kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

hypervisor, vmm: pass SNP guest policy to sev_snp_init

Browse Source 
The SNP guest policy (AMD SEV-SNP ABI bits controlling SMT, migration,
debug, etc.) was previously hardcoded inside the MSHV implementation.
Widen Vm::sev_snp_init() to accept an SnpPolicy parameter so each
hypervisor backend receives the policy at init time.

Add get_default_sev_snp_guest_policy() in the VMM to construct the
default policy.

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-07 08:09:58 -07:00
committed by Rob Bradford
parent 8ee0a07ab1
commit b545b2fc4e
4 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
hypervisor/src/mshv/mod.rs
View File

@@ -58,7 +58,7 @@ pub use aarch64::VcpuMshvState;
#[cfg(target_arch = "aarch64")]
use aarch64::gic::{BASE_SPI_IRQ, MshvGicV2M};
#[cfg(feature = "sev_snp")]
use igvm_defs::IGVM_VHS_SNP_ID_BLOCK;
use igvm_defs::{IGVM_VHS_SNP_ID_BLOCK, SnpPolicy};
#[cfg(feature = "sev_snp")]
use snp_constants::*;
use vmm_sys_util::eventfd::EventFd;
@@ -2254,7 +2254,7 @@ impl vm::Vm for MshvVm {
/// Initialize the SEV-SNP VM
#[cfg(feature = "sev_snp")]
fn sev_snp_init(&self) -> vm::Result<()> {
fn sev_snp_init(&self, _guest_policy: SnpPolicy) -> vm::Result<()> {
self.fd
.set_partition_property(
hv_partition_property_code_HV_PARTITION_PROPERTY_ISOLATION_STATE,

4
hypervisor/src/vm.rs
View File

@@ -17,6 +17,8 @@ use std::sync::Mutex;
#[cfg(feature = "sev_snp")]
use igvm_defs::IGVM_VHS_SNP_ID_BLOCK;
#[cfg(feature = "sev_snp")]
use igvm_defs::SnpPolicy;
use thiserror::Error;
use vmm_sys_util::eventfd::EventFd;
@@ -392,7 +394,7 @@ pub trait Vm: Send + Sync + Any {
fn get_dirty_log(&self, slot: u32, base_gpa: u64, memory_size: u64) -> Result<Vec<u64>>;
#[cfg(feature = "sev_snp")]
/// Initialize SEV-SNP on this VM
fn sev_snp_init(&self) -> Result<()> {
fn sev_snp_init(&self, _guest_policy: SnpPolicy) -> Result<()> {
unimplemented!()
}
#[cfg(feature = "tdx")]

7
vmm/Cargo.toml
View File

@@ -32,7 +32,12 @@ mshv = [
"vm-device/mshv",
]
pvmemcontrol = ["devices/pvmemcontrol"]
sev_snp = ["arch/sev_snp", "hypervisor/sev_snp", "virtio-devices/sev_snp"]
sev_snp = [
"arch/sev_snp",
"hypervisor/sev_snp",
"igvm_defs",
"virtio-devices/sev_snp",
]
tdx = ["arch/tdx", "hypervisor/tdx"]
tracing = ["tracer/tracing"]

18
vmm/src/vm.rs
View File

@@ -47,6 +47,8 @@ use gdbstub_arch::x86::reg::X86_64CoreRegs as CoreRegs;
#[cfg(target_arch = "aarch64")]
use hypervisor::arch::aarch64::regs::AARCH64_PMU_IRQ;
use hypervisor::{HypervisorVmConfig, HypervisorVmError, VmOps};
#[cfg(feature = "sev_snp")]
use igvm_defs::SnpPolicy;
use libc::{SIGWINCH, termios};
use linux_loader::cmdline::Cmdline;
#[cfg(all(target_arch = "x86_64", feature = "guest_debug"))]
@@ -534,6 +536,19 @@ pub struct Vm {
impl Vm {
pub const HANDLED_SIGNALS: [i32; 1] = [SIGWINCH];
#[cfg(feature = "sev_snp")]
pub fn get_default_sev_snp_guest_policy() -> SnpPolicy {
SnpPolicy::new()
.with_abi_minor(0)
.with_abi_major(0)
// SMT permitted: allows the guest to run on an SMT-enabled host.
// This is the permissive default; future work can expose this as a
// configurable platform option.
.with_smt(1)
.with_reserved_must_be_one(1)
.with_migrate_ma(0)
}
#[allow(clippy::needless_pass_by_value)]
#[allow(clippy::too_many_arguments)]
pub fn new_from_memory_manager(
@@ -982,7 +997,8 @@ impl Vm {
.map_err(Error::CpuManager)?;
// Initialize SEV-SNP - transitions guest into secure state
vm.sev_snp_init().map_err(Error::InitializeSevSnpVm)?;
vm.sev_snp_init(Self::get_default_sev_snp_guest_policy())
.map_err(Error::InitializeSevSnpVm)?;
// Load payload for SEV-SNP (IGVM parser needs cpu_manager for cpuid)
let load_payload_handle = if snapshot.is_none() {