cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

vmgenid.c (9201B)


      1/*
      2 *  Virtual Machine Generation ID Device
      3 *
      4 *  Copyright (C) 2017 Skyport Systems.
      5 *
      6 *  Author: Ben Warren <ben@skyportsystems.com>
      7 *
      8 * This work is licensed under the terms of the GNU GPL, version 2 or later.
      9 * See the COPYING file in the top-level directory.
     10 *
     11 */
     12
     13#include "qemu/osdep.h"
     14#include "qapi/error.h"
     15#include "qapi/qapi-commands-machine.h"
     16#include "qemu/module.h"
     17#include "hw/acpi/acpi.h"
     18#include "hw/acpi/aml-build.h"
     19#include "hw/acpi/vmgenid.h"
     20#include "hw/nvram/fw_cfg.h"
     21#include "hw/qdev-properties.h"
     22#include "hw/qdev-properties-system.h"
     23#include "migration/vmstate.h"
     24#include "sysemu/reset.h"
     25
     26void vmgenid_build_acpi(VmGenIdState *vms, GArray *table_data, GArray *guid,
     27                        BIOSLinker *linker, const char *oem_id)
     28{
     29    Aml *ssdt, *dev, *scope, *method, *addr, *if_ctx;
     30    uint32_t vgia_offset;
     31    QemuUUID guid_le;
     32    AcpiTable table = { .sig = "SSDT", .rev = 1,
     33                        .oem_id = oem_id, .oem_table_id = "VMGENID" };
     34
     35    /* Fill in the GUID values.  These need to be converted to little-endian
     36     * first, since that's what the guest expects
     37     */
     38    g_array_set_size(guid, VMGENID_FW_CFG_SIZE - ARRAY_SIZE(guid_le.data));
     39    guid_le = qemu_uuid_bswap(vms->guid);
     40    /* The GUID is written at a fixed offset into the fw_cfg file
     41     * in order to implement the "OVMF SDT Header probe suppressor"
     42     * see docs/specs/vmgenid.txt for more details
     43     */
     44    g_array_insert_vals(guid, VMGENID_GUID_OFFSET, guid_le.data,
     45                        ARRAY_SIZE(guid_le.data));
     46
     47    /* Put VMGNEID into a separate SSDT table */
     48    acpi_table_begin(&table, table_data);
     49    ssdt = init_aml_allocator();
     50
     51    /* Storage for the GUID address */
     52    vgia_offset = table_data->len +
     53        build_append_named_dword(ssdt->buf, "VGIA");
     54    scope = aml_scope("\\_SB");
     55    dev = aml_device("VGEN");
     56    aml_append(dev, aml_name_decl("_HID", aml_string("QEMUVGID")));
     57    aml_append(dev, aml_name_decl("_CID", aml_string("VM_Gen_Counter")));
     58    aml_append(dev, aml_name_decl("_DDN", aml_string("VM_Gen_Counter")));
     59
     60    /* Simple status method to check that address is linked and non-zero */
     61    method = aml_method("_STA", 0, AML_NOTSERIALIZED);
     62    addr = aml_local(0);
     63    aml_append(method, aml_store(aml_int(0xf), addr));
     64    if_ctx = aml_if(aml_equal(aml_name("VGIA"), aml_int(0)));
     65    aml_append(if_ctx, aml_store(aml_int(0), addr));
     66    aml_append(method, if_ctx);
     67    aml_append(method, aml_return(addr));
     68    aml_append(dev, method);
     69
     70    /* the ADDR method returns two 32-bit words representing the lower and
     71     * upper halves * of the physical address of the fw_cfg blob
     72     * (holding the GUID)
     73     */
     74    method = aml_method("ADDR", 0, AML_NOTSERIALIZED);
     75
     76    addr = aml_local(0);
     77    aml_append(method, aml_store(aml_package(2), addr));
     78
     79    aml_append(method, aml_store(aml_add(aml_name("VGIA"),
     80                                         aml_int(VMGENID_GUID_OFFSET), NULL),
     81                                 aml_index(addr, aml_int(0))));
     82    aml_append(method, aml_store(aml_int(0), aml_index(addr, aml_int(1))));
     83    aml_append(method, aml_return(addr));
     84
     85    aml_append(dev, method);
     86    aml_append(scope, dev);
     87    aml_append(ssdt, scope);
     88
     89    /* attach an ACPI notify */
     90    method = aml_method("\\_GPE._E05", 0, AML_NOTSERIALIZED);
     91    aml_append(method, aml_notify(aml_name("\\_SB.VGEN"), aml_int(0x80)));
     92    aml_append(ssdt, method);
     93
     94    g_array_append_vals(table_data, ssdt->buf->data, ssdt->buf->len);
     95
     96    /* Allocate guest memory for the Data fw_cfg blob */
     97    bios_linker_loader_alloc(linker, VMGENID_GUID_FW_CFG_FILE, guid, 4096,
     98                             false /* page boundary, high memory */);
     99
    100    /* Patch address of GUID fw_cfg blob into the ADDR fw_cfg blob
    101     * so QEMU can write the GUID there.  The address is expected to be
    102     * < 4GB, but write 64 bits anyway.
    103     * The address that is patched in is offset in order to implement
    104     * the "OVMF SDT Header probe suppressor"
    105     * see docs/specs/vmgenid.txt for more details.
    106     */
    107    bios_linker_loader_write_pointer(linker,
    108        VMGENID_ADDR_FW_CFG_FILE, 0, sizeof(uint64_t),
    109        VMGENID_GUID_FW_CFG_FILE, VMGENID_GUID_OFFSET);
    110
    111    /* Patch address of GUID fw_cfg blob into the AML so OSPM can retrieve
    112     * and read it.  Note that while we provide storage for 64 bits, only
    113     * the least-signficant 32 get patched into AML.
    114     */
    115    bios_linker_loader_add_pointer(linker,
    116        ACPI_BUILD_TABLE_FILE, vgia_offset, sizeof(uint32_t),
    117        VMGENID_GUID_FW_CFG_FILE, 0);
    118
    119    /* must be called after above command to ensure correct table checksum */
    120    acpi_table_end(linker, &table);
    121    free_aml_allocator();
    122}
    123
    124void vmgenid_add_fw_cfg(VmGenIdState *vms, FWCfgState *s, GArray *guid)
    125{
    126    /* Create a read-only fw_cfg file for GUID */
    127    fw_cfg_add_file(s, VMGENID_GUID_FW_CFG_FILE, guid->data,
    128                    VMGENID_FW_CFG_SIZE);
    129    /* Create a read-write fw_cfg file for Address */
    130    fw_cfg_add_file_callback(s, VMGENID_ADDR_FW_CFG_FILE, NULL, NULL, NULL,
    131                             vms->vmgenid_addr_le,
    132                             ARRAY_SIZE(vms->vmgenid_addr_le), false);
    133}
    134
    135static void vmgenid_update_guest(VmGenIdState *vms)
    136{
    137    Object *obj = object_resolve_path_type("", TYPE_ACPI_DEVICE_IF, NULL);
    138    uint32_t vmgenid_addr;
    139    QemuUUID guid_le;
    140
    141    if (obj) {
    142        /* Write the GUID to guest memory */
    143        memcpy(&vmgenid_addr, vms->vmgenid_addr_le, sizeof(vmgenid_addr));
    144        vmgenid_addr = le32_to_cpu(vmgenid_addr);
    145        /* A zero value in vmgenid_addr means that BIOS has not yet written
    146         * the address
    147         */
    148        if (vmgenid_addr) {
    149            /* QemuUUID has the first three words as big-endian, and expect
    150             * that any GUIDs passed in will always be BE.  The guest,
    151             * however, will expect the fields to be little-endian.
    152             * Perform a byte swap immediately before writing.
    153             */
    154            guid_le = qemu_uuid_bswap(vms->guid);
    155            /* The GUID is written at a fixed offset into the fw_cfg file
    156             * in order to implement the "OVMF SDT Header probe suppressor"
    157             * see docs/specs/vmgenid.txt for more details.
    158             */
    159            cpu_physical_memory_write(vmgenid_addr, guid_le.data,
    160                                      sizeof(guid_le.data));
    161            /* Send _GPE.E05 event */
    162            acpi_send_event(DEVICE(obj), ACPI_VMGENID_CHANGE_STATUS);
    163        }
    164    }
    165}
    166
    167/* After restoring an image, we need to update the guest memory and notify
    168 * it of a potential change to VM Generation ID
    169 */
    170static int vmgenid_post_load(void *opaque, int version_id)
    171{
    172    VmGenIdState *vms = opaque;
    173    vmgenid_update_guest(vms);
    174    return 0;
    175}
    176
    177static const VMStateDescription vmstate_vmgenid = {
    178    .name = "vmgenid",
    179    .version_id = 1,
    180    .minimum_version_id = 1,
    181    .post_load = vmgenid_post_load,
    182    .fields = (VMStateField[]) {
    183        VMSTATE_UINT8_ARRAY(vmgenid_addr_le, VmGenIdState, sizeof(uint64_t)),
    184        VMSTATE_END_OF_LIST()
    185    },
    186};
    187
    188static void vmgenid_handle_reset(void *opaque)
    189{
    190    VmGenIdState *vms = VMGENID(opaque);
    191    /* Clear the guest-allocated GUID address when the VM resets */
    192    memset(vms->vmgenid_addr_le, 0, ARRAY_SIZE(vms->vmgenid_addr_le));
    193}
    194
    195static void vmgenid_realize(DeviceState *dev, Error **errp)
    196{
    197    VmGenIdState *vms = VMGENID(dev);
    198
    199    if (!bios_linker_loader_can_write_pointer()) {
    200        error_setg(errp, "%s requires DMA write support in fw_cfg, "
    201                   "which this machine type does not provide", TYPE_VMGENID);
    202        return;
    203    }
    204
    205    /* Given that this function is executing, there is at least one VMGENID
    206     * device. Check if there are several.
    207     */
    208    if (!find_vmgenid_dev()) {
    209        error_setg(errp, "at most one %s device is permitted", TYPE_VMGENID);
    210        return;
    211    }
    212
    213    qemu_register_reset(vmgenid_handle_reset, vms);
    214
    215    vmgenid_update_guest(vms);
    216}
    217
    218static Property vmgenid_device_properties[] = {
    219    DEFINE_PROP_UUID(VMGENID_GUID, VmGenIdState, guid),
    220    DEFINE_PROP_END_OF_LIST(),
    221};
    222
    223static void vmgenid_device_class_init(ObjectClass *klass, void *data)
    224{
    225    DeviceClass *dc = DEVICE_CLASS(klass);
    226
    227    dc->vmsd = &vmstate_vmgenid;
    228    dc->realize = vmgenid_realize;
    229    device_class_set_props(dc, vmgenid_device_properties);
    230    dc->hotpluggable = false;
    231    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
    232}
    233
    234static const TypeInfo vmgenid_device_info = {
    235    .name          = TYPE_VMGENID,
    236    .parent        = TYPE_DEVICE,
    237    .instance_size = sizeof(VmGenIdState),
    238    .class_init    = vmgenid_device_class_init,
    239};
    240
    241static void vmgenid_register_types(void)
    242{
    243    type_register_static(&vmgenid_device_info);
    244}
    245
    246type_init(vmgenid_register_types)
    247
    248GuidInfo *qmp_query_vm_generation_id(Error **errp)
    249{
    250    GuidInfo *info;
    251    VmGenIdState *vms;
    252    Object *obj = find_vmgenid_dev();
    253
    254    if (!obj) {
    255        error_setg(errp, "VM Generation ID device not found");
    256        return NULL;
    257    }
    258    vms = VMGENID(obj);
    259
    260    info = g_malloc0(sizeof(*info));
    261    info->guid = qemu_uuid_unparse_strdup(&vms->guid);
    262    return info;
    263}