backends/tpm/tpm_util.c

   1 /*
   2  * TPM utility functions
   3  *
   4  *  Copyright (c) 2010 - 2015 IBM Corporation
   5  *  Authors:
   6  *    Stefan Berger <stefanb@us.ibm.com>
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, see <http://www.gnu.org/licenses/>
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/error-report.h"
  24 #include "qapi/error.h"
  25 #include "qapi/visitor.h"
  26 #include "tpm_int.h"
  27 #include "exec/memory.h"
  28 #include "hw/qdev-properties.h"
  29 #include "sysemu/tpm_backend.h"
  30 #include "sysemu/tpm_util.h"
  31 #include "trace.h"
  32
  33 /* tpm backend property */
  34
  35 static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
  36                     Error **errp)
  37 {
  38     DeviceState *dev = DEVICE(obj);
  39     TPMBackend **be = qdev_get_prop_ptr(dev, opaque);
  40     char *p;
  41
  42     p = g_strdup(*be ? (*be)->id : "");
  43     visit_type_str(v, name, &p, errp);
  44     g_free(p);
  45 }
  46
  47 static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
  48                     Error **errp)
  49 {
  50     DeviceState *dev = DEVICE(obj);
  51     Property *prop = opaque;
  52     TPMBackend *s, **be = qdev_get_prop_ptr(dev, prop);
  53     char *str;
  54
  55     if (dev->realized) {
  56         qdev_prop_set_after_realize(dev, name, errp);
  57         return;
  58     }
  59
  60     if (!visit_type_str(v, name, &str, errp)) {
  61         return;
  62     }
  63
  64     s = qemu_find_tpm_be(str);
  65     if (s == NULL) {
  66         error_setg(errp, "Property '%s.%s' can't find value '%s'",
  67                    object_get_typename(obj), prop->name, str);
  68     } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) {
  69         *be = s; /* weak reference, avoid cyclic ref */
  70     }
  71     g_free(str);
  72 }
  73
  74 static void release_tpm(Object *obj, const char *name, void *opaque)
  75 {
  76     DeviceState *dev = DEVICE(obj);
  77     Property *prop = opaque;
  78     TPMBackend **be = qdev_get_prop_ptr(dev, prop);
  79
  80     if (*be) {
  81         tpm_backend_reset(*be);
  82     }
  83 }
  84
  85 const PropertyInfo qdev_prop_tpm = {
  86     .name  = "str",
  87     .description = "ID of a tpm to use as a backend",
  88     .get   = get_tpm,
  89     .set   = set_tpm,
  90     .release = release_tpm,
  91 };
  92
  93 /*
  94  * Write an error message in the given output buffer.
  95  */
  96 void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len)
  97 {
  98     if (out_len >= sizeof(struct tpm_resp_hdr)) {
  99         tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND);
 100         tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr));
 101         tpm_cmd_set_error(out, TPM_FAIL);
 102     }
 103 }
 104
 105 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len)
 106 {
 107     if (in_len >= sizeof(struct tpm_req_hdr)) {
 108         return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest;
 109     }
 110
 111     return false;
 112 }
 113
 114 /*
 115  * Send request to a TPM device. We expect a response within one second.
 116  */
 117 static int tpm_util_request(int fd,
 118                             const void *request,
 119                             size_t requestlen,
 120                             void *response,
 121                             size_t responselen)
 122 {
 123     fd_set readfds;
 124     int n;
 125     struct timeval tv = {
 126         .tv_sec = 1,
 127         .tv_usec = 0,
 128     };
 129
 130     n = write(fd, request, requestlen);
 131     if (n < 0) {
 132         return -errno;
 133     }
 134     if (n != requestlen) {
 135         return -EFAULT;
 136     }
 137
 138     FD_ZERO(&readfds);
 139     FD_SET(fd, &readfds);
 140
 141     /* wait for a second */
 142     n = select(fd + 1, &readfds, NULL, NULL, &tv);
 143     if (n != 1) {
 144         return -errno;
 145     }
 146
 147     n = read(fd, response, responselen);
 148     if (n < sizeof(struct tpm_resp_hdr)) {
 149         return -EFAULT;
 150     }
 151
 152     /* check the header */
 153     if (tpm_cmd_get_size(response) != n) {
 154         return -EMSGSIZE;
 155     }
 156
 157     return 0;
 158 }
 159
 160 /*
 161  * A basic test of a TPM device. We expect a well formatted response header
 162  * (error response is fine).
 163  */
 164 static int tpm_util_test(int fd,
 165                          const void *request,
 166                          size_t requestlen,
 167                          uint16_t *return_tag)
 168 {
 169     char buf[1024];
 170     ssize_t ret;
 171
 172     ret = tpm_util_request(fd, request, requestlen,
 173                            buf, sizeof(buf));
 174     if (ret < 0) {
 175         return ret;
 176     }
 177
 178     *return_tag = tpm_cmd_get_tag(buf);
 179
 180     return 0;
 181 }
 182
 183 /*
 184  * Probe for the TPM device in the back
 185  * Returns 0 on success with the version of the probed TPM set, 1 on failure.
 186  */
 187 int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version)
 188 {
 189     /*
 190      * Sending a TPM1.2 command to a TPM2 should return a TPM1.2
 191      * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e)
 192      *
 193      * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the
 194      * header.
 195      * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag
 196      * in the header and an error code.
 197      */
 198     const struct tpm_req_hdr test_req = {
 199         .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
 200         .len = cpu_to_be32(sizeof(test_req)),
 201         .ordinal = cpu_to_be32(TPM_ORD_GetTicks),
 202     };
 203
 204     const struct tpm_req_hdr test_req_tpm2 = {
 205         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 206         .len = cpu_to_be32(sizeof(test_req_tpm2)),
 207         .ordinal = cpu_to_be32(TPM2_CC_ReadClock),
 208     };
 209     uint16_t return_tag;
 210     int ret;
 211
 212     /* Send TPM 2 command */
 213     ret = tpm_util_test(tpm_fd, &test_req_tpm2,
 214                         sizeof(test_req_tpm2), &return_tag);
 215     /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */
 216     if (!ret && return_tag == TPM2_ST_NO_SESSIONS) {
 217         *tpm_version = TPM_VERSION_2_0;
 218         return 0;
 219     }
 220
 221     /* Send TPM 1.2 command */
 222     ret = tpm_util_test(tpm_fd, &test_req,
 223                         sizeof(test_req), &return_tag);
 224     if (!ret && return_tag == TPM_TAG_RSP_COMMAND) {
 225         *tpm_version = TPM_VERSION_1_2;
 226         /* this is a TPM 1.2 */
 227         return 0;
 228     }
 229
 230     *tpm_version = TPM_VERSION_UNSPEC;
 231
 232     return 1;
 233 }
 234
 235 int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version,
 236                              size_t *buffersize)
 237 {
 238     int ret;
 239
 240     switch (tpm_version) {
 241     case TPM_VERSION_1_2: {
 242         const struct tpm_req_get_buffer_size {
 243             struct tpm_req_hdr hdr;
 244             uint32_t capability;
 245             uint32_t len;
 246             uint32_t subcap;
 247         } QEMU_PACKED tpm_get_buffer_size = {
 248             .hdr = {
 249                 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
 250                 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)),
 251                 .ordinal = cpu_to_be32(TPM_ORD_GetCapability),
 252             },
 253             .capability = cpu_to_be32(TPM_CAP_PROPERTY),
 254             .len = cpu_to_be32(sizeof(uint32_t)),
 255             .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER),
 256         };
 257         struct tpm_resp_get_buffer_size {
 258             struct tpm_resp_hdr hdr;
 259             uint32_t len;
 260             uint32_t buffersize;
 261         } QEMU_PACKED tpm_resp;
 262
 263         ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size,
 264                                sizeof(tpm_get_buffer_size),
 265                                &tpm_resp, sizeof(tpm_resp));
 266         if (ret < 0) {
 267             return ret;
 268         }
 269
 270         if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) ||
 271             be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) {
 272             trace_tpm_util_get_buffer_size_hdr_len(
 273                 be32_to_cpu(tpm_resp.hdr.len),
 274                 sizeof(tpm_resp));
 275             trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len),
 276                                                sizeof(uint32_t));
 277             error_report("tpm_util: Got unexpected response to "
 278                          "TPM_GetCapability; errcode: 0x%x",
 279                          be32_to_cpu(tpm_resp.hdr.errcode));
 280             return -EFAULT;
 281         }
 282         *buffersize = be32_to_cpu(tpm_resp.buffersize);
 283         break;
 284     }
 285     case TPM_VERSION_2_0: {
 286         const struct tpm2_req_get_buffer_size {
 287             struct tpm_req_hdr hdr;
 288             uint32_t capability;
 289             uint32_t property;
 290             uint32_t count;
 291         } QEMU_PACKED tpm2_get_buffer_size = {
 292             .hdr = {
 293                 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 294                 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)),
 295                 .ordinal = cpu_to_be32(TPM2_CC_GetCapability),
 296             },
 297             .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES),
 298             .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE),
 299             .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */
 300         };
 301         struct tpm2_resp_get_buffer_size {
 302             struct tpm_resp_hdr hdr;
 303             uint8_t more;
 304             uint32_t capability;
 305             uint32_t count;
 306             uint32_t property1;
 307             uint32_t value1;
 308             uint32_t property2;
 309             uint32_t value2;
 310         } QEMU_PACKED tpm2_resp;
 311
 312         ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size,
 313                                sizeof(tpm2_get_buffer_size),
 314                                &tpm2_resp, sizeof(tpm2_resp));
 315         if (ret < 0) {
 316             return ret;
 317         }
 318
 319         if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) ||
 320             be32_to_cpu(tpm2_resp.count) != 2) {
 321             trace_tpm_util_get_buffer_size_hdr_len2(
 322                 be32_to_cpu(tpm2_resp.hdr.len),
 323                 sizeof(tpm2_resp));
 324             trace_tpm_util_get_buffer_size_len2(
 325                 be32_to_cpu(tpm2_resp.count), 2);
 326             error_report("tpm_util: Got unexpected response to "
 327                          "TPM2_GetCapability; errcode: 0x%x",
 328                          be32_to_cpu(tpm2_resp.hdr.errcode));
 329             return -EFAULT;
 330         }
 331         *buffersize = MAX(be32_to_cpu(tpm2_resp.value1),
 332                           be32_to_cpu(tpm2_resp.value2));
 333         break;
 334     }
 335     case TPM_VERSION_UNSPEC:
 336         return -EFAULT;
 337     }
 338
 339     trace_tpm_util_get_buffer_size(*buffersize);
 340
 341     return 0;
 342 }
 343
 344 void tpm_sized_buffer_reset(TPMSizedBuffer *tsb)
 345 {
 346     g_free(tsb->buffer);
 347     tsb->buffer = NULL;
 348     tsb->size = 0;
 349 }
 350
 351 void tpm_util_show_buffer(const unsigned char *buffer,
 352                           size_t buffer_size, const char *string)
 353 {
 354     size_t len, i;
 355     char *line_buffer, *p;
 356
 357     if (!trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) {
 358         return;
 359     }
 360     len = MIN(tpm_cmd_get_size(buffer), buffer_size);
 361
 362     /*
 363      * allocate enough room for 3 chars per buffer entry plus a
 364      * newline after every 16 chars and a final null terminator.
 365      */
 366     line_buffer = g_malloc(len * 3 + (len / 16) + 1);
 367
 368     for (i = 0, p = line_buffer; i < len; i++) {
 369         if (i && !(i % 16)) {
 370             p += sprintf(p, "\n");
 371         }
 372         p += sprintf(p, "%.2X ", buffer[i]);
 373     }
 374     trace_tpm_util_show_buffer(string, len, line_buffer);
 375
 376     g_free(line_buffer);
 377 }