From nobody Fri Dec 19 16:06:57 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1E27C74A5B for ; Tue, 21 Mar 2023 15:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231689AbjCUP2v (ORCPT ); Tue, 21 Mar 2023 11:28:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55410 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231637AbjCUP2j (ORCPT ); Tue, 21 Mar 2023 11:28:39 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E99912CDB; Tue, 21 Mar 2023 08:28:28 -0700 (PDT) Date: Tue, 21 Mar 2023 15:28:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1679412506; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHBaZ/SWGtkniVd+1PKIhIQ2oED2sm6RACVOBu3XXnU=; b=PBjxsquSMrb2Q2SC3chZsJPWQAcRGj6HPtGs7D/fz+ZI4+5mGfjMZFbOC7HscuKf3lM5Fg XICcQ6W+7nalIKXj7Fyl+QT0b90mXCHAl8Q7CUZakYw1djW24T/vmAPXkjsrDD1pCK9w+3 9FgKCPRo5mKZCrLPP188QUL65VrWB8LDGjn0cEFiIotQcbIYPMb0xMOt3K02THtEHQRl33 SX07acmDENZoJr+B0498NgsF56OUsKQHXFNziKTGcgGGV1rTae0pubkCq663bUgejCmDjl Nk/47T6lP0nkqjJvjEwEUhq9VOZk5+vPFSqIUXPXtdYIjEUDqj06dsJdQ5/fLg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1679412506; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHBaZ/SWGtkniVd+1PKIhIQ2oED2sm6RACVOBu3XXnU=; b=3YZcZxpXXUhgnqDuA7PaEacYPwKfjB5/oEdbgGK4G/c/AAk0cMmueUoE2u9NfTCh8Ok21r RP55RCeH6+BirVBw== From: "tip-bot2 for Dionna Glaze" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/sev] virt/coco/sev-guest: Double-buffer messages Cc: Dionna Glaze , "Borislav Petkov (AMD)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20230214164638.1189804-3-dionnaglaze@google.com> References: <20230214164638.1189804-3-dionnaglaze@google.com> MIME-Version: 1.0 Message-ID: <167941250633.5837.11136413082956254836.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/sev branch of tip: Commit-ID: 965006103a14703cc42043bbf9b5e0cdf7a468ad Gitweb: https://git.kernel.org/tip/965006103a14703cc42043bbf9b5e0cdf= 7a468ad Author: Dionna Glaze AuthorDate: Tue, 07 Mar 2023 20:24:48 +01:00 Committer: Borislav Petkov (AMD) CommitterDate: Tue, 21 Mar 2023 13:20:04 +01:00 virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them. Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Signed-off-by: Dionna Glaze Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google= .com --- drivers/virt/coco/sev-guest/sev-guest.c | 27 ++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/se= v-guest/sev-guest.c index 46f1a8d..0c7b47a 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -46,7 +46,15 @@ struct snp_guest_dev { =20 void *certs_data; struct snp_guest_crypto *crypto; + /* request and response are in unencrypted memory */ struct snp_guest_msg *request, *response; + + /* + * Avoid information leakage by double-buffering shared messages + * in fields that are in regular encrypted memory. + */ + struct snp_guest_msg secret_request, secret_response; + struct snp_secrets_page_layout *layout; struct snp_req_data input; u32 *os_area_msg_seqno; @@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev,= struct snp_guest_msg *msg, static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *pay= load, u32 sz) { struct snp_guest_crypto *crypto =3D snp_dev->crypto; - struct snp_guest_msg *resp =3D snp_dev->response; - struct snp_guest_msg *req =3D snp_dev->request; + struct snp_guest_msg *resp =3D &snp_dev->secret_response; + struct snp_guest_msg *req =3D &snp_dev->secret_request; struct snp_guest_msg_hdr *req_hdr =3D &req->hdr; struct snp_guest_msg_hdr *resp_hdr =3D &resp->hdr; =20 dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr= ->msg_sz); =20 + /* Copy response from shared memory to encrypted memory. */ + memcpy(resp, snp_dev->response, sizeof(*resp)); + /* Verify that the sequence counter is incremented by 1 */ if (unlikely(resp_hdr->msg_seqno !=3D (req_hdr->msg_seqno + 1))) return -EBADMSG; @@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev = *snp_dev, void *payload,=20 static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int versi= on, u8 type, void *payload, size_t sz) { - struct snp_guest_msg *req =3D snp_dev->request; + struct snp_guest_msg *req =3D &snp_dev->secret_request; struct snp_guest_msg_hdr *hdr =3D &req->hdr; =20 memset(req, 0, sizeof(*req)); @@ -417,13 +428,21 @@ static int handle_guest_request(struct snp_guest_dev = *snp_dev, u64 exit_code, in if (!seqno) return -EIO; =20 + /* Clear shared memory's response for the host to populate. */ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); =20 - /* Encrypt the userspace provided payload */ + /* Encrypt the userspace provided payload in snp_dev->secret_request. */ rc =3D enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); if (rc) return rc; =20 + /* + * Write the fully encrypted request to the shared unencrypted + * request page. + */ + memcpy(snp_dev->request, &snp_dev->secret_request, + sizeof(snp_dev->secret_request)); + rc =3D __handle_guest_request(snp_dev, exit_code, fw_err); if (rc) { if (rc =3D=3D -EIO && *fw_err =3D=3D SNP_GUEST_REQ_INVALID_LEN)