From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (NAM10-DM6-obe.outbound.protection.outlook.com [40.107.93.75]) by mx.groups.io with SMTP id smtpd.web12.584.1632352224377847822 for ; Wed, 22 Sep 2021 16:10:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=SkRqDOc7; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.93.75, mailfrom: michael.roth@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gwqa+kbfMR4mU4FYXsVnahtWqGnf8tPCH1tAZwYVqHQ8fA0aohIqBQxGrNDEGMH0ikuqNSzIBraX194kv5Ov+xl6d+5DbJlKk6mNw5Bm0x+NdajqVFrBKHZdNXPgGWxTkOjCAFfBi2uaXbbyMZPfssO0OSW9Sa2FzudPPJJla9qjOTaKC9Q49nOj/jGcubrhzi7wOa4lM3nn3WctsSWW8G6yjT73ocm0o40gtG1lCIrD5xNSf7WyASgRRuLWW2kuNlSc+ih4uOfvTsMPeBEgGdmNT0BMPxL6tpFhNKvylPEpxJLax1/y60gnTtcoo43BHkTXqTGJN1dlfW0AQAH3vw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ZE+bw7w/gpLnBgnrnLho4PTuOuTMpK5am8012MxLXJg=; b=f2tTxYuZfs8KMFZDT1FctZbHJPkQ1Csr4+4VNmI0PjfbOJcSweyptf813eblvc1BcSR/7ep+xhgIxEe+1KbZMPEoPfrAvWiWjyLfW2gJTLbwaYXjDmT2K7VP5Tlaid7KuypjDxUyZ2e4NYZyQqzhpmHH7b3YK2mvSdsN92VRQUp0qGMlLSmwlsgfYREhd5yDtuYlr1r2vE2wX4JoRcGpVSXJGAL1x8lNTcodQttIz9Z+2KQQzUq9as7ad/mbu7jbN4wYP3gm53+InIXgOi37Y1EVDrCJIa29vlBjxgCqbRfPpB9bVczYV//iZM9opW8sXeRu96v/O1iiV6Cw8cRbcA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZE+bw7w/gpLnBgnrnLho4PTuOuTMpK5am8012MxLXJg=; b=SkRqDOc7dAJQqhpn1e8TPezGHDDBvoh2VJsWsjAJS2z53eBn0dujDA9iFsYcTTxH+VgvxzLFRS2NVrz97LxGt6eXU3QTY/lV2KPt6w8FbY4xOyzv2hDAfF8Koe4bncIX0Ij0F2BIKbFSRPRSqlzoX2Q68XuyvXjQvT+Vc4n3fFM= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from CH2PR12MB4133.namprd12.prod.outlook.com (2603:10b6:610:7a::13) by CH2PR12MB4054.namprd12.prod.outlook.com (2603:10b6:610:a6::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.13; Wed, 22 Sep 2021 23:10:22 +0000 Received: from CH2PR12MB4133.namprd12.prod.outlook.com ([fe80::f5af:373a:5a75:c353]) by CH2PR12MB4133.namprd12.prod.outlook.com ([fe80::f5af:373a:5a75:c353%8]) with mapi id 15.20.4544.013; Wed, 22 Sep 2021 23:10:22 +0000 Date: Wed, 22 Sep 2021 18:10:07 -0500 From: Michael Roth To: Gerd Hoffmann Cc: Brijesh Singh , devel@edk2.groups.io, James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas Subject: Re: [PATCH v8 08/32] OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values Message-ID: <20210922231007.566nxiaqagtwjlps@amd.com> References: <20210920184604.31590-1-brijesh.singh@amd.com> <20210920184604.31590-9-brijesh.singh@amd.com> <20210922075558.zpbcyceegytfumqq@sirius.home.kraxel.org> In-Reply-To: <20210922075558.zpbcyceegytfumqq@sirius.home.kraxel.org> X-ClientProxiedBy: SN4PR0501CA0082.namprd05.prod.outlook.com (2603:10b6:803:22::20) To CH2PR12MB4133.namprd12.prod.outlook.com (2603:10b6:610:7a::13) Return-Path: Michael.Roth@amd.com MIME-Version: 1.0 Received: from localhost (165.204.77.1) by SN4PR0501CA0082.namprd05.prod.outlook.com (2603:10b6:803:22::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.6 via Frontend Transport; Wed, 22 Sep 2021 23:10:22 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 919fa12a-3ae2-44ff-0081-08d97e1e2769 X-MS-TrafficTypeDiagnostic: CH2PR12MB4054: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: mhbHEvfTaw5+0I7i3OKl4ss5V4bma2dEnAbB/RRfOuV5PHphQhqz3u/spx50Kiqn6LfO/od3ntqK0DgE/ACiowkoNY/tu80DlgDp21/58NbYpxq5ndG1EoeB02naFyE+lDUnXpicKm+iOvO6hkzGGlLHn+T8Cv3FXgdKEigHyhyrly+i/q3bKYfpdNHAC8rUi3IqJHcifMvRDGiyHa/6EngAIw/m3hXyI+mXeqeILt1SOb3kJiiNLBkLQFexCSc5hDFIWtmPRAE3lgQ5EZ9W0ocxov2aCLBZ5Liq+cmx+3kvzTcSLT49W2i3OajNlklh5VyU9l9NPzJMTE24uhY43O4AX95nf7YkZbsAdX0pG40skpujBijs5pteP/Hz6nQglWfOUwzfVT25v2nh31FkTifuYuL+8HTARwEEzU3Jzur+/hzpSYzzXiZAAE3BquKieyktdwCQEKy2FkATAlaAp7DQnra7jX45gAHUsWsZ4MoDRP4wOcLCksqsJOfzA3eSXcy7b1ldIWlbhKB0bckpJiOpJHXO8kvA3DAyMWGTPnipvTevt/dLZKZWW0XoXDfo04n4hxLqaS0Sx58yVFfZO0EBh5WPQMk06bCylVg+bCKDJSeQRyMP9zBMRpnzWKUqd47KXbneLN2Z3ohtselmCh0t/gXEVi7zWFYH1wwdGPztHbYp+PELfxZwNrEi+XtOCSx1bRQ4ME47gd7i6NcJRQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR12MB4133.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(36756003)(6666004)(83380400001)(6486002)(38350700002)(956004)(186003)(86362001)(44832011)(15650500001)(4326008)(66476007)(66946007)(66556008)(8936002)(2906002)(38100700002)(1076003)(8676002)(316002)(6916009)(54906003)(26005)(508600001)(6496006)(2616005)(5660300002)(52116002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MYPyRDOLHFH9NNzVJKmjcGT3qEVLho63NEBhyIwSXvnozutNUMfWo21qVBEf?= =?us-ascii?Q?6frcm06epSkYO8S5Nw6gwpkeAayGDZlt4zfrOqXBXqJkIbgqI+4GW7eDkDP8?= =?us-ascii?Q?os0w+vZ/iQQYHFDbNevQjJJ5nPjm9ukvU+3NZ/fk8mcro6PZTyFpn9flauSR?= =?us-ascii?Q?NmpcMTFFqgU9S+nm5GVVUtr1FAM9epFZKaQhTbcslkTIv/DiFenvCyPO3oHJ?= =?us-ascii?Q?cukrZOeuGmry4EcQvvip9nA5+YoHgAulcs+9UaVvYkxuzGROYWY5oo7WEonN?= =?us-ascii?Q?lX3eqGiQtxhwRXq89+0hF0Yuh3cWrolELNxgQbacWjlo5gQWlRG7SaYCjeZD?= =?us-ascii?Q?5hgmhP8pkIDM7xm/tTJrU7qZCp+NOfsTweu3mj/v44w/YdZ+VDoe8hImXbJ2?= =?us-ascii?Q?fx92bdchvuwbyiDUr+5drw+7odPVrqbR2FLqroD7qYJP1RTWcROg36PW1K2U?= =?us-ascii?Q?NGRBavylHrm3lC+rOsCGlnQjGeDGpWCB0lnzu7Jr5ELldpuE0qPAYsxFyoYi?= =?us-ascii?Q?IioiowKOC0SvRXuEW1ssKkmYUn+JEyZJXW+ESRl+SKvRS/gvLCn+NVDK5bHR?= =?us-ascii?Q?BdovHbRcm5RK/L7jIKAnqgjNXHAycy3/98lF4Kj1SI41R/BdmHlwsBCYUh+g?= =?us-ascii?Q?ORJxslTwUMIYSDloPWOk6W9M33MGSWzXncRKjBrD6N79p6ZrG6pnUpfijvvI?= =?us-ascii?Q?V0gOoFrHT+M499pOvcxeYpQW28eEjFyRwx3E1F8EFd6ii8DUqi5YMO2dwGIF?= =?us-ascii?Q?q0joVMoT1er9NCXoIjAjCZys6HhhNpEumdcHBfC71/CYXrnPr7GJPYXpfqEA?= =?us-ascii?Q?SeOkqRcbutc18QYYOpYOIU9aPjKQvow48DqdmN/2IE9ft5E/FRXN0e+w0GwI?= =?us-ascii?Q?9opbLSi5qWz+vpyzViPynO+OFy1AZAkhbJ3Es68U1oQ3+uTWKoCEZnm7ZZFz?= =?us-ascii?Q?tQqsoY/p4xZWNbL/SJcRG12ZgU1+DOxDc3MGy4nh0/LJvDDvzntrfgKH7EMf?= =?us-ascii?Q?wRSB679sSJ2zPSM0+k5WaYWHzLZizO8h4SSFKEgXG75Qmm1pP+206Gc4v30+?= =?us-ascii?Q?qCFa/mmGxoz7kJ0pTKVjoivg45Wd1d+10jffLbcBAn/BGQUFwCxKABIH/Lku?= =?us-ascii?Q?Nce3HCm+EzwyaBp4vi7O8iXD3rqxZCUtl8+iHPpqD76DNbhfDUnaoyuPlNpT?= =?us-ascii?Q?wFQXsWtzx7zusDq/L0sD14eoMOTne19qoLE/WJETTzI9+n1VVx6OgkWTU9sb?= =?us-ascii?Q?rJX9ONAHDwlaAcDYmwwCQk26XEUHzeQdMd3zM4/XvZEFIvd06GAr8uKuhGUg?= =?us-ascii?Q?sZX4WS1KG//XpuEiY2vM3r4G?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 919fa12a-3ae2-44ff-0081-08d97e1e2769 X-MS-Exchange-CrossTenant-AuthSource: CH2PR12MB4133.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Sep 2021 23:10:22.7864 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: SxQXBuJhp16O73KUix+NdS9jb0XLUS13lDUs8FzX9a5Z/KD72MqSjKVbL6Rc/kjPJWG/IMDircquOG1g5mlUOA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4054 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Sep 22, 2021 at 09:55:58AM +0200, Gerd Hoffmann wrote: > Hi, > > > + ; If SEV-SNP is enabled, use the CPUID page to handle the CPUID > > + ; instruction. > > + mov ecx, SEV_STATUS_MSR > > + rdmsr > > + bt eax, 2 > > + jc SnpCpuidLookup > > Maybe check SNP_CPUID_COUNT instead, so the cpuid page can also be used > without SEV-SNP ? One issue with that is that the contents of the CPUID page are not part of guest measurement that will be checked later during attestation (only the metadata such as page type/location is recorded in the measurement). So if someone on the host slipped in, say, a malicious QEMU, and modified it to zero out the CPUID page prior to launching the guest, it would end up being accepted by firmware as legitimate CPUID table encoding 0 entries. So implementing the check based on SNP_CPUID_COUNT would make it easy to bypass the CPUID page in such a scenario, and even worse, they'd be able to get all the way past attestation, since the CPUID metadata is the same, it's only the contents that have changed. Since the CPUID page is required by SNP, the approach taken here is to always utilize it when SNP is enabled. In that case, if someone were to maliciously zero out the CPUID page, it would still get used by the guest, rather than bypassed, in which case the guest would never make it to attestation since bits that get checked for early like SEV/SEV-ES/SEV-SNP flags in 0x8000001F would all be 0. That said, for the !SNP case, additional handling *could* be added to make use of the CPUID page, but in that case it wouldn't be validated by firmware, so isn't much better security-wise than asking KVM. It might be possible to bake the CPUID page into the measurement to ensure integrity, but that requires accounting for the CPUID page along with all the other elements of the initial payload (like OVMF), and unlike with OVMF, the CPUID values will vary often depending on guest configuration, and so cloud providers would need to provide some sort of tooling to export this CPUID page to the guest owner so it can be verified and accounted for in attestation, which doesn't seem likely to get much uptake (and is probably at least partly why the CPUID page contents aren't included in the measurement for SNP). > > take care, > Gerd >