Re: [PATCH] KVM: SEV: allow KVM_SEV_GET_ATTESTATION_REPORT for SNP guests

[Michael Roth <michael.roth@amd.com>]

On Mon, Aug 05, 2024 at 04:32:16PM +0200, Paolo Bonzini wrote:
> On Fri, Aug 2, 2024 at 10:41 PM Michael Roth <michael.roth@amd.com> wrote:
> > On Fri, Aug 02, 2024 at 01:53:33AM +0200, Paolo Bonzini wrote:
> > > Even though KVM_SEV_GET_ATTESTATION_REPORT is not one of the commands
> > > that were added for SEV-SNP guests, it can be applied to them.  Filtering
> >
> > Is the command actually succeeding for an SNP-enabled guest? When I
> > test this, I get a fw_err code of 1 (INVALID_PLATFORM_STATE), and
> > after speaking with some firmware folks that seems to be the expected
> > behavior.
> 
> So is there no equivalent of QEMU's query-sev-attestation-report for
> SEV-SNP?

No, but all the attestation support is via the guest request interface.

It would be possible for KVM to provide the measurement by logging the
digest values

> (And is there any user of query-sev-attestation-report for
> non-SNP?)

No, this would have always returned error, either via KVM, or via
firmware failure.

But maybe QEMU should do the error handling a bit more directly in this
case. I can send a patch for QEMU 9.1 that results in an error when
issued for an SNP guest.

-Mike

> 
> Paolo
> 
> > There's also some other things that aren't going to work as expected,
> > e.g. KVM uses sev->handle as the handle for the guest it wants to fetch
> > the attestation report for, but in the case of SNP, sev->handle will be
> > uninitialized since that only happens via KVM_SEV_LAUNCH_UPDATE_DATA,
> > which isn't usable for SNP guests.
> >
> > As I understand it, the only firmware commands allowed for SNP guests are
> > those listed in the SNP firmware ABI, section "Command Reference", and
> > in any instance where a legacy command from the legacy SEV/SEV-ES firmware
> > ABI is also applicable for SNP, the legacy command will be defined again
> > in the "Command Reference" section of the SNP spec.  E.g., GET_ID is
> > specifically documented in both the SEV/SEV-ES firmware ABI, as well as
> > the SNP firmware ABI spec. But ATTESTATION (and the similar LAUNCH_MEASURE)
> > are only mentioned in the SEV/SEV-ES Firmware ABI, so I think it makes
> > sense that KVM also only allows them for SEV/SEV-ES.
>