Skip to content

Misleading display of new V5 attestation report fields (TIO_EN, PAGE_SWAP_DISABLE) on V3/V4 reports #330

Open

Description

@hyperfinitism

When parsing and displaying attestation reports, the sev crate currently shows newly introduced bitfields TIO_EN (in PLATFORM_INFO) and PAGE_SWAP_DISABLE (in GUEST_POLICY) (both added in ABI Rev 1.58) as false for older reports (e.g. V3, V4).

This behavior can be misleading because these fields did not exist in earlier versions of the attestation report. Displaying them as false may suggest that the feature is explicitly disabled, while in reality the field is simply not present.

These fields should be represented as None rather than false when parsing V3/V4 reports. This would be consistent with how other fields introduced in ABI Rev 1.58 (LAUNCH_MIT_VECTOR and CURRENT_MIT_VECTOR) are currently handled.

Example

  • Azure DCasv6 (Genoa)
  • OS: Ubuntu 24.04 LTS (CVM)
  • Kernel: 6.11.0-1018-azure
Attestation Report of V3 (selected)
Attestation Report:

Version:                      3

Guest SVN:                    65547

Guest Policy (0x3001f):
  ABI Major:     0
  ABI Minor:     31
  SMT Allowed:   true
  Migrate MA:    false
  Debug Allowed: false
  Single Socket: false
  CXL Allowed:   false
  AEX 256 XTS:   false
  RAPL Allowed:  false
  Ciphertext hiding: false
  Page Swap Disable: false

...

  Microcode:   84
  SNP:         23
  TEE:         0
  Boot Loader: 10
  FMC:         None

Platform Info (39):
  SMT Enabled:               true
  TSME Enabled:              true
  ECC Enabled:               true
  RAPL Disabled:             false
  Ciphertext Hiding Enabled: false
  Alias Check Complete:      true
  SEV-TIO Enabled:           false

...

Reported TCB:

TCB Version:
  Microcode:   84
  SNP:         23
  TEE:         0
  Boot Loader: 10
  FMC:         None

...

Launch Mitigation Vector:     None

Current Mitigation Vector:    None

...

Activity

  1. DGonzalezVillal commented on Apr 2, 2026

    @DGonzalezVillal
    Member

    Hello @hyperfinitism I have attempted to resolve this issue in this PR:
    #378

    So I noticed that guest policy and platform info are their own independent structures and not necessarily tied to the version of the attestation report. So I'm using the firmware version to parse these fields rather than report version. Would love your thoughts on this approach!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions