mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

target/i386: add support for masking CPUID features in confidential guests

Browse Source 
Some CPUID features may be provided by KVM for some guests, independent of
processor support, for example TSC deadline or TSC adjust.  If these are
not supported by the confidential computing firmware, however, the guest
will fail to start.  Add support for removing unsupported features from
"-cpu host".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2024-07-03 11:12:06 +02:00
parent a0124e333e
commit c28d8b097f
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
target/i386/confidential-guest.h
View File

@ -39,6 +39,8 @@ struct X86ConfidentialGuestClass {
/* <public> */ /* <public> */
int (*kvm_type)(X86ConfidentialGuest *cg); int (*kvm_type)(X86ConfidentialGuest *cg);
uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
int reg, uint32_t value);
}; };
/** /**
@ -56,4 +58,26 @@ static inline int x86_confidential_guest_kvm_type(X86ConfidentialGuest *cg)
return 0; return 0;
} }
} }
/**
* x86_confidential_guest_mask_cpuid_features:
*
* Removes unsupported features from a confidential guest's CPUID values, returns
* the value with the bits removed. The bits removed should be those that KVM
* provides independent of host-supported CPUID features, but are not supported by
* the confidential computing firmware.
*/
static inline int x86_confidential_guest_mask_cpuid_features(X86ConfidentialGuest *cg,
uint32_t feature, uint32_t index,
int reg, uint32_t value)
{
X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
if (klass->mask_cpuid_features) {
return klass->mask_cpuid_features(cg, feature, index, reg, value);
} else {
return value;
}
}
#endif #endif

5
target/i386/kvm/kvm.c
View File

@ -548,6 +548,11 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
ret |= 1U << KVM_HINTS_REALTIME; ret |= 1U << KVM_HINTS_REALTIME;
} }
if (current_machine->cgs) {
ret = x86_confidential_guest_mask_cpuid_features(
X86_CONFIDENTIAL_GUEST(current_machine->cgs),
function, index, reg, ret);
}
return ret; return ret;
} }