Re: [PATCH v7 0/2] SEV-SNP: Add KVM support for SNP certificate fetching

[Liam Merwick <liam.merwick@oracle.com>]

On 09/01/2026 23:17, Michael Roth wrote:
> This patchset is also available at:
> 
>    https://github.com/amdese/linux/commits/snp-certs-v7
> 
> and is based on top of kvm/next (0499add8efd7)
> 
> 
> Overview
> --------
> 
> The GHCB 2.0 specification defines 2 GHCB request types to allow SNP guests
> to send encrypted messages/requests to firmware: SNP Guest Requests and SNP
> Extended Guest Requests. These encrypted messages are used for things like
> servicing attestation requests issued by the guest. Implementing support for
> these is required to be fully GHCB-compliant.
> 

(...)

> 
> Changes since v6:
> 
>   * Incorporate documentation/comment suggestions from Sean, along with
>     additional clarity/grammar fixups.
>   * Don't define SNP_GUEST_VMM_ERR_GENERIC for general use within kernel,
>     instead limit it to a KVM-specific choice of value in lieu of any
>     formally-defined guest message return code for generic/undefined errors.
>   * switch struct kvm_exit_snp_req_certs to using a 'gpa' argument instead
>     of 'gfn' (Sean)
>   * rebase to kvm/next, re-test, and collect R-b/T-b's
> 

v7 also
Tested-by: Liam Merwick <liam.merwick@oracle.com>


(...)
> 
> ----------------------------------------------------------------
> Michael Roth (2):
>        KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching
>        KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command
> 
>   Documentation/virt/kvm/api.rst                     | 44 ++++++++++++
>   .../virt/kvm/x86/amd-memory-encryption.rst         | 52 ++++++++++++++-
>   arch/x86/include/uapi/asm/kvm.h                    |  2 +
>   arch/x86/kvm/svm/sev.c                             | 78 ++++++++++++++++++++--
>   arch/x86/kvm/svm/svm.h                             |  1 +
>   include/uapi/linux/kvm.h                           |  9 +++
>   6 files changed, 179 insertions(+), 7 deletions(-)
> 
> 
>