qemu/hw/i386/Kconfig

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

165 lines
2.8 KiB
Plaintext
Raw Permalink Normal View History

config X86_FW_OVMF
bool
config SEV
bool
select X86_FW_OVMF
depends on KVM
config SGX
bool
depends on KVM
config PC
bool
imply APPLESMC
imply HYPERV
imply ISA_IPMI_KCS
imply ISA_IPMI_BT
imply PCI_IPMI_KCS
imply PCI_IPMI_BT
imply IPMI_SSIF
imply ISA_DEBUG
imply PARALLEL
imply PCI_DEVICES
imply PVPANIC_ISA
imply QXL
imply SEV
imply SGX
imply TEST_DEVICES
imply TPM_CRB
imply TPM_TIS_ISA
imply VGA_PCI
imply VIRTIO_VGA
imply NVDIMM
imply FDC_ISA
select I8259
select I8254
select PCKBD
select PCSPK
select I8257
select MC146818RTC
# For ACPI builder:
select SERIAL_ISA
select ACPI_PCI
select ACPI_VMGENID
select VIRTIO_PMEM_SUPPORTED
select VIRTIO_MEM_SUPPORTED
select HV_BALLOON_SUPPORTED
config PC_PCI
bool
select APIC
select IOAPIC
select PC
config PC_ACPI
bool
select ACPI_X86
select ACPI_CPU_HOTPLUG
select ACPI_MEMORY_HOTPLUG
select ACPI_PCI_BRIDGE
select ACPI_VIOT
select SMBUS_EEPROM
select PFLASH_CFI01
depends on ACPI_SMBUS
config I440FX
bool
default y
depends on I386
imply E1000_PCI
imply VMPORT
imply VMMOUSE
select ACPI_PIIX4
select PC_PCI
select PC_ACPI
select PCI_I440FX
select PIIX
select DIMM
select SMBIOS
select SMBIOS_LEGACY
select FW_CFG_DMA
config ISAPC
bool
default y
depends on I386
imply VGA_ISA
select ISA_BUS
select PC
select IDE_ISA
# FIXME: it is in the same file as i440fx, and does not compile
# if separated
depends on I440FX
config Q35
bool
default y
depends on I386
imply VTD
imply AMD_IOMMU
imply E1000E_PCI_EXPRESS
imply VMPORT
imply VMMOUSE
imply IOMMUFD
select PC_PCI
select PC_ACPI
select PCI_EXPRESS_Q35
select LPC_ICH9
select AHCI_ICH9
select DIMM
select SMBIOS
select FW_CFG_DMA
config MICROVM
bool
default y
depends on I386 && FDT
select DEVICE_TREE
select SERIAL_ISA # for serial_hds_isa_init()
select ISA_BUS
select APIC
select IOAPIC
select I8259
select MC146818RTC
select VIRTIO_MMIO
select ACPI_HW_REDUCED
select PCI_EXPRESS_GENERIC_BRIDGE
select USB_XHCI_SYSBUS
hw/i386/Kconfig: Add missing Kconfig dependency (runtime error) When building the 'microvm' machine stand-alone we get: $ qemu-system-x86_64 -M microvm ** ERROR:qom/object.c:714:object_new_with_type: assertion failed: (type != NULL) Bail out! ERROR:qom/object.c:714:object_new_with_type: assertion failed: (type != NULL) Aborted (core dumped) Looking at the backtrace: (gdb) bt #3 0x00007ff2330492ff in g_assertion_message_expr () at /lib64/libglib-2.0.so.0 #4 0x000055a878c18341 in object_new_with_type (type=<optimized out>) at qom/object.c:714 #5 0x000055a878c18399 in object_new (typename=typename@entry=0x55a878dec36a "isa-pit") at qom/object.c:747 #6 0x000055a878cc8146 in qdev_new (name=name@entry=0x55a878dec36a "isa-pit") at hw/core/qdev.c:153 #7 0x000055a878a8b439 in isa_new (name=name@entry=0x55a878dec36a "isa-pit") at hw/isa/isa-bus.c:160 #8 0x000055a878adb782 in i8254_pit_init (base=64, isa_irq=0, alt_irq=0x0, bus=0x55a87ab38760) at include/hw/timer/i8254.h:54 #9 microvm_devices_init (mms=0x55a87ac36800) at hw/i386/microvm.c:263 #10 microvm_machine_state_init (machine=<optimized out>) at hw/i386/microvm.c:471 #11 0x000055a878a944ab in machine_run_board_init (machine=machine@entry=0x55a87ac36800) at hw/core/machine.c:1239 The "isa-pit" type (TYPE_I8254) is missing. Add it. Fixes: 0ebf007ddac ("hw/i386: Introduce the microvm machine type") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20210616204328.2611406-24-philmd@redhat.com>
2021-06-08 15:55:53 +03:00
select I8254
machine/nitro-enclave: New machine type for AWS Nitro Enclaves AWS nitro enclaves[1] is an Amazon EC2[2] feature that allows creating isolated execution environments, called enclaves, from Amazon EC2 instances which are used for processing highly sensitive data. Enclaves have no persistent storage and no external networking. The enclave VMs are based on the Firecracker microvm with a vhost-vsock device for communication with the parent EC2 instance that spawned it and a Nitro Secure Module (NSM) device for cryptographic attestation. The parent instance VM always has CID 3 while the enclave VM gets a dynamic CID. An EIF (Enclave Image Format)[3] file is used to boot an AWS nitro enclave virtual machine. This commit adds support for AWS nitro enclave emulation using a new machine type option '-M nitro-enclave'. This new machine type is based on the 'microvm' machine type, similar to how real nitro enclave VMs are based on Firecracker microvm. For nitro-enclave to boot from an EIF file, the kernel and ramdisk(s) are extracted into a temporary kernel and a temporary initrd file which are then hooked into the regular x86 boot mechanism along with the extracted cmdline. The EIF file path should be provided using the '-kernel' QEMU option. In QEMU, the vsock emulation for nitro enclave is added using vhost-user- vsock as opposed to vhost-vsock. vhost-vsock doesn't support sibling VM communication which is needed for nitro enclaves. So for the vsock communication to CID 3 to work, another process that does the vsock emulation in userspace must be run, for example, vhost-device-vsock[4] from rust-vmm, with necessary vsock communication support in another guest VM with CID 3. Using vhost-user-vsock also enables the possibility to implement some proxying support in the vhost-user-vsock daemon that will forward all the packets to the host machine instead of CID 3 so that users of nitro-enclave can run the necessary applications in their host machine instead of running another whole VM with CID 3. The following mandatory nitro-enclave machine option has been added related to the vhost-user-vsock device. - 'vsock': The chardev id from the '-chardev' option for the vhost-user-vsock device. AWS Nitro Enclaves have built-in Nitro Secure Module (NSM) device which has been added using the virtio-nsm device added in a previous commit. In Nitro Enclaves, all the PCRs start in a known zero state and the first 16 PCRs are locked from boot and reserved. The PCR0, PCR1, PCR2 and PCR8 contain the SHA384 hashes related to the EIF file used to boot the VM for validation. The following optional nitro-enclave machine options have been added related to the NSM device. - 'id': Enclave identifier, reflected in the module-id of the NSM device. If not provided, a default id will be set. - 'parent-role': Parent instance IAM role ARN, reflected in PCR3 of the NSM device. - 'parent-id': Parent instance identifier, reflected in PCR4 of the NSM device. [1] https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html [2] https://aws.amazon.com/ec2/ [3] https://github.com/aws/aws-nitro-enclaves-image-format [4] https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-vsock Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com> Reviewed-by: Alexander Graf <graf@amazon.com> Link: https://lore.kernel.org/r/20241008211727.49088-6-dorjoychy111@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-09 00:17:26 +03:00
config NITRO_ENCLAVE
default y
depends on I386 && FDT # for MICROVM
depends on LIBCBOR && GNUTLS # for EIF and VIRTIO_NSM
depends on VHOST_USER # for VHOST_USER_VSOCK
select EIF
select MICROVM
select VHOST_USER_VSOCK
select VIRTIO_NSM
config X86_IOMMU
bool
depends on PC
config VTD
bool
select X86_IOMMU
config AMD_IOMMU
bool
select X86_IOMMU
config VMPORT
bool
config VMMOUSE
bool
depends on VMPORT
config XEN_EMU
bool
default y
depends on KVM && I386