Skip to contentSkip to conversation

crypto: ccp: Add a quirk to firmware update

PATCH In review Jarkko Sakkinen 3 participants 3 messages Aug 9, 2022 – Aug 19, 2022

Subsystems (3)
Crypto API AMD cryptographic coprocessor (CCP) driver AMD cryptographic coprocessor (CCP) driver - SEV support
lore
Share & tools
lore

Jarkko Sakkinen

author
#0 lore raw

PATCH v2 1/1 crypto: ccp: Add a quirk to firmware update

From: Jarkko Sakkinen <[email protected]>

A quirk for fixing the committed TCB version, when upgrading from a firmware version earlier than 1.50. This is a known issue, and the documented workaround is to load the firmware twice.

Currently, this issue requires the following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>

---
v2:
- Updated the commit message and comments.
https://lore.kernel.org/all/[email protected]/

 drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/crypto/ccp/sev-dev.c +14 -2
index 799b476fc3e8..f27f8bc966b1 100644
@@ -742,6 +742,11 @@ static int sev_update_firmware(struct device *dev)
 	struct page *p;
 	u64 data_size;
 
+	if (!sev_version_greater_or_equal(0, 15)) {
+		dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");
+		return -1;
+	}
+
 	if (sev_get_firmware(dev, &firmware) == -ENOENT) {
 		dev_dbg(dev, "No SEV firmware file present\n");
 		return -1;

@@ -774,6 +779,14 @@ static int sev_update_firmware(struct device *dev)
 	data->len = firmware->size;
 
 	ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
+	/*
+	 * A quirk for fixing the committed TCB version, when upgrading from
+	 * earlier firmware version than 1.50.
+	 */
+	if (!ret && !sev_version_greater_or_equal(1, 50))
+		ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
+
 	if (ret)
 		dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error);
 	else

@@ -1283,8 +1296,7 @@ void sev_pci_init(void)
 	if (sev_get_api_version())
 		goto err;
 
-	if (sev_version_greater_or_equal(0, 15) &&
-	    sev_update_firmware(sev->dev) == 0)
+	if (sev_update_firmware(sev->dev) == 0)
 		sev_get_api_version();
 
 	/* If an init_ex_path is provided rely on INIT_EX for PSP initialization
Signature · 1 line
2.37.1
maintainer Acked-by on v2 1/1
#1 lore raw
Quoted 13 lines · Jarkko Sakkinen

From: Jarkko Sakkinen <[email protected]>

A quirk for fixing the committed TCB version, when upgrading from a firmware version earlier than 1.50. This is a known issue, and the documented workaround is to load the firmware twice.

Currently, this issue requires the following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Quoted 7 lines

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
Acked-by Tom Lendacky <[email protected]>
maintainer
#2 lore raw
In reply to Jarkko Sakkinen
Quoted 20 lines · Jarkko Sakkinen

From: Jarkko Sakkinen <[email protected]>

A quirk for fixing the committed TCB version, when upgrading from a firmware version earlier than 1.50. This is a known issue, and the documented workaround is to load the firmware twice.

Currently, this issue requires the following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API version is less than 1.50, and if so, download the firmware twice. This addresses the TCB version issue.

Link https://lore.kernel.org/all/[email protected]/ open here
Reported-by Harald Hoyer <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
Quoted 6 lines

---
v2:
- Updated the commit message and comments.
https://lore.kernel.org/all/[email protected]/

 drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt