The guest policy from an IGVM file never actually made it to the platform before launch. The callback that was supposed to forward it ran after LAUNCH_START, so it did nothing and the guest was launched with the default policy instead of the one requested by the file.
The policy is part of the attestation report, so this quietly breaks attestation: the resulting measurement does not match what the IGVM file was built for. Patches 1 to 4 are cleanups needed to get there: dropping an overloaded callback, moving the SNP ID block handling, giving the policy properties proper accessors, and adding a way to read back the platform's current guest policy. Patch 5 is the actual fix. One thing worth calling out: if a policy is also passed on the command line and it differs from the IGVM one, the command-line value takes precedence and we print a warning instead of silently picking one over the other. Signed-off-by: Luigi Leonardi <[email protected]> --- Changes in v2: - Rework the callback split. Now we don't have an unimplemented callback [Stefano, Gerd] - Reject a command-line/IGVM policy that doesn't fit in the 32-bit SEV/SEV-ES policy field instead of truncating it [Stefano] - On a mismatch between the command-line and IGVM policy, print a warning and keep the command-line value instead of returning an error. [Daniel, Gerd, Stefano] - Picked up RoB - Rebased to latest upstream - Link to v1: https://lore.kernel.org/qemu-devel/[email protected] --- Luigi Leonardi (5): sev: split set_guest_policy into set_guest_policy and set_id_block igvm: move set_id_block call into the SNP ID block directive handler i386/sev: convert the guest policy properties to custom accessors i386/sev: add a get_guest_policy callback igvm/sev: forward the IGVM guest policy to the platform before launch backends/confidential-guest-support.c | 24 +++- backends/igvm.c | 91 ++++++------ include/system/confidential-guest-support.h | 36 +++-- include/system/igvm-internal.h | 3 - target/i386/sev.c | 215 ++++++++++++++++++---------- 5 files changed, 230 insertions(+), 139 deletions(-) --- base-commit: cacd3462963a0a4f5bab4263ce79c2aa4b32692d change-id: 20260831-fix_igvm_policy-0b92de52dd6a Best regards, -- Luigi Leonardi <[email protected]>
