[OLK-5.10]Support request attestation report from CSV guest · Pull Request !18365 · openEuler/kernel

Support request attestation report from CSV guest

issue:
https://gitee.com/openeuler/kernel/issues/ID1WC6

The ATTESTATION function allows the users of CSV virtual machine to obtain an attestation report, and the 3rd party can verify the identity of the user. The attestation report contains the key authentication information of the CSV virtual machine and is signed by the PSP. The plaintext of the attestation report can only be obtained inside the CSV virtual machine, VMM and system software of the host can not spy and forge the attestation report.

To support this functionality, the CSV virtual machine kernel uses a similar approach to confidential computing virtual machines such as SEV, providing an ioctl interface through a csv-guest driver, through which the user of CSV virtual machine initiates hypercall requests. KVM converts hypercall requests into ATTESTATION API requests and sends them to the PSP.

The CSV virtual machine kernel must be compiled with the following configuration:
CONFIG_HYGON_CSV=y
CONFIG_VIRT_DRIVERS=y
CONFIG_CSV_GUEST=m

Test:

boot and login to the CSV guest, and install csv-guest kernel module
Run ioclt-get-attestation in the CSV guest, which will generate a report.cert file and send it to 'machine2'
Use he gadget verify-attestation on 'machine2' to verify the attestation report

GVPopenEuler/kernel

搜索帮助

GVP openEuler/kernel