qemu/tpm.c

263 lines
5.6 KiB
C
Raw Normal View History

/*
* TPM configuration
*
* Copyright (C) 2011-2013 IBM Corporation
*
* Authors:
* Stefan Berger <stefanb@us.ibm.com>
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
* See the COPYING file in the top-level directory.
*
* Based on net.c
*/
#include "qemu/osdep.h"
#include "qapi/qmp/qerror.h"
#include "sysemu/tpm_backend.h"
#include "sysemu/tpm.h"
#include "qemu/config-file.h"
#include "qemu/error-report.h"
#include "qmp-commands.h"
static QLIST_HEAD(, TPMBackend) tpm_backends =
QLIST_HEAD_INITIALIZER(tpm_backends);
static bool tpm_models[TPM_MODEL__MAX];
void tpm_register_model(enum TpmModel model)
{
tpm_models[model] = true;
}
Add a TPM Passthrough backend driver implementation This patch is based of off version 9 of Stefan Berger's patch series "QEMU Trusted Platform Module (TPM) integration" and adds a new backend driver for it. This patch adds a passthrough backend driver for passing commands sent to the emulated TPM device directly to a TPM device opened on the host machine. Thus it is possible to use a hardware TPM device in a system running on QEMU, providing the ability to access a TPM in a special state (e.g. after a Trusted Boot). This functionality is being used in the acTvSM Trusted Virtualization Platform which is available on [1]. Usage example: qemu-system-x86_64 -tpmdev passthrough,id=tpm0,path=/dev/tpm0 \ -device tpm-tis,tpmdev=tpm0 \ -cdrom test.iso -boot d Some notes about the host TPM: The TPM needs to be enabled and activated. If that's not the case one has to go through the BIOS/UEFI and enable and activate that TPM for TPM commands to work as expected. It may be necessary to boot the kernel using tpm_tis.force=1 in the boot command line or 'modprobe tpm_tis force=1' in case of using it as a module. Regards, Andreas Niederl, Stefan Berger [1] http://trustedjava.sourceforge.net/ Signed-off-by: Andreas Niederl <andreas.niederl@iaik.tugraz.at> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Reviewed-by: Joel Schopp <jschopp@linux.vnet.ibm.com> Message-id: 1361987275-26289-6-git-send-email-stefanb@linux.vnet.ibm.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-02-27 21:47:53 +04:00
static const TPMBackendClass *
tpm_be_find_by_type(enum TpmType type)
{
ObjectClass *oc;
char *typename = g_strdup_printf("tpm-%s", TpmType_str(type));
oc = object_class_by_name(typename);
g_free(typename);
if (!object_class_dynamic_cast(oc, TYPE_TPM_BACKEND)) {
return NULL;
}
return TPM_BACKEND_CLASS(oc);
}
/*
* Walk the list of available TPM backend drivers and display them on the
* screen.
*/
static void tpm_display_backend_drivers(void)
{
int i;
fprintf(stderr, "Supported TPM types (choose only one):\n");
for (i = 0; i < TPM_TYPE__MAX; i++) {
const TPMBackendClass *bc = tpm_be_find_by_type(i);
if (!bc) {
continue;
}
fprintf(stderr, "%12s %s\n", TpmType_str(i), bc->desc);
}
fprintf(stderr, "\n");
}
/*
* Find the TPM with the given Id
*/
TPMBackend *qemu_find_tpm_be(const char *id)
{
TPMBackend *drv;
if (id) {
QLIST_FOREACH(drv, &tpm_backends, list) {
if (!strcmp(drv->id, id)) {
return drv;
}
}
}
return NULL;
}
static int tpm_init_tpmdev(void *dummy, QemuOpts *opts, Error **errp)
{
const char *value;
const char *id;
const TPMBackendClass *be;
TPMBackend *drv;
Error *local_err = NULL;
int i;
if (!QLIST_EMPTY(&tpm_backends)) {
error_report("Only one TPM is allowed.");
return 1;
}
id = qemu_opts_id(opts);
if (id == NULL) {
error_report(QERR_MISSING_PARAMETER, "id");
return 1;
}
value = qemu_opt_get(opts, "type");
if (!value) {
error_report(QERR_MISSING_PARAMETER, "type");
tpm_display_backend_drivers();
return 1;
}
i = qapi_enum_parse(&TpmType_lookup, value, -1, NULL);
be = i >= 0 ? tpm_be_find_by_type(i) : NULL;
if (be == NULL) {
error_report(QERR_INVALID_PARAMETER_VALUE,
"type", "a TPM backend type");
tpm_display_backend_drivers();
return 1;
}
/* validate backend specific opts */
qemu_opts_validate(opts, be->opts, &local_err);
if (local_err) {
error_report_err(local_err);
return 1;
}
drv = be->create(opts);
if (!drv) {
return 1;
}
drv->id = g_strdup(id);
QLIST_INSERT_HEAD(&tpm_backends, drv, list);
return 0;
}
/*
* Walk the list of TPM backend drivers that are in use and call their
* destroy function to have them cleaned up.
*/
void tpm_cleanup(void)
{
TPMBackend *drv, *next;
QLIST_FOREACH_SAFE(drv, &tpm_backends, list, next) {
QLIST_REMOVE(drv, list);
object_unref(OBJECT(drv));
}
}
/*
* Initialize the TPM. Process the tpmdev command line options describing the
* TPM backend.
*/
int tpm_init(void)
{
if (qemu_opts_foreach(qemu_find_opts("tpmdev"),
tpm_init_tpmdev, NULL, NULL)) {
return -1;
}
return 0;
}
/*
* Parse the TPM configuration options.
* To display all available TPM backends the user may use '-tpmdev help'
*/
int tpm_config_parse(QemuOptsList *opts_list, const char *optarg)
{
QemuOpts *opts;
if (!strcmp(optarg, "help")) {
tpm_display_backend_drivers();
return -1;
}
QemuOpts: Wean off qerror_report_err() qerror_report_err() is a transitional interface to help with converting existing monitor commands to QMP. It should not be used elsewhere. The only remaining user in qemu-option.c is qemu_opts_parse(). Is it used in QMP context? If not, we can simply replace qerror_report_err() by error_report_err(). The uses in qemu-img.c, qemu-io.c, qemu-nbd.c and under tests/ are clearly not in QMP context. The uses in vl.c aren't either, because the only QMP command handlers there are qmp_query_status() and qmp_query_machines(), and they don't call it. Remaining uses: * drive_def(): Command line -drive and such, HMP drive_add and pci_add * hmp_chardev_add(): HMP chardev-add * monitor_parse_command(): HMP core * tmp_config_parse(): Command line -tpmdev * net_host_device_add(): HMP host_net_add * net_client_parse(): Command line -net and -netdev * qemu_global_option(): Command line -global * vnc_parse_func(): Command line -display, -vnc, default display, HMP change, QMP change. Bummer. * qemu_pci_hot_add_nic(): HMP pci_add * usb_net_init(): Command line -usbdevice, HMP usb_add Propagate errors through qemu_opts_parse(). Create a convenience function qemu_opts_parse_noisily() that passes errors to error_report_err(). Switch all non-QMP users outside tests to it. That leaves vnc_parse_func(). Propagate errors through it. Since I'm touching it anyway, rename it to vnc_parse(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
2015-02-13 14:50:26 +03:00
opts = qemu_opts_parse_noisily(opts_list, optarg, true);
if (!opts) {
return -1;
}
return 0;
}
/*
* Walk the list of active TPM backends and collect information about them
* following the schema description in qapi-schema.json.
*/
TPMInfoList *qmp_query_tpm(Error **errp)
{
TPMBackend *drv;
TPMInfoList *info, *head = NULL, *cur_item = NULL;
QLIST_FOREACH(drv, &tpm_backends, list) {
if (!drv->tpmif) {
continue;
}
info = g_new0(TPMInfoList, 1);
info->value = tpm_backend_query_tpm(drv);
if (!cur_item) {
head = cur_item = info;
} else {
cur_item->next = info;
cur_item = info;
}
}
return head;
}
TpmTypeList *qmp_query_tpm_types(Error **errp)
{
unsigned int i = 0;
TpmTypeList *head = NULL, *prev = NULL, *cur_item;
for (i = 0; i < TPM_TYPE__MAX; i++) {
if (!tpm_be_find_by_type(i)) {
continue;
}
cur_item = g_new0(TpmTypeList, 1);
cur_item->value = i;
if (prev) {
prev->next = cur_item;
}
if (!head) {
head = cur_item;
}
prev = cur_item;
}
return head;
}
TpmModelList *qmp_query_tpm_models(Error **errp)
{
unsigned int i = 0;
TpmModelList *head = NULL, *prev = NULL, *cur_item;
for (i = 0; i < TPM_MODEL__MAX; i++) {
if (!tpm_models[i]) {
continue;
}
cur_item = g_new0(TpmModelList, 1);
cur_item->value = i;
if (prev) {
prev->next = cur_item;
}
if (!head) {
head = cur_item;
}
prev = cur_item;
}
return head;
}