Proxmox and SGX instruction

[elite128]

Good afternoonHas anyone had a successful experience of dropping SGX into a virtual machine?Everything is fine on the host, the keys are generated, when choosing a host processor in the virtual machine, there are instructions, but the keys are not generated
If add flags manually in config - SGX not transfered
flags=+sgx-provisionkey;+sgx-tokenkey;+sgx1;+sgxlc;+sgx-kss;+sgx-debug;+sgx-mode64

On proxmox host all ok
Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.21.100.3

Warning: platform manifest is not available or current platform is not multi-package platform.

Please input the pccs password, and use "Enter key" to end
Error: network error, please check the network setting or whether the cache server is down.
/tmp/pckid.csv has been generated successfully, however the data couldn't be sent to cache server!

Virtual host

root@test:~# cpuid |grep SGX
SGX: Software Guard Extensions supported = true
SGX_LC: SGX launch config supported = true
Software Guard Extensions (SGX) capability (0x12/0):
SGX1 supported = true
SGX2 supported = true
SGX ENCLV E*VIRTCHILD, ESETCONTEXT = false
SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):
SGX: Software Guard Extensions supported = true
SGX_LC: SGX launch config supported = true
Software Guard Extensions (SGX) capability (0x12/0):
SGX1 supported = true
SGX2 supported = true
SGX ENCLV E*VIRTCHILD, ESETCONTEXT = false
SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):
SGX: Software Guard Extensions supported = true
SGX_LC: SGX launch config supported = true
Software Guard Extensions (SGX) capability (0x12/0):
SGX1 supported = true
SGX2 supported = true
SGX ENCLV E*VIRTCHILD, ESETCONTEXT = false
SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):
SGX: Software Guard Extensions supported = true
SGX_LC: SGX launch config supported = true
Software Guard Extensions (SGX) capability (0x12/0):
SGX1 supported = true
SGX2 supported = true
SGX ENCLV E*VIRTCHILD, ESETCONTEXT = false
SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):


Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.21.100.3

Warning: platform manifest is not available or current platform is not multi-package platform.
[get_driver_type edmm_utility.cpp:116] Failed to open Intel SGX device.
[get_driver_type /home/sgx/jenkins/ubuntuServer2004-release-build-trunk-224/build_target/PROD/label/Builder-UbuntuSrv20/label_exp/ubuntu64/linux-trunk-opensource/psw/urts/linux/edmm_utility.cpp:116] Failed to open Intel SGX device.
Error, call sgx_create_enclave: fail [load_enclave], SGXError:2006.

 

[elite128]

on host at the end grep

SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x3):

On VM

SGX attributes: ECREATE SECS.ATTRIBUTES (0x12/1):
SGX Enclave Page Cache (EPC) enumeration (0x12/0x2):

 

[elite128]

args: -cpu 'host,+sgx_provisionkey,sgx-epc id=epc1,memdev=mem1 -object memory-backend-epc,id=mem1,size=64M,prealloc'



Task viewer: VM 100 - Start

OutputStatus

Stop

Download
kvm: can't apply global host-x86_64-cpu.sgx-epc id=epc1: Property 'host-x86_64-cpu.sgx-epc id' not found
TASK ERROR: start failed: QEMU exited with code 1

 

[KuDeTa]

args: -cpu host,+sgx,+sgx2,+sgx,+sgxlc,+sgx-provisionkey -object memory-backend-epc,id=mem1,size=64M,prealloc=on -M sgx-epc.0.memdev=mem1,sgx-epc.0.node=0

Worked for me