From nobody Tue Nov 12 07:55:44 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Xndy84dyxz5bf4M; Tue, 12 Nov 2024 07:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Xndy81c7hz4fFM; Tue, 12 Nov 2024 07:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731398144; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/lg0nhnY1meLWB9bForv1esezw0lRxTV8JKH2O6im14=; b=aryg6QFpK+VCKKArQwzthXpHfIraLC5F0HR91jeEL2QxMLcsvQwdTYAL6t2mTJbSvlubd3 TfNGOw5CJfllOQzhzraRhDKdJJEB71Lcuhu83d+49n3x1+YhtlQBL2JyB8tva7w/7gX9A1 2SKo4/FeTLwqhpcEPrlDRY3AyPaGZr6Inl3bYykDiD2yIOwuaAKpMsNdpKdksVQH+sG0oL RxpGRlO/fEpcrXR5GS8jV7nJvmRZuE9bQkoK8KrTnlgO8fRego7ZqTiy1PREyT4cbNueKX ttx0q5JA0Mw6W+51sKBqeA4TO2kZxGEGimAONNEoxVAZ0lsljD2Sq2r37drN2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731398144; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/lg0nhnY1meLWB9bForv1esezw0lRxTV8JKH2O6im14=; b=Pesb0geoDvuA9x0nJJ4eRdHFd0kYgV8Rm5Op+TCFWnVuf63QhheElO2SHWtal1R6Xx4fuA GEqHsQKwwg4S+QspIzD2itP7b5wNXrbLkMKFtfpJ6mZZTuQBGyny4AN3yKs3N86FIfsMBz AHcvOoHDSxOMtC4C5hio6lY6xI+jeq8v8U31fi8P+pe6Ax7XeY7Oqcq9KRVoFQIHxgeGs5 0wXbIBAaMQIpe92aJ7m8PO4uK2Aq8/a02fVCi67scV3HovUQ7qjCjBCThdyJep95M9bc1I M7j/uofyN1Ev5HpYAraqXJcAn2wt/sQle+hab2pCgJNYqn6Mha4pkAMt1ZEF9Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731398144; a=rsa-sha256; cv=none; b=peIz+WcP0B+7Vb5UU51sPLfdVMR7hIWQkVzhQMH+7MHYKMTJw5Xis+b+fxZXI7IUnaM14v ZqX4RBtrrKNdRuA3MkD1ah/qFry9vuR6X+uM5ICglwtRmXXbqS/lISSEbDqQrRTD0ws4Ce i+8uSGaroSul0skskkwJPnsiwOcKI/3Ylgj7/pahcN5hQbRAZ7xvf+fBNVFSApO2ztxrH0 KtxQF90mUy8GYgDVqiZoIEnDWNiREhVs9pk/0q6JQ11wa9vffyaTiCypPtN/7/jYbMYTjO LGzYc4gqnCaugwfMlvcOuhxEFFuKgcafouNEplkglOhI0SfyoZiXgWek7ZmsxA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Xndy817FFz11wB; Tue, 12 Nov 2024 07:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4AC7tiHn077159; Tue, 12 Nov 2024 07:55:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4AC7tiOh077156; Tue, 12 Nov 2024 07:55:44 GMT (envelope-from git) Date: Tue, 12 Nov 2024 07:55:44 GMT Message-Id: <202411120755.4AC7tiOh077156@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Corvin =?utf-8?Q?K=C3=B6hne?= Subject: git: b3180bea9b1d - stable/14 - bhyve: TPM CRB: pass actual TPM request length to backend execute_cmd() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: corvink X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: b3180bea9b1d0c30d46a10e92d96d4944004f37a Auto-Submitted: auto-generated The branch stable/14 has been updated by corvink: URL: https://cgit.FreeBSD.org/src/commit/?id=b3180bea9b1d0c30d46a10e92d96d4944004f37a commit b3180bea9b1d0c30d46a10e92d96d4944004f37a Author: Hans Rosenfeld AuthorDate: 2024-09-09 08:42:42 +0000 Commit: Corvin Köhne CommitDate: 2024-11-12 07:54:22 +0000 bhyve: TPM CRB: pass actual TPM request length to backend execute_cmd() The TPM spec (TPM Library, Part3: Commands, Section 5.2: Command Header Validation) requires that no more bytes are written than the size of the commands, as given in the request header. Thus the TPM CRB interface needs to get the command size from the request header and pass that to the emulation backend. As the guest OS driver can set the address and size of the command and response buffers freely within the limits of the provided CRB data buffer, bhyve should verify that the values set in the corresponding registers make sense before processing a command. Reviewed by: corvink MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D46564 (cherry picked from commit bc3d09e90b8625f17017663fad3e049348b04ded) --- usr.sbin/bhyve/tpm_intf_crb.c | 45 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/usr.sbin/bhyve/tpm_intf_crb.c b/usr.sbin/bhyve/tpm_intf_crb.c index 3e0769d1fef6..b1f5b72b6285 100644 --- a/usr.sbin/bhyve/tpm_intf_crb.c +++ b/usr.sbin/bhyve/tpm_intf_crb.c @@ -166,6 +166,15 @@ static_assert(sizeof(struct tpm_crb_regs) == TPM_CRB_REGS_SIZE, regs.rsp_addr = val; \ } while (0) +struct tpm_cmd_hdr { + uint16_t tag; + uint32_t len; + union { + uint32_t ordinal; + uint32_t errcode; + }; +} __packed; + struct tpm_crb { struct tpm_emul *emul; void *emul_sc; @@ -177,6 +186,7 @@ struct tpm_crb { bool closing; }; + static void * tpm_crb_thread(void *const arg) { @@ -201,6 +211,26 @@ tpm_crb_thread(void *const arg) const uint32_t cmd_size = CRB_CMD_SIZE_READ(crb->regs); const uint32_t rsp_size = CRB_RSP_SIZE_READ(crb->regs); + if ((cmd_addr < TPM_CRB_DATA_BUFFER_ADDRESS) || + (cmd_size < sizeof (struct tpm_cmd_hdr)) || + (cmd_size > TPM_CRB_DATA_BUFFER_SIZE) || + (cmd_addr + cmd_size > + TPM_CRB_DATA_BUFFER_ADDRESS + TPM_CRB_DATA_BUFFER_SIZE)) { + warnx("%s: invalid cmd [%16lx/%8x] outside of TPM " + "buffer", __func__, cmd_addr, cmd_size); + break; + } + + if ((rsp_addr < TPM_CRB_DATA_BUFFER_ADDRESS) || + (rsp_size < sizeof (struct tpm_cmd_hdr)) || + (rsp_size > TPM_CRB_DATA_BUFFER_SIZE) || + (rsp_addr + rsp_size > + TPM_CRB_DATA_BUFFER_ADDRESS + TPM_CRB_DATA_BUFFER_SIZE)) { + warnx("%s: invalid rsp [%16lx/%8x] outside of TPM " + "buffer", __func__, rsp_addr, rsp_size); + break; + } + const uint64_t cmd_off = cmd_addr - TPM_CRB_DATA_BUFFER_ADDRESS; const uint64_t rsp_off = rsp_addr - TPM_CRB_DATA_BUFFER_ADDRESS; @@ -218,6 +248,17 @@ tpm_crb_thread(void *const arg) uint8_t cmd[TPM_CRB_DATA_BUFFER_SIZE]; memcpy(cmd, crb->regs.data_buffer, TPM_CRB_DATA_BUFFER_SIZE); + /* + * Do a basic sanity check of the TPM request header. We'll need + * the TPM request length for execute_cmd() below. + */ + struct tpm_cmd_hdr *req = (struct tpm_cmd_hdr *)&cmd[cmd_off]; + if (be32toh(req->len) < sizeof (struct tpm_cmd_hdr) || + be32toh(req->len) > cmd_size) { + warnx("%s: invalid TPM request header", __func__); + break; + } + /* * A TPM command can take multiple seconds to execute. As we've * copied all required values and buffers at this point, we can @@ -238,8 +279,8 @@ tpm_crb_thread(void *const arg) * response. */ uint8_t rsp[TPM_CRB_DATA_BUFFER_SIZE] = { 0 }; - crb->emul->execute_cmd(crb->emul_sc, &cmd[cmd_off], cmd_size, - &rsp[rsp_off], rsp_size); + (void) crb->emul->execute_cmd(crb->emul_sc, req, + be32toh(req->len), &rsp[rsp_off], rsp_size); pthread_mutex_lock(&crb->mutex); memset(crb->regs.data_buffer, 0, TPM_CRB_DATA_BUFFER_SIZE);