diff --git a/0045-anolis-target-i386-sev-Add-support-for-reuse-ASID-fo.patch b/0045-anolis-target-i386-sev-Add-support-for-reuse-ASID-fo.patch new file mode 100644 index 0000000000000000000000000000000000000000..0a0a53758d2c700d44556484eea029ab0a7f7515 --- /dev/null +++ b/0045-anolis-target-i386-sev-Add-support-for-reuse-ASID-fo.patch @@ -0,0 +1,192 @@ +From d883bd2e1361d9b7d7744a1e359eac290406c64d Mon Sep 17 00:00:00 2001 +From: appleLin +Date: Wed, 3 Aug 2022 21:02:41 +0800 +Subject: [PATCH] anolis: target/i386/sev: Add support for reuse ASID for + different CSV guests + +In you want to reuse one ASID for many CSV guests, you should provide a +label (i.e. userid) and the length of the label when launch CSV guest. +The CSV guests which were provided the same userid will share the same +ASID. + +Signed-off-by: hanliyang +--- + linux-headers/linux/kvm.h | 5 +++++ + qapi/qom.json | 5 ++++- + qemu-options.hx | 5 ++++- + target/i386/csv.c | 2 -- + target/i386/csv.h | 3 +++ + target/i386/sev.c | 47 ++++++++++++++++++++++++++++++++++++++- + 6 files changed, 62 insertions(+), 5 deletions(-) + +diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h +index 534616f56..a67662545 100644 +--- a/linux-headers/linux/kvm.h ++++ b/linux-headers/linux/kvm.h +@@ -2078,6 +2078,11 @@ struct kvm_csv_receive_encrypt_context { + __u32 trans_len; + }; + ++struct kvm_csv_init { ++ __u64 userid_addr; ++ __u32 len; ++}; ++ + #define KVM_DEV_ASSIGN_ENABLE_IOMMU (1 << 0) + #define KVM_DEV_ASSIGN_PCI_2_3 (1 << 1) + #define KVM_DEV_ASSIGN_MASK_INTX (1 << 2) +diff --git a/qapi/qom.json b/qapi/qom.json +index 30e76653a..72a53d2f7 100644 +--- a/qapi/qom.json ++++ b/qapi/qom.json +@@ -822,6 +822,8 @@ + # designated guest firmware page for measured boot + # with -kernel (default: false) (since 6.2) + # ++# @user-id: the user id of the guest owner, only support on Hygon CPUs ++# + # Since: 2.12 + ## + { 'struct': 'SevGuestProperties', +@@ -832,7 +834,8 @@ + '*handle': 'uint32', + '*cbitpos': 'uint32', + 'reduced-phys-bits': 'uint32', +- '*kernel-hashes': 'bool' } } ++ '*kernel-hashes': 'bool', ++ '*user-id': 'str' } } + + ## + # @ThreadContextProperties: +diff --git a/qemu-options.hx b/qemu-options.hx +index 379692da8..d7cf9fff0 100644 +--- a/qemu-options.hx ++++ b/qemu-options.hx +@@ -5416,7 +5416,7 @@ SRST + -object secret,id=sec0,keyid=secmaster0,format=base64,\\ + data=$SECRET,iv=$(dh_cert_file = g_strdup(value); + } + ++static char * ++sev_guest_get_user_id(Object *obj, Error **errp) ++{ ++ SevGuestState *s = SEV_GUEST(obj); ++ ++ return g_strdup(s->user_id); ++} ++ ++static void ++sev_guest_set_user_id(Object *obj, const char *value, Error **errp) ++{ ++ SevGuestState *s = SEV_GUEST(obj); ++ ++ s->user_id = g_strdup(value); ++} ++ + static char * + sev_guest_get_sev_device(Object *obj, Error **errp) + { +@@ -436,6 +453,11 @@ sev_guest_class_init(ObjectClass *oc, void *data) + sev_guest_set_kernel_hashes); + object_class_property_set_description(oc, "kernel-hashes", + "add kernel hashes to guest firmware for measured Linux boot"); ++ object_class_property_add_str(oc, "user-id", ++ sev_guest_get_user_id, ++ sev_guest_set_user_id); ++ object_class_property_set_description(oc, "user-id", ++ "user id of the guest owner"); + } + + static void +@@ -1177,7 +1199,30 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) + } + + trace_kvm_sev_init(); +- ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); ++ ++ /* Only support reuse asid for CSV/CSV2 guest */ ++ if (is_hygon_cpu() && ++ (sev_guest->policy & GUEST_POLICY_REUSE_ASID) && ++ !(sev_guest->policy & GUEST_POLICY_CSV_BIT)) { ++ char *user_id = NULL; ++ struct kvm_csv_init *init_cmd_buf = NULL; ++ ++ user_id = object_property_get_str(OBJECT(sev), "user-id", NULL); ++ if (user_id && strlen(user_id)) { ++ init_cmd_buf = g_new0(struct kvm_csv_init, 1); ++ init_cmd_buf->len = strlen(user_id); ++ init_cmd_buf->userid_addr = (__u64)user_id; ++ } ++ ret = sev_ioctl(sev->sev_fd, cmd, init_cmd_buf, &fw_error); ++ ++ if (user_id) { ++ g_free(user_id); ++ g_free(init_cmd_buf); ++ } ++ } else { ++ ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); ++ } ++ + if (ret) { + error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, fw_error_to_str(fw_error)); +-- +2.31.1 + diff --git a/qemu.spec b/qemu.spec index 3bb514c4e75805e0ddd3a45207e5725de4536043..b3bdde1daf918f9b09f44631f4c3936be7d6a2c3 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,4 +1,4 @@ -%define anolis_release 6 +%define anolis_release 7 %bcond_with check @@ -307,6 +307,7 @@ Patch0041: 0041-anolis-csv-i386-add-support-to-migrate-the-incoming-.patch Patch0042: 0042-anolis-csv-i386-add-support-to-migrate-the-outgoing-.patch Patch0043: 0043-anolis-csv-i386-add-support-to-migrate-the-incoming-.patch Patch0044: 0044-Fix-crash-when-loading-snapshot-on-inactive-node.patch +Patch0045: 0045-anolis-target-i386-sev-Add-support-for-reuse-ASID-fo.patch ExclusiveArch: x86_64 aarch64 @@ -1875,6 +1876,10 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Wed Jan 22 2024 Liyang Han - 15:7.2.6-7 +- Patch0045: 0045-anolis-target-i386-sev-Add-support-for-reuse-ASID-fo.patch + (Support reuse ASID for CSV guests) + * Fri Jan 19 2024 Chang Gao - 15:7.2.6-6 - Fix crash when revert snapshot