fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

backends/confidential-guest-support: Add set_guest_policy() function

Browse source 
For confidential guests a policy can be provided that defines the
security level, debug status, expected launch measurement and other
parameters that define the configuration of the confidential platform.

This commit adds a new function named set_guest_policy() that can be
implemented by each confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Link: https://lore.kernel.org/r/d3888a2eb170c8d8c85a1c4b7e99accf3a15589c.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Roy Hopkins 2025-07-03 17:02:20 +01:00 • committed by Paolo Bonzini
parent 596c330b19
commit 96a3088f5e
2 changed files with 33 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
backends/confidential-guest-support.c
View file

@ -38,6 +38,17 @@ static int set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
return -1;
}
static int set_guest_policy(ConfidentialGuestPolicyType policy_type,
uint64_t policy,
void *policy_data1, uint32_t policy_data1_size,
void *policy_data2, uint32_t policy_data2_size,
Error **errp)
{
error_setg(errp,
"Setting confidential guest policy is not supported for this platform");
return -1;
}
static int get_mem_map_entry(int index, ConfidentialGuestMemoryMapEntry *entry,
Error **errp)
{
@ -53,6 +64,7 @@ static void confidential_guest_support_class_init(ObjectClass *oc,
ConfidentialGuestSupportClass *cgsc = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
cgsc->check_support = check_support;
cgsc->set_guest_state = set_guest_state;
cgsc->set_guest_policy = set_guest_policy;
cgsc->get_mem_map_entry = get_mem_map_entry;
}

21
include/system/confidential-guest-support.h
View file

@ -57,6 +57,10 @@ typedef enum ConfidentialGuestPageType {
CGS_PAGE_TYPE_REQUIRED_MEMORY,
} ConfidentialGuestPageType;
typedef enum ConfidentialGuestPolicyType {
GUEST_POLICY_SEV,
} ConfidentialGuestPolicyType;
struct ConfidentialGuestSupport {
Object parent;
@ -123,6 +127,23 @@ typedef struct ConfidentialGuestSupportClass {
ConfidentialGuestPageType memory_type,
uint16_t cpu_index, Error **errp);
/*
* Set the guest policy. The policy can be used to configure the
* confidential platform, such as if debug is enabled or not and can contain
* information about expected launch measurements, signed verification of
* guest configuration and other platform data.
*
* The format of the policy data is specific to each platform. For example,
* SEV-SNP uses a policy bitfield in the 'policy' argument and provides an
* ID block and ID authentication in the 'policy_data' parameters. The type
* of policy data is identified by the 'policy_type' argument.
*/
int (*set_guest_policy)(ConfidentialGuestPolicyType policy_type,
uint64_t policy,
void *policy_data1, uint32_t policy_data1_size,
void *policy_data2, uint32_t policy_data2_size,
Error **errp);
/*
* Iterate the system memory map, getting the entry with the given index
* that can be populated into guest memory.