@samitouri / QOSamiQemu / commits / 470ccb470b

i386/sev/igvm: do not reset guest policy if IGVM does not set it

The guest policy is set either through command-line or through IGVM. If none of the above applies, default guest policy applies. However, if IGVM does not set the guest policy, currently the policy gets set to 0 regardless of whether it was previously set to default value or command line. This change fixes this by checking if IGVM indeed has set a policy value. If not, do not reset existing value. This avoids guest crashes such as the following during reset when the IGVM has not explicitly set any guest policies: qemu-system-x86_64: sev_snp_launch_start: SNP_LAUNCH_START ret=-22 fw_error=0 '' qemu-system-x86_64: sev_common_kvm_init: failed to create encryption context qemu-system-x86_64: unable to rebuild guest: Operation not permitted(-1) Reported-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Ani Sinha <anisinha@redhat.com> Message-ID: <20260310094450.35861-3-anisinha@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Ani Sinha committed Mar 10, 2026 at 15:14 UTC 470ccb470b33bedede0100fdb703228a3f2683a5
1 file changed +10 -2
target/i386/sev.c
+10 -2
@@ -2760,7 +2760,11 @@ static int cgs_set_guest_policy(ConfidentialGuestPolicyType policy_type,
2760 id_auth->author_key[0] ? 1 : 0;
2761 finish->id_block_en = 1;
2762 }
2763 - sev_snp_guest->kvm_start_conf.policy = policy;
2763 +
2764 + /* do not reset existing policy if policy was not set in IGVM */
2765 + if (policy != 0) {
2766 + sev_snp_guest->kvm_start_conf.policy = policy;
2767 + }
2768 } else {
2769 SevGuestState *sev_guest = SEV_GUEST(MACHINE(qdev_get_machine())->cgs);
2770 /* Only the policy flags are supported for SEV and SEV-ES */
@@ -2769,7 +2773,11 @@ static int cgs_set_guest_policy(ConfidentialGuestPolicyType policy_type,
2773 "but SEV-SNP is not enabled", __func__);
2774 return -1;
2775 }
2772 - sev_guest->policy = policy;
2776 +
2777 + /* do not reset existing policy if policy was not set in IGVM */
2778 + if (policy != 0) {
2779 + sev_guest->policy = policy;
2780 + }
2781 }
2782 return 0;
2783 }