[6.6][feat]Hygon:增加CSV3虚拟机远程认证支持 · Pull Request !4388 · anolis/cloud-kernel

bugzilla: https://bugzilla.openanolis.cn/show_bug.cgi?id=13042

Feat: Attestation for CSV3 VM
The CSV3 guest linux provide csv-guest kernel module to respond userspace request, and return CSV3 attestation report to userspace. The CSV3 guest linux issue secure call command to get attestation report from the CSV3 firmware.

## How to Test:
1. Launch a CSV3 VM
```shell
sudo /path/to/qemu-system-x86_64 -enable-kvm -cpu host -smp 40 -m 6G -drive \
if=pflash,format=raw,unit=0,file=csv_func_test/OVMF.Regular/OVMF_CODE.fd,readonly=on \
-object sev-guest,id=sev0,policy=0x45,cbitpos=47,reduced-phys-bits=5 \
-machine memory-encryption=sev0 -machine q35 \
-device virtio-scsi-pci,id=scsi0,disable-legacy=on,iommu_platform=on \
-drive file=./vm.qcow2,if=none,id=drive0 -device scsi-hd,drive=drive0,bootindex=1 \
-vnc 0.0.0.0:0,to=90 -netdev tap,id=hostnet0,vhost=on,br=virbr0,ifname=guestnet1 \
-device virtio-net-pci,netdev=hostnet0,id=net0,mac=12:23:34:45:56:99,disable-legacy=on,iommu_platform=on
```
2. Get attestation report in the CSV3 Guest
![输入图片说明](https://foruda.gitee.com/images/1735197042870720279/deae82bd_7824598.jpeg "csv3-attestation.jpg")
3. Transfer the report to third party, the third party verify the report success
```shell
$ scp ${csv3-vm-user}@${csv3-vm-ip}:/path/to/report.cert ./
$ ./verify-attestation true
```
```
verify attestation report
load attestation report from ./report.cert

Validate cert chain:
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   832  100   832    0     0   4425      0 --:--:-- --:--:-- --:--:--  4449
Get hrk file successful

% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2916  100  2916    0     0  16021      0 --:--:-- --:--:-- --:--:-- 16110
Get hsk-cek file successful

Signature:
	r=B1B6DAA440BEC84708E6F78D6233940958B7CEE63B0B8ECBA048E08CEEFF6529
	s=8E4321DE8E79D346B5C9A1C6492554AB81D523F351A3567C852BBB4FE36BD750
SM2_do_verify success!
hrk pubkey verify hrk cert successful
Signature:
	r=E6C8D853A375B99A64459B9CC0FF3489FFDBA88E3274EC20B67C26EA375D20EF
	s=08F775A4E819D80DE01A1E318148F65CF9D618B5DF624143A1F4641CF9BB0CBF
SM2_do_verify success!
hrk pubkey verify hsk cert successful
Signature:
	r=B9B2AF6273A165F4F12CAA1B357A74F240D1D0AFE1141270DC15E909BDE2F0F0
	s=62F4D433626F35035191995BBCC9A7185AA2B1CC5CA19C7C12C228BBF079FFD0
SM2_do_verify success!
hsk pubkey verify cek cert successful
Signature:
	r=634B3CD4933A3C20DEAB353779C1545FDE3EFC7B1F887EFF0FFB1C3011241BD0
	s=1BBBD4E5467E9ACE82AD2F3E8B60C8857EDD26E4515822FE68B2D50019A3B60A
SM2_do_verify success!
cek pubkey verify pek cert successful
validata cert chain successful

verify report
report.userdata:
75736572206461746100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
report.mnonce:
67c6697351ff4aec29cdbaabf2fbe346
report.measure:
fdac9e85fee29925091fa26113947d18a2b64264d2cad71d6318606d1eda5eec
report.sn:
4b504136353430323138323230370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
verify: do verify
Signature:
	r=A1837D349B20C5DEBFBB4CBDBDBF04A6312EF149B28A9767124320E29622649D
	s=83841CEE73FF574F0684522C69F5A84C2552FA18D470F4A371BF5DCEE7229759
SM2_do_verify success!
verify success
```

类型	指派人员	状态
审查	Guanjun xunlei Artie Ding zelindeng Guixin Liu Xuchun Shang	已完成 (0/0人)
测试	小龙已测试通过	已完成 (1/1人)

GVPanolis/cloud-kernel

搜索帮助

GVP anolis/cloud-kernel