On Fri, May 31, 2024 at 1:20 PM Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > > On Thu, May 30, 2024 at 1:16 PM Pankaj Gupta <pankaj.gupta@xxxxxxx> wrote: > > > > These patches implement SEV-SNP base support along with CPUID enforcement > > support for QEMU, and are also available at: > > > > https://github.com/pagupta/qemu/tree/snp_v4 > > > > Latest version of kvm changes are posted here [2] and also queued in kvm/next. > > > > Patch Layout > > ------------ > > 01-03: 'error_setg' independent fix, kvm/next header sync & patch from > > Xiaoyao's TDX v5 patchset. > > 04-29: Introduction of sev-snp-guest object and various configuration > > requirements for SNP. Support for creating a cryptographic "launch" context > > and populating various OVMF metadata pages, BIOS regions, and vCPU/VMSA > > pages with the initial encrypted/measured/validated launch data prior to > > launching the SNP guest. > > 30-31: Handling for KVM_HC_MAP_GPA_RANGE hypercall for userspace VMEXIT. > > These patches are more or less okay, with only a few nits, and I can > queue them already: Hey, please check if branch qemu-coco-queue of https://gitlab.com/bonzini/qemu works for you! I tested it successfully on CentOS 9 Stream with kernel from kvm/next and firmware from edk2-ovmf-20240524-1.fc41.noarch. Paolo > i386/sev: Replace error_report with error_setg > linux-headers: Update to current kvm/next > i386/sev: Introduce "sev-common" type to encapsulate common SEV state > i386/sev: Move sev_launch_update to separate class method > i386/sev: Move sev_launch_finish to separate class method > i386/sev: Introduce 'sev-snp-guest' object > i386/sev: Add a sev_snp_enabled() helper > i386/sev: Add sev_kvm_init() override for SEV class > i386/sev: Add snp_kvm_init() override for SNP class > i386/cpu: Set SEV-SNP CPUID bit when SNP enabled > i386/sev: Don't return launch measurements for SEV-SNP guests > i386/sev: Add a class method to determine KVM VM type for SNP guests > i386/sev: Update query-sev QAPI format to handle SEV-SNP > i386/sev: Add the SNP launch start context > i386/sev: Add handling to encrypt/finalize guest launch data > i386/sev: Set CPU state to protected once SNP guest payload is finalized > hw/i386/sev: Add function to get SEV metadata from OVMF header > i386/sev: Add support for populating OVMF metadata pages > i386/sev: Add support for SNP CPUID validation > i386/sev: Invoke launch_updata_data() for SEV class > i386/sev: Invoke launch_updata_data() for SNP class > i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE > i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests > i386/sev: Extract build_kernel_loader_hashes > i386/sev: Reorder struct declarations > i386/sev: Allow measured direct kernel boot on SNP > hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled > memory: Introduce memory_region_init_ram_guest_memfd() > > These patches need a small prerequisite that I'll post soon: > > hw/i386/sev: Use guest_memfd for legacy ROMs > hw/i386: Add support for loading BIOS using guest_memfd > > This one definitely requires more work: > > hw/i386/sev: Allow use of pflash in conjunction with -bios > > > Paolo
