On Thu, Sep 03, 2026 at 02:57:44PM +0200, Stefano Garzarella wrote:
On Tue, Sep 01, 2026 at 12:09:19PM +0200, Luigi Leonardi wrote:
set_id_block only makes sense when the IGVM file contains an
IGVM_VHT_SNP_ID_BLOCK directive. Move the call from the removed
qigvm_handle_policy into qigvm_directive_snp_id_block, where the ID
block and ID auth are populated. This avoids a no-op call to
set_id_block when no ID block is present.
The ID block embeds the guest policy, so the policy must be known by the
time the directive is handled. Process the initialization section (which
carries the GUEST_POLICY header) before the directive section, and
copy ctx->sev_policy into the ID block in the directive handler.
Signed-off-by: Luigi Leonardi <[email protected]>
---
backends/igvm.c | 81 +++++++++++++++++++++++++++------------------------------
1 file changed, 38 insertions(+), 43 deletions(-)
diff --git a/backends/igvm.c b/backends/igvm.c
index 85de0d54ec..6545382546 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -778,6 +778,8 @@ static int qigvm_directive_snp_id_block(QIgvm *ctx, const
uint8_t *header_data,
ctx->id_block->version = IGVM_SEV_ID_BLOCK_VERSION;
memcpy(ctx->id_block->ld, igvm_id->ld, sizeof(ctx->id_block->ld));
+ ctx->id_block->policy = ctx->sev_policy;
Is it fine to copy the sev_policy in the id_block in any case?
I mean, what happen if IGVM_VHT_GUEST_POLICY is not in the IGVM file,
so IIUC sev_policy is 0, but the user set the policy by the CLI?
Maybe this was pre-existing and handled in the next patches.
This is a very good question: id block per snp spec *requires* a policy
to be set. So can we consider an IGVM file that contains a id block directive
but not guest policy to be valid? If so, I need to modify the code and read
the policy from `kvm_start_conf` with a new callback.
Luigi
