1 /* 2 * Copyright (C) 2016 Intel Corporation 3 * 4 * Authors: 5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> 6 * 7 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 8 * 9 * This file contains TPM2 protocol implementations of the commands 10 * used by the kernel internally. 11 * 12 * This program is free software; you can redistribute it and/or 13 * modify it under the terms of the GNU General Public License 14 * as published by the Free Software Foundation; version 2 15 * of the License. 16 */ 17 18 #include <linux/gfp.h> 19 #include <asm/unaligned.h> 20 #include "tpm.h" 21 22 enum tpm2_handle_types { 23 TPM2_HT_HMAC_SESSION = 0x02000000, 24 TPM2_HT_POLICY_SESSION = 0x03000000, 25 TPM2_HT_TRANSIENT = 0x80000000, 26 }; 27 28 struct tpm2_context { 29 __be64 sequence; 30 __be32 saved_handle; 31 __be32 hierarchy; 32 __be16 blob_size; 33 } __packed; 34 35 static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) 36 { 37 int i; 38 39 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 40 if (space->session_tbl[i]) 41 tpm2_flush_context_cmd(chip, space->session_tbl[i], 42 TPM_TRANSMIT_UNLOCKED); 43 } 44 } 45 46 int tpm2_init_space(struct tpm_space *space) 47 { 48 space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); 49 if (!space->context_buf) 50 return -ENOMEM; 51 52 space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); 53 if (space->session_buf == NULL) { 54 kfree(space->context_buf); 55 return -ENOMEM; 56 } 57 58 return 0; 59 } 60 61 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) 62 { 63 mutex_lock(&chip->tpm_mutex); 64 tpm2_flush_sessions(chip, space); 65 mutex_unlock(&chip->tpm_mutex); 66 kfree(space->context_buf); 67 kfree(space->session_buf); 68 } 69 70 static int tpm2_load_context(struct tpm_chip *chip, u8 *buf, 71 unsigned int *offset, u32 *handle) 72 { 73 struct tpm_buf tbuf; 74 struct tpm2_context *ctx; 75 unsigned int body_size; 76 int rc; 77 78 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD); 79 if (rc) 80 return rc; 81 82 ctx = (struct tpm2_context *)&buf[*offset]; 83 body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size); 84 tpm_buf_append(&tbuf, &buf[*offset], body_size); 85 86 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 4, 87 TPM_TRANSMIT_UNLOCKED, NULL); 88 if (rc < 0) { 89 dev_warn(&chip->dev, "%s: failed with a system error %d\n", 90 __func__, rc); 91 tpm_buf_destroy(&tbuf); 92 return -EFAULT; 93 } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE || 94 rc == TPM2_RC_REFERENCE_H0) { 95 /* 96 * TPM_RC_HANDLE means that the session context can't 97 * be loaded because of an internal counter mismatch 98 * that makes the TPM think there might have been a 99 * replay. This might happen if the context was saved 100 * and loaded outside the space. 101 * 102 * TPM_RC_REFERENCE_H0 means the session has been 103 * flushed outside the space 104 */ 105 rc = -ENOENT; 106 tpm_buf_destroy(&tbuf); 107 } else if (rc > 0) { 108 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", 109 __func__, rc); 110 tpm_buf_destroy(&tbuf); 111 return -EFAULT; 112 } 113 114 *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]); 115 *offset += body_size; 116 117 tpm_buf_destroy(&tbuf); 118 return 0; 119 } 120 121 static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, 122 unsigned int buf_size, unsigned int *offset) 123 { 124 struct tpm_buf tbuf; 125 unsigned int body_size; 126 int rc; 127 128 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE); 129 if (rc) 130 return rc; 131 132 tpm_buf_append_u32(&tbuf, handle); 133 134 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 0, 135 TPM_TRANSMIT_UNLOCKED, NULL); 136 if (rc < 0) { 137 dev_warn(&chip->dev, "%s: failed with a system error %d\n", 138 __func__, rc); 139 tpm_buf_destroy(&tbuf); 140 return -EFAULT; 141 } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) { 142 tpm_buf_destroy(&tbuf); 143 return -ENOENT; 144 } else if (rc) { 145 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", 146 __func__, rc); 147 tpm_buf_destroy(&tbuf); 148 return -EFAULT; 149 } 150 151 body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE; 152 if ((*offset + body_size) > buf_size) { 153 dev_warn(&chip->dev, "%s: out of backing storage\n", __func__); 154 tpm_buf_destroy(&tbuf); 155 return -ENOMEM; 156 } 157 158 memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size); 159 *offset += body_size; 160 tpm_buf_destroy(&tbuf); 161 return 0; 162 } 163 164 static void tpm2_flush_space(struct tpm_chip *chip) 165 { 166 struct tpm_space *space = &chip->work_space; 167 int i; 168 169 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) 170 if (space->context_tbl[i] && ~space->context_tbl[i]) 171 tpm2_flush_context_cmd(chip, space->context_tbl[i], 172 TPM_TRANSMIT_UNLOCKED); 173 174 tpm2_flush_sessions(chip, space); 175 } 176 177 static int tpm2_load_space(struct tpm_chip *chip) 178 { 179 struct tpm_space *space = &chip->work_space; 180 unsigned int offset; 181 int i; 182 int rc; 183 184 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 185 if (!space->context_tbl[i]) 186 continue; 187 188 /* sanity check, should never happen */ 189 if (~space->context_tbl[i]) { 190 dev_err(&chip->dev, "context table is inconsistent"); 191 return -EFAULT; 192 } 193 194 rc = tpm2_load_context(chip, space->context_buf, &offset, 195 &space->context_tbl[i]); 196 if (rc) 197 return rc; 198 } 199 200 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 201 u32 handle; 202 203 if (!space->session_tbl[i]) 204 continue; 205 206 rc = tpm2_load_context(chip, space->session_buf, 207 &offset, &handle); 208 if (rc == -ENOENT) { 209 /* load failed, just forget session */ 210 space->session_tbl[i] = 0; 211 } else if (rc) { 212 tpm2_flush_space(chip); 213 return rc; 214 } 215 if (handle != space->session_tbl[i]) { 216 dev_warn(&chip->dev, "session restored to wrong handle\n"); 217 tpm2_flush_space(chip); 218 return -EFAULT; 219 } 220 } 221 222 return 0; 223 } 224 225 static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) 226 { 227 u32 vhandle = be32_to_cpup((__be32 *)handle); 228 u32 phandle; 229 int i; 230 231 i = 0xFFFFFF - (vhandle & 0xFFFFFF); 232 if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) 233 return false; 234 235 phandle = space->context_tbl[i]; 236 *((__be32 *)handle) = cpu_to_be32(phandle); 237 return true; 238 } 239 240 static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd) 241 { 242 struct tpm_space *space = &chip->work_space; 243 unsigned int nr_handles; 244 u32 attrs; 245 __be32 *handle; 246 int i; 247 248 i = tpm2_find_cc(chip, cc); 249 if (i < 0) 250 return -EINVAL; 251 252 attrs = chip->cc_attrs_tbl[i]; 253 nr_handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0); 254 255 handle = (__be32 *)&cmd[TPM_HEADER_SIZE]; 256 for (i = 0; i < nr_handles; i++, handle++) { 257 if ((be32_to_cpu(*handle) & 0xFF000000) == TPM2_HT_TRANSIENT) { 258 if (!tpm2_map_to_phandle(space, handle)) 259 return -EINVAL; 260 } 261 } 262 263 return 0; 264 } 265 266 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc, 267 u8 *cmd) 268 { 269 int rc; 270 271 if (!space) 272 return 0; 273 274 memcpy(&chip->work_space.context_tbl, &space->context_tbl, 275 sizeof(space->context_tbl)); 276 memcpy(&chip->work_space.session_tbl, &space->session_tbl, 277 sizeof(space->session_tbl)); 278 memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE); 279 memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE); 280 281 rc = tpm2_load_space(chip); 282 if (rc) { 283 tpm2_flush_space(chip); 284 return rc; 285 } 286 287 rc = tpm2_map_command(chip, cc, cmd); 288 if (rc) { 289 tpm2_flush_space(chip); 290 return rc; 291 } 292 293 return 0; 294 } 295 296 static bool tpm2_add_session(struct tpm_chip *chip, u32 handle) 297 { 298 struct tpm_space *space = &chip->work_space; 299 int i; 300 301 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) 302 if (space->session_tbl[i] == 0) 303 break; 304 305 if (i == ARRAY_SIZE(space->session_tbl)) 306 return false; 307 308 space->session_tbl[i] = handle; 309 return true; 310 } 311 312 static u32 tpm2_map_to_vhandle(struct tpm_space *space, u32 phandle, bool alloc) 313 { 314 int i; 315 316 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 317 if (alloc) { 318 if (!space->context_tbl[i]) { 319 space->context_tbl[i] = phandle; 320 break; 321 } 322 } else if (space->context_tbl[i] == phandle) 323 break; 324 } 325 326 if (i == ARRAY_SIZE(space->context_tbl)) 327 return 0; 328 329 return TPM2_HT_TRANSIENT | (0xFFFFFF - i); 330 } 331 332 static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp, 333 size_t len) 334 { 335 struct tpm_space *space = &chip->work_space; 336 struct tpm_output_header *header = (void *)rsp; 337 u32 phandle; 338 u32 phandle_type; 339 u32 vhandle; 340 u32 attrs; 341 int i; 342 343 if (be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) 344 return 0; 345 346 i = tpm2_find_cc(chip, cc); 347 /* sanity check, should never happen */ 348 if (i < 0) 349 return -EFAULT; 350 351 attrs = chip->cc_attrs_tbl[i]; 352 if (!((attrs >> TPM2_CC_ATTR_RHANDLE) & 1)) 353 return 0; 354 355 phandle = be32_to_cpup((__be32 *)&rsp[TPM_HEADER_SIZE]); 356 phandle_type = phandle & 0xFF000000; 357 358 switch (phandle_type) { 359 case TPM2_HT_TRANSIENT: 360 vhandle = tpm2_map_to_vhandle(space, phandle, true); 361 if (!vhandle) 362 goto out_no_slots; 363 364 *(__be32 *)&rsp[TPM_HEADER_SIZE] = cpu_to_be32(vhandle); 365 break; 366 case TPM2_HT_HMAC_SESSION: 367 case TPM2_HT_POLICY_SESSION: 368 if (!tpm2_add_session(chip, phandle)) 369 goto out_no_slots; 370 break; 371 default: 372 dev_err(&chip->dev, "%s: unknown handle 0x%08X\n", 373 __func__, phandle); 374 break; 375 }; 376 377 return 0; 378 out_no_slots: 379 tpm2_flush_context_cmd(chip, phandle, TPM_TRANSMIT_UNLOCKED); 380 dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__, 381 phandle); 382 return -ENOMEM; 383 } 384 385 struct tpm2_cap_handles { 386 u8 more_data; 387 __be32 capability; 388 __be32 count; 389 __be32 handles[]; 390 } __packed; 391 392 static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp, 393 size_t len) 394 { 395 struct tpm_space *space = &chip->work_space; 396 struct tpm_output_header *header = (void *)rsp; 397 struct tpm2_cap_handles *data; 398 u32 phandle; 399 u32 phandle_type; 400 u32 vhandle; 401 int i; 402 int j; 403 404 if (cc != TPM2_CC_GET_CAPABILITY || 405 be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) { 406 return 0; 407 } 408 409 if (len < TPM_HEADER_SIZE + 9) 410 return -EFAULT; 411 412 data = (void *)&rsp[TPM_HEADER_SIZE]; 413 if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) 414 return 0; 415 416 if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) 417 return -EFAULT; 418 419 for (i = 0, j = 0; i < be32_to_cpu(data->count); i++) { 420 phandle = be32_to_cpup((__be32 *)&data->handles[i]); 421 phandle_type = phandle & 0xFF000000; 422 423 switch (phandle_type) { 424 case TPM2_HT_TRANSIENT: 425 vhandle = tpm2_map_to_vhandle(space, phandle, false); 426 if (!vhandle) 427 break; 428 429 data->handles[j] = cpu_to_be32(vhandle); 430 j++; 431 break; 432 433 default: 434 data->handles[j] = cpu_to_be32(phandle); 435 j++; 436 break; 437 } 438 439 } 440 441 header->length = cpu_to_be32(TPM_HEADER_SIZE + 9 + 4 * j); 442 data->count = cpu_to_be32(j); 443 return 0; 444 } 445 446 static int tpm2_save_space(struct tpm_chip *chip) 447 { 448 struct tpm_space *space = &chip->work_space; 449 unsigned int offset; 450 int i; 451 int rc; 452 453 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 454 if (!(space->context_tbl[i] && ~space->context_tbl[i])) 455 continue; 456 457 rc = tpm2_save_context(chip, space->context_tbl[i], 458 space->context_buf, PAGE_SIZE, 459 &offset); 460 if (rc == -ENOENT) { 461 space->context_tbl[i] = 0; 462 continue; 463 } else if (rc) 464 return rc; 465 466 tpm2_flush_context_cmd(chip, space->context_tbl[i], 467 TPM_TRANSMIT_UNLOCKED); 468 space->context_tbl[i] = ~0; 469 } 470 471 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 472 if (!space->session_tbl[i]) 473 continue; 474 475 rc = tpm2_save_context(chip, space->session_tbl[i], 476 space->session_buf, PAGE_SIZE, 477 &offset); 478 479 if (rc == -ENOENT) { 480 /* handle error saving session, just forget it */ 481 space->session_tbl[i] = 0; 482 } else if (rc < 0) { 483 tpm2_flush_space(chip); 484 return rc; 485 } 486 } 487 488 return 0; 489 } 490 491 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, 492 u32 cc, u8 *buf, size_t *bufsiz) 493 { 494 struct tpm_output_header *header = (void *)buf; 495 int rc; 496 497 if (!space) 498 return 0; 499 500 rc = tpm2_map_response_header(chip, cc, buf, *bufsiz); 501 if (rc) { 502 tpm2_flush_space(chip); 503 return rc; 504 } 505 506 rc = tpm2_map_response_body(chip, cc, buf, *bufsiz); 507 if (rc) { 508 tpm2_flush_space(chip); 509 return rc; 510 } 511 512 rc = tpm2_save_space(chip); 513 if (rc) { 514 tpm2_flush_space(chip); 515 return rc; 516 } 517 518 *bufsiz = be32_to_cpu(header->length); 519 520 memcpy(&space->context_tbl, &chip->work_space.context_tbl, 521 sizeof(space->context_tbl)); 522 memcpy(&space->session_tbl, &chip->work_space.session_tbl, 523 sizeof(space->session_tbl)); 524 memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE); 525 memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE); 526 527 return 0; 528 } 529