motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2026-02-05 07:40:42 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

i386/tdx: Get tdx_capabilities via KVM_TDX_CAPABILITIES

Browse source 
KVM provides TDX capabilities via sub command KVM_TDX_CAPABILITIES of
IOCTL(KVM_MEMORY_ENCRYPT_OP). Get the capabilities when initializing
TDX context. It will be used to validate user's setting later.

Since there is no interface reporting how many cpuid configs contains in
KVM_TDX_CAPABILITIES, QEMU chooses to try starting with a known number
and abort when it exceeds KVM_MAX_CPUID_ENTRIES.

Besides, introduce the interfaces to invoke TDX "ioctls" at VCPU scope
in preparation.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-6-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Xiaoyao Li 2025-05-08 10:59:11 -04:00 • committed by Paolo Bonzini
parent 631a2ac5a4
commit 8eddedc370
3 changed files with 109 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
target/i386/kvm/kvm.c
View file

@ -1780,8 +1780,6 @@ static int hyperv_init_vcpu(X86CPU *cpu)
static Error *invtsc_mig_blocker;
#define KVM_MAX_CPUID_ENTRIES 100
static void kvm_init_xsave(CPUX86State *env)
{
if (has_xsave2) {

2
target/i386/kvm/kvm_i386.h
View file

@ -13,6 +13,8 @@
#include "system/kvm.h"
#define KVM_MAX_CPUID_ENTRIES 100
/* always false if !CONFIG_KVM */
#define kvm_pit_in_kernel() \
(kvm_irqchip_in_kernel() && !kvm_irqchip_is_split())

109
target/i386/kvm/tdx.c
View file

@ -10,19 +10,124 @@
*/
#include "qemu/osdep.h"
#include "qemu/error-report.h"
#include "qapi/error.h"
#include "qom/object_interfaces.h"
#include "hw/i386/x86.h"
#include "kvm_i386.h"
#include "tdx.h"
static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
static struct kvm_tdx_capabilities *tdx_caps;
enum tdx_ioctl_level {
TDX_VM_IOCTL,
TDX_VCPU_IOCTL,
};
static int tdx_ioctl_internal(enum tdx_ioctl_level level, void *state,
int cmd_id, __u32 flags, void *data,
Error **errp)
{
kvm_mark_guest_state_protected();
struct kvm_tdx_cmd tdx_cmd = {};
int r;
const char *tdx_ioctl_name[] = {
[KVM_TDX_CAPABILITIES] = "KVM_TDX_CAPABILITIES",
[KVM_TDX_INIT_VM] = "KVM_TDX_INIT_VM",
[KVM_TDX_INIT_VCPU] = "KVM_TDX_INIT_VCPU",
[KVM_TDX_INIT_MEM_REGION] = "KVM_TDX_INIT_MEM_REGION",
[KVM_TDX_FINALIZE_VM] = "KVM_TDX_FINALIZE_VM",
[KVM_TDX_GET_CPUID] = "KVM_TDX_GET_CPUID",
};
tdx_cmd.id = cmd_id;
tdx_cmd.flags = flags;
tdx_cmd.data = (__u64)(unsigned long)data;
switch (level) {
case TDX_VM_IOCTL:
r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
break;
case TDX_VCPU_IOCTL:
r = kvm_vcpu_ioctl(state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
break;
default:
error_setg(errp, "Invalid tdx_ioctl_level %d", level);
return -EINVAL;
}
if (r < 0) {
error_setg_errno(errp, -r, "TDX ioctl %s failed, hw_errors: 0x%llx",
tdx_ioctl_name[cmd_id], tdx_cmd.hw_error);
}
return r;
}
static inline int tdx_vm_ioctl(int cmd_id, __u32 flags, void *data,
Error **errp)
{
return tdx_ioctl_internal(TDX_VM_IOCTL, NULL, cmd_id, flags, data, errp);
}
static inline int tdx_vcpu_ioctl(CPUState *cpu, int cmd_id, __u32 flags,
void *data, Error **errp)
{
return tdx_ioctl_internal(TDX_VCPU_IOCTL, cpu, cmd_id, flags, data, errp);
}
static int get_tdx_capabilities(Error **errp)
{
struct kvm_tdx_capabilities *caps;
/* 1st generation of TDX reports 6 cpuid configs */
int nr_cpuid_configs = 6;
size_t size;
int r;
do {
Error *local_err = NULL;
size = sizeof(struct kvm_tdx_capabilities) +
nr_cpuid_configs * sizeof(struct kvm_cpuid_entry2);
caps = g_malloc0(size);
caps->cpuid.nent = nr_cpuid_configs;
r = tdx_vm_ioctl(KVM_TDX_CAPABILITIES, 0, caps, &local_err);
if (r == -E2BIG) {
g_free(caps);
nr_cpuid_configs *= 2;
if (nr_cpuid_configs > KVM_MAX_CPUID_ENTRIES) {
error_report("KVM TDX seems broken that number of CPUID entries"
" in kvm_tdx_capabilities exceeds limit: %d",
KVM_MAX_CPUID_ENTRIES);
error_propagate(errp, local_err);
return r;
}
error_free(local_err);
} else if (r < 0) {
g_free(caps);
error_propagate(errp, local_err);
return r;
}
} while (r == -E2BIG);
tdx_caps = caps;
return 0;
}
static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
{
int r = 0;
kvm_mark_guest_state_protected();
if (!tdx_caps) {
r = get_tdx_capabilities(errp);
}
return r;
}
static int tdx_kvm_type(X86ConfidentialGuest *cg)
{
/* Do the object check */