[Feature]: AMD CPU state attestation

[rvolosatovs]

Is there an existing issue for this?

• I have searched the existing issues

Description

From https://hackmd.io/zx6x0HHrTeuSvf8r9OhG5w

The attestation of the workload includes the CPU state information.
When the workload running in the AMD keep exits, the system stores the state in the special area (VMSA). When the workload is started again, it loads the state back. This is a well-defined process and works.
The initial state, however, needs to be better defined. Currently, it is defined by Kernel without userspace knowledge or ability to influence. As a result, Enarx does not know the initial state and has to guess. If it guesses right the attestation would include the correct data and everything would check out. If Enarx guesses wrong the attestation of the workload would be incorrect.
VMSA MUST be public, since all parties need to agree on it. So the kernel choosing this information on its own and making everyone guess is unexpected behavior.

There are two questions:

Who chooses the initial state?
How is the initial state communicated to all other parties?

If the kernel chooses the initial state, it MUST communicate it to userspace. But this makes the process fragile. Every kernel version might choose a different initial state. So this is very bad for implementation stability.
Our preferred approach is that userspace chooses the initial value and communicates it to the kernel (and other parties).
The kernel can still choose to reject this initial state if it doesn’t like it. But userspace gets more stability this way.

Acceptance Criteria

• The Kernel should have a way for the user space to provide input regarding the initial state. The kernel might reject requests from the user space if the request does not meet the criteria that Kernel defines. But there must be a way for the userspace to define it.
• Kernel must publicly communicate the state it set (returning the corrected VMSA?).
• Kernel should rarely (never?) change its mind about what it rejects.

Suggestions for a technical implementation

• We must propose Kernel changes to AMD to address the situation and allow userspace to influence the parameters of the initial state.
• The Kernel must provide a way for user space to know the initial state that Kernel has chosen based on the userspace request.

[rvolosatovs]

A follow-up shim work will be required in https://github.com/enarx/enarx