Re: [PATCH v8 08/32] OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values

[Michael Roth <michael.roth@amd.com>]

On Wed, Sep 22, 2021 at 09:55:58AM +0200, Gerd Hoffmann wrote:
>   Hi,
> 
> > +    ; If SEV-SNP is enabled, use the CPUID page to handle the CPUID
> > +    ; instruction.
> > +    mov     ecx, SEV_STATUS_MSR
> > +    rdmsr
> > +    bt      eax, 2
> > +    jc      SnpCpuidLookup
> 
> Maybe check SNP_CPUID_COUNT instead, so the cpuid page can also be used
> without SEV-SNP ?

One issue with that is that the contents of the CPUID page are not part
of guest measurement that will be checked later during attestation (only
the metadata such as page type/location is recorded in the measurement).

So if someone on the host slipped in, say, a malicious QEMU, and modified
it to zero out the CPUID page prior to launching the guest, it would end up
being accepted by firmware as legitimate CPUID table encoding 0 entries. So
implementing the check based on SNP_CPUID_COUNT would make it easy to bypass
the CPUID page in such a scenario, and even worse, they'd be able to get
all the way past attestation, since the CPUID metadata is the same, it's
only the contents that have changed.

Since the CPUID page is required by SNP, the approach taken here is to
always utilize it when SNP is enabled. In that case, if someone were to
maliciously zero out the CPUID page, it would still get used by the
guest, rather than bypassed, in which case the guest would never make it
to attestation since bits that get checked for early like
SEV/SEV-ES/SEV-SNP flags in 0x8000001F would all be 0.

That said, for the !SNP case, additional handling *could* be added to make
use of the CPUID page, but in that case it wouldn't be validated by firmware,
so isn't much better security-wise than asking KVM. It might be possible to
bake the CPUID page into the measurement to ensure integrity, but that
requires accounting for the CPUID page along with all the other elements of
the initial payload (like OVMF), and unlike with OVMF, the CPUID values
will vary often depending on guest configuration, and so cloud providers
would need to provide some sort of tooling to export this CPUID page to the
guest owner so it can be verified and accounted for in attestation, which
doesn't seem likely to get much uptake (and is probably at least partly why
the CPUID page contents aren't included in the measurement for SNP).

> 
> take care,
>   Gerd
>