Commit b3b9fdf1 authored by Jarkko Sakkinen's avatar Jarkko Sakkinen Committed by Herbert Xu
Browse files

crypto: ccp - Add a quirk to firmware update 

A quirk for fixing the committed TCB version, when upgrading from a
firmware version earlier than 1.50. This is a known issue, and the
documented workaround is to load the firmware twice.

Currently, this issue requires the  following workaround:

sudo modprobe -r kvm_amd
sudo modprobe -r ccp
sudo modprobe ccp
sudo modprobe kvm_amd

Implement this workaround inside kernel by checking whether the API
version is less than 1.50, and if so, download the firmware twice.
This addresses the TCB version issue.

Link: https://lore.kernel.org/all/de02389f-249d-f565-1136-4af3655fab2a@profian.com/


Reported-by: default avatarHarald Hoyer <harald@profian.com>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@profian.com>
Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 56fae430

drivers/crypto/ccp/sev-dev.c

+14 −2
Original line number Diff line number Diff line
@@ -744,6 +744,11 @@ static int sev_update_firmware(struct device *dev) 
	struct page *p;

	u64 data_size;



	if (!sev_version_greater_or_equal(0, 15)) {

		dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");

		return -1;

	}



	if (sev_get_firmware(dev, &firmware) == -ENOENT) {

		dev_dbg(dev, "No SEV firmware file present\n");

		return -1;
@@ -776,6 +781,14 @@ static int sev_update_firmware(struct device *dev) 
	data->len = firmware->size;



	ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);



	/*

	 * A quirk for fixing the committed TCB version, when upgrading from

	 * earlier firmware version than 1.50.

	 */

	if (!ret && !sev_version_greater_or_equal(1, 50))

		ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);



	if (ret)

		dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error);

	else
@@ -1285,8 +1298,7 @@ void sev_pci_init(void) 
	if (sev_get_api_version())

		goto err;



	if (sev_version_greater_or_equal(0, 15) &&

	    sev_update_firmware(sev->dev) == 0)

	if (sev_update_firmware(sev->dev) == 0)

		sev_get_api_version();



	/* If an init_ex_path is provided rely on INIT_EX for PSP initialization