system/i386/sgx.rst

8 for memory accesses in order to provide security accesses for sensitive
9 applications and data. SGX allows an application to use its particular
11 and integrity even in the presence of privileged malware. Accesses to the
18 SGX feature is exposed to guest via SGX CPUID. Looking at SGX CPUID, we can
19 report the same CPUID info to guest as on host for most of SGX CPUID. With
20 reporting the same CPUID guest is able to use full capacity of SGX, and KVM
21 doesn't need to emulate those info.
23 The guest's EPC base and size are determined by QEMU, and KVM needs QEMU to
24 notify such info to it before it can initialize SGX for guest.
29 By default, QEMU does not assign EPC to a VM, i.e. fully enabling SGX in a VM
30 requires explicit allocation of EPC to the VM. Similar to other specialized
33 SGX EPC is enumerated through CPUID, i.e. EPC "devices" need to be realized
34 prior to realizing the vCPUs themselves, which occurs long before generic
38 QEMU does not artificially restrict the number of EPC sections exposed to a
39 guest, e.g. QEMU will happily allow you to create 64 1M EPC sections. Be aware
41 is hardwired to support only 8 EPC sections.
44 to the VM and an additional 28M mapped but not allocated::
53 to physical EPC. Because physical EPC is protected via range registers,
57 requires the size and location to be page aligned. QEMU enforces the EPC
59 To simplify the implementation, EPC is always located above 4g in the guest
67 key hierarchy are bound to the physical platform. However live migration
72 and when enclave fails to unseal sensitive information from outside, it can
73 detect such error and sensitive information can be provisioned to it again.
78 Due to its myriad dependencies, SGX is currently not listed as supported
79 in any of QEMU's built-in CPU configuration. To expose SGX (and SGX Launch
80 Control) to a guest, you must either use ``-cpu host`` to pass-through the
104 The following QEMU snippet passes through the host CPU but restricts access to
117 the ability to set/clear the CPUID flag (and by extension the associated
119 when getting/putting guest state, but QEMU does not add new controls to
120 directly modify the LC configuration.  Similar to hardware behavior, locking
121 the LC configuration to a non-Intel value is left to guest firmware.  Unlike
129 QEMU SGX updates the ``etc/msr_feature_control`` fw_cfg entry to set the SGX
137 To launch a SGX guest:
155 …[    0.183695] sgx: [Firmware Bug]: Unable to map EPC section to online node. Fallback to the NUMA…
157 To launch a SGX numa guest: