system/i386/sgx.rst

5 --------
16 -----------
36 require -maxmem as EPC is not treated as {cold,hot}plugged memory.
43 The following QEMU snippet creates two EPC sections, with 64M pre-allocated
46  -object memory-backend-epc,id=mem1,size=64M,prealloc=on \
47  -object memory-backend-epc,id=mem2,size=28M \
48  -M sgx-epc.0.memdev=mem1,sgx-epc.1.memdev=mem2
79 in any of QEMU's built-in CPU configuration. To expose SGX (and SGX Launch
80 Control) to a guest, you must either use ``-cpu host`` to pass-through the
81 host CPU model, or explicitly enable SGX when using a built-in CPU model,
82 e.g. via ``-cpu <model>,+sgx`` or ``-cpu <model>,+sgx,+sgxlc``.
84 All SGX sub-features enumerated through CPUID, e.g. SGX2, MISCSELECT,
87 i.e. may marginally reduce SGX performance in the guest. All SGX sub-features
88 controlled via -cpu are prefixed with "sgx", e.g.::
90   $ qemu-system-x86_64 -cpu help | xargs printf "%s\n" | grep sgx
92   sgx-debug
93   sgx-encls-c
94   sgx-enclv
95   sgx-exinfo
96   sgx-kss
97   sgx-mode64
98   sgx-provisionkey
99   sgx-tokenkey
107  -cpu host,-sgx-provisionkey,-sgx-tokenkey
109 SGX sub-features cannot be emulated, i.e. sub-features that are not present
110 in hardware cannot be forced on via '-cpu'.
121 the LC configuration to a non-Intel value is left to guest firmware.  Unlike
135 -----------------
139 .. parsed-literal::
142    -cpu host,+sgx-provisionkey \\
143    -object memory-backend-epc,id=mem1,size=64M,prealloc=on \\
144    -M sgx-epc.0.memdev=mem1,sgx-epc.0.node=0
146 Utilizing SGX in the guest requires a kernel/OS with SGX support.
154   [    0.182807] sgx: EPC section 0x140000000-0x143ffffff
159 .. parsed-literal::
162    -cpu host,+sgx-provisionkey \\
163    -object memory-backend-ram,size=2G,host-nodes=0,policy=bind,id=node0 \\
164    -object memory-backend-epc,id=mem0,size=64M,prealloc=on,host-nodes=0,policy=bind \\
165    -numa node,nodeid=0,cpus=0-1,memdev=node0 \\
166    -object memory-backend-ram,size=2G,host-nodes=1,policy=bind,id=node1 \\
167    -object memory-backend-epc,id=mem1,size=28M,prealloc=on,host-nodes=1,policy=bind \\
168    -numa node,nodeid=1,cpus=2-3,memdev=node1 \\
169    -M sgx-epc.0.memdev=mem0,sgx-epc.0.node=0,sgx-epc.1.memdev=mem1,sgx-epc.1.node=1
174   [    0.369937] sgx: EPC section 0x180000000-0x183ffffff
175   [    0.370259] sgx: EPC section 0x184000000-0x185bfffff
178   [    0.009981] ACPI: SRAT: Node 0 PXM 0 [mem 0x180000000-0x183ffffff]
179   [    0.009982] ACPI: SRAT: Node 1 PXM 1 [mem 0x184000000-0x185bfffff]
182 ----------
184 - `SGX Homepage <https://software.intel.com/sgx>`__
186 - `SGX SDK <https://github.com/intel/linux-sgx.git>`__
188 - SGX specification: Intel SDM Volume 3