CoRIM profile for AMD SEV-SNP attestation report

3.1.2.1. Version scheme extension

Extend the $version-scheme type with as follows¶

$version-scheme /= &(sevsnpvm-familyimageid-hex: -1)

The -1 scheme is a string representation of the two 128-bit identifiers in hexadecimal encoding as separated by /. The scheme allows for fuzzy comparison with _ as a wildcard on either side of the /.¶

An endorsement provider MAY use a different version scheme for the &(version: 0) codepoint.¶

3.1.2.2. Notional Instance Identity

A CoRIM instance identifier is universally unique, but there are different notions of identity within a single attestation report that are each unique within their notion. A notional instance identifier is a tagged CBOR map from integer codepoint to opaque bytes.¶

int-bytes-map = { * int => bytes }

Profiles may restrict which integers are valid codepoints, and may restrict the respective byte string sizes. For this profile, only codepoints 0 and 1 are valid. The expected byte string sizes are 32 bytes. For the int-bytes-map to be an interpretable extension of $instance-id-type-choice, there is tagged-int-bytes-map:¶

tagged-int-bytes-map = #6.563(int-bytes-map)

3.1.3.1. environment-map

• The environment-map / class / class-id field SHALL be set to the BER [X.690] encoding of OID [RFC9090] 1.3.6.1.4.1.3704.2.1 and tagged with #6.111.¶

• The environment-map / instance field SHALL be set to an int-bytes-map tagged with #6.111 with at least one codepoint 0 or 1. If codepoint 0 is populated, it SHALL be set to REPORT_ID. If codepoint 1 is populated, it SHALL be set to REPORT_ID_MA.¶

• The environment-map / group field SHALL be set to the VLEK csp_id and tagged with #6.111 if SIGNING_KEY is 1. If SIGNING_KEY is 0, the field MAY be set to the VCEK hwid and tagged with #6.111.¶

3.1.3.2. measurement-map

The mkey is left unset. The authorized-by key SHALL be set to a representation of the VEK that signed the ATTESTATION_REPORT, or a key along the certificate path to a self-signed root, i.e., the ASK, ASVK, or ARK for the product line. The measurement-values-map is set as described in the following section.¶

3.1.3.3. measurement-values-map

The function is-set(x, b) represents whether the bit at position b is set in the number x.¶

• The digests: 2 codepoint SHALL be set to either [ / digest / { alg: 7 val: MEASUREMENT } ] or [ / digest / { alg: "sha-384" val: MEASUREMENT } ] as assigned in [IANA.named-information].¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-smt-allowed codepoint SHALL be set to is-set(GUEST_POLICY, 16.¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-migration-agent-allowed codepoint SHALL be set to is-set(GUEST_POLICY, 18).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-debug-allowed codepoint SHALL be set to is-set(GUEST_POLICY, 19).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-single-socket-only codepoint SHALL be set to is-set(GUEST_POLICY, 20).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-cxl-allowed codepoint SHALL be set to is-set(GUEST_POLICY, 21).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-mem-aes-256-xts-required codepoint SHALL be set to is-set(GUEST_POLICY, 22).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-rapl-must-be-disabled codepoint SHALL be set to is-set(GUEST_POLICY, 23).¶

• The &(flags: 3) / flags-map / sevsnpvm-policy-ciphertext-hiding-must-be-enabled codepoint SHALL be set to is-set(GUEST_POLICY, 24).¶

• The &(flags: 3) / flags-map / sevsnphost-smt-enabled codepoint SHALL be set to is-set(PLATFORM_INFO, 0).¶

• The &(flags: 3) / flags-map / sevsnphost-tsmu-enabled codepoint SHALL be set to is-set(PLATFORM_INFO, 1).¶

• The &(flags: 3) / flags-map / sevsnphost-ecc-mem-reported-enabled codepoint SHALL be set to is-set(PLATFORM_INFO, 2).¶

• The &(flags: 3) / flags-map / sevsnphost-rapl-disabled codepoint SHALL be set to is-set(PLATFORM_INFO, 3).¶

• The &(flags: 3) / flags-map / sevsnphost-ciphertext-hiding-enabled codepoint SHALL be set to is-set(PLATFORM_INFO, 4).¶

• The &(sevsnpvm-policy-abi: -1) codepoint SHALL be set to [ ABI_MAJOR, ABI_MINOR ].¶

• The &(sevsnpvm-vmpl: -2) codepoint SHALL be set to VMPL.¶

• The &(sevsnpvm-hostdata: -3) codepoint SHALL be set to HOSTDATA if nonzero. It MAY be set to HOSTDATA if all zeroes.¶

• The &(sevsnphost-sp-fw-current: -4) codepoint SHALL be set to [ CURRENT_BUILD, CURRENT_MAJOR, CURRENT_MINOR ].¶

• The &(sevsnphost-sp-fw-committed: -5) codepoint SHALL be set to [ COMMITTED_BUILD, COMMITTED_MAJOR, COMMITTED_MINOR ].¶

• The &(sevsnphost-current-tcb: -6) codepoint SHALL be set to 552(CURRENT_TCB).¶

• The &(sevsnphost-committed-tcb: -7) codepoint SHALL be set to 552(COMMITTED_TCB)¶

• The &(sevsnphost-launch-tcb: -8) codepoint SHALL be set to 552(LAUNCH_TCB).¶

• The &(sevsnphost-reported-tcb: -9) codepoint SHALL be set to 552(REPORTED_TCB).¶

If ID_BLOCK information is available, it appears in its own endorement-triple-record with additional values in authorized-by beyond the attestation key. The authorized-by field is extended with 32780(ID_KEY_DIGEST), and if AUTHOR_KEY_EN is 1, then it is also extended with 32780(AUTHOR_KEY_DIGEST). The Verifier MAY use a base CDDL CoRIM $crypto-key-type-choice representation if its public key information's digest is equal to the #6.32780-tagged bytes, as described it Section 3.1.3.4.¶

• The version: 0 codepoint SHALL be set to ~~~cbor-diag / version-map / { / version: / 0 => hexlify(FAMILY_ID) '/' hexlify(IMAGE_ID) / version-scheme: -1 / => &(sevsnpvm-familyimageid-hex: -1) } ~~~ where hexlify is a function that translates the a byte string to its hexadecimal string encoding.¶

• The &(svn: 1) codepoint SHALL be set to 552(GUEST_SVN).¶

• The &(digests: 2) codepoint is in the triple record.¶

• The &(flags: 3) / flags-map codepoints prefixed by sevsnpvm-policy SHALL be set in the triple's &(flags: 3) entry as per above translation rules.¶

3.1.3.4. Key digest comparison

When ID_BLOCK is used, the full key information needed for signature verification is provided by the VMM at launch in an ID_AUTH structure. The SNP firmware verifies the signatures and adds digests of the signing key(s) to the attestation report as evidence of successful signature verification. When a Verifier does not have access to the original public key information used in ID_AUTH, the attestation report key digests can still be used as a representation of authority.¶

The APPENDIX: Digital Signatures section of [SEV-SNP.API] specifies a representation of public keys and signatures. An attestation report key digest will be a SHA-384 digest of the 0x403 byte buffer representation of a public key. If an author key is used, its signature of the ID_KEY is assumed to exist and have passed given the SNP firmware specification.¶

If a $crypto-key-type-choice key representation specifies an algorithm and parameters that are included in the Digital Signatures appendix, it is comparable to a #6.32780-tagged byte string.¶

• Two #6.32780-tagged byte strings match if and only if their encodings are bitwise equal.¶

• A thumbprint representation of a key is not comparable to a #6.32780-tagged byte string since the parameters are not extractable.¶

• A PKIX public key (#6.554-tagged tstr) or PKIX certificate (#6.555-tagged tstr) MAY be comparable to a #6.32780-tagged byte string.¶

The [RFC3280] specified AlgorithmIdentifier has optional parameters based on the algorithm identifier. The AMD signature algorithm 1h corresponds to algorithm ecdsa-with-sha384 from section 3.2 of [RFC5758], but the parameters MUST be omitted. The SubjectPublicKeyInfo is therefore id-ecPublicKey from section 2.1.1 of [RFC5480] to further allow the curve to be specified, despite not further specifying that the signature is of a SHA-384 digest. The AMD ECSDA curve name 2h corresponds to named curve secp384r1 from section 2.2 of [RFC5480]. The ECPoint conversion routines in section 2 of [SEC1] provide guidance on how the QX and QY little-endian big integers zero-padded to 72 bytes may be constructed.¶

3.2.2.1. Example VMM reference values for VMSA

Qemu, AWS Elastic Compute Cloud (EC2), and Google Compute Engine (GCE), all use KVM, which initializes cr4 and efer to non-default values. The values for cr4 and efer are different from the SPM to allow for PSE (page size extension) SVME (secure virtual machine enable).¶

Only Qemu follows the [AMD.SPM] specification for rdx, which is to match the family/model/stepping of the chip used. GCE provides an rdx of 0x600 regardless (following the Intel spec), and EC2 provides 0 regardless. GCE sets the G_PAT (guest page attribute table) register to 0x70406 to disable PA4-PA7. Both Qemu and GCE set the tr attrib to 0x8b, so it starts as a busy 32-bit TSS instead of the default 16-bit. GCE sets ds, es, fs, gs, and ss attributes to 0x93 since that's the initial state on Intel processors and that works fine too.¶

Qemu uses the Intel INIT state for the x87 floating point control word (0x37f), but 0 for the x87 floating point tag word.¶

3.3.4.1. OVMF data

The GUID table at the end of the ROM is terminated by the GUID 96b582de-1fb2-45f7-baea-a366c55a082d starting at offset ROM_end - 0x30. At offset ROM_end - 0x32 there is a length in a 16-bit little endian unsigned integer. At offset ROM_end - 0x32 - length there is a table with format¶

LE_UINT16 is the type of a little endian 16-bit unsigned integer. EFI_GUID is the UUID format specified in section 4 of [RFC4122]. The footer GUID and length specifies the length of the table of entries itself, which does not include the footer.¶

Within this table there is an entry that specifies the guest physical address that contains the SevMetadata.¶

At this address when loaded, or at offset ROM_end - (4GiB - Address), the SevMetadata,¶

The Signature value should be 'A', 'S', 'E', 'V' or "VESA" in big-endian order: 0x56455341. Where SevMetadataSection is¶

A section references some slice of guest physical memory that has a certain purpose as labeled by Kind:¶

The memory allocated to the initial UEFI boot phase, SEC, is unmeasured but must be marked for encryption without needing the GHCB or MSR protocol. The SEC_MEM sections contain the initial GHCB pages, page tables, and temporary memory for stack and heap. The secrets section is memory allocated specifically for holding secrets that the AMD-SP populates at launch. The cpuid section is memory allocated to the CPUID source of truth, which shouldn't be measured for portability and host security, but should be verified by AMD-SP for validity. The SVSM calling area address section is to enable the firmware to communicate with a secure VM services module running at VMPL0. The kernel hashes section is populated with expected measurements when boot advances to load Linux directly and must fail if the disk contents' digests disagree with the measured hashes.¶

The producer of the OVMF binary may therefore decide to sign a verbose representation or a compact representation. A verbose representation would have hundreds of updates given that every 4KiB page must be represented. For an initial example, consider the 2MiB OVMF ROM's 512 4KiB updates as the baseline, and the metadata as individual measurements afterwards.¶

/ sevsnp-launch-configuration-map / {
  / sevsnp-launch-update-baseline: / 1 =>
    h'70698b35cd5368eb11d27fa2162b7fe5d72d2471efd832598f6815115b08b420259a74fe0954f4dccfa8b9254c1dd4bb'
  / sevsnpvm-launch-updates: / 2 => [
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x800000
      / seq-no: / 5 => 1
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x801000
      / seq-no: / 5 => 2
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x802000
      / seq-no: / 5 => 3
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x803000
      / seq-no: / 5 => 4
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x804000
      / seq-no: / 5 => 5
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x805000
      / seq-no: / 5 => 6
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x806000
      / seq-no: / 5 => 7
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x807000
      / seq-no: / 5 => 8
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x808000
      / seq-no: / 5 => 9
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x80A000
      / seq-no: / 5 => 10
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x80B000
      / seq-no: / 5 => 11
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x80C000
      / seq-no: / 5 => 12
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 5
      / gpa: / 2 => 0x80D000
      / seq-no: / 5 => 13
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 6
      / gpa: / 2 => 0x80E000
      / seq-no: / 5 => 14
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 3
      / gpa: / 2 => 0x80F000
      / seq-no: / 5 => 15
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 1
      / gpa: / 2 => 0x810000
      / seq-no: / 5 => 16
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x811000
      / seq-no: / 5 => 17
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x812000
      / seq-no: / 5 => 18
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x813000
      / seq-no: / 5 => 19
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x814000
      / seq-no: / 5 => 20
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x815000
      / seq-no: / 5 => 21
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x816000
      / seq-no: / 5 => 22
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x817000
      / seq-no: / 5 => 23
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x818000
      / seq-no: / 5 => 24
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x819000
      / seq-no: / 5 => 25
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81A000
      / seq-no: / 5 => 26
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81B000
      / seq-no: / 5 => 27
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81C000
      / seq-no: / 5 => 28
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81D000
      / seq-no: / 5 => 29
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81E000
      / seq-no: / 5 => 30
    },
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 4
      / gpa: / 2 => 0x81F000
      / seq-no: / 5 => 31
    },
  ]
  / ap-vmsa: 4 / => #6.32781({
    / cs: / 1 => / svm-vmcb-seg-map / {/ base: / 3 => 0x800000}
    / rip: / 37 => 0xb004
  })
}

In this example the SEV-ES reset vector is located at 0x80b004. The AP RIP is the lower word and the CS_BASE is the upper word. The first unmeasured section is for the SEC stage page tables up to GHCB at address 0x800000, which has 9 pages accounted for in sequence. The second unmeasured section is for the GHCB page up to secrets at address 0x80A000, which has 3 pages accounted for in sequence. The secrets page is at address 0x80D000. The CPUID page is at address rx80E000. The svsm calling area page address is 0x80F000. The launch secrets and kernel hashes are at address 0x810000 and fit in 1 page. The location of the final unmeasured pages are for the APIC page tables and PEI temporary memory. The final section after the svsm calling area and kernel hashes up to the PEI firmware volume base, so 0x811000 up to 0x820000 for another 15 pages.¶

A more compact representation can take advantage of the fact that several of the first update commands are driven entirely by the firmware. The firmware author may then decide to reorder the section processing to ensure the kernel hashes are last, as there is no requirement for sequential GPAs. The baseline contains the initial ROM plus all the sections that don't have a dependency on external measured information. Thanks to the section reordering, only the SEV_KERNEL_HASHES need to be called out in the signed configuration.¶

/ sevsnp-launch-configuration-map / {
  / sevsnp-launch-update-baseline: / 1 =>
    h'5b01655cda55211f900fbd073ec36882400453eec9dba3ed63be7353798850ae561625a0f6e5f136e8c4e196fcbca45f'
  / sevsnpvm-launch-updates: / 2 => [
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 1
      / gpa: / 2 => 0x810000
      / seq-no: / 5 => 1
    },
  ]
  / ap-vmsa: 4 / => #6.32781({
    / cs: / 1 => / svm-vmcb-seg-map / {/ base: / 3 => 0x800000}
    / rip: / 37 => 0xb004
  })
}

3.3.4.2. Kernel data

The OVMF image may be provided by a different vendor than the OS disk image. The user of the VM platform may not have direct access to reference values ahead of time to countersign their combination. The kernel hashes become an input to the control plane that are then fed to the construction of the VM launch. The provider of the OS disk image then is responsible for signing the reference values for kernel hashes. The order in which kernel hashes are loaded, and at which address is irrelevant provided the attestation policy requires some signed value in the end, so the signer does not provide either the gpa or seq-no values.¶

/ sevsnp-launch-configuration-map / {
  / sevsnpvm-launch-updates: / 2 => [
    / sevsnp-launch-update-data-map / {
      / page-type: / 0 => 1
      / content: / 2 => / digest / [ 7, h'111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111' ]
    }
  ]
}

The digest is of a Qemu data structure that contains different digests of content from the command line.¶