On Fri, Jun 13, 2025 at 7:06 PM Roy Hopkins <roy.hopkins@randomman.co.uk> wrote:
>
> Here is v8 of the set of patches to add support for IGVM files to QEMU. This is
> based on commit d9ce74873a6a5a7c504379857461e4ae64fcf0cd of qemu.
>
> The previous version of this patch series [1] has only received a few comments
> which are now addressed in this new version. Additionally, the series has
> benefited from additional reviews and testing from the community. Therefore I
> am hoping that this will be the final version and rebase of this patch series.
>
> Suggestions have been received for adding support for setting CPU initial state
> for non-confidential guests (Gerd) and for reorganization of the confidential-
> guest support modules (dhildenb). These suggestions have not been
> implemented in this version of the patch series, but I will look to implement
> them in a future patch series.
>
> The only functional change in this version is to fix an issue in patch 16/16
> where the pre-parsing of the IGVM file caused an error after rebasing.
> Additionally, commit metadata, version numbers and documentation changes have
> been made, as suggested in review comments.
>
> As always, thanks to those that have been following along, reviewing and testing
> this series. This v8 patch series is also available on github: [2]
>
> For testing IGVM support in QEMU you need to generate an IGVM file that is
> configured for the platform you want to launch. You can use the `buildigvm`
> test tool [3] to allow generation of IGVM files for all currently supported
> platforms. Patch 11/17 contains information on how to generate an IGVM file
> using this tool.
>
> Changes in v8:
>
> * Fix an issue found after rebasing where the pre-parsing of the IGVM file
> caused an error.
> * Update version numbers for IGVM support to 10.1
> * Minor changes to documentation.
> * Add metadata to relevant commits.
>
Other than the comments I already posted ...
Reviewed-by: Ani Sinha <anisinha@redhat.com>
> Patch summary:
>
> 1-11: Add support and documentation for processing IGVM files for SEV, SEV-ES,
> SEV-SNP and native platforms.
>
> 12-15: Processing of policy and SEV-SNP ID_BLOCK from IGVM file.
>
> 16: Add pre-processing of IGVM file to support synchronization of 'SEV_FEATURES'
> from IGVM VMSA to KVM.
>
> [1] Link to v7:
> https://lists.gnu.org/archive/html/qemu-devel/2025-02/msg05714.html
>
> [2] v8 patches also available here:
> https://github.com/roy-hopkins/qemu/tree/igvm_master_v8
>
> [3] `buildigvm` tool v0.2.0
> https://github.com/roy-hopkins/buildigvm/releases/tag/v0.2.0
>
> Roy Hopkins (16):
> meson: Add optional dependency on IGVM library
> backends/confidential-guest-support: Add functions to support IGVM
> backends/igvm: Add IGVM loader and configuration
> hw/i386: Add igvm-cfg object and processing for IGVM files
> i386/pc_sysfw: Ensure sysfw flash configuration does not conflict with
> IGVM
> sev: Update launch_update_data functions to use Error handling
> target/i386: Allow setting of R_LDTR and R_TR with
> cpu_x86_load_seg_cache()
> i386/sev: Refactor setting of reset vector and initial CPU state
> i386/sev: Implement ConfidentialGuestSupport functions for SEV
> docs/system: Add documentation on support for IGVM
> docs/interop/firmware.json: Add igvm to FirmwareDevice
> backends/confidential-guest-support: Add set_guest_policy() function
> backends/igvm: Process initialization sections in IGVM file
> backends/igvm: Handle policy for SEV guests
> i386/sev: Add implementation of CGS set_guest_policy()
> sev: Provide sev_features flags from IGVM VMSA to KVM_SEV_INIT2
>
> backends/confidential-guest-support.c | 43 +
> backends/igvm-cfg.c | 51 +
> backends/igvm.c | 977 ++++++++++++++++++++
> backends/igvm.h | 22 +
> backends/meson.build | 5 +
> docs/interop/firmware.json | 30 +-
> docs/system/i386/amd-memory-encryption.rst | 2 +
> docs/system/igvm.rst | 173 ++++
> docs/system/index.rst | 1 +
> hw/i386/pc.c | 12 +
> hw/i386/pc_piix.c | 10 +
> hw/i386/pc_q35.c | 10 +
> hw/i386/pc_sysfw.c | 31 +-
> include/hw/i386/x86.h | 3 +
> include/system/confidential-guest-support.h | 88 ++
> include/system/igvm-cfg.h | 49 +
> meson.build | 8 +
> meson_options.txt | 2 +
> qapi/qom.json | 17 +
> qemu-options.hx | 28 +
> scripts/meson-buildoptions.sh | 3 +
> target/i386/cpu.h | 9 +-
> target/i386/sev.c | 851 +++++++++++++++--
> target/i386/sev.h | 124 +++
> 24 files changed, 2465 insertions(+), 84 deletions(-)
> create mode 100644 backends/igvm-cfg.c
> create mode 100644 backends/igvm.c
> create mode 100644 backends/igvm.h
> create mode 100644 docs/system/igvm.rst
> create mode 100644 include/system/igvm-cfg.h
>
> --
> 2.43.0
>