1 /* 2 * TPM utility functions 3 * 4 * Copyright (c) 2010 - 2015 IBM Corporation 5 * Authors: 6 * Stefan Berger <stefanb@us.ibm.com> 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, see <http://www.gnu.org/licenses/> 20 */ 21 22 #include "qemu/osdep.h" 23 #include "qemu/error-report.h" 24 #include "qapi/error.h" 25 #include "qapi/visitor.h" 26 #include "tpm_int.h" 27 #include "exec/memory.h" 28 #include "hw/qdev-properties.h" 29 #include "sysemu/tpm_backend.h" 30 #include "sysemu/tpm_util.h" 31 #include "trace.h" 32 33 /* tpm backend property */ 34 35 static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque, 36 Error **errp) 37 { 38 DeviceState *dev = DEVICE(obj); 39 TPMBackend **be = qdev_get_prop_ptr(dev, opaque); 40 char *p; 41 42 p = g_strdup(*be ? (*be)->id : ""); 43 visit_type_str(v, name, &p, errp); 44 g_free(p); 45 } 46 47 static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque, 48 Error **errp) 49 { 50 DeviceState *dev = DEVICE(obj); 51 Property *prop = opaque; 52 TPMBackend *s, **be = qdev_get_prop_ptr(dev, prop); 53 char *str; 54 55 if (dev->realized) { 56 qdev_prop_set_after_realize(dev, name, errp); 57 return; 58 } 59 60 if (!visit_type_str(v, name, &str, errp)) { 61 return; 62 } 63 64 s = qemu_find_tpm_be(str); 65 if (s == NULL) { 66 error_setg(errp, "Property '%s.%s' can't find value '%s'", 67 object_get_typename(obj), prop->name, str); 68 } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) { 69 *be = s; /* weak reference, avoid cyclic ref */ 70 } 71 g_free(str); 72 } 73 74 static void release_tpm(Object *obj, const char *name, void *opaque) 75 { 76 DeviceState *dev = DEVICE(obj); 77 Property *prop = opaque; 78 TPMBackend **be = qdev_get_prop_ptr(dev, prop); 79 80 if (*be) { 81 tpm_backend_reset(*be); 82 } 83 } 84 85 const PropertyInfo qdev_prop_tpm = { 86 .name = "str", 87 .description = "ID of a tpm to use as a backend", 88 .get = get_tpm, 89 .set = set_tpm, 90 .release = release_tpm, 91 }; 92 93 /* 94 * Write an error message in the given output buffer. 95 */ 96 void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len) 97 { 98 if (out_len >= sizeof(struct tpm_resp_hdr)) { 99 tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND); 100 tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr)); 101 tpm_cmd_set_error(out, TPM_FAIL); 102 } 103 } 104 105 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len) 106 { 107 if (in_len >= sizeof(struct tpm_req_hdr)) { 108 return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest; 109 } 110 111 return false; 112 } 113 114 /* 115 * Send request to a TPM device. We expect a response within one second. 116 */ 117 static int tpm_util_request(int fd, 118 const void *request, 119 size_t requestlen, 120 void *response, 121 size_t responselen) 122 { 123 fd_set readfds; 124 int n; 125 struct timeval tv = { 126 .tv_sec = 1, 127 .tv_usec = 0, 128 }; 129 130 n = write(fd, request, requestlen); 131 if (n < 0) { 132 return -errno; 133 } 134 if (n != requestlen) { 135 return -EFAULT; 136 } 137 138 FD_ZERO(&readfds); 139 FD_SET(fd, &readfds); 140 141 /* wait for a second */ 142 n = select(fd + 1, &readfds, NULL, NULL, &tv); 143 if (n != 1) { 144 return -errno; 145 } 146 147 n = read(fd, response, responselen); 148 if (n < sizeof(struct tpm_resp_hdr)) { 149 return -EFAULT; 150 } 151 152 /* check the header */ 153 if (tpm_cmd_get_size(response) != n) { 154 return -EMSGSIZE; 155 } 156 157 return 0; 158 } 159 160 /* 161 * A basic test of a TPM device. We expect a well formatted response header 162 * (error response is fine). 163 */ 164 static int tpm_util_test(int fd, 165 const void *request, 166 size_t requestlen, 167 uint16_t *return_tag) 168 { 169 char buf[1024]; 170 ssize_t ret; 171 172 ret = tpm_util_request(fd, request, requestlen, 173 buf, sizeof(buf)); 174 if (ret < 0) { 175 return ret; 176 } 177 178 *return_tag = tpm_cmd_get_tag(buf); 179 180 return 0; 181 } 182 183 /* 184 * Probe for the TPM device in the back 185 * Returns 0 on success with the version of the probed TPM set, 1 on failure. 186 */ 187 int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version) 188 { 189 /* 190 * Sending a TPM1.2 command to a TPM2 should return a TPM1.2 191 * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e) 192 * 193 * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the 194 * header. 195 * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag 196 * in the header and an error code. 197 */ 198 const struct tpm_req_hdr test_req = { 199 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND), 200 .len = cpu_to_be32(sizeof(test_req)), 201 .ordinal = cpu_to_be32(TPM_ORD_GetTicks), 202 }; 203 204 const struct tpm_req_hdr test_req_tpm2 = { 205 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS), 206 .len = cpu_to_be32(sizeof(test_req_tpm2)), 207 .ordinal = cpu_to_be32(TPM2_CC_ReadClock), 208 }; 209 uint16_t return_tag; 210 int ret; 211 212 /* Send TPM 2 command */ 213 ret = tpm_util_test(tpm_fd, &test_req_tpm2, 214 sizeof(test_req_tpm2), &return_tag); 215 /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */ 216 if (!ret && return_tag == TPM2_ST_NO_SESSIONS) { 217 *tpm_version = TPM_VERSION_2_0; 218 return 0; 219 } 220 221 /* Send TPM 1.2 command */ 222 ret = tpm_util_test(tpm_fd, &test_req, 223 sizeof(test_req), &return_tag); 224 if (!ret && return_tag == TPM_TAG_RSP_COMMAND) { 225 *tpm_version = TPM_VERSION_1_2; 226 /* this is a TPM 1.2 */ 227 return 0; 228 } 229 230 *tpm_version = TPM_VERSION_UNSPEC; 231 232 return 1; 233 } 234 235 int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version, 236 size_t *buffersize) 237 { 238 int ret; 239 240 switch (tpm_version) { 241 case TPM_VERSION_1_2: { 242 const struct tpm_req_get_buffer_size { 243 struct tpm_req_hdr hdr; 244 uint32_t capability; 245 uint32_t len; 246 uint32_t subcap; 247 } QEMU_PACKED tpm_get_buffer_size = { 248 .hdr = { 249 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND), 250 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)), 251 .ordinal = cpu_to_be32(TPM_ORD_GetCapability), 252 }, 253 .capability = cpu_to_be32(TPM_CAP_PROPERTY), 254 .len = cpu_to_be32(sizeof(uint32_t)), 255 .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER), 256 }; 257 struct tpm_resp_get_buffer_size { 258 struct tpm_resp_hdr hdr; 259 uint32_t len; 260 uint32_t buffersize; 261 } QEMU_PACKED tpm_resp; 262 263 ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size, 264 sizeof(tpm_get_buffer_size), 265 &tpm_resp, sizeof(tpm_resp)); 266 if (ret < 0) { 267 return ret; 268 } 269 270 if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) || 271 be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) { 272 trace_tpm_util_get_buffer_size_hdr_len( 273 be32_to_cpu(tpm_resp.hdr.len), 274 sizeof(tpm_resp)); 275 trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len), 276 sizeof(uint32_t)); 277 error_report("tpm_util: Got unexpected response to " 278 "TPM_GetCapability; errcode: 0x%x", 279 be32_to_cpu(tpm_resp.hdr.errcode)); 280 return -EFAULT; 281 } 282 *buffersize = be32_to_cpu(tpm_resp.buffersize); 283 break; 284 } 285 case TPM_VERSION_2_0: { 286 const struct tpm2_req_get_buffer_size { 287 struct tpm_req_hdr hdr; 288 uint32_t capability; 289 uint32_t property; 290 uint32_t count; 291 } QEMU_PACKED tpm2_get_buffer_size = { 292 .hdr = { 293 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS), 294 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)), 295 .ordinal = cpu_to_be32(TPM2_CC_GetCapability), 296 }, 297 .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES), 298 .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE), 299 .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */ 300 }; 301 struct tpm2_resp_get_buffer_size { 302 struct tpm_resp_hdr hdr; 303 uint8_t more; 304 uint32_t capability; 305 uint32_t count; 306 uint32_t property1; 307 uint32_t value1; 308 uint32_t property2; 309 uint32_t value2; 310 } QEMU_PACKED tpm2_resp; 311 312 ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size, 313 sizeof(tpm2_get_buffer_size), 314 &tpm2_resp, sizeof(tpm2_resp)); 315 if (ret < 0) { 316 return ret; 317 } 318 319 if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) || 320 be32_to_cpu(tpm2_resp.count) != 2) { 321 trace_tpm_util_get_buffer_size_hdr_len2( 322 be32_to_cpu(tpm2_resp.hdr.len), 323 sizeof(tpm2_resp)); 324 trace_tpm_util_get_buffer_size_len2( 325 be32_to_cpu(tpm2_resp.count), 2); 326 error_report("tpm_util: Got unexpected response to " 327 "TPM2_GetCapability; errcode: 0x%x", 328 be32_to_cpu(tpm2_resp.hdr.errcode)); 329 return -EFAULT; 330 } 331 *buffersize = MAX(be32_to_cpu(tpm2_resp.value1), 332 be32_to_cpu(tpm2_resp.value2)); 333 break; 334 } 335 case TPM_VERSION_UNSPEC: 336 return -EFAULT; 337 } 338 339 trace_tpm_util_get_buffer_size(*buffersize); 340 341 return 0; 342 } 343 344 void tpm_sized_buffer_reset(TPMSizedBuffer *tsb) 345 { 346 g_free(tsb->buffer); 347 tsb->buffer = NULL; 348 tsb->size = 0; 349 } 350 351 void tpm_util_show_buffer(const unsigned char *buffer, 352 size_t buffer_size, const char *string) 353 { 354 size_t len, i; 355 char *line_buffer, *p; 356 357 if (!trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) { 358 return; 359 } 360 len = MIN(tpm_cmd_get_size(buffer), buffer_size); 361 362 /* 363 * allocate enough room for 3 chars per buffer entry plus a 364 * newline after every 16 chars and a final null terminator. 365 */ 366 line_buffer = g_malloc(len * 3 + (len / 16) + 1); 367 368 for (i = 0, p = line_buffer; i < len; i++) { 369 if (i && !(i % 16)) { 370 p += sprintf(p, "\n"); 371 } 372 p += sprintf(p, "%.2X ", buffer[i]); 373 } 374 trace_tpm_util_show_buffer(string, len, line_buffer); 375 376 g_free(line_buffer); 377 } 378