[v3] Add AMD Secure Nested Paging (SEV-SNP) support

[PATCH v3 27/49] i386/sev: Set ms->require_guest_memfd for SNP

Posted by Michael Roth 1 year, 10 months ago

SNP requires guest_memfd for private guest memory, so enable it so that
the appropriate guest_memfd backend will be available for normal RAM
regions.

Signed-off-by: Michael Roth <michael.roth@amd.com>
---
 target/i386/sev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index e4deb7b41e..b06c796aae 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -880,6 +880,7 @@ out:
 static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
     SevCommonState *sev_common = SEV_COMMON(cgs);
+    MachineState *ms = MACHINE(qdev_get_machine());
     char *devname;
     int ret, fw_error, cmd;
     uint32_t ebx;
@@ -1000,6 +1001,10 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
     }
 
+    if (sev_snp_enabled()) {
+        ms->require_guest_memfd = true;
+    }
+
     qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common);
 
     cgs->ready = true;
-- 
2.25.1

Re: [PATCH v3 27/49] i386/sev: Set ms->require_guest_memfd for SNP

Posted by Paolo Bonzini 1 year, 10 months ago

On 3/20/24 09:39, Michael Roth wrote:
> SNP requires guest_memfd for private guest memory, so enable it so that
> the appropriate guest_memfd backend will be available for normal RAM
> regions.
> 
> Signed-off-by: Michael Roth <michael.roth@amd.com>
> ---
>   target/i386/sev.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index e4deb7b41e..b06c796aae 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -880,6 +880,7 @@ out:
>   static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
>   {
>       SevCommonState *sev_common = SEV_COMMON(cgs);
> +    MachineState *ms = MACHINE(qdev_get_machine());
>       char *devname;
>       int ret, fw_error, cmd;
>       uint32_t ebx;
> @@ -1000,6 +1001,10 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
>           qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
>       }
>   
> +    if (sev_snp_enabled()) {
> +        ms->require_guest_memfd = true;
> +    }

Likewise, this and the following patch should be done in the 
sev-snp-guest's override of kvm_init.

Paolo

>       qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common);
>   
>       cgs->ready = true;