Re: SEV guest attestation

[Tyler Fanelli]

On 11/24/21 12:49 PM, Dr. David Alan Gilbert wrote:
> * Tyler Fanelli (tfanelli@redhat.com) wrote:
> > Hi,
> >
> > We recently discussed a way for remote SEV guest attestation through QEMU.
> > My initial approach was to get data needed for attestation through different
> > QMP commands (all of which are already available, so no changes required
> > there), deriving hashes and certificate data; and collecting all of this
> > into a new QMP struct (SevLaunchStart, which would include the VM's policy,
> > secret, and GPA) which would need to be upstreamed into QEMU. Once this is
> > provided, QEMU would then need to have support for attestation before a VM
> > is started. Upon speaking to Dave about this proposal, he mentioned that
> > this may not be the best approach, as some situations would render the
> > attestation unavailable, such as the instance where a VM is running in a
> > cloud, and a guest owner would like to perform attestation via QMP (a likely
> > scenario), yet a cloud provider cannot simply let anyone pass arbitrary QMP
> > commands, as this could be an issue.
> >
> > So I ask, does anyone involved in QEMU's SEV implementation have any input
> > on a quality way to perform guest attestation? If so, I'd be interested.
> > Thanks.
> QMP is the right way to talk to QEMU; the question is whether something
> sits between qemu and the attestation program - e.g. libvirt or possibly
> subsequently something even higher level.
>
> Can we start by you putting down what your interfaces look like at the
> moment?

Basically, I just establish a connection with a QMP socket at the 
beginning, serialize different QMP structs to get the data I need 
(query-sev, query-sev-capabilities, etc..), get the results and 
deserialize that data. In the original attempt, I would keep this 
protocol for issuing "sev-launch-start", "sev-inject-secret", and 
others. From a mgmt app perspective (in my case, I'm looking at it from 
a sevctl perspective), it's relatively straightforward. Any work 
required for getting certificates, sessions, measurements, and OVMF data 
is handled by sevctl.

> Dave

Tyler.

--
Tyler Fanelli (tfanelli)