diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs index eec0da83c..2c31efe33 100644 --- a/vmm/src/device_manager.rs +++ b/vmm/src/device_manager.rs @@ -1126,8 +1126,8 @@ pub struct DeviceManager { // pvpanic device pvpanic_device: Option>>, - // Flag to force setting the iommu on virtio devices - force_iommu: bool, + // Force VIRTIO_F_ACCESS_PLATFORM on all virtio devices (e.g. for TDX/SEV-SNP) + force_access_platform: bool, // io_uring availability if detected io_uring_supported: Option, @@ -1215,7 +1215,7 @@ impl DeviceManager { seccomp_action: SeccompAction, numa_nodes: NumaNodes, activate_evt: &EventFd, - force_iommu: bool, + force_access_platform: bool, boot_id_list: BTreeSet, #[cfg(not(target_arch = "riscv64"))] timestamp: Instant, snapshot: Option<&Snapshot>, @@ -1429,7 +1429,7 @@ impl DeviceManager { #[cfg(feature = "pvmemcontrol")] pvmemcontrol_devices: None, pvpanic_device: None, - force_iommu, + force_access_platform, io_uring_supported: None, aio_supported: None, boot_id_list, @@ -2440,7 +2440,7 @@ impl DeviceManager { self.console_resize_pipe .as_ref() .map(|p| p.try_clone().unwrap()), - self.force_iommu | console_config.iommu, + self.force_access_platform | console_config.iommu, self.seccomp_action.clone(), self.exit_evt .try_clone() @@ -2703,7 +2703,7 @@ impl DeviceManager { self.exit_evt .try_clone() .map_err(DeviceManagerError::EventFd)?, - self.force_iommu, + self.force_access_platform, state_from_id(self.snapshot.as_ref(), id.as_str()) .map_err(DeviceManagerError::RestoreGetState)?, ) { @@ -2930,7 +2930,7 @@ impl DeviceManager { .ok_or(DeviceManagerError::NoDiskPath)? .clone(), disk_cfg.readonly, - self.force_iommu | disk_cfg.pci_common.iommu, + self.force_access_platform | disk_cfg.pci_common.iommu, disk_cfg.num_queues, disk_cfg.queue_size, disk_cfg.serial.clone(), @@ -3032,7 +3032,7 @@ impl DeviceManager { self.exit_evt .try_clone() .map_err(DeviceManagerError::EventFd)?, - self.force_iommu, + self.force_access_platform, state_from_id(self.snapshot.as_ref(), id.as_str()) .map_err(DeviceManagerError::RestoreGetState)?, net_cfg.offload_tso, @@ -3063,7 +3063,7 @@ impl DeviceManager { Some(net_cfg.mac), &mut net_cfg.host_mac, net_cfg.mtu, - self.force_iommu | net_cfg.pci_common.iommu, + self.force_access_platform | net_cfg.pci_common.iommu, net_cfg.num_queues, net_cfg.queue_size, self.seccomp_action.clone(), @@ -3084,7 +3084,7 @@ impl DeviceManager { fds, Some(net_cfg.mac), net_cfg.mtu, - self.force_iommu | net_cfg.pci_common.iommu, + self.force_access_platform | net_cfg.pci_common.iommu, net_cfg.queue_size, self.seccomp_action.clone(), net_cfg.rate_limiter_config, @@ -3114,7 +3114,7 @@ impl DeviceManager { Some(net_cfg.mac), &mut net_cfg.host_mac, net_cfg.mtu, - self.force_iommu | net_cfg.pci_common.iommu, + self.force_access_platform | net_cfg.pci_common.iommu, net_cfg.num_queues, net_cfg.queue_size, self.seccomp_action.clone(), @@ -3177,7 +3177,7 @@ impl DeviceManager { virtio_devices::Rng::new( id.clone(), rng_path, - self.force_iommu | rng_config.iommu, + self.force_access_platform | rng_config.iommu, self.seccomp_action.clone(), self.exit_evt .try_clone() @@ -3239,7 +3239,7 @@ impl DeviceManager { self.exit_evt .try_clone() .map_err(DeviceManagerError::EventFd)?, - self.force_iommu, + self.force_access_platform, state_from_id(self.snapshot.as_ref(), id.as_str()) .map_err(DeviceManagerError::RestoreGetState)?, ) @@ -3305,7 +3305,7 @@ impl DeviceManager { self.exit_evt .try_clone() .map_err(DeviceManagerError::EventFd)?, - self.force_iommu, + self.force_access_platform, state_from_id(self.snapshot.as_ref(), id.as_str()) .map_err(DeviceManagerError::RestoreGetState)?, ) @@ -3484,7 +3484,7 @@ impl DeviceManager { file, GuestAddress(region_base), mapping, - self.force_iommu | pmem_cfg.pci_common.iommu, + self.force_access_platform | pmem_cfg.pci_common.iommu, self.seccomp_action.clone(), self.exit_evt .try_clone() @@ -3555,7 +3555,7 @@ impl DeviceManager { vsock_cfg.cid, vsock_cfg.socket.clone(), backend, - self.force_iommu | vsock_cfg.pci_common.iommu, + self.force_access_platform | vsock_cfg.pci_common.iommu, self.seccomp_action.clone(), self.exit_evt .try_clone() diff --git a/vmm/src/vm.rs b/vmm/src/vm.rs index 6bb088cb0..ffe7b8624 100644 --- a/vmm/src/vm.rs +++ b/vmm/src/vm.rs @@ -567,8 +567,8 @@ impl Vm { let numa_nodes = Self::create_numa_nodes(config.lock().unwrap().numa.as_deref(), &memory_manager)?; - // Determine if IOMMU should be forced based on confidential computing features - let force_iommu = Self::should_force_iommu(&config); + // Determine if VIRTIO_F_ACCESS_PLATFORM should be forced (e.g. for TDX/SEV-SNP) + let force_access_platform = Self::should_force_access_platform(&config); let stop_on_boot = Self::should_stop_on_boot(&config); @@ -615,7 +615,7 @@ impl Vm { seccomp_action.clone(), numa_nodes.clone(), &activate_evt, - force_iommu, + force_access_platform, boot_id_list, #[cfg(not(target_arch = "riscv64"))] timestamp, @@ -694,8 +694,9 @@ impl Vm { }) } - /// Determine if IOMMU should be forced based on confidential computing features. - fn should_force_iommu(_config: &Arc>) -> bool { + /// Determine if VIRTIO_F_ACCESS_PLATFORM should be forced based on + /// confidential computing features. + fn should_force_access_platform(_config: &Arc>) -> bool { #[cfg(feature = "tdx")] if _config.lock().unwrap().is_tdx_enabled() { return true; @@ -802,7 +803,7 @@ impl Vm { seccomp_action: SeccompAction, numa_nodes: NumaNodes, activate_evt: &EventFd, - force_iommu: bool, + force_access_platform: bool, boot_id_list: BTreeSet, #[cfg(not(target_arch = "riscv64"))] timestamp: Instant, snapshot: Option<&Snapshot>, @@ -825,7 +826,7 @@ impl Vm { seccomp_action, numa_nodes, activate_evt, - force_iommu, + force_access_platform, boot_id_list, #[cfg(not(target_arch = "riscv64"))] timestamp,