Dev/cross cvm keys - #269
Closed
markg-github wants to merge 9 commits into
Closed
Conversation
See the last paragraph for more on ordering the new keys test. See README.md in modules/test/guest/key-derivation for more about the derived keys test, in general. Old TCB components (eg, PSP FW, microcode) can cause some guest tests to fail. In general, I don't think this should be the case, but if the TCB components are very old, then maybe it makes sense. By putting the derived keys test first, this test's contributions to the certificates should be present regardless of how old the TCB components are. Note that preserving the derived keys test contributions could also be achieved by using Wants= instead of Requires= for the services corresponding to the tests that fail due to the old TCB components.
Co-Authored-By: Claude <noreply@anthropic.com>
Always verify that values above the active bound are rejected, even when the bound is 0 (no ID block). Tests 3 values above the bound for both guest SVN and each TCB component. Co-Authored-By: Claude <noreply@anthropic.com>
Import calculate_measurement from attestation_test instead of duplicating it. Conditionally add generate_id_block step when sev_verify.id_block is available. Co-Authored-By: Claude <noreply@anthropic.com>
Same fix as pr/id-block — snphost ok can report failures on systems that are otherwise fully functional for SNP guest testing. Co-Authored-By: Claude <noreply@anthropic.com>
…heck Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR adds a more comprehensive SEV-SNP key-derivation test that (a) runs an in-guest key-derivation test suite and (b) verifies cross-CVM determinism by launching two guests sequentially and comparing derived keys. It also wires the new guest test into the guest image build and the host-side certificate/report generation pipeline.
Changes:
- Add a new certification test (
3.0.0-2) that launches two CVMs sequentially and compares derived keys across them. - Add a new guest module/systemd service plus Python test runner for SNP key derivation.
- Extend host reporting to include key-derivation test results in the generated SEV certificate summary, and update guest log display tooling.
Reviewed changes
Copilot reviewed 12 out of 13 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| sev_verify/cert_tests/common/snp_ok.py | Changes prerequisite step severity for snphost ok. |
| sev_verify/cert_tests/c3_0/manifest.toml | Registers new 3.0.0-2 key derivation test in the certification manifest. |
| sev_verify/cert_tests/c3_0/c3_0_0_2/key_derivation_test.py | New mixed-scope test: launch guest(s), run derivation tests, pull artifacts, compare cross-CVM keys. |
| sev_verify/cert_tests/c3_0/c3_0_0_2/init.py | Package marker for the new test module directory. |
| modules/test/guest/test-done/mkosi.extra/usr/local/lib/systemd/system/test-done.service | Ensures the guest “done” barrier waits for key-derivation.service as well. |
| modules/test/guest/mkosi.conf | Includes the new key-derivation guest module in the test guest image composition. |
| modules/test/guest/key-derivation/README.md | Documents the guest-side key-derivation service and the test suite behavior. |
| modules/test/guest/key-derivation/mkosi.extra/usr/local/lib/systemd/system/key-derivation.service | New systemd unit to run the key derivation tests on guest boot. |
| modules/test/guest/key-derivation/mkosi.extra/usr/local/lib/scripts/snpguest_key_derivation.py | New in-guest Python test runner that exercises SNP_DERIVE_KEY-related properties. |
| modules/report/host/sev-certificate-generator/.../sev_certificate_version_3_0_0_0.py | Adds parsing/summary of key-derivation.service JSON output into the certificate report. |
| modules/report/host/sev-certificate-generator/.../service/service.py | Improves robustness when parsing a service description line from journald output. |
| modules/report/host/display-guest-logs/.../display-guest-logs.sh | Includes key-derivation.service in the collected guest logs; prints a timeout message. |
| modules/build/guest/mkosi.conf | Adds Python to the guest build to support the new key derivation test runner. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Step.for_host( | ||
| name="snphost ok", | ||
| type="required", | ||
| type="info", |
Comment on lines
+13
to
+14
| Packages= | ||
| python3 |
Comment on lines
+50
to
+52
| key1 = (ctx.artifact_dir / "cross_cvm_key_1.bin").read_bytes() | ||
| key2 = (ctx.artifact_dir / "cross_cvm_key_2.bin").read_bytes() | ||
|
|
Comment on lines
+137
to
+139
| # Convert status codes to human-readable form (0=passed, non-zero=failed) | ||
| for step, status_code in key_derivation_data.items(): | ||
| key_derivation_data[step] = "passed" if int(status_code) == 0 else "failed" |
| This script tests the snpguest key derivation functionality, verifying: | ||
| 1. Deterministic key generation (same params -> same key) | ||
| 2. VMPL-based key isolation (different VMPL -> different keys) | ||
| 3. Root key differences (VCK vs VMRK -> different keys) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An even better derived keys test that takes advantage of sev_verify's ability to launch multiple guests in a single test. This is used in the improved keys test here to test whether the same key(s) can be derived in two guests.
I'm making this PR a draft for now since there's an existing, non-draft PR (#242) with a simpler (not as good) version of the test.