guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Tested-by: Stefano Garzarella
Reviewed-by: Liam Merwick
Reviewed-by: Ani Sinha
---
backends/igvm.c | 17 +++-
backends/igvm.h | 2 +-
hw/i386/pc_piix.c
s and the
signatures are valid.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Reviewed-by: Ani Sinha
---
target/i386/sev.c | 83 +++
target/i386/sev.h | 12 +++
2 files changed,
Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.
Signed-off-by: Roy Hopkins
initialization sections during
processing of the IGVM file.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano Garzarella
---
backends/igvm.c | 21 +
1 file changed, 21 insertions(+)
diff --git a/backends/igvm.c b/backends
confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano
IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by
such as SEV.
This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Reviewed-by: Ani Sinha
---
target/i386
access of the segment array.
Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.
This patch adds correct handling for R_LDTR and R_TR in the function.
Signed-off-by: R
startup and CPU reset.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Reviewed-by: Pankaj Gupta
---
target/i386/sev.c | 322 +-
target/i386/sev.h | 110
2 files changed, 399
tly set an error condition if a non-zero value is
returned.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Pankaj Gupta
Reviewed-by: Stefano Garzarella
Reviewed-by: Ani Sinha
---
target/i386/sev.c | 68 +++--
have been configured when using
IGVM, exiting with an error message if this is not the case.
Signed-off-by: Roy Hopkins
Acked-by: Gerd Hoffman
Reviewed-by: Daniel P. Berrangé
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
Reviewed-by: Pankaj Gupta
Reviewed-by: Ani Sinha
---
hw
guest before it is started.
If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.
Signed-off-by: Roy Hopkins
Acked-by: Gerd Hoffman
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano
system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.
The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked
-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano Garzarella
Reviewed-by: Ani Sinha
---
backends/confidential-guest-support.c | 31 ++
include/system/confidential-guest-support.h | 67 +
2 files changed, 98 insertions
, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.
The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.
Signed-off-by: Roy Hopkins
Acked-by
tches also available here:
https://github.com/roy-hopkins/qemu/tree/igvm_master_v9
[3] `buildigvm` tool v0.2.0
https://github.com/roy-hopkins/buildigvm/releases/tag/v0.2.0
Roy Hopkins (16):
meson: Add optional dependency on IGVM library
backends/confidential-guest-support: Add functions to su
> On 13/06/2025 16:22, Roy Hopkins wrote:
> > Adds a handler for the guest policy initialization IGVM section and
> > builds an SEV policy based on this information and the ID block
> > directive if present. The policy is applied using by calling
> >
On Fri, 2025-06-27 at 16:58 +0530, Ani Sinha wrote:
> On Fri, Jun 13, 2025 at 8:52 PM Roy Hopkins
> wrote:
> >
> > The initialization sections in IGVM files contain configuration that
> > should be applied to the guest platform before it is started. This
> > i
On Mon, 2025-06-16 at 14:11 +0530, Ani Sinha wrote:
>
>
> > On 13 Jun 2025, at 7:41 PM, Roy Hopkins wrote:
> >
> > When an SEV guest is started, the reset vector and state are
> > extracted from metadata that is contained in the firmware volume.
> >
> &
On Fri, 2025-06-27 at 15:41 +0530, Ani Sinha wrote:
> On Fri, Jun 13, 2025 at 7:24 PM Roy Hopkins
> wrote:
> >
> > Adds an IGVM loader to QEMU which processes a given IGVM file and
> > applies the directives within the file to the current guest
> > configuration.
&
s and the
signatures are valid.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
---
target/i386/sev.c | 83 +++
target/i386/sev.h | 12 +++
2 files changed, 95 insertions(+)
diff --gi
guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Tested-by: Stefano Garzarella
---
backends/igvm.c | 17 +++-
backends/igvm.h | 2 +-
hw/i386/pc_piix.c | 2 +-
hw/i386/pc_q35.c | 2
initialization sections during
processing of the IGVM file.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano Garzarella
---
backends/igvm.c | 21 +
1 file changed, 21 insertions(+)
diff --git a/backends/igvm.c b/backends
Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.
Signed-off-by: Roy Hopkins
confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano
such as SEV.
This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
---
target/i386/sev.c | 254
IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by
access of the segment array.
Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.
This patch adds correct handling for R_LDTR and R_TR in the function.
Signed-off-by: R
startup and CPU reset.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
Acked-by: Gerd Hoffman
Reviewed-by: Pankaj Gupta
---
target/i386/sev.c | 323 +-
target/i386/sev.h | 110
2 files changed, 400
tly set an error condition if a non-zero value is
returned.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Pankaj Gupta
Reviewed-by: Stefano Garzarella
---
target/i386/sev.c | 68 +++
1 file changed, 33
have been configured when using
IGVM, exiting with an error message if this is not the case.
Signed-off-by: Roy Hopkins
Acked-by: Gerd Hoffman
Reviewed-by: Daniel P. Berrangé
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
Reviewed-by: Pankaj Gupta
---
hw/i386/pc_sysfw.c | 31
guest before it is started.
If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.
Signed-off-by: Roy Hopkins
Acked-by: Gerd Hoffman
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano
system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.
The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked
-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Gerd Hoffman
Reviewed-by: Stefano Garzarella
---
backends/confidential-guest-support.c | 31 ++
include/system/confidential-guest-support.h | 67 +
2 files changed, 98 insertions(+)
diff --git a/backends
, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.
The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.
Signed-off-by: Roy Hopkins
Acked-by
v7:
https://lists.gnu.org/archive/html/qemu-devel/2025-02/msg05714.html
[2] v8 patches also available here:
https://github.com/roy-hopkins/qemu/tree/igvm_master_v8
[3] `buildigvm` tool v0.2.0
https://github.com/roy-hopkins/buildigvm/releases/tag/v0.2.0
Roy Hopkins (16):
meson: Add optional dependency on IG
On Fri, 2025-06-13 at 17:41 +0530, Ani Sinha wrote:
>
>
> > On 27 Feb 2025, at 7:59 PM, Roy Hopkins wrote:
> >
> > The new cgs_set_guest_policy() function is provided to receive the guest
> > policy flags, SNP ID block and SNP ID authentication from guest
> >
On Fri, 2025-02-28 at 14:13 +0100, Gerd Hoffmann wrote:
> On Thu, Feb 27, 2025 at 01:44:07PM +0000, Roy Hopkins wrote:
> > The IGVM loader can be used to configure both confidential and
> > non-confidential guests.
>
> For non-confidential guests the initial register state i
n initial parsing of the IGVM file during initialization
to extract sev_features. I was parsing all directives in the file but it
appears this has some unwanted side effects.
Please could you try the patch below to see if it fixes the issue? If it
does I'll incorporate it into the patch series
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
On Thu, 2025-02-27 at 16:32 +0100, Stefano Garzarella wrote:
> Hi Roy,
>
> On Thu, Feb 27, 2025 at 01:38:08PM +0000, Roy Hopkins wrote:
> > Here is v7 of the set of patches to add support for IGVM files to
> > QEMU. This is
> > based on commit 40efe733e10cc00e4fb4f
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
such as SEV.
This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 254
Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.
Signed-off-by: Roy Hopkins
Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
do
initialization sections during
processing of the IGVM file.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
backends/igvm.c | 21 +
1 file changed, 21 insertions(+)
diff --git a/backends/igvm.c b/backends/igvm.c
index 4dfc9b0c67
s and the
signatures are valid.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 83 +++
target/i386/sev.h | 12 +++
2 files changed, 95 insertions(+)
diff --git a/target/i386/s
confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
startup and CPU reset.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 323 +-
target/i386/sev.h | 110
2 files changed, 400 insertions(+), 33 deletions(-)
diff --git a/target
tly set an error condition if a non-zero value is
returned.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Pankaj Gupta
Reviewed-by: Stefano Garzarella
---
target/i386/sev.c | 68 +++
1 file changed, 33 insertions(+), 35 deletion
IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by
access of the segment array.
Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.
This patch adds correct handling for R_LDTR and R_TR in the function.
Signed-off-by: R
have been configured when using
IGVM, exiting with an error message if this is not the case.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
Reviewed-by: Pankaj Gupta
---
hw/i386/pc_sysfw.c | 31
file to support synchronization of 'SEV_FEATURES'
from IGVM VMSA to KVM.
[1] Link to v6:
https://lore.kernel.org/qemu-devel/cover.1727341768.git.roy.hopk...@suse.com/
[2] v7 patches also available here:
https://github.com/roy-hopkins/qemu/tree/igvm_master_v7
[3] `buildigvm` tool v0
system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.
The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.
The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.
Signed-off-by: Roy Hopkins
Acked-by
guest before it is started.
If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.
Signed-off-by: Roy Hopkins
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
hw/i386
-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
backends/confidential-guest-support.c | 31 ++
include/system/confidential-guest-support.h | 67 +
2 files changed, 98 insertions(+)
diff --git a/backends/confidential-guest
On Tue, 2024-10-22 at 11:05 +0200, Stefano Garzarella wrote:
> On Mon, Oct 21, 2024 at 03:44:26PM +0100, Roy Hopkins wrote:
> > > Here is v6 of the set of patches to add support for IGVM files to QEMU.
> > > This
> > > is
> > > based on commit a5dd9e
> Here is v6 of the set of patches to add support for IGVM files to QEMU. This
> is
> based on commit a5dd9ee060 of qemu.
>
> This version addresses all of the review comments from v5 [1].
Hi all. I'm just drawing attention to this series again. It has been through a
number of review cycles and a
s and the
signatures are valid.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 83 +++
target/i386/sev.h | 12 +++
2 files changed, 95 insertions(+)
diff --git a/target/i386/s
Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.
Signed-off-by: Roy Hopkins
guest before it is started.
If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.
Signed-off-by: Roy Hopkins
Reviewed-by: Michael S. Tsirkin
---
hw/i386/pc.c | 12
confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
startup and CPU reset.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 323 +-
target/i386/sev.h | 110
2 files changed, 400 insertions(+), 33 deletions(-)
diff --git a/target
initialization sections during
processing of the IGVM file.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
backends/igvm.c | 21 +
1 file changed, 21 insertions(+)
diff --git a/backends/igvm.c b/backends/igvm.c
index 4dfc9b0c67
IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by
have been configured when using
IGVM, exiting with an error message if this is not the case.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
hw/i386/pc_sysfw.c | 31 ---
1 file changed, 28
tly set an error condition if a non-zero value is
returned.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Pankaj Gupta
Reviewed-by: Stefano Garzarella
---
target/i386/sev.c | 68 +++
1 file changed, 33 insertions(+), 35 deletion
, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.
The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.
Signed-off-by: Roy Hopkins
Acked-by
Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
do
system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.
The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
access of the segment array.
Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.
This patch adds correct handling for R_LDTR and R_TR in the function.
Signed-off-by: R
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
such as SEV.
This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Acked-by: Stefano Garzarella
---
target/i386/sev.c | 254
ng of policy and SEV-SNP ID_BLOCK from IGVM file.
16: Add pre-processing of IGVM file to support synchronization of 'SEV_FEATURES'
from IGVM VMSA to KVM.
[1] Link to v5:
https://lore.kernel.org/all/cover.1723560001.git.roy.hopk...@suse.com/
[2] v6 patches also available here:
https://github.
-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
Reviewed-by: Stefano Garzarella
---
backends/confidential-guest-support.c | 31 +++
include/exec/confidential-guest-support.h | 67 +++
2 files changed, 98 insertions(+)
diff --git a/backends/confidential-guest
On Mon, 2024-09-02 at 16:40 +0200, Stefano Garzarella wrote:
> On Tue, Aug 13, 2024 at 04:01:02PM GMT, Roy Hopkins wrote:
> > Here is v5 of the set of patches to add support for IGVM files to QEMU. This
> > is
> > based on commit 0f397dcfec of qemu.
> >
> >
have been configured when using
IGVM, exiting with an error message if this is not the case.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by: Michael S. Tsirkin
---
hw/i386/pc_sysfw.c | 31 ---
1 file changed, 28 insertions(+), 3 deletions
-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
backends/confidential-guest-support.c | 31 +++
include/exec/confidential-guest-support.h | 65 +++
2 files changed, 96 insertions(+)
diff --git a/backends/confidential-guest-support.c
b/backends/confidential
s and the
signatures are valid.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
target/i386/sev.c | 83 +++
target/i386/sev.h | 12 +++
2 files changed, 95 insertions(+)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 6db76
startup and CPU reset.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
target/i386/sev.c | 323 +-
target/i386/sev.h | 110
2 files changed, 400 insertions(+), 33 deletions(-)
diff --git a/target/i386/sev.c b/target/i386/sev.c
does cause the IGVM file to be processed twice. Firstly to extract
the sev_features then secondly to actually configure the guest. However,
the first pass is largely ignored meaning the overhead is minimal.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
target/i386/sev.c | 160
lable here:
https://github.com/roy-hopkins/qemu/tree/igvm_master_v5
[3] `buildigvm` tool v0.2.0
https://github.com/roy-hopkins/buildigvm/releases/tag/v0.2.0
Roy Hopkins (16):
meson: Add optional dependency on IGVM library
backends/confidential-guest-support: Add functions to support IGVM
back
system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.
The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
guest before it is started.
If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.
Signed-off-by: Roy Hopkins
Reviewed-by: Michael S. Tsirkin
---
hw/i386/pc.c | 12
such as SEV.
This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
target/i386/sev.c | 254 --
target/i386/sev.h
confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.
Signed-off-by: Roy Hopkins
initialization sections during
processing of the IGVM file.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
backends/igvm.c | 21 +
1 file changed, 21 insertions(+)
diff --git a/backends/igvm.c b/backends/igvm.c
index 7a3fedcc76..9120922a95 100644
--- a/backends
access of the segment array.
Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.
This patch adds correct handling for R_LDTR and R_TR in the function.
Signed-off-by: R
Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
docs/interop/firmware
IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.
Signed-off-by: Roy Hopkins
Reviewed-by: Daniel P. Berrangé
Reviewed-by
, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.
The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.
Signed-off-by: Roy Hopkins
Acked-by
tly set an error condition if a non-zero value is
returned.
Signed-off-by: Roy Hopkins
Acked-by: Michael S. Tsirkin
---
target/i386/sev.c | 68 +++
1 file changed, 33 insertions(+), 35 deletions(-)
diff --git a/target/i386/sev.c b/target/i386/sev.c
index
On Wed, 2024-07-24 at 18:13 +0100, Daniel P. Berrangé wrote:
> On Wed, Jul 03, 2024 at 12:05:43PM +0100, Roy Hopkins wrote:
> > When using an IGVM file the configuration of the system firmware is
> > defined by IGVM directives contained in the file. In this case the user
> >
1 - 100 of 183 matches
Mail list logo
