1/*
2 * TPM utility functions
3 *
4 * Copyright (c) 2010 - 2015 IBM Corporation
5 * Authors:
6 * Stefan Berger <stefanb@us.ibm.com>
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>
20 */
21
22#include "qemu/osdep.h"
23#include "qemu/error-report.h"
24#include "qapi/error.h"
25#include "qapi/visitor.h"
26#include "tpm_util.h"
27#include "tpm_int.h"
28#include "exec/memory.h"
29#include "hw/qdev-properties.h"
30#include "sysemu/tpm_backend.h"
31#include "trace.h"
32
33/* tpm backend property */
34
35static void get_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
36 Error **errp)
37{
38 DeviceState *dev = DEVICE(obj);
39 TPMBackend **be = qdev_get_prop_ptr(dev, opaque);
40 char *p;
41
42 p = g_strdup(*be ? (*be)->id : "");
43 visit_type_str(v, name, &p, errp);
44 g_free(p);
45}
46
47static void set_tpm(Object *obj, Visitor *v, const char *name, void *opaque,
48 Error **errp)
49{
50 DeviceState *dev = DEVICE(obj);
51 Error *local_err = NULL;
52 Property *prop = opaque;
53 TPMBackend *s, **be = qdev_get_prop_ptr(dev, prop);
54 char *str;
55
56 if (dev->realized) {
57 qdev_prop_set_after_realize(dev, name, errp);
58 return;
59 }
60
61 visit_type_str(v, name, &str, &local_err);
62 if (local_err) {
63 error_propagate(errp, local_err);
64 return;
65 }
66
67 s = qemu_find_tpm_be(str);
68 if (s == NULL) {
69 error_setg(errp, "Property '%s.%s' can't find value '%s'",
70 object_get_typename(obj), prop->name, str);
71 } else if (tpm_backend_init(s, TPM_IF(obj), errp) == 0) {
72 *be = s; /* weak reference, avoid cyclic ref */
73 }
74 g_free(str);
75}
76
77static void release_tpm(Object *obj, const char *name, void *opaque)
78{
79 DeviceState *dev = DEVICE(obj);
80 Property *prop = opaque;
81 TPMBackend **be = qdev_get_prop_ptr(dev, prop);
82
83 if (*be) {
84 tpm_backend_reset(*be);
85 }
86}
87
88const PropertyInfo qdev_prop_tpm = {
89 .name = "str",
90 .description = "ID of a tpm to use as a backend",
91 .get = get_tpm,
92 .set = set_tpm,
93 .release = release_tpm,
94};
95
96/*
97 * Write an error message in the given output buffer.
98 */
99void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len)
100{
101 if (out_len >= sizeof(struct tpm_resp_hdr)) {
102 tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND);
103 tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr));
104 tpm_cmd_set_error(out, TPM_FAIL);
105 }
106}
107
108bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len)
109{
110 if (in_len >= sizeof(struct tpm_req_hdr)) {
111 return tpm_cmd_get_ordinal(in) == TPM_ORD_ContinueSelfTest;
112 }
113
114 return false;
115}
116
117/*
118 * Send request to a TPM device. We expect a response within one second.
119 */
120static int tpm_util_request(int fd,
121 const void *request,
122 size_t requestlen,
123 void *response,
124 size_t responselen)
125{
126 fd_set readfds;
127 int n;
128 struct timeval tv = {
129 .tv_sec = 1,
130 .tv_usec = 0,
131 };
132
133 n = write(fd, request, requestlen);
134 if (n < 0) {
135 return -errno;
136 }
137 if (n != requestlen) {
138 return -EFAULT;
139 }
140
141 FD_ZERO(&readfds);
142 FD_SET(fd, &readfds);
143
144 /* wait for a second */
145 n = select(fd + 1, &readfds, NULL, NULL, &tv);
146 if (n != 1) {
147 return -errno;
148 }
149
150 n = read(fd, response, responselen);
151 if (n < sizeof(struct tpm_resp_hdr)) {
152 return -EFAULT;
153 }
154
155 /* check the header */
156 if (tpm_cmd_get_size(response) != n) {
157 return -EMSGSIZE;
158 }
159
160 return 0;
161}
162
163/*
164 * A basic test of a TPM device. We expect a well formatted response header
165 * (error response is fine).
166 */
167static int tpm_util_test(int fd,
168 const void *request,
169 size_t requestlen,
170 uint16_t *return_tag)
171{
172 char buf[1024];
173 ssize_t ret;
174
175 ret = tpm_util_request(fd, request, requestlen,
176 buf, sizeof(buf));
177 if (ret < 0) {
178 return ret;
179 }
180
181 *return_tag = tpm_cmd_get_tag(buf);
182
183 return 0;
184}
185
186/*
187 * Probe for the TPM device in the back
188 * Returns 0 on success with the version of the probed TPM set, 1 on failure.
189 */
190int tpm_util_test_tpmdev(int tpm_fd, TPMVersion *tpm_version)
191{
192 /*
193 * Sending a TPM1.2 command to a TPM2 should return a TPM1.2
194 * header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e)
195 *
196 * Sending a TPM2 command to a TPM 2 will give a TPM 2 tag in the
197 * header.
198 * Sending a TPM2 command to a TPM 1.2 will give a TPM 1.2 tag
199 * in the header and an error code.
200 */
201 const struct tpm_req_hdr test_req = {
202 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
203 .len = cpu_to_be32(sizeof(test_req)),
204 .ordinal = cpu_to_be32(TPM_ORD_GetTicks),
205 };
206
207 const struct tpm_req_hdr test_req_tpm2 = {
208 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
209 .len = cpu_to_be32(sizeof(test_req_tpm2)),
210 .ordinal = cpu_to_be32(TPM2_CC_ReadClock),
211 };
212 uint16_t return_tag;
213 int ret;
214
215 /* Send TPM 2 command */
216 ret = tpm_util_test(tpm_fd, &test_req_tpm2,
217 sizeof(test_req_tpm2), &return_tag);
218 /* TPM 2 would respond with a tag of TPM2_ST_NO_SESSIONS */
219 if (!ret && return_tag == TPM2_ST_NO_SESSIONS) {
220 *tpm_version = TPM_VERSION_2_0;
221 return 0;
222 }
223
224 /* Send TPM 1.2 command */
225 ret = tpm_util_test(tpm_fd, &test_req,
226 sizeof(test_req), &return_tag);
227 if (!ret && return_tag == TPM_TAG_RSP_COMMAND) {
228 *tpm_version = TPM_VERSION_1_2;
229 /* this is a TPM 1.2 */
230 return 0;
231 }
232
233 *tpm_version = TPM_VERSION_UNSPEC;
234
235 return 1;
236}
237
238int tpm_util_get_buffer_size(int tpm_fd, TPMVersion tpm_version,
239 size_t *buffersize)
240{
241 int ret;
242
243 switch (tpm_version) {
244 case TPM_VERSION_1_2: {
245 const struct tpm_req_get_buffer_size {
246 struct tpm_req_hdr hdr;
247 uint32_t capability;
248 uint32_t len;
249 uint32_t subcap;
250 } QEMU_PACKED tpm_get_buffer_size = {
251 .hdr = {
252 .tag = cpu_to_be16(TPM_TAG_RQU_COMMAND),
253 .len = cpu_to_be32(sizeof(tpm_get_buffer_size)),
254 .ordinal = cpu_to_be32(TPM_ORD_GetCapability),
255 },
256 .capability = cpu_to_be32(TPM_CAP_PROPERTY),
257 .len = cpu_to_be32(sizeof(uint32_t)),
258 .subcap = cpu_to_be32(TPM_CAP_PROP_INPUT_BUFFER),
259 };
260 struct tpm_resp_get_buffer_size {
261 struct tpm_resp_hdr hdr;
262 uint32_t len;
263 uint32_t buffersize;
264 } QEMU_PACKED tpm_resp;
265
266 ret = tpm_util_request(tpm_fd, &tpm_get_buffer_size,
267 sizeof(tpm_get_buffer_size),
268 &tpm_resp, sizeof(tpm_resp));
269 if (ret < 0) {
270 return ret;
271 }
272
273 if (be32_to_cpu(tpm_resp.hdr.len) != sizeof(tpm_resp) ||
274 be32_to_cpu(tpm_resp.len) != sizeof(uint32_t)) {
275 trace_tpm_util_get_buffer_size_hdr_len(
276 be32_to_cpu(tpm_resp.hdr.len),
277 sizeof(tpm_resp));
278 trace_tpm_util_get_buffer_size_len(be32_to_cpu(tpm_resp.len),
279 sizeof(uint32_t));
280 error_report("tpm_util: Got unexpected response to "
281 "TPM_GetCapability; errcode: 0x%x",
282 be32_to_cpu(tpm_resp.hdr.errcode));
283 return -EFAULT;
284 }
285 *buffersize = be32_to_cpu(tpm_resp.buffersize);
286 break;
287 }
288 case TPM_VERSION_2_0: {
289 const struct tpm2_req_get_buffer_size {
290 struct tpm_req_hdr hdr;
291 uint32_t capability;
292 uint32_t property;
293 uint32_t count;
294 } QEMU_PACKED tpm2_get_buffer_size = {
295 .hdr = {
296 .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
297 .len = cpu_to_be32(sizeof(tpm2_get_buffer_size)),
298 .ordinal = cpu_to_be32(TPM2_CC_GetCapability),
299 },
300 .capability = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES),
301 .property = cpu_to_be32(TPM2_PT_MAX_COMMAND_SIZE),
302 .count = cpu_to_be32(2), /* also get TPM2_PT_MAX_RESPONSE_SIZE */
303 };
304 struct tpm2_resp_get_buffer_size {
305 struct tpm_resp_hdr hdr;
306 uint8_t more;
307 uint32_t capability;
308 uint32_t count;
309 uint32_t property1;
310 uint32_t value1;
311 uint32_t property2;
312 uint32_t value2;
313 } QEMU_PACKED tpm2_resp;
314
315 ret = tpm_util_request(tpm_fd, &tpm2_get_buffer_size,
316 sizeof(tpm2_get_buffer_size),
317 &tpm2_resp, sizeof(tpm2_resp));
318 if (ret < 0) {
319 return ret;
320 }
321
322 if (be32_to_cpu(tpm2_resp.hdr.len) != sizeof(tpm2_resp) ||
323 be32_to_cpu(tpm2_resp.count) != 2) {
324 trace_tpm_util_get_buffer_size_hdr_len2(
325 be32_to_cpu(tpm2_resp.hdr.len),
326 sizeof(tpm2_resp));
327 trace_tpm_util_get_buffer_size_len2(
328 be32_to_cpu(tpm2_resp.count), 2);
329 error_report("tpm_util: Got unexpected response to "
330 "TPM2_GetCapability; errcode: 0x%x",
331 be32_to_cpu(tpm2_resp.hdr.errcode));
332 return -EFAULT;
333 }
334 *buffersize = MAX(be32_to_cpu(tpm2_resp.value1),
335 be32_to_cpu(tpm2_resp.value2));
336 break;
337 }
338 case TPM_VERSION_UNSPEC:
339 return -EFAULT;
340 }
341
342 trace_tpm_util_get_buffer_size(*buffersize);
343
344 return 0;
345}
346
347void tpm_sized_buffer_reset(TPMSizedBuffer *tsb)
348{
349 g_free(tsb->buffer);
350 tsb->buffer = NULL;
351 tsb->size = 0;
352}
353