kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: pass host data to SevSnp guest

Browse Source 
Host data that is passed to the hypervisor. Then
the firmware includes the data in the attestation report.
The data might include any key or secret that the SevSnp guest
might need later.

Signed-off-by: Muminul Islam <muislam@microsoft.com>
This commit is contained in:
Muminul Islam
2024-02-08 11:53:56 -08:00
committed by Bo Chen
parent e51fb0ee36
commit 1a4c890f83
2 changed files with 43 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
vmm/src/vm.rs
View File

@@ -574,7 +574,13 @@ impl Vm {
// per cpuid through cpu_manager.
#[cfg(feature = "igvm")]
let load_payload_handle = if snapshot.is_none() {
Self::load_payload_async(&memory_manager, &config, &cpu_manager)?
Self::load_payload_async(
&memory_manager,
&config,
&cpu_manager,
#[cfg(feature = "sev_snp")]
sev_snp_enabled,
)?
} else {
None
};
@@ -1006,9 +1012,17 @@ impl Vm {
igvm: File,
memory_manager: Arc<Mutex<MemoryManager>>,
cpu_manager: Arc<Mutex<cpu::CpuManager>>,
#[cfg(feature = "sev_snp")] host_data: &Option<String>,
) -> Result<EntryPoint> {
let res = igvm_loader::load_igvm(&igvm, memory_manager, cpu_manager.clone(), "")
.map_err(Error::IgvmLoad)?;
let res = igvm_loader::load_igvm(
&igvm,
memory_manager,
cpu_manager.clone(),
"",
#[cfg(feature = "sev_snp")]
host_data,
)
.map_err(Error::IgvmLoad)?;
cfg_if::cfg_if! {
if #[cfg(feature = "sev_snp")] {
@@ -1087,12 +1101,20 @@ impl Vm {
payload: &PayloadConfig,
memory_manager: Arc<Mutex<MemoryManager>>,
#[cfg(feature = "igvm")] cpu_manager: Arc<Mutex<cpu::CpuManager>>,
#[cfg(feature = "sev_snp")] sev_snp_enabled: bool,
) -> Result<EntryPoint> {
trace_scoped!("load_payload");
#[cfg(feature = "igvm")]
if let Some(_igvm_file) = &payload.igvm {
let igvm = File::open(_igvm_file).map_err(Error::IgvmFile)?;
return Self::load_igvm(igvm, memory_manager, cpu_manager);
{
if let Some(_igvm_file) = &payload.igvm {
let igvm = File::open(_igvm_file).map_err(Error::IgvmFile)?;
#[cfg(feature = "sev_snp")]
if sev_snp_enabled {
return Self::load_igvm(igvm, memory_manager, cpu_manager, &payload.host_data);
}
#[cfg(not(feature = "sev_snp"))]
return Self::load_igvm(igvm, memory_manager, cpu_manager);
}
}
match (
&payload.firmware,
@@ -1135,6 +1157,7 @@ impl Vm {
memory_manager: &Arc<Mutex<MemoryManager>>,
config: &Arc<Mutex<VmConfig>>,
#[cfg(feature = "igvm")] cpu_manager: &Arc<Mutex<cpu::CpuManager>>,
#[cfg(feature = "sev_snp")] sev_snp_enabled: bool,
) -> Result<Option<thread::JoinHandle<Result<EntryPoint>>>> {
// Kernel with TDX is loaded in a different manner
#[cfg(feature = "tdx")]
@@ -1161,6 +1184,8 @@ impl Vm {
memory_manager,
#[cfg(feature = "igvm")]
cpu_manager,
#[cfg(feature = "sev_snp")]
sev_snp_enabled,
)
})
.map_err(Error::KernelLoadThreadSpawn)