1 /* 2 * TPM utility functions 3 * 4 * Copyright (c) 2010 - 2015 IBM Corporation 5 * Authors: 6 * Stefan Berger <stefanb@us.ibm.com> 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, see <http://www.gnu.org/licenses/> 20 */ 21 22 #include "qemu/osdep.h" 23 #include "qemu/error-report.h" 24 #include "qapi/error.h" 25 #include "qapi/visitor.h" 26 #include "tpm_int.h" 27 #include "exec/memory.h" 28 #include "hw/qdev-properties.h" 29 #include "sysemu/tpm_backend.h" 30 #include "sysemu/tpm_util.h" 31 #include "trace.h" 32 33 /* tpm backend property */ 34 35 static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque, 36 Error **errp) 37 { 38 TPMBackend **be = qdev_get_prop_ptr(obj, opaque); 39 char *p; 40 41 p = g_strdup(*be ? (*be)->id : ""); 42 visit_type_str(v, name, &p, errp); 43 g_free(p); 44 } 45 46 static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque, 47 Error **errp) 48 { 49 DeviceState *dev = DEVICE(obj); 50 Property *prop = opaque; 51 TPMBackend *s, **be = qdev_get_prop_ptr(obj, prop); 52 char *str; 53 54 if (dev->realized) { 55 qdev_prop_set_after_realize(dev, name, errp); 56 return; 57 } 58 59 if (!visit_type_str(v, name, &str, errp)) { 60 return; 61 } 62 63 s = qemu_find_tpm_be(str); 64 if (s == NULL) { 65 error_setg(errp, "Property '%s.%s' can't find value '%s'", 66 object_get_typename(obj), prop->name, str); 67 } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) { 68 *be = s; /* weak reference, avoid cyclic ref */ 69 } 70 g_free(str); 71 } 72 73 static void release_tpm(Object *obj, const char *name, void *opaque) 74 { 75 Property *prop = opaque; 76 TPMBackend **be = qdev_get_prop_ptr(obj, prop); 77 78 if (*be) { 79 tpm_backend_reset(*be); 80 } 81 } 82 83 const PropertyInfo qdev_prop_tpm = { 84 .name = "str", 85 .description = "ID of a tpm to use as a backend", 86 .get = get_tpm, 87 .set = set_tpm, 88 .release = release_tpm, 89 }; 90 91 /* 92 * Write an error message in the given output buffer. 93 */ 94 void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len) 95 { 96 if (out_len >= sizeof(struct tpm_resp_hdr)) { 97 tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND); 98 tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr)); 99 tpm_cmd_set_error(out, TPM_FAIL); 100 } 101 } 102 103 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len) 104 { 105 if (in_len >= sizeof(struct tpm_req_hdr)) { 106 return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest; 107 } 108 109 return false; 110 } 111 112 /* 113 * Send request to a TPM device. We expect a response within one second. 114 */ 115 static int tpm_util_request(int fd, 116 const void *request, 117 size_t requestlen, 118 void *response, 119 size_t responselen) 120 { 121 fd_set readfds; 122 int n; 123 struct timeval tv = { 124 .tv_sec = 1, 125 .tv_usec = 0, 126 }; 127 128 n = write(fd, request, requestlen); 129 if (n < 0) { 130 return -errno; 131 } 132 if (n != requestlen) { 133 return -EFAULT; 134 } 135 136 FD_ZERO(&readfds); 137 FD_SET(fd, &readfds); 138 139 /* wait for a second */ 140 n = select(fd + 1, &readfds, NULL, NULL, &tv); 141 if (n != 1) { 142 return -errno; 143 } 144 145 n = read(fd, response, responselen); 146 if (n < sizeof(struct tpm_resp_hdr)) { 147 return -EFAULT; 148 } 149 150 /* check the header */ 151 if (tpm_cmd_get_size(response) != n) { 152 return -EMSGSIZE; 153 } 154 155 return 0; 156 } 157 158 /* 159 * A basic test of a TPM device. We expect a well formatted response header 160 * (error response is fine). 161 */ 162 static int tpm_util_test(int fd, 163 const void *request, 164 size_t requestlen, 165 uint16_t *return_tag) 166 { 167 char buf[1024]; 168 ssize_t ret; 169 170 ret = tpm_util_request(fd, request, requestlen, 171 buf, sizeof(buf)); 172 if (ret < 0) { 173 return ret; 174 } 175 176 *return_tag = tpm_cmd_get_tag(buf); 177 178 return 0; 179 } 180 181 /* 182 * Probe for the TPM device in the back 183 * Returns 0 on success with the version of the probed TPM set, 1 on failure. 184 */ 185 int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version) 186 { 187 /* 188 * Sending a TPM1.2 command to a TPM2 should return a TPM1.2 189 * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e) 190 * 191 * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the 192 * header. 193 * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag 194 * in the header and an error code. 195 */ 196 const struct tpm_req_hdr test_req = { 197 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND), 198 .len = cpu_to_be32(sizeof(test_req)), 199 .ordinal = cpu_to_be32(TPM_ORD_GetTicks), 200 }; 201 202 const struct tpm_req_hdr test_req_tpm2 = { 203 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS), 204 .len = cpu_to_be32(sizeof(test_req_tpm2)), 205 .ordinal = cpu_to_be32(TPM2_CC_ReadClock), 206 }; 207 uint16_t return_tag; 208 int ret; 209 210 /* Send TPM 2 command */ 211 ret = tpm_util_test(tpm_fd, &test_req_tpm2, 212 sizeof(test_req_tpm2), &return_tag); 213 /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */ 214 if (!ret && return_tag == TPM2_ST_NO_SESSIONS) { 215 *tpm_version = TPM_VERSION_2_0; 216 return 0; 217 } 218 219 /* Send TPM 1.2 command */ 220 ret = tpm_util_test(tpm_fd, &test_req, 221 sizeof(test_req), &return_tag); 222 if (!ret && return_tag == TPM_TAG_RSP_COMMAND) { 223 *tpm_version = TPM_VERSION_1_2; 224 /* this is a TPM 1.2 */ 225 return 0; 226 } 227 228 *tpm_version = TPM_VERSION_UNSPEC; 229 230 return 1; 231 } 232 233 int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version, 234 size_t *buffersize) 235 { 236 int ret; 237 238 switch (tpm_version) { 239 case TPM_VERSION_1_2: { 240 const struct tpm_req_get_buffer_size { 241 struct tpm_req_hdr hdr; 242 uint32_t capability; 243 uint32_t len; 244 uint32_t subcap; 245 } QEMU_PACKED tpm_get_buffer_size = { 246 .hdr = { 247 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND), 248 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)), 249 .ordinal = cpu_to_be32(TPM_ORD_GetCapability), 250 }, 251 .capability = cpu_to_be32(TPM_CAP_PROPERTY), 252 .len = cpu_to_be32(sizeof(uint32_t)), 253 .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER), 254 }; 255 struct tpm_resp_get_buffer_size { 256 struct tpm_resp_hdr hdr; 257 uint32_t len; 258 uint32_t buffersize; 259 } QEMU_PACKED tpm_resp; 260 261 ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size, 262 sizeof(tpm_get_buffer_size), 263 &tpm_resp, sizeof(tpm_resp)); 264 if (ret < 0) { 265 return ret; 266 } 267 268 if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) || 269 be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) { 270 trace_tpm_util_get_buffer_size_hdr_len( 271 be32_to_cpu(tpm_resp.hdr.len), 272 sizeof(tpm_resp)); 273 trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len), 274 sizeof(uint32_t)); 275 error_report("tpm_util: Got unexpected response to " 276 "TPM_GetCapability; errcode: 0x%x", 277 be32_to_cpu(tpm_resp.hdr.errcode)); 278 return -EFAULT; 279 } 280 *buffersize = be32_to_cpu(tpm_resp.buffersize); 281 break; 282 } 283 case TPM_VERSION_2_0: { 284 const struct tpm2_req_get_buffer_size { 285 struct tpm_req_hdr hdr; 286 uint32_t capability; 287 uint32_t property; 288 uint32_t count; 289 } QEMU_PACKED tpm2_get_buffer_size = { 290 .hdr = { 291 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS), 292 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)), 293 .ordinal = cpu_to_be32(TPM2_CC_GetCapability), 294 }, 295 .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES), 296 .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE), 297 .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */ 298 }; 299 struct tpm2_resp_get_buffer_size { 300 struct tpm_resp_hdr hdr; 301 uint8_t more; 302 uint32_t capability; 303 uint32_t count; 304 uint32_t property1; 305 uint32_t value1; 306 uint32_t property2; 307 uint32_t value2; 308 } QEMU_PACKED tpm2_resp; 309 310 ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size, 311 sizeof(tpm2_get_buffer_size), 312 &tpm2_resp, sizeof(tpm2_resp)); 313 if (ret < 0) { 314 return ret; 315 } 316 317 if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) || 318 be32_to_cpu(tpm2_resp.count) != 2) { 319 trace_tpm_util_get_buffer_size_hdr_len2( 320 be32_to_cpu(tpm2_resp.hdr.len), 321 sizeof(tpm2_resp)); 322 trace_tpm_util_get_buffer_size_len2( 323 be32_to_cpu(tpm2_resp.count), 2); 324 error_report("tpm_util: Got unexpected response to " 325 "TPM2_GetCapability; errcode: 0x%x", 326 be32_to_cpu(tpm2_resp.hdr.errcode)); 327 return -EFAULT; 328 } 329 *buffersize = MAX(be32_to_cpu(tpm2_resp.value1), 330 be32_to_cpu(tpm2_resp.value2)); 331 break; 332 } 333 case TPM_VERSION_UNSPEC: 334 return -EFAULT; 335 } 336 337 trace_tpm_util_get_buffer_size(*buffersize); 338 339 return 0; 340 } 341 342 void tpm_sized_buffer_reset(TPMSizedBuffer *tsb) 343 { 344 g_free(tsb->buffer); 345 tsb->buffer = NULL; 346 tsb->size = 0; 347 } 348 349 void tpm_util_show_buffer(const unsigned char *buffer, 350 size_t buffer_size, const char *string) 351 { 352 size_t len, i; 353 char *line_buffer, *p; 354 355 if (!trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) { 356 return; 357 } 358 len = MIN(tpm_cmd_get_size(buffer), buffer_size); 359 360 /* 361 * allocate enough room for 3 chars per buffer entry plus a 362 * newline after every 16 chars and a final null terminator. 363 */ 364 line_buffer = g_malloc(len * 3 + (len / 16) + 1); 365 366 for (i = 0, p = line_buffer; i < len; i++) { 367 if (i && !(i % 16)) { 368 p += sprintf(p, "\n"); 369 } 370 p += sprintf(p, "%.2X ", buffer[i]); 371 } 372 trace_tpm_util_show_buffer(string, len, line_buffer); 373 374 g_free(line_buffer); 375 } 376