On Thu, May 30, 2024 at 1:16 PM Pankaj Gupta <pankaj.gupta@xxxxxxx> wrote: > > These patches implement SEV-SNP base support along with CPUID enforcement > support for QEMU, and are also available at: > > https://github.com/pagupta/qemu/tree/snp_v4 > > Latest version of kvm changes are posted here [2] and also queued in kvm/next. > > Patch Layout > ------------ > 01-03: 'error_setg' independent fix, kvm/next header sync & patch from > Xiaoyao's TDX v5 patchset. > 04-29: Introduction of sev-snp-guest object and various configuration > requirements for SNP. Support for creating a cryptographic "launch" context > and populating various OVMF metadata pages, BIOS regions, and vCPU/VMSA > pages with the initial encrypted/measured/validated launch data prior to > launching the SNP guest. > 30-31: Handling for KVM_HC_MAP_GPA_RANGE hypercall for userspace VMEXIT. These patches are more or less okay, with only a few nits, and I can queue them already: i386/sev: Replace error_report with error_setg linux-headers: Update to current kvm/next i386/sev: Introduce "sev-common" type to encapsulate common SEV state i386/sev: Move sev_launch_update to separate class method i386/sev: Move sev_launch_finish to separate class method i386/sev: Introduce 'sev-snp-guest' object i386/sev: Add a sev_snp_enabled() helper i386/sev: Add sev_kvm_init() override for SEV class i386/sev: Add snp_kvm_init() override for SNP class i386/cpu: Set SEV-SNP CPUID bit when SNP enabled i386/sev: Don't return launch measurements for SEV-SNP guests i386/sev: Add a class method to determine KVM VM type for SNP guests i386/sev: Update query-sev QAPI format to handle SEV-SNP i386/sev: Add the SNP launch start context i386/sev: Add handling to encrypt/finalize guest launch data i386/sev: Set CPU state to protected once SNP guest payload is finalized hw/i386/sev: Add function to get SEV metadata from OVMF header i386/sev: Add support for populating OVMF metadata pages i386/sev: Add support for SNP CPUID validation i386/sev: Invoke launch_updata_data() for SEV class i386/sev: Invoke launch_updata_data() for SNP class i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests i386/sev: Extract build_kernel_loader_hashes i386/sev: Reorder struct declarations i386/sev: Allow measured direct kernel boot on SNP hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled memory: Introduce memory_region_init_ram_guest_memfd() These patches need a small prerequisite that I'll post soon: hw/i386/sev: Use guest_memfd for legacy ROMs hw/i386: Add support for loading BIOS using guest_memfd This one definitely requires more work: hw/i386/sev: Allow use of pflash in conjunction with -bios Paolo
