[Qemu-devel] [PATCH] Add a TPM Passthrough backend driver implementation

[Andreas Niederl]

This patch is based of off version 7 of Stefan Berger's patch series
  "Qemu Trusted Platform Module (TPM) integration"
and adds a new backend driver for it.

This patch adds a passthrough backend driver for passing commands sent to the
emulated TPM device directly to a TPM device opened on the host machine.

Thus it is possible to use a hardware TPM device in a system running on QEMU,
providing the ability to access a TPM in a special state (e.g. after a Trusted
Boot).

This functionality is being used in the acTvSM Trusted Virtualization Platform
which is available on [1].

Usage example:
  qemu-system-x86_64 -tpmdev passthrough,id=tpm0,path=/dev/tpm0 \
                     -device tpm-tis,tpmdev=tpm0 \
                     -cdrom test.iso -boot d

Regards,
Andreas Niederl

[1] http://trustedjava.sourceforge.net/

Signed-off-by: Andreas Niederl <address@hidden>
---
 Makefile.target      |    2 +-
 hw/tpm_passthrough.c |  450 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tpm.c                |    1 +
 tpm.h                |    1 +
 4 files changed, 453 insertions(+), 1 deletions(-)
 create mode 100644 hw/tpm_passthrough.c

diff --git a/Makefile.target b/Makefile.target
index f4d42d4..7f19f28 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -233,7 +233,7 @@ obj-i386-y += debugcon.o multiboot.o
 obj-i386-y += pc_piix.o
 obj-i386-$(CONFIG_KVM) += kvmclock.o
 obj-i386-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o
-obj-i386-$(CONFIG_TPM) += tpm_tis.o sha1.o tpm_null.o
+obj-i386-$(CONFIG_TPM) += tpm_tis.o sha1.o tpm_null.o tpm_passthrough.o
 obj-i386-$(CONFIG_TPM_BUILTIN) += tpm_builtin.o
 
 ifdef CONFIG_TPM_BUILTIN
diff --git a/hw/tpm_passthrough.c b/hw/tpm_passthrough.c
new file mode 100644
index 0000000..aabfea2
--- /dev/null
+++ b/hw/tpm_passthrough.c
@@ -0,0 +1,450 @@
+/*
+ *  passthrough TPM driver
+ *
+ *  Copyright (c) 2010, 2011 IBM Corporation
+ *  Copyright (c) 2010, 2011 Stefan Berger
+ *
+ *  Copyright (C) 2011 IAIK, Graz University of Technology
+ *    Author: Andreas Niederl
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+
+#include "qemu-common.h"
+#include "tpm.h"
+#include "hw/hw.h"
+#include "hw/tpm_tis.h"
+#include "hw/pc.h"
+
+
+//#define DEBUG_TPM
+//#define DEBUG_TPM_SR /* suspend - resume */
+
+
+/* data structures */
+
+typedef struct ThreadParams {
+    TPMState *tpm_state;
+
+    TPMRecvDataCB *recv_data_callback;
+
+    int fd;
+} ThreadParams;
+
+
+/* local variables */
+
+static QemuThread thread;
+
+static bool thread_terminate = false;
+static bool thread_running = false;
+
+static ThreadParams tpm_thread_params;
+
+static const unsigned char tpm_std_fatal_error_response[10] = {
+    0x00, 0xc4, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x09 /* TPM_FAIL */
+};
+
+static char dev_description[80];
+
+static char tpm_dev[255];
+static int tpmfd = -1;
+
+static bool had_startup_error = false;
+
+
+/* borrowed from qemu-char.c */
+static int unix_write(int fd, const uint8_t *buf, uint32_t len)
+{
+    int ret, len1;
+
+    len1 = len;
+    while (len1 > 0) {
+        ret = write(fd, buf, len1);
+        if (ret < 0) {
+            if (errno != EINTR && errno != EAGAIN)
+                return -1;
+        } else if (ret == 0) {
+            break;
+        } else {
+            buf  += ret;
+            len1 -= ret;
+        }
+    }
+    return len - len1;
+}
+
+static int unix_read(int fd, uint8_t *buf, uint32_t len)
+{
+    int ret, len1;
+    uint8_t *buf1;
+
+    len1 = len;
+    buf1 = buf;
+    while ((len1 > 0) && (ret = read(fd, buf1, len1)) != 0) {
+        if (ret < 0) {
+            if (errno != EINTR && errno != EAGAIN)
+                return -1;
+        } else {
+            buf1 += ret;
+            len1 -= ret;
+        }
+    }
+    return len - len1;
+}
+
+
+static void tpm_write_std_fatal_error_response(uint8_t *out,
+        uint8_t *in, uint32_t in_len)
+{
+    memcpy(out, tpm_std_fatal_error_response,
+            sizeof(tpm_std_fatal_error_response));
+    out[1] = (in_len > 2 && in[1] >= 0xc1 && in[1] <= 0xc3)
+        ? in[1] + 3
+        : 0xc4;
+}
+
+static void *tpm_passthrough_main_loop(void *d)
+{
+    ThreadParams *thr_parms = d;
+    uint32_t in_len, out_len;
+    uint8_t *in, *out;
+    uint8_t locty;
+    int ret;
+
+#ifdef DEBUG_TPM
+    fprintf(stderr, "tpm: THREAD IS STARTING\n");
+#endif
+
+    /* start command processing */
+    while (!thread_terminate) {
+        /* receive and handle commands */
+        in_len = 0;
+        do {
+#ifdef DEBUG_TPM
+            fprintf(stderr, "tpm: waiting for commands...\n");
+#endif
+
+            if (thread_terminate) {
+                break;
+            }
+
+            qemu_mutex_lock(&thr_parms->tpm_state->state_lock);
+
+            /* in case we were to slow and missed the signal, the
+               to_tpm_execute boolean tells us about a pending command */
+            if (!thr_parms->tpm_state->to_tpm_execute) {
+                qemu_cond_wait(&thr_parms->tpm_state->to_tpm_cond,
+                        &thr_parms->tpm_state->state_lock);
+            }
+
+            thr_parms->tpm_state->to_tpm_execute = false;
+
+            qemu_mutex_unlock(&thr_parms->tpm_state->state_lock);
+
+            if (thread_terminate) {
+                break;
+            }
+
+            locty = thr_parms->tpm_state->command_locty;
+
+            in      = thr_parms->tpm_state->loc[locty].w_buffer.buffer;
+            in_len  = thr_parms->tpm_state->loc[locty].w_offset;
+            out     = thr_parms->tpm_state->loc[locty].r_buffer.buffer;
+            out_len = thr_parms->tpm_state->loc[locty].r_buffer.size;
+
+            ret = unix_write(tpmfd, in, in_len);
+            if (ret < 0) {
+                fprintf(stderr, "tpm: error while transmitting data to host 
tpm"
+                        ": %s (%i)\n",
+                        strerror(errno), errno);
+                tpm_write_std_fatal_error_response(out, in, in_len);
+                continue;
+            }
+
+            ret = unix_read(tpmfd, out, out_len);
+            if (ret < 0) {
+                fprintf(stderr, "tpm: error while reading data from host tpm"
+                        ": %s (%i)\n",
+                        strerror(errno), errno);
+                tpm_write_std_fatal_error_response(out, in, in_len);
+                continue;
+            }
+
+            thr_parms->recv_data_callback(thr_parms->tpm_state, locty);
+        } while (in_len > 0);
+    }
+
+#ifdef DEBUG_TPM
+    fprintf(stderr, "tpm: THREAD IS ENDING\n");
+#endif
+
+    thread_running = false;
+
+    return NULL;
+}
+
+
+static void tpm_passthrough_terminate_tpm_thread(void)
+{
+    if (!thread_running) {
+        return;
+    }
+
+#if defined DEBUG_TPM || defined DEBUG_TPM_SR
+    fprintf(stderr, "tpm: TERMINATING RUNNING TPM THREAD\n");
+#endif
+
+    if (!thread_terminate) {
+        thread_terminate = true;
+
+        qemu_mutex_lock  (&tpm_thread_params.tpm_state->state_lock);
+        qemu_cond_signal (&tpm_thread_params.tpm_state->to_tpm_cond);
+        qemu_mutex_unlock(&tpm_thread_params.tpm_state->state_lock);
+
+        while (thread_running) {
+            usleep(100000);
+        }
+        memset(&thread, 0, sizeof(thread));
+    }
+}
+
+
+static void tpm_passthrough_tpm_atexit(void)
+{
+    tpm_passthrough_terminate_tpm_thread();
+
+    close(tpmfd);
+    tpmfd = -1;
+}
+
+
+/**
+ * Start the TPM (thread). If it had been started before, then terminate
+ * and start it again.
+ */
+static int tpm_passthrough_startup_tpm(void)
+{
+    /* terminate a running TPM */
+    tpm_passthrough_terminate_tpm_thread();
+
+    /* reset the flag so the thread keeps on running */
+    thread_terminate = false;
+
+    qemu_thread_create(&thread, tpm_passthrough_main_loop, &tpm_thread_params);
+
+    thread_running = true;
+
+    return 0;
+}
+
+
+static int tpm_passthrough_do_startup_tpm(void)
+{
+    int rc;
+
+    rc = tpm_passthrough_startup_tpm();
+    if (rc) {
+        had_startup_error = true;
+    }
+    return rc;
+}
+
+
+static int tpm_passthrough_early_startup_tpm(void)
+{
+    return tpm_passthrough_do_startup_tpm();
+}
+
+
+static int tpm_passthrough_late_startup_tpm(void)
+{
+    return tpm_passthrough_do_startup_tpm();
+}
+
+
+static void tpm_passthrough_reset(void)
+{
+#if defined DEBUG_TPM || defined DEBUG_TPM_SR
+    fprintf(stderr, "tpm: CALL TO TPM_RESET!\n");
+#endif
+
+    tpm_passthrough_terminate_tpm_thread();
+
+    had_startup_error = false;
+}
+
+
+/*
+ * Since the null driver does not have much persistent storage
+ * there is not much to do here...
+ */
+static int tpm_passthrough_instantiate_with_volatile_data(TPMState *s)
+{
+    if (thread_running) {
+#ifdef DEBUG_TPM_SR
+        fprintf(stderr, "tpm: This is resume of a SNAPSHOT\n");
+#endif
+        tis_reset_for_snapshot_resume(s);
+    }
+
+    return 0;
+}
+
+
+static int tpm_passthrough_init(TPMState *s, TPMRecvDataCB *recv_data_cb)
+{
+    tpm_thread_params.tpm_state = s;
+    tpm_thread_params.recv_data_callback = recv_data_cb;
+
+    tpmfd = open(tpm_dev, O_RDWR);
+    if (tpmfd < 0) {
+        fprintf(stderr,
+                "Cannot open device '%s' from tpm's path option.\n",
+                tpm_dev);
+        goto err_exit;
+    }
+
+    atexit(tpm_passthrough_tpm_atexit);
+
+    return 0;
+
+err_exit:
+    if (tpmfd >= 0) {
+        close(tpmfd);
+        tpmfd = -1;
+    }
+    return 1;
+}
+
+
+static bool tpm_passthrough_get_tpm_established_flag(void)
+{
+    return false;
+}
+
+
+static bool tpm_passthrough_get_startup_error(void)
+{
+    return had_startup_error;
+}
+
+
+/**
+ * This function is called by tpm_tis.c once the TPM has processed
+ * the last command and returned the response to the TIS.
+ */
+static int tpm_passthrough_save_volatile_data(void)
+{
+    return 0;
+}
+
+
+static size_t tpm_passthrough_realloc_buffer(TPMSizedBuffer *sb)
+{
+    size_t wanted_size = 4096;
+
+    if (sb->size != wanted_size) {
+        sb->buffer = qemu_realloc(sb->buffer, wanted_size);
+        if (sb->buffer != NULL) {
+            sb->size = wanted_size;
+        } else {
+            sb->size = 0;
+        }
+    }
+    return sb->size;
+}
+
+
+static const char *tpm_passthrough_create_desc(void)
+{
+    static int done;
+
+    if (!done) {
+        snprintf(dev_description, sizeof(dev_description),
+                "Passthrough TPM backend driver");
+        done = 1;
+    }
+
+    return dev_description;
+}
+
+
+static TPMBackend *tpm_passthrough_create(QemuOpts *opts, const char *id,
+        const char *model)
+{
+    TPMBackend *driver;
+    const char *value;
+
+    driver = qemu_malloc(sizeof(TPMBackend));
+    if (!driver) {
+        fprintf(stderr, "Could not allocate memory.\n");
+        return NULL;
+    }
+    driver->id = qemu_strdup(id);
+    driver->model = NULL;
+    if (model)
+        driver->model = qemu_strdup(model);
+    driver->ops = &tpm_passthrough_driver;
+
+    value = qemu_opt_get(opts, "path");
+    if (value) {
+        if (access(value, R_OK|W_OK)) {
+            fprintf(stderr,
+                    "Cannot access device '%s' from tpm's path option.\n",
+                    value);
+            goto err_exit;
+        }
+        strncpy(tpm_dev, value, sizeof(tpm_dev));
+    } else {
+        fprintf(stderr, "-tpm is missing path= parameter\n");
+        goto err_exit;
+    }
+
+    return driver;
+
+err_exit:
+    qemu_free(driver->id);
+    if (driver->model)
+        qemu_free(driver->model);
+    qemu_free(driver);
+    return NULL;
+}
+
+
+static void tpm_passthrough_destroy(TPMBackend *driver)
+{
+    qemu_free(driver->id);
+    if (driver->model)
+        qemu_free(driver->model);
+    qemu_free(driver);
+}
+
+
+TPMDriverOps tpm_passthrough_driver = {
+    .id                       = "passthrough",
+    .desc                     = tpm_passthrough_create_desc,
+    .job_for_main_thread      = NULL,
+    .create                   = tpm_passthrough_create,
+    .destroy                  = tpm_passthrough_destroy,
+    .init                     = tpm_passthrough_init,
+    .early_startup_tpm        = tpm_passthrough_early_startup_tpm,
+    .late_startup_tpm         = tpm_passthrough_late_startup_tpm,
+    .realloc_buffer           = tpm_passthrough_realloc_buffer,
+    .reset                    = tpm_passthrough_reset,
+    .had_startup_error        = tpm_passthrough_get_startup_error,
+    .save_volatile_data       = tpm_passthrough_save_volatile_data,
+    .load_volatile_data       = tpm_passthrough_instantiate_with_volatile_data,
+    .get_tpm_established_flag = tpm_passthrough_get_tpm_established_flag,
+};
diff --git a/tpm.c b/tpm.c
index b75fe5c..edcbfe7 100644
--- a/tpm.c
+++ b/tpm.c
@@ -28,6 +28,7 @@ static const TPMDriverOps *bes[] = {
 #ifdef CONFIG_TPM_BUILTIN
     &tpm_builtin,
 #endif
+    &tpm_passthrough_driver,
     NULL,
 };
 
diff --git a/tpm.h b/tpm.h
index d00e599..01cae9a 100644
--- a/tpm.h
+++ b/tpm.h
@@ -143,5 +143,6 @@ void tpm_measure_buffer(const void *buffer, long length,
 
 extern TPMDriverOps tpm_null_driver;
 extern TPMDriverOps tpm_builtin;
+extern TPMDriverOps tpm_passthrough_driver;
 
 #endif /* _HW_TPM_CONFIG_H */
-- 
1.7.6