linux-kernel - Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABgObfbhB9AaoEONr+zPuG4YBZr2nd-BDA4Sqou-NKe-Y2Ch+Q@mail.gmail.com>
Date: Mon, 5 Aug 2024 16:32:16 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Michael Roth <michael.roth@....com>
Cc: linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Subject: Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION_REPORT for SNP guests

On Fri, Aug 2, 2024 at 10:41 PM Michael Roth <michael.roth@....com> wrote:
> On Fri, Aug 02, 2024 at 01:53:33AM +0200, Paolo Bonzini wrote:
> > Even though KVM_SEV_GET_ATTESTATION_REPORT is not one of the commands
> > that were added for SEV-SNP guests, it can be applied to them.  Filtering
>
> Is the command actually succeeding for an SNP-enabled guest? When I
> test this, I get a fw_err code of 1 (INVALID_PLATFORM_STATE), and
> after speaking with some firmware folks that seems to be the expected
> behavior.

So is there no equivalent of QEMU's query-sev-attestation-report for
SEV-SNP? (And is there any user of query-sev-attestation-report for
non-SNP?)

Paolo

> There's also some other things that aren't going to work as expected,
> e.g. KVM uses sev->handle as the handle for the guest it wants to fetch
> the attestation report for, but in the case of SNP, sev->handle will be
> uninitialized since that only happens via KVM_SEV_LAUNCH_UPDATE_DATA,
> which isn't usable for SNP guests.
>
> As I understand it, the only firmware commands allowed for SNP guests are
> those listed in the SNP firmware ABI, section "Command Reference", and
> in any instance where a legacy command from the legacy SEV/SEV-ES firmware
> ABI is also applicable for SNP, the legacy command will be defined again
> in the "Command Reference" section of the SNP spec.  E.g., GET_ID is
> specifically documented in both the SEV/SEV-ES firmware ABI, as well as
> the SNP firmware ABI spec. But ATTESTATION (and the similar LAUNCH_MEASURE)
> are only mentioned in the SEV/SEV-ES Firmware ABI, so I think it makes
> sense that KVM also only allows them for SEV/SEV-ES.