qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH 12/26] KVM: track whether guest state is encrypted


From: Philippe Mathieu-Daudé
Subject: Re: [PATCH 12/26] KVM: track whether guest state is encrypted
Date: Mon, 25 Mar 2024 10:25:00 +0100
User-agent: Mozilla Thunderbird

On 22/3/24 19:11, Paolo Bonzini wrote:
So far, KVM has allowed KVM_GET/SET_* ioctls to execute even if the
guest state is encrypted, in which case they do nothing.  For the new
API using VM types, instead, the ioctls will fail which is a safer and
more robust approach.

The new API will be the only one available for SEV-SNP and TDX, but it
is also usable for SEV and SEV-ES.  In preparation for that, require
architecture-specific KVM code to communicate the point at which guest
state is protected (which must be after kvm_cpu_synchronize_post_init(),
though that might change in the future in order to suppor migration).
 From that point, skip reading registers so that cpu->vcpu_dirty is
never true: if it ever becomes true, kvm_arch_put_registers() will
fail miserably.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
  include/sysemu/kvm.h     |  2 ++
  include/sysemu/kvm_int.h |  1 +
  accel/kvm/kvm-all.c      | 14 ++++++++++++--
  target/i386/sev.c        |  1 +
  4 files changed, 16 insertions(+), 2 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>




reply via email to

[Prev in Thread] Current Thread [Next in Thread]