hw/tpm/tpm_emulator.c

   1 /*
   2  *  Emulator TPM driver
   3  *
   4  *  Copyright (c) 2017 Intel Corporation
   5  *  Author: Amarnath Valluri <amarnath.valluri@intel.com>
   6  *
   7  *  Copyright (c) 2010 - 2013, 2018 IBM Corporation
   8  *  Authors:
   9  *    Stefan Berger <stefanb@us.ibm.com>
  10  *
  11  *  Copyright (C) 2011 IAIK, Graz University of Technology
  12  *    Author: Andreas Niederl
  13  *
  14  * This library is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU Lesser General Public
  16  * License as published by the Free Software Foundation; either
  17  * version 2 of the License, or (at your option) any later version.
  18  *
  19  * This library is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  22  * Lesser General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU Lesser General Public
  25  * License along with this library; if not, see <http://www.gnu.org/licenses/>
  26  *
  27  */
  28
  29 #include "qemu/osdep.h"
  30 #include "qemu/error-report.h"
  31 #include "qemu/module.h"
  32 #include "qemu/sockets.h"
  33 #include "io/channel-socket.h"
  34 #include "sysemu/tpm_backend.h"
  35 #include "tpm_int.h"
  36 #include "hw/hw.h"
  37 #include "tpm_util.h"
  38 #include "tpm_ioctl.h"
  39 #include "migration/blocker.h"
  40 #include "qapi/error.h"
  41 #include "qapi/clone-visitor.h"
  42 #include "qapi/qapi-visit-tpm.h"
  43 #include "chardev/char-fe.h"
  44 #include "trace.h"
  45
  46 #define TYPE_TPM_EMULATOR "tpm-emulator"
  47 #define TPM_EMULATOR(obj) \
  48     OBJECT_CHECK(TPMEmulator, (obj), TYPE_TPM_EMULATOR)
  49
  50 #define TPM_EMULATOR_IMPLEMENTS_ALL_CAPS(S, cap) (((S)->caps & (cap)) == (cap))
  51
  52 /* data structures */
  53
  54 /* blobs from the TPM; part of VM state when migrating */
  55 typedef struct TPMBlobBuffers {
  56     uint32_t permanent_flags;
  57     TPMSizedBuffer permanent;
  58
  59     uint32_t volatil_flags;
  60     TPMSizedBuffer volatil;
  61
  62     uint32_t savestate_flags;
  63     TPMSizedBuffer savestate;
  64 } TPMBlobBuffers;
  65
  66 typedef struct TPMEmulator {
  67     TPMBackend parent;
  68
  69     TPMEmulatorOptions *options;
  70     CharBackend ctrl_chr;
  71     QIOChannel *data_ioc;
  72     TPMVersion tpm_version;
  73     ptm_cap caps; /* capabilities of the TPM */
  74     uint8_t cur_locty_number; /* last set locality */
  75     Error *migration_blocker;
  76
  77     QemuMutex mutex;
  78
  79     unsigned int established_flag:1;
  80     unsigned int established_flag_cached:1;
  81
  82     TPMBlobBuffers state_blobs;
  83 } TPMEmulator;
  84
  85
  86 static int tpm_emulator_ctrlcmd(TPMEmulator *tpm, unsigned long cmd, void *msg,
  87                                 size_t msg_len_in, size_t msg_len_out)
  88 {
  89     CharBackend *dev = &tpm->ctrl_chr;
  90     uint32_t cmd_no = cpu_to_be32(cmd);
  91     ssize_t n = sizeof(uint32_t) + msg_len_in;
  92     uint8_t *buf = NULL;
  93     int ret = -1;
  94
  95     qemu_mutex_lock(&tpm->mutex);
  96
  97     buf = g_alloca(n);
  98     memcpy(buf, &cmd_no, sizeof(cmd_no));
  99     memcpy(buf + sizeof(cmd_no), msg, msg_len_in);
 100
 101     n = qemu_chr_fe_write_all(dev, buf, n);
 102     if (n <= 0) {
 103         goto end;
 104     }
 105
 106     if (msg_len_out != 0) {
 107         n = qemu_chr_fe_read_all(dev, msg, msg_len_out);
 108         if (n <= 0) {
 109             goto end;
 110         }
 111     }
 112
 113     ret = 0;
 114
 115 end:
 116     qemu_mutex_unlock(&tpm->mutex);
 117     return ret;
 118 }
 119
 120 static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
 121                                      const uint8_t *in, uint32_t in_len,
 122                                      uint8_t *out, uint32_t out_len,
 123                                      bool *selftest_done,
 124                                      Error **err)
 125 {
 126     ssize_t ret;
 127     bool is_selftest = false;
 128
 129     if (selftest_done) {
 130         *selftest_done = false;
 131         is_selftest = tpm_util_is_selftest(in, in_len);
 132     }
 133
 134     ret = qio_channel_write_all(tpm_emu->data_ioc, (char *)in, in_len, err);
 135     if (ret != 0) {
 136         return -1;
 137     }
 138
 139     ret = qio_channel_read_all(tpm_emu->data_ioc, (char *)out,
 140               sizeof(struct tpm_resp_hdr), err);
 141     if (ret != 0) {
 142         return -1;
 143     }
 144
 145     ret = qio_channel_read_all(tpm_emu->data_ioc,
 146               (char *)out + sizeof(struct tpm_resp_hdr),
 147               tpm_cmd_get_size(out) - sizeof(struct tpm_resp_hdr), err);
 148     if (ret != 0) {
 149         return -1;
 150     }
 151
 152     if (is_selftest) {
 153         *selftest_done = tpm_cmd_get_errcode(out) == 0;
 154     }
 155
 156     return 0;
 157 }
 158
 159 static int tpm_emulator_set_locality(TPMEmulator *tpm_emu, uint8_t locty_number,
 160                                      Error **errp)
 161 {
 162     ptm_loc loc;
 163
 164     if (tpm_emu->cur_locty_number == locty_number) {
 165         return 0;
 166     }
 167
 168     trace_tpm_emulator_set_locality(locty_number);
 169
 170     memset(&loc, 0, sizeof(loc));
 171     loc.u.req.loc = locty_number;
 172     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_LOCALITY, &loc,
 173                              sizeof(loc), sizeof(loc)) < 0) {
 174         error_setg(errp, "tpm-emulator: could not set locality : %s",
 175                    strerror(errno));
 176         return -1;
 177     }
 178
 179     loc.u.resp.tpm_result = be32_to_cpu(loc.u.resp.tpm_result);
 180     if (loc.u.resp.tpm_result != 0) {
 181         error_setg(errp, "tpm-emulator: TPM result for set locality : 0x%x",
 182                    loc.u.resp.tpm_result);
 183         return -1;
 184     }
 185
 186     tpm_emu->cur_locty_number = locty_number;
 187
 188     return 0;
 189 }
 190
 191 static void tpm_emulator_handle_request(TPMBackend *tb, TPMBackendCmd *cmd,
 192                                         Error **errp)
 193 {
 194     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 195
 196     trace_tpm_emulator_handle_request();
 197
 198     if (tpm_emulator_set_locality(tpm_emu, cmd->locty, errp) < 0 ||
 199         tpm_emulator_unix_tx_bufs(tpm_emu, cmd->in, cmd->in_len,
 200                                   cmd->out, cmd->out_len,
 201                                   &cmd->selftest_done, errp) < 0) {
 202         tpm_util_write_fatal_error_response(cmd->out, cmd->out_len);
 203     }
 204 }
 205
 206 static int tpm_emulator_probe_caps(TPMEmulator *tpm_emu)
 207 {
 208     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_GET_CAPABILITY,
 209                              &tpm_emu->caps, 0, sizeof(tpm_emu->caps)) < 0) {
 210         error_report("tpm-emulator: probing failed : %s", strerror(errno));
 211         return -1;
 212     }
 213
 214     tpm_emu->caps = be64_to_cpu(tpm_emu->caps);
 215
 216     trace_tpm_emulator_probe_caps(tpm_emu->caps);
 217
 218     return 0;
 219 }
 220
 221 static int tpm_emulator_check_caps(TPMEmulator *tpm_emu)
 222 {
 223     ptm_cap caps = 0;
 224     const char *tpm = NULL;
 225
 226     /* check for min. required capabilities */
 227     switch (tpm_emu->tpm_version) {
 228     case TPM_VERSION_1_2:
 229         caps = PTM_CAP_INIT | PTM_CAP_SHUTDOWN | PTM_CAP_GET_TPMESTABLISHED |
 230                PTM_CAP_SET_LOCALITY | PTM_CAP_SET_DATAFD | PTM_CAP_STOP |
 231                PTM_CAP_SET_BUFFERSIZE;
 232         tpm = "1.2";
 233         break;
 234     case TPM_VERSION_2_0:
 235         caps = PTM_CAP_INIT | PTM_CAP_SHUTDOWN | PTM_CAP_GET_TPMESTABLISHED |
 236                PTM_CAP_SET_LOCALITY | PTM_CAP_RESET_TPMESTABLISHED |
 237                PTM_CAP_SET_DATAFD | PTM_CAP_STOP | PTM_CAP_SET_BUFFERSIZE;
 238         tpm = "2";
 239         break;
 240     case TPM_VERSION_UNSPEC:
 241         error_report("tpm-emulator: TPM version has not been set");
 242         return -1;
 243     }
 244
 245     if (!TPM_EMULATOR_IMPLEMENTS_ALL_CAPS(tpm_emu, caps)) {
 246         error_report("tpm-emulator: TPM does not implement minimum set of "
 247                      "required capabilities for TPM %s (0x%x)", tpm, (int)caps);
 248         return -1;
 249     }
 250
 251     return 0;
 252 }
 253
 254 static int tpm_emulator_stop_tpm(TPMBackend *tb)
 255 {
 256     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 257     ptm_res res;
 258
 259     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_STOP, &res, 0, sizeof(res)) < 0) {
 260         error_report("tpm-emulator: Could not stop TPM: %s",
 261                      strerror(errno));
 262         return -1;
 263     }
 264
 265     res = be32_to_cpu(res);
 266     if (res) {
 267         error_report("tpm-emulator: TPM result for CMD_STOP: 0x%x", res);
 268         return -1;
 269     }
 270
 271     return 0;
 272 }
 273
 274 static int tpm_emulator_set_buffer_size(TPMBackend *tb,
 275                                         size_t wanted_size,
 276                                         size_t *actual_size)
 277 {
 278     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 279     ptm_setbuffersize psbs;
 280
 281     if (tpm_emulator_stop_tpm(tb) < 0) {
 282         return -1;
 283     }
 284
 285     psbs.u.req.buffersize = cpu_to_be32(wanted_size);
 286
 287     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_BUFFERSIZE, &psbs,
 288                              sizeof(psbs.u.req), sizeof(psbs.u.resp)) < 0) {
 289         error_report("tpm-emulator: Could not set buffer size: %s",
 290                      strerror(errno));
 291         return -1;
 292     }
 293
 294     psbs.u.resp.tpm_result = be32_to_cpu(psbs.u.resp.tpm_result);
 295     if (psbs.u.resp.tpm_result != 0) {
 296         error_report("tpm-emulator: TPM result for set buffer size : 0x%x",
 297                      psbs.u.resp.tpm_result);
 298         return -1;
 299     }
 300
 301     if (actual_size) {
 302         *actual_size = be32_to_cpu(psbs.u.resp.buffersize);
 303     }
 304
 305     trace_tpm_emulator_set_buffer_size(
 306             be32_to_cpu(psbs.u.resp.buffersize),
 307             be32_to_cpu(psbs.u.resp.minsize),
 308             be32_to_cpu(psbs.u.resp.maxsize));
 309
 310     return 0;
 311 }
 312
 313 static int tpm_emulator_startup_tpm_resume(TPMBackend *tb, size_t buffersize,
 314                                      bool is_resume)
 315 {
 316     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 317     ptm_init init = {
 318         .u.req.init_flags = 0,
 319     };
 320     ptm_res res;
 321
 322     trace_tpm_emulator_startup_tpm_resume(is_resume, buffersize);
 323
 324     if (buffersize != 0 &&
 325         tpm_emulator_set_buffer_size(tb, buffersize, NULL) < 0) {
 326         goto err_exit;
 327     }
 328
 329     if (is_resume) {
 330         init.u.req.init_flags |= cpu_to_be32(PTM_INIT_FLAG_DELETE_VOLATILE);
 331     }
 332
 333     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_INIT, &init, sizeof(init),
 334                              sizeof(init)) < 0) {
 335         error_report("tpm-emulator: could not send INIT: %s",
 336                      strerror(errno));
 337         goto err_exit;
 338     }
 339
 340     res = be32_to_cpu(init.u.resp.tpm_result);
 341     if (res) {
 342         error_report("tpm-emulator: TPM result for CMD_INIT: 0x%x", res);
 343         goto err_exit;
 344     }
 345     return 0;
 346
 347 err_exit:
 348     return -1;
 349 }
 350
 351 static int tpm_emulator_startup_tpm(TPMBackend *tb, size_t buffersize)
 352 {
 353     return tpm_emulator_startup_tpm_resume(tb, buffersize, false);
 354 }
 355
 356 static bool tpm_emulator_get_tpm_established_flag(TPMBackend *tb)
 357 {
 358     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 359     ptm_est est;
 360
 361     if (tpm_emu->established_flag_cached) {
 362         return tpm_emu->established_flag;
 363     }
 364
 365     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_GET_TPMESTABLISHED, &est,
 366                              0, sizeof(est)) < 0) {
 367         error_report("tpm-emulator: Could not get the TPM established flag: %s",
 368                      strerror(errno));
 369         return false;
 370     }
 371     trace_tpm_emulator_get_tpm_established_flag(est.u.resp.bit);
 372
 373     tpm_emu->established_flag_cached = 1;
 374     tpm_emu->established_flag = (est.u.resp.bit != 0);
 375
 376     return tpm_emu->established_flag;
 377 }
 378
 379 static int tpm_emulator_reset_tpm_established_flag(TPMBackend *tb,
 380                                                    uint8_t locty)
 381 {
 382     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 383     ptm_reset_est reset_est;
 384     ptm_res res;
 385
 386     /* only a TPM 2.0 will support this */
 387     if (tpm_emu->tpm_version != TPM_VERSION_2_0) {
 388         return 0;
 389     }
 390
 391     reset_est.u.req.loc = tpm_emu->cur_locty_number;
 392     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_RESET_TPMESTABLISHED,
 393                              &reset_est, sizeof(reset_est),
 394                              sizeof(reset_est)) < 0) {
 395         error_report("tpm-emulator: Could not reset the establishment bit: %s",
 396                      strerror(errno));
 397         return -1;
 398     }
 399
 400     res = be32_to_cpu(reset_est.u.resp.tpm_result);
 401     if (res) {
 402         error_report("tpm-emulator: TPM result for rest establixhed flag: 0x%x",
 403                      res);
 404         return -1;
 405     }
 406
 407     tpm_emu->established_flag_cached = 0;
 408
 409     return 0;
 410 }
 411
 412 static void tpm_emulator_cancel_cmd(TPMBackend *tb)
 413 {
 414     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 415     ptm_res res;
 416
 417     if (!TPM_EMULATOR_IMPLEMENTS_ALL_CAPS(tpm_emu, PTM_CAP_CANCEL_TPM_CMD)) {
 418         trace_tpm_emulator_cancel_cmd_not_supt();
 419         return;
 420     }
 421
 422     /* FIXME: make the function non-blocking, or it may block a VCPU */
 423     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_CANCEL_TPM_CMD, &res, 0,
 424                              sizeof(res)) < 0) {
 425         error_report("tpm-emulator: Could not cancel command: %s",
 426                      strerror(errno));
 427     } else if (res != 0) {
 428         error_report("tpm-emulator: Failed to cancel TPM: 0x%x",
 429                      be32_to_cpu(res));
 430     }
 431 }
 432
 433 static TPMVersion tpm_emulator_get_tpm_version(TPMBackend *tb)
 434 {
 435     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 436
 437     return tpm_emu->tpm_version;
 438 }
 439
 440 static size_t tpm_emulator_get_buffer_size(TPMBackend *tb)
 441 {
 442     size_t actual_size;
 443
 444     if (tpm_emulator_set_buffer_size(tb, 0, &actual_size) < 0) {
 445         return 4096;
 446     }
 447
 448     return actual_size;
 449 }
 450
 451 static int tpm_emulator_block_migration(TPMEmulator *tpm_emu)
 452 {
 453     Error *err = NULL;
 454     ptm_cap caps = PTM_CAP_GET_STATEBLOB | PTM_CAP_SET_STATEBLOB |
 455                    PTM_CAP_STOP;
 456
 457     if (!TPM_EMULATOR_IMPLEMENTS_ALL_CAPS(tpm_emu, caps)) {
 458         error_setg(&tpm_emu->migration_blocker,
 459                    "Migration disabled: TPM emulator does not support "
 460                    "migration");
 461         migrate_add_blocker(tpm_emu->migration_blocker, &err);
 462         if (err) {
 463             error_report_err(err);
 464             error_free(tpm_emu->migration_blocker);
 465             tpm_emu->migration_blocker = NULL;
 466
 467             return -1;
 468         }
 469     }
 470
 471     return 0;
 472 }
 473
 474 static int tpm_emulator_prepare_data_fd(TPMEmulator *tpm_emu)
 475 {
 476     ptm_res res;
 477     Error *err = NULL;
 478     int fds[2] = { -1, -1 };
 479
 480     if (socketpair(AF_UNIX, SOCK_STREAM, 0, fds) < 0) {
 481         error_report("tpm-emulator: Failed to create socketpair");
 482         return -1;
 483     }
 484
 485     qemu_chr_fe_set_msgfds(&tpm_emu->ctrl_chr, fds + 1, 1);
 486
 487     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_DATAFD, &res, 0,
 488                              sizeof(res)) < 0 || res != 0) {
 489         error_report("tpm-emulator: Failed to send CMD_SET_DATAFD: %s",
 490                      strerror(errno));
 491         goto err_exit;
 492     }
 493
 494     tpm_emu->data_ioc = QIO_CHANNEL(qio_channel_socket_new_fd(fds[0], &err));
 495     if (err) {
 496         error_prepend(&err, "tpm-emulator: Failed to create io channel: ");
 497         error_report_err(err);
 498         goto err_exit;
 499     }
 500
 501     closesocket(fds[1]);
 502
 503     return 0;
 504
 505 err_exit:
 506     closesocket(fds[0]);
 507     closesocket(fds[1]);
 508     return -1;
 509 }
 510
 511 static int tpm_emulator_handle_device_opts(TPMEmulator *tpm_emu, QemuOpts *opts)
 512 {
 513     const char *value;
 514
 515     value = qemu_opt_get(opts, "chardev");
 516     if (value) {
 517         Error *err = NULL;
 518         Chardev *dev = qemu_chr_find(value);
 519
 520         if (!dev) {
 521             error_report("tpm-emulator: tpm chardev '%s' not found.", value);
 522             goto err;
 523         }
 524
 525         if (!qemu_chr_fe_init(&tpm_emu->ctrl_chr, dev, &err)) {
 526             error_prepend(&err, "tpm-emulator: No valid chardev found at '%s':",
 527                           value);
 528             error_report_err(err);
 529             goto err;
 530         }
 531
 532         tpm_emu->options->chardev = g_strdup(value);
 533     }
 534
 535     if (tpm_emulator_prepare_data_fd(tpm_emu) < 0) {
 536         goto err;
 537     }
 538
 539     /* FIXME: tpm_util_test_tpmdev() accepts only on socket fd, as it also used
 540      * by passthrough driver, which not yet using GIOChannel.
 541      */
 542     if (tpm_util_test_tpmdev(QIO_CHANNEL_SOCKET(tpm_emu->data_ioc)->fd,
 543                              &tpm_emu->tpm_version)) {
 544         error_report("'%s' is not emulating TPM device. Error: %s",
 545                       tpm_emu->options->chardev, strerror(errno));
 546         goto err;
 547     }
 548
 549     switch (tpm_emu->tpm_version) {
 550     case TPM_VERSION_1_2:
 551         trace_tpm_emulator_handle_device_opts_tpm12();
 552         break;
 553     case TPM_VERSION_2_0:
 554         trace_tpm_emulator_handle_device_opts_tpm2();
 555         break;
 556     default:
 557         trace_tpm_emulator_handle_device_opts_unspec();
 558     }
 559
 560     if (tpm_emulator_probe_caps(tpm_emu) ||
 561         tpm_emulator_check_caps(tpm_emu)) {
 562         goto err;
 563     }
 564
 565     return tpm_emulator_block_migration(tpm_emu);
 566
 567 err:
 568     trace_tpm_emulator_handle_device_opts_startup_error();
 569
 570     return -1;
 571 }
 572
 573 static TPMBackend *tpm_emulator_create(QemuOpts *opts)
 574 {
 575     TPMBackend *tb = TPM_BACKEND(object_new(TYPE_TPM_EMULATOR));
 576
 577     if (tpm_emulator_handle_device_opts(TPM_EMULATOR(tb), opts)) {
 578         object_unref(OBJECT(tb));
 579         return NULL;
 580     }
 581
 582     return tb;
 583 }
 584
 585 static TpmTypeOptions *tpm_emulator_get_tpm_options(TPMBackend *tb)
 586 {
 587     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 588     TpmTypeOptions *options = g_new0(TpmTypeOptions, 1);
 589
 590     options->type = TPM_TYPE_OPTIONS_KIND_EMULATOR;
 591     options->u.emulator.data = QAPI_CLONE(TPMEmulatorOptions, tpm_emu->options);
 592
 593     return options;
 594 }
 595
 596 static const QemuOptDesc tpm_emulator_cmdline_opts[] = {
 597     TPM_STANDARD_CMDLINE_OPTS,
 598     {
 599         .name = "chardev",
 600         .type = QEMU_OPT_STRING,
 601         .help = "Character device to use for out-of-band control messages",
 602     },
 603     { /* end of list */ },
 604 };
 605
 606 /*
 607  * Transfer a TPM state blob from the TPM into a provided buffer.
 608  *
 609  * @tpm_emu: TPMEmulator
 610  * @type: the type of blob to transfer
 611  * @tsb: the TPMSizeBuffer to fill with the blob
 612  * @flags: the flags to return to the caller
 613  */
 614 static int tpm_emulator_get_state_blob(TPMEmulator *tpm_emu,
 615                                        uint8_t type,
 616                                        TPMSizedBuffer *tsb,
 617                                        uint32_t *flags)
 618 {
 619     ptm_getstate pgs;
 620     ptm_res res;
 621     ssize_t n;
 622     uint32_t totlength, length;
 623
 624     tpm_sized_buffer_reset(tsb);
 625
 626     pgs.u.req.state_flags = cpu_to_be32(PTM_STATE_FLAG_DECRYPTED);
 627     pgs.u.req.type = cpu_to_be32(type);
 628     pgs.u.req.offset = 0;
 629
 630     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_GET_STATEBLOB,
 631                              &pgs, sizeof(pgs.u.req),
 632                              offsetof(ptm_getstate, u.resp.data)) < 0) {
 633         error_report("tpm-emulator: could not get state blob type %d : %s",
 634                      type, strerror(errno));
 635         return -1;
 636     }
 637
 638     res = be32_to_cpu(pgs.u.resp.tpm_result);
 639     if (res != 0 && (res & 0x800) == 0) {
 640         error_report("tpm-emulator: Getting the stateblob (type %d) failed "
 641                      "with a TPM error 0x%x", type, res);
 642         return -1;
 643     }
 644
 645     totlength = be32_to_cpu(pgs.u.resp.totlength);
 646     length = be32_to_cpu(pgs.u.resp.length);
 647     if (totlength != length) {
 648         error_report("tpm-emulator: Expecting to read %u bytes "
 649                      "but would get %u", totlength, length);
 650         return -1;
 651     }
 652
 653     *flags = be32_to_cpu(pgs.u.resp.state_flags);
 654
 655     if (totlength > 0) {
 656         tsb->buffer = g_try_malloc(totlength);
 657         if (!tsb->buffer) {
 658             error_report("tpm-emulator: Out of memory allocating %u bytes",
 659                          totlength);
 660             return -1;
 661         }
 662
 663         n = qemu_chr_fe_read_all(&tpm_emu->ctrl_chr, tsb->buffer, totlength);
 664         if (n != totlength) {
 665             error_report("tpm-emulator: Could not read stateblob (type %d); "
 666                          "expected %u bytes, got %zd",
 667                          type, totlength, n);
 668             return -1;
 669         }
 670     }
 671     tsb->size = totlength;
 672
 673     trace_tpm_emulator_get_state_blob(type, tsb->size, *flags);
 674
 675     return 0;
 676 }
 677
 678 static int tpm_emulator_get_state_blobs(TPMEmulator *tpm_emu)
 679 {
 680     TPMBlobBuffers *state_blobs = &tpm_emu->state_blobs;
 681
 682     if (tpm_emulator_get_state_blob(tpm_emu, PTM_BLOB_TYPE_PERMANENT,
 683                                     &state_blobs->permanent,
 684                                     &state_blobs->permanent_flags) < 0 ||
 685         tpm_emulator_get_state_blob(tpm_emu, PTM_BLOB_TYPE_VOLATILE,
 686                                     &state_blobs->volatil,
 687                                     &state_blobs->volatil_flags) < 0 ||
 688         tpm_emulator_get_state_blob(tpm_emu, PTM_BLOB_TYPE_SAVESTATE,
 689                                     &state_blobs->savestate,
 690                                     &state_blobs->savestate_flags) < 0) {
 691         goto err_exit;
 692     }
 693
 694     return 0;
 695
 696  err_exit:
 697     tpm_sized_buffer_reset(&state_blobs->volatil);
 698     tpm_sized_buffer_reset(&state_blobs->permanent);
 699     tpm_sized_buffer_reset(&state_blobs->savestate);
 700
 701     return -1;
 702 }
 703
 704 /*
 705  * Transfer a TPM state blob to the TPM emulator.
 706  *
 707  * @tpm_emu: TPMEmulator
 708  * @type: the type of TPM state blob to transfer
 709  * @tsb: TPMSizedBuffer containing the TPM state blob
 710  * @flags: Flags describing the (encryption) state of the TPM state blob
 711  */
 712 static int tpm_emulator_set_state_blob(TPMEmulator *tpm_emu,
 713                                        uint32_t type,
 714                                        TPMSizedBuffer *tsb,
 715                                        uint32_t flags)
 716 {
 717     ssize_t n;
 718     ptm_setstate pss;
 719     ptm_res tpm_result;
 720
 721     if (tsb->size == 0) {
 722         return 0;
 723     }
 724
 725     pss = (ptm_setstate) {
 726         .u.req.state_flags = cpu_to_be32(flags),
 727         .u.req.type = cpu_to_be32(type),
 728         .u.req.length = cpu_to_be32(tsb->size),
 729     };
 730
 731     /* write the header only */
 732     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_STATEBLOB, &pss,
 733                              offsetof(ptm_setstate, u.req.data), 0) < 0) {
 734         error_report("tpm-emulator: could not set state blob type %d : %s",
 735                      type, strerror(errno));
 736         return -1;
 737     }
 738
 739     /* now the body */
 740     n = qemu_chr_fe_write_all(&tpm_emu->ctrl_chr, tsb->buffer, tsb->size);
 741     if (n != tsb->size) {
 742         error_report("tpm-emulator: Writing the stateblob (type %d) "
 743                      "failed; could not write %u bytes, but only %zd",
 744                      type, tsb->size, n);
 745         return -1;
 746     }
 747
 748     /* now get the result */
 749     n = qemu_chr_fe_read_all(&tpm_emu->ctrl_chr,
 750                              (uint8_t *)&pss, sizeof(pss.u.resp));
 751     if (n != sizeof(pss.u.resp)) {
 752         error_report("tpm-emulator: Reading response from writing stateblob "
 753                      "(type %d) failed; expected %zu bytes, got %zd", type,
 754                      sizeof(pss.u.resp), n);
 755         return -1;
 756     }
 757
 758     tpm_result = be32_to_cpu(pss.u.resp.tpm_result);
 759     if (tpm_result != 0) {
 760         error_report("tpm-emulator: Setting the stateblob (type %d) failed "
 761                      "with a TPM error 0x%x", type, tpm_result);
 762         return -1;
 763     }
 764
 765     trace_tpm_emulator_set_state_blob(type, tsb->size, flags);
 766
 767     return 0;
 768 }
 769
 770 /*
 771  * Set all the TPM state blobs.
 772  *
 773  * Returns a negative errno code in case of error.
 774  */
 775 static int tpm_emulator_set_state_blobs(TPMBackend *tb)
 776 {
 777     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 778     TPMBlobBuffers *state_blobs = &tpm_emu->state_blobs;
 779
 780     trace_tpm_emulator_set_state_blobs();
 781
 782     if (tpm_emulator_stop_tpm(tb) < 0) {
 783         trace_tpm_emulator_set_state_blobs_error("Could not stop TPM");
 784         return -EIO;
 785     }
 786
 787     if (tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_PERMANENT,
 788                                     &state_blobs->permanent,
 789                                     state_blobs->permanent_flags) < 0 ||
 790         tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_VOLATILE,
 791                                     &state_blobs->volatil,
 792                                     state_blobs->volatil_flags) < 0 ||
 793         tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_SAVESTATE,
 794                                     &state_blobs->savestate,
 795                                     state_blobs->savestate_flags) < 0) {
 796         return -EIO;
 797     }
 798
 799     trace_tpm_emulator_set_state_blobs_done();
 800
 801     return 0;
 802 }
 803
 804 static int tpm_emulator_pre_save(void *opaque)
 805 {
 806     TPMBackend *tb = opaque;
 807     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
 808
 809     trace_tpm_emulator_pre_save();
 810
 811     tpm_backend_finish_sync(tb);
 812
 813     /* get the state blobs from the TPM */
 814     return tpm_emulator_get_state_blobs(tpm_emu);
 815 }
 816
 817 /*
 818  * Load the TPM state blobs into the TPM.
 819  *
 820  * Returns negative errno codes in case of error.
 821  */
 822 static int tpm_emulator_post_load(void *opaque, int version_id)
 823 {
 824     TPMBackend *tb = opaque;
 825     int ret;
 826
 827     ret = tpm_emulator_set_state_blobs(tb);
 828     if (ret < 0) {
 829         return ret;
 830     }
 831
 832     if (tpm_emulator_startup_tpm_resume(tb, 0, true) < 0) {
 833         return -EIO;
 834     }
 835
 836     return 0;
 837 }
 838
 839 static const VMStateDescription vmstate_tpm_emulator = {
 840     .name = "tpm-emulator",
 841     .version_id = 0,
 842     .pre_save = tpm_emulator_pre_save,
 843     .post_load = tpm_emulator_post_load,
 844     .fields = (VMStateField[]) {
 845         VMSTATE_UINT32(state_blobs.permanent_flags, TPMEmulator),
 846         VMSTATE_UINT32(state_blobs.permanent.size, TPMEmulator),
 847         VMSTATE_VBUFFER_ALLOC_UINT32(state_blobs.permanent.buffer,
 848                                      TPMEmulator, 0, 0,
 849                                      state_blobs.permanent.size),
 850
 851         VMSTATE_UINT32(state_blobs.volatil_flags, TPMEmulator),
 852         VMSTATE_UINT32(state_blobs.volatil.size, TPMEmulator),
 853         VMSTATE_VBUFFER_ALLOC_UINT32(state_blobs.volatil.buffer,
 854                                      TPMEmulator, 0, 0,
 855                                      state_blobs.volatil.size),
 856
 857         VMSTATE_UINT32(state_blobs.savestate_flags, TPMEmulator),
 858         VMSTATE_UINT32(state_blobs.savestate.size, TPMEmulator),
 859         VMSTATE_VBUFFER_ALLOC_UINT32(state_blobs.savestate.buffer,
 860                                      TPMEmulator, 0, 0,
 861                                      state_blobs.savestate.size),
 862
 863         VMSTATE_END_OF_LIST()
 864     }
 865 };
 866
 867 static void tpm_emulator_inst_init(Object *obj)
 868 {
 869     TPMEmulator *tpm_emu = TPM_EMULATOR(obj);
 870
 871     trace_tpm_emulator_inst_init();
 872
 873     tpm_emu->options = g_new0(TPMEmulatorOptions, 1);
 874     tpm_emu->cur_locty_number = ~0;
 875     qemu_mutex_init(&tpm_emu->mutex);
 876
 877     vmstate_register(NULL, -1, &vmstate_tpm_emulator, obj);
 878 }
 879
 880 /*
 881  * Gracefully shut down the external TPM
 882  */
 883 static void tpm_emulator_shutdown(TPMEmulator *tpm_emu)
 884 {
 885     ptm_res res;
 886
 887     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SHUTDOWN, &res, 0, sizeof(res)) < 0) {
 888         error_report("tpm-emulator: Could not cleanly shutdown the TPM: %s",
 889                      strerror(errno));
 890     } else if (res != 0) {
 891         error_report("tpm-emulator: TPM result for sutdown: 0x%x",
 892                      be32_to_cpu(res));
 893     }
 894 }
 895
 896 static void tpm_emulator_inst_finalize(Object *obj)
 897 {
 898     TPMEmulator *tpm_emu = TPM_EMULATOR(obj);
 899     TPMBlobBuffers *state_blobs = &tpm_emu->state_blobs;
 900
 901     tpm_emulator_shutdown(tpm_emu);
 902
 903     object_unref(OBJECT(tpm_emu->data_ioc));
 904
 905     qemu_chr_fe_deinit(&tpm_emu->ctrl_chr, false);
 906
 907     qapi_free_TPMEmulatorOptions(tpm_emu->options);
 908
 909     if (tpm_emu->migration_blocker) {
 910         migrate_del_blocker(tpm_emu->migration_blocker);
 911         error_free(tpm_emu->migration_blocker);
 912     }
 913
 914     tpm_sized_buffer_reset(&state_blobs->volatil);
 915     tpm_sized_buffer_reset(&state_blobs->permanent);
 916     tpm_sized_buffer_reset(&state_blobs->savestate);
 917
 918     qemu_mutex_destroy(&tpm_emu->mutex);
 919
 920     vmstate_unregister(NULL, &vmstate_tpm_emulator, obj);
 921 }
 922
 923 static void tpm_emulator_class_init(ObjectClass *klass, void *data)
 924 {
 925     TPMBackendClass *tbc = TPM_BACKEND_CLASS(klass);
 926
 927     tbc->type = TPM_TYPE_EMULATOR;
 928     tbc->opts = tpm_emulator_cmdline_opts;
 929     tbc->desc = "TPM emulator backend driver";
 930     tbc->create = tpm_emulator_create;
 931     tbc->startup_tpm = tpm_emulator_startup_tpm;
 932     tbc->cancel_cmd = tpm_emulator_cancel_cmd;
 933     tbc->get_tpm_established_flag = tpm_emulator_get_tpm_established_flag;
 934     tbc->reset_tpm_established_flag = tpm_emulator_reset_tpm_established_flag;
 935     tbc->get_tpm_version = tpm_emulator_get_tpm_version;
 936     tbc->get_buffer_size = tpm_emulator_get_buffer_size;
 937     tbc->get_tpm_options = tpm_emulator_get_tpm_options;
 938
 939     tbc->handle_request = tpm_emulator_handle_request;
 940 }
 941
 942 static const TypeInfo tpm_emulator_info = {
 943     .name = TYPE_TPM_EMULATOR,
 944     .parent = TYPE_TPM_BACKEND,
 945     .instance_size = sizeof(TPMEmulator),
 946     .class_init = tpm_emulator_class_init,
 947     .instance_init = tpm_emulator_inst_init,
 948     .instance_finalize = tpm_emulator_inst_finalize,
 949 };
 950
 951 static void tpm_emulator_register(void)
 952 {
 953     type_register_static(&tpm_emulator_info);
 954 }
 955
 956 type_init(tpm_emulator_register)