Install VM-with-vSGX based on KVM and QEMU Quick Guide

Ubuntu上基于KVM和QEMU安装vSGX VM快速指南

最新推荐文章于 2023-02-27 14:32:19 发布

原创

最新推荐文章于 2023-02-27 14:32:19 发布 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#ubuntu #bash #linux

本文档提供了一个快速指南，详细介绍了在Ubuntu 20.04系统上，如何基于KVM和QEMU安装支持Intel SGX的虚拟机。内容包括安装前的必要条件，如主机系统支持SGX、内核版本需求，以及如何更新Ubuntu内核、构建带有SGX支持的最新QEMU，安装Libvirt，并配置AppArmor以允许QEMU访问所需的设备。

Requirements

To use Intel SGX in a virtual machine, you must meet the following requirements:

The host system must support Intel SGX.
Intel SGX must be enabled, either explicitly in the BIOS or via the software enabling procedure.
If you want to use Flexible Launch Control in guest systems, the hardware must also support the feature.
You must run Linux kernel version 5.13 or later, on the host and in the guest VMs.

Notes: Our Host OS is Ubuntu 20.04, and the device has FLC support.

Installation Procedure

Update ubuntu kernel

# Download the latest kernel v5.16-rc8
wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16-rc8/amd64/linux-headers-5.16.0-051600rc8-generic_5.16.0-051600rc8.202201022330_amd64.deb
wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16-rc8/amd64/linux-headers-5.16.0-051600rc8_5.16.0-051600rc8.202201022330_all.deb
wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16-rc8/amd64/linux-image-unsigned-5.16.0-051600rc8-generic_5.16.0-051600rc8.202201022330_amd64.deb
wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.16-rc8/amd64/linux-modules-5.16.0-051600rc8-generic_5.16.0-051600rc8.202201022330_amd64.deb

# Install Kernel
sudo dpkg -i *.deb

# It will have some issue like missed the libssl3 support, fix it by the workaround
# Add the following line at the end of /etc/apt/sources.list
deb http://cz.archive.ubuntu.com/ubuntu jammy main
sudo apt update
sudo apt install libssl3

# Check the kernel
grep -A100 submenu  /boot/grub/grub.cfg |grep menuentry

# Reboot to the new kernel (by default)
sudo reboot

# Verify the SGX
$ dmesg | grep sgx
[    3.748768] sgx: EPC section 0x2000c00000-0x207f7fffff
[    3.753699] sgx: EPC section 0x4000c00000-0x407fffffff

Build the latest Qemu (which already has SGX support)

# Download qemu code
git clone https://github.com/qemu/qemu

# Install the requirements
sudo apt install git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev

sudo apt install git-email libaio-dev libbluetooth-dev libbrlapi-dev libbz2-dev li