linux.git/drivers/crypto/ccp/sev-dev.c, branch v6.1

crypto: ccp - Fail the PSP initialization when writing psp data file failed

2022-08-26T10:50:07+00:00

Currently the OS continues the PSP initialization when there is a write
failure to the init_ex_file. Therefore, the userspace would be told that
SEV is properly INIT'd even though the psp data file is not updated.
This is problematic because later when asked for the SEV data, the OS
won't be able to provide it.

Fixes: 3d725965f836 ("crypto: ccp - Add SEV_INIT_EX support")
Reported-by: Peter Gonda 
Reported-by: kernel test robot 
Signed-off-by: Jacky Li 
Acked-by: David Rientjes 
Acked-by: Tom Lendacky 
Signed-off-by: Herbert Xu

crypto: ccp - Initialize PSP when reading psp data file failed

2022-08-26T10:50:07+00:00

Currently the OS fails the PSP initialization when the file specified at
'init_ex_path' does not exist or has invalid content. However the SEV
spec just requires users to allocate 32KB of 0xFF in the file, which can
be taken care of by the OS easily.

To improve the robustness during the PSP init, leverage the retry
mechanism and continue the init process:

Before the first INIT_EX call, if the content is invalid or missing,
continue the process by feeding those contents into PSP instead of
aborting. PSP will then override it with 32KB 0xFF and return
SEV_RET_SECURE_DATA_INVALID status code. In the second INIT_EX call,
this 32KB 0xFF content will then be fed and PSP will write the valid
data to the file.

In order to do this, sev_read_init_ex_file should only be called once
for the first INIT_EX call. Calling it again for the second INIT_EX call
will cause the invalid file content overwriting the valid 32KB 0xFF data
provided by PSP in the first INIT_EX call.

Co-developed-by: Peter Gonda 
Signed-off-by: Peter Gonda 
Signed-off-by: Jacky Li 
Reported-by: Alper Gun 
Acked-by: David Rientjes 
Acked-by: Tom Lendacky 
Signed-off-by: Herbert Xu

crypto: ccp - Add a quirk to firmware update

2022-08-19T10:39:36+00:00

A quirk for fixing the committed TCB version, when upgrading from a
firmware version earlier than 1.50. This is a known issue, and the
documented workaround is to load the firmware twice.

Currently, this issue requires the  following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API
version is less than 1.50, and if so, download the firmware twice.
This addresses the TCB version issue.

Link: https://lore.kernel.org/all/de02389f-249d-f565-1136-4af3655fab2a@profian.com/
Reported-by: Harald Hoyer 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Tom Lendacky 
Signed-off-by: Herbert Xu

crypto: ccp - During shutdown, check SEV data pointer before using

2022-06-24T09:12:29+00:00

On shutdown, each CCP device instance performs shutdown processing.
However, __sev_platform_shutdown_locked() uses the controlling psp
structure to obtain the pointer to the sev_device structure. However,
during driver initialization, it is possible that an error can be received
from the firmware that results in the sev_data pointer being cleared from
the controlling psp structure. The __sev_platform_shutdown_locked()
function does not check for this situation and will segfault.

While not common, this scenario should be accounted for. Add a check for a
NULL sev_device structure before attempting to use it.

Fixes: 5441a07a127f ("crypto: ccp - shutdown SEV firmware on kexec")
Signed-off-by: Tom Lendacky 
Signed-off-by: Herbert Xu

crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak

2022-06-10T08:40:16+00:00

For some sev ioctl interfaces, input may be passed that is less than or
equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP
firmware returns. In this case, kmalloc will allocate memory that is the
size of the input rather than the size of the data. Since PSP firmware
doesn't fully overwrite the buffer, the sev ioctl interfaces with the
issue may return uninitialized slab memory.

Currently, all of the ioctl interfaces in the ccp driver are safe, but
to prevent future problems, change all ioctl interfaces that allocate
memory with kmalloc to use kzalloc and memset the data buffer to zero
in sev_ioctl_do_platform_status.

Fixes: 38103671aad3 ("crypto: ccp: Use the stack and common buffer for status commands")
Fixes: e799035609e15 ("crypto: ccp: Implement SEV_PEK_CSR ioctl command")
Fixes: 76a2b524a4b1d ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
Fixes: d6112ea0cb344 ("crypto: ccp - introduce SEV_GET_ID2 command")
Cc: stable@vger.kernel.org
Reported-by: Andy Nguyen 
Suggested-by: David Rientjes 
Suggested-by: Peter Gonda 
Signed-off-by: John Allen 
Reviewed-by: Peter Gonda 
Acked-by: David Rientjes 
Signed-off-by: Herbert Xu

crypto: ccp - Fix the INIT_EX data file open failure

2022-04-29T05:44:57+00:00

There are 2 common cases when INIT_EX data file might not be
opened successfully and fail the sev initialization:

1. In user namespaces, normal user tasks (e.g. VMM) can change their
   current->fs->root to point to arbitrary directories. While
   init_ex_path is provided as a module param related to root file
   system. Solution: use the root directory of init_task to avoid
   accessing the wrong file.

2. Normal user tasks (e.g. VMM) don't have the privilege to access
   the INIT_EX data file. Solution: open the file as root and
   restore permissions immediately.

Fixes: 3d725965f836 ("crypto: ccp - Add SEV_INIT_EX support")
Signed-off-by: Jacky Li 
Reviewed-by: Peter Gonda 
Acked-by: Tom Lendacky 
Signed-off-by: Herbert Xu

crypto: ccp - Log when resetting PSP SEV state

2022-04-21T09:53:55+00:00

Currently when the PSP returns a SECURE_DATA_INVALID error on INIT or
INIT_EX the driver retries the command once which should reset the PSP's
state SEV related state, meaning the PSP will regenerate its keying
material. This is logged with a dbg log but given this will change
system state this should be logged at a higher priority and with more
information.

Signed-off-by: Peter Gonda 
Cc: Tom Lendacky 
Cc: Brijesh Singh 
Cc: David Rientjes 
Cc: Herbert Xu 
Cc: John Allen 
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu

crypto: ccp - Ensure psp_ret is always init'd in __sev_platform_init_locked()

2022-01-28T05:51:11+00:00

Initialize psp_ret inside of __sev_platform_init_locked() because there
are many failure paths with PSP initialization that do not set
__sev_do_cmd_locked().

Fixes: e423b9d75e77: ("crypto: ccp - Move SEV_INIT retry for corrupted data")

Signed-off-by: Peter Gonda 
Reported-by: Dan Carpenter 
Cc: Tom Lendacky 
Cc: Brijesh Singh 
Cc: Marc Orr 
Cc: Herbert Xu 
Cc: John Allen 
Cc: "David S. Miller" 
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu

crypto: ccp - remove unneeded semicolon

2021-12-31T07:10:55+00:00

Eliminate the following coccicheck warning:
./drivers/crypto/ccp/sev-dev.c:263:2-3: Unneeded semicolon

Reported-by: Abaci Robot 
Signed-off-by: Yang Li 
Signed-off-by: Herbert Xu

crypto: ccp - Add SEV_INIT_EX support

2021-12-17T05:59:47+00:00

Add new module parameter to allow users to use SEV_INIT_EX instead of
SEV_INIT. This helps users who lock their SPI bus to use the PSP for SEV
functionality. The 'init_ex_path' parameter defaults to NULL which means
the kernel will use SEV_INIT, if a path is specified SEV_INIT_EX will be
used with the data found at the path. On certain PSP commands this
file is written to as the PSP updates the NV memory region. Depending on
file system initialization this file open may fail during module init
but the CCP driver for SEV already has sufficient retries for platform
initialization. During normal operation of PSP system and SEV commands
if the PSP has not been initialized it is at run time. If the file at
'init_ex_path' does not exist the PSP will not be initialized. The user
must create the file prior to use with 32Kb of 0xFFs per spec.

Signed-off-by: David Rientjes 
Co-developed-by: Peter Gonda 
Signed-off-by: Peter Gonda 
Reviewed-by: Marc Orr 
Reported-by: kernel test robot 
Acked-by: Brijesh Singh 
Cc: Tom Lendacky 
Cc: Brijesh Singh 
Cc: Marc Orr 
Cc: Joerg Roedel 
Cc: Herbert Xu 
Cc: David Rientjes 
Cc: John Allen 
Cc: "David S. Miller" 
Cc: Paolo Bonzini 
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu