linux-kernel - Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240802203608.3sds2wauu37cgebw@amd.com>
Date: Fri, 2 Aug 2024 15:36:08 -0500
From: Michael Roth <michael.roth@....com>
To: Paolo Bonzini <pbonzini@...hat.com>
CC: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>
Subject: Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION_REPORT for SNP
 guests

On Fri, Aug 02, 2024 at 01:53:33AM +0200, Paolo Bonzini wrote:
> Even though KVM_SEV_GET_ATTESTATION_REPORT is not one of the commands
> that were added for SEV-SNP guests, it can be applied to them.  Filtering

Is the command actually succeeding for an SNP-enabled guest? When I
test this, I get a fw_err code of 1 (INVALID_PLATFORM_STATE), and
after speaking with some firmware folks that seems to be the expected
behavior.

There's also some other things that aren't going to work as expected,
e.g. KVM uses sev->handle as the handle for the guest it wants to fetch
the attestation report for, but in the case of SNP, sev->handle will be
uninitialized since that only happens via KVM_SEV_LAUNCH_UPDATE_DATA,
which isn't usable for SNP guests.

As I understand it, the only firmware commands allowed for SNP guests are
those listed in the SNP firmware ABI, section "Command Reference", and
in any instance where a legacy command from the legacy SEV/SEV-ES firmware
ABI is also applicable for SNP, the legacy command will be defined again
in the "Command Reference" section of the SNP spec.  E.g., GET_ID is
specifically documented in both the SEV/SEV-ES firmware ABI, as well as
the SNP firmware ABI spec. But ATTESTATION (and the similar LAUNCH_MEASURE)
are only mentioned in the SEV/SEV-ES Firmware ABI, so I think it makes
sense that KVM also only allows them for SEV/SEV-ES.

-Mike

> it out, for example, makes the QEMU command query-sev-attestation-report
> fail.
> 
> Cc: Michael Roth <michael.roth@....com>
> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> ---
>  arch/x86/kvm/svm/sev.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 5c125e4c1096..17307257d632 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -2587,7 +2587,9 @@ int sev_mem_enc_ioctl(struct kvm *kvm, void __user *argp)
>  	 * Once KVM_SEV_INIT2 initializes a KVM instance as an SNP guest, only
>  	 * allow the use of SNP-specific commands.
>  	 */
> -	if (sev_snp_guest(kvm) && sev_cmd.id < KVM_SEV_SNP_LAUNCH_START) {
> +	if (sev_snp_guest(kvm) &&
> +	    sev_cmd.id < KVM_SEV_SNP_LAUNCH_START &&
> +	    sev_cmd.id != KVM_SEV_GET_ATTESTATION_REPORT) {
>  		r = -EPERM;
>  		goto out;
>  	}
> -- 
> 2.45.2
>