hypervisor, vmm: Build and pass SNP ID block to launch finish

Add KvmSevSnpIdBlock and KvmSevSnpIdAuth structs matching the AMD
SEV-SNP Firmware ABI Spec (Rev 1.58), and build them from the IGVM
SNP ID block directive during launch finish. This properly populates
id_block_uaddr/id_auth_uaddr in KVM_SEV_SNP_LAUNCH_FINISH and derives
auth_key_en from the assembled author key, matching QEMU's behavior.

Thread the guest policy from sev_snp_init to launch_finish via an
atomic on KvmVm so the ID block gets the correct policy value.

Also track has_snp_id_block in IgvmLoadedInfo to enable the ID block
based on whether the IGVM file actually contains one, rather than
hardcoding it for KVM.

Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-30 06:57:40 -07:00
committed by Rob Bradford
parent bfab43e252
commit c97d635d40
6 changed files with 228 additions and 9 deletions

View File

@@ -2318,6 +2318,7 @@ impl vm::Vm for MshvVm {
snp_id_block: IGVM_VHS_SNP_ID_BLOCK,
host_data: [u8; 32],
id_block_enabled: u8,
auth_key_enabled: u8,
) -> vm::Result<()> {
let mut auth_info = hv_snp_id_auth_info {
id_key_algorithm: snp_id_block.id_key_algorithm,
@@ -2351,7 +2352,7 @@ impl vm::Vm for MshvVm {
id_auth_info: auth_info,
host_data,
id_block_enabled,
author_key_enabled: 0,
author_key_enabled: auth_key_enabled,
},
},
};