3 ms·

no, that is the whole point of the Secure Encrypted Virtualization hypervisor (and remember, bare-metal is just another guest). Guests should not be able to ju

by paulmd 2y ago

no, that is the whole point of the Secure Encrypted Virtualization hypervisor (and remember, bare-metal is just another guest). Guests should not be able to jump to hypervisor control just because they type sudo, or just because they have physical presence. this all comes from the work AMD did on the xbox hypervisor, and obviously a console needs to be physically present (sitting in the attacker's living room) and survive a complete compromise of a guest partition (again, potentially including the OS/"bare-metal guest"). https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo why would ring0 ever be intended to grant you access to ring -1 or -2? why even have rings -1 or -2 in that situation?

ndriscoll 2y ago
When the owner of the device is the "attacker", "why even have this" is indeed a good question.
- paulmd 2y ago
  well, like it or not that's a real use-case - and not just DRM/anti-cheat but also things like homomorphic encryption. there's lots of interest in being able to do useful things when the owner of the machine might be an attacker, that is an extremely broad and useful primitive to build upon. secure encrypted virtualization is supposed to be "homomorphic encryption, but in a system we can actually implement/that actually performs decently". obviously it would be reassuring to know that hetzner can't look at your data that you put into the hardware they own, right? how do you accomplish that if not creating a root-of-trust that's not controlled by the owner of the machine? I don't trust Hetzner to not see my data, but I might be willing to trust AMD. Let AMD hold the key to my VM memory partition, and the hypervisor exists in a different VM memory partition, and its keys don't work in my partition. Things which break that security model are obviously of huge concern and it feels borderline intentionally-misleading to phrase it as "why would you be concerned about that". The answer is because it's a foundational break in the security model of SEV and the PSP.
  - ndriscoll 2y ago
    I suppose the cloud use-case makes sense, and my reaction was more to the people saying it mattered that they wouldn't fix consumer/desktop processors, where this thing is primarily if not almost exclusively used to undermine the owner.
    - paulmd 2y ago
      even for consumers, the existence of a PSP implies that you don’t want that PSP to become compromised. It has the complete ability to fuck with your container instance in any way it wants with no mitigations possible. You immediately fall into trusting-trust problems around working in an inherently compromised environment where an attacker can manipulate you in arbitrary ways. You think reading a file twice produces the same results? You think adding two numbers or doing an if-statement returns the proper result? Not if the hardware is malicious. Beyond the broader “should this exist”, once it is a given that it exists, it’s an incredibly powerful weapon and it certainly shouldn’t be left unsecured. This is the thing that can see the true state of memory, hold all the keys, and even just arbitrarily rewrite memory state or processor state. This is god on this system. The fact that people see that and say “well you’d have to type sudo to permanently own the machine!” as some kind of excuse or downplaying is nuts and wouldn’t be tolerated from any other brand. But AMD always gets extra benefit-of-the-doubt and kid-glove treatment. When intel gets compromised nobody does the “ok but should we really have a hypervisor ring anyway???” shit. The amount of special pleading people do on behalf of AMD is insane. And people would never tolerate intel leaving a bunch of hardware exploits unpatched like some of AMD’s exploits have been.
      - ndriscoll 2y ago
        I think people's reaction to e.g. Intel ME and SGX is also "this shouldn't exist on consumer hardware", and it makes perfect sense to be happy about being able to control both as the owner. The owner is supposed to be god on the system. They're supposed to have a sudo that really gives them full power over everything. sudo (on the bare metal ring) is supposed to let the user see the true state of everything, hold all the keys, arbitrarily rewrite memory, etc.

by paulmd 2y ago

ndriscoll 2y ago

When the owner of the device is the "attacker", "why even have this" is indeed a good question.

paulmd 2y ago
well, like it or not that's a real use-case - and not just DRM/anti-cheat but also things like homomorphic encryption. there's lots of interest in being able to do useful things when the owner of the machine might be an attacker, that is an extremely broad and useful primitive to build upon. secure encrypted virtualization is supposed to be "homomorphic encryption, but in a system we can actually implement/that actually performs decently". obviously it would be reassuring to know that hetzner can't look at your data that you put into the hardware they own, right? how do you accomplish that if not creating a root-of-trust that's not controlled by the owner of the machine? I don't trust Hetzner to not see my data, but I might be willing to trust AMD. Let AMD hold the key to my VM memory partition, and the hypervisor exists in a different VM memory partition, and its keys don't work in my partition. Things which break that security model are obviously of huge concern and it feels borderline intentionally-misleading to phrase it as "why would you be concerned about that". The answer is because it's a foundational break in the security model of SEV and the PSP.
- ndriscoll 2y ago
  I suppose the cloud use-case makes sense, and my reaction was more to the people saying it mattered that they wouldn't fix consumer/desktop processors, where this thing is primarily if not almost exclusively used to undermine the owner.
  - paulmd 2y ago
    even for consumers, the existence of a PSP implies that you don’t want that PSP to become compromised. It has the complete ability to fuck with your container instance in any way it wants with no mitigations possible. You immediately fall into trusting-trust problems around working in an inherently compromised environment where an attacker can manipulate you in arbitrary ways. You think reading a file twice produces the same results? You think adding two numbers or doing an if-statement returns the proper result? Not if the hardware is malicious. Beyond the broader “should this exist”, once it is a given that it exists, it’s an incredibly powerful weapon and it certainly shouldn’t be left unsecured. This is the thing that can see the true state of memory, hold all the keys, and even just arbitrarily rewrite memory state or processor state. This is god on this system. The fact that people see that and say “well you’d have to type sudo to permanently own the machine!” as some kind of excuse or downplaying is nuts and wouldn’t be tolerated from any other brand. But AMD always gets extra benefit-of-the-doubt and kid-glove treatment. When intel gets compromised nobody does the “ok but should we really have a hypervisor ring anyway???” shit. The amount of special pleading people do on behalf of AMD is insane. And people would never tolerate intel leaving a bunch of hardware exploits unpatched like some of AMD’s exploits have been.
    - ndriscoll 2y ago
      I think people's reaction to e.g. Intel ME and SGX is also "this shouldn't exist on consumer hardware", and it makes perfect sense to be happy about being able to control both as the owner. The owner is supposed to be god on the system. They're supposed to have a sudo that really gives them full power over everything. sudo (on the bare metal ring) is supposed to let the user see the true state of everything, hold all the keys, arbitrarily rewrite memory, etc.