From nobody Fri Sep 12 03:14:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15F50C64EC7 for ; Tue, 14 Feb 2023 16:49:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232513AbjBNQtD (ORCPT ); Tue, 14 Feb 2023 11:49:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232447AbjBNQsw (ORCPT ); Tue, 14 Feb 2023 11:48:52 -0500 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC2AD83E4 for ; Tue, 14 Feb 2023 08:48:50 -0800 (PST) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-52ec8c88d75so139470927b3.12 for ; Tue, 14 Feb 2023 08:48:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=s0nfdnvfldsrO3Wlbi7UXxbxGh5v/Cc3vMzKji0VJCw=; b=WBceX564EWms8L5oRwFo5LqR4t0pF7MQ1SN05LYidS09ZBWhB1oM/T2CpKL25862NX X6KUSF1RvcvkVsqnto+XKdP/3EInT0Y7ReNwzpqOIN0Uni33pIw95AFs6yXSBfETo4Iu v6rB1dtqqHuLFqrCBe626m8fUBt8u3lhffJaxAH2FN2JWGXldf3rHOts6+ngQXm18W0H gA2M8EH/FRHWQNDsids5N0OZNJ6WI6fzvaKB25/gb7kOFiCyGIJ9hM7JrSUpGfiibp4n +hXrRtjEdWdA1SFYFDihgThU7Don6bky/waq5m8tDNU9F/QjdMDfdmvChL4w9BS7B/3j 5POQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=s0nfdnvfldsrO3Wlbi7UXxbxGh5v/Cc3vMzKji0VJCw=; b=dgD6SdrgW4QhOHLdUHOyYSAv73cDUFtSD+pMmQ1Hr2FmgCj+SSOsKOz+yonmM45siL uTw6HH7o+ogvJ5qnZacVeDMEucoxOBGyYyjAiLWlpJX1NHrOakYDCw0HJF4ttkrC15kI H+d1JiLucG6P6XtXetuWXn5fP0dGh1oiniG2clrc5GPTrYy61VlHHwJOjPoPgQ5vdROC a+rQvwbtfpG+BRt5fIpQSMZH2x1fpVZ1LMKM37W6XuuTOPwECMa3h3AcYb4D+oCVwQVR o/w/mhEssyeGZ199qZek9VjGPFpVh8HJ6LAQk2/NPaATgONjXLdC1l89KxdwlpYniTr3 gviQ== X-Gm-Message-State: AO0yUKXUszwqVnn9gdXKCi4k2JPCxWizgUWzkiqmmopRUQeGZsOtjzFt +62+8HjjfysYI9xIfvM/uJfBJOYMCe0SXhYdVC1itdc/4gfdqhVKa+WsOr9ciRHdly0+R5hWoYl j/4hvbPAi/DjLd4VDi5B9hxq2oKwVxdaq2riHx2CB8R+/kMFFtJUQkzHBSU6JRJmCf6oihDM1s5 XDHWqr650= X-Google-Smtp-Source: AK7set9U2gh1E4Zu3sxIanWgg2VqTuBpapDNzMznUIzHuOOEowrzNDDxq8w3+Dnl27mY4U0RliJWWMNgjm7ejB9HOw== X-Received: from dionnaglaze.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:2ee6]) (user=dionnaglaze job=sendgmr) by 2002:a81:9c08:0:b0:4ff:95a:1aa with SMTP id m8-20020a819c08000000b004ff095a01aamr369220ywa.364.1676393329914; Tue, 14 Feb 2023 08:48:49 -0800 (PST) Date: Tue, 14 Feb 2023 16:46:36 +0000 In-Reply-To: <20230214164638.1189804-1-dionnaglaze@google.com> Mime-Version: 1.0 References: <20230214164638.1189804-1-dionnaglaze@google.com> X-Mailer: git-send-email 2.39.1.637.g21b0678d19-goog Message-ID: <20230214164638.1189804-3-dionnaglaze@google.com> Subject: [PATCH v15 2/4] virt/coco/sev-guest: Double-buffer messages From: Dionna Glaze To: linux-kernel@vger.kernel.org, x86@kernel.org Cc: Dionna Glaze , Tom Lendacky , Paolo Bonzini , Joerg Roedel , Peter Gonda , Thomas Gleixner , Dave Hansen , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , Venu Busireddy , Michael Roth , "Kirill A. Shutemov" , Michael Sterritt Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead copy whole messages in or out as needed before doing any computation on them. Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Cc: Tom Lendacky Cc: Paolo Bonzini Cc: Joerg Roedel Cc: Peter Gonda Cc: Thomas Gleixner Cc: Dave Hansen Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Venu Busireddy Cc: Michael Roth Cc: "Kirill A. Shutemov" Cc: Michael Sterritt Signed-off-by: Dionna Glaze --- drivers/virt/coco/sev-guest/sev-guest.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/se= v-guest/sev-guest.c index dc75f11c086e..9f6c5ca40d3b 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -45,7 +45,13 @@ struct snp_guest_dev { =20 void *certs_data; struct snp_guest_crypto *crypto; + /* request and response are in unencrypted memory */ struct snp_guest_msg *request, *response; + /* + * Avoid information leakage by double-buffering shared messages + * in fields that are in regular encrypted memory. + */ + struct snp_guest_msg secret_request, secret_response; struct snp_secrets_page_layout *layout; struct snp_req_data input; u32 *os_area_msg_seqno; @@ -265,14 +271,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev,= struct snp_guest_msg *msg, static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *pay= load, u32 sz) { struct snp_guest_crypto *crypto =3D snp_dev->crypto; - struct snp_guest_msg *resp =3D snp_dev->response; - struct snp_guest_msg *req =3D snp_dev->request; + struct snp_guest_msg *resp =3D &snp_dev->secret_response; + struct snp_guest_msg *req =3D &snp_dev->secret_request; struct snp_guest_msg_hdr *req_hdr =3D &req->hdr; struct snp_guest_msg_hdr *resp_hdr =3D &resp->hdr; =20 dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr= ->msg_sz); =20 + /* Copy response from shared memory to encrypted memory. */ + memcpy(resp, snp_dev->response, sizeof(*resp)); + /* Verify that the sequence counter is incremented by 1 */ if (unlikely(resp_hdr->msg_seqno !=3D (req_hdr->msg_seqno + 1))) return -EBADMSG; @@ -296,7 +305,7 @@ static int verify_and_dec_payload(struct snp_guest_dev = *snp_dev, void *payload, static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int versi= on, u8 type, void *payload, size_t sz) { - struct snp_guest_msg *req =3D snp_dev->request; + struct snp_guest_msg *req =3D &snp_dev->secret_request; struct snp_guest_msg_hdr *hdr =3D &req->hdr; =20 memset(req, 0, sizeof(*req)); @@ -336,13 +345,21 @@ static int handle_guest_request(struct snp_guest_dev = *snp_dev, u64 exit_code, in if (!seqno) return -EIO; =20 + /* Clear shared memory's response for the host to populate. */ memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); =20 - /* Encrypt the userspace provided payload */ + /* Encrypt the userspace provided payload in snp_dev->secret_request. */ rc =3D enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); if (rc) return rc; =20 + /* + * Write the fully encrypted request to the shared unencrypted + * request page. + */ + memcpy(snp_dev->request, &snp_dev->secret_request, + sizeof(snp_dev->secret_request)); + retry: /* * Call firmware to process the request. In this function the encrypted --=20 2.39.1.637.g21b0678d19-goog