[PATCH v2 0/9] crypto: ccp - Make sev_cmd_mutex more granular

[Michael Roth <michael.roth@amd.com>]

This patchset is also available at:

  https://github.com/amdese/linux/commits/ccp-mutex-rework-v2

and is based on cryptodev-2.6 master (a29888556578).

v1: https://lore.kernel.org/linux-crypto/20261014132145.1726322-1-michael.roth@amd.com/
v2:
 - rework to address cleanup.h guidelines about not mixing goto
   with guard()'s (Sashiko)
 - invert boolean logic for better readability (Tom)
 - simplify by avoiding uncessary helper for sev_do_snp_platform_status() (Tom)


OVERVIEW
--------

The current code makes very coarse usage of the sev_cmd_mutex; for SEV
firmware ioctls, it is essentially taken upon entry, and ends up wrapping
a lot of potentially time-consuming prep/cleanup work that may need to be
done before/after issuing the actual firmware call, which is the main
thing the mutex is meant to protect.

Additionally, some of that prep work involves
copy_from_user()/copy_to_user() calls which can generate page faults and
unecessarily lead to potential deadlock scenarios. No known case exists
in current upstream, but with the upcoming KVM/guest_memfd support for
in-place conversion of the same PFN between shared/private state (which
is currently targeted for kernel 7.4), a special fault handler is added
that could theoretically deadlock if a malicious user tries to use
guest_memfd pages as the source/target of target of said
copy_from_user()/copy_to_user() scenarios[1].

So this series is a prereq to enabling the above-mentioned KVM/guest_memfd
in-place conversion support on SNP-enabled hosts, as well as a cleanup
for SEV ioctls in general.

Patches #7 and #9 are where the mutexes are actually made more granular,
the other patches are just prep for them.

Thank you to Sean for suggesting this approach and Ackerley for wrangling
the changes into a presentable patchset.


REFERENCES
----------

[1] https://lore.kernel.org/kvm/asz8GKNO9aQANr5E@google.com/


Thanks!

-Mike


----------------------------------------------------------------
Ackerley Tng (3):
      crypto: ccp - Shut down SEV firmware before copying to user
      crypto: ccp - Check SNP initialization state after copying user inputs
      crypto: ccp - Make usage of sev_cmd_mutex more granular

Michael Roth (6):
      crypto: ccp - Use __free() handlers for sev_ioctl_do_pek_csr() allocations
      crypto: ccp - Use __free() handlers for sev_ioctl_do_pek_import() allocations
      crypto: ccp - Use __free() handlers for sev_ioctl_do_pdh_export() allocations
      crypto: ccp: - Rework sev_ioctl_do_pdh_export() to avoid goto usage
      crypto: ccp - Use __free() handlers for __sev_do_snp_platform_status() allocations
      crypto: ccp - Allocate status page outside sev_cmd_mutex in SNP_PLATFORM_STATUS

 drivers/crypto/ccp/sev-dev.c | 277 ++++++++++++++++++++-----------------------
 1 file changed, 130 insertions(+), 147 deletions(-)