Re: [PATCH v2 0/5] igvm/sev: apply the IGVM guest policy before launch

[Luigi Leonardi <leonardi@redhat.com>]

On Mon, Sep 07, 2026 at 05:56:56PM +0200, Luigi Leonardi wrote:
>The guest policy from an IGVM file never actually made it to the platform
>before launch. The callback that was supposed to forward it ran after
>LAUNCH_START, so it did nothing and the guest was launched with the
>default policy instead of the one requested by the file.
>
>The policy is part of the attestation report, so this quietly breaks
>attestation: the resulting measurement does not match what the IGVM file
>was built for.
>
>Patches 1 to 4 are cleanups needed to get there: dropping an overloaded
>callback, moving the SNP ID block handling, giving the policy properties
>proper accessors, and adding a way to read back the platform's current
>guest policy. Patch 5 is the actual fix.
>
>One thing worth calling out: if a policy is also passed on the command
>line and it differs from the IGVM one, the command-line value takes
>precedence and we print a warning instead of silently picking one over
>the other.
>
>Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
>---
>Changes in v2:
>- Rework the callback split. Now we don't have an unimplemented callback [Stefano, Gerd]
>- Reject a command-line/IGVM policy that doesn't fit in the 32-bit
>  SEV/SEV-ES policy field instead of truncating it [Stefano]
>- On a mismatch between the command-line and IGVM policy, print a warning and
>  keep the command-line value instead of returning an error. [Daniel,
>  Gerd, Stefano]
>- Picked up RoB
>- Rebased to latest upstream
>- Link to v1: https://lore.kernel.org/qemu-devel/20260901-fix_igvm_policy-v1-0-e93a6cf8c5ac@redhat.com
>
>---
>Luigi Leonardi (5):
>      sev: split set_guest_policy into set_guest_policy and set_id_block
>      igvm: move set_id_block call into the SNP ID block directive handler
>      i386/sev: convert the guest policy properties to custom accessors
>      i386/sev: add a get_guest_policy callback
>      igvm/sev: forward the IGVM guest policy to the platform before launch
>
> backends/confidential-guest-support.c       |  24 +++-
> backends/igvm.c                             |  91 ++++++------
> include/system/confidential-guest-support.h |  36 +++--
> include/system/igvm-internal.h              |   3 -
> target/i386/sev.c                           | 215 ++++++++++++++++++----------
> 5 files changed, 230 insertions(+), 139 deletions(-)
>---
>base-commit: cacd3462963a0a4f5bab4263ce79c2aa4b32692d
>change-id: 20260831-fix_igvm_policy-0b92de52dd6a
>
>Best regards,
>-- 
>Luigi Leonardi <leonardi@redhat.com>
>

gentle ping :)

Thanks,
Luigi