linux-kernel - [PATCH 0/2] x86/sev: Rework SNP Guest Request to fix race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250307013700.437505-1-aik@amd.com>
Date: Fri, 7 Mar 2025 12:36:58 +1100
From: Alexey Kardashevskiy <aik@....com>
To: <x86@...nel.org>
CC: <linux-kernel@...r.kernel.org>, Thomas Gleixner <tglx@...utronix.de>,
	"Ingo Molnar" <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, Dave Hansen
	<dave.hansen@...ux.intel.com>, "H. Peter Anvin" <hpa@...or.com>, Tom Lendacky
	<thomas.lendacky@....com>, Nikunj A Dadhania <nikunj@....com>, Ard Biesheuvel
	<ardb@...nel.org>, Pavan Kumar Paluri <papaluri@....com>, Ashish Kalra
	<ashish.kalra@....com>, Paolo Bonzini <pbonzini@...hat.com>, Michael Roth
	<michael.roth@....com>, Kevin Loughlin <kevinloughlin@...gle.com>,
	"Kuppuswamy Sathyanarayanan" <sathyanarayanan.kuppuswamy@...ux.intel.com>,
	Brijesh Singh <brijesh.singh@....com>, Liam Merwick
	<liam.merwick@...cle.com>, "Alexey Kardashevskiy" <aik@....com>
Subject: [PATCH 0/2] x86/sev: Rework SNP Guest Request to fix race

Guest Request is a mechanism for a SNP VM to talk to the PSP described
in the GHCB spec. GHCB allows one request in flight at the time and
there is a mutex for it: msnp_cmd_mutex. Unfortunaty series of events
led to use of shared data outside of this mutex area and recent commit
ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command
mutex") broke it.

The shared data includes:

- request structures in snp_guest_dev which was not a problem when
they were introduced as they were put on stack but db10cb9b5746
("virt: sevguest: Fix passing a stack buffer as a scatterlist target")
moved them to snp_guest_dev so they became shared but there was
a mutex so it was ok (not anymore);

- data pages and the number of them in Extended Guest Request.

So here are 2 patches. Reverting ae596615d93d is not an easy option as
the code developed far enough (the mutex moved and secure TSC now
calls the PSP too) to make it rather large.


This is based on sha1
277255aa69e5 Ingo Molnar "Merge branch into tip/master: 'x86/sev'".

Please comment. Thanks.



Alexey Kardashevskiy (1):
  virt: sev-guest: Move SNP Guest Request data pages handling under
    snp_cmd_mutex

Nikunj A Dadhania (1):
  virt: sev-guest: Allocate request data dynamically

 arch/x86/include/asm/sev.h              |  6 +-
 arch/x86/coco/sev/core.c                | 23 +++-----
 drivers/virt/coco/sev-guest/sev-guest.c | 58 +++++++++++++++-----
 3 files changed, 54 insertions(+), 33 deletions(-)

-- 
2.47.1