From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:28 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktm-0000qx-C0; Thu, 01 May 2014 06:55:14 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktl-0000qo-MH for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:13 +0000 Received: from [85.158.139.211:20680] by server-11.bemta-5.messagelabs.com id 07/7B-30804-1DFE1635; Thu, 01 May 2014 06:55:13 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-5.tower-206.messagelabs.com!1398927311!1680424!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 18079 invoked from network); 1 May 2014 06:55:12 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-5.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:12 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkti-0001nT-RV for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:10 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfktd-0004p2-Fh for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:05 +0000 Date: Thu, 01 May 2014 06:55:05 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Inject an undefined instruction when the coproc/sysreg is not handled X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 60f737636c2be52fe1af2f1a3a2f66acacdc6a30 Author: Julien Grall AuthorDate: Mon Apr 14 19:01:20 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:33 2014 +0100 xen/arm: Inject an undefined instruction when the coproc/sysreg is not handled Currently Xen panics if it's unable to handle a coprocessor/sysreg instruction. Replace this behavior by inject an undefined instruction to the faulty guest and log if Xen is in debug mode. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 61 +++++++++++++++++++++++++++++++++---------------- 1 files changed, 41 insertions(+), 20 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index a7edc4e..92b7910 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -1351,10 +1351,16 @@ static void do_cp15_32(struct cpu_user_regs *regs, *r = v->arch.actlr; break; default: - printk("%s p15, %d, r%d, cr%d, cr%d, %d @ 0x%"PRIregister"\n", - cp32.read ? "mrc" : "mcr", - cp32.op1, cp32.reg, cp32.crn, cp32.crm, cp32.op2, regs->pc); - panic("unhandled 32-bit CP15 access %#x", hsr.bits & HSR_CP32_REGS_MASK); +#ifndef NDEBUG + gdprintk(XENLOG_ERR, + "%s p15, %d, r%d, cr%d, cr%d, %d @ 0x%"PRIregister"\n", + cp32.read ? "mrc" : "mcr", + cp32.op1, cp32.reg, cp32.crn, cp32.crm, cp32.op2, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 32-bit CP15 access %#x", + hsr.bits & HSR_CP32_REGS_MASK); +#endif + inject_undef32_exception(regs); + return; } advance_pc(regs, hsr); } @@ -1362,8 +1368,6 @@ static void do_cp15_32(struct cpu_user_regs *regs, static void do_cp15_64(struct cpu_user_regs *regs, union hsr hsr) { - struct hsr_cp64 cp64 = hsr.cp64; - if ( !check_conditional_instr(regs, hsr) ) { advance_pc(regs, hsr); @@ -1381,10 +1385,20 @@ static void do_cp15_64(struct cpu_user_regs *regs, } break; default: - printk("%s p15, %d, r%d, r%d, cr%d @ 0x%"PRIregister"\n", - cp64.read ? "mrrc" : "mcrr", - cp64.op1, cp64.reg1, cp64.reg2, cp64.crm, regs->pc); - panic("unhandled 64-bit CP15 access %#x", hsr.bits & HSR_CP64_REGS_MASK); + { +#ifndef NDEBUG + struct hsr_cp64 cp64 = hsr.cp64; + + gdprintk(XENLOG_ERR, + "%s p15, %d, r%d, r%d, cr%d @ 0x%"PRIregister"\n", + cp64.read ? "mrrc" : "mcrr", + cp64.op1, cp64.reg1, cp64.reg2, cp64.crm, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 64-bit CP15 access %#x", + hsr.bits & HSR_CP64_REGS_MASK); +#endif + inject_undef32_exception(regs); + return; + } } advance_pc(regs, hsr); } @@ -1393,7 +1407,6 @@ static void do_cp15_64(struct cpu_user_regs *regs, static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) { - struct hsr_sysreg sysreg = hsr.sysreg; switch ( hsr.bits & HSR_SYSREG_REGS_MASK ) { @@ -1407,15 +1420,23 @@ static void do_sysreg(struct cpu_user_regs *regs, } break; default: - printk("%s %d, %d, c%d, c%d, %d %s x%d @ 0x%"PRIregister"\n", - sysreg.read ? "mrs" : "msr", - sysreg.op0, sysreg.op1, - sysreg.crn, sysreg.crm, - sysreg.op2, - sysreg.read ? "=>" : "<=", - sysreg.reg, regs->pc); - panic("unhandled 64-bit sysreg access %#x", - hsr.bits & HSR_SYSREG_REGS_MASK); + { + struct hsr_sysreg sysreg = hsr.sysreg; +#ifndef NDEBUG + + gdprintk(XENLOG_ERR, + "%s %d, %d, c%d, c%d, %d %s x%d @ 0x%"PRIregister"\n", + sysreg.read ? "mrs" : "msr", + sysreg.op0, sysreg.op1, + sysreg.crn, sysreg.crm, + sysreg.op2, + sysreg.read ? "=>" : "<=", + sysreg.reg, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 64-bit sysreg access %#x", + hsr.bits & HSR_SYSREG_REGS_MASK); +#endif + inject_undef64_exception(regs, sysreg.len); + } } regs->pc += 4; -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:28 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktm-0000qx-C0; Thu, 01 May 2014 06:55:14 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktl-0000qo-MH for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:13 +0000 Received: from [85.158.139.211:20680] by server-11.bemta-5.messagelabs.com id 07/7B-30804-1DFE1635; Thu, 01 May 2014 06:55:13 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-5.tower-206.messagelabs.com!1398927311!1680424!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 18079 invoked from network); 1 May 2014 06:55:12 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-5.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:12 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkti-0001nT-RV for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:10 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfktd-0004p2-Fh for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:05 +0000 Date: Thu, 01 May 2014 06:55:05 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Inject an undefined instruction when the coproc/sysreg is not handled X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 60f737636c2be52fe1af2f1a3a2f66acacdc6a30 Author: Julien Grall AuthorDate: Mon Apr 14 19:01:20 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:33 2014 +0100 xen/arm: Inject an undefined instruction when the coproc/sysreg is not handled Currently Xen panics if it's unable to handle a coprocessor/sysreg instruction. Replace this behavior by inject an undefined instruction to the faulty guest and log if Xen is in debug mode. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 61 +++++++++++++++++++++++++++++++++---------------- 1 files changed, 41 insertions(+), 20 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index a7edc4e..92b7910 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -1351,10 +1351,16 @@ static void do_cp15_32(struct cpu_user_regs *regs, *r = v->arch.actlr; break; default: - printk("%s p15, %d, r%d, cr%d, cr%d, %d @ 0x%"PRIregister"\n", - cp32.read ? "mrc" : "mcr", - cp32.op1, cp32.reg, cp32.crn, cp32.crm, cp32.op2, regs->pc); - panic("unhandled 32-bit CP15 access %#x", hsr.bits & HSR_CP32_REGS_MASK); +#ifndef NDEBUG + gdprintk(XENLOG_ERR, + "%s p15, %d, r%d, cr%d, cr%d, %d @ 0x%"PRIregister"\n", + cp32.read ? "mrc" : "mcr", + cp32.op1, cp32.reg, cp32.crn, cp32.crm, cp32.op2, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 32-bit CP15 access %#x", + hsr.bits & HSR_CP32_REGS_MASK); +#endif + inject_undef32_exception(regs); + return; } advance_pc(regs, hsr); } @@ -1362,8 +1368,6 @@ static void do_cp15_32(struct cpu_user_regs *regs, static void do_cp15_64(struct cpu_user_regs *regs, union hsr hsr) { - struct hsr_cp64 cp64 = hsr.cp64; - if ( !check_conditional_instr(regs, hsr) ) { advance_pc(regs, hsr); @@ -1381,10 +1385,20 @@ static void do_cp15_64(struct cpu_user_regs *regs, } break; default: - printk("%s p15, %d, r%d, r%d, cr%d @ 0x%"PRIregister"\n", - cp64.read ? "mrrc" : "mcrr", - cp64.op1, cp64.reg1, cp64.reg2, cp64.crm, regs->pc); - panic("unhandled 64-bit CP15 access %#x", hsr.bits & HSR_CP64_REGS_MASK); + { +#ifndef NDEBUG + struct hsr_cp64 cp64 = hsr.cp64; + + gdprintk(XENLOG_ERR, + "%s p15, %d, r%d, r%d, cr%d @ 0x%"PRIregister"\n", + cp64.read ? "mrrc" : "mcrr", + cp64.op1, cp64.reg1, cp64.reg2, cp64.crm, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 64-bit CP15 access %#x", + hsr.bits & HSR_CP64_REGS_MASK); +#endif + inject_undef32_exception(regs); + return; + } } advance_pc(regs, hsr); } @@ -1393,7 +1407,6 @@ static void do_cp15_64(struct cpu_user_regs *regs, static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) { - struct hsr_sysreg sysreg = hsr.sysreg; switch ( hsr.bits & HSR_SYSREG_REGS_MASK ) { @@ -1407,15 +1420,23 @@ static void do_sysreg(struct cpu_user_regs *regs, } break; default: - printk("%s %d, %d, c%d, c%d, %d %s x%d @ 0x%"PRIregister"\n", - sysreg.read ? "mrs" : "msr", - sysreg.op0, sysreg.op1, - sysreg.crn, sysreg.crm, - sysreg.op2, - sysreg.read ? "=>" : "<=", - sysreg.reg, regs->pc); - panic("unhandled 64-bit sysreg access %#x", - hsr.bits & HSR_SYSREG_REGS_MASK); + { + struct hsr_sysreg sysreg = hsr.sysreg; +#ifndef NDEBUG + + gdprintk(XENLOG_ERR, + "%s %d, %d, c%d, c%d, %d %s x%d @ 0x%"PRIregister"\n", + sysreg.read ? "mrs" : "msr", + sysreg.op0, sysreg.op1, + sysreg.crn, sysreg.crm, + sysreg.op2, + sysreg.read ? "=>" : "<=", + sysreg.reg, regs->pc); + gdprintk(XENLOG_ERR, "unhandled 64-bit sysreg access %#x", + hsr.bits & HSR_SYSREG_REGS_MASK); +#endif + inject_undef64_exception(regs, sysreg.len); + } } regs->pc += 4; -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:35 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktx-0000rs-Ec; Thu, 01 May 2014 06:55:25 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktw-0000rh-21 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:24 +0000 Received: from [85.158.139.211:34141] by server-9.bemta-5.messagelabs.com id 2A/A9-04350-BDFE1635; Thu, 01 May 2014 06:55:23 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-5.tower-206.messagelabs.com!1398927321!1680447!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 18638 invoked from network); 1 May 2014 06:55:22 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-5.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:22 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktt-0001nW-2O for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:21 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfktt-0004pU-0x for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:21 +0000 Date: Thu, 01 May 2014 06:55:21 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't let the guest access the coprocessors registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 5496c642535da9c5738a3e19276de564304a5082 Author: Julien Grall AuthorDate: Mon Apr 14 20:37:16 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:34 2014 +0100 xen/arm: Don't let the guest access the coprocessors registers In Xen we only handle save/restore for coprocessor 10 and 11 (NEON). Other coprocessors (0-9, 12-13) are currently exposed to the guest and may lead to data shared between guest. Disable access to all coprocessor except 10 and 11 by setting correctly HCTPR. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 22 ++++++++++++++++++++++ xen/include/asm-arm/cpregs.h | 2 ++ xen/include/asm-arm/processor.h | 7 ++++++- 3 files changed, 30 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 92b7910..97ab286 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,12 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap all coprocessor registers (0-13) except cp10 and cp11 for VFP + * /!\ All processors except cp10 and cp11 cannot be used in Xen + */ + WRITE_SYSREG((HCPTR_CP_MASK & ~(HCPTR_CP(10) | HCPTR_CP(11))) | HCPTR_TTA, + CPTR_EL2); + /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| HCR_TAC, HCR_EL2); @@ -1403,6 +1409,17 @@ static void do_cp15_64(struct cpu_user_regs *regs, advance_pc(regs, hsr); } +static void do_cp(struct cpu_user_regs *regs, union hsr hsr) +{ + if ( !check_conditional_instr(regs, hsr) ) + { + advance_pc(regs, hsr); + return; + } + + inject_undef32_exception(regs); +} + #ifdef CONFIG_ARM_64 static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) @@ -1594,6 +1611,11 @@ asmlinkage void do_trap_hypervisor(struct cpu_user_regs *regs) goto bad_trap; do_cp15_64(regs, hsr); break; + case HSR_EC_CP: + if ( !is_32bit_domain(current->domain) ) + goto bad_trap; + do_cp(regs, hsr); + break; case HSR_EC_SMC32: inject_undef32_exception(regs); break; diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index 508467a..2b411af 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -115,6 +115,7 @@ #define NSACR p15,0,c1,c1,2 /* Non-Secure Access Control Register */ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ +#define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ /* CP15 CR2: Translation Table Base and Control Registers */ #define TTBCR p15,0,c2,c0,2 /* Translatation Table Base Control Register */ @@ -260,6 +261,7 @@ #define CNTV_CVAL_EL0 CNTV_CVAL #define CONTEXTIDR_EL1 CONTEXTIDR #define CPACR_EL1 CPACR +#define CPTR_EL2 HCPTR #define CSSELR_EL1 CSSELR #define DACR32_EL2 DACR #define ESR_EL1 DFSR diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 06e638f..02cefe9 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -84,13 +84,18 @@ #define HCR_SWIO (_AC(1,UL)<<1) /* Set/Way Invalidation Override */ #define HCR_VM (_AC(1,UL)<<0) /* Virtual MMU Enable */ +/* HCPTR Hyp. Coprocessor Trap Register */ +#define HCPTR_TTA ((_AC(1,U)<<20)) /* Trap trace registers */ +#define HCPTR_CP(x) ((_AC(1,U)<<(x))) /* Trap Coprocessor x */ +#define HCPTR_CP_MASK ((_AC(1,U)<<14)-1) + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 #define HSR_EC_CP15_64 0x04 #define HSR_EC_CP14_32 0x05 #define HSR_EC_CP14_DBG 0x06 -#define HSR_EC_CP 0x07 +#define HSR_EC_CP 0x07 /* HCPTR-trapped access to CP0-CP13 */ #define HSR_EC_CP10 0x08 #define HSR_EC_JAZELLE 0x09 #define HSR_EC_BXJ 0x0a -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:35 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktx-0000rs-Ec; Thu, 01 May 2014 06:55:25 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktw-0000rh-21 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:24 +0000 Received: from [85.158.139.211:34141] by server-9.bemta-5.messagelabs.com id 2A/A9-04350-BDFE1635; Thu, 01 May 2014 06:55:23 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-5.tower-206.messagelabs.com!1398927321!1680447!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 18638 invoked from network); 1 May 2014 06:55:22 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-5.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:22 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfktt-0001nW-2O for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:21 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfktt-0004pU-0x for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:21 +0000 Date: Thu, 01 May 2014 06:55:21 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't let the guest access the coprocessors registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 5496c642535da9c5738a3e19276de564304a5082 Author: Julien Grall AuthorDate: Mon Apr 14 20:37:16 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:34 2014 +0100 xen/arm: Don't let the guest access the coprocessors registers In Xen we only handle save/restore for coprocessor 10 and 11 (NEON). Other coprocessors (0-9, 12-13) are currently exposed to the guest and may lead to data shared between guest. Disable access to all coprocessor except 10 and 11 by setting correctly HCTPR. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 22 ++++++++++++++++++++++ xen/include/asm-arm/cpregs.h | 2 ++ xen/include/asm-arm/processor.h | 7 ++++++- 3 files changed, 30 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 92b7910..97ab286 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,12 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap all coprocessor registers (0-13) except cp10 and cp11 for VFP + * /!\ All processors except cp10 and cp11 cannot be used in Xen + */ + WRITE_SYSREG((HCPTR_CP_MASK & ~(HCPTR_CP(10) | HCPTR_CP(11))) | HCPTR_TTA, + CPTR_EL2); + /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| HCR_TAC, HCR_EL2); @@ -1403,6 +1409,17 @@ static void do_cp15_64(struct cpu_user_regs *regs, advance_pc(regs, hsr); } +static void do_cp(struct cpu_user_regs *regs, union hsr hsr) +{ + if ( !check_conditional_instr(regs, hsr) ) + { + advance_pc(regs, hsr); + return; + } + + inject_undef32_exception(regs); +} + #ifdef CONFIG_ARM_64 static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) @@ -1594,6 +1611,11 @@ asmlinkage void do_trap_hypervisor(struct cpu_user_regs *regs) goto bad_trap; do_cp15_64(regs, hsr); break; + case HSR_EC_CP: + if ( !is_32bit_domain(current->domain) ) + goto bad_trap; + do_cp(regs, hsr); + break; case HSR_EC_SMC32: inject_undef32_exception(regs); break; diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index 508467a..2b411af 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -115,6 +115,7 @@ #define NSACR p15,0,c1,c1,2 /* Non-Secure Access Control Register */ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ +#define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ /* CP15 CR2: Translation Table Base and Control Registers */ #define TTBCR p15,0,c2,c0,2 /* Translatation Table Base Control Register */ @@ -260,6 +261,7 @@ #define CNTV_CVAL_EL0 CNTV_CVAL #define CONTEXTIDR_EL1 CONTEXTIDR #define CPACR_EL1 CPACR +#define CPTR_EL2 HCPTR #define CSSELR_EL1 CSSELR #define DACR32_EL2 DACR #define ESR_EL1 DFSR diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 06e638f..02cefe9 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -84,13 +84,18 @@ #define HCR_SWIO (_AC(1,UL)<<1) /* Set/Way Invalidation Override */ #define HCR_VM (_AC(1,UL)<<0) /* Virtual MMU Enable */ +/* HCPTR Hyp. Coprocessor Trap Register */ +#define HCPTR_TTA ((_AC(1,U)<<20)) /* Trap trace registers */ +#define HCPTR_CP(x) ((_AC(1,U)<<(x))) /* Trap Coprocessor x */ +#define HCPTR_CP_MASK ((_AC(1,U)<<14)-1) + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 #define HSR_EC_CP15_64 0x04 #define HSR_EC_CP14_32 0x05 #define HSR_EC_CP14_DBG 0x06 -#define HSR_EC_CP 0x07 +#define HSR_EC_CP 0x07 /* HCPTR-trapped access to CP0-CP13 */ #define HSR_EC_CP10 0x08 #define HSR_EC_JAZELLE 0x09 #define HSR_EC_BXJ 0x0a -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:45 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku7-0000tf-HG; Thu, 01 May 2014 06:55:35 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku6-0000tI-4J for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:34 +0000 Received: from [85.158.137.68:59065] by server-13.bemta-3.messagelabs.com id FB/16-18692-5EFE1635; Thu, 01 May 2014 06:55:33 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-31.messagelabs.com!1398927331!1191338!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.3 required=7.0 tests=MAILTO_TO_SPAM_ADDR X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 12443 invoked from network); 1 May 2014 06:55:32 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-14.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:32 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku3-0001nb-B7 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:31 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfku3-0004pr-65 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:31 +0000 Date: Thu, 01 May 2014 06:55:31 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Upgrade DCISW into DCCISW X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit cda12fa0cee7023878598ff8ced3613b57576ce3 Author: Julien Grall AuthorDate: Mon Apr 14 20:46:43 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:34 2014 +0100 xen/arm: Upgrade DCISW into DCCISW A guest is allowed to use invalidate cache by set/way instruction (i.e DCISW) without any restriction. As the cache is shared with Xen, the guest invalidate an address being in used by Xen. This may lead a Xen crash because the memory state is invalid. Set the bit HCR.SWIO to upgrade invalidate cache by set/way instruction to an invalidate and clean. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Reported-by: Thomas Leonard Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 97ab286..17ac8d8 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -82,7 +82,7 @@ void __cpuinit init_traps(void) /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| - HCR_TAC, HCR_EL2); + HCR_TAC|HCR_SWIO, HCR_EL2); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:45 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku7-0000tf-HG; Thu, 01 May 2014 06:55:35 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku6-0000tI-4J for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:34 +0000 Received: from [85.158.137.68:59065] by server-13.bemta-3.messagelabs.com id FB/16-18692-5EFE1635; Thu, 01 May 2014 06:55:33 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-31.messagelabs.com!1398927331!1191338!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.3 required=7.0 tests=MAILTO_TO_SPAM_ADDR X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 12443 invoked from network); 1 May 2014 06:55:32 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-14.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:32 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfku3-0001nb-B7 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:31 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfku3-0004pr-65 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:31 +0000 Date: Thu, 01 May 2014 06:55:31 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Upgrade DCISW into DCCISW X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit cda12fa0cee7023878598ff8ced3613b57576ce3 Author: Julien Grall AuthorDate: Mon Apr 14 20:46:43 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:30:34 2014 +0100 xen/arm: Upgrade DCISW into DCCISW A guest is allowed to use invalidate cache by set/way instruction (i.e DCISW) without any restriction. As the cache is shared with Xen, the guest invalidate an address being in used by Xen. This may lead a Xen crash because the memory state is invalid. Set the bit HCR.SWIO to upgrade invalidate cache by set/way instruction to an invalidate and clean. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Reported-by: Thomas Leonard Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 97ab286..17ac8d8 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -82,7 +82,7 @@ void __cpuinit init_traps(void) /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| - HCR_TAC, HCR_EL2); + HCR_TAC|HCR_SWIO, HCR_EL2); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:46 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuH-0000vH-Jt; Thu, 01 May 2014 06:55:45 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuG-0000uz-1Q for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:44 +0000 Received: from [85.158.143.35:7984] by server-2.bemta-4.messagelabs.com id 93/F1-06539-FEFE1635; Thu, 01 May 2014 06:55:43 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-13.tower-21.messagelabs.com!1398927341!2160398!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 4289 invoked from network); 1 May 2014 06:55:42 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-13.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:42 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuD-0001nk-Fw for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:41 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuD-0004qG-Eh for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:41 +0000 Date: Thu, 01 May 2014 06:55:41 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Trap cache and TCM lockdown registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 11faafd9d9739a47d5fa360a43669f52672ef40e Author: Julien Grall AuthorDate: Mon Apr 14 20:00:14 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Trap cache and TCM lockdown registers Some cp15 c9/c10/c11 encodings are used for: - cache control - TCM control - branch predictor control All of them are implementation defined. For now inject an undefined exception if the guest wants try to access it. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 17ac8d8..b77e623 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -82,7 +82,7 @@ void __cpuinit init_traps(void) /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| - HCR_TAC|HCR_SWIO, HCR_EL2); + HCR_TAC|HCR_SWIO|HCR_TIDCP, HCR_EL2); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:55:46 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:55:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuH-0000vH-Jt; Thu, 01 May 2014 06:55:45 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuG-0000uz-1Q for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:44 +0000 Received: from [85.158.143.35:7984] by server-2.bemta-4.messagelabs.com id 93/F1-06539-FEFE1635; Thu, 01 May 2014 06:55:43 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-13.tower-21.messagelabs.com!1398927341!2160398!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 4289 invoked from network); 1 May 2014 06:55:42 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-13.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:42 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuD-0001nk-Fw for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:41 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuD-0004qG-Eh for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:41 +0000 Date: Thu, 01 May 2014 06:55:41 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Trap cache and TCM lockdown registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 11faafd9d9739a47d5fa360a43669f52672ef40e Author: Julien Grall AuthorDate: Mon Apr 14 20:00:14 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Trap cache and TCM lockdown registers Some cp15 c9/c10/c11 encodings are used for: - cache control - TCM control - branch predictor control All of them are implementation defined. For now inject an undefined exception if the guest wants try to access it. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 17ac8d8..b77e623 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -82,7 +82,7 @@ void __cpuinit init_traps(void) /* Setup hypervisor traps */ WRITE_SYSREG(HCR_PTW|HCR_BSU_INNER|HCR_AMO|HCR_IMO|HCR_VM|HCR_TWI|HCR_TSC| - HCR_TAC|HCR_SWIO, HCR_EL2); + HCR_TAC|HCR_SWIO|HCR_TIDCP, HCR_EL2); isb(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:05 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuR-0000xT-Me; Thu, 01 May 2014 06:55:55 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuQ-0000xA-DV for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:54 +0000 Received: from [85.158.137.68:39770] by server-11.bemta-3.messagelabs.com id 02/C9-19438-9FFE1635; Thu, 01 May 2014 06:55:53 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-10.tower-31.messagelabs.com!1398927351!1178276!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9539 invoked from network); 1 May 2014 06:55:52 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-10.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:52 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuN-0001nt-Of for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:51 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuN-0004qg-J2 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:51 +0000 Date: Thu, 01 May 2014 06:55:51 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't expose implementation defined registers (Cp15 c15) to the guest X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit a0453db0c6ead85e0e2143c133268bcc5a017f73 Author: Julien Grall AuthorDate: Tue Apr 15 12:45:28 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Don't expose implementation defined registers (Cp15 c15) to the guest On Cortex-A15, CP15 c15 contains registers to retrieve data from L1/L2 RAM. Exposing this registers to guest may result to leak data from Xen and/or another guest. By default trap every registers and inject an undefined instruction. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 3 +++ xen/include/asm-arm/cpregs.h | 2 ++ xen/include/asm-arm/processor.h | 3 +++ 3 files changed, 8 insertions(+), 0 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index b77e623..710e5cc 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,9 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap CP15 c15 used for implementation defined registers */ + WRITE_SYSREG(HSTR_T(15), HSTR_EL2); + /* Trap all coprocessor registers (0-13) except cp10 and cp11 for VFP * /!\ All processors except cp10 and cp11 cannot be used in Xen */ diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index 2b411af..e9a8094 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -116,6 +116,7 @@ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ #define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ +#define HSTR p15,4,c1,c1,3 /* Hyp. System Trap Register */ /* CP15 CR2: Translation Table Base and Control Registers */ #define TTBCR p15,0,c2,c0,2 /* Translatation Table Base Control Register */ @@ -270,6 +271,7 @@ #define FAR_EL2 HIFAR #define HCR_EL2 HCR #define HPFAR_EL2 HPFAR +#define HSTR_EL2 HSTR #define ID_AFR0_EL1 ID_AFR0 #define ID_DFR0_EL1 ID_DFR0 #define ID_ISAR0_EL1 ID_ISAR0 diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 02cefe9..750864a 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -89,6 +89,9 @@ #define HCPTR_CP(x) ((_AC(1,U)<<(x))) /* Trap Coprocessor x */ #define HCPTR_CP_MASK ((_AC(1,U)<<14)-1) +/* HSTR Hyp. System Trap Register */ +#define HSTR_T(x) ((_AC(1,U)<<(x))) /* Trap Cp15 c */ + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:05 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuR-0000xT-Me; Thu, 01 May 2014 06:55:55 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuQ-0000xA-DV for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:54 +0000 Received: from [85.158.137.68:39770] by server-11.bemta-3.messagelabs.com id 02/C9-19438-9FFE1635; Thu, 01 May 2014 06:55:53 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-10.tower-31.messagelabs.com!1398927351!1178276!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9539 invoked from network); 1 May 2014 06:55:52 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-10.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:55:52 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuN-0001nt-Of for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:51 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuN-0004qg-J2 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:55:51 +0000 Date: Thu, 01 May 2014 06:55:51 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't expose implementation defined registers (Cp15 c15) to the guest X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit a0453db0c6ead85e0e2143c133268bcc5a017f73 Author: Julien Grall AuthorDate: Tue Apr 15 12:45:28 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Don't expose implementation defined registers (Cp15 c15) to the guest On Cortex-A15, CP15 c15 contains registers to retrieve data from L1/L2 RAM. Exposing this registers to guest may result to leak data from Xen and/or another guest. By default trap every registers and inject an undefined instruction. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Acked-by: Ian Campbell --- xen/arch/arm/traps.c | 3 +++ xen/include/asm-arm/cpregs.h | 2 ++ xen/include/asm-arm/processor.h | 3 +++ 3 files changed, 8 insertions(+), 0 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index b77e623..710e5cc 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,9 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap CP15 c15 used for implementation defined registers */ + WRITE_SYSREG(HSTR_T(15), HSTR_EL2); + /* Trap all coprocessor registers (0-13) except cp10 and cp11 for VFP * /!\ All processors except cp10 and cp11 cannot be used in Xen */ diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index 2b411af..e9a8094 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -116,6 +116,7 @@ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ #define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ +#define HSTR p15,4,c1,c1,3 /* Hyp. System Trap Register */ /* CP15 CR2: Translation Table Base and Control Registers */ #define TTBCR p15,0,c2,c0,2 /* Translatation Table Base Control Register */ @@ -270,6 +271,7 @@ #define FAR_EL2 HIFAR #define HCR_EL2 HCR #define HPFAR_EL2 HPFAR +#define HSTR_EL2 HSTR #define ID_AFR0_EL1 ID_AFR0 #define ID_DFR0_EL1 ID_DFR0 #define ID_ISAR0_EL1 ID_ISAR0 diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 02cefe9..750864a 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -89,6 +89,9 @@ #define HCPTR_CP(x) ((_AC(1,U)<<(x))) /* Trap Coprocessor x */ #define HCPTR_CP_MASK ((_AC(1,U)<<14)-1) +/* HSTR Hyp. System Trap Register */ +#define HSTR_T(x) ((_AC(1,U)<<(x))) /* Trap Cp15 c */ + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:16 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuc-0000zU-PR; Thu, 01 May 2014 06:56:06 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkua-0000yp-TI for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:05 +0000 Received: from [85.158.139.211:56866] by server-17.bemta-5.messagelabs.com id 06/63-09046-400F1635; Thu, 01 May 2014 06:56:04 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-10.tower-206.messagelabs.com!1398927362!1668713!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests=UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 24765 invoked from network); 1 May 2014 06:56:03 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-10.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:03 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuX-0001oS-Tz for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:01 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuX-0004rC-S0 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:01 +0000 Date: Thu, 01 May 2014 06:56:01 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't let guess access to Debug and Performance Monitor registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 0b182202fef8ebfc093a00ead9414a683eb8807c Author: Julien Grall AuthorDate: Tue Apr 15 14:06:42 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Don't let guess access to Debug and Performance Monitor registers Debug and performance registers are not properly switched by Xen. Trap them and inject an undefined instruction, except for those registers which might be unconditionally accessed which we implement as RAZ/WI. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Signed-off-by: Ian Campbell --- xen/arch/arm/traps.c | 59 +++++++++++++++++++++++++++++++++++++++ xen/include/asm-arm/cpregs.h | 2 + xen/include/asm-arm/processor.h | 11 ++++++- xen/include/asm-arm/sysregs.h | 43 ++++++++++++++++++++++++++++ 4 files changed, 113 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 710e5cc..822848f 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,10 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap Debug and Performance Monitor accesses */ + WRITE_SYSREG(HDCR_TDRA|HDCR_TDOSA|HDCR_TDA|HDCR_TPM|HDCR_TPMCR, + MDCR_EL2); + /* Trap CP15 c15 used for implementation defined registers */ WRITE_SYSREG(HSTR_T(15), HSTR_EL2); @@ -1412,6 +1416,17 @@ static void do_cp15_64(struct cpu_user_regs *regs, advance_pc(regs, hsr); } +static void do_cp14(struct cpu_user_regs *regs, union hsr hsr) +{ + if ( !check_conditional_instr(regs, hsr) ) + { + advance_pc(regs, hsr); + return; + } + + inject_undef32_exception(regs); +} + static void do_cp(struct cpu_user_regs *regs, union hsr hsr) { if ( !check_conditional_instr(regs, hsr) ) @@ -1427,9 +1442,46 @@ static void do_cp(struct cpu_user_regs *regs, union hsr hsr) static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) { + register_t *x = select_user_reg(regs, hsr.sysreg.reg); switch ( hsr.bits & HSR_SYSREG_REGS_MASK ) { + /* RAZ/WI registers: */ + /* - Debug */ + case HSR_SYSREG_MDSCR_EL1: + /* - Perf monitors */ + case HSR_SYSREG_PMINTENSET_EL1: + case HSR_SYSREG_PMINTENCLR_EL1: + case HSR_SYSREG_PMCR_EL0: + case HSR_SYSREG_PMCNTENSET_EL0: + case HSR_SYSREG_PMCNTENCLR_EL0: + case HSR_SYSREG_PMOVSCLR_EL0: + case HSR_SYSREG_PMSWINC_EL0: + case HSR_SYSREG_PMSELR_EL0: + case HSR_SYSREG_PMCEID0_EL0: + case HSR_SYSREG_PMCEID1_EL0: + case HSR_SYSREG_PMCCNTR_EL0: + case HSR_SYSREG_PMXEVTYPER_EL0: + case HSR_SYSREG_PMXEVCNTR_EL0: + case HSR_SYSREG_PMUSERENR_EL0: + case HSR_SYSREG_PMOVSSET_EL0: + /* - Breakpoints */ + HSR_SYSREG_DBG_CASES(DBGBVR): + HSR_SYSREG_DBG_CASES(DBGBCR): + /* - Watchpoints */ + HSR_SYSREG_DBG_CASES(DBGWVR): + HSR_SYSREG_DBG_CASES(DBGWCR): + if ( hsr.sysreg.read ) + *x = 0; + /* else: write ignored */ + break; + + /* Write only, Write ignore registers: */ + case HSR_SYSREG_OSLAR_EL1: + if ( hsr.sysreg.read ) + goto bad_sysreg; + /* else: write ignored */ + break; case HSR_SYSREG_CNTP_CTL_EL0: case HSR_SYSREG_CNTP_TVAL_EL0: if ( !vtimer_emulate(regs, hsr) ) @@ -1440,6 +1492,7 @@ static void do_sysreg(struct cpu_user_regs *regs, } break; default: + bad_sysreg: { struct hsr_sysreg sysreg = hsr.sysreg; #ifndef NDEBUG @@ -1614,6 +1667,12 @@ asmlinkage void do_trap_hypervisor(struct cpu_user_regs *regs) goto bad_trap; do_cp15_64(regs, hsr); break; + case HSR_EC_CP14_32: + case HSR_EC_CP14_DBG: + if ( !is_32bit_domain(current->domain) ) + goto bad_trap; + do_cp14(regs, hsr); + break; case HSR_EC_CP: if ( !is_32bit_domain(current->domain) ) goto bad_trap; diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index e9a8094..bf8133e 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -115,6 +115,7 @@ #define NSACR p15,0,c1,c1,2 /* Non-Secure Access Control Register */ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ +#define HDCR p15,4,c1,c1,1 /* Hyp. Debug Configuration Register */ #define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ #define HSTR p15,4,c1,c1,3 /* Hyp. System Trap Register */ @@ -287,6 +288,7 @@ #define ID_PFR0_EL1 ID_PFR0 #define ID_PFR1_EL1 ID_PFR1 #define IFSR32_EL2 IFSR +#define MDCR_EL2 HDCR #define MIDR_EL1 MIDR #define MPIDR_EL1 MPIDR #define PAR_EL1 PAR diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 750864a..9267c1b 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -92,12 +92,19 @@ /* HSTR Hyp. System Trap Register */ #define HSTR_T(x) ((_AC(1,U)<<(x))) /* Trap Cp15 c */ +/* HDCR Hyp. Debug Configuration Register */ +#define HDCR_TDRA (_AC(1,U)<<11) /* Trap Debug ROM access */ +#define HDCR_TDOSA (_AC(1,U)<<10) /* Trap Debug-OS-related register access */ +#define HDCR_TDA (_AC(1,U)<<9) /* Trap Debug Access */ +#define HDCR_TPM (_AC(1,U)<<6) /* Trap Performance Monitors accesses */ +#define HDCR_TPMCR (_AC(1,U)<<5) /* Trap PMCR accesses */ + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 #define HSR_EC_CP15_64 0x04 -#define HSR_EC_CP14_32 0x05 -#define HSR_EC_CP14_DBG 0x06 +#define HSR_EC_CP14_32 0x05 /* Trapped MCR or MRC access to CP14 */ +#define HSR_EC_CP14_DBG 0x06 /* Trapped LDC/STC access to CP14 (only for debug registers) */ #define HSR_EC_CP 0x07 /* HCPTR-trapped access to CP0-CP13 */ #define HSR_EC_CP10 0x08 #define HSR_EC_JAZELLE 0x09 diff --git a/xen/include/asm-arm/sysregs.h b/xen/include/asm-arm/sysregs.h index 0cee0e9..4a4de34 100644 --- a/xen/include/asm-arm/sysregs.h +++ b/xen/include/asm-arm/sysregs.h @@ -40,6 +40,31 @@ ((__HSR_SYSREG_##crm) << HSR_SYSREG_CRM_SHIFT) | \ ((__HSR_SYSREG_##op2) << HSR_SYSREG_OP2_SHIFT) +#define HSR_SYSREG_MDSCR_EL1 HSR_SYSREG(2,0,c0,c2,2) +#define HSR_SYSREG_OSLAR_EL1 HSR_SYSREG(2,0,c1,c0,4) + +#define HSR_SYSREG_DBGBVRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,4) +#define HSR_SYSREG_DBGBCRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,5) +#define HSR_SYSREG_DBGWVRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,6) +#define HSR_SYSREG_DBGWCRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,7) + +#define HSR_SYSREG_DBG_CASES(REG) case HSR_SYSREG_##REG##n_EL1(0): \ + case HSR_SYSREG_##REG##n_EL1(1): \ + case HSR_SYSREG_##REG##n_EL1(2): \ + case HSR_SYSREG_##REG##n_EL1(3): \ + case HSR_SYSREG_##REG##n_EL1(4): \ + case HSR_SYSREG_##REG##n_EL1(5): \ + case HSR_SYSREG_##REG##n_EL1(6): \ + case HSR_SYSREG_##REG##n_EL1(7): \ + case HSR_SYSREG_##REG##n_EL1(8): \ + case HSR_SYSREG_##REG##n_EL1(9): \ + case HSR_SYSREG_##REG##n_EL1(10): \ + case HSR_SYSREG_##REG##n_EL1(11): \ + case HSR_SYSREG_##REG##n_EL1(12): \ + case HSR_SYSREG_##REG##n_EL1(13): \ + case HSR_SYSREG_##REG##n_EL1(14): \ + case HSR_SYSREG_##REG##n_EL1(15) + #define HSR_SYSREG_SCTLR_EL1 HSR_SYSREG(3,0,c1, c0,0) #define HSR_SYSREG_TTBR0_EL1 HSR_SYSREG(3,0,c2, c0,0) #define HSR_SYSREG_TTBR1_EL1 HSR_SYSREG(3,0,c2, c0,1) @@ -48,10 +73,28 @@ #define HSR_SYSREG_AFSR1_EL1 HSR_SYSREG(3,0,c5, c1,1) #define HSR_SYSREG_ESR_EL1 HSR_SYSREG(3,0,c5, c2,0) #define HSR_SYSREG_FAR_EL1 HSR_SYSREG(3,0,c6, c0,0) +#define HSR_SYSREG_PMINTENSET_EL1 HSR_SYSREG(3,0,c9,c14,1) +#define HSR_SYSREG_PMINTENCLR_EL1 HSR_SYSREG(3,0,c9,c14,2) #define HSR_SYSREG_MAIR_EL1 HSR_SYSREG(3,0,c10,c2,0) #define HSR_SYSREG_AMAIR_EL1 HSR_SYSREG(3,0,c10,c3,0) #define HSR_SYSREG_CONTEXTIDR_EL1 HSR_SYSREG(3,0,c13,c0,1) +#define HSR_SYSREG_PMCR_EL0 HSR_SYSREG(3,3,c9,c12,0) +#define HSR_SYSREG_PMCNTENSET_EL0 HSR_SYSREG(3,3,c9,c12,1) +#define HSR_SYSREG_PMCNTENCLR_EL0 HSR_SYSREG(3,3,c9,c12,2) +#define HSR_SYSREG_PMOVSCLR_EL0 HSR_SYSREG(3,3,c9,c12,3) +#define HSR_SYSREG_PMSWINC_EL0 HSR_SYSREG(3,3,c9,c12,4) +#define HSR_SYSREG_PMSELR_EL0 HSR_SYSREG(3,3,c9,c12,5) +#define HSR_SYSREG_PMCEID0_EL0 HSR_SYSREG(3,3,c9,c12,6) +#define HSR_SYSREG_PMCEID1_EL0 HSR_SYSREG(3,3,c9,c12,7) + +#define HSR_SYSREG_PMCCNTR_EL0 HSR_SYSREG(3,3,c9,c13,0) +#define HSR_SYSREG_PMXEVTYPER_EL0 HSR_SYSREG(3,3,c9,c13,1) +#define HSR_SYSREG_PMXEVCNTR_EL0 HSR_SYSREG(3,3,c9,c13,2) + +#define HSR_SYSREG_PMUSERENR_EL0 HSR_SYSREG(3,3,c9,c14,0) +#define HSR_SYSREG_PMOVSSET_EL0 HSR_SYSREG(3,3,c9,c14,3) + #define HSR_SYSREG_CNTPCT_EL0 HSR_SYSREG(3,3,c14,c0,0) #define HSR_SYSREG_CNTP_CTL_EL0 HSR_SYSREG(3,3,c14,c2,1) #define HSR_SYSREG_CNTP_TVAL_EL0 HSR_SYSREG(3,3,c14,c2,0) -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:16 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuc-0000zU-PR; Thu, 01 May 2014 06:56:06 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkua-0000yp-TI for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:05 +0000 Received: from [85.158.139.211:56866] by server-17.bemta-5.messagelabs.com id 06/63-09046-400F1635; Thu, 01 May 2014 06:56:04 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-10.tower-206.messagelabs.com!1398927362!1668713!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests=UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 24765 invoked from network); 1 May 2014 06:56:03 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-10.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:03 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkuX-0001oS-Tz for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:01 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkuX-0004rC-S0 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:01 +0000 Date: Thu, 01 May 2014 06:56:01 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] xen/arm: Don't let guess access to Debug and Performance Monitor registers X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 0b182202fef8ebfc093a00ead9414a683eb8807c Author: Julien Grall AuthorDate: Tue Apr 15 14:06:42 2014 +0100 Commit: Ian Campbell CommitDate: Wed Apr 23 10:31:07 2014 +0100 xen/arm: Don't let guess access to Debug and Performance Monitor registers Debug and performance registers are not properly switched by Xen. Trap them and inject an undefined instruction, except for those registers which might be unconditionally accessed which we implement as RAZ/WI. This is CVE-2014-2915 / XSA-93. Signed-off-by: Julien Grall Signed-off-by: Ian Campbell --- xen/arch/arm/traps.c | 59 +++++++++++++++++++++++++++++++++++++++ xen/include/asm-arm/cpregs.h | 2 + xen/include/asm-arm/processor.h | 11 ++++++- xen/include/asm-arm/sysregs.h | 43 ++++++++++++++++++++++++++++ 4 files changed, 113 insertions(+), 2 deletions(-) diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 710e5cc..822848f 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -74,6 +74,10 @@ void __cpuinit init_traps(void) /* Setup Hyp vector base */ WRITE_SYSREG((vaddr_t)hyp_traps_vector, VBAR_EL2); + /* Trap Debug and Performance Monitor accesses */ + WRITE_SYSREG(HDCR_TDRA|HDCR_TDOSA|HDCR_TDA|HDCR_TPM|HDCR_TPMCR, + MDCR_EL2); + /* Trap CP15 c15 used for implementation defined registers */ WRITE_SYSREG(HSTR_T(15), HSTR_EL2); @@ -1412,6 +1416,17 @@ static void do_cp15_64(struct cpu_user_regs *regs, advance_pc(regs, hsr); } +static void do_cp14(struct cpu_user_regs *regs, union hsr hsr) +{ + if ( !check_conditional_instr(regs, hsr) ) + { + advance_pc(regs, hsr); + return; + } + + inject_undef32_exception(regs); +} + static void do_cp(struct cpu_user_regs *regs, union hsr hsr) { if ( !check_conditional_instr(regs, hsr) ) @@ -1427,9 +1442,46 @@ static void do_cp(struct cpu_user_regs *regs, union hsr hsr) static void do_sysreg(struct cpu_user_regs *regs, union hsr hsr) { + register_t *x = select_user_reg(regs, hsr.sysreg.reg); switch ( hsr.bits & HSR_SYSREG_REGS_MASK ) { + /* RAZ/WI registers: */ + /* - Debug */ + case HSR_SYSREG_MDSCR_EL1: + /* - Perf monitors */ + case HSR_SYSREG_PMINTENSET_EL1: + case HSR_SYSREG_PMINTENCLR_EL1: + case HSR_SYSREG_PMCR_EL0: + case HSR_SYSREG_PMCNTENSET_EL0: + case HSR_SYSREG_PMCNTENCLR_EL0: + case HSR_SYSREG_PMOVSCLR_EL0: + case HSR_SYSREG_PMSWINC_EL0: + case HSR_SYSREG_PMSELR_EL0: + case HSR_SYSREG_PMCEID0_EL0: + case HSR_SYSREG_PMCEID1_EL0: + case HSR_SYSREG_PMCCNTR_EL0: + case HSR_SYSREG_PMXEVTYPER_EL0: + case HSR_SYSREG_PMXEVCNTR_EL0: + case HSR_SYSREG_PMUSERENR_EL0: + case HSR_SYSREG_PMOVSSET_EL0: + /* - Breakpoints */ + HSR_SYSREG_DBG_CASES(DBGBVR): + HSR_SYSREG_DBG_CASES(DBGBCR): + /* - Watchpoints */ + HSR_SYSREG_DBG_CASES(DBGWVR): + HSR_SYSREG_DBG_CASES(DBGWCR): + if ( hsr.sysreg.read ) + *x = 0; + /* else: write ignored */ + break; + + /* Write only, Write ignore registers: */ + case HSR_SYSREG_OSLAR_EL1: + if ( hsr.sysreg.read ) + goto bad_sysreg; + /* else: write ignored */ + break; case HSR_SYSREG_CNTP_CTL_EL0: case HSR_SYSREG_CNTP_TVAL_EL0: if ( !vtimer_emulate(regs, hsr) ) @@ -1440,6 +1492,7 @@ static void do_sysreg(struct cpu_user_regs *regs, } break; default: + bad_sysreg: { struct hsr_sysreg sysreg = hsr.sysreg; #ifndef NDEBUG @@ -1614,6 +1667,12 @@ asmlinkage void do_trap_hypervisor(struct cpu_user_regs *regs) goto bad_trap; do_cp15_64(regs, hsr); break; + case HSR_EC_CP14_32: + case HSR_EC_CP14_DBG: + if ( !is_32bit_domain(current->domain) ) + goto bad_trap; + do_cp14(regs, hsr); + break; case HSR_EC_CP: if ( !is_32bit_domain(current->domain) ) goto bad_trap; diff --git a/xen/include/asm-arm/cpregs.h b/xen/include/asm-arm/cpregs.h index e9a8094..bf8133e 100644 --- a/xen/include/asm-arm/cpregs.h +++ b/xen/include/asm-arm/cpregs.h @@ -115,6 +115,7 @@ #define NSACR p15,0,c1,c1,2 /* Non-Secure Access Control Register */ #define HSCTLR p15,4,c1,c0,0 /* Hyp. System Control Register */ #define HCR p15,4,c1,c1,0 /* Hyp. Configuration Register */ +#define HDCR p15,4,c1,c1,1 /* Hyp. Debug Configuration Register */ #define HCPTR p15,4,c1,c1,2 /* Hyp. Coprocessor Trap Register */ #define HSTR p15,4,c1,c1,3 /* Hyp. System Trap Register */ @@ -287,6 +288,7 @@ #define ID_PFR0_EL1 ID_PFR0 #define ID_PFR1_EL1 ID_PFR1 #define IFSR32_EL2 IFSR +#define MDCR_EL2 HDCR #define MIDR_EL1 MIDR #define MPIDR_EL1 MPIDR #define PAR_EL1 PAR diff --git a/xen/include/asm-arm/processor.h b/xen/include/asm-arm/processor.h index 750864a..9267c1b 100644 --- a/xen/include/asm-arm/processor.h +++ b/xen/include/asm-arm/processor.h @@ -92,12 +92,19 @@ /* HSTR Hyp. System Trap Register */ #define HSTR_T(x) ((_AC(1,U)<<(x))) /* Trap Cp15 c */ +/* HDCR Hyp. Debug Configuration Register */ +#define HDCR_TDRA (_AC(1,U)<<11) /* Trap Debug ROM access */ +#define HDCR_TDOSA (_AC(1,U)<<10) /* Trap Debug-OS-related register access */ +#define HDCR_TDA (_AC(1,U)<<9) /* Trap Debug Access */ +#define HDCR_TPM (_AC(1,U)<<6) /* Trap Performance Monitors accesses */ +#define HDCR_TPMCR (_AC(1,U)<<5) /* Trap PMCR accesses */ + #define HSR_EC_UNKNOWN 0x00 #define HSR_EC_WFI_WFE 0x01 #define HSR_EC_CP15_32 0x03 #define HSR_EC_CP15_64 0x04 -#define HSR_EC_CP14_32 0x05 -#define HSR_EC_CP14_DBG 0x06 +#define HSR_EC_CP14_32 0x05 /* Trapped MCR or MRC access to CP14 */ +#define HSR_EC_CP14_DBG 0x06 /* Trapped LDC/STC access to CP14 (only for debug registers) */ #define HSR_EC_CP 0x07 /* HCPTR-trapped access to CP0-CP13 */ #define HSR_EC_CP10 0x08 #define HSR_EC_JAZELLE 0x09 diff --git a/xen/include/asm-arm/sysregs.h b/xen/include/asm-arm/sysregs.h index 0cee0e9..4a4de34 100644 --- a/xen/include/asm-arm/sysregs.h +++ b/xen/include/asm-arm/sysregs.h @@ -40,6 +40,31 @@ ((__HSR_SYSREG_##crm) << HSR_SYSREG_CRM_SHIFT) | \ ((__HSR_SYSREG_##op2) << HSR_SYSREG_OP2_SHIFT) +#define HSR_SYSREG_MDSCR_EL1 HSR_SYSREG(2,0,c0,c2,2) +#define HSR_SYSREG_OSLAR_EL1 HSR_SYSREG(2,0,c1,c0,4) + +#define HSR_SYSREG_DBGBVRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,4) +#define HSR_SYSREG_DBGBCRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,5) +#define HSR_SYSREG_DBGWVRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,6) +#define HSR_SYSREG_DBGWCRn_EL1(n) HSR_SYSREG(2,0,c0,c##n,7) + +#define HSR_SYSREG_DBG_CASES(REG) case HSR_SYSREG_##REG##n_EL1(0): \ + case HSR_SYSREG_##REG##n_EL1(1): \ + case HSR_SYSREG_##REG##n_EL1(2): \ + case HSR_SYSREG_##REG##n_EL1(3): \ + case HSR_SYSREG_##REG##n_EL1(4): \ + case HSR_SYSREG_##REG##n_EL1(5): \ + case HSR_SYSREG_##REG##n_EL1(6): \ + case HSR_SYSREG_##REG##n_EL1(7): \ + case HSR_SYSREG_##REG##n_EL1(8): \ + case HSR_SYSREG_##REG##n_EL1(9): \ + case HSR_SYSREG_##REG##n_EL1(10): \ + case HSR_SYSREG_##REG##n_EL1(11): \ + case HSR_SYSREG_##REG##n_EL1(12): \ + case HSR_SYSREG_##REG##n_EL1(13): \ + case HSR_SYSREG_##REG##n_EL1(14): \ + case HSR_SYSREG_##REG##n_EL1(15) + #define HSR_SYSREG_SCTLR_EL1 HSR_SYSREG(3,0,c1, c0,0) #define HSR_SYSREG_TTBR0_EL1 HSR_SYSREG(3,0,c2, c0,0) #define HSR_SYSREG_TTBR1_EL1 HSR_SYSREG(3,0,c2, c0,1) @@ -48,10 +73,28 @@ #define HSR_SYSREG_AFSR1_EL1 HSR_SYSREG(3,0,c5, c1,1) #define HSR_SYSREG_ESR_EL1 HSR_SYSREG(3,0,c5, c2,0) #define HSR_SYSREG_FAR_EL1 HSR_SYSREG(3,0,c6, c0,0) +#define HSR_SYSREG_PMINTENSET_EL1 HSR_SYSREG(3,0,c9,c14,1) +#define HSR_SYSREG_PMINTENCLR_EL1 HSR_SYSREG(3,0,c9,c14,2) #define HSR_SYSREG_MAIR_EL1 HSR_SYSREG(3,0,c10,c2,0) #define HSR_SYSREG_AMAIR_EL1 HSR_SYSREG(3,0,c10,c3,0) #define HSR_SYSREG_CONTEXTIDR_EL1 HSR_SYSREG(3,0,c13,c0,1) +#define HSR_SYSREG_PMCR_EL0 HSR_SYSREG(3,3,c9,c12,0) +#define HSR_SYSREG_PMCNTENSET_EL0 HSR_SYSREG(3,3,c9,c12,1) +#define HSR_SYSREG_PMCNTENCLR_EL0 HSR_SYSREG(3,3,c9,c12,2) +#define HSR_SYSREG_PMOVSCLR_EL0 HSR_SYSREG(3,3,c9,c12,3) +#define HSR_SYSREG_PMSWINC_EL0 HSR_SYSREG(3,3,c9,c12,4) +#define HSR_SYSREG_PMSELR_EL0 HSR_SYSREG(3,3,c9,c12,5) +#define HSR_SYSREG_PMCEID0_EL0 HSR_SYSREG(3,3,c9,c12,6) +#define HSR_SYSREG_PMCEID1_EL0 HSR_SYSREG(3,3,c9,c12,7) + +#define HSR_SYSREG_PMCCNTR_EL0 HSR_SYSREG(3,3,c9,c13,0) +#define HSR_SYSREG_PMXEVTYPER_EL0 HSR_SYSREG(3,3,c9,c13,1) +#define HSR_SYSREG_PMXEVCNTR_EL0 HSR_SYSREG(3,3,c9,c13,2) + +#define HSR_SYSREG_PMUSERENR_EL0 HSR_SYSREG(3,3,c9,c14,0) +#define HSR_SYSREG_PMOVSSET_EL0 HSR_SYSREG(3,3,c9,c14,3) + #define HSR_SYSREG_CNTPCT_EL0 HSR_SYSREG(3,3,c14,c0,0) #define HSR_SYSREG_CNTP_CTL_EL0 HSR_SYSREG(3,3,c14,c2,1) #define HSR_SYSREG_CNTP_TVAL_EL0 HSR_SYSREG(3,3,c14,c2,0) -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:31 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuq-00011t-Uj; Thu, 01 May 2014 06:56:20 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkup-00011W-CN for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:20 +0000 Received: from [85.158.143.35:41553] by server-2.bemta-4.messagelabs.com id AB/52-06539-210F1635; Thu, 01 May 2014 06:56:18 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-15.tower-21.messagelabs.com!1398927373!2148179!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG, ML_RADAR_SPEW_LINKS_23,spamassassin: X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 7673 invoked from network); 1 May 2014 06:56:14 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-15.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:14 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkui-0001oY-4w for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:12 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkui-0004sJ-1P for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:12 +0000 Date: Thu, 01 May 2014 06:56:12 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: add TPM group support X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 5c3705c900581af6f30be124ab8fb64603bdca03 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:22:57 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:56:41 2014 +0100 vtpmmgr: add TPM group support This is a complete rewrite of the disk format and key hierarchy for the TPM Manager. The new format supports multiple groups of vTPMs which define the permitted configurations where a given vTPM's keys are available, allowing upgrades of critical components while retaining the secrecy of cryptographic keys. New features of the TPM Manager are explained in the README and in the definitions of the management commands in vtpm_manager.h. New features for vTPMs: 1. The size of the state blob for a vTPM is expanded from 52 to 64 bytes in order to support future vTPMs using SHA-2/3 instead of SHA-1. 2. vTPMs can obtain a quote from the physical TPM with certain resettable PCRs set to include information about the vTPM. This can be used by a vTPM to provide evidence of its integrity, including the secrecy of its EK, and for deep quotes. Some additional changes made by this rewrite that may impact existing users: 1. The value of WELLKNOWN_OWNER_AUTH was incorrect for the physical TPM; the convention is to use all zero bits for well-known authentication values, not all one bits. 2. Randomly generating the owner auth value for the physical TPM is no longer supported, as it prevents later creation or certification of AIKs (which the old manager did not support). 3. The vTPM Manager needs to be provisioned with a PCR composite and an upgrade authority's public key before it will save data across boots. The current implementation still has some limitations: * 5 valid system PCR selections per group * The vTPM Manager's disk can use at most 2MB of space * The vTPM domain's build hash is always set to null/zero Most of the code relating to upgrade and rollback protection is currently stubbed out, but future versions can add: * Support for using the TPM's monotonic counter to prevent rollback of vTPM data by taking and restoring disk snapshots * Masking the master disk encryption key using a value stored in the TPM's NVRAM so that revocation of old data is possible without relying on all previously authorized software stacks to respect the monotonic counter's value Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- docs/misc/vtpm-platforms.txt | 127 ++++ docs/misc/vtpm.txt | 247 ++++--- docs/misc/vtpmmgr.txt | 163 +++++ stubdom/vtpm/README | 75 -- stubdom/vtpmmgr/Makefile | 4 +- stubdom/vtpmmgr/README | 75 -- stubdom/vtpmmgr/disk_crypto.c | 231 ++++++ stubdom/vtpmmgr/disk_crypto.h | 17 + stubdom/vtpmmgr/disk_format.h | 193 +++++ stubdom/vtpmmgr/disk_io.c | 125 ++++ stubdom/vtpmmgr/disk_io.h | 25 + stubdom/vtpmmgr/disk_read.c | 606 ++++++++++++++++ stubdom/vtpmmgr/disk_tpm.c | 238 +++++++ stubdom/vtpmmgr/disk_tpm.h | 25 + stubdom/vtpmmgr/disk_write.c | 410 +++++++++++ stubdom/vtpmmgr/endian_int.h | 72 ++ stubdom/vtpmmgr/init.c | 104 +-- stubdom/vtpmmgr/log.h | 8 +- stubdom/vtpmmgr/marshal.h | 824 ++++++++++++++-------- stubdom/vtpmmgr/mgmt_authority.c | 323 +++++++++ stubdom/vtpmmgr/mgmt_authority.h | 11 + stubdom/vtpmmgr/tcg.h | 7 + stubdom/vtpmmgr/tpm.c | 1360 ++++++++++++++++++------------------ stubdom/vtpmmgr/tpm.h | 104 +-- stubdom/vtpmmgr/tpmrsa.c | 25 + stubdom/vtpmmgr/tpmrsa.h | 3 + stubdom/vtpmmgr/vtpm_cmd_handler.c | 858 ++++++++++++++++++++--- stubdom/vtpmmgr/vtpm_disk.c | 237 +++++++ stubdom/vtpmmgr/vtpm_disk.h | 233 ++++++ stubdom/vtpmmgr/vtpm_manager.h | 391 ++++++++++- stubdom/vtpmmgr/vtpm_storage.c | 794 --------------------- stubdom/vtpmmgr/vtpm_storage.h | 68 -- stubdom/vtpmmgr/vtpmmgr.h | 12 +- 33 files changed, 5639 insertions(+), 2356 deletions(-) diff --git a/docs/misc/vtpm-platforms.txt b/docs/misc/vtpm-platforms.txt new file mode 100644 index 0000000..fe35fb6 --- /dev/null +++ b/docs/misc/vtpm-platforms.txt @@ -0,0 +1,127 @@ +Author: Daniel De Graaf + +================================================================================ +Overview +================================================================================ + +This document describes example platforms which use virtual TPMs to provide +security properties for guests running on the platforms. There are several +tradeoffs between flexibility and trust which must be considered when +implementing a platform containing vTPMs. + +================================================================================ +Example 1: Trusted Domain 0 +================================================================================ + +This is the simplest example and provides maximal flexibility for testing the +vTPM Manager and vTPMs. The vtpmmgr, vtpm, and guest domains are created using +xl from the command line on domain 0. + +Provisioning on domain 0: +# dd if=/dev/zero of=/images/vtpmmgr-stubdom.img bs=2M count=1 +# dd if=/dev/zero of=/images/vtpm-guest1.img bs=2M count=1 +# dd if=/dev/zero of=/images/vtpm-guest2.img bs=2M count=1 + +The vtpmmgr configuration file (vtpmmgr.cfg): + +name="vtpmmgr" +kernel="/usr/lib/xen/boot/vtpmmgr-stubdom.gz" +extra="tpmlocality=2" +memory=8 +disk=["file:/images/vtpmmgr-stubdom.img,hda,w"] +iomem=["fed42,1"] + +The vtpm configuration files (vtpm-guest1.cfg, vtpm-guest2.cfg): + +name="vtpm-guest1" +kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" +extra="loglevel=debug" +memory=8 +disk=["file:/images/vtpm-guest1.img,hda,w"] +vtpm=["backend=vtpmmgr,uuid=ac0a5b9e-cbe2-4c07-b43b-1d69e46fb839"] + +name="vtpm-guest2" +kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" +extra="loglevel=debug" +memory=8 +disk=["file:/images/vtpm-guest2.img,hda,w"] +vtpm=["backend=vtpmmgr,uuid=6c3ff5f1-8d58-4fed-b00d-a5ea9a817f7f"] + +The guest configuration files (guest1.cfg, guest2.cfg): + +name="guest1" +kernel="/usr/lib/xen/boot/pv-grub-x86_64.gz" +memory=1024 +disk=["file:/images/guest1.img,xvda,w"] +vif=['mac=00:01:02:03:04:05,bridge=br0'] +vtpm=["backend=vtpm-guest1"] + +name="guest2" +kernel="/usr/lib/xen/boot/pv-grub-x86_64.gz" +memory=1024 +disk=["file:/images/guest2.img,xvda,w"] +vif=['mac=00:01:02:03:04:06,bridge=br0'] +vtpm=["backend=vtpm-guest2"] + +Starting domains: + +# xl create vtpmmgr.cfg +# xl create vtpm-guest1.cfg +# xl create guest1.cfg + +================================================================================ +Example 2: Domain Builder with Static vTPMs +================================================================================ + +This example uses the domain builder to construct a TPM Manager and vTPM which +do not require trusting the hardware domain with the vTPM's secrets. However, +it is not possible to construct additional vTPMs after the system is booted, and +the guests with access to vTPMs may not be rebooted without rebooting the entire +platform. + +The domain builder (dom0) constructs: + dom1 - xenstore system_u:system_r:xenstore_t + dom2 - hardware system_u:system_r:hwdom_t + dom3 - vtpmmgr system_u:system_r:vtpmmgr_t + dom4 - vtpm-hw system_u:system_r:vtpm_t + dom5 - vtpm-g1 guest1_u:vm_r:vtpm_t + dom6 - vtpm-g2 guest2_u:vm_r:vtpm_t + dom7 - guest1 guest1_u:vm_r:guest_t + dom8 - guest2 guest2_u:vm_r:guest_t + +It unpauses dom1 and dom2 after setting up Xenstore. The hardware domain is not +permitted access to IO memory at 0xfed42; this IO memory is accessible to the +vtpmmgr domain. The two guest domains may be instantiated using pv-grub or +using the same kernel as the hardware domain to conserve space in the domain +builder's initrd. + +Once the hardware domain boots, it runs: + +# xl block-attach vtpmmgr 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpmmgr' +# xl block-attach vtpm-hw 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-hw' +# xl block-attach vtpm-g1 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-g1' +# xl block-attach vtpm-g2 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-g2' +# xl block-attach guest1 'backendtype=phy,backend=hardware,vdev=xvda,access=w,target=/dev/lvm/guest1' +# xl block-attach guest2 'backendtype=phy,backend=hardware,vdev=xvda,access=w,target=/dev/lvm/guest2' +# xl vtpm-attach vtpm-hw uuid=062b6416-ed46-492a-9e65-a2f92dc07f7f backend=vtpmmgr +# xl vtpm-attach vtpm-g1 uuid=e9aa9d0f-ece5-4b84-b129-93004ba61a5f backend=vtpmmgr +# xl vtpm-attach vtpm-g2 uuid=3fb2caf0-d305-4516-96c7-420618d98efb backend=vtpmmgr +# xl vtpm-attach hardware uuid=062b6416-ed46-492a-9e65-a2f92dc07f7f backend=vtpm-hw +# xl vtpm-attach guest1 uuid=e9aa9d0f-ece5-4b84-b129-93004ba61a5f backend=vtpm-g1 +# xl vtpm-attach guest2 uuid=3fb2caf0-d305-4516-96c7-420618d98efb backend=vtpm-g2 + +Once these commands are complete, the domains are unpaused and may boot. The XSM +policy must be configured to not allow any of the domain types named above to be +created by any domain except the domain builder; guests created by the hardware +domain or one of the primary guests acting as a control domain must have a +different type. The type vtpmmgr_t may only map grants from vtpm_t; vtpm_t may +only map grants from a domain of type guest_t or hwdom_t with the same user +field. + +This example may be extended to allow dynamic creation of domains by using a +domain builder that accepts build requests. A single build request would create +a pair of domains using an unused XSM user field: a vTPM and a pv-grub domain +which requires the presence of a vTPM. To bind the configuration of the guest +to the vTPM, the guest may use full-disk encryption which can be unlocked using +an unseal operation; using the wrong vTPM will then yield a non-functioning +guest. diff --git a/docs/misc/vtpm.txt b/docs/misc/vtpm.txt index d20b424..1887d40 100644 --- a/docs/misc/vtpm.txt +++ b/docs/misc/vtpm.txt @@ -22,8 +22,8 @@ major component of vTPM is implemented as a separate domain, providing secure separation guaranteed by the hypervisor. The vTPM domains are implemented in mini-os to reduce memory and processor overhead. -This mini-os vTPM subsystem was built on top of the previous vTPM -work done by IBM and Intel corporation. +This mini-os vTPM subsystem was built on top of the previous vTPM work done by +IBM and Intel corporation. ------------------------------ DESIGN OVERVIEW @@ -106,16 +106,15 @@ INSTALLATION Prerequisites: -------------- -You must have an x86 machine with a TPM on the motherboard. -The only software requirement to compiling vTPM is cmake. -You must use libxl to manage domains with vTPMs. 'xm' is -deprecated and does not support vTPM. +You must have an x86 machine with a TPM on the motherboard. The only extra +software requirement for compiling vTPM is cmake. You must use libxl to manage +domains with vTPMs; 'xm' is deprecated and does not support vTPMs. -Compiling the XEN tree: +Compiling the Xen tree: ----------------------- -Compile and install the XEN tree as usual. Be sure to build and install -the stubdom tree. +Compile and install the Xen tree as usual; be sure that the vTPM domains are +enabled when you run configure. Compiling the LINUX dom0 kernel: -------------------------------- @@ -127,16 +126,15 @@ blacklisting the module. If dom0 needs a TPM but does not need to use it during the boot process (i.e. it is not using IMA), a virtual TPM can be attached to dom0 after the system is booted. -Because the TPM manager does not yet accept requests for deep quotes, if a quote -or other request needs to be fulfilled by the physical TPM, dom0 will need to -access the physical TPM. In order to prevent interference, the TPM Manager and -dom0 should use different values for the TPM's locality; since Linux always uses -locality 0, using locality 2 for the TPM Manager is recommended. If both Linux -and the TPM Manager attempt to access the TPM at the same time, the TPM device -will return a busy status; some applications will consider this a fatal error -instead of retrying the command at a later time. If a vTPM gets an error when -loading its key, it will currently generate a fresh vTPM image (with a new EK, -SRK, and blank NVRAM). +Access to the physical TPM may be required in order to manage the NVRAM or to +perform other advanced operations where the vTPM is insufficient. In order to +prevent interference, the TPM Manager and dom0 should use different values for +the TPM's locality; since Linux always uses locality 0, using locality 2 for the +TPM Manager is recommended. If both Linux and the TPM Manager attempt to access +the TPM at the same time, the TPM device will return a busy status; some +applications will consider this a fatal error instead of retrying the command at +a later time. If a vTPM gets an error when loading its key, it will currently +generate a fresh vTPM image (with a new EK, SRK, and blank NVRAM). Compiling the LINUX domU kernel: @@ -156,130 +154,100 @@ VTPM MANAGER SETUP Manager disk image setup: ------------------------- -The vTPM Manager requires a disk image to store its -encrypted data. The image does not require a filesystem -and can live anywhere on the host disk. The image does not need -to be large. 8 to 16 Mb should be sufficient. - -# dd if=/dev/zero of=/var/vtpmmgr-stubdom.img bs=16M count=1 +The vTPM Manager requires a disk image to store its encrypted data. The image +does not require a filesystem and can live anywhere on the host disk. The image +is not large; the Xen 4.5 vtpmmgr is limited to using the first 2MB of the image +but can support more than 20,000 vTPMs. Manager config file: -------------------- -The vTPM Manager domain (vtpmmgr-stubdom) must be started like -any other Xen virtual machine and requires a config file. -The manager requires a disk image for storage and permission -to access the hardware memory pages for the TPM. An -example configuration looks like the following. - -kernel="/usr/lib/xen/boot/vtpmmgr-stubdom.gz" -memory=16 -disk=["file:/var/vtpmmgr-stubdom.img,hda,w"] -name="vtpmmgr" -iomem=["fed40,5"] - -The iomem line tells xl to allow access to all of the TPM IO memory -pages, which are 5 pages (one per locality) that start at 0xfed40000. By -default, the TPM manager uses locality 0 (so only the page at 0xfed40 is -needed); this can be changed on the domain's command line. +The vTPM Manager domain (vtpmmgr-stubdom) must be started like any other Xen +virtual machine and requires a config file. The manager requires a disk image +for storage and permission to access the hardware memory pages for the TPM. The +disk must be presented as "hda", and the TPM memory pages are passed using the +iomem configuration parameter. The TPM TIS uses 5 pages of IO memory (one per +locality) that start at physical address 0xfed40000. By default, the TPM manager +uses locality 0 (so only the page at 0xfed40 is needed); this can be changed on +the domain's command line. For full functionality in deep quotes, using +locality 2 is required to manipulate PCR 20-22. Starting and stopping the manager: ---------------------------------- -The vTPM manager should be started at boot, you may wish to -create an init script to do this. - -# xl create -c vtpmmgr-stubdom.cfg +The vTPM manager should be started at boot; you may wish to create an init +script to do this. If a domain builder is used, the TPM Manager should be +started by the domain builder to minimize the trusted computing base for the +vTPM manager's secrets. Once initialization is complete you should see the following: INFO[VTPM]: Waiting for commands from vTPM's: -To shutdown the manager you must destroy it. To avoid data corruption, -only destroy the manager when you see the above "Waiting for commands" -message. This ensures the disk is in a consistent state. - -# xl destroy vtpmmgr-stubdom +The TPM Manager does not respond to shutdown requests; use the destroy command +to shut it down. ------------------------------ VTPM AND LINUX PVM SETUP ------------------------------ -In the following examples we will assume we have Linux -guest named "domu" with its associated configuration -located at /home/user/domu. It's vtpm will be named -domu-vtpm. - vTPM disk image setup: ---------------------- -The vTPM requires a disk image to store its persistent -data. The image does not require a filesystem. The image -does not need to be large. 8 Mb should be sufficient. - -# dd if=/dev/zero of=/home/user/domu/vtpm.img bs=8M count=1 +The vTPM requires a disk image to store its persistent data (RSA keys, NVRAM, +etc). The image does not require a filesystem. The image does not need to be +large; 2 Mb should be sufficient. vTPM config file: ----------------- -The vTPM domain requires a configuration file like -any other domain. The vTPM requires a disk image for -storage and a TPM frontend driver to communicate -with the manager. An example configuration is given: - -kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" -memory=8 -disk=["file:/home/user/domu/vtpm.img,hda,w"] -name="domu-vtpm" -vtpm=["backend=vtpmmgr,uuid=ac0a5b9e-cbe2-4c07-b43b-1d69e46fb839"] +The vTPM domain requires a configuration file like any other domain. The vTPM +requires a disk image for storage and a TPM frontend driver to communicate with +the manager. You are required to generate a uuid for this vtpm, which is +specified on the "vtpm=" line that describes its connection to the vTPM Manager. +The uuidgen application may be used to generate a uuid, or one from the output +of the "manage-vtpmmgr.pl vtpm-add" command may be used to create a vTPM +belonging to a specific group. -The vtpm= line sets up the tpm frontend driver. The backend must set -to vtpmmgr. You are required to generate a uuid for this vtpm. -You can use the uuidgen unix program or some other method to create a -uuid. The uuid uniquely identifies this vtpm to manager. - -If you wish to clear the vTPM data you can either recreate the -disk image or change the uuid. +If you wish to clear the vTPM data you can either recreate the disk image or +change the uuid. Linux Guest config file: ------------------------ -The Linux guest config file needs to be modified to include -the Linux tpmfront driver. Add the following line: +The Linux guest config file needs to be modified to include the Linux tpmfront +driver. Add the following line: vtpm=["backend=domu-vtpm"] Currently only Linux guests are supported (PV or HVM with PV drivers). -Launching and shut down: ------------------------- - -To launch a Linux guest with a vTPM we first have to start the vTPM domain. - -# xl create -c /home/user/domu/vtpm.cfg +While attaching a vTPM after a guest is booted (using xl vtpm-attach) is +supported, the attached vTPM will not have a record of the boot of the attached +guest. Furthermore, if the vTPM has been freshly created, a malicious guest +could then extend any values into PCRs, potentially forging its boot +configuration. Attaching a vTPM to a running domain should only be used for +trusted domains or when measurements have already been sent to the vTPM from +another source. -After initialization is complete, you should see the following: -Info: Waiting for frontend domain to connect.. +Using the vTPM in the guest: +---------------------------- -Next, launch the Linux guest - -# xl create -c /home/user/domu/domu.cfg - -If xen-tpmfront was compiled as a module, be sure to load it -in the guest. +If xen-tpmfront was compiled as a module, it must be loaded it in the guest. # modprobe xen-tpmfront -After the Linux domain boots and the xen-tpmfront driver is loaded, -you should see the following on the vtpm console: +After the Linux domain boots and the xen-tpmfront driver is loaded, you should +see the following on the vtpm console: Info: VTPM attached to Frontend X/Y -If you have trousers and tpm_tools installed on the guest, you can test the -vtpm. +You can quickly test the vTPM by using the sysfs interface: -On guest: -# tcsd (if tcsd is not running already) -# tpm_version +# cat /sys/devices/vtpm-0/pubek +# cat /sys/devices/vtpm-0/pcrs + +If you have trousers and tpm_tools installed on the guest, the tpm_version +command should return the following: The version command should return the following: TPM 1.2 Version Info: @@ -290,12 +258,12 @@ The version command should return the following: TPM Version: 01010000 Manufacturer Info: 4554485a -You should also see the command being sent to the vtpm console as well -as the vtpm saving its state. You should see the vtpm key being -encrypted and stored on the vtpmmgr console. +You should also see the command being sent to the vtpm console as well as the +vtpm saving its state. You should see the vtpm key being encrypted and stored on +the vtpmmgr console. -You may wish to write a script to start your vtpm and guest together and -to destroy the vtpm when the guest shuts down. +You may wish to write a script to start your vtpm and guest together and to +destroy the vtpm when the guest shuts down. ------------------------------ INTEGRATION WITH PV-GRUB @@ -319,10 +287,69 @@ way can attest to its early boot state. MORE INFORMATION ------------------------------ -See stubdom/vtpmmgr/README for more details about how -the manager domain works, how to use it, and its command line -parameters. +See vtpmmgr.txt for more details about how the manager domain works, how to use +it, and its command line parameters. + +------------------------------ +VTPM DOMAIN OPERATION +------------------------------ + +The vtpm-stubdom is a mini-OS domain that emulates a TPM for the guest OS to +use. It is a small wrapper around the Berlios TPM emulator version 0.7.4. +Commands are passed from the linux guest via the mini-os TPM backend driver. +vTPM data is encrypted and stored via a disk image provided to the virtual +machine. The key used to encrypt the data along with a hash of the vTPM's data +is sent to the vTPM manager for secure storage and later retrieval. The vTPM +domain communicates with the manager using a mini-os tpm front/back device pair. + +------------------------------------ +VTPM DOMAIN COMMAND LINE ARGUMENTS +------------------------------------ + +Command line arguments are passed to the domain via the 'extra' parameter in the +VM config file. Each parameter is separated by white space. For example: + +extra="foo=bar baz" + +List of Arguments: +------------------ + +loglevel=: Controls the amount of logging printed to the console. + The possible values for are: + error + info (default) + debug -See stubdom/vtpm/README for more specifics about how vtpm-stubdom -operates and the command line options it accepts. +clear: Start the Berlios emulator in "clear" mode. (default) + +save: Start the Berlios emulator in "save" mode. + +deactivated: Start the Berlios emulator in "deactivated" mode. + See the Berlios TPM emulator documentation for details + about the startup mode. For all normal use, always use clear + which is the default. You should not need to specify any of these. + +maintcmds=<1|0>: Enable to disable the TPM maintenance commands. + These commands are used by tpm manufacturers and thus + open a security hole. They are disabled by default. + +hwinitpcr=: Initialize the virtual Platform Configuration Registers + (PCRs) with PCR values from the hardware TPM. Each pcr specified by + will be initialized with the value of that same PCR in TPM + once at startup. By default all PCRs are zero initialized. + Value values of are: + all: copy all pcrs + none: copy no pcrs (default) + : copy pcr n + : copy pcrs x to y (inclusive) + + These can also be combined by comma separation, for example: + hwinitpcrs=5,12-16 + will copy pcrs 5, 12, 13, 14, 15, and 16. + +------------------------------ +REFERENCES +------------------------------ +Berlios TPM Emulator: +http://tpm-emulator.berlios.de/ diff --git a/docs/misc/vtpmmgr.txt b/docs/misc/vtpmmgr.txt new file mode 100644 index 0000000..fe3d8a6 --- /dev/null +++ b/docs/misc/vtpmmgr.txt @@ -0,0 +1,163 @@ +Author: Daniel De Graaf + +This document describes the operation and command line interface of +vtpmmgr-stubdom. See docs/misc/vtpm.txt for details on the vTPM subsystem as a +whole. + +================================================================================ +Overview +================================================================================ + +The TPM Manager has three primary functions: + +1. Securely store the encryption keys for vTPMs +2. Provide a single controlled path of access to the physical TPM +3. Provide evidence (via TPM Quotes) of the current configuration + +When combined with a platform that provides a trusted method for creating +domains, the TPM Manager provides assurance that the private keys in a vTPM are +only available in specific trusted configurations. + +The manager accepts commands from the vtpm-stubdom domains via the mini-os TPM +backend driver. The vTPM manager communicates directly with hardware TPM using +the mini-os tpm_tis driver. + +================================================================================ +Boot Configurations and TPM Groups +================================================================================ + +The TPM Manager's data is secured by using the physical TPM's seal operation, +which allows data to be bound to specific PCRs. These PCRs are populated in the +physical TPM during the boot process, either by the firmware/BIOS or by a +dynamic launch environment such as TBOOT. In order to provide assurance of the +system's security, the PCRs used to seal the TPM manager's data must contain +measurements for domains used to bootstrap the TPM Manager and vTPMs. + +Because these measurements are based on hashes, they will change any time that +any component of the system is upgraded. Since it is not possible to construct a +list of all possible future good measurements, the job of approving +configurations is delegated to a third party, referred to here as the system +approval agent (SAA). The SAA is identified by its public (RSA) signature key, +which is used to sign lists of valid configurations. A single TPM manager can +support multiple SAAs via the use of vTPM groups. Each group is associated with +a single SAA; this allows the creation of a multi-tenant environment where +tenants may not all choose to trust the same SAA. + +Each vTPM is bound to a vTPM group at the time of its creation. Each vTPM group +has its own AIK in the physical TPM for quotes of the hardware TPM state; when +used with a conforming Privacy CA, this allows each group on the system to form +the basis of a distinct identity. + +================================================================================ +Initial Provisioning +================================================================================ + +When the TPM Manager first boots up, it will create a stub vTPM group along with +entries for any vTPMs that communicate with it. This stub group must be +provisioned with an SAA and a boot configuration in order to survive a reboot. + +When a vTPM is connected to the TPM Manager using a UUID that is not recognized, +a slot will be created in group 0 for it. In the future, this auto-creation may +be restricted to specific UUIDs (such as the all-zero UUID) to enforce the use +of the TPM manager as the generator of the UUID. The first vTPM to be connected +is given administrative privileges for the TPM Manager, and should be attached +to dom0 or a control domain in order to send provisioning commands. + +Provisioning a vTPM group for the system requires the public key of the SAA and +privacy CA data used to certify the AIK (see the TPM spec for details). Once the +group is created, a signed list of boot measurements can be installed. The +initial group controls the ability to boot the system as a whole, and cannot be +deleted once provisioned. + +================================================================================ +Command Line Arguments +================================================================================ + +Command line arguments are passed to the domain via the 'extra' parameter in the +VM config file. Each parameter is separated by white space. For example: + +extra="foo=bar baz" + +Valid arguments: + +owner_auth= +srk_auth= + Set the owner and SRK authdata for the TPM. If not specified, the + default is 160 zero bits (the well-known auth value). Valid values of + are: + well-known Use the well known auth (default) + hash: Use the given 40-character ASCII hex string + text: Use sha1 hash of . + +tpmdriver= + Choose the driver used for communication with the hardware TPM. Values + other than tpm_tis should only be used for testing. + + The possible values of are: + tpm_tis Direct communication with a hardware TPM 1.2. The + domain must have access to TPM IO memory. (default) + tpmfront Use the Xen tpmfront interface to talk to another + domain which provides access to the TPM. + +The following options only apply to the tpm_tis driver: + +tpmiomem=: The base address of the hardware memory pages of the TPM. + The default is 0xfed40000, as defined by the TCG's PC Client spec. + +tpmirq=: The irq of the hardware TPM if using interrupts. A value of + "probe" can be set to probe for the irq. A value of 0 disables + interrupts and uses polling (default 0). + +tpmlocality=: Attempt to use locality of the hardware TPM. + For full functionality of the TPM Manager, this should be set to "2". + +================================================================================ +Platform Security Assumptions +================================================================================ + +While the TPM Manager has the ability to check the hash of the vTPM requesting a +key, there is currently no trusted method to inform the TPM Manager of the hash +of each new domain. Because of this, the TPM Manager trusts the UUID key in +Xenstore to identify a vTPM in a trusted manner. The XSM policy may be used to +strengthen this assumption if the creation of vTPM-labeled domains is more +constrained (for example, only permitted to a domain builder service): the only +grants mapped by the TPM Manager should belong to vTPM domains, so restricting +the ability to map other domain's granted pages will prevent other domains from +directly requesting keys from the TPM Manager. + +A domain with direct access to the hardware TPM will be able to decrypt the TPM +Manager's disk image if the haredware TPM's PCR values are in a permitted +configuration. To protect the TPM Manager's data, the list of permitted +configurations should be chosen to include PCRs that measure the hypervisor, +domain 0, the TPM Manager, and other critical configuration such as the XSM +policy. If the TPM Manager is configured to use locality 2 as recommended, it +is safe to permit the hardware domain to access locality 0 (the default in +Linux), although concurrent use of the TPM should be avoided as it can result in +unexpected busy errors from the TPM driver. The ability to access locality 2 of +the TPM should be enforced using IO memory labeling in the XSM policy; the +physical address 0xFED42xxx is always locality 2 for TPMs using the TIS driver. + +================================================================================ +Appendix: unsecured migration process for vtpmmgr domain upgrade +================================================================================ + +There is no direct upgrade supported from previous versions of the vtpmmgr +domain due to changes in the on-disk format and the method used to seal data. +If a vTPM domain supports migration, this feature should be used to migrate the +vTPM's data; however, the vTPM packaged with Xen does not yet support migration. + +If adding migration support to the vTPM is not desired, a simpler migration +domain usable only for local migration can be constructed. The migration process +would look like the following: + +1. Start the old vtpmmgr +2. Start the vTPM migration domain +3. Attach the vTPM migration domain's vtpm/0 device to the old vtpmmgr +4. Migration domain executes vtpmmgr_LoadHashKey on vtpm/0 +5. Start the new vtpmmgr, possibly shutting down the old one first +6. Attach the vTPM migration domain's vtpm/1 device to the new vtpmmgr +7. Migration domain executes vtpmmgr_SaveHashKey on vtpm/1 + +This requires the migration domain must be added to the list of valid vTPM +kernel hashes. Because the TPM Manager currently does not verify vTPM kernel +hashes, the control domain can initiate this operation at any time. diff --git a/stubdom/vtpm/README b/stubdom/vtpm/README deleted file mode 100644 index 11bdacb..0000000 --- a/stubdom/vtpm/README +++ /dev/null @@ -1,75 +0,0 @@ -Copyright (c) 2010-2012 United States Government, as represented by -the Secretary of Defense. All rights reserved. -November 12 2012 -Authors: Matthew Fioravante (JHUAPL), - -This document describes the operation and command line interface -of vtpm-stubdom. See docs/misc/vtpm.txt for details on the -vTPM subsystem as a whole. - - ------------------------------- -OPERATION ------------------------------- - -The vtpm-stubdom is a mini-OS domain that emulates a TPM for the guest OS to -use. It is a small wrapper around the Berlios TPM emulator -version 0.7.4. Commands are passed from the linux guest via the -mini-os TPM backend driver. vTPM data is encrypted and stored via a disk image -provided to the virtual machine. The key used to encrypt the data along -with a hash of the vTPM's data is sent to the vTPM manager for secure storage -and later retrieval. The vTPM domain communicates with the manager using a -mini-os tpm front/back device pair. - ------------------------------- -COMMAND LINE ARGUMENTS ------------------------------- - -Command line arguments are passed to the domain via the 'extra' -parameter in the VM config file. Each parameter is separated -by white space. For example: - -extra="foo=bar baz" - -List of Arguments: ------------------- - -loglevel=: Controls the amount of logging printed to the console. - The possible values for are: - error - info (default) - debug - -clear: Start the Berlios emulator in "clear" mode. (default) - -save: Start the Berlios emulator in "save" mode. - -deactivated: Start the Berlios emulator in "deactivated" mode. - See the Berlios TPM emulator documentation for details - about the startup mode. For all normal use, always use clear - which is the default. You should not need to specify any of these. - -maintcmds=<1|0>: Enable to disable the TPM maintenance commands. - These commands are used by tpm manufacturers and thus - open a security hole. They are disabled by default. - -hwinitpcr=: Initialize the virtual Platform Configuration Registers - (PCRs) with PCR values from the hardware TPM. Each pcr specified by - will be initialized with the value of that same PCR in TPM - once at startup. By default all PCRs are zero initialized. - Value values of are: - all: copy all pcrs - none: copy no pcrs (default) - : copy pcr n - : copy pcrs x to y (inclusive) - - These can also be combined by comma separation, for example: - hwinitpcrs=5,12-16 - will copy pcrs 5, 12, 13, 14, 15, and 16. - ------------------------------- -REFERENCES ------------------------------- - -Berlios TPM Emulator: -http://tpm-emulator.berlios.de/ diff --git a/stubdom/vtpmmgr/Makefile b/stubdom/vtpmmgr/Makefile index af13b39..a39a22c 100644 --- a/stubdom/vtpmmgr/Makefile +++ b/stubdom/vtpmmgr/Makefile @@ -12,7 +12,9 @@ XEN_ROOT=../.. TARGET=vtpmmgr.a -OBJS=vtpmmgr.o vtpm_cmd_handler.o vtpm_storage.o init.o tpmrsa.o tpm.o log.o +OBJS=vtpmmgr.o vtpm_cmd_handler.o init.o tpmrsa.o tpm.o log.o +OBJS += vtpm_disk.o disk_tpm.o disk_io.o disk_crypto.o disk_read.o disk_write.o +OBJS += mgmt_authority.o CFLAGS+=-Werror -Iutil -Icrypto -Itcs CFLAGS+=-Wno-declaration-after-statement -Wno-unused-label diff --git a/stubdom/vtpmmgr/README b/stubdom/vtpmmgr/README deleted file mode 100644 index a70c1cc..0000000 --- a/stubdom/vtpmmgr/README +++ /dev/null @@ -1,75 +0,0 @@ -Copyright (c) 2010-2012 United States Government, as represented by -the Secretary of Defense. All rights reserved. -November 12 2012 -Authors: Matthew Fioravante (JHUAPL), - -This document describes the operation and command line interface -of vtpmmgr-stubdom. See docs/misc/vtpm.txt for details on the -vTPM subsystem as a whole. - - ------------------------------- -OPERATION ------------------------------- - -The vtpmmgr-stubdom implements a vTPM manager who has two major functions: - - - Securely store encryption keys for each of the vTPMS - - Regulate access to the hardware TPM for the entire system - -The manager accepts commands from the vtpm-stubdom domains via the mini-os -TPM backend driver. The vTPM manager communicates directly with hardware TPM -using the mini-os tpm_tis driver. - - -When the manager starts for the first time it will check if the TPM -has an owner. If the TPM is unowned, it will attempt to take ownership -with the supplied owner_auth (see below) and then create a TPM -storage key which will be used to secure vTPM key data. Currently the -manager only binds vTPM keys to the disk. In the future support -for sealing to PCRs should be added. - ------------------------------- -COMMAND LINE ARGUMENTS ------------------------------- - -Command line arguments are passed to the domain via the 'extra' -parameter in the VM config file. Each parameter is separated -by white space. For example: - -extra="foo=bar baz" - -List of Arguments: ------------------- - -owner_auth=: Set the owner auth of the TPM. The default - is the well known owner auth of all ones. - -srk_auth=: Set the SRK auth for the TPM. The default is - the well known srk auth of all zeroes. - The possible values of are: - well-known: Use the well known auth (default) - random: Randomly generate an auth - hash: : Use the given 40 character ASCII hex string - text: : Use sha1 hash of . - -tpmdriver=: Which driver to use to talk to the hardware TPM. - Don't change this unless you know what you're doing. - The possible values of are: - tpm_tis: Use the tpm_tis driver to talk directly to the TPM. - The domain must have access to TPM IO memory. (default) - tpmfront: Use tpmfront to talk to the TPM. The domain must have - a tpmfront device setup to talk to another domain - which provides access to the TPM. - -The following options only apply to the tpm_tis driver: - -tpmiomem=: The base address of the hardware memory pages of the - TPM (default 0xfed40000). - -tpmirq=: The irq of the hardware TPM if using interrupts. A value of - "probe" can be set to probe for the irq. A value of 0 - disabled interrupts and uses polling (default 0). - -tpmlocality=: Attempt to use locality of the hardware TPM. - (default 0) diff --git a/stubdom/vtpmmgr/disk_crypto.c b/stubdom/vtpmmgr/disk_crypto.c new file mode 100644 index 0000000..18718d0 --- /dev/null +++ b/stubdom/vtpmmgr/disk_crypto.c @@ -0,0 +1,231 @@ +#include +#include +#include +#include +#include + +#include "log.h" +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_io.h" +#include "disk_crypto.h" + +// XXX defining this stubs out all disk encryption for easier debugging +#undef DISK_IS_PLAINTEXT + +void do_random(void *buf, size_t size) +{ + int rc = ctr_drbg_random(&vtpm_globals.ctr_drbg, buf, size); + if (rc) abort(); +} + +void aes_setup(aes_context *ctx, const struct key128 *key) +{ + aes_setkey_enc(ctx, (void*)key, 128); +} + +static void aes_encrypt_ecb(void *target, const void *src, const aes_context *key_e) +{ + aes_crypt_ecb((void*)key_e, AES_ENCRYPT, src, target); +} + +void aes_encrypt_one(void *target, const void *src, const struct key128 *key) +{ + aes_context ctx; + aes_setkey_enc(&ctx, (void*)key, 128); + aes_crypt_ecb(&ctx, AES_ENCRYPT, src, target); +} + +void aes_decrypt_one(void *target, const void *src, const struct key128 *key) +{ + aes_context ctx; + aes_setkey_dec(&ctx, (void*)key, 128); + aes_crypt_ecb(&ctx, AES_DECRYPT, src, target); +} + +static void aes_ctr_one(uint64_t out[2], uint64_t ctr[2], const aes_context *key_e) +{ +#ifdef DISK_IS_PLAINTEXT + memset(out, 0, 16); +#else + aes_encrypt_ecb(out, ctr, key_e); +#endif + ctr[1]++; +} + +void aes_encrypt_ctr(void *target, size_t target_size, const void *srcv, size_t pt_size, const aes_context *key_e) +{ + uint64_t ctr[2]; + uint64_t tmp[2]; + uint64_t *dst = target; + const uint64_t *src = srcv; + + do_random(ctr, sizeof(ctr)); + dst[0] = ctr[0]; + dst[1] = ctr[1]; + dst += 2; + target_size -= 16; + + if (pt_size > target_size) + abort(); // invalid argument: target too small for plaintext + + while (pt_size >= 16) { + aes_ctr_one(tmp, ctr, key_e); + + dst[0] = tmp[0] ^ src[0]; + dst[1] = tmp[1] ^ src[1]; + + dst += 2; + src += 2; + pt_size -= 16; + target_size -= 16; + } + if (pt_size) { + uint64_t stmp[2]; + uint64_t dtmp[2]; + memset(stmp, 0, 16); + memcpy(stmp, src, pt_size); + + aes_ctr_one(tmp, ctr, key_e); + + dtmp[0] = tmp[0] ^ stmp[0]; + dtmp[1] = tmp[1] ^ stmp[1]; + if (target_size < 16) { + memcpy(dst, dtmp, target_size); + return; + } else { + memcpy(dst, dtmp, 16); + target_size -= 16; + } + } + while (target_size >= 16) { + aes_ctr_one(dst, ctr, key_e); + + dst += 2; + target_size -= 16; + } + if (target_size) + abort(); // invalid argument: overlarge target size is not a full block +} + +void aes_decrypt_ctr(void *target, size_t pt_size, const void *srcv, size_t src_size, const aes_context *key_e) +{ + uint64_t ctr[2]; + uint64_t tmp[2]; + uint64_t *dst = target; + const uint64_t *src = srcv; + + ctr[0] = src[0]; + ctr[1] = src[1]; + src += 2; + src_size -= 16; + + if (pt_size > src_size) + abort(); // invalid argument: source too small for plaintext + // we discard src_size now + + while (pt_size >= 16) { + aes_ctr_one(tmp, ctr, key_e); + dst[0] = tmp[0] ^ src[0]; + dst[1] = tmp[1] ^ src[1]; + + dst += 2; + src += 2; + pt_size -= 16; + } + if (pt_size) { + uint64_t stmp[2]; + uint64_t dtmp[2]; + memset(stmp, 0, 16); + memcpy(stmp, src, pt_size); + + aes_ctr_one(tmp, ctr, key_e); + + dtmp[0] = tmp[0] ^ stmp[0]; + dtmp[1] = tmp[1] ^ stmp[1]; + memcpy(dst, dtmp, pt_size); + } +} + +static void shl_128_mod_hex87(struct mac128 *dst, const struct mac128 *src) +{ + int i; + int carry = 0x87 * !!(src->bits[0] & 0x80); + for(i=0; i < 15; i++) + dst->bits[i] = (src->bits[i] << 1) | (src->bits[i+1] >> 7); + dst->bits[15] = (src->bits[15] << 1) ^ carry; +} + +static void xor128(struct mac128 *dst, const struct mac128 *s1, const struct mac128 *s2) +{ + int i; + for(i=0; i < 16; i++) + dst->bits[i] = s1->bits[i] ^ s2->bits[i]; +} + +void aes_cmac(struct mac128 *target, const void *src, size_t size, const aes_context *key) +{ + const struct mac128 *M = src; + struct mac128 x, y, L, K1, K2; + int i; + size_t bsize = (size - 1) / 16; + + memset(&x, 0, sizeof(x)); + aes_encrypt_ecb(&L, &x, key); + shl_128_mod_hex87(&K1, &L); + shl_128_mod_hex87(&K2, &K1); + + for(i=0; i < bsize; i++) { + xor128(&y, &x, &M[i]); + aes_encrypt_ecb(&x, &y, key); + } + if (size & 0xF) { + struct mac128 z; + memset(&z, 0, sizeof(z)); + memcpy(&z, M + bsize, size & 0xF); + xor128(&y, &x, &K2); + xor128(&x, &y, &z); + } else { + xor128(&y, &x, &K1); + xor128(&x, &y, M + bsize); + } + aes_encrypt_ecb(target, &x, key); +} + +static int verify_128(const void *a, const void* b) +{ + const volatile uint64_t *x = a; + const volatile uint64_t *y = b; + if ((x[0] ^ y[0]) | (x[1] ^ y[1])) + return 1; + return 0; +} + +int aes_cmac_verify(const struct mac128 *target, const void *src, size_t size, const aes_context *key) +{ + struct mac128 mac; + aes_cmac(&mac, src, size, key); + return verify_128(&mac, target); +} + +static int verify_256(const void *a, const void* b) +{ + const volatile uint64_t *x = a; + const volatile uint64_t *y = b; + if ((x[0] ^ y[0]) | (x[1] ^ y[1]) | (x[2] ^ y[2]) | (x[3] ^ y[3])) + return 1; + return 0; +} + +void sha256(struct hash256 *target, const void *src, size_t size) +{ + void* dst = target; + sha2(src, size, dst, 0); +} + +int sha256_verify(const struct hash256 *targ, const void *data, size_t size) +{ + struct hash256 hash; + sha256(&hash, data, size); + return verify_256(&hash, targ); +} diff --git a/stubdom/vtpmmgr/disk_crypto.h b/stubdom/vtpmmgr/disk_crypto.h new file mode 100644 index 0000000..faae9ab --- /dev/null +++ b/stubdom/vtpmmgr/disk_crypto.h @@ -0,0 +1,17 @@ +#ifndef __VTPMMGR_DISK_CRYPTO_H +#define __VTPMMGR_DISK_CRYPTO_H + +void do_random(void *buf, size_t size); +void aes_encrypt_one(void *target, const void *src, const struct key128 *key); +void aes_decrypt_one(void *target, const void *src, const struct key128 *key); + +void aes_setup(aes_context *ctx, const struct key128 *key); +void aes_encrypt_ctr(void *target, size_t target_size, const void *srcv, size_t src_size, const aes_context *key_e); +void aes_decrypt_ctr(void *target, size_t target_size, const void *srcv, size_t src_size, const aes_context *key_e); +void aes_cmac(struct mac128 *target, const void *src, size_t size, const aes_context *key); +int aes_cmac_verify(const struct mac128 *target, const void *src, size_t size, const aes_context *key); + +void sha256(struct hash256 *target, const void *src, size_t size); +int sha256_verify(const struct hash256 *targ, const void *data, size_t size); + +#endif diff --git a/stubdom/vtpmmgr/disk_format.h b/stubdom/vtpmmgr/disk_format.h new file mode 100644 index 0000000..bc20fbb --- /dev/null +++ b/stubdom/vtpmmgr/disk_format.h @@ -0,0 +1,193 @@ +#ifndef __VTPMMGR_DISK_FORMAT_H +#define __VTPMMGR_DISK_FORMAT_H + +static const uint8_t TPM_MGR_MAGIC[12] = { + 'T','P','M',0xfe,'M','G','R',0xdd,'D','O','M',0x00 +}; + +/** + * Sector 0 on disk: stored in plaintext + */ +struct disk_header { + char magic[12]; +#define TPM_MGR_VERSION 0 + be32_t version; +}; + +/** + * Raw contents of disk sectors that need both encryption and authentication + */ +struct disk_crypt_sector_plain { + struct mac128 mac; + union { + struct { + uint8_t iv[16]; + char data[4096-32]; + }; + uint8_t iv_data[4096-16]; + }; +}; + +/** + * Contents of the sealed blob in the root seal list + */ +struct disk_root_sealed_data { +#define DISK_ROOT_BOUND_MAGIC "Root" + char magic[4]; + uuid_t tpm_manager_uuid; + + be32_t nvram_slot; + struct tpm_authdata nvram_auth; + be32_t counter_index; + struct tpm_authdata counter_auth; + + /* encrypted (AES-ECB) with key from NVRAM */ + struct key128 tm_key; +}; + +/** + * Contents of the sealed blob in a group's seal list + */ +struct disk_group_sealed_data { +#define DISK_GROUP_BOUND_MAGIC "TGrp" + char magic[4]; + uuid_t tpm_manager_uuid; + struct tpm_authdata aik_authdata; + + struct key128 group_key; + struct key128 rollback_mac_key; +}; + +/** + * Contents of the seal_list_N sectors on disk (plaintext, linked list) + * + * The hdr field is unused except in sector 0 + */ +struct disk_seal_list { + struct disk_header hdr; + be32_t length; + sector_t next; +#define SEALS_PER_ROOT_SEAL_LIST 13 + struct disk_seal_entry entry[SEALS_PER_ROOT_SEAL_LIST]; +}; + +/** + * TODO - overflow for struct disk_group_boot_config_list + */ +struct disk_group_seal_list { + sector_t next; +#define SEALS_PER_GROUP_SEAL_LIST 13 + struct disk_seal_entry entry[SEALS_PER_GROUP_SEAL_LIST]; +}; + +/** + * Rollback detection MAC entry + */ +struct disk_rb_mac_entry { + be32_t id; + struct mac128 mac; +}; + +#define NR_ENTRIES_PER_ROOT 16 +/** + * The area of the root sector protected by rollback MACs + */ +struct disk_root_sector_mac1_area { + be64_t sequence; + be32_t tpm_counter_value; + + be32_t nr_groups; + struct hash256 group_hash[NR_ENTRIES_PER_ROOT]; +}; + +/** + * Decrypted contents of the root sector (sector 1 and 2) on disk + */ +struct disk_root_sector { + struct disk_root_sector_mac1_area v; + + sector_t group_loc[NR_ENTRIES_PER_ROOT]; + + uint8_t pad[8]; + + /* Rollback detection MACs */ + be32_t nr_rb_macs; + sector_t rb_next_loc; + /* used if rb_macs overflows */ + struct hash256 rb_next_hash; + +#define NR_RB_MACS_PER_ROOT 128 + struct disk_rb_mac_entry rb_macs[NR_RB_MACS_PER_ROOT]; +}; + +/** + * Hash tree for list expansion. Used for the list of groups in the root and for + * the list of vTPMs in a group. + */ +struct disk_itree_sector { +#define NR_ENTRIES_PER_ITREE 112 + sector_t location[NR_ENTRIES_PER_ITREE]; + /* SECTOR-HASH { */ + struct hash256 hash[NR_ENTRIES_PER_ITREE]; + /* SECTOR-HASH } */ +}; + +#define NR_ENTRIES_PER_GROUP_BASE 16 +/** + * Data that must remain constant if a group is not open + */ +struct disk_group_sector_mac3_area { + struct group_id_data id_data; /* MAC2 */ + struct group_details details; + struct disk_group_boot_config_list boot_configs; + + be32_t nr_vtpms; + struct hash256 vtpm_hash[NR_ENTRIES_PER_GROUP_BASE]; +}; + +/** + * Group metadata sector + * + * Encrypted with TM_KEY - takes 16 bytes for IV; integrity from parent. + */ +struct disk_group_sector { + /* SECTOR-HASH { */ + struct disk_group_sector_mac3_area v; + + /* MAC(MAC3, group_key) */ + struct mac128 group_mac; + /* SECTOR-HASH } */ + + sector_t vtpm_location[NR_ENTRIES_PER_GROUP_BASE]; + sector_t boot_configs_next; +}; + +/** + * Data on a vTPM which is available when its group is not open + */ +struct disk_vtpm_plain { + uuid_t uuid; + be32_t flags; +}; + +/** + * Data on a vTPM which is only available when its group is open + */ +struct disk_vtpm_secret { + uint8_t data[64]; +}; + +/** + * Contents of a vTPM data disk sector + * + * Encrypted with TM_KEY - takes 16 bytes for IV + */ +struct disk_vtpm_sector { + /* SECTOR-HASH { */ + struct disk_vtpm_plain header[VTPMS_PER_SECTOR]; + struct mac128 iv; + struct disk_vtpm_secret data[VTPMS_PER_SECTOR]; + /* SECTOR-HASH } */ +}; + +#endif diff --git a/stubdom/vtpmmgr/disk_io.c b/stubdom/vtpmmgr/disk_io.c new file mode 100644 index 0000000..02b4fdd --- /dev/null +++ b/stubdom/vtpmmgr/disk_io.c @@ -0,0 +1,125 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" + +static uint8_t disk_staging_buf[4096] __attribute__((aligned(4096))); + +static struct blkfront_dev* blkdev; +static int blkfront_fd = -1; + +int vtpm_storage_init(void) { + struct blkfront_info info; + blkdev = init_blkfront(NULL, &info); + if (blkdev == NULL) + return -1; + blkfront_fd = blkfront_open(blkdev); + if (blkfront_fd < 0) + return -1; + return 0; +} + +void* disk_read_sector(sector_t sector) +{ + uint32_t pos = be32_native(sector); + int rc; + vtpmloginfo(VTPM_LOG_VTPM, "disk_read_sector %x\n", pos); + lseek(blkfront_fd, pos * 4096, SEEK_SET); + rc = read(blkfront_fd, disk_staging_buf, 4096); + if (rc != 4096) + abort(); + return disk_staging_buf; +} + +void* disk_write_buf(void) { return disk_staging_buf; } + +void disk_write_sector(sector_t sector, void* buf, size_t siz) +{ + int rc; + uint32_t pos = be32_native(sector); + lseek(blkfront_fd, pos * 4096, SEEK_SET); + if (siz < 4096) { + if (buf != disk_staging_buf) + memcpy(disk_staging_buf, buf, siz); + memset(disk_staging_buf + siz, 0, 4096 - siz); + buf = disk_staging_buf; + } else if (siz > 4096) + abort(); + + rc = write(blkfront_fd, buf, 4096); + if (rc != 4096) + abort(); +} + +void disk_write_barrier(void) +{ + blkfront_sync(blkdev); +} + +enum inuse_value { + UNUSED, + SLOT_1, + SLOT_2, + SHARED +}; + +/* TODO make this dynamic to support using more than 2MB of disk */ +#define DISK_MAX_SECTOR 0x200 + +/* The first 4 sectors are statically allocated: + * 0 - disk header (copy 1) + * 1 - disk header (copy 2) + * 2 - root sector (copy 1) + * 3 - root sector (copy 2) + */ +#define FIRST_DYNAMIC_SECTOR 4 + +static uint8_t sector_inuse_map[DISK_MAX_SECTOR]; + +static int active_slot(const struct mem_tpm_mgr *mgr) +{ + return 1 + mgr->active_root; +} + +void disk_set_used(sector_t loc, const struct mem_tpm_mgr *mgr) +{ + uint32_t s = be32_native(loc); + if (s > DISK_MAX_SECTOR) { + printk("Attempted disk_set_used %x\n", s); + return; + } + sector_inuse_map[s] |= active_slot(mgr); +} + +void disk_flush_slot(const struct mem_tpm_mgr *mgr) +{ + int i; + for(i = FIRST_DYNAMIC_SECTOR; i < DISK_MAX_SECTOR; i++) + sector_inuse_map[i] &= ~active_slot(mgr); +} + +sector_t disk_find_free(const struct mem_tpm_mgr *mgr) +{ + int i; + for(i = FIRST_DYNAMIC_SECTOR; i < DISK_MAX_SECTOR; i++) { + if (sector_inuse_map[i]) + continue; + sector_inuse_map[i] = active_slot(mgr); + return native_be32(i); + } + // TODO more graceful error handling (in callers) + abort(); +} diff --git a/stubdom/vtpmmgr/disk_io.h b/stubdom/vtpmmgr/disk_io.h new file mode 100644 index 0000000..c0d35a5 --- /dev/null +++ b/stubdom/vtpmmgr/disk_io.h @@ -0,0 +1,25 @@ +#ifndef __VTPMMGR_DISK_IO_H +#define __VTPMMGR_DISK_IO_H + +void* disk_read_sector(sector_t sector); +void disk_write_sector(sector_t sector, void* buf, size_t siz); +void* disk_write_buf(void); +void disk_write_barrier(void); + +sector_t disk_find_free(const struct mem_tpm_mgr *mgr); +void disk_flush_slot(const struct mem_tpm_mgr *mgr); +void disk_set_used(sector_t loc, const struct mem_tpm_mgr *mgr); + +void disk_write_all(struct mem_tpm_mgr *mgr); + +static inline sector_t seal_loc(struct mem_tpm_mgr *mgr) +{ + return native_be32(mgr->active_root); +} + +static inline sector_t root_loc(struct mem_tpm_mgr *mgr) +{ + return native_be32(2 + mgr->active_root); +} + +#endif diff --git a/stubdom/vtpmmgr/disk_read.c b/stubdom/vtpmmgr/disk_read.c new file mode 100644 index 0000000..33aacdd --- /dev/null +++ b/stubdom/vtpmmgr/disk_read.c @@ -0,0 +1,606 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" +#include "disk_crypto.h" +#include "disk_format.h" + +static int disk_read_crypt_sector(void *data, size_t size, sector_t block, const struct mem_tpm_mgr *mgr) +{ + struct disk_crypt_sector_plain *sector = disk_read_sector(block); + if (!sector) + return 2; + + if (aes_cmac_verify(§or->mac, sector->data, sizeof(sector->data), &mgr->tm_key_e)) + return 2; + + aes_decrypt_ctr(data, size, sector->iv_data, sizeof(sector->iv_data), &mgr->tm_key_e); + return 0; +} + +static void group_free(struct mem_group *group) +{ + int i, j; + if (!group) + return; + if (group->data) { + for (i = 0; i < group->nr_pages; i++) { + for (j = 0; j < group->data[i].size; j++) { + free(group->data[i].vtpms[j]); + } + } + free(group->data); + } + free(group->seals); + free(group); +} + +static void mgr_free(struct mem_tpm_mgr *mgr) +{ + int i; + if (!mgr) + return; + if (mgr->groups) { + for(i=0; i < mgr->nr_groups; i++) + group_free(mgr->groups[i].v); + free(mgr->groups); + } + free(mgr); +} + +/* Open the group keys from one of the sealed strutures */ +static int find_group_key(struct mem_group *dst, + const struct disk_group_sector *group, + const struct mem_tpm_mgr *parent) +{ + int i, rc, rv = 1; + struct hash160 buf; + struct disk_group_sealed_data sealed; + + dst->nr_seals = be32_native(group->v.boot_configs.nr_cfgs); + if (dst->nr_seals > NR_SEALS_PER_GROUP) + return 3; // TODO support spill to extra pages + + dst->seals = calloc(dst->nr_seals, sizeof(dst->seals[0])); + if (!dst->seals) { + vtpmlogerror(VTPM_LOG_VTPM, "find_group_key alloc %x\n", dst->nr_seals); + return 2; + } + + for(i=0; i < dst->nr_seals; i++) { + const struct disk_seal_entry *cfg = &group->v.boot_configs.entry[i]; + dst->seals[i].pcr_selection = cfg->pcr_selection; + memcpy(&dst->seals[i].digest_release, &cfg->digest_release, 20); + + TPM_pcr_digest(&buf, cfg->pcr_selection); + if (memcmp(&buf, &cfg->digest_release, 20)) + continue; + rc = TPM_disk_unseal(&sealed, sizeof(sealed), cfg); + if (rc) + continue; + if (memcmp(&sealed.magic, DISK_GROUP_BOUND_MAGIC, 4)) + continue; + if (memcmp(sealed.tpm_manager_uuid, parent->uuid, 16)) + continue; + + memcpy(&dst->rollback_mac_key, &sealed.rollback_mac_key, 16); + memcpy(&dst->group_key, &sealed.group_key, 16); + memcpy(&dst->aik_authdata, &sealed.aik_authdata, 20); + rv = 0; + } + + // cache the list to allow writes without touching the TPM + memcpy(&dst->seal_bits, &group->v.boot_configs, sizeof(dst->seal_bits)); + dst->flags |= MEM_GROUP_FLAG_SEAL_VALID; + + return rv; +} + +static int parse_root_key(struct mem_tpm_mgr *dst, struct disk_seal_entry *src) +{ + int rc; + struct disk_root_sealed_data sealed; + + rc = TPM_disk_unseal(&sealed, sizeof(sealed), src); + if (rc) + return rc; + + if (memcmp(&sealed.magic, DISK_ROOT_BOUND_MAGIC, 4)) + return 1; + + rc = TPM_disk_nvread(&dst->nv_key, 16, sealed.nvram_slot, sealed.nvram_auth); + if (rc) + return rc; + + // TODO when an NV slot in the physical TPM is used to populate nv_key, + // that value should be used to mask the master key so that the value + // can be changed to revoke old disk state +#if 0 + aes_decrypt_one(&dst->tm_key, &sealed.tm_key, &dst->nv_key); +#else + memcpy(&dst->tm_key, &sealed.tm_key, 16); +#endif + + memcpy(dst->uuid, sealed.tpm_manager_uuid, 16); + dst->nvram_slot = sealed.nvram_slot; + memcpy(&dst->nvram_auth, &sealed.nvram_auth, sizeof(struct tpm_authdata)); + dst->counter_index = sealed.counter_index; + memcpy(&dst->counter_auth, &sealed.counter_auth, sizeof(struct tpm_authdata)); + + return 0; +} + +static struct mem_tpm_mgr *find_root_key(int active_root) +{ + sector_t seal_list = native_be32(active_root); + struct disk_seal_list *seal = disk_read_sector(seal_list); + struct hash160 buf; + int i, rc, nr; + struct mem_tpm_mgr *dst; + + if (memcmp(seal->hdr.magic, TPM_MGR_MAGIC, 12)) + return NULL; + + if (be32_native(seal->hdr.version) != TPM_MGR_VERSION) + return NULL; + + dst = calloc(1, sizeof(*dst)); + dst->active_root = active_root; + + for (nr = 0; nr < 100; nr++) { + disk_set_used(seal_list, dst); + uint32_t nr_seals = be32_native(seal->length); + if (nr_seals > SEALS_PER_ROOT_SEAL_LIST) + break; + for (i = 0; i < nr_seals; i++) { + struct disk_seal_entry *src = &seal->entry[i]; + + TPM_pcr_digest(&buf, src->pcr_selection); + if (memcmp(&buf, &src->digest_release, 20)) + continue; + + rc = parse_root_key(dst, src); + if (rc) + continue; + return dst; + } + seal_list = seal->next; + if (seal_list.value == 0) + break; + seal = disk_read_sector(seal_list); + } + mgr_free(dst); + return NULL; +} + +/* Load and verify one sector's worth of vTPMs. This loads all the vTPM entries + * and decrypts their state data into memory. + */ +static int load_verify_vtpm_page(struct mem_vtpm_page *dst, int base, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + struct disk_vtpm_sector pt; + int i, rc; + + disk_set_used(dst->disk_loc, mgr); + + rc = disk_read_crypt_sector(&pt, sizeof(pt), dst->disk_loc, mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + rc = sha256_verify(&dst->disk_hash, &pt, sizeof(pt)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + if (!group_key) + return 0; + + aes_decrypt_ctr(pt.data, sizeof(pt.data), &pt.iv, sizeof(pt.data) + 16, group_key); + + for (i = 0; i < dst->size; i++) { + struct mem_vtpm *vtpm = calloc(1, sizeof(*vtpm)); + dst->vtpms[i] = vtpm; + memcpy(vtpm->uuid, pt.header[i].uuid, 16); + memcpy(vtpm->data, pt.data[i].data, 64); + vtpm->flags = be32_native(pt.header[i].flags); + vtpm->index_in_parent = i + base; + } + return 0; +} + +static int load_verify_vtpm_pages(struct mem_group *group, int base, int size, + const struct hash256 *hash, const sector_t *loc, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + int i, rc; + struct mem_vtpm_page *page = group->data + base; + + /* base was in terms of sectors; convert to vtpms */ + base *= VTPMS_PER_SECTOR; + + for (i = 0; i < size; i++) { + page->disk_hash = hash[i]; + page->disk_loc = loc[i]; + if (group->nr_vtpms - base > VTPMS_PER_SECTOR) + page->size = VTPMS_PER_SECTOR; + else + page->size = group->nr_vtpms - base; + rc = load_verify_vtpm_page(page, base, mgr, group_key); + if (rc) + return rc; + base += VTPMS_PER_SECTOR; + } + + return 0; +} + +static int load_verify_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize, + const struct mem_tpm_mgr *mgr, const aes_context *group_key); + +static int load_verify_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + int i, rc, incr = 1, inuse_base = hdr->disk_nr_inuse, lsize; + + // increase tree depth until all entries fit + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + // save the list of used sectors (itree and vtpm) in the header + lsize = 1 + (nr_entries - 1) / incr; + hdr->disk_nr_inuse += lsize; + hdr->disk_inuse = realloc(hdr->disk_inuse, hdr->disk_nr_inuse * sizeof(sector_t)); + memcpy(&hdr->disk_inuse[inuse_base], loc, lsize * sizeof(sector_t)); + + // if the entries already fit, process vtpm pages + if (nr_entries <= hsize) + return load_verify_vtpm_pages(hdr->v, base, nr_entries, hash, loc, mgr, group_key); + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_set_used(loc[i], mgr); + hdr->disk_inuse[inuse_base++] = loc[i]; + + rc = disk_read_crypt_sector(&pt, sizeof(pt), loc[i], mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = sha256_verify(&hash[i], pt.hash, sizeof(pt.hash)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = load_verify_vtpm_itree(hdr, base, child_entries, pt.hash, pt.location, + NR_ENTRIES_PER_ITREE, mgr, group_key); + if (rc) + return rc; + + base += incr; + } + + return 0; +} + +/* Load and verify one group's data structure, including its vTPMs. + */ +static int load_verify_group(struct mem_group_hdr *dst, const struct mem_tpm_mgr *mgr) +{ + struct mem_group *group; + struct disk_group_sector disk; + int rc; + aes_context key_e; + aes_context *opened_key = NULL; + + disk_set_used(dst->disk_loc, mgr); + + rc = disk_read_crypt_sector(&disk, sizeof(disk), dst->disk_loc, mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + rc = sha256_verify(&dst->disk_hash, &disk.v, sizeof(disk.v) + sizeof(disk.group_mac)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + dst->v = group = calloc(1, sizeof(*group)); + + rc = find_group_key(group, &disk, mgr); + if (rc == 0) { + opened_key = &key_e; + /* Verify the group with the group's own key */ + aes_setup(opened_key, &group->group_key); + if (aes_cmac_verify(&disk.group_mac, &disk.v, sizeof(disk.v), opened_key)) { + printk("Group CMAC failed\n"); + return 2; + } + + memcpy(&group->id_data, &disk.v.id_data, sizeof(group->id_data)); + memcpy(&group->details, &disk.v.details, sizeof(group->details)); + } else if (rc == 1) { + // still need to walk the vtpm list + rc = 0; + } else { + printk("Group key unsealing failed\n"); + return rc; + } + + group->nr_vtpms = be32_native(disk.v.nr_vtpms); + group->nr_pages = (group->nr_vtpms + VTPMS_PER_SECTOR - 1) / VTPMS_PER_SECTOR; + + group->data = calloc(group->nr_pages, sizeof(group->data[0])); + + rc = load_verify_vtpm_itree(dst, 0, group->nr_pages, disk.v.vtpm_hash, + disk.vtpm_location, NR_ENTRIES_PER_GROUP_BASE, mgr, opened_key); + + if (!opened_key) { + /* remove the struct */ + free(group->data); + free(group->seals); + free(group); + dst->v = NULL; + } + + return rc; +} + +static int load_root_pre(struct disk_root_sector *root, struct mem_tpm_mgr *dst) +{ + int rc; + + aes_setup(&dst->tm_key_e, &dst->tm_key); + + rc = disk_read_crypt_sector(root, sizeof(*root), root_loc(dst), dst); + + if (rc) { + vtpmloginfo(VTPM_LOG_VTPM, "root cmac verify failed in slot %d\n", dst->active_root); + return 2; + } + + dst->root_seals_valid = 1 + dst->active_root; + dst->sequence = be64_native(root->v.sequence); + + return 0; +} + +static int load_verify_group_itree(struct mem_tpm_mgr *dst, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize); + +static int load_verify_group_itree(struct mem_tpm_mgr *dst, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize) +{ + int i, rc, incr = 1; + + if (nr_entries <= hsize) { + for(i=0; i < nr_entries; i++) { + struct mem_group_hdr *group = dst->groups + base + i; + group->disk_loc = loc[i]; + memcpy(&group->disk_hash, &hash[i], sizeof(group->disk_hash)); + rc = load_verify_group(group, dst); + if (rc) { + printk("Error loading group %d\n", base + i); + return rc; + } + } + return 0; + } + + // increase tree depth until all entries fit + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_set_used(loc[i], dst); + + rc = disk_read_crypt_sector(&pt, sizeof(pt), loc[i], dst); + if (rc) { + printk("Malformed sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = sha256_verify(&hash[i], pt.hash, sizeof(pt.hash)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = load_verify_group_itree(dst, base, child_entries, pt.hash, pt.location, NR_ENTRIES_PER_ITREE); + if (rc) + return rc; + + base += incr; + } + + return 0; +} + +static int load_root_post(struct mem_tpm_mgr *dst, const struct disk_root_sector *root) +{ + int rc, i, j; + uint32_t nr_disk_rbs = be32_native(root->nr_rb_macs); + + rc = TPM_disk_check_counter(dst->counter_index, dst->counter_auth, + root->v.tpm_counter_value); + if (rc) + return 2; + dst->counter_value = root->v.tpm_counter_value; + + dst->nr_groups = be32_native(root->v.nr_groups); + dst->groups = calloc(sizeof(dst->groups[0]), dst->nr_groups); + + if (!dst->groups) { + vtpmlogerror(VTPM_LOG_VTPM, "load_root_post alloc %x\n", dst->nr_groups); + return 2; + } + + rc = load_verify_group_itree(dst, 0, dst->nr_groups, + root->v.group_hash, root->group_loc, NR_ENTRIES_PER_ROOT); + if (rc) + return rc; + + /* Sanity check: group0 must be open */ + if (!dst->groups[0].v) { + printk("Error opening group 0\n"); + return 2; + } + + /* TODO support for spilling rollback list */ + if (nr_disk_rbs > NR_RB_MACS_PER_ROOT) + return 3; + + i = 0; + j = 0; + while (i < dst->nr_groups) { + aes_context key_e; + struct mem_group_hdr *group = &dst->groups[i]; + struct mem_group *groupv = group->v; + const struct disk_rb_mac_entry *ent = &root->rb_macs[j]; + + if (!groupv) { + i++; + // this group is not open - no need to verify now + continue; + } + + if (be32_native(ent->id) < i) { + // this entry is for a group that is not open + j++; + continue; + } + + if (j >= nr_disk_rbs || be32_native(ent->id) != i) { + // TODO allow delegation + if (!(groupv->details.flags.value & FLAG_ROLLBACK_DETECTED)) { + groupv->details.flags.value |= FLAG_ROLLBACK_DETECTED; + group->disk_loc.value = 0; + } + i++; + continue; + } + + aes_setup(&key_e, &groupv->rollback_mac_key); + if (aes_cmac_verify(&ent->mac, &root->v, sizeof(root->v), &key_e)) { + if (!(groupv->details.flags.value & FLAG_ROLLBACK_DETECTED)) { + groupv->details.flags.value |= FLAG_ROLLBACK_DETECTED; + group->disk_loc.value = 0; + } + } + i++; j++; + } + + return 0; +} + +int vtpm_load_disk(void) +{ + struct disk_root_sector root1, root2; + int rc = 0; + TPM_read_pcrs(); + + printk("TPM Manager - disk format %d\n", TPM_MGR_VERSION); + printk(" root seal: %lu; sector of %d: %lu\n", + sizeof(struct disk_root_sealed_data), SEALS_PER_ROOT_SEAL_LIST, sizeof(struct disk_seal_list)); + printk(" root: %lu v=%lu\n", sizeof(root1), sizeof(root1.v)); + printk(" itree: %lu; sector of %d: %lu\n", + 4 + 32, NR_ENTRIES_PER_ITREE, sizeof(struct disk_itree_sector)); + printk(" group: %lu v=%lu id=%lu md=%lu\n", + sizeof(struct disk_group_sector), sizeof(struct disk_group_sector_mac3_area), + sizeof(struct group_id_data), sizeof(struct group_details)); + printk(" group seal: %lu; %d in parent: %lu; sector of %d: %lu\n", + sizeof(struct disk_group_sealed_data), NR_SEALS_PER_GROUP, sizeof(struct disk_group_boot_config_list), + SEALS_PER_GROUP_SEAL_LIST, sizeof(struct disk_group_seal_list)); + printk(" vtpm: %lu+%lu; sector of %d: %lu\n", + sizeof(struct disk_vtpm_plain), sizeof(struct disk_vtpm_secret), + VTPMS_PER_SECTOR, sizeof(struct disk_vtpm_sector)); + + struct mem_tpm_mgr *mgr1 = find_root_key(0); + struct mem_tpm_mgr *mgr2 = find_root_key(1); + + rc = mgr1 ? load_root_pre(&root1, mgr1) : 0; + if (rc) { + mgr_free(mgr1); + mgr1 = NULL; + } + + rc = mgr2 ? load_root_pre(&root2, mgr2) : 0; + if (rc) { + mgr_free(mgr2); + mgr2 = NULL; + } + + printk("load_root_pre: %c/%c\n", mgr1 ? 'y' : 'n', mgr2 ? 'y' : 'n'); + + if (!mgr1 && !mgr2) + return 2; + + if (mgr1 && mgr2 && mgr2->sequence > mgr1->sequence) { + rc = load_root_post(mgr2, &root2); + if (rc) { + mgr_free(mgr2); + mgr2 = NULL; + } else { + mgr_free(mgr1); + g_mgr = mgr2; + return 0; + } + } + if (mgr1) { + rc = load_root_post(mgr1, &root1); + if (rc) { + mgr_free(mgr1); + } else { + mgr_free(mgr2); + g_mgr = mgr1; + return 0; + } + } + if (mgr2) { + rc = load_root_post(mgr2, &root2); + if (rc) { + mgr_free(mgr2); + } else { + g_mgr = mgr2; + return 0; + } + } + printk("Could not read vTPM disk\n"); + + return 2; +} diff --git a/stubdom/vtpmmgr/disk_tpm.c b/stubdom/vtpmmgr/disk_tpm.c new file mode 100644 index 0000000..6f5d556 --- /dev/null +++ b/stubdom/vtpmmgr/disk_tpm.c @@ -0,0 +1,238 @@ +/* TPM disk interface */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "tpm.h" +#include "tcg.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" + +// Print out input/output of seal/unseal operations (includes keys) +#undef DEBUG_SEAL_OPS + +#ifdef DEBUG_SEAL_OPS +#include "marshal.h" +#endif + +struct pcr_list { + TPM_DIGEST pcrs[24]; +}; + +static struct pcr_list hwtpm; + +void TPM_read_pcrs(void) +{ + int i; + for(i=0; i < 24; i++) + TPM_PCR_Read(i, &hwtpm.pcrs[i]); +} + +struct pcr_composite_3 { + be16_t sel_size; + uint8_t sel[3]; + be32_t val_size; + uint8_t val[0]; +} __attribute__((packed)); + +void TPM_pcr_digest(struct hash160 *buf, le32_t selection) +{ + int i; + int count = 0; + uint32_t sel = le32_native(selection); + struct pcr_composite_3 *v; + for(i=0; i < 24; i++) { + if (sel & (1 << i)) + count++; + } + v = alloca(sizeof(*v) + 20 * count); + v->sel_size = native_be16(3); + memcpy(v->sel, &selection, 3); + v->val_size = native_be32(20 * count); + + count = 0; + for(i=0; i < 24; i++) { + if (sel & (1 << i)) { + memcpy(v->val + 20 * count, &hwtpm.pcrs[i], 20); + count++; + } + } + + sha1((void*)v, sizeof(*v) + 20 * count, buf->bits); +} + + +int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) +{ + uint32_t rc; + TPM_PCR_INFO info; + TPM_STORED_DATA out; + TPM_AUTH_SESSION osap = TPM_AUTH_SESSION_INIT; + TPM_AUTHDATA sharedsecret; + TPM_AUTHDATA auth; + + rc = TPM_OSAP(TPM_ET_KEYHANDLE, TPM_SRK_KEYHANDLE, (void*)&vtpm_globals.srk_auth, + &sharedsecret, &osap); + + if (rc) abort(); + +#ifdef DEBUG_SEAL_OPS + int i; + printk("to-seal:"); + for(i=0; i < size; i++) + printk(" %02x", ((uint8_t*)src)[i]); + printk("\n"); +#endif + + memset(auth, 0, 20); + info.pcrSelection.sizeOfSelect = 3; + info.pcrSelection.pcrSelect = (void*)&dst->pcr_selection; + memcpy(&info.digestAtCreation, &dst->digest_at_seal, 20); + memcpy(&info.digestAtRelease, &dst->digest_release, 20); + + rc = TPM_Seal(TPM_SRK_KEYHANDLE, 45, &info, size, src, &out, + (void*)&sharedsecret, (void*)&auth, &osap); + + TPM_TerminateHandle(osap.AuthHandle); + +#ifdef DEBUG_SEAL_OPS + printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoSize); +#endif + if (!rc) + memcpy(dst->sealed_data, out.encData, 256); + +#ifdef DEBUG_SEAL_OPS + uint8_t buf[512]; + uint8_t *start = buf; + uint8_t *end = pack_TPM_STORED_DATA(buf, &out); + printk("stored_data:"); + while (start != end) { + printk(" %02x", *start); + start++; + } + printk("\n"); +#endif + + free_TPM_STORED_DATA(&out); + return rc; +} + +int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src) +{ + uint32_t rc; + TPM_STORED_DATA in; + TPM_AUTH_SESSION oiap = TPM_AUTH_SESSION_INIT; + TPM_AUTHDATA auth; + uint32_t outSize = 0; + uint8_t *out = NULL; + + rc = TPM_OIAP(&oiap); + if (rc) abort(); + + memset(auth, 0, 20); + + in.ver = TPM_STRUCT_VER_1_1; + in.sealInfoSize = 45; + in.sealInfo.pcrSelection.sizeOfSelect = 3; + in.sealInfo.pcrSelection.pcrSelect = (void*)&src->pcr_selection; + memcpy(&in.sealInfo.digestAtCreation, &src->digest_at_seal, 20); + memcpy(&in.sealInfo.digestAtRelease, &src->digest_release, 20); + in.encDataSize = 256; + in.encData = (void*)src->sealed_data; + +#ifdef DEBUG_SEAL_OPS + uint8_t buf[512]; + uint8_t *start = buf; + uint8_t *end = pack_TPM_STORED_DATA(buf, &in); + printk("stored_data:"); + while (start != end) { + printk(" %02x", *start); + start++; + } + printk("\n"); +#endif + + rc = TPM_Unseal(TPM_SRK_KEYHANDLE, &in, &outSize, &out, + (void*)&vtpm_globals.srk_auth, (void*)&auth, &vtpm_globals.oiap, &oiap); + + TPM_TerminateHandle(oiap.AuthHandle); + +#ifdef DEBUG_SEAL_OPS + printk("TPM_Unseal rc=%d outSize=%d size=%d\n", rc, outSize, size); +#endif + if (!rc) { + memcpy(dst, out, size); +#ifdef DEBUG_SEAL_OPS + printk("unsealed:"); + int i; + for(i=0; i < size; i++) + printk(" %02x", ((uint8_t*)dst)[i]); + printk("\n"); +#endif + } + + free(out); + + return rc; +} + +int TPM_disk_nvalloc(be32_t *nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + nvram_slot->value = 0; + return 0; +} + +int TPM_disk_nvread(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + memset(buf, 0, bufsiz); + return 0; +} + +int TPM_disk_nvwrite(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + return 0; +} + +int TPM_disk_nvchange(be32_t nvram_slot, struct tpm_authdata old, struct tpm_authdata noo) +{ + // TODO-3 + return 0; +} + +int TPM_disk_alloc_counter(be32_t *slot, struct tpm_authdata auth, be32_t *value) +{ + // TODO-3 + slot->value = 0; + value->value = 0; + return 0; +} + +int TPM_disk_check_counter(be32_t slot, struct tpm_authdata auth, be32_t value) +{ + // TODO-3 + return 0; +} + +int TPM_disk_incr_counter(be32_t slot, struct tpm_authdata auth) +{ + // TODO-3 + return 0; +} + +int TPM_disk_change_counter(be32_t slot, struct tpm_authdata old, struct tpm_authdata noo) +{ + // TODO-3 + return 0; +} diff --git a/stubdom/vtpmmgr/disk_tpm.h b/stubdom/vtpmmgr/disk_tpm.h new file mode 100644 index 0000000..b235895 --- /dev/null +++ b/stubdom/vtpmmgr/disk_tpm.h @@ -0,0 +1,25 @@ +#ifndef __VTPMMGR_DISK_VTPM_H +#define __VTPMMGR_DISK_VTPM_H +#include "vtpm_disk.h" + +/* Read PCR values to determine which unseal to try */ +void TPM_read_pcrs(void); +void TPM_pcr_digest(struct hash160 *buf, le32_t selection); + +/* Sealing for key storage */ +int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size); +int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src); + +/* NVRAM to allow revocation of TM-KEY */ +int TPM_disk_nvalloc(be32_t *nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvread(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvwrite(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvchange(be32_t nvram_slot, struct tpm_authdata old, struct tpm_authdata noo); + +/* Monotonic counters to detect rollback */ +int TPM_disk_alloc_counter(be32_t *slot, struct tpm_authdata auth, be32_t *value); +int TPM_disk_check_counter(be32_t slot, struct tpm_authdata auth, be32_t value); +int TPM_disk_incr_counter(be32_t slot, struct tpm_authdata auth); +int TPM_disk_change_counter(be32_t slot, struct tpm_authdata old, struct tpm_authdata noo); + +#endif diff --git a/stubdom/vtpmmgr/disk_write.c b/stubdom/vtpmmgr/disk_write.c new file mode 100644 index 0000000..4c825c5 --- /dev/null +++ b/stubdom/vtpmmgr/disk_write.c @@ -0,0 +1,410 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" +#include "disk_crypto.h" +#include "disk_format.h" +#include "mgmt_authority.h" + +static void disk_write_crypt_sector(sector_t *dst, const void *data, size_t size, const struct mem_tpm_mgr *mgr) +{ + struct disk_crypt_sector_plain *sector = disk_write_buf(); + *dst = disk_find_free(mgr); + aes_encrypt_ctr(sector->iv_data, sizeof(sector->iv_data), data, size, &mgr->tm_key_e); + aes_cmac(§or->mac, sector->data, sizeof(sector->data), &mgr->tm_key_e); + disk_write_sector(*dst, sector, sizeof(*sector)); +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_vtpm(const struct mem_vtpm_page *src, const struct mem_tpm_mgr *mgr) +{ + if (be32_native(src->disk_loc) != 0) + disk_set_used(src->disk_loc, mgr); +} + +/* + * Write out a vTPM page to disk, doing nothing if the existing copy is valid + */ +static void disk_write_vtpm_page(struct mem_vtpm_page *dst, const aes_context *auth_key, + const struct mem_tpm_mgr *mgr) +{ + struct disk_vtpm_sector pt; + int i; + memset(&pt, 0, sizeof(pt)); + if (be32_native(dst->disk_loc) != 0) + return; + + for(i=0; i < dst->size; i++) { + memcpy(pt.header[i].uuid, dst->vtpms[i]->uuid, 16); + memcpy(pt.data[i].data, dst->vtpms[i]->data, 64); + pt.header[i].flags = native_be32(dst->vtpms[i]->flags & VTPM_FLAG_DISK_MASK); + } + aes_encrypt_ctr(&pt.iv, sizeof(pt.data) + 16, &pt.data, sizeof(pt.data), auth_key); + + sha256(&dst->disk_hash, &pt, sizeof(pt)); + + disk_write_crypt_sector(&dst->disk_loc, &pt, sizeof(pt), mgr); +} + +/* + * Generate TPM seal blobs for a group's keys; do nothing if existing copy is valid + */ +static void generate_group_seals(struct mem_group *src, const struct mem_tpm_mgr *parent) +{ + int i; + struct disk_group_sealed_data sblob; + + // previous seals are still valid, skip talking to the TPM + if (src->flags & MEM_GROUP_FLAG_SEAL_VALID) + return; + + memcpy(&sblob.magic, DISK_GROUP_BOUND_MAGIC, 4); + memcpy(sblob.tpm_manager_uuid, parent->uuid, 16); + memcpy(&sblob.aik_authdata, &src->aik_authdata, 20); + memcpy(&sblob.group_key, &src->group_key, 16); + memcpy(&sblob.rollback_mac_key, &src->rollback_mac_key, 16); + + /* TODO support for more than NR_SEALS_PER_GROUP seals */ + if (src->nr_seals > NR_SEALS_PER_GROUP) + abort(); + + for(i=0; i < src->nr_seals; i++) { + struct disk_seal_entry *dst = &src->seal_bits.entry[i]; + dst->pcr_selection = src->seals[i].pcr_selection; + memcpy(&dst->digest_release, &src->seals[i].digest_release, 20); + TPM_pcr_digest(&dst->digest_at_seal, dst->pcr_selection); + TPM_disk_seal(dst, &sblob, sizeof(sblob)); + } + src->seal_bits.nr_cfgs = native_be32(src->nr_seals); + + src->flags |= MEM_GROUP_FLAG_SEAL_VALID; +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_group(const struct mem_group_hdr *src, const struct mem_tpm_mgr *mgr) +{ + int i; + struct mem_group *group = src->v; + if (be32_native(src->disk_loc) != 0) { + // entire group is unchanged - mark group, itree, and vtpm sectors + // TODO mark other children (seal) + disk_set_used(src->disk_loc, mgr); + for(i = 0; i < src->disk_nr_inuse; i++) + disk_set_used(src->disk_inuse[i], mgr); + return; + } + + // unopened groups should never have been invalidated + if (!group) + abort(); + + for (i = 0; i < group->nr_pages; i++) + disk_populate_used_vtpm(&group->data[i], mgr); +} + +static void disk_write_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize, + const aes_context *group_key, const struct mem_tpm_mgr *mgr); + +static void disk_write_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize, + const aes_context *group_key, const struct mem_tpm_mgr *mgr) +{ + int i, incr = 1, inuse_base, lsize; + + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + if (nr_entries <= hsize) { + struct mem_group *group = hdr->v; + for (i = 0; i < nr_entries; i++) { + struct mem_vtpm_page *page = group->data + base + i; + disk_write_vtpm_page(page, group_key, mgr); + loc[i] = page->disk_loc; + hash[i] = page->disk_hash; + } + } else { + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_write_vtpm_itree(hdr, base, child_entries, pt.hash, pt.location, + NR_ENTRIES_PER_ITREE, group_key, mgr); + + sha256(&hash[i], &pt.hash, sizeof(pt.hash)); + disk_write_crypt_sector(&loc[i], &pt, sizeof(pt), mgr); + + base += incr; + } + } + + // save the list of used sectors (itree and vtpm) in the header + inuse_base = hdr->disk_nr_inuse; + lsize = 1 + (nr_entries - 1) / incr; + hdr->disk_nr_inuse += lsize; + hdr->disk_inuse = realloc(hdr->disk_inuse, hdr->disk_nr_inuse * sizeof(sector_t)); + memcpy(&hdr->disk_inuse[inuse_base], loc, lsize * sizeof(sector_t)); +} + +/* + * Write out a vTPM group sector and its children + */ +static void disk_write_group_sector(struct mem_group_hdr *src, + const struct mem_tpm_mgr *mgr) +{ + struct disk_group_sector disk; + struct mem_group *group = src->v; + aes_context key_e; + + /* Don't write if the data hasn't changed */ + if (be32_native(src->disk_loc) != 0) + return; + + // if the group was not opened, it should not have been changed + if (!group) + abort(); + + memset(&disk, 0, sizeof(disk)); + memcpy(&disk.v.id_data, &group->id_data, sizeof(disk.v.id_data)); + memcpy(&disk.v.details, &group->details, sizeof(disk.v.details)); + + aes_setup(&key_e, &group->group_key); + + disk.v.nr_vtpms = native_be32(group->nr_vtpms); + + // regenerated + src->disk_nr_inuse = 0; + + disk_write_vtpm_itree(src, 0, group->nr_pages, disk.v.vtpm_hash, disk.vtpm_location, + NR_ENTRIES_PER_GROUP_BASE, &key_e, mgr); + + generate_group_seals(group, mgr); + memcpy(&disk.v.boot_configs, &group->seal_bits, sizeof(group->seal_bits)); + + aes_cmac(&disk.group_mac, &disk.v, sizeof(disk.v), &key_e); + sha256(&src->disk_hash, &disk.v, sizeof(disk.v) + sizeof(disk.group_mac)); + disk_write_crypt_sector(&src->disk_loc, &disk, sizeof(disk), mgr); +} + +/* + * Write TPM seal blobs for the manager's keys, using the given group's list + * of valid configurations + */ +static void disk_write_seal_list(struct mem_tpm_mgr *mgr, struct mem_group *group) +{ + int i; + struct disk_seal_list *seal = disk_write_buf(); + struct disk_root_sealed_data sblob; + + if (mgr->root_seals_valid & (1 + mgr->active_root)) + return; + + memcpy(&sblob.magic, DISK_ROOT_BOUND_MAGIC, 4); + memcpy(sblob.tpm_manager_uuid, mgr->uuid, 16); + memcpy(&sblob.nvram_slot, &mgr->nvram_slot, 4); + memcpy(&sblob.nvram_auth, &mgr->nvram_auth, 20); + memcpy(&sblob.counter_index, &mgr->counter_index, 4); + memcpy(&sblob.counter_auth, &mgr->counter_auth, 20); + + // TODO when an NV slot in the physical TPM is used to populate nv_key, + // that value should be used to mask the master key so that the value + // can be changed to revoke old disk state +#if 0 + aes_encrypt_one(&sblob.tm_key, &mgr->tm_key, &mgr->nv_key); +#else + memcpy(&sblob.tm_key, &mgr->tm_key, 16); +#endif + + memset(seal, 0, sizeof(*seal)); + seal->length = native_be32(group->nr_seals); + + // TODO support for more entries + if (group->nr_seals > SEALS_PER_ROOT_SEAL_LIST) + abort(); + + for(i=0; i < group->nr_seals; i++) { + struct mem_seal *src = &group->seals[i]; + struct disk_seal_entry *dst = &seal->entry[i]; + dst->pcr_selection = src->pcr_selection; + memcpy(&dst->digest_release, &src->digest_release, 20); + TPM_pcr_digest(&dst->digest_at_seal, dst->pcr_selection); + + TPM_disk_seal(dst, &sblob, sizeof(sblob)); + } + + memcpy(seal->hdr.magic, TPM_MGR_MAGIC, 12); + seal->hdr.version = native_be32(TPM_MGR_VERSION); + + disk_write_sector(seal_loc(mgr), seal, sizeof(*seal)); + mgr->root_seals_valid |= 1 + mgr->active_root; +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_mgr(const struct mem_tpm_mgr *mgr) +{ + int i; + + // TODO walk the linked lists for seals, rb_macs here (when supported) + + for(i=0; i < mgr->nr_groups; i++) + disk_populate_used_group(&mgr->groups[i], mgr); +} + +static void disk_write_group_itree(struct mem_tpm_mgr *mgr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize); + +static void disk_write_group_itree(struct mem_tpm_mgr *mgr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize) +{ + int i, incr = 1; + + if (nr_entries <= hsize) { + for(i=0; i < mgr->nr_groups; i++) { + struct mem_group_hdr *group = mgr->groups + base + i; + disk_write_group_sector(group, mgr); + loc[i] = group->disk_loc; + hash[i] = group->disk_hash; + } + return; + } + + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_write_group_itree(mgr, base, child_entries, pt.hash, pt.location, NR_ENTRIES_PER_ITREE); + + sha256(&hash[i], &pt.hash, sizeof(pt.hash)); + disk_write_crypt_sector(&loc[i], &pt, sizeof(pt), mgr); + + base += incr; + } +} + +/* + * Write out the root TPM Manager sector and its children + */ +static void disk_write_root_sector(struct mem_tpm_mgr *mgr) +{ + int i, j; + struct disk_root_sector root; + memset(&root, 0, sizeof(root)); + root.v.sequence = native_be64(mgr->sequence); + root.v.tpm_counter_value = mgr->counter_value; + + root.v.nr_groups = native_be32(mgr->nr_groups); + + disk_write_group_itree(mgr, 0, mgr->nr_groups, root.v.group_hash, root.group_loc, NR_ENTRIES_PER_ROOT); + + i = 0; + j = 0; + while (i < mgr->nr_groups) { + aes_context key_e; + struct mem_group_hdr *group = &mgr->groups[i]; + struct mem_group *groupv = group->v; + + if (!groupv) { + i++; + continue; + } + if (groupv->details.flags.value & FLAG_ROLLBACK_DETECTED) { + i++; + continue; + } + if (j >= NR_RB_MACS_PER_ROOT) + break; // TODO support for nr_rb_macs > 128 + + aes_setup(&key_e, &groupv->rollback_mac_key); + root.rb_macs[j].id = native_be32(i); + aes_cmac(&root.rb_macs[j].mac, &root.v, sizeof(root.v), &key_e); + i++; j++; + } + root.nr_rb_macs = native_be32(j); + + struct disk_crypt_sector_plain *root_sect = disk_write_buf(); + aes_encrypt_ctr(root_sect->iv_data, sizeof(root_sect->iv_data), &root, sizeof(root), &mgr->tm_key_e); + aes_cmac(&root_sect->mac, &root_sect->data, sizeof(root_sect->data), &mgr->tm_key_e); + disk_write_sector(root_loc(mgr), root_sect, sizeof(*root_sect)); +} + +/* + * Write out changes to disk + */ +void disk_write_all(struct mem_tpm_mgr *mgr) +{ + disk_flush_slot(mgr); + disk_populate_used_mgr(mgr); + disk_write_root_sector(mgr); + + disk_write_seal_list(mgr, mgr->groups[0].v); + + disk_write_barrier(); +} + +/* + * Create a new (blank) TPM Manager disk image. + * + * Does not actually write anything to disk. + */ +int vtpm_new_disk(void) +{ + int rc; + struct mem_tpm_mgr *mgr = calloc(1, sizeof(*mgr)); + + do_random(mgr->uuid, 16); + do_random(&mgr->tm_key, 16); + do_random(&mgr->nvram_auth, 20); + do_random(&mgr->counter_auth, 20); + do_random(&mgr->nv_key, 16); + + aes_setup(&mgr->tm_key_e, &mgr->tm_key); + + // TODO postpone these allocs until first write? + rc = TPM_disk_nvalloc(&mgr->nvram_slot, mgr->nvram_auth); + if (rc) + return rc; + + rc = TPM_disk_alloc_counter(&mgr->counter_index, mgr->counter_auth, &mgr->counter_value); + if (rc) + return rc; + + mgr->nr_groups = 1; + mgr->groups = calloc(1, sizeof(mgr->groups[0])); + mgr->groups[0].v = vtpm_new_group(NULL); + + TPM_disk_nvwrite(&mgr->nv_key, 16, mgr->nvram_slot, mgr->nvram_auth); + + g_mgr = mgr; + + return 0; +} diff --git a/stubdom/vtpmmgr/endian_int.h b/stubdom/vtpmmgr/endian_int.h new file mode 100644 index 0000000..030f87b --- /dev/null +++ b/stubdom/vtpmmgr/endian_int.h @@ -0,0 +1,72 @@ +#ifndef __VTPMMGR_ENDIAN_INT_H +#define __VTPMMGR_ENDIAN_INT_H + +#include + +/* These wrapper structs force the use of endian-to-CPU conversions */ + +typedef struct be_int16 { + uint16_t value; +} be16_t; + +typedef struct be_int32 { + uint32_t value; +} be32_t; + +typedef struct le_int32 { + uint32_t value; +} le32_t; + +typedef struct be_int64 { + uint64_t value; +} be64_t; + +static inline uint16_t be16_native(be16_t v) +{ + return be16_to_cpu(v.value); +} + +static inline uint32_t le32_native(le32_t v) +{ + return le32_to_cpu(v.value); +} + +static inline uint32_t be32_native(be32_t v) +{ + return be32_to_cpu(v.value); +} + +static inline uint64_t be64_native(be64_t v) +{ + return be64_to_cpu(v.value); +} + +static inline be16_t native_be16(uint16_t v) +{ + be16_t rv; + rv.value = cpu_to_be16(v); + return rv; +} + +static inline le32_t native_le32(uint32_t v) +{ + le32_t rv; + rv.value = cpu_to_le32(v); + return rv; +} + +static inline be32_t native_be32(uint32_t v) +{ + be32_t rv; + rv.value = cpu_to_be32(v); + return rv; +} + +static inline be64_t native_be64(uint64_t v) +{ + be64_t rv; + rv.value = cpu_to_be64(v); + return rv; +} + +#endif diff --git a/stubdom/vtpmmgr/init.c b/stubdom/vtpmmgr/init.c index 33ac152..89643e7 100644 --- a/stubdom/vtpmmgr/init.c +++ b/stubdom/vtpmmgr/init.c @@ -48,7 +48,7 @@ #include "log.h" #include "vtpmmgr.h" -#include "vtpm_storage.h" +#include "vtpm_disk.h" #include "tpm.h" #include "marshal.h" @@ -64,16 +64,11 @@ struct Opts { }; // --------------------------- Well Known Auths -------------------------- -const TPM_AUTHDATA WELLKNOWN_SRK_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +const TPM_AUTHDATA WELLKNOWN_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; -const TPM_AUTHDATA WELLKNOWN_OWNER_AUTH = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; - struct vtpm_globals vtpm_globals = { .tpm_fd = -1, - .storage_key = TPM_KEY_INIT, - .storage_key_handle = 0, .oiap = { .AuthHandle = 0 } }; @@ -247,42 +242,11 @@ abort_egress: return status; } -static void init_storage_key(TPM_KEY* key) { - key->ver.major = 1; - key->ver.minor = 1; - key->ver.revMajor = 0; - key->ver.revMinor = 0; - - key->keyUsage = TPM_KEY_BIND; - key->keyFlags = 0; - key->authDataUsage = TPM_AUTH_ALWAYS; - - TPM_KEY_PARMS* p = &key->algorithmParms; - p->algorithmID = TPM_ALG_RSA; - p->encScheme = TPM_ES_RSAESOAEP_SHA1_MGF1; - p->sigScheme = TPM_SS_NONE; - p->parmSize = 12; - - TPM_RSA_KEY_PARMS* r = &p->parms.rsa; - r->keyLength = RSA_KEY_SIZE; - r->numPrimes = 2; - r->exponentSize = 0; - r->exponent = NULL; - - key->PCRInfoSize = 0; - key->encDataSize = 0; - key->encData = NULL; -} - -static int parse_auth_string(char* authstr, BYTE* target, const TPM_AUTHDATA wellknown, int allowrandom) { +static int parse_auth_string(char* authstr, BYTE* target) { int rc; /* well known owner auth */ if(!strcmp(authstr, "well-known")) { - memcpy(target, wellknown, sizeof(TPM_AUTHDATA)); - } - /* Create a randomly generated owner auth */ - else if(allowrandom && !strcmp(authstr, "random")) { - return 1; + return 0; } /* owner auth is a raw hash */ else if(!strncmp(authstr, "hash:", 5)) { @@ -318,12 +282,12 @@ int parse_cmdline_opts(int argc, char** argv, struct Opts* opts) int i; //Set defaults - memcpy(vtpm_globals.owner_auth, WELLKNOWN_OWNER_AUTH, sizeof(TPM_AUTHDATA)); - memcpy(vtpm_globals.srk_auth, WELLKNOWN_SRK_AUTH, sizeof(TPM_AUTHDATA)); _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:31 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuq-00011t-Uj; Thu, 01 May 2014 06:56:20 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkup-00011W-CN for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:20 +0000 Received: from [85.158.143.35:41553] by server-2.bemta-4.messagelabs.com id AB/52-06539-210F1635; Thu, 01 May 2014 06:56:18 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-15.tower-21.messagelabs.com!1398927373!2148179!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG, ML_RADAR_SPEW_LINKS_23,spamassassin: X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 7673 invoked from network); 1 May 2014 06:56:14 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-15.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:14 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkui-0001oY-4w for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:12 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkui-0004sJ-1P for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:12 +0000 Date: Thu, 01 May 2014 06:56:12 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: add TPM group support X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 5c3705c900581af6f30be124ab8fb64603bdca03 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:22:57 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:56:41 2014 +0100 vtpmmgr: add TPM group support This is a complete rewrite of the disk format and key hierarchy for the TPM Manager. The new format supports multiple groups of vTPMs which define the permitted configurations where a given vTPM's keys are available, allowing upgrades of critical components while retaining the secrecy of cryptographic keys. New features of the TPM Manager are explained in the README and in the definitions of the management commands in vtpm_manager.h. New features for vTPMs: 1. The size of the state blob for a vTPM is expanded from 52 to 64 bytes in order to support future vTPMs using SHA-2/3 instead of SHA-1. 2. vTPMs can obtain a quote from the physical TPM with certain resettable PCRs set to include information about the vTPM. This can be used by a vTPM to provide evidence of its integrity, including the secrecy of its EK, and for deep quotes. Some additional changes made by this rewrite that may impact existing users: 1. The value of WELLKNOWN_OWNER_AUTH was incorrect for the physical TPM; the convention is to use all zero bits for well-known authentication values, not all one bits. 2. Randomly generating the owner auth value for the physical TPM is no longer supported, as it prevents later creation or certification of AIKs (which the old manager did not support). 3. The vTPM Manager needs to be provisioned with a PCR composite and an upgrade authority's public key before it will save data across boots. The current implementation still has some limitations: * 5 valid system PCR selections per group * The vTPM Manager's disk can use at most 2MB of space * The vTPM domain's build hash is always set to null/zero Most of the code relating to upgrade and rollback protection is currently stubbed out, but future versions can add: * Support for using the TPM's monotonic counter to prevent rollback of vTPM data by taking and restoring disk snapshots * Masking the master disk encryption key using a value stored in the TPM's NVRAM so that revocation of old data is possible without relying on all previously authorized software stacks to respect the monotonic counter's value Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- docs/misc/vtpm-platforms.txt | 127 ++++ docs/misc/vtpm.txt | 247 ++++--- docs/misc/vtpmmgr.txt | 163 +++++ stubdom/vtpm/README | 75 -- stubdom/vtpmmgr/Makefile | 4 +- stubdom/vtpmmgr/README | 75 -- stubdom/vtpmmgr/disk_crypto.c | 231 ++++++ stubdom/vtpmmgr/disk_crypto.h | 17 + stubdom/vtpmmgr/disk_format.h | 193 +++++ stubdom/vtpmmgr/disk_io.c | 125 ++++ stubdom/vtpmmgr/disk_io.h | 25 + stubdom/vtpmmgr/disk_read.c | 606 ++++++++++++++++ stubdom/vtpmmgr/disk_tpm.c | 238 +++++++ stubdom/vtpmmgr/disk_tpm.h | 25 + stubdom/vtpmmgr/disk_write.c | 410 +++++++++++ stubdom/vtpmmgr/endian_int.h | 72 ++ stubdom/vtpmmgr/init.c | 104 +-- stubdom/vtpmmgr/log.h | 8 +- stubdom/vtpmmgr/marshal.h | 824 ++++++++++++++-------- stubdom/vtpmmgr/mgmt_authority.c | 323 +++++++++ stubdom/vtpmmgr/mgmt_authority.h | 11 + stubdom/vtpmmgr/tcg.h | 7 + stubdom/vtpmmgr/tpm.c | 1360 ++++++++++++++++++------------------ stubdom/vtpmmgr/tpm.h | 104 +-- stubdom/vtpmmgr/tpmrsa.c | 25 + stubdom/vtpmmgr/tpmrsa.h | 3 + stubdom/vtpmmgr/vtpm_cmd_handler.c | 858 ++++++++++++++++++++--- stubdom/vtpmmgr/vtpm_disk.c | 237 +++++++ stubdom/vtpmmgr/vtpm_disk.h | 233 ++++++ stubdom/vtpmmgr/vtpm_manager.h | 391 ++++++++++- stubdom/vtpmmgr/vtpm_storage.c | 794 --------------------- stubdom/vtpmmgr/vtpm_storage.h | 68 -- stubdom/vtpmmgr/vtpmmgr.h | 12 +- 33 files changed, 5639 insertions(+), 2356 deletions(-) diff --git a/docs/misc/vtpm-platforms.txt b/docs/misc/vtpm-platforms.txt new file mode 100644 index 0000000..fe35fb6 --- /dev/null +++ b/docs/misc/vtpm-platforms.txt @@ -0,0 +1,127 @@ +Author: Daniel De Graaf + +================================================================================ +Overview +================================================================================ + +This document describes example platforms which use virtual TPMs to provide +security properties for guests running on the platforms. There are several +tradeoffs between flexibility and trust which must be considered when +implementing a platform containing vTPMs. + +================================================================================ +Example 1: Trusted Domain 0 +================================================================================ + +This is the simplest example and provides maximal flexibility for testing the +vTPM Manager and vTPMs. The vtpmmgr, vtpm, and guest domains are created using +xl from the command line on domain 0. + +Provisioning on domain 0: +# dd if=/dev/zero of=/images/vtpmmgr-stubdom.img bs=2M count=1 +# dd if=/dev/zero of=/images/vtpm-guest1.img bs=2M count=1 +# dd if=/dev/zero of=/images/vtpm-guest2.img bs=2M count=1 + +The vtpmmgr configuration file (vtpmmgr.cfg): + +name="vtpmmgr" +kernel="/usr/lib/xen/boot/vtpmmgr-stubdom.gz" +extra="tpmlocality=2" +memory=8 +disk=["file:/images/vtpmmgr-stubdom.img,hda,w"] +iomem=["fed42,1"] + +The vtpm configuration files (vtpm-guest1.cfg, vtpm-guest2.cfg): + +name="vtpm-guest1" +kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" +extra="loglevel=debug" +memory=8 +disk=["file:/images/vtpm-guest1.img,hda,w"] +vtpm=["backend=vtpmmgr,uuid=ac0a5b9e-cbe2-4c07-b43b-1d69e46fb839"] + +name="vtpm-guest2" +kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" +extra="loglevel=debug" +memory=8 +disk=["file:/images/vtpm-guest2.img,hda,w"] +vtpm=["backend=vtpmmgr,uuid=6c3ff5f1-8d58-4fed-b00d-a5ea9a817f7f"] + +The guest configuration files (guest1.cfg, guest2.cfg): + +name="guest1" +kernel="/usr/lib/xen/boot/pv-grub-x86_64.gz" +memory=1024 +disk=["file:/images/guest1.img,xvda,w"] +vif=['mac=00:01:02:03:04:05,bridge=br0'] +vtpm=["backend=vtpm-guest1"] + +name="guest2" +kernel="/usr/lib/xen/boot/pv-grub-x86_64.gz" +memory=1024 +disk=["file:/images/guest2.img,xvda,w"] +vif=['mac=00:01:02:03:04:06,bridge=br0'] +vtpm=["backend=vtpm-guest2"] + +Starting domains: + +# xl create vtpmmgr.cfg +# xl create vtpm-guest1.cfg +# xl create guest1.cfg + +================================================================================ +Example 2: Domain Builder with Static vTPMs +================================================================================ + +This example uses the domain builder to construct a TPM Manager and vTPM which +do not require trusting the hardware domain with the vTPM's secrets. However, +it is not possible to construct additional vTPMs after the system is booted, and +the guests with access to vTPMs may not be rebooted without rebooting the entire +platform. + +The domain builder (dom0) constructs: + dom1 - xenstore system_u:system_r:xenstore_t + dom2 - hardware system_u:system_r:hwdom_t + dom3 - vtpmmgr system_u:system_r:vtpmmgr_t + dom4 - vtpm-hw system_u:system_r:vtpm_t + dom5 - vtpm-g1 guest1_u:vm_r:vtpm_t + dom6 - vtpm-g2 guest2_u:vm_r:vtpm_t + dom7 - guest1 guest1_u:vm_r:guest_t + dom8 - guest2 guest2_u:vm_r:guest_t + +It unpauses dom1 and dom2 after setting up Xenstore. The hardware domain is not +permitted access to IO memory at 0xfed42; this IO memory is accessible to the +vtpmmgr domain. The two guest domains may be instantiated using pv-grub or +using the same kernel as the hardware domain to conserve space in the domain +builder's initrd. + +Once the hardware domain boots, it runs: + +# xl block-attach vtpmmgr 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpmmgr' +# xl block-attach vtpm-hw 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-hw' +# xl block-attach vtpm-g1 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-g1' +# xl block-attach vtpm-g2 'backendtype=phy,backend=hardware,vdev=hda,access=w,target=/dev/lvm/vtpm-g2' +# xl block-attach guest1 'backendtype=phy,backend=hardware,vdev=xvda,access=w,target=/dev/lvm/guest1' +# xl block-attach guest2 'backendtype=phy,backend=hardware,vdev=xvda,access=w,target=/dev/lvm/guest2' +# xl vtpm-attach vtpm-hw uuid=062b6416-ed46-492a-9e65-a2f92dc07f7f backend=vtpmmgr +# xl vtpm-attach vtpm-g1 uuid=e9aa9d0f-ece5-4b84-b129-93004ba61a5f backend=vtpmmgr +# xl vtpm-attach vtpm-g2 uuid=3fb2caf0-d305-4516-96c7-420618d98efb backend=vtpmmgr +# xl vtpm-attach hardware uuid=062b6416-ed46-492a-9e65-a2f92dc07f7f backend=vtpm-hw +# xl vtpm-attach guest1 uuid=e9aa9d0f-ece5-4b84-b129-93004ba61a5f backend=vtpm-g1 +# xl vtpm-attach guest2 uuid=3fb2caf0-d305-4516-96c7-420618d98efb backend=vtpm-g2 + +Once these commands are complete, the domains are unpaused and may boot. The XSM +policy must be configured to not allow any of the domain types named above to be +created by any domain except the domain builder; guests created by the hardware +domain or one of the primary guests acting as a control domain must have a +different type. The type vtpmmgr_t may only map grants from vtpm_t; vtpm_t may +only map grants from a domain of type guest_t or hwdom_t with the same user +field. + +This example may be extended to allow dynamic creation of domains by using a +domain builder that accepts build requests. A single build request would create +a pair of domains using an unused XSM user field: a vTPM and a pv-grub domain +which requires the presence of a vTPM. To bind the configuration of the guest +to the vTPM, the guest may use full-disk encryption which can be unlocked using +an unseal operation; using the wrong vTPM will then yield a non-functioning +guest. diff --git a/docs/misc/vtpm.txt b/docs/misc/vtpm.txt index d20b424..1887d40 100644 --- a/docs/misc/vtpm.txt +++ b/docs/misc/vtpm.txt @@ -22,8 +22,8 @@ major component of vTPM is implemented as a separate domain, providing secure separation guaranteed by the hypervisor. The vTPM domains are implemented in mini-os to reduce memory and processor overhead. -This mini-os vTPM subsystem was built on top of the previous vTPM -work done by IBM and Intel corporation. +This mini-os vTPM subsystem was built on top of the previous vTPM work done by +IBM and Intel corporation. ------------------------------ DESIGN OVERVIEW @@ -106,16 +106,15 @@ INSTALLATION Prerequisites: -------------- -You must have an x86 machine with a TPM on the motherboard. -The only software requirement to compiling vTPM is cmake. -You must use libxl to manage domains with vTPMs. 'xm' is -deprecated and does not support vTPM. +You must have an x86 machine with a TPM on the motherboard. The only extra +software requirement for compiling vTPM is cmake. You must use libxl to manage +domains with vTPMs; 'xm' is deprecated and does not support vTPMs. -Compiling the XEN tree: +Compiling the Xen tree: ----------------------- -Compile and install the XEN tree as usual. Be sure to build and install -the stubdom tree. +Compile and install the Xen tree as usual; be sure that the vTPM domains are +enabled when you run configure. Compiling the LINUX dom0 kernel: -------------------------------- @@ -127,16 +126,15 @@ blacklisting the module. If dom0 needs a TPM but does not need to use it during the boot process (i.e. it is not using IMA), a virtual TPM can be attached to dom0 after the system is booted. -Because the TPM manager does not yet accept requests for deep quotes, if a quote -or other request needs to be fulfilled by the physical TPM, dom0 will need to -access the physical TPM. In order to prevent interference, the TPM Manager and -dom0 should use different values for the TPM's locality; since Linux always uses -locality 0, using locality 2 for the TPM Manager is recommended. If both Linux -and the TPM Manager attempt to access the TPM at the same time, the TPM device -will return a busy status; some applications will consider this a fatal error -instead of retrying the command at a later time. If a vTPM gets an error when -loading its key, it will currently generate a fresh vTPM image (with a new EK, -SRK, and blank NVRAM). +Access to the physical TPM may be required in order to manage the NVRAM or to +perform other advanced operations where the vTPM is insufficient. In order to +prevent interference, the TPM Manager and dom0 should use different values for +the TPM's locality; since Linux always uses locality 0, using locality 2 for the +TPM Manager is recommended. If both Linux and the TPM Manager attempt to access +the TPM at the same time, the TPM device will return a busy status; some +applications will consider this a fatal error instead of retrying the command at +a later time. If a vTPM gets an error when loading its key, it will currently +generate a fresh vTPM image (with a new EK, SRK, and blank NVRAM). Compiling the LINUX domU kernel: @@ -156,130 +154,100 @@ VTPM MANAGER SETUP Manager disk image setup: ------------------------- -The vTPM Manager requires a disk image to store its -encrypted data. The image does not require a filesystem -and can live anywhere on the host disk. The image does not need -to be large. 8 to 16 Mb should be sufficient. - -# dd if=/dev/zero of=/var/vtpmmgr-stubdom.img bs=16M count=1 +The vTPM Manager requires a disk image to store its encrypted data. The image +does not require a filesystem and can live anywhere on the host disk. The image +is not large; the Xen 4.5 vtpmmgr is limited to using the first 2MB of the image +but can support more than 20,000 vTPMs. Manager config file: -------------------- -The vTPM Manager domain (vtpmmgr-stubdom) must be started like -any other Xen virtual machine and requires a config file. -The manager requires a disk image for storage and permission -to access the hardware memory pages for the TPM. An -example configuration looks like the following. - -kernel="/usr/lib/xen/boot/vtpmmgr-stubdom.gz" -memory=16 -disk=["file:/var/vtpmmgr-stubdom.img,hda,w"] -name="vtpmmgr" -iomem=["fed40,5"] - -The iomem line tells xl to allow access to all of the TPM IO memory -pages, which are 5 pages (one per locality) that start at 0xfed40000. By -default, the TPM manager uses locality 0 (so only the page at 0xfed40 is -needed); this can be changed on the domain's command line. +The vTPM Manager domain (vtpmmgr-stubdom) must be started like any other Xen +virtual machine and requires a config file. The manager requires a disk image +for storage and permission to access the hardware memory pages for the TPM. The +disk must be presented as "hda", and the TPM memory pages are passed using the +iomem configuration parameter. The TPM TIS uses 5 pages of IO memory (one per +locality) that start at physical address 0xfed40000. By default, the TPM manager +uses locality 0 (so only the page at 0xfed40 is needed); this can be changed on +the domain's command line. For full functionality in deep quotes, using +locality 2 is required to manipulate PCR 20-22. Starting and stopping the manager: ---------------------------------- -The vTPM manager should be started at boot, you may wish to -create an init script to do this. - -# xl create -c vtpmmgr-stubdom.cfg +The vTPM manager should be started at boot; you may wish to create an init +script to do this. If a domain builder is used, the TPM Manager should be +started by the domain builder to minimize the trusted computing base for the +vTPM manager's secrets. Once initialization is complete you should see the following: INFO[VTPM]: Waiting for commands from vTPM's: -To shutdown the manager you must destroy it. To avoid data corruption, -only destroy the manager when you see the above "Waiting for commands" -message. This ensures the disk is in a consistent state. - -# xl destroy vtpmmgr-stubdom +The TPM Manager does not respond to shutdown requests; use the destroy command +to shut it down. ------------------------------ VTPM AND LINUX PVM SETUP ------------------------------ -In the following examples we will assume we have Linux -guest named "domu" with its associated configuration -located at /home/user/domu. It's vtpm will be named -domu-vtpm. - vTPM disk image setup: ---------------------- -The vTPM requires a disk image to store its persistent -data. The image does not require a filesystem. The image -does not need to be large. 8 Mb should be sufficient. - -# dd if=/dev/zero of=/home/user/domu/vtpm.img bs=8M count=1 +The vTPM requires a disk image to store its persistent data (RSA keys, NVRAM, +etc). The image does not require a filesystem. The image does not need to be +large; 2 Mb should be sufficient. vTPM config file: ----------------- -The vTPM domain requires a configuration file like -any other domain. The vTPM requires a disk image for -storage and a TPM frontend driver to communicate -with the manager. An example configuration is given: - -kernel="/usr/lib/xen/boot/vtpm-stubdom.gz" -memory=8 -disk=["file:/home/user/domu/vtpm.img,hda,w"] -name="domu-vtpm" -vtpm=["backend=vtpmmgr,uuid=ac0a5b9e-cbe2-4c07-b43b-1d69e46fb839"] +The vTPM domain requires a configuration file like any other domain. The vTPM +requires a disk image for storage and a TPM frontend driver to communicate with +the manager. You are required to generate a uuid for this vtpm, which is +specified on the "vtpm=" line that describes its connection to the vTPM Manager. +The uuidgen application may be used to generate a uuid, or one from the output +of the "manage-vtpmmgr.pl vtpm-add" command may be used to create a vTPM +belonging to a specific group. -The vtpm= line sets up the tpm frontend driver. The backend must set -to vtpmmgr. You are required to generate a uuid for this vtpm. -You can use the uuidgen unix program or some other method to create a -uuid. The uuid uniquely identifies this vtpm to manager. - -If you wish to clear the vTPM data you can either recreate the -disk image or change the uuid. +If you wish to clear the vTPM data you can either recreate the disk image or +change the uuid. Linux Guest config file: ------------------------ -The Linux guest config file needs to be modified to include -the Linux tpmfront driver. Add the following line: +The Linux guest config file needs to be modified to include the Linux tpmfront +driver. Add the following line: vtpm=["backend=domu-vtpm"] Currently only Linux guests are supported (PV or HVM with PV drivers). -Launching and shut down: ------------------------- - -To launch a Linux guest with a vTPM we first have to start the vTPM domain. - -# xl create -c /home/user/domu/vtpm.cfg +While attaching a vTPM after a guest is booted (using xl vtpm-attach) is +supported, the attached vTPM will not have a record of the boot of the attached +guest. Furthermore, if the vTPM has been freshly created, a malicious guest +could then extend any values into PCRs, potentially forging its boot +configuration. Attaching a vTPM to a running domain should only be used for +trusted domains or when measurements have already been sent to the vTPM from +another source. -After initialization is complete, you should see the following: -Info: Waiting for frontend domain to connect.. +Using the vTPM in the guest: +---------------------------- -Next, launch the Linux guest - -# xl create -c /home/user/domu/domu.cfg - -If xen-tpmfront was compiled as a module, be sure to load it -in the guest. +If xen-tpmfront was compiled as a module, it must be loaded it in the guest. # modprobe xen-tpmfront -After the Linux domain boots and the xen-tpmfront driver is loaded, -you should see the following on the vtpm console: +After the Linux domain boots and the xen-tpmfront driver is loaded, you should +see the following on the vtpm console: Info: VTPM attached to Frontend X/Y -If you have trousers and tpm_tools installed on the guest, you can test the -vtpm. +You can quickly test the vTPM by using the sysfs interface: -On guest: -# tcsd (if tcsd is not running already) -# tpm_version +# cat /sys/devices/vtpm-0/pubek +# cat /sys/devices/vtpm-0/pcrs + +If you have trousers and tpm_tools installed on the guest, the tpm_version +command should return the following: The version command should return the following: TPM 1.2 Version Info: @@ -290,12 +258,12 @@ The version command should return the following: TPM Version: 01010000 Manufacturer Info: 4554485a -You should also see the command being sent to the vtpm console as well -as the vtpm saving its state. You should see the vtpm key being -encrypted and stored on the vtpmmgr console. +You should also see the command being sent to the vtpm console as well as the +vtpm saving its state. You should see the vtpm key being encrypted and stored on +the vtpmmgr console. -You may wish to write a script to start your vtpm and guest together and -to destroy the vtpm when the guest shuts down. +You may wish to write a script to start your vtpm and guest together and to +destroy the vtpm when the guest shuts down. ------------------------------ INTEGRATION WITH PV-GRUB @@ -319,10 +287,69 @@ way can attest to its early boot state. MORE INFORMATION ------------------------------ -See stubdom/vtpmmgr/README for more details about how -the manager domain works, how to use it, and its command line -parameters. +See vtpmmgr.txt for more details about how the manager domain works, how to use +it, and its command line parameters. + +------------------------------ +VTPM DOMAIN OPERATION +------------------------------ + +The vtpm-stubdom is a mini-OS domain that emulates a TPM for the guest OS to +use. It is a small wrapper around the Berlios TPM emulator version 0.7.4. +Commands are passed from the linux guest via the mini-os TPM backend driver. +vTPM data is encrypted and stored via a disk image provided to the virtual +machine. The key used to encrypt the data along with a hash of the vTPM's data +is sent to the vTPM manager for secure storage and later retrieval. The vTPM +domain communicates with the manager using a mini-os tpm front/back device pair. + +------------------------------------ +VTPM DOMAIN COMMAND LINE ARGUMENTS +------------------------------------ + +Command line arguments are passed to the domain via the 'extra' parameter in the +VM config file. Each parameter is separated by white space. For example: + +extra="foo=bar baz" + +List of Arguments: +------------------ + +loglevel=: Controls the amount of logging printed to the console. + The possible values for are: + error + info (default) + debug -See stubdom/vtpm/README for more specifics about how vtpm-stubdom -operates and the command line options it accepts. +clear: Start the Berlios emulator in "clear" mode. (default) + +save: Start the Berlios emulator in "save" mode. + +deactivated: Start the Berlios emulator in "deactivated" mode. + See the Berlios TPM emulator documentation for details + about the startup mode. For all normal use, always use clear + which is the default. You should not need to specify any of these. + +maintcmds=<1|0>: Enable to disable the TPM maintenance commands. + These commands are used by tpm manufacturers and thus + open a security hole. They are disabled by default. + +hwinitpcr=: Initialize the virtual Platform Configuration Registers + (PCRs) with PCR values from the hardware TPM. Each pcr specified by + will be initialized with the value of that same PCR in TPM + once at startup. By default all PCRs are zero initialized. + Value values of are: + all: copy all pcrs + none: copy no pcrs (default) + : copy pcr n + : copy pcrs x to y (inclusive) + + These can also be combined by comma separation, for example: + hwinitpcrs=5,12-16 + will copy pcrs 5, 12, 13, 14, 15, and 16. + +------------------------------ +REFERENCES +------------------------------ +Berlios TPM Emulator: +http://tpm-emulator.berlios.de/ diff --git a/docs/misc/vtpmmgr.txt b/docs/misc/vtpmmgr.txt new file mode 100644 index 0000000..fe3d8a6 --- /dev/null +++ b/docs/misc/vtpmmgr.txt @@ -0,0 +1,163 @@ +Author: Daniel De Graaf + +This document describes the operation and command line interface of +vtpmmgr-stubdom. See docs/misc/vtpm.txt for details on the vTPM subsystem as a +whole. + +================================================================================ +Overview +================================================================================ + +The TPM Manager has three primary functions: + +1. Securely store the encryption keys for vTPMs +2. Provide a single controlled path of access to the physical TPM +3. Provide evidence (via TPM Quotes) of the current configuration + +When combined with a platform that provides a trusted method for creating +domains, the TPM Manager provides assurance that the private keys in a vTPM are +only available in specific trusted configurations. + +The manager accepts commands from the vtpm-stubdom domains via the mini-os TPM +backend driver. The vTPM manager communicates directly with hardware TPM using +the mini-os tpm_tis driver. + +================================================================================ +Boot Configurations and TPM Groups +================================================================================ + +The TPM Manager's data is secured by using the physical TPM's seal operation, +which allows data to be bound to specific PCRs. These PCRs are populated in the +physical TPM during the boot process, either by the firmware/BIOS or by a +dynamic launch environment such as TBOOT. In order to provide assurance of the +system's security, the PCRs used to seal the TPM manager's data must contain +measurements for domains used to bootstrap the TPM Manager and vTPMs. + +Because these measurements are based on hashes, they will change any time that +any component of the system is upgraded. Since it is not possible to construct a +list of all possible future good measurements, the job of approving +configurations is delegated to a third party, referred to here as the system +approval agent (SAA). The SAA is identified by its public (RSA) signature key, +which is used to sign lists of valid configurations. A single TPM manager can +support multiple SAAs via the use of vTPM groups. Each group is associated with +a single SAA; this allows the creation of a multi-tenant environment where +tenants may not all choose to trust the same SAA. + +Each vTPM is bound to a vTPM group at the time of its creation. Each vTPM group +has its own AIK in the physical TPM for quotes of the hardware TPM state; when +used with a conforming Privacy CA, this allows each group on the system to form +the basis of a distinct identity. + +================================================================================ +Initial Provisioning +================================================================================ + +When the TPM Manager first boots up, it will create a stub vTPM group along with +entries for any vTPMs that communicate with it. This stub group must be +provisioned with an SAA and a boot configuration in order to survive a reboot. + +When a vTPM is connected to the TPM Manager using a UUID that is not recognized, +a slot will be created in group 0 for it. In the future, this auto-creation may +be restricted to specific UUIDs (such as the all-zero UUID) to enforce the use +of the TPM manager as the generator of the UUID. The first vTPM to be connected +is given administrative privileges for the TPM Manager, and should be attached +to dom0 or a control domain in order to send provisioning commands. + +Provisioning a vTPM group for the system requires the public key of the SAA and +privacy CA data used to certify the AIK (see the TPM spec for details). Once the +group is created, a signed list of boot measurements can be installed. The +initial group controls the ability to boot the system as a whole, and cannot be +deleted once provisioned. + +================================================================================ +Command Line Arguments +================================================================================ + +Command line arguments are passed to the domain via the 'extra' parameter in the +VM config file. Each parameter is separated by white space. For example: + +extra="foo=bar baz" + +Valid arguments: + +owner_auth= +srk_auth= + Set the owner and SRK authdata for the TPM. If not specified, the + default is 160 zero bits (the well-known auth value). Valid values of + are: + well-known Use the well known auth (default) + hash: Use the given 40-character ASCII hex string + text: Use sha1 hash of . + +tpmdriver= + Choose the driver used for communication with the hardware TPM. Values + other than tpm_tis should only be used for testing. + + The possible values of are: + tpm_tis Direct communication with a hardware TPM 1.2. The + domain must have access to TPM IO memory. (default) + tpmfront Use the Xen tpmfront interface to talk to another + domain which provides access to the TPM. + +The following options only apply to the tpm_tis driver: + +tpmiomem=: The base address of the hardware memory pages of the TPM. + The default is 0xfed40000, as defined by the TCG's PC Client spec. + +tpmirq=: The irq of the hardware TPM if using interrupts. A value of + "probe" can be set to probe for the irq. A value of 0 disables + interrupts and uses polling (default 0). + +tpmlocality=: Attempt to use locality of the hardware TPM. + For full functionality of the TPM Manager, this should be set to "2". + +================================================================================ +Platform Security Assumptions +================================================================================ + +While the TPM Manager has the ability to check the hash of the vTPM requesting a +key, there is currently no trusted method to inform the TPM Manager of the hash +of each new domain. Because of this, the TPM Manager trusts the UUID key in +Xenstore to identify a vTPM in a trusted manner. The XSM policy may be used to +strengthen this assumption if the creation of vTPM-labeled domains is more +constrained (for example, only permitted to a domain builder service): the only +grants mapped by the TPM Manager should belong to vTPM domains, so restricting +the ability to map other domain's granted pages will prevent other domains from +directly requesting keys from the TPM Manager. + +A domain with direct access to the hardware TPM will be able to decrypt the TPM +Manager's disk image if the haredware TPM's PCR values are in a permitted +configuration. To protect the TPM Manager's data, the list of permitted +configurations should be chosen to include PCRs that measure the hypervisor, +domain 0, the TPM Manager, and other critical configuration such as the XSM +policy. If the TPM Manager is configured to use locality 2 as recommended, it +is safe to permit the hardware domain to access locality 0 (the default in +Linux), although concurrent use of the TPM should be avoided as it can result in +unexpected busy errors from the TPM driver. The ability to access locality 2 of +the TPM should be enforced using IO memory labeling in the XSM policy; the +physical address 0xFED42xxx is always locality 2 for TPMs using the TIS driver. + +================================================================================ +Appendix: unsecured migration process for vtpmmgr domain upgrade +================================================================================ + +There is no direct upgrade supported from previous versions of the vtpmmgr +domain due to changes in the on-disk format and the method used to seal data. +If a vTPM domain supports migration, this feature should be used to migrate the +vTPM's data; however, the vTPM packaged with Xen does not yet support migration. + +If adding migration support to the vTPM is not desired, a simpler migration +domain usable only for local migration can be constructed. The migration process +would look like the following: + +1. Start the old vtpmmgr +2. Start the vTPM migration domain +3. Attach the vTPM migration domain's vtpm/0 device to the old vtpmmgr +4. Migration domain executes vtpmmgr_LoadHashKey on vtpm/0 +5. Start the new vtpmmgr, possibly shutting down the old one first +6. Attach the vTPM migration domain's vtpm/1 device to the new vtpmmgr +7. Migration domain executes vtpmmgr_SaveHashKey on vtpm/1 + +This requires the migration domain must be added to the list of valid vTPM +kernel hashes. Because the TPM Manager currently does not verify vTPM kernel +hashes, the control domain can initiate this operation at any time. diff --git a/stubdom/vtpm/README b/stubdom/vtpm/README deleted file mode 100644 index 11bdacb..0000000 --- a/stubdom/vtpm/README +++ /dev/null @@ -1,75 +0,0 @@ -Copyright (c) 2010-2012 United States Government, as represented by -the Secretary of Defense. All rights reserved. -November 12 2012 -Authors: Matthew Fioravante (JHUAPL), - -This document describes the operation and command line interface -of vtpm-stubdom. See docs/misc/vtpm.txt for details on the -vTPM subsystem as a whole. - - ------------------------------- -OPERATION ------------------------------- - -The vtpm-stubdom is a mini-OS domain that emulates a TPM for the guest OS to -use. It is a small wrapper around the Berlios TPM emulator -version 0.7.4. Commands are passed from the linux guest via the -mini-os TPM backend driver. vTPM data is encrypted and stored via a disk image -provided to the virtual machine. The key used to encrypt the data along -with a hash of the vTPM's data is sent to the vTPM manager for secure storage -and later retrieval. The vTPM domain communicates with the manager using a -mini-os tpm front/back device pair. - ------------------------------- -COMMAND LINE ARGUMENTS ------------------------------- - -Command line arguments are passed to the domain via the 'extra' -parameter in the VM config file. Each parameter is separated -by white space. For example: - -extra="foo=bar baz" - -List of Arguments: ------------------- - -loglevel=: Controls the amount of logging printed to the console. - The possible values for are: - error - info (default) - debug - -clear: Start the Berlios emulator in "clear" mode. (default) - -save: Start the Berlios emulator in "save" mode. - -deactivated: Start the Berlios emulator in "deactivated" mode. - See the Berlios TPM emulator documentation for details - about the startup mode. For all normal use, always use clear - which is the default. You should not need to specify any of these. - -maintcmds=<1|0>: Enable to disable the TPM maintenance commands. - These commands are used by tpm manufacturers and thus - open a security hole. They are disabled by default. - -hwinitpcr=: Initialize the virtual Platform Configuration Registers - (PCRs) with PCR values from the hardware TPM. Each pcr specified by - will be initialized with the value of that same PCR in TPM - once at startup. By default all PCRs are zero initialized. - Value values of are: - all: copy all pcrs - none: copy no pcrs (default) - : copy pcr n - : copy pcrs x to y (inclusive) - - These can also be combined by comma separation, for example: - hwinitpcrs=5,12-16 - will copy pcrs 5, 12, 13, 14, 15, and 16. - ------------------------------- -REFERENCES ------------------------------- - -Berlios TPM Emulator: -http://tpm-emulator.berlios.de/ diff --git a/stubdom/vtpmmgr/Makefile b/stubdom/vtpmmgr/Makefile index af13b39..a39a22c 100644 --- a/stubdom/vtpmmgr/Makefile +++ b/stubdom/vtpmmgr/Makefile @@ -12,7 +12,9 @@ XEN_ROOT=../.. TARGET=vtpmmgr.a -OBJS=vtpmmgr.o vtpm_cmd_handler.o vtpm_storage.o init.o tpmrsa.o tpm.o log.o +OBJS=vtpmmgr.o vtpm_cmd_handler.o init.o tpmrsa.o tpm.o log.o +OBJS += vtpm_disk.o disk_tpm.o disk_io.o disk_crypto.o disk_read.o disk_write.o +OBJS += mgmt_authority.o CFLAGS+=-Werror -Iutil -Icrypto -Itcs CFLAGS+=-Wno-declaration-after-statement -Wno-unused-label diff --git a/stubdom/vtpmmgr/README b/stubdom/vtpmmgr/README deleted file mode 100644 index a70c1cc..0000000 --- a/stubdom/vtpmmgr/README +++ /dev/null @@ -1,75 +0,0 @@ -Copyright (c) 2010-2012 United States Government, as represented by -the Secretary of Defense. All rights reserved. -November 12 2012 -Authors: Matthew Fioravante (JHUAPL), - -This document describes the operation and command line interface -of vtpmmgr-stubdom. See docs/misc/vtpm.txt for details on the -vTPM subsystem as a whole. - - ------------------------------- -OPERATION ------------------------------- - -The vtpmmgr-stubdom implements a vTPM manager who has two major functions: - - - Securely store encryption keys for each of the vTPMS - - Regulate access to the hardware TPM for the entire system - -The manager accepts commands from the vtpm-stubdom domains via the mini-os -TPM backend driver. The vTPM manager communicates directly with hardware TPM -using the mini-os tpm_tis driver. - - -When the manager starts for the first time it will check if the TPM -has an owner. If the TPM is unowned, it will attempt to take ownership -with the supplied owner_auth (see below) and then create a TPM -storage key which will be used to secure vTPM key data. Currently the -manager only binds vTPM keys to the disk. In the future support -for sealing to PCRs should be added. - ------------------------------- -COMMAND LINE ARGUMENTS ------------------------------- - -Command line arguments are passed to the domain via the 'extra' -parameter in the VM config file. Each parameter is separated -by white space. For example: - -extra="foo=bar baz" - -List of Arguments: ------------------- - -owner_auth=: Set the owner auth of the TPM. The default - is the well known owner auth of all ones. - -srk_auth=: Set the SRK auth for the TPM. The default is - the well known srk auth of all zeroes. - The possible values of are: - well-known: Use the well known auth (default) - random: Randomly generate an auth - hash: : Use the given 40 character ASCII hex string - text: : Use sha1 hash of . - -tpmdriver=: Which driver to use to talk to the hardware TPM. - Don't change this unless you know what you're doing. - The possible values of are: - tpm_tis: Use the tpm_tis driver to talk directly to the TPM. - The domain must have access to TPM IO memory. (default) - tpmfront: Use tpmfront to talk to the TPM. The domain must have - a tpmfront device setup to talk to another domain - which provides access to the TPM. - -The following options only apply to the tpm_tis driver: - -tpmiomem=: The base address of the hardware memory pages of the - TPM (default 0xfed40000). - -tpmirq=: The irq of the hardware TPM if using interrupts. A value of - "probe" can be set to probe for the irq. A value of 0 - disabled interrupts and uses polling (default 0). - -tpmlocality=: Attempt to use locality of the hardware TPM. - (default 0) diff --git a/stubdom/vtpmmgr/disk_crypto.c b/stubdom/vtpmmgr/disk_crypto.c new file mode 100644 index 0000000..18718d0 --- /dev/null +++ b/stubdom/vtpmmgr/disk_crypto.c @@ -0,0 +1,231 @@ +#include +#include +#include +#include +#include + +#include "log.h" +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_io.h" +#include "disk_crypto.h" + +// XXX defining this stubs out all disk encryption for easier debugging +#undef DISK_IS_PLAINTEXT + +void do_random(void *buf, size_t size) +{ + int rc = ctr_drbg_random(&vtpm_globals.ctr_drbg, buf, size); + if (rc) abort(); +} + +void aes_setup(aes_context *ctx, const struct key128 *key) +{ + aes_setkey_enc(ctx, (void*)key, 128); +} + +static void aes_encrypt_ecb(void *target, const void *src, const aes_context *key_e) +{ + aes_crypt_ecb((void*)key_e, AES_ENCRYPT, src, target); +} + +void aes_encrypt_one(void *target, const void *src, const struct key128 *key) +{ + aes_context ctx; + aes_setkey_enc(&ctx, (void*)key, 128); + aes_crypt_ecb(&ctx, AES_ENCRYPT, src, target); +} + +void aes_decrypt_one(void *target, const void *src, const struct key128 *key) +{ + aes_context ctx; + aes_setkey_dec(&ctx, (void*)key, 128); + aes_crypt_ecb(&ctx, AES_DECRYPT, src, target); +} + +static void aes_ctr_one(uint64_t out[2], uint64_t ctr[2], const aes_context *key_e) +{ +#ifdef DISK_IS_PLAINTEXT + memset(out, 0, 16); +#else + aes_encrypt_ecb(out, ctr, key_e); +#endif + ctr[1]++; +} + +void aes_encrypt_ctr(void *target, size_t target_size, const void *srcv, size_t pt_size, const aes_context *key_e) +{ + uint64_t ctr[2]; + uint64_t tmp[2]; + uint64_t *dst = target; + const uint64_t *src = srcv; + + do_random(ctr, sizeof(ctr)); + dst[0] = ctr[0]; + dst[1] = ctr[1]; + dst += 2; + target_size -= 16; + + if (pt_size > target_size) + abort(); // invalid argument: target too small for plaintext + + while (pt_size >= 16) { + aes_ctr_one(tmp, ctr, key_e); + + dst[0] = tmp[0] ^ src[0]; + dst[1] = tmp[1] ^ src[1]; + + dst += 2; + src += 2; + pt_size -= 16; + target_size -= 16; + } + if (pt_size) { + uint64_t stmp[2]; + uint64_t dtmp[2]; + memset(stmp, 0, 16); + memcpy(stmp, src, pt_size); + + aes_ctr_one(tmp, ctr, key_e); + + dtmp[0] = tmp[0] ^ stmp[0]; + dtmp[1] = tmp[1] ^ stmp[1]; + if (target_size < 16) { + memcpy(dst, dtmp, target_size); + return; + } else { + memcpy(dst, dtmp, 16); + target_size -= 16; + } + } + while (target_size >= 16) { + aes_ctr_one(dst, ctr, key_e); + + dst += 2; + target_size -= 16; + } + if (target_size) + abort(); // invalid argument: overlarge target size is not a full block +} + +void aes_decrypt_ctr(void *target, size_t pt_size, const void *srcv, size_t src_size, const aes_context *key_e) +{ + uint64_t ctr[2]; + uint64_t tmp[2]; + uint64_t *dst = target; + const uint64_t *src = srcv; + + ctr[0] = src[0]; + ctr[1] = src[1]; + src += 2; + src_size -= 16; + + if (pt_size > src_size) + abort(); // invalid argument: source too small for plaintext + // we discard src_size now + + while (pt_size >= 16) { + aes_ctr_one(tmp, ctr, key_e); + dst[0] = tmp[0] ^ src[0]; + dst[1] = tmp[1] ^ src[1]; + + dst += 2; + src += 2; + pt_size -= 16; + } + if (pt_size) { + uint64_t stmp[2]; + uint64_t dtmp[2]; + memset(stmp, 0, 16); + memcpy(stmp, src, pt_size); + + aes_ctr_one(tmp, ctr, key_e); + + dtmp[0] = tmp[0] ^ stmp[0]; + dtmp[1] = tmp[1] ^ stmp[1]; + memcpy(dst, dtmp, pt_size); + } +} + +static void shl_128_mod_hex87(struct mac128 *dst, const struct mac128 *src) +{ + int i; + int carry = 0x87 * !!(src->bits[0] & 0x80); + for(i=0; i < 15; i++) + dst->bits[i] = (src->bits[i] << 1) | (src->bits[i+1] >> 7); + dst->bits[15] = (src->bits[15] << 1) ^ carry; +} + +static void xor128(struct mac128 *dst, const struct mac128 *s1, const struct mac128 *s2) +{ + int i; + for(i=0; i < 16; i++) + dst->bits[i] = s1->bits[i] ^ s2->bits[i]; +} + +void aes_cmac(struct mac128 *target, const void *src, size_t size, const aes_context *key) +{ + const struct mac128 *M = src; + struct mac128 x, y, L, K1, K2; + int i; + size_t bsize = (size - 1) / 16; + + memset(&x, 0, sizeof(x)); + aes_encrypt_ecb(&L, &x, key); + shl_128_mod_hex87(&K1, &L); + shl_128_mod_hex87(&K2, &K1); + + for(i=0; i < bsize; i++) { + xor128(&y, &x, &M[i]); + aes_encrypt_ecb(&x, &y, key); + } + if (size & 0xF) { + struct mac128 z; + memset(&z, 0, sizeof(z)); + memcpy(&z, M + bsize, size & 0xF); + xor128(&y, &x, &K2); + xor128(&x, &y, &z); + } else { + xor128(&y, &x, &K1); + xor128(&x, &y, M + bsize); + } + aes_encrypt_ecb(target, &x, key); +} + +static int verify_128(const void *a, const void* b) +{ + const volatile uint64_t *x = a; + const volatile uint64_t *y = b; + if ((x[0] ^ y[0]) | (x[1] ^ y[1])) + return 1; + return 0; +} + +int aes_cmac_verify(const struct mac128 *target, const void *src, size_t size, const aes_context *key) +{ + struct mac128 mac; + aes_cmac(&mac, src, size, key); + return verify_128(&mac, target); +} + +static int verify_256(const void *a, const void* b) +{ + const volatile uint64_t *x = a; + const volatile uint64_t *y = b; + if ((x[0] ^ y[0]) | (x[1] ^ y[1]) | (x[2] ^ y[2]) | (x[3] ^ y[3])) + return 1; + return 0; +} + +void sha256(struct hash256 *target, const void *src, size_t size) +{ + void* dst = target; + sha2(src, size, dst, 0); +} + +int sha256_verify(const struct hash256 *targ, const void *data, size_t size) +{ + struct hash256 hash; + sha256(&hash, data, size); + return verify_256(&hash, targ); +} diff --git a/stubdom/vtpmmgr/disk_crypto.h b/stubdom/vtpmmgr/disk_crypto.h new file mode 100644 index 0000000..faae9ab --- /dev/null +++ b/stubdom/vtpmmgr/disk_crypto.h @@ -0,0 +1,17 @@ +#ifndef __VTPMMGR_DISK_CRYPTO_H +#define __VTPMMGR_DISK_CRYPTO_H + +void do_random(void *buf, size_t size); +void aes_encrypt_one(void *target, const void *src, const struct key128 *key); +void aes_decrypt_one(void *target, const void *src, const struct key128 *key); + +void aes_setup(aes_context *ctx, const struct key128 *key); +void aes_encrypt_ctr(void *target, size_t target_size, const void *srcv, size_t src_size, const aes_context *key_e); +void aes_decrypt_ctr(void *target, size_t target_size, const void *srcv, size_t src_size, const aes_context *key_e); +void aes_cmac(struct mac128 *target, const void *src, size_t size, const aes_context *key); +int aes_cmac_verify(const struct mac128 *target, const void *src, size_t size, const aes_context *key); + +void sha256(struct hash256 *target, const void *src, size_t size); +int sha256_verify(const struct hash256 *targ, const void *data, size_t size); + +#endif diff --git a/stubdom/vtpmmgr/disk_format.h b/stubdom/vtpmmgr/disk_format.h new file mode 100644 index 0000000..bc20fbb --- /dev/null +++ b/stubdom/vtpmmgr/disk_format.h @@ -0,0 +1,193 @@ +#ifndef __VTPMMGR_DISK_FORMAT_H +#define __VTPMMGR_DISK_FORMAT_H + +static const uint8_t TPM_MGR_MAGIC[12] = { + 'T','P','M',0xfe,'M','G','R',0xdd,'D','O','M',0x00 +}; + +/** + * Sector 0 on disk: stored in plaintext + */ +struct disk_header { + char magic[12]; +#define TPM_MGR_VERSION 0 + be32_t version; +}; + +/** + * Raw contents of disk sectors that need both encryption and authentication + */ +struct disk_crypt_sector_plain { + struct mac128 mac; + union { + struct { + uint8_t iv[16]; + char data[4096-32]; + }; + uint8_t iv_data[4096-16]; + }; +}; + +/** + * Contents of the sealed blob in the root seal list + */ +struct disk_root_sealed_data { +#define DISK_ROOT_BOUND_MAGIC "Root" + char magic[4]; + uuid_t tpm_manager_uuid; + + be32_t nvram_slot; + struct tpm_authdata nvram_auth; + be32_t counter_index; + struct tpm_authdata counter_auth; + + /* encrypted (AES-ECB) with key from NVRAM */ + struct key128 tm_key; +}; + +/** + * Contents of the sealed blob in a group's seal list + */ +struct disk_group_sealed_data { +#define DISK_GROUP_BOUND_MAGIC "TGrp" + char magic[4]; + uuid_t tpm_manager_uuid; + struct tpm_authdata aik_authdata; + + struct key128 group_key; + struct key128 rollback_mac_key; +}; + +/** + * Contents of the seal_list_N sectors on disk (plaintext, linked list) + * + * The hdr field is unused except in sector 0 + */ +struct disk_seal_list { + struct disk_header hdr; + be32_t length; + sector_t next; +#define SEALS_PER_ROOT_SEAL_LIST 13 + struct disk_seal_entry entry[SEALS_PER_ROOT_SEAL_LIST]; +}; + +/** + * TODO - overflow for struct disk_group_boot_config_list + */ +struct disk_group_seal_list { + sector_t next; +#define SEALS_PER_GROUP_SEAL_LIST 13 + struct disk_seal_entry entry[SEALS_PER_GROUP_SEAL_LIST]; +}; + +/** + * Rollback detection MAC entry + */ +struct disk_rb_mac_entry { + be32_t id; + struct mac128 mac; +}; + +#define NR_ENTRIES_PER_ROOT 16 +/** + * The area of the root sector protected by rollback MACs + */ +struct disk_root_sector_mac1_area { + be64_t sequence; + be32_t tpm_counter_value; + + be32_t nr_groups; + struct hash256 group_hash[NR_ENTRIES_PER_ROOT]; +}; + +/** + * Decrypted contents of the root sector (sector 1 and 2) on disk + */ +struct disk_root_sector { + struct disk_root_sector_mac1_area v; + + sector_t group_loc[NR_ENTRIES_PER_ROOT]; + + uint8_t pad[8]; + + /* Rollback detection MACs */ + be32_t nr_rb_macs; + sector_t rb_next_loc; + /* used if rb_macs overflows */ + struct hash256 rb_next_hash; + +#define NR_RB_MACS_PER_ROOT 128 + struct disk_rb_mac_entry rb_macs[NR_RB_MACS_PER_ROOT]; +}; + +/** + * Hash tree for list expansion. Used for the list of groups in the root and for + * the list of vTPMs in a group. + */ +struct disk_itree_sector { +#define NR_ENTRIES_PER_ITREE 112 + sector_t location[NR_ENTRIES_PER_ITREE]; + /* SECTOR-HASH { */ + struct hash256 hash[NR_ENTRIES_PER_ITREE]; + /* SECTOR-HASH } */ +}; + +#define NR_ENTRIES_PER_GROUP_BASE 16 +/** + * Data that must remain constant if a group is not open + */ +struct disk_group_sector_mac3_area { + struct group_id_data id_data; /* MAC2 */ + struct group_details details; + struct disk_group_boot_config_list boot_configs; + + be32_t nr_vtpms; + struct hash256 vtpm_hash[NR_ENTRIES_PER_GROUP_BASE]; +}; + +/** + * Group metadata sector + * + * Encrypted with TM_KEY - takes 16 bytes for IV; integrity from parent. + */ +struct disk_group_sector { + /* SECTOR-HASH { */ + struct disk_group_sector_mac3_area v; + + /* MAC(MAC3, group_key) */ + struct mac128 group_mac; + /* SECTOR-HASH } */ + + sector_t vtpm_location[NR_ENTRIES_PER_GROUP_BASE]; + sector_t boot_configs_next; +}; + +/** + * Data on a vTPM which is available when its group is not open + */ +struct disk_vtpm_plain { + uuid_t uuid; + be32_t flags; +}; + +/** + * Data on a vTPM which is only available when its group is open + */ +struct disk_vtpm_secret { + uint8_t data[64]; +}; + +/** + * Contents of a vTPM data disk sector + * + * Encrypted with TM_KEY - takes 16 bytes for IV + */ +struct disk_vtpm_sector { + /* SECTOR-HASH { */ + struct disk_vtpm_plain header[VTPMS_PER_SECTOR]; + struct mac128 iv; + struct disk_vtpm_secret data[VTPMS_PER_SECTOR]; + /* SECTOR-HASH } */ +}; + +#endif diff --git a/stubdom/vtpmmgr/disk_io.c b/stubdom/vtpmmgr/disk_io.c new file mode 100644 index 0000000..02b4fdd --- /dev/null +++ b/stubdom/vtpmmgr/disk_io.c @@ -0,0 +1,125 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" + +static uint8_t disk_staging_buf[4096] __attribute__((aligned(4096))); + +static struct blkfront_dev* blkdev; +static int blkfront_fd = -1; + +int vtpm_storage_init(void) { + struct blkfront_info info; + blkdev = init_blkfront(NULL, &info); + if (blkdev == NULL) + return -1; + blkfront_fd = blkfront_open(blkdev); + if (blkfront_fd < 0) + return -1; + return 0; +} + +void* disk_read_sector(sector_t sector) +{ + uint32_t pos = be32_native(sector); + int rc; + vtpmloginfo(VTPM_LOG_VTPM, "disk_read_sector %x\n", pos); + lseek(blkfront_fd, pos * 4096, SEEK_SET); + rc = read(blkfront_fd, disk_staging_buf, 4096); + if (rc != 4096) + abort(); + return disk_staging_buf; +} + +void* disk_write_buf(void) { return disk_staging_buf; } + +void disk_write_sector(sector_t sector, void* buf, size_t siz) +{ + int rc; + uint32_t pos = be32_native(sector); + lseek(blkfront_fd, pos * 4096, SEEK_SET); + if (siz < 4096) { + if (buf != disk_staging_buf) + memcpy(disk_staging_buf, buf, siz); + memset(disk_staging_buf + siz, 0, 4096 - siz); + buf = disk_staging_buf; + } else if (siz > 4096) + abort(); + + rc = write(blkfront_fd, buf, 4096); + if (rc != 4096) + abort(); +} + +void disk_write_barrier(void) +{ + blkfront_sync(blkdev); +} + +enum inuse_value { + UNUSED, + SLOT_1, + SLOT_2, + SHARED +}; + +/* TODO make this dynamic to support using more than 2MB of disk */ +#define DISK_MAX_SECTOR 0x200 + +/* The first 4 sectors are statically allocated: + * 0 - disk header (copy 1) + * 1 - disk header (copy 2) + * 2 - root sector (copy 1) + * 3 - root sector (copy 2) + */ +#define FIRST_DYNAMIC_SECTOR 4 + +static uint8_t sector_inuse_map[DISK_MAX_SECTOR]; + +static int active_slot(const struct mem_tpm_mgr *mgr) +{ + return 1 + mgr->active_root; +} + +void disk_set_used(sector_t loc, const struct mem_tpm_mgr *mgr) +{ + uint32_t s = be32_native(loc); + if (s > DISK_MAX_SECTOR) { + printk("Attempted disk_set_used %x\n", s); + return; + } + sector_inuse_map[s] |= active_slot(mgr); +} + +void disk_flush_slot(const struct mem_tpm_mgr *mgr) +{ + int i; + for(i = FIRST_DYNAMIC_SECTOR; i < DISK_MAX_SECTOR; i++) + sector_inuse_map[i] &= ~active_slot(mgr); +} + +sector_t disk_find_free(const struct mem_tpm_mgr *mgr) +{ + int i; + for(i = FIRST_DYNAMIC_SECTOR; i < DISK_MAX_SECTOR; i++) { + if (sector_inuse_map[i]) + continue; + sector_inuse_map[i] = active_slot(mgr); + return native_be32(i); + } + // TODO more graceful error handling (in callers) + abort(); +} diff --git a/stubdom/vtpmmgr/disk_io.h b/stubdom/vtpmmgr/disk_io.h new file mode 100644 index 0000000..c0d35a5 --- /dev/null +++ b/stubdom/vtpmmgr/disk_io.h @@ -0,0 +1,25 @@ +#ifndef __VTPMMGR_DISK_IO_H +#define __VTPMMGR_DISK_IO_H + +void* disk_read_sector(sector_t sector); +void disk_write_sector(sector_t sector, void* buf, size_t siz); +void* disk_write_buf(void); +void disk_write_barrier(void); + +sector_t disk_find_free(const struct mem_tpm_mgr *mgr); +void disk_flush_slot(const struct mem_tpm_mgr *mgr); +void disk_set_used(sector_t loc, const struct mem_tpm_mgr *mgr); + +void disk_write_all(struct mem_tpm_mgr *mgr); + +static inline sector_t seal_loc(struct mem_tpm_mgr *mgr) +{ + return native_be32(mgr->active_root); +} + +static inline sector_t root_loc(struct mem_tpm_mgr *mgr) +{ + return native_be32(2 + mgr->active_root); +} + +#endif diff --git a/stubdom/vtpmmgr/disk_read.c b/stubdom/vtpmmgr/disk_read.c new file mode 100644 index 0000000..33aacdd --- /dev/null +++ b/stubdom/vtpmmgr/disk_read.c @@ -0,0 +1,606 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" +#include "disk_crypto.h" +#include "disk_format.h" + +static int disk_read_crypt_sector(void *data, size_t size, sector_t block, const struct mem_tpm_mgr *mgr) +{ + struct disk_crypt_sector_plain *sector = disk_read_sector(block); + if (!sector) + return 2; + + if (aes_cmac_verify(§or->mac, sector->data, sizeof(sector->data), &mgr->tm_key_e)) + return 2; + + aes_decrypt_ctr(data, size, sector->iv_data, sizeof(sector->iv_data), &mgr->tm_key_e); + return 0; +} + +static void group_free(struct mem_group *group) +{ + int i, j; + if (!group) + return; + if (group->data) { + for (i = 0; i < group->nr_pages; i++) { + for (j = 0; j < group->data[i].size; j++) { + free(group->data[i].vtpms[j]); + } + } + free(group->data); + } + free(group->seals); + free(group); +} + +static void mgr_free(struct mem_tpm_mgr *mgr) +{ + int i; + if (!mgr) + return; + if (mgr->groups) { + for(i=0; i < mgr->nr_groups; i++) + group_free(mgr->groups[i].v); + free(mgr->groups); + } + free(mgr); +} + +/* Open the group keys from one of the sealed strutures */ +static int find_group_key(struct mem_group *dst, + const struct disk_group_sector *group, + const struct mem_tpm_mgr *parent) +{ + int i, rc, rv = 1; + struct hash160 buf; + struct disk_group_sealed_data sealed; + + dst->nr_seals = be32_native(group->v.boot_configs.nr_cfgs); + if (dst->nr_seals > NR_SEALS_PER_GROUP) + return 3; // TODO support spill to extra pages + + dst->seals = calloc(dst->nr_seals, sizeof(dst->seals[0])); + if (!dst->seals) { + vtpmlogerror(VTPM_LOG_VTPM, "find_group_key alloc %x\n", dst->nr_seals); + return 2; + } + + for(i=0; i < dst->nr_seals; i++) { + const struct disk_seal_entry *cfg = &group->v.boot_configs.entry[i]; + dst->seals[i].pcr_selection = cfg->pcr_selection; + memcpy(&dst->seals[i].digest_release, &cfg->digest_release, 20); + + TPM_pcr_digest(&buf, cfg->pcr_selection); + if (memcmp(&buf, &cfg->digest_release, 20)) + continue; + rc = TPM_disk_unseal(&sealed, sizeof(sealed), cfg); + if (rc) + continue; + if (memcmp(&sealed.magic, DISK_GROUP_BOUND_MAGIC, 4)) + continue; + if (memcmp(sealed.tpm_manager_uuid, parent->uuid, 16)) + continue; + + memcpy(&dst->rollback_mac_key, &sealed.rollback_mac_key, 16); + memcpy(&dst->group_key, &sealed.group_key, 16); + memcpy(&dst->aik_authdata, &sealed.aik_authdata, 20); + rv = 0; + } + + // cache the list to allow writes without touching the TPM + memcpy(&dst->seal_bits, &group->v.boot_configs, sizeof(dst->seal_bits)); + dst->flags |= MEM_GROUP_FLAG_SEAL_VALID; + + return rv; +} + +static int parse_root_key(struct mem_tpm_mgr *dst, struct disk_seal_entry *src) +{ + int rc; + struct disk_root_sealed_data sealed; + + rc = TPM_disk_unseal(&sealed, sizeof(sealed), src); + if (rc) + return rc; + + if (memcmp(&sealed.magic, DISK_ROOT_BOUND_MAGIC, 4)) + return 1; + + rc = TPM_disk_nvread(&dst->nv_key, 16, sealed.nvram_slot, sealed.nvram_auth); + if (rc) + return rc; + + // TODO when an NV slot in the physical TPM is used to populate nv_key, + // that value should be used to mask the master key so that the value + // can be changed to revoke old disk state +#if 0 + aes_decrypt_one(&dst->tm_key, &sealed.tm_key, &dst->nv_key); +#else + memcpy(&dst->tm_key, &sealed.tm_key, 16); +#endif + + memcpy(dst->uuid, sealed.tpm_manager_uuid, 16); + dst->nvram_slot = sealed.nvram_slot; + memcpy(&dst->nvram_auth, &sealed.nvram_auth, sizeof(struct tpm_authdata)); + dst->counter_index = sealed.counter_index; + memcpy(&dst->counter_auth, &sealed.counter_auth, sizeof(struct tpm_authdata)); + + return 0; +} + +static struct mem_tpm_mgr *find_root_key(int active_root) +{ + sector_t seal_list = native_be32(active_root); + struct disk_seal_list *seal = disk_read_sector(seal_list); + struct hash160 buf; + int i, rc, nr; + struct mem_tpm_mgr *dst; + + if (memcmp(seal->hdr.magic, TPM_MGR_MAGIC, 12)) + return NULL; + + if (be32_native(seal->hdr.version) != TPM_MGR_VERSION) + return NULL; + + dst = calloc(1, sizeof(*dst)); + dst->active_root = active_root; + + for (nr = 0; nr < 100; nr++) { + disk_set_used(seal_list, dst); + uint32_t nr_seals = be32_native(seal->length); + if (nr_seals > SEALS_PER_ROOT_SEAL_LIST) + break; + for (i = 0; i < nr_seals; i++) { + struct disk_seal_entry *src = &seal->entry[i]; + + TPM_pcr_digest(&buf, src->pcr_selection); + if (memcmp(&buf, &src->digest_release, 20)) + continue; + + rc = parse_root_key(dst, src); + if (rc) + continue; + return dst; + } + seal_list = seal->next; + if (seal_list.value == 0) + break; + seal = disk_read_sector(seal_list); + } + mgr_free(dst); + return NULL; +} + +/* Load and verify one sector's worth of vTPMs. This loads all the vTPM entries + * and decrypts their state data into memory. + */ +static int load_verify_vtpm_page(struct mem_vtpm_page *dst, int base, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + struct disk_vtpm_sector pt; + int i, rc; + + disk_set_used(dst->disk_loc, mgr); + + rc = disk_read_crypt_sector(&pt, sizeof(pt), dst->disk_loc, mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + rc = sha256_verify(&dst->disk_hash, &pt, sizeof(pt)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + if (!group_key) + return 0; + + aes_decrypt_ctr(pt.data, sizeof(pt.data), &pt.iv, sizeof(pt.data) + 16, group_key); + + for (i = 0; i < dst->size; i++) { + struct mem_vtpm *vtpm = calloc(1, sizeof(*vtpm)); + dst->vtpms[i] = vtpm; + memcpy(vtpm->uuid, pt.header[i].uuid, 16); + memcpy(vtpm->data, pt.data[i].data, 64); + vtpm->flags = be32_native(pt.header[i].flags); + vtpm->index_in_parent = i + base; + } + return 0; +} + +static int load_verify_vtpm_pages(struct mem_group *group, int base, int size, + const struct hash256 *hash, const sector_t *loc, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + int i, rc; + struct mem_vtpm_page *page = group->data + base; + + /* base was in terms of sectors; convert to vtpms */ + base *= VTPMS_PER_SECTOR; + + for (i = 0; i < size; i++) { + page->disk_hash = hash[i]; + page->disk_loc = loc[i]; + if (group->nr_vtpms - base > VTPMS_PER_SECTOR) + page->size = VTPMS_PER_SECTOR; + else + page->size = group->nr_vtpms - base; + rc = load_verify_vtpm_page(page, base, mgr, group_key); + if (rc) + return rc; + base += VTPMS_PER_SECTOR; + } + + return 0; +} + +static int load_verify_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize, + const struct mem_tpm_mgr *mgr, const aes_context *group_key); + +static int load_verify_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize, + const struct mem_tpm_mgr *mgr, const aes_context *group_key) +{ + int i, rc, incr = 1, inuse_base = hdr->disk_nr_inuse, lsize; + + // increase tree depth until all entries fit + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + // save the list of used sectors (itree and vtpm) in the header + lsize = 1 + (nr_entries - 1) / incr; + hdr->disk_nr_inuse += lsize; + hdr->disk_inuse = realloc(hdr->disk_inuse, hdr->disk_nr_inuse * sizeof(sector_t)); + memcpy(&hdr->disk_inuse[inuse_base], loc, lsize * sizeof(sector_t)); + + // if the entries already fit, process vtpm pages + if (nr_entries <= hsize) + return load_verify_vtpm_pages(hdr->v, base, nr_entries, hash, loc, mgr, group_key); + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_set_used(loc[i], mgr); + hdr->disk_inuse[inuse_base++] = loc[i]; + + rc = disk_read_crypt_sector(&pt, sizeof(pt), loc[i], mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = sha256_verify(&hash[i], pt.hash, sizeof(pt.hash)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = load_verify_vtpm_itree(hdr, base, child_entries, pt.hash, pt.location, + NR_ENTRIES_PER_ITREE, mgr, group_key); + if (rc) + return rc; + + base += incr; + } + + return 0; +} + +/* Load and verify one group's data structure, including its vTPMs. + */ +static int load_verify_group(struct mem_group_hdr *dst, const struct mem_tpm_mgr *mgr) +{ + struct mem_group *group; + struct disk_group_sector disk; + int rc; + aes_context key_e; + aes_context *opened_key = NULL; + + disk_set_used(dst->disk_loc, mgr); + + rc = disk_read_crypt_sector(&disk, sizeof(disk), dst->disk_loc, mgr); + if (rc) { + printk("Malformed sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + rc = sha256_verify(&dst->disk_hash, &disk.v, sizeof(disk.v) + sizeof(disk.group_mac)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(dst->disk_loc)); + return rc; + } + + dst->v = group = calloc(1, sizeof(*group)); + + rc = find_group_key(group, &disk, mgr); + if (rc == 0) { + opened_key = &key_e; + /* Verify the group with the group's own key */ + aes_setup(opened_key, &group->group_key); + if (aes_cmac_verify(&disk.group_mac, &disk.v, sizeof(disk.v), opened_key)) { + printk("Group CMAC failed\n"); + return 2; + } + + memcpy(&group->id_data, &disk.v.id_data, sizeof(group->id_data)); + memcpy(&group->details, &disk.v.details, sizeof(group->details)); + } else if (rc == 1) { + // still need to walk the vtpm list + rc = 0; + } else { + printk("Group key unsealing failed\n"); + return rc; + } + + group->nr_vtpms = be32_native(disk.v.nr_vtpms); + group->nr_pages = (group->nr_vtpms + VTPMS_PER_SECTOR - 1) / VTPMS_PER_SECTOR; + + group->data = calloc(group->nr_pages, sizeof(group->data[0])); + + rc = load_verify_vtpm_itree(dst, 0, group->nr_pages, disk.v.vtpm_hash, + disk.vtpm_location, NR_ENTRIES_PER_GROUP_BASE, mgr, opened_key); + + if (!opened_key) { + /* remove the struct */ + free(group->data); + free(group->seals); + free(group); + dst->v = NULL; + } + + return rc; +} + +static int load_root_pre(struct disk_root_sector *root, struct mem_tpm_mgr *dst) +{ + int rc; + + aes_setup(&dst->tm_key_e, &dst->tm_key); + + rc = disk_read_crypt_sector(root, sizeof(*root), root_loc(dst), dst); + + if (rc) { + vtpmloginfo(VTPM_LOG_VTPM, "root cmac verify failed in slot %d\n", dst->active_root); + return 2; + } + + dst->root_seals_valid = 1 + dst->active_root; + dst->sequence = be64_native(root->v.sequence); + + return 0; +} + +static int load_verify_group_itree(struct mem_tpm_mgr *dst, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize); + +static int load_verify_group_itree(struct mem_tpm_mgr *dst, int base, int nr_entries, + const struct hash256 *hash, const sector_t *loc, int hsize) +{ + int i, rc, incr = 1; + + if (nr_entries <= hsize) { + for(i=0; i < nr_entries; i++) { + struct mem_group_hdr *group = dst->groups + base + i; + group->disk_loc = loc[i]; + memcpy(&group->disk_hash, &hash[i], sizeof(group->disk_hash)); + rc = load_verify_group(group, dst); + if (rc) { + printk("Error loading group %d\n", base + i); + return rc; + } + } + return 0; + } + + // increase tree depth until all entries fit + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_set_used(loc[i], dst); + + rc = disk_read_crypt_sector(&pt, sizeof(pt), loc[i], dst); + if (rc) { + printk("Malformed sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = sha256_verify(&hash[i], pt.hash, sizeof(pt.hash)); + if (rc) { + printk("Hash mismatch in sector %d\n", be32_native(loc[i])); + return rc; + } + + rc = load_verify_group_itree(dst, base, child_entries, pt.hash, pt.location, NR_ENTRIES_PER_ITREE); + if (rc) + return rc; + + base += incr; + } + + return 0; +} + +static int load_root_post(struct mem_tpm_mgr *dst, const struct disk_root_sector *root) +{ + int rc, i, j; + uint32_t nr_disk_rbs = be32_native(root->nr_rb_macs); + + rc = TPM_disk_check_counter(dst->counter_index, dst->counter_auth, + root->v.tpm_counter_value); + if (rc) + return 2; + dst->counter_value = root->v.tpm_counter_value; + + dst->nr_groups = be32_native(root->v.nr_groups); + dst->groups = calloc(sizeof(dst->groups[0]), dst->nr_groups); + + if (!dst->groups) { + vtpmlogerror(VTPM_LOG_VTPM, "load_root_post alloc %x\n", dst->nr_groups); + return 2; + } + + rc = load_verify_group_itree(dst, 0, dst->nr_groups, + root->v.group_hash, root->group_loc, NR_ENTRIES_PER_ROOT); + if (rc) + return rc; + + /* Sanity check: group0 must be open */ + if (!dst->groups[0].v) { + printk("Error opening group 0\n"); + return 2; + } + + /* TODO support for spilling rollback list */ + if (nr_disk_rbs > NR_RB_MACS_PER_ROOT) + return 3; + + i = 0; + j = 0; + while (i < dst->nr_groups) { + aes_context key_e; + struct mem_group_hdr *group = &dst->groups[i]; + struct mem_group *groupv = group->v; + const struct disk_rb_mac_entry *ent = &root->rb_macs[j]; + + if (!groupv) { + i++; + // this group is not open - no need to verify now + continue; + } + + if (be32_native(ent->id) < i) { + // this entry is for a group that is not open + j++; + continue; + } + + if (j >= nr_disk_rbs || be32_native(ent->id) != i) { + // TODO allow delegation + if (!(groupv->details.flags.value & FLAG_ROLLBACK_DETECTED)) { + groupv->details.flags.value |= FLAG_ROLLBACK_DETECTED; + group->disk_loc.value = 0; + } + i++; + continue; + } + + aes_setup(&key_e, &groupv->rollback_mac_key); + if (aes_cmac_verify(&ent->mac, &root->v, sizeof(root->v), &key_e)) { + if (!(groupv->details.flags.value & FLAG_ROLLBACK_DETECTED)) { + groupv->details.flags.value |= FLAG_ROLLBACK_DETECTED; + group->disk_loc.value = 0; + } + } + i++; j++; + } + + return 0; +} + +int vtpm_load_disk(void) +{ + struct disk_root_sector root1, root2; + int rc = 0; + TPM_read_pcrs(); + + printk("TPM Manager - disk format %d\n", TPM_MGR_VERSION); + printk(" root seal: %lu; sector of %d: %lu\n", + sizeof(struct disk_root_sealed_data), SEALS_PER_ROOT_SEAL_LIST, sizeof(struct disk_seal_list)); + printk(" root: %lu v=%lu\n", sizeof(root1), sizeof(root1.v)); + printk(" itree: %lu; sector of %d: %lu\n", + 4 + 32, NR_ENTRIES_PER_ITREE, sizeof(struct disk_itree_sector)); + printk(" group: %lu v=%lu id=%lu md=%lu\n", + sizeof(struct disk_group_sector), sizeof(struct disk_group_sector_mac3_area), + sizeof(struct group_id_data), sizeof(struct group_details)); + printk(" group seal: %lu; %d in parent: %lu; sector of %d: %lu\n", + sizeof(struct disk_group_sealed_data), NR_SEALS_PER_GROUP, sizeof(struct disk_group_boot_config_list), + SEALS_PER_GROUP_SEAL_LIST, sizeof(struct disk_group_seal_list)); + printk(" vtpm: %lu+%lu; sector of %d: %lu\n", + sizeof(struct disk_vtpm_plain), sizeof(struct disk_vtpm_secret), + VTPMS_PER_SECTOR, sizeof(struct disk_vtpm_sector)); + + struct mem_tpm_mgr *mgr1 = find_root_key(0); + struct mem_tpm_mgr *mgr2 = find_root_key(1); + + rc = mgr1 ? load_root_pre(&root1, mgr1) : 0; + if (rc) { + mgr_free(mgr1); + mgr1 = NULL; + } + + rc = mgr2 ? load_root_pre(&root2, mgr2) : 0; + if (rc) { + mgr_free(mgr2); + mgr2 = NULL; + } + + printk("load_root_pre: %c/%c\n", mgr1 ? 'y' : 'n', mgr2 ? 'y' : 'n'); + + if (!mgr1 && !mgr2) + return 2; + + if (mgr1 && mgr2 && mgr2->sequence > mgr1->sequence) { + rc = load_root_post(mgr2, &root2); + if (rc) { + mgr_free(mgr2); + mgr2 = NULL; + } else { + mgr_free(mgr1); + g_mgr = mgr2; + return 0; + } + } + if (mgr1) { + rc = load_root_post(mgr1, &root1); + if (rc) { + mgr_free(mgr1); + } else { + mgr_free(mgr2); + g_mgr = mgr1; + return 0; + } + } + if (mgr2) { + rc = load_root_post(mgr2, &root2); + if (rc) { + mgr_free(mgr2); + } else { + g_mgr = mgr2; + return 0; + } + } + printk("Could not read vTPM disk\n"); + + return 2; +} diff --git a/stubdom/vtpmmgr/disk_tpm.c b/stubdom/vtpmmgr/disk_tpm.c new file mode 100644 index 0000000..6f5d556 --- /dev/null +++ b/stubdom/vtpmmgr/disk_tpm.c @@ -0,0 +1,238 @@ +/* TPM disk interface */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "tpm.h" +#include "tcg.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" + +// Print out input/output of seal/unseal operations (includes keys) +#undef DEBUG_SEAL_OPS + +#ifdef DEBUG_SEAL_OPS +#include "marshal.h" +#endif + +struct pcr_list { + TPM_DIGEST pcrs[24]; +}; + +static struct pcr_list hwtpm; + +void TPM_read_pcrs(void) +{ + int i; + for(i=0; i < 24; i++) + TPM_PCR_Read(i, &hwtpm.pcrs[i]); +} + +struct pcr_composite_3 { + be16_t sel_size; + uint8_t sel[3]; + be32_t val_size; + uint8_t val[0]; +} __attribute__((packed)); + +void TPM_pcr_digest(struct hash160 *buf, le32_t selection) +{ + int i; + int count = 0; + uint32_t sel = le32_native(selection); + struct pcr_composite_3 *v; + for(i=0; i < 24; i++) { + if (sel & (1 << i)) + count++; + } + v = alloca(sizeof(*v) + 20 * count); + v->sel_size = native_be16(3); + memcpy(v->sel, &selection, 3); + v->val_size = native_be32(20 * count); + + count = 0; + for(i=0; i < 24; i++) { + if (sel & (1 << i)) { + memcpy(v->val + 20 * count, &hwtpm.pcrs[i], 20); + count++; + } + } + + sha1((void*)v, sizeof(*v) + 20 * count, buf->bits); +} + + +int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) +{ + uint32_t rc; + TPM_PCR_INFO info; + TPM_STORED_DATA out; + TPM_AUTH_SESSION osap = TPM_AUTH_SESSION_INIT; + TPM_AUTHDATA sharedsecret; + TPM_AUTHDATA auth; + + rc = TPM_OSAP(TPM_ET_KEYHANDLE, TPM_SRK_KEYHANDLE, (void*)&vtpm_globals.srk_auth, + &sharedsecret, &osap); + + if (rc) abort(); + +#ifdef DEBUG_SEAL_OPS + int i; + printk("to-seal:"); + for(i=0; i < size; i++) + printk(" %02x", ((uint8_t*)src)[i]); + printk("\n"); +#endif + + memset(auth, 0, 20); + info.pcrSelection.sizeOfSelect = 3; + info.pcrSelection.pcrSelect = (void*)&dst->pcr_selection; + memcpy(&info.digestAtCreation, &dst->digest_at_seal, 20); + memcpy(&info.digestAtRelease, &dst->digest_release, 20); + + rc = TPM_Seal(TPM_SRK_KEYHANDLE, 45, &info, size, src, &out, + (void*)&sharedsecret, (void*)&auth, &osap); + + TPM_TerminateHandle(osap.AuthHandle); + +#ifdef DEBUG_SEAL_OPS + printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoSize); +#endif + if (!rc) + memcpy(dst->sealed_data, out.encData, 256); + +#ifdef DEBUG_SEAL_OPS + uint8_t buf[512]; + uint8_t *start = buf; + uint8_t *end = pack_TPM_STORED_DATA(buf, &out); + printk("stored_data:"); + while (start != end) { + printk(" %02x", *start); + start++; + } + printk("\n"); +#endif + + free_TPM_STORED_DATA(&out); + return rc; +} + +int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src) +{ + uint32_t rc; + TPM_STORED_DATA in; + TPM_AUTH_SESSION oiap = TPM_AUTH_SESSION_INIT; + TPM_AUTHDATA auth; + uint32_t outSize = 0; + uint8_t *out = NULL; + + rc = TPM_OIAP(&oiap); + if (rc) abort(); + + memset(auth, 0, 20); + + in.ver = TPM_STRUCT_VER_1_1; + in.sealInfoSize = 45; + in.sealInfo.pcrSelection.sizeOfSelect = 3; + in.sealInfo.pcrSelection.pcrSelect = (void*)&src->pcr_selection; + memcpy(&in.sealInfo.digestAtCreation, &src->digest_at_seal, 20); + memcpy(&in.sealInfo.digestAtRelease, &src->digest_release, 20); + in.encDataSize = 256; + in.encData = (void*)src->sealed_data; + +#ifdef DEBUG_SEAL_OPS + uint8_t buf[512]; + uint8_t *start = buf; + uint8_t *end = pack_TPM_STORED_DATA(buf, &in); + printk("stored_data:"); + while (start != end) { + printk(" %02x", *start); + start++; + } + printk("\n"); +#endif + + rc = TPM_Unseal(TPM_SRK_KEYHANDLE, &in, &outSize, &out, + (void*)&vtpm_globals.srk_auth, (void*)&auth, &vtpm_globals.oiap, &oiap); + + TPM_TerminateHandle(oiap.AuthHandle); + +#ifdef DEBUG_SEAL_OPS + printk("TPM_Unseal rc=%d outSize=%d size=%d\n", rc, outSize, size); +#endif + if (!rc) { + memcpy(dst, out, size); +#ifdef DEBUG_SEAL_OPS + printk("unsealed:"); + int i; + for(i=0; i < size; i++) + printk(" %02x", ((uint8_t*)dst)[i]); + printk("\n"); +#endif + } + + free(out); + + return rc; +} + +int TPM_disk_nvalloc(be32_t *nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + nvram_slot->value = 0; + return 0; +} + +int TPM_disk_nvread(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + memset(buf, 0, bufsiz); + return 0; +} + +int TPM_disk_nvwrite(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth) +{ + // TODO-3 + return 0; +} + +int TPM_disk_nvchange(be32_t nvram_slot, struct tpm_authdata old, struct tpm_authdata noo) +{ + // TODO-3 + return 0; +} + +int TPM_disk_alloc_counter(be32_t *slot, struct tpm_authdata auth, be32_t *value) +{ + // TODO-3 + slot->value = 0; + value->value = 0; + return 0; +} + +int TPM_disk_check_counter(be32_t slot, struct tpm_authdata auth, be32_t value) +{ + // TODO-3 + return 0; +} + +int TPM_disk_incr_counter(be32_t slot, struct tpm_authdata auth) +{ + // TODO-3 + return 0; +} + +int TPM_disk_change_counter(be32_t slot, struct tpm_authdata old, struct tpm_authdata noo) +{ + // TODO-3 + return 0; +} diff --git a/stubdom/vtpmmgr/disk_tpm.h b/stubdom/vtpmmgr/disk_tpm.h new file mode 100644 index 0000000..b235895 --- /dev/null +++ b/stubdom/vtpmmgr/disk_tpm.h @@ -0,0 +1,25 @@ +#ifndef __VTPMMGR_DISK_VTPM_H +#define __VTPMMGR_DISK_VTPM_H +#include "vtpm_disk.h" + +/* Read PCR values to determine which unseal to try */ +void TPM_read_pcrs(void); +void TPM_pcr_digest(struct hash160 *buf, le32_t selection); + +/* Sealing for key storage */ +int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size); +int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src); + +/* NVRAM to allow revocation of TM-KEY */ +int TPM_disk_nvalloc(be32_t *nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvread(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvwrite(void *buf, size_t bufsiz, be32_t nvram_slot, struct tpm_authdata auth); +int TPM_disk_nvchange(be32_t nvram_slot, struct tpm_authdata old, struct tpm_authdata noo); + +/* Monotonic counters to detect rollback */ +int TPM_disk_alloc_counter(be32_t *slot, struct tpm_authdata auth, be32_t *value); +int TPM_disk_check_counter(be32_t slot, struct tpm_authdata auth, be32_t value); +int TPM_disk_incr_counter(be32_t slot, struct tpm_authdata auth); +int TPM_disk_change_counter(be32_t slot, struct tpm_authdata old, struct tpm_authdata noo); + +#endif diff --git a/stubdom/vtpmmgr/disk_write.c b/stubdom/vtpmmgr/disk_write.c new file mode 100644 index 0000000..4c825c5 --- /dev/null +++ b/stubdom/vtpmmgr/disk_write.c @@ -0,0 +1,410 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "vtpm_manager.h" +#include "log.h" +#include "uuid.h" + +#include "vtpmmgr.h" +#include "vtpm_disk.h" +#include "disk_tpm.h" +#include "disk_io.h" +#include "disk_crypto.h" +#include "disk_format.h" +#include "mgmt_authority.h" + +static void disk_write_crypt_sector(sector_t *dst, const void *data, size_t size, const struct mem_tpm_mgr *mgr) +{ + struct disk_crypt_sector_plain *sector = disk_write_buf(); + *dst = disk_find_free(mgr); + aes_encrypt_ctr(sector->iv_data, sizeof(sector->iv_data), data, size, &mgr->tm_key_e); + aes_cmac(§or->mac, sector->data, sizeof(sector->data), &mgr->tm_key_e); + disk_write_sector(*dst, sector, sizeof(*sector)); +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_vtpm(const struct mem_vtpm_page *src, const struct mem_tpm_mgr *mgr) +{ + if (be32_native(src->disk_loc) != 0) + disk_set_used(src->disk_loc, mgr); +} + +/* + * Write out a vTPM page to disk, doing nothing if the existing copy is valid + */ +static void disk_write_vtpm_page(struct mem_vtpm_page *dst, const aes_context *auth_key, + const struct mem_tpm_mgr *mgr) +{ + struct disk_vtpm_sector pt; + int i; + memset(&pt, 0, sizeof(pt)); + if (be32_native(dst->disk_loc) != 0) + return; + + for(i=0; i < dst->size; i++) { + memcpy(pt.header[i].uuid, dst->vtpms[i]->uuid, 16); + memcpy(pt.data[i].data, dst->vtpms[i]->data, 64); + pt.header[i].flags = native_be32(dst->vtpms[i]->flags & VTPM_FLAG_DISK_MASK); + } + aes_encrypt_ctr(&pt.iv, sizeof(pt.data) + 16, &pt.data, sizeof(pt.data), auth_key); + + sha256(&dst->disk_hash, &pt, sizeof(pt)); + + disk_write_crypt_sector(&dst->disk_loc, &pt, sizeof(pt), mgr); +} + +/* + * Generate TPM seal blobs for a group's keys; do nothing if existing copy is valid + */ +static void generate_group_seals(struct mem_group *src, const struct mem_tpm_mgr *parent) +{ + int i; + struct disk_group_sealed_data sblob; + + // previous seals are still valid, skip talking to the TPM + if (src->flags & MEM_GROUP_FLAG_SEAL_VALID) + return; + + memcpy(&sblob.magic, DISK_GROUP_BOUND_MAGIC, 4); + memcpy(sblob.tpm_manager_uuid, parent->uuid, 16); + memcpy(&sblob.aik_authdata, &src->aik_authdata, 20); + memcpy(&sblob.group_key, &src->group_key, 16); + memcpy(&sblob.rollback_mac_key, &src->rollback_mac_key, 16); + + /* TODO support for more than NR_SEALS_PER_GROUP seals */ + if (src->nr_seals > NR_SEALS_PER_GROUP) + abort(); + + for(i=0; i < src->nr_seals; i++) { + struct disk_seal_entry *dst = &src->seal_bits.entry[i]; + dst->pcr_selection = src->seals[i].pcr_selection; + memcpy(&dst->digest_release, &src->seals[i].digest_release, 20); + TPM_pcr_digest(&dst->digest_at_seal, dst->pcr_selection); + TPM_disk_seal(dst, &sblob, sizeof(sblob)); + } + src->seal_bits.nr_cfgs = native_be32(src->nr_seals); + + src->flags |= MEM_GROUP_FLAG_SEAL_VALID; +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_group(const struct mem_group_hdr *src, const struct mem_tpm_mgr *mgr) +{ + int i; + struct mem_group *group = src->v; + if (be32_native(src->disk_loc) != 0) { + // entire group is unchanged - mark group, itree, and vtpm sectors + // TODO mark other children (seal) + disk_set_used(src->disk_loc, mgr); + for(i = 0; i < src->disk_nr_inuse; i++) + disk_set_used(src->disk_inuse[i], mgr); + return; + } + + // unopened groups should never have been invalidated + if (!group) + abort(); + + for (i = 0; i < group->nr_pages; i++) + disk_populate_used_vtpm(&group->data[i], mgr); +} + +static void disk_write_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize, + const aes_context *group_key, const struct mem_tpm_mgr *mgr); + +static void disk_write_vtpm_itree(struct mem_group_hdr *hdr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize, + const aes_context *group_key, const struct mem_tpm_mgr *mgr) +{ + int i, incr = 1, inuse_base, lsize; + + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + if (nr_entries <= hsize) { + struct mem_group *group = hdr->v; + for (i = 0; i < nr_entries; i++) { + struct mem_vtpm_page *page = group->data + base + i; + disk_write_vtpm_page(page, group_key, mgr); + loc[i] = page->disk_loc; + hash[i] = page->disk_hash; + } + } else { + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_write_vtpm_itree(hdr, base, child_entries, pt.hash, pt.location, + NR_ENTRIES_PER_ITREE, group_key, mgr); + + sha256(&hash[i], &pt.hash, sizeof(pt.hash)); + disk_write_crypt_sector(&loc[i], &pt, sizeof(pt), mgr); + + base += incr; + } + } + + // save the list of used sectors (itree and vtpm) in the header + inuse_base = hdr->disk_nr_inuse; + lsize = 1 + (nr_entries - 1) / incr; + hdr->disk_nr_inuse += lsize; + hdr->disk_inuse = realloc(hdr->disk_inuse, hdr->disk_nr_inuse * sizeof(sector_t)); + memcpy(&hdr->disk_inuse[inuse_base], loc, lsize * sizeof(sector_t)); +} + +/* + * Write out a vTPM group sector and its children + */ +static void disk_write_group_sector(struct mem_group_hdr *src, + const struct mem_tpm_mgr *mgr) +{ + struct disk_group_sector disk; + struct mem_group *group = src->v; + aes_context key_e; + + /* Don't write if the data hasn't changed */ + if (be32_native(src->disk_loc) != 0) + return; + + // if the group was not opened, it should not have been changed + if (!group) + abort(); + + memset(&disk, 0, sizeof(disk)); + memcpy(&disk.v.id_data, &group->id_data, sizeof(disk.v.id_data)); + memcpy(&disk.v.details, &group->details, sizeof(disk.v.details)); + + aes_setup(&key_e, &group->group_key); + + disk.v.nr_vtpms = native_be32(group->nr_vtpms); + + // regenerated + src->disk_nr_inuse = 0; + + disk_write_vtpm_itree(src, 0, group->nr_pages, disk.v.vtpm_hash, disk.vtpm_location, + NR_ENTRIES_PER_GROUP_BASE, &key_e, mgr); + + generate_group_seals(group, mgr); + memcpy(&disk.v.boot_configs, &group->seal_bits, sizeof(group->seal_bits)); + + aes_cmac(&disk.group_mac, &disk.v, sizeof(disk.v), &key_e); + sha256(&src->disk_hash, &disk.v, sizeof(disk.v) + sizeof(disk.group_mac)); + disk_write_crypt_sector(&src->disk_loc, &disk, sizeof(disk), mgr); +} + +/* + * Write TPM seal blobs for the manager's keys, using the given group's list + * of valid configurations + */ +static void disk_write_seal_list(struct mem_tpm_mgr *mgr, struct mem_group *group) +{ + int i; + struct disk_seal_list *seal = disk_write_buf(); + struct disk_root_sealed_data sblob; + + if (mgr->root_seals_valid & (1 + mgr->active_root)) + return; + + memcpy(&sblob.magic, DISK_ROOT_BOUND_MAGIC, 4); + memcpy(sblob.tpm_manager_uuid, mgr->uuid, 16); + memcpy(&sblob.nvram_slot, &mgr->nvram_slot, 4); + memcpy(&sblob.nvram_auth, &mgr->nvram_auth, 20); + memcpy(&sblob.counter_index, &mgr->counter_index, 4); + memcpy(&sblob.counter_auth, &mgr->counter_auth, 20); + + // TODO when an NV slot in the physical TPM is used to populate nv_key, + // that value should be used to mask the master key so that the value + // can be changed to revoke old disk state +#if 0 + aes_encrypt_one(&sblob.tm_key, &mgr->tm_key, &mgr->nv_key); +#else + memcpy(&sblob.tm_key, &mgr->tm_key, 16); +#endif + + memset(seal, 0, sizeof(*seal)); + seal->length = native_be32(group->nr_seals); + + // TODO support for more entries + if (group->nr_seals > SEALS_PER_ROOT_SEAL_LIST) + abort(); + + for(i=0; i < group->nr_seals; i++) { + struct mem_seal *src = &group->seals[i]; + struct disk_seal_entry *dst = &seal->entry[i]; + dst->pcr_selection = src->pcr_selection; + memcpy(&dst->digest_release, &src->digest_release, 20); + TPM_pcr_digest(&dst->digest_at_seal, dst->pcr_selection); + + TPM_disk_seal(dst, &sblob, sizeof(sblob)); + } + + memcpy(seal->hdr.magic, TPM_MGR_MAGIC, 12); + seal->hdr.version = native_be32(TPM_MGR_VERSION); + + disk_write_sector(seal_loc(mgr), seal, sizeof(*seal)); + mgr->root_seals_valid |= 1 + mgr->active_root; +} + +/* + * Mark unchanged sectors on disk as being used + */ +static void disk_populate_used_mgr(const struct mem_tpm_mgr *mgr) +{ + int i; + + // TODO walk the linked lists for seals, rb_macs here (when supported) + + for(i=0; i < mgr->nr_groups; i++) + disk_populate_used_group(&mgr->groups[i], mgr); +} + +static void disk_write_group_itree(struct mem_tpm_mgr *mgr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize); + +static void disk_write_group_itree(struct mem_tpm_mgr *mgr, int base, int nr_entries, + struct hash256 *hash, sector_t *loc, int hsize) +{ + int i, incr = 1; + + if (nr_entries <= hsize) { + for(i=0; i < mgr->nr_groups; i++) { + struct mem_group_hdr *group = mgr->groups + base + i; + disk_write_group_sector(group, mgr); + loc[i] = group->disk_loc; + hash[i] = group->disk_hash; + } + return; + } + + while (nr_entries > incr * hsize) + incr *= NR_ENTRIES_PER_ITREE; + + for (i = 0; i * incr < nr_entries; i++) { + struct disk_itree_sector pt; + int child_entries = incr; + + // the last sector is not completely full + if (nr_entries - i * incr < incr) + child_entries = nr_entries - i * incr; + + disk_write_group_itree(mgr, base, child_entries, pt.hash, pt.location, NR_ENTRIES_PER_ITREE); + + sha256(&hash[i], &pt.hash, sizeof(pt.hash)); + disk_write_crypt_sector(&loc[i], &pt, sizeof(pt), mgr); + + base += incr; + } +} + +/* + * Write out the root TPM Manager sector and its children + */ +static void disk_write_root_sector(struct mem_tpm_mgr *mgr) +{ + int i, j; + struct disk_root_sector root; + memset(&root, 0, sizeof(root)); + root.v.sequence = native_be64(mgr->sequence); + root.v.tpm_counter_value = mgr->counter_value; + + root.v.nr_groups = native_be32(mgr->nr_groups); + + disk_write_group_itree(mgr, 0, mgr->nr_groups, root.v.group_hash, root.group_loc, NR_ENTRIES_PER_ROOT); + + i = 0; + j = 0; + while (i < mgr->nr_groups) { + aes_context key_e; + struct mem_group_hdr *group = &mgr->groups[i]; + struct mem_group *groupv = group->v; + + if (!groupv) { + i++; + continue; + } + if (groupv->details.flags.value & FLAG_ROLLBACK_DETECTED) { + i++; + continue; + } + if (j >= NR_RB_MACS_PER_ROOT) + break; // TODO support for nr_rb_macs > 128 + + aes_setup(&key_e, &groupv->rollback_mac_key); + root.rb_macs[j].id = native_be32(i); + aes_cmac(&root.rb_macs[j].mac, &root.v, sizeof(root.v), &key_e); + i++; j++; + } + root.nr_rb_macs = native_be32(j); + + struct disk_crypt_sector_plain *root_sect = disk_write_buf(); + aes_encrypt_ctr(root_sect->iv_data, sizeof(root_sect->iv_data), &root, sizeof(root), &mgr->tm_key_e); + aes_cmac(&root_sect->mac, &root_sect->data, sizeof(root_sect->data), &mgr->tm_key_e); + disk_write_sector(root_loc(mgr), root_sect, sizeof(*root_sect)); +} + +/* + * Write out changes to disk + */ +void disk_write_all(struct mem_tpm_mgr *mgr) +{ + disk_flush_slot(mgr); + disk_populate_used_mgr(mgr); + disk_write_root_sector(mgr); + + disk_write_seal_list(mgr, mgr->groups[0].v); + + disk_write_barrier(); +} + +/* + * Create a new (blank) TPM Manager disk image. + * + * Does not actually write anything to disk. + */ +int vtpm_new_disk(void) +{ + int rc; + struct mem_tpm_mgr *mgr = calloc(1, sizeof(*mgr)); + + do_random(mgr->uuid, 16); + do_random(&mgr->tm_key, 16); + do_random(&mgr->nvram_auth, 20); + do_random(&mgr->counter_auth, 20); + do_random(&mgr->nv_key, 16); + + aes_setup(&mgr->tm_key_e, &mgr->tm_key); + + // TODO postpone these allocs until first write? + rc = TPM_disk_nvalloc(&mgr->nvram_slot, mgr->nvram_auth); + if (rc) + return rc; + + rc = TPM_disk_alloc_counter(&mgr->counter_index, mgr->counter_auth, &mgr->counter_value); + if (rc) + return rc; + + mgr->nr_groups = 1; + mgr->groups = calloc(1, sizeof(mgr->groups[0])); + mgr->groups[0].v = vtpm_new_group(NULL); + + TPM_disk_nvwrite(&mgr->nv_key, 16, mgr->nvram_slot, mgr->nvram_auth); + + g_mgr = mgr; + + return 0; +} diff --git a/stubdom/vtpmmgr/endian_int.h b/stubdom/vtpmmgr/endian_int.h new file mode 100644 index 0000000..030f87b --- /dev/null +++ b/stubdom/vtpmmgr/endian_int.h @@ -0,0 +1,72 @@ +#ifndef __VTPMMGR_ENDIAN_INT_H +#define __VTPMMGR_ENDIAN_INT_H + +#include + +/* These wrapper structs force the use of endian-to-CPU conversions */ + +typedef struct be_int16 { + uint16_t value; +} be16_t; + +typedef struct be_int32 { + uint32_t value; +} be32_t; + +typedef struct le_int32 { + uint32_t value; +} le32_t; + +typedef struct be_int64 { + uint64_t value; +} be64_t; + +static inline uint16_t be16_native(be16_t v) +{ + return be16_to_cpu(v.value); +} + +static inline uint32_t le32_native(le32_t v) +{ + return le32_to_cpu(v.value); +} + +static inline uint32_t be32_native(be32_t v) +{ + return be32_to_cpu(v.value); +} + +static inline uint64_t be64_native(be64_t v) +{ + return be64_to_cpu(v.value); +} + +static inline be16_t native_be16(uint16_t v) +{ + be16_t rv; + rv.value = cpu_to_be16(v); + return rv; +} + +static inline le32_t native_le32(uint32_t v) +{ + le32_t rv; + rv.value = cpu_to_le32(v); + return rv; +} + +static inline be32_t native_be32(uint32_t v) +{ + be32_t rv; + rv.value = cpu_to_be32(v); + return rv; +} + +static inline be64_t native_be64(uint64_t v) +{ + be64_t rv; + rv.value = cpu_to_be64(v); + return rv; +} + +#endif diff --git a/stubdom/vtpmmgr/init.c b/stubdom/vtpmmgr/init.c index 33ac152..89643e7 100644 --- a/stubdom/vtpmmgr/init.c +++ b/stubdom/vtpmmgr/init.c @@ -48,7 +48,7 @@ #include "log.h" #include "vtpmmgr.h" -#include "vtpm_storage.h" +#include "vtpm_disk.h" #include "tpm.h" #include "marshal.h" @@ -64,16 +64,11 @@ struct Opts { }; // --------------------------- Well Known Auths -------------------------- -const TPM_AUTHDATA WELLKNOWN_SRK_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +const TPM_AUTHDATA WELLKNOWN_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; -const TPM_AUTHDATA WELLKNOWN_OWNER_AUTH = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; - struct vtpm_globals vtpm_globals = { .tpm_fd = -1, - .storage_key = TPM_KEY_INIT, - .storage_key_handle = 0, .oiap = { .AuthHandle = 0 } }; @@ -247,42 +242,11 @@ abort_egress: return status; } -static void init_storage_key(TPM_KEY* key) { - key->ver.major = 1; - key->ver.minor = 1; - key->ver.revMajor = 0; - key->ver.revMinor = 0; - - key->keyUsage = TPM_KEY_BIND; - key->keyFlags = 0; - key->authDataUsage = TPM_AUTH_ALWAYS; - - TPM_KEY_PARMS* p = &key->algorithmParms; - p->algorithmID = TPM_ALG_RSA; - p->encScheme = TPM_ES_RSAESOAEP_SHA1_MGF1; - p->sigScheme = TPM_SS_NONE; - p->parmSize = 12; - - TPM_RSA_KEY_PARMS* r = &p->parms.rsa; - r->keyLength = RSA_KEY_SIZE; - r->numPrimes = 2; - r->exponentSize = 0; - r->exponent = NULL; - - key->PCRInfoSize = 0; - key->encDataSize = 0; - key->encData = NULL; -} - -static int parse_auth_string(char* authstr, BYTE* target, const TPM_AUTHDATA wellknown, int allowrandom) { +static int parse_auth_string(char* authstr, BYTE* target) { int rc; /* well known owner auth */ if(!strcmp(authstr, "well-known")) { - memcpy(target, wellknown, sizeof(TPM_AUTHDATA)); - } - /* Create a randomly generated owner auth */ - else if(allowrandom && !strcmp(authstr, "random")) { - return 1; + return 0; } /* owner auth is a raw hash */ else if(!strncmp(authstr, "hash:", 5)) { @@ -318,12 +282,12 @@ int parse_cmdline_opts(int argc, char** argv, struct Opts* opts) int i; //Set defaults - memcpy(vtpm_globals.owner_auth, WELLKNOWN_OWNER_AUTH, sizeof(TPM_AUTHDATA)); - memcpy(vtpm_globals.srk_auth, WELLKNOWN_SRK_AUTH, sizeof(TPM_AUTHDATA)); _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:37 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:37 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkux-00013E-4Y; Thu, 01 May 2014 06:56:27 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuv-00012q-QI for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:26 +0000 Received: from [85.158.137.68:31148] by server-13.bemta-3.messagelabs.com id 7F/A6-18692-910F1635; Thu, 01 May 2014 06:56:25 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-31.messagelabs.com!1398927382!1191463!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 17374 invoked from network); 1 May 2014 06:56:23 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-14.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:23 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkus-0001oe-9X for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:22 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkus-0004sh-81 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:22 +0000 Date: Thu, 01 May 2014 06:56:22 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: add example control tools X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit ffa11862aa431494e809c6e99f7358c12cb67e44 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:22:58 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:42 2014 +0100 vtpmmgr: add example control tools The manage-vtpmmgr.pl script is an example client for interacting with the TPM Manager; it is intended to run in a management domain with a vTPM (which may be dom0). It is used to create and manage vTPMs and vTPM groups. The calc.pl script is an example manager of a vTPM group. It signs the configuration lists used by the TPM Manager with a locally held private key. Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- config/Tools.mk.in | 1 + tools/Makefile | 1 + tools/vtpmmgr/Makefile | 15 ++++ tools/vtpmmgr/calc.pl | 97 +++++++++++++++++++++++ tools/vtpmmgr/manage-vtpmmgr.pl | 160 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 274 insertions(+), 0 deletions(-) diff --git a/config/Tools.mk.in b/config/Tools.mk.in index 0bdf37a..18f3b8a 100644 --- a/config/Tools.mk.in +++ b/config/Tools.mk.in @@ -54,6 +54,7 @@ CONFIG_SEABIOS := @seabios@ CONFIG_QEMU_TRAD := @qemu_traditional@ CONFIG_QEMU_XEN := @qemu_xen@ CONFIG_BLKTAP1 := @blktap1@ +CONFIG_VTPM := @vtpm@ #System options ZLIB := @zlib@ diff --git a/tools/Makefile b/tools/Makefile index c3cfb38..2d32f27 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -38,6 +38,7 @@ SUBDIRS-$(CONFIG_X86) += xenpaging SUBDIRS-$(CONFIG_X86) += debugger/gdbsx SUBDIRS-$(CONFIG_X86) += debugger/kdd SUBDIRS-$(CONFIG_TESTS) += tests +SUBDIRS-$(CONFIG_VTPM) += vtpmmgr # These don't cross-compile ifeq ($(XEN_COMPILE_ARCH),$(XEN_TARGET_ARCH)) diff --git a/tools/vtpmmgr/Makefile b/tools/vtpmmgr/Makefile new file mode 100644 index 0000000..8890b06 --- /dev/null +++ b/tools/vtpmmgr/Makefile @@ -0,0 +1,15 @@ +XEN_ROOT=$(CURDIR)/../.. +include $(XEN_ROOT)/tools/Rules.mk + +all: + @true + +install: + $(INSTALL_DIR) "$(DESTDIR)$(LIBEXEC)" + $(INSTALL_DATA) calc.pl "$(DESTDIR)$(LIBEXEC)" + $(INSTALL_DATA) manage-vtpmmgr.pl "$(DESTDIR)$(LIBEXEC)" + +clean: + @true + +.PHONY: all install clean diff --git a/tools/vtpmmgr/calc.pl b/tools/vtpmmgr/calc.pl new file mode 100755 index 0000000..4183733 --- /dev/null +++ b/tools/vtpmmgr/calc.pl @@ -0,0 +1,97 @@ +#!/usr/bin/perl +use strict; +use Digest::SHA qw(sha1); +use Math::BigInt only => 'GMP'; + +my $s2 = Digest::SHA->new("SHA256"); + +# The key below is an example; its private key is (obviously) not private. This +# key must be protected at least as well as the vTPM's secrets, since it can +# approve the release of these secrets to a new TCB. It may make sense to +# modify this script to use a TPM or some other hardware key storage device to +# hold the private key instead of holding the key in plaintext; such integration +# is beyond the scope of this example script. +# +# The public exponent of this key must be 65537 (0x10001); this is the default +# for TPM-generated RSA keys. +# +# The manage-tpmmgr.pl script expects the modulus of this RSA key to be +# available; this may be done using: +# +# open KEY, '>rsa-modulus-file'; +# print KEY pack 'H*', $rsa_n; +# close KEY; + +my $rsa_n = 'c1580b4ea118a6c2f0a56d5af59b080928a9de7267f824457a1e9d7216013b5a322ff67f72153cd4b58693284490aced3a85d81da909ffe544f934c80340020b5bf514e8850926c6ce3314c3283e33cb79cb6aecf041726782013d07f8171fde4ea8165c6a7050af534ffc1b11ae37ace2ed6436c626edb49bf5bd70ee71f74bf2c132a99e5a6427343dbe46829961755558386436ebea90959161295c78df0127d4e468f9a188b3c1e9b68e5b1e78a450ea437ac7930dab294ede8117f6849d53f11e0bbc8ccef44b7fc9ebd6d7c7532875b3225a9106961771001be618ab3f991ba18edc1b73d73b6b80b5df854f9c9113d0b0cd1fec81a85da3638745fd29'; +my $rsa_d = '3229508daed80173f4114744e111beccf982d0d6a7c8c6484c3da3259535ee9b21083690ac1d7c71c742c9ed1994db7894c562e39716a4106c8ba738f936e310e563b96ff60c00c6757ae53918b8c2a158d100c5c63384a5fc21ac1ee42bc3b5de7c5788d4889d364f8c21e137fe162dc1964b78b682250bc5a6c4e686c6849cf8f0020f6ca383d784e5ffb85da56c2b89dc2e879509b1916c8b51f5907a0dbb7e2f9e5fabc500588ef7db6f78ba4605da86d907493648017ac46a1571ffe9b6a68babeeb277e3a96d346cddc996a94163f1e8393d88f710ff64369a62d3edfc62dbdeae57ee12a33adbb9b9d48d575158117f29fc991cbbbaaa4a47ee974f31'; + +sub rsa_sign { + my $m = '1'.('ff'x218).'003021300906052b0e03021a05000414'; + $m .= unpack 'H*', sha1(shift); + $m = Math::BigInt->from_hex($m); + my $n = Math::BigInt->from_hex($rsa_n); + my $e = Math::BigInt->from_hex($rsa_d); + $m->bmodpow($e, $n); + $m = $m->as_hex(); + $m =~ s/^0x//; + $m =~ s/^/0/ while length $m < 512; + pack 'H*', $m; +} + +sub auth_update_file { + my($dst,$seq) = (shift, shift); + my(@plt, @pcrs, @kerns, $cfg); + open my $update, '>', $dst or die $!; + for (@_) { + if (/^([0-9a-fA-F]+)=([0-9a-fA-F]+)$/) { + push @pcrs, pack 'V', hex $1; + push @plt, pack 'H*', $2; + } elsif (/^[0-9a-fA-F]{40}$/) { + push @kerns, pack 'H*', $_; + } elsif (length $_ == 20) { + push @kerns, $_; + } else { + print "Bad argument: $_"; + exit 1; + } + } + $cfg = pack 'Q>', $seq; + $cfg .= pack 'N/(a20)', @plt; + $cfg .= pack 'N/(a20)', @kerns; + + printf "cfg_hash for %s: %s\n", $dst, Digest::SHA::sha1_hex($cfg); + + print $update rsa_sign($cfg); + print $update $cfg; + print $update map { pack 'n/a3', $_ } @pcrs; + close $update; +} + +my $out = shift; +my $seq = $ENV{SEQ} || time; + +if (!$out) { + print < {=}* {}* + is the file that will contain the signed configuration + is a 24-bit PCR mask in hexadecimal + is a PCR_COMPOSITE_HASH in hexadecimal + is a 160-bit vTPM kernel hash in hexadecimal + +The sequence number may be specified using the SEQ environment variable, +otherwise the current UNIX timestamp will be used. The sequence number of a +vTPM group must increase on each update. + +When the vTPM Manager is compiled without support for a domain builder, the +SHA-1 hash of the vTPM domain's XSM label is used in place of its kernel hash. + +Example: + A configuration with two valid command lines and one valid vTPM kernel + PCRs 0-7 and 17-19 are being validated (static RTM and TBOOT). + $0 auth-0 0e00ff=0593ecb564f532df6ef2f4d7272489da52c4c840 0e00ff=0593ecb564f532df6ef2f4d7272489da52c4c840 2bc65001d506ce6cd12cab90a4a2ad9040d641e1 +EOF + exit 0; +} +print "Sequence: $seq\n"; + +auth_update_file $out, $seq, @ARGV; diff --git a/tools/vtpmmgr/manage-vtpmmgr.pl b/tools/vtpmmgr/manage-vtpmmgr.pl new file mode 100755 index 0000000..caf4f02 --- /dev/null +++ b/tools/vtpmmgr/manage-vtpmmgr.pl @@ -0,0 +1,160 @@ +#!/usr/bin/perl +use strict; +use warnings; +use Digest::SHA; + +# The /dev/tpm0 device can only be opened by one application at a time, so if +# the trousers daemon is running, this script will fail. +system "killall tcsd 2>/dev/null"; +open my $tpm, '+>', '/dev/tpm0' or die "Could not open /dev/tpm0: $!"; + +sub tpm_cmd_raw { + my $msg = join '', @_; + my $rsp; + print '<<', unpack('H*', $msg), "\n" if $ENV{V}; + syswrite $tpm, $msg; + sysread $tpm, $rsp, 4096; + print '>>', unpack('H*', $rsp), "\n" if $ENV{V}; + $rsp; +} + +sub tpm_cmd_nohdr { + my($type, $msg) = @_; + my $head = pack 'nN', $type, 6 + length $msg; + my $rsp = tpm_cmd_raw $head, $msg; + my($rtype, $len, $stat, $reply) = unpack 'nNNa*', $rsp; + die "incomplete response" if $len != 10 + length $reply; + if ($stat) { + print "TPM error: $stat\n"; + exit 1; + } + $reply; +} + +sub cmd_list_group { + my $group = shift; + my($uuid, $pubk, $cfg_list) = unpack 'H32 a256 a*', tpm_cmd_nohdr 0x1C2, + pack 'NN', 0x02000107, $group; + $uuid = join "-", unpack 'a8a4a4a4a12', $uuid; + my $pk_hash = Digest::SHA::sha1_hex($pubk); + my $cfg_hash = Digest::SHA::sha1_hex($cfg_list); + my($seq, @cfgs) = unpack 'Q> N/(H40) a*', $cfg_list; + my @kerns = unpack "N/(H40)", pop @cfgs; + print "Group $group ($uuid):\n"; + print " Public key hash: $pk_hash\n"; + print " Boot config #$seq ($cfg_hash)\n"; + print " Platforms:\n"; + print " $_\n" for @cfgs; + print " Kernels:\n"; + print " $_\n" for @kerns; + print " VTPMs:\n"; + + my($nr, @vtpms) = unpack 'N(H32)*', tpm_cmd_nohdr 0x1C2, pack 'NNN', 0x02000201, $group, 0; + if ($nr > @vtpms) { + print " TODO this list is cropped; needs multiple requests\n"; + } + @vtpms = () if $nr == 0; # unpack returns an empty string in this case + @vtpms = map { join "-", unpack 'a8a4a4a4a12', $_ } @vtpms; + print " $_\n" for @vtpms; +} + +sub cmd_list { + if (@_) { + cmd_list_group $_[0]; + } else { + my $nr = unpack 'N', tpm_cmd_nohdr 0x1C2, pack 'N', 0x02000101; + cmd_list_group $_ for (0..($nr - 1)); + } +} + +sub cmd_group_add { + my $rsa_modfile = shift; + my $ca_digest = "\0"x20; + open MOD, $rsa_modfile or die $!; + my $group_pubkey = join '', ; + close MOD; + + my($uuid, $pubkey, $pksig) = unpack 'H32 a256 a*', tpm_cmd_nohdr 0x1C2, pack 'N(a*)*', + 0x02000102, $ca_digest, $group_pubkey; + $uuid = join "-", unpack 'a8a4a4a4a12', $uuid; + print "$uuid\n"; + mkdir "group-$uuid"; + open F, ">group-$uuid/aik.pub"; + print F $pubkey; + close F; + open F, ">group-$uuid/aik.priv-ca-data"; + print F $pksig; + close F; + + # TODO certify the AIK using the pTPM's EK (privacy CA) + # TODO escrow the recovery key for this group +} + +sub cmd_group_del { + my $nr = shift; + tpm_cmd_nohdr 0x1C2, pack 'NN', 0x02000103, $nr; +} + +sub cmd_group_update { + my $nr = shift; + open my $fh, '<', shift; + my $cmd = join '', <$fh>; + close $fh; + + tpm_cmd_nohdr 0x1C2, pack 'NNa*', 0x02000106, $nr, $cmd; +} + +sub cmd_vtpm_add { + my($group,$uuid) = @_; + if ($uuid) { + $uuid =~ s/-//g; + $uuid = pack('H32', $uuid)."\0"; + } else { + $uuid = ''; + } + $uuid = unpack 'H32', tpm_cmd_nohdr 0x1C2, pack 'NNa*', 0x02000204, $group, $uuid; + printf "%s\n", join "-", unpack 'a8a4a4a4a12', $uuid; +} + +sub cmd_vtpm_del { + my($uuid) = @_; + $uuid =~ s/-//g; + tpm_cmd_nohdr 0x1C2, pack 'NH32', 0x02000205, $uuid; +} + +sub cmd_help { + print < + +list [index] + Lists the group identified by index, or all groups if omitted + +group-add rsa-modulus-file + Adds a new group to the TPM. The public key and Privacy CA data are + output to group-UUID/aik.pub and group-UUID/aik.priv-ca-data, and the + UUID is output to stdout. + +group-update index signed-config-list-file + Updates the permitted boot configuration list for an group + +group-del index + Deletes a group + +vtpm-add index + Adds a vTPM. Output: UUID + +vtpm-del UUID + Deletes a vTPM. + +EOH +} + +my $cmd = shift || 'help'; +$cmd =~ s/-/_/g; +my $fn = $main::{"cmd_$cmd"}; +if ($fn) { + $fn->(@ARGV); +} else { + print "Unknown command: $cmd\n"; + exit 1; +} -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:56:37 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:56:37 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkux-00013E-4Y; Thu, 01 May 2014 06:56:27 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkuv-00012q-QI for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:26 +0000 Received: from [85.158.137.68:31148] by server-13.bemta-3.messagelabs.com id 7F/A6-18692-910F1635; Thu, 01 May 2014 06:56:25 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-31.messagelabs.com!1398927382!1191463!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 17374 invoked from network); 1 May 2014 06:56:23 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-14.tower-31.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:23 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkus-0001oe-9X for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:22 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkus-0004sh-81 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:22 +0000 Date: Thu, 01 May 2014 06:56:22 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: add example control tools X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit ffa11862aa431494e809c6e99f7358c12cb67e44 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:22:58 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:42 2014 +0100 vtpmmgr: add example control tools The manage-vtpmmgr.pl script is an example client for interacting with the TPM Manager; it is intended to run in a management domain with a vTPM (which may be dom0). It is used to create and manage vTPMs and vTPM groups. The calc.pl script is an example manager of a vTPM group. It signs the configuration lists used by the TPM Manager with a locally held private key. Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- config/Tools.mk.in | 1 + tools/Makefile | 1 + tools/vtpmmgr/Makefile | 15 ++++ tools/vtpmmgr/calc.pl | 97 +++++++++++++++++++++++ tools/vtpmmgr/manage-vtpmmgr.pl | 160 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 274 insertions(+), 0 deletions(-) diff --git a/config/Tools.mk.in b/config/Tools.mk.in index 0bdf37a..18f3b8a 100644 --- a/config/Tools.mk.in +++ b/config/Tools.mk.in @@ -54,6 +54,7 @@ CONFIG_SEABIOS := @seabios@ CONFIG_QEMU_TRAD := @qemu_traditional@ CONFIG_QEMU_XEN := @qemu_xen@ CONFIG_BLKTAP1 := @blktap1@ +CONFIG_VTPM := @vtpm@ #System options ZLIB := @zlib@ diff --git a/tools/Makefile b/tools/Makefile index c3cfb38..2d32f27 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -38,6 +38,7 @@ SUBDIRS-$(CONFIG_X86) += xenpaging SUBDIRS-$(CONFIG_X86) += debugger/gdbsx SUBDIRS-$(CONFIG_X86) += debugger/kdd SUBDIRS-$(CONFIG_TESTS) += tests +SUBDIRS-$(CONFIG_VTPM) += vtpmmgr # These don't cross-compile ifeq ($(XEN_COMPILE_ARCH),$(XEN_TARGET_ARCH)) diff --git a/tools/vtpmmgr/Makefile b/tools/vtpmmgr/Makefile new file mode 100644 index 0000000..8890b06 --- /dev/null +++ b/tools/vtpmmgr/Makefile @@ -0,0 +1,15 @@ +XEN_ROOT=$(CURDIR)/../.. +include $(XEN_ROOT)/tools/Rules.mk + +all: + @true + +install: + $(INSTALL_DIR) "$(DESTDIR)$(LIBEXEC)" + $(INSTALL_DATA) calc.pl "$(DESTDIR)$(LIBEXEC)" + $(INSTALL_DATA) manage-vtpmmgr.pl "$(DESTDIR)$(LIBEXEC)" + +clean: + @true + +.PHONY: all install clean diff --git a/tools/vtpmmgr/calc.pl b/tools/vtpmmgr/calc.pl new file mode 100755 index 0000000..4183733 --- /dev/null +++ b/tools/vtpmmgr/calc.pl @@ -0,0 +1,97 @@ +#!/usr/bin/perl +use strict; +use Digest::SHA qw(sha1); +use Math::BigInt only => 'GMP'; + +my $s2 = Digest::SHA->new("SHA256"); + +# The key below is an example; its private key is (obviously) not private. This +# key must be protected at least as well as the vTPM's secrets, since it can +# approve the release of these secrets to a new TCB. It may make sense to +# modify this script to use a TPM or some other hardware key storage device to +# hold the private key instead of holding the key in plaintext; such integration +# is beyond the scope of this example script. +# +# The public exponent of this key must be 65537 (0x10001); this is the default +# for TPM-generated RSA keys. +# +# The manage-tpmmgr.pl script expects the modulus of this RSA key to be +# available; this may be done using: +# +# open KEY, '>rsa-modulus-file'; +# print KEY pack 'H*', $rsa_n; +# close KEY; + +my $rsa_n = 'c1580b4ea118a6c2f0a56d5af59b080928a9de7267f824457a1e9d7216013b5a322ff67f72153cd4b58693284490aced3a85d81da909ffe544f934c80340020b5bf514e8850926c6ce3314c3283e33cb79cb6aecf041726782013d07f8171fde4ea8165c6a7050af534ffc1b11ae37ace2ed6436c626edb49bf5bd70ee71f74bf2c132a99e5a6427343dbe46829961755558386436ebea90959161295c78df0127d4e468f9a188b3c1e9b68e5b1e78a450ea437ac7930dab294ede8117f6849d53f11e0bbc8ccef44b7fc9ebd6d7c7532875b3225a9106961771001be618ab3f991ba18edc1b73d73b6b80b5df854f9c9113d0b0cd1fec81a85da3638745fd29'; +my $rsa_d = '3229508daed80173f4114744e111beccf982d0d6a7c8c6484c3da3259535ee9b21083690ac1d7c71c742c9ed1994db7894c562e39716a4106c8ba738f936e310e563b96ff60c00c6757ae53918b8c2a158d100c5c63384a5fc21ac1ee42bc3b5de7c5788d4889d364f8c21e137fe162dc1964b78b682250bc5a6c4e686c6849cf8f0020f6ca383d784e5ffb85da56c2b89dc2e879509b1916c8b51f5907a0dbb7e2f9e5fabc500588ef7db6f78ba4605da86d907493648017ac46a1571ffe9b6a68babeeb277e3a96d346cddc996a94163f1e8393d88f710ff64369a62d3edfc62dbdeae57ee12a33adbb9b9d48d575158117f29fc991cbbbaaa4a47ee974f31'; + +sub rsa_sign { + my $m = '1'.('ff'x218).'003021300906052b0e03021a05000414'; + $m .= unpack 'H*', sha1(shift); + $m = Math::BigInt->from_hex($m); + my $n = Math::BigInt->from_hex($rsa_n); + my $e = Math::BigInt->from_hex($rsa_d); + $m->bmodpow($e, $n); + $m = $m->as_hex(); + $m =~ s/^0x//; + $m =~ s/^/0/ while length $m < 512; + pack 'H*', $m; +} + +sub auth_update_file { + my($dst,$seq) = (shift, shift); + my(@plt, @pcrs, @kerns, $cfg); + open my $update, '>', $dst or die $!; + for (@_) { + if (/^([0-9a-fA-F]+)=([0-9a-fA-F]+)$/) { + push @pcrs, pack 'V', hex $1; + push @plt, pack 'H*', $2; + } elsif (/^[0-9a-fA-F]{40}$/) { + push @kerns, pack 'H*', $_; + } elsif (length $_ == 20) { + push @kerns, $_; + } else { + print "Bad argument: $_"; + exit 1; + } + } + $cfg = pack 'Q>', $seq; + $cfg .= pack 'N/(a20)', @plt; + $cfg .= pack 'N/(a20)', @kerns; + + printf "cfg_hash for %s: %s\n", $dst, Digest::SHA::sha1_hex($cfg); + + print $update rsa_sign($cfg); + print $update $cfg; + print $update map { pack 'n/a3', $_ } @pcrs; + close $update; +} + +my $out = shift; +my $seq = $ENV{SEQ} || time; + +if (!$out) { + print < {=}* {}* + is the file that will contain the signed configuration + is a 24-bit PCR mask in hexadecimal + is a PCR_COMPOSITE_HASH in hexadecimal + is a 160-bit vTPM kernel hash in hexadecimal + +The sequence number may be specified using the SEQ environment variable, +otherwise the current UNIX timestamp will be used. The sequence number of a +vTPM group must increase on each update. + +When the vTPM Manager is compiled without support for a domain builder, the +SHA-1 hash of the vTPM domain's XSM label is used in place of its kernel hash. + +Example: + A configuration with two valid command lines and one valid vTPM kernel + PCRs 0-7 and 17-19 are being validated (static RTM and TBOOT). + $0 auth-0 0e00ff=0593ecb564f532df6ef2f4d7272489da52c4c840 0e00ff=0593ecb564f532df6ef2f4d7272489da52c4c840 2bc65001d506ce6cd12cab90a4a2ad9040d641e1 +EOF + exit 0; +} +print "Sequence: $seq\n"; + +auth_update_file $out, $seq, @ARGV; diff --git a/tools/vtpmmgr/manage-vtpmmgr.pl b/tools/vtpmmgr/manage-vtpmmgr.pl new file mode 100755 index 0000000..caf4f02 --- /dev/null +++ b/tools/vtpmmgr/manage-vtpmmgr.pl @@ -0,0 +1,160 @@ +#!/usr/bin/perl +use strict; +use warnings; +use Digest::SHA; + +# The /dev/tpm0 device can only be opened by one application at a time, so if +# the trousers daemon is running, this script will fail. +system "killall tcsd 2>/dev/null"; +open my $tpm, '+>', '/dev/tpm0' or die "Could not open /dev/tpm0: $!"; + +sub tpm_cmd_raw { + my $msg = join '', @_; + my $rsp; + print '<<', unpack('H*', $msg), "\n" if $ENV{V}; + syswrite $tpm, $msg; + sysread $tpm, $rsp, 4096; + print '>>', unpack('H*', $rsp), "\n" if $ENV{V}; + $rsp; +} + +sub tpm_cmd_nohdr { + my($type, $msg) = @_; + my $head = pack 'nN', $type, 6 + length $msg; + my $rsp = tpm_cmd_raw $head, $msg; + my($rtype, $len, $stat, $reply) = unpack 'nNNa*', $rsp; + die "incomplete response" if $len != 10 + length $reply; + if ($stat) { + print "TPM error: $stat\n"; + exit 1; + } + $reply; +} + +sub cmd_list_group { + my $group = shift; + my($uuid, $pubk, $cfg_list) = unpack 'H32 a256 a*', tpm_cmd_nohdr 0x1C2, + pack 'NN', 0x02000107, $group; + $uuid = join "-", unpack 'a8a4a4a4a12', $uuid; + my $pk_hash = Digest::SHA::sha1_hex($pubk); + my $cfg_hash = Digest::SHA::sha1_hex($cfg_list); + my($seq, @cfgs) = unpack 'Q> N/(H40) a*', $cfg_list; + my @kerns = unpack "N/(H40)", pop @cfgs; + print "Group $group ($uuid):\n"; + print " Public key hash: $pk_hash\n"; + print " Boot config #$seq ($cfg_hash)\n"; + print " Platforms:\n"; + print " $_\n" for @cfgs; + print " Kernels:\n"; + print " $_\n" for @kerns; + print " VTPMs:\n"; + + my($nr, @vtpms) = unpack 'N(H32)*', tpm_cmd_nohdr 0x1C2, pack 'NNN', 0x02000201, $group, 0; + if ($nr > @vtpms) { + print " TODO this list is cropped; needs multiple requests\n"; + } + @vtpms = () if $nr == 0; # unpack returns an empty string in this case + @vtpms = map { join "-", unpack 'a8a4a4a4a12', $_ } @vtpms; + print " $_\n" for @vtpms; +} + +sub cmd_list { + if (@_) { + cmd_list_group $_[0]; + } else { + my $nr = unpack 'N', tpm_cmd_nohdr 0x1C2, pack 'N', 0x02000101; + cmd_list_group $_ for (0..($nr - 1)); + } +} + +sub cmd_group_add { + my $rsa_modfile = shift; + my $ca_digest = "\0"x20; + open MOD, $rsa_modfile or die $!; + my $group_pubkey = join '', ; + close MOD; + + my($uuid, $pubkey, $pksig) = unpack 'H32 a256 a*', tpm_cmd_nohdr 0x1C2, pack 'N(a*)*', + 0x02000102, $ca_digest, $group_pubkey; + $uuid = join "-", unpack 'a8a4a4a4a12', $uuid; + print "$uuid\n"; + mkdir "group-$uuid"; + open F, ">group-$uuid/aik.pub"; + print F $pubkey; + close F; + open F, ">group-$uuid/aik.priv-ca-data"; + print F $pksig; + close F; + + # TODO certify the AIK using the pTPM's EK (privacy CA) + # TODO escrow the recovery key for this group +} + +sub cmd_group_del { + my $nr = shift; + tpm_cmd_nohdr 0x1C2, pack 'NN', 0x02000103, $nr; +} + +sub cmd_group_update { + my $nr = shift; + open my $fh, '<', shift; + my $cmd = join '', <$fh>; + close $fh; + + tpm_cmd_nohdr 0x1C2, pack 'NNa*', 0x02000106, $nr, $cmd; +} + +sub cmd_vtpm_add { + my($group,$uuid) = @_; + if ($uuid) { + $uuid =~ s/-//g; + $uuid = pack('H32', $uuid)."\0"; + } else { + $uuid = ''; + } + $uuid = unpack 'H32', tpm_cmd_nohdr 0x1C2, pack 'NNa*', 0x02000204, $group, $uuid; + printf "%s\n", join "-", unpack 'a8a4a4a4a12', $uuid; +} + +sub cmd_vtpm_del { + my($uuid) = @_; + $uuid =~ s/-//g; + tpm_cmd_nohdr 0x1C2, pack 'NH32', 0x02000205, $uuid; +} + +sub cmd_help { + print < + +list [index] + Lists the group identified by index, or all groups if omitted + +group-add rsa-modulus-file + Adds a new group to the TPM. The public key and Privacy CA data are + output to group-UUID/aik.pub and group-UUID/aik.priv-ca-data, and the + UUID is output to stdout. + +group-update index signed-config-list-file + Updates the permitted boot configuration list for an group + +group-del index + Deletes a group + +vtpm-add index + Adds a vTPM. Output: UUID + +vtpm-del UUID + Deletes a vTPM. + +EOH +} + +my $cmd = shift || 'help'; +$cmd =~ s/-/_/g; +my $fn = $main::{"cmd_$cmd"}; +if ($fn) { + $fn->(@ARGV); +} else { + print "Unknown command: $cmd\n"; + exit 1; +} -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:07 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvH-00016w-AS; Thu, 01 May 2014 06:56:47 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvF-00016Y-VA for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:46 +0000 Received: from [85.158.143.35:42620] by server-1.bemta-4.messagelabs.com id 9F/DD-09853-D20F1635; Thu, 01 May 2014 06:56:45 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-6.tower-21.messagelabs.com!1398927402!2164426!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests=UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 16138 invoked from network); 1 May 2014 06:56:43 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-6.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:43 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvC-0001os-NZ for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:42 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvC-0004tW-LU for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:42 +0000 Date: Thu, 01 May 2014 06:56:42 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 2c8a51eebeb54c49eecec97ffacf393145738284 Author: Jason Andryuk AuthorDate: Mon Apr 21 13:23:00 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG Infineon 1.2 TPMs fail TPM_Seal commands with TPM_BAD_PARAMETER when PCRS are specified by a TPM_PCR_INFO structure. Using a TPM_PCR_INFO_LONG structure to specify PCRs succeeds, so update to use that. This also requires changes to use TPM_STORED_DATA12 for the result. Signed-off-by: Jason Andryuk Acked-by: Daniel De Graaf --- stubdom/vtpmmgr/disk_tpm.c | 52 +++++++++++++++++++-------- stubdom/vtpmmgr/marshal.h | 82 ++++++++++++++++++++++++++++++++++++++++++++ stubdom/vtpmmgr/tcg.h | 42 ++++++++++++++++++++++ stubdom/vtpmmgr/tpm.c | 22 ++++++----- stubdom/vtpmmgr/tpm.h | 8 ++-- 5 files changed, 176 insertions(+), 30 deletions(-) diff --git a/stubdom/vtpmmgr/disk_tpm.c b/stubdom/vtpmmgr/disk_tpm.c index 6f5d556..a9f4552 100644 --- a/stubdom/vtpmmgr/disk_tpm.c +++ b/stubdom/vtpmmgr/disk_tpm.c @@ -74,12 +74,15 @@ void TPM_pcr_digest(struct hash160 *buf, le32_t selection) int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) { uint32_t rc; - TPM_PCR_INFO info; - TPM_STORED_DATA out; + uint32_t infoSize; + TPM_PCR_INFO_LONG info; + TPM_STORED_DATA12 out; TPM_AUTH_SESSION osap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA sharedsecret; TPM_AUTHDATA auth; + printk("Calling TPM_disk_seal\n"); + rc = TPM_OSAP(TPM_ET_KEYHANDLE, TPM_SRK_KEYHANDLE, (void*)&vtpm_globals.srk_auth, &sharedsecret, &osap); @@ -94,18 +97,26 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #endif memset(auth, 0, 20); - info.pcrSelection.sizeOfSelect = 3; - info.pcrSelection.pcrSelect = (void*)&dst->pcr_selection; + info.tag = TPM_TAG_PCR_INFO_LONG; + info.localityAtCreation = 1 << vtpm_globals.hw_locality; + info.localityAtRelease = 1 << vtpm_globals.hw_locality; + info.creationPCRSelection.sizeOfSelect = 3; + info.creationPCRSelection.pcrSelect = (void*)&dst->pcr_selection; + info.releasePCRSelection.sizeOfSelect = 3; + info.releasePCRSelection.pcrSelect = (void*)&dst->pcr_selection; memcpy(&info.digestAtCreation, &dst->digest_at_seal, 20); memcpy(&info.digestAtRelease, &dst->digest_release, 20); - rc = TPM_Seal(TPM_SRK_KEYHANDLE, 45, &info, size, src, &out, + infoSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + //infoSize = sizeof_TPM_PCR_INFO_LONG(&info); + + rc = TPM_Seal(TPM_SRK_KEYHANDLE, infoSize, &info, size, src, &out, (void*)&sharedsecret, (void*)&auth, &osap); TPM_TerminateHandle(osap.AuthHandle); #ifdef DEBUG_SEAL_OPS - printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoSize); + printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoLongSize); #endif if (!rc) memcpy(dst->sealed_data, out.encData, 256); @@ -113,7 +124,7 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &out); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &out); printk("stored_data:"); while (start != end) { printk(" %02x", *start); @@ -122,37 +133,46 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) printk("\n"); #endif - free_TPM_STORED_DATA(&out); + free_TPM_STORED_DATA12(&out); return rc; } int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src) { uint32_t rc; - TPM_STORED_DATA in; + TPM_STORED_DATA12 in; TPM_AUTH_SESSION oiap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA auth; uint32_t outSize = 0; uint8_t *out = NULL; + printk("Calling TPM_disk_unseal\n"); + rc = TPM_OIAP(&oiap); if (rc) abort(); memset(auth, 0, 20); - in.ver = TPM_STRUCT_VER_1_1; - in.sealInfoSize = 45; - in.sealInfo.pcrSelection.sizeOfSelect = 3; - in.sealInfo.pcrSelection.pcrSelect = (void*)&src->pcr_selection; - memcpy(&in.sealInfo.digestAtCreation, &src->digest_at_seal, 20); - memcpy(&in.sealInfo.digestAtRelease, &src->digest_release, 20); + in.tag = TPM_TAG_STORED_DATA12; + in.et = 0; + //in.sealInfoLongSize = sizeof_TPM_PCR_INFO_LONG(&in.sealInfoLong); + in.sealInfoLongSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + in.sealInfoLong.tag = TPM_TAG_PCR_INFO_LONG; + in.sealInfoLong.localityAtCreation = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.localityAtRelease = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.creationPCRSelection.sizeOfSelect = 3; + in.sealInfoLong.creationPCRSelection.pcrSelect = (void*)&src->pcr_selection; + in.sealInfoLong.releasePCRSelection.sizeOfSelect = 3; + in.sealInfoLong.releasePCRSelection.pcrSelect = (void*)&src->pcr_selection; + memcpy(&in.sealInfoLong.digestAtCreation, &src->digest_at_seal, 20); + memcpy(&in.sealInfoLong.digestAtRelease, &src->digest_release, 20); in.encDataSize = 256; in.encData = (void*)src->sealed_data; #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &in); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &in); printk("stored_data:"); while (start != end) { printk(" %02x", *start); diff --git a/stubdom/vtpmmgr/marshal.h b/stubdom/vtpmmgr/marshal.h index ef54272..bcc7c46 100644 --- a/stubdom/vtpmmgr/marshal.h +++ b/stubdom/vtpmmgr/marshal.h @@ -142,6 +142,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define pack_TPM_MIGRATE_SCHEME(p, t) pack_UINT16(p, t) #define pack_TPM_PHYSICAL_PRESENCE(p, t) pack_UINT16(p, t) #define pack_TPM_KEY_FLAGS(p, t) pack_UINT32(p, t) +#define pack_TPM_LOCALITY_SELECTION(p, t) pack_BYTE(p, t) #define unpack_TPM_RESULT(p, t) unpack_UINT32(p, t) #define unpack_TPM_PCRINDEX(p, t) unpack_UINT32(p, t) @@ -167,6 +168,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack_TPM_MIGRATE_SCHEME(p, t) unpack_UINT16(p, t) #define unpack_TPM_PHYSICAL_PRESENCE(p, t) unpack_UINT16(p, t) #define unpack_TPM_KEY_FLAGS(p, t) unpack_UINT32(p, t) +#define unpack_TPM_LOCALITY_SELECTION(p, t) unpack_BYTE(p, t) #define unpack3_TPM_RESULT(p, l, m, t) unpack3_UINT32(p, l, m, t) #define unpack3_TPM_PCRINDEX(p, l, m, t) unpack3_UINT32(p, l, m, t) @@ -192,6 +194,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack3_TPM_MIGRATE_SCHEME(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_PHYSICAL_PRESENCE(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_KEY_FLAGS(p, l, m, t) unpack3_UINT32(p, l, m, t) +#define unpack3_TPM_LOCALITY_SELECTION(p, l, m, t) unpack3_BYTE(p, l, m, t) #define sizeof_TPM_RESULT(t) sizeof_UINT32(t) #define sizeof_TPM_PCRINDEX(t) sizeof_UINT32(t) @@ -217,6 +220,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define sizeof_TPM_MIGRATE_SCHEME(t) sizeof_UINT16(t) #define sizeof_TPM_PHYSICAL_PRESENCE(t) sizeof_UINT16(t) #define sizeof_TPM_KEY_FLAGS(t) sizeof_UINT32(t) +#define sizeof_TPM_LOCALITY_SELECTION(t) sizeof_BYTE(t) #define pack_TPM_AUTH_HANDLE(p, t) pack_UINT32(p, t) #define pack_TCS_CONTEXT_HANDLE(p, t) pack_UINT32(p, t) @@ -312,6 +316,7 @@ inline int unpack3_TPM_AUTHDATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTHDATA #define unpack_TPM_PAYLOAD_TYPE(p, t) unpack_BYTE(p, t) #define unpack_TPM_TAG(p, t) unpack_UINT16(p, t) #define unpack_TPM_STRUCTURE_TAG(p, t) unpack_UINT16(p, t) +#define unpack3_TPM_STRUCTURE_TAG(p, l, m, t) unpack3_UINT16(p, l, m, t) #define sizeof_TPM_SECRET(t) sizeof_TPM_AUTHDATA(t) #define sizeof_TPM_ENCAUTH(t) sizeof_TPM_AUTHDATA(t) @@ -593,6 +598,43 @@ inline int sizeof_TPM_PCR_INFO(const TPM_PCR_INFO* p) { return rc; } +inline BYTE* pack_TPM_PCR_INFO_LONG(BYTE* ptr, const TPM_PCR_INFO_LONG* p) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, p->tag); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtCreation); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtRelease); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->creationPCRSelection); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->releasePCRSelection); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtCreation); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtRelease); + return ptr; +} + +inline int sizeof_TPM_PCR_INFO_LONG(const TPM_PCR_INFO_LONG* p) { + int rc = 0; + rc += sizeof_TPM_STRUCTURE_TAG(p->tag); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtCreation); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtRelease); + rc += sizeof_TPM_PCR_SELECTION(&p->creationPCRSelection); + rc += sizeof_TPM_PCR_SELECTION(&p->releasePCRSelection); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtCreation); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtRelease); + return rc; +} + +inline int unpack3_TPM_PCR_INFO_LONG(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_INFO_LONG* p, UnpackPtr alloc) { + return unpack3_TPM_STRUCTURE_TAG(ptr, pos, max, &p->tag) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtCreation) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtRelease) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->creationPCRSelection, alloc) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->releasePCRSelection, alloc) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, + &p->digestAtCreation) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtRelease); +} inline BYTE* pack_TPM_PCR_COMPOSITE(BYTE* ptr, const TPM_PCR_COMPOSITE* p) { ptr = pack_TPM_PCR_SELECTION(ptr, &p->select); @@ -703,6 +745,46 @@ inline int unpack3_TPM_STORED_DATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORE return rc; } +inline BYTE* pack_TPM_STORED_DATA12(BYTE* ptr, const TPM_STORED_DATA12* d) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, d->tag); + ptr = pack_TPM_ENTITY_TYPE(ptr, d->et); + ptr = pack_UINT32(ptr, d->sealInfoLongSize); + if(d->sealInfoLongSize) { + ptr = pack_TPM_PCR_INFO_LONG(ptr, &d->sealInfoLong); + } + ptr = pack_UINT32(ptr, d->encDataSize); + ptr = pack_BUFFER(ptr, d->encData, d->encDataSize); + return ptr; +} + +inline int sizeof_TPM_STORED_DATA12(const TPM_STORED_DATA12* d) { + int rv = sizeof_TPM_STRUCTURE_TAG(&d->ver) + + sizeof_TPM_ENTITY_TYPE(&d->et) + + sizeof_UINT32(d->sealInfoLongSize); + if (d->sealInfoLongSize) { + rv += sizeof_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + rv += sizeof_UINT32(d->encDataSize); + rv += sizeof_BUFFER(d->encData, d->encDataSize); + return rv; +} + +inline int unpack3_TPM_STORED_DATA12(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORED_DATA12* d, UnpackPtr alloc) { + int rc = unpack3_TPM_STRUCTURE_TAG(ptr, pos, len, &d->tag) || + unpack3_TPM_ENTITY_TYPE(ptr, pos, len, &d->et) || + unpack3_UINT32(ptr, pos, len, &d->sealInfoLongSize); + if (rc) + return rc; + if (d->sealInfoLongSize) + rc = unpack3_TPM_PCR_INFO_LONG(ptr, pos, len, &d->sealInfoLong, + alloc); + if (rc) + return rc; + rc = unpack3_UINT32(ptr, pos, len, &d->encDataSize) || + unpack3_PTR(ptr, pos, len, &d->encData, d->encDataSize, alloc); + return rc; +} + inline BYTE* pack_TPM_AUTH_SESSION(BYTE* ptr, const TPM_AUTH_SESSION* auth) { ptr = pack_TPM_AUTH_HANDLE(ptr, auth->AuthHandle); ptr = pack_TPM_NONCE(ptr, &auth->NonceOdd); diff --git a/stubdom/vtpmmgr/tcg.h b/stubdom/vtpmmgr/tcg.h index f4c8bc0..7321ec6 100644 --- a/stubdom/vtpmmgr/tcg.h +++ b/stubdom/vtpmmgr/tcg.h @@ -259,6 +259,8 @@ #define TPM_ST_DEACTIVATED 0x003 // TPM_TAG values +#define TPM_TAG_PCR_INFO_LONG 0x0006 +#define TPM_TAG_STORED_DATA12 0x0016 #define TPM_TAG_RQU_COMMAND 0x00c1 #define TPM_TAG_RQU_AUTH1_COMMAND 0x00c2 #define TPM_TAG_RQU_AUTH2_COMMAND 0x00c3 @@ -582,6 +584,26 @@ inline void free_TPM_PCR_SELECTION(TPM_PCR_SELECTION* p) { p->pcrSelect = NULL; } +#define TPM_LOCALITY_SELECTION BYTE + +typedef struct TPM_PCR_INFO_LONG { + TPM_STRUCTURE_TAG tag; + TPM_LOCALITY_SELECTION localityAtCreation; + TPM_LOCALITY_SELECTION localityAtRelease; + TPM_PCR_SELECTION creationPCRSelection; + TPM_PCR_SELECTION releasePCRSelection; + TPM_COMPOSITE_HASH digestAtCreation; + TPM_COMPOSITE_HASH digestAtRelease; +} TPM_PCR_INFO_LONG; + +#define TPM_PCR_INFO_LONG_INIT { 0, 0, 0, TPM_PCR_SELECTION_INIT, \ + TPM_PCR_SELECTION_INIT } + +inline void free_TPM_PCR_INFO_LONG(TPM_PCR_INFO_LONG* p) { + free_TPM_PCR_SELECTION(&p->creationPCRSelection); + free_TPM_PCR_SELECTION(&p->releasePCRSelection); +} + typedef struct TPM_PCR_INFO { TPM_PCR_SELECTION pcrSelection; TPM_COMPOSITE_HASH digestAtRelease; @@ -667,6 +689,26 @@ inline void free_TPM_STORED_DATA(TPM_STORED_DATA* d) { d->encData = NULL; } +typedef struct TPM_STORED_DATA12 { + TPM_STRUCTURE_TAG tag; + TPM_ENTITY_TYPE et; + UINT32 sealInfoLongSize; + TPM_PCR_INFO_LONG sealInfoLong; + UINT32 encDataSize; + BYTE* encData; +} TPM_STORED_DATA12; + +#define TPM_STORED_DATA12_INIT { .sealInfoLongSize = 0, \ + sealInfoLong = TPM_PCR_INFO_INIT, .encDataSize = 0, .encData = NULL } + +inline void free_TPM_STORED_DATA12(TPM_STORED_DATA12* d) { + if(d->sealInfoLongSize) { + free_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + free(d->encData); + d->encData = NULL; +} + typedef struct TPM_AUTH_SESSION { TPM_AUTHHANDLE AuthHandle; TPM_NONCE NonceOdd; // system diff --git a/stubdom/vtpmmgr/tpm.c b/stubdom/vtpmmgr/tpm.c index 0548e5c..779cddd 100644 --- a/stubdom/vtpmmgr/tpm.c +++ b/stubdom/vtpmmgr/tpm.c @@ -492,11 +492,11 @@ abort_egress: TPM_RESULT TPM_Seal( TPM_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealedDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -509,28 +509,30 @@ TPM_RESULT TPM_Seal( xorEncrypt(osapSharedSecret, &pubAuth->NonceEven, sealedDataAuth, IN_PTR, NULL, NULL); in_pos += sizeof(TPM_ENCAUTH); - PACK_IN(UINT32, pcrInfoSize); - if (pcrInfoSize) - PACK_IN(TPM_PCR_INFO, pcrInfo); + + PACK_IN(UINT32, pcrInfoLongSize); + if (pcrInfoLongSize) { + PACK_IN(TPM_PCR_INFO_LONG, pcrInfoLong); + } PACK_IN(UINT32, inDataSize); PACK_IN(BUFFER, inData, inDataSize); TPM_XMIT_AUTH1(osapSharedSecret, pubAuth); - UNPACK_OUT(TPM_STORED_DATA, sealedData, UNPACK_ALLOC); + UNPACK_OUT(TPM_STORED_DATA12, sealedData, UNPACK_ALLOC); TPM_END_AUTH1(osapSharedSecret, pubAuth); abort_egress: if (status) - free_TPM_STORED_DATA(sealedData); + free_TPM_STORED_DATA12(sealedData); TPM_AUTH_ERR_CHECK(pubAuth); return status; } TPM_RESULT TPM_Unseal( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in @@ -544,7 +546,7 @@ TPM_RESULT TPM_Unseal( PACK_IN(TPM_KEY_HANDLE, parentHandle); TPM_HASH_IN_BEGIN; - PACK_IN(TPM_STORED_DATA, sealedData); + PACK_IN(TPM_STORED_DATA12, sealedData); TPM_XMIT_AUTH2(key_usage_auth, keyAuth, data_usage_auth, dataAuth); diff --git a/stubdom/vtpmmgr/tpm.h b/stubdom/vtpmmgr/tpm.h index 2161976..d613eb3 100644 --- a/stubdom/vtpmmgr/tpm.h +++ b/stubdom/vtpmmgr/tpm.h @@ -88,11 +88,11 @@ TPM_RESULT TPM_Reset(TPM_PCR_SELECTION *sel); TPM_RESULT TPM_Seal( TCS_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -100,7 +100,7 @@ TPM_RESULT TPM_Seal( TPM_RESULT TPM_Unseal ( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:07 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvH-00016w-AS; Thu, 01 May 2014 06:56:47 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvF-00016Y-VA for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:46 +0000 Received: from [85.158.143.35:42620] by server-1.bemta-4.messagelabs.com id 9F/DD-09853-D20F1635; Thu, 01 May 2014 06:56:45 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-6.tower-21.messagelabs.com!1398927402!2164426!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests=UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 16138 invoked from network); 1 May 2014 06:56:43 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-6.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:43 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvC-0001os-NZ for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:42 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvC-0004tW-LU for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:42 +0000 Date: Thu, 01 May 2014 06:56:42 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 2c8a51eebeb54c49eecec97ffacf393145738284 Author: Jason Andryuk AuthorDate: Mon Apr 21 13:23:00 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG Infineon 1.2 TPMs fail TPM_Seal commands with TPM_BAD_PARAMETER when PCRS are specified by a TPM_PCR_INFO structure. Using a TPM_PCR_INFO_LONG structure to specify PCRs succeeds, so update to use that. This also requires changes to use TPM_STORED_DATA12 for the result. Signed-off-by: Jason Andryuk Acked-by: Daniel De Graaf --- stubdom/vtpmmgr/disk_tpm.c | 52 +++++++++++++++++++-------- stubdom/vtpmmgr/marshal.h | 82 ++++++++++++++++++++++++++++++++++++++++++++ stubdom/vtpmmgr/tcg.h | 42 ++++++++++++++++++++++ stubdom/vtpmmgr/tpm.c | 22 ++++++----- stubdom/vtpmmgr/tpm.h | 8 ++-- 5 files changed, 176 insertions(+), 30 deletions(-) diff --git a/stubdom/vtpmmgr/disk_tpm.c b/stubdom/vtpmmgr/disk_tpm.c index 6f5d556..a9f4552 100644 --- a/stubdom/vtpmmgr/disk_tpm.c +++ b/stubdom/vtpmmgr/disk_tpm.c @@ -74,12 +74,15 @@ void TPM_pcr_digest(struct hash160 *buf, le32_t selection) int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) { uint32_t rc; - TPM_PCR_INFO info; - TPM_STORED_DATA out; + uint32_t infoSize; + TPM_PCR_INFO_LONG info; + TPM_STORED_DATA12 out; TPM_AUTH_SESSION osap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA sharedsecret; TPM_AUTHDATA auth; + printk("Calling TPM_disk_seal\n"); + rc = TPM_OSAP(TPM_ET_KEYHANDLE, TPM_SRK_KEYHANDLE, (void*)&vtpm_globals.srk_auth, &sharedsecret, &osap); @@ -94,18 +97,26 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #endif memset(auth, 0, 20); - info.pcrSelection.sizeOfSelect = 3; - info.pcrSelection.pcrSelect = (void*)&dst->pcr_selection; + info.tag = TPM_TAG_PCR_INFO_LONG; + info.localityAtCreation = 1 << vtpm_globals.hw_locality; + info.localityAtRelease = 1 << vtpm_globals.hw_locality; + info.creationPCRSelection.sizeOfSelect = 3; + info.creationPCRSelection.pcrSelect = (void*)&dst->pcr_selection; + info.releasePCRSelection.sizeOfSelect = 3; + info.releasePCRSelection.pcrSelect = (void*)&dst->pcr_selection; memcpy(&info.digestAtCreation, &dst->digest_at_seal, 20); memcpy(&info.digestAtRelease, &dst->digest_release, 20); - rc = TPM_Seal(TPM_SRK_KEYHANDLE, 45, &info, size, src, &out, + infoSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + //infoSize = sizeof_TPM_PCR_INFO_LONG(&info); + + rc = TPM_Seal(TPM_SRK_KEYHANDLE, infoSize, &info, size, src, &out, (void*)&sharedsecret, (void*)&auth, &osap); TPM_TerminateHandle(osap.AuthHandle); #ifdef DEBUG_SEAL_OPS - printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoSize); + printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoLongSize); #endif if (!rc) memcpy(dst->sealed_data, out.encData, 256); @@ -113,7 +124,7 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &out); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &out); printk("stored_data:"); while (start != end) { printk(" %02x", *start); @@ -122,37 +133,46 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) printk("\n"); #endif - free_TPM_STORED_DATA(&out); + free_TPM_STORED_DATA12(&out); return rc; } int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src) { uint32_t rc; - TPM_STORED_DATA in; + TPM_STORED_DATA12 in; TPM_AUTH_SESSION oiap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA auth; uint32_t outSize = 0; uint8_t *out = NULL; + printk("Calling TPM_disk_unseal\n"); + rc = TPM_OIAP(&oiap); if (rc) abort(); memset(auth, 0, 20); - in.ver = TPM_STRUCT_VER_1_1; - in.sealInfoSize = 45; - in.sealInfo.pcrSelection.sizeOfSelect = 3; - in.sealInfo.pcrSelection.pcrSelect = (void*)&src->pcr_selection; - memcpy(&in.sealInfo.digestAtCreation, &src->digest_at_seal, 20); - memcpy(&in.sealInfo.digestAtRelease, &src->digest_release, 20); + in.tag = TPM_TAG_STORED_DATA12; + in.et = 0; + //in.sealInfoLongSize = sizeof_TPM_PCR_INFO_LONG(&in.sealInfoLong); + in.sealInfoLongSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + in.sealInfoLong.tag = TPM_TAG_PCR_INFO_LONG; + in.sealInfoLong.localityAtCreation = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.localityAtRelease = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.creationPCRSelection.sizeOfSelect = 3; + in.sealInfoLong.creationPCRSelection.pcrSelect = (void*)&src->pcr_selection; + in.sealInfoLong.releasePCRSelection.sizeOfSelect = 3; + in.sealInfoLong.releasePCRSelection.pcrSelect = (void*)&src->pcr_selection; + memcpy(&in.sealInfoLong.digestAtCreation, &src->digest_at_seal, 20); + memcpy(&in.sealInfoLong.digestAtRelease, &src->digest_release, 20); in.encDataSize = 256; in.encData = (void*)src->sealed_data; #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &in); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &in); printk("stored_data:"); while (start != end) { printk(" %02x", *start); diff --git a/stubdom/vtpmmgr/marshal.h b/stubdom/vtpmmgr/marshal.h index ef54272..bcc7c46 100644 --- a/stubdom/vtpmmgr/marshal.h +++ b/stubdom/vtpmmgr/marshal.h @@ -142,6 +142,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define pack_TPM_MIGRATE_SCHEME(p, t) pack_UINT16(p, t) #define pack_TPM_PHYSICAL_PRESENCE(p, t) pack_UINT16(p, t) #define pack_TPM_KEY_FLAGS(p, t) pack_UINT32(p, t) +#define pack_TPM_LOCALITY_SELECTION(p, t) pack_BYTE(p, t) #define unpack_TPM_RESULT(p, t) unpack_UINT32(p, t) #define unpack_TPM_PCRINDEX(p, t) unpack_UINT32(p, t) @@ -167,6 +168,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack_TPM_MIGRATE_SCHEME(p, t) unpack_UINT16(p, t) #define unpack_TPM_PHYSICAL_PRESENCE(p, t) unpack_UINT16(p, t) #define unpack_TPM_KEY_FLAGS(p, t) unpack_UINT32(p, t) +#define unpack_TPM_LOCALITY_SELECTION(p, t) unpack_BYTE(p, t) #define unpack3_TPM_RESULT(p, l, m, t) unpack3_UINT32(p, l, m, t) #define unpack3_TPM_PCRINDEX(p, l, m, t) unpack3_UINT32(p, l, m, t) @@ -192,6 +194,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack3_TPM_MIGRATE_SCHEME(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_PHYSICAL_PRESENCE(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_KEY_FLAGS(p, l, m, t) unpack3_UINT32(p, l, m, t) +#define unpack3_TPM_LOCALITY_SELECTION(p, l, m, t) unpack3_BYTE(p, l, m, t) #define sizeof_TPM_RESULT(t) sizeof_UINT32(t) #define sizeof_TPM_PCRINDEX(t) sizeof_UINT32(t) @@ -217,6 +220,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define sizeof_TPM_MIGRATE_SCHEME(t) sizeof_UINT16(t) #define sizeof_TPM_PHYSICAL_PRESENCE(t) sizeof_UINT16(t) #define sizeof_TPM_KEY_FLAGS(t) sizeof_UINT32(t) +#define sizeof_TPM_LOCALITY_SELECTION(t) sizeof_BYTE(t) #define pack_TPM_AUTH_HANDLE(p, t) pack_UINT32(p, t) #define pack_TCS_CONTEXT_HANDLE(p, t) pack_UINT32(p, t) @@ -312,6 +316,7 @@ inline int unpack3_TPM_AUTHDATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTHDATA #define unpack_TPM_PAYLOAD_TYPE(p, t) unpack_BYTE(p, t) #define unpack_TPM_TAG(p, t) unpack_UINT16(p, t) #define unpack_TPM_STRUCTURE_TAG(p, t) unpack_UINT16(p, t) +#define unpack3_TPM_STRUCTURE_TAG(p, l, m, t) unpack3_UINT16(p, l, m, t) #define sizeof_TPM_SECRET(t) sizeof_TPM_AUTHDATA(t) #define sizeof_TPM_ENCAUTH(t) sizeof_TPM_AUTHDATA(t) @@ -593,6 +598,43 @@ inline int sizeof_TPM_PCR_INFO(const TPM_PCR_INFO* p) { return rc; } +inline BYTE* pack_TPM_PCR_INFO_LONG(BYTE* ptr, const TPM_PCR_INFO_LONG* p) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, p->tag); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtCreation); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtRelease); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->creationPCRSelection); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->releasePCRSelection); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtCreation); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtRelease); + return ptr; +} + +inline int sizeof_TPM_PCR_INFO_LONG(const TPM_PCR_INFO_LONG* p) { + int rc = 0; + rc += sizeof_TPM_STRUCTURE_TAG(p->tag); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtCreation); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtRelease); + rc += sizeof_TPM_PCR_SELECTION(&p->creationPCRSelection); + rc += sizeof_TPM_PCR_SELECTION(&p->releasePCRSelection); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtCreation); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtRelease); + return rc; +} + +inline int unpack3_TPM_PCR_INFO_LONG(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_INFO_LONG* p, UnpackPtr alloc) { + return unpack3_TPM_STRUCTURE_TAG(ptr, pos, max, &p->tag) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtCreation) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtRelease) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->creationPCRSelection, alloc) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->releasePCRSelection, alloc) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, + &p->digestAtCreation) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtRelease); +} inline BYTE* pack_TPM_PCR_COMPOSITE(BYTE* ptr, const TPM_PCR_COMPOSITE* p) { ptr = pack_TPM_PCR_SELECTION(ptr, &p->select); @@ -703,6 +745,46 @@ inline int unpack3_TPM_STORED_DATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORE return rc; } +inline BYTE* pack_TPM_STORED_DATA12(BYTE* ptr, const TPM_STORED_DATA12* d) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, d->tag); + ptr = pack_TPM_ENTITY_TYPE(ptr, d->et); + ptr = pack_UINT32(ptr, d->sealInfoLongSize); + if(d->sealInfoLongSize) { + ptr = pack_TPM_PCR_INFO_LONG(ptr, &d->sealInfoLong); + } + ptr = pack_UINT32(ptr, d->encDataSize); + ptr = pack_BUFFER(ptr, d->encData, d->encDataSize); + return ptr; +} + +inline int sizeof_TPM_STORED_DATA12(const TPM_STORED_DATA12* d) { + int rv = sizeof_TPM_STRUCTURE_TAG(&d->ver) + + sizeof_TPM_ENTITY_TYPE(&d->et) + + sizeof_UINT32(d->sealInfoLongSize); + if (d->sealInfoLongSize) { + rv += sizeof_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + rv += sizeof_UINT32(d->encDataSize); + rv += sizeof_BUFFER(d->encData, d->encDataSize); + return rv; +} + +inline int unpack3_TPM_STORED_DATA12(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORED_DATA12* d, UnpackPtr alloc) { + int rc = unpack3_TPM_STRUCTURE_TAG(ptr, pos, len, &d->tag) || + unpack3_TPM_ENTITY_TYPE(ptr, pos, len, &d->et) || + unpack3_UINT32(ptr, pos, len, &d->sealInfoLongSize); + if (rc) + return rc; + if (d->sealInfoLongSize) + rc = unpack3_TPM_PCR_INFO_LONG(ptr, pos, len, &d->sealInfoLong, + alloc); + if (rc) + return rc; + rc = unpack3_UINT32(ptr, pos, len, &d->encDataSize) || + unpack3_PTR(ptr, pos, len, &d->encData, d->encDataSize, alloc); + return rc; +} + inline BYTE* pack_TPM_AUTH_SESSION(BYTE* ptr, const TPM_AUTH_SESSION* auth) { ptr = pack_TPM_AUTH_HANDLE(ptr, auth->AuthHandle); ptr = pack_TPM_NONCE(ptr, &auth->NonceOdd); diff --git a/stubdom/vtpmmgr/tcg.h b/stubdom/vtpmmgr/tcg.h index f4c8bc0..7321ec6 100644 --- a/stubdom/vtpmmgr/tcg.h +++ b/stubdom/vtpmmgr/tcg.h @@ -259,6 +259,8 @@ #define TPM_ST_DEACTIVATED 0x003 // TPM_TAG values +#define TPM_TAG_PCR_INFO_LONG 0x0006 +#define TPM_TAG_STORED_DATA12 0x0016 #define TPM_TAG_RQU_COMMAND 0x00c1 #define TPM_TAG_RQU_AUTH1_COMMAND 0x00c2 #define TPM_TAG_RQU_AUTH2_COMMAND 0x00c3 @@ -582,6 +584,26 @@ inline void free_TPM_PCR_SELECTION(TPM_PCR_SELECTION* p) { p->pcrSelect = NULL; } +#define TPM_LOCALITY_SELECTION BYTE + +typedef struct TPM_PCR_INFO_LONG { + TPM_STRUCTURE_TAG tag; + TPM_LOCALITY_SELECTION localityAtCreation; + TPM_LOCALITY_SELECTION localityAtRelease; + TPM_PCR_SELECTION creationPCRSelection; + TPM_PCR_SELECTION releasePCRSelection; + TPM_COMPOSITE_HASH digestAtCreation; + TPM_COMPOSITE_HASH digestAtRelease; +} TPM_PCR_INFO_LONG; + +#define TPM_PCR_INFO_LONG_INIT { 0, 0, 0, TPM_PCR_SELECTION_INIT, \ + TPM_PCR_SELECTION_INIT } + +inline void free_TPM_PCR_INFO_LONG(TPM_PCR_INFO_LONG* p) { + free_TPM_PCR_SELECTION(&p->creationPCRSelection); + free_TPM_PCR_SELECTION(&p->releasePCRSelection); +} + typedef struct TPM_PCR_INFO { TPM_PCR_SELECTION pcrSelection; TPM_COMPOSITE_HASH digestAtRelease; @@ -667,6 +689,26 @@ inline void free_TPM_STORED_DATA(TPM_STORED_DATA* d) { d->encData = NULL; } +typedef struct TPM_STORED_DATA12 { + TPM_STRUCTURE_TAG tag; + TPM_ENTITY_TYPE et; + UINT32 sealInfoLongSize; + TPM_PCR_INFO_LONG sealInfoLong; + UINT32 encDataSize; + BYTE* encData; +} TPM_STORED_DATA12; + +#define TPM_STORED_DATA12_INIT { .sealInfoLongSize = 0, \ + sealInfoLong = TPM_PCR_INFO_INIT, .encDataSize = 0, .encData = NULL } + +inline void free_TPM_STORED_DATA12(TPM_STORED_DATA12* d) { + if(d->sealInfoLongSize) { + free_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + free(d->encData); + d->encData = NULL; +} + typedef struct TPM_AUTH_SESSION { TPM_AUTHHANDLE AuthHandle; TPM_NONCE NonceOdd; // system diff --git a/stubdom/vtpmmgr/tpm.c b/stubdom/vtpmmgr/tpm.c index 0548e5c..779cddd 100644 --- a/stubdom/vtpmmgr/tpm.c +++ b/stubdom/vtpmmgr/tpm.c @@ -492,11 +492,11 @@ abort_egress: TPM_RESULT TPM_Seal( TPM_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealedDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -509,28 +509,30 @@ TPM_RESULT TPM_Seal( xorEncrypt(osapSharedSecret, &pubAuth->NonceEven, sealedDataAuth, IN_PTR, NULL, NULL); in_pos += sizeof(TPM_ENCAUTH); - PACK_IN(UINT32, pcrInfoSize); - if (pcrInfoSize) - PACK_IN(TPM_PCR_INFO, pcrInfo); + + PACK_IN(UINT32, pcrInfoLongSize); + if (pcrInfoLongSize) { + PACK_IN(TPM_PCR_INFO_LONG, pcrInfoLong); + } PACK_IN(UINT32, inDataSize); PACK_IN(BUFFER, inData, inDataSize); TPM_XMIT_AUTH1(osapSharedSecret, pubAuth); - UNPACK_OUT(TPM_STORED_DATA, sealedData, UNPACK_ALLOC); + UNPACK_OUT(TPM_STORED_DATA12, sealedData, UNPACK_ALLOC); TPM_END_AUTH1(osapSharedSecret, pubAuth); abort_egress: if (status) - free_TPM_STORED_DATA(sealedData); + free_TPM_STORED_DATA12(sealedData); TPM_AUTH_ERR_CHECK(pubAuth); return status; } TPM_RESULT TPM_Unseal( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in @@ -544,7 +546,7 @@ TPM_RESULT TPM_Unseal( PACK_IN(TPM_KEY_HANDLE, parentHandle); TPM_HASH_IN_BEGIN; - PACK_IN(TPM_STORED_DATA, sealedData); + PACK_IN(TPM_STORED_DATA12, sealedData); TPM_XMIT_AUTH2(key_usage_auth, keyAuth, data_usage_auth, dataAuth); diff --git a/stubdom/vtpmmgr/tpm.h b/stubdom/vtpmmgr/tpm.h index 2161976..d613eb3 100644 --- a/stubdom/vtpmmgr/tpm.h +++ b/stubdom/vtpmmgr/tpm.h @@ -88,11 +88,11 @@ TPM_RESULT TPM_Reset(TPM_PCR_SELECTION *sel); TPM_RESULT TPM_Seal( TCS_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -100,7 +100,7 @@ TPM_RESULT TPM_Seal( TPM_RESULT TPM_Unseal ( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv7-000153-7Q; Thu, 01 May 2014 06:56:37 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv5-00014c-GR for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:35 +0000 Received: from [193.109.254.147:38498] by server-2.bemta-14.messagelabs.com id FA/3B-21684-220F1635; Thu, 01 May 2014 06:56:34 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-4.tower-27.messagelabs.com!1398927392!2013324!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 21918 invoked from network); 1 May 2014 06:56:33 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-4.tower-27.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:33 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv2-0001oj-IG for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:32 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkv2-0004t4-DB for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:32 +0000 Date: Thu, 01 May 2014 06:56:32 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: Store hardware TPM Locality X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit d426026701b3a74bbd2776a5c45c265e7775773e Author: Jason Andryuk AuthorDate: Mon Apr 21 13:22:59 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpmmgr: Store hardware TPM Locality The TPM locality must be specified when using TPM_PCR_INFO_LONG for TPM_Seal. Store the locality so it can be provided later. Signed-off-by: Jason Andryuk Acked-by: Daniel De Graaf --- stubdom/vtpmmgr/init.c | 4 +++- stubdom/vtpmmgr/vtpmmgr.h | 2 ++ 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/stubdom/vtpmmgr/init.c b/stubdom/vtpmmgr/init.c index 89643e7..c35ab8f 100644 --- a/stubdom/vtpmmgr/init.c +++ b/stubdom/vtpmmgr/init.c @@ -69,7 +69,8 @@ const TPM_AUTHDATA WELLKNOWN_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0 struct vtpm_globals vtpm_globals = { .tpm_fd = -1, - .oiap = { .AuthHandle = 0 } + .oiap = { .AuthHandle = 0 }, + .hw_locality = 0 }; static int tpm_entropy_source(void* dummy, unsigned char* data, size_t len, size_t* olen) { @@ -436,6 +437,7 @@ TPM_RESULT vtpmmgr_init(int argc, char** argv) { } vtpm_globals.tpm_fd = tpm_tis_open(tpm); tpm_tis_request_locality(tpm, opts.tpmlocality); + vtpm_globals.hw_locality = opts.tpmlocality; } break; case TPMDRV_TPMFRONT: diff --git a/stubdom/vtpmmgr/vtpmmgr.h b/stubdom/vtpmmgr/vtpmmgr.h index cf2b962..68edd4c 100644 --- a/stubdom/vtpmmgr/vtpmmgr.h +++ b/stubdom/vtpmmgr/vtpmmgr.h @@ -57,6 +57,8 @@ struct vtpm_globals { entropy_context entropy; ctr_drbg_context ctr_drbg; + + int hw_locality; }; struct tpm_opaque { -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvR-00018m-F1; Thu, 01 May 2014 06:56:57 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvP-00018S-FL for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:55 +0000 Received: from [85.158.139.211:28980] by server-9.bemta-5.messagelabs.com id 8E/FA-04350-630F1635; Thu, 01 May 2014 06:56:54 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-8.tower-206.messagelabs.com!1398927413!1656293!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 21323 invoked from network); 1 May 2014 06:56:54 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-8.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:54 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvM-0001p2-T0 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:52 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvM-0004ts-R8 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:52 +0000 Date: Thu, 01 May 2014 06:56:52 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: passthru requests to manager X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit c1fe4dcf3f9b2641b668d912d2894e9df9096538 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:01 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpm: passthru requests to manager When sending commands to a vTPM, commands with the VTPM_TAG_REQ2 tag are passed directly to the TPM Manager since they are used in the management interface to the TPM Manager. The VTPM_TAG_REQ tag is translated to TPM_TAG_RQU_COMMAND to allow access to the physical TPM for certain ordinals (PCRRead, Extend, and GetRandom). Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/vtpm/vtpm.c | 40 +++++++++++++++++++++++++++++++++++++++- 1 files changed, 39 insertions(+), 1 deletions(-) diff --git a/stubdom/vtpm/vtpm.c b/stubdom/vtpm/vtpm.c index f67de18..61982c2 100644 --- a/stubdom/vtpm/vtpm.c +++ b/stubdom/vtpm/vtpm.c @@ -33,6 +33,7 @@ #include "vtpm_cmd.h" #include "vtpm_pcrs.h" #include "vtpmblk.h" +#include "vtpm_manager.h" #define TPM_LOG_INFO LOG_INFO #define TPM_LOG_ERROR LOG_ERR @@ -117,6 +118,40 @@ int init_random(void) { return 0; } +int check_passthru(tpmcmd_t* tpmcmd) { + TPM_TAG tag; + UINT32 len = 10; + BYTE* ptr; + size_t size; + + if(tpmcmd->req_len < 10) { + return false; + } + + ptr = tpmcmd->req; + tpm_unmarshal_UINT16(&ptr, &len, &tag); + + if (tag == VTPM_TAG_REQ2) { + info("VTPM passthru: %d bytes", (int)tpmcmd->req_len); + tpmfront_cmd(tpmfront_dev, tpmcmd->req, tpmcmd->req_len, &tpmcmd->resp, &size); + tpmcmd->resp_len = size; + info("VTPM passthru return: %d bytes", (int)size); + return true; + } + + if (tag == VTPM_TAG_REQ) { + info("VTPM pTPM-cmd: %d bytes", (int)tpmcmd->req_len); + ptr = tpmcmd->req; + tpm_marshal_UINT16(&ptr, &len, TPM_TAG_RQU_COMMAND); + tpmfront_cmd(tpmfront_dev, tpmcmd->req, tpmcmd->req_len, &tpmcmd->resp, &size); + tpmcmd->resp_len = size; + info("VTPM pTPM-cmd return: %d bytes", (int)size); + return true; + } + + return false; +} + int check_ordinal(tpmcmd_t* tpmcmd) { TPM_COMMAND_CODE ord; UINT32 len = 4; @@ -209,6 +244,9 @@ static void main_loop(void) { error("Invalid locality (%d) for client in tpm_handle_command", tpmcmd->locality); create_error_response(tpmcmd, TPM_FAIL); } + /* Check for TPM Manager passthrough command */ + else if(check_passthru(tpmcmd)) { + } /* Check for disabled ordinals */ else if(!check_ordinal(tpmcmd)) { create_error_response(tpmcmd, TPM_BAD_ORDINAL); @@ -231,7 +269,7 @@ static void main_loop(void) { } abort_postpcrs: - info("VTPM Shutting down\n"); + info("VTPM Shutting down"); tpm_emulator_shutdown(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvb-0001AK-Hk; Thu, 01 May 2014 06:57:07 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvZ-00019x-Vs for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:06 +0000 Received: from [85.158.143.35:43575] by server-3.bemta-4.messagelabs.com id 54/00-13602-140F1635; Thu, 01 May 2014 06:57:05 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-15.tower-21.messagelabs.com!1398927423!2148301!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9983 invoked from network); 1 May 2014 06:57:04 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-15.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:57:04 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvX-0001pY-32 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:03 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvW-0004uO-W7 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:03 +0000 Date: Thu, 01 May 2014 06:57:02 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: add ordinal for obtaining an EK signature X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit d4ea6ab10f35f98a15ccc612f2235198bb733412 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:02 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpm: add ordinal for obtaining an EK signature For a vTPM to be useful for remote attestation, proof that the vTPM's EK was generated and held within a secure vTPM implementation is necessary. This patch adds an ordinal to the vTPM which will request a quote providing this evidence from the TPM Manager; it only functions during the first startup of a given vTPM in order to provide proof that the EK was freshly generated (and not a key whose private part is available elsewhere). Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/Makefile | 1 + stubdom/vtpm-parent-sign-ek.patch | 196 +++++++++++++++++++++++++++++++++++++ stubdom/vtpm/vtpm_cmd.c | 45 +++++++++ 3 files changed, 242 insertions(+), 0 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index b1822b7..3e5f054 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -208,6 +208,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz patch -d $@ -p1 < tpmemu-$(TPMEMU_VERSION).patch; patch -d $@ -p1 < vtpm-bufsize.patch patch -d $@ -p1 < vtpm-locality.patch + patch -d $@ -p1 < vtpm-parent-sign-ek.patch mkdir $@/build cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement" touch $@ diff --git a/stubdom/vtpm-parent-sign-ek.patch b/stubdom/vtpm-parent-sign-ek.patch new file mode 100644 index 0000000..14e66ee --- /dev/null +++ b/stubdom/vtpm-parent-sign-ek.patch @@ -0,0 +1,196 @@ +diff --git a/tpm/tpm_cmd_handler.c b/tpm/tpm_cmd_handler.c +index 9e1cfb4..0fabf98 100644 +--- a/tpm/tpm_cmd_handler.c ++++ b/tpm/tpm_cmd_handler.c +@@ -3312,6 +3312,37 @@ static TPM_RESULT execute_TPM_OwnerReadPubek(TPM_REQUEST *req, TPM_RESPONSE *rsp + return res; + } + ++static TPM_RESULT execute_TPM_ParentSignEK(TPM_REQUEST *req, TPM_RESPONSE *rsp) ++{ ++ TPM_NONCE nonce; ++ TPM_RESULT res; ++ UINT32 sigSize; ++ BYTE *sig; ++ BYTE *ptr; ++ UINT32 len; ++ TPM_PCR_SELECTION targetPCR; ++ ++ tpm_compute_in_param_digest(req); ++ ++ ptr = req->param; ++ len = req->paramSize; ++ if (tpm_unmarshal_TPM_NONCE(&ptr, &len, &nonce) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &targetPCR) ++ || len != 0) return TPM_BAD_PARAMETER; ++ ++ res = TPM_ParentSignEK(&nonce, &targetPCR, &req->auth1, &sigSize, &sig); ++ if (res != TPM_SUCCESS) return res; ++ rsp->paramSize = len = sigSize; ++ rsp->param = ptr = tpm_malloc(len); ++ if (ptr == NULL || tpm_marshal_BLOB(&ptr, &len, sig, sigSize)) { ++ tpm_free(rsp->param); ++ res = TPM_FAIL; ++ } ++ tpm_free(sig); ++ ++ return res; ++} ++ + static void tpm_setup_rsp_auth(TPM_COMMAND_CODE ordinal, TPM_RESPONSE *rsp) + { + tpm_hmac_ctx_t hmac; +@@ -4062,6 +4093,11 @@ void tpm_execute_command(TPM_REQUEST *req, TPM_RESPONSE *rsp) + res = execute_TPM_OwnerReadPubek(req, rsp); + break; + ++ case TPM_ORD_ParentSignEK: ++ debug("[TPM_ORD_ParentSignEK]"); ++ res = execute_TPM_ParentSignEK(req, rsp); ++ break; ++ + default: + #ifdef MTM_EMULATOR + res = mtm_execute_command(req, rsp); +diff --git a/tpm/tpm_commands.h b/tpm/tpm_commands.h +index a7666f6..7fef934 100644 +--- a/tpm/tpm_commands.h ++++ b/tpm/tpm_commands.h +@@ -3054,6 +3054,23 @@ TPM_RESULT TPM_OwnerReadPubek( + TPM_PUBKEY *pubEndorsementKey + ); + ++/** ++ * TPM_ParentSignEK - gets a hardware TPM quote of a vTPM's EK ++ * @externalData: [in] AntiReplay nonce to prevent replay of messages ++ * @sel: [in] PCR selection for the hardware TPM's quote ++ * @auth1: [in, out] Authorization protocol parameters ++ * @sigSize: [out] The length of the returned digital signature ++ * @sig: [out] The resulting digital signature and PCR values ++ * Returns: TPM_SUCCESS on success, a TPM error code otherwise. ++ */ ++TPM_RESULT TPM_ParentSignEK( ++ TPM_NONCE *externalData, ++ TPM_PCR_SELECTION *sel, ++ TPM_AUTH *auth1, ++ UINT32 *sigSize, ++ BYTE **sig ++); ++ + /* + * Error handling + * [tpm_error.c] +diff --git a/tpm/tpm_credentials.c b/tpm/tpm_credentials.c +index 9cd64af..01f29e6 100644 +--- a/tpm/tpm_credentials.c ++++ b/tpm/tpm_credentials.c +@@ -180,3 +180,34 @@ TPM_RESULT TPM_OwnerReadInternalPub(TPM_KEY_HANDLE keyHandle, TPM_AUTH *auth1, + return TPM_BAD_PARAMETER; + } + } ++ ++int endorsementKeyFresh = 0; ++ ++TPM_RESULT VTPM_GetParentQuote(TPM_DIGEST* data, TPM_PCR_SELECTION *sel, UINT32 *sigSize, BYTE **sig); ++ ++TPM_RESULT TPM_ParentSignEK(TPM_NONCE *externalData, TPM_PCR_SELECTION *sel, ++ TPM_AUTH *auth1, UINT32 *sigSize, BYTE **sig) ++{ ++ TPM_PUBKEY pubKey; ++ TPM_RESULT res; ++ TPM_DIGEST hres; ++ ++ info("TPM_ParentSignEK()"); ++ ++ res = tpm_verify_auth(auth1, tpmData.permanent.data.ownerAuth, TPM_KH_OWNER); ++ if (res != TPM_SUCCESS) return res; ++ ++ if (!endorsementKeyFresh) return TPM_DISABLED_CMD; ++ ++ res = tpm_get_pubek(&pubKey); ++ if (res != TPM_SUCCESS) return res; ++ ++ if (tpm_compute_pubkey_checksum(externalData, &pubKey, &hres)) ++ res = TPM_FAIL; ++ ++ if (res == TPM_SUCCESS) ++ res = VTPM_GetParentQuote(&hres, sel, sigSize, sig); ++ ++ free_TPM_PUBKEY(pubKey); ++ return res; ++} +diff --git a/tpm/tpm_data.c b/tpm/tpm_data.c +index 50c9697..6a0c499 100644 +--- a/tpm/tpm_data.c ++++ b/tpm/tpm_data.c +@@ -76,6 +76,8 @@ static void init_timeouts(void) + tpmData.permanent.data.cmd_durations[2] = 1000; + } + ++extern int endorsementKeyFresh; ++ + void tpm_init_data(void) + { + /* endorsement key */ +@@ -157,6 +159,7 @@ void tpm_init_data(void) + if (tpmConf & TPM_CONF_GENERATE_EK) { + /* generate a new endorsement key */ + tpm_rsa_generate_key(&tpmData.permanent.data.endorsementKey, 2048); ++ endorsementKeyFresh = 1; + } else { + /* setup endorsement key */ + tpm_rsa_import_key(&tpmData.permanent.data.endorsementKey, +diff --git a/tpm/tpm_structures.h b/tpm/tpm_structures.h +index f746c05..b0f4625 100644 +--- a/tpm/tpm_structures.h ++++ b/tpm/tpm_structures.h +@@ -658,6 +658,49 @@ typedef struct tdTPM_CMK_MA_APPROVAL { + #define TPM_ORD_TickStampBlob 242 + #define TPM_ORD_MAX 256 + ++/* VTPM-only commands: */ ++/* ++ * ParentSignEK - Proof of fresh provisioning and EK value ++ * ++ * Input: ++ * TPM_TAG tag TPM_TAG_RQU_AUTH1_COMMAND ++ * UINT32 paramSize Total size of request ++ * TPM_COMMAND_CODE ordinal TPM_ORD_ParentSignEK ++ * TPM_NONCE externData 20 bytes of external data ++ * TPM_PCR_SELECTION ptSel PCR selection for physical TPM ++ * --- ++ * UINT32 authHandle Owner authorization session (OIAP) ++ * TPM_NONCE nonceOdd Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA privAuth Authorization digest for command ++ * ++ * Output: ++ * TPM_TAG tag TPM_TAG_RSP_AUTH1_COMMAND ++ * UINT32 paramSize Total size of response ++ * TPM_RESULT returnCode Return code of the operation ++ * BYTE[] sig Signature provided by physical TPM ++ * TPM_PCRVALUE[] pcrValue Values of hardware PCRs used in the quote ++ * --- ++ * TPM_NONCE nonceEven Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA resAuth Authorization digest for response ++ * ++ * This command is only valid on the first boot of a vTPM; on any subsequent ++ * boot, the command returns TPM_DISABLED_CMD. It is intended to be used to ++ * provide evidence of proper platform configuration to the verifier/CA which is ++ * responsible for the creation of the vTPM's endorsement credential, which will ++ * be used on subsequent boots to certify AIKs via the usual Privacy CA protocol. ++ * ++ * The values of the virtual TPM's PCRs are not included in the response. ++ * The signature is a standard TPM_Quote response from the physical TPM; its ++ * externalData is the SHA1 hash of the following structure: ++ * TPM_PUBKEY pubEK The vTPM's public EK ++ * TPM_NONCE externData From input to the deep quote ++ * ++ * This structure was chosen to match the return of TPM_ReadPubek ++ */ ++#define TPM_ORD_ParentSignEK (TPM_VENDOR_COMMAND | TPM_ORD_ReadPubek) ++ + /* + * TCS Ordinals ([TPM_Part2], Section 17.1) + * diff --git a/stubdom/vtpm/vtpm_cmd.c b/stubdom/vtpm/vtpm_cmd.c index 7eae98b..6fda456 100644 --- a/stubdom/vtpm/vtpm_cmd.c +++ b/stubdom/vtpm/vtpm_cmd.c @@ -217,6 +217,51 @@ egress: return status; } +extern struct tpmfront_dev* tpmfront_dev; +TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel, UINT32 *sigSize, BYTE **sig) +{ + TPM_RESULT status = TPM_SUCCESS; + uint8_t* bptr, *resp; + uint8_t* cmdbuf = NULL; + size_t resplen = 0; + UINT32 len; + + TPM_TAG tag = VTPM_TAG_REQ; + UINT32 size; + TPM_COMMAND_CODE ord = VTPM_ORD_GET_QUOTE; + + /*Create the command*/ + len = size = VTPM_COMMAND_HEADER_SIZE + 25; + bptr = cmdbuf = malloc(size); + TRYFAILGOTO(pack_header(&bptr, &len, tag, size, ord)); + TRYFAILGOTO(tpm_marshal_TPM_NONCE(&bptr, &len, data)); + TRYFAILGOTO(tpm_marshal_TPM_PCR_SELECTION(&bptr, &len, sel)); + + /* Send the command to vtpm_manager */ + info("Requesting Quote from backend"); + TRYFAILGOTOMSG(tpmfront_cmd(tpmfront_dev, cmdbuf, size, &resp, &resplen), ERR_TPMFRONT); + + /* Unpack response header */ + bptr = resp; + len = resplen; + TRYFAILGOTOMSG(unpack_header(&bptr, &len, &tag, &size, &ord), ERR_MALFORMED); + + /* Check return code */ + CHECKSTATUSGOTO(ord, "VTPM_GetParentQuote()"); + + /* Copy out the value */ + *sigSize = len; + *sig = tpm_malloc(*sigSize); + TRYFAILGOTOMSG(tpm_unmarshal_BYTE_ARRAY(&bptr, &len, *sig, *sigSize), ERR_MALFORMED); + + goto egress; +abort_egress: + error("VTPM_GetParentQuote failed"); +egress: + free(cmdbuf); + return status; +} + TPM_RESULT VTPM_PCRRead(struct tpmfront_dev* tpmfront_dev, UINT32 pcrIndex, BYTE* outDigest) { TPM_RESULT status = TPM_SUCCESS; -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv7-000153-7Q; Thu, 01 May 2014 06:56:37 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv5-00014c-GR for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:35 +0000 Received: from [193.109.254.147:38498] by server-2.bemta-14.messagelabs.com id FA/3B-21684-220F1635; Thu, 01 May 2014 06:56:34 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-4.tower-27.messagelabs.com!1398927392!2013324!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 21918 invoked from network); 1 May 2014 06:56:33 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-4.tower-27.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:33 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkv2-0001oj-IG for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:32 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkv2-0004t4-DB for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:32 +0000 Date: Thu, 01 May 2014 06:56:32 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpmmgr: Store hardware TPM Locality X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit d426026701b3a74bbd2776a5c45c265e7775773e Author: Jason Andryuk AuthorDate: Mon Apr 21 13:22:59 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpmmgr: Store hardware TPM Locality The TPM locality must be specified when using TPM_PCR_INFO_LONG for TPM_Seal. Store the locality so it can be provided later. Signed-off-by: Jason Andryuk Acked-by: Daniel De Graaf --- stubdom/vtpmmgr/init.c | 4 +++- stubdom/vtpmmgr/vtpmmgr.h | 2 ++ 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/stubdom/vtpmmgr/init.c b/stubdom/vtpmmgr/init.c index 89643e7..c35ab8f 100644 --- a/stubdom/vtpmmgr/init.c +++ b/stubdom/vtpmmgr/init.c @@ -69,7 +69,8 @@ const TPM_AUTHDATA WELLKNOWN_AUTH = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0 struct vtpm_globals vtpm_globals = { .tpm_fd = -1, - .oiap = { .AuthHandle = 0 } + .oiap = { .AuthHandle = 0 }, + .hw_locality = 0 }; static int tpm_entropy_source(void* dummy, unsigned char* data, size_t len, size_t* olen) { @@ -436,6 +437,7 @@ TPM_RESULT vtpmmgr_init(int argc, char** argv) { } vtpm_globals.tpm_fd = tpm_tis_open(tpm); tpm_tis_request_locality(tpm, opts.tpmlocality); + vtpm_globals.hw_locality = opts.tpmlocality; } break; case TPMDRV_TPMFRONT: diff --git a/stubdom/vtpmmgr/vtpmmgr.h b/stubdom/vtpmmgr/vtpmmgr.h index cf2b962..68edd4c 100644 --- a/stubdom/vtpmmgr/vtpmmgr.h +++ b/stubdom/vtpmmgr/vtpmmgr.h @@ -57,6 +57,8 @@ struct vtpm_globals { entropy_context entropy; ctr_drbg_context ctr_drbg; + + int hw_locality; }; struct tpm_opaque { -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvR-00018m-F1; Thu, 01 May 2014 06:56:57 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvP-00018S-FL for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:55 +0000 Received: from [85.158.139.211:28980] by server-9.bemta-5.messagelabs.com id 8E/FA-04350-630F1635; Thu, 01 May 2014 06:56:54 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-8.tower-206.messagelabs.com!1398927413!1656293!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 21323 invoked from network); 1 May 2014 06:56:54 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-8.tower-206.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:56:54 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvM-0001p2-T0 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:52 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvM-0004ts-R8 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:56:52 +0000 Date: Thu, 01 May 2014 06:56:52 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: passthru requests to manager X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit c1fe4dcf3f9b2641b668d912d2894e9df9096538 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:01 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpm: passthru requests to manager When sending commands to a vTPM, commands with the VTPM_TAG_REQ2 tag are passed directly to the TPM Manager since they are used in the management interface to the TPM Manager. The VTPM_TAG_REQ tag is translated to TPM_TAG_RQU_COMMAND to allow access to the physical TPM for certain ordinals (PCRRead, Extend, and GetRandom). Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/vtpm/vtpm.c | 40 +++++++++++++++++++++++++++++++++++++++- 1 files changed, 39 insertions(+), 1 deletions(-) diff --git a/stubdom/vtpm/vtpm.c b/stubdom/vtpm/vtpm.c index f67de18..61982c2 100644 --- a/stubdom/vtpm/vtpm.c +++ b/stubdom/vtpm/vtpm.c @@ -33,6 +33,7 @@ #include "vtpm_cmd.h" #include "vtpm_pcrs.h" #include "vtpmblk.h" +#include "vtpm_manager.h" #define TPM_LOG_INFO LOG_INFO #define TPM_LOG_ERROR LOG_ERR @@ -117,6 +118,40 @@ int init_random(void) { return 0; } +int check_passthru(tpmcmd_t* tpmcmd) { + TPM_TAG tag; + UINT32 len = 10; + BYTE* ptr; + size_t size; + + if(tpmcmd->req_len < 10) { + return false; + } + + ptr = tpmcmd->req; + tpm_unmarshal_UINT16(&ptr, &len, &tag); + + if (tag == VTPM_TAG_REQ2) { + info("VTPM passthru: %d bytes", (int)tpmcmd->req_len); + tpmfront_cmd(tpmfront_dev, tpmcmd->req, tpmcmd->req_len, &tpmcmd->resp, &size); + tpmcmd->resp_len = size; + info("VTPM passthru return: %d bytes", (int)size); + return true; + } + + if (tag == VTPM_TAG_REQ) { + info("VTPM pTPM-cmd: %d bytes", (int)tpmcmd->req_len); + ptr = tpmcmd->req; + tpm_marshal_UINT16(&ptr, &len, TPM_TAG_RQU_COMMAND); + tpmfront_cmd(tpmfront_dev, tpmcmd->req, tpmcmd->req_len, &tpmcmd->resp, &size); + tpmcmd->resp_len = size; + info("VTPM pTPM-cmd return: %d bytes", (int)size); + return true; + } + + return false; +} + int check_ordinal(tpmcmd_t* tpmcmd) { TPM_COMMAND_CODE ord; UINT32 len = 4; @@ -209,6 +244,9 @@ static void main_loop(void) { error("Invalid locality (%d) for client in tpm_handle_command", tpmcmd->locality); create_error_response(tpmcmd, TPM_FAIL); } + /* Check for TPM Manager passthrough command */ + else if(check_passthru(tpmcmd)) { + } /* Check for disabled ordinals */ else if(!check_ordinal(tpmcmd)) { create_error_response(tpmcmd, TPM_BAD_ORDINAL); @@ -231,7 +269,7 @@ static void main_loop(void) { } abort_postpcrs: - info("VTPM Shutting down\n"); + info("VTPM Shutting down"); tpm_emulator_shutdown(); } -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:10 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvb-0001AK-Hk; Thu, 01 May 2014 06:57:07 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvZ-00019x-Vs for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:06 +0000 Received: from [85.158.143.35:43575] by server-3.bemta-4.messagelabs.com id 54/00-13602-140F1635; Thu, 01 May 2014 06:57:05 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-15.tower-21.messagelabs.com!1398927423!2148301!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9983 invoked from network); 1 May 2014 06:57:04 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-15.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:57:04 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WfkvX-0001pY-32 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:03 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1WfkvW-0004uO-W7 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:03 +0000 Date: Thu, 01 May 2014 06:57:02 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: add ordinal for obtaining an EK signature X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit d4ea6ab10f35f98a15ccc612f2235198bb733412 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:02 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:57:53 2014 +0100 vtpm: add ordinal for obtaining an EK signature For a vTPM to be useful for remote attestation, proof that the vTPM's EK was generated and held within a secure vTPM implementation is necessary. This patch adds an ordinal to the vTPM which will request a quote providing this evidence from the TPM Manager; it only functions during the first startup of a given vTPM in order to provide proof that the EK was freshly generated (and not a key whose private part is available elsewhere). Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/Makefile | 1 + stubdom/vtpm-parent-sign-ek.patch | 196 +++++++++++++++++++++++++++++++++++++ stubdom/vtpm/vtpm_cmd.c | 45 +++++++++ 3 files changed, 242 insertions(+), 0 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index b1822b7..3e5f054 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -208,6 +208,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz patch -d $@ -p1 < tpmemu-$(TPMEMU_VERSION).patch; patch -d $@ -p1 < vtpm-bufsize.patch patch -d $@ -p1 < vtpm-locality.patch + patch -d $@ -p1 < vtpm-parent-sign-ek.patch mkdir $@/build cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement" touch $@ diff --git a/stubdom/vtpm-parent-sign-ek.patch b/stubdom/vtpm-parent-sign-ek.patch new file mode 100644 index 0000000..14e66ee --- /dev/null +++ b/stubdom/vtpm-parent-sign-ek.patch @@ -0,0 +1,196 @@ +diff --git a/tpm/tpm_cmd_handler.c b/tpm/tpm_cmd_handler.c +index 9e1cfb4..0fabf98 100644 +--- a/tpm/tpm_cmd_handler.c ++++ b/tpm/tpm_cmd_handler.c +@@ -3312,6 +3312,37 @@ static TPM_RESULT execute_TPM_OwnerReadPubek(TPM_REQUEST *req, TPM_RESPONSE *rsp + return res; + } + ++static TPM_RESULT execute_TPM_ParentSignEK(TPM_REQUEST *req, TPM_RESPONSE *rsp) ++{ ++ TPM_NONCE nonce; ++ TPM_RESULT res; ++ UINT32 sigSize; ++ BYTE *sig; ++ BYTE *ptr; ++ UINT32 len; ++ TPM_PCR_SELECTION targetPCR; ++ ++ tpm_compute_in_param_digest(req); ++ ++ ptr = req->param; ++ len = req->paramSize; ++ if (tpm_unmarshal_TPM_NONCE(&ptr, &len, &nonce) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &targetPCR) ++ || len != 0) return TPM_BAD_PARAMETER; ++ ++ res = TPM_ParentSignEK(&nonce, &targetPCR, &req->auth1, &sigSize, &sig); ++ if (res != TPM_SUCCESS) return res; ++ rsp->paramSize = len = sigSize; ++ rsp->param = ptr = tpm_malloc(len); ++ if (ptr == NULL || tpm_marshal_BLOB(&ptr, &len, sig, sigSize)) { ++ tpm_free(rsp->param); ++ res = TPM_FAIL; ++ } ++ tpm_free(sig); ++ ++ return res; ++} ++ + static void tpm_setup_rsp_auth(TPM_COMMAND_CODE ordinal, TPM_RESPONSE *rsp) + { + tpm_hmac_ctx_t hmac; +@@ -4062,6 +4093,11 @@ void tpm_execute_command(TPM_REQUEST *req, TPM_RESPONSE *rsp) + res = execute_TPM_OwnerReadPubek(req, rsp); + break; + ++ case TPM_ORD_ParentSignEK: ++ debug("[TPM_ORD_ParentSignEK]"); ++ res = execute_TPM_ParentSignEK(req, rsp); ++ break; ++ + default: + #ifdef MTM_EMULATOR + res = mtm_execute_command(req, rsp); +diff --git a/tpm/tpm_commands.h b/tpm/tpm_commands.h +index a7666f6..7fef934 100644 +--- a/tpm/tpm_commands.h ++++ b/tpm/tpm_commands.h +@@ -3054,6 +3054,23 @@ TPM_RESULT TPM_OwnerReadPubek( + TPM_PUBKEY *pubEndorsementKey + ); + ++/** ++ * TPM_ParentSignEK - gets a hardware TPM quote of a vTPM's EK ++ * @externalData: [in] AntiReplay nonce to prevent replay of messages ++ * @sel: [in] PCR selection for the hardware TPM's quote ++ * @auth1: [in, out] Authorization protocol parameters ++ * @sigSize: [out] The length of the returned digital signature ++ * @sig: [out] The resulting digital signature and PCR values ++ * Returns: TPM_SUCCESS on success, a TPM error code otherwise. ++ */ ++TPM_RESULT TPM_ParentSignEK( ++ TPM_NONCE *externalData, ++ TPM_PCR_SELECTION *sel, ++ TPM_AUTH *auth1, ++ UINT32 *sigSize, ++ BYTE **sig ++); ++ + /* + * Error handling + * [tpm_error.c] +diff --git a/tpm/tpm_credentials.c b/tpm/tpm_credentials.c +index 9cd64af..01f29e6 100644 +--- a/tpm/tpm_credentials.c ++++ b/tpm/tpm_credentials.c +@@ -180,3 +180,34 @@ TPM_RESULT TPM_OwnerReadInternalPub(TPM_KEY_HANDLE keyHandle, TPM_AUTH *auth1, + return TPM_BAD_PARAMETER; + } + } ++ ++int endorsementKeyFresh = 0; ++ ++TPM_RESULT VTPM_GetParentQuote(TPM_DIGEST* data, TPM_PCR_SELECTION *sel, UINT32 *sigSize, BYTE **sig); ++ ++TPM_RESULT TPM_ParentSignEK(TPM_NONCE *externalData, TPM_PCR_SELECTION *sel, ++ TPM_AUTH *auth1, UINT32 *sigSize, BYTE **sig) ++{ ++ TPM_PUBKEY pubKey; ++ TPM_RESULT res; ++ TPM_DIGEST hres; ++ ++ info("TPM_ParentSignEK()"); ++ ++ res = tpm_verify_auth(auth1, tpmData.permanent.data.ownerAuth, TPM_KH_OWNER); ++ if (res != TPM_SUCCESS) return res; ++ ++ if (!endorsementKeyFresh) return TPM_DISABLED_CMD; ++ ++ res = tpm_get_pubek(&pubKey); ++ if (res != TPM_SUCCESS) return res; ++ ++ if (tpm_compute_pubkey_checksum(externalData, &pubKey, &hres)) ++ res = TPM_FAIL; ++ ++ if (res == TPM_SUCCESS) ++ res = VTPM_GetParentQuote(&hres, sel, sigSize, sig); ++ ++ free_TPM_PUBKEY(pubKey); ++ return res; ++} +diff --git a/tpm/tpm_data.c b/tpm/tpm_data.c +index 50c9697..6a0c499 100644 +--- a/tpm/tpm_data.c ++++ b/tpm/tpm_data.c +@@ -76,6 +76,8 @@ static void init_timeouts(void) + tpmData.permanent.data.cmd_durations[2] = 1000; + } + ++extern int endorsementKeyFresh; ++ + void tpm_init_data(void) + { + /* endorsement key */ +@@ -157,6 +159,7 @@ void tpm_init_data(void) + if (tpmConf & TPM_CONF_GENERATE_EK) { + /* generate a new endorsement key */ + tpm_rsa_generate_key(&tpmData.permanent.data.endorsementKey, 2048); ++ endorsementKeyFresh = 1; + } else { + /* setup endorsement key */ + tpm_rsa_import_key(&tpmData.permanent.data.endorsementKey, +diff --git a/tpm/tpm_structures.h b/tpm/tpm_structures.h +index f746c05..b0f4625 100644 +--- a/tpm/tpm_structures.h ++++ b/tpm/tpm_structures.h +@@ -658,6 +658,49 @@ typedef struct tdTPM_CMK_MA_APPROVAL { + #define TPM_ORD_TickStampBlob 242 + #define TPM_ORD_MAX 256 + ++/* VTPM-only commands: */ ++/* ++ * ParentSignEK - Proof of fresh provisioning and EK value ++ * ++ * Input: ++ * TPM_TAG tag TPM_TAG_RQU_AUTH1_COMMAND ++ * UINT32 paramSize Total size of request ++ * TPM_COMMAND_CODE ordinal TPM_ORD_ParentSignEK ++ * TPM_NONCE externData 20 bytes of external data ++ * TPM_PCR_SELECTION ptSel PCR selection for physical TPM ++ * --- ++ * UINT32 authHandle Owner authorization session (OIAP) ++ * TPM_NONCE nonceOdd Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA privAuth Authorization digest for command ++ * ++ * Output: ++ * TPM_TAG tag TPM_TAG_RSP_AUTH1_COMMAND ++ * UINT32 paramSize Total size of response ++ * TPM_RESULT returnCode Return code of the operation ++ * BYTE[] sig Signature provided by physical TPM ++ * TPM_PCRVALUE[] pcrValue Values of hardware PCRs used in the quote ++ * --- ++ * TPM_NONCE nonceEven Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA resAuth Authorization digest for response ++ * ++ * This command is only valid on the first boot of a vTPM; on any subsequent ++ * boot, the command returns TPM_DISABLED_CMD. It is intended to be used to ++ * provide evidence of proper platform configuration to the verifier/CA which is ++ * responsible for the creation of the vTPM's endorsement credential, which will ++ * be used on subsequent boots to certify AIKs via the usual Privacy CA protocol. ++ * ++ * The values of the virtual TPM's PCRs are not included in the response. ++ * The signature is a standard TPM_Quote response from the physical TPM; its ++ * externalData is the SHA1 hash of the following structure: ++ * TPM_PUBKEY pubEK The vTPM's public EK ++ * TPM_NONCE externData From input to the deep quote ++ * ++ * This structure was chosen to match the return of TPM_ReadPubek ++ */ ++#define TPM_ORD_ParentSignEK (TPM_VENDOR_COMMAND | TPM_ORD_ReadPubek) ++ + /* + * TCS Ordinals ([TPM_Part2], Section 17.1) + * diff --git a/stubdom/vtpm/vtpm_cmd.c b/stubdom/vtpm/vtpm_cmd.c index 7eae98b..6fda456 100644 --- a/stubdom/vtpm/vtpm_cmd.c +++ b/stubdom/vtpm/vtpm_cmd.c @@ -217,6 +217,51 @@ egress: return status; } +extern struct tpmfront_dev* tpmfront_dev; +TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel, UINT32 *sigSize, BYTE **sig) +{ + TPM_RESULT status = TPM_SUCCESS; + uint8_t* bptr, *resp; + uint8_t* cmdbuf = NULL; + size_t resplen = 0; + UINT32 len; + + TPM_TAG tag = VTPM_TAG_REQ; + UINT32 size; + TPM_COMMAND_CODE ord = VTPM_ORD_GET_QUOTE; + + /*Create the command*/ + len = size = VTPM_COMMAND_HEADER_SIZE + 25; + bptr = cmdbuf = malloc(size); + TRYFAILGOTO(pack_header(&bptr, &len, tag, size, ord)); + TRYFAILGOTO(tpm_marshal_TPM_NONCE(&bptr, &len, data)); + TRYFAILGOTO(tpm_marshal_TPM_PCR_SELECTION(&bptr, &len, sel)); + + /* Send the command to vtpm_manager */ + info("Requesting Quote from backend"); + TRYFAILGOTOMSG(tpmfront_cmd(tpmfront_dev, cmdbuf, size, &resp, &resplen), ERR_TPMFRONT); + + /* Unpack response header */ + bptr = resp; + len = resplen; + TRYFAILGOTOMSG(unpack_header(&bptr, &len, &tag, &size, &ord), ERR_MALFORMED); + + /* Check return code */ + CHECKSTATUSGOTO(ord, "VTPM_GetParentQuote()"); + + /* Copy out the value */ + *sigSize = len; + *sig = tpm_malloc(*sigSize); + TRYFAILGOTOMSG(tpm_unmarshal_BYTE_ARRAY(&bptr, &len, *sig, *sigSize), ERR_MALFORMED); + + goto egress; +abort_egress: + error("VTPM_GetParentQuote failed"); +egress: + free(cmdbuf); + return status; +} + TPM_RESULT VTPM_PCRRead(struct tpmfront_dev* tpmfront_dev, UINT32 pcrIndex, BYTE* outDigest) { TPM_RESULT status = TPM_SUCCESS; -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:18 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvm-0001DU-KS; Thu, 01 May 2014 06:57:18 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvk-0001Cq-6w for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:16 +0000 Received: from [85.158.143.35:46061] by server-2.bemta-4.messagelabs.com id 91/13-06539-B40F1635; Thu, 01 May 2014 06:57:15 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-13.tower-21.messagelabs.com!1398927433!2160627!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG, UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 11589 invoked from network); 1 May 2014 06:57:14 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-13.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:57:14 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvh-0001pm-8b for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:13 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkvh-0004vN-5z for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:13 +0000 Date: Thu, 01 May 2014 06:57:13 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: add deep quote support X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit f00b68e706c052002fbcbe820f434f1f1afb725d Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:03 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:58:09 2014 +0100 vtpm: add deep quote support This allows the client of a vTPM to request a quote from the physical TPM which includes PCRs from both the physical and virtual TPMs, signed by an AIK from the physical TPM. This quote can be used to provide evidence of the complete launch environment of a virtual machine. Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/Makefile | 1 + stubdom/vtpm-deepquote.patch | 187 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 188 insertions(+), 0 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index 3e5f054..c41de27 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -209,6 +209,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz patch -d $@ -p1 < vtpm-bufsize.patch patch -d $@ -p1 < vtpm-locality.patch patch -d $@ -p1 < vtpm-parent-sign-ek.patch + patch -d $@ -p1 < vtpm-deepquote.patch mkdir $@/build cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement" touch $@ diff --git a/stubdom/vtpm-deepquote.patch b/stubdom/vtpm-deepquote.patch new file mode 100644 index 0000000..6344f38 --- /dev/null +++ b/stubdom/vtpm-deepquote.patch @@ -0,0 +1,187 @@ +diff --git a/tpm/tpm_cmd_handler.c b/tpm/tpm_cmd_handler.c +index 0fabf98..69511d1 100644 +--- a/tpm/tpm_cmd_handler.c ++++ b/tpm/tpm_cmd_handler.c +@@ -3343,6 +3343,39 @@ static TPM_RESULT execute_TPM_ParentSignEK(TPM_REQUEST *req, TPM_RESPONSE *rsp) + return res; + } + ++static TPM_RESULT execute_TPM_DeepQuote(TPM_REQUEST *req, TPM_RESPONSE *rsp) ++{ ++ TPM_NONCE nonce; ++ TPM_RESULT res; ++ UINT32 sigSize; ++ BYTE *sig; ++ BYTE *ptr; ++ UINT32 len; ++ TPM_PCR_SELECTION myPCR; ++ TPM_PCR_SELECTION ptPCR; ++ ++ tpm_compute_in_param_digest(req); ++ ++ ptr = req->param; ++ len = req->paramSize; ++ if (tpm_unmarshal_TPM_NONCE(&ptr, &len, &nonce) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &myPCR) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &ptPCR) ++ || len != 0) return TPM_BAD_PARAMETER; ++ ++ res = TPM_DeepQuote(&nonce, &myPCR, &ptPCR, &req->auth1, &sigSize, &sig); ++ if (res != TPM_SUCCESS) return res; ++ rsp->paramSize = len = sigSize; ++ rsp->param = ptr = tpm_malloc(len); ++ if (ptr == NULL || tpm_marshal_BLOB(&ptr, &len, sig, sigSize)) { ++ tpm_free(rsp->param); ++ res = TPM_FAIL; ++ } ++ tpm_free(sig); ++ ++ return res; ++} ++ + static void tpm_setup_rsp_auth(TPM_COMMAND_CODE ordinal, TPM_RESPONSE *rsp) + { + tpm_hmac_ctx_t hmac; +@@ -4098,6 +4131,11 @@ void tpm_execute_command(TPM_REQUEST *req, TPM_RESPONSE *rsp) + res = execute_TPM_ParentSignEK(req, rsp); + break; + ++ case TPM_ORD_DeepQuote: ++ debug("[TPM_ORD_DeepQuote]"); ++ res = execute_TPM_DeepQuote(req, rsp); ++ break; ++ + default: + #ifdef MTM_EMULATOR + res = mtm_execute_command(req, rsp); +diff --git a/tpm/tpm_commands.h b/tpm/tpm_commands.h +index 7fef934..328d1be 100644 +--- a/tpm/tpm_commands.h ++++ b/tpm/tpm_commands.h +@@ -3071,6 +3071,25 @@ TPM_RESULT TPM_ParentSignEK( + BYTE **sig + ); + ++/** ++ * TPM_DeepQuote - gets a hardware TPM quote of a vTPM's PCRs ++ * @externalData: [in] AntiReplay nonce to prevent replay of messages ++ * @myPCR: [in] PCR selection for the virtual TPM ++ * @ptPCR: [in] PCR selection for the hardware TPM ++ * @auth1: [in, out] Authorization protocol parameters ++ * @sigSize: [out] The length of the returned digital signature ++ * @sig: [out] The resulting digital signature and PCR values ++ * Returns: TPM_SUCCESS on success, a TPM error code otherwise. ++ */ ++TPM_RESULT TPM_DeepQuote( ++ TPM_NONCE *externalData, ++ TPM_PCR_SELECTION *myPCR, ++ TPM_PCR_SELECTION *ptPCR, ++ TPM_AUTH *auth1, ++ UINT32 *sigSize, ++ BYTE **sig ++); ++ + /* + * Error handling + * [tpm_error.c] +diff --git a/tpm/tpm_credentials.c b/tpm/tpm_credentials.c +index 01f29e6..c0d62e7 100644 +--- a/tpm/tpm_credentials.c ++++ b/tpm/tpm_credentials.c +@@ -211,3 +211,49 @@ TPM_RESULT TPM_ParentSignEK(TPM_NONCE *externalData, TPM_PCR_SELECTION *sel, + free_TPM_PUBKEY(pubKey); + return res; + } ++ ++static const BYTE dquot_hdr[] = { ++ 0, 0, 0, 0, 'D', 'Q', 'U', 'T' ++}; ++ ++TPM_RESULT TPM_DeepQuote(TPM_NONCE *externalData, TPM_PCR_SELECTION *myPCR, ++ TPM_PCR_SELECTION *ptPCR, TPM_AUTH *auth1, ++ UINT32 *sigSize, BYTE **sig) ++{ ++ TPM_RESULT res; ++ TPM_DIGEST hres; ++ TPM_PCR_INFO_SHORT pcrData; ++ tpm_sha1_ctx_t ctx; ++ BYTE *buf, *ptr; ++ UINT32 size, len; ++ ++ info("TPM_DeepQuote()"); ++ ++ res = tpm_verify_auth(auth1, tpmData.permanent.data.ownerAuth, TPM_KH_OWNER); ++ if (res != TPM_SUCCESS) return res; ++ ++ res = tpm_compute_pcr_digest(myPCR, &pcrData.digestAtRelease, NULL); ++ if (res != TPM_SUCCESS) return res; ++ ++ pcrData.pcrSelection.sizeOfSelect = myPCR->sizeOfSelect; ++ memcpy(pcrData.pcrSelection.pcrSelect, myPCR->pcrSelect, myPCR->sizeOfSelect); ++ pcrData.localityAtRelease = 1 << tpmData.stany.flags.localityModifier; ++ ++ size = len = sizeof_TPM_PCR_INFO_SHORT(pcrData); ++ buf = ptr = tpm_malloc(size); ++ if (buf == NULL) return TPM_NOSPACE; ++ if (tpm_marshal_TPM_PCR_INFO_SHORT(&ptr, &len, &pcrData)) ++ return TPM_FAIL; ++ ++ tpm_sha1_init(&ctx); ++ tpm_sha1_update(&ctx, dquot_hdr, 8); ++ tpm_sha1_update(&ctx, externalData->nonce, 20); ++ tpm_sha1_update(&ctx, buf, size); ++ tpm_sha1_final(&ctx, hres.digest); ++ ++ tpm_free(buf); ++ ++ res = VTPM_GetParentQuote(&hres, ptPCR, sigSize, sig); ++ ++ return res; ++} +diff --git a/tpm/tpm_structures.h b/tpm/tpm_structures.h +index b0f4625..dfb1894 100644 +--- a/tpm/tpm_structures.h ++++ b/tpm/tpm_structures.h +@@ -660,6 +660,42 @@ typedef struct tdTPM_CMK_MA_APPROVAL { + + /* VTPM-only commands: */ + /* ++ * Deep Quote - Create quote of PCRs ++ * Input: ++ * TPM_TAG tag TPM_TAG_RQU_AUTH1_COMMAND ++ * UINT32 paramSize Total size of request ++ * TPM_COMMAND_CODE ordinal TPM_ORD_DeepQuote ++ * TPM_NONCE externData 20 bytes of external data ++ * TPM_PCR_SELECTION vtSel PCR selection for virtual TPM ++ * TPM_PCR_SELECTION ptSel PCR selection for physical TPM ++ * --- ++ * UINT32 authHandle Owner authorization session (OIAP) ++ * TPM_NONCE nonceOdd Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA privAuth Authorization digest for command ++ * ++ * Output: ++ * TPM_TAG tag TPM_TAG_RSP_AUTH1_COMMAND ++ * UINT32 paramSize Total size of response ++ * TPM_RESULT returnCode Return code of the operation ++ * BYTE[] sig Signature provided by physical TPM ++ * TPM_PCRVALUE[] pcrValue Values of hardware PCRs used in the quote ++ * --- ++ * TPM_NONCE nonceEven Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA resAuth Authorization digest for response ++ * ++ * The values of the virutal TPM's PCRs are not included in the response. ++ * The signature is a standard TPM_Quote response from the physical TPM; its ++ * externalData is the SHA1 hash of the following structure: ++ * TPM_STRUCT_VER version MUST be 0.0.0.0 ++ * BYTE[4] fixed MUST be the string "DQUT" ++ * TPM_NONCE externData From input to the deep quote ++ * TPM_PCR_INFO_SHORT pcrData Virtual TPM's PCRs ++ */ ++#define TPM_ORD_DeepQuote (TPM_VENDOR_COMMAND | TPM_ORD_Quote) ++ ++/* + * ParentSignEK - Proof of fresh provisioning and EK value + * + * Input: -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:18 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvm-0001DU-KS; Thu, 01 May 2014 06:57:18 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvk-0001Cq-6w for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:16 +0000 Received: from [85.158.143.35:46061] by server-2.bemta-4.messagelabs.com id 91/13-06539-B40F1635; Thu, 01 May 2014 06:57:15 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-13.tower-21.messagelabs.com!1398927433!2160627!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG, UPPERCASE_25_50 X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 11589 invoked from network); 1 May 2014 06:57:14 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-13.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:57:14 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvh-0001pm-8b for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:13 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkvh-0004vN-5z for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:13 +0000 Date: Thu, 01 May 2014 06:57:13 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] vtpm: add deep quote support X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit f00b68e706c052002fbcbe820f434f1f1afb725d Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:03 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:58:09 2014 +0100 vtpm: add deep quote support This allows the client of a vTPM to request a quote from the physical TPM which includes PCRs from both the physical and virtual TPMs, signed by an AIK from the physical TPM. This quote can be used to provide evidence of the complete launch environment of a virtual machine. Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell --- stubdom/Makefile | 1 + stubdom/vtpm-deepquote.patch | 187 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 188 insertions(+), 0 deletions(-) diff --git a/stubdom/Makefile b/stubdom/Makefile index 3e5f054..c41de27 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -209,6 +209,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz patch -d $@ -p1 < vtpm-bufsize.patch patch -d $@ -p1 < vtpm-locality.patch patch -d $@ -p1 < vtpm-parent-sign-ek.patch + patch -d $@ -p1 < vtpm-deepquote.patch mkdir $@/build cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement" touch $@ diff --git a/stubdom/vtpm-deepquote.patch b/stubdom/vtpm-deepquote.patch new file mode 100644 index 0000000..6344f38 --- /dev/null +++ b/stubdom/vtpm-deepquote.patch @@ -0,0 +1,187 @@ +diff --git a/tpm/tpm_cmd_handler.c b/tpm/tpm_cmd_handler.c +index 0fabf98..69511d1 100644 +--- a/tpm/tpm_cmd_handler.c ++++ b/tpm/tpm_cmd_handler.c +@@ -3343,6 +3343,39 @@ static TPM_RESULT execute_TPM_ParentSignEK(TPM_REQUEST *req, TPM_RESPONSE *rsp) + return res; + } + ++static TPM_RESULT execute_TPM_DeepQuote(TPM_REQUEST *req, TPM_RESPONSE *rsp) ++{ ++ TPM_NONCE nonce; ++ TPM_RESULT res; ++ UINT32 sigSize; ++ BYTE *sig; ++ BYTE *ptr; ++ UINT32 len; ++ TPM_PCR_SELECTION myPCR; ++ TPM_PCR_SELECTION ptPCR; ++ ++ tpm_compute_in_param_digest(req); ++ ++ ptr = req->param; ++ len = req->paramSize; ++ if (tpm_unmarshal_TPM_NONCE(&ptr, &len, &nonce) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &myPCR) ++ || tpm_unmarshal_TPM_PCR_SELECTION(&ptr, &len, &ptPCR) ++ || len != 0) return TPM_BAD_PARAMETER; ++ ++ res = TPM_DeepQuote(&nonce, &myPCR, &ptPCR, &req->auth1, &sigSize, &sig); ++ if (res != TPM_SUCCESS) return res; ++ rsp->paramSize = len = sigSize; ++ rsp->param = ptr = tpm_malloc(len); ++ if (ptr == NULL || tpm_marshal_BLOB(&ptr, &len, sig, sigSize)) { ++ tpm_free(rsp->param); ++ res = TPM_FAIL; ++ } ++ tpm_free(sig); ++ ++ return res; ++} ++ + static void tpm_setup_rsp_auth(TPM_COMMAND_CODE ordinal, TPM_RESPONSE *rsp) + { + tpm_hmac_ctx_t hmac; +@@ -4098,6 +4131,11 @@ void tpm_execute_command(TPM_REQUEST *req, TPM_RESPONSE *rsp) + res = execute_TPM_ParentSignEK(req, rsp); + break; + ++ case TPM_ORD_DeepQuote: ++ debug("[TPM_ORD_DeepQuote]"); ++ res = execute_TPM_DeepQuote(req, rsp); ++ break; ++ + default: + #ifdef MTM_EMULATOR + res = mtm_execute_command(req, rsp); +diff --git a/tpm/tpm_commands.h b/tpm/tpm_commands.h +index 7fef934..328d1be 100644 +--- a/tpm/tpm_commands.h ++++ b/tpm/tpm_commands.h +@@ -3071,6 +3071,25 @@ TPM_RESULT TPM_ParentSignEK( + BYTE **sig + ); + ++/** ++ * TPM_DeepQuote - gets a hardware TPM quote of a vTPM's PCRs ++ * @externalData: [in] AntiReplay nonce to prevent replay of messages ++ * @myPCR: [in] PCR selection for the virtual TPM ++ * @ptPCR: [in] PCR selection for the hardware TPM ++ * @auth1: [in, out] Authorization protocol parameters ++ * @sigSize: [out] The length of the returned digital signature ++ * @sig: [out] The resulting digital signature and PCR values ++ * Returns: TPM_SUCCESS on success, a TPM error code otherwise. ++ */ ++TPM_RESULT TPM_DeepQuote( ++ TPM_NONCE *externalData, ++ TPM_PCR_SELECTION *myPCR, ++ TPM_PCR_SELECTION *ptPCR, ++ TPM_AUTH *auth1, ++ UINT32 *sigSize, ++ BYTE **sig ++); ++ + /* + * Error handling + * [tpm_error.c] +diff --git a/tpm/tpm_credentials.c b/tpm/tpm_credentials.c +index 01f29e6..c0d62e7 100644 +--- a/tpm/tpm_credentials.c ++++ b/tpm/tpm_credentials.c +@@ -211,3 +211,49 @@ TPM_RESULT TPM_ParentSignEK(TPM_NONCE *externalData, TPM_PCR_SELECTION *sel, + free_TPM_PUBKEY(pubKey); + return res; + } ++ ++static const BYTE dquot_hdr[] = { ++ 0, 0, 0, 0, 'D', 'Q', 'U', 'T' ++}; ++ ++TPM_RESULT TPM_DeepQuote(TPM_NONCE *externalData, TPM_PCR_SELECTION *myPCR, ++ TPM_PCR_SELECTION *ptPCR, TPM_AUTH *auth1, ++ UINT32 *sigSize, BYTE **sig) ++{ ++ TPM_RESULT res; ++ TPM_DIGEST hres; ++ TPM_PCR_INFO_SHORT pcrData; ++ tpm_sha1_ctx_t ctx; ++ BYTE *buf, *ptr; ++ UINT32 size, len; ++ ++ info("TPM_DeepQuote()"); ++ ++ res = tpm_verify_auth(auth1, tpmData.permanent.data.ownerAuth, TPM_KH_OWNER); ++ if (res != TPM_SUCCESS) return res; ++ ++ res = tpm_compute_pcr_digest(myPCR, &pcrData.digestAtRelease, NULL); ++ if (res != TPM_SUCCESS) return res; ++ ++ pcrData.pcrSelection.sizeOfSelect = myPCR->sizeOfSelect; ++ memcpy(pcrData.pcrSelection.pcrSelect, myPCR->pcrSelect, myPCR->sizeOfSelect); ++ pcrData.localityAtRelease = 1 << tpmData.stany.flags.localityModifier; ++ ++ size = len = sizeof_TPM_PCR_INFO_SHORT(pcrData); ++ buf = ptr = tpm_malloc(size); ++ if (buf == NULL) return TPM_NOSPACE; ++ if (tpm_marshal_TPM_PCR_INFO_SHORT(&ptr, &len, &pcrData)) ++ return TPM_FAIL; ++ ++ tpm_sha1_init(&ctx); ++ tpm_sha1_update(&ctx, dquot_hdr, 8); ++ tpm_sha1_update(&ctx, externalData->nonce, 20); ++ tpm_sha1_update(&ctx, buf, size); ++ tpm_sha1_final(&ctx, hres.digest); ++ ++ tpm_free(buf); ++ ++ res = VTPM_GetParentQuote(&hres, ptPCR, sigSize, sig); ++ ++ return res; ++} +diff --git a/tpm/tpm_structures.h b/tpm/tpm_structures.h +index b0f4625..dfb1894 100644 +--- a/tpm/tpm_structures.h ++++ b/tpm/tpm_structures.h +@@ -660,6 +660,42 @@ typedef struct tdTPM_CMK_MA_APPROVAL { + + /* VTPM-only commands: */ + /* ++ * Deep Quote - Create quote of PCRs ++ * Input: ++ * TPM_TAG tag TPM_TAG_RQU_AUTH1_COMMAND ++ * UINT32 paramSize Total size of request ++ * TPM_COMMAND_CODE ordinal TPM_ORD_DeepQuote ++ * TPM_NONCE externData 20 bytes of external data ++ * TPM_PCR_SELECTION vtSel PCR selection for virtual TPM ++ * TPM_PCR_SELECTION ptSel PCR selection for physical TPM ++ * --- ++ * UINT32 authHandle Owner authorization session (OIAP) ++ * TPM_NONCE nonceOdd Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA privAuth Authorization digest for command ++ * ++ * Output: ++ * TPM_TAG tag TPM_TAG_RSP_AUTH1_COMMAND ++ * UINT32 paramSize Total size of response ++ * TPM_RESULT returnCode Return code of the operation ++ * BYTE[] sig Signature provided by physical TPM ++ * TPM_PCRVALUE[] pcrValue Values of hardware PCRs used in the quote ++ * --- ++ * TPM_NONCE nonceEven Nonce for authHandle ++ * BOOL continueAuth Continue flag for authHandle ++ * TPM_AUTHDATA resAuth Authorization digest for response ++ * ++ * The values of the virutal TPM's PCRs are not included in the response. ++ * The signature is a standard TPM_Quote response from the physical TPM; its ++ * externalData is the SHA1 hash of the following structure: ++ * TPM_STRUCT_VER version MUST be 0.0.0.0 ++ * BYTE[4] fixed MUST be the string "DQUT" ++ * TPM_NONCE externData From input to the deep quote ++ * TPM_PCR_INFO_SHORT pcrData Virtual TPM's PCRs ++ */ ++#define TPM_ORD_DeepQuote (TPM_VENDOR_COMMAND | TPM_ORD_Quote) ++ ++/* + * ParentSignEK - Proof of fresh provisioning and EK value + * + * Input: -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@lists.xen.org http://lists.xensource.com/xen-changelog From xen-changelog-bounces@lists.xen.org Thu May 01 06:57:27 2014 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Thu, 01 May 2014 06:57:27 +0000 Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvu-0001FH-NM; Thu, 01 May 2014 06:57:26 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvu-0001F3-77 for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:26 +0000 Received: from [85.158.143.35:46528] by server-3.bemta-4.messagelabs.com id 03/40-13602-550F1635; Thu, 01 May 2014 06:57:25 +0000 X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-21.messagelabs.com!1398927443!2175010!1 X-Originating-IP: [50.57.168.107] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 6.11.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 29603 invoked from network); 1 May 2014 06:57:24 -0000 Received: from mail.xen.org (HELO mail.xen.org) (50.57.168.107) by server-14.tower-21.messagelabs.com with AES256-SHA encrypted SMTP; 1 May 2014 06:57:24 -0000 Received: from xenbits.xen.org ([50.57.170.242]) by mail.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfkvr-0001px-Em for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:23 +0000 Received: from xen by xenbits.xen.org with local (Exim 4.72) (envelope-from ) id 1Wfkvr-0004vm-BZ for xen-changelog@lists.xensource.com; Thu, 01 May 2014 06:57:23 +0000 Date: Thu, 01 May 2014 06:57:23 +0000 Message-Id: From: patchbot@xen.org To: xen-changelog@lists.xensource.com Subject: [Xen-changelog] [xen master] stubdom/grub: verify vTPM label if requested X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: xen-devel@lists.xensource.com List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xen-changelog-bounces@lists.xen.org Errors-To: xen-changelog-bounces@lists.xen.org commit 331d4b0eb8beb0af9c022de50cbf341e70c7ac80 Author: Daniel De Graaf AuthorDate: Mon Apr 21 13:23:04 2014 -0400 Commit: Ian Campbell CommitDate: Wed Apr 23 11:58:15 2014 +0100 stubdom/grub: verify vTPM label if requested This adds an optional argument --vtpm-label=