Missing support for adding certificate chains to the hypervisor memory

[ngiraud99]

Hi,

I'm currently looking for an option to add a certificate-chain to the hypervisor memory to be able to perform the extended attestation workflow on an SNP host.
Is there already a method in this project to do this?
I already had a look at the respective AMD Documentation and it seems that this feature is supported by AMD under section 2.2.2.

Thanks in advance!

[tylerfanelli]

Yes, it's supported, but is hypervisor-specific. I believe the documentation you're pointing to is showing how hypervisors importing this crate can easily store certificate chains in their memory using the API.

What hypervisor are you using?

[DGonzalezVillal]

This functionality was deprecated in most recent kernels, the workflow was changed to creating a ghcb file and then passing it to the VM through QEMU, although that was not up streamed on kernel 6.11. The functionality is still in development and the behavior is expected to change. I could provide further instructions on how to do it with the more current workflow if you are interested.

[tylerfanelli]

Closing as its not a snphost bug/feature.