tpm/tpm_passthrough.c

   1 /*
   2  *  passthrough TPM driver
   3  *
   4  *  Copyright (c) 2010 - 2013 IBM Corporation
   5  *  Authors:
   6  *    Stefan Berger <stefanb@us.ibm.com>
   7  *
   8  *  Copyright (C) 2011 IAIK, Graz University of Technology
   9  *    Author: Andreas Niederl
  10  *
  11  * This library is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU Lesser General Public
  13  * License as published by the Free Software Foundation; either
  14  * version 2 of the License, or (at your option) any later version.
  15  *
  16  * This library is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * Lesser General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU Lesser General Public
  22  * License along with this library; if not, see <http://www.gnu.org/licenses/>
  23  */
  24
  25 #include <dirent.h>
  26
  27 #include "qemu-common.h"
  28 #include "qapi/error.h"
  29 #include "qemu/sockets.h"
  30 #include "tpm_int.h"
  31 #include "hw/hw.h"
  32 #include "hw/pc.h"
  33 #include "tpm_tis.h"
  34 #include "tpm_backend.h"
  35
  36 /* #define DEBUG_TPM */
  37
  38 #ifdef DEBUG_TPM
  39 #define DPRINTF(fmt, ...) \
  40     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
  41 #else
  42 #define DPRINTF(fmt, ...) \
  43     do { } while (0)
  44 #endif
  45
  46 /* data structures */
  47
  48 typedef struct TPMPassthruThreadParams {
  49     TPMState *tpm_state;
  50
  51     TPMRecvDataCB *recv_data_callback;
  52     TPMBackend *tb;
  53 } TPMPassthruThreadParams;
  54
  55 struct TPMPassthruState {
  56     TPMBackendThread tbt;
  57
  58     TPMPassthruThreadParams tpm_thread_params;
  59
  60     char *tpm_dev;
  61     int tpm_fd;
  62     bool tpm_executing;
  63     bool tpm_op_canceled;
  64     int cancel_fd;
  65     bool had_startup_error;
  66 };
  67
  68 #define TPM_PASSTHROUGH_DEFAULT_DEVICE "/dev/tpm0"
  69
  70 /* functions */
  71
  72 static void tpm_passthrough_cancel_cmd(TPMBackend *tb);
  73
  74 static int tpm_passthrough_unix_write(int fd, const uint8_t *buf, uint32_t len)
  75 {
  76     return send_all(fd, buf, len);
  77 }
  78
  79 static int tpm_passthrough_unix_read(int fd, uint8_t *buf, uint32_t len)
  80 {
  81     return recv_all(fd, buf, len, true);
  82 }
  83
  84 static uint32_t tpm_passthrough_get_size_from_buffer(const uint8_t *buf)
  85 {
  86     struct tpm_resp_hdr *resp = (struct tpm_resp_hdr *)buf;
  87
  88     return be32_to_cpu(resp->len);
  89 }
  90
  91 static int tpm_passthrough_unix_tx_bufs(TPMPassthruState *tpm_pt,
  92                                         const uint8_t *in, uint32_t in_len,
  93                                         uint8_t *out, uint32_t out_len)
  94 {
  95     int ret;
  96
  97     tpm_pt->tpm_op_canceled = false;
  98     tpm_pt->tpm_executing = true;
  99
 100     ret = tpm_passthrough_unix_write(tpm_pt->tpm_fd, in, in_len);
 101     if (ret != in_len) {
 102         if (!tpm_pt->tpm_op_canceled ||
 103             (tpm_pt->tpm_op_canceled && errno != ECANCELED)) {
 104             error_report("tpm_passthrough: error while transmitting data "
 105                          "to TPM: %s (%i)\n",
 106                          strerror(errno), errno);
 107         }
 108         goto err_exit;
 109     }
 110
 111     tpm_pt->tpm_executing = false;
 112
 113     ret = tpm_passthrough_unix_read(tpm_pt->tpm_fd, out, out_len);
 114     if (ret < 0) {
 115         if (!tpm_pt->tpm_op_canceled ||
 116             (tpm_pt->tpm_op_canceled && errno != ECANCELED)) {
 117             error_report("tpm_passthrough: error while reading data from "
 118                          "TPM: %s (%i)\n",
 119                          strerror(errno), errno);
 120         }
 121     } else if (ret < sizeof(struct tpm_resp_hdr) ||
 122                tpm_passthrough_get_size_from_buffer(out) != ret) {
 123         ret = -1;
 124         error_report("tpm_passthrough: received invalid response "
 125                      "packet from TPM\n");
 126     }
 127
 128 err_exit:
 129     if (ret < 0) {
 130         tpm_write_fatal_error_response(out, out_len);
 131     }
 132
 133     tpm_pt->tpm_executing = false;
 134
 135     return ret;
 136 }
 137
 138 static int tpm_passthrough_unix_transfer(TPMPassthruState *tpm_pt,
 139                                          const TPMLocality *locty_data)
 140 {
 141     return tpm_passthrough_unix_tx_bufs(tpm_pt,
 142                                         locty_data->w_buffer.buffer,
 143                                         locty_data->w_offset,
 144                                         locty_data->r_buffer.buffer,
 145                                         locty_data->r_buffer.size);
 146 }
 147
 148 static void tpm_passthrough_worker_thread(gpointer data,
 149                                           gpointer user_data)
 150 {
 151     TPMPassthruThreadParams *thr_parms = user_data;
 152     TPMPassthruState *tpm_pt = thr_parms->tb->s.tpm_pt;
 153     TPMBackendCmd cmd = (TPMBackendCmd)data;
 154
 155     DPRINTF("tpm_passthrough: processing command type %d\n", cmd);
 156
 157     switch (cmd) {
 158     case TPM_BACKEND_CMD_PROCESS_CMD:
 159         tpm_passthrough_unix_transfer(tpm_pt,
 160                                       thr_parms->tpm_state->locty_data);
 161
 162         thr_parms->recv_data_callback(thr_parms->tpm_state,
 163                                       thr_parms->tpm_state->locty_number);
 164         break;
 165     case TPM_BACKEND_CMD_INIT:
 166     case TPM_BACKEND_CMD_END:
 167     case TPM_BACKEND_CMD_TPM_RESET:
 168         /* nothing to do */
 169         break;
 170     }
 171 }
 172
 173 /*
 174  * Start the TPM (thread). If it had been started before, then terminate
 175  * and start it again.
 176  */
 177 static int tpm_passthrough_startup_tpm(TPMBackend *tb)
 178 {
 179     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 180
 181     /* terminate a running TPM */
 182     tpm_backend_thread_end(&tpm_pt->tbt);
 183
 184     tpm_backend_thread_create(&tpm_pt->tbt,
 185                               tpm_passthrough_worker_thread,
 186                               &tb->s.tpm_pt->tpm_thread_params);
 187
 188     return 0;
 189 }
 190
 191 static void tpm_passthrough_reset(TPMBackend *tb)
 192 {
 193     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 194
 195     DPRINTF("tpm_passthrough: CALL TO TPM_RESET!\n");
 196
 197     tpm_passthrough_cancel_cmd(tb);
 198
 199     tpm_backend_thread_end(&tpm_pt->tbt);
 200
 201     tpm_pt->had_startup_error = false;
 202 }
 203
 204 static int tpm_passthrough_init(TPMBackend *tb, TPMState *s,
 205                                 TPMRecvDataCB *recv_data_cb)
 206 {
 207     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 208
 209     tpm_pt->tpm_thread_params.tpm_state = s;
 210     tpm_pt->tpm_thread_params.recv_data_callback = recv_data_cb;
 211     tpm_pt->tpm_thread_params.tb = tb;
 212
 213     return 0;
 214 }
 215
 216 static bool tpm_passthrough_get_tpm_established_flag(TPMBackend *tb)
 217 {
 218     return false;
 219 }
 220
 221 static bool tpm_passthrough_get_startup_error(TPMBackend *tb)
 222 {
 223     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 224
 225     return tpm_pt->had_startup_error;
 226 }
 227
 228 static size_t tpm_passthrough_realloc_buffer(TPMSizedBuffer *sb)
 229 {
 230     size_t wanted_size = 4096; /* Linux tpm.c buffer size */
 231
 232     if (sb->size != wanted_size) {
 233         sb->buffer = g_realloc(sb->buffer, wanted_size);
 234         sb->size = wanted_size;
 235     }
 236     return sb->size;
 237 }
 238
 239 static void tpm_passthrough_deliver_request(TPMBackend *tb)
 240 {
 241     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 242
 243     tpm_backend_thread_deliver_request(&tpm_pt->tbt);
 244 }
 245
 246 static void tpm_passthrough_cancel_cmd(TPMBackend *tb)
 247 {
 248     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 249     int n;
 250
 251     /*
 252      * As of Linux 3.7 the tpm_tis driver does not properly cancel
 253      * commands on all TPM manufacturers' TPMs.
 254      * Only cancel if we're busy so we don't cancel someone else's
 255      * command, e.g., a command executed on the host.
 256      */
 257     if (tpm_pt->tpm_executing) {
 258         if (tpm_pt->cancel_fd >= 0) {
 259             n = write(tpm_pt->cancel_fd, "-", 1);
 260             if (n != 1) {
 261                 error_report("Canceling TPM command failed: %s\n",
 262                              strerror(errno));
 263             } else {
 264                 tpm_pt->tpm_op_canceled = true;
 265             }
 266         } else {
 267             error_report("Cannot cancel TPM command due to missing "
 268                          "TPM sysfs cancel entry");
 269         }
 270     }
 271 }
 272
 273 static const char *tpm_passthrough_create_desc(void)
 274 {
 275     return "Passthrough TPM backend driver";
 276 }
 277
 278 /*
 279  * A basic test of a TPM device. We expect a well formatted response header
 280  * (error response is fine) within one second.
 281  */
 282 static int tpm_passthrough_test_tpmdev(int fd)
 283 {
 284     struct tpm_req_hdr req = {
 285         .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
 286         .len = cpu_to_be32(sizeof(req)),
 287         .ordinal = cpu_to_be32(TPM_ORD_GetTicks),
 288     };
 289     struct tpm_resp_hdr *resp;
 290     fd_set readfds;
 291     int n;
 292     struct timeval tv = {
 293         .tv_sec = 1,
 294         .tv_usec = 0,
 295     };
 296     unsigned char buf[1024];
 297
 298     n = write(fd, &req, sizeof(req));
 299     if (n < 0) {
 300         return errno;
 301     }
 302     if (n != sizeof(req)) {
 303         return EFAULT;
 304     }
 305
 306     FD_ZERO(&readfds);
 307     FD_SET(fd, &readfds);
 308
 309     /* wait for a second */
 310     n = select(fd + 1, &readfds, NULL, NULL, &tv);
 311     if (n != 1) {
 312         return errno;
 313     }
 314
 315     n = read(fd, &buf, sizeof(buf));
 316     if (n < sizeof(struct tpm_resp_hdr)) {
 317         return EFAULT;
 318     }
 319
 320     resp = (struct tpm_resp_hdr *)buf;
 321     /* check the header */
 322     if (be16_to_cpu(resp->tag) != TPM_TAG_RSP_COMMAND ||
 323         be32_to_cpu(resp->len) != n) {
 324         return EBADMSG;
 325     }
 326
 327     return 0;
 328 }
 329
 330 /*
 331  * Check whether the given base path, e.g.,  /sys/class/misc/tpm0/device,
 332  * is the sysfs directory of a TPM. A TPM sysfs directory should be uniquely
 333  * recognizable by the file entries 'pcrs' and 'cancel'.
 334  * Upon success 'true' is returned and the basebath buffer has '/cancel'
 335  * appended.
 336  */
 337 static bool tpm_passthrough_check_sysfs_cancel(char *basepath, size_t bufsz)
 338 {
 339     char path[PATH_MAX];
 340     struct stat statbuf;
 341
 342     snprintf(path, sizeof(path), "%s/pcrs", basepath);
 343     if (stat(path, &statbuf) == -1 || !S_ISREG(statbuf.st_mode)) {
 344         return false;
 345     }
 346
 347     snprintf(path, sizeof(path), "%s/cancel", basepath);
 348     if (stat(path, &statbuf) == -1 || !S_ISREG(statbuf.st_mode)) {
 349         return false;
 350     }
 351
 352     strncpy(basepath, path, bufsz);
 353
 354     return true;
 355 }
 356
 357 /*
 358  * Unless path or file descriptor set has been provided by user,
 359  * determine the sysfs cancel file following kernel documentation
 360  * in Documentation/ABI/stable/sysfs-class-tpm.
 361  */
 362 static int tpm_passthrough_open_sysfs_cancel(TPMBackend *tb)
 363 {
 364     int fd = -1;
 365     unsigned int idx;
 366     DIR *pnp_dir;
 367     char path[PATH_MAX];
 368     struct dirent entry, *result;
 369     int len;
 370
 371     if (tb->cancel_path) {
 372         fd = qemu_open(tb->cancel_path, O_WRONLY);
 373         if (fd < 0) {
 374             error_report("Could not open TPM cancel path : %s",
 375                          strerror(errno));
 376         }
 377         return fd;
 378     }
 379
 380     snprintf(path, sizeof(path), "/sys/class/misc");
 381     pnp_dir = opendir(path);
 382     if (pnp_dir != NULL) {
 383         while (readdir_r(pnp_dir, &entry, &result) == 0 &&
 384                result != NULL) {
 385             /*
 386              * only allow /sys/class/misc/tpm%u type of paths
 387              */
 388             if (sscanf(entry.d_name, "tpm%u%n", &idx, &len) < 1 ||
 389                 len <= strlen("tpm") ||
 390                 len != strlen(entry.d_name)) {
 391                 continue;
 392             }
 393
 394             snprintf(path, sizeof(path), "/sys/class/misc/%s/device",
 395                      entry.d_name);
 396             if (!tpm_passthrough_check_sysfs_cancel(path, sizeof(path))) {
 397                 continue;
 398             }
 399
 400             fd = qemu_open(path, O_WRONLY);
 401             break;
 402         }
 403         closedir(pnp_dir);
 404     }
 405
 406     if (fd >= 0) {
 407         tb->cancel_path = g_strdup(path);
 408     }
 409
 410     return fd;
 411 }
 412
 413 static int tpm_passthrough_handle_device_opts(QemuOpts *opts, TPMBackend *tb)
 414 {
 415     const char *value;
 416
 417     value = qemu_opt_get(opts, "cancel-path");
 418     if (value) {
 419         tb->cancel_path = g_strdup(value);
 420     }
 421
 422     value = qemu_opt_get(opts, "path");
 423     if (!value) {
 424         value = TPM_PASSTHROUGH_DEFAULT_DEVICE;
 425     }
 426
 427     tb->s.tpm_pt->tpm_dev = g_strdup(value);
 428
 429     tb->path = g_strdup(tb->s.tpm_pt->tpm_dev);
 430
 431     tb->s.tpm_pt->tpm_fd = qemu_open(tb->s.tpm_pt->tpm_dev, O_RDWR);
 432     if (tb->s.tpm_pt->tpm_fd < 0) {
 433         error_report("Cannot access TPM device using '%s': %s\n",
 434                      tb->s.tpm_pt->tpm_dev, strerror(errno));
 435         goto err_free_parameters;
 436     }
 437
 438     if (tpm_passthrough_test_tpmdev(tb->s.tpm_pt->tpm_fd)) {
 439         error_report("'%s' is not a TPM device.\n",
 440                      tb->s.tpm_pt->tpm_dev);
 441         goto err_close_tpmdev;
 442     }
 443
 444     return 0;
 445
 446  err_close_tpmdev:
 447     qemu_close(tb->s.tpm_pt->tpm_fd);
 448     tb->s.tpm_pt->tpm_fd = -1;
 449
 450  err_free_parameters:
 451     g_free(tb->path);
 452     tb->path = NULL;
 453
 454     g_free(tb->s.tpm_pt->tpm_dev);
 455     tb->s.tpm_pt->tpm_dev = NULL;
 456
 457     return 1;
 458 }
 459
 460 static TPMBackend *tpm_passthrough_create(QemuOpts *opts, const char *id)
 461 {
 462     TPMBackend *tb;
 463
 464     tb = g_new0(TPMBackend, 1);
 465     tb->s.tpm_pt = g_new0(TPMPassthruState, 1);
 466     tb->id = g_strdup(id);
 467     /* let frontend set the fe_model to proper value */
 468     tb->fe_model = -1;
 469
 470     tb->ops = &tpm_passthrough_driver;
 471
 472     if (tpm_passthrough_handle_device_opts(opts, tb)) {
 473         goto err_exit;
 474     }
 475
 476     tb->s.tpm_pt->cancel_fd = tpm_passthrough_open_sysfs_cancel(tb);
 477     if (tb->s.tpm_pt->cancel_fd < 0) {
 478         goto err_exit;
 479     }
 480
 481     return tb;
 482
 483 err_exit:
 484     g_free(tb->id);
 485     g_free(tb->s.tpm_pt);
 486     g_free(tb);
 487
 488     return NULL;
 489 }
 490
 491 static void tpm_passthrough_destroy(TPMBackend *tb)
 492 {
 493     TPMPassthruState *tpm_pt = tb->s.tpm_pt;
 494
 495     tpm_passthrough_cancel_cmd(tb);
 496
 497     tpm_backend_thread_end(&tpm_pt->tbt);
 498
 499     qemu_close(tpm_pt->tpm_fd);
 500     qemu_close(tb->s.tpm_pt->cancel_fd);
 501
 502     g_free(tb->id);
 503     g_free(tb->path);
 504     g_free(tb->cancel_path);
 505     g_free(tb->s.tpm_pt->tpm_dev);
 506     g_free(tb->s.tpm_pt);
 507     g_free(tb);
 508 }
 509
 510 const TPMDriverOps tpm_passthrough_driver = {
 511     .type                     = TPM_TYPE_PASSTHROUGH,
 512     .desc                     = tpm_passthrough_create_desc,
 513     .create                   = tpm_passthrough_create,
 514     .destroy                  = tpm_passthrough_destroy,
 515     .init                     = tpm_passthrough_init,
 516     .startup_tpm              = tpm_passthrough_startup_tpm,
 517     .realloc_buffer           = tpm_passthrough_realloc_buffer,
 518     .reset                    = tpm_passthrough_reset,
 519     .had_startup_error        = tpm_passthrough_get_startup_error,
 520     .deliver_request          = tpm_passthrough_deliver_request,
 521     .cancel_cmd               = tpm_passthrough_cancel_cmd,
 522     .get_tpm_established_flag = tpm_passthrough_get_tpm_established_flag,
 523 };
 524
 525 static void tpm_passthrough_register(void)
 526 {
 527     tpm_register_driver(&tpm_passthrough_driver);
 528 }
 529
 530 type_init(tpm_passthrough_register)