Merge pull request #238 from Freax13/feature/snp-report-v5

add support for V5 attestation report

Author: Freax13

common/snp-types/src/attestation.rs

@@ -56,69 +56,87 @@ pub enum MsgReportRspStatus {
 pub enum AttestionReport {
     V2(AttestionReportV2) = 2,
     V3(AttestionReportV3) = 3,
+    V5(AttestionReportV5) = 5,
 }
 
 impl AttestionReport {
     pub fn policy(&self) -> GuestPolicy {
         match self {
             AttestionReport::V2(report) => report.policy,
             AttestionReport::V3(report) => report.policy,
+            AttestionReport::V5(report) => report.policy,
         }
     }
 
     pub fn vmpl(&self) -> u32 {
         match self {
             AttestionReport::V2(report) => report.vmpl,
             AttestionReport::V3(report) => report.vmpl,
+            AttestionReport::V5(report) => report.vmpl,
         }
     }
 
     pub fn signature_algo(&self) -> u32 {
         match self {
             AttestionReport::V2(report) => report.signature_algo,
             AttestionReport::V3(report) => report.signature_algo,
+            AttestionReport::V5(report) => report.signature_algo,
         }
     }
 
     pub fn report_data(&self) -> [u8; 64] {
         match self {
             AttestionReport::V2(report) => report.report_data,
             AttestionReport::V3(report) => report.report_data,
+            AttestionReport::V5(report) => report.report_data,
         }
     }
 
     pub fn measurement(&self) -> [u8; 48] {
         match self {
             AttestionReport::V2(report) => report.measurement,
             AttestionReport::V3(report) => report.measurement,
+            AttestionReport::V5(report) => report.measurement,
         }
     }
 
     pub fn host_data(&self) -> [u8; 32] {
         match self {
             AttestionReport::V2(report) => report.host_data,
             AttestionReport::V3(report) => report.host_data,
+            AttestionReport::V5(report) => report.host_data,
         }
     }
 
     pub fn id_key_digest(&self) -> [u8; 48] {
         match self {
             AttestionReport::V2(report) => report.id_key_digest,
             AttestionReport::V3(report) => report.id_key_digest,
+            AttestionReport::V5(report) => report.id_key_digest,
         }
     }
 
     pub fn launch_tcb(&self) -> TcbVersion {
         match self {
             AttestionReport::V2(report) => report.launch_tcb,
             AttestionReport::V3(report) => report.launch_tcb,
+            AttestionReport::V5(report) => report.launch_tcb,
+        }
+    }
+
+    pub fn launch_mitigation_vector(&self) -> u64 {
+        match self {
+            AttestionReport::V2(_) => 0,
+            AttestionReport::V3(_) => 0,
+            AttestionReport::V5(report) => report.launch_mitigation_vector,
         }
     }
 
     pub fn signature(&self) -> [u8; 512] {
         match self {
             AttestionReport::V2(report) => report.signature,
             AttestionReport::V3(report) => report.signature,
+            AttestionReport::V5(report) => report.signature,
         }
     }
 }
@@ -200,6 +218,48 @@ pub struct AttestionReportV3 {
     pub signature: [u8; 512],
 }
 
+#[derive(Debug, Clone, Copy, CheckedBitPattern)]
+#[repr(C, packed)]
+pub struct AttestionReportV5 {
+    pub guest_svn: u32,
+    pub policy: GuestPolicy,
+    pub familiy_id: u128,
+    pub image_id: u128,
+    pub vmpl: u32,
+    pub signature_algo: u32,
+    pub current_tcb: TcbVersion,
+    pub platform_info: u64,
+    pub fixme_key_stuff: u32,
+    _reserved1: Reserved<4>,
+    pub report_data: [u8; 64],
+    pub measurement: [u8; 48],
+    pub host_data: [u8; 32],
+    pub id_key_digest: [u8; 48],
+    pub author_key_digest: [u8; 48],
+    pub report_id: [u8; 32],
+    pub report_id_ma: [u8; 32],
+    pub reported_tcb: TcbVersion,
+    pub cpuid_fam_id: u8,
+    pub cpuid_mod_id: u8,
+    pub cpuid_step: u8,
+    _reserved2: Reserved<21>,
+    pub chip_id: [u8; 64],
+    pub commited_tcb: TcbVersion,
+    pub current_build: u8,
+    pub current_minor: u8,
+    pub current_major: u8,
+    _reserved3: Reserved<1>,
+    pub commited_build: u8,
+    pub commited_minor: u8,
+    pub commited_major: u8,
+    _reserved4: Reserved<1>,
+    pub launch_tcb: TcbVersion,
+    pub launch_mitigation_vector: u64,
+    pub current_mitigation_vector: u64,
+    _reserved5: Reserved<152>,
+    pub signature: [u8; 512],
+}
+
 #[derive(Clone, Copy, AnyBitPattern, NoUninit)]
 #[repr(C)]
 pub struct EcdsaP384Sha384Signature {

host/mushroom-verify/src/lib.rs

@@ -55,6 +55,7 @@ impl Configuration {
         load_kasan_shadow_mappings: bool,
         policy: GuestPolicy,
         min_tcb: TcbVersion,
+        min_mitigation_vector: u64,
     ) -> Self {
         Self(ConfigurationImpl::Snp(snp::Configuration::new(
             supervisor,
@@ -63,6 +64,7 @@ impl Configuration {
             load_kasan_shadow_mappings,
             policy,
             min_tcb,
+            min_mitigation_vector,
         )))
     }
 

host/mushroom-verify/src/snp.rs

@@ -25,6 +25,7 @@ pub(crate) struct Configuration {
     id_key_digest: [u8; 48],
     policy: GuestPolicy,
     min_tcb: TcbVersion,
+    min_mitigation_vector: u64,
 }
 
 impl Configuration {
@@ -35,6 +36,7 @@ impl Configuration {
         load_kasan_shadow_mappings: bool,
         policy: GuestPolicy,
         min_tcb: TcbVersion,
+        min_mitigation_vector: u64,
     ) -> Self {
         let commands =
             generate_base_load_commands(Some(supervisor), kernel, init, load_kasan_shadow_mappings);
@@ -52,6 +54,7 @@ impl Configuration {
             id_key_digest,
             policy,
             min_tcb,
+            min_mitigation_vector,
         }
     }
 
@@ -117,6 +120,13 @@ impl Configuration {
             });
         }
 
+        if !report.launch_mitigation_vector() & self.min_mitigation_vector != 0 {
+            return Err(Error::MitigationVector {
+                expected: self.min_mitigation_vector,
+                got: report.launch_mitigation_vector(),
+            });
+        }
+
         // Construct signature.
         let signature = pod_read_unaligned::<EcdsaP384Sha384Signature>(&report.signature());
         let signature = Signature::try_from(signature)?;
@@ -279,6 +289,8 @@ pub(crate) enum Error {
         expected: TcbVersion,
         got: TcbVersion,
     },
+    #[error("expected mitigation vector to contain {expected:?} or more, got {got:?}")]
+    MitigationVector { expected: u64, got: u64 },
     #[error("failed to verify report signature")]
     Ecdsa(#[from] ecdsa::Error),
 }

host/mushroom/src/main.rs

@@ -377,6 +377,10 @@ struct TcbArgs {
     #[cfg(feature = "snp")]
     #[arg(long, default_value_t = 213)]
     microcode_svn: u8,
+    /// The minimum set of mitigation vector bits.
+    #[cfg(feature = "snp")]
+    #[arg(long, default_value_t = 0)]
+    mitigation_vector: u64,
     // TDX:
     /// TDX module minor SVN.
     #[cfg(feature = "tdx")]
@@ -445,6 +449,7 @@ async fn verify(run: VerifyCommand) -> Result<()> {
                 run.config.kasan,
                 run.config.policy.policy(),
                 run.tcb_args.min_tcb(),
+                run.tcb_args.mitigation_vector,
             )
         }
         #[cfg(feature = "tdx")]