Re: SEV guest attestation

[Dov Murik <dovmurik@linux.ibm.com>]

On 25/11/2021 18:08, Dr. David Alan Gilbert wrote:
> * Daniel P. Berrangé (berrange@redhat.com) wrote:
>> On Thu, Nov 25, 2021 at 03:40:36PM +0000, Dr. David Alan Gilbert wrote:
>>> * Sergio Lopez (slp@redhat.com) wrote:
>>>> On Thu, Nov 25, 2021 at 02:44:51PM +0200, Dov Murik wrote:
>>>>>
>>>>> SEV-ES has pre-launch measurement and secret injection, just like SEV
>>>>> (except that the measurement includes the initial states of all vcpus,
>>>>> that is, their VMSAs.  BTW that means that in order to calculate the
>>>>> measurement the Attestation Server must know exactly how many vcpus are
>>>>> in the VM).
>>>>
>>>> You need the number of vCPUs and an idea of what their initial state
>>>> is going to be, to be able to reproduce the same VMSA struct in the
>>>> Attestation Server.
>>>>
>>>> This may tie the Attestation Server with a particular version of both
>>>> QEMU and KVM. I haven't checked if configuration changes in QEMU may
>>>> also have an impact on it.
>>>
>>> That's all OK; I'm expecting the attestation server to be given a whole
>>> pile of information about the apparent environment to check.
>>
>> Generally though we try not to let a VM to tied to a specific
>> version of software. eg use machine types to ensure that the
>> guest can run on any QEMU version, and get the same environment.
>> This lets host admin upgrade the host software for bug/security
>> fixes without negatively impacting users. It'd be nice not to
>> loose that feature with SEV if possible.
>>
>> IOW, if there are aspects of the vCPU initial state that might
>> vary over time with different QEMU versions, should we be looking
>> to tie that variance into the machine type version.
> 
> It's not tied to a particular version; but you may need to let the
> attesting server know what version it's using so that it can check
> everything adds up.


To further complicate things, note that in SEV-ES the reset vector
address (CS:IP) for all APs is not set by QEMU, but taken from GUIDed
tables in OVMF (towards the end of the image); QEMU parses the table and
takes the reset address from there.  So a benign-looking change in OVMF
(changing the AP reset vector address) might cause a change in the
VMSAs, and therefore a change in the measurement.

Of course the OVMF binary itself is part of the measurement as well.

-Dov



> 
> Dave
> 
>> For KVM changes, this might again come back to the idea fo a
>> "host type version".
>>
>> Regards,
>> Daniel
>> -- 
>> |: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
>> |: https://libvirt.org         -o-            https://fstop138.berrange.com :|
>> |: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|
>>