Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION_REPORT for SNP guests

[Michael Roth <michael.roth@amd.com>]

On Fri, Aug 02, 2024 at 01:53:33AM +0200, Paolo Bonzini wrote:
> Even though KVM_SEV_GET_ATTESTATION_REPORT is not one of the commands
> that were added for SEV-SNP guests, it can be applied to them.  Filtering

Is the command actually succeeding for an SNP-enabled guest? When I
test this, I get a fw_err code of 1 (INVALID_PLATFORM_STATE), and
after speaking with some firmware folks that seems to be the expected
behavior.

There's also some other things that aren't going to work as expected,
e.g. KVM uses sev->handle as the handle for the guest it wants to fetch
the attestation report for, but in the case of SNP, sev->handle will be
uninitialized since that only happens via KVM_SEV_LAUNCH_UPDATE_DATA,
which isn't usable for SNP guests.

As I understand it, the only firmware commands allowed for SNP guests are
those listed in the SNP firmware ABI, section "Command Reference", and
in any instance where a legacy command from the legacy SEV/SEV-ES firmware
ABI is also applicable for SNP, the legacy command will be defined again
in the "Command Reference" section of the SNP spec.  E.g., GET_ID is
specifically documented in both the SEV/SEV-ES firmware ABI, as well as
the SNP firmware ABI spec. But ATTESTATION (and the similar LAUNCH_MEASURE)
are only mentioned in the SEV/SEV-ES Firmware ABI, so I think it makes
sense that KVM also only allows them for SEV/SEV-ES.

-Mike

> it out, for example, makes the QEMU command query-sev-attestation-report
> fail.
> 
> Cc: Michael Roth <michael.roth@amd.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  arch/x86/kvm/svm/sev.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 5c125e4c1096..17307257d632 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -2587,7 +2587,9 @@ int sev_mem_enc_ioctl(struct kvm *kvm, void __user *argp)
>  	 * Once KVM_SEV_INIT2 initializes a KVM instance as an SNP guest, only
>  	 * allow the use of SNP-specific commands.
>  	 */
> -	if (sev_snp_guest(kvm) && sev_cmd.id < KVM_SEV_SNP_LAUNCH_START) {
> +	if (sev_snp_guest(kvm) &&
> +	    sev_cmd.id < KVM_SEV_SNP_LAUNCH_START &&
> +	    sev_cmd.id != KVM_SEV_GET_ATTESTATION_REPORT) {
>  		r = -EPERM;
>  		goto out;
>  	}
> -- 
> 2.45.2
>