2021-05-21 16:34:07 +03:00
|
|
|
config X86_FW_OVMF
|
|
|
|
bool
|
|
|
|
|
2019-01-23 09:56:00 +03:00
|
|
|
config SEV
|
|
|
|
bool
|
2021-05-21 16:34:07 +03:00
|
|
|
select X86_FW_OVMF
|
2019-01-23 09:56:01 +03:00
|
|
|
depends on KVM
|
|
|
|
|
2021-07-19 14:21:34 +03:00
|
|
|
config SGX
|
|
|
|
bool
|
|
|
|
depends on KVM
|
|
|
|
|
2019-01-23 09:56:01 +03:00
|
|
|
config PC
|
|
|
|
bool
|
2019-01-23 09:56:16 +03:00
|
|
|
imply APPLESMC
|
2019-01-23 09:56:14 +03:00
|
|
|
imply HYPERV
|
2019-01-23 09:56:16 +03:00
|
|
|
imply ISA_IPMI_KCS
|
|
|
|
imply ISA_IPMI_BT
|
2017-12-06 22:36:21 +03:00
|
|
|
imply PCI_IPMI_KCS
|
|
|
|
imply PCI_IPMI_BT
|
2015-04-01 23:11:10 +03:00
|
|
|
imply IPMI_SSIF
|
2019-01-23 09:56:16 +03:00
|
|
|
imply ISA_DEBUG
|
2019-03-11 12:50:54 +03:00
|
|
|
imply PARALLEL
|
2019-01-23 09:56:16 +03:00
|
|
|
imply PCI_DEVICES
|
2021-01-27 17:59:27 +03:00
|
|
|
imply PVPANIC_ISA
|
2019-01-23 09:56:01 +03:00
|
|
|
imply QXL
|
|
|
|
imply SEV
|
2021-07-19 14:21:34 +03:00
|
|
|
imply SGX
|
2019-01-23 09:56:16 +03:00
|
|
|
imply TEST_DEVICES
|
2019-01-23 09:56:01 +03:00
|
|
|
imply TPM_CRB
|
2020-03-05 19:51:43 +03:00
|
|
|
imply TPM_TIS_ISA
|
2019-03-16 23:08:07 +03:00
|
|
|
imply VGA_PCI
|
2019-03-21 17:29:50 +03:00
|
|
|
imply VIRTIO_VGA
|
2021-05-11 18:53:50 +03:00
|
|
|
imply NVDIMM
|
2024-04-25 21:43:14 +03:00
|
|
|
imply FDC_ISA
|
2019-01-23 09:56:10 +03:00
|
|
|
select I8259
|
|
|
|
select I8254
|
2019-01-23 09:56:16 +03:00
|
|
|
select PCKBD
|
2019-01-23 09:56:10 +03:00
|
|
|
select PCSPK
|
|
|
|
select I8257
|
|
|
|
select MC146818RTC
|
2019-01-23 09:56:16 +03:00
|
|
|
# For ACPI builder:
|
|
|
|
select SERIAL_ISA
|
2019-09-09 20:34:10 +03:00
|
|
|
select ACPI_PCI
|
2019-01-23 09:56:16 +03:00
|
|
|
select ACPI_VMGENID
|
2019-06-19 12:49:07 +03:00
|
|
|
select VIRTIO_PMEM_SUPPORTED
|
2020-06-26 10:22:42 +03:00
|
|
|
select VIRTIO_MEM_SUPPORTED
|
2023-08-24 00:36:35 +03:00
|
|
|
select HV_BALLOON_SUPPORTED
|
2019-01-23 09:56:10 +03:00
|
|
|
|
|
|
|
config PC_PCI
|
|
|
|
bool
|
|
|
|
select APIC
|
|
|
|
select IOAPIC
|
|
|
|
select PC
|
|
|
|
|
|
|
|
config PC_ACPI
|
|
|
|
bool
|
|
|
|
select ACPI_X86
|
|
|
|
select ACPI_CPU_HOTPLUG
|
|
|
|
select ACPI_MEMORY_HOTPLUG
|
2023-01-12 17:03:01 +03:00
|
|
|
select ACPI_PCI_BRIDGE
|
2021-10-26 21:20:23 +03:00
|
|
|
select ACPI_VIOT
|
2019-01-23 09:56:11 +03:00
|
|
|
select SMBUS_EEPROM
|
2019-01-23 09:56:16 +03:00
|
|
|
select PFLASH_CFI01
|
2019-01-23 09:56:10 +03:00
|
|
|
depends on ACPI_SMBUS
|
2019-01-23 09:56:00 +03:00
|
|
|
|
|
|
|
config I440FX
|
|
|
|
bool
|
2024-01-25 15:36:37 +03:00
|
|
|
default y
|
|
|
|
depends on I386
|
2019-03-16 23:08:07 +03:00
|
|
|
imply E1000_PCI
|
2019-07-12 19:02:57 +03:00
|
|
|
imply VMPORT
|
2019-07-17 10:06:15 +03:00
|
|
|
imply VMMOUSE
|
2022-12-16 16:03:51 +03:00
|
|
|
select ACPI_PIIX4
|
2019-01-23 09:56:10 +03:00
|
|
|
select PC_PCI
|
|
|
|
select PC_ACPI
|
2019-02-02 23:03:07 +03:00
|
|
|
select PCI_I440FX
|
2023-10-07 15:38:27 +03:00
|
|
|
select PIIX
|
2019-01-23 09:56:10 +03:00
|
|
|
select DIMM
|
|
|
|
select SMBIOS
|
2024-03-14 18:22:52 +03:00
|
|
|
select SMBIOS_LEGACY
|
2019-01-23 09:56:10 +03:00
|
|
|
select FW_CFG_DMA
|
2019-01-23 09:56:00 +03:00
|
|
|
|
|
|
|
config ISAPC
|
|
|
|
bool
|
2024-01-25 15:36:37 +03:00
|
|
|
default y
|
|
|
|
depends on I386
|
2023-05-10 19:51:26 +03:00
|
|
|
imply VGA_ISA
|
2019-01-23 09:56:09 +03:00
|
|
|
select ISA_BUS
|
2019-01-23 09:56:10 +03:00
|
|
|
select PC
|
|
|
|
select IDE_ISA
|
|
|
|
# FIXME: it is in the same file as i440fx, and does not compile
|
|
|
|
# if separated
|
|
|
|
depends on I440FX
|
2019-01-23 09:56:00 +03:00
|
|
|
|
|
|
|
config Q35
|
|
|
|
bool
|
2024-01-25 15:36:37 +03:00
|
|
|
default y
|
|
|
|
depends on I386
|
2019-01-23 09:56:10 +03:00
|
|
|
imply VTD
|
|
|
|
imply AMD_IOMMU
|
2019-03-16 23:08:07 +03:00
|
|
|
imply E1000E_PCI_EXPRESS
|
2019-07-12 19:02:57 +03:00
|
|
|
imply VMPORT
|
2019-07-17 10:06:15 +03:00
|
|
|
imply VMMOUSE
|
2023-11-21 11:44:20 +03:00
|
|
|
imply IOMMUFD
|
2019-01-23 09:56:10 +03:00
|
|
|
select PC_PCI
|
|
|
|
select PC_ACPI
|
|
|
|
select PCI_EXPRESS_Q35
|
|
|
|
select LPC_ICH9
|
2019-02-22 17:48:11 +03:00
|
|
|
select AHCI_ICH9
|
2019-01-23 09:56:10 +03:00
|
|
|
select DIMM
|
|
|
|
select SMBIOS
|
|
|
|
select FW_CFG_DMA
|
2019-01-23 09:56:00 +03:00
|
|
|
|
2019-10-02 09:03:19 +03:00
|
|
|
config MICROVM
|
|
|
|
bool
|
2024-01-25 15:36:37 +03:00
|
|
|
default y
|
2024-04-30 22:08:15 +03:00
|
|
|
depends on I386 && FDT
|
|
|
|
select DEVICE_TREE
|
2019-12-31 21:32:05 +03:00
|
|
|
select SERIAL_ISA # for serial_hds_isa_init()
|
2019-10-02 09:03:19 +03:00
|
|
|
select ISA_BUS
|
|
|
|
select APIC
|
|
|
|
select IOAPIC
|
|
|
|
select I8259
|
|
|
|
select MC146818RTC
|
|
|
|
select VIRTIO_MMIO
|
2020-09-15 15:08:56 +03:00
|
|
|
select ACPI_HW_REDUCED
|
2020-09-28 13:42:49 +03:00
|
|
|
select PCI_EXPRESS_GENERIC_BRIDGE
|
2020-10-20 10:48:39 +03:00
|
|
|
select USB_XHCI_SYSBUS
|
2021-06-08 15:55:53 +03:00
|
|
|
select I8254
|
2019-10-02 09:03:19 +03:00
|
|
|
|
machine/nitro-enclave: New machine type for AWS Nitro Enclaves
AWS nitro enclaves[1] is an Amazon EC2[2] feature that allows creating
isolated execution environments, called enclaves, from Amazon EC2
instances which are used for processing highly sensitive data. Enclaves
have no persistent storage and no external networking. The enclave VMs
are based on the Firecracker microvm with a vhost-vsock device for
communication with the parent EC2 instance that spawned it and a Nitro
Secure Module (NSM) device for cryptographic attestation. The parent
instance VM always has CID 3 while the enclave VM gets a dynamic CID.
An EIF (Enclave Image Format)[3] file is used to boot an AWS nitro enclave
virtual machine. This commit adds support for AWS nitro enclave emulation
using a new machine type option '-M nitro-enclave'. This new machine type
is based on the 'microvm' machine type, similar to how real nitro enclave
VMs are based on Firecracker microvm. For nitro-enclave to boot from an
EIF file, the kernel and ramdisk(s) are extracted into a temporary kernel
and a temporary initrd file which are then hooked into the regular x86
boot mechanism along with the extracted cmdline. The EIF file path should
be provided using the '-kernel' QEMU option.
In QEMU, the vsock emulation for nitro enclave is added using vhost-user-
vsock as opposed to vhost-vsock. vhost-vsock doesn't support sibling VM
communication which is needed for nitro enclaves. So for the vsock
communication to CID 3 to work, another process that does the vsock
emulation in userspace must be run, for example, vhost-device-vsock[4]
from rust-vmm, with necessary vsock communication support in another
guest VM with CID 3. Using vhost-user-vsock also enables the possibility
to implement some proxying support in the vhost-user-vsock daemon that
will forward all the packets to the host machine instead of CID 3 so
that users of nitro-enclave can run the necessary applications in their
host machine instead of running another whole VM with CID 3. The following
mandatory nitro-enclave machine option has been added related to the
vhost-user-vsock device.
- 'vsock': The chardev id from the '-chardev' option for the
vhost-user-vsock device.
AWS Nitro Enclaves have built-in Nitro Secure Module (NSM) device which
has been added using the virtio-nsm device added in a previous commit.
In Nitro Enclaves, all the PCRs start in a known zero state and the first
16 PCRs are locked from boot and reserved. The PCR0, PCR1, PCR2 and PCR8
contain the SHA384 hashes related to the EIF file used to boot the VM
for validation. The following optional nitro-enclave machine options
have been added related to the NSM device.
- 'id': Enclave identifier, reflected in the module-id of the NSM
device. If not provided, a default id will be set.
- 'parent-role': Parent instance IAM role ARN, reflected in PCR3
of the NSM device.
- 'parent-id': Parent instance identifier, reflected in PCR4 of the
NSM device.
[1] https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html
[2] https://aws.amazon.com/ec2/
[3] https://github.com/aws/aws-nitro-enclaves-image-format
[4] https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-vsock
Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com>
Reviewed-by: Alexander Graf <graf@amazon.com>
Link: https://lore.kernel.org/r/20241008211727.49088-6-dorjoychy111@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-09 00:17:26 +03:00
|
|
|
config NITRO_ENCLAVE
|
|
|
|
default y
|
|
|
|
depends on I386 && FDT # for MICROVM
|
|
|
|
depends on LIBCBOR && GNUTLS # for EIF and VIRTIO_NSM
|
|
|
|
depends on VHOST_USER # for VHOST_USER_VSOCK
|
|
|
|
select EIF
|
|
|
|
select MICROVM
|
|
|
|
select VHOST_USER_VSOCK
|
|
|
|
select VIRTIO_NSM
|
|
|
|
|
2019-12-12 20:10:35 +03:00
|
|
|
config X86_IOMMU
|
|
|
|
bool
|
|
|
|
depends on PC
|
|
|
|
|
2019-01-23 09:56:00 +03:00
|
|
|
config VTD
|
|
|
|
bool
|
2019-12-12 20:10:35 +03:00
|
|
|
select X86_IOMMU
|
2019-01-23 09:56:00 +03:00
|
|
|
|
|
|
|
config AMD_IOMMU
|
|
|
|
bool
|
2019-12-12 20:10:35 +03:00
|
|
|
select X86_IOMMU
|
2019-01-23 09:56:00 +03:00
|
|
|
|
|
|
|
config VMPORT
|
|
|
|
bool
|
|
|
|
|
|
|
|
config VMMOUSE
|
|
|
|
bool
|
2019-01-23 09:56:10 +03:00
|
|
|
depends on VMPORT
|
2022-12-06 12:03:48 +03:00
|
|
|
|
|
|
|
config XEN_EMU
|
|
|
|
bool
|
|
|
|
default y
|
2024-01-25 15:36:37 +03:00
|
|
|
depends on KVM && I386
|