diff options
| author | Michael Roth <michael.roth@amd.com> | 2024-04-09 18:07:41 -0500 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-04-23 17:35:25 +0200 |
| commit | 023267334da375226720e62963df9545aa8fc2fd (patch) | |
| tree | 4df5704ddbb9198ad87b7dbe9c98783b9a83d649 /qapi/qom.json | |
| parent | 663e2f443e5722370708ce2f4c27d94a2087d2d3 (diff) | |
i386/sev: Add 'legacy-vm-type' parameter for SEV guest objects
QEMU will currently automatically make use of the KVM_SEV_INIT2 API for
initializing SEV and SEV-ES guests verses the older
KVM_SEV_INIT/KVM_SEV_ES_INIT interfaces.
However, the older interfaces will silently avoid sync'ing FPU/XSAVE
state to the VMSA prior to encryption, thus relying on behavior and
measurements that assume the related fields to be allow zero.
With KVM_SEV_INIT2, this state is now synced into the VMSA, resulting in
measurements changes and, theoretically, behaviorial changes, though the
latter are unlikely to be seen in practice.
To allow a smooth transition to the newer interface, while still
providing a mechanism to maintain backward compatibility with VMs
created using the older interfaces, provide a new command-line
parameter:
-object sev-guest,legacy-vm-type=true,...
and have it default to false.
Signed-off-by: Michael Roth <michael.roth@amd.com>
Message-ID: <20240409230743.962513-2-michael.roth@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'qapi/qom.json')
| -rw-r--r-- | qapi/qom.json | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/qapi/qom.json b/qapi/qom.json index 85e6b4f84a..38dde6d785 100644 --- a/qapi/qom.json +++ b/qapi/qom.json @@ -898,6 +898,14 @@ # designated guest firmware page for measured boot with -kernel # (default: false) (since 6.2) # +# @legacy-vm-type: Use legacy KVM_SEV_INIT KVM interface for creating the VM. +# The newer KVM_SEV_INIT2 interface syncs additional vCPU +# state when initializing the VMSA structures, which will +# result in a different guest measurement. Set this to +# maintain compatibility with older QEMU or kernel versions +# that rely on legacy KVM_SEV_INIT behavior. +# (default: false) (since 9.1) +# # Since: 2.12 ## { 'struct': 'SevGuestProperties', @@ -908,7 +916,8 @@ '*handle': 'uint32', '*cbitpos': 'uint32', 'reduced-phys-bits': 'uint32', - '*kernel-hashes': 'bool' } } + '*kernel-hashes': 'bool', + '*legacy-vm-type': 'bool' } } ## # @ThreadContextProperties: |