b585ec0abd
- kvm-introduce-pc_rhel_9_5_compat.patch [RHEL-39544] - kvm-target-i386-add-guest-phys-bits-cpu-property.patch [RHEL-39544] - kvm-kvm-add-support-for-guest-physical-bits.patch [RHEL-39544] - kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch [RHEL-39544] - kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch [RHEL-39544] - kvm-target-i386-Add-new-CPU-model-SierraForest.patch [RHEL-39544] - kvm-target-i386-Export-RFDS-bit-to-guests.patch [RHEL-39544] - kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch [RHEL-39544] - kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch [RHEL-39544] - kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch [RHEL-39544] - kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch [RHEL-39544] - kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544] - kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch [RHEL-39544] - kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544] - kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch [RHEL-39544] - kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch [RHEL-39544] - kvm-linux-headers-update-to-current-kvm-next.patch [RHEL-39544] - kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch [RHEL-39544] - kvm-KVM-track-whether-guest-state-is-encrypted.patch [RHEL-39544] - kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch [RHEL-39544] - kvm-target-i386-introduce-x86-confidential-guest.patch [RHEL-39544] - kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch [RHEL-39544] - kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch [RHEL-39544] - kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch [RHEL-39544] - kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch [RHEL-39544] - kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch [RHEL-39544] - kvm-kvm-Introduce-support-for-memory_attributes.patch [RHEL-39544] - kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch [RHEL-39544] - kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch [RHEL-39544] - kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch [RHEL-39544] - kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch [RHEL-39544] - kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch [RHEL-39544] - kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch [RHEL-39544] - kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch [RHEL-39544] - kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch [RHEL-39544] - kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch [RHEL-39544] - kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch [RHEL-39544] - kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch [RHEL-39544] - kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch [RHEL-39544] - kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch [RHEL-39544] - kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch [RHEL-39544] - kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch [RHEL-39544] - kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch [RHEL-39544] - kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch [RHEL-39544] - kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch [RHEL-39544] - kvm-hw-i386-split-x86.c-in-multiple-parts.patch [RHEL-39544] - kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch [RHEL-39544] - kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch [RHEL-39544] - kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch [RHEL-39544] - kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch [RHEL-39544] - kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch [RHEL-39544] - kvm-linux-headers-Update-to-current-kvm-next.patch [RHEL-39544] - kvm-update-linux-headers-import-linux-kvm_para.h-header.patch [RHEL-39544] - kvm-machine-allow-early-use-of-machine_require_guest_mem.patch [RHEL-39544] - kvm-i386-sev-Replace-error_report-with-error_setg.patch [RHEL-39544] - kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch [RHEL-39544] - kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch [RHEL-39544] - kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch [RHEL-39544] - kvm-i386-sev-Introduce-sev-snp-guest-object.patch [RHEL-39544] - kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch [RHEL-39544] - kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch [RHEL-39544] - kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch [RHEL-39544] - kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch [RHEL-39544] - kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch [RHEL-39544] - kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch [RHEL-39544] - kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch [RHEL-39544] - kvm-i386-sev-Add-the-SNP-launch-start-context.patch [RHEL-39544] - kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch [RHEL-39544] - kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch [RHEL-39544] - kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch [RHEL-39544] - kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch [RHEL-39544] - kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch [RHEL-39544] - kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch [RHEL-39544] - kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch [RHEL-39544] - kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch [RHEL-39544] - kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch [RHEL-39544] - kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch [RHEL-39544] - kvm-i386-sev-Extract-build_kernel_loader_hashes.patch [RHEL-39544] - kvm-i386-sev-Reorder-struct-declarations.patch [RHEL-39544] - kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch [RHEL-39544] - kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch [RHEL-39544] - kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch [RHEL-39544] - kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch [RHEL-39544] - kvm-i386-sev-fix-unreachable-code-coverity-issue.patch [RHEL-39544] - kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch [RHEL-39544] - kvm-i386-sev-Return-when-sev_common-is-null.patch [RHEL-39544] - kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch [RHEL-39544] - kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch [RHEL-39544] - kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch [RHEL-39544] - kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch [RHEL-39544] - kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch [RHEL-39544] - kvm-virtio-rng-block-max-bytes-0.patch [RHEL-50336] - kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch [RHEL-50000] - kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch [RHEL-50000] - kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch [RHEL-50000] - kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch [RHEL-50000] - kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch [RHEL-52617] - kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch [RHEL-52617] - kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch [RHEL-52617] - kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch [RHEL-52617] - Resolves: RHEL-39544 ([QEMU] Add support for AMD SEV-SNP to Qemu) - Resolves: RHEL-50336 (Fail to boot up the guest including vtpm and virtio-rng (max-bytes=0) devices) - Resolves: RHEL-50000 (scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert) - Resolves: RHEL-52617 (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5])
190 lines
5.9 KiB
Diff
190 lines
5.9 KiB
Diff
From c3e2bc3319882c16fa36eafc7a613073746cfc8b Mon Sep 17 00:00:00 2001
|
|
From: Pankaj Gupta <pankaj.gupta@amd.com>
|
|
Date: Thu, 30 May 2024 06:16:14 -0500
|
|
Subject: [PATCH 052/100] linux-headers: Update to current kvm/next
|
|
|
|
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
|
RH-MergeRequest: 245: SEV-SNP support
|
|
RH-Jira: RHEL-39544
|
|
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
|
RH-Acked-by: Bandan Das <bdas@redhat.com>
|
|
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
RH-Commit: [52/91] df77e867072f60110b8387a54ba2db6226b35007 (bonzini/rhel-qemu-kvm)
|
|
|
|
This updates kernel headers to commit 6f627b425378 ("KVM: SVM: Add module
|
|
parameter to enable SEV-SNP", 2024-05-12). The SNP host patches will
|
|
be included in Linux 6.11, to be released next July.
|
|
|
|
Also brings in an linux-headers/linux/vhost.h fix from v6.9-rc4.
|
|
|
|
Co-developed-by: Michael Roth <michael.roth@amd.com>
|
|
Signed-off-by: Michael Roth <michael.roth@amd.com>
|
|
Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
|
|
Message-ID: <20240530111643.1091816-3-pankaj.gupta@amd.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 5f69e42da5b40a2213f4db70ca461f554abca686)
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
linux-headers/asm-loongarch/kvm.h | 4 +++
|
|
linux-headers/asm-riscv/kvm.h | 1 +
|
|
linux-headers/asm-x86/kvm.h | 52 ++++++++++++++++++++++++++++++-
|
|
linux-headers/linux/vhost.h | 15 ++++-----
|
|
4 files changed, 64 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
|
|
index 109785922c..f9abef3823 100644
|
|
--- a/linux-headers/asm-loongarch/kvm.h
|
|
+++ b/linux-headers/asm-loongarch/kvm.h
|
|
@@ -17,6 +17,8 @@
|
|
#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
|
|
#define KVM_DIRTY_LOG_PAGE_OFFSET 64
|
|
|
|
+#define KVM_GUESTDBG_USE_SW_BP 0x00010000
|
|
+
|
|
/*
|
|
* for KVM_GET_REGS and KVM_SET_REGS
|
|
*/
|
|
@@ -72,6 +74,8 @@ struct kvm_fpu {
|
|
|
|
#define KVM_REG_LOONGARCH_COUNTER (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
|
|
#define KVM_REG_LOONGARCH_VCPU_RESET (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
|
|
+/* Debugging: Special instruction for software breakpoint */
|
|
+#define KVM_REG_LOONGARCH_DEBUG_INST (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 3)
|
|
|
|
#define LOONGARCH_REG_SHIFT 3
|
|
#define LOONGARCH_REG_64(TYPE, REG) (TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
|
|
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
|
|
index b1c503c295..e878e7cc39 100644
|
|
--- a/linux-headers/asm-riscv/kvm.h
|
|
+++ b/linux-headers/asm-riscv/kvm.h
|
|
@@ -167,6 +167,7 @@ enum KVM_RISCV_ISA_EXT_ID {
|
|
KVM_RISCV_ISA_EXT_ZFA,
|
|
KVM_RISCV_ISA_EXT_ZTSO,
|
|
KVM_RISCV_ISA_EXT_ZACAS,
|
|
+ KVM_RISCV_ISA_EXT_SSCOFPMF,
|
|
KVM_RISCV_ISA_EXT_MAX,
|
|
};
|
|
|
|
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
|
|
index 31c95c2dfe..1c8f918234 100644
|
|
--- a/linux-headers/asm-x86/kvm.h
|
|
+++ b/linux-headers/asm-x86/kvm.h
|
|
@@ -695,6 +695,11 @@ enum sev_cmd_id {
|
|
/* Second time is the charm; improved versions of the above ioctls. */
|
|
KVM_SEV_INIT2,
|
|
|
|
+ /* SNP-specific commands */
|
|
+ KVM_SEV_SNP_LAUNCH_START = 100,
|
|
+ KVM_SEV_SNP_LAUNCH_UPDATE,
|
|
+ KVM_SEV_SNP_LAUNCH_FINISH,
|
|
+
|
|
KVM_SEV_NR_MAX,
|
|
};
|
|
|
|
@@ -709,7 +714,9 @@ struct kvm_sev_cmd {
|
|
struct kvm_sev_init {
|
|
__u64 vmsa_features;
|
|
__u32 flags;
|
|
- __u32 pad[9];
|
|
+ __u16 ghcb_version;
|
|
+ __u16 pad1;
|
|
+ __u32 pad2[8];
|
|
};
|
|
|
|
struct kvm_sev_launch_start {
|
|
@@ -820,6 +827,48 @@ struct kvm_sev_receive_update_data {
|
|
__u32 pad2;
|
|
};
|
|
|
|
+struct kvm_sev_snp_launch_start {
|
|
+ __u64 policy;
|
|
+ __u8 gosvw[16];
|
|
+ __u16 flags;
|
|
+ __u8 pad0[6];
|
|
+ __u64 pad1[4];
|
|
+};
|
|
+
|
|
+/* Kept in sync with firmware values for simplicity. */
|
|
+#define KVM_SEV_SNP_PAGE_TYPE_NORMAL 0x1
|
|
+#define KVM_SEV_SNP_PAGE_TYPE_ZERO 0x3
|
|
+#define KVM_SEV_SNP_PAGE_TYPE_UNMEASURED 0x4
|
|
+#define KVM_SEV_SNP_PAGE_TYPE_SECRETS 0x5
|
|
+#define KVM_SEV_SNP_PAGE_TYPE_CPUID 0x6
|
|
+
|
|
+struct kvm_sev_snp_launch_update {
|
|
+ __u64 gfn_start;
|
|
+ __u64 uaddr;
|
|
+ __u64 len;
|
|
+ __u8 type;
|
|
+ __u8 pad0;
|
|
+ __u16 flags;
|
|
+ __u32 pad1;
|
|
+ __u64 pad2[4];
|
|
+};
|
|
+
|
|
+#define KVM_SEV_SNP_ID_BLOCK_SIZE 96
|
|
+#define KVM_SEV_SNP_ID_AUTH_SIZE 4096
|
|
+#define KVM_SEV_SNP_FINISH_DATA_SIZE 32
|
|
+
|
|
+struct kvm_sev_snp_launch_finish {
|
|
+ __u64 id_block_uaddr;
|
|
+ __u64 id_auth_uaddr;
|
|
+ __u8 id_block_en;
|
|
+ __u8 auth_key_en;
|
|
+ __u8 vcek_disabled;
|
|
+ __u8 host_data[KVM_SEV_SNP_FINISH_DATA_SIZE];
|
|
+ __u8 pad0[3];
|
|
+ __u16 flags;
|
|
+ __u64 pad1[4];
|
|
+};
|
|
+
|
|
#define KVM_X2APIC_API_USE_32BIT_IDS (1ULL << 0)
|
|
#define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK (1ULL << 1)
|
|
|
|
@@ -870,5 +919,6 @@ struct kvm_hyperv_eventfd {
|
|
#define KVM_X86_SW_PROTECTED_VM 1
|
|
#define KVM_X86_SEV_VM 2
|
|
#define KVM_X86_SEV_ES_VM 3
|
|
+#define KVM_X86_SNP_VM 4
|
|
|
|
#endif /* _ASM_X86_KVM_H */
|
|
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
|
|
index bea6973906..b95dd84eef 100644
|
|
--- a/linux-headers/linux/vhost.h
|
|
+++ b/linux-headers/linux/vhost.h
|
|
@@ -179,12 +179,6 @@
|
|
/* Get the config size */
|
|
#define VHOST_VDPA_GET_CONFIG_SIZE _IOR(VHOST_VIRTIO, 0x79, __u32)
|
|
|
|
-/* Get the count of all virtqueues */
|
|
-#define VHOST_VDPA_GET_VQS_COUNT _IOR(VHOST_VIRTIO, 0x80, __u32)
|
|
-
|
|
-/* Get the number of virtqueue groups. */
|
|
-#define VHOST_VDPA_GET_GROUP_NUM _IOR(VHOST_VIRTIO, 0x81, __u32)
|
|
-
|
|
/* Get the number of address spaces. */
|
|
#define VHOST_VDPA_GET_AS_NUM _IOR(VHOST_VIRTIO, 0x7A, unsigned int)
|
|
|
|
@@ -228,10 +222,17 @@
|
|
#define VHOST_VDPA_GET_VRING_DESC_GROUP _IOWR(VHOST_VIRTIO, 0x7F, \
|
|
struct vhost_vring_state)
|
|
|
|
+
|
|
+/* Get the count of all virtqueues */
|
|
+#define VHOST_VDPA_GET_VQS_COUNT _IOR(VHOST_VIRTIO, 0x80, __u32)
|
|
+
|
|
+/* Get the number of virtqueue groups. */
|
|
+#define VHOST_VDPA_GET_GROUP_NUM _IOR(VHOST_VIRTIO, 0x81, __u32)
|
|
+
|
|
/* Get the queue size of a specific virtqueue.
|
|
* userspace set the vring index in vhost_vring_state.index
|
|
* kernel set the queue size in vhost_vring_state.num
|
|
*/
|
|
-#define VHOST_VDPA_GET_VRING_SIZE _IOWR(VHOST_VIRTIO, 0x80, \
|
|
+#define VHOST_VDPA_GET_VRING_SIZE _IOWR(VHOST_VIRTIO, 0x82, \
|
|
struct vhost_vring_state)
|
|
#endif
|
|
--
|
|
2.39.3
|
|
|