tdx-guest.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * TDX guest user interface driver
  4 *
  5 * Copyright (C) 2022 Intel Corporation
  6 */
  7
  8#define pr_fmt(fmt)			KBUILD_MODNAME ": " fmt
  9
 10#include <linux/kernel.h>
 11#include <linux/miscdevice.h>
 12#include <linux/mm.h>
 13#include <linux/module.h>
 14#include <linux/mod_devicetable.h>
 15#include <linux/string.h>
 16#include <linux/uaccess.h>
 17#include <linux/set_memory.h>
 18#include <linux/io.h>
 19#include <linux/delay.h>
 20#include <linux/sockptr.h>
 21#include <linux/tsm.h>
 22#include <linux/tsm-mr.h>
 23
 24#include <uapi/linux/tdx-guest.h>
 25
 26#include <asm/cpu_device_id.h>
 27#include <asm/tdx.h>
 28
 29/* TDREPORT buffer */
 30static u8 *tdx_report_buf;
 31
 32/* Lock to serialize TDG.MR.REPORT and TDG.MR.RTMR.EXTEND TDCALLs */
 33static DEFINE_MUTEX(mr_lock);
 34
 35/* TDREPORT fields */
 36enum {
 37	TDREPORT_reportdata = 128,
 38	TDREPORT_tee_tcb_info = 256,
 39	TDREPORT_tdinfo = TDREPORT_tee_tcb_info + 256,
 40	TDREPORT_attributes = TDREPORT_tdinfo,
 41	TDREPORT_xfam = TDREPORT_attributes + sizeof(u64),
 42	TDREPORT_mrtd = TDREPORT_xfam + sizeof(u64),
 43	TDREPORT_mrconfigid = TDREPORT_mrtd + SHA384_DIGEST_SIZE,
 44	TDREPORT_mrowner = TDREPORT_mrconfigid + SHA384_DIGEST_SIZE,
 45	TDREPORT_mrownerconfig = TDREPORT_mrowner + SHA384_DIGEST_SIZE,
 46	TDREPORT_rtmr0 = TDREPORT_mrownerconfig + SHA384_DIGEST_SIZE,
 47	TDREPORT_rtmr1 = TDREPORT_rtmr0 + SHA384_DIGEST_SIZE,
 48	TDREPORT_rtmr2 = TDREPORT_rtmr1 + SHA384_DIGEST_SIZE,
 49	TDREPORT_rtmr3 = TDREPORT_rtmr2 + SHA384_DIGEST_SIZE,
 50	TDREPORT_servtd_hash = TDREPORT_rtmr3 + SHA384_DIGEST_SIZE,
 51};
 52
 53static int tdx_do_report(sockptr_t data, sockptr_t tdreport)
 54{
 55	scoped_cond_guard(mutex_intr, return -EINTR, &mr_lock) {
 56		u8 *reportdata = tdx_report_buf + TDREPORT_reportdata;
 57		int ret;
 58
 59		if (!sockptr_is_null(data) &&
 60		    copy_from_sockptr(reportdata, data, TDX_REPORTDATA_LEN))
 61			return -EFAULT;
 62
 63		ret = tdx_mcall_get_report0(reportdata, tdx_report_buf);
 64		if (WARN_ONCE(ret, "tdx_mcall_get_report0() failed: %d", ret))
 65			return ret;
 66
 67		if (!sockptr_is_null(tdreport) &&
 68		    copy_to_sockptr(tdreport, tdx_report_buf, TDX_REPORT_LEN))
 69			return -EFAULT;
 70	}
 71	return 0;
 72}
 73
 74static int tdx_do_extend(u8 mr_ind, const u8 *data)
 75{
 76	scoped_cond_guard(mutex_intr, return -EINTR, &mr_lock) {
 77		/*
 78		 * TDX requires @extend_buf to be 64-byte aligned.
 79		 * It's safe to use REPORTDATA buffer for that purpose because
 80		 * tdx_mr_report/extend_lock() are mutually exclusive.
 81		 */
 82		u8 *extend_buf = tdx_report_buf + TDREPORT_reportdata;
 83		int ret;
 84
 85		memcpy(extend_buf, data, SHA384_DIGEST_SIZE);
 86
 87		ret = tdx_mcall_extend_rtmr(mr_ind, extend_buf);
 88		if (WARN_ONCE(ret, "tdx_mcall_extend_rtmr(%u) failed: %d", mr_ind, ret))
 89			return ret;
 90	}
 91	return 0;
 92}
 93
 94#define TDX_MR_(r) .mr_value = (void *)TDREPORT_##r, TSM_MR_(r, SHA384)
 95static struct tsm_measurement_register tdx_mrs[] = {
 96	{ TDX_MR_(rtmr0) | TSM_MR_F_RTMR },
 97	{ TDX_MR_(rtmr1) | TSM_MR_F_RTMR },
 98	{ TDX_MR_(rtmr2) | TSM_MR_F_RTMR },
 99	{ TDX_MR_(rtmr3) | TSM_MR_F_RTMR },
100	{ TDX_MR_(mrtd) },
101	{ TDX_MR_(mrconfigid) | TSM_MR_F_NOHASH },
102	{ TDX_MR_(mrowner) | TSM_MR_F_NOHASH },
103	{ TDX_MR_(mrownerconfig) | TSM_MR_F_NOHASH },
104};
105#undef TDX_MR_
106
107static int tdx_mr_refresh(const struct tsm_measurements *tm)
108{
109	return tdx_do_report(KERNEL_SOCKPTR(NULL), KERNEL_SOCKPTR(NULL));
110}
111
112static int tdx_mr_extend(const struct tsm_measurements *tm,
113			 const struct tsm_measurement_register *mr,
114			 const u8 *data)
115{
116	return tdx_do_extend(mr - tm->mrs, data);
117}
118
119static struct tsm_measurements tdx_measurements = {
120	.mrs = tdx_mrs,
121	.nr_mrs = ARRAY_SIZE(tdx_mrs),
122	.refresh = tdx_mr_refresh,
123	.write = tdx_mr_extend,
124};
125
126static const struct attribute_group *tdx_mr_init(void)
127{
128	const struct attribute_group *g;
129	int rc;
130
131	u8 *buf __free(kfree) = kzalloc(TDX_REPORT_LEN, GFP_KERNEL);
132	if (!buf)
133		return ERR_PTR(-ENOMEM);
134
135	tdx_report_buf = buf;
136	rc = tdx_mr_refresh(&tdx_measurements);
137	if (rc)
138		return ERR_PTR(rc);
139
140	/*
141	 * @mr_value was initialized with the offset only, while the base
142	 * address is being added here.
143	 */
144	for (size_t i = 0; i < ARRAY_SIZE(tdx_mrs); ++i)
145		*(long *)&tdx_mrs[i].mr_value += (long)buf;
146
147	g = tsm_mr_create_attribute_group(&tdx_measurements);
148	if (!IS_ERR(g))
149		tdx_report_buf = no_free_ptr(buf);
150
151	return g;
152}
153
154static void tdx_mr_deinit(const struct attribute_group *mr_grp)
155{
156	tsm_mr_free_attribute_group(mr_grp);
157	kfree(tdx_report_buf);
158}
159
160/*
161 * Intel's SGX QE implementation generally uses Quote size less
162 * than 8K (2K Quote data + ~5K of certificate blob).
163 */
164#define GET_QUOTE_BUF_SIZE		SZ_8K
165
166#define GET_QUOTE_CMD_VER		1
167
168/* TDX GetQuote status codes */
169#define GET_QUOTE_SUCCESS		0
170#define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
171
172#define TDX_QUOTE_MAX_LEN		(GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
173
174/* struct tdx_quote_buf: Format of Quote request buffer.
175 * @version: Quote format version, filled by TD.
176 * @status: Status code of Quote request, filled by VMM.
177 * @in_len: Length of TDREPORT, filled by TD.
178 * @out_len: Length of Quote data, filled by VMM.
179 * @data: Quote data on output or TDREPORT on input.
180 *
181 * More details of Quote request buffer can be found in TDX
182 * Guest-Host Communication Interface (GHCI) for Intel TDX 1.0,
183 * section titled "TDG.VP.VMCALL<GetQuote>"
184 */
185struct tdx_quote_buf {
186	u64 version;
187	u64 status;
188	u32 in_len;
189	u32 out_len;
190	u8 data[];
191};
192
193/* Quote data buffer */
194static void *quote_data;
195
196/* Lock to streamline quote requests */
197static DEFINE_MUTEX(quote_lock);
198
199/*
200 * GetQuote request timeout in seconds. Expect that 30 seconds
201 * is enough time for QE to respond to any Quote requests.
202 */
203static u32 getquote_timeout = 30;
204
205static long tdx_get_report0(struct tdx_report_req __user *req)
206{
207	return tdx_do_report(USER_SOCKPTR(req->reportdata),
208			     USER_SOCKPTR(req->tdreport));
209}
210
211static void free_quote_buf(void *buf)
212{
213	size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
214	unsigned int count = len >> PAGE_SHIFT;
215
216	if (set_memory_encrypted((unsigned long)buf, count)) {
217		pr_err("Failed to restore encryption mask for Quote buffer, leak it\n");
218		return;
219	}
220
221	free_pages_exact(buf, len);
222}
223
224static void *alloc_quote_buf(void)
225{
226	size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
227	unsigned int count = len >> PAGE_SHIFT;
228	void *addr;
229
230	addr = alloc_pages_exact(len, GFP_KERNEL | __GFP_ZERO);
231	if (!addr)
232		return NULL;
233
234	if (set_memory_decrypted((unsigned long)addr, count))
235		return NULL;
236
237	return addr;
238}
239
240/*
241 * wait_for_quote_completion() - Wait for Quote request completion
242 * @quote_buf: Address of Quote buffer.
243 * @timeout: Timeout in seconds to wait for the Quote generation.
244 *
245 * As per TDX GHCI v1.0 specification, sec titled "TDG.VP.VMCALL<GetQuote>",
246 * the status field in the Quote buffer will be set to GET_QUOTE_IN_FLIGHT
247 * while VMM processes the GetQuote request, and will change it to success
248 * or error code after processing is complete. So wait till the status
249 * changes from GET_QUOTE_IN_FLIGHT or the request being timed out.
250 */
251static int wait_for_quote_completion(struct tdx_quote_buf *quote_buf, u32 timeout)
252{
253	int i = 0;
254
255	/*
256	 * Quote requests usually take a few seconds to complete, so waking up
257	 * once per second to recheck the status is fine for this use case.
258	 */
259	while (quote_buf->status == GET_QUOTE_IN_FLIGHT && i++ < timeout) {
260		if (msleep_interruptible(MSEC_PER_SEC))
261			return -EINTR;
262	}
263
264	return (i == timeout) ? -ETIMEDOUT : 0;
265}
266
267static int tdx_report_new_locked(struct tsm_report *report, void *data)
268{
269	u8 *buf;
270	struct tdx_quote_buf *quote_buf = quote_data;
271	struct tsm_report_desc *desc = &report->desc;
272	u32 out_len;
273	int ret;
274	u64 err;
275
276	/*
277	 * If the previous request is timedout or interrupted, and the
278	 * Quote buf status is still in GET_QUOTE_IN_FLIGHT (owned by
279	 * VMM), don't permit any new request.
280	 */
281	if (quote_buf->status == GET_QUOTE_IN_FLIGHT)
282		return -EBUSY;
283
284	if (desc->inblob_len != TDX_REPORTDATA_LEN)
285		return -EINVAL;
286
287	memset(quote_data, 0, GET_QUOTE_BUF_SIZE);
288
289	/* Update Quote buffer header */
290	quote_buf->version = GET_QUOTE_CMD_VER;
291	quote_buf->in_len = TDX_REPORT_LEN;
292
293	ret = tdx_do_report(KERNEL_SOCKPTR(desc->inblob),
294			    KERNEL_SOCKPTR(quote_buf->data));
295	if (ret)
296		return ret;
297
298	err = tdx_hcall_get_quote(quote_data, GET_QUOTE_BUF_SIZE);
299	if (err) {
300		pr_err("GetQuote hypercall failed, status:%llx\n", err);
301		return -EIO;
302	}
303
304	ret = wait_for_quote_completion(quote_buf, getquote_timeout);
305	if (ret) {
306		pr_err("GetQuote request timedout\n");
307		return ret;
308	}
309
310	out_len = READ_ONCE(quote_buf->out_len);
311
312	if (out_len > TDX_QUOTE_MAX_LEN)
313		return -EFBIG;
314
315	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
316	if (!buf)
317		return -ENOMEM;
318
319	report->outblob = buf;
320	report->outblob_len = out_len;
321
322	/*
323	 * TODO: parse the PEM-formatted cert chain out of the quote buffer when
324	 * provided
325	 */
326
327	return ret;
328}
329
330static int tdx_report_new(struct tsm_report *report, void *data)
331{
332	scoped_cond_guard(mutex_intr, return -EINTR, &quote_lock)
333		return tdx_report_new_locked(report, data);
334}
335
336static bool tdx_report_attr_visible(int n)
337{
338	switch (n) {
339	case TSM_REPORT_GENERATION:
340	case TSM_REPORT_PROVIDER:
341		return true;
342	}
343
344	return false;
345}
346
347static bool tdx_report_bin_attr_visible(int n)
348{
349	switch (n) {
350	case TSM_REPORT_INBLOB:
351	case TSM_REPORT_OUTBLOB:
352		return true;
353	}
354
355	return false;
356}
357
358static long tdx_guest_ioctl(struct file *file, unsigned int cmd,
359			    unsigned long arg)
360{
361	switch (cmd) {
362	case TDX_CMD_GET_REPORT0:
363		return tdx_get_report0((struct tdx_report_req __user *)arg);
364	default:
365		return -ENOTTY;
366	}
367}
368
369static const struct file_operations tdx_guest_fops = {
370	.owner = THIS_MODULE,
371	.unlocked_ioctl = tdx_guest_ioctl,
372};
373
374static const struct attribute_group *tdx_attr_groups[] = {
375	NULL, /* measurements */
376	NULL
377};
378
379static struct miscdevice tdx_misc_dev = {
380	.name = KBUILD_MODNAME,
381	.minor = MISC_DYNAMIC_MINOR,
382	.fops = &tdx_guest_fops,
383	.groups = tdx_attr_groups,
384};
385
386static const struct x86_cpu_id tdx_guest_ids[] = {
387	X86_MATCH_FEATURE(X86_FEATURE_TDX_GUEST, NULL),
388	{}
389};
390MODULE_DEVICE_TABLE(x86cpu, tdx_guest_ids);
391
392static const struct tsm_report_ops tdx_tsm_ops = {
393	.name = KBUILD_MODNAME,
394	.report_new = tdx_report_new,
395	.report_attr_visible = tdx_report_attr_visible,
396	.report_bin_attr_visible = tdx_report_bin_attr_visible,
397};
398
399static int __init tdx_guest_init(void)
400{
401	int ret;
402
403	if (!x86_match_cpu(tdx_guest_ids))
404		return -ENODEV;
405
406	tdx_attr_groups[0] = tdx_mr_init();
407	if (IS_ERR(tdx_attr_groups[0]))
408		return PTR_ERR(tdx_attr_groups[0]);
409
410	ret = misc_register(&tdx_misc_dev);
411	if (ret)
412		goto deinit_mr;
413
414	quote_data = alloc_quote_buf();
415	if (!quote_data) {
416		pr_err("Failed to allocate Quote buffer\n");
417		ret = -ENOMEM;
418		goto free_misc;
419	}
420
421	ret = tsm_report_register(&tdx_tsm_ops, NULL);
422	if (ret)
423		goto free_quote;
424
425	return 0;
426
427free_quote:
428	free_quote_buf(quote_data);
429free_misc:
430	misc_deregister(&tdx_misc_dev);
431deinit_mr:
432	tdx_mr_deinit(tdx_attr_groups[0]);
433
434	return ret;
435}
436module_init(tdx_guest_init);
437
438static void __exit tdx_guest_exit(void)
439{
440	tsm_report_unregister(&tdx_tsm_ops);
441	free_quote_buf(quote_data);
442	misc_deregister(&tdx_misc_dev);
443	tdx_mr_deinit(tdx_attr_groups[0]);
444}
445module_exit(tdx_guest_exit);
446
447MODULE_AUTHOR("Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>");
448MODULE_DESCRIPTION("TDX Guest Driver");
449MODULE_LICENSE("GPL");