From b24f801c455f33517bf8bb1bec9ef6defaa0c4f5 Mon Sep 17 00:00:00 2001 From: Tyler Fanelli Date: Sun, 10 Dec 2023 21:01:20 -0500 Subject: [PATCH 1/5] lib: TryFrom for Generation At times (most notably in attestation scenarios), the SEV generation in which to attest with is specified via strings. Add a helper method to parse the SEV generation from a given string. Signed-off-by: Tyler Fanelli --- src/lib.rs | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/src/lib.rs b/src/lib.rs index e6a1c2bc..46e9c2b8 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -118,7 +118,7 @@ use certs::sev::builtin as SevBuiltin; #[cfg(feature = "sev")] use crate::{certs::sev::sev::Certificate as SevCertificate, error::Indeterminate, launch::sev::*}; -#[cfg(all(feature = "sev", feature = "openssl"))] +#[cfg(any(feature = "sev", feature = "openssl", feature = "snp"))] use std::convert::TryFrom; use std::io::{Read, Write}; @@ -308,6 +308,29 @@ impl TryFrom<&sev::Chain> for Generation { } } +#[cfg(any(feature = "sev", feature = "snp"))] +impl TryFrom for Generation { + type Error = (); + + fn try_from(val: String) -> Result { + match &val.to_lowercase()[..] { + #[cfg(feature = "sev")] + "naples" => Ok(Self::Naples), + + #[cfg(feature = "sev")] + "rome" => Ok(Self::Rome), + + #[cfg(feature = "snp")] + "milan" => Ok(Self::Milan), + + #[cfg(feature = "snp")] + "genoa" => Ok(Self::Genoa), + + _ => Err(()), + } + } +} + // The C FFI interface to the library. #[cfg(feature = "sev")] From a40c1c545600777e252cc2462968c9ee01531fcf Mon Sep 17 00:00:00 2001 From: Tyler Fanelli Date: Sun, 10 Dec 2023 21:08:13 -0500 Subject: [PATCH 2/5] lib: Add method to create title-cased string of SEV generation At times (notably during attestation), it is required to fetch certificates from AMD's KDS. To do this, a title-cased string of the current SEV generation needs to be specified. Create a helper method to marshal this string. Signed-off-by: Tyler Fanelli --- src/lib.rs | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/lib.rs b/src/lib.rs index 46e9c2b8..0f3bea0b 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -320,10 +320,10 @@ impl TryFrom for Generation { #[cfg(feature = "sev")] "rome" => Ok(Self::Rome), - #[cfg(feature = "snp")] + #[cfg(any(feature = "sev", feature = "snp"))] "milan" => Ok(Self::Milan), - #[cfg(feature = "snp")] + #[cfg(any(feature = "sev", feature = "snp"))] "genoa" => Ok(Self::Genoa), _ => Err(()), @@ -331,6 +331,26 @@ impl TryFrom for Generation { } } +#[cfg(any(feature = "sev", feature = "snp"))] +impl Generation { + /// Create a title-cased string identifying the SEV generation. + pub fn titlecase(&self) -> String { + match self { + #[cfg(feature = "sev")] + Self::Naples => "Naples".to_string(), + + #[cfg(feature = "sev")] + Self::Rome => "Rome".to_string(), + + #[cfg(any(feature = "sev", feature = "snp"))] + Self::Milan => "Milan".to_string(), + + #[cfg(any(feature = "sev", feature = "snp"))] + Self::Genoa => "Genoa".to_string(), + } + } +} + // The C FFI interface to the library. #[cfg(feature = "sev")] From 5b5b7c255569d8d43256f58bb4b948e535c96afe Mon Sep 17 00:00:00 2001 From: Tyler Fanelli Date: Sun, 10 Dec 2023 21:17:55 -0500 Subject: [PATCH 3/5] measurement: Conditionally compile gctx module behind snp flag Signed-off-by: Tyler Fanelli --- src/measurement/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/measurement/mod.rs b/src/measurement/mod.rs index 424ebf80..612ca357 100644 --- a/src/measurement/mod.rs +++ b/src/measurement/mod.rs @@ -3,7 +3,7 @@ //! Everything one needs to calculate a launch measurement for a SEV encrypted confidential guest. //! This includes, GCTX, SEV-HASHES, VMSA and OVMF pages. -#[cfg(all(any(feature = "sev", feature = "snp"), feature = "openssl"))] +#[cfg(all(feature = "snp", feature = "openssl"))] pub mod gctx; #[cfg(any(feature = "sev", feature = "snp"))] From a8e4e1f665d3e83a01cd989e49500f9c489cc14e Mon Sep 17 00:00:00 2001 From: Tyler Fanelli Date: Sun, 10 Dec 2023 22:51:26 -0500 Subject: [PATCH 4/5] lib: Allow SNP-only CA chain from Generation Signed-off-by: Tyler Fanelli --- src/lib.rs | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/src/lib.rs b/src/lib.rs index 0f3bea0b..d7aa6d23 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -112,13 +112,19 @@ use certs::sev::sev; #[cfg(all(feature = "sev", feature = "openssl"))] use certs::sev::ca::{Certificate, Chain as CertSevCaChain}; +#[cfg(all(not(feature = "sev"), feature = "snp", feature = "openssl"))] +use certs::snp::ca::Chain as CertSnpCaChain; + #[cfg(all(feature = "sev", feature = "openssl"))] use certs::sev::builtin as SevBuiltin; +#[cfg(all(not(feature = "sev"), feature = "snp", feature = "openssl"))] +use certs::snp::builtin as SnpBuiltin; + #[cfg(feature = "sev")] use crate::{certs::sev::sev::Certificate as SevCertificate, error::Indeterminate, launch::sev::*}; -#[cfg(any(feature = "sev", feature = "openssl", feature = "snp"))] +#[cfg(any(feature = "sev", feature = "snp"))] use std::convert::TryFrom; use std::io::{Read, Write}; @@ -282,6 +288,24 @@ impl From for CertSevCaChain { } } +#[cfg(all(not(feature = "sev"), feature = "snp", feature = "openssl"))] +impl From for CertSnpCaChain { + fn from(gen: Generation) -> CertSnpCaChain { + let (ark, ask) = match gen { + Generation::Milan => ( + SnpBuiltin::milan::ark().unwrap(), + SnpBuiltin::milan::ask().unwrap(), + ), + Generation::Genoa => ( + SnpBuiltin::genoa::ark().unwrap(), + SnpBuiltin::genoa::ask().unwrap(), + ), + }; + + CertSnpCaChain { ark, ask } + } +} + #[cfg(all(feature = "sev", feature = "openssl"))] impl TryFrom<&sev::Chain> for Generation { type Error = (); From c695448bbb68d006e45e61300d1d3b8b76748b2f Mon Sep 17 00:00:00 2001 From: Tyler Fanelli Date: Fri, 16 Feb 2024 00:07:29 -0500 Subject: [PATCH 5/5] lib: Add bergamo and siena support to Generation from String Signed-off-by: Tyler Fanelli --- src/lib.rs | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lib.rs b/src/lib.rs index d7aa6d23..178ed282 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -350,6 +350,12 @@ impl TryFrom for Generation { #[cfg(any(feature = "sev", feature = "snp"))] "genoa" => Ok(Self::Genoa), + #[cfg(any(feature = "sev", feature = "snp"))] + "bergamo" => Ok(Self::Genoa), + + #[cfg(any(feature = "sev", feature = "snp"))] + "siena" => Ok(Self::Genoa), + _ => Err(()), } }