From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 592631FF0AF for ; Thu, 24 Sep 2026 16:24:10 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 7906D217DF; Thu, 24 Sep 2026 16:23:08 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1790259245; bh=y2h4HqdFTceDwWYtwJpMnQliog1R6WzjfvBxjr4eY/I=; h=Date:From:To:Subject:References:In-Reply-To:From; b=rDJV1kDxu7dhHs0DJ8DPcsXiGJF5gWiRrWyqzcLr2HbIdqj4XFnrxEXMosLWGpzat dW+Yi9/pJsLYeBAaaP9/0eJPtFDTNBASNbbKx3FxbtBSZEokW4nCXbb8uXnOMuMqvo neKLX0vIOxACoEu9ceJfHNCaGzvGvQ/u+B6kTLA5Eit7LsuBp6m5LCySRLLVDqTfll KUv5ICU+uj2Uboq18KqzF+5rRSIm6faNI5ZZuNTCa7FE/IpGQH8O28vpTLhzMQrnSf YK4nzRDYfDzeBnNIBHqUC/pCJPswsyOpAmzbOHZ01Jf1gixImNK2o9PfiXOr1CqcR6 iNUGuVO4/U1Ng== Date: Thu, 24 Sep 2026 16:14:04 +0200 From: Christian Ludwig To: Subject: [PATCH qemu-server 2/7] sev: Detect SEV- Message-ID: <64d1760116eab24690f674738cc6ef63a9213710.1790236014.git@genua.de> References: MIME-Version: 1.0 In-Reply-To: X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta07.win.genua.de (10.208.16.107) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----589AF89B3A73EB8D834EC2EB29F318DB" X-SPAM-LEVEL: Spam detection results: 0 AWL 0.107 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: HVPCYGJ6UWLOSDLXNLNNSZWG6SQUAVQX X-Message-ID-Hash: HVPCYGJ6UWLOSDLXNLNNSZWG6SQUAVQX X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ------589AF89B3A73EB8D834EC2EB29F318DB Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline CPUID only announces what the silicon is capable of. SEV, SEV-ES and SNP can all still be disabled by firmware/platform config. If KVM signals support, Qemu is able launch VMs with that feature. Signed-off-by: Christian Ludwig --- .../query-machine-capabilities.c | 42 ++++++++++++++++--- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/src/query-machine-capabilities/query-machine-capabilities.c b/src/query-machine-capabilities/query-machine-capabilities.c index 0a9ab805..b7e06286 100644 --- a/src/query-machine-capabilities/query-machine-capabilities.c +++ b/src/query-machine-capabilities/query-machine-capabilities.c @@ -120,9 +120,44 @@ int read_msr(uint32_t msr_index, uint64_t *value) { return 0; } + void query_cpu_capabilities_sev(cpu_caps_amd_sev_t *res) { #ifdef __x86_64__ uint32_t eax, ebx, ecx, edx; + struct { + const char *path; + bool *result; + } s[] = { + { "/sys/module/kvm_amd/parameters/sev", &res->sev_support }, + { "/sys/module/kvm_amd/parameters/sev_es", &res->sev_es_support }, + { "/sys/module/kvm_amd/parameters/sev_snp", &res->sev_snp_support }, + }; + + for (size_t i = 0; i < sizeof(s) / sizeof(s[0]); i++) { + char c; + FILE *fp = fopen(s[i].path, "r"); + if (fp == NULL) + continue; + if (fscanf(fp, " %c", &c) != 1) { + fclose(fp); + continue; + } + fclose(fp); + + switch (c) { + case '1': + case 'y': + case 'Y': + *s[i].result = true; + break; + default: + *s[i].result = false; + break; + } + } + + if (!res->sev_support && !res->sev_es_support && !res->sev_snp_support) + return; // query Encrypted Memory Capabilities, see: // https://en.wikipedia.org/wiki/CPUID#EAX=8000001Fh:_Encrypted_Memory_Capabilities @@ -132,12 +167,9 @@ void query_cpu_capabilities_sev(cpu_caps_amd_sev_t *res) { : "0"(query_function) ); - res->sev_support = (eax & (1<<1)) != 0; - res->sev_es_support = (eax & (1<<3)) != 0; - res->sev_snp_support = (eax & (1<<4)) != 0; - res->cbitpos = ebx & 0x3f; res->reduced_phys_bits = (ebx >> 6) & 0x3f; + #else memset(res, 0, sizeof(*res)); #endif @@ -206,7 +238,7 @@ int main() { #ifdef __x86_64__ if (strncmp(vendor, "AuthenticAMD", 12) == 0) { - cpu_caps_amd_sev_t caps_sev; + cpu_caps_amd_sev_t caps_sev = { 0 }; query_cpu_capabilities_sev(&caps_sev); ret = fprintf(file, -- 2.34.1 ------589AF89B3A73EB8D834EC2EB29F318DB--