1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * TDX guest user interface driver
4 *
5 * Copyright (C) 2022 Intel Corporation
6 */
7
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9
10 #include <linux/kernel.h>
11 #include <linux/miscdevice.h>
12 #include <linux/mm.h>
13 #include <linux/module.h>
14 #include <linux/string.h>
15 #include <linux/uaccess.h>
16 #include <linux/set_memory.h>
17 #include <linux/io.h>
18 #include <linux/delay.h>
19 #include <linux/sockptr.h>
20 #include <linux/tsm.h>
21 #include <linux/tsm-mr.h>
22
23 #include <uapi/linux/tdx-guest.h>
24
25 #include <asm/cpu_device_id.h>
26 #include <asm/tdx.h>
27
28 /* TDREPORT buffer */
29 static u8 *tdx_report_buf;
30
31 /* Lock to serialize TDG.MR.REPORT and TDG.MR.RTMR.EXTEND TDCALLs */
32 static DEFINE_MUTEX(mr_lock);
33
34 /* TDREPORT fields */
35 enum {
36 TDREPORT_reportdata = 128,
37 TDREPORT_tee_tcb_info = 256,
38 TDREPORT_tdinfo = TDREPORT_tee_tcb_info + 256,
39 TDREPORT_attributes = TDREPORT_tdinfo,
40 TDREPORT_xfam = TDREPORT_attributes + sizeof(u64),
41 TDREPORT_mrtd = TDREPORT_xfam + sizeof(u64),
42 TDREPORT_mrconfigid = TDREPORT_mrtd + SHA384_DIGEST_SIZE,
43 TDREPORT_mrowner = TDREPORT_mrconfigid + SHA384_DIGEST_SIZE,
44 TDREPORT_mrownerconfig = TDREPORT_mrowner + SHA384_DIGEST_SIZE,
45 TDREPORT_rtmr0 = TDREPORT_mrownerconfig + SHA384_DIGEST_SIZE,
46 TDREPORT_rtmr1 = TDREPORT_rtmr0 + SHA384_DIGEST_SIZE,
47 TDREPORT_rtmr2 = TDREPORT_rtmr1 + SHA384_DIGEST_SIZE,
48 TDREPORT_rtmr3 = TDREPORT_rtmr2 + SHA384_DIGEST_SIZE,
49 TDREPORT_servtd_hash = TDREPORT_rtmr3 + SHA384_DIGEST_SIZE,
50 };
51
tdx_do_report(sockptr_t data,sockptr_t tdreport)52 static int tdx_do_report(sockptr_t data, sockptr_t tdreport)
53 {
54 scoped_cond_guard(mutex_intr, return -EINTR, &mr_lock) {
55 u8 *reportdata = tdx_report_buf + TDREPORT_reportdata;
56 int ret;
57
58 if (!sockptr_is_null(data) &&
59 copy_from_sockptr(reportdata, data, TDX_REPORTDATA_LEN))
60 return -EFAULT;
61
62 ret = tdx_mcall_get_report0(reportdata, tdx_report_buf);
63 if (WARN_ONCE(ret, "tdx_mcall_get_report0() failed: %d", ret))
64 return ret;
65
66 if (!sockptr_is_null(tdreport) &&
67 copy_to_sockptr(tdreport, tdx_report_buf, TDX_REPORT_LEN))
68 return -EFAULT;
69 }
70 return 0;
71 }
72
tdx_do_extend(u8 mr_ind,const u8 * data)73 static int tdx_do_extend(u8 mr_ind, const u8 *data)
74 {
75 scoped_cond_guard(mutex_intr, return -EINTR, &mr_lock) {
76 /*
77 * TDX requires @extend_buf to be 64-byte aligned.
78 * It's safe to use REPORTDATA buffer for that purpose because
79 * tdx_mr_report/extend_lock() are mutually exclusive.
80 */
81 u8 *extend_buf = tdx_report_buf + TDREPORT_reportdata;
82 int ret;
83
84 memcpy(extend_buf, data, SHA384_DIGEST_SIZE);
85
86 ret = tdx_mcall_extend_rtmr(mr_ind, extend_buf);
87 if (WARN_ONCE(ret, "tdx_mcall_extend_rtmr(%u) failed: %d", mr_ind, ret))
88 return ret;
89 }
90 return 0;
91 }
92
93 #define TDX_MR_(r) .mr_value = (void *)TDREPORT_##r, TSM_MR_(r, SHA384)
94 static struct tsm_measurement_register tdx_mrs[] = {
95 { TDX_MR_(rtmr0) | TSM_MR_F_RTMR },
96 { TDX_MR_(rtmr1) | TSM_MR_F_RTMR },
97 { TDX_MR_(rtmr2) | TSM_MR_F_RTMR },
98 { TDX_MR_(rtmr3) | TSM_MR_F_RTMR },
99 { TDX_MR_(mrtd) },
100 { TDX_MR_(mrconfigid) | TSM_MR_F_NOHASH },
101 { TDX_MR_(mrowner) | TSM_MR_F_NOHASH },
102 { TDX_MR_(mrownerconfig) | TSM_MR_F_NOHASH },
103 };
104 #undef TDX_MR_
105
tdx_mr_refresh(const struct tsm_measurements * tm)106 static int tdx_mr_refresh(const struct tsm_measurements *tm)
107 {
108 return tdx_do_report(KERNEL_SOCKPTR(NULL), KERNEL_SOCKPTR(NULL));
109 }
110
tdx_mr_extend(const struct tsm_measurements * tm,const struct tsm_measurement_register * mr,const u8 * data)111 static int tdx_mr_extend(const struct tsm_measurements *tm,
112 const struct tsm_measurement_register *mr,
113 const u8 *data)
114 {
115 return tdx_do_extend(mr - tm->mrs, data);
116 }
117
118 static struct tsm_measurements tdx_measurements = {
119 .mrs = tdx_mrs,
120 .nr_mrs = ARRAY_SIZE(tdx_mrs),
121 .refresh = tdx_mr_refresh,
122 .write = tdx_mr_extend,
123 };
124
tdx_mr_init(void)125 static const struct attribute_group *tdx_mr_init(void)
126 {
127 const struct attribute_group *g;
128 int rc;
129
130 u8 *buf __free(kfree) = kzalloc(TDX_REPORT_LEN, GFP_KERNEL);
131 if (!buf)
132 return ERR_PTR(-ENOMEM);
133
134 tdx_report_buf = buf;
135 rc = tdx_mr_refresh(&tdx_measurements);
136 if (rc)
137 return ERR_PTR(rc);
138
139 /*
140 * @mr_value was initialized with the offset only, while the base
141 * address is being added here.
142 */
143 for (size_t i = 0; i < ARRAY_SIZE(tdx_mrs); ++i)
144 *(long *)&tdx_mrs[i].mr_value += (long)buf;
145
146 g = tsm_mr_create_attribute_group(&tdx_measurements);
147 if (!IS_ERR(g))
148 tdx_report_buf = no_free_ptr(buf);
149
150 return g;
151 }
152
tdx_mr_deinit(const struct attribute_group * mr_grp)153 static void tdx_mr_deinit(const struct attribute_group *mr_grp)
154 {
155 tsm_mr_free_attribute_group(mr_grp);
156 kfree(tdx_report_buf);
157 }
158
159 /*
160 * Intel's SGX QE implementation generally uses Quote size less
161 * than 8K (2K Quote data + ~5K of certificate blob).
162 * DICE-based attestation uses layered evidence that requires
163 * larger Quote size (~100K).
164 */
165 #define GET_QUOTE_BUF_SIZE SZ_128K
166
167 #define GET_QUOTE_CMD_VER 1
168
169 /* TDX GetQuote status codes */
170 #define GET_QUOTE_SUCCESS 0
171 #define GET_QUOTE_IN_FLIGHT 0xffffffffffffffff
172
173 #define TDX_QUOTE_MAX_LEN (GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
174
175 /* struct tdx_quote_buf: Format of Quote request buffer.
176 * @version: Quote format version, filled by TD.
177 * @status: Status code of Quote request, filled by VMM.
178 * @in_len: Length of TDREPORT, filled by TD.
179 * @out_len: Length of Quote data, filled by VMM.
180 * @data: Quote data on output or TDREPORT on input.
181 *
182 * More details of Quote request buffer can be found in TDX
183 * Guest-Host Communication Interface (GHCI) for Intel TDX 1.0,
184 * section titled "TDG.VP.VMCALL<GetQuote>"
185 */
186 struct tdx_quote_buf {
187 u64 version;
188 u64 status;
189 u32 in_len;
190 u32 out_len;
191 u8 data[];
192 };
193
194 /* Quote data buffer */
195 static void *quote_data;
196
197 /* Lock to streamline quote requests */
198 static DEFINE_MUTEX(quote_lock);
199
200 /*
201 * GetQuote request timeout in seconds. Expect that 30 seconds
202 * is enough time for QE to respond to any Quote requests.
203 */
204 static u32 getquote_timeout = 30;
205
tdx_get_report0(struct tdx_report_req __user * req)206 static long tdx_get_report0(struct tdx_report_req __user *req)
207 {
208 return tdx_do_report(USER_SOCKPTR(req->reportdata),
209 USER_SOCKPTR(req->tdreport));
210 }
211
free_quote_buf(void * buf)212 static void free_quote_buf(void *buf)
213 {
214 size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
215 unsigned int count = len >> PAGE_SHIFT;
216
217 if (set_memory_encrypted((unsigned long)buf, count)) {
218 pr_err("Failed to restore encryption mask for Quote buffer, leak it\n");
219 return;
220 }
221
222 free_pages_exact(buf, len);
223 }
224
alloc_quote_buf(void)225 static void *alloc_quote_buf(void)
226 {
227 size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
228 unsigned int count = len >> PAGE_SHIFT;
229 void *addr;
230
231 addr = alloc_pages_exact(len, GFP_KERNEL | __GFP_ZERO);
232 if (!addr)
233 return NULL;
234
235 if (set_memory_decrypted((unsigned long)addr, count))
236 return NULL;
237
238 return addr;
239 }
240
241 /*
242 * wait_for_quote_completion() - Wait for Quote request completion
243 * @quote_buf: Address of Quote buffer.
244 * @timeout: Timeout in seconds to wait for the Quote generation.
245 *
246 * As per TDX GHCI v1.0 specification, sec titled "TDG.VP.VMCALL<GetQuote>",
247 * the status field in the Quote buffer will be set to GET_QUOTE_IN_FLIGHT
248 * while VMM processes the GetQuote request, and will change it to success
249 * or error code after processing is complete. So wait till the status
250 * changes from GET_QUOTE_IN_FLIGHT or the request being timed out.
251 */
wait_for_quote_completion(struct tdx_quote_buf * quote_buf,u32 timeout)252 static int wait_for_quote_completion(struct tdx_quote_buf *quote_buf, u32 timeout)
253 {
254 int i = 0;
255
256 /*
257 * Quote requests usually take a few seconds to complete, so waking up
258 * once per second to recheck the status is fine for this use case.
259 */
260 while (quote_buf->status == GET_QUOTE_IN_FLIGHT && i++ < timeout) {
261 if (msleep_interruptible(MSEC_PER_SEC))
262 return -EINTR;
263 }
264
265 return (i == timeout) ? -ETIMEDOUT : 0;
266 }
267
tdx_report_new_locked(struct tsm_report * report,void * data)268 static int tdx_report_new_locked(struct tsm_report *report, void *data)
269 {
270 u8 *buf;
271 struct tdx_quote_buf *quote_buf = quote_data;
272 struct tsm_report_desc *desc = &report->desc;
273 u32 out_len;
274 int ret;
275 u64 err;
276
277 /*
278 * If the previous request is timedout or interrupted, and the
279 * Quote buf status is still in GET_QUOTE_IN_FLIGHT (owned by
280 * VMM), don't permit any new request.
281 */
282 if (quote_buf->status == GET_QUOTE_IN_FLIGHT)
283 return -EBUSY;
284
285 if (desc->inblob_len != TDX_REPORTDATA_LEN)
286 return -EINVAL;
287
288 memset(quote_data, 0, GET_QUOTE_BUF_SIZE);
289
290 /* Update Quote buffer header */
291 quote_buf->version = GET_QUOTE_CMD_VER;
292 quote_buf->in_len = TDX_REPORT_LEN;
293
294 ret = tdx_do_report(KERNEL_SOCKPTR(desc->inblob),
295 KERNEL_SOCKPTR(quote_buf->data));
296 if (ret)
297 return ret;
298
299 err = tdx_hcall_get_quote(quote_data, GET_QUOTE_BUF_SIZE);
300 if (err) {
301 pr_err("GetQuote hypercall failed, status:%llx\n", err);
302 return -EIO;
303 }
304
305 ret = wait_for_quote_completion(quote_buf, getquote_timeout);
306 if (ret) {
307 pr_err("GetQuote request timedout\n");
308 return ret;
309 }
310
311 if (quote_buf->status != GET_QUOTE_SUCCESS) {
312 pr_debug("GetQuote request failed, status:%llx\n", quote_buf->status);
313 return -EIO;
314 }
315
316 out_len = READ_ONCE(quote_buf->out_len);
317
318 if (out_len > TDX_QUOTE_MAX_LEN)
319 return -EFBIG;
320
321 buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
322 if (!buf)
323 return -ENOMEM;
324
325 report->outblob = buf;
326 report->outblob_len = out_len;
327
328 /*
329 * TODO: parse the PEM-formatted cert chain out of the quote buffer when
330 * provided
331 */
332
333 return ret;
334 }
335
tdx_report_new(struct tsm_report * report,void * data)336 static int tdx_report_new(struct tsm_report *report, void *data)
337 {
338 scoped_cond_guard(mutex_intr, return -EINTR, "e_lock)
339 return tdx_report_new_locked(report, data);
340 }
341
tdx_report_attr_visible(int n)342 static bool tdx_report_attr_visible(int n)
343 {
344 switch (n) {
345 case TSM_REPORT_GENERATION:
346 case TSM_REPORT_PROVIDER:
347 return true;
348 }
349
350 return false;
351 }
352
tdx_report_bin_attr_visible(int n)353 static bool tdx_report_bin_attr_visible(int n)
354 {
355 switch (n) {
356 case TSM_REPORT_INBLOB:
357 case TSM_REPORT_OUTBLOB:
358 return true;
359 }
360
361 return false;
362 }
363
tdx_guest_ioctl(struct file * file,unsigned int cmd,unsigned long arg)364 static long tdx_guest_ioctl(struct file *file, unsigned int cmd,
365 unsigned long arg)
366 {
367 switch (cmd) {
368 case TDX_CMD_GET_REPORT0:
369 return tdx_get_report0((struct tdx_report_req __user *)arg);
370 default:
371 return -ENOTTY;
372 }
373 }
374
375 static const struct file_operations tdx_guest_fops = {
376 .owner = THIS_MODULE,
377 .unlocked_ioctl = tdx_guest_ioctl,
378 };
379
380 static const struct attribute_group *tdx_attr_groups[] = {
381 NULL, /* measurements */
382 NULL
383 };
384
385 static struct miscdevice tdx_misc_dev = {
386 .name = KBUILD_MODNAME,
387 .minor = MISC_DYNAMIC_MINOR,
388 .fops = &tdx_guest_fops,
389 .groups = tdx_attr_groups,
390 };
391
392 static const struct x86_cpu_id tdx_guest_ids[] = {
393 X86_MATCH_FEATURE(X86_FEATURE_TDX_GUEST, NULL),
394 {}
395 };
396 MODULE_DEVICE_TABLE(x86cpu, tdx_guest_ids);
397
398 static const struct tsm_report_ops tdx_tsm_ops = {
399 .name = KBUILD_MODNAME,
400 .report_new = tdx_report_new,
401 .report_attr_visible = tdx_report_attr_visible,
402 .report_bin_attr_visible = tdx_report_bin_attr_visible,
403 };
404
tdx_guest_init(void)405 static int __init tdx_guest_init(void)
406 {
407 int ret;
408
409 if (!x86_match_cpu(tdx_guest_ids))
410 return -ENODEV;
411
412 tdx_attr_groups[0] = tdx_mr_init();
413 if (IS_ERR(tdx_attr_groups[0]))
414 return PTR_ERR(tdx_attr_groups[0]);
415
416 ret = misc_register(&tdx_misc_dev);
417 if (ret)
418 goto deinit_mr;
419
420 quote_data = alloc_quote_buf();
421 if (!quote_data) {
422 pr_err("Failed to allocate Quote buffer\n");
423 ret = -ENOMEM;
424 goto free_misc;
425 }
426
427 ret = tsm_report_register(&tdx_tsm_ops, NULL);
428 if (ret)
429 goto free_quote;
430
431 return 0;
432
433 free_quote:
434 free_quote_buf(quote_data);
435 free_misc:
436 misc_deregister(&tdx_misc_dev);
437 deinit_mr:
438 tdx_mr_deinit(tdx_attr_groups[0]);
439
440 return ret;
441 }
442 module_init(tdx_guest_init);
443
tdx_guest_exit(void)444 static void __exit tdx_guest_exit(void)
445 {
446 tsm_report_unregister(&tdx_tsm_ops);
447 free_quote_buf(quote_data);
448 misc_deregister(&tdx_misc_dev);
449 tdx_mr_deinit(tdx_attr_groups[0]);
450 }
451 module_exit(tdx_guest_exit);
452
453 MODULE_AUTHOR("Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>");
454 MODULE_DESCRIPTION("TDX Guest Driver");
455 MODULE_LICENSE("GPL");
456