| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <a8073390-b952-43a1-8e63-18c2a10bb721@linux.intel.com>
Date: Thu, 27 Nov 2025 16:30:41 +0800
From: Binbin Wu <binbin.wu@...ux.intel.com>
To: Chao Gao <chao.gao@...el.com>
Cc: linux-coco@...ts.linux.dev, linux-kernel@...r.kernel.org, x86@...nel.org,
reinette.chatre@...el.com, ira.weiny@...el.com, kai.huang@...el.com,
dan.j.williams@...el.com, yilun.xu@...ux.intel.com, sagis@...gle.com,
vannapurve@...gle.com, paulmck@...nel.org, nik.borisov@...e.com,
Farrah Chen <farrah.chen@...el.com>, "Kirill A. Shutemov" <kas@...nel.org>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
Borislav Petkov <bp@...en8.de>, "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH v2 11/21] x86/virt/seamldr: Allocate and populate a module
update request
On 10/1/2025 10:52 AM, Chao Gao wrote:
[...]
> +
> +/* Allocate and populate a seamldr_params */
> +static struct seamldr_params *alloc_seamldr_params(const void *module, int module_size,
> + const void *sig, int sig_size)
> +{
> + struct seamldr_params *params;
> + const u8 *ptr;
> + int i;
> +
> + BUILD_BUG_ON(sizeof(struct seamldr_params) != SZ_4K);
> + if (module_size > SEAMLDR_MAX_NR_MODULE_4KB_PAGES * SZ_4K)
> + return ERR_PTR(-EINVAL);
> +
> + if (!IS_ALIGNED(module_size, SZ_4K) || !IS_ALIGNED(sig_size, SZ_4K) ||
> + !IS_ALIGNED((unsigned long)module, SZ_4K) ||
> + !IS_ALIGNED((unsigned long)sig, SZ_4K))
> + return ERR_PTR(-EINVAL);
> +
> + /* seamldr_params accepts one 4KB-page for sigstruct */
> + if (sig_size != SZ_4K)
According to the link [2] you provided above, it seems that the layout of
tdx_blob as following:
tdx_blob
|- u16 version
|- u16 checksum
|- u32 offset_of_module --------------------------------------|
|- u8 signature[8] |
|- u32 len 8KB + (N * 4KB) |
|- u32 resv1 |
|- u64 resv2[509] |
|- u8 data[] |
|- _u64 sigstruct[256] //2KB sigstruct |
|- _u64 reserved2[256] |
|- _u64 reserved3[N*512] //4KB aligned, optional, N >=0 |
|- _u8 module[] //<-----------------------------|
If N is not 0 for reserved3, then the sig_size passed will not be 4KB.
> + return ERR_PTR(-EINVAL);
> +
> + params = (struct seamldr_params *)get_zeroed_page(GFP_KERNEL);
> + if (!params)
> + return ERR_PTR(-ENOMEM);
> +
> + params->scenario = SEAMLDR_SCENARIO_UPDATE;
> + params->sigstruct_pa = (vmalloc_to_pfn(sig) << PAGE_SHIFT) +
> + ((unsigned long)sig & ~PAGE_MASK);
Since sig is 4KB aligned, is ((unsigned long)sig & ~PAGE_MASK) needed?
> + params->num_module_pages = module_size / SZ_4K;
> +
> + ptr = module;
> + for (i = 0; i < params->num_module_pages; i++) {
> + params->mod_pages_pa_list[i] = (vmalloc_to_pfn(ptr) << PAGE_SHIFT) +
> + ((unsigned long)ptr & ~PAGE_MASK);
Ditto for ptr, very ptr is 4KB aligned.
> + ptr += SZ_4K;
> + }
> +
> + return params;
> +}
> +
> +/*
> + * Intel TDX Module blob. Its format is defined at:
> + * https://github.com/intel/tdx-module-binaries/blob/main/blob_structure.txt
> + */
> +struct tdx_blob {
> + u16 version;
> + u16 checksum;
> + u32 offset_of_module;
> + u8 signature[8];
> + u32 len;
> + u32 resv1;
> + u64 resv2[509];
> + u8 data[];
> +} __packed;
> +
> +/*
> + * Verify that the checksum of the entire blob is zero. The checksum is
> + * calculated by summing up all 16-bit words, with carry bits dropped.
> + */
> +static bool verify_checksum(const struct tdx_blob *blob)
> +{
> + u32 size = blob->len;
> + u16 checksum = 0;
> + const u16 *p;
> + int i;
> +
> + /* Handle the last byte if the size is odd */
> + if (size % 2) {
> + checksum += *((const u8 *)blob + size - 1);
> + size--;
> + }
> +
> + p = (const u16 *)blob;
> + for (i = 0; i < size; i += 2) {
> + checksum += *p;
> + p++;
> + }
> +
> + return !checksum;
> +}
> +
> +static struct seamldr_params *init_seamldr_params(const u8 *data, u32 size)
> +{
> + const struct tdx_blob *blob = (const void *)data;
> + int module_size, sig_size;
> + const void *sig, *module;
> +
> + if (blob->version != 0x100) {
> + pr_err("unsupported blob version: %u\n", blob->version);
Based on the link [2], 0x100 stands for version 1.0, Using hexadecimal seems
more readable.
> + return ERR_PTR(-EINVAL);
> + }
> +
> + if (blob->resv1 || memchr_inv(blob->resv2, 0, sizeof(blob->resv2))) {
> + pr_err("non-zero reserved fields\n");
> + return ERR_PTR(-EINVAL);
> + }
> +
> + /* Split the given blob into a sigstruct and a module */
> + sig = blob->data;
> + sig_size = blob->offset_of_module - sizeof(struct tdx_blob);
> + module = data + blob->offset_of_module;
> + module_size = size - blob->offset_of_module;
> +
> + if (sig_size <= 0 || module_size <= 0 || blob->len != size)
> + return ERR_PTR(-EINVAL);
> +
> + if (memcmp(blob->signature, "TDX-BLOB", 8)) {
> + pr_err("invalid signature\n");
> + return ERR_PTR(-EINVAL);
> + }
> +
> + if (!verify_checksum(blob)) {
> + pr_err("invalid checksum\n");
> + return ERR_PTR(-EINVAL);
> + }
> +
> + return alloc_seamldr_params(module, module_size, sig, sig_size);
> +}
> +
> +DEFINE_FREE(free_seamldr_params, struct seamldr_params *,
> + if (!IS_ERR_OR_NULL(_T)) free_seamldr_params(_T))
> +
> int seamldr_install_module(const u8 *data, u32 size)
> {
> const struct seamldr_info *info = seamldr_get_info();
> @@ -82,6 +232,11 @@ int seamldr_install_module(const u8 *data, u32 size)
> if (!info->num_remaining_updates)
> return -ENOSPC;
>
> + struct seamldr_params *params __free(free_seamldr_params) =
> + init_seamldr_params(data, size);
> + if (IS_ERR(params))
> + return PTR_ERR(params);
> +
> guard(cpus_read_lock)();
> if (!cpumask_equal(cpu_online_mask, cpu_present_mask)) {
> pr_err("Cannot update TDX module if any CPU is offline\n");
Powered by blists - more mailing lists