1 /*
2 * TPM utility functions
3 *
4 * Copyright (c) 2010 - 2015 IBM Corporation
5 * Authors:
6 * Stefan Berger <stefanb@us.ibm.com>
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>
20 */
21
22 #include "qemu/osdep.h"
23 #include "qemu/error-report.h"
24 #include "qapi/error.h"
25 #include "qapi/visitor.h"
26 #include "tpm_int.h"
27 #include "exec/memory.h"
28 #include "hw/qdev-properties.h"
29 #include "sysemu/tpm_backend.h"
30 #include "sysemu/tpm_util.h"
31 #include "trace.h"
32
33 /* tpm backend property */
34
get_tpm(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)35 static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
36 Error **errp)
37 {
38 TPMBackend **be = object_field_prop_ptr(obj, opaque);
39 char *p;
40
41 p = g_strdup(*be ? (*be)->id : "");
42 visit_type_str(v, name, &p, errp);
43 g_free(p);
44 }
45
set_tpm(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)46 static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
47 Error **errp)
48 {
49 Property *prop = opaque;
50 TPMBackend *s, **be = object_field_prop_ptr(obj, prop);
51 char *str;
52
53 if (!visit_type_str(v, name, &str, errp)) {
54 return;
55 }
56
57 s = qemu_find_tpm_be(str);
58 if (s == NULL) {
59 error_setg(errp, "Property '%s.%s' can't find value '%s'",
60 object_get_typename(obj), name, str);
61 } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) {
62 *be = s; /* weak reference, avoid cyclic ref */
63 }
64 g_free(str);
65 }
66
release_tpm(Object * obj,const char * name,void * opaque)67 static void release_tpm(Object *obj, const char *name, void *opaque)
68 {
69 Property *prop = opaque;
70 TPMBackend **be = object_field_prop_ptr(obj, prop);
71
72 if (*be) {
73 tpm_backend_reset(*be);
74 }
75 }
76
77 const PropertyInfo qdev_prop_tpm = {
78 .name = "str",
79 .description = "ID of a tpm to use as a backend",
80 .get = get_tpm,
81 .set = set_tpm,
82 .release = release_tpm,
83 };
84
85 /*
86 * Write an error message in the given output buffer.
87 */
tpm_util_write_fatal_error_response(uint8_t * out,uint32_t out_len)88 void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len)
89 {
90 if (out_len >= sizeof(struct tpm_resp_hdr)) {
91 tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND);
92 tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr));
93 tpm_cmd_set_error(out, TPM_FAIL);
94 }
95 }
96
tpm_util_is_selftest(const uint8_t * in,uint32_t in_len)97 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len)
98 {
99 if (in_len >= sizeof(struct tpm_req_hdr)) {
100 return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest;
101 }
102
103 return false;
104 }
105
106 /*
107 * Send request to a TPM device. We expect a response within one second.
108 */
tpm_util_request(int fd,const void * request,size_t requestlen,void * response,size_t responselen)109 static int tpm_util_request(int fd,
110 const void *request,
111 size_t requestlen,
112 void *response,
113 size_t responselen)
114 {
115 GPollFD fds[1] = { {.fd = fd, .events = G_IO_IN } };
116 int n;
117
118 n = write(fd, request, requestlen);
119 if (n < 0) {
120 return -errno;
121 }
122 if (n != requestlen) {
123 return -EFAULT;
124 }
125
126 /* wait for a second */
127 n = RETRY_ON_EINTR(g_poll(fds, 1, 1000));
128 if (n != 1) {
129 return -errno;
130 }
131
132 n = read(fd, response, responselen);
133 if (n < sizeof(struct tpm_resp_hdr)) {
134 return -EFAULT;
135 }
136
137 /* check the header */
138 if (tpm_cmd_get_size(response) != n) {
139 return -EMSGSIZE;
140 }
141
142 return 0;
143 }
144
145 /*
146 * A basic test of a TPM device. We expect a well formatted response header
147 * (error response is fine).
148 */
tpm_util_test(int fd,const void * request,size_t requestlen,uint16_t * return_tag)149 static int tpm_util_test(int fd,
150 const void *request,
151 size_t requestlen,
152 uint16_t *return_tag)
153 {
154 char buf[1024];
155 ssize_t ret;
156
157 ret = tpm_util_request(fd, request, requestlen,
158 buf, sizeof(buf));
159 if (ret < 0) {
160 return ret;
161 }
162
163 *return_tag = tpm_cmd_get_tag(buf);
164
165 return 0;
166 }
167
168 /*
169 * Probe for the TPM device in the back
170 * Returns 0 on success with the version of the probed TPM set, 1 on failure.
171 */
tpm_util_test_tpmdev(int tpm_fd,TPMVersion * tpm_version)172 int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version)
173 {
174 /*
175 * Sending a TPM1.2 command to a TPM2 should return a TPM1.2
176 * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e)
177 *
178 * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the
179 * header.
180 * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag
181 * in the header and an error code.
182 */
183 const struct tpm_req_hdr test_req = {
184 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
185 .len = cpu_to_be32(sizeof(test_req)),
186 .ordinal = cpu_to_be32(TPM_ORD_GetTicks),
187 };
188
189 const struct tpm_req_hdr test_req_tpm2 = {
190 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
191 .len = cpu_to_be32(sizeof(test_req_tpm2)),
192 .ordinal = cpu_to_be32(TPM2_CC_ReadClock),
193 };
194 uint16_t return_tag;
195 int ret;
196
197 /* Send TPM 2 command */
198 ret = tpm_util_test(tpm_fd, &test_req_tpm2,
199 sizeof(test_req_tpm2), &return_tag);
200 /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */
201 if (!ret && return_tag == TPM2_ST_NO_SESSIONS) {
202 *tpm_version = TPM_VERSION_2_0;
203 return 0;
204 }
205
206 /* Send TPM 1.2 command */
207 ret = tpm_util_test(tpm_fd, &test_req,
208 sizeof(test_req), &return_tag);
209 if (!ret && return_tag == TPM_TAG_RSP_COMMAND) {
210 *tpm_version = TPM_VERSION_1_2;
211 /* this is a TPM 1.2 */
212 return 0;
213 }
214
215 *tpm_version = TPM_VERSION_UNSPEC;
216
217 return 1;
218 }
219
tpm_util_get_buffer_size(int tpm_fd,TPMVersion tpm_version,size_t * buffersize)220 int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version,
221 size_t *buffersize)
222 {
223 int ret;
224
225 switch (tpm_version) {
226 case TPM_VERSION_1_2: {
227 const struct tpm_req_get_buffer_size {
228 struct tpm_req_hdr hdr;
229 uint32_t capability;
230 uint32_t len;
231 uint32_t subcap;
232 } QEMU_PACKED tpm_get_buffer_size = {
233 .hdr = {
234 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
235 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)),
236 .ordinal = cpu_to_be32(TPM_ORD_GetCapability),
237 },
238 .capability = cpu_to_be32(TPM_CAP_PROPERTY),
239 .len = cpu_to_be32(sizeof(uint32_t)),
240 .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER),
241 };
242 struct tpm_resp_get_buffer_size {
243 struct tpm_resp_hdr hdr;
244 uint32_t len;
245 uint32_t buffersize;
246 } QEMU_PACKED tpm_resp;
247
248 ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size,
249 sizeof(tpm_get_buffer_size),
250 &tpm_resp, sizeof(tpm_resp));
251 if (ret < 0) {
252 return ret;
253 }
254
255 if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) ||
256 be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) {
257 trace_tpm_util_get_buffer_size_hdr_len(
258 be32_to_cpu(tpm_resp.hdr.len),
259 sizeof(tpm_resp));
260 trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len),
261 sizeof(uint32_t));
262 error_report("tpm_util: Got unexpected response to "
263 "TPM_GetCapability; errcode: 0x%x",
264 be32_to_cpu(tpm_resp.hdr.errcode));
265 return -EFAULT;
266 }
267 *buffersize = be32_to_cpu(tpm_resp.buffersize);
268 break;
269 }
270 case TPM_VERSION_2_0: {
271 const struct tpm2_req_get_buffer_size {
272 struct tpm_req_hdr hdr;
273 uint32_t capability;
274 uint32_t property;
275 uint32_t count;
276 } QEMU_PACKED tpm2_get_buffer_size = {
277 .hdr = {
278 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
279 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)),
280 .ordinal = cpu_to_be32(TPM2_CC_GetCapability),
281 },
282 .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES),
283 .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE),
284 .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */
285 };
286 struct tpm2_resp_get_buffer_size {
287 struct tpm_resp_hdr hdr;
288 uint8_t more;
289 uint32_t capability;
290 uint32_t count;
291 uint32_t property1;
292 uint32_t value1;
293 uint32_t property2;
294 uint32_t value2;
295 } QEMU_PACKED tpm2_resp;
296
297 ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size,
298 sizeof(tpm2_get_buffer_size),
299 &tpm2_resp, sizeof(tpm2_resp));
300 if (ret < 0) {
301 return ret;
302 }
303
304 if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) ||
305 be32_to_cpu(tpm2_resp.count) != 2) {
306 trace_tpm_util_get_buffer_size_hdr_len2(
307 be32_to_cpu(tpm2_resp.hdr.len),
308 sizeof(tpm2_resp));
309 trace_tpm_util_get_buffer_size_len2(
310 be32_to_cpu(tpm2_resp.count), 2);
311 error_report("tpm_util: Got unexpected response to "
312 "TPM2_GetCapability; errcode: 0x%x",
313 be32_to_cpu(tpm2_resp.hdr.errcode));
314 return -EFAULT;
315 }
316 *buffersize = MAX(be32_to_cpu(tpm2_resp.value1),
317 be32_to_cpu(tpm2_resp.value2));
318 break;
319 }
320 case TPM_VERSION_UNSPEC:
321 return -EFAULT;
322 }
323
324 trace_tpm_util_get_buffer_size(*buffersize);
325
326 return 0;
327 }
328
tpm_sized_buffer_reset(TPMSizedBuffer * tsb)329 void tpm_sized_buffer_reset(TPMSizedBuffer *tsb)
330 {
331 g_free(tsb->buffer);
332 tsb->buffer = NULL;
333 tsb->size = 0;
334 }
335
tpm_util_show_buffer(const unsigned char * buffer,size_t buffer_size,const char * string)336 void tpm_util_show_buffer(const unsigned char *buffer,
337 size_t buffer_size, const char *string)
338 {
339 size_t len, i;
340 char *line_buffer, *p;
341
342 if (!trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER_CONTENT)) {
343 return;
344 }
345 len = MIN(tpm_cmd_get_size(buffer), buffer_size);
346 trace_tpm_util_show_buffer_header(string, len);
347
348 /*
349 * allocate enough room for 3 chars per buffer entry plus a
350 * newline after every 16 chars and a final null terminator.
351 */
352 line_buffer = g_malloc(len * 3 + (len / 16) + 1);
353
354 for (i = 0, p = line_buffer; i < len; i++) {
355 if (i && !(i % 16)) {
356 p += sprintf(p, "\n");
357 }
358 p += sprintf(p, "%.2X ", buffer[i]);
359 }
360 trace_tpm_util_show_buffer_content(line_buffer);
361
362 g_free(line_buffer);
363 }
364