xref: /openbmc/linux/drivers/char/tpm/tpm_ftpm_tee.c (revision ae36453a)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright (C) Microsoft Corporation
4  *
5  * Implements a firmware TPM as described here:
6  * https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/
7  *
8  * A reference implementation is available here:
9  * https://github.com/microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM
10  */
11 
12 #include <linux/acpi.h>
13 #include <linux/of.h>
14 #include <linux/platform_device.h>
15 #include <linux/tee_drv.h>
16 #include <linux/tpm.h>
17 #include <linux/uuid.h>
18 
19 #include "tpm.h"
20 #include "tpm_ftpm_tee.h"
21 
22 /*
23  * TA_FTPM_UUID: BC50D971-D4C9-42C4-82CB-343FB7F37896
24  *
25  * Randomly generated, and must correspond to the GUID on the TA side.
26  * Defined here in the reference implementation:
27  * https://github.com/microsoft/ms-tpm-20-ref/blob/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/include/fTPM.h#L42
28  */
29 static const uuid_t ftpm_ta_uuid =
30 	UUID_INIT(0xBC50D971, 0xD4C9, 0x42C4,
31 		  0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96);
32 
33 /**
34  * ftpm_tee_tpm_op_recv() - retrieve fTPM response.
35  * @chip:	the tpm_chip description as specified in driver/char/tpm/tpm.h.
36  * @buf:	the buffer to store data.
37  * @count:	the number of bytes to read.
38  *
39  * Return:
40  *	In case of success the number of bytes received.
41  *	On failure, -errno.
42  */
ftpm_tee_tpm_op_recv(struct tpm_chip * chip,u8 * buf,size_t count)43 static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
44 {
45 	struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent);
46 	size_t len;
47 
48 	len = pvt_data->resp_len;
49 	if (count < len) {
50 		dev_err(&chip->dev,
51 			"%s: Invalid size in recv: count=%zd, resp_len=%zd\n",
52 			__func__, count, len);
53 		return -EIO;
54 	}
55 
56 	memcpy(buf, pvt_data->resp_buf, len);
57 	pvt_data->resp_len = 0;
58 
59 	return len;
60 }
61 
62 /**
63  * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory.
64  * @chip:	the tpm_chip description as specified in driver/char/tpm/tpm.h
65  * @buf:	the buffer to send.
66  * @len:	the number of bytes to send.
67  *
68  * Return:
69  *	In case of success, returns 0.
70  *	On failure, -errno
71  */
ftpm_tee_tpm_op_send(struct tpm_chip * chip,u8 * buf,size_t len)72 static int ftpm_tee_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t len)
73 {
74 	struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent);
75 	size_t resp_len;
76 	int rc;
77 	u8 *temp_buf;
78 	struct tpm_header *resp_header;
79 	struct tee_ioctl_invoke_arg transceive_args;
80 	struct tee_param command_params[4];
81 	struct tee_shm *shm = pvt_data->shm;
82 
83 	if (len > MAX_COMMAND_SIZE) {
84 		dev_err(&chip->dev,
85 			"%s: len=%zd exceeds MAX_COMMAND_SIZE supported by fTPM TA\n",
86 			__func__, len);
87 		return -EIO;
88 	}
89 
90 	memset(&transceive_args, 0, sizeof(transceive_args));
91 	memset(command_params, 0, sizeof(command_params));
92 	pvt_data->resp_len = 0;
93 
94 	/* Invoke FTPM_OPTEE_TA_SUBMIT_COMMAND function of fTPM TA */
95 	transceive_args = (struct tee_ioctl_invoke_arg) {
96 		.func = FTPM_OPTEE_TA_SUBMIT_COMMAND,
97 		.session = pvt_data->session,
98 		.num_params = 4,
99 	};
100 
101 	/* Fill FTPM_OPTEE_TA_SUBMIT_COMMAND parameters */
102 	command_params[0] = (struct tee_param) {
103 		.attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT,
104 		.u.memref = {
105 			.shm = shm,
106 			.size = len,
107 			.shm_offs = 0,
108 		},
109 	};
110 
111 	temp_buf = tee_shm_get_va(shm, 0);
112 	if (IS_ERR(temp_buf)) {
113 		dev_err(&chip->dev, "%s: tee_shm_get_va failed for transmit\n",
114 			__func__);
115 		return PTR_ERR(temp_buf);
116 	}
117 	memset(temp_buf, 0, (MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE));
118 	memcpy(temp_buf, buf, len);
119 
120 	command_params[1] = (struct tee_param) {
121 		.attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT,
122 		.u.memref = {
123 			.shm = shm,
124 			.size = MAX_RESPONSE_SIZE,
125 			.shm_offs = MAX_COMMAND_SIZE,
126 		},
127 	};
128 
129 	rc = tee_client_invoke_func(pvt_data->ctx, &transceive_args,
130 				    command_params);
131 	if ((rc < 0) || (transceive_args.ret != 0)) {
132 		dev_err(&chip->dev, "%s: SUBMIT_COMMAND invoke error: 0x%x\n",
133 			__func__, transceive_args.ret);
134 		return (rc < 0) ? rc : transceive_args.ret;
135 	}
136 
137 	temp_buf = tee_shm_get_va(shm, command_params[1].u.memref.shm_offs);
138 	if (IS_ERR(temp_buf)) {
139 		dev_err(&chip->dev, "%s: tee_shm_get_va failed for receive\n",
140 			__func__);
141 		return PTR_ERR(temp_buf);
142 	}
143 
144 	resp_header = (struct tpm_header *)temp_buf;
145 	resp_len = be32_to_cpu(resp_header->length);
146 
147 	/* sanity check resp_len */
148 	if (resp_len < TPM_HEADER_SIZE) {
149 		dev_err(&chip->dev, "%s: tpm response header too small\n",
150 			__func__);
151 		return -EIO;
152 	}
153 	if (resp_len > MAX_RESPONSE_SIZE) {
154 		dev_err(&chip->dev,
155 			"%s: resp_len=%zd exceeds MAX_RESPONSE_SIZE\n",
156 			__func__, resp_len);
157 		return -EIO;
158 	}
159 
160 	/* sanity checks look good, cache the response */
161 	memcpy(pvt_data->resp_buf, temp_buf, resp_len);
162 	pvt_data->resp_len = resp_len;
163 
164 	return 0;
165 }
166 
ftpm_tee_tpm_op_cancel(struct tpm_chip * chip)167 static void ftpm_tee_tpm_op_cancel(struct tpm_chip *chip)
168 {
169 	/* not supported */
170 }
171 
ftpm_tee_tpm_op_status(struct tpm_chip * chip)172 static u8 ftpm_tee_tpm_op_status(struct tpm_chip *chip)
173 {
174 	return 0;
175 }
176 
ftpm_tee_tpm_req_canceled(struct tpm_chip * chip,u8 status)177 static bool ftpm_tee_tpm_req_canceled(struct tpm_chip *chip, u8 status)
178 {
179 	return false;
180 }
181 
182 static const struct tpm_class_ops ftpm_tee_tpm_ops = {
183 	.flags = TPM_OPS_AUTO_STARTUP,
184 	.recv = ftpm_tee_tpm_op_recv,
185 	.send = ftpm_tee_tpm_op_send,
186 	.cancel = ftpm_tee_tpm_op_cancel,
187 	.status = ftpm_tee_tpm_op_status,
188 	.req_complete_mask = 0,
189 	.req_complete_val = 0,
190 	.req_canceled = ftpm_tee_tpm_req_canceled,
191 };
192 
193 /*
194  * Check whether this driver supports the fTPM TA in the TEE instance
195  * represented by the params (ver/data) to this function.
196  */
ftpm_tee_match(struct tee_ioctl_version_data * ver,const void * data)197 static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data)
198 {
199 	/*
200 	 * Currently this driver only support GP Complaint OPTEE based fTPM TA
201 	 */
202 	if ((ver->impl_id == TEE_IMPL_ID_OPTEE) &&
203 		(ver->gen_caps & TEE_GEN_CAP_GP))
204 		return 1;
205 	else
206 		return 0;
207 }
208 
209 /**
210  * ftpm_tee_probe() - initialize the fTPM
211  * @pdev: the platform_device description.
212  *
213  * Return:
214  *	On success, 0. On failure, -errno.
215  */
ftpm_tee_probe(struct device * dev)216 static int ftpm_tee_probe(struct device *dev)
217 {
218 	int rc;
219 	struct tpm_chip *chip;
220 	struct ftpm_tee_private *pvt_data = NULL;
221 	struct tee_ioctl_open_session_arg sess_arg;
222 
223 	pvt_data = devm_kzalloc(dev, sizeof(struct ftpm_tee_private),
224 				GFP_KERNEL);
225 	if (!pvt_data)
226 		return -ENOMEM;
227 
228 	dev_set_drvdata(dev, pvt_data);
229 
230 	/* Open context with TEE driver */
231 	pvt_data->ctx = tee_client_open_context(NULL, ftpm_tee_match, NULL,
232 						NULL);
233 	if (IS_ERR(pvt_data->ctx)) {
234 		if (PTR_ERR(pvt_data->ctx) == -ENOENT)
235 			return -EPROBE_DEFER;
236 		dev_err(dev, "%s: tee_client_open_context failed\n", __func__);
237 		return PTR_ERR(pvt_data->ctx);
238 	}
239 
240 	/* Open a session with fTPM TA */
241 	memset(&sess_arg, 0, sizeof(sess_arg));
242 	export_uuid(sess_arg.uuid, &ftpm_ta_uuid);
243 	sess_arg.clnt_login = TEE_IOCTL_LOGIN_PUBLIC;
244 	sess_arg.num_params = 0;
245 
246 	rc = tee_client_open_session(pvt_data->ctx, &sess_arg, NULL);
247 	if ((rc < 0) || (sess_arg.ret != 0)) {
248 		dev_err(dev, "%s: tee_client_open_session failed, err=%x\n",
249 			__func__, sess_arg.ret);
250 		rc = -EINVAL;
251 		goto out_tee_session;
252 	}
253 	pvt_data->session = sess_arg.session;
254 
255 	/* Allocate dynamic shared memory with fTPM TA */
256 	pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx,
257 						 MAX_COMMAND_SIZE +
258 						 MAX_RESPONSE_SIZE);
259 	if (IS_ERR(pvt_data->shm)) {
260 		dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__);
261 		rc = -ENOMEM;
262 		goto out_shm_alloc;
263 	}
264 
265 	/* Allocate new struct tpm_chip instance */
266 	chip = tpm_chip_alloc(dev, &ftpm_tee_tpm_ops);
267 	if (IS_ERR(chip)) {
268 		dev_err(dev, "%s: tpm_chip_alloc failed\n", __func__);
269 		rc = PTR_ERR(chip);
270 		goto out_chip_alloc;
271 	}
272 
273 	pvt_data->chip = chip;
274 	pvt_data->chip->flags |= TPM_CHIP_FLAG_TPM2;
275 
276 	/* Create a character device for the fTPM */
277 	rc = tpm_chip_register(pvt_data->chip);
278 	if (rc) {
279 		dev_err(dev, "%s: tpm_chip_register failed with rc=%d\n",
280 			__func__, rc);
281 		goto out_chip;
282 	}
283 
284 	return 0;
285 
286 out_chip:
287 	put_device(&pvt_data->chip->dev);
288 out_chip_alloc:
289 	tee_shm_free(pvt_data->shm);
290 out_shm_alloc:
291 	tee_client_close_session(pvt_data->ctx, pvt_data->session);
292 out_tee_session:
293 	tee_client_close_context(pvt_data->ctx);
294 
295 	return rc;
296 }
297 
ftpm_plat_tee_probe(struct platform_device * pdev)298 static int ftpm_plat_tee_probe(struct platform_device *pdev)
299 {
300 	struct device *dev = &pdev->dev;
301 
302 	return ftpm_tee_probe(dev);
303 }
304 
305 /**
306  * ftpm_tee_remove() - remove the TPM device
307  * @pdev: the platform_device description.
308  *
309  * Return:
310  *	0 always.
311  */
ftpm_tee_remove(struct device * dev)312 static int ftpm_tee_remove(struct device *dev)
313 {
314 	struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev);
315 
316 	/* Release the chip */
317 	tpm_chip_unregister(pvt_data->chip);
318 
319 	/* frees chip */
320 	put_device(&pvt_data->chip->dev);
321 
322 	/* Free the shared memory pool */
323 	tee_shm_free(pvt_data->shm);
324 
325 	/* close the existing session with fTPM TA*/
326 	tee_client_close_session(pvt_data->ctx, pvt_data->session);
327 
328 	/* close the context with TEE driver */
329 	tee_client_close_context(pvt_data->ctx);
330 
331 	/* memory allocated with devm_kzalloc() is freed automatically */
332 
333 	return 0;
334 }
335 
ftpm_plat_tee_remove(struct platform_device * pdev)336 static void ftpm_plat_tee_remove(struct platform_device *pdev)
337 {
338 	struct device *dev = &pdev->dev;
339 
340 	ftpm_tee_remove(dev);
341 }
342 
343 /**
344  * ftpm_tee_shutdown() - shutdown the TPM device
345  * @pdev: the platform_device description.
346  */
ftpm_plat_tee_shutdown(struct platform_device * pdev)347 static void ftpm_plat_tee_shutdown(struct platform_device *pdev)
348 {
349 	struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev);
350 
351 	tee_shm_free(pvt_data->shm);
352 	tee_client_close_session(pvt_data->ctx, pvt_data->session);
353 	tee_client_close_context(pvt_data->ctx);
354 }
355 
356 static const struct of_device_id of_ftpm_tee_ids[] = {
357 	{ .compatible = "microsoft,ftpm" },
358 	{ }
359 };
360 MODULE_DEVICE_TABLE(of, of_ftpm_tee_ids);
361 
362 static struct platform_driver ftpm_tee_plat_driver = {
363 	.driver = {
364 		.name = "ftpm-tee",
365 		.of_match_table = of_match_ptr(of_ftpm_tee_ids),
366 	},
367 	.shutdown = ftpm_plat_tee_shutdown,
368 	.probe = ftpm_plat_tee_probe,
369 	.remove_new = ftpm_plat_tee_remove,
370 };
371 
372 /* UUID of the fTPM TA */
373 static const struct tee_client_device_id optee_ftpm_id_table[] = {
374 	{UUID_INIT(0xbc50d971, 0xd4c9, 0x42c4,
375 		   0x82, 0xcb, 0x34, 0x3f, 0xb7, 0xf3, 0x78, 0x96)},
376 	{}
377 };
378 
379 MODULE_DEVICE_TABLE(tee, optee_ftpm_id_table);
380 
381 static struct tee_client_driver ftpm_tee_driver = {
382 	.id_table	= optee_ftpm_id_table,
383 	.driver		= {
384 		.name		= "optee-ftpm",
385 		.bus		= &tee_bus_type,
386 		.probe		= ftpm_tee_probe,
387 		.remove		= ftpm_tee_remove,
388 	},
389 };
390 
ftpm_mod_init(void)391 static int __init ftpm_mod_init(void)
392 {
393 	int rc;
394 
395 	rc = platform_driver_register(&ftpm_tee_plat_driver);
396 	if (rc)
397 		return rc;
398 
399 	rc = driver_register(&ftpm_tee_driver.driver);
400 	if (rc) {
401 		platform_driver_unregister(&ftpm_tee_plat_driver);
402 		return rc;
403 	}
404 
405 	return 0;
406 }
407 
ftpm_mod_exit(void)408 static void __exit ftpm_mod_exit(void)
409 {
410 	platform_driver_unregister(&ftpm_tee_plat_driver);
411 	driver_unregister(&ftpm_tee_driver.driver);
412 }
413 
414 module_init(ftpm_mod_init);
415 module_exit(ftpm_mod_exit);
416 
417 MODULE_AUTHOR("Thirupathaiah Annapureddy <thiruan@microsoft.com>");
418 MODULE_DESCRIPTION("TPM Driver for fTPM TA in TEE");
419 MODULE_LICENSE("GPL v2");
420