kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

hypervisor, vmm: pass SNP guest policy to sev_snp_init

Browse Source 
The SNP guest policy (AMD SEV-SNP ABI bits controlling SMT, migration,
debug, etc.) was previously hardcoded inside the MSHV implementation.
Widen Vm::sev_snp_init() to accept an SnpPolicy parameter so each
hypervisor backend receives the policy at init time.

Add get_default_sev_snp_guest_policy() in the VMM to construct the
default policy.

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-07 08:09:58 -07:00
committed by Rob Bradford
parent 8ee0a07ab1
commit b545b2fc4e
4 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
vmm/Cargo.toml
View File

@@ -32,7 +32,12 @@ mshv = [
"vm-device/mshv",
]
pvmemcontrol = ["devices/pvmemcontrol"]
sev_snp = ["arch/sev_snp", "hypervisor/sev_snp", "virtio-devices/sev_snp"]
sev_snp = [
"arch/sev_snp",
"hypervisor/sev_snp",
"igvm_defs",
"virtio-devices/sev_snp",
]
tdx = ["arch/tdx", "hypervisor/tdx"]
tracing = ["tracer/tracing"]

18
vmm/src/vm.rs
View File

@@ -47,6 +47,8 @@ use gdbstub_arch::x86::reg::X86_64CoreRegs as CoreRegs;
#[cfg(target_arch = "aarch64")]
use hypervisor::arch::aarch64::regs::AARCH64_PMU_IRQ;
use hypervisor::{HypervisorVmConfig, HypervisorVmError, VmOps};
#[cfg(feature = "sev_snp")]
use igvm_defs::SnpPolicy;
use libc::{SIGWINCH, termios};
use linux_loader::cmdline::Cmdline;
#[cfg(all(target_arch = "x86_64", feature = "guest_debug"))]
@@ -534,6 +536,19 @@ pub struct Vm {
impl Vm {
pub const HANDLED_SIGNALS: [i32; 1] = [SIGWINCH];
#[cfg(feature = "sev_snp")]
pub fn get_default_sev_snp_guest_policy() -> SnpPolicy {
SnpPolicy::new()
.with_abi_minor(0)
.with_abi_major(0)
// SMT permitted: allows the guest to run on an SMT-enabled host.
// This is the permissive default; future work can expose this as a
// configurable platform option.
.with_smt(1)
.with_reserved_must_be_one(1)
.with_migrate_ma(0)
}
#[allow(clippy::needless_pass_by_value)]
#[allow(clippy::too_many_arguments)]
pub fn new_from_memory_manager(
@@ -982,7 +997,8 @@ impl Vm {
.map_err(Error::CpuManager)?;
// Initialize SEV-SNP - transitions guest into secure state
vm.sev_snp_init().map_err(Error::InitializeSevSnpVm)?;
vm.sev_snp_init(Self::get_default_sev_snp_guest_policy())
.map_err(Error::InitializeSevSnpVm)?;
// Load payload for SEV-SNP (IGVM parser needs cpu_manager for cpuid)
let load_payload_handle = if snapshot.is_none() {