On Wed, Sep 22, 2021 at 09:55:58AM +0200, Gerd Hoffmann wrote: > Hi, > > > + ; If SEV-SNP is enabled, use the CPUID page to handle the CPUID > > + ; instruction. > > + mov ecx, SEV_STATUS_MSR > > + rdmsr > > + bt eax, 2 > > + jc SnpCpuidLookup > > Maybe check SNP_CPUID_COUNT instead, so the cpuid page can also be used > without SEV-SNP ?
One issue with that is that the contents of the CPUID page are not part of guest measurement that will be checked later during attestation (only the metadata such as page type/location is recorded in the measurement). So if someone on the host slipped in, say, a malicious QEMU, and modified it to zero out the CPUID page prior to launching the guest, it would end up being accepted by firmware as legitimate CPUID table encoding 0 entries. So implementing the check based on SNP_CPUID_COUNT would make it easy to bypass the CPUID page in such a scenario, and even worse, they'd be able to get all the way past attestation, since the CPUID metadata is the same, it's only the contents that have changed. Since the CPUID page is required by SNP, the approach taken here is to always utilize it when SNP is enabled. In that case, if someone were to maliciously zero out the CPUID page, it would still get used by the guest, rather than bypassed, in which case the guest would never make it to attestation since bits that get checked for early like SEV/SEV-ES/SEV-SNP flags in 0x8000001F would all be 0. That said, for the !SNP case, additional handling *could* be added to make use of the CPUID page, but in that case it wouldn't be validated by firmware, so isn't much better security-wise than asking KVM. It might be possible to bake the CPUID page into the measurement to ensure integrity, but that requires accounting for the CPUID page along with all the other elements of the initial payload (like OVMF), and unlike with OVMF, the CPUID values will vary often depending on guest configuration, and so cloud providers would need to provide some sort of tooling to export this CPUID page to the guest owner so it can be verified and accounted for in attestation, which doesn't seem likely to get much uptake (and is probably at least partly why the CPUID page contents aren't included in the measurement for SNP). > > take care, > Gerd > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81008): https://edk2.groups.io/g/devel/message/81008 Mute This Topic: https://groups.io/mt/85749022/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
