linux-stable/drivers/virt
Peter Gonda 47894e0fa6 virt/sev-guest: Prevent IV reuse in the SNP guest driver
The AMD Secure Processor (ASP) and an SNP guest use a series of
AES-GCM keys called VMPCKs to communicate securely with each other.
The IV to this scheme is a sequence number that both the ASP and the
guest track.

Currently, this sequence number in a guest request must exactly match
the sequence number tracked by the ASP. This means that if the guest
sees an error from the host during a request it can only retry that
exact request or disable the VMPCK to prevent an IV reuse. AES-GCM
cannot tolerate IV reuse, see: "Authentication Failures in NIST version
of GCM" - Antoine Joux et al.

In order to address this, make handle_guest_request() delete the VMPCK
on any non successful return. To allow userspace querying the cert_data
length make handle_guest_request() save the number of pages required by
the host, then have handle_guest_request() retry the request without
requesting the extended data, then return the number of pages required
back to userspace.

  [ bp: Massage, incorporate Tom's review comments. ]

Fixes: fce96cf044 ("virt: Add SEV-SNP guest driver")
Reported-by: Peter Gonda <pgonda@google.com>
Signed-off-by: Peter Gonda <pgonda@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20221116175558.2373112-1-pgonda@google.com
2022-11-21 11:03:40 +01:00
..
acrn virt: acrn: using for_each_set_bit to simplify the code 2022-07-08 15:42:10 +02:00
coco virt/sev-guest: Prevent IV reuse in the SNP guest driver 2022-11-21 11:03:40 +01:00
nitro_enclaves kunit: fix Kconfig for build-in tests USB4 and Nitro Enclaves 2022-09-01 13:00:48 -06:00
vboxguest virt: vbox: Remove unproper information 2022-09-09 10:19:18 +02:00
fsl_hypervisor.c drivers/virt/fsl_hypervisor: remove unneeded ret variable in fsl_hv_open() 2022-04-26 12:50:31 +02:00
Kconfig AMD SEV-SNP support 2022-05-23 17:38:01 -07:00
Makefile AMD SEV-SNP support 2022-05-23 17:38:01 -07:00
vmgenid.c virt: vmgenid: recognize new CID added by Hyper-V 2022-03-25 08:49:40 -06:00