[Qemu-devel] [PATCH V5 10/12] Encrypt state blobs using AES CBC encryption

[Stefan Berger]

This patch adds encryption of the individual state blobs that are written
into the block storage. The 'directory' at the beginnig of the block
storage is not encrypted.

Keys can be passed either as a string of hexadecimal digits forming a 256,
192 or 128 bit AES key. Those keys can optionally start with '0x'. If the
parser does not recognize it as such, the string itself is taken as the AES
key.

The key is passed via command line argument. It is wiped from the command
line after parsing. If key=0x1234... was passed before it will then be
changed to key=------... so that 'ps' does not show the key anymore. Obviously
it cannot be completely prevented that the key is visible during a very
short period of time until qemu is done parsing the command line parameters.

A flag is introduced in the directory structure indicating whether the blobs
are encrypted.

An additional 'layer' for reading and writing the blobs to the underlying
block storage is added. This layer encrypts the blobs for writing if a key is
available. Similarly it decrypts the blobs after reading.

Checks are added that test whether a key has been provided although all
data are stored in clear-text or whether a key is missing. In either one of
the cases the backend returns an error and Qemu terminates.

-v5:
  - -tpmdev now also gets a key parameter
  - add documentation about key parameter

Signed-off-by: Stefan Berger <address@hidden>

---
 hw/tpm_builtin.c |  213 +++++++++++++++++++++++++++++++++++++++++++++++++++++--
 qemu-config.c    |   10 ++
 qemu-options.hx  |   20 ++++-
 tpm.c            |   10 ++
 4 files changed, 246 insertions(+), 7 deletions(-)

Index: qemu-git/hw/tpm_builtin.c
===================================================================
--- qemu-git.orig/hw/tpm_builtin.c
+++ qemu-git/hw/tpm_builtin.c
@@ -27,6 +27,7 @@
 #include "hw/pc.h"
 #include "migration.h"
 #include "sysemu.h"
+#include "aes.h"
 
 #include <libtpms/tpm_library.h>
 #include <libtpms/tpm_error.h>
@@ -110,7 +111,8 @@ typedef struct BSDir {
     uint16_t  rev;
     uint32_t  checksum;
     uint32_t  num_entries;
-    uint32_t  reserved[10];
+    uint32_t  flags;
+    uint32_t  reserved[9];
     BSEntry   entries[BS_DIR_MAX_NUM_ENTRIES];
 } __attribute__((packed)) BSDir;
 
@@ -119,6 +121,8 @@ typedef struct BSDir {
 
 #define BS_DIR_REV_CURRENT  BS_DIR_REV1
 
+#define BS_DIR_FLAG_ENC_BLOBS   (1 << 0)
+
 /* local variables */
 
 static QemuThread thread;
@@ -150,6 +154,8 @@ static const unsigned char tpm_std_fatal
 
 static char dev_description[80];
 
+static bool has_key;
+static AES_KEY tpm_enc_key, tpm_dec_key;
 
 static void tpm_builtin_adjust_data_layout(BlockDriverState *bs, BSDir *dir);
 static int tpm_builtin_load_sized_data_from_bs(BlockDriverState *bs,
@@ -206,6 +212,7 @@ static void tpm_builtin_dir_be_to_cpu(BS
     be16_to_cpus(&dir->rev);
     be32_to_cpus(&dir->checksum);
     be32_to_cpus(&dir->num_entries);
+    be32_to_cpus(&dir->flags);
 
     for (c = 0; c < dir->num_entries && c < BS_DIR_MAX_NUM_ENTRIES; c++) {
         be32_to_cpus(&dir->entries[c].type);
@@ -232,6 +239,7 @@ static void tpm_builtin_dir_cpu_to_be(BS
     dir->rev         = cpu_to_be16(dir->rev);
     dir->checksum    = cpu_to_be32(dir->checksum);
     dir->num_entries = cpu_to_be32(dir->num_entries);
+    dir->flags       = cpu_to_be32(dir->flags);
 }
 
 
@@ -297,6 +305,36 @@ static bool tpm_builtin_has_valid_conten
 }
 
 
+static uint32_t tpm_builtin_get_dir_flags(void)
+{
+    if (has_key) {
+        return BS_DIR_FLAG_ENC_BLOBS;
+    }
+
+    return 0;
+}
+
+
+static bool tpm_builtin_has_missing_key(const BSDir *dir)
+{
+    if ((dir->flags & BS_DIR_FLAG_ENC_BLOBS) && !has_key) {
+        return true;
+    }
+
+    return false;
+}
+
+
+static bool tpm_builtin_has_unnecessary_key(const BSDir *dir)
+{
+    if (!(dir->flags & BS_DIR_FLAG_ENC_BLOBS) && has_key) {
+        return true;
+    }
+
+    return false;
+}
+
+
 static int tpm_builtin_create_blank_dir(BlockDriverState *bs)
 {
     uint8_t buf[BDRV_SECTOR_SIZE];
@@ -307,6 +345,7 @@ static int tpm_builtin_create_blank_dir(
     dir = (BSDir *)buf;
     dir->rev = BS_DIR_REV_CURRENT;
     dir->num_entries = 0;
+    dir->flags = tpm_builtin_get_dir_flags();
 
     dir->checksum = tpm_builtin_calc_dir_checksum(dir);
 
@@ -408,6 +447,28 @@ static int tpm_builtin_startup_bs(BlockD
 
     tpm_builtin_dir_be_to_cpu(dir);
 
+    if (tpm_builtin_is_valid_bsdir(dir)) {
+        if (tpm_builtin_has_missing_key(dir)) {
+            fprintf(stderr,
+                    "tpm: the data are encrypted but I am missing the key.\n");
+            rc = -EIO;
+            goto err_exit;
+        }
+        if (tpm_builtin_has_unnecessary_key(dir)) {
+            fprintf(stderr,
+                    "tpm: I have a key but the data are not encrypted.\n");
+            rc = -EIO;
+            goto err_exit;
+        }
+        if ((dir->flags & BS_DIR_FLAG_ENC_BLOBS) &&
+            !tpm_builtin_has_valid_content(dir)) {
+            fprintf(stderr, "tpm: cannot read the data - "
+                    "is this the wrong key?\n");
+            rc = -EIO;
+            goto err_exit;
+        }
+    }
+
     if (!tpm_builtin_is_valid_bsdir(dir) ||
         !tpm_builtin_has_valid_content(dir)) {
         /* if it's encrypted and has something else than null-content,
@@ -572,6 +633,81 @@ static int set_bs_entry_size_crc(BlockDr
 }
 
 
+static int tpm_builtin_bdrv_pread(BlockDriverState *bs, int64_t offset,
+                                  void *buf, int count,
+                                  enum BSEntryType type)
+{
+    int ret;
+    union {
+        uint64_t ll[2];
+        uint8_t b[16];
+    } ivec;
+    int toread = count;
+
+    if (has_key) {
+        toread = ALIGN(count, AES_BLOCK_SIZE);
+    }
+
+    ret = bdrv_pread(bs, offset, buf, toread);
+
+    if (ret != toread) {
+        return ret;
+    }
+
+    if (has_key) {
+        ivec.ll[0] = cpu_to_be64(type);
+        ivec.ll[1] = 0;
+
+        AES_cbc_encrypt(buf, buf, toread, &tpm_dec_key, ivec.b, 0);
+    }
+
+    return count;
+}
+
+
+static int tpm_builtin_bdrv_pwrite(BlockDriverState *bs, int64_t offset,
+                                   void *buf, int count,
+                                   enum BSEntryType type)
+{
+    int ret;
+    union {
+        uint64_t ll[2];
+        uint8_t b[16];
+    } ivec;
+    int towrite = count;
+    void *out_buf = buf;
+
+    if (has_key) {
+        ivec.ll[0] = cpu_to_be64(type);
+        ivec.ll[1] = 0;
+
+        towrite = ALIGN(count, AES_BLOCK_SIZE);
+
+        if (towrite != count) {
+            out_buf = qemu_malloc(towrite);
+
+            if (out_buf == NULL) {
+                return -ENOMEM;
+            }
+        }
+
+        AES_cbc_encrypt(buf, out_buf, towrite, &tpm_enc_key, ivec.b, 1);
+    }
+
+    ret = bdrv_pwrite(bs, offset, out_buf, towrite);
+
+    if (out_buf != buf) {
+        qemu_free(out_buf);
+    }
+
+    if (ret == towrite) {
+        return count;
+    }
+
+    return ret;
+}
+
+
 static int tpm_builtin_load_sized_data_from_bs(BlockDriverState *bs,
                                                enum BSEntryType be,
                                                TPMSizedBuffer *tsb)
@@ -596,7 +732,7 @@ static int tpm_builtin_load_sized_data_f
         goto err_exit;
     }
 
-    tsb->buffer = qemu_malloc(entry.blobsize);
+    tsb->buffer = qemu_malloc(ALIGN(entry.blobsize, AES_BLOCK_SIZE));
     if (!tsb->buffer) {
         rc = -ENOMEM;
         goto err_exit;
@@ -604,7 +740,8 @@ static int tpm_builtin_load_sized_data_f
 
     tsb->size = entry.blobsize;
 
-    if (bdrv_pread(bs, entry.offset, tsb->buffer, tsb->size) != tsb->size) {
+    if (tpm_builtin_bdrv_pread(bs, entry.offset, tsb->buffer, tsb->size, be) !=
+        tsb->size) {
         clear_sized_buffer(tsb);
         fprintf(stderr,"tpm: Error while reading sized data!\n");
         rc = -EIO;
@@ -668,7 +805,8 @@ static int tpm_builtin_save_sized_data_t
     }
 
     if (data_len > 0) {
-        if (bdrv_pwrite(bs, entry.offset, data, data_len) != data_len) {
+        if (tpm_builtin_bdrv_pwrite(bs, entry.offset, data, data_len, be) !=
+            data_len) {
             rc = -EIO;
         }
     }
@@ -1578,11 +1716,61 @@ static const char *tpm_builtin_create_de
 }
 
 
+static bool tpm_builtin_parse_as_hexkey(const char *rawkey,
+                                        unsigned char keyvalue[32],
+                                        int *keysize)
+{
+    unsigned int c;
+    unsigned char nib = 0;
+
+    /* skip over leading '0x' */
+    if (!strncmp(rawkey, "0x", 2)) {
+        rawkey += 2;
+    }
+
+    while (c < 64) {
+        if (rawkey[c] == 0) {
+            break;
+        }
+
+        if (rawkey[c] >= '0' && rawkey[c] <= '9') {
+            nib |= rawkey[c] - '0';
+        } else if (rawkey[c] >= 'A' && rawkey[c] <= 'F') {
+            nib |= rawkey[c] - 'A' + 10;
+        } else if (rawkey[c] >= 'a' && rawkey[c] <= 'f') {
+            nib |= rawkey[c] - 'a' + 10;
+        } else {
+            break;
+        }
+
+        keyvalue[c/2] = nib;
+
+        nib <<= 4;
+
+        c++;
+    }
+
+    if (c == 256/4) {
+        *keysize = 256;
+    } else if (c >= 192/4) {
+        *keysize = 192;
+    } else if (c >= 128/4) {
+        *keysize = 128;
+    } else {
+        return false;
+    }
+
+    return true;
+}
+
+
 static TPMBackend *tpm_builtin_create(QemuOpts *opts, const char *id,
                                       const char *model)
 {
     TPMBackend *driver;
     const char *value;
+    int keysize;
+    unsigned char keyvalue[256/8];
 
     driver = qemu_malloc(sizeof(TPMBackend));
     if (!driver) {
@@ -1608,6 +1796,23 @@ static TPMBackend *tpm_builtin_create(Qe
         goto err_exit;
     }
 
+    value = qemu_opt_get(opts, "key");
+    if (value) {
+        has_key = true;
+        memset(keyvalue, 0x0, sizeof(keyvalue));
+
+        if (!tpm_builtin_parse_as_hexkey(value, keyvalue, &keysize)) {
+            keysize = 128;
+            strncpy((char *)keyvalue, value, 128/8);
+        }
+
+        if (AES_set_encrypt_key(keyvalue, keysize, &tpm_enc_key) != 0 ||
+            AES_set_decrypt_key(keyvalue, keysize, &tpm_dec_key) != 0 ) {
+            fprintf(stderr, "tpm: Error setting AES key.\n");
+            goto err_exit;
+        }
+    }
+
     return driver;
 
 err_exit:
Index: qemu-git/qemu-config.c
===================================================================
--- qemu-git.orig/qemu-config.c
+++ qemu-git/qemu-config.c
@@ -478,6 +478,11 @@ static QemuOptsList qemu_tpmdev_opts = {
             .type = QEMU_OPT_STRING,
             .help = "Persistent storage for TPM state",
         },
+        {
+            .name = "key",
+            .type = QEMU_OPT_STRING,
+            .help = "Data encryption key",
+        },
         { /* end of list */ }
     },
 };
@@ -502,6 +507,11 @@ static QemuOptsList qemu_tpm_opts = {
             .type = QEMU_OPT_STRING,
             .help = "Persistent storage for TPM state",
         },
+        {
+            .name = "key",
+            .type = QEMU_OPT_STRING,
+            .help = "Data encryption key",
+        },
         { /* end of list */ }
     },
 };
Index: qemu-git/tpm.c
===================================================================
--- qemu-git.orig/tpm.c
+++ qemu-git/tpm.c
@@ -243,6 +243,7 @@ void tpm_cleanup(void)
 void tpm_config_parse(QemuOptsList *opts_list, const char *optarg)
 {
     QemuOpts *opts;
+    char *key;
 
     if (strcmp("none", optarg) != 0) {
         if (*optarg == '?') {
@@ -253,6 +254,15 @@ void tpm_config_parse(QemuOptsList *opts
         if (!opts) {
             exit(1);
         }
+
+        /* if a key is provided, wipe it out so no one can see it with 'ps' */
+        key = strstr(optarg, "key=");
+        if (key) {
+            key += 4;
+            while (key[0] && key[0] != ',') {
+                *key++ = '-';
+            }
+        }
     }
 }
 
Index: qemu-git/qemu-options.hx
===================================================================
--- qemu-git.orig/qemu-options.hx
+++ qemu-git/qemu-options.hx
@@ -1697,8 +1697,9 @@ DEFHEADING(TPM device options:)
 # ifdef CONFIG_TPM
 DEF("tpm", HAS_ARG, QEMU_OPTION_tpm, \
     "" \
-    "-tpm builtin,path=<path>[,model=<model>]\n" \
+    "-tpm builtin,path=<path>[,model=<model>][,key=<aes key>]\n" \
     "                enable a builtin TPM with state in file in path\n" \
+    "                and encrypt the TPM's state with the given AES key\n" \
     "-tpm model=?    to list available TPM device models\n" \
     "-tpm ?          to list available TPM backend types\n",
     QEMU_ARCH_I386)
@@ -1727,13 +1728,20 @@ Use ? to print all available TPM backend
 qemu -tpmdev ?
 @end example
 
address@hidden -tpmdev builtin ,address@hidden, address@hidden
address@hidden -tpmdev builtin ,address@hidden, address@hidden, address@hidden
 
 Creates an instance of the built-in TPM.
 
 @option{path} specifies the path to the QCoW2 image that will store
 the TPM's persistent data. @option{path} is required.
 
address@hidden specifies the AES key to use to encrypt the TPM's persistent
+data. If encryption is to be used, the key must be provided the first
+time a Qemu VM with attached TPM is started and the same key must subsequently
+be used. The format of the key is a hex number with optional leading @code{0x}
+and 32, 48 or 64 hex digits for 128, 192 or 256 bit AES keys respectively.
address@hidden is optional.
+
 To create a built-in TPM use the following two options:
 @example
 -tpmdev builtin,id=tpm0,path=<path_to_qcow2> -device tpm-tis,tpmdev=tpm0
@@ -1741,12 +1749,18 @@ To create a built-in TPM use the followi
 Not that the @code{-tpmdev} id is @code{tpm0} and is referenced by
 @code{tpmdev=tpm0} in the device option.
 
+
+To create a built-in TPM whose state is encrypted with a 128 bit AES key
+use the following two options:
address@hidden
+-tpmdev 
builtin,id=tpm0,path=<path_to_qcow2>,key=0x1234567890abcdef01234567890abcdef 
-device tpm-tis,tpmdev=tpm0
address@hidden example
 @end table
 
 The short form of a TPM device option is:
 @table @option
 
address@hidden -tpm @var{backend-type}, address@hidden [,address@hidden
address@hidden -tpm @var{backend-type}, address@hidden [,address@hidden 
[,address@hidden
 @findex -tpm
 
 @option{model} specifies the device model. The default device model is a