Add initial build script

15 files changed, 473 insertions, 1177 deletions

diff --git a/README.md b/README.md
index cfcac53..e69de29 100644
--- a/README.md
+++ b/README.md
@@ -1,566 +0,0 @@
-# Table of contents
-* [ Introduction ](#intro)
-* [ SLES-15 ](#sles-15)
-  * [ Prepare Host OS ](#sles-15-host)
-  * [ Prepare VM ](#sles-15-prep-vm)
-  * [ Launch SEV VM ](#sles-15-launch-vm)
-* [ RHEL-8 ](#rhel-8)
-  * [ Prepare Host OS ](#rhel-8-host)
-  * [ Prepare VM ](#rhel-8-prep-vm)
-  * [ Launch SEV VM ](#rhel-8-launch-vm)  
-* [ Fedora-28 ](#fc-28)
-  * [ Prepare Host OS ](#fc-28-host)
-  * [ Prepare VM ](#fc-28-prep-vm)
-  * [ Launch SEV VM ](#fc-28-launch-vm)
-* [ Fedora-29 ](#fc-29)
-  * [ Prepare Host OS ](#fc-29-host)
-  * [ Prepare VM ](#fc-29-prep-vm)
-  * [ Launch SEV VM ](#fc-29-launch-vm)
-* [ Ubuntu-18.04 ](#ubuntu18)
-  * [ Prepare Host OS ](#ubuntu18-host)
-  * [ Prepare VM ](#ubuntu18-prep-vm)
-  * [ Launch SEV VM ](#ubuntu18-launch-vm)
-* [ openSuse-Tumbleweed](#tumbleweed)
-  * [ Prepare Host OS ](#tumbleweed-host)
-  * [ Launch SEV VM ](#tumbleweed-launch-vm)
-* [ SEV Containers ](#kata)
-* [ Additional resources ](#resources)
-* [ FAQ ](#faq)
-  * [ How do I know if Hypervisor supports SEV ](#faq-1)
-  * [ How do I know if SEV is enabled in the guest](#faq-2)
-  * [ Can I use virt-manager to launch SEV guest](#faq-3)
-  * [ How to increase SWIOTLB limit](#faq-4)
-  * [ virtio-blk fails with out-of-dma-buffer error](#faq-5)  
-  
-<a name="intro"></a>
-# Secure Encrypted Virtualization (SEV)
-
-SEV is an extension to the AMD-V architecture which supports running encrypted
-virtual machine (VMs) under the control of KVM. Encrypted VMs have their pages
-(code and data) secured such that only the guest itself has access to the
-unencrypted version. Each encrypted VM is associated with a unique encryption
-key; if its data is accessed to a different entity using a different key the
-encrypted guests data will be incorrectly decrypted, leading to unintelligible
-data. 
-
-SEV support has been accepted in upstream projects. This repository provides
-scripts to build various components to enable SEV support until the distros
-pick the newer version of components.
-
-To enable the SEV support we need the following versions.
-
-| Project       | Version                              |
-| ------------- |:------------------------------------:|
-| kernel        | >= 4.16                              |
-| libvirt       | >= 4.5                               |
-| qemu          | >= 2.12                              |
-| ovmf          | >= commit (75b7aa9528bd 2018-07-06 ) |
-
-> * Installing newer libvirt may conflict with existing setups hence script does
->   not install the newer version of libvirt. If you are interested in launching
->   SEV guest through the virsh commands then build and install libvirt 4.5 or
->   higher. Use LaunchSecurity tag https://libvirt.org/formatdomain.html#sev for
->   creating the SEV enabled guest.
->
-> * SEV support is not available in SeaBIOS. Guest must use OVMF.
-
-<a name="sles-15"></a>
-
-## SLES-15
-
-SUSE Linux Enterprise Server 15 GA includes the SEV support; we do not need
-to compile the sources.
-
-> SLES-15 does not contain the updated libvirt packages yet hence we will
-use QEMU command line interface to launch VMs.
-
-<a name="sles-15-host"></a>
-### Prepare Host OS
-
-SEV is not enabled by default, lets enable it through kernel command line:
-
-Append the following in /etc/defaults/grub
-
-```
-GRUB_CMDLINE_LINUX_DEFAULT=".... mem_encrypt=on kvm_amd.sev=1"
-```
-
-Regenerate grub.cfg and reboot the host
-
-```
-# grub2-mkconfig -o /boot/efi/EFI/sles/grub.cfg
-# reboot
-```
-
-Install the qemu launch script. The launch script can be obtained from this project.
-
-```
-# git clone https://github.com/AMDESE/AMDSEV.git
-# cd AMDSEV/distros/sles-15
-# ./build.sh
-```
-<a name="sles-15-prep-vm"></a>
-### Prepare VM image
-
-Create empty virtual disk image
-
-```
-# qemu-img create -f qcow2 sles-15.qcow2 30G
-```
-
-Create a new copy of OVMF_VARS.fd. The OVMF_VARS.fd is a "template" used
-to emulate persistent NVRAM storage. Each VM needs a private, writable
-copy of VARS.fd.
-
-```
-#cp /usr/share/qemu/ovmf-x86_64-suse-4m-vars.bin OVMF_VARS.fd 
-```
-
-Download and install sles-15 guest
-
-```
-# launch-qemu.sh -hda sles-15.qcow2 -cdrom SLE-15-Installer-DVD-x86_64-GM-DVD1.iso -nosev
-```
-Follow the screen to complete the guest installation.
-
-<a name="sles-15-launch-vm"></a>
-### Launch VM
-
-Use the following command to launch SEV guest
-
-```
-# launch-qemu.sh -hda sles-15.qcow2
-```
-NOTE: when guest is booting, CTRL-C is mapped to CTRL-], use CTRL-] to stop the guest
-
-## RHEL-8
-
-RedHat Enterprise Linux 8.0 GA includes the SEV support; we do not need
-to compile the sources.
-
-<a name="rhel-8-host"></a>
-### Prepare Host OS
-
-SEV is not enabled by default, lets enable it through kernel command line:
-
-Append the following in /etc/defaults/grub
-
-```
-GRUB_CMDLINE_LINUX_DEFAULT=".... mem_encrypt=on kvm_amd.sev=1"
-```
-
-Regenerate grub.cfg and reboot the host
-
-```
-# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
-# reboot
-```
-
-Install the qemu launch script. The launch script can be obtained from this project.
-
-```
-# git clone https://github.com/AMDESE/AMDSEV.git
-# cd AMDSEV/distros/rhel-8
-# ./build.sh
-```
-<a name="rhel-8-prep-vm"></a>
-### Prepare VM image
-
-Create empty virtual disk image
-
-```
-# qemu-img create -f qcow2 rhel-8.qcow2 30G
-```
-
-Create a new copy of OVMF_VARS.fd. The OVMF_VARS.fd is a "template" used
-to emulate persistent NVRAM storage. Each VM needs a private, writable
-copy of VARS.fd.
-
-```
-#cp /usr/share/OVMF/OVMF_VARS.fd OVMF_VARS.fd 
-```
-
-Download and install rhel-8 guest
-
-```
-# launch-qemu.sh -hda rhel-8.qcow2 -cdrom RHEL-8.0.0-20190404.2-x86_64-dvd1.iso
-```
-Follow the screen to complete the guest installation.
-
-<a name="rhel-8-launch-vm"></a>
-### Launch VM
-
-Use the following command to launch SEV guest
-
-```
-# launch-qemu.sh -hda rhel-8.qcow2
-```
-NOTE: when guest is booting, CTRL-C is mapped to CTRL-], use CTRL-] to stop the guest
-
-<a name="fc-28"></a>
-## Fedora-28
-
-Fedora-28 includes newer kernel and ovmf packages but has older qemu. We will need to update the QEMU to launch SEV guest.
-
-<a name="fc-28-host"></a>
-### Prepare Host OS
-
-SEV is not enabled by default, lets enable it through kernel command line:
-
-Append the following in /etc/defaults/grub
-
-```
-GRUB_CMDLINE_LINUX_DEFAULT=".... mem_encrypt=on kvm_amd.sev=1"
-```
-
-Regenerate grub.cfg and reboot the host
-
-```
-# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg
-# reboot
-```
-
-Build and install newer qemu
-
-```
-# cd distros/fedora-28
-# ./build.sh
-```
-
-<a name="fc-28-prep-vm"></a>
-### Prepare VM image
-
-Create empty virtual disk image
-
-```
-# qemu-img create -f qcow2 fedora-28.qcow2 30G
-```
-
-Create a new copy of OVMF_VARS.fd. The OVMF_VARS.fd is a "template" used
-to emulate persistent NVRAM storage. Each VM needs a private, writable
-copy of VARS.fd.
-
-```
-# cp /usr/share/OVMF/OVMF_VARS.fd OVMF_VARS.fd
-```
-
-Download and install fedora-28 guest
-
-```
-# launch-qemu.sh -hda fedora-28.qcow2 -cdrom  Fedora-Workstation-netinst-x86_64-28-1.1.iso
-```
-Follow the screen to complete the guest installation.
-
-<a name="fc-28-launch-vm"></a>
-### Launch VM
-
-Use the following command to launch SEV guest
-
-```
-# launch-qemu.sh -hda fedora-28.qcow2
-```
-
-NOTE: when guest is booting, CTRL-C is mapped to CTRL-], use CTRL-] to stop the guest
-
-<a name="fc-29"></a>
-## Fedora-29
-
-Fedora-29 contains all the pre-requisite packages to launch an SEV guest. But the SEV feature is not enabled by default, this section documents how to enable the SEV feature.
-
-<a name="fc-29-host"></a>
-### Prepare Host OS
-
-* Add new udev rule for the /dev/sev device
-  
-  ```
-  # cat /etc/udev/rules.d/71-sev.rules
-  KERNEL=="sev", MODE="0660", GROUP="kvm"
-  ```
-* Clean libvirt caches so that on restart libvirt re-generates the capabilities
-
-  ```
-  # rm -rf /var/cache/libvirt/qemu/capabilities/
-  ```
-  
-* The default FC-29 kernel (4.18) has SEV disabled in config files, but the kernel available through the FC-29 update
-  has SEV config set
-
-  Use the following command to upgrade the packages and also install the virtulization packages
-
-   ```
-   # yum groupinstall virtualization
-   # yum upgrade
-   ```
-
-* By default SEV is disabled, append the following in /etc/defaults/grub
-
-    ```
-     GRUB_CMDLINE_LINUX_DEFAULT=".... mem_encrypt=on kvm_amd.sev=1"
-    ```
-
-    Regenerate grub.cfg and reboot the host
-
-    ```
-     # grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg
-     # reboot
-    ```
-
-* Install the qemu launch script
-
-     ```
-      # cd distros/fedora-29
-      # ./build.sh
-     ```
-     
-<a name="fc-29-prep-vm"></a>
-### Prepare VM image
-
-Create empty virtual disk image
-
-```
-# qemu-img create -f qcow2 fedora-29.qcow2 30G
-```
-
-Create a new copy of OVMF_VARS.fd. The OVMF_VARS.fd is a "template" used
-to emulate persistent NVRAM storage. Each VM needs a private, writable
-copy of VARS.fd.
-
-```
-# cp /usr/share/edk2/ovmf/OVMF_VARS.fd OVMF_VARS.fd
-```
-
-Download and install fedora-29 guest
-
-```
-# launch-qemu.sh -hda fedora-29.qcow2 -cdrom  Fedora-Workstation-netinst-x86_64-29-1.1.iso
-```
-Follow the screen to complete the guest installation.
-
-<a name="fc-29-launch-vm"></a>
-### Launch VM
-
-Use the following command to launch SEV guest
-
-```
-# launch-qemu.sh -hda fedora-29.qcow2
-```
-
-NOTE: when guest is booting, CTRL-C is mapped to CTRL-], use CTRL-] to stop the guest
-
-<a name="ubuntu18"></a>
-## Ubuntu 18.04
-
-Ubuntu 18.04 does not includes the newer version of components to be used as SEV
-hypervisor hence we will build and install newer kernel, qemu, ovmf.
-
-<a name="ubuntu18-host"></a>
-### Prepare Host OS
-
-* Enable source repositories [See](https://askubuntu.com/questions/158871/how-do-i-enable-the-source-code-repositories)
-
-* Build and install newer components
-
-```
-# cd distros/ubuntu-18.04
-# ./build.sh
-```
-
-<a name="ubuntu18-prep-vm"></a>
-### Prepare VM image
-
-Create empty virtual disk image
-
-```
-# qemu-img create -f qcow2 ubuntu-18.04.qcow2 30G
-```
-
-Create a new copy of OVMF_VARS.fd. The OVMF_VARS.fd is a "template" used
-to emulate persistent NVRAM storage. Each VM needs a private, writable
-copy of VARS.fd.
-
-```
-# cp /usr/local/share/qemu/OVMF_VARS.fd OVMF_VARS.fd
-```
-
-Install ubuntu-18.04 guest
-
-```
-# launch-qemu.sh -hda ubuntu-18.04.qcow2 -cdrom ubuntu-18.04-desktop-amd64.iso
-```
-Follow the screen to complete the guest installation.
-
-<a name="ubuntu18-launch-vm"></a>
-### Launch VM
-
-Use the following command to launch SEV guest
-
-```
-# launch-qemu.sh -hda ubuntu-18.04.qcow2
-```
-NOTE: when guest is booting, CTRL-C is mapped to CTRL-], use CTRL-] to stop the guest
-
-<a name="tumbleweed"></a>
-## openSUSE-Tumbleweed
-
-Latest version of openSUSE Tumbleweed distro contains all the pre-requisite packages to launch an SEV guest. But the SEV feature is not enabled by default, this section documents how to enable the SEV feature.
-
-<a name="tumbleweed-host"></a>
-### Prepare Host OS
-
-* Add new udev rule for the /dev/sev device
-  
-  ```
-  # cat /etc/udev/rules.d/71-sev.rules
-  KERNEL=="sev", MODE="0660", GROUP="kvm"
-  ```
-* Clean libvirt caches so that on restart libvirt re-generates the capabilities
-
-  ```
-  # rm -rf /var/cache/libvirt/qemu/capabilities/
-  # systemctl restart libvirtd
-  ```
-* SEV feature is not enabled in kernel by default, lets enable it through kernel command line:
-
-  Append the following in /etc/defaults/grub
-  ```
-   GRUB_CMDLINE_LINUX_DEFAULT=".... mem_encrypt=on kvm_amd.sev=1"
-  ```
-  Regenerate grub.cfg and reboot the host
-
-  ```
-  # grub2-mkconfig -o /boot/efi/EFI/opensuse/grub.cfg
-  # reboot
-  ```
-  
-<a name="tumbleweed-launch-vm"></a>  
-### Launch SEV VM
-
-Since virt-manager does not support SEV yet hence we need to use 'virsh' command to launch the SEV guest. See xmls/sample.xml on how to add SEV specific information in existing xml. Use the following command to launch SEV guest
-
-```
-# virsh create sample.xml
-```
-
-> The sample xml was generated through virt-manager and then edited with SEV specific information. The main changes are:
->
->* For virtio devices we need to enable DMA APIs. The DMA APIs are enable through <b><driver iommu='on'/></b> (aka iommu_platform=on) tag
-
-```
-    <controller type='virtio-serial' index='0'> 
-      <driver iommu='on' /> 
-      <alias name='virtio-serial0'/>
-      <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> 
-    </controller>
- ``` 
-> * Add LaunchSecurity tag to tell libvirt to enable memory-encryption
-
-```
-    <launchSecurity type='sev'>
-      <policy>0x0001</policy>
-      <cbitpos>47</cbitpos>
-      <reducedPhysBits>1</reducedPhysBits>
-    </launchSecurity>
-```
-
-> * QEMU pins the guest memory during the SEV guest launch hence we need to set the domain specific memory parameters to raise the memlock rlimits. e.g the below <b>memtune</b> tags raise the memlock limit to 5GB.
-
-```
-    <memtune>
-      <hard_limit unit='G'>5</hard_limit>
-      <soft_limit unit='G'>5</soft_limit>
-    </memtune>  
-```
-
-<a name="kata"></a>
-## SEV Containers
-
-Container runtimes that use hardware virtualization to further isolate container workloads can also make use of SEV. As a proof-of-concept, the [kata](https://github.com/AMDESE/AMDSEV/tree/kata) branch contains an SEV-capable version of the Kata Containers runtime that will start all containers inside of SEV virtual machines.
-
-For installation instructions on Ubuntu systems, see the [README](https://github.com/AMDESE/AMDSEV/blob/kata/README.md).
-
-<a name="resources"></a>
-# Additional Resources
-
-[SME/SEV white paper](http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf)
-
-[SEV API Spec](http://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf)
-
-[APM Section 15.34](http://support.amd.com/TechDocs/24593.pdf)
-
-[KVM forum slides](http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption_Technology.pdf)
-
-[KVM forum videos](https://www.youtube.com/watch?v=RcvQ1xN55Ew)
-
-[Linux kernel](https://elixir.bootlin.com/linux/latest/source/Documentation/virtual/kvm/amd-memory-encryption.rst)
-
-[Linux kernel](https://elixir.bootlin.com/linux/latest/source/Documentation/x86/amd-memory-encryption.txt)
-
-[Libvirt LaunchSecurity tag](https://libvirt.org/formatdomain.html#sev)
-
-[Libvirt SEV domainCap](https://libvirt.org/formatdomaincaps.html#elementsSEV)
-
-[Qemu doc](https://git.qemu.org/?p=qemu.git;a=blob;f=docs/amd-memory-encryption.txt;h=f483795eaafed8409b1e96806ca743354338c9dc;hb=HEAD)
-
-<a name="faq"></a>
-# FAQ
-
-<a name="faq-1"></a>
- * <b>How do I know if hypervisor supports SEV feature ?</b>
-   
-   a) When using libvirt >= 4.15 run the following command
-   
-   ```
-   # virsh domcapabilities
-   ```
-   If hypervisor supports SEV feature then <b>sev</b> tag will be present.
-   
-   >See [Libvirt DomainCapabilities feature](https://libvirt.org/formatdomaincaps.html#elementsSEV)
-for additional information.
- 
-   b) Use qemu QMP 'query-sev-capabilities' command to check the SEV support. If SEV is supported then command will return the full SEV capabilities (which includes host PDH, cert-chain, cbitpos and reduced-phys-bits).
-   
-     > See [QMP doc](https://github.com/qemu/qemu/blob/master/docs/devel/writing-qmp-commands.txt) for details on how to interact with QMP shell.
-  
-<a name="faq-2"></a>
- * <b>How do I know if SEV is enabled in the guest ?</b>
- 
-   a) Check the kernel log buffer for the following message
-   ```
-   # dmesg | grep -i sev
-   AMD Secure Encrypted Virtualization (SEV) active
-   ```
-   
-   b) MSR 0xc0010131 (MSR_AMD64_SEV) can be used to determine if SEV is active
-   
-   ```
-   # rdmsr -a 0xc0010131
-   ```
-   <pre>
-   Bit[0]:   0 = SEV is not active
-             1 = SEV is active
-   </pre>
-
-<a name="faq-3"></a>
- * <b>Can I use virt-manager to launch SEV guest?</b>
-
-    virt-manager uses libvirt to manage VMs, SEV support has been added in libvirt but virt-manager does use the newly introduced [LaunchSecurity](https://libvirt.org/formatdomain.html#sev) tags yet hence we will not able to launch SEV guest through the virt-manager.
-    > If your system is using libvirt >= 4.15 then you can manually edit the xml file to use [LaunchSecurity](https://libvirt.org/formatdomain.html#sev) to enable the SEV support in the guest.
-
-<a name="faq-4"></a>
- * <b>How to increase SWIOTLB limit ?</b>
- 
- When SEV is enabled, all the DMA operations inside the guest are performed on the shared memory. Linux kernel uses SWIOTLB  bounce buffer for DMA operations inside SEV guest. A guest panic will occur if kernel runs out of the SWIOTLB pool. Linux kernel default to 64MB SWIOTLB pool. It is recommended to increase the swiotlb pool size to 512MB. The swiotlb pool size can be increased in guest by appending the following in the grub.cfg file
- 
- Append the following in /etc/defaults/grub
-
-```
-GRUB_CMDLINE_LINUX_DEFAULT=".... swiotlb=262144"
-```
-
-And regenerate the grub.cfg.
-
-<a name="faq-5"></a>
- * <b>virtio-blk device runs out-of-dma-buffer error </b>
- 
- To support the multiqueue mode, virtio-blk drivers inside the guest allocates large number of DMA buffer. SEV guest uses SWIOTLB for the DMA buffer allocation or mapping hence kernel runs of the SWIOTLB pool quickly and triggers the out-of-memory error. In those cases consider increasing the SWIOTLB pool size or use virtio-scsi device.
- 
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..cb9f907
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(dirname $0)"
+. ${SCRIPT_DIR}/common.sh
+. ${SCRIPT_DIR}/stable-commits
+[ -e /etc/os-release ] && . /etc/os-release
+
+function usage()
+{
+	echo "Usage: $0 [OPTIONS] [COMPONENT]"
+	echo "  where COMPONENT is an individual component to build:"
+	echo "    qemu, ovmf, kernel"
+	echo "  where OPTIONS are:"
+	echo "  --install PATH   Installation path (default $INSTALL_DIR)"
+	echo "  -h|--help        Usage information"
+
+	exit 1
+}
+
+INSTALL_DIR="`pwd`/usr/local"
+
+while [ -n "$1" ]; do
+	case "$1" in
+	--install)
+		[ -z "$2" ] && usage
+		INSTALL_DIR="$2"
+		shift; shift
+		;;
+	-h|--help)
+		usage
+		;;
+	-*|--*)
+		echo "Unsupported option: [$1]"
+		usage
+		;;
+	*)
+		break
+		;;
+	esac
+done
+
+mkdir -p $INSTALL_DIR
+IDIR=$INSTALL_DIR
+INSTALL_DIR=$(readlink -e $INSTALL_DIR)
+[ -n "$INSTALL_DIR" -a -d "$INSTALL_DIR" ] || {
+	echo "Installation directory [$IDIR] does not exist, exiting"
+	exit 1
+}
+
+if [ -z "$1" ]; then
+	build_install_qemu "$INSTALL_DIR"
+	build_install_ovmf "$INSTALL_DIR/share/qemu"
+	build_kernel
+else
+	case "$1" in
+	qemu)
+		build_install_qemu "$INSTALL_DIR"
+		;;
+	ovmf)
+		build_install_ovmf "$INSTALL_DIR/share/qemu"
+		;;
+	kernel)
+		build_kernel
+		;;
+	esac
+fi
diff --git a/common.sh b/common.sh
new file mode 100755
index 0000000..1b5ff3b
--- /dev/null
+++ b/common.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+run_cmd()
+{
+	echo "$*"
+
+	eval "$*" || {
+		echo "ERROR: $*"
+		exit 1
+	}
+}
+
+build_kernel()
+{
+	[ -d linux ] || {
+		run_cmd git clone --single-branch -b ${KERNEL_BRANCH} ${KERNEL_GIT_URL} linux
+	}
+
+	[ -d linux-patches ] && {
+		pushd linux >/dev/null
+			run_cmd git checkout .
+		popd >/dev/null
+
+		for P in linux-patches/*.patch; do
+			run_cmd patch -p1 -d linux < $P
+		done
+	}
+
+
+	MAKE="make -C linux -j $(getconf _NPROCESSORS_ONLN) LOCALVERSION="
+
+	for V in snp; do
+		VER="-sev-es-$V"
+
+		run_cmd $MAKE distclean
+
+		pushd linux >/dev/null
+			run_cmd "cp /boot/config-$(uname -r) .config"
+			run_cmd ./scripts/config --set-str LOCALVERSION "$VER"
+			run_cmd ./scripts/config --disable LOCALVERSION_AUTO
+			run_cmd ./scripts/config --disable CONFIG_DEBUG_INFO
+		popd >/dev/null
+
+		yes "" | $MAKE olddefconfig
+
+		# Build 
+		run_cmd $MAKE >/dev/null
+
+		if [ "$ID_LIKE" = "debian" ]; then
+			run_cmd $MAKE bindeb-pkg
+		else
+			run_cmd $MAKE "RPMOPTS='--define \"_rpmdir .\"'" binrpm-pkg
+
+			run_cmd mv linux/x86_64/*.rpm .
+		fi
+	done
+}
+
+build_install_ovmf()
+{
+	DEST="$1"
+
+	GCC_VERSION=$(gcc -v 2>&1 | tail -1 | awk '{print $3}')
+	GCC_MAJOR=$(echo $GCC_VERSION | awk -F . '{print $1}')
+	GCC_MINOR=$(echo $GCC_VERSION | awk -F . '{print $2}')
+	if [ "$GCC_MAJOR" == "4" ]; then
+		GCCVERS="GCC${GCC_MAJOR}${GCC_MINOR}"
+	else
+		GCCVERS="GCC5"
+	fi
+
+	BUILD_CMD="nice build -q --cmd-len=64436 -DDEBUG_ON_SERIAL_PORT=TRUE -n $(getconf _NPROCESSORS_ONLN) ${GCCVERS:+-t $GCCVERS} -a X64 -p OvmfPkg/OvmfPkgX64.dsc"
+
+	[ -d ovmf ] || {
+		run_cmd git clone --single-branch -b ${OVMF_BRANCH} ${OVMF_GIT_URL} ovmf
+
+		pushd ovmf >/dev/null
+			run_cmd git submodule update --init --recursive
+		popd >/dev/null
+	}
+
+	pushd ovmf >/dev/null
+		run_cmd make -C BaseTools
+		. ./edksetup.sh --reconfig
+		run_cmd $BUILD_CMD
+
+		mkdir -p $DEST
+		run_cmd cp -f Build/OvmfX64/DEBUG_$GCCVERS/FV/OVMF_CODE.fd $DEST
+		run_cmd cp -f Build/OvmfX64/DEBUG_$GCCVERS/FV/OVMF_VARS.fd $DEST
+	popd >/dev/null
+}
+
+build_install_qemu()
+{
+	DEST="$1"
+
+	[ -d qemu ] || run_cmd git clone --single-branch -b ${QEMU_BRANCH} ${QEMU_GIT_URL} qemu
+
+	MAKE="make -j $(getconf _NPROCESSORS_ONLN) LOCALVERSION="
+
+	pushd qemu >/dev/null
+		run_cmd ./configure --target-list=x86_64-softmmu --disable-werror --prefix=$DEST --enable-trace-backend=log --enable-debug --extra-cflags="-g3" --extra-ldflags="-g3" --disable-strip --disable-pie --disable-werror --disable-glusterfs
+		run_cmd $MAKE
+		run_cmd $MAKE install
+	popd >/dev/null
+}
diff --git a/distros/common.sh b/distros/common.sh
deleted file mode 100755
index 714b66a..0000000
--- a/distros/common.sh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/bash
-
-. ../stable-commits
-
-BUILD_DIR=`pwd`/src
-NUM_OF_CORES=`grep -c ^processor /proc/cpuinfo`
-
-run_cmd()
-{
-	echo "$*"
-
-	$*
-	if [ $? -ne 0 ]; then
-		echo "ERROR: $*"
-		exit 1
-	fi
-}
-
-build_kernel()
-{
-	if [ ! -d $BUILD_DIR/linux ]; then
-		run_cmd "mkdir -p ${BUILD_DIR}/linux"
-		run_cmd "git clone --single-branch -b ${KERNEL_COMMIT} ${KERNEL_GIT_URL} ${BUILD_DIR}/linux"
-	fi
-
-	pushd $BUILD_DIR/linux
-	run_cmd "cp /boot/config-$(uname -r) .config"
-	./scripts/config --enable CONFIG_AMD_MEM_ENCRYPT
-	./scripts/config --enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
-	./scripts/config --enable CONFIG_KVM_AMD_SEV
-	./scripts/config --disable CONFIG_DEBUG_INFO
-	./scripts/config --enable CRYPTO_DEV_SP_PSP
-	./scripts/config --module CRYPTO_DEV_CCP_DD
-	./scripts/config --enable CONFIG_CRYPTO_DEV_CCP
-	./scripts/config --disable CONFIG_LOCALVERSION_AUTO
-	yes "" | make olddefconfig
-
-	run_cmd "make -j `getconf _NPROCESSORS_ONLN` bindeb-pkg LOCALVERSION=-sev"
-	popd
-}
-
-install_kernel()
-{
-	pushd $BUILD_DIR
-	run_cmd "dpkg -i *.deb"
-	popd
-}
-
-build_install_ovmf()
-{
-	if [ ! -d $BUILD_DIR/edk2 ]; then
-		run_cmd "mkdir -p ${BUILD_DIR}/edk2"
-		run_cmd "git clone ${EDK2_GIT_URL} ${BUILD_DIR}/edk2"
-		pushd $BUILD_DIR/edk2
-		run_cmd "git submodule update --init --recursive"
-		popd
-	fi
-
-	pushd $BUILD_DIR/edk2
-	run_cmd "make -C BaseTools"
-	. ./edksetup.sh --reconfig
-	run_cmd "nice build --cmd-len=64436 \
-		-DDEBUG_ON_SERIAL_PORT=TRUE \
-		-n $(getconf _NPROCESSORS_ONLN) \
-		-a X64 \
-		-a IA32 \
-		-t GCC5 \
-		-DSMM_REQUIRE \
-		-DSECURE_BOOT_ENABLE=TRUE \
-	        -p OvmfPkg/OvmfPkgIa32X64.dsc"
-	run_cmd "mkdir -p /usr/local/share/qemu"
-	run_cmd "cp Build/Ovmf3264/DEBUG_GCC5/FV/OVMF_CODE.fd $*"
-	run_cmd "cp Build/Ovmf3264/DEBUG_GCC5/FV/OVMF_VARS.fd $*"
-	popd
-}
-
-build_install_qemu()
-{
-	if [ ! -d $BUILD_DIR/qemu ]; then
-		run_cmd "mkdir -p ${BUILD_DIR}/qemu"
-		run_cmd "git clone --single-branch -b ${QEMU_COMMIT} ${QEMU_GIT_URL} ${BUILD_DIR}/qemu"
-	fi
-
-	pushd $BUILD_DIR/qemu
-	run_cmd "./configure --target-list=x86_64-softmmu --prefix=$*"
-	run_cmd "make -j$(getconf _NPROCESSORS_ONLN)"
-	run_cmd "make -j$(getconf _NPROCESSORS_ONLN) install"
-	popd
-}
diff --git a/distros/fedora-28/build.sh b/distros/fedora-28/build.sh
deleted file mode 100755
index 37929cf..0000000
--- a/distros/fedora-28/build.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-. ../common.sh
-
-# install qemu and libvirt build depends
-run_cmd "yum install yum-utils"
-run_cmd "yum-builddep qemu"
-
-# build and install QEMU 2.12
-build_install_qemu "/usr/local"
-
-run_cmd "cp ../launch-qemu.sh /usr/local/bin"
-
-# fix path to pick rebuild BIOS
-sed -i 's|UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd"|UEFI_BIOS_CODE=/usr/share/OVMF/OVMF_CODE.secboot.fd|' /usr/local/bin/launch-qemu.sh
diff --git a/distros/fedora-29/build.sh b/distros/fedora-29/build.sh
deleted file mode 100755
index 76777b1..0000000
--- a/distros/fedora-29/build.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-. ../common.sh
-
-run_cmd "cp ../launch-qemu.sh /usr/local/bin"
-
-# fix the path
-sed -i 's|QEMU_INSTALL_DIR=/usr/local/bin/|QEMU_INSTALL_DIR=""|' /usr/local/bin/launch-qemu.sh
-sed -i 's|UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd"|UEFI_BIOS_CODE=/usr/share/edk2/ovmf/OVMF_CODE.fd|' /usr/local/bin/launch-qemu.sh
diff --git a/distros/launch-qemu.sh b/distros/launch-qemu.sh
deleted file mode 100755
index 173fdbc..0000000
--- a/distros/launch-qemu.sh
+++ /dev/null
@@ -1,192 +0,0 @@
-#!/bin/bash
-
-#
-# user changeable parameters
-#
-HDA_FILE="${HOME}/ubuntu-18.04-desktop.qcow2"
-GUEST_SIZE_IN_MB="4096"
-SEV_GUEST="1"
-SMP_NCPUS="4"
-CONSOLE="qxl"
-QEMU_INSTALL_DIR=/usr/local/bin/
-UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd"
-UEFI_BIOS_VARS="OVMF_VARS.fd"
-#VNC_PORT=""
-USE_VIRTIO="1"
-
-usage() {
-	echo "$0 [options]"
-	echo "Available <commands>:"
-	echo " -hda          hard disk ($HDA_FILE)"
-	echo " -nosev        disable sev support"
-	echo " -mem          guest memory"
-	echo " -smp          number of cpus"
-	echo " -console      display console to use (serial or gxl)"
-	echo " -vnc          VNC port to use"
-	echo " -bios         bios to use (default $UEFI_BIOS_CODE)"
-	echo " -kernel       kernel to use"
-	echo " -initrd       initrd to use"
-	echo " -cdrom        CDROM image"
-	echo " -virtio       use virtio devices"
-	echo " -gdb          start gdbserver"
-	exit 1  
-}
-
-add_opts() {
-	echo -n "$* " >> ${QEMU_CMDLINE}
-}
-
-run_cmd () {
-	$*
-	if [ $? -ne 0 ]; then
-		echo "command $* failed"
-		exit 1
-	fi
-}
-
-if [ `id -u` -ne 0 ]; then
-	echo "Must be run as root!"
-	exit 1
-fi
-
-while [[ $1 != "" ]]; do
-	case "$1" in
-		-hda) 		HDA_FILE="${2}"
-				shift
-				;;
-		-nosev) 	SEV_GUEST="0"
-				;;
-		-mem)  		GUEST_SIZE_IN_MB=${2}
-				shift
-				;;
-		-console)	CONSOLE=${2}
-				shift
-				;;
-		-smp)		SMP_NCPUS=$2
-				shift
-				;;
-		-vnc)		VNC_PORT=$2
-				shift
-				if [ "${VNC_PORT}" = "" ]; then
-					usage
-				fi
-				;;
-		-bios)		UEFI_BIOS_CODE="`readlink -f $2`"
-				shift
-				;;
-		-netconsole)	NETCONSOLE_PORT=$2
-				shift
-				;;
-		-initrd)	INITRD_FILE=$2
-				shift
-				;;
-		-kernel)	KERNEL_FILE=$2
-				shift
-				;;
-		-cdrom)		CDROM_FILE=$2
-				shift
-				;;
-		-virtio)        USE_VIRTIO="1"
-				;;
-		-gdb)      	USE_GDB="1"
-				;;
-		*) 		usage;;
-	esac
-	shift
-done
-
-# we add all the qemu command line options into a file
-QEMU_CMDLINE=/tmp/cmdline.$$
-rm -rf ${QEMU_CMDLINE}
-
-add_opts "${QEMU_INSTALL_DIR}qemu-system-x86_64"
-
-# Basic virtual machine property
-add_opts "-enable-kvm -cpu EPYC -machine q35"
-
-# add number of VCPUs
-[ ! -z ${SMP_NCPUS} ] && add_opts "-smp ${SMP_NCPUS},maxcpus=64"
-
-# define guest memory
-add_opts "-m ${GUEST_SIZE_IN_MB}M,slots=5,maxmem=30G"
-
-# The OVMF binary, including the non-volatile variable store, appears as a
-# "normal" qemu drive on the host side, and it is exposed to the guest as a
-# persistent flash device.
-add_opts "-drive if=pflash,format=raw,unit=0,file=${UEFI_BIOS_CODE},readonly"
-add_opts "-drive if=pflash,format=raw,unit=1,file=${UEFI_BIOS_VARS}"
-
-# add CDROM if specified
-[ ! -z ${CDROM_FILE} ] && add_opts "-drive file=${CDROM_FILE},media=cdrom -boot d"
-
-add_opts "-netdev user,id=vmnic -device e1000,netdev=vmnic,romfile="
-
-# If harddisk file is specified then add the HDD drive
-if [ ! -z ${HDA_FILE} ]; then
-	if [ "$USE_VIRTIO" = "1" ]; then
-		if [[ ${HDA_FILE} = *"qcow2" ]]; then
-			add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=qcow2"
-		else
-			add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=raw"
-		fi
-		add_opts "-device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true"
-		add_opts "-device scsi-hd,drive=disk0"
-	else
-		if [[ ${HDA_FILE} = *"qcow2" ]]; then
-			add_opts "-drive file=${HDA_FILE},format=qcow2"
-		else
-			add_opts "-drive file=${HDA_FILE},format=raw"
-		fi
-	fi
-fi
-
-# If this is SEV guest then add the encryption device objects to enable support
-if [ ${SEV_GUEST} = "1" ]; then
-	add_opts "-object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1"
-	add_opts "-machine memory-encryption=sev0"
-fi
-
-# if console is serial then disable graphical interface
-if [ "${CONSOLE}" = "serial" ]; then
-	add_opts "-nographic"
-else
-	add_opts "-vga ${CONSOLE}"
-fi
-
-# if -kernel arg is specified then use the kernel provided in command line for boot
-if [ "${KERNEL_FILE}" != "" ]; then
-	add_opts "-kernel $KERNEL_FILE"
-	add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\""
-	[ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}"
-fi
-
-# start vnc server
-[ ! -z ${VNC_PORT} ] && add_opts "-vnc :${VNC_PORT}" && echo "Starting VNC on port ${VNC_PORT}"
-
-# start monitor on pty
-add_opts "-monitor pty"
-
-# add virtio ring
-if [ "$USE_VIRTIO" = "1" ]; then
-	add_opts "-device virtio-rng-pci,disable-legacy=on,iommu_platform=true"
-fi
-
-# log the console  output in stdout.log
-QEMU_CONSOLE_LOG=`pwd`/stdout.log
-
-# save the command line args into log file
-cat $QEMU_CMDLINE | tee ${QEMU_CONSOLE_LOG}
-echo | tee -a ${QEMU_CONSOLE_LOG}
-
-
-# map CTRL-C to CTRL ]
-echo "Mapping CTRL-C to CTRL-]"
-stty intr ^]
-
-echo "Launching VM ..."
-bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG}
-
-# restore the mapping
-stty intr ^c
-
-rm -rf ${QEMU_CMDLINE}
diff --git a/distros/rhel-8.0/build.sh b/distros/rhel-8.0/build.sh
deleted file mode 100755
index 3867c17..0000000
--- a/distros/rhel-8.0/build.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-. ../common.sh
-
-sudo yum install qemu-kvm qemu-img edk2-ovmf
-
-run_cmd "cp ../launch-qemu.sh /usr/local/bin"
-
-# fix the path
-sed -i 's|QEMU_INSTALL_DIR=/usr/local/bin/|QEMU_INSTALL_DIR="/usr/libexec/"|' /usr/local/bin/launch-qemu.sh
-sed -i 's|UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd"|UEFI_BIOS_CODE=/usr/share/OVMF/OVMF_CODE.secboot.fd|' /usr/local/bin/launch-qemu.sh
-sed -i 's|qemu-system-x86_64|qemu-kvm|' /usr/local/bin/launch-qemu.sh
diff --git a/distros/sles-15/build.sh b/distros/sles-15/build.sh
deleted file mode 100755
index 2269912..0000000
--- a/distros/sles-15/build.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-. ../common.sh
-
-run_cmd "cp ../launch-qemu.sh /usr/local/bin"
-
-# fix the path
-sed -i 's|QEMU_INSTALL_DIR=/usr/local/bin/|QEMU_INSTALL_DIR=""|' /usr/local/bin/launch-qemu.sh
-sed -i 's|UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd"|UEFI_BIOS_CODE=/usr/share/qemu/ovmf-x86_64-suse-4m.bin|' /usr/local/bin/launch-qemu.sh
-
-# sles may have older version of patch, lets fix the sev-guest params
-sed -i 's|reduced-phys-bits=1|reduced-phys-bits=5|' /usr/local/bin/launch-qemu.sh
diff --git a/distros/stable-commits b/distros/stable-commits
deleted file mode 100644
index ee05cd4..0000000
--- a/distros/stable-commits
+++ /dev/null
@@ -1,18 +0,0 @@
-#
-# stable commit for SEV test builds
-#
-
-# hypervisor commit
-KERNEL_GIT_URL=https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
-KERNEL_COMMIT=v4.20
-
-# qemu commit
-QEMU_GIT_URL=http://git.qemu.org/git/qemu.git
-QEMU_COMMIT=v2.12.0
-
-# guest bios
-EDK2_GIT_URL=https://github.com/tianocore/edk2.git
-
-# libvirt commit
-LIBVIRT_GIT_URL=https://libvirt.org/git/libvirt.git
-LIBVIRT_COMMIT=v4.5.0
diff --git a/distros/ubuntu-18.04/build.sh b/distros/ubuntu-18.04/build.sh
deleted file mode 100755
index a86efb9..0000000
--- a/distros/ubuntu-18.04/build.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-
-. ../common.sh
-
-grep deb-src /etc/apt/sources.list
-if [ $? -ne 0 ]; then
-cat >> /etc/apt/sources.list <<EOF
-deb-src http://archive.ubuntu.com/ubuntu bionic main restricted
-deb-src http://archive.ubuntu.com/ubuntu bionic-updates main restricted
-deb-src http://archive.ubuntu.com/ubuntu bionic universe
-deb-src http://archive.ubuntu.com/ubuntu bionic-updates universe
-deb-src http://archive.ubuntu.com/ubuntu bionic multiverse
-deb-src http://archive.ubuntu.com/ubuntu bionic-updates multiverse
-deb-src http://archive.ubuntu.com/ubuntu bionic-backports main restricted universe multiverse
-deb-src http://security.ubuntu.com/ubuntu bionic-security main restricted
-deb-src http://security.ubuntu.com/ubuntu bionic-security universe
-deb-src http://security.ubuntu.com/ubuntu bionic-security multiverse
-EOF
-fi
-
-# build linux kernel image
-run_cmd "apt-get update"
-run_cmd "apt install -y apt-utils"
-echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
-run_cmd "apt-get -y build-dep linux-image-$(uname -r)"
-run_cmd "apt-get -y install flex"
-run_cmd "apt-get -y install bison fakeroot libssl-dev"
-build_kernel
-
-# install newly built kernel
-install_kernel
-
-# install qemu build deps
-# build and install QEMU 2.12
-run_cmd "apt-get -y build-dep qemu"
-build_install_qemu "/usr/local"
-
-run_cmd "apt-get -y build-dep ovmf"
-build_install_ovmf "/usr/local/share/qemu"
-
-run_cmd "cp ../launch-qemu.sh /usr/local/bin"
diff --git a/kvm.conf b/kvm.conf
new file mode 100644
index 0000000..57f008a
--- /dev/null
+++ b/kvm.conf
@@ -0,0 +1,6 @@
+###
+### Set these options to enable the SEV support
+###
+
+# Enable SEV-SNP Support
+options kvm_amd sev-snp=1
diff --git a/launch-qemu.sh b/launch-qemu.sh
new file mode 100755
index 0000000..a2c4c53
--- /dev/null
+++ b/launch-qemu.sh
@@ -0,0 +1,280 @@
+#!/bin/bash
+
+#
+# user changeable parameters
+#
+HDA="/home/amd/fedora-30.raw"
+MEM="2048"
+SMP="4"
+VNC=""
+CONSOLE="serial"
+USE_VIRTIO="1"
+
+SEV="0"
+SEV_ES="0"
+SEV_SNP="0"
+ALLOW_DEBUG="0"
+USE_GDB="0"
+
+EXEC_PATH="./usr/local"
+UEFI_PATH="$EXEC_PATH/share/qemu"
+
+usage() {
+	echo "$0 [options]"
+	echo "Available <commands>:"
+	echo " -sev               launch SEV guest"
+	echo " -sev-es            launch SEV guest"
+	echo " -sev-snp           launch SNP guest"
+	echo " -bios              the bios to use (default $UEFI_PATH)"
+	echo " -hda PATH          hard disk file (default $HDA)"
+	echo " -mem MEM           guest memory size in MB (default $MEM)"
+	echo " -smp NCPUS         number of virtual cpus (default $SMP)"
+	echo " -allow-debug       dump vmcb on exit and enable the trace"
+	exit 1
+}
+
+add_opts() {
+	echo -n "$* " >> ${QEMU_CMDLINE}
+}
+
+exit_from_int() {
+	rm -rf ${QEMU_CMDLINE}
+	# restore the mapping
+	stty intr ^c
+	exit 1
+}
+
+run_cmd () {
+	$*
+	if [ $? -ne 0 ]; then
+		echo "command $* failed"
+		exit 1
+	fi
+}
+
+get_cbitpos() {
+	#
+	# Get C-bit position directly from the hardware
+	#   Reads of /dev/cpu/x/cpuid have to be 16 bytes in size
+	#     and the seek position represents the CPUID function
+	#     to read.
+	#   The skip parameter of DD skips ibs-sized blocks, so
+	#     can't directly go to 0x8000001f function (since it
+	#     is not a multiple of 16). So just start at 0x80000000
+	#     function and read 32 functions to get to 0x8000001f
+	#   To get to EBX, which contains the C-bit position, skip
+	#     the first 4 bytes (EAX) and then convert 4 bytes.
+	#
+
+	EBX=$(dd if=/dev/cpu/0/cpuid ibs=16 count=32 skip=134217728 | tail -c 16 | od -An -t u4 -j 4 -N 4 | sed -re 's|^ *||')
+	CBITPOS=$((EBX & 0x3f))
+}
+
+trap exit_from_int SIGINT
+
+if [ `id -u` -ne 0 ]; then
+	echo "Must be run as root!"
+	exit 1
+fi
+
+while [ -n "$1" ]; do
+	case "$1" in
+		-sev-snp)	SEV_SNP="1"
+				SEV_ES="1"
+				SEV="1"
+				;;
+		-sev-es)	SEV_ES="1"
+				SEV="1"
+				;;
+		-sev)		SEV="1"
+				;;
+		-hda) 		HDA="$2"
+				shift
+				;;
+		-mem)  		MEM="$2"
+				shift
+				;;
+		-smp)		SMP="$2"
+				shift
+				;;
+		-bios)          UEFI_PATH="$2"
+				shift
+				;;
+		-allow-debug)   ALLOW_DEBUG="1"
+				;;
+		-kernel)	KERNEL_FILE=$2
+				shift
+				;;
+		-initrd)	INITRD_FILE=$2
+				shift
+				;;
+		*) 		usage
+				;;
+	esac
+
+	shift
+done
+
+TMP="$EXEC_PATH/bin/qemu-system-x86_64"
+QEMU_EXE="$(readlink -e $TMP)"
+[ -z "$QEMU_EXE" ] && {
+	echo "Can't locate qemu executable [$TMP]"
+	usage
+}
+
+[ -n "$HDA" ] && {
+	TMP="$HDA"
+	HDA="$(readlink -e $TMP)"
+	[ -z "$HDA" ] && {
+		echo "Can't locate guest image file [$TMP]"
+		usage
+	}
+
+	GUEST_NAME="$(basename $TMP | sed -re 's|\.[^\.]+$||')"
+}
+
+TMP="$UEFI_PATH/OVMF_CODE.fd"
+UEFI_CODE="$(readlink -e $TMP)"
+[ -z "$UEFI_CODE" ] && {
+	echo "Can't locate UEFI code file [$TMP]"
+	usage
+}
+
+[ -e "./$GUEST_NAME.fd" ] || {
+	TMP="$UEFI_PATH/OVMF_VARS.fd"
+	UEFI_VARS="$(readlink -e $TMP)"
+	[ -z "$UEFI_VARS" ] && {
+		echo "Can't locate UEFI variable file [$TMP]"
+		usage
+	}
+
+	run_cmd "cp $UEFI_VARS ./$GUEST_NAME.fd"
+}
+UEFI_VARS="$(readlink -e ./$GUEST_NAME.fd)"
+
+if [ "$ALLOW_DEBUG" = "1" ]; then
+	# This will dump all the VMCB on VM exit
+	echo 1 > /sys/module/kvm_amd/parameters/dump_all_vmcbs
+
+	# Enable some KVM tracing to the debug
+	#echo kvm: >/sys/kernel/debug/tracing/set_event
+	#echo kvm:* >/sys/kernel/debug/tracing/set_event
+	#echo kvm:kvm_page_fault >/sys/kernel/debug/tracing/set_event
+	#echo >/sys/kernel/debug/tracing/set_event
+	#echo > /sys/kernel/debug/tracing/trace
+	#echo 1 > /sys/kernel/debug/tracing/tracing_on
+fi
+
+# we add all the qemu command line options into a file
+QEMU_CMDLINE=/tmp/cmdline.$$
+rm -rf $QEMU_CMDLINE
+
+add_opts "$QEMU_EXE"
+
+# Basic virtual machine property
+add_opts "-enable-kvm -cpu EPYC -machine q35"
+
+# add number of VCPUs
+[ -n "${SMP}" ] && add_opts "-smp ${SMP},maxcpus=64"
+
+# define guest memory
+add_opts "-m ${MEM}M,slots=5,maxmem=30G"
+
+# don't reboot for SEV-ES guest
+add_opts "-no-reboot"
+
+# The OVMF binary, including the non-volatile variable store, appears as a
+# "normal" qemu drive on the host side, and it is exposed to the guest as a
+# persistent flash device.
+add_opts "-drive if=pflash,format=raw,unit=0,file=${UEFI_CODE},readonly"
+
+# add network support and fwd port 22 to 8000
+echo "guest port 22 is fwd to host 8000..."
+#add_opts "-netdev user,id=vmnic,hostfwd=tcp::8000-:22 -device e1000,netdev=vmnic,romfile="
+add_opts "-netdev user,id=vmnic,hostfwd=tcp::8000-:22"
+add_opts " -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile="
+
+# If harddisk file is specified then add the HDD drive
+if [ -n "${HDA}" ]; then
+	if [ "$USE_VIRTIO" = "1" ]; then
+		if [[ ${HDA} = *"qcow2" ]]; then
+			add_opts "-drive file=${HDA},if=none,id=disk0,format=qcow2"
+		else
+			add_opts "-drive file=${HDA},if=none,id=disk0,format=raw"
+		fi
+		add_opts "-device virtio-scsi-pci,id=scsi0,disable-legacy=on,iommu_platform=true"
+		add_opts "-device scsi-hd,drive=disk0"
+	else
+		if [[ ${HDA} = *"qcow2" ]]; then
+			add_opts "-drive file=${HDA},format=qcow2"
+		else
+			add_opts "-drive file=${HDA},format=raw"
+		fi
+	fi
+fi
+
+# If this is SEV guest then add the encryption device objects to enable support
+if [ ${SEV} = "1" ]; then
+	if [ "${ALLOW_DEBUG}" = "1" -o "${SEV_ES}" = 1 ]; then
+		POLICY=$((0x01))
+		[ "${ALLOW_DEBUG}" = "1" ] && POLICY=$((POLICY & ~0x01))
+		[ "${SEV_ES}" = "1" ] && POLICY=$((POLICY | 0x04))
+		SEV_POLICY=$(printf ",policy=%#x" $POLICY)
+		SEV_POLICY=",policy=0x90000"
+	fi
+
+	if [ "${SEV_SNP}" = 1 ]; then
+		SEV_GUEST_SNP=",snp=yes"
+	fi
+
+	get_cbitpos
+
+	add_opts "-object sev-guest,id=sev0${SEV_POLICY},cbitpos=${CBITPOS},reduced-phys-bits=1${SEV_GUEST_SNP}"
+	add_opts "-machine memory-encryption=sev0,vmport=off"
+fi
+
+# if -kernel arg is specified then use the kernel provided in command line for boot
+if [ "${KERNEL_FILE}" != "" ]; then
+	add_opts "-kernel $KERNEL_FILE"
+	add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\""
+	[ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}"
+fi
+
+# if console is serial then disable graphical interface
+if [ "${CONSOLE}" = "serial" ]; then
+	add_opts "-nographic"
+else
+	add_opts "-vga ${CONSOLE}"
+fi
+
+# start monitor on pty and named socket 'monitor'
+add_opts "-monitor pty -monitor unix:monitor,server,nowait"
+
+# add virtio ring
+if [ "$USE_VIRTIO" = "1" ]; then
+	add_opts "-device virtio-rng-pci,disable-legacy=on,iommu_platform=true"
+fi
+
+# log the console  output in stdout.log
+QEMU_CONSOLE_LOG=`pwd`/stdout.log
+
+# save the command line args into log file
+cat $QEMU_CMDLINE | tee ${QEMU_CONSOLE_LOG}
+echo | tee -a ${QEMU_CONSOLE_LOG}
+
+#touch /tmp/events
+#add_opts "-trace events=/tmp/events"
+
+# map CTRL-C to CTRL ]
+echo "Mapping CTRL-C to CTRL-]"
+stty intr ^]
+
+echo "Launching VM ..."
+echo "  $QEMU_CMDLINE"
+sleep 1
+bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG}
+
+# restore the mapping
+stty intr ^c
+
+rm -rf ${QEMU_CMDLINE}
diff --git a/stable-commits b/stable-commits
new file mode 100644
index 0000000..a974fa1
--- /dev/null
+++ b/stable-commits
@@ -0,0 +1,15 @@
+#
+# Repos/Branches for SEV-SNP support
+#
+
+# hypervisor commit
+KERNEL_GIT_URL="https://github.com/AMDESE/linux.git"
+KERNEL_BRANCH="sev-es-5.6-v1+snp"
+
+# qemu commit
+QEMU_GIT_URL="https://github.com/AMDESE/qemu.git"
+QEMU_BRANCH="sev-es-v4+snp"
+
+# guest bios
+OVMF_GIT_URL="https://github.com/AMDESE/ovmf.git"
+OVMF_BRANCH="sev-es-v12+snp"
diff --git a/xmls/sample.xml b/xmls/sample.xml
deleted file mode 100644
index 8a273b2..0000000
--- a/xmls/sample.xml
+++ /dev/null
@@ -1,223 +0,0 @@
-<domain type='kvm' id='47'>
-  <name>TestVm</name>
-  <uuid>b044f644-5cbd-42b0-b9b9-298c8d885160</uuid>
-  <memory unit='KiB'>4194304</memory>
-  <currentMemory unit='KiB'>4194304</currentMemory>
-  <vcpu placement='static'>4</vcpu>
-  <resource>
-    <partition>/machine</partition>
-  </resource>
-  <os>
-    <type arch='x86_64' machine='pc-q35-2.12'>hvm</type>
-    <loader readonly='yes' type='pflash'>/usr/share/qemu/ovmf-x86_64-ms-4m-code.bin</loader>
-    <nvram>/var/lib/libvirt/qemu/nvram/fedora28_VARS.fd</nvram>
-    <boot dev='hd'/>
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <vmport state='off'/>
-  </features>
-  <cpu mode='custom' match='exact' check='full'>
-    <model fallback='forbid'>EPYC-IBPB</model>
-    <feature policy='disable' name='monitor'/>
-    <feature policy='require' name='x2apic'/>
-    <feature policy='require' name='hypervisor'/>
-    <feature policy='disable' name='svm'/>
-  </cpu>
-  <clock offset='utc'>
-    <timer name='rtc' tickpolicy='catchup'/>
-    <timer name='pit' tickpolicy='delay'/>
-    <timer name='hpet' present='no'/>
-  </clock>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <pm>
-    <suspend-to-mem enabled='no'/>
-    <suspend-to-disk enabled='no'/>
-  </pm>
-  <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
-    <disk type='file' device='cdrom'>
-      <driver name='qemu'/>
-      <target dev='sda' bus='sata'/>
-      <readonly/>
-      <alias name='sata0-0-0'/>
-      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
-    </disk>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2'/>
-      <source file='/home/amd/workdir/fedora-28-guest/fedora-28.qcow2'/>
-      <backingStore/>
-      <target dev='sdb' bus='scsi' model='virtio-scsi'/>
-      <alias name='virtio-disk0'/>
-    </disk>
-    <controller type='usb' index='0' model='ich9-ehci1'>
-      <alias name='usb'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x7'/>
-    </controller>
-    <controller type='usb' index='0' model='ich9-uhci1'>
-      <alias name='usb'/>
-      <master startport='0'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='usb' index='0' model='ich9-uhci2'>
-      <alias name='usb'/>
-      <master startport='2'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x1'/>
-    </controller>
-    <controller type='usb' index='0' model='ich9-uhci3'>
-      <alias name='usb'/>
-      <master startport='4'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x2'/>
-    </controller>
-    <controller type='pci' index='0' model='pcie-root'>
-      <alias name='pcie.0'/>
-    </controller>
-    <controller type='pci' index='1' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='1' port='0x10'/>
-      <alias name='pci.1'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='2' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='2' port='0x11'/>
-      <alias name='pci.2'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
-    </controller>
-    <controller type='pci' index='3' model='pcie-to-pci-bridge'>
-      <model name='pcie-pci-bridge'/>
-      <alias name='pci.3'/>
-      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='pci' index='4' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='4' port='0x12'/>
-      <alias name='pci.4'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
-    </controller>
-    <controller type='pci' index='5' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='5' port='0x13'/>
-      <alias name='pci.5'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
-    </controller>
-    <controller type='pci' index='6' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='6' port='0x14'/>
-      <alias name='pci.6'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
-    </controller>
-    <controller type='pci' index='7' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='7' port='0x15'/>
-      <alias name='pci.7'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
-    </controller>
-    <controller type='pci' index='8' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='8' port='0x16'/>
-      <alias name='pci.8'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
-    </controller>
-    <controller type='sata' index='0'>
-      <alias name='ide'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
-    </controller>
-    <controller type='virtio-serial' index='0'>
-      <driver iommu='on' />
-      <alias name='virtio-serial0'/>
-      <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='scsi' index='0' model='virtio-scsi'>
-      <driver iommu='on' />
-      <alias name='scsi0'/>
-      <address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
-    </controller>
-    <interface type='network'>
-      <mac address='52:54:00:d9:0b:ef'/>
-      <source network='default' bridge='virbr0'/>
-      <target dev='vnet0'/>
-      <model type='e1000'/>
-      <alias name='net0'/>
-      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
-    </interface>
-    <serial type='pty'>
-      <source path='/dev/pts/1'/>
-      <target type='isa-serial' port='0'>
-        <model name='isa-serial'/>
-      </target>
-      <alias name='serial0'/>
-    </serial>
-    <console type='pty' tty='/dev/pts/1'>
-      <source path='/dev/pts/1'/>
-      <target type='serial' port='0'/>
-      <alias name='serial0'/>
-    </console>
-    <channel type='unix'>
-      <source mode='bind' path='/var/lib/libvirt/qemu/channel/target/domain-47-fedora28/org.qemu.guest_agent.0'/>
-      <target type='virtio' name='org.qemu.guest_agent.0' state='disconnected'/>
-      <alias name='channel0'/>
-      <address type='virtio-serial' controller='0' bus='0' port='1'/>
-    </channel>
-    <channel type='spicevmc'>
-      <target type='virtio' name='com.redhat.spice.0' state='disconnected'/>
-      <alias name='channel1'/>
-      <address type='virtio-serial' controller='0' bus='0' port='2'/>
-    </channel>
-    <input type='tablet' bus='usb'>
-      <alias name='input0'/>
-      <address type='usb' bus='0' port='1'/>
-    </input>
-    <input type='mouse' bus='ps2'>
-      <alias name='input1'/>
-    </input>
-    <input type='keyboard' bus='ps2'>
-      <alias name='input2'/>
-    </input>
-    <graphics type='spice' port='5900' autoport='yes' listen='127.0.0.1'>
-      <listen type='address' address='127.0.0.1'/>
-      <image compression='off'/>
-    </graphics>
-    <sound model='ich6'>
-      <alias name='sound0'/>
-      <address type='pci' domain='0x0000' bus='0x03' slot='0x01' function='0x0'/>
-    </sound>
-    <video>
-      <model type='qxl' ram='65536' vram='65536' vgamem='16384' heads='1' primary='yes'/>
-      <alias name='video0'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
-    </video>
-    <redirdev bus='usb' type='spicevmc'>
-      <alias name='redir0'/>
-      <address type='usb' bus='0' port='2'/>
-    </redirdev>
-    <redirdev bus='usb' type='spicevmc'>
-      <alias name='redir1'/>
-      <address type='usb' bus='0' port='3'/>
-    </redirdev>
-    <memballoon model='virtio'>
-      <driver iommu='on' />
-      <alias name='balloon0'/>
-      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-    </memballoon>
-    <rng model='virtio'>
-      <driver iommu='on' />
-      <backend model='random'>/dev/urandom</backend>
-      <alias name='rng0'/>
-      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-    </rng>
-  </devices>
-  <launchSecurity type='sev'>
-    <policy>0x0001</policy>
-    <cbitpos>47</cbitpos>
-    <reducedPhysBits>1</reducedPhysBits>
-  </launchSecurity>
-  <memtune>
-    <hard_limit unit='G'>5</hard_limit>
-    <soft_limit unit='G'>5</soft_limit>
-  </memtune>
-</domain>
-