Feature: Add QEMU option to include ARK, ASK and VCEK certificates to the guest VM

[danko-miladinovic]

Is your feature request related to a problem? Please describe.

This feature is designed to increase the speed of the verification process.

Describe the feature you are requesting, as well as the possible use case(s) for it.

This feature will enable the Manager to run SVMs with added ARK, AS and VCEK to guest memory. This will enable the Agent to send the certificates ARK, ASK and VCEK alongside the attestation report. The CLI will then only have to fetch the CRL from AMD and not ARK, ASK and VCEK.

Indicate the importance of this feature to you.

Must-have

Anything else?

No response

[dborovcanin]

@danko-miladinovic What's the status with this one?

[dborovcanin]

@danko-miladinovic What's the status of this ticket?

[danko-miladinovic]

This was not able to be done before because of QEMU. Now with the new version of QEMU installed, this can be done. I will work on it.

[dborovcanin]

@danko-miladinovic What's the status here?

[danko-miladinovic]

I will start on this one as soon as I finish with aTLS bug.

[dborovcanin]

@danko-miladinovic Any progress on this one?

[dborovcanin]

@danko-miladinovic Any updates?

[danko-miladinovic]

It seems that the parameter for certs-path is still not implemented in QEMU, it is implemented in AMDSEV repo QEMU. This feature will still be delayed.

[dborovcanin]

@danko-miladinovic What's the status here?

[dborovcanin]

@danko-miladinovic Please double-check if this is merged to mainstream Qemu. If it's unlikely to ever happen, feel free to close it.

[dborovcanin]

@danko-miladinovic Please update the estimate once the research is done, or feel free to close this one and open another if we decide to pivot to a different solution.

[danko-miladinovic]

I revisited this issue this week. The problem still remains the same. There is currently no way to pass the ARK, ASK, and VCEK certificates to QEMU. This feature was once supported with AMDSEV GitHub fork of QEMU, but they removed it.

There is also VirTee Rust crates that implement the SEV-SNP ABI and makes it easier for the user to interact with the host. They used to have a tutorial on how to pass the certificates to the hypervisor memory, but that tutorial is out of date. I have opened an issue on sev GitHub repo to see if they still support this feature.