openhcl: add build that relays NVIDIA GPUs to CVM guests

[robertschaedler3]

Adds a dedicated build that relays NVIDIA GPUs (and their NVLink fabric) through the VPCI relay to confidential VM guests, enabling confidential GPU workloads on Azure Local.

The behavior is gated behind a new nvidia_vpci_relay_allowed cargo feature and is only compiled into a new IGVM recipe the default x64-cvm build is unchanged.

Why vendor + class rather than an explicit device list?

Datacenter GPUs (H100/H200/HGX H100/H200, HGX B200/B300) are headless and enumerate as 3D controllers rather than VGA, and HGX clusters additionally expose NVSwitch devices that are PCI bridges so a single display-class filter would miss the fabric. Keying on vendor + the two relevant classes covers whole clusters while still rejecting all non-NVIDIA devices, and avoids a rebuild each time a new SKU ships.

[Copilot]

Pull request overview

Adds an Azure Local–specific OpenHCL build configuration that expands the VPCI relay allow-list to include NVIDIA datacenter GPUs (3D controller class) and NVLink/NVSwitch fabric devices (bridge/other class), and wires this through Flowey as a new x64-cvm-azure-local IGVM recipe gated by a new azurelocal Cargo feature.

Changes:

• Add PCI subclass constant for “3D controller” (0x0302) to support class-based allow-listing.
• Introduce azurelocal Cargo feature plumbing across openvmm_hcl → underhill_entry → underhill_core, enabling extra NVIDIA allow-list entries in the VPCI relay.
• Add a new Flowey/build-igvm recipe (x64-cvm-azure-local) that builds CVM OpenHCL with the azurelocal feature enabled.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vm/devices/pci/pci_core/src/spec.rs	Adds Subclass::DISPLAY_CONTROLLER_3D needed for NVIDIA GPU class filtering.
openhcl/underhill_entry/Cargo.toml	Exposes azurelocal feature to propagate into underhill_core.
openhcl/underhill_core/src/worker.rs	Adds NVIDIA vendor constant and azurelocal-gated VPCI relay allow-list rules for GPU + fabric devices.
openhcl/underhill_core/Cargo.toml	Defines the azurelocal feature flag at the core layer.
openhcl/openvmm_hcl/Cargo.toml	Exposes azurelocal feature at the OpenHCL binary layer.
flowey/flowey_lib_hvlite/src/build_openvmm_hcl.rs	Adds OpenvmmHclFeature::AzureLocal → cargo feature name mapping.
flowey/flowey_lib_hvlite/src/build_openhcl_igvm_from_recipe.rs	Adds X64CvmAzureLocal recipe that enables the azurelocal OpenHCL feature.
flowey/flowey_lib_hvlite/src/artifact_openhcl_igvm_from_recipe.rs	Maps the new recipe to/from its artifact filename.
flowey/flowey_lib_hvlite/src/_jobs/local_build_igvm.rs	Adds local build output name for the new recipe.
flowey/flowey_hvlite/src/pipelines/build_igvm.rs	Adds build-igvm CLI enum variant and recipe mapping for x64-cvm-azure-local.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.