From owner-freebsd-virtualization@freebsd.org Mon Oct 14 18:52:37 2019 Return-Path: <owner-freebsd-virtualization@freebsd.org> Delivered-To: freebsd-virtualization@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4912913350B; Mon, 14 Oct 2019 18:52:37 +0000 (UTC) (envelope-from sjg@juniper.net) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.pphosted.com", Issuer "Thawte RSA CA 2018" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 46sSNh2cYyz3F88; Mon, 14 Oct 2019 18:52:36 +0000 (UTC) (envelope-from sjg@juniper.net) Received: from pps.filterd (m0108160.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x9EIqYJ7021781; Mon, 14 Oct 2019 11:52:34 -0700 Received: from nam05-dm3-obe.outbound.protection.outlook.com (mail-dm3nam05lp2056.outbound.protection.outlook.com [104.47.49.56]) by mx0b-00273201.pphosted.com with ESMTP id 2vmtf4rdj4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 14 Oct 2019 11:52:34 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kQnFGEmKSzp/mcGzwYnFww9WnRaZ/pFWS0XJMJJJD2ZOoqrhF7mnfjj2tqg0bAmnDZSRDQJ2Vz7VdPS1haVz30x9nMH4XgyphDVcgFllTGmXJEuq4usoS+ZocKhZPHQwpIlVladmuGCVYSBPhm+dTHOr73p2D9CCWJbWhyZUfMop1EzD1m9Rcqzv6z0oupyqOdPyc+2k6pjFvjKWOAwsz03rUgpcWiw0j6YKeySk0KViO6Y1J4r8nMIst4NvDxBNTyxl4ZoPW7TJONs02Fq9cqupT6dzglyl2IGJ3Gh4tnB/B7XWQ3YQynMLuKeq4gFf/uyo7nQELMZuOF/avwBs0Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7pbEtrnHkTUH1/Kq6lo58dRG1EnpGN12BLQFPBltO4I=; b=ix/tWmw36dLHf2S6gzYV76T2UBPfVQ/W9bQQXbT+Q1Fn20gqpq4BdAM9jclilMyslwE6mEgrgXu/IAUGMQy2/myLHTxK8OngUAarsiZHlgQP6ntGAaaoMCOlhTIoAzCtN91y3O0Z4o3LINF0cypz9siwySgDSLePWZEtJAetUW/qY4Tb3vEITfB5cUUQAWZXGdp0IVUNFzQmZQvH7HQ0SNKg/9Nv8nFN/0ZyjVnBGYvTkCawbIYhRPBwEVmCm2pzWRc1iebdI6FGAH3Eeu82k+bziRizqJcBfTAzL/qEWHLwSArF9x6fJ0xHO7gKDA9MvSFRCzkeGFOOh2RP3RPUMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=softfail (sender ip is 66.129.239.13) smtp.rcpttodomain=freebsd.org smtp.mailfrom=juniper.net; dmarc=fail (p=reject sp=reject pct=100) action=oreject header.from=juniper.net; dkim=none (message not signed); arc=none Received: from SN4PR0501CA0115.namprd05.prod.outlook.com (2603:10b6:803:42::32) by BN7PR05MB4353.namprd05.prod.outlook.com (2603:10b6:406:f6::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2347.13; Mon, 14 Oct 2019 18:52:32 +0000 Received: from DM3NAM05FT045.eop-nam05.prod.protection.outlook.com (2a01:111:f400:7e51::203) by SN4PR0501CA0115.outlook.office365.com (2603:10b6:803:42::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2367.5 via Frontend Transport; Mon, 14 Oct 2019 18:52:31 +0000 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning juniper.net discourages use of 66.129.239.13 as permitted sender) Received: from P-EXFEND-EQX-02.jnpr.net (66.129.239.13) by DM3NAM05FT045.mail.protection.outlook.com (10.152.98.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2367.5 via Frontend Transport; Mon, 14 Oct 2019 18:52:31 +0000 Received: from P-EXBEND-EQX-01.jnpr.net (10.104.8.52) by P-EXFEND-EQX-02.jnpr.net (10.104.8.55) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 14 Oct 2019 11:52:30 -0700 Received: from p-mailhub01.juniper.net (10.104.20.6) by P-EXBEND-EQX-01.jnpr.net (10.104.8.52) with Microsoft SMTP Server (TLS) id 15.0.1367.3 via Frontend Transport; Mon, 14 Oct 2019 11:52:30 -0700 Received: from kaos.jnpr.net (kaos.jnpr.net [172.23.50.162]) by p-mailhub01.juniper.net (8.14.4/8.11.3) with ESMTP id x9EIqTCI028584; Mon, 14 Oct 2019 11:52:29 -0700 (envelope-from sjg@juniper.net) Received: by kaos.jnpr.net (Postfix, from userid 1377) id 41BAC3463B; Mon, 14 Oct 2019 11:52:29 -0700 (PDT) Received: from kaos.jnpr.net (localhost [127.0.0.1]) by kaos.jnpr.net (Postfix) with ESMTP id 401733463A; Mon, 14 Oct 2019 11:52:29 -0700 (PDT) To: Tomasz CEDRO <tomek@cedro.info> CC: grarpamp <grarpamp@gmail.com>, <freebsd-security@freebsd.org>, <freebsd-current@freebsd.org>, <freebsd-virtualization@freebsd.org>, <sjg@juniper.net> Subject: Re: AMD Secure Encrypted Virtualization - FreeBSD Status? In-Reply-To: <CAFYkXj=f0NEQ+=WQ_y8_RZtOc3-+HkoBreAgRM669R6s4cWSmQ@mail.gmail.com> References: <CAD2Ti2-2TWZEcCdyg1seHHdWRVSC9v_kuMe4f-ERo1LNdJAnmw@mail.gmail.com> <CAFYkXj=f0NEQ+=WQ_y8_RZtOc3-+HkoBreAgRM669R6s4cWSmQ@mail.gmail.com> Comments: In-reply-to: Tomasz CEDRO <tomek@cedro.info> message dated "Thu, 03 Oct 2019 18:10:16 +0200." From: "Simon J. Gerraty" <sjg@juniper.net> X-Mailer: MH-E 8.6+git; nmh 1.7.1; GNU Emacs 26.1 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <75549.1571079149.1@kaos.jnpr.net> Date: Mon, 14 Oct 2019 11:52:29 -0700 Message-ID: <76102.1571079149@kaos.jnpr.net> X-EXCLAIMER-MD-CONFIG: e3cb0ff2-54e7-4646-8a04-0dae4ac7b136 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:66.129.239.13; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(39860400002)(396003)(136003)(376002)(346002)(199004)(189003)(76176011)(336012)(316002)(54906003)(16586007)(70206006)(70586007)(478600001)(2906002)(126002)(14444005)(486006)(97876018)(446003)(11346002)(7126003)(46406003)(4326008)(476003)(45080400002)(5660300002)(47776003)(53416004)(4744005)(50466002)(86362001)(23726003)(356004)(9686003)(6266002)(117636001)(55016002)(50226002)(6916009)(186003)(107886003)(8936002)(8676002)(81156014)(81166006)(26005)(229853002)(305945005)(7696005)(97756001)(76506006)(6246003)(6606295002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR05MB4353; H:P-EXFEND-EQX-02.jnpr.net; FPR:; SPF:SoftFail; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 85c6b498-dc7c-4cb1-47d9-08d750d7ab3b X-MS-TrafficTypeDiagnostic: BN7PR05MB4353: X-Microsoft-Antispam-PRVS: <BN7PR05MB4353A7E72317A9BDF1344A10AA900@BN7PR05MB4353.namprd05.prod.outlook.com> X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-Forefront-PRVS: 01901B3451 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: lR0z13dyPjSN89xCwTpEULla8Lv/MEHBhEY193I2sBd9wry8WEQV/R6QsmsbGzHDHenamf07eZo0nwpxC5O+i98WmlW2vWOOnd9TPzG96Xkmz730R3StWSFfiNeuEZRDxL/G5n6x6c+1dVaqT4XImGp/aX90FwL9gmKGdjl43jlHmAexnxor+ofMO5BxEq2UVq0MlQfGVBVDalGN5Nhen8Rm5eb856q4pPkQwfSOQhu+Ega7E1fJ20COsmWDB72czSCrM9AL8j6zIUdBmTDfMp+uhLDxOWrp0XJjcqmoW4VcR4TrZuW1n//bO6yKzodcPnHgdAuozYGk07AkosVZbEFaBFfiFXDD6gFeN4fS+snFHqJ/oqfYleADEk/rm+4d+iWRBWs6WLZrDhzfIFJuFbC+a6fseArjxnhi0uoxW5E= X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Oct 2019 18:52:31.6283 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 85c6b498-dc7c-4cb1-47d9-08d750d7ab3b X-MS-Exchange-CrossTenant-Id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bea78b3c-4cdb-4130-854a-1d193232e5f4; Ip=[66.129.239.13]; Helo=[P-EXFEND-EQX-02.jnpr.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB4353 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,1.0.8 definitions=2019-10-14_09:2019-10-11,2019-10-14 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 impostorscore=0 suspectscore=3 mlxscore=0 malwarescore=0 mlxlogscore=643 phishscore=0 adultscore=0 bulkscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1908290000 definitions=main-1910140153 X-Rspamd-Queue-Id: 46sSNh2cYyz3F88 X-Spamd-Bar: ---- X-Spamd-Result: default: False [-4.03 / 15.00]; RCVD_TLS_LAST(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[juniper.net:s=PPS1017]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:67.231.152.164]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[text/plain]; IP_SCORE(-0.93)[ip: (-2.15), ipnet: 67.231.152.0/24(-0.94), asn: 22843(-1.49), country: US(-0.05)]; ARC_ALLOW(-1.00)[i=1]; RCPT_COUNT_FIVE(0.00)[6]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[juniper.net:+]; DMARC_POLICY_ALLOW(-0.50)[juniper.net,reject]; RCVD_IN_DNSWL_LOW(-0.10)[164.152.231.67.list.dnswl.org : 127.0.3.1]; SUBJECT_ENDS_QUESTION(1.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:22843, ipnet:67.231.152.0/24, country:US]; FREEMAIL_CC(0.00)[gmail.com]; RCVD_COUNT_SEVEN(0.00)[10]; FROM_EQ_ENVFROM(0.00)[] X-BeenThere: freebsd-virtualization@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussion of various virtualization techniques FreeBSD supports." <freebsd-virtualization.freebsd.org> List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-virtualization>, <mailto:freebsd-virtualization-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-virtualization/> List-Post: <mailto:freebsd-virtualization@freebsd.org> List-Help: <mailto:freebsd-virtualization-request@freebsd.org?subject=help> List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-virtualization>, <mailto:freebsd-virtualization-request@freebsd.org?subject=subscribe> X-List-Received-Date: Mon, 14 Oct 2019 18:52:37 -0000 Tomasz CEDRO <tomek@cedro.info> wrote: > would be really nice also to get UEFI BOOT compatible with SECURE BOOT :-) Unless you are using your own BIOS, the above means getting Microsoft to sign boot1.efi or similar. Shims that simply work around lack of acceptible signature don't help. That would need to then verify loader.efi - which can be built to to verify all the modules and kernel. In my implementation (uses the non efi loader) trust anchors are embedded in loader but there is code in current to lookup trust anchors in /efi I think which would be more generally useful - I've not looked at the attack vectors that introduces though. --sjg