From nobody Sun Nov 24 08:58:16 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1725566364; cv=none; d=zohomail.com; s=zohoarc; b=DPbYqgqZ8Xmr5e0us/TLCUiZmji7VHwARqwJIaVw4u9ddhvx02+iep94IMfWxcbVxanBG+djFh/t/FaPhAniDBj1feqnG5I2igHKFsTyyqFZaAs7W8/sEGawDopZwdRXhTZJ5zNeVk8Fcqatz+e8zT7RSw75x/c5r0s1uR/9wpA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1725566364; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hhMjTsQKStT+/SjSYAuvmvPjXZgsrUDCW4DUN02r8L0=; b=lvzhsOLjObM/R827BRzrPI5zeFGIMqI256pC67JAkyfzm0nWoXO5VedZ2OzgP8IQMLVx+jEgDRjtsu266kUf4FT0kPGj3E2DdmRbNkeP6oo/Gd6n2payk6HNtorzNEDmoJZ2D2KjE/ETHfLvIfrwhx9jdDPX6HZEoJ0HW1+kDB8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1725566364491328.5176252335766; Thu, 5 Sep 2024 12:59:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smIcV-0007SE-OV; Thu, 05 Sep 2024 15:58:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smIcT-0007FE-C5 for qemu-devel@nongnu.org; Thu, 05 Sep 2024 15:58:17 -0400 Received: from mail-pg1-x534.google.com ([2607:f8b0:4864:20::534]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1smIcQ-0005Rm-EI for qemu-devel@nongnu.org; Thu, 05 Sep 2024 15:58:17 -0400 Received: by mail-pg1-x534.google.com with SMTP id 41be03b00d2f7-6c5bcb8e8edso929962a12.2 for ; Thu, 05 Sep 2024 12:58:14 -0700 (PDT) Received: from localhost.localdomain ([103.103.35.145]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-206aea5554dsm32031355ad.235.2024.09.05.12.58.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Sep 2024 12:58:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1725566293; x=1726171093; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hhMjTsQKStT+/SjSYAuvmvPjXZgsrUDCW4DUN02r8L0=; b=dJsRXjMAEhHp8XfSKRMBn31IrsBmTT6QePZzCqvlAyC3WMDR7UM6JkHN4qt987qrw8 HVzzuRhcfD8MrsXmLyA8bQYNIMBRhg8zKfrNKVQpV2dXshJI1lwDs0P+lW3X/ooau0q7 +i1h7xG5BrJkfTtlNDB8nWYgpY3eBzqDXmd68gR4mHsm7/aOYCq/a8+6A8HpZQIiMVnb IS6yTwQFG0XOVDk59hnfNJpRLa6/ih34RcGGe2xvPQdfmBYZE2bVi8eoaYjAfm+Y6wNA tuN67QIl/BTDVH0UphAoQ7IuOHF9iYyDXGTCqfmATWptjBzi3eBBawcV2JwV8HLrIU0d aRuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725566293; x=1726171093; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hhMjTsQKStT+/SjSYAuvmvPjXZgsrUDCW4DUN02r8L0=; b=Dt5f0KxCOk2SqJlRWdchbnb7ELHB93GxUU0VqrVkyu/0Oh1m5wW3iIrNzahr7yLyKK a9wkvnb5dBRgJevSGaY4wBsOz4+9UXrU6Bwgc3fWiDK425d7J+Ty3dB3eKmvRV2CJUYE UZ+kIMt807YVJ/Mlgb+3WJT89o5UfFgDmEklYxQ5RTiA+xpIK4I8L3FPWe9ogU2/qPXH Qyyh7F3+Xbj3nRXRUrfWFq1yFjt2gjXf5nhER1lKL15nNMrBms1hWJ7uC4fKz854jTJx sThetvcTKnRMQfMJlJyR2z7xDVEXL91bdfsA2ggP+KKRdLEg8R0ve64GociT/OX82VHB 7LHQ== X-Gm-Message-State: AOJu0Yz4Z5P29+SvDnpWwPuPrzqiTEyT0t9XJanf3gn48+NstjDRz8Wi C4+4cSUA5GEkMXEHsmdv5CeAR5C9SFurH1wNxlyeFEsNbVzeD+FtlrMPWg== X-Google-Smtp-Source: AGHT+IGQEXDmZXvp872iB16qvAQGzz29Mnt1mlnWDSrPl2Q9d0Xx8qy5hCaTYleLNQHXwOW+ZNfLcw== X-Received: by 2002:a17:903:230a:b0:206:c486:4c33 with SMTP id d9443c01a7336-206f0522330mr2409635ad.30.1725566292496; Thu, 05 Sep 2024 12:58:12 -0700 (PDT) From: Dorjoy Chowdhury To: qemu-devel@nongnu.org Cc: graf@amazon.com, agraf@csgraf.de, stefanha@redhat.com, pbonzini@redhat.com, slp@redhat.com, richard.henderson@linaro.org, eduardo@habkost.net, mst@redhat.com, marcel.apfelbaum@gmail.com, berrange@redhat.com, philmd@linaro.org Subject: [PATCH v6 6/8] hw/core: Add Enclave Image Format (EIF) related helpers Date: Fri, 6 Sep 2024 01:57:33 +0600 Message-Id: <20240905195735.16911-7-dorjoychy111@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240905195735.16911-1-dorjoychy111@gmail.com> References: <20240905195735.16911-1-dorjoychy111@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2607:f8b0:4864:20::534; envelope-from=dorjoychy111@gmail.com; helo=mail-pg1-x534.google.com X-Spam_score_int: 15 X-Spam_score: 1.5 X-Spam_bar: + X-Spam_report: (1.5 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1725566366060116600 Content-Type: text/plain; charset="utf-8" An EIF (Enclave Image Format)[1] file is used to boot an AWS nitro enclave[2] virtual machine. The EIF file contains the necessary kernel, cmdline, ramdisk(s) sections to boot. Some helper functions have been introduced for extracting the necessary sections from an EIF file and then writing them to temporary files as well as computing SHA384 hashes from the section data. These will be used in the following commit to add support for nitro-enclave machine type in QEMU. The files added in this commit are not compiled yet but will be added to the hw/core/meson.build file in the following commit where CONFIG_NITRO_ENCLAVE will be introduced. [1] https://github.com/aws/aws-nitro-enclaves-image-format [2] https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html Signed-off-by: Dorjoy Chowdhury --- MAINTAINERS | 7 + hw/core/eif.c | 719 ++++++++++++++++++++++++++++++++++++++++++++++++++ hw/core/eif.h | 22 ++ 3 files changed, 748 insertions(+) create mode 100644 hw/core/eif.c create mode 100644 hw/core/eif.h diff --git a/MAINTAINERS b/MAINTAINERS index b371c24747..ead98e645a 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1879,6 +1879,13 @@ F: hw/i386/microvm.c F: include/hw/i386/microvm.h F: pc-bios/bios-microvm.bin =20 +nitro-enclave +M: Alexander Graf +M: Dorjoy Chowdhury +S: Maintained +F: hw/core/eif.c +F: hw/core/eif.h + Machine core M: Eduardo Habkost M: Marcel Apfelbaum diff --git a/hw/core/eif.c b/hw/core/eif.c new file mode 100644 index 0000000000..2e0759e18c --- /dev/null +++ b/hw/core/eif.c @@ -0,0 +1,719 @@ +/* + * EIF (Enclave Image Format) related helpers + * + * Copyright (c) 2024 Dorjoy Chowdhury + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * (at your option) any later version. See the COPYING file in the + * top-level directory. + */ + +#include "qemu/osdep.h" +#include "qemu/bswap.h" +#include "qapi/error.h" +#include "crypto/hash.h" +#include "crypto/x509-utils.h" +#include /* for crc32 */ +#include + +#include "hw/core/eif.h" + +#define MAX_SECTIONS 32 + +/* members are ordered according to field order in .eif file */ +typedef struct EifHeader { + uint8_t magic[4]; /* must be .eif in ascii i.e., [46, 101, 105, 102] = */ + uint16_t version; + uint16_t flags; + uint64_t default_memory; + uint64_t default_cpus; + uint16_t reserved; + uint16_t section_cnt; + uint64_t section_offsets[MAX_SECTIONS]; + uint64_t section_sizes[MAX_SECTIONS]; + uint32_t unused; + uint32_t eif_crc32; +} QEMU_PACKED EifHeader; + +/* members are ordered according to field order in .eif file */ +typedef struct EifSectionHeader { + /* + * 0 =3D invalid, 1 =3D kernel, 2 =3D cmdline, 3 =3D ramdisk, 4 =3D si= gnature, + * 5 =3D metadata + */ + uint16_t section_type; + uint16_t flags; + uint64_t section_size; +} QEMU_PACKED EifSectionHeader; + +enum EifSectionTypes { + EIF_SECTION_INVALID =3D 0, + EIF_SECTION_KERNEL =3D 1, + EIF_SECTION_CMDLINE =3D 2, + EIF_SECTION_RAMDISK =3D 3, + EIF_SECTION_SIGNATURE =3D 4, + EIF_SECTION_METADATA =3D 5, + EIF_SECTION_MAX =3D 6, +}; + +static const char *section_type_to_string(uint16_t type) +{ + const char *str; + switch (type) { + case EIF_SECTION_INVALID: + str =3D "invalid"; + break; + case EIF_SECTION_KERNEL: + str =3D "kernel"; + break; + case EIF_SECTION_CMDLINE: + str =3D "cmdline"; + break; + case EIF_SECTION_RAMDISK: + str =3D "ramdisk"; + break; + case EIF_SECTION_SIGNATURE: + str =3D "signature"; + break; + case EIF_SECTION_METADATA: + str =3D "metadata"; + break; + default: + str =3D "unknown"; + break; + } + + return str; +} + +static bool read_eif_header(FILE *f, EifHeader *header, uint32_t *crc, + Error **errp) +{ + size_t got; + size_t header_size =3D sizeof(*header); + + got =3D fread(header, 1, header_size, f); + if (got !=3D header_size) { + error_setg(errp, "Failed to read EIF header"); + return false; + } + + if (memcmp(header->magic, ".eif", 4) !=3D 0) { + error_setg(errp, "Invalid EIF image. Magic mismatch."); + return false; + } + + /* Exclude header->eif_crc32 field from CRC calculation */ + *crc =3D crc32(*crc, (uint8_t *)header, header_size - 4); + + header->version =3D be16_to_cpu(header->version); + header->flags =3D be16_to_cpu(header->flags); + header->default_memory =3D be64_to_cpu(header->default_memory); + header->default_cpus =3D be64_to_cpu(header->default_cpus); + header->reserved =3D be16_to_cpu(header->reserved); + header->section_cnt =3D be16_to_cpu(header->section_cnt); + + for (int i =3D 0; i < MAX_SECTIONS; ++i) { + header->section_offsets[i] =3D be64_to_cpu(header->section_offsets= [i]); + } + + for (int i =3D 0; i < MAX_SECTIONS; ++i) { + header->section_sizes[i] =3D be64_to_cpu(header->section_sizes[i]); + } + + header->unused =3D be32_to_cpu(header->unused); + header->eif_crc32 =3D be32_to_cpu(header->eif_crc32); + return true; +} + +static bool read_eif_section_header(FILE *f, EifSectionHeader *section_hea= der, + uint32_t *crc, Error **errp) +{ + size_t got; + size_t section_header_size =3D sizeof(*section_header); + + got =3D fread(section_header, 1, section_header_size, f); + if (got !=3D section_header_size) { + error_setg(errp, "Failed to read EIF section header"); + return false; + } + + *crc =3D crc32(*crc, (uint8_t *)section_header, section_header_size); + + section_header->section_type =3D be16_to_cpu(section_header->section_t= ype); + section_header->flags =3D be16_to_cpu(section_header->flags); + section_header->section_size =3D be64_to_cpu(section_header->section_s= ize); + return true; +} + +/* + * Upon success, the caller is responsible for unlinking and freeing *tmp_= path. + */ +static bool get_tmp_file(const char *template, char **tmp_path, Error **er= rp) +{ + int tmp_fd; + + *tmp_path =3D NULL; + tmp_fd =3D g_file_open_tmp(template, tmp_path, NULL); + if (tmp_fd < 0 || *tmp_path =3D=3D NULL) { + error_setg(errp, "Failed to create temporary file for template %s", + template); + return false; + } + + close(tmp_fd); + return true; +} + +static void safe_fclose(FILE *f) +{ + if (f) { + fclose(f); + } +} + +static void safe_unlink(char *f) +{ + if (f) { + unlink(f); + } +} + +/* + * Upon success, the caller is reponsible for unlinking and freeing *kerne= l_path + */ +static bool read_eif_kernel(FILE *f, uint64_t size, char **kernel_path, + uint8_t *kernel, uint32_t *crc, Error **errp) +{ + size_t got; + FILE *tmp_file =3D NULL; + + *kernel_path =3D NULL; + if (!get_tmp_file("eif-kernel-XXXXXX", kernel_path, errp)) { + goto cleanup; + } + + tmp_file =3D fopen(*kernel_path, "wb"); + if (tmp_file =3D=3D NULL) { + error_setg_errno(errp, errno, "Failed to open temporary file %s", + *kernel_path); + goto cleanup; + } + + got =3D fread(kernel, 1, size, f); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to read EIF kernel section data"); + goto cleanup; + } + + got =3D fwrite(kernel, 1, size, tmp_file); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to write EIF kernel section data to tempo= rary" + " file"); + goto cleanup; + } + + *crc =3D crc32(*crc, kernel, size); + fclose(tmp_file); + + return true; + + cleanup: + safe_fclose(tmp_file); + + safe_unlink(*kernel_path); + g_free(*kernel_path); + *kernel_path =3D NULL; + + return false; +} + +static bool read_eif_cmdline(FILE *f, uint64_t size, char *cmdline, + uint32_t *crc, Error **errp) +{ + size_t got =3D fread(cmdline, 1, size, f); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to read EIF cmdline section data"); + return false; + } + + *crc =3D crc32(*crc, (uint8_t *)cmdline, size); + return true; +} + +static bool read_eif_ramdisk(FILE *eif, FILE *initrd, uint64_t size, + uint8_t *ramdisk, uint32_t *crc, Error **errp) +{ + size_t got; + + got =3D fread(ramdisk, 1, size, eif); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to read EIF ramdisk section data"); + return false; + } + + got =3D fwrite(ramdisk, 1, size, initrd); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to write EIF ramdisk data to temporary fi= le"); + return false; + } + + *crc =3D crc32(*crc, ramdisk, size); + return true; +} + +static bool get_signature_fingerprint_sha384(FILE *eif, uint64_t size, + uint8_t *sha384, + uint32_t *crc, + Error **errp) +{ + size_t got; + g_autofree uint8_t *sig =3D NULL; + g_autofree uint8_t *cert =3D NULL; + cbor_item_t *item =3D NULL; + cbor_item_t *pcr0 =3D NULL; + size_t len; + size_t hash_len =3D QCRYPTO_HASH_DIGEST_LEN_SHA384; + struct cbor_pair *pair; + struct cbor_load_result result; + bool ret =3D false; + + sig =3D g_malloc(size); + got =3D fread(sig, 1, size, eif); + if ((uint64_t) got !=3D size) { + error_setg(errp, "Failed to read EIF signature section data"); + goto cleanup; + } + + *crc =3D crc32(*crc, sig, size); + + item =3D cbor_load(sig, size, &result); + if (!item || result.error.code !=3D CBOR_ERR_NONE) { + error_setg(errp, "Failed to load signature section data as CBOR"); + goto cleanup; + } + if (!cbor_isa_array(item) || cbor_array_size(item) < 1) { + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + pcr0 =3D cbor_array_get(item, 0); + if (!pcr0) { + error_setg(errp, "Failed to get PCR0 signature"); + goto cleanup; + } + if (!cbor_isa_map(pcr0) || cbor_map_size(pcr0) !=3D 2) { + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + pair =3D cbor_map_handle(pcr0); + if (!cbor_isa_string(pair->key) || cbor_string_length(pair->key) !=3D = 19 || + memcmp(cbor_string_handle(pair->key), "signing_certificate", 19) != =3D 0) { + error_setg(errp, "Invalid signautre CBOR"); + goto cleanup; + } + if (!cbor_isa_array(pair->value)) { + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + len =3D cbor_array_size(pair->value); + if (len =3D=3D 0) { + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + cert =3D g_malloc(len); + for (int i =3D 0; i < len; ++i) { + cbor_item_t *tmp =3D cbor_array_get(pair->value, i); + if (!tmp) { + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + if (!cbor_isa_uint(tmp) || cbor_int_get_width(tmp) !=3D CBOR_INT_8= ) { + cbor_decref(&tmp); + error_setg(errp, "Invalid signature CBOR"); + goto cleanup; + } + cert[i] =3D cbor_get_uint8(tmp); + cbor_decref(&tmp); + } + + if (qcrypto_get_x509_cert_fingerprint(cert, len, QCRYPTO_HASH_ALG_SHA3= 84, + sha384, &hash_len, errp)) { + goto cleanup; + } + + ret =3D true; + + cleanup: + if (pcr0) { + cbor_decref(&pcr0); + } + if (item) { + cbor_decref(&item); + } + return ret; +} + +/* Expects file to have offset 0 before this function is called */ +static long get_file_size(FILE *f, Error **errp) +{ + long size; + + if (fseek(f, 0, SEEK_END) !=3D 0) { + error_setg_errno(errp, errno, "Failed to seek to the end of file"); + return -1; + } + + size =3D ftell(f); + if (size =3D=3D -1) { + error_setg_errno(errp, errno, "Failed to get offset"); + return -1; + } + + if (fseek(f, 0, SEEK_SET) !=3D 0) { + error_setg_errno(errp, errno, "Failed to seek back to the start"); + return -1; + } + + return size; +} + +static bool get_SHA384_digest(GList *list, uint8_t *digest, Error **errp) +{ + size_t digest_len =3D QCRYPTO_HASH_DIGEST_LEN_SHA384; + size_t list_len =3D g_list_length(list); + struct iovec *iovec_list =3D g_new0(struct iovec, list_len); + bool ret =3D true; + GList *l; + int i; + + for (i =3D 0, l =3D list; l !=3D NULL; l =3D l->next, i++) { + iovec_list[i] =3D *(struct iovec *) l->data; + } + + if (qcrypto_hash_bytesv(QCRYPTO_HASH_ALG_SHA384, iovec_list, list_len, + &digest, &digest_len, errp) < 0) { + ret =3D false; + } + + g_free(iovec_list); + return ret; +} + +static void free_iovec(struct iovec *iov) +{ + if (iov) { + g_free(iov->iov_base); + g_free(iov); + } +} + +/* + * Upon success, the caller is reponsible for unlinking and freeing + * *kernel_path, *initrd_path and freeing *cmdline. + */ +bool read_eif_file(const char *eif_path, const char *machine_initrd, + char **kernel_path, char **initrd_path, char **cmdline, + uint8_t *image_sha384, uint8_t *bootstrap_sha384, + uint8_t *app_sha384, uint8_t *fingerprint_sha384, + bool *signature_found, Error **errp) +{ + FILE *f =3D NULL; + FILE *machine_initrd_f =3D NULL; + FILE *initrd_path_f =3D NULL; + long machine_initrd_size; + uint32_t crc =3D 0; + EifHeader eif_header; + bool seen_sections[EIF_SECTION_MAX] =3D {false}; + /* kernel + ramdisks + cmdline sha384 hash */ + GList *iov_PCR0 =3D NULL; + /* kernel + boot ramdisk + cmdline sha384 hash */ + GList *iov_PCR1 =3D NULL; + /* application ramdisk(s) hash */ + GList *iov_PCR2 =3D NULL; + uint8_t *ptr =3D NULL; + struct iovec *iov_ptr =3D NULL; + + *signature_found =3D false; + *kernel_path =3D *initrd_path =3D *cmdline =3D NULL; + + f =3D fopen(eif_path, "rb"); + if (f =3D=3D NULL) { + error_setg_errno(errp, errno, "Failed to open %s", eif_path); + goto cleanup; + } + + if (!read_eif_header(f, &eif_header, &crc, errp)) { + goto cleanup; + } + + if (eif_header.version < 4) { + error_setg(errp, "Expected EIF version 4 or greater"); + goto cleanup; + } + + if (eif_header.flags !=3D 0) { + error_setg(errp, "Expected EIF flags to be 0"); + goto cleanup; + } + + if (eif_header.section_cnt > MAX_SECTIONS) { + error_setg(errp, "EIF header section count must not be greater tha= n " + "%d but found %d", MAX_SECTIONS, eif_header.section_cnt= ); + goto cleanup; + } + + for (int i =3D 0; i < eif_header.section_cnt; ++i) { + EifSectionHeader hdr; + uint16_t section_type; + + if (fseek(f, eif_header.section_offsets[i], SEEK_SET) !=3D 0) { + error_setg_errno(errp, errno, "Failed to offset to %lu in EIF = file", + eif_header.section_offsets[i]); + goto cleanup; + } + + if (!read_eif_section_header(f, &hdr, &crc, errp)) { + goto cleanup; + } + + if (hdr.flags !=3D 0) { + error_setg(errp, "Expected EIF section header flags to be 0"); + goto cleanup; + } + + if (eif_header.section_sizes[i] !=3D hdr.section_size) { + error_setg(errp, "EIF section size mismatch between header and= " + "section header: header %lu, section header %lu", + eif_header.section_sizes[i], + hdr.section_size); + goto cleanup; + } + + section_type =3D hdr.section_type; + + switch (section_type) { + case EIF_SECTION_KERNEL: + if (seen_sections[EIF_SECTION_KERNEL]) { + error_setg(errp, "Invalid EIF image. More than 1 kernel " + "section"); + goto cleanup; + } + + ptr =3D g_malloc(hdr.section_size); + + iov_ptr =3D g_malloc(sizeof(struct iovec)); + iov_ptr->iov_base =3D ptr; + iov_ptr->iov_len =3D hdr.section_size; + + iov_PCR0 =3D g_list_append(iov_PCR0, iov_ptr); + iov_PCR1 =3D g_list_append(iov_PCR1, iov_ptr); + + if (!read_eif_kernel(f, hdr.section_size, kernel_path, ptr, &c= rc, + errp)) { + goto cleanup; + } + + break; + case EIF_SECTION_CMDLINE: + { + uint64_t size; + uint8_t *cmdline_copy; + if (seen_sections[EIF_SECTION_CMDLINE]) { + error_setg(errp, "Invalid EIF image. More than 1 cmdline " + "section"); + goto cleanup; + } + size =3D hdr.section_size; + *cmdline =3D g_malloc(size + 1); + if (!read_eif_cmdline(f, size, *cmdline, &crc, errp)) { + goto cleanup; + } + (*cmdline)[size] =3D '\0'; + + /* + * We make a copy of '*cmdline' for putting it in iovecs so th= at + * we can easily free all the iovec entries later as we cannot + * free '*cmdline' which is used by the caller. + */ + cmdline_copy =3D g_memdup2(*cmdline, size); + + iov_ptr =3D g_malloc(sizeof(struct iovec)); + iov_ptr->iov_base =3D cmdline_copy; + iov_ptr->iov_len =3D size; + + iov_PCR0 =3D g_list_append(iov_PCR0, iov_ptr); + iov_PCR1 =3D g_list_append(iov_PCR1, iov_ptr); + break; + } + case EIF_SECTION_RAMDISK: + { + if (!seen_sections[EIF_SECTION_RAMDISK]) { + /* + * If this is the first time we are seeing a ramdisk secti= on, + * we need to create the initrd temporary file. + */ + if (!get_tmp_file("eif-initrd-XXXXXX", initrd_path, errp))= { + goto cleanup; + } + initrd_path_f =3D fopen(*initrd_path, "wb"); + if (initrd_path_f =3D=3D NULL) { + error_setg_errno(errp, errno, "Failed to open file %s", + *initrd_path); + goto cleanup; + } + } + + ptr =3D g_malloc(hdr.section_size); + + iov_ptr =3D g_malloc(sizeof(struct iovec)); + iov_ptr->iov_base =3D ptr; + iov_ptr->iov_len =3D hdr.section_size; + + iov_PCR0 =3D g_list_append(iov_PCR0, iov_ptr); + /* + * If it's the first ramdisk, we need to hash it into bootstrap + * i.e., iov_PCR1, otherwise we need to hash it into app i.e., + * iov_PCR2. + */ + if (!seen_sections[EIF_SECTION_RAMDISK]) { + iov_PCR1 =3D g_list_append(iov_PCR1, iov_ptr); + } else { + iov_PCR2 =3D g_list_append(iov_PCR2, iov_ptr); + } + + if (!read_eif_ramdisk(f, initrd_path_f, hdr.section_size, ptr, + &crc, errp)) { + goto cleanup; + } + + break; + } + case EIF_SECTION_SIGNATURE: + *signature_found =3D true; + if (!get_signature_fingerprint_sha384(f, hdr.section_size, + fingerprint_sha384, &crc, + errp)) { + goto cleanup; + } + break; + default: + /* other sections including invalid or unknown sections */ + { + uint8_t *buf; + size_t got; + uint64_t size =3D hdr.section_size; + buf =3D g_malloc(size); + got =3D fread(buf, 1, size, f); + if ((uint64_t) got !=3D size) { + g_free(buf); + error_setg(errp, "Failed to read EIF %s section data", + section_type_to_string(section_type)); + goto cleanup; + } + crc =3D crc32(crc, buf, size); + g_free(buf); + break; + } + } + + if (section_type < EIF_SECTION_MAX) { + seen_sections[section_type] =3D true; + } + } + + if (!seen_sections[EIF_SECTION_KERNEL]) { + error_setg(errp, "Invalid EIF image. No kernel section."); + goto cleanup; + } + if (!seen_sections[EIF_SECTION_CMDLINE]) { + error_setg(errp, "Invalid EIF image. No cmdline section."); + goto cleanup; + } + if (!seen_sections[EIF_SECTION_RAMDISK]) { + error_setg(errp, "Invalid EIF image. No ramdisk section."); + goto cleanup; + } + + if (eif_header.eif_crc32 !=3D crc) { + error_setg(errp, "CRC mismatch. Expected %u but header has %u.", + crc, eif_header.eif_crc32); + goto cleanup; + } + + /* + * Let's append the initrd file from "-initrd" option if any. Although + * we pass the crc pointer to read_eif_ramdisk, it is not useful anymo= re. + * We have already done the crc mismatch check above this code. + */ + if (machine_initrd) { + machine_initrd_f =3D fopen(machine_initrd, "rb"); + if (machine_initrd_f =3D=3D NULL) { + error_setg_errno(errp, errno, "Failed to open initrd file %s", + machine_initrd); + goto cleanup; + } + + machine_initrd_size =3D get_file_size(machine_initrd_f, errp); + if (machine_initrd_size =3D=3D -1) { + goto cleanup; + } + + ptr =3D g_malloc(machine_initrd_size); + + iov_ptr =3D g_malloc(sizeof(struct iovec)); + iov_ptr->iov_base =3D ptr; + iov_ptr->iov_len =3D machine_initrd_size; + + iov_PCR0 =3D g_list_append(iov_PCR0, iov_ptr); + iov_PCR2 =3D g_list_append(iov_PCR2, iov_ptr); + + if (!read_eif_ramdisk(machine_initrd_f, initrd_path_f, + machine_initrd_size, ptr, &crc, errp)) { + goto cleanup; + } + } + + if (!get_SHA384_digest(iov_PCR0, image_sha384, errp)) { + goto cleanup; + } + if (!get_SHA384_digest(iov_PCR1, bootstrap_sha384, errp)) { + goto cleanup; + } + if (!get_SHA384_digest(iov_PCR2, app_sha384, errp)) { + goto cleanup; + } + + /* + * We only need to free iov_PCR0 entries because iov_PCR1 and + * iov_PCR2 iovec entries are subsets of iov_PCR0 iovec entries. + */ + g_list_free_full(iov_PCR0, (GDestroyNotify) free_iovec); + g_list_free(iov_PCR1); + g_list_free(iov_PCR2); + fclose(f); + fclose(initrd_path_f); + safe_fclose(machine_initrd_f); + return true; + + cleanup: + g_list_free_full(iov_PCR0, (GDestroyNotify) free_iovec); + g_list_free(iov_PCR1); + g_list_free(iov_PCR2); + + safe_fclose(f); + safe_fclose(initrd_path_f); + safe_fclose(machine_initrd_f); + + safe_unlink(*kernel_path); + g_free(*kernel_path); + *kernel_path =3D NULL; + + safe_unlink(*initrd_path); + g_free(*initrd_path); + *initrd_path =3D NULL; + + g_free(*cmdline); + *cmdline =3D NULL; + + return false; +} diff --git a/hw/core/eif.h b/hw/core/eif.h new file mode 100644 index 0000000000..fed3cb5514 --- /dev/null +++ b/hw/core/eif.h @@ -0,0 +1,22 @@ +/* + * EIF (Enclave Image Format) related helpers + * + * Copyright (c) 2024 Dorjoy Chowdhury + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * (at your option) any later version. See the COPYING file in the + * top-level directory. + */ + +#ifndef HW_CORE_EIF_H +#define HW_CORE_EIF_H + +bool read_eif_file(const char *eif_path, const char *machine_initrd, + char **kernel_path, char **initrd_path, + char **kernel_cmdline, uint8_t *image_sha384, + uint8_t *bootstrap_sha384, uint8_t *app_sha384, + uint8_t *fingerprint_sha384, bool *signature_found, + Error **errp); + +#endif + --=20 2.39.2