[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 15/16] target/i386: add support for masking CPUID features in conf
From: |
Paolo Bonzini |
Subject: |
[PULL 15/16] target/i386: add support for masking CPUID features in confidential guests |
Date: |
Thu, 4 Jul 2024 11:58:05 +0200 |
Some CPUID features may be provided by KVM for some guests, independent of
processor support, for example TSC deadline or TSC adjust. If these are
not supported by the confidential computing firmware, however, the guest
will fail to start. Add support for removing unsupported features from
"-cpu host".
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/confidential-guest.h | 24 ++++++++++++++++++++++++
target/i386/kvm/kvm.c | 5 +++++
2 files changed, 29 insertions(+)
diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
index 532e172a60b..7342d2843aa 100644
--- a/target/i386/confidential-guest.h
+++ b/target/i386/confidential-guest.h
@@ -39,6 +39,8 @@ struct X86ConfidentialGuestClass {
/* <public> */
int (*kvm_type)(X86ConfidentialGuest *cg);
+ uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t
feature, uint32_t index,
+ int reg, uint32_t value);
};
/**
@@ -56,4 +58,26 @@ static inline int
x86_confidential_guest_kvm_type(X86ConfidentialGuest *cg)
return 0;
}
}
+
+/**
+ * x86_confidential_guest_mask_cpuid_features:
+ *
+ * Removes unsupported features from a confidential guest's CPUID values,
returns
+ * the value with the bits removed. The bits removed should be those that KVM
+ * provides independent of host-supported CPUID features, but are not
supported by
+ * the confidential computing firmware.
+ */
+static inline int
x86_confidential_guest_mask_cpuid_features(X86ConfidentialGuest *cg,
+ uint32_t feature,
uint32_t index,
+ int reg, uint32_t
value)
+{
+ X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
+
+ if (klass->mask_cpuid_features) {
+ return klass->mask_cpuid_features(cg, feature, index, reg, value);
+ } else {
+ return value;
+ }
+}
+
#endif
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index dd8b0f33136..056d117cd11 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -548,6 +548,11 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s,
uint32_t function,
ret |= 1U << KVM_HINTS_REALTIME;
}
+ if (current_machine->cgs) {
+ ret = x86_confidential_guest_mask_cpuid_features(
+ X86_CONFIDENTIAL_GUEST(current_machine->cgs),
+ function, index, reg, ret);
+ }
return ret;
}
--
2.45.2
- [PULL 05/16] Revert "meson: Propagate gnutls dependency", (continued)
- [PULL 05/16] Revert "meson: Propagate gnutls dependency", Paolo Bonzini, 2024/07/04
- [PULL 06/16] meson: Drop the .fa library suffix, Paolo Bonzini, 2024/07/04
- [PULL 07/16] target/i386: pass X86CPU to x86_cpu_get_supported_feature_word, Paolo Bonzini, 2024/07/04
- [PULL 08/16] target/i386: drop AMD machine check bits from Intel CPUID, Paolo Bonzini, 2024/07/04
- [PULL 11/16] i386/sev: Fix error message in sev_get_capabilities(), Paolo Bonzini, 2024/07/04
- [PULL 10/16] target/i386: do not include undefined bits in the AMD topoext leaf, Paolo Bonzini, 2024/07/04
- [PULL 13/16] target/i386: add avx-vnni-int16 feature, Paolo Bonzini, 2024/07/04
- [PULL 09/16] target/i386: SEV: fix formatting of CPUID mismatch message, Paolo Bonzini, 2024/07/04
- [PULL 14/16] char-stdio: Restore blocking mode of stdout on exit, Paolo Bonzini, 2024/07/04
- [PULL 12/16] i386/sev: Fallback to the default SEV device if none provided in sev_get_capabilities(), Paolo Bonzini, 2024/07/04
- [PULL 15/16] target/i386: add support for masking CPUID features in confidential guests,
Paolo Bonzini <=
- [PULL 16/16] target/i386/SEV: implement mask_cpuid_features, Paolo Bonzini, 2024/07/04
- Re: [PULL 00/16] meson, i386 changes for 2024-07-04, Richard Henderson, 2024/07/04