Skip to contentSkip to conversation

crypto: ccp: Add a quirk to firmware update

PATCH Superseded Jarkko Sakkinen 2 participants 3 messages Aug 8, 2022 – Aug 9, 2022

Subsystems (3)
Crypto API AMD cryptographic coprocessor (CCP) driver AMD cryptographic coprocessor (CCP) driver - SEV support

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Jarkko Sakkinen

author
#0 lore raw

PATCH 1/1 crypto: ccp: Add a quirk to firmware update

From: Jarkko Sakkinen <[email protected]>

A quirk for fixing the committed TCB version, when upgrading from earlier firmware version than 1.33.01. This is a known issue, and the documented workaround is to load the firmware twice.

The issue realizes in a machine where the upgrade is done from firmware reporting having SEV API version 1.49, and requires the following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
---
 drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/crypto/ccp/sev-dev.c +14 -2
index 799b476fc3e8..8ae26c5c64f6 100644
@@ -742,6 +742,11 @@ static int sev_update_firmware(struct device *dev)
 	struct page *p;
 	u64 data_size;
 
+	if (!sev_version_greater_or_equal(0, 15)) {
+		dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");
+		return -1;
+	}
+
 	if (sev_get_firmware(dev, &firmware) == -ENOENT) {
 		dev_dbg(dev, "No SEV firmware file present\n");
 		return -1;

@@ -774,6 +779,14 @@ static int sev_update_firmware(struct device *dev)
 	data->len = firmware->size;
 
 	ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
+	/*
+	 * A quirk for fixing the committed TCB version, when upgrading from
+	 * earlier firmware version than 1.33.01.
+	 */
+	if (!ret && !sev_version_greater_or_equal(1, 50))
+		ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
 	if (ret)
 		dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error);
 	else

@@ -1283,8 +1296,7 @@ void sev_pci_init(void)
 	if (sev_get_api_version())
 		goto err;
 
-	if (sev_version_greater_or_equal(0, 15) &&
-	    sev_update_firmware(sev->dev) == 0)
+	if (sev_update_firmware(sev->dev) == 0)
 		sev_get_api_version();
 
 	/* If an init_ex_path is provided rely on INIT_EX for PSP initialization
Signature · 1 line
2.37.1
maintainer
#1 lore raw
Quoted 1 line · Jarkko Sakkinen

From: Jarkko Sakkinen <[email protected]>

Looks good, just some minor commit message and comment changes requested.

Quoted 3 lines

A quirk for fixing the committed TCB version, when upgrading from earlier firmware version than 1.33.01. This is a known issue, and the documented

", when upgrading from earlier firmware version than 1.33.01" => "when upgrading from a firmware version earlier than 1.50"

Quoted 5 lines

workaround is to load the firmware twice.

The issue realizes in a machine where the upgrade is done from firmware reporting having SEV API version 1.49, and requires the following workaround:

Replace the above paragraph with just: "Currently, this issue requires the following workaround:"

Quoted 34 lines

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
---
  drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
  1 file changed, 14 insertions(+), 2 deletions(-)
drivers/crypto/ccp/sev-dev.c +5 -0
index 799b476fc3e8..8ae26c5c64f6 100644
@@ -742,6 +742,11 @@ static int sev_update_firmware(struct device *dev)
  	struct page *p;
  	u64 data_size;
 
+	if (!sev_version_greater_or_equal(0, 15)) {
+		dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");
+		return -1;
+	}
+
  	if (sev_get_firmware(dev, &firmware) == -ENOENT) {
  		dev_dbg(dev, "No SEV firmware file present\n");
  		return -1;

drivers/crypto/ccp/sev-dev.c static int sev_update_firmware(struct device *dev) · line 785

Quoted 7 lines
drivers/crypto/ccp/sev-dev.c +4 -0
@@ -774,6 +779,14 @@ static int sev_update_firmware(struct device *dev)
  	data->len = firmware->size;
 
  	ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
+	/*
+	 * A quirk for fixing the committed TCB version, when upgrading from
+	 * earlier firmware version than 1.33.01.

s/1.33.01/1.50/

Thanks,
Tom

Quoted 17 lines
drivers/crypto/ccp/sev-dev.c +5 -2
+	 */
+	if (!ret && !sev_version_greater_or_equal(1, 50))
+		ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
  	if (ret)
  		dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error);
  	else

@@ -1283,8 +1296,7 @@ void sev_pci_init(void)
  	if (sev_get_api_version())
  		goto err;
 
-	if (sev_version_greater_or_equal(0, 15) &&
-	    sev_update_firmware(sev->dev) == 0)
+	if (sev_update_firmware(sev->dev) == 0)
  		sev_get_api_version();
 
  	/* If an init_ex_path is provided rely on INIT_EX for PSP initialization
author
#2 lore raw
Quoted 63 lines · Tom Lendacky
Quoted 1 line · Jarkko Sakkinen

From: Jarkko Sakkinen <[email protected]>

Looks good, just some minor commit message and comment changes requested.

Quoted 3 lines

A quirk for fixing the committed TCB version, when upgrading from earlier firmware version than 1.33.01. This is a known issue, and the documented

", when upgrading from earlier firmware version than 1.33.01" => "when upgrading from a firmware version earlier than 1.50"

Quoted 5 lines

workaround is to load the firmware twice.

The issue realizes in a machine where the upgrade is done from firmware reporting having SEV API version 1.49, and requires the following workaround:

Replace the above paragraph with just: "Currently, this issue requires the following workaround:"

Quoted 33 lines

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
---
  drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
  1 file changed, 14 insertions(+), 2 deletions(-)
drivers/crypto/ccp/sev-dev.c +5 -0
index 799b476fc3e8..8ae26c5c64f6 100644
@@ -742,6 +742,11 @@ static int sev_update_firmware(struct device *dev)
  	struct page *p;
  	u64 data_size;
+	if (!sev_version_greater_or_equal(0, 15)) {
+		dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");
+		return -1;
+	}
+
  	if (sev_get_firmware(dev, &firmware) == -ENOENT) {
  		dev_dbg(dev, "No SEV firmware file present\n");
  		return -1;

drivers/crypto/ccp/sev-dev.c static int sev_update_firmware(struct device *dev) · line 784

Quoted 6 lines
drivers/crypto/ccp/sev-dev.c +4 -0
@@ -774,6 +779,14 @@ static int sev_update_firmware(struct device *dev)
  	data->len = firmware->size;
  	ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
+	/*
+	 * A quirk for fixing the committed TCB version, when upgrading from
+	 * earlier firmware version than 1.33.01.

s/1.33.01/1.50/

Quoted 2 lines

Thanks,
Tom

Thanks Tom, I'll address the issues and send a new version.

BR, Jarkko