Re: [PATCH 4/4] igvm/sev: forward the IGVM guest policy to the platform before launch

[Gerd Hoffmann <kraxel@redhat.com>]

  Hi,

> > > If the user choose to override policy on the CLI, isn't it now just
> > > their problem to also figure out what the new expected measurement
> > > will be ?
> > > 
> > > Why wouldn't we just honour the IGVM by default, and if the CLI
> > > has further customizations let them override the IGVM, and leave
> > > the user to figure out the implications.
> > 
> > I also slightly prefer this behaviour too, I see some advantages,
> > especially for testing and debugging, where you don't want to regenerate
> > the IGVM. But I don't have a strong opinion on this; if there is a
> > mismatch, though, I agree that it's better to get an error than to
> > ignore the CLI.
> 
> In this series, if there is a mismatch between IGVM and CLI, QEMU returns an error.
> Debugging sounds very reasonable to me, so I'm fine on letting the CLI override IGVM.

qemu should flag this mismatch in any case.  Either throw an error and
exit, or log a warning and continue.  Given that changing the policy
changes the launch measurement I'd tend to prefer an error.  If people
see value and real use cases for policy overrides I'm fine with a
warning too.

Silently accepting the override is IMHO not an option.  We had enough
problems with qemu silently doing things not expected by users in the
past.

take care,
  Gerd