From nobody Sun Apr 12 15:43:30 2026 Delivered-To: importer2@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1713885269; cv=none; d=zohomail.com; s=zohoarc; b=hN4PAM0iFw9vWyh/efvoebbZHIev9hFWwojRbMhLcISYaIwmNa2NZ1WJnZDzW7kaylBjfDc3lRRmciRhTo1Qs2iGrr9twQ4dj1+u35mvOup7fCd/ZxcgBg8N5Wh9qZ+4fAtydRu5rkGd268C3vl6Q6Fv6G2r9+jToh4v3qZxyYk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1713885269; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=8JOqgK6T21wzwgr87RLBCecRIltf/5dHdAu0xkCFNnw=; b=ijF8XKMj24zobEwaYNpQm3ysRFdxiXxSTJWT0vnQR4Xvl06dQpyCOI8s6c0VsxYVc/WxYXbFc2pEYuZA6Zb7PSHYoRjpY/8EisBr4Ju6gXUKv2nj2Ptp6HIDOZdSq447ySFsyUuxqt4hluu/ZK97IQt+qLxEGNn4HFhEZ3sL3NM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 171388526959154.80856233150837; Tue, 23 Apr 2024 08:14:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rzHnS-00068j-Pt; Tue, 23 Apr 2024 11:11:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rzHnC-0004kV-UW for qemu-devel@nongnu.org; Tue, 23 Apr 2024 11:10:47 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rzHn7-0000Hp-VU for qemu-devel@nongnu.org; Tue, 23 Apr 2024 11:10:45 -0400 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-115-N7QJ5teiOgK963udsg0OQQ-1; Tue, 23 Apr 2024 11:10:37 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 2B44B1827109 for ; Tue, 23 Apr 2024 15:10:37 +0000 (UTC) Received: from avogadro.lan (unknown [10.39.192.70]) by smtp.corp.redhat.com (Postfix) with ESMTP id BABD9200E290 for ; Tue, 23 Apr 2024 15:10:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1713885038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8JOqgK6T21wzwgr87RLBCecRIltf/5dHdAu0xkCFNnw=; b=K0nwkbhKqq5F3j6ZbXNMdw1kRZvqdHwQYv2cqU4UhDf6m4NQdDs985OMyFS56ojjvY0o61 z7/+XThC1kbzgRFe9L9oeYbnqbuxaOgpVyYh/Es0Q16Q0N2bUfwwPRNFQY0sDBvCLZdkjG qR2/1SEG6SOUbXHEzClw9wvm062eKKk= X-MC-Unique: N7QJ5teiOgK963udsg0OQQ-1 From: Paolo Bonzini To: qemu-devel@nongnu.org Subject: [PULL 44/63] target/i386: SEV: use KVM_SEV_INIT2 if possible Date: Tue, 23 Apr 2024 17:09:32 +0200 Message-ID: <20240423150951.41600-45-pbonzini@redhat.com> In-Reply-To: <20240423150951.41600-1-pbonzini@redhat.com> References: <20240423150951.41600-1-pbonzini@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer2=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=pbonzini@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.67, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer2=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer2=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1713885270650100001 Content-Type: text/plain; charset="utf-8" Implement support for the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM virtual machine types, and the KVM_SEV_INIT2 function of KVM_MEMORY_ENCRYPT_OP. These replace the KVM_SEV_INIT and KVM_SEV_ES_INIT functions, and have several advantages: - sharing the initialization sequence with SEV-SNP and TDX - allowing arguments including the set of desired VMSA features - protection against invalid use of KVM_GET/SET_* ioctls for guests with encrypted state If the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM types are not supported, fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT (which use the default x86 VM type). Signed-off-by: Paolo Bonzini --- target/i386/kvm/kvm.c | 2 ++ target/i386/sev.c | 41 +++++++++++++++++++++++++++++++++++++---- 2 files changed, 39 insertions(+), 4 deletions(-) diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index 974586e57a1..a9e93502734 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -164,6 +164,8 @@ static int kvm_get_one_msr(X86CPU *cpu, int index, uint= 64_t *value); =20 static const char *vm_type_name[] =3D { [KVM_X86_DEFAULT_VM] =3D "default", + [KVM_X86_SEV_VM] =3D "SEV", + [KVM_X86_SEV_ES_VM] =3D "SEV-ES", }; =20 bool kvm_is_vm_type_supported(int type) diff --git a/target/i386/sev.c b/target/i386/sev.c index ebe36d4c10c..9dab4060b84 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -26,6 +26,7 @@ #include "qemu/error-report.h" #include "crypto/hash.h" #include "sysemu/kvm.h" +#include "kvm/kvm_i386.h" #include "sev.h" #include "sysemu/sysemu.h" #include "sysemu/runstate.h" @@ -56,6 +57,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST) struct SevGuestState { X86ConfidentialGuest parent_obj; =20 + int kvm_type; + /* configuration parameters */ char *sev_device; uint32_t policy; @@ -850,6 +853,26 @@ sev_vm_state_change(void *opaque, bool running, RunSta= te state) } } =20 +static int sev_kvm_type(X86ConfidentialGuest *cg) +{ + SevGuestState *sev =3D SEV_GUEST(cg); + int kvm_type; + + if (sev->kvm_type !=3D -1) { + goto out; + } + + kvm_type =3D (sev->policy & SEV_POLICY_ES) ? KVM_X86_SEV_ES_VM : KVM_X= 86_SEV_VM; + if (kvm_is_vm_type_supported(kvm_type)) { + sev->kvm_type =3D kvm_type; + } else { + sev->kvm_type =3D KVM_X86_DEFAULT_VM; + } + +out: + return sev->kvm_type; +} + static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) { SevGuestState *sev =3D SEV_GUEST(cgs); @@ -929,13 +952,19 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs= , Error **errp) __func__); goto err; } - cmd =3D KVM_SEV_ES_INIT; - } else { - cmd =3D KVM_SEV_INIT; } =20 trace_kvm_sev_init(); - ret =3D sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); + if (sev_kvm_type(X86_CONFIDENTIAL_GUEST(sev)) =3D=3D KVM_X86_DEFAULT_V= M) { + cmd =3D sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT; + + ret =3D sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); + } else { + struct kvm_sev_init args =3D { 0 }; + + ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_INIT2, &args, &fw_error); + } + if (ret) { error_setg(errp, "%s: failed to initialize ret=3D%d fw_error=3D%d = '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); @@ -1327,8 +1356,10 @@ static void sev_guest_class_init(ObjectClass *oc, void *data) { ConfidentialGuestSupportClass *klass =3D CONFIDENTIAL_GUEST_SUPPORT_CL= ASS(oc); + X86ConfidentialGuestClass *x86_klass =3D X86_CONFIDENTIAL_GUEST_CLASS(= oc); =20 klass->kvm_init =3D sev_kvm_init; + x86_klass->kvm_type =3D sev_kvm_type; =20 object_class_property_add_str(oc, "sev-device", sev_guest_get_sev_device, @@ -1357,6 +1388,8 @@ sev_guest_instance_init(Object *obj) { SevGuestState *sev =3D SEV_GUEST(obj); =20 + sev->kvm_type =3D -1; + sev->sev_device =3D g_strdup(DEFAULT_SEV_DEVICE); sev->policy =3D DEFAULT_GUEST_POLICY; object_property_add_uint32_ptr(obj, "policy", &sev->policy, --=20 2.44.0