kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: Parse guest policy from IGVM initialization headers

Browse Source 
Extract the SNP guest policy from IGVM initialization headers when
available, falling back to the default policy. This matches QEMU's
behaviour where only a non-zero IGVM policy overrides the default.

Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-05-01 09:25:24 -07:00
committed by Rob Bradford
parent 4a91b4a608
commit bfab43e252
2 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
vmm/src/vm.rs
View File

@@ -1012,8 +1012,16 @@ impl Vm {
.create_boot_vcpus(snapshot_from_id(snapshot, CPU_MANAGER_SNAPSHOT_ID))
.map_err(Error::CpuManager)?;
// Initialize SEV-SNP - transitions guest into secure state
vm.sev_snp_init(Self::get_default_sev_snp_guest_policy())
// Extract guest policy from IGVM if available, otherwise use default.
#[cfg(feature = "igvm")]
let guest_policy = igvm_file
.as_ref()
.and_then(igvm_loader::extract_guest_policy)
.unwrap_or_else(Self::get_default_sev_snp_guest_policy);
#[cfg(not(feature = "igvm"))]
let guest_policy = Self::get_default_sev_snp_guest_policy();
vm.sev_snp_init(guest_policy)
.map_err(Error::InitializeSevSnpVm)?;
// Load payload for SEV-SNP (IGVM parser needs cpu_manager for cpuid)