kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

hypervisor, vmm: Add KVM SEV_{INIT2, SNP_LAUNCH_START} support

Browse Source 
Introduce the SevFd abstraction that wraps /dev/sev and implements the
KVM_SEV_INIT2 and KVM_SEV_SNP_LAUNCH_START ioctls for SEV-SNP VM
initialization on KVM.

Key changes:
- Add sev.rs with KvmSevInit and KvmSevSnpLaunchStart ioctl structs
  matching the kernel layout (linux/arch/x86/include/uapi/asm/kvm.h)
- Implement KVM_SEV_INIT2 and KVM_SEV_SNP_LAUNCH_START ioctls
- Set KVM_MEMORY_ATTRIBUTE_PRIVATE on newly created memory regions
  when guest_memfd is supported
- Widen SevSnpPageAccessProxy cfg gates from mshv-only to all
  sev_snp-enabled builds
- Make sev_snp_init a required trait method (remove default impl)
- Include KVM_SEV_SNP_LAUNCH_START in the seccomp allowlist
- Parse VMSA SEV features from IGVM and include them in the
  KVM_SEV_INIT2 ioctl

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Co-authored-by: Rob Bradford <rbradford@meta.com>
Signed-off-by: Rob Bradford <rbradford@meta.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-07 14:23:13 -07:00
committed by Rob Bradford
parent 425609a8b5
commit 2e004521e0
12 changed files with 225 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vmm/src/device_manager.rs
+4 -4
View File
@@ -957,26 +957,26 @@ pub struct AcpiPlatformAddresses {
pub sleep_status_reg_address: Option<GenericAddress>,
}
#[cfg(all(feature = "mshv", feature = "sev_snp"))]
#[cfg(feature = "sev_snp")]
struct SevSnpPageAccessProxy {
vm: Arc<dyn hypervisor::Vm>,
}
#[cfg(all(feature = "mshv", feature = "sev_snp"))]
#[cfg(feature = "sev_snp")]
impl std::fmt::Debug for SevSnpPageAccessProxy {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
write!(f, "SNP Page access proxy")
}
}
#[cfg(all(feature = "mshv", feature = "sev_snp"))]
#[cfg(feature = "sev_snp")]
impl SevSnpPageAccessProxy {
fn new(vm: Arc<dyn hypervisor::Vm>) -> SevSnpPageAccessProxy {
SevSnpPageAccessProxy { vm }
}
}
#[cfg(all(feature = "mshv", feature = "sev_snp"))]
#[cfg(feature = "sev_snp")]
impl AccessPlatform for SevSnpPageAccessProxy {
fn translate_gpa(&self, base: u64, _size: u64) -> std::result::Result<u64, std::io::Error> {
Ok(base)