From patchwork Thu Feb 16 12:46:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Borislav Petkov X-Patchwork-Id: 58038 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp279550wrn; Thu, 16 Feb 2023 04:48:01 -0800 (PST) X-Google-Smtp-Source: AK7set/Spm6tjbIERoqdrTlEYTVu2qz5F2XuSnHqwElywY14E45Dd/xEuVm+tefkyQVXxvllDZ9K X-Received: by 2002:a17:903:22c9:b0:196:7c6d:2aee with SMTP id y9-20020a17090322c900b001967c6d2aeemr6436076plg.11.1676551681205; Thu, 16 Feb 2023 04:48:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1676551681; cv=none; d=google.com; s=arc-20160816; b=eeGiK9Cm4BdcY8yJ/p1NILZMV4ihS+9C0Jx1BR+wykWAa8y6GoU8j7+LY8iHDy/3Ni 3FJwDc7hGghVnMKwKxNon5EUN97VmyMB5ijcvA/xsdqSfgXi96i7sSaIqlaVInySLF/+ yH3s+CPN6KM/BTH+Ea7sDyKlWtK5XbwL6CsEcFXvNAv52uCIKoHqEmjoPild8OmO274T lYPTN2AvxVeG7rxiU7vgdC/4+wSEfAmsog+SDd6/U1pPUSQkv6kALv8IshfgbjZzMcSF N9snwa0ThoWuj3Vn0oDOWW3DBUvlcwvyw6lqBzJdtUeHGGGy3RFuJgGsn5jxbPk7gDwe PF3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=W4fNzZVp6ePbAT+6Jjwj3b2oeBPQ7cQ0clPlhPYCkY4=; b=JdpQ9vDtbko+VNAjHRNb4asGZ+984EN9KTCwuwURwh1tqzQ6oNWpyq1smQCL5Pme8H d5QMBzvq5lUYl93967pbxE2LeRX4J8ygbI/EkbSJMN9fShMAYmI2iK0WtZZpaaObOToV 2HJaGSbz97h6QlzcvIzT565ufxlaGg81h5+GgDYmS0LCu4lddMli5oEqzMU/D7PTYDsX ZL6PWrhfZLvHEwT31zxTBEU3zNnNdWlZ6vNAi3kXU1CZiuxIpwlsutkKKXJKNBmniVmN u1VMEHA0mtw544SZTCirxnfj+SZmlc3tH6xwtaTSUuEdKtoSqblgdR6JHcuYG81EmuMi KBCw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@alien8.de header.s=dkim header.b="W5gYmg9/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u14-20020a170902e5ce00b001990b9e7c81si1656926plf.568.2023.02.16.04.47.48; Thu, 16 Feb 2023 04:48:01 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@alien8.de header.s=dkim header.b="W5gYmg9/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230293AbjBPMqS (ORCPT + 99 others); Thu, 16 Feb 2023 07:46:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229946AbjBPMqL (ORCPT ); Thu, 16 Feb 2023 07:46:11 -0500 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 060172D67 for ; Thu, 16 Feb 2023 04:46:06 -0800 (PST) Received: from zn.tnic (p5de8e9fe.dip0.t-ipconnect.de [93.232.233.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id A22871EC0936; Thu, 16 Feb 2023 13:46:04 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1676551564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=W4fNzZVp6ePbAT+6Jjwj3b2oeBPQ7cQ0clPlhPYCkY4=; b=W5gYmg9/rgBZ+OYxwfvMa476vZXL8ADyRXj63MQ0zCaQijXtG+7EODhCVi6QBrHgl2OSH2 rlhEvCBj4RLcXFxZS19tHln3awVB6OJNxIo3TyLgTA1vmWymZ+6nsLxb7snaarMddYJCKA rkyi2tXWDyw7ZG2OeMzshhZZ34dIcRs= From: Borislav Petkov To: LKML Cc: Dionna Glaze , Joerg Roedel , Michael Roth , Nikunj A Dadhania , Peter Gonda , Tom Lendacky , linux-coco@lists.linux.dev, x86@kernel.org Subject: [PATCH 09/11] virt/coco/sev-guest: Double-buffer messages Date: Thu, 16 Feb 2023 13:46:00 +0100 Message-Id: <20230216124602.26849-4-bp@alien8.de> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20230216124602.26849-1-bp@alien8.de> References: <20230216124120.26578-1-bp@alien8.de> <20230216124602.26849-1-bp@alien8.de> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757991855910218417?= X-GMAIL-MSGID: =?utf-8?q?1757991855910218417?= From: Dionna Glaze The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them. Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Signed-off-by: Dionna Glaze Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google.com --- drivers/virt/coco/sev-guest/sev-guest.c | 27 +++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c index ca501d119233..070c6f414bfd 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -46,7 +46,15 @@ struct snp_guest_dev { void *certs_data; struct snp_guest_crypto *crypto; + /* request and response are in unencrypted memory */ struct snp_guest_msg *request, *response; + + /* + * Avoid information leakage by double-buffering shared messages + * in fields that are in regular encrypted memory. + */ + struct snp_guest_msg secret_request, secret_response; + struct snp_secrets_page_layout *layout; struct snp_req_data input; u32 *os_area_msg_seqno; @@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev, struct snp_guest_msg *msg, static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, u32 sz) { struct snp_guest_crypto *crypto = snp_dev->crypto; - struct snp_guest_msg *resp = snp_dev->response; - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *resp = &snp_dev->secret_response; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *req_hdr = &req->hdr; struct snp_guest_msg_hdr *resp_hdr = &resp->hdr; dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr->msg_sz); + /* Copy response from shared memory to encrypted memory. */ + memcpy(resp, snp_dev->response, sizeof(*resp)); + /* Verify that the sequence counter is incremented by 1 */ if (unlikely(resp_hdr->msg_seqno != (req_hdr->msg_seqno + 1))) return -EBADMSG; @@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8 type, void *payload, size_t sz) { - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *hdr = &req->hdr; memset(req, 0, sizeof(*req)); @@ -400,13 +411,21 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in if (!seqno) return -EIO; + /* Clear shared memory's response for the host to populate. */ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); - /* Encrypt the userspace provided payload */ + /* Encrypt the userspace provided payload in snp_dev->secret_request. */ rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); if (rc) return rc; + /* + * Write the fully encrypted request to the shared unencrypted + * request page. + */ + memcpy(snp_dev->request, &snp_dev->secret_request, + sizeof(snp_dev->secret_request)); + rc = __handle_guest_request(snp_dev, exit_code, fw_err); if (rc) { dev_alert(snp_dev->dev, "Detected error from ASP request. rc: %d, fw_err: %llu\n", rc, *fw_err);