Add igvm V2 RPC interfaces to propagate igvm error info #665
+491
−108
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add igvm V2 RPC request and response headers to propagate igvm attest error info.
HCL and Underhill in Confidential VMs, send requests to IGVM Agent in the host through the VM worker process (VMWP). The HCL/UH sends requests to the VMWP via the GET emulation protocol, while the VMWP communicates with the IGVM Agent via Windows RPC.
The current interface between HCL/UH and VMWP will not change. Currently interface, sends a i32 (-1), 0xFFFFFFFF back if there are any errors with the request to IGVM Agent. VMWP just acts as a proxy.
The proposed changes are to the format of the messages that are sent between UH/HCL and IGVM Agent. The version field of request header is incremented from 1 to 2 and a new struct CapabilityBitmap is added to the header:
In case of a version 2 request being sent, IGVM Agent would respond with a version 2 response, whose header include a new field as
IgvmErrorInfo
that include error code and retry signal. The IGVM Agent attestation error is then propagated to UH and UH can take proper retry strategy as per retry recommendation.