backends/tpm/tpm_util.c

   1 /*
   2  * TPM utility functions
   3  *
   4  *  Copyright (c) 2010 - 2015 IBM Corporation
   5  *  Authors:
   6  *    Stefan Berger <stefanb@us.ibm.com>
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, see <http://www.gnu.org/licenses/>
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/error-report.h"
  24 #include "qapi/error.h"
  25 #include "qapi/visitor.h"
  26 #include "tpm_int.h"
  27 #include "exec/memory.h"
  28 #include "hw/qdev-properties.h"
  29 #include "sysemu/tpm_backend.h"
  30 #include "sysemu/tpm_util.h"
  31 #include "trace.h"
  32
  33 /* tpm backend property */
  34
  35 static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
  36                     Error **errp)
  37 {
  38     TPMBackend **be = object_field_prop_ptr(obj, opaque);
  39     char *p;
  40
  41     p = g_strdup(*be ? (*be)->id : "");
  42     visit_type_str(v, name, &p, errp);
  43     g_free(p);
  44 }
  45
  46 static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
  47                     Error **errp)
  48 {
  49     Property *prop = opaque;
  50     TPMBackend *s, **be = object_field_prop_ptr(obj, prop);
  51     char *str;
  52
  53     if (!visit_type_str(v, name, &str, errp)) {
  54         return;
  55     }
  56
  57     s = qemu_find_tpm_be(str);
  58     if (s == NULL) {
  59         error_setg(errp, "Property '%s.%s' can't find value '%s'",
  60                    object_get_typename(obj), name, str);
  61     } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) {
  62         *be = s; /* weak reference, avoid cyclic ref */
  63     }
  64     g_free(str);
  65 }
  66
  67 static void release_tpm(Object *obj, const char *name, void *opaque)
  68 {
  69     Property *prop = opaque;
  70     TPMBackend **be = object_field_prop_ptr(obj, prop);
  71
  72     if (*be) {
  73         tpm_backend_reset(*be);
  74     }
  75 }
  76
  77 const PropertyInfo qdev_prop_tpm = {
  78     .name  = "str",
  79     .description = "ID of a tpm to use as a backend",
  80     .get   = get_tpm,
  81     .set   = set_tpm,
  82     .release = release_tpm,
  83 };
  84
  85 /*
  86  * Write an error message in the given output buffer.
  87  */
  88 void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len)
  89 {
  90     if (out_len >= sizeof(struct tpm_resp_hdr)) {
  91         tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND);
  92         tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr));
  93         tpm_cmd_set_error(out, TPM_FAIL);
  94     }
  95 }
  96
  97 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len)
  98 {
  99     if (in_len >= sizeof(struct tpm_req_hdr)) {
 100         return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest;
 101     }
 102
 103     return false;
 104 }
 105
 106 /*
 107  * Send request to a TPM device. We expect a response within one second.
 108  */
 109 static int tpm_util_request(int fd,
 110                             const void *request,
 111                             size_t requestlen,
 112                             void *response,
 113                             size_t responselen)
 114 {
 115     fd_set readfds;
 116     int n;
 117     struct timeval tv = {
 118         .tv_sec = 1,
 119         .tv_usec = 0,
 120     };
 121
 122     n = write(fd, request, requestlen);
 123     if (n < 0) {
 124         return -errno;
 125     }
 126     if (n != requestlen) {
 127         return -EFAULT;
 128     }
 129
 130     FD_ZERO(&readfds);
 131     FD_SET(fd, &readfds);
 132
 133     /* wait for a second */
 134     n = select(fd + 1, &readfds, NULL, NULL, &tv);
 135     if (n != 1) {
 136         return -errno;
 137     }
 138
 139     n = read(fd, response, responselen);
 140     if (n < sizeof(struct tpm_resp_hdr)) {
 141         return -EFAULT;
 142     }
 143
 144     /* check the header */
 145     if (tpm_cmd_get_size(response) != n) {
 146         return -EMSGSIZE;
 147     }
 148
 149     return 0;
 150 }
 151
 152 /*
 153  * A basic test of a TPM device. We expect a well formatted response header
 154  * (error response is fine).
 155  */
 156 static int tpm_util_test(int fd,
 157                          const void *request,
 158                          size_t requestlen,
 159                          uint16_t *return_tag)
 160 {
 161     char buf[1024];
 162     ssize_t ret;
 163
 164     ret = tpm_util_request(fd, request, requestlen,
 165                            buf, sizeof(buf));
 166     if (ret < 0) {
 167         return ret;
 168     }
 169
 170     *return_tag = tpm_cmd_get_tag(buf);
 171
 172     return 0;
 173 }
 174
 175 /*
 176  * Probe for the TPM device in the back
 177  * Returns 0 on success with the version of the probed TPM set, 1 on failure.
 178  */
 179 int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version)
 180 {
 181     /*
 182      * Sending a TPM1.2 command to a TPM2 should return a TPM1.2
 183      * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e)
 184      *
 185      * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the
 186      * header.
 187      * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag
 188      * in the header and an error code.
 189      */
 190     const struct tpm_req_hdr test_req = {
 191         .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
 192         .len = cpu_to_be32(sizeof(test_req)),
 193         .ordinal = cpu_to_be32(TPM_ORD_GetTicks),
 194     };
 195
 196     const struct tpm_req_hdr test_req_tpm2 = {
 197         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 198         .len = cpu_to_be32(sizeof(test_req_tpm2)),
 199         .ordinal = cpu_to_be32(TPM2_CC_ReadClock),
 200     };
 201     uint16_t return_tag;
 202     int ret;
 203
 204     /* Send TPM 2 command */
 205     ret = tpm_util_test(tpm_fd, &test_req_tpm2,
 206                         sizeof(test_req_tpm2), &return_tag);
 207     /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */
 208     if (!ret && return_tag == TPM2_ST_NO_SESSIONS) {
 209         *tpm_version = TPM_VERSION_2_0;
 210         return 0;
 211     }
 212
 213     /* Send TPM 1.2 command */
 214     ret = tpm_util_test(tpm_fd, &test_req,
 215                         sizeof(test_req), &return_tag);
 216     if (!ret && return_tag == TPM_TAG_RSP_COMMAND) {
 217         *tpm_version = TPM_VERSION_1_2;
 218         /* this is a TPM 1.2 */
 219         return 0;
 220     }
 221
 222     *tpm_version = TPM_VERSION_UNSPEC;
 223
 224     return 1;
 225 }
 226
 227 int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version,
 228                              size_t *buffersize)
 229 {
 230     int ret;
 231
 232     switch (tpm_version) {
 233     case TPM_VERSION_1_2: {
 234         const struct tpm_req_get_buffer_size {
 235             struct tpm_req_hdr hdr;
 236             uint32_t capability;
 237             uint32_t len;
 238             uint32_t subcap;
 239         } QEMU_PACKED tpm_get_buffer_size = {
 240             .hdr = {
 241                 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
 242                 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)),
 243                 .ordinal = cpu_to_be32(TPM_ORD_GetCapability),
 244             },
 245             .capability = cpu_to_be32(TPM_CAP_PROPERTY),
 246             .len = cpu_to_be32(sizeof(uint32_t)),
 247             .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER),
 248         };
 249         struct tpm_resp_get_buffer_size {
 250             struct tpm_resp_hdr hdr;
 251             uint32_t len;
 252             uint32_t buffersize;
 253         } QEMU_PACKED tpm_resp;
 254
 255         ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size,
 256                                sizeof(tpm_get_buffer_size),
 257                                &tpm_resp, sizeof(tpm_resp));
 258         if (ret < 0) {
 259             return ret;
 260         }
 261
 262         if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) ||
 263             be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) {
 264             trace_tpm_util_get_buffer_size_hdr_len(
 265                 be32_to_cpu(tpm_resp.hdr.len),
 266                 sizeof(tpm_resp));
 267             trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len),
 268                                                sizeof(uint32_t));
 269             error_report("tpm_util: Got unexpected response to "
 270                          "TPM_GetCapability; errcode: 0x%x",
 271                          be32_to_cpu(tpm_resp.hdr.errcode));
 272             return -EFAULT;
 273         }
 274         *buffersize = be32_to_cpu(tpm_resp.buffersize);
 275         break;
 276     }
 277     case TPM_VERSION_2_0: {
 278         const struct tpm2_req_get_buffer_size {
 279             struct tpm_req_hdr hdr;
 280             uint32_t capability;
 281             uint32_t property;
 282             uint32_t count;
 283         } QEMU_PACKED tpm2_get_buffer_size = {
 284             .hdr = {
 285                 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
 286                 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)),
 287                 .ordinal = cpu_to_be32(TPM2_CC_GetCapability),
 288             },
 289             .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES),
 290             .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE),
 291             .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */
 292         };
 293         struct tpm2_resp_get_buffer_size {
 294             struct tpm_resp_hdr hdr;
 295             uint8_t more;
 296             uint32_t capability;
 297             uint32_t count;
 298             uint32_t property1;
 299             uint32_t value1;
 300             uint32_t property2;
 301             uint32_t value2;
 302         } QEMU_PACKED tpm2_resp;
 303
 304         ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size,
 305                                sizeof(tpm2_get_buffer_size),
 306                                &tpm2_resp, sizeof(tpm2_resp));
 307         if (ret < 0) {
 308             return ret;
 309         }
 310
 311         if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) ||
 312             be32_to_cpu(tpm2_resp.count) != 2) {
 313             trace_tpm_util_get_buffer_size_hdr_len2(
 314                 be32_to_cpu(tpm2_resp.hdr.len),
 315                 sizeof(tpm2_resp));
 316             trace_tpm_util_get_buffer_size_len2(
 317                 be32_to_cpu(tpm2_resp.count), 2);
 318             error_report("tpm_util: Got unexpected response to "
 319                          "TPM2_GetCapability; errcode: 0x%x",
 320                          be32_to_cpu(tpm2_resp.hdr.errcode));
 321             return -EFAULT;
 322         }
 323         *buffersize = MAX(be32_to_cpu(tpm2_resp.value1),
 324                           be32_to_cpu(tpm2_resp.value2));
 325         break;
 326     }
 327     case TPM_VERSION_UNSPEC:
 328         return -EFAULT;
 329     }
 330
 331     trace_tpm_util_get_buffer_size(*buffersize);
 332
 333     return 0;
 334 }
 335
 336 void tpm_sized_buffer_reset(TPMSizedBuffer *tsb)
 337 {
 338     g_free(tsb->buffer);
 339     tsb->buffer = NULL;
 340     tsb->size = 0;
 341 }
 342
 343 void tpm_util_show_buffer(const unsigned char *buffer,
 344                           size_t buffer_size, const char *string)
 345 {
 346     size_t len, i;
 347     char *line_buffer, *p;
 348
 349     if (!trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) {
 350         return;
 351     }
 352     len = MIN(tpm_cmd_get_size(buffer), buffer_size);
 353
 354     /*
 355      * allocate enough room for 3 chars per buffer entry plus a
 356      * newline after every 16 chars and a final null terminator.
 357      */
 358     line_buffer = g_malloc(len * 3 + (len / 16) + 1);
 359
 360     for (i = 0, p = line_buffer; i < len; i++) {
 361         if (i && !(i % 16)) {
 362             p += sprintf(p, "\n");
 363         }
 364         p += sprintf(p, "%.2X ", buffer[i]);
 365     }
 366     trace_tpm_util_show_buffer(string, len, line_buffer);
 367
 368     g_free(line_buffer);
 369 }