From patchwork Tue Mar 21 15:28:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 72931 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:1828:b0:ab:1fc6:e12a with SMTP id l40csp2424318dyk; Tue, 21 Mar 2023 08:57:29 -0700 (PDT) X-Google-Smtp-Source: AK7set+0Uvf6VvfwYhiqbaDN1Xy73CBh7WJzf2PSTEQNnkx3pxcdS1wX/jwRc5YBMMFsrWLc7yBB X-Received: by 2002:a05:6a20:4923:b0:d9:c71d:131f with SMTP id ft35-20020a056a20492300b000d9c71d131fmr2213213pzb.15.1679414249141; Tue, 21 Mar 2023 08:57:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1679414249; cv=none; d=google.com; s=arc-20160816; b=Juv5T3CDqB2rwZstovryPlFXJIdC01aKq+q09tFi8MIhGR9TEafolKrMGmz/MzePVz QO4pcYgNAtMYr1dcPE1Za3PmsML3FSJ9q/Vsm9V5ojyBUjXgZCdJUqVaBz4Sc2L5+rsW 0U06cP5ZNyuAzqEavBK2kz2mkkI8o+XB6gdcoXIs3x9BfupTU50sklHoeqY8d7kqr+CU tksRDJh7JJop3u5qjvFDIfHspVWGFfLzYEBShAa6TMFrPbo8CemsBdoP/ky2zEG0CYKk L1XKgtojWbrpVwC7WU1+9UP0EKKchgqC7mmr8/Zs7C66irhiwcU6dV3bOzacvfYU9uu3 JKPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=CHBaZ/SWGtkniVd+1PKIhIQ2oED2sm6RACVOBu3XXnU=; b=FTWe4tXdNzKdwpiZVlHTJIeMBb9ndWIiXrGplia5sf7K8NCa2VxPUj1+nhFRQ3xrd4 MC8WGrx3ypScMGUHyymxqIKk89pCPQ65qZycVI0cuztREymm4I825sJfnX9tQH2xqu/Y WjGpG+xqOmhwY+ZMapMBO+oVZr7WmSO2uGe7lXhTINdz6MSJ9y19/A7jkPYP14Y/hfjL +pSBHfvqETnxgHgedr+aTsmv3FeQDtuweYYxJFb/2GFq5nUHMLKTZT7Gmhwxn2pGCS73 3Ok1Hr2q1yLG5GNsH0LdZ5P80gdeE/fPkSQACbQ4Y1aKHppdE18ct8+pZx9jrOpd5rQ8 80CA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=PBjxsquS; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d134-20020a621d8c000000b006257a8b0d69si12844334pfd.100.2023.03.21.08.57.16; Tue, 21 Mar 2023 08:57:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=PBjxsquS; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231564AbjCUP2u (ORCPT + 99 others); Tue, 21 Mar 2023 11:28:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55410 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231637AbjCUP2j (ORCPT ); Tue, 21 Mar 2023 11:28:39 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E99912CDB; Tue, 21 Mar 2023 08:28:28 -0700 (PDT) Date: Tue, 21 Mar 2023 15:28:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1679412506; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHBaZ/SWGtkniVd+1PKIhIQ2oED2sm6RACVOBu3XXnU=; b=PBjxsquSMrb2Q2SC3chZsJPWQAcRGj6HPtGs7D/fz+ZI4+5mGfjMZFbOC7HscuKf3lM5Fg XICcQ6W+7nalIKXj7Fyl+QT0b90mXCHAl8Q7CUZakYw1djW24T/vmAPXkjsrDD1pCK9w+3 9FgKCPRo5mKZCrLPP188QUL65VrWB8LDGjn0cEFiIotQcbIYPMb0xMOt3K02THtEHQRl33 SX07acmDENZoJr+B0498NgsF56OUsKQHXFNziKTGcgGGV1rTae0pubkCq663bUgejCmDjl Nk/47T6lP0nkqjJvjEwEUhq9VOZk5+vPFSqIUXPXtdYIjEUDqj06dsJdQ5/fLg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1679412506; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHBaZ/SWGtkniVd+1PKIhIQ2oED2sm6RACVOBu3XXnU=; b=3YZcZxpXXUhgnqDuA7PaEacYPwKfjB5/oEdbgGK4G/c/AAk0cMmueUoE2u9NfTCh8Ok21r RP55RCeH6+BirVBw== From: "tip-bot2 for Dionna Glaze" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/sev] virt/coco/sev-guest: Double-buffer messages Cc: Dionna Glaze , "Borislav Petkov (AMD)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20230214164638.1189804-3-dionnaglaze@google.com> References: <20230214164638.1189804-3-dionnaglaze@google.com> MIME-Version: 1.0 Message-ID: <167941250633.5837.11136413082956254836.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757826640291517072?= X-GMAIL-MSGID: =?utf-8?q?1760993475568782761?= The following commit has been merged into the x86/sev branch of tip: Commit-ID: 965006103a14703cc42043bbf9b5e0cdf7a468ad Gitweb: https://git.kernel.org/tip/965006103a14703cc42043bbf9b5e0cdf7a468ad Author: Dionna Glaze AuthorDate: Tue, 07 Mar 2023 20:24:48 +01:00 Committer: Borislav Petkov (AMD) CommitterDate: Tue, 21 Mar 2023 13:20:04 +01:00 virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them. Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Signed-off-by: Dionna Glaze Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google.com --- drivers/virt/coco/sev-guest/sev-guest.c | 27 ++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c index 46f1a8d..0c7b47a 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -46,7 +46,15 @@ struct snp_guest_dev { void *certs_data; struct snp_guest_crypto *crypto; + /* request and response are in unencrypted memory */ struct snp_guest_msg *request, *response; + + /* + * Avoid information leakage by double-buffering shared messages + * in fields that are in regular encrypted memory. + */ + struct snp_guest_msg secret_request, secret_response; + struct snp_secrets_page_layout *layout; struct snp_req_data input; u32 *os_area_msg_seqno; @@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev, struct snp_guest_msg *msg, static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, u32 sz) { struct snp_guest_crypto *crypto = snp_dev->crypto; - struct snp_guest_msg *resp = snp_dev->response; - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *resp = &snp_dev->secret_response; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *req_hdr = &req->hdr; struct snp_guest_msg_hdr *resp_hdr = &resp->hdr; dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr->msg_sz); + /* Copy response from shared memory to encrypted memory. */ + memcpy(resp, snp_dev->response, sizeof(*resp)); + /* Verify that the sequence counter is incremented by 1 */ if (unlikely(resp_hdr->msg_seqno != (req_hdr->msg_seqno + 1))) return -EBADMSG; @@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8 type, void *payload, size_t sz) { - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *hdr = &req->hdr; memset(req, 0, sizeof(*req)); @@ -417,13 +428,21 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in if (!seqno) return -EIO; + /* Clear shared memory's response for the host to populate. */ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); - /* Encrypt the userspace provided payload */ + /* Encrypt the userspace provided payload in snp_dev->secret_request. */ rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); if (rc) return rc; + /* + * Write the fully encrypted request to the shared unencrypted + * request page. + */ + memcpy(snp_dev->request, &snp_dev->secret_request, + sizeof(snp_dev->secret_request)); + rc = __handle_guest_request(snp_dev, exit_code, fw_err); if (rc) { if (rc == -EIO && *fw_err == SNP_GUEST_REQ_INVALID_LEN)