From nobody Sat Apr 5 15:03:28 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1743515097; cv=none; d=zohomail.com; s=zohoarc; b=O16zXQi5gojfgNGTg7TfvIiMB8TWsAPskomy3FMS6dN+nfdCOCMO/dP1oQoObfBMtDaX1x8rRzsAFcBsGiTVVVQlu9SRYB8QqOuGLSCdu4/9w7sONoGpPBtYz8M9UDHvT68zJUIhy/56KdqCcksuM8YXmPlA1NQ9HKKV8EebDPs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1743515097; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oVh8Qvk5m57Mfw/xVFhrp4EOWRXgnlBlJHxuPxWY6V8=; b=Rist9iFtyjqfHR+Y2huoyNCQakSCUpXMmP5J0tt9kV3U9xwSQwjX1LrUC7VJ/axypBT4xpqOLGEEpjcKNsk5JcIGeFmdSa/kloxDCmad66yLEHNHJmvvjY6IdhBdFmDJeo5+wepOubP/g9gbWk8ewd8FPY8a3rlou1CrHyPbE4Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1743515097049514.3104083170393; Tue, 1 Apr 2025 06:44:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tzbt5-0006En-Ag; Tue, 01 Apr 2025 09:42:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tzbsi-0005ZZ-FL for qemu-devel@nongnu.org; Tue, 01 Apr 2025 09:42:25 -0400 Received: from mgamail.intel.com ([192.198.163.16]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tzbse-0006ZP-Qv for qemu-devel@nongnu.org; Tue, 01 Apr 2025 09:42:18 -0400 Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Apr 2025 06:41:55 -0700 Received: from lxy-clx-4s.sh.intel.com ([10.239.48.52]) by fmviesa008.fm.intel.com with ESMTP; 01 Apr 2025 06:41:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1743514937; x=1775050937; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=WTwtv/6pKBWaG3jox22sfdZ9prfinUFSMGgNvIrq8p8=; b=IhcSgcgQv6LHeFRDHM1+/RxApTpYOh9o1Pot0bPko///FMVFkgyBSHFh tdwqHOqpiUEwVKvXVjvJafsi1Sz3gG7TVeUxBTSFUTYNGwBE31x1xc0Lr C/5MSX2a3yprjE2y4JqLVQfwy1inrNzstx5T/0i8vAjE91gMAk+k7fNJB DpSQKg6MALtIn6kz/FqjfuWj3kTceL1jfhQ0tYKDYsWigMVPHI6Jtbuc+ K+3sOsSn9n6lvo/SrfNjd36JwFkbHEb/MGPaS/hSUbBvEs3btX1zDvZjy CuLWrjxRwggZd7SWrBAJAJhhgvbZ42RaBlsI/yUzXfiOKo97XSlgBeCL0 Q==; X-CSE-ConnectionGUID: TK9T3xrkQU2M7xoECp/4Ew== X-CSE-MsgGUID: Fo8YmrM0Rv+I2yuPXhwKjg== X-IronPort-AV: E=McAfee;i="6700,10204,11391"; a="32433274" X-IronPort-AV: E=Sophos;i="6.14,293,1736841600"; d="scan'208";a="32433274" X-CSE-ConnectionGUID: 5Vp8bJXhTgWTW+M+OwyPZA== X-CSE-MsgGUID: BSRXXYzBQm+v2H4sUCO2rQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,293,1736841600"; d="scan'208";a="126639984" From: Xiaoyao Li To: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Cc: "Michael S. Tsirkin" , Markus Armbruster , Francesco Lavra , Marcelo Tosatti , qemu-devel@nongnu.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Rick Edgecombe , Xiaoyao Li Subject: [PATCH v8 17/55] i386/tdvf: Introduce function to parse TDVF metadata Date: Tue, 1 Apr 2025 09:01:27 -0400 Message-Id: <20250401130205.2198253-18-xiaoyao.li@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250401130205.2198253-1-xiaoyao.li@intel.com> References: <20250401130205.2198253-1-xiaoyao.li@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.198.163.16; envelope-from=xiaoyao.li@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.997, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1743515099375019100 Content-Type: text/plain; charset="utf-8" From: Isaku Yamahata TDX VM needs to boot with its specialized firmware, Trusted Domain Virtual Firmware (TDVF). QEMU needs to parse TDVF and map it in TD guest memory prior to running the TDX VM. A TDVF Metadata in TDVF image describes the structure of firmware. QEMU refers to it to setup memory for TDVF. Introduce function tdvf_parse_metadata() to parse the metadata from TDVF image and store the info of each TDVF section. TDX metadata is located by a TDX metadata offset block, which is a GUID-ed structure. The data portion of the GUID structure contains only an 4-byte field that is the offset of TDX metadata to the end of firmware file. Select X86_FW_OVMF when TDX is enable to leverage existing functions to parse and search OVMF's GUID-ed structures. Signed-off-by: Isaku Yamahata Co-developed-by: Xiaoyao Li Signed-off-by: Xiaoyao Li Acked-by: Gerd Hoffmann --- Changes in v8: - Drop the failure handling of memcpy() since it cannot fail; Changes in v7: - Update license info to only use SPDX tag; - use g_autofree to avoid manually free; Changes in v6: - Drop the the data endianness change for metadata->Length; Changes in v1: - rename tdvf_parse_section_entry() to tdvf_parse_and_check_section_entry() Changes in RFC v4: - rename TDX_METADATA_GUID to TDX_METADATA_OFFSET_GUID --- hw/i386/Kconfig | 1 + hw/i386/meson.build | 1 + hw/i386/tdvf.c | 183 +++++++++++++++++++++++++++++++++++++++++ include/hw/i386/tdvf.h | 38 +++++++++ 4 files changed, 223 insertions(+) create mode 100644 hw/i386/tdvf.c create mode 100644 include/hw/i386/tdvf.h diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig index cce9521ba934..eb65bda6e071 100644 --- a/hw/i386/Kconfig +++ b/hw/i386/Kconfig @@ -12,6 +12,7 @@ config SGX =20 config TDX bool + select X86_FW_OVMF depends on KVM =20 config PC diff --git a/hw/i386/meson.build b/hw/i386/meson.build index 10bdfde27c69..3bc1da2b6eb4 100644 --- a/hw/i386/meson.build +++ b/hw/i386/meson.build @@ -32,6 +32,7 @@ i386_ss.add(when: 'CONFIG_PC', if_true: files( 'port92.c')) i386_ss.add(when: 'CONFIG_X86_FW_OVMF', if_true: files('pc_sysfw_ovmf.c'), if_false: files('pc_sysfw_ovmf-stu= bs.c')) +i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c')) =20 subdir('kvm') subdir('xen') diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c new file mode 100644 index 000000000000..328d1b7ffdf8 --- /dev/null +++ b/hw/i386/tdvf.c @@ -0,0 +1,183 @@ +/* + * Copyright (c) 2025 Intel Corporation + * Author: Isaku Yamahata + * + * Xiaoyao Li + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qemu/error-report.h" + +#include "hw/i386/pc.h" +#include "hw/i386/tdvf.h" +#include "system/kvm.h" + +#define TDX_METADATA_OFFSET_GUID "e47a6535-984a-4798-865e-4685a7bf8ec2" +#define TDX_METADATA_VERSION 1 +#define TDVF_SIGNATURE 0x46564454 /* TDVF as little endian */ + +typedef struct { + uint32_t DataOffset; + uint32_t RawDataSize; + uint64_t MemoryAddress; + uint64_t MemoryDataSize; + uint32_t Type; + uint32_t Attributes; +} TdvfSectionEntry; + +typedef struct { + uint32_t Signature; + uint32_t Length; + uint32_t Version; + uint32_t NumberOfSectionEntries; + TdvfSectionEntry SectionEntries[]; +} TdvfMetadata; + +struct tdx_metadata_offset { + uint32_t offset; +}; + +static TdvfMetadata *tdvf_get_metadata(void *flash_ptr, int size) +{ + TdvfMetadata *metadata; + uint32_t offset =3D 0; + uint8_t *data; + + if ((uint32_t) size !=3D size) { + return NULL; + } + + if (pc_system_ovmf_table_find(TDX_METADATA_OFFSET_GUID, &data, NULL)) { + offset =3D size - le32_to_cpu(((struct tdx_metadata_offset *)data)= ->offset); + + if (offset + sizeof(*metadata) > size) { + return NULL; + } + } else { + error_report("Cannot find TDX_METADATA_OFFSET_GUID"); + return NULL; + } + + metadata =3D flash_ptr + offset; + + /* Finally, verify the signature to determine if this is a TDVF image.= */ + metadata->Signature =3D le32_to_cpu(metadata->Signature); + if (metadata->Signature !=3D TDVF_SIGNATURE) { + error_report("Invalid TDVF signature in metadata!"); + return NULL; + } + + /* Sanity check that the TDVF doesn't overlap its own metadata. */ + metadata->Length =3D le32_to_cpu(metadata->Length); + if (offset + metadata->Length > size) { + return NULL; + } + + /* Only version 1 is supported/defined. */ + metadata->Version =3D le32_to_cpu(metadata->Version); + if (metadata->Version !=3D TDX_METADATA_VERSION) { + return NULL; + } + + return metadata; +} + +static int tdvf_parse_and_check_section_entry(const TdvfSectionEntry *src, + TdxFirmwareEntry *entry) +{ + entry->data_offset =3D le32_to_cpu(src->DataOffset); + entry->data_len =3D le32_to_cpu(src->RawDataSize); + entry->address =3D le64_to_cpu(src->MemoryAddress); + entry->size =3D le64_to_cpu(src->MemoryDataSize); + entry->type =3D le32_to_cpu(src->Type); + entry->attributes =3D le32_to_cpu(src->Attributes); + + /* sanity check */ + if (entry->size < entry->data_len) { + error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%l= x", + entry->data_len, entry->size); + return -1; + } + if (!QEMU_IS_ALIGNED(entry->address, TARGET_PAGE_SIZE)) { + error_report("MemoryAddress 0x%lx not page aligned", entry->addres= s); + return -1; + } + if (!QEMU_IS_ALIGNED(entry->size, TARGET_PAGE_SIZE)) { + error_report("MemoryDataSize 0x%lx not page aligned", entry->size); + return -1; + } + + switch (entry->type) { + case TDVF_SECTION_TYPE_BFV: + case TDVF_SECTION_TYPE_CFV: + /* The sections that must be copied from firmware image to TD memo= ry */ + if (entry->data_len =3D=3D 0) { + error_report("%d section with RawDataSize =3D=3D 0", entry->ty= pe); + return -1; + } + break; + case TDVF_SECTION_TYPE_TD_HOB: + case TDVF_SECTION_TYPE_TEMP_MEM: + /* The sections that no need to be copied from firmware image */ + if (entry->data_len !=3D 0) { + error_report("%d section with RawDataSize 0x%x !=3D 0", + entry->type, entry->data_len); + return -1; + } + break; + default: + error_report("TDVF contains unsupported section type %d", entry->t= ype); + return -1; + } + + return 0; +} + +int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size) +{ + g_autofree TdvfSectionEntry *sections =3D NULL; + TdvfMetadata *metadata; + ssize_t entries_size; + int i; + + metadata =3D tdvf_get_metadata(flash_ptr, size); + if (!metadata) { + return -EINVAL; + } + + /* load and parse metadata entries */ + fw->nr_entries =3D le32_to_cpu(metadata->NumberOfSectionEntries); + if (fw->nr_entries < 2) { + error_report("Invalid number of fw entries (%u) in TDVF Metadata", + fw->nr_entries); + return -EINVAL; + } + + entries_size =3D fw->nr_entries * sizeof(TdvfSectionEntry); + if (metadata->Length !=3D sizeof(*metadata) + entries_size) { + error_report("TDVF metadata len (0x%x) mismatch, expected (0x%x)", + metadata->Length, + (uint32_t)(sizeof(*metadata) + entries_size)); + return -EINVAL; + } + + fw->entries =3D g_new(TdxFirmwareEntry, fw->nr_entries); + sections =3D g_new(TdvfSectionEntry, fw->nr_entries); + + memcpy(sections, (void *)metadata + sizeof(*metadata), entries_size); + + for (i =3D 0; i < fw->nr_entries; i++) { + if (tdvf_parse_and_check_section_entry(§ions[i], &fw->entries[= i])) { + goto err; + } + } + + return 0; + +err: + fw->entries =3D 0; + g_free(fw->entries); + return -EINVAL; +} diff --git a/include/hw/i386/tdvf.h b/include/hw/i386/tdvf.h new file mode 100644 index 000000000000..7ebcac42a36c --- /dev/null +++ b/include/hw/i386/tdvf.h @@ -0,0 +1,38 @@ +/* + * Copyright (c) 2025 Intel Corporation + * Author: Isaku Yamahata + * + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HW_I386_TDVF_H +#define HW_I386_TDVF_H + +#include "qemu/osdep.h" + +#define TDVF_SECTION_TYPE_BFV 0 +#define TDVF_SECTION_TYPE_CFV 1 +#define TDVF_SECTION_TYPE_TD_HOB 2 +#define TDVF_SECTION_TYPE_TEMP_MEM 3 + +#define TDVF_SECTION_ATTRIBUTES_MR_EXTEND (1U << 0) +#define TDVF_SECTION_ATTRIBUTES_PAGE_AUG (1U << 1) + +typedef struct TdxFirmwareEntry { + uint32_t data_offset; + uint32_t data_len; + uint64_t address; + uint64_t size; + uint32_t type; + uint32_t attributes; +} TdxFirmwareEntry; + +typedef struct TdxFirmware { + uint32_t nr_entries; + TdxFirmwareEntry *entries; +} TdxFirmware; + +int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size); + +#endif /* HW_I386_TDVF_H */ --=20 2.34.1