Commit 17b1af77 authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Stefan Berger
Browse files

tpm-emulator: protect concurrent ctrl_chr access 



The control chardev is being used from the data thread to set the
locality of the next request. Altough the chr has a write mutex, we
may potentially read the reply from another thread request.

Add a mutex to protect from concurrent control commands.

Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: default avatarStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: default avatarStefan Berger <stefanb@linux.vnet.ibm.com>
parent 83e83c34

hw/tpm/tpm_emulator.c

+28 −16
Original line number Diff line number Diff line
@@ -71,15 +71,21 @@ typedef struct TPMEmulator { 
    ptm_cap caps; /* capabilities of the TPM */

    uint8_t cur_locty_number; /* last set locality */

    Error *migration_blocker;



    QemuMutex mutex;

} TPMEmulator;





static int tpm_emulator_ctrlcmd(CharBackend *dev, unsigned long cmd, void *msg,

static int tpm_emulator_ctrlcmd(TPMEmulator *tpm, unsigned long cmd, void *msg,

                                size_t msg_len_in, size_t msg_len_out)

{

    CharBackend *dev = &tpm->ctrl_chr;

    uint32_t cmd_no = cpu_to_be32(cmd);

    ssize_t n = sizeof(uint32_t) + msg_len_in;

    uint8_t *buf = NULL;

    int ret = -1;



    qemu_mutex_lock(&tpm->mutex);



    buf = g_alloca(n);

    memcpy(buf, &cmd_no, sizeof(cmd_no));
@@ -87,17 +93,21 @@ static int tpm_emulator_ctrlcmd(CharBackend *dev, unsigned long cmd, void *msg, 


    n = qemu_chr_fe_write_all(dev, buf, n);

    if (n <= 0) {

        return -1;

        goto end;

    }



    if (msg_len_out != 0) {

        n = qemu_chr_fe_read_all(dev, msg, msg_len_out);

        if (n <= 0) {

            return -1;

            goto end;

        }

    }



    return 0;

    ret = 0;



end:

    qemu_mutex_unlock(&tpm->mutex);

    return ret;

}



static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
@@ -154,7 +164,7 @@ static int tpm_emulator_set_locality(TPMEmulator *tpm_emu, uint8_t locty_number, 


    DPRINTF("setting locality : 0x%x", locty_number);

    loc.u.req.loc = locty_number;

    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_SET_LOCALITY, &loc,

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_LOCALITY, &loc,

                             sizeof(loc), sizeof(loc)) < 0) {

        error_setg(errp, "tpm-emulator: could not set locality : %s",

                   strerror(errno));
@@ -202,7 +212,7 @@ error: 
static int tpm_emulator_probe_caps(TPMEmulator *tpm_emu)

{

    DPRINTF("%s", __func__);

    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_GET_CAPABILITY,

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_GET_CAPABILITY,

                             &tpm_emu->caps, 0, sizeof(tpm_emu->caps)) < 0) {

        error_report("tpm-emulator: probing failed : %s", strerror(errno));

        return -1;
@@ -254,7 +264,7 @@ static int tpm_emulator_startup_tpm(TPMBackend *tb) 
    ptm_res res;



    DPRINTF("%s", __func__);

    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_INIT, &init, sizeof(init),

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_INIT, &init, sizeof(init),

                             sizeof(init)) < 0) {

        error_report("tpm-emulator: could not send INIT: %s",

                     strerror(errno));
@@ -278,7 +288,7 @@ static bool tpm_emulator_get_tpm_established_flag(TPMBackend *tb) 
    ptm_est est;



    DPRINTF("%s", __func__);

    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_GET_TPMESTABLISHED, &est,

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_GET_TPMESTABLISHED, &est,

                             0, sizeof(est)) < 0) {

        error_report("tpm-emulator: Could not get the TPM established flag: %s",

                     strerror(errno));
@@ -302,7 +312,7 @@ static int tpm_emulator_reset_tpm_established_flag(TPMBackend *tb, 
    }



    reset_est.u.req.loc = tpm_emu->cur_locty_number;

    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_RESET_TPMESTABLISHED,

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_RESET_TPMESTABLISHED,

                             &reset_est, sizeof(reset_est),

                             sizeof(reset_est)) < 0) {

        error_report("tpm-emulator: Could not reset the establishment bit: %s",
@@ -330,7 +340,7 @@ static void tpm_emulator_cancel_cmd(TPMBackend *tb) 
        return;

    }



    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_CANCEL_TPM_CMD, &res, 0,

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_CANCEL_TPM_CMD, &res, 0,

                             sizeof(res)) < 0) {

        error_report("tpm-emulator: Could not cancel command: %s",

                     strerror(errno));
@@ -378,8 +388,8 @@ static int tpm_emulator_prepare_data_fd(TPMEmulator *tpm_emu) 


    qemu_chr_fe_set_msgfds(&tpm_emu->ctrl_chr, fds + 1, 1);



    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_SET_DATAFD, &res, 0,

                    sizeof(res)) || res != 0) {

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_DATAFD, &res, 0,

                             sizeof(res)) < 0 || res != 0) {

        error_report("tpm-emulator: Failed to send CMD_SET_DATAFD: %s",

                     strerror(errno));

        goto err_exit;
@@ -501,6 +511,7 @@ static void tpm_emulator_inst_init(Object *obj) 
    DPRINTF("%s", __func__);

    tpm_emu->options = g_new0(TPMEmulatorOptions, 1);

    tpm_emu->cur_locty_number = ~0;

    qemu_mutex_init(&tpm_emu->mutex);

}



/*
@@ -510,8 +521,7 @@ static void tpm_emulator_shutdown(TPMEmulator *tpm_emu) 
{

    ptm_res res;



    if (tpm_emulator_ctrlcmd(&tpm_emu->ctrl_chr, CMD_SHUTDOWN, &res, 0,

                             sizeof(res)) < 0) {

    if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SHUTDOWN, &res, 0, sizeof(res)) < 0) {

        error_report("tpm-emulator: Could not cleanly shutdown the TPM: %s",

                     strerror(errno));

    } else if (res != 0) {
@@ -536,6 +546,8 @@ static void tpm_emulator_inst_finalize(Object *obj) 
        migrate_del_blocker(tpm_emu->migration_blocker);

        error_free(tpm_emu->migration_blocker);

    }



    qemu_mutex_destroy(&tpm_emu->mutex);

}



static void tpm_emulator_class_init(ObjectClass *klass, void *data)