On 22/3/24 19:11, Paolo Bonzini wrote:
So far, KVM has allowed KVM_GET/SET_* ioctls to execute even if the
guest state is encrypted, in which case they do nothing. For the new
API using VM types, instead, the ioctls will fail which is a safer and
more robust approach.
The new API will be the only one available for SEV-SNP and TDX, but it
is also usable for SEV and SEV-ES. In preparation for that, require
architecture-specific KVM code to communicate the point at which guest
state is protected (which must be after kvm_cpu_synchronize_post_init(),
though that might change in the future in order to suppor migration).
From that point, skip reading registers so that cpu->vcpu_dirty is
never true: if it ever becomes true, kvm_arch_put_registers() will
fail miserably.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
---
include/sysemu/kvm.h | 2 ++
include/sysemu/kvm_int.h | 1 +
accel/kvm/kvm-all.c | 14 ++++++++++++--
target/i386/sev.c | 1 +
4 files changed, 16 insertions(+), 2 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org>
