Re: [PATCH v9 38/43] x86/sev: Use firmware-validated CPUID for SEV-SNP guests

On Sat, Feb 05, 2022 at 11:19:01AM -0600, Michael Roth wrote:

I mentioned the concern you raised about out-of-spec hypervisors
using non-zero for Reserved fields, and potentially breaking future
guests that attempt to make use of them if they ever get re-purposed
for some other functionality, but their take on that is that such a
hypervisor is clearly out-of-spec, and would not be supported.

Yah, like stating that something should not be done in the spec is
going to stop people from doing it anyway. You folks need to understand
one thing: the smaller the attack surface, the better. And you need to
*enforce* that - not state it in a spec. No one cares about the spec
when it comes to poking holes in the architecture. And people do poke
and will poke holes *especially* in this architecture, as its main goal
is security.

Another possibility is enforcing 0 in the firmware itself.

Yes, this is the thing to do. If they're going to be reused in the
future, then guests can be changed to handle that. Like we do all the
time anyway.

So given their guidance on the Reserved fields, and your guidance
on not doing the other sanity-checks, my current plan to to drop
snp_check_cpuid_table() completely for v10, but if you have other
thoughts on that just let me know.

Yes, and pls fix the firmware to zero them out, because from reading
your very detailed explanation - btw, thanks for taking the time to
explain properly what's not in the ABI doc:

https://lore.kernel.org/r/20220205154243.s33gwghqwbb4efyl@amd.com (local)

it sounds like those two input fields are not really needed. So the
earlier you fix them in the firmware and deprecate them, the better.

Thx!

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette