCaps, domCaps); virQEMUCapsFillDomainFeatureS390PVCaps(qemuCaps, domCaps); + virQEMUCapsFillDomainFeatureSGXCaps(qemuCaps, domCaps); =20 return 0; } --=20 2.17.1