diff options
Diffstat (limited to 'meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.14.71-e3000/0030-crypto-ccp-Implement-SEV_PEK_CERT_IMPORT-ioctl-comma.patch')
| -rw-r--r-- | meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.14.71-e3000/0030-crypto-ccp-Implement-SEV_PEK_CERT_IMPORT-ioctl-comma.patch | 155 |
1 files changed, 0 insertions, 155 deletions
diff --git a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.14.71-e3000/0030-crypto-ccp-Implement-SEV_PEK_CERT_IMPORT-ioctl-comma.patch b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.14.71-e3000/0030-crypto-ccp-Implement-SEV_PEK_CERT_IMPORT-ioctl-comma.patch deleted file mode 100644 index f053c273..00000000 --- a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.14.71-e3000/0030-crypto-ccp-Implement-SEV_PEK_CERT_IMPORT-ioctl-comma.patch +++ /dev/null @@ -1,155 +0,0 @@ -From 9dfdbc1c0e75abf8130122c6d0661d40c884aa42 Mon Sep 17 00:00:00 2001 -From: Brijesh Singh <brijesh.singh@amd.com> -Date: Mon, 4 Dec 2017 10:57:31 -0600 -Subject: [PATCH 30/95] crypto: ccp: Implement SEV_PEK_CERT_IMPORT ioctl - command -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The SEV_PEK_CERT_IMPORT command can be used to import the signed PEK -certificate. The command is defined in SEV spec section 5.8. - -Cc: Paolo Bonzini <pbonzini@redhat.com> -Cc: "Radim Krčmář" <rkrcmar@redhat.com> -Cc: Borislav Petkov <bp@suse.de> -Cc: Herbert Xu <herbert@gondor.apana.org.au> -Cc: Gary Hook <gary.hook@amd.com> -Cc: Tom Lendacky <thomas.lendacky@amd.com> -Cc: linux-crypto@vger.kernel.org -Cc: kvm@vger.kernel.org -Cc: linux-kernel@vger.kernel.org -Improvements-by: Borislav Petkov <bp@suse.de> -Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> -Acked-by: Gary R Hook <gary.hook@amd.com> -Reviewed-by: Borislav Petkov <bp@suse.de> -Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com> ---- - drivers/crypto/ccp/psp-dev.c | 81 ++++++++++++++++++++++++++++++++++++++++++++ - include/linux/psp-sev.h | 4 +++ - 2 files changed, 85 insertions(+) - -diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c -index c3906bb..9d1c460 100644 ---- a/drivers/crypto/ccp/psp-dev.c -+++ b/drivers/crypto/ccp/psp-dev.c -@@ -365,6 +365,84 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp) - return ret; - } - -+void *psp_copy_user_blob(u64 __user uaddr, u32 len) -+{ -+ void *data; -+ -+ if (!uaddr || !len) -+ return ERR_PTR(-EINVAL); -+ -+ /* verify that blob length does not exceed our limit */ -+ if (len > SEV_FW_BLOB_MAX_SIZE) -+ return ERR_PTR(-EINVAL); -+ -+ data = kmalloc(len, GFP_KERNEL); -+ if (!data) -+ return ERR_PTR(-ENOMEM); -+ -+ if (copy_from_user(data, (void __user *)(uintptr_t)uaddr, len)) -+ goto e_free; -+ -+ return data; -+ -+e_free: -+ kfree(data); -+ return ERR_PTR(-EFAULT); -+} -+EXPORT_SYMBOL_GPL(psp_copy_user_blob); -+ -+static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp) -+{ -+ struct sev_user_data_pek_cert_import input; -+ struct sev_data_pek_cert_import *data; -+ void *pek_blob, *oca_blob; -+ int ret; -+ -+ if (copy_from_user(&input, (void __user *)argp->data, sizeof(input))) -+ return -EFAULT; -+ -+ data = kzalloc(sizeof(*data), GFP_KERNEL); -+ if (!data) -+ return -ENOMEM; -+ -+ /* copy PEK certificate blobs from userspace */ -+ pek_blob = psp_copy_user_blob(input.pek_cert_address, input.pek_cert_len); -+ if (IS_ERR(pek_blob)) { -+ ret = PTR_ERR(pek_blob); -+ goto e_free; -+ } -+ -+ data->pek_cert_address = __psp_pa(pek_blob); -+ data->pek_cert_len = input.pek_cert_len; -+ -+ /* copy PEK certificate blobs from userspace */ -+ oca_blob = psp_copy_user_blob(input.oca_cert_address, input.oca_cert_len); -+ if (IS_ERR(oca_blob)) { -+ ret = PTR_ERR(oca_blob); -+ goto e_free_pek; -+ } -+ -+ data->oca_cert_address = __psp_pa(oca_blob); -+ data->oca_cert_len = input.oca_cert_len; -+ -+ /* If platform is not in INIT state then transition it to INIT */ -+ if (psp_master->sev_state != SEV_STATE_INIT) { -+ ret = __sev_platform_init_locked(&argp->error); -+ if (ret) -+ goto e_free_oca; -+ } -+ -+ ret = __sev_do_cmd_locked(SEV_CMD_PEK_CERT_IMPORT, data, &argp->error); -+ -+e_free_oca: -+ kfree(oca_blob); -+e_free_pek: -+ kfree(pek_blob); -+e_free: -+ kfree(data); -+ return ret; -+} -+ - static long sev_ioctl(struct file *file, unsigned int ioctl, unsigned long arg) - { - void __user *argp = (void __user *)arg; -@@ -402,6 +480,9 @@ static long sev_ioctl(struct file *file, unsigned int ioctl, unsigned long arg) - case SEV_PEK_CSR: - ret = sev_ioctl_do_pek_csr(&input); - break; -+ case SEV_PEK_CERT_IMPORT: -+ ret = sev_ioctl_do_pek_import(&input); -+ break; - default: - ret = -EINVAL; - goto out; -diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h -index 0b6dd30..93addfa 100644 ---- a/include/linux/psp-sev.h -+++ b/include/linux/psp-sev.h -@@ -576,6 +576,8 @@ int sev_guest_df_flush(int *error); - */ - int sev_guest_decommission(struct sev_data_decommission *data, int *error); - -+void *psp_copy_user_blob(u64 __user uaddr, u32 len); -+ - #else /* !CONFIG_CRYPTO_DEV_SP_PSP */ - - static inline int -@@ -597,6 +599,8 @@ static inline int sev_guest_df_flush(int *error) { return -ENODEV; } - static inline int - sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; } - -+static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); } -+ - #endif /* CONFIG_CRYPTO_DEV_SP_PSP */ - - #endif /* __PSP_SEV_H__ */ --- -2.7.4 - |