These patches implement SEV-SNP base support along with CPUID enforcement
support for QEMU, and are also available at:
https://github.com/pagupta/qemu/tree/snp_v4
Latest version of kvm changes are posted here [2] and also queued in kvm/next.
Patch Layout
------------
01-03: 'error_setg' independent fix, kvm/next header sync & patch from
Xiaoyao's TDX v5 patchset.
04-29: Introduction of sev-snp-guest object and various configuration
requirements for SNP. Support for creating a cryptographic "launch"
context
and populating various OVMF metadata pages, BIOS regions, and vCPU/VMSA
pages with the initial encrypted/measured/validated launch data prior to
launching the SNP guest.
30-31: Handling for KVM_HC_MAP_GPA_RANGE hypercall for userspace VMEXIT.
These patches are more or less okay, with only a few nits, and I can
queue them already:
Hey,
please check if branch qemu-coco-queue of
https://gitlab.com/bonzini/qemu works for you!
Getting compilation error here: Hope I am looking at correct branch.
softmmu.fa.p/target_i386_kvm_kvm.c.o.d -o
libqemu-x86_64-softmmu.fa.p/target_i386_kvm_kvm.c.o -c
../target/i386/kvm/kvm.c
../target/i386/kvm/kvm.c:171:6: error: ‘KVM_X86_SEV_SNP_VM’ undeclared
here (not in a function); did you mean ‘KVM_X86_SEV_ES_VM’?
171 | [KVM_X86_SEV_SNP_VM] = "SEV-SNP",
| ^~~~~~~~~~~~~~~~~~
| KVM_X86_SEV_ES_VM
Thanks,
Pankaj
I tested it successfully on CentOS 9 Stream with kernel from kvm/next
and firmware from edk2-ovmf-20240524-1.fc41.noarch.
Paolo
i386/sev: Replace error_report with error_setg
linux-headers: Update to current kvm/next
i386/sev: Introduce "sev-common" type to encapsulate common SEV state
i386/sev: Move sev_launch_update to separate class method
i386/sev: Move sev_launch_finish to separate class method
i386/sev: Introduce 'sev-snp-guest' object
i386/sev: Add a sev_snp_enabled() helper
i386/sev: Add sev_kvm_init() override for SEV class
i386/sev: Add snp_kvm_init() override for SNP class
i386/cpu: Set SEV-SNP CPUID bit when SNP enabled
i386/sev: Don't return launch measurements for SEV-SNP guests
i386/sev: Add a class method to determine KVM VM type for SNP guests
i386/sev: Update query-sev QAPI format to handle SEV-SNP
i386/sev: Add the SNP launch start context
i386/sev: Add handling to encrypt/finalize guest launch data
i386/sev: Set CPU state to protected once SNP guest payload is finalized
hw/i386/sev: Add function to get SEV metadata from OVMF header
i386/sev: Add support for populating OVMF metadata pages
i386/sev: Add support for SNP CPUID validation
i386/sev: Invoke launch_updata_data() for SEV class
i386/sev: Invoke launch_updata_data() for SNP class
i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE
i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests
i386/sev: Extract build_kernel_loader_hashes
i386/sev: Reorder struct declarations
i386/sev: Allow measured direct kernel boot on SNP
hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled
memory: Introduce memory_region_init_ram_guest_memfd()
These patches need a small prerequisite that I'll post soon:
hw/i386/sev: Use guest_memfd for legacy ROMs
hw/i386: Add support for loading BIOS using guest_memfd
This one definitely requires more work:
hw/i386/sev: Allow use of pflash in conjunction with -bios
Paolo
