linux-kernel - Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240805153927.fxqyxoritwguquyd@amd.com>
Date: Mon, 5 Aug 2024 10:39:27 -0500
From: Michael Roth <michael.roth@....com>
To: Paolo Bonzini <pbonzini@...hat.com>
CC: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>
Subject: Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION_REPORT for SNP
 guests

On Mon, Aug 05, 2024 at 04:32:16PM +0200, Paolo Bonzini wrote:
> On Fri, Aug 2, 2024 at 10:41 PM Michael Roth <michael.roth@....com> wrote:
> > On Fri, Aug 02, 2024 at 01:53:33AM +0200, Paolo Bonzini wrote:
> > > Even though KVM_SEV_GET_ATTESTATION_REPORT is not one of the commands
> > > that were added for SEV-SNP guests, it can be applied to them.  Filtering
> >
> > Is the command actually succeeding for an SNP-enabled guest? When I
> > test this, I get a fw_err code of 1 (INVALID_PLATFORM_STATE), and
> > after speaking with some firmware folks that seems to be the expected
> > behavior.
> 
> So is there no equivalent of QEMU's query-sev-attestation-report for
> SEV-SNP?

No, but all the attestation support is via the guest request interface.

It would be possible for KVM to provide the measurement by logging the
digest values

> (And is there any user of query-sev-attestation-report for
> non-SNP?)

No, this would have always returned error, either via KVM, or via
firmware failure.

But maybe QEMU should do the error handling a bit more directly in this
case. I can send a patch for QEMU 9.1 that results in an error when
issued for an SNP guest.

-Mike

> 
> Paolo
> 
> > There's also some other things that aren't going to work as expected,
> > e.g. KVM uses sev->handle as the handle for the guest it wants to fetch
> > the attestation report for, but in the case of SNP, sev->handle will be
> > uninitialized since that only happens via KVM_SEV_LAUNCH_UPDATE_DATA,
> > which isn't usable for SNP guests.
> >
> > As I understand it, the only firmware commands allowed for SNP guests are
> > those listed in the SNP firmware ABI, section "Command Reference", and
> > in any instance where a legacy command from the legacy SEV/SEV-ES firmware
> > ABI is also applicable for SNP, the legacy command will be defined again
> > in the "Command Reference" section of the SNP spec.  E.g., GET_ID is
> > specifically documented in both the SEV/SEV-ES firmware ABI, as well as
> > the SNP firmware ABI spec. But ATTESTATION (and the similar LAUNCH_MEASURE)
> > are only mentioned in the SEV/SEV-ES Firmware ABI, so I think it makes
> > sense that KVM also only allows them for SEV/SEV-ES.
>