1 /*
2 * Copyright (C) 2016 Intel Corporation
3 *
4 * Authors:
5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
6 *
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8 *
9 * This file contains TPM2 protocol implementations of the commands
10 * used by the kernel internally.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; version 2
15 * of the License.
16 */
17
18 #include <linux/gfp.h>
19 #include <asm/unaligned.h>
20 #include "tpm.h"
21
22 enum tpm2_handle_types {
23 TPM2_HT_HMAC_SESSION = 0x02000000,
24 TPM2_HT_POLICY_SESSION = 0x03000000,
25 TPM2_HT_TRANSIENT = 0x80000000,
26 };
27
28 struct tpm2_context {
29 __be64 sequence;
30 __be32 saved_handle;
31 __be32 hierarchy;
32 __be16 blob_size;
33 } __packed;
34
tpm2_flush_sessions(struct tpm_chip * chip,struct tpm_space * space)35 static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
36 {
37 int i;
38
39 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
40 if (space->session_tbl[i])
41 tpm2_flush_context_cmd(chip, space->session_tbl[i],
42 TPM_TRANSMIT_NESTED);
43 }
44 }
45
tpm2_init_space(struct tpm_space * space,unsigned int buf_size)46 int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
47 {
48 space->context_buf = kzalloc(buf_size, GFP_KERNEL);
49 if (!space->context_buf)
50 return -ENOMEM;
51
52 space->session_buf = kzalloc(buf_size, GFP_KERNEL);
53 if (space->session_buf == NULL) {
54 kfree(space->context_buf);
55 /* Prevent caller getting a dangling pointer. */
56 space->context_buf = NULL;
57 return -ENOMEM;
58 }
59
60 space->buf_size = buf_size;
61 return 0;
62 }
63
tpm2_del_space(struct tpm_chip * chip,struct tpm_space * space)64 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
65 {
66 mutex_lock(&chip->tpm_mutex);
67 tpm2_flush_sessions(chip, space);
68 mutex_unlock(&chip->tpm_mutex);
69 kfree(space->context_buf);
70 kfree(space->session_buf);
71 }
72
tpm2_load_context(struct tpm_chip * chip,u8 * buf,unsigned int * offset,u32 * handle)73 static int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
74 unsigned int *offset, u32 *handle)
75 {
76 struct tpm_buf tbuf;
77 struct tpm2_context *ctx;
78 unsigned int body_size;
79 int rc;
80
81 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD);
82 if (rc)
83 return rc;
84
85 ctx = (struct tpm2_context *)&buf[*offset];
86 body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size);
87 tpm_buf_append(&tbuf, &buf[*offset], body_size);
88
89 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 4,
90 TPM_TRANSMIT_NESTED, NULL);
91 if (rc < 0) {
92 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
93 __func__, rc);
94 tpm_buf_destroy(&tbuf);
95 return -EFAULT;
96 } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE ||
97 rc == TPM2_RC_REFERENCE_H0) {
98 /*
99 * TPM_RC_HANDLE means that the session context can't
100 * be loaded because of an internal counter mismatch
101 * that makes the TPM think there might have been a
102 * replay. This might happen if the context was saved
103 * and loaded outside the space.
104 *
105 * TPM_RC_REFERENCE_H0 means the session has been
106 * flushed outside the space
107 */
108 *handle = 0;
109 tpm_buf_destroy(&tbuf);
110 return -ENOENT;
111 } else if (rc > 0) {
112 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
113 __func__, rc);
114 tpm_buf_destroy(&tbuf);
115 return -EFAULT;
116 }
117
118 *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]);
119 *offset += body_size;
120
121 tpm_buf_destroy(&tbuf);
122 return 0;
123 }
124
tpm2_save_context(struct tpm_chip * chip,u32 handle,u8 * buf,unsigned int buf_size,unsigned int * offset)125 static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf,
126 unsigned int buf_size, unsigned int *offset)
127 {
128 struct tpm_buf tbuf;
129 unsigned int body_size;
130 int rc;
131
132 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE);
133 if (rc)
134 return rc;
135
136 tpm_buf_append_u32(&tbuf, handle);
137
138 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 0,
139 TPM_TRANSMIT_NESTED, NULL);
140 if (rc < 0) {
141 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
142 __func__, rc);
143 tpm_buf_destroy(&tbuf);
144 return -EFAULT;
145 } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) {
146 tpm_buf_destroy(&tbuf);
147 return -ENOENT;
148 } else if (rc) {
149 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
150 __func__, rc);
151 tpm_buf_destroy(&tbuf);
152 return -EFAULT;
153 }
154
155 body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE;
156 if ((*offset + body_size) > buf_size) {
157 dev_warn(&chip->dev, "%s: out of backing storage\n", __func__);
158 tpm_buf_destroy(&tbuf);
159 return -ENOMEM;
160 }
161
162 memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size);
163 *offset += body_size;
164 tpm_buf_destroy(&tbuf);
165 return 0;
166 }
167
tpm2_flush_space(struct tpm_chip * chip)168 static void tpm2_flush_space(struct tpm_chip *chip)
169 {
170 struct tpm_space *space = &chip->work_space;
171 int i;
172
173 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++)
174 if (space->context_tbl[i] && ~space->context_tbl[i])
175 tpm2_flush_context_cmd(chip, space->context_tbl[i],
176 TPM_TRANSMIT_NESTED);
177
178 tpm2_flush_sessions(chip, space);
179 }
180
tpm2_load_space(struct tpm_chip * chip)181 static int tpm2_load_space(struct tpm_chip *chip)
182 {
183 struct tpm_space *space = &chip->work_space;
184 unsigned int offset;
185 int i;
186 int rc;
187
188 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
189 if (!space->context_tbl[i])
190 continue;
191
192 /* sanity check, should never happen */
193 if (~space->context_tbl[i]) {
194 dev_err(&chip->dev, "context table is inconsistent");
195 return -EFAULT;
196 }
197
198 rc = tpm2_load_context(chip, space->context_buf, &offset,
199 &space->context_tbl[i]);
200 if (rc)
201 return rc;
202 }
203
204 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
205 u32 handle;
206
207 if (!space->session_tbl[i])
208 continue;
209
210 rc = tpm2_load_context(chip, space->session_buf,
211 &offset, &handle);
212 if (rc == -ENOENT) {
213 /* load failed, just forget session */
214 space->session_tbl[i] = 0;
215 } else if (rc) {
216 tpm2_flush_space(chip);
217 return rc;
218 }
219 if (handle != space->session_tbl[i]) {
220 dev_warn(&chip->dev, "session restored to wrong handle\n");
221 tpm2_flush_space(chip);
222 return -EFAULT;
223 }
224 }
225
226 return 0;
227 }
228
tpm2_map_to_phandle(struct tpm_space * space,void * handle)229 static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle)
230 {
231 u32 vhandle = be32_to_cpup((__be32 *)handle);
232 u32 phandle;
233 int i;
234
235 i = 0xFFFFFF - (vhandle & 0xFFFFFF);
236 if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i])
237 return false;
238
239 phandle = space->context_tbl[i];
240 *((__be32 *)handle) = cpu_to_be32(phandle);
241 return true;
242 }
243
tpm2_map_command(struct tpm_chip * chip,u32 cc,u8 * cmd)244 static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd)
245 {
246 struct tpm_space *space = &chip->work_space;
247 unsigned int nr_handles;
248 u32 attrs;
249 __be32 *handle;
250 int i;
251
252 i = tpm2_find_cc(chip, cc);
253 if (i < 0)
254 return -EINVAL;
255
256 attrs = chip->cc_attrs_tbl[i];
257 nr_handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0);
258
259 handle = (__be32 *)&cmd[TPM_HEADER_SIZE];
260 for (i = 0; i < nr_handles; i++, handle++) {
261 if ((be32_to_cpu(*handle) & 0xFF000000) == TPM2_HT_TRANSIENT) {
262 if (!tpm2_map_to_phandle(space, handle))
263 return -EINVAL;
264 }
265 }
266
267 return 0;
268 }
269
tpm2_prepare_space(struct tpm_chip * chip,struct tpm_space * space,u32 cc,u8 * cmd)270 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
271 u8 *cmd)
272 {
273 int rc;
274
275 if (!space)
276 return 0;
277
278 memcpy(&chip->work_space.context_tbl, &space->context_tbl,
279 sizeof(space->context_tbl));
280 memcpy(&chip->work_space.session_tbl, &space->session_tbl,
281 sizeof(space->session_tbl));
282 memcpy(chip->work_space.context_buf, space->context_buf,
283 space->buf_size);
284 memcpy(chip->work_space.session_buf, space->session_buf,
285 space->buf_size);
286
287 rc = tpm2_load_space(chip);
288 if (rc) {
289 tpm2_flush_space(chip);
290 return rc;
291 }
292
293 rc = tpm2_map_command(chip, cc, cmd);
294 if (rc) {
295 tpm2_flush_space(chip);
296 return rc;
297 }
298
299 return 0;
300 }
301
tpm2_add_session(struct tpm_chip * chip,u32 handle)302 static bool tpm2_add_session(struct tpm_chip *chip, u32 handle)
303 {
304 struct tpm_space *space = &chip->work_space;
305 int i;
306
307 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++)
308 if (space->session_tbl[i] == 0)
309 break;
310
311 if (i == ARRAY_SIZE(space->session_tbl))
312 return false;
313
314 space->session_tbl[i] = handle;
315 return true;
316 }
317
tpm2_map_to_vhandle(struct tpm_space * space,u32 phandle,bool alloc)318 static u32 tpm2_map_to_vhandle(struct tpm_space *space, u32 phandle, bool alloc)
319 {
320 int i;
321
322 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
323 if (alloc) {
324 if (!space->context_tbl[i]) {
325 space->context_tbl[i] = phandle;
326 break;
327 }
328 } else if (space->context_tbl[i] == phandle)
329 break;
330 }
331
332 if (i == ARRAY_SIZE(space->context_tbl))
333 return 0;
334
335 return TPM2_HT_TRANSIENT | (0xFFFFFF - i);
336 }
337
tpm2_map_response_header(struct tpm_chip * chip,u32 cc,u8 * rsp,size_t len)338 static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp,
339 size_t len)
340 {
341 struct tpm_space *space = &chip->work_space;
342 struct tpm_output_header *header = (void *)rsp;
343 u32 phandle;
344 u32 phandle_type;
345 u32 vhandle;
346 u32 attrs;
347 int i;
348
349 if (be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS)
350 return 0;
351
352 i = tpm2_find_cc(chip, cc);
353 /* sanity check, should never happen */
354 if (i < 0)
355 return -EFAULT;
356
357 attrs = chip->cc_attrs_tbl[i];
358 if (!((attrs >> TPM2_CC_ATTR_RHANDLE) & 1))
359 return 0;
360
361 phandle = be32_to_cpup((__be32 *)&rsp[TPM_HEADER_SIZE]);
362 phandle_type = phandle & 0xFF000000;
363
364 switch (phandle_type) {
365 case TPM2_HT_TRANSIENT:
366 vhandle = tpm2_map_to_vhandle(space, phandle, true);
367 if (!vhandle)
368 goto out_no_slots;
369
370 *(__be32 *)&rsp[TPM_HEADER_SIZE] = cpu_to_be32(vhandle);
371 break;
372 case TPM2_HT_HMAC_SESSION:
373 case TPM2_HT_POLICY_SESSION:
374 if (!tpm2_add_session(chip, phandle))
375 goto out_no_slots;
376 break;
377 default:
378 dev_err(&chip->dev, "%s: unknown handle 0x%08X\n",
379 __func__, phandle);
380 break;
381 };
382
383 return 0;
384 out_no_slots:
385 tpm2_flush_context_cmd(chip, phandle, TPM_TRANSMIT_NESTED);
386 dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__,
387 phandle);
388 return -ENOMEM;
389 }
390
391 struct tpm2_cap_handles {
392 u8 more_data;
393 __be32 capability;
394 __be32 count;
395 __be32 handles[];
396 } __packed;
397
tpm2_map_response_body(struct tpm_chip * chip,u32 cc,u8 * rsp,size_t len)398 static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp,
399 size_t len)
400 {
401 struct tpm_space *space = &chip->work_space;
402 struct tpm_output_header *header = (void *)rsp;
403 struct tpm2_cap_handles *data;
404 u32 phandle;
405 u32 phandle_type;
406 u32 vhandle;
407 int i;
408 int j;
409
410 if (cc != TPM2_CC_GET_CAPABILITY ||
411 be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) {
412 return 0;
413 }
414
415 if (len < TPM_HEADER_SIZE + 9)
416 return -EFAULT;
417
418 data = (void *)&rsp[TPM_HEADER_SIZE];
419 if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
420 return 0;
421
422 if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4)
423 return -EFAULT;
424
425 if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
426 return -EFAULT;
427
428 for (i = 0, j = 0; i < be32_to_cpu(data->count); i++) {
429 phandle = be32_to_cpup((__be32 *)&data->handles[i]);
430 phandle_type = phandle & 0xFF000000;
431
432 switch (phandle_type) {
433 case TPM2_HT_TRANSIENT:
434 vhandle = tpm2_map_to_vhandle(space, phandle, false);
435 if (!vhandle)
436 break;
437
438 data->handles[j] = cpu_to_be32(vhandle);
439 j++;
440 break;
441
442 default:
443 data->handles[j] = cpu_to_be32(phandle);
444 j++;
445 break;
446 }
447
448 }
449
450 header->length = cpu_to_be32(TPM_HEADER_SIZE + 9 + 4 * j);
451 data->count = cpu_to_be32(j);
452 return 0;
453 }
454
tpm2_save_space(struct tpm_chip * chip)455 static int tpm2_save_space(struct tpm_chip *chip)
456 {
457 struct tpm_space *space = &chip->work_space;
458 unsigned int offset;
459 int i;
460 int rc;
461
462 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
463 if (!(space->context_tbl[i] && ~space->context_tbl[i]))
464 continue;
465
466 rc = tpm2_save_context(chip, space->context_tbl[i],
467 space->context_buf, space->buf_size,
468 &offset);
469 if (rc == -ENOENT) {
470 space->context_tbl[i] = 0;
471 continue;
472 } else if (rc)
473 return rc;
474
475 tpm2_flush_context_cmd(chip, space->context_tbl[i],
476 TPM_TRANSMIT_NESTED);
477 space->context_tbl[i] = ~0;
478 }
479
480 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
481 if (!space->session_tbl[i])
482 continue;
483
484 rc = tpm2_save_context(chip, space->session_tbl[i],
485 space->session_buf, space->buf_size,
486 &offset);
487 if (rc == -ENOENT) {
488 /* handle error saving session, just forget it */
489 space->session_tbl[i] = 0;
490 } else if (rc < 0) {
491 tpm2_flush_space(chip);
492 return rc;
493 }
494 }
495
496 return 0;
497 }
498
tpm2_commit_space(struct tpm_chip * chip,struct tpm_space * space,u32 cc,u8 * buf,size_t * bufsiz)499 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
500 u32 cc, u8 *buf, size_t *bufsiz)
501 {
502 struct tpm_output_header *header = (void *)buf;
503 int rc;
504
505 if (!space)
506 return 0;
507
508 rc = tpm2_map_response_header(chip, cc, buf, *bufsiz);
509 if (rc) {
510 tpm2_flush_space(chip);
511 return rc;
512 }
513
514 rc = tpm2_map_response_body(chip, cc, buf, *bufsiz);
515 if (rc) {
516 tpm2_flush_space(chip);
517 return rc;
518 }
519
520 rc = tpm2_save_space(chip);
521 if (rc) {
522 tpm2_flush_space(chip);
523 return rc;
524 }
525
526 *bufsiz = be32_to_cpu(header->length);
527
528 memcpy(&space->context_tbl, &chip->work_space.context_tbl,
529 sizeof(space->context_tbl));
530 memcpy(&space->session_tbl, &chip->work_space.session_tbl,
531 sizeof(space->session_tbl));
532 memcpy(space->context_buf, chip->work_space.context_buf,
533 space->buf_size);
534 memcpy(space->session_buf, chip->work_space.session_buf,
535 space->buf_size);
536
537 return 0;
538 }
539
540 /*
541 * Put the reference to the main device.
542 */
tpm_devs_release(struct device * dev)543 static void tpm_devs_release(struct device *dev)
544 {
545 struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs);
546
547 /* release the master device reference */
548 put_device(&chip->dev);
549 }
550
551 /*
552 * Remove the device file for exposed TPM spaces and release the device
553 * reference. This may also release the reference to the master device.
554 */
tpm_devs_remove(struct tpm_chip * chip)555 void tpm_devs_remove(struct tpm_chip *chip)
556 {
557 cdev_device_del(&chip->cdevs, &chip->devs);
558 put_device(&chip->devs);
559 }
560
561 /*
562 * Add a device file to expose TPM spaces. Also take a reference to the
563 * main device.
564 */
tpm_devs_add(struct tpm_chip * chip)565 int tpm_devs_add(struct tpm_chip *chip)
566 {
567 int rc;
568
569 device_initialize(&chip->devs);
570 chip->devs.parent = chip->dev.parent;
571 chip->devs.class = tpmrm_class;
572
573 /*
574 * Get extra reference on main device to hold on behalf of devs.
575 * This holds the chip structure while cdevs is in use. The
576 * corresponding put is in the tpm_devs_release.
577 */
578 get_device(&chip->dev);
579 chip->devs.release = tpm_devs_release;
580 chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES);
581 cdev_init(&chip->cdevs, &tpmrm_fops);
582 chip->cdevs.owner = THIS_MODULE;
583
584 rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num);
585 if (rc)
586 goto err_put_devs;
587
588 rc = cdev_device_add(&chip->cdevs, &chip->devs);
589 if (rc) {
590 dev_err(&chip->devs,
591 "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n",
592 dev_name(&chip->devs), MAJOR(chip->devs.devt),
593 MINOR(chip->devs.devt), rc);
594 goto err_put_devs;
595 }
596
597 return 0;
598
599 err_put_devs:
600 put_device(&chip->devs);
601
602 return rc;
603 }
604