From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648444; cv=none; d=zohomail.com; s=zohoarc; b=ShZ3zWZaSRxNhIZbhrA+bbi4HDXDFlb9miaHil3uGzc/eHwi65zSow6RnLHPFdSx9iwuoMoInNHe4CnvLY7txR7xX1flvy3sKBrbUOzQeV+PirMTCZZQ+y6XfbGi/TEd/OEPS0nz6xyQ7Z34YANZ4v3anU8BDq9dYa8f5BXKnWk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648444; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1X3Cvx0xDYSk/Rw52AD+6QSRYyGsoteW5TuQUBul1Hc=; b=fV3dyK+uYp7Pbfbg85Rnjm/9HdmO6ZuvwHazntP7QFjZ23BZ2Ln2zxsJyPJ80OF21KzZsKugPzM4Ya3RqG7mZ3nmAJ2i3Sv9XtM4Z+T71O7xmYHYagZDxB7HRUFzplXw4+WBoJ1kgnK55sgL5nNmLLGg5YBh0YUdwU/9oX6xjWo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648444610220.48695655960967; Tue, 28 Oct 2025 03:47:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhEO-0008T2-09; Tue, 28 Oct 2025 06:47:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDe-0007rr-2U for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:29 -0400 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDS-0005lF-CC for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:25 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 87F7741513; Tue, 28 Oct 2025 10:46:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 490E3C4CEE7; Tue, 28 Oct 2025 10:46:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648372; bh=DMy/sGWIKYOYAjfxscxSO7zrh4vdvWXqXux+y2OofO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LGmEIE6qmOBBUaiw68FMIieV16L+rar82q/drLlhQLM1onQOrYezk8+4Ate2yOR4s MTikW5B73j5StNYZFvRZN/pHUwNiJMpuwT3F4u3vtqQQL9hIGycH3BKiSHavS75BZJ r0ohZLYqZqhK89HWnDvGRPvYLsefoHeWNONhzdVP7EIrrI9v1Xg+bLrFMS7QeJM2ox iwe4JrM6HznAWZ8pbWx0anIU/Ov95THrPZ5bU4jjKZiomAK9Yb5IFiyz3bPsGIFYZU QffCnlCt3AEUVSOQQgK80W2BLrXpHLi2bA+vOyMd+rFfusW+JUfvBlXkkC4O33Ds2o AjR00ZN7JjcCQ== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 1/9] target/i386: SEV: Generalize handling of SVM_SEV_FEAT_SNP_ACTIVE Date: Tue, 28 Oct 2025 16:13:26 +0530 Message-ID: <2bd23921fa66a3857892bf082dbf80508f93b076.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2600:3c0a:e001:78e:0:1991:8:25; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648447091154100 Content-Type: text/plain; charset="utf-8" Align with IGVM files providing SEV features with SVM_SEV_FEAT_SNP_ACTIVE set by setting the same when creating a sev-snp-guest object. Since KVM sets this feature itself, SVM_SEV_FEAT_SNP_ACTIVE is unset before KVM_SEV_INIT2 ioctl is invoked. Move that out of IGVM-specific section to common code. While at it, convert the existing SVM_SEV_FEAT_SNP_ACTIVE definition to use the BIT() macro for consistency with upcoming feature flags. Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.h | 2 +- target/i386/sev.c | 24 +++++++++++++++++------- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/target/i386/sev.h b/target/i386/sev.h index 9db1a802f6bb..102546b112d6 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -44,7 +44,7 @@ bool sev_snp_enabled(void); #define SEV_SNP_POLICY_SMT 0x10000 #define SEV_SNP_POLICY_DBG 0x80000 =20 -#define SVM_SEV_FEAT_SNP_ACTIVE 1 +#define SVM_SEV_FEAT_SNP_ACTIVE BIT(0) =20 typedef struct SevKernelLoaderContext { char *setup_data; diff --git a/target/i386/sev.c b/target/i386/sev.c index 1057b8ab2c60..2fb1268ed788 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -319,6 +319,15 @@ sev_set_guest_state(SevCommonState *sev_common, SevSta= te new_state) sev_common->state =3D new_state; } =20 +static void sev_set_feature(SevCommonState *sev_common, uint64_t feature, = bool set) +{ + if (set) { + sev_common->sev_features |=3D feature; + } else { + sev_common->sev_features &=3D ~feature; + } +} + static void sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size, size_t max_size) @@ -1897,15 +1906,15 @@ static int sev_common_kvm_init(ConfidentialGuestSup= port *cgs, Error **errp) -1) { return -1; } - /* - * KVM maintains a bitmask of allowed sev_features. This does = not - * include SVM_SEV_FEAT_SNP_ACTIVE which is set accordingly by= KVM - * itself. Therefore we need to clear this flag. - */ - args.vmsa_features =3D sev_common->sev_features & - ~SVM_SEV_FEAT_SNP_ACTIVE; } =20 + /* + * KVM maintains a bitmask of allowed sev_features. This does not + * include SVM_SEV_FEAT_SNP_ACTIVE which is set accordingly by KVM + * itself. Therefore we need to clear this flag. + */ + args.vmsa_features =3D sev_common->sev_features & ~SVM_SEV_FEAT_SN= P_ACTIVE; + ret =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_er= ror); break; } @@ -3127,6 +3136,7 @@ sev_snp_guest_instance_init(Object *obj) =20 /* default init/start/finish params for kvm */ sev_snp_guest->kvm_start_conf.policy =3D DEFAULT_SEV_SNP_POLICY; + sev_set_feature(SEV_COMMON(sev_snp_guest), SVM_SEV_FEAT_SNP_ACTIVE, tr= ue); } =20 /* guest info specific to sev-snp */ --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648348; cv=none; d=zohomail.com; s=zohoarc; b=jYDZDe6Ul9j5Ijd/ic9uBgDNGKfxec2n3sZBdkMsn89Ra8ozJduiADWfDExke6j2tbKa9tRjrECRlwMiHvN8Mjpf2nMQTduC22LLgnKoUVKJrGcsjBaCth0NwKSZ1gVYKAQo+RJ0gOAEbDo/ZE/Jty8Rxg7sJlZAO3y9y5gpiMY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648348; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6bO+yB71pU3KU3bz6n/aFamnutIZ/41SptNwqZy7plg=; b=hMkBrvM8BkxgQNy28G7cafnbH9kpn7aeTvN6cjfaA/+TWqmIM8/Au0V6ofkPk02TmuQxY+q0EB2bTMwj8eQetkTIsRS0ToC7YClOlIrZB3NqpoEyI9pCFWS4/gD8oETElY6ldB+i6JPGLIxWUuCcAI9hJf/Ho25rj3IWn7JHq6w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648348342935.9201948893151; Tue, 28 Oct 2025 03:45:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhCO-00078l-Nq; Tue, 28 Oct 2025 06:45:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCM-00078S-IS for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:06 -0400 Received: from tor.source.kernel.org ([172.105.4.254]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCJ-0005HZ-R6 for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:06 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id E2D6B61D57; Tue, 28 Oct 2025 10:44:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D35DC4CEE7; Tue, 28 Oct 2025 10:44:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648299; bh=Hc+WVNOksc7fHzE0GlYVXDqhJNv+8kQ/1DHhePDHkEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tmYsk1ipz6sNZK4K6okQ7E7KxiM59Ei9aLV/d0UPfINQyOpnYWLD1zIUh0P4Isj6e MoJgSyzMK/pzepNIhbyQX9RYd15hq0E1ESqRyOUs0FAD5kE0sczkm+UsMtm/i+GyUz +WhovHa6QXRPYDai9ocunYHSojArSeY7DgfZzKmCFUHgbKI3eJ08kKxD/2gDhQ4ig/ IpJBvOL4uZS4r3mJ6W21azHrB5xkzldRnpjO1U7ez4dw1TGq1eTY3lhLCkfLPIXPEH CnTAgtB01x1uszKe7Cv/K327UXuGxgBucddfuCQY2ifg9xihoyHXSDxJ0NjQZ7Rbvu QrUKDjEa/rPIw== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 2/9] target/i386: SEV: Ensure SEV features are only set through qemu cli or IGVM Date: Tue, 28 Oct 2025 16:13:27 +0530 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=172.105.4.254; envelope-from=naveen@kernel.org; helo=tor.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648352058154100 Content-Type: text/plain; charset="utf-8" In preparation for qemu being able to set SEV features through the cli, add a check to ensure that SEV features are not also set if using IGVM files. Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/target/i386/sev.c b/target/i386/sev.c index 2fb1268ed788..7cfd15238703 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -1901,6 +1901,16 @@ static int sev_common_kvm_init(ConfidentialGuestSupp= ort *cgs, Error **errp) * as SEV_STATE_UNINIT. */ if (x86machine->igvm) { + /* + * Test only the user-set SEV features by masking out + * SVM_SEV_FEAT_SNP_ACTIVE which is set by default. + */ + if (sev_common->sev_features & ~SVM_SEV_FEAT_SNP_ACTIVE) { + error_setg(errp, + "%s: SEV features can't be specified when using= IGVM files", + __func__); + return -1; + } if (IGVM_CFG_GET_CLASS(x86machine->igvm) ->process(x86machine->igvm, machine->cgs, true, errp) = =3D=3D -1) { --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648349; cv=none; d=zohomail.com; s=zohoarc; b=AFGQBxhEfBtMWaxq/XHpAeIYjSPxSvAzTxAQzyKAD+clrQqs/8ehRxATnb81n1TLWikukufh2Qrg2r2u699gvhYKUJKT/YZW9ReZj3lwWH/JJtWMZhG+Q0e7IZ/nlPXzlpesZ8GjZ/XVkGIuCkXHuWkcpZEh33li9ak5l6jgUP8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648349; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bya8FiEQ6EwAMpDwY/KaoM6R65NeOBrxURDaSg6mP2Y=; b=PTOU/IKw+9mkF8oYzklGLQ3e99FyN2eRtpxlYgv2cjgWo764+4y4N8byh4CyrVofeiV4TtebOu13nvWP3UtNLSZwIpviQ690Cne6V8qijbc/9KZfCskfjpCALTsWuOztFFwojmjtDA2VbZP+w37Wu96hYEb9+OFtomXBUG046bQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648349477619.6415177923208; Tue, 28 Oct 2025 03:45:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhCW-0007AA-7g; Tue, 28 Oct 2025 06:45:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCV-00079t-6t for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:15 -0400 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCS-0005UL-Q8 for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:15 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 6DA4F61F04; Tue, 28 Oct 2025 10:45:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47C70C4CEE7; Tue, 28 Oct 2025 10:45:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648309; bh=PlncIndr7i+Vu3ghe2WzLIyZcXUvCuWC5Vg8QrGPzAw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ks7YblDqXF3wB86qL0V7gIeTgC/CXwoj5GlZ0wxiisqHvys+14QgNAsHT7q+y7eR9 ycbmjQJ9urcAwqiv5RykAUVGHUlGpfO0Gt843Og1GUqByuhKQo8VYmIx6dLI/J+uMC 2Ogs7vOwaO7kmMiYYiE5Lu9UWu/WKJEjN0RnGMFP7iqE47YA7dnvcmCjgPQ4r2/eQV dtNUpu+ChVKL4Z9C992En4lSKgl/algn/dCJD9gfACt+fAUAMn7QKneVVjM7K4tqp2 nJ/FEghdHfOMNv4XrVSapPRtHnvsD0GVrWKf+qI1DqFFfh8ZlPamMXoS/qPLnSgnUN 9zt29BoR+gEwg== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 3/9] target/i386: SEV: Consolidate SEV feature validation to common init path Date: Tue, 28 Oct 2025 16:13:28 +0530 Message-ID: <4bd665e05d26b441f04dabca9c8145d1cdefbc4a.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2600:3c04:e001:324:0:1991:8:25; envelope-from=naveen@kernel.org; helo=tor.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648352081154100 Content-Type: text/plain; charset="utf-8" Currently, check_sev_features() is called in multiple places when processing IGVM files: both when processing the initial VMSA SEV features from IGVM, as well as when validating the full contents of the VMSA. Move this to a single point in sev_common_kvm_init() to simplify the flow, as well as to re-use this function when VMSA SEV features are being set without using IGVM files. Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 7cfd15238703..89cde2c6464a 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -595,9 +595,6 @@ static int check_vmsa_supported(SevCommonState *sev_com= mon, hwaddr gpa, vmsa_check.x87_fcw =3D 0; vmsa_check.mxcsr =3D 0; =20 - if (check_sev_features(sev_common, vmsa_check.sev_features, errp) < 0)= { - return -1; - } vmsa_check.sev_features =3D 0; =20 if (!buffer_is_zero(&vmsa_check, sizeof(vmsa_check))) { @@ -1918,6 +1915,10 @@ static int sev_common_kvm_init(ConfidentialGuestSupp= ort *cgs, Error **errp) } } =20 + if (check_sev_features(sev_common, sev_common->sev_features, errp)= < 0) { + return -1; + } + /* * KVM maintains a bitmask of allowed sev_features. This does not * include SVM_SEV_FEAT_SNP_ACTIVE which is set accordingly by KVM @@ -2537,9 +2538,6 @@ static int cgs_set_guest_state(hwaddr gpa, uint8_t *p= tr, uint64_t len, __func__); return -1; } - if (check_sev_features(sev_common, sa->sev_features, errp) < 0= ) { - return -1; - } sev_common->sev_features =3D sa->sev_features; } return 0; --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648349; cv=none; d=zohomail.com; s=zohoarc; b=AT6WuofZ5GD7nDKZS+2cUDWNznDiodroyHOH0yYr//S9Sq9SR+coUlweACNJb6IZkyIYkHeV52szIAULm78sBLPUCDrpMxrBeic34y7ZRWOSeljIqVSNcKBrDZz+YT5B/pH8/w27mTswplUtGJEiZtMre1S1hnV7MGIEfHDZpwI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648349; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hFDOQcXy+FPAt7mTke01pN6pQ2thmoaI1Xi8GBria1o=; b=L684nJP12lSOMEyGLvPZr0xpi1fCEOcgLsGPSkUdJUiPoe6ZDCPSWhR3JoDvh0EP1nKFewHOGKxf/jFUF2iVQhJdMvjR6Lv0L1K+zJeo30Gp1je3tblpGo9t1Eyrmb1GxrSqrhjQ0jzbK/3X1XtdUmCFgmRElYYRjzXMz1H5Xn0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648349860227.76522998378152; Tue, 28 Oct 2025 03:45:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhCf-0007Fz-E4; Tue, 28 Oct 2025 06:45:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCd-0007Fb-Lm for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:24 -0400 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCa-0005V4-Gt for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:23 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 67F6248D5E; Tue, 28 Oct 2025 10:45:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6DABBC4CEE7; Tue, 28 Oct 2025 10:45:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648318; bh=xVnqX8crbKqd8uWLNFV2xVdJ2zPB23rGCWpVzawCkbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=myMMvoSXfcqZ+0CGHxOkDKAKjEOysapkQVz0Ulpqm+I32MhAuY5Vp41IDXyC6hd7b rmxTCDavsP7AjvABLENeHPe6iHWqwnDu3Sjd8azjYNzbaSPf6xE6YTAxOAonkj1Laf Ka6uV0nlbJVl3UUA5Por882ky7OolzURTYGlhAoWUMSSwrz2O0Wx+d8kf3fHrt6PDc sHuItETnQDwVqNR/4ehP5zJOwJz2ZAS/5dA9sIVQsTF7MSGg366Nrp4EbjIdXPKJuS ovIF8pq7dtyG9/+Bl6gLcKszHNc5XqGHeEPiG1WX8HCBbw4Co1s61pQZLdZoe1w5cw pcY4XHTx09IbA== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 4/9] target/i386: SEV: Validate that SEV-ES is enabled when VMSA features are used Date: Tue, 28 Oct 2025 16:13:29 +0530 Message-ID: <57e9313692d7aad7f663a267f360e9ff708a1c77.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2600:3c0a:e001:78e:0:1991:8:25; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648352076154100 Content-Type: text/plain; charset="utf-8" SEV features in the VMSA are only meaningful for SEV-ES and SEV-SNP guests, as they control aspects of the encrypted guest state that are not relevant for basic SEV guests. Add a check in check_sev_features() to ensure that SEV-ES or SEV-SNP is enabled when any SEV features are specified. Reviewed-by: Nikunj A Dadhania Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/target/i386/sev.c b/target/i386/sev.c index 89cde2c6464a..35df7be4f67c 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -518,6 +518,12 @@ static int check_sev_features(SevCommonState *sev_comm= on, uint64_t sev_features, __func__); return -1; } + if (sev_features && !sev_es_enabled()) { + error_setg(errp, + "%s: SEV features require either SEV-ES or SEV-SNP to b= e enabled", + __func__); + return -1; + } if (sev_features & ~sev_common->supported_sev_features) { error_setg(errp, "%s: VMSA contains unsupported sev_features: %lX, " --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648403; cv=none; d=zohomail.com; s=zohoarc; b=aEUXWG37V5+ZSjGr/Nkt52ffRb0juRJSEPp+b2Jru+fXbMteCE5ySdab0FFe1xrUfQMbG/MKfQllHWJigbgQTfKqpHCg4wRAOn4xG47B35xQnccNcrDgNdv1+to2aCB0vMzIa8XOb+ZHTTvILnWnMjm7o+gh67KhyKob6eYF5vg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648403; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FPduU5Esi5RF1kzn5hitQKOEWcjswSDeOYc7kLdfWgw=; b=IrhKAMBsUAcEkrIAzX7ODUsbwK+PK6OIGpGfflqvjpt5WYLscNbyHVBW7Hz2xh2/tPuB2LUrZYGQGYYwSzu05axYI1RjXXYU/q9BlaVTR6WzaJOCHtFqNwiXA1vnMUEcP8pExV/PqwZc6qVcMAnY6TeDOT06lCr0NYZgTQ7MDh4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648403943730.7551009458236; Tue, 28 Oct 2025 03:46:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhCs-0007Ht-TQ; Tue, 28 Oct 2025 06:45:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCo-0007H7-EE for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:34 -0400 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCl-0005XE-1y for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:34 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 01EA040195; Tue, 28 Oct 2025 10:45:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B889AC4CEE7; Tue, 28 Oct 2025 10:45:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648327; bh=RSWeHer5ogiaCBX7doP42pYj41uDEP8FTTxi62xTfuM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DkcVPH12APd1M/K7syTb2yNbeTJTw25gc35SlBskQgAAUe5OL31jg8euPhf6yBMpi 19MRW5Cf9tSIx8aHI4pV8v9+SXOTiXfxYE8NSEAEW6OY6oRSoihY2vSSvnSUTxzDmK naLcO8cGjNXKzRmplwr0eA8sVGognWNBeZ5PYMYy7UgN9nWZixytzNY3V+JTeCd4w5 uunresLv3at5y/d1JsYiL309A2GIWHHYoU5o7RCITL5lnXp23uAU9iDVXH/4ce4YWs vxS51HL3yEVkSdkWojI1HXeXekfyJLGxqSKAL0ToS/agjWMQtTqGQIzTqF9f40W8nO zh4uossSOAf0w== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 5/9] target/i386: SEV: Enable use of KVM_SEV_INIT2 for SEV-ES guests Date: Tue, 28 Oct 2025 16:13:30 +0530 Message-ID: <99f1b890070a36862766bbd496ad18dd5b24aa18.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2600:3c0a:e001:78e:0:1991:8:25; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648406456154100 Content-Type: text/plain; charset="utf-8" In preparation for allowing SEV-ES guests to enable VMSA SEV features, update sev_init2_required() to return true if any SEV features are requested. This enables qemu to use KVM_SEV_INIT2 for SEV-ES guests when necessary. Reviewed-by: Nikunj A Dadhania Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 35df7be4f67c..0508b8998997 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -1699,8 +1699,7 @@ sev_vm_state_change(void *opaque, bool running, RunSt= ate state) */ static bool sev_init2_required(SevGuestState *sev_guest) { - /* Currently no KVM_SEV_INIT2-specific options are exposed via QEMU */ - return false; + return !!SEV_COMMON(sev_guest)->sev_features; } =20 static int sev_kvm_type(X86ConfidentialGuest *cg) --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648391; cv=none; d=zohomail.com; s=zohoarc; b=bMlmrbeRypk1t780kcqUWGu2uBnqFrvpQ8jjwmf4fpVgphh/kKKytNZ+YhZH890Z95ARy7xqOiAOfTxSDrxVvgM7zb3e0ZERAktjioNqvIEYYI5+6mZuNVTb95ei5KPMrQa5IzjiKvc6f4kD2sK23MFltzq+tWr2+aBc1BWpY4Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648391; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7PXU0KudA4lCh1cHWJ2Z3Ek88d4g0GilUKcFYkuqxBU=; b=L8wfZ185SMXLKK+trUHwhp9y4AydAEMWXwPJvxs48X3ZKkGAzPhO9T3Cx8B/MS5kT2U2mtNusQPPVgcWsgelhGzxbtxc+DZ2EOz2BDhuNed1I04nx2QIscJQhIMHq9cbGHzkJwUklygj92ypu3+9eOgZ0PHW7u7nuHhiQ9skwD0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648391412531.6784030093797; Tue, 28 Oct 2025 03:46:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhD4-0007PG-J2; Tue, 28 Oct 2025 06:45:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCy-0007IL-Sm for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:46 -0400 Received: from sea.source.kernel.org ([172.234.252.31]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhCt-0005aa-Iq for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:44 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id CC81640195; Tue, 28 Oct 2025 10:45:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBA7AC4CEE7; Tue, 28 Oct 2025 10:45:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648337; bh=5loEzMpfIdonqQFmPBZ630rSRFDUYBkaKtJLL1zfw3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hUGbmm8PZGStITaZJsS9Td8Liin28iEbvewokKYQ26oBC/wPoP9gXJjQjo2waSb0o 45984r3uV8uDMNCzKiD+WSLJvNIo4gC8Kw31+UkWsW9lYj7/ZOk1poIhdmkv7qfq2S a3fq8+8HQ4ecEaq0u7aa2+DYHddhkK7TINE6Zuv4Plw2Hn7B9YA0b/9rc2DOGkne4K 1V67DfYACl3gMXaUTMFFCHhETpwboQlWLBdBR1qu/foN56AsYj9pmWMkIYv+hmOVKw EH3GbFnxkLstBQKUoZ8DXQaAfDQ2AL849+Vr04NOCWw2Dp8Fk5fclx7xjYYg9lg6Hn CJbjKFG5eb1QQ== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 6/9] target/i386: SEV: Add support for enabling debug-swap SEV feature Date: Tue, 28 Oct 2025 16:13:31 +0530 Message-ID: <5fad4eec4386eba7a3aaa7fbc7b8ab3fa79dcdbd.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=172.234.252.31; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648392350154100 Content-Type: text/plain; charset="utf-8" Add support for enabling debug-swap VMSA SEV feature in SEV-ES and SEV-SNP guests through a new "debug-swap" boolean property on SEV guest objects. Though the boolean property is available for plain SEV guests, check_sev_features() has a check that rejects attempts to enable any SEV feature for a plain SEV guest. Though this SEV feature is called "Debug virtualization" in the APM, KVM calls this "debug swap" so use the same name for consistency. Sample command-line: -machine q35,confidential-guest-support=3Dsev0 \ -object sev-snp-guest,id=3Dsev0,cbitpos=3D51,reduced-phys-bits=3D1,debug-= swap=3Don Reviewed-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.h | 1 + target/i386/sev.c | 20 ++++++++++++++++++++ qapi/qom.json | 7 ++++++- 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/target/i386/sev.h b/target/i386/sev.h index 102546b112d6..8e09b2ce1976 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -45,6 +45,7 @@ bool sev_snp_enabled(void); #define SEV_SNP_POLICY_DBG 0x80000 =20 #define SVM_SEV_FEAT_SNP_ACTIVE BIT(0) +#define SVM_SEV_FEAT_DEBUG_SWAP BIT(5) =20 typedef struct SevKernelLoaderContext { char *setup_data; diff --git a/target/i386/sev.c b/target/i386/sev.c index 0508b8998997..2cea2661cc03 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -319,6 +319,11 @@ sev_set_guest_state(SevCommonState *sev_common, SevSta= te new_state) sev_common->state =3D new_state; } =20 +static bool is_sev_feature_set(SevCommonState *sev_common, uint64_t featur= e) +{ + return !!(sev_common->sev_features & feature); +} + static void sev_set_feature(SevCommonState *sev_common, uint64_t feature, = bool set) { if (set) { @@ -2745,6 +2750,16 @@ static int cgs_set_guest_policy(ConfidentialGuestPol= icyType policy_type, return 0; } =20 +static bool sev_common_get_debug_swap(Object *obj, Error **errp) +{ + return is_sev_feature_set(SEV_COMMON(obj), SVM_SEV_FEAT_DEBUG_SWAP); +} + +static void sev_common_set_debug_swap(Object *obj, bool value, Error **err= p) +{ + sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_DEBUG_SWAP, value); +} + static void sev_common_class_init(ObjectClass *oc, const void *data) { @@ -2762,6 +2777,11 @@ sev_common_class_init(ObjectClass *oc, const void *d= ata) sev_common_set_kernel_hashes); object_class_property_set_description(oc, "kernel-hashes", "add kernel hashes to guest firmware for measured Linux boot"); + object_class_property_add_bool(oc, "debug-swap", + sev_common_get_debug_swap, + sev_common_set_debug_swap); + object_class_property_set_description(oc, "debug-swap", + "enable virtualization of debug registers"); } =20 static void diff --git a/qapi/qom.json b/qapi/qom.json index 830cb2ffe781..e89d11ce45ad 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -1010,13 +1010,18 @@ # designated guest firmware page for measured boot with -kernel # (default: false) (since 6.2) # +# @debug-swap: enable virtualization of debug registers, +# only supported on SEV-ES and SEV-SNP guests +# (default: false) (since 10.2) +# # Since: 9.1 ## { 'struct': 'SevCommonProperties', 'data': { '*sev-device': 'str', '*cbitpos': 'uint32', 'reduced-phys-bits': 'uint32', - '*kernel-hashes': 'bool' } } + '*kernel-hashes': 'bool', + '*debug-swap': 'bool' } } =20 ## # @SevGuestProperties: --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648398; cv=none; d=zohomail.com; s=zohoarc; b=QH0cyAN6gSiMleFiUo2/TgMnxLZc8xq84Hh542N2Lu/T3v3erVOhghcyZ3X0IJEMoFMOZaRAvQJXKkTOlZp9nvWNR37p8+ejwqMf4z2qd4s37gooyy1dqSahze/8xbXvWSSoZ/MmyRzl08vXgPkWmfxEB1gR38rm/UjrAdWk0Vs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648398; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pRPNqL7g44jSdml3fsXqFTsYiWGrqpOkP+0BAT3EHf0=; b=MqSgZgcRNxpQrJyqLUd2Rb1zDvpfEAJk3nKAzrmEJHQY3oZf/h0iTucSLfGdv79HlsfrIiieVJAW4ivSb1Mn6Gz63TZx/1C9oZtlNwWpparzGI6u+9NP2zptoc2ugt1tVsYsx5ydOKuOzTTjONSxWHI2P5NxLd31DbQPb1K5wq4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648398705802.0745193195978; Tue, 28 Oct 2025 03:46:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhDC-0007UE-Kd; Tue, 28 Oct 2025 06:45:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhD6-0007QG-Fs for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:54 -0400 Received: from sea.source.kernel.org ([172.234.252.31]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhD2-0005cm-W3 for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:45:52 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id F14A740195; Tue, 28 Oct 2025 10:45:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B63D2C4CEE7; Tue, 28 Oct 2025 10:45:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648346; bh=yuefX2bV8TgwobVJcRSeFhEprglnx9h+ky2Mj086e38=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cCkhiyGz0MoyRDhWl+MLLVT6QY98/zwC5nDtvFVT49TJRugsGdco8vY9zFSl5L3qn qYWn5sl6+9suoieSiBLUj9QJIoT9MVDNRXYJ8CB71aXsYuKlKYYHNC4s2teiuo+ORZ GemR04/Jbw08yXsPacBrbrPk5mxzBiohypTO9LtkTrotusUWbCmoFd70PS7oEyjZw7 5JDP/d6fgjjO7lWulNaqi09RhqgFnKpfafSenW7Dn6fwf1h8xH1RouuL8BIOg1iXYi 8KhCIfxuuG1/TDR1aIqWtJHLaohLOgNuOSWdJXaETwrJ6yCuo6sr0g2U2phnWDwwbV /AyGid/25RYoQ== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 7/9] target/i386: SEV: Add support for enabling Secure TSC SEV feature Date: Tue, 28 Oct 2025 16:13:32 +0530 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=172.234.252.31; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648400664154100 Content-Type: text/plain; charset="utf-8" Add support for enabling Secure TSC VMSA SEV feature in SEV-SNP guests through a new "secure-tsc" boolean property on SEV-SNP guest objects. By default, KVM uses the host TSC frequency for Secure TSC. Sample command-line: -machine q35,confidential-guest-support=3Dsev0 \ -object sev-snp-guest,id=3Dsev0,cbitpos=3D51,reduced-phys-bits=3D1,secure= -tsc=3Don Reviewed-by: Tom Lendacky Co-developed-by: Ketan Chaturvedi Signed-off-by: Ketan Chaturvedi Co-developed-by: Nikunj A Dadhania Signed-off-by: Nikunj A Dadhania Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.h | 1 + target/i386/sev.c | 13 +++++++++++++ qapi/qom.json | 6 +++++- 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/target/i386/sev.h b/target/i386/sev.h index 8e09b2ce1976..87e73034ad15 100644 --- a/target/i386/sev.h +++ b/target/i386/sev.h @@ -46,6 +46,7 @@ bool sev_snp_enabled(void); =20 #define SVM_SEV_FEAT_SNP_ACTIVE BIT(0) #define SVM_SEV_FEAT_DEBUG_SWAP BIT(5) +#define SVM_SEV_FEAT_SECURE_TSC BIT(9) =20 typedef struct SevKernelLoaderContext { char *setup_data; diff --git a/target/i386/sev.c b/target/i386/sev.c index 2cea2661cc03..af8222b8ceb3 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -3122,6 +3122,16 @@ sev_snp_guest_set_host_data(Object *obj, const char = *value, Error **errp) memcpy(finish->host_data, blob, len); } =20 +static bool sev_snp_guest_get_secure_tsc(Object *obj, Error **errp) +{ + return is_sev_feature_set(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC); +} + +static void sev_snp_guest_set_secure_tsc(Object *obj, bool value, Error **= errp) +{ + sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC, value); +} + static void sev_snp_guest_class_init(ObjectClass *oc, const void *data) { @@ -3157,6 +3167,9 @@ sev_snp_guest_class_init(ObjectClass *oc, const void = *data) object_class_property_add_str(oc, "host-data", sev_snp_guest_get_host_data, sev_snp_guest_set_host_data); + object_class_property_add_bool(oc, "secure-tsc", + sev_snp_guest_get_secure_tsc, + sev_snp_guest_set_secure_tsc); } =20 static void diff --git a/qapi/qom.json b/qapi/qom.json index e89d11ce45ad..c7dd2dd1b095 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -1101,6 +1101,9 @@ # firmware. Set this to true to disable the use of VCEK. # (default: false) (since: 9.1) # +# @secure-tsc: enable Secure TSC +# (default: false) (since 10.2) +# # Since: 9.1 ## { 'struct': 'SevSnpGuestProperties', @@ -1112,7 +1115,8 @@ '*id-auth': 'str', '*author-key-enabled': 'bool', '*host-data': 'str', - '*vcek-disabled': 'bool' } } + '*vcek-disabled': 'bool', + '*secure-tsc': 'bool' } } =20 ## # @TdxGuestProperties: --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648459; cv=none; d=zohomail.com; s=zohoarc; b=elrGoEx5H6y7+0yt8QH6WUleIZRrNz9JzjpJE6lz+QL7IRfY+IGdGkTqZKJoyhihTR5lYpf2nOAQ2gYvtQyE913SHbsdp4OA1+bbzICNrLG3DJRDolO41YkDK2bjsG3Er/2toRx0zRTvXCixhYVgzc/ID6hkNCpzd4uuOr2o1Lg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648459; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=E1n5JudM8ZWyfzPrbD+s+uiDiM2KWNrRzLxO7oai+R4=; b=SqVOW5Y6qDXVP4g7KB5q4trDN3Xfg+mNKLiKjzPcFeDDseYgGr0TLdT9e2Lmzf3XtHjqBKya6/Ap3PFtjQhDp/KPUvDUGycfSRRUDucahqBERzXU798mzBPCt3nukrvUkdvX0ADK3l62IRNV9kz3RL6b0mBgmdM4tPd4wbISf0U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648459518243.16654522142176; Tue, 28 Oct 2025 03:47:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhEK-0008P5-8f; Tue, 28 Oct 2025 06:47:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDG-0007WK-0z for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:10 -0400 Received: from tor.source.kernel.org ([172.105.4.254]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDA-0005fe-UJ for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:01 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 3549D61DF9; Tue, 28 Oct 2025 10:45:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09727C4CEF7; Tue, 28 Oct 2025 10:45:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648354; bh=fGiMIK+5rvPBNof4E+LoU+XtI3OHKHXj0Nev0oi8Bb8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WBi/VdPAGcyZP9N/cwwcFYtQMQv+NSVagZ62uWJnKMf9LxaS7F7NF7HRMIRohtSIG +wDqMucj6P/mCyOEkGy2WDKNAsDidzPTsclyesZ3b/ctTT+1GowrxEqeuy3j938q7G YIZVA61K74Pe13oBdL0nO7Gm3Vpr+tuG8Hxrw5dJ3wPO2qd0RNGwufSSuFbdS8c2CF VgeeqTZ8pKm8Xyowveb9JTjJJfUzYScqNKtGtLdr+UcYOVET7P01Z8aBFecHkW+JcC 0psBfJyz0rUFsWhUuxPkywZr/2jTqqXjWHSG0ferMdBJedNOAzLb1uClFwVIJxk6hq j3+i6bh2AjG3w== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 8/9] target/i386: SEV: Add support for setting TSC frequency for Secure TSC Date: Tue, 28 Oct 2025 16:13:33 +0530 Message-ID: X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=172.105.4.254; envelope-from=naveen@kernel.org; helo=tor.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648461298154100 Content-Type: text/plain; charset="utf-8" Add support for configuring the TSC frequency when Secure TSC is enabled in SEV-SNP guests through a new "tsc-frequency" property on SEV-SNP guest objects, similar to the vCPU-specific property used by regular guests and TDX. A new property is needed since SEV-SNP guests require the TSC frequency to be specified during early SNP_LAUNCH_START command before any vCPUs are created. The user-provided TSC frequency is set through KVM_SET_TSC_KHZ before issuing KVM_SEV_SNP_LAUNCH_START. Attempts to set TSC frequency on both the SEV_SNP object and the cpu object result in an error from KVM (on the vCPU ioctl), so do not add separate checks for the same. Sample command-line: -machine q35,confidential-guest-support=3Dsev0 \ -object sev-snp-guest,id=3Dsev0,cbitpos=3D51,reduced-phys-bits=3D1,secure= -tsc=3Don,tsc-frequency=3D2500000000 Co-developed-by: Ketan Chaturvedi Signed-off-by: Ketan Chaturvedi Co-developed-by: Nikunj A Dadhania Signed-off-by: Nikunj A Dadhania Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ qapi/qom.json | 6 +++++- 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index af8222b8ceb3..56d7cc9e6901 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -178,6 +178,7 @@ struct SevSnpGuestState { char *id_auth_base64; uint8_t *id_auth; char *host_data; + uint32_t tsc_khz; =20 struct kvm_sev_snp_launch_start kvm_start_conf; struct kvm_sev_snp_launch_finish kvm_finish_conf; @@ -536,6 +537,13 @@ static int check_sev_features(SevCommonState *sev_comm= on, uint64_t sev_features, __func__, sev_features, sev_common->supported_sev_featu= res); return -1; } + if (sev_snp_enabled() && SEV_SNP_GUEST(sev_common)->tsc_khz && + !(sev_features & SVM_SEV_FEAT_SECURE_TSC)) { + error_setg(errp, + "%s: TSC frequency can only be set if Secure TSC is ena= bled", + __func__); + return -1; + } return 0; } =20 @@ -1085,6 +1093,19 @@ sev_snp_launch_start(SevCommonState *sev_common) return 1; } =20 + if (is_sev_feature_set(sev_common, SVM_SEV_FEAT_SECURE_TSC) && + sev_snp_guest->tsc_khz) { + rc =3D -EINVAL; + if (kvm_check_extension(kvm_state, KVM_CAP_VM_TSC_CONTROL)) { + rc =3D kvm_vm_ioctl(kvm_state, KVM_SET_TSC_KHZ, sev_snp_guest-= >tsc_khz); + } + if (rc < 0) { + error_report("%s: Unable to set Secure TSC frequency to %u kHz= ret=3D%d", + __func__, sev_snp_guest->tsc_khz, rc); + return 1; + } + } + rc =3D sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START, start, &fw_error); if (rc < 0) { @@ -3132,6 +3153,28 @@ static void sev_snp_guest_set_secure_tsc(Object *obj= , bool value, Error **errp) sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC, value); } =20 +static void +sev_snp_guest_get_tsc_frequency(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + uint32_t value =3D SEV_SNP_GUEST(obj)->tsc_khz * 1000; + + visit_type_uint32(v, name, &value, errp); +} + +static void +sev_snp_guest_set_tsc_frequency(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + uint32_t value; + + if (!visit_type_uint32(v, name, &value, errp)) { + return; + } + + SEV_SNP_GUEST(obj)->tsc_khz =3D value / 1000; +} + static void sev_snp_guest_class_init(ObjectClass *oc, const void *data) { @@ -3170,6 +3213,9 @@ sev_snp_guest_class_init(ObjectClass *oc, const void = *data) object_class_property_add_bool(oc, "secure-tsc", sev_snp_guest_get_secure_tsc, sev_snp_guest_set_secure_tsc); + object_class_property_add(oc, "tsc-frequency", "uint32", + sev_snp_guest_get_tsc_frequency, + sev_snp_guest_set_tsc_frequency, NULL, NULL); } =20 static void diff --git a/qapi/qom.json b/qapi/qom.json index c7dd2dd1b095..5daaf065b6b7 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -1104,6 +1104,9 @@ # @secure-tsc: enable Secure TSC # (default: false) (since 10.2) # +# @tsc-frequency: set secure TSC frequency. Only valid if Secure TSC +# is enabled (default: zero) (since 10.2) +# # Since: 9.1 ## { 'struct': 'SevSnpGuestProperties', @@ -1116,7 +1119,8 @@ '*author-key-enabled': 'bool', '*host-data': 'str', '*vcek-disabled': 'bool', - '*secure-tsc': 'bool' } } + '*secure-tsc': 'bool', + '*tsc-frequency': 'uint32' } } =20 ## # @TdxGuestProperties: --=20 2.51.0 From nobody Fri Nov 14 18:15:52 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1761648460; cv=none; d=zohomail.com; s=zohoarc; b=DskBeJZVb4GQ3vQI3jDV12DWdB81jY5SpB3Jwia8PpibPKVsGAcUOK0ELVJAZYY6KRaW75Jme5+V5jMg9JHOPtqqVDqzekUvRxCxRwLRwZam4ov2tszJ2aiZfKinYKPKT9KDLN4oKgDgmtq7p1VkhK6nMMtK+LOGM3vUaB1S0rk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761648460; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uL4MJkPAGZY44VYhNMdnrBVSUjHtzjhtTLLcZtqq9U4=; b=Bj3FgnW3UkGBF+j9N3cd8R/Kh9C2unEhENKKZtNa5GI3YGXd8JzLH3YO/0Z8tThM3/7AGNL8lBnGL3yQ8sz0zjeEjBSkXb/PI4Fd51RSe5aRgik4a8jIK9reQUE5Zg7ZIKD+zEZJheLUy/zoK2G4OAJym13klDziuEK47ejd0EE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1761648460917763.8290787006915; Tue, 28 Oct 2025 03:47:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vDhEL-0008Pa-44; Tue, 28 Oct 2025 06:47:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDM-0007dh-64 for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:10 -0400 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vDhDI-0005ik-Ic for qemu-devel@nongnu.org; Tue, 28 Oct 2025 06:46:07 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 1B0B341513; Tue, 28 Oct 2025 10:46:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2534C4CEE7; Tue, 28 Oct 2025 10:46:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1761648362; bh=D7GV5YIK68KaGFIMf54ClZrWmjlH6jCoh70v8kXC7y4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VYEHinBMuNAEqyu4VNJ9U0kDI3rfkJwqKkNvLUWzhvaFnFLyj1NlX5NqOFuDArxw6 ULBmuOh1lRRK38agQcTJbtya6scu9CuZnv4o6icC1NgNOURJtO+eeKAeYpv1esiSca EYWP47hadwWrYRjYQOOyWdaURJWqCtrYZDNmxdbeFYBmrw4Pjebonpd5h6Nwje39z1 kQ3iyTPYSyDToz26+cjSrmGNE1eP/E0GjZOqk5KjmYCdyTy7SaIdeJOMx7CXL2vgtC 3STl0iZpx0M+jxwgotCpaDe2ao+3rp1enSNrc0nL1v2BJo0ZTWZR6tkJSejwyQLaHG Uwj9LbHJaSyTQ== From: "Naveen N Rao (AMD)" To: qemu-devel Cc: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Eduardo Habkost , Eric Blake , Markus Armbruster , Marcelo Tosatti , Zhao Liu , Nikunj A Dadhania , Tom Lendacky , Michael Roth , Roy Hopkins , Srikanth Aithal Subject: [PATCH v3 9/9] target/i386: SEV: Refactor check_sev_features() Date: Tue, 28 Oct 2025 16:13:34 +0530 Message-ID: <0f998f5761f180829240f84172698f9315655572.1761648149.git.naveen@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2600:3c0a:e001:78e:0:1991:8:25; envelope-from=naveen@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1761648463357154100 Content-Type: text/plain; charset="utf-8" Refactor check_sev_features() to consolidate SEV-SNP checks to a single if block. This is also helpful when adding checks for future SEV features. While at it, move the comment about the checks being done outside of the function body and expand it to describe what this function does. Update error_setg() invocations to use a consistent format. No functional change intended. Suggested-by: Tom Lendacky Signed-off-by: Naveen N Rao (AMD) --- target/i386/sev.c | 55 ++++++++++++++++++++++++++--------------------- 1 file changed, 30 insertions(+), 25 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index 56d7cc9e6901..50d9e5714408 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -502,34 +502,22 @@ static void sev_apply_cpu_context(CPUState *cpu) } } =20 +/* + * Ensure SEV_FEATURES is configured for correct SEV hardware and that + * the requested features are supported. In addition, ensure feature + * dependencies are satisfied (allow tsc-frequency only if secure-tsc + * is also enabled, as an example). + */ static int check_sev_features(SevCommonState *sev_common, uint64_t sev_fea= tures, Error **errp) { - /* - * Ensure SEV_FEATURES is configured for correct SEV hardware and that - * the requested features are supported. If SEV-SNP is enabled then - * that feature must be enabled, otherwise it must be cleared. - */ - if (sev_snp_enabled() && !(sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) { - error_setg( - errp, - "%s: SEV_SNP is enabled but is not enabled in VMSA sev_feature= s", - __func__); - return -1; - } else if (!sev_snp_enabled() && - (sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) { - error_setg( - errp, - "%s: SEV_SNP is not enabled but is enabled in VMSA sev_feature= s", - __func__); - return -1; - } if (sev_features && !sev_es_enabled()) { error_setg(errp, "%s: SEV features require either SEV-ES or SEV-SNP to b= e enabled", __func__); return -1; } + if (sev_features & ~sev_common->supported_sev_features) { error_setg(errp, "%s: VMSA contains unsupported sev_features: %lX, " @@ -537,13 +525,30 @@ static int check_sev_features(SevCommonState *sev_com= mon, uint64_t sev_features, __func__, sev_features, sev_common->supported_sev_featu= res); return -1; } - if (sev_snp_enabled() && SEV_SNP_GUEST(sev_common)->tsc_khz && - !(sev_features & SVM_SEV_FEAT_SECURE_TSC)) { - error_setg(errp, - "%s: TSC frequency can only be set if Secure TSC is ena= bled", - __func__); - return -1; + + if (sev_snp_enabled()) { + if (!(sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) { + error_setg(errp, + "%s: SEV_SNP is enabled but is not enabled in VMSA = sev_features", + __func__); + return -1; + } + if (SEV_SNP_GUEST(sev_common)->tsc_khz && + !(sev_features & SVM_SEV_FEAT_SECURE_TSC)) { + error_setg(errp, + "%s: TSC frequency can only be set if Secure TSC is= enabled", + __func__); + return -1; + } + } else { + if (sev_features & SVM_SEV_FEAT_SNP_ACTIVE) { + error_setg(errp, + "%s: SEV_SNP is not enabled but is enabled in VMSA = sev_features", + __func__); + return -1; + } } + return 0; } =20 --=20 2.51.0