xen/arm: Inject an undefined instruction when the coproc/sysreg is not handled

Currently Xen panics if it's unable to handle a coprocessor/sysreg instruction.
Replace this behavior by inject an undefined instruction to the faulty guest
and log if Xen is in debug mode.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Don't let the guest access the coprocessors registers

In Xen we only handle save/restore for coprocessor 10 and 11 (NEON). Other
coprocessors (0-9, 12-13) are currently exposed to the guest and may lead
to data shared between guest.

Disable access to all coprocessor except 10 and 11 by setting correctly
HCTPR.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Upgrade DCISW into DCCISW

A guest is allowed to use invalidate cache by set/way instruction (i.e DCISW)
without any restriction. As the cache is shared with Xen, the guest invalidate
an address being in used by Xen. This may lead a Xen crash because the memory
state is invalid.
Set the bit HCR.SWIO to upgrade invalidate cache by set/way instruction to an
invalidate and clean.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Reported-by: Thomas Leonard <tal36@cam.ac.uk>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Trap cache and TCM lockdown registers

Some cp15 c9/c10/c11 encodings are used for:
     - cache control
     - TCM control
     - branch predictor control

All of them are implementation defined. For now inject an undefined exception
if the guest wants try to access it.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Don't expose implementation defined registers (Cp15 c15) to the guest

On Cortex-A15, CP15 c15 contains registers to retrieve data from L1/L2 RAM.

Exposing this registers to guest may result to leak data from Xen and/or
another guest.

By default trap every registers and inject an undefined instruction.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arm: Don't let guess access to Debug and Performance Monitor registers

Debug and performance registers are not properly switched by Xen.

Trap them and inject an undefined instruction, except for those registers
which might be unconditionally accessed which we implement as RAZ/WI.

This is CVE-2014-2915 / XSA-93.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
vtpmmgr: add TPM group support

This is a complete rewrite of the disk format and key hierarchy for the
TPM Manager. The new format supports multiple groups of vTPMs which
define the permitted configurations where a given vTPM's keys are
available, allowing upgrades of critical components while retaining the
secrecy of cryptographic keys.

New features of the TPM Manager are explained in the README and in the
definitions of the management commands in vtpm_manager.h.

New features for vTPMs:

1. The size of the state blob for a vTPM is expanded from 52 to 64
bytes in order to support future vTPMs using SHA-2/3 instead of SHA-1.

2. vTPMs can obtain a quote from the physical TPM with certain
resettable PCRs set to include information about the vTPM. This can be
used by a vTPM to provide evidence of its integrity, including the
secrecy of its EK, and for deep quotes.

Some additional changes made by this rewrite that may impact existing
users:

1. The value of WELLKNOWN_OWNER_AUTH was incorrect for the physical TPM;
the convention is to use all zero bits for well-known authentication
values, not all one bits.

2. Randomly generating the owner auth value for the physical TPM is no
longer supported, as it prevents later creation or certification of
AIKs (which the old manager did not support).

3. The vTPM Manager needs to be provisioned with a PCR composite and an
upgrade authority's public key before it will save data across boots.

The current implementation still has some limitations:
 * 5 valid system PCR selections per group
 * The vTPM Manager's disk can use at most 2MB of space
 * The vTPM domain's build hash is always set to null/zero

Most of the code relating to upgrade and rollback protection is
currently stubbed out, but future versions can add:
 * Support for using the TPM's monotonic counter to prevent rollback
   of vTPM data by taking and restoring disk snapshots
 * Masking the master disk encryption key using a value stored in the
   TPM's NVRAM so that revocation of old data is possible without
   relying on all previously authorized software stacks to respect the
   monotonic counter's value

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
vtpmmgr: add example control tools

The manage-vtpmmgr.pl script is an example client for interacting with
the TPM Manager; it is intended to run in a management domain with a
vTPM (which may be dom0).  It is used to create and manage vTPMs and
vTPM groups.

The calc.pl script is an example manager of a vTPM group.  It signs
the configuration lists used by the TPM Manager with a locally held
private key.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
vtpmmgr: Store hardware TPM Locality

The TPM locality must be specified when using TPM_PCR_INFO_LONG for
TPM_Seal.  Store the locality so it can be provided later.

Signed-off-by: Jason Andryuk <andryuk@aero.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG

Infineon 1.2 TPMs fail TPM_Seal commands with TPM_BAD_PARAMETER when
PCRS are specified by a TPM_PCR_INFO structure.  Using a
TPM_PCR_INFO_LONG structure to specify PCRs succeeds, so update to use
that.  This also requires changes to use TPM_STORED_DATA12 for the
result.

Signed-off-by: Jason Andryuk <andryuk@aero.org>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
vtpm: passthru requests to manager

When sending commands to a vTPM, commands with the VTPM_TAG_REQ2 tag are
passed directly to the TPM Manager since they are used in the management
interface to the TPM Manager. The VTPM_TAG_REQ tag is translated to
TPM_TAG_RQU_COMMAND to allow access to the physical TPM for certain
ordinals (PCRRead, Extend, and GetRandom).

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
vtpm: add ordinal for obtaining an EK signature

For a vTPM to be useful for remote attestation, proof that the vTPM's EK
was generated and held within a secure vTPM implementation is necessary.
This patch adds an ordinal to the vTPM which will request a quote
providing this evidence from the TPM Manager; it only functions during
the first startup of a given vTPM in order to provide proof that the EK
was freshly generated (and not a key whose private part is available
elsewhere).

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
vtpm: add deep quote support

This allows the client of a vTPM to request a quote from the physical
TPM which includes PCRs from both the physical and virtual TPMs, signed
by an AIK from the physical TPM. This quote can be used to provide
evidence of the complete launch environment of a virtual machine.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
stubdom/grub: verify vTPM label if requested

This adds an optional argument --vtpm-label=<label> to the pv-grub
command line.  If specified, a vtpm device must be connected to the
pv-grub domain and the backend of this device must have the given XSM
label (which may start with a * to indicate a wildcard).  Verifying the
label of the vTPM before sending measurements prevents a disaggregated
control domain that has access to xenstore but not to the guest domains
from causing the measurements performed by pv-grub to be discarded,
allowing the forgery of arbitrary kernel measurements in the TPM.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
vtpmmgr: use XSM label as vTPM kernel hash

Because there is not currently a method for the vTPM Manager to obtain a
build hash of a vTPM, use the hash of the vTPM's XSM label as a
substitute.  This allows the vTPM Manager to distinguish between vTPMs
intended to be paired with a hardware domain kernel (which cannot use
pv-grub) and vTPMs which are paired with a pv-grub domain and therefore
contain reliable measurements of the guest kernel in PCRs 4 and 5.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools: remove /var/run/xenstored from install target

xenstored already does "mkdir /var/run/xenstored" on startup, so its not
required to create this directory during make install|rpmball.

Without this change installing the resulting xen.rpm will fail on
systems where /var/run is a symlink. rpm complains that '/var/run' (the
symlink) is already owned by some other system rpm package.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools: remove /var/lock/subsys from install target

/var/lock/subsys is used only in tools/hotplug/Linux/init.d/xendomains.
The start() function already does a "mkdir /var/lock/subsys", so its not
required to create this directory during make install|rpmball.

Without this change installing the resulting xen.rpm will fail on
systems where /var/lock is a symlink. rpm complains that '/var/lock'
(the symlink) is already owned by some other system rpm package.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/pygrub: remove /var/run/xend/boot from install target

pygrub stores the temporary kernel+initrd files in /var/run/pygrub, or
any other directory specified with --output-directory=<dir>. If the
default dir is missing pygrub will create it.

Without this change installing the resulting xen.rpm will fail on
systems where /var/run is a symlink. rpm complains that '/var/run' (the
symlink) is already owned by some other system rpm package.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/python: add APPEND_LDFLAGS to CFLAGS

Required to pass -Wl,-rpath,$libdir to link command.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
tools/libfsimage: append APPEND_LDFLAGS to link command

Required to pass -Wl,-rpath,$libdir to link command.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Campbell <ian.campbell@citrix.com>