From nobody Fri Dec 19 20:34:46 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass(p=quarantine dis=none) header.from=amd.com ARC-Seal: i=2; a=rsa-sha256; t=1630017050; cv=pass; d=zohomail.com; s=zohoarc; b=MSRY7ywgEyujxlXIWcE/bRtF4/pbVcHaAqMAigZu5ihtHmKCgSvqVHbVmr5z68uB4Td71VrHP8rHtfePKrZXEEpwR0413Su7i5q4yzszppUH52ctRIk6aOwx60ASaTLYGSKf+vlqwOfeaxNCYEqLMGXOuPmAwx4jR0axsUZTQ1c= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1630017050; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=FU7FBvCnDgVKQ9DfFebIXTbIUW6gvYS5l+KNu/lKuYM=; b=CAmijfojQQTlrgAunInmq5QEh8ylWj0psB/iN440jUVd3OgUlbnKgtwKfnBeGo8etoOmzhyguven+miDrglcvxfzr2JfYSe+o9mw/XMS0NNlTAlKKRX6evQlznvHNyLiNiQAihQv22Wd+nqR9QLZCEWP3ZquWz30dhmbw9L9tzY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1630017050903741.0864251740636; Thu, 26 Aug 2021 15:30:50 -0700 (PDT) Received: from localhost ([::1]:43604 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mJNtZ-0006eY-PU for importer@patchew.org; Thu, 26 Aug 2021 18:30:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59276) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mJNqK-0000NO-01 for qemu-devel@nongnu.org; Thu, 26 Aug 2021 18:27:28 -0400 Received: from mail-dm6nam11hn2244.outbound.protection.outlook.com ([52.100.172.244]:22689 helo=NAM11-DM6-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mJNqG-0005L3-OU for qemu-devel@nongnu.org; Thu, 26 Aug 2021 18:27:27 -0400 Received: from CH2PR12MB4133.namprd12.prod.outlook.com (2603:10b6:610:7a::13) by CH2PR12MB3925.namprd12.prod.outlook.com (2603:10b6:610:21::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.22; Thu, 26 Aug 2021 22:27:16 +0000 Received: from CH2PR12MB4133.namprd12.prod.outlook.com ([fe80::d19e:b657:5259:24d0]) by CH2PR12MB4133.namprd12.prod.outlook.com ([fe80::d19e:b657:5259:24d0%8]) with mapi id 15.20.4436.019; Thu, 26 Aug 2021 22:27:16 +0000 Received: from localhost (165.204.77.1) by SA0PR11CA0071.namprd11.prod.outlook.com (2603:10b6:806:d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4457.17 via Frontend Transport; Thu, 26 Aug 2021 22:27:15 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TVq+LiRVbrDnbO6sVkKRm5vnXySfbmbJIQSqzBKLa3bihNWALK7GQpElQWeP9zubGjrQF0Y459vXsshe5FvvL0/LStWByfKfaptIodjnKQBUdM1zIu7WUGie1zWYxYzfLxKsxUY5V8JGSLkibUnMHnGMjF/DPX2KJHdWGSgjTYorpYtjeXLhdki/jHHHcpCUFEad2xLy9jNZdPb6YGm4lCLlYjA54bCOgTYVd7uCmzsOkf7tAioWjCEaqUFGtoJAdT9jQI0qi/X1dBnpaN6sR7IlFrFxJSH8BA9ThI/GRY3bxvgWryaN8xXyGBJD4+7mHPzvP5DdRxjra822ci3NqQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FU7FBvCnDgVKQ9DfFebIXTbIUW6gvYS5l+KNu/lKuYM=; b=JP4HE+5XUm1hgD55FxYJdlH9pIMjMdq80Eejw50wz6csmQqHBrlCEBvvwkJeQbbb7KuQZuu6box9CJZZiieHEfOvAycCNSXUzWQ58v7kq5thGgvpj/4xs83Kro8YqIaom1Vkj0IsXRxlUAXwwIZFmHQ5oK9CruBRWhq2cy8G9b9AeysLKL+TQGECLSnUiewvKY0LzRceQAgdnvIpJAw+DqDF0Uki7mx9XePN9qGhhpiA+wNM6FEaEl0KnOdelrZk81SbFB0AlMS9d+Tw+3kxTyPunp4c3iRZVdETkjiQo7LIy3qgOM2PpYVDtsC6lLE7mifc3pQ+J4yawYNMNrltqw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FU7FBvCnDgVKQ9DfFebIXTbIUW6gvYS5l+KNu/lKuYM=; b=DiXT+NFeK25trhOakOsj4ITEJxefKRMni0Hb1cvV5cayVYlwUsrSRRReC2SS23c5klgGUULN3g797kFeyTyxhocFPh/zXhfuPT418G6gsUdTOZUcBngNTcDTufxw8T8d9bN56BvCxYgqvcWB0tHpAlN0p6tAhNIbuC28QvzwUMo= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=amd.com; From: Michael Roth To: qemu-devel@nongnu.org Cc: Connor Kuehl , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , "Michael S . Tsirkin" , James Bottomley , "Dr . David Alan Gilbert" , Tom Lendacky , Paolo Bonzini , Dov Murik , David Gibson , =?UTF-8?q?Daniel=20P=20=2E=20Berrang=C3=A9?= , kvm@vger.kernel.org, Eduardo Habkost , Brijesh Singh , Markus Armbruster , Eric Blake Subject: [RFC PATCH v2 01/12] i386/sev: introduce "sev-common" type to encapsulate common SEV state Date: Thu, 26 Aug 2021 17:26:16 -0500 Message-Id: <20210826222627.3556-2-michael.roth@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210826222627.3556-1-michael.roth@amd.com> References: <20210826222627.3556-1-michael.roth@amd.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SA0PR11CA0071.namprd11.prod.outlook.com (2603:10b6:806:d2::16) To CH2PR12MB4133.namprd12.prod.outlook.com (2603:10b6:610:7a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5e26a3c3-8394-4a6f-707e-08d968e0a89f X-MS-TrafficTypeDiagnostic: CH2PR12MB3925: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1775; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?rtox3oSF/ZH4EKcIP7sDBXQCB6YwukBwgTxkVtHQrWufzuNv3WxHvE8dYAVx?= =?us-ascii?Q?T3yz4ZB+uD/9PnhwqCmehF54tsRR0WtjnFvxH7Y7cI1ykIntrXgf+xnmwLYI?= =?us-ascii?Q?x+xDBtMVrRBN9X7ZMU9MsMYtZvv3JrmT0Xjmxr//BIzIKzqySlJ59E0cg0Ip?= =?us-ascii?Q?U1plLUc55OrH6ubhKH5zcPt/243M+wO1ZL0toVmY+3A6zHv0jwF0MJ/Xkb+S?= =?us-ascii?Q?S5IO1VpmESF7Ad0wnEMX6b/yhVJew+Ip8RXW0gENvguNVmffJOSfs+BD8BuC?= =?us-ascii?Q?JD47rXw/QGyRNCM/mLmOJokZg3FDSjDaEa3tUzEyTpE6CPOqcxQ3y2BfC7tw?= =?us-ascii?Q?hyaIhT3cYUA0dDOcRrRn4H2O3JqAm62bTLFNaC39hyYH6IAG0tnL4hKHWxzy?= =?us-ascii?Q?wY4QVrhB56lYhv43pciN7bD5ytj3lDci1tRNC11T8RmCFJuIOrOYx8/tx49K?= =?us-ascii?Q?QIQe9W9463yeMS43CY2NvY8GK7elha5RKpyWck2QeMFBe+88mFxxe2htHEU7?= =?us-ascii?Q?/p+P6Wf/2s/Eun/yON1UWyBRD+TwDzeMjN6Y0dHBJRzS1swchVs/FyQECuqi?= =?us-ascii?Q?Du+okf5T9ERlOe8PSoZGeN6HHuijN5RBHbjs4buN1GHoIWHs0LKfkVECktmI?= =?us-ascii?Q?1QxNOXChMIyJe8XYMYJ3Qlxu67AAqtbF+3ggDvKOIOtrLE3ucRzRY8J8IsJp?= =?us-ascii?Q?u/LcSIuOe0eSYaC3WTnnrxAAu5GfUni0FpW+A8Zt/90QSeSxrVSLv6WfvZw7?= =?us-ascii?Q?gJn0fGoijaHG5kuHSdHElLm27CafbWl3Y7s3D3nUZUQ6D5i3kBwPbi/ojiZb?= =?us-ascii?Q?pYjqBbjsW9Xiod/iSZCTyCeZu0N/vEGVkm4wsL4ZlgpL5wXgqkf1stHr3K6c?= =?us-ascii?Q?RBkQpfPPibBzK3GcfkukYSjWrAGTwVsjMTEk7isetxhZwqOv5mlcAn6iLgW6?= =?us-ascii?Q?U2KcwoMSwxHaCcsdPIalCH3R1TWlkFfNKv0dFjAswBkMSmfYVxYtvdIV+aqm?= =?us-ascii?Q?DIkQBpbB2wA2h7hqhOmQmw/Y34eMr7PxACKUKEr7//HWdI0=3D?= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:5; SRV:; IPV:NLI; SFV:SPM; H:CH2PR12MB4133.namprd12.prod.outlook.com; PTR:; CAT:OSPM; SFS:(4636009)(376002)(396003)(346002)(136003)(39860400002)(366004)(8676002)(38350700002)(66476007)(38100700002)(956004)(2616005)(66556008)(83380400001)(186003)(30864003)(6916009)(478600001)(36756003)(316002)(4326008)(44832011)(54906003)(66946007)(52116002)(6496006)(2906002)(86362001)(1076003)(6486002)(5660300002)(7416002)(8936002)(26005)(23200700001); DIR:OUT; SFP:1501; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KQ4/wtKFpwnDaB01J2viZvKc2FrW1w3Ng2ZhnckMD/lGg/ztGzsI9WC5vqFH?= =?us-ascii?Q?er8nIe6A3tUET7mYPcaLrDDoSRYA0XRIrmfn/NCzGM7LGnJf//tdVjQG2ZpE?= =?us-ascii?Q?RZLSTluNj6XwbjjVkCTP2qRZmZm9l+gj0tqHiVXeokRy45ViCnaHmA+IC5p9?= =?us-ascii?Q?USKLEnOtgJU/SSHcIOYo8f0cSHTQtn0SmTHz3zO3A9tItUlhYp/dLc8bKLqC?= =?us-ascii?Q?z/htNvvMHIbYp6iU1p9AfplXX+U/XrUsdkZziViNHRlNa39AMDtkGmZlFKRv?= =?us-ascii?Q?1cZvtrd37Ecem3HeDJG3nyUg6ZHAUJdDzlYZVSFg7wciSm7oOlxASKvtBM5D?= =?us-ascii?Q?Y0UbFEJnQK4SwMeU9AEzfxNtnJjO2BSHcqH+yzrMV6stn9tLrvJGeY4QsF1X?= =?us-ascii?Q?B17V1p4tS6JG2qNXkbcDlafYHLzRlhGICDxAkkbpQ37oQvzeLx2+/ckBQvLz?= =?us-ascii?Q?At8XNwQYwO9N9hKOepYNXitfnsb+oKH7XcCjfji09iRkqqViTJmL5LmZLltY?= =?us-ascii?Q?5YKqUCrzg1i530iwUIRbzY5Gbsi30xdnAF7HED4IQCGIoFTYL+QvGMiJgSk4?= =?us-ascii?Q?du79zm2CFGAH1e7UtXNZs0okKBcM6QCEPvqV0KeumLY5NyUTrCz2N44215mn?= =?us-ascii?Q?BRzeskpN8M6ifOAabjR+fs+4tMejMFAUmhUxMaxY0wdcCWwcdrNw6MxWrkD5?= =?us-ascii?Q?o668/NFZeeqhKz394Mb4UAzYHtGunsVHRgFUlbnzffB2npN9sOY5LfQyjSS9?= =?us-ascii?Q?um0LSq1Y1Qv9sA854FWQVmF1u1lq4LFyoA1shGzaXi9KhcjsRcIcmHRAALFR?= =?us-ascii?Q?g5V0Qtw+Uzp8od2iU81CL+muzD1kI8gJgqwBmyvUvGg6Bp6E6Wf+bXyFp5kk?= =?us-ascii?Q?nXA6xYCS+KVIlpHFtCBPfHtDns8seBbWt8qIztKFGcDz67ig49fUDsaW9+sK?= =?us-ascii?Q?WS0ESfzS8zAUjQLfyoPbMlr8mTt+DYjs3shS4rKFZtXySBDGgnwDLlyemwoU?= =?us-ascii?Q?RWLGGyAiXDE8KciesYqArB8GbI504AArkZf5ut8JqaJLElh0MYnllMbaUwGZ?= =?us-ascii?Q?IO+VzLctXPoQewY9unyf5ZS6+xOUD3U3++4W8hj8mdpuzotZXMD+Hdra9vsi?= =?us-ascii?Q?0kfgd2axqtT7JdaaiNFxe1LWFL955O8n7AMvmcTzrtCfDS4/o6eg7U+hqgoJ?= =?us-ascii?Q?Y0vZGfuVOLwxXCIGtFdaS7E4//lG8uoJ1PHHWtgtPASH1GJIBmgNH7/DOU7C?= =?us-ascii?Q?aySzoscKDKgRxcMJBpFqwhZAE+vnRlhOMJPhZBEaxgrlPVgpP+4/vxH40MuG?= =?us-ascii?Q?NoKnaG+dmdAqaVchDg8bqpbt?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5e26a3c3-8394-4a6f-707e-08d968e0a89f X-MS-Exchange-CrossTenant-AuthSource: CH2PR12MB4133.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Aug 2021 22:27:16.2362 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: BJN564CpAG5XtDxLDQALYx5+B2J4vjJoPvNqW28pNkXY7k4W9vAkxsR5j0cpZfwM1i577D8K0LR5s7NqqSSQzw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB3925 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: softfail client-ip=52.100.172.244; envelope-from=Michael.Roth@amd.com; helo=NAM11-DM6-obe.outbound.protection.outlook.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @amd.com) X-ZM-MESSAGEID: 1630017051717100001 Content-Type: text/plain; charset="utf-8" Currently all SEV/SEV-ES functionality is managed through a single 'sev-guest' QOM type. With upcoming support for SEV-SNP, taking this same approach won't work well since some of the properties/state managed by 'sev-guest' is not applicable to SEV-SNP, which will instead rely on a new QOM type with its own set of properties/state. To prepare for this, this patch moves common state into an abstract 'sev-common' parent type to encapsulate properties/state that is common to both SEV/SEV-ES and SEV-SNP, leaving only SEV/SEV-ES-specific properties/state in the current 'sev-guest' type. This should not affect current behavior or command-line options. As part of this patch, some related changes are also made: - a static 'sev_guest' variable is currently used to keep track of the 'sev-guest' instance. SEV-SNP would similarly introduce an 'sev_snp_guest' static variable. But these instances are now available via qdev_get_machine()->cgs, so switch to using that instead and drop the static variable. - 'sev_guest' is currently used as the name for the static variable holding a pointer to the 'sev-guest' instance. Re-purpose the name as a local variable referring the 'sev-guest' instance, and use that consistently throughout the code so it can be easily distinguished from sev-common/sev-snp-guest instances. - 'sev' is generally used as the name for local variables holding a pointer to the 'sev-guest' instance. In cases where that now points to common state, use the name 'sev_common'; in cases where that now points to state specific to 'sev-guest' instance, use the name 'sev_guest' Signed-off-by: Michael Roth Acked-by: Markus Armbruster --- qapi/qom.json | 34 +++-- target/i386/sev.c | 329 +++++++++++++++++++++++++++------------------- 2 files changed, 214 insertions(+), 149 deletions(-) diff --git a/qapi/qom.json b/qapi/qom.json index a25616bc7a..211e083727 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -735,12 +735,29 @@ 'data': { '*filename': 'str' } } =20 ## -# @SevGuestProperties: +# @SevCommonProperties: # -# Properties for sev-guest objects. +# Properties common to objects that are derivatives of sev-common. # # @sev-device: SEV device to use (default: "/dev/sev") # +# @cbitpos: C-bit location in page table entry (default: 0) +# +# @reduced-phys-bits: number of bits in physical addresses that become +# unavailable when SEV is enabled +# +# Since: 2.12 +## +{ 'struct': 'SevCommonProperties', + 'data': { '*sev-device': 'str', + '*cbitpos': 'uint32', + 'reduced-phys-bits': 'uint32' } } + +## +# @SevGuestProperties: +# +# Properties for sev-guest objects. +# # @dh-cert-file: guest owners DH certificate (encoded with base64) # # @session-file: guest owners session parameters (encoded with base64) @@ -749,21 +766,14 @@ # # @handle: SEV firmware handle (default: 0) # -# @cbitpos: C-bit location in page table entry (default: 0) -# -# @reduced-phys-bits: number of bits in physical addresses that become -# unavailable when SEV is enabled -# # Since: 2.12 ## { 'struct': 'SevGuestProperties', - 'data': { '*sev-device': 'str', - '*dh-cert-file': 'str', + 'base': 'SevCommonProperties', + 'data': { '*dh-cert-file': 'str', '*session-file': 'str', '*policy': 'uint32', - '*handle': 'uint32', - '*cbitpos': 'uint32', - 'reduced-phys-bits': 'uint32' } } + '*handle': 'uint32' } } =20 ## # @ObjectType: diff --git a/target/i386/sev.c b/target/i386/sev.c index 83df8c09f6..6acebfbd53 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -34,6 +34,8 @@ #include "exec/confidential-guest-support.h" #include "hw/i386/pc.h" =20 +#define TYPE_SEV_COMMON "sev-common" +OBJECT_DECLARE_SIMPLE_TYPE(SevCommonState, SEV_COMMON) #define TYPE_SEV_GUEST "sev-guest" OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST) =20 @@ -48,32 +50,38 @@ OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST) * -object sev-guest,id=3Dsev0 \ * -machine ...,memory-encryption=3Dsev0 */ -struct SevGuestState { +struct SevCommonState { ConfidentialGuestSupport parent_obj; =20 /* configuration parameters */ char *sev_device; - uint32_t policy; - char *dh_cert_file; - char *session_file; uint32_t cbitpos; uint32_t reduced_phys_bits; =20 /* runtime state */ - uint32_t handle; uint8_t api_major; uint8_t api_minor; uint8_t build_id; uint64_t me_mask; int sev_fd; SevState state; - gchar *measurement; =20 uint32_t reset_cs; uint32_t reset_ip; bool reset_data_valid; }; =20 +struct SevGuestState { + SevCommonState sev_common; + gchar *measurement; + + /* configuration parameters */ + uint32_t handle; + uint32_t policy; + char *dh_cert_file; + char *session_file; +}; + #define DEFAULT_GUEST_POLICY 0x1 /* disable debug */ #define DEFAULT_SEV_DEVICE "/dev/sev" =20 @@ -83,7 +91,6 @@ typedef struct __attribute__((__packed__)) SevInfoBlock { uint32_t reset_addr; } SevInfoBlock; =20 -static SevGuestState *sev_guest; static Error *sev_mig_blocker; =20 static const char *const sev_fw_errlist[] =3D { @@ -164,21 +171,21 @@ fw_error_to_str(int code) } =20 static bool -sev_check_state(const SevGuestState *sev, SevState state) +sev_check_state(const SevCommonState *sev_common, SevState state) { - assert(sev); - return sev->state =3D=3D state ? true : false; + assert(sev_common); + return sev_common->state =3D=3D state ? true : false; } =20 static void -sev_set_guest_state(SevGuestState *sev, SevState new_state) +sev_set_guest_state(SevCommonState *sev_common, SevState new_state) { assert(new_state < SEV_STATE__MAX); - assert(sev); + assert(sev_common); =20 - trace_kvm_sev_change_state(SevState_str(sev->state), + trace_kvm_sev_change_state(SevState_str(sev_common->state), SevState_str(new_state)); - sev->state =3D new_state; + sev_common->state =3D new_state; } =20 static void @@ -245,67 +252,85 @@ static struct RAMBlockNotifier sev_ram_notifier =3D { .ram_block_removed =3D sev_ram_block_removed, }; =20 -static void -sev_guest_finalize(Object *obj) +static char * +sev_common_get_sev_device(Object *obj, Error **errp) { + return g_strdup(SEV_COMMON(obj)->sev_device); } =20 -static char * -sev_guest_get_session_file(Object *obj, Error **errp) +static void +sev_common_set_sev_device(Object *obj, const char *value, Error **errp) { - SevGuestState *s =3D SEV_GUEST(obj); + SEV_COMMON(obj)->sev_device =3D g_strdup(value); +} =20 - return s->session_file ? g_strdup(s->session_file) : NULL; +static void +sev_common_class_init(ObjectClass *oc, void *data) +{ + object_class_property_add_str(oc, "sev-device", + sev_common_get_sev_device, + sev_common_set_sev_device); + object_class_property_set_description(oc, "sev-device", + "SEV device to use"); } =20 static void -sev_guest_set_session_file(Object *obj, const char *value, Error **errp) +sev_common_instance_init(Object *obj) { - SevGuestState *s =3D SEV_GUEST(obj); + SevCommonState *sev_common =3D SEV_COMMON(obj); + + sev_common->sev_device =3D g_strdup(DEFAULT_SEV_DEVICE); =20 - s->session_file =3D g_strdup(value); + object_property_add_uint32_ptr(obj, "cbitpos", &sev_common->cbitpos, + OBJ_PROP_FLAG_READWRITE); + object_property_add_uint32_ptr(obj, "reduced-phys-bits", + &sev_common->reduced_phys_bits, + OBJ_PROP_FLAG_READWRITE); } =20 +/* sev guest info common to sev/sev-es/sev-snp */ +static const TypeInfo sev_common_info =3D { + .parent =3D TYPE_CONFIDENTIAL_GUEST_SUPPORT, + .name =3D TYPE_SEV_COMMON, + .instance_size =3D sizeof(SevCommonState), + .class_init =3D sev_common_class_init, + .instance_init =3D sev_common_instance_init, + .abstract =3D true, + .interfaces =3D (InterfaceInfo[]) { + { TYPE_USER_CREATABLE }, + { } + } +}; + static char * sev_guest_get_dh_cert_file(Object *obj, Error **errp) { - SevGuestState *s =3D SEV_GUEST(obj); - - return g_strdup(s->dh_cert_file); + return g_strdup(SEV_GUEST(obj)->dh_cert_file); } =20 static void sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp) { - SevGuestState *s =3D SEV_GUEST(obj); - - s->dh_cert_file =3D g_strdup(value); + SEV_GUEST(obj)->dh_cert_file =3D g_strdup(value); } =20 static char * -sev_guest_get_sev_device(Object *obj, Error **errp) +sev_guest_get_session_file(Object *obj, Error **errp) { - SevGuestState *sev =3D SEV_GUEST(obj); + SevGuestState *sev_guest =3D SEV_GUEST(obj); =20 - return g_strdup(sev->sev_device); + return sev_guest->session_file ? g_strdup(sev_guest->session_file) : N= ULL; } =20 static void -sev_guest_set_sev_device(Object *obj, const char *value, Error **errp) +sev_guest_set_session_file(Object *obj, const char *value, Error **errp) { - SevGuestState *sev =3D SEV_GUEST(obj); - - sev->sev_device =3D g_strdup(value); + SEV_GUEST(obj)->session_file =3D g_strdup(value); } =20 static void sev_guest_class_init(ObjectClass *oc, void *data) { - object_class_property_add_str(oc, "sev-device", - sev_guest_get_sev_device, - sev_guest_set_sev_device); - object_class_property_set_description(oc, "sev-device", - "SEV device to use"); object_class_property_add_str(oc, "dh-cert-file", sev_guest_get_dh_cert_file, sev_guest_set_dh_cert_file); @@ -321,80 +346,88 @@ sev_guest_class_init(ObjectClass *oc, void *data) static void sev_guest_instance_init(Object *obj) { - SevGuestState *sev =3D SEV_GUEST(obj); + SevGuestState *sev_guest =3D SEV_GUEST(obj); =20 - sev->sev_device =3D g_strdup(DEFAULT_SEV_DEVICE); - sev->policy =3D DEFAULT_GUEST_POLICY; - object_property_add_uint32_ptr(obj, "policy", &sev->policy, - OBJ_PROP_FLAG_READWRITE); - object_property_add_uint32_ptr(obj, "handle", &sev->handle, + sev_guest->policy =3D DEFAULT_GUEST_POLICY; + object_property_add_uint32_ptr(obj, "handle", &sev_guest->handle, OBJ_PROP_FLAG_READWRITE); - object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos, - OBJ_PROP_FLAG_READWRITE); - object_property_add_uint32_ptr(obj, "reduced-phys-bits", - &sev->reduced_phys_bits, + object_property_add_uint32_ptr(obj, "policy", &sev_guest->policy, OBJ_PROP_FLAG_READWRITE); } =20 -/* sev guest info */ +/* guest info specific sev/sev-es */ static const TypeInfo sev_guest_info =3D { - .parent =3D TYPE_CONFIDENTIAL_GUEST_SUPPORT, + .parent =3D TYPE_SEV_COMMON, .name =3D TYPE_SEV_GUEST, .instance_size =3D sizeof(SevGuestState), - .instance_finalize =3D sev_guest_finalize, - .class_init =3D sev_guest_class_init, .instance_init =3D sev_guest_instance_init, - .interfaces =3D (InterfaceInfo[]) { - { TYPE_USER_CREATABLE }, - { } - } + .class_init =3D sev_guest_class_init, }; =20 bool sev_enabled(void) { - return !!sev_guest; + ConfidentialGuestSupport *cgs =3D MACHINE(qdev_get_machine())->cgs; + + return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON); } =20 bool sev_es_enabled(void) { - return sev_enabled() && (sev_guest->policy & SEV_POLICY_ES); + ConfidentialGuestSupport *cgs =3D MACHINE(qdev_get_machine())->cgs; + + return sev_enabled() && (SEV_GUEST(cgs)->policy & SEV_POLICY_ES); } =20 uint64_t sev_get_me_mask(void) { - return sev_guest ? sev_guest->me_mask : ~0; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + + return sev_common ? sev_common->me_mask : ~0; } =20 uint32_t sev_get_cbit_position(void) { - return sev_guest ? sev_guest->cbitpos : 0; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + + return sev_common ? sev_common->cbitpos : 0; } =20 uint32_t sev_get_reduced_phys_bits(void) { - return sev_guest ? sev_guest->reduced_phys_bits : 0; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + + return sev_common ? sev_common->reduced_phys_bits : 0; } =20 SevInfo * sev_get_info(void) { SevInfo *info; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + SevGuestState *sev_guest =3D + (SevGuestState *)object_dynamic_cast(OBJECT(sev_common), + TYPE_SEV_GUEST); =20 info =3D g_new0(SevInfo, 1); info->enabled =3D sev_enabled(); =20 if (info->enabled) { - info->api_major =3D sev_guest->api_major; - info->api_minor =3D sev_guest->api_minor; - info->build_id =3D sev_guest->build_id; - info->policy =3D sev_guest->policy; - info->state =3D sev_guest->state; - info->handle =3D sev_guest->handle; + if (sev_guest) { + info->handle =3D sev_guest->handle; + } + info->api_major =3D sev_common->api_major; + info->api_minor =3D sev_common->api_minor; + info->build_id =3D sev_common->build_id; + info->state =3D sev_common->state; + /* we only report the lower 32-bits of policy for SNP, ok for now.= .. */ + info->policy =3D + (uint32_t)object_property_get_uint(OBJECT(sev_common), + "policy", NULL); } =20 return info; @@ -452,6 +485,8 @@ sev_get_capabilities(Error **errp) size_t pdh_len =3D 0, cert_chain_len =3D 0; uint32_t ebx; int fd; + SevCommonState *sev_common; + char *sev_device; =20 if (!kvm_enabled()) { error_setg(errp, "KVM not enabled"); @@ -462,12 +497,21 @@ sev_get_capabilities(Error **errp) return NULL; } =20 - fd =3D open(DEFAULT_SEV_DEVICE, O_RDWR); + sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())->cgs); + if (!sev_common) { + error_setg(errp, "SEV is not configured"); + } + + sev_device =3D object_property_get_str(OBJECT(sev_common), "sev-device= ", + &error_abort); + fd =3D open(sev_device, O_RDWR); if (fd < 0) { error_setg_errno(errp, errno, "Failed to open %s", DEFAULT_SEV_DEVICE); + g_free(sev_device); return NULL; } + g_free(sev_device); =20 if (sev_get_pdh_info(fd, &pdh_data, &pdh_len, &cert_chain_data, &cert_chain_len, errp)) { @@ -499,7 +543,7 @@ sev_get_attestation_report(const char *mnonce, Error **= errp) { struct kvm_sev_attestation_report input =3D {}; SevAttestationReport *report =3D NULL; - SevGuestState *sev =3D sev_guest; + SevCommonState *sev_common; guchar *data; guchar *buf; gsize len; @@ -525,8 +569,10 @@ sev_get_attestation_report(const char *mnonce, Error *= *errp) return NULL; } =20 + sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())->cgs); + /* Query the report length */ - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, &input, &err); if (ret < 0) { if (err !=3D SEV_RET_INVALID_LEN) { @@ -542,7 +588,7 @@ sev_get_attestation_report(const char *mnonce, Error **= errp) memcpy(input.mnonce, buf, sizeof(input.mnonce)); =20 /* Query the report */ - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT, &input, &err); if (ret) { error_setg_errno(errp, errno, "Failed to get attestation report" @@ -579,28 +625,29 @@ sev_read_file_base64(const char *filename, guchar **d= ata, gsize *len) } =20 static int -sev_launch_start(SevGuestState *sev) +sev_launch_start(SevGuestState *sev_guest) { gsize sz; int ret =3D 1; int fw_error, rc; struct kvm_sev_launch_start *start; guchar *session =3D NULL, *dh_cert =3D NULL; + SevCommonState *sev_common =3D SEV_COMMON(sev_guest); =20 start =3D g_new0(struct kvm_sev_launch_start, 1); =20 - start->handle =3D sev->handle; - start->policy =3D sev->policy; - if (sev->session_file) { - if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) { + start->handle =3D sev_guest->handle; + start->policy =3D sev_guest->policy; + if (sev_guest->session_file) { + if (sev_read_file_base64(sev_guest->session_file, &session, &sz) <= 0) { goto out; } start->session_uaddr =3D (unsigned long)session; start->session_len =3D sz; } =20 - if (sev->dh_cert_file) { - if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) { + if (sev_guest->dh_cert_file) { + if (sev_read_file_base64(sev_guest->dh_cert_file, &dh_cert, &sz) <= 0) { goto out; } start->dh_uaddr =3D (unsigned long)dh_cert; @@ -608,15 +655,15 @@ sev_launch_start(SevGuestState *sev) } =20 trace_kvm_sev_launch_start(start->policy, session, dh_cert); - rc =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_error); + rc =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_START, start, &fw_= error); if (rc < 0) { error_report("%s: LAUNCH_START ret=3D%d fw_error=3D%d '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); goto out; } =20 - sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE); - sev->handle =3D start->handle; + sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE); + sev_guest->handle =3D start->handle; ret =3D 0; =20 out: @@ -627,7 +674,7 @@ out: } =20 static int -sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len) +sev_launch_update_data(SevGuestState *sev_guest, uint8_t *addr, uint64_t l= en) { int ret, fw_error; struct kvm_sev_launch_update_data update; @@ -639,7 +686,7 @@ sev_launch_update_data(SevGuestState *sev, uint8_t *add= r, uint64_t len) update.uaddr =3D (__u64)(unsigned long)addr; update.len =3D len; trace_kvm_sev_launch_update_data(addr, len); - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, + ret =3D sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE= _DATA, &update, &fw_error); if (ret) { error_report("%s: LAUNCH_UPDATE ret=3D%d fw_error=3D%d '%s'", @@ -650,11 +697,12 @@ sev_launch_update_data(SevGuestState *sev, uint8_t *a= ddr, uint64_t len) } =20 static int -sev_launch_update_vmsa(SevGuestState *sev) +sev_launch_update_vmsa(SevGuestState *sev_guest) { int ret, fw_error; =20 - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, NULL, &fw_e= rror); + ret =3D sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE= _VMSA, + NULL, &fw_error); if (ret) { error_report("%s: LAUNCH_UPDATE_VMSA ret=3D%d fw_error=3D%d '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); @@ -666,18 +714,19 @@ sev_launch_update_vmsa(SevGuestState *sev) static void sev_launch_get_measure(Notifier *notifier, void *unused) { - SevGuestState *sev =3D sev_guest; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + SevGuestState *sev_guest =3D SEV_GUEST(sev_common); int ret, error; guchar *data; struct kvm_sev_launch_measure *measurement; =20 - if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) { + if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) { return; } =20 if (sev_es_enabled()) { /* measure all the VM save areas before getting launch_measure */ - ret =3D sev_launch_update_vmsa(sev); + ret =3D sev_launch_update_vmsa(sev_guest); if (ret) { exit(1); } @@ -686,7 +735,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) measurement =3D g_new0(struct kvm_sev_launch_measure, 1); =20 /* query the measurement blob length */ - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, measurement, &error); if (!measurement->len) { error_report("%s: LAUNCH_MEASURE ret=3D%d fw_error=3D%d '%s'", @@ -698,7 +747,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused) measurement->uaddr =3D (unsigned long)data; =20 /* get the measurement blob */ - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE, + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE, measurement, &error); if (ret) { error_report("%s: LAUNCH_MEASURE ret=3D%d fw_error=3D%d '%s'", @@ -706,11 +755,11 @@ sev_launch_get_measure(Notifier *notifier, void *unus= ed) goto free_data; } =20 - sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET); + sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_SECRET); =20 /* encode the measurement value and emit the event */ - sev->measurement =3D g_base64_encode(data, measurement->len); - trace_kvm_sev_launch_measurement(sev->measurement); + sev_guest->measurement =3D g_base64_encode(data, measurement->len); + trace_kvm_sev_launch_measurement(sev_guest->measurement); =20 free_data: g_free(data); @@ -721,8 +770,10 @@ free_measurement: char * sev_get_launch_measurement(void) { + SevGuestState *sev_guest =3D SEV_GUEST(MACHINE(qdev_get_machine())->cg= s); + if (sev_guest && - sev_guest->state >=3D SEV_STATE_LAUNCH_SECRET) { + SEV_COMMON(sev_guest)->state >=3D SEV_STATE_LAUNCH_SECRET) { return g_strdup(sev_guest->measurement); } =20 @@ -734,20 +785,21 @@ static Notifier sev_machine_done_notify =3D { }; =20 static void -sev_launch_finish(SevGuestState *sev) +sev_launch_finish(SevGuestState *sev_guest) { int ret, error; Error *local_err =3D NULL; =20 trace_kvm_sev_launch_finish(); - ret =3D sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error); + ret =3D sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_FINISH= , 0, + &error); if (ret) { error_report("%s: LAUNCH_FINISH ret=3D%d fw_error=3D%d '%s'", __func__, ret, error, fw_error_to_str(error)); exit(1); } =20 - sev_set_guest_state(sev, SEV_STATE_RUNNING); + sev_set_guest_state(SEV_COMMON(sev_guest), SEV_STATE_RUNNING); =20 /* add migration blocker */ error_setg(&sev_mig_blocker, @@ -763,26 +815,25 @@ sev_launch_finish(SevGuestState *sev) static void sev_vm_state_change(void *opaque, bool running, RunState state) { - SevGuestState *sev =3D opaque; + SevCommonState *sev_common =3D opaque; =20 if (running) { - if (!sev_check_state(sev, SEV_STATE_RUNNING)) { - sev_launch_finish(sev); + if (!sev_check_state(sev_common, SEV_STATE_RUNNING)) { + sev_launch_finish(SEV_GUEST(sev_common)); } } } =20 int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) { - SevGuestState *sev - =3D (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUE= ST); + SevCommonState *sev_common =3D SEV_COMMON(cgs); char *devname; int ret, fw_error, cmd; uint32_t ebx; uint32_t host_cbitpos; struct sev_user_data_status status =3D {}; =20 - if (!sev) { + if (!sev_common) { return 0; } =20 @@ -792,29 +843,28 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error= **errp) return -1; } =20 - sev_guest =3D sev; - sev->state =3D SEV_STATE_UNINIT; + sev_common->state =3D SEV_STATE_UNINIT; =20 host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL); host_cbitpos =3D ebx & 0x3f; =20 - if (host_cbitpos !=3D sev->cbitpos) { + if (host_cbitpos !=3D sev_common->cbitpos) { error_setg(errp, "%s: cbitpos check failed, host '%d' requested '%= d'", - __func__, host_cbitpos, sev->cbitpos); + __func__, host_cbitpos, sev_common->cbitpos); goto err; } =20 - if (sev->reduced_phys_bits < 1) { + if (sev_common->reduced_phys_bits < 1) { error_setg(errp, "%s: reduced_phys_bits check failed, it should be= >=3D1," - " requested '%d'", __func__, sev->reduced_phys_bits); + " requested '%d'", __func__, sev_common->reduced_phys_b= its); goto err; } =20 - sev->me_mask =3D ~(1UL << sev->cbitpos); + sev_common->me_mask =3D ~(1UL << sev_common->cbitpos); =20 - devname =3D object_property_get_str(OBJECT(sev), "sev-device", NULL); - sev->sev_fd =3D open(devname, O_RDWR); - if (sev->sev_fd < 0) { + devname =3D object_property_get_str(OBJECT(sev_common), "sev-device", = NULL); + sev_common->sev_fd =3D open(devname, O_RDWR); + if (sev_common->sev_fd < 0) { error_setg(errp, "%s: Failed to open %s '%s'", __func__, devname, strerror(errno)); g_free(devname); @@ -822,7 +872,7 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error *= *errp) } g_free(devname); =20 - ret =3D sev_platform_ioctl(sev->sev_fd, SEV_PLATFORM_STATUS, &status, + ret =3D sev_platform_ioctl(sev_common->sev_fd, SEV_PLATFORM_STATUS, &s= tatus, &fw_error); if (ret) { error_setg(errp, "%s: failed to get platform status ret=3D%d " @@ -830,9 +880,9 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error *= *errp) fw_error_to_str(fw_error)); goto err; } - sev->build_id =3D status.build; - sev->api_major =3D status.api_major; - sev->api_minor =3D status.api_minor; + sev_common->build_id =3D status.build; + sev_common->api_major =3D status.api_major; + sev_common->api_minor =3D status.api_minor; =20 if (sev_es_enabled()) { if (!kvm_kernel_irqchip_allowed()) { @@ -853,14 +903,14 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error= **errp) } =20 trace_kvm_sev_init(); - ret =3D sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); + ret =3D sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error); if (ret) { error_setg(errp, "%s: failed to initialize ret=3D%d fw_error=3D%d = '%s'", __func__, ret, fw_error, fw_error_to_str(fw_error)); goto err; } =20 - ret =3D sev_launch_start(sev); + ret =3D sev_launch_start(SEV_GUEST(sev_common)); if (ret) { error_setg(errp, "%s: failed to create encryption context", __func= __); goto err; @@ -868,13 +918,12 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error= **errp) =20 ram_block_notifier_add(&sev_ram_notifier); qemu_add_machine_init_done_notifier(&sev_machine_done_notify); - qemu_add_vm_change_state_handler(sev_vm_state_change, sev); + qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common); =20 cgs->ready =3D true; =20 return 0; err: - sev_guest =3D NULL; ram_block_discard_disable(false); return -1; } @@ -882,13 +931,15 @@ err: int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp) { - if (!sev_guest) { + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); + + if (!sev_common) { return 0; } =20 /* if SEV is in update state then encrypt the data else do nothing */ - if (sev_check_state(sev_guest, SEV_STATE_LAUNCH_UPDATE)) { - int ret =3D sev_launch_update_data(sev_guest, ptr, len); + if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) { + int ret =3D sev_launch_update_data(SEV_GUEST(sev_common), ptr, len= ); if (ret < 0) { error_setg(errp, "failed to encrypt pflash rom"); return ret; @@ -907,16 +958,17 @@ int sev_inject_launch_secret(const char *packet_hdr, = const char *secret, void *hva; gsize hdr_sz =3D 0, data_sz =3D 0; MemoryRegion *mr =3D NULL; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); =20 - if (!sev_guest) { + if (!sev_common) { error_setg(errp, "SEV: SEV not enabled."); return 1; } =20 /* secret can be injected only in this state */ - if (!sev_check_state(sev_guest, SEV_STATE_LAUNCH_SECRET)) { + if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_SECRET)) { error_setg(errp, "SEV: Not in correct state. (LSECRET) %x", - sev_guest->state); + sev_common->state); return 1; } =20 @@ -950,7 +1002,7 @@ int sev_inject_launch_secret(const char *packet_hdr, c= onst char *secret, trace_kvm_sev_launch_secret(gpa, input.guest_uaddr, input.trans_uaddr, input.trans_len); =20 - ret =3D sev_ioctl(sev_guest->sev_fd, KVM_SEV_LAUNCH_SECRET, + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_SECRET, &input, &error); if (ret) { error_setg(errp, "SEV: failed to inject secret ret=3D%d fw_error= =3D%d '%s'", @@ -1026,9 +1078,10 @@ void sev_es_set_reset_vector(CPUState *cpu) { X86CPU *x86; CPUX86State *env; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); =20 /* Only update if we have valid reset information */ - if (!sev_guest || !sev_guest->reset_data_valid) { + if (!sev_common || !sev_common->reset_data_valid) { return; } =20 @@ -1040,11 +1093,11 @@ void sev_es_set_reset_vector(CPUState *cpu) x86 =3D X86_CPU(cpu); env =3D &x86->env; =20 - cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_guest->reset_cs, 0xffff, + cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_common->reset_cs, 0xffff, DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); =20 - env->eip =3D sev_guest->reset_ip; + env->eip =3D sev_common->reset_ip; } =20 int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size) @@ -1052,6 +1105,7 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_= t flash_size) CPUState *cpu; uint32_t addr; int ret; + SevCommonState *sev_common =3D SEV_COMMON(MACHINE(qdev_get_machine())-= >cgs); =20 if (!sev_es_enabled()) { return 0; @@ -1065,9 +1119,9 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_= t flash_size) } =20 if (addr) { - sev_guest->reset_cs =3D addr & 0xffff0000; - sev_guest->reset_ip =3D addr & 0x0000ffff; - sev_guest->reset_data_valid =3D true; + sev_common->reset_cs =3D addr & 0xffff0000; + sev_common->reset_ip =3D addr & 0x0000ffff; + sev_common->reset_data_valid =3D true; =20 CPU_FOREACH(cpu) { sev_es_set_reset_vector(cpu); @@ -1080,6 +1134,7 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_= t flash_size) static void sev_register_types(void) { + type_register_static(&sev_common_info); type_register_static(&sev_guest_info); } =20 --=20 2.25.1