Re: [PATCH v9 08/16] i386/sev: Refactor setting of reset vector and initial CPU state

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Jul 08, 2025 at 04:25:25PM +0100, Daniel P. Berrangé wrote:
> On Thu, Jul 03, 2025 at 04:31:59PM +0100, Roy Hopkins wrote:
> > When an SEV guest is started, the reset vector and state are
> > extracted from metadata that is contained in the firmware volume.
> > 
> > In preparation for using IGVM to setup the initial CPU state,
> > the code has been refactored to populate vmcb_save_area for each
> > CPU which is then applied during guest startup and CPU reset.
> > 
> > Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
> > Acked-by: Michael S. Tsirkin <mst@redhat.com>
> > Acked-by: Stefano Garzarella <sgarzare@redhat.com>
> > Acked-by: Gerd Hoffman <kraxel@redhat.com>
> > Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
> > ---
> >  target/i386/sev.c | 322 +++++++++++++++++++++++++++++++++++++++++-----
> >  target/i386/sev.h | 110 ++++++++++++++++
> >  2 files changed, 399 insertions(+), 33 deletions(-)
> > 
> > diff --git a/target/i386/sev.c b/target/i386/sev.c
> > index a84f5f5d28..a13f91e615 100644
> > --- a/target/i386/sev.c
> > +++ b/target/i386/sev.c
> 
> 
> > +static void sev_apply_cpu_context(CPUState *cpu)
> > +{
> > +    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
> > +    X86CPU *x86;
> > +    CPUX86State *env;
> > +    struct SevLaunchVmsa *launch_vmsa;
> > +
> > +    /* See if an initial VMSA has been provided for this CPU */
> > +    QTAILQ_FOREACH(launch_vmsa, &sev_common->launch_vmsa, next)
> > +    {
> > +        if (cpu->cpu_index == launch_vmsa->cpu_index) {
> > +            x86 = X86_CPU(cpu);
> > +            env = &x86->env;
> > +
> > +            /*
> > +             * Ideally we would provide the VMSA directly to kvm which would
> > +             * ensure that the resulting initial VMSA measurement which is
> > +             * calculated during KVM_SEV_LAUNCH_UPDATE_VMSA is calculated from
> > +             * exactly what we provide here. Currently this is not possible so
> > +             * we need to copy the parts of the VMSA structure that we currently
> > +             * support into the CPU state.
> > +             */
> 
> Are there any parts of the VMSA described in the IGVM that we are
> unable to handle here ?
> 
> If so, what happens if those parts are set in the IGVM and their
> value doesn't match KVM's default ? Presumably that would become
> a measurement failure ?

Never mind, this is answered by the following patch.


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|