If you like running QEMU as a normal user (very common for TCG runs) but you have to run virtiofsd as a root user you run into connection problems. Adding support for an optional --socket-group allows the users to keep using the command line.

Signed-off-by: Alex Bennée alex.bennee@linaro.org Reviewed-by: Stefan Hajnoczi stefanha@redhat.com

--- v1 - tweak documentation and commentary --- docs/tools/virtiofsd.rst | 4 ++++ tools/virtiofsd/fuse_i.h | 1 + tools/virtiofsd/fuse_lowlevel.c | 6 ++++++ tools/virtiofsd/fuse_virtio.c | 20 ++++++++++++++++++-- 4 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst index e33c81ed41f1..085f9b12a6a3 100644 --- a/docs/tools/virtiofsd.rst +++ b/docs/tools/virtiofsd.rst @@ -87,6 +87,10 @@ Options

Listen on vhost-user UNIX domain socket at PATH.

+.. option:: --socket-group=GROUP + + Set the vhost-user UNIX domain socket gid to GROUP. + .. option:: --fd=FDNUM

Accept connections from vhost-user UNIX domain socket file descriptor FDNUM. diff --git a/tools/virtiofsd/fuse_i.h b/tools/virtiofsd/fuse_i.h index 1240828208ab..492e002181e2 100644 --- a/tools/virtiofsd/fuse_i.h +++ b/tools/virtiofsd/fuse_i.h @@ -68,6 +68,7 @@ struct fuse_session { size_t bufsize; int error; char *vu_socket_path; + char *vu_socket_group; int vu_listen_fd; int vu_socketfd; struct fv_VuDev *virtio_dev; diff --git a/tools/virtiofsd/fuse_lowlevel.c b/tools/virtiofsd/fuse_lowlevel.c index 2dd36ec03b6e..4d1ba2925d1b 100644 --- a/tools/virtiofsd/fuse_lowlevel.c +++ b/tools/virtiofsd/fuse_lowlevel.c @@ -2523,6 +2523,7 @@ static const struct fuse_opt fuse_ll_opts[] = { LL_OPTION("--debug", debug, 1), LL_OPTION("allow_root", deny_others, 1), LL_OPTION("--socket-path=%s", vu_socket_path, 0), + LL_OPTION("--socket-group=%s", vu_socket_group, 0), LL_OPTION("--fd=%d", vu_listen_fd, 0), LL_OPTION("--thread-pool-size=%d", thread_pool_size, 0), FUSE_OPT_END @@ -2630,6 +2631,11 @@ struct fuse_session *fuse_session_new(struct fuse_args *args, "fuse: --socket-path and --fd cannot be given together\n"); goto out4; } + if (se->vu_socket_group && !se->vu_socket_path) { + fuse_log(FUSE_LOG_ERR, + "fuse: --socket-group can only be used with --socket-path\n"); + goto out4; + }

se->bufsize = FUSE_MAX_MAX_PAGES * getpagesize() + FUSE_BUFFER_HEADER_SIZE;

diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c index 9e5537506c16..7942d3d11a87 100644 --- a/tools/virtiofsd/fuse_virtio.c +++ b/tools/virtiofsd/fuse_virtio.c @@ -31,6 +31,8 @@ #include <sys/socket.h> #include <sys/types.h> #include <sys/un.h> +#include <sys/types.h> +#include <grp.h> #include <unistd.h>

#include "contrib/libvhost-user/libvhost-user.h" @@ -924,15 +926,29 @@ static int fv_create_listen_socket(struct fuse_session *se)

/* * Unfortunately bind doesn't let you set the mask on the socket, - * so set umask to 077 and restore it later. + * so set umask appropriately and restore it later. */ - old_umask = umask(0077); + if (se->vu_socket_group) { + old_umask = umask(S_IROTH | S_IWOTH | S_IXOTH); + } else { + old_umask = umask(S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH | S_IWOTH | S_IXOTH); + } if (bind(listen_sock, (struct sockaddr *)&un, addr_len) == -1) { fuse_log(FUSE_LOG_ERR, "vhost socket bind: %m\n"); close(listen_sock); umask(old_umask); return -1; } + if (se->vu_socket_group) { + struct group *g = getgrnam(se->vu_socket_group); + if (g) { + if (!chown(se->vu_socket_path, -1, g->gr_gid)) { + fuse_log(FUSE_LOG_WARNING, + "vhost socket failed to set group to %s (%d)\n", + se->vu_socket_group, g->gr_gid); + } + } + } umask(old_umask);

if (listen(listen_sock, 1) == -1) {

This creates the QEMU side of the vhost-user-rpmb device which connects to the remote daemon. It is based of the reasonably modern vhost-user-fs code with bits from vhost-user-blk as we want the virtio-config itself to be sourced from the daemon.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- include/hw/virtio/vhost-user-rpmb.h | 46 ++++ hw/block/vhost-user-rpmb.c | 333 ++++++++++++++++++++++++++++ hw/block/Kconfig | 5 + hw/block/meson.build | 1 + 4 files changed, 385 insertions(+) create mode 100644 include/hw/virtio/vhost-user-rpmb.h create mode 100644 hw/block/vhost-user-rpmb.c

diff --git a/include/hw/virtio/vhost-user-rpmb.h b/include/hw/virtio/vhost-user-rpmb.h new file mode 100644 index 000000000000..7e5988127dc2 --- /dev/null +++ b/include/hw/virtio/vhost-user-rpmb.h @@ -0,0 +1,46 @@ +/* + * vhost-user-rpmb virtio device + * + * Copyright (c) 2020 Linaro Ltd + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef _VHOST_USER_RPMB_H_ +#define _VHOST_USER_RPMB_H_ + +#include "hw/virtio/virtio.h" +#include "hw/virtio/vhost.h" +#include "hw/virtio/vhost-user.h" +#include "chardev/char-fe.h" + +#define TYPE_VHOST_USER_RPMB "vhost-user-rpmb-device" +#define VHOST_USER_RPMB(obj) \ + OBJECT_CHECK(VHostUserRPMB, (obj), TYPE_VHOST_USER_RPMB) + +/* This is defined in the VIRTIO spec */ +struct virtio_rpmb_config { + uint8_t capacity; + uint8_t max_wr_cnt; + uint8_t max_rd_cnt; +}; + +typedef struct { + CharBackend chardev; + struct virtio_rpmb_config config; +} VHostUserRPMBConf; + +typedef struct { + /*< private >*/ + VirtIODevice parent; + VHostUserRPMBConf conf; + struct vhost_virtqueue *vhost_vq; + struct vhost_dev vhost_dev; + VhostUserState vhost_user; + VirtQueue *req_vq; + bool connected; + /*< public >*/ +} VHostUserRPMB; + + +#endif /* _VHOST_USER_RPMB_H_ */ diff --git a/hw/block/vhost-user-rpmb.c b/hw/block/vhost-user-rpmb.c new file mode 100644 index 000000000000..de243e7a53a0 --- /dev/null +++ b/hw/block/vhost-user-rpmb.c @@ -0,0 +1,333 @@ +/* + * Vhost-user RPMB virtio device + * + * This is the boilerplate for instantiating a vhost-user device + * implementing a Replay Protected Memory Block (RPMB) device. This is + * a type of flash chip that is protected from replay attacks and used + * for tamper resistant storage. The actual back-end for this driver + * is the vhost-user-rpmb daemon. The code here just connects up the + * device in QEMU and allows it to be instantiated. + * + * Copyright (c) 2020 Linaro Ltd + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "hw/qdev-properties.h" +#include "hw/virtio/virtio-bus.h" +#include "hw/virtio/vhost-user-rpmb.h" +#include "qemu/error-report.h" + +/* currently there is no RPMB driver in Linux */ +#define VIRTIO_ID_RPMB 28 /* virtio RPMB */ + +static void vurpmb_get_config(VirtIODevice *vdev, uint8_t *config) +{ + /* this somehow needs to come from the vhost-user daemon */ +} + +static void vurpmb_start(VirtIODevice *vdev) +{ + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev))); + VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus); + int ret; + int i; + + if (!k->set_guest_notifiers) { + error_report("binding does not support guest notifiers"); + return; + } + + ret = vhost_dev_enable_notifiers(&rpmb->vhost_dev, vdev); + if (ret < 0) { + error_report("Error enabling host notifiers: %d", -ret); + return; + } + + ret = k->set_guest_notifiers(qbus->parent, rpmb->vhost_dev.nvqs, true); + if (ret < 0) { + error_report("Error binding guest notifier: %d", -ret); + goto err_host_notifiers; + } + + rpmb->vhost_dev.acked_features = vdev->guest_features; + ret = vhost_dev_start(&rpmb->vhost_dev, vdev); + if (ret < 0) { + error_report("Error starting vhost-user-rpmb: %d", -ret); + goto err_guest_notifiers; + } + + /* + * guest_notifier_mask/pending not used yet, so just unmask + * everything here. virtio-pci will do the right thing by + * enabling/disabling irqfd. + */ + for (i = 0; i < rpmb->vhost_dev.nvqs; i++) { + vhost_virtqueue_mask(&rpmb->vhost_dev, vdev, i, false); + } + + return; + +err_guest_notifiers: + k->set_guest_notifiers(qbus->parent, rpmb->vhost_dev.nvqs, false); +err_host_notifiers: + vhost_dev_disable_notifiers(&rpmb->vhost_dev, vdev); +} + +static void vurpmb_stop(VirtIODevice *vdev) +{ + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev))); + VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus); + int ret; + + if (!k->set_guest_notifiers) { + return; + } + + vhost_dev_stop(&rpmb->vhost_dev, vdev); + + ret = k->set_guest_notifiers(qbus->parent, rpmb->vhost_dev.nvqs, false); + if (ret < 0) { + error_report("vhost guest notifier cleanup failed: %d", ret); + return; + } + + vhost_dev_disable_notifiers(&rpmb->vhost_dev, vdev); +} + +static void vurpmb_set_status(VirtIODevice *vdev, uint8_t status) +{ + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + bool should_start = status & VIRTIO_CONFIG_S_DRIVER_OK; + + if (!vdev->vm_running) { + should_start = false; + } + + if (rpmb->vhost_dev.started == should_start) { + return; + } + + if (should_start) { + vurpmb_start(vdev); + } else { + vurpmb_stop(vdev); + } +} + +static uint64_t vurpmb_get_features(VirtIODevice *vdev, + uint64_t requested_features, + Error **errp) +{ + /* No feature bits used yet */ + return requested_features; +} + +static void vurpmb_handle_output(VirtIODevice *vdev, VirtQueue *vq) +{ + /* + * Not normally called; it's the daemon that handles the queue; + * however virtio's cleanup path can call this. + */ +} + +static void vurpmb_guest_notifier_mask(VirtIODevice *vdev, int idx, + bool mask) +{ + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + vhost_virtqueue_mask(&rpmb->vhost_dev, vdev, idx, mask); +} + +static bool vurpmb_guest_notifier_pending(VirtIODevice *vdev, int idx) +{ + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + return vhost_virtqueue_pending(&rpmb->vhost_dev, idx); +} + +/* + * Chardev connect/disconnect events + */ + +static int vurpmb_handle_config_change(struct vhost_dev *dev) +{ + int ret; + VHostUserRPMB *rpmb = VHOST_USER_RPMB(dev->vdev); + + ret = vhost_dev_get_config(dev, (uint8_t *)&rpmb->conf.config, + sizeof(struct virtio_rpmb_config)); + if (ret < 0) { + error_report("get config space failed"); + return -1; + } + + return 0; +} + +const VhostDevConfigOps rpmb_ops = { + .vhost_dev_config_notifier = vurpmb_handle_config_change, +}; + +static int vurpmb_connect(DeviceState *dev) +{ + VirtIODevice *vdev = VIRTIO_DEVICE(dev); + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + + if (rpmb->connected) { + return 0; + } + rpmb->connected = true; + + /* restore vhost state */ + if (virtio_device_started(vdev, vdev->status)) { + vurpmb_start(vdev); + } + + return 0; +} + +static void vurpmb_disconnect(DeviceState *dev) +{ + VirtIODevice *vdev = VIRTIO_DEVICE(dev); + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + + if (!rpmb->connected) { + return; + } + rpmb->connected = false; + + if (rpmb->vhost_dev.started) { + vurpmb_stop(vdev); + } + + vhost_dev_cleanup(&rpmb->vhost_dev); +} + +static void vurpmb_event(void *opaque, QEMUChrEvent event) +{ + DeviceState *dev = opaque; + VirtIODevice *vdev = VIRTIO_DEVICE(dev); + VHostUserRPMB *rpmb = VHOST_USER_RPMB(vdev); + + switch (event) { + case CHR_EVENT_OPENED: + if (vurpmb_connect(dev) < 0) { + qemu_chr_fe_disconnect(&rpmb->conf.chardev); + return; + } + break; + case CHR_EVENT_CLOSED: + vurpmb_disconnect(dev); + break; + case CHR_EVENT_BREAK: + case CHR_EVENT_MUX_IN: + case CHR_EVENT_MUX_OUT: + /* Ignore */ + break; + } +} + +static void do_vhost_user_cleanup(VirtIODevice *vdev, VHostUserRPMB *rpmb) +{ + vhost_user_cleanup(&rpmb->vhost_user); + virtio_delete_queue(rpmb->req_vq); + virtio_cleanup(vdev); + g_free(rpmb->vhost_dev.vqs); + rpmb->vhost_dev.vqs = NULL; +} + + +static void vurpmb_device_realize(DeviceState *dev, Error **errp) +{ + VirtIODevice *vdev = VIRTIO_DEVICE(dev); + VHostUserRPMB *rpmb = VHOST_USER_RPMB(dev); + int ret; + + if (!rpmb->conf.chardev.chr) { + error_setg(errp, "missing chardev"); + return; + } + + if (!vhost_user_init(&rpmb->vhost_user, &rpmb->conf.chardev, errp)) { + return; + } + + virtio_init(vdev, "vhost-user-rpmb", VIRTIO_ID_RPMB, + sizeof(struct virtio_rpmb_config)); + + /* One request queue, 4 elements in case we don't do indirect */ + rpmb->req_vq = virtio_add_queue(vdev, 4, vurpmb_handle_output); + rpmb->vhost_dev.nvqs = 1; + rpmb->vhost_dev.vqs = g_new0(struct vhost_virtqueue, rpmb->vhost_dev.nvqs); + ret = vhost_dev_init(&rpmb->vhost_dev, &rpmb->vhost_user, + VHOST_BACKEND_TYPE_USER, 0); + if (ret < 0) { + error_setg_errno(errp, -ret, "vhost_dev_init failed"); + do_vhost_user_cleanup(vdev, rpmb); + } + + /* + * At this point the next event we will get is a connection from + * the daemon on the control socket. + */ + + qemu_chr_fe_set_handlers(&rpmb->conf.chardev, NULL, NULL, vurpmb_event, + NULL, (void *)dev, NULL, true); + + return; +} + +static void vurpmb_device_unrealize(DeviceState *dev) +{ + VirtIODevice *vdev = VIRTIO_DEVICE(dev); + VHostUserRPMB *rpmb = VHOST_USER_RPMB(dev); + + /* This will stop vhost backend if appropriate. */ + vurpmb_set_status(vdev, 0); + + do_vhost_user_cleanup(vdev, rpmb); +} + +static const VMStateDescription vurpmb_vmstate = { + .name = "vhost-user-rpmb", + .unmigratable = 1, +}; + +static Property vurpmb_properties[] = { + DEFINE_PROP_CHR("chardev", VHostUserRPMB, conf.chardev), + DEFINE_PROP_END_OF_LIST(), +}; + +static void vurpmb_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass); + + device_class_set_props(dc, vurpmb_properties); + dc->vmsd = &vurpmb_vmstate; + set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); + vdc->realize = vurpmb_device_realize; + vdc->unrealize = vurpmb_device_unrealize; + vdc->get_features = vurpmb_get_features; + vdc->get_config = vurpmb_get_config; + vdc->set_status = vurpmb_set_status; + vdc->guest_notifier_mask = vurpmb_guest_notifier_mask; + vdc->guest_notifier_pending = vurpmb_guest_notifier_pending; +} + +static const TypeInfo vurpmb_info = { + .name = TYPE_VHOST_USER_RPMB, + .parent = TYPE_VIRTIO_DEVICE, + .instance_size = sizeof(VHostUserRPMB), + .class_init = vurpmb_class_init, +}; + +static void vurpmb_register_types(void) +{ + type_register_static(&vurpmb_info); +} + +type_init(vurpmb_register_types) diff --git a/hw/block/Kconfig b/hw/block/Kconfig index 2d17f481adc6..12e21870847a 100644 --- a/hw/block/Kconfig +++ b/hw/block/Kconfig @@ -38,5 +38,10 @@ config VHOST_USER_BLK default y if VIRTIO_PCI depends on VIRTIO && VHOST_USER && LINUX

+config VHOST_USER_RPMB + bool + default y + depends on VIRTIO && VHOST_USER + config SWIM bool diff --git a/hw/block/meson.build b/hw/block/meson.build index 78cad8f7cba1..114222f18424 100644 --- a/hw/block/meson.build +++ b/hw/block/meson.build @@ -17,5 +17,6 @@ softmmu_ss.add(when: 'CONFIG_NVME_PCI', if_true: files('nvme.c'))

specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c')) specific_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('vhost-user-blk.c')) +specific_ss.add(when: 'CONFIG_VHOST_USER_RPMB', if_true: files('vhost-user-rpmb.c'))

subdir('dataplane')

This allows is to instantiate a vhost-user-rpmb device as part of a PCI bus. It is mostly boilerplate which looks pretty similar to the vhost-user-fs-pci device if you squint.

Signed-off-by: Alex Bennée alex.bennee@linaro.org

--- - enable use IOEVENTFD flag - swap obj set bool args --- hw/block/vhost-user-rpmb-pci.c | 82 ++++++++++++++++++++++++++++++++++ hw/block/meson.build | 2 + 2 files changed, 84 insertions(+) create mode 100644 hw/block/vhost-user-rpmb-pci.c

diff --git a/hw/block/vhost-user-rpmb-pci.c b/hw/block/vhost-user-rpmb-pci.c new file mode 100644 index 000000000000..f0518305a1d9 --- /dev/null +++ b/hw/block/vhost-user-rpmb-pci.c @@ -0,0 +1,82 @@ +/* + * Vhost-user RPMB virtio device PCI glue + * + * Copyright (c) 2020 Linaro Ltd + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "hw/qdev-properties.h" +#include "hw/virtio/vhost-user-rpmb.h" +#include "hw/virtio/virtio-pci.h" + +struct VHostUserRPMBPCI { + VirtIOPCIProxy parent_obj; + VHostUserRPMB vdev; +}; + +typedef struct VHostUserRPMBPCI VHostUserRPMBPCI; + +#define TYPE_VHOST_USER_RPMB_PCI "vhost-user-rpmb-pci-base" + +#define VHOST_USER_RPMB_PCI(obj) \ + OBJECT_CHECK(VHostUserRPMBPCI, (obj), TYPE_VHOST_USER_RPMB_PCI) + +static Property vurpmb_pci_properties[] = { + DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags, + VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true), + DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, + DEV_NVECTORS_UNSPECIFIED), + DEFINE_PROP_END_OF_LIST(), +}; + +static void vurpmb_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp) +{ + VHostUserRPMBPCI *dev = VHOST_USER_RPMB_PCI(vpci_dev); + DeviceState *vdev = DEVICE(&dev->vdev); + + if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) { + vpci_dev->nvectors = 1; + } + + qdev_set_parent_bus(vdev, BUS(&vpci_dev->bus)); + object_property_set_bool(OBJECT(vdev), "realized", true, errp); +} + +static void vurpmb_pci_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass); + PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass); + k->realize = vurpmb_pci_realize; + set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); + device_class_set_props(dc, vurpmb_pci_properties); + pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET; + pcidev_k->device_id = 0; /* Set by virtio-pci based on virtio id */ + pcidev_k->revision = 0x00; + pcidev_k->class_id = PCI_CLASS_STORAGE_OTHER; +} + +static void vurpmb_pci_instance_init(Object *obj) +{ + VHostUserRPMBPCI *dev = VHOST_USER_RPMB_PCI(obj); + + virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev), + TYPE_VHOST_USER_RPMB); +} + +static const VirtioPCIDeviceTypeInfo vurpmb_pci_info = { + .base_name = TYPE_VHOST_USER_RPMB_PCI, + .non_transitional_name = "vhost-user-rpmb-pci", + .instance_size = sizeof(VHostUserRPMBPCI), + .instance_init = vurpmb_pci_instance_init, + .class_init = vurpmb_pci_class_init, +}; + +static void vurpmb_pci_register(void) +{ + virtio_pci_types_register(&vurpmb_pci_info); +} + +type_init(vurpmb_pci_register); diff --git a/hw/block/meson.build b/hw/block/meson.build index 114222f18424..0b2d10201e28 100644 --- a/hw/block/meson.build +++ b/hw/block/meson.build @@ -18,5 +18,7 @@ softmmu_ss.add(when: 'CONFIG_NVME_PCI', if_true: files('nvme.c')) specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c')) specific_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('vhost-user-blk.c')) specific_ss.add(when: 'CONFIG_VHOST_USER_RPMB', if_true: files('vhost-user-rpmb.c')) +specific_ss.add(when: ['CONFIG_VHOST_USER_RPMB', 'CONFIG_VIRTIO_PCI' ], + if_true: files('vhost-user-rpmb-pci.c'))

subdir('dataplane')

A very simple capabilities dump.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index a40a680a74ca..6b1989125bd6 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -7,6 +7,7 @@ */

#include <glib.h> +#include <stdio.h>

static gchar *socket_path; static gint socket_fd; @@ -20,6 +21,14 @@ static GOptionEntry options[] = { NULL } };

+/* Print vhost-user.json backend program capabilities */ +static void print_capabilities(void) +{ + printf("{\n"); + printf(" "type": "block"\n"); + printf("}\n"); +} + int main (int argc, char *argv[]) { GError *error = NULL; @@ -33,5 +42,9 @@ int main (int argc, char *argv[]) exit (1); }

+ if (print_cap) { + print_capabilities(); + exit(0); + }

}

This gives us two levels of informational output when tracing what the daemon is doing.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index 269c86cbb633..1be0d4b8a567 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -6,6 +6,9 @@ * SPDX-License-Identifier: GPL-2.0-or-later */

+#define G_LOG_DOMAIN "vhost-user-rpmb" +#define G_LOG_USE_STRUCTURED 1 + #include <glib.h> #include <gio/gio.h> #include <gio/gunixsocketaddress.h> @@ -25,12 +28,16 @@ static gchar *socket_path; static gint socket_fd = -1; static gboolean print_cap; +static gboolean verbose; +static gboolean debug;

static GOptionEntry options[] = { { "socket-path", 0, 0, G_OPTION_ARG_FILENAME, &socket_path, "Location of vhost-user Unix domain socket, incompatible with --fd", "PATH" }, { "fd", 0, 0, G_OPTION_ARG_INT, &socket_fd, "Specify the file-descriptor of the backend, incompatible with --socket-path", "FD" }, { "print-capabilities", 0, 0, G_OPTION_ARG_NONE, &print_cap, "Output to stdout the backend capabilities in JSON format and exit", NULL}, + { "verbose", 'v', 0, G_OPTION_ARG_NONE, &verbose, "Be more verbose in output", NULL}, + { "debug", 0, 0, G_OPTION_ARG_NONE, &debug, "Include debug output", NULL}, { NULL } };

@@ -84,6 +91,7 @@ static void vrpmb_panic(VuDev *dev, const char *msg)

static uint64_t vrpmb_get_features(VuDev *dev) { + g_info("%s: replying", __func__); return 0; }

@@ -209,6 +217,17 @@ int main (int argc, char *argv[]) exit(EXIT_FAILURE); }

+ if (verbose || debug) { + g_log_set_handler(NULL, G_LOG_LEVEL_MASK, g_log_default_handler, NULL); + if (debug) { + g_setenv("G_MESSAGES_DEBUG", "all", true); + } + } else { + g_log_set_handler(NULL, + G_LOG_LEVEL_WARNING | G_LOG_LEVEL_CRITICAL | G_LOG_LEVEL_ERROR, + g_log_default_handler, NULL); + } + /* * Now create a vhost-user socket that we will receive messages * on. Once we have our handler set up we can enter the glib main

We will need to store the data somewhere so add the option to point to the file where we will keep the data.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 58 +++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index 7b3b29ccfc5b..64bd7e79f573 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -13,9 +13,15 @@ #include <gio/gio.h> #include <gio/gunixsocketaddress.h> #include <glib-unix.h> +#include <glib/gstdio.h> #include <stdio.h> #include <string.h> #include <inttypes.h> +#include <fcntl.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <unistd.h>

#include "contrib/libvhost-user/libvhost-user-glib.h" #include "contrib/libvhost-user/libvhost-user.h" @@ -27,6 +33,7 @@ #endif

static gchar *socket_path; +static char *flash_path; static gint socket_fd = -1; static gboolean print_cap; static gboolean verbose; @@ -35,6 +42,7 @@ static gboolean debug; static GOptionEntry options[] = { { "socket-path", 0, 0, G_OPTION_ARG_FILENAME, &socket_path, "Location of vhost-user Unix domain socket, incompatible with --fd", "PATH" }, + { "flash-path", 0, 0, G_OPTION_ARG_FILENAME, &flash_path, "Location of raw flash image file", "PATH" }, { "fd", 0, 0, G_OPTION_ARG_INT, &socket_fd, "Specify the file-descriptor of the backend, incompatible with --socket-path", "FD" }, { "print-capabilities", 0, 0, G_OPTION_ARG_NONE, &print_cap, "Output to stdout the backend capabilities in JSON format and exit", NULL}, { "verbose", 'v', 0, G_OPTION_ARG_NONE, &verbose, "Be more verbose in output", NULL}, @@ -47,6 +55,8 @@ enum { };

/* These structures are defined in the specification */ +#define KiB (1UL << 10) +#define MAX_RPMB_SIZE (KiB * 128 * 256)

struct virtio_rpmb_config { uint8_t capacity; @@ -75,6 +85,8 @@ typedef struct VuRpmb { VugDev dev; struct virtio_rpmb_config virtio_config; GMainLoop *loop; + int flash_fd; + void *flash_map; } VuRpmb;

struct virtio_rpmb_ctrl_command { @@ -116,6 +128,8 @@ vrpmb_get_config(VuDev *dev, uint8_t *config, uint32_t len) VuRpmb *r = container_of(dev, VuRpmb, dev.parent); g_return_val_if_fail(len <= sizeof(struct virtio_rpmb_config), -1); memcpy(config, &r->virtio_config, len); + + g_info("%s: done", __func__); return 0; }

@@ -192,6 +206,41 @@ static const VuDevIface vuiface = { .set_config = vrpmb_set_config, };

+static bool vrpmb_load_flash_image(VuRpmb *r, char *img_path) +{ + GStatBuf statbuf; + size_t map_size; + + if (g_stat(img_path, &statbuf) < 0) { + g_error("couldn't stat %s", img_path); + return false; + } + + r->flash_fd = g_open(img_path, O_RDWR, 0); + if (r->flash_fd < 0) { + g_error("couldn't open %s (%s)", img_path, strerror(errno)); + return false; + } + + if (statbuf.st_size > MAX_RPMB_SIZE) { + g_warning("%s larger than maximum size supported", img_path); + map_size = MAX_RPMB_SIZE; + } else { + map_size = statbuf.st_size; + } + r->virtio_config.capacity = map_size / (128 *KiB); + r->virtio_config.max_wr_cnt = 1; + r->virtio_config.max_rd_cnt = 1; + + r->flash_map = mmap(NULL, map_size, PROT_READ, MAP_SHARED, r->flash_fd, 0); + if (r->flash_map == MAP_FAILED) { + g_error("failed to mmap file"); + return false; + } + + return true; +} + static void vrpmb_destroy(VuRpmb *r) { vug_deinit(&r->dev); @@ -216,7 +265,7 @@ static gboolean hangup(gpointer user_data) return true; }

-int main (int argc, char *argv[]) +int main(int argc, char *argv[]) { GError *error = NULL; GOptionContext *context; @@ -236,6 +285,13 @@ int main (int argc, char *argv[]) exit(0); }

+ if (!flash_path || !g_file_test(flash_path, G_FILE_TEST_EXISTS)) { + g_printerr("Please specify a valid --flash-path for the flash image\n"); + exit(EXIT_FAILURE); + } else { + vrpmb_load_flash_image(&rpmb, flash_path); + } + if (!socket_path && socket_fd < 0) { g_printerr("Please specify either --fd or --socket-path\n"); exit(EXIT_FAILURE);

This implements the first handshake of the device initialisation which is the programming of the device key. This can only be done once per-device.

Currently there is no persistence for the device key and other metadata such as the write count. This will be added later.

[TODO: clarify the spec if we should respond immediately or on request]

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 299 +++++++++++++++++++++++++++++++++-- 1 file changed, 286 insertions(+), 13 deletions(-)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index 64bd7e79f573..9c98f6916f6f 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -22,10 +22,14 @@ #include <sys/stat.h> #include <sys/mman.h> #include <unistd.h> +#include <endian.h> +#include <assert.h>

#include "contrib/libvhost-user/libvhost-user-glib.h" #include "contrib/libvhost-user/libvhost-user.h"

+#include "hmac_sha256.h" + #ifndef container_of #define container_of(ptr, type, member) ({ \ const typeof(((type *) 0)->member) *__mptr = (ptr); \ @@ -57,6 +61,31 @@ enum { /* These structures are defined in the specification */ #define KiB (1UL << 10) #define MAX_RPMB_SIZE (KiB * 128 * 256) +#define RPMB_KEY_MAC_SIZE 32 + +/* RPMB Request Types */ +#define VIRTIO_RPMB_REQ_PROGRAM_KEY 0x0001 +#define VIRTIO_RPMB_REQ_GET_WRITE_COUNTER 0x0002 +#define VIRTIO_RPMB_REQ_DATA_WRITE 0x0003 +#define VIRTIO_RPMB_REQ_DATA_READ 0x0004 +#define VIRTIO_RPMB_REQ_RESULT_READ 0x0005 + +/* RPMB Response Types */ +#define VIRTIO_RPMB_RESP_PROGRAM_KEY 0x0100 +#define VIRTIO_RPMB_RESP_GET_COUNTER 0x0200 +#define VIRTIO_RPMB_RESP_DATA_WRITE 0x0300 +#define VIRTIO_RPMB_RESP_DATA_READ 0x0400 + +/* RPMB Operation Results */ +#define VIRTIO_RPMB_RES_OK 0x0000 +#define VIRTIO_RPMB_RES_GENERAL_FAILURE 0x0001 +#define VIRTIO_RPMB_RES_AUTH_FAILURE 0x0002 +#define VIRTIO_RPMB_RES_COUNT_FAILURE 0x0003 +#define VIRTIO_RPMB_RES_ADDR_FAILURE 0x0004 +#define VIRTIO_RPMB_RES_WRITE_FAILURE 0x0005 +#define VIRTIO_RPMB_RES_READ_FAILURE 0x0006 +#define VIRTIO_RPMB_RES_NO_AUTH_KEY 0x0007 +#define VIRTIO_RPMB_RES_WRITE_COUNTER_EXPIRED 0x0080

struct virtio_rpmb_config { uint8_t capacity; @@ -64,9 +93,13 @@ struct virtio_rpmb_config { uint8_t max_rd_cnt; };

+/* + * This is based on the JDEC standard and not the currently not + * up-streamed NVME standard. + */ struct virtio_rpmb_frame { uint8_t stuff[196]; - uint8_t key_mac[32]; + uint8_t key_mac[RPMB_KEY_MAC_SIZE]; uint8_t data[256]; uint8_t nonce[16]; /* remaining fields are big-endian */ @@ -75,7 +108,7 @@ struct virtio_rpmb_frame { uint16_t block_count; uint16_t result; uint16_t req_resp; -}; +} __attribute__((packed));

/* * Structure to track internal state of RPMB Device @@ -87,15 +120,63 @@ typedef struct VuRpmb { GMainLoop *loop; int flash_fd; void *flash_map; + uint8_t *key; + uint16_t last_result; + uint16_t last_reqresp; } VuRpmb;

-struct virtio_rpmb_ctrl_command { - VuVirtqElement elem; - VuVirtq *vq; - struct virtio_rpmb_frame frame; - uint32_t error; - bool finished; -}; +/* refer to util/iov.c */ +static size_t vrpmb_iov_size(const struct iovec *iov, + const unsigned int iov_cnt) +{ + size_t len; + unsigned int i; + + len = 0; + for (i = 0; i < iov_cnt; i++) { + len += iov[i].iov_len; + } + return len; +} + + +static size_t vrpmb_iov_to_buf(const struct iovec *iov, const unsigned int iov_cnt, + size_t offset, void *buf, size_t bytes) +{ + size_t done; + unsigned int i; + for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) { + if (offset < iov[i].iov_len) { + size_t len = MIN(iov[i].iov_len - offset, bytes - done); + memcpy(buf + done, iov[i].iov_base + offset, len); + done += len; + offset = 0; + } else { + offset -= iov[i].iov_len; + } + } + assert(offset == 0); + return done; +} + +static size_t vrpmb_iov_from_buf(const struct iovec *iov, unsigned int iov_cnt, + size_t offset, const void *buf, size_t bytes) +{ + size_t done; + unsigned int i; + for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) { + if (offset < iov[i].iov_len) { + size_t len = MIN(iov[i].iov_len - offset, bytes - done); + memcpy(iov[i].iov_base + offset, buf + done, len); + done += len; + offset = 0; + } else { + offset -= iov[i].iov_len; + } + } + assert(offset == 0); + return done; +}

static void vrpmb_panic(VuDev *dev, const char *msg) { @@ -142,19 +223,211 @@ vrpmb_set_config(VuDev *dev, const uint8_t *data, return 0; }

+/* + * vrpmb_update_mac_in_frame: + * + * From the spec: + * The MAC is calculated using HMAC SHA-256. It takes + * as input a key and a message. The key used for the MAC calculation + * is always the 256-bit RPMB authentication key. The message used as + * input to the MAC calculation is the concatenation of the fields in + * the RPMB frames excluding stuff bytes and the MAC itself. + * + * The code to do this has been lifted from the optee supplicant code + * which itself uses a 3 clause BSD chunk of code. + */ + +static void vrpmb_update_mac_in_frame(VuRpmb *r, struct virtio_rpmb_frame *frm) +{ + hmac_sha256_ctx ctx; + static const int dlen = (sizeof(struct virtio_rpmb_frame) - + offsetof(struct virtio_rpmb_frame, data)); + + hmac_sha256_init(&ctx, r->key, RPMB_KEY_MAC_SIZE); + hmac_sha256_update(&ctx, frm->data, dlen); + hmac_sha256_final(&ctx, &frm->key_mac[0], 32); +} + +/* + * Handlers for individual control messages + */ + +/* + * vrpmb_handle_program_key: + * + * Program the device with our key. The spec is a little hazzy on if + * we respond straight away or we wait for the user to send a + * VIRTIO_RPMB_REQ_RESULT_READ request. + */ +static void vrpmb_handle_program_key(VuDev *dev, struct virtio_rpmb_frame *frame) +{ + VuRpmb *r = container_of(dev, VuRpmb, dev.parent); + + /* + * Run the checks from: + * 5.12.6.1.1 Device Requirements: Device Operation: Program Key + */ + r->last_reqresp = VIRTIO_RPMB_RESP_PROGRAM_KEY; + + /* Fail if already programmed */ + if (r->key) { + g_debug("key already programmed"); + r->last_result = VIRTIO_RPMB_RES_WRITE_FAILURE; + } else if (be16toh(frame->block_count) != 1) { + g_debug("weird block counts (%d)", frame->block_count); + r->last_result = VIRTIO_RPMB_RES_GENERAL_FAILURE; + } else { + r->key = g_memdup(&frame->key_mac[0], RPMB_KEY_MAC_SIZE); + r->last_result = VIRTIO_RPMB_RES_OK; + } + + g_info("%s: req_resp = %x, result = %x", __func__, + r->last_reqresp, r->last_result); + return; +} + +/* + * Return the result of the last message. This is only valid if the + * previous message was VIRTIO_RPMB_REQ_PROGRAM_KEY or + * VIRTIO_RPMB_REQ_DATA_WRITE. + * + * The frame should be freed once sent. + */ +static struct virtio_rpmb_frame * vrpmb_handle_result_read(VuDev *dev) +{ + VuRpmb *r = container_of(dev, VuRpmb, dev.parent); + struct virtio_rpmb_frame *resp = g_new0(struct virtio_rpmb_frame, 1); + + if (r->last_reqresp == VIRTIO_RPMB_RESP_PROGRAM_KEY || + r->last_reqresp == VIRTIO_RPMB_REQ_DATA_WRITE) { + resp->result = htobe16(r->last_result); + resp->req_resp = htobe16(r->last_reqresp); + } else { + resp->result = htobe16(VIRTIO_RPMB_RES_GENERAL_FAILURE); + } + + /* calculate HMAC */ + if (!r->key) { + resp->result = htobe16(VIRTIO_RPMB_RES_GENERAL_FAILURE); + } else { + vrpmb_update_mac_in_frame(r, resp); + } + + g_info("%s: result = %x req_resp = %x", __func__, + be16toh(resp->result), + be16toh(resp->req_resp)); + return resp; +} + +static void fmt_bytes(GString *s, uint8_t *bytes, int len) +{ + int i; + for (i = 0; i < len; i++) { + if (i % 16 == 0) { + g_string_append_c(s, '\n'); + } + g_string_append_printf(s, "%x ", bytes[i]); + } +} + +static void vrpmb_dump_frame(struct virtio_rpmb_frame *frame) +{ + g_autoptr(GString) s = g_string_new("frame: "); + + g_string_append_printf(s, " %p\n", frame); + g_string_append_printf(s, "key_mac:"); + fmt_bytes(s, (uint8_t *) &frame->key_mac[0], 32); + g_string_append_printf(s, "\ndata:"); + fmt_bytes(s, (uint8_t *) &frame->data, 256); + g_string_append_printf(s, "\nnonce:"); + fmt_bytes(s, (uint8_t *) &frame->nonce, 16); + g_string_append_printf(s, "\nwrite_counter: %d\n", + be32toh(frame->write_counter)); + g_string_append_printf(s, "address: %#04x\n", be16toh(frame->address)); + g_string_append_printf(s, "block_count: %d\n", be16toh(frame->block_count)); + g_string_append_printf(s, "result: %d\n", be16toh(frame->result)); + g_string_append_printf(s, "req_resp: %d\n", be16toh(frame->req_resp)); + + g_debug("%s: %s\n", __func__, s->str); +} + static void vrpmb_handle_ctrl(VuDev *dev, int qidx) { VuVirtq *vq = vu_get_queue(dev, qidx); - struct virtio_rpmb_ctrl_command *cmd = NULL; + struct virtio_rpmb_frame *frames = NULL;

for (;;) { - cmd = vu_queue_pop(dev, vq, sizeof(struct virtio_rpmb_ctrl_command)); - if (!cmd) { + VuVirtqElement *elem; + size_t len, frame_sz = sizeof(struct virtio_rpmb_frame); + int n; + + elem = vu_queue_pop(dev, vq, sizeof(VuVirtqElement)); + if (!elem) { break; } + g_debug("%s: got queue (in %d, out %d)", __func__, + elem->in_num, elem->out_num);

- g_debug("un-handled cmd: %p", cmd); + len = vrpmb_iov_size(elem->out_sg, elem->out_num); + frames = g_realloc(frames, len); + vrpmb_iov_to_buf(elem->out_sg, elem->out_num, 0, frames, len); + + if (len % frame_sz != 0) { + g_warning("%s: incomplete frames %zu/%zu != 0\n", + __func__, len, frame_sz); + } + + for (n = 0; n < len / frame_sz; n++) { + struct virtio_rpmb_frame *f = &frames[n]; + struct virtio_rpmb_frame *resp = NULL; + uint16_t req_resp = be16toh(f->req_resp); + bool responded = false; + + if (debug) { + g_info("req_resp=%x", req_resp); + vrpmb_dump_frame(f); + } + + switch (req_resp) { + case VIRTIO_RPMB_REQ_PROGRAM_KEY: + vrpmb_handle_program_key(dev, f); + break; + case VIRTIO_RPMB_REQ_RESULT_READ: + if (!responded) { + resp = vrpmb_handle_result_read(dev); + } else { + g_warning("%s: already sent a response in this set of frames", + __func__); + } + break; + default: + g_debug("un-handled request: %x", f->req_resp); + break; + } + + /* + * Do we have a frame to send back? + */ + if (resp) { + g_debug("sending response frame: %p", resp); + if (debug) { + vrpmb_dump_frame(resp); + } + len = vrpmb_iov_from_buf(elem->in_sg, + elem->in_num, 0, resp, sizeof(*resp)); + if (len != sizeof(*resp)) { + g_critical("%s: response size incorrect %zu vs %zu", + __func__, len, sizeof(*resp)); + } else { + vu_queue_push(dev, vq, elem, len); + vu_queue_notify(dev, vq); + responded = true; + } + + g_free(resp); + } + } } }

With this command we are finally updating data to the backing store and cycling the write_count and each successful write. We also include the write count in all response frames as the spec is a little unclear but the example test code expected it.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 111 +++++++++++++++++++++++++++++++++-- 1 file changed, 105 insertions(+), 6 deletions(-)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index 88747c50fa44..a17c3b4bcc4e 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -62,6 +62,7 @@ enum { #define KiB (1UL << 10) #define MAX_RPMB_SIZE (KiB * 128 * 256) #define RPMB_KEY_MAC_SIZE 32 +#define RPMB_BLOCK_SIZE 256

/* RPMB Request Types */ #define VIRTIO_RPMB_REQ_PROGRAM_KEY 0x0001 @@ -100,7 +101,7 @@ struct virtio_rpmb_config { struct virtio_rpmb_frame { uint8_t stuff[196]; uint8_t key_mac[RPMB_KEY_MAC_SIZE]; - uint8_t data[256]; + uint8_t data[RPMB_BLOCK_SIZE]; uint8_t nonce[16]; /* remaining fields are big-endian */ uint32_t write_counter; @@ -124,6 +125,7 @@ typedef struct VuRpmb { uint8_t last_nonce[16]; uint16_t last_result; uint16_t last_reqresp; + uint16_t last_address; uint32_t write_count; } VuRpmb;

@@ -239,17 +241,30 @@ vrpmb_set_config(VuDev *dev, const uint8_t *data, * which itself uses a 3 clause BSD chunk of code. */

+static const int rpmb_frame_dlen = (sizeof(struct virtio_rpmb_frame) - + offsetof(struct virtio_rpmb_frame, data)); + static void vrpmb_update_mac_in_frame(VuRpmb *r, struct virtio_rpmb_frame *frm) { hmac_sha256_ctx ctx; - static const int dlen = (sizeof(struct virtio_rpmb_frame) - - offsetof(struct virtio_rpmb_frame, data));

hmac_sha256_init(&ctx, r->key, RPMB_KEY_MAC_SIZE); - hmac_sha256_update(&ctx, frm->data, dlen); + hmac_sha256_update(&ctx, frm->data, rpmb_frame_dlen); hmac_sha256_final(&ctx, &frm->key_mac[0], 32); }

+static bool vrpmb_verify_mac_in_frame(VuRpmb *r, struct virtio_rpmb_frame *frm) +{ + hmac_sha256_ctx ctx; + uint8_t calculated_mac[RPMB_KEY_MAC_SIZE]; + + hmac_sha256_init(&ctx, r->key, RPMB_KEY_MAC_SIZE); + hmac_sha256_update(&ctx, frm->data, rpmb_frame_dlen); + hmac_sha256_final(&ctx, calculated_mac, RPMB_KEY_MAC_SIZE); + + return memcmp(calculated_mac, frm->key_mac, RPMB_KEY_MAC_SIZE) == 0; +} + /* * Handlers for individual control messages */ @@ -324,6 +339,82 @@ vrpmb_handle_get_write_counter(VuDev *dev, struct virtio_rpmb_frame *frame) return resp; }

+/* + * vrpmb_handle_write: + * + * We will report the success/fail on receipt of + * VIRTIO_RPMB_REQ_RESULT_READ. Returns the number of extra frames + * processed in the request. + */ +static int vrpmb_handle_write(VuDev *dev, struct virtio_rpmb_frame *frame) +{ + VuRpmb *r = container_of(dev, VuRpmb, dev.parent); + int extra_frames = 0; + uint16_t block_count = be16toh(frame->block_count); + uint32_t write_counter = be32toh(frame->write_counter); + size_t offset; + + r->last_reqresp = VIRTIO_RPMB_RESP_DATA_WRITE; + r->last_address = be16toh(frame->address); + offset = r->last_address * RPMB_BLOCK_SIZE; + + /* + * Run the checks from: + * 5.12.6.1.3 Device Requirements: Device Operation: Data Write + */ + if (!r->key) { + g_warning("no key programmed"); + r->last_result = VIRTIO_RPMB_RES_NO_AUTH_KEY; + } else if (block_count == 0 || + block_count > r->virtio_config.max_wr_cnt) { + r->last_result = VIRTIO_RPMB_RES_GENERAL_FAILURE; + } else if (false /* what does an expired write counter mean? */) { + r->last_result = VIRTIO_RPMB_RES_WRITE_COUNTER_EXPIRED; + } else if (offset > (r->virtio_config.capacity * (128 * KiB))) { + r->last_result = VIRTIO_RPMB_RES_ADDR_FAILURE; + } else if (!vrpmb_verify_mac_in_frame(r, frame)) { + r->last_result = VIRTIO_RPMB_RES_AUTH_FAILURE; + } else if (write_counter != r->write_count) { + r->last_result = VIRTIO_RPMB_RES_COUNT_FAILURE; + } else { + int i; + /* At this point we have a valid authenticated write request + * so the counter can incremented and we can attempt to + * update the backing device. + */ + r->write_count++; + for (i = 0; i < block_count; i++) { + void *blk = r->flash_map + offset; + g_debug("%s: writing block %d", __func__, i); + if (mprotect(blk, RPMB_BLOCK_SIZE, PROT_WRITE) != 0) { + r->last_result = VIRTIO_RPMB_RES_WRITE_FAILURE; + break; + } + memcpy(blk, frame[i].data, RPMB_BLOCK_SIZE); + if (msync(blk, RPMB_BLOCK_SIZE, MS_SYNC) != 0) { + g_warning("%s: failed to sync update", __func__); + r->last_result = VIRTIO_RPMB_RES_WRITE_FAILURE; + break; + } + if (mprotect(blk, RPMB_BLOCK_SIZE, PROT_READ) != 0) { + g_warning("%s: failed to re-apply read protection", __func__); + r->last_result = VIRTIO_RPMB_RES_GENERAL_FAILURE; + break; + } + offset += RPMB_BLOCK_SIZE; + } + r->last_result = VIRTIO_RPMB_RES_OK; + extra_frames = i - 1; + } + + g_info("%s: %s (%x, %d extra frames processed), write_count=%d", __func__, + r->last_result == VIRTIO_RPMB_RES_OK ? "successful":"failed", + r->last_result, extra_frames, r->write_count); + + return extra_frames; +} + + /* * Return the result of the last message. This is only valid if the * previous message was VIRTIO_RPMB_REQ_PROGRAM_KEY or @@ -339,10 +430,14 @@ static struct virtio_rpmb_frame * vrpmb_handle_result_read(VuDev *dev) g_info("%s: for request:%x result:%x", __func__, r->last_reqresp, r->last_result);

- if (r->last_reqresp == VIRTIO_RPMB_RESP_PROGRAM_KEY || - r->last_reqresp == VIRTIO_RPMB_REQ_DATA_WRITE) { + if (r->last_reqresp == VIRTIO_RPMB_RESP_PROGRAM_KEY) { resp->result = htobe16(r->last_result); resp->req_resp = htobe16(r->last_reqresp); + } else if (r->last_reqresp == VIRTIO_RPMB_RESP_DATA_WRITE) { + resp->result = htobe16(r->last_result); + resp->req_resp = htobe16(r->last_reqresp); + resp->write_counter = htobe32(r->write_count); + resp->address = htobe16(r->last_address); } else { resp->result = htobe16(VIRTIO_RPMB_RES_GENERAL_FAILURE); } @@ -445,6 +540,10 @@ vrpmb_handle_ctrl(VuDev *dev, int qidx) __func__); } break; + case VIRTIO_RPMB_REQ_DATA_WRITE: + /* we can have multiple blocks handled */ + n += vrpmb_handle_write(dev, f); + break; default: g_debug("un-handled request: %x", f->req_resp); break;

The read command is a lot simpler to implement. However the spec does specify you can only read a single block at a time so we limit it to that.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 52 ++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index a17c3b4bcc4e..49d4e00b24a9 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -414,6 +414,55 @@ static int vrpmb_handle_write(VuDev *dev, struct virtio_rpmb_frame *frame) return extra_frames; }

+/* + * vrpmb_handle_read: + * + * Unlike the write operation we return a frame with the result of the + * read here. While the config specifies a maximum read count the spec + * is limited to a single read at a time. + */ +static struct virtio_rpmb_frame * +vrpmb_handle_read(VuDev *dev, struct virtio_rpmb_frame *frame) +{ + VuRpmb *r = container_of(dev, VuRpmb, dev.parent); + size_t offset = be16toh(frame->address) * RPMB_BLOCK_SIZE; + uint16_t block_count = be16toh(frame->block_count); + struct virtio_rpmb_frame *resp = g_new0(struct virtio_rpmb_frame, 1); + + resp->req_resp = htobe16(VIRTIO_RPMB_RESP_DATA_READ); + resp->address = frame->address; + resp->block_count = htobe16(1); + + /* + * Run the checks from: + * 5.12.6.1.4 Device Requirements: Device Operation: Data Read + */ + if (!r->key) { + g_warning("no key programmed"); + resp->result = htobe16(VIRTIO_RPMB_RES_NO_AUTH_KEY); + } else if (block_count != 1) { + /* + * Despite the config the spec only allows for reading one + * block at a time: "If block count has not been set to 1 then + * VIRTIO_RPMB_RES_GENERAL_FAILURE SHOULD be responded as + * result." + */ + resp->result = htobe16(VIRTIO_RPMB_RES_GENERAL_FAILURE); + } else if (offset > (r->virtio_config.capacity * (128 * KiB))) { + resp->result = htobe16(VIRTIO_RPMB_RES_ADDR_FAILURE); + } else { + void *blk = r->flash_map + offset; + g_debug("%s: reading block from %p (%zu)", __func__, blk, offset); + memcpy(resp->data, blk, RPMB_BLOCK_SIZE); + resp->result = htobe16(VIRTIO_RPMB_RES_OK); + } + + /* Final housekeeping, copy nonce and calculate MAC */ + memcpy(&resp->nonce, &frame->nonce, sizeof(frame->nonce)); + vrpmb_update_mac_in_frame(r, resp); + + return resp; +}

/* * Return the result of the last message. This is only valid if the @@ -544,6 +593,9 @@ vrpmb_handle_ctrl(VuDev *dev, int qidx) /* we can have multiple blocks handled */ n += vrpmb_handle_write(dev, f); break; + case VIRTIO_RPMB_REQ_DATA_READ: + resp = vrpmb_handle_read(dev, f); + break; default: g_debug("un-handled request: %x", f->req_resp); break;

This is mostly useful for testing. Practically all guest operations will probe the write count before any write transaction.

Signed-off-by: Alex Bennée alex.bennee@linaro.org --- tools/vhost-user-rpmb/main.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/tools/vhost-user-rpmb/main.c b/tools/vhost-user-rpmb/main.c index 34607ad19429..c798a6f66cd2 100644 --- a/tools/vhost-user-rpmb/main.c +++ b/tools/vhost-user-rpmb/main.c @@ -39,6 +39,7 @@ static gchar *socket_path; static char *flash_path; static char *key_path; +static gint initial_counter; static gint socket_fd = -1; static gboolean print_cap; static gboolean verbose; @@ -49,6 +50,7 @@ static GOptionEntry options[] = { { "socket-path", 0, 0, G_OPTION_ARG_FILENAME, &socket_path, "Location of vhost-user Unix domain socket, incompatible with --fd", "PATH" }, { "flash-path", 0, 0, G_OPTION_ARG_FILENAME, &flash_path, "Location of raw flash image file", "PATH" }, + { "initial-counter", 0, 0, G_OPTION_ARG_INT, &initial_counter, "Set initial value of write counter", NULL}, { "key-path", 0, 0, G_OPTION_ARG_FILENAME, &key_path, "Location of persistent keyfile", "KEY"}, { "key-set", 0, 0, G_OPTION_ARG_NONE, &key_set, "Is the key already programmed", NULL}, { "fd", 0, 0, G_OPTION_ARG_INT, &socket_fd, "Specify the file-descriptor of the backend, incompatible with --socket-path", "FD" }, @@ -797,6 +799,10 @@ int main(int argc, char *argv[]) vrpmb_set_key(&rpmb, key_path); }

+ if (initial_counter) { + rpmb.write_count = initial_counter; + } + if (!socket_path && socket_fd < 0) { g_printerr("Please specify either --fd or --socket-path\n"); exit(EXIT_FAILURE);