114 lines
3.8 KiB
Diff
114 lines
3.8 KiB
Diff
From b62e9f0a875520807daa28d0b808e2ba9d96ca79 Mon Sep 17 00:00:00 2001
|
|
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
Date: Fri, 18 Jul 2025 18:03:46 +0200
|
|
Subject: [PATCH 038/115] i386/tdx: Add property sept-ve-disable for tdx-guest
|
|
object
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
|
RH-MergeRequest: 391: TDX support, including attestation and device assignment
|
|
RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
|
|
RH-Acked-by: Yash Mankad <None>
|
|
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
RH-Acked-by: David Hildenbrand <david@redhat.com>
|
|
RH-Commit: [38/115] 3a21966b474dde36a34aa215e45262ba83a809ac (bonzini/rhel-qemu-kvm)
|
|
|
|
Bit 28 of TD attribute, named SEPT_VE_DISABLE. When set to 1, it disables
|
|
EPT violation conversion to #VE on guest TD access of PENDING pages.
|
|
|
|
Some guest OS (e.g., Linux TD guest) may require this bit as 1.
|
|
Otherwise refuse to boot.
|
|
|
|
Add sept-ve-disable property for tdx-guest object, for user to configure
|
|
this bit.
|
|
|
|
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
|
|
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Acked-by: Markus Armbruster <armbru@redhat.com>
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
|
|
Link: https://lore.kernel.org/r/20250508150002.689633-10-xiaoyao.li@intel.com
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 6016e2972d94c90307b6caf55a8e3aee5424c09b)
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
qapi/qom.json | 8 +++++++-
|
|
target/i386/kvm/tdx.c | 23 +++++++++++++++++++++++
|
|
2 files changed, 30 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/qapi/qom.json b/qapi/qom.json
|
|
index 530efeb7c5..fefb54f90b 100644
|
|
--- a/qapi/qom.json
|
|
+++ b/qapi/qom.json
|
|
@@ -1016,10 +1016,16 @@
|
|
# @attributes: The 'attributes' of a TD guest that is passed to
|
|
# KVM_TDX_INIT_VM
|
|
#
|
|
+# @sept-ve-disable: toggle bit 28 of TD attributes to control disabling
|
|
+# of EPT violation conversion to #VE on guest TD access of PENDING
|
|
+# pages. Some guest OS (e.g., Linux TD guest) may require this to
|
|
+# be set, otherwise they refuse to boot.
|
|
+#
|
|
# Since: 10.1
|
|
##
|
|
{ 'struct': 'TdxGuestProperties',
|
|
- 'data': { '*attributes': 'uint64' } }
|
|
+ 'data': { '*attributes': 'uint64',
|
|
+ '*sept-ve-disable': 'bool' } }
|
|
|
|
##
|
|
# @ThreadContextProperties:
|
|
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
|
|
index 8f02c76249..370bd86f2c 100644
|
|
--- a/target/i386/kvm/tdx.c
|
|
+++ b/target/i386/kvm/tdx.c
|
|
@@ -18,6 +18,8 @@
|
|
#include "kvm_i386.h"
|
|
#include "tdx.h"
|
|
|
|
+#define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE BIT_ULL(28)
|
|
+
|
|
static TdxGuest *tdx_guest;
|
|
|
|
static struct kvm_tdx_capabilities *tdx_caps;
|
|
@@ -252,6 +254,24 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
|
|
return 0;
|
|
}
|
|
|
|
+static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
|
|
+{
|
|
+ TdxGuest *tdx = TDX_GUEST(obj);
|
|
+
|
|
+ return !!(tdx->attributes & TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE);
|
|
+}
|
|
+
|
|
+static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp)
|
|
+{
|
|
+ TdxGuest *tdx = TDX_GUEST(obj);
|
|
+
|
|
+ if (value) {
|
|
+ tdx->attributes |= TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
|
|
+ } else {
|
|
+ tdx->attributes &= ~TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
|
|
+ }
|
|
+}
|
|
+
|
|
/* tdx guest */
|
|
OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
|
|
tdx_guest,
|
|
@@ -272,6 +292,9 @@ static void tdx_guest_init(Object *obj)
|
|
|
|
object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
|
|
OBJ_PROP_FLAG_READWRITE);
|
|
+ object_property_add_bool(obj, "sept-ve-disable",
|
|
+ tdx_guest_get_sept_ve_disable,
|
|
+ tdx_guest_set_sept_ve_disable);
|
|
}
|
|
|
|
static void tdx_guest_finalize(Object *obj)
|
|
--
|
|
2.50.1
|
|
|