From patchwork Tue Feb 21 11:34:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Borislav Petkov X-Patchwork-Id: 59884 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp1812810wrn; Tue, 21 Feb 2023 03:37:47 -0800 (PST) X-Google-Smtp-Source: AK7set8yoAh3RFBDM/XKTBbwMgFFFkdW2sRD4rij6evq8B/fEEsj5D7/EyRMwlrvN1lfBMotNmSx X-Received: by 2002:a17:907:a40d:b0:878:7349:5ce6 with SMTP id sg13-20020a170907a40d00b0087873495ce6mr15195092ejc.71.1676979467771; Tue, 21 Feb 2023 03:37:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1676979467; cv=none; d=google.com; s=arc-20160816; b=OzXpf1mXnA/I+sWfFJzVO3dCqo9MfI3YoEpnM2UXe9eZ0+kMjmYQicV9M69H8PnJii +ewF8qnqZjStMIB83YlgqZ8EC32yWHnPnQRTDZVlV+7/U9OW3ZB+EGURvu0DBs+v6rM/ aK9d4LR8vA9cqXHf+PK8cUXW7h6i5QsWp/WyyPy5ChhBmG69EXS6uJPZw5kZ+gRkWUx8 3a1kJUJJmikg+qNh+wloI8N20swpvwRo5TtGv/HEn83ZyqdSZcOUzqygpkgD1ES5ElNY e4YJfADVU3Q++qwAU9rij9f2FfBpTtnYoooA4+d5Y17oUdcW4u2XWZYr5cXoGGNS6Gml aZSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=dWHBIgi4/PPHoVD+CngkvEQZ9VAcHNq+ytmZl53I++c=; b=Amcw3NdnqeODtFqSA8qNwf3wqqMiGGbprarh6N8pbkkMhlsD1yuAudU+jEj0WthCtu Jl80LtjAJ29Ime3uLzxId8tQQ2JZnAZ0jeIodF67ghjX8sMmxxbje/8fAGqH5Z0GeXnJ 8jZrNgpKjuFVPn0CpUAUMbWh2lFhBdtzun7tB/MBBG+DtaAElrky4cJz/hHz3n/Ucq16 Yem1Ic9+j9Z4sh3uGh4yqTSd6kUKHSETWxEcBvjwlySWUEx9aS4JpxTQqhGZSBD4KEpC ztSY+JaC75HjTcL+Jcs+HbNpxC1lDATGpsLliRoAOAfpHRNonadmc7cPVwltfTors1rI 3nsQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@alien8.de header.s=dkim header.b=Pa3GQzNp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 30-20020a170906209e00b008b1a3d719b4si19612405ejq.202.2023.02.21.03.37.24; Tue, 21 Feb 2023 03:37:47 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@alien8.de header.s=dkim header.b=Pa3GQzNp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234115AbjBULfM (ORCPT + 99 others); Tue, 21 Feb 2023 06:35:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58154 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233832AbjBULeo (ORCPT ); Tue, 21 Feb 2023 06:34:44 -0500 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7757526CEC for ; Tue, 21 Feb 2023 03:34:42 -0800 (PST) Received: from zn.tnic (p5de8e9fe.dip0.t-ipconnect.de [93.232.233.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id CF1FA1EC0682; Tue, 21 Feb 2023 12:34:40 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1676979280; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dWHBIgi4/PPHoVD+CngkvEQZ9VAcHNq+ytmZl53I++c=; b=Pa3GQzNpCEz5RIlXXbe112ECZiXJnWwMhmAnOK0IZbYyETMd8xNqbPoBdNZ7z7ZtQpZci4 xu457d3A+pT/QFBpwL3XB/XLxKeBhMGkAQdnSTIu9tV0VcMvYZZhhKDHbSkDF0CbU6GS5f ikY0Z0bUIxYDKFvwapn2qeTqIOZqvLc= From: Borislav Petkov To: LKML Cc: Dionna Glaze , Joerg Roedel , Michael Roth , Nikunj A Dadhania , Peter Gonda , Tom Lendacky , linux-coco@lists.linux.dev, x86@kernel.org Subject: [PATCH -v2 10/11] virt/coco/sev-guest: Double-buffer messages Date: Tue, 21 Feb 2023 12:34:27 +0100 Message-Id: <20230221113428.19324-11-bp@alien8.de> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20230221113428.19324-1-bp@alien8.de> References: <20230221113428.19324-1-bp@alien8.de> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758440421892107310?= X-GMAIL-MSGID: =?utf-8?q?1758440421892107310?= From: Dionna Glaze The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them. Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Signed-off-by: Dionna Glaze Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google.com --- drivers/virt/coco/sev-guest/sev-guest.c | 27 +++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c index da4f6267baad..6bc1390b54e8 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -46,7 +46,15 @@ struct snp_guest_dev { void *certs_data; struct snp_guest_crypto *crypto; + /* request and response are in unencrypted memory */ struct snp_guest_msg *request, *response; + + /* + * Avoid information leakage by double-buffering shared messages + * in fields that are in regular encrypted memory. + */ + struct snp_guest_msg secret_request, secret_response; + struct snp_secrets_page_layout *layout; struct snp_req_data input; u32 *os_area_msg_seqno; @@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev, struct snp_guest_msg *msg, static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, u32 sz) { struct snp_guest_crypto *crypto = snp_dev->crypto; - struct snp_guest_msg *resp = snp_dev->response; - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *resp = &snp_dev->secret_response; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *req_hdr = &req->hdr; struct snp_guest_msg_hdr *resp_hdr = &resp->hdr; dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr->msg_sz); + /* Copy response from shared memory to encrypted memory. */ + memcpy(resp, snp_dev->response, sizeof(*resp)); + /* Verify that the sequence counter is incremented by 1 */ if (unlikely(resp_hdr->msg_seqno != (req_hdr->msg_seqno + 1))) return -EBADMSG; @@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8 type, void *payload, size_t sz) { - struct snp_guest_msg *req = snp_dev->request; + struct snp_guest_msg *req = &snp_dev->secret_request; struct snp_guest_msg_hdr *hdr = &req->hdr; memset(req, 0, sizeof(*req)); @@ -400,13 +411,21 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in if (!seqno) return -EIO; + /* Clear shared memory's response for the host to populate. */ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); - /* Encrypt the userspace provided payload */ + /* Encrypt the userspace provided payload in snp_dev->secret_request. */ rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); if (rc) return rc; + /* + * Write the fully encrypted request to the shared unencrypted + * request page. + */ + memcpy(snp_dev->request, &snp_dev->secret_request, + sizeof(snp_dev->secret_request)); + rc = __handle_guest_request(snp_dev, exit_code, fw_err); if (rc) { dev_alert(snp_dev->dev, "Detected error from ASP request. rc: %d, fw_err: %llu\n", rc, *fw_err);