diff --git a/1047-target-i386-sev-Fix-incompatibility-between-SEV-and-.patch b/1047-target-i386-sev-Fix-incompatibility-between-SEV-and-.patch new file mode 100644 index 0000000000000000000000000000000000000000..111042e113d7f6b4da8b00563a599e3f1fb3cdd3 --- /dev/null +++ b/1047-target-i386-sev-Fix-incompatibility-between-SEV-and-.patch @@ -0,0 +1,37 @@ +From 07177f6d3928d81a0c604df28efe4ac99ff96572 Mon Sep 17 00:00:00 2001 +From: hanliyang +Date: Fri, 1 Mar 2024 14:12:44 +0800 +Subject: [PATCH 1/2] target/i386: sev: Fix incompatibility between SEV and CSV + on the GET_ID API + +If the length of GET_ID request is too small, Hygon CSV will return +SEV_RET_INVALID_PARAM. This return code doesn't comply with SEV API +Spec. + +Hygon will consider to fix the compitibility issue of return value +of the GET_ID API, so also check whether the return value is +SEV_RET_INVALID_LEN on Hygon CPUs. + +Signed-off-by: hanliyang +Change-Id: I204e69817fbb97c6c81bea086af53d4c312895b4 +--- + target/i386/sev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/target/i386/sev.c b/target/i386/sev.c +index 337f54415..95b16cc63 100644 +--- a/target/i386/sev.c ++++ b/target/i386/sev.c +@@ -589,7 +589,8 @@ static int sev_get_cpu0_id(int fd, guchar **id, size_t *id_len, Error **errp) + + /* query the ID length */ + r = sev_platform_ioctl(fd, SEV_GET_ID2, &get_id2, &err); +- if (r < 0 && err != SEV_RET_INVALID_LEN) { ++ if (r < 0 && err != SEV_RET_INVALID_LEN && ++ !(is_hygon_cpu() && err == SEV_RET_INVALID_PARAM)) { + error_setg(errp, "SEV: Failed to get ID ret=%d fw_err=%d (%s)", + r, err, fw_error_to_str(err)); + return 1; +-- +2.31.1 + diff --git a/1048-target-i386-sev-Add-support-for-reuse-ASID-for-diffe.patch b/1048-target-i386-sev-Add-support-for-reuse-ASID-for-diffe.patch new file mode 100644 index 0000000000000000000000000000000000000000..8ff070eea07f9376911bac6a8c3f7c61f51aeef9 --- /dev/null +++ b/1048-target-i386-sev-Add-support-for-reuse-ASID-for-diffe.patch @@ -0,0 +1,188 @@ +From 61c644ba560b8dd7fef2180633b0aa0cb1998fcd Mon Sep 17 00:00:00 2001 +From: appleLin +Date: Wed, 3 Aug 2022 21:02:41 +0800 +Subject: [PATCH 2/2] target/i386: sev: Add support for reuse ASID for + different CSV guests + +In you want to reuse one ASID for many CSV guests, you should provide a +label (i.e. userid) and the length of the label when launch CSV guest. +The CSV guests which were provided the same userid will share the same +ASID. + +Signed-off-by: hanliyang +Change-Id: I929a7489b310f08535df67c231ee7b3cd9cee51e +--- + linux-headers/linux/kvm.h | 5 +++++ + qapi/qom.json | 5 ++++- + qemu-options.hx | 5 ++++- + target/i386/csv.h | 5 +++-- + target/i386/sev.c | 47 ++++++++++++++++++++++++++++++++++++++- + 5 files changed, 62 insertions(+), 5 deletions(-) + +diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h +index 6edf0b33a..f67a7dde1 100644 +--- a/linux-headers/linux/kvm.h ++++ b/linux-headers/linux/kvm.h +@@ -2060,6 +2060,11 @@ struct kvm_csv_command_batch { + __u64 csv_batch_list_uaddr; + }; + ++struct kvm_csv_init { ++ __u64 userid_addr; ++ __u32 len; ++}; ++ + /* CSV3 command */ + enum csv3_cmd_id { + KVM_CSV3_NR_MIN = 0xc0, +diff --git a/qapi/qom.json b/qapi/qom.json +index c53ef978f..89a2516b4 100644 +--- a/qapi/qom.json ++++ b/qapi/qom.json +@@ -866,6 +866,8 @@ + # designated guest firmware page for measured boot with -kernel + # (default: false) (since 6.2) + # ++# @user-id: the user id of the guest owner, only support on Hygon CPUs ++# + # Since: 2.12 + ## + { 'struct': 'SevGuestProperties', +@@ -876,7 +878,8 @@ + '*handle': 'uint32', + '*cbitpos': 'uint32', + 'reduced-phys-bits': 'uint32', +- '*kernel-hashes': 'bool' } } ++ '*kernel-hashes': 'bool', ++ '*user-id': 'str' } } + + ## + # @ThreadContextProperties: +diff --git a/qemu-options.hx b/qemu-options.hx +index 42fd09e4d..0bc184cd0 100644 +--- a/qemu-options.hx ++++ b/qemu-options.hx +@@ -5637,7 +5637,7 @@ SRST + -object secret,id=sec0,keyid=secmaster0,format=base64,\\ + data=$SECRET,iv=$(dh_cert_file = g_strdup(value); + } + ++static char * ++sev_guest_get_user_id(Object *obj, Error **errp) ++{ ++ SevGuestState *s = SEV_GUEST(obj); ++ ++ return g_strdup(s->user_id); ++} ++ ++static void ++sev_guest_set_user_id(Object *obj, const char *value, Error **errp) ++{ ++ SevGuestState *s = SEV_GUEST(obj); ++ ++ s->user_id = g_strdup(value); ++} ++ + static char * + sev_guest_get_sev_device(Object *obj, Error **errp) + { +@@ -426,6 +443,11 @@ sev_guest_class_init(ObjectClass *oc, void *data) + sev_guest_set_kernel_hashes); + object_class_property_set_description(oc, "kernel-hashes", + "add kernel hashes to guest firmware for measured Linux boot"); ++ object_class_property_add_str(oc, "user-id", ++ sev_guest_get_user_id, ++ sev_guest_set_user_id); ++ object_class_property_set_description(oc, "user-id", ++ "user id of the guest owner"); + } + + static void +@@ -1178,7 +1200,30 @@ int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) + } + + trace_kvm_sev_init(); +- ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); ++ ++ /* Only support reuse asid for CSV/CSV2 guest */ ++ if (is_hygon_cpu() && ++ (sev_guest->policy & GUEST_POLICY_REUSE_ASID) && ++ !(sev_guest->policy & GUEST_POLICY_CSV3_BIT)) { ++ char *user_id = NULL; ++ struct kvm_csv_init *init_cmd_buf = NULL; ++ ++ user_id = object_property_get_str(OBJECT(sev), "user-id", NULL); ++ if (user_id && strlen(user_id)) { ++ init_cmd_buf = g_new0(struct kvm_csv_init, 1); ++ init_cmd_buf->len = strlen(user_id); ++ init_cmd_buf->userid_addr = (__u64)user_id; ++ } ++ ret = sev_ioctl(sev->sev_fd, cmd, init_cmd_buf, &fw_error); ++ ++ if (user_id) { ++ g_free(user_id); ++ g_free(init_cmd_buf); ++ } ++ } else { ++ ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error); ++ } ++ + if (ret) { + error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'", + __func__, ret, fw_error, fw_error_to_str(fw_error)); +-- +2.31.1 + diff --git a/qemu.spec b/qemu.spec index af6eefdcabb3d573e07f3cf1c62945870179134a..086f33c147b1a7126629e92a0774e3572eae03ff 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,4 +1,4 @@ -%define anolis_release 10 +%define anolis_release 11 %bcond_with check @@ -347,6 +347,8 @@ Patch1043: 1043-target-i386-csv-Add-support-to-migrate-the-outgoing-.patch Patch1044: 1044-target-i386-csv-Add-support-to-migrate-the-incoming-.patch Patch1045: 1045-target-i386-csv-Add-support-to-migrate-the-outgoing-.patch Patch1046: 1046-target-i386-csv-Add-support-to-migrate-the-incoming-.patch +Patch1047: 1047-target-i386-sev-Fix-incompatibility-between-SEV-and-.patch +Patch1048: 1048-target-i386-sev-Add-support-for-reuse-ASID-for-diffe.patch ExclusiveArch: x86_64 aarch64 loongarch64 @@ -1906,6 +1908,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Apr 15 2024 Liyang Han - 2:8.2.0-11 +- Patch1047: 1047-target-i386-sev-Fix-incompatibility-between-SEV-and-.patch +- Patch1048: 1048-target-i386-sev-Add-support-for-reuse-ASID-for-diffe.patch + (Fix GET_ID API incompatibility issue, support CSV reuse ASID) + * Thu Apr 11 2024 Liyang Han - 2:8.2.0-10 - Patch1033: 1033-target-i386-csv-Add-CSV3-context.patch - Patch1034: 1034-target-i386-csv-Add-command-to-initialize-CSV3-conte.patch