Tommaso Califano <[email protected]> writes:
> Il 19/03/26 13:31, Markus Armbruster ha scritto:
>> Tommaso Califano <[email protected]> writes:
>>
>>> QEMU's AMD SEV support requires KVM on costly AMD EPYC processors,
>>> limiting development and testing to users with specialized server
>>> hardware. This makes it hard to validate SEV guest behavior, like
>>> OVMF boots or SEV-aware software, on common dev machines.
>>> A solution to this is the emulation of SEV from the guest's
>>> perspective using TCG.
>>>
>>> This change begins this process with the exposure of the SEV CPUID leaf.
>>> In target/i386/cpu.c:cpu_x86_cpuid() case 0x8000001F:
>>>
>>> case 0x8000001F:
>>> *eax = *ebx = *ecx = *edx = 0;
>>> if (sev_enabled()) {
>>> *eax = 0x2;
>>> *eax |= sev_es_enabled() ? 0x8 : 0;
>>> *eax |= sev_snp_enabled() ? 0x10 : 0;
>>> *ebx = sev_get_cbit_position() & 0x3f; /* EBX[5:0] */
>>> *ebx |= (sev_get_reduced_phys_bits() & 0x3f) << 6; /* EBX[11:6] */
>>> }
>>> break;
>>>
>>> sev_enabled() verifies if the QOM object is TYPE_SEV_GUEST;
>>> TYPE_SEV_EMULATED is derived from TYPE_SEV_GUEST with SevEmulatedState
>>> to satisfy this check with minimal changes. In particular this allows
>>> to bypass all the sev_enabled() checks for future features.
>>>
>>> Since KVM hardware isn't available, override the QOM's kvm_init() and add
>>> a conditional confidential_guest_kvm_init() call during machine_init() to
>>> set up emulated confidential support using the ConfidentialGuestSupport
>>> structure.
>>>
>>> With this change it is possible to run a VM with the SEV CPUID active
>>> adding:
>>>
>>> -accel tcg \
>>> -object sev-emulated,id=sev0,cbitpos=47,reduced-phys-bits=1 \
>>> -machine memory-encryption=sev0
>>>
>>> To the QEMU start arguments.
>>>
>>> Signed-off-by: Tommaso Califano <[email protected]>
>>
>> [...]
>>
>>> diff --git a/qapi/qom.json b/qapi/qom.json
>>> index c653248f85..35cda819ec 100644
>>> --- a/qapi/qom.json
>>> +++ b/qapi/qom.json
[...]
>>> @@ -1241,6 +1254,7 @@
>>> { 'name': 'secret_keyring',
>>> 'if': 'CONFIG_SECRET_KEYRING' },
>>> 'sev-guest',
>>> + 'sev-emulated',
>>> 'sev-snp-guest',
>>> 'thread-context',
>>> 's390-pv-guest',
>>
>> Please insert before sev-guest to keep things more or less sorted.
>>
>
> I'll do it, but I don't understand the convention. I'd organized them
> by object derivation hierarchy, so what is the expected sorting order?
It looks alphabetical modulo lazy mistakes to me.
[...]
