mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-02 23:33:54 -06:00
* virtio-blk: remove SCSI passthrough functionality
* require x86-64-v2 baseline ISA * SEV-SNP host support * fix xsave.flat with TCG * fixes for CPUID checks done by TCG -----BEGIN PGP SIGNATURE----- iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZgKVYUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroPKYgf/QkWrNXdjjD3yAsv5LbJFVTVyCYW3 b4Iax29kEDy8k9wbzfLxOfIk9jXIjmbOMO5ZN9LFiHK6VJxbXslsMh6hm50M3xKe 49X1Rvf9YuVA7KZX+dWkEuqLYI6Tlgj3HaCilYWfXrjyo6hY3CxzkPV/ChmaeYlV Ad4Y8biifoUuuEK8OTeTlcDWLhOHlFXylG3AXqULsUsXp0XhWJ9juXQ60eATv/W4 eCEH7CSmRhYFu2/rV+IrWFYMnskLRTk1OC1/m6yXGPKOzgnOcthuvQfiUgPkbR/d llY6Ni5Aaf7+XX3S7Avcyvoq8jXzaaMzOrzL98rxYGDR1sYBYO+4h4ZToA== =qQeP -----END PGP SIGNATURE----- Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging * virtio-blk: remove SCSI passthrough functionality * require x86-64-v2 baseline ISA * SEV-SNP host support * fix xsave.flat with TCG * fixes for CPUID checks done by TCG # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZgKVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPKYgf/QkWrNXdjjD3yAsv5LbJFVTVyCYW3 # b4Iax29kEDy8k9wbzfLxOfIk9jXIjmbOMO5ZN9LFiHK6VJxbXslsMh6hm50M3xKe # 49X1Rvf9YuVA7KZX+dWkEuqLYI6Tlgj3HaCilYWfXrjyo6hY3CxzkPV/ChmaeYlV # Ad4Y8biifoUuuEK8OTeTlcDWLhOHlFXylG3AXqULsUsXp0XhWJ9juXQ60eATv/W4 # eCEH7CSmRhYFu2/rV+IrWFYMnskLRTk1OC1/m6yXGPKOzgnOcthuvQfiUgPkbR/d # llY6Ni5Aaf7+XX3S7Avcyvoq8jXzaaMzOrzL98rxYGDR1sYBYO+4h4ZToA== # =qQeP # -----END PGP SIGNATURE----- # gpg: Signature made Wed 05 Jun 2024 02:01:10 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (46 commits) hw/i386: Add support for loading BIOS using guest_memfd hw/i386/sev: Use guest_memfd for legacy ROMs memory: Introduce memory_region_init_ram_guest_memfd() i386/sev: Allow measured direct kernel boot on SNP i386/sev: Reorder struct declarations i386/sev: Extract build_kernel_loader_hashes i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE i386/sev: Invoke launch_updata_data() for SNP class i386/sev: Invoke launch_updata_data() for SEV class hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled i386/sev: Add support for SNP CPUID validation i386/sev: Add support for populating OVMF metadata pages hw/i386/sev: Add function to get SEV metadata from OVMF header i386/sev: Set CPU state to protected once SNP guest payload is finalized i386/sev: Add handling to encrypt/finalize guest launch data i386/sev: Add the SNP launch start context i386/sev: Update query-sev QAPI format to handle SEV-SNP i386/sev: Add a class method to determine KVM VM type for SNP guests i386/sev: Don't return launch measurements for SEV-SNP guests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Richard Henderson
commit
f1572ab947
51 changed files with 1849 additions and 614 deletions
|
|
@ -280,16 +280,6 @@ Device options
|
|||
Emulated device options
|
||||
'''''''''''''''''''''''
|
||||
|
||||
``-device virtio-blk,scsi=on|off`` (since 5.0)
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
The virtio-blk SCSI passthrough feature is a legacy VIRTIO feature. VIRTIO 1.0
|
||||
and later do not support it because the virtio-scsi device was introduced for
|
||||
full SCSI support. Use virtio-scsi instead when SCSI passthrough is required.
|
||||
|
||||
Note this also applies to ``-device virtio-blk-pci,scsi=on|off``, which is an
|
||||
alias.
|
||||
|
||||
``-device nvme-ns,eui64-default=on|off`` (since 7.1)
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
|
|
|
|||
|
|
@ -510,6 +510,14 @@ than zero.
|
|||
|
||||
Removed along with the ``compression`` migration capability.
|
||||
|
||||
``-device virtio-blk,scsi=on|off`` (since 9.1)
|
||||
''''''''''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
The virtio-blk SCSI passthrough feature is a legacy VIRTIO feature. VIRTIO 1.0
|
||||
and later do not support it because the virtio-scsi device was introduced for
|
||||
full SCSI support. Use virtio-scsi instead when SCSI passthrough is required.
|
||||
|
||||
|
||||
User-mode emulator command line arguments
|
||||
-----------------------------------------
|
||||
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ A detailed command line would be:
|
|||
-object memory-backend-ram,size=1024M,policy=bind,host-nodes=1,id=ram-node1 -numa node,nodeid=1,cpus=1,memdev=ram-node1
|
||||
-device pxb,id=bridge1,bus=pci.0,numa_node=1,bus_nr=4 -netdev user,id=nd -device e1000,bus=bridge1,addr=0x4,netdev=nd
|
||||
-device pxb,id=bridge2,bus=pci.0,numa_node=0,bus_nr=8 -device e1000,bus=bridge2,addr=0x3
|
||||
-device pxb,id=bridge3,bus=pci.0,bus_nr=40 -drive if=none,id=drive0,file=[img] -device virtio-blk-pci,drive=drive0,scsi=off,bus=bridge3,addr=1
|
||||
-device pxb,id=bridge3,bus=pci.0,bus_nr=40 -drive if=none,id=drive0,file=[img] -device virtio-blk-pci,drive=drive0,bus=bridge3,addr=1
|
||||
|
||||
Here you have:
|
||||
- 2 NUMA nodes for the guest, 0 and 1. (both mapped to the same NUMA node in host, but you can and should put it in different host NUMA nodes)
|
||||
|
|
|
|||
|
|
@ -336,7 +336,7 @@ In case a pSeries machine is emulated, use the following command line:
|
|||
-tpmdev emulator,id=tpm0,chardev=chrtpm \
|
||||
-device tpm-spapr,tpmdev=tpm0 \
|
||||
-device spapr-vscsi,id=scsi0,reg=0x00002000 \
|
||||
-device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \
|
||||
-device virtio-blk-pci,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \
|
||||
-drive file=test.img,format=raw,if=none,id=drive-virtio-disk0
|
||||
|
||||
In case an Arm virt machine is emulated, use the following command line:
|
||||
|
|
|
|||
|
|
@ -25,8 +25,8 @@ support for notifying a guest's operating system when certain types of VMEXITs
|
|||
are about to occur. This allows the guest to selectively share information with
|
||||
the hypervisor to satisfy the requested function.
|
||||
|
||||
Launching
|
||||
---------
|
||||
Launching (SEV and SEV-ES)
|
||||
--------------------------
|
||||
|
||||
Boot images (such as bios) must be encrypted before a guest can be booted. The
|
||||
``MEMORY_ENCRYPT_OP`` ioctl provides commands to encrypt the images: ``LAUNCH_START``,
|
||||
|
|
@ -161,6 +161,72 @@ The value of GCTX.LD is
|
|||
If kernel hashes are not used, or SEV-ES is disabled, use empty blobs for
|
||||
``kernel_hashes_blob`` and ``vmsas_blob`` as needed.
|
||||
|
||||
Launching (SEV-SNP)
|
||||
-------------------
|
||||
Boot images (such as bios) must be encrypted before a guest can be booted. The
|
||||
``MEMORY_ENCRYPT_OP`` ioctl provides commands to encrypt the images:
|
||||
``SNP_LAUNCH_START``, ``SNP_LAUNCH_UPDATE``, and ``SNP_LAUNCH_FINISH``. These
|
||||
three commands communicate with SEV-SNP firmware to generate a fresh memory
|
||||
encryption key for the VM, encrypt the boot images for a successful launch. For
|
||||
more details on the SEV-SNP firmware interfaces used by these commands please
|
||||
see the SEV-SNP Firmware ABI.
|
||||
|
||||
``SNP_LAUNCH_START`` is called first to create a cryptographic launch context
|
||||
within the firmware. To create this context, the guest owner must provide a
|
||||
guest policy and other parameters as described in the SEV-SNP firmware
|
||||
specification. The launch parameters should be specified as described in the
|
||||
QAPI schema for the sev-snp-guest object.
|
||||
|
||||
The ``SNP_LAUNCH_START`` uses the following parameters, which can be configured
|
||||
by the corresponding parameters documented in the QAPI schema for the
|
||||
'sev-snp-guest' object.
|
||||
|
||||
+--------+-------+----------+-------------------------------------------------+
|
||||
| key | type | default | meaning |
|
||||
+---------------------------+-------------------------------------------------+
|
||||
| policy | hex | 0x30000 | a 64-bit guest policy |
|
||||
+---------------------------+-------------------------------------------------+
|
||||
| guest-visible-workarounds | string| 0 | 16-byte base64 encoded string|
|
||||
| | | | for guest OS visible |
|
||||
| | | | workarounds. |
|
||||
+---------------------------+-------------------------------------------------+
|
||||
|
||||
``SNP_LAUNCH_UPDATE`` encrypts the memory region using the cryptographic context
|
||||
created via the ``SNP_LAUNCH_START`` command. If required, this command can be
|
||||
called multiple times to encrypt different memory regions. The command also
|
||||
calculates the measurement of the memory contents as it encrypts.
|
||||
|
||||
``SNP_LAUNCH_FINISH`` finalizes the guest launch flow. Optionally, while
|
||||
finalizing the launch the firmware can perform checks on the launch digest
|
||||
computing through the ``SNP_LAUNCH_UPDATE``. To perform the check the user must
|
||||
supply the id block, authentication blob and host data that should be included
|
||||
in the attestation report. See the SEV-SNP spec for further details.
|
||||
|
||||
The ``SNP_LAUNCH_FINISH`` uses the following parameters, which can be configured
|
||||
by the corresponding parameters documented in the QAPI schema for the
|
||||
'sev-snp-guest' object.
|
||||
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
| key | type | default | meaning |
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
| id-block | string| none | base64 encoded ID block |
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
| id-auth | string| none | base64 encoded authentication |
|
||||
| | | | information |
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
| author-key-enabled | bool | 0 | auth block contains author key |
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
| host_data | string| none | host provided data |
|
||||
+--------------------+-------+----------+-------------------------------------+
|
||||
|
||||
To launch a SEV-SNP guest (additional parameters are documented in the QAPI
|
||||
schema for the 'sev-snp-guest' object)::
|
||||
|
||||
# ${QEMU} \
|
||||
-machine ...,confidential-guest-support=sev0 \
|
||||
-object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1
|
||||
|
||||
|
||||
Debugging
|
||||
---------
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue