1 /* 2 * Copyright (C) 2016 Intel Corporation 3 * 4 * Authors: 5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> 6 * 7 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 8 * 9 * This file contains TPM2 protocol implementations of the commands 10 * used by the kernel internally. 11 * 12 * This program is free software; you can redistribute it and/or 13 * modify it under the terms of the GNU General Public License 14 * as published by the Free Software Foundation; version 2 15 * of the License. 16 */ 17 18 #include <linux/gfp.h> 19 #include <asm/unaligned.h> 20 #include "tpm.h" 21 22 enum tpm2_handle_types { 23 TPM2_HT_HMAC_SESSION = 0x02000000, 24 TPM2_HT_POLICY_SESSION = 0x03000000, 25 TPM2_HT_TRANSIENT = 0x80000000, 26 }; 27 28 struct tpm2_context { 29 __be64 sequence; 30 __be32 saved_handle; 31 __be32 hierarchy; 32 __be16 blob_size; 33 } __packed; 34 35 static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) 36 { 37 int i; 38 39 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 40 if (space->session_tbl[i]) 41 tpm2_flush_context(chip, space->session_tbl[i]); 42 } 43 } 44 45 int tpm2_init_space(struct tpm_space *space) 46 { 47 space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); 48 if (!space->context_buf) 49 return -ENOMEM; 50 51 space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); 52 if (space->session_buf == NULL) { 53 kfree(space->context_buf); 54 return -ENOMEM; 55 } 56 57 return 0; 58 } 59 60 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) 61 { 62 mutex_lock(&chip->tpm_mutex); 63 if (!tpm_chip_start(chip)) { 64 tpm2_flush_sessions(chip, space); 65 tpm_chip_stop(chip); 66 } 67 mutex_unlock(&chip->tpm_mutex); 68 kfree(space->context_buf); 69 kfree(space->session_buf); 70 } 71 72 static int tpm2_load_context(struct tpm_chip *chip, u8 *buf, 73 unsigned int *offset, u32 *handle) 74 { 75 struct tpm_buf tbuf; 76 struct tpm2_context *ctx; 77 unsigned int body_size; 78 int rc; 79 80 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD); 81 if (rc) 82 return rc; 83 84 ctx = (struct tpm2_context *)&buf[*offset]; 85 body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size); 86 tpm_buf_append(&tbuf, &buf[*offset], body_size); 87 88 rc = tpm_transmit_cmd(chip, &tbuf, 4, NULL); 89 if (rc < 0) { 90 dev_warn(&chip->dev, "%s: failed with a system error %d\n", 91 __func__, rc); 92 tpm_buf_destroy(&tbuf); 93 return -EFAULT; 94 } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE || 95 rc == TPM2_RC_REFERENCE_H0) { 96 /* 97 * TPM_RC_HANDLE means that the session context can't 98 * be loaded because of an internal counter mismatch 99 * that makes the TPM think there might have been a 100 * replay. This might happen if the context was saved 101 * and loaded outside the space. 102 * 103 * TPM_RC_REFERENCE_H0 means the session has been 104 * flushed outside the space 105 */ 106 *handle = 0; 107 tpm_buf_destroy(&tbuf); 108 return -ENOENT; 109 } else if (rc > 0) { 110 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", 111 __func__, rc); 112 tpm_buf_destroy(&tbuf); 113 return -EFAULT; 114 } 115 116 *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]); 117 *offset += body_size; 118 119 tpm_buf_destroy(&tbuf); 120 return 0; 121 } 122 123 static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, 124 unsigned int buf_size, unsigned int *offset) 125 { 126 struct tpm_buf tbuf; 127 unsigned int body_size; 128 int rc; 129 130 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE); 131 if (rc) 132 return rc; 133 134 tpm_buf_append_u32(&tbuf, handle); 135 136 rc = tpm_transmit_cmd(chip, &tbuf, 0, NULL); 137 if (rc < 0) { 138 dev_warn(&chip->dev, "%s: failed with a system error %d\n", 139 __func__, rc); 140 tpm_buf_destroy(&tbuf); 141 return -EFAULT; 142 } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) { 143 tpm_buf_destroy(&tbuf); 144 return -ENOENT; 145 } else if (rc) { 146 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", 147 __func__, rc); 148 tpm_buf_destroy(&tbuf); 149 return -EFAULT; 150 } 151 152 body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE; 153 if ((*offset + body_size) > buf_size) { 154 dev_warn(&chip->dev, "%s: out of backing storage\n", __func__); 155 tpm_buf_destroy(&tbuf); 156 return -ENOMEM; 157 } 158 159 memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size); 160 *offset += body_size; 161 tpm_buf_destroy(&tbuf); 162 return 0; 163 } 164 165 void tpm2_flush_space(struct tpm_chip *chip) 166 { 167 struct tpm_space *space = &chip->work_space; 168 int i; 169 170 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) 171 if (space->context_tbl[i] && ~space->context_tbl[i]) 172 tpm2_flush_context(chip, space->context_tbl[i]); 173 174 tpm2_flush_sessions(chip, space); 175 } 176 177 static int tpm2_load_space(struct tpm_chip *chip) 178 { 179 struct tpm_space *space = &chip->work_space; 180 unsigned int offset; 181 int i; 182 int rc; 183 184 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 185 if (!space->context_tbl[i]) 186 continue; 187 188 /* sanity check, should never happen */ 189 if (~space->context_tbl[i]) { 190 dev_err(&chip->dev, "context table is inconsistent"); 191 return -EFAULT; 192 } 193 194 rc = tpm2_load_context(chip, space->context_buf, &offset, 195 &space->context_tbl[i]); 196 if (rc) 197 return rc; 198 } 199 200 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 201 u32 handle; 202 203 if (!space->session_tbl[i]) 204 continue; 205 206 rc = tpm2_load_context(chip, space->session_buf, 207 &offset, &handle); 208 if (rc == -ENOENT) { 209 /* load failed, just forget session */ 210 space->session_tbl[i] = 0; 211 } else if (rc) { 212 tpm2_flush_space(chip); 213 return rc; 214 } 215 if (handle != space->session_tbl[i]) { 216 dev_warn(&chip->dev, "session restored to wrong handle\n"); 217 tpm2_flush_space(chip); 218 return -EFAULT; 219 } 220 } 221 222 return 0; 223 } 224 225 static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) 226 { 227 u32 vhandle = be32_to_cpup((__be32 *)handle); 228 u32 phandle; 229 int i; 230 231 i = 0xFFFFFF - (vhandle & 0xFFFFFF); 232 if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) 233 return false; 234 235 phandle = space->context_tbl[i]; 236 *((__be32 *)handle) = cpu_to_be32(phandle); 237 return true; 238 } 239 240 static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd) 241 { 242 struct tpm_space *space = &chip->work_space; 243 unsigned int nr_handles; 244 u32 attrs; 245 __be32 *handle; 246 int i; 247 248 i = tpm2_find_cc(chip, cc); 249 if (i < 0) 250 return -EINVAL; 251 252 attrs = chip->cc_attrs_tbl[i]; 253 nr_handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0); 254 255 handle = (__be32 *)&cmd[TPM_HEADER_SIZE]; 256 for (i = 0; i < nr_handles; i++, handle++) { 257 if ((be32_to_cpu(*handle) & 0xFF000000) == TPM2_HT_TRANSIENT) { 258 if (!tpm2_map_to_phandle(space, handle)) 259 return -EINVAL; 260 } 261 } 262 263 return 0; 264 } 265 266 static int tpm_find_and_validate_cc(struct tpm_chip *chip, 267 struct tpm_space *space, 268 const void *cmd, size_t len) 269 { 270 const struct tpm_header *header = (const void *)cmd; 271 int i; 272 u32 cc; 273 u32 attrs; 274 unsigned int nr_handles; 275 276 if (len < TPM_HEADER_SIZE || !chip->nr_commands) 277 return -EINVAL; 278 279 cc = be32_to_cpu(header->ordinal); 280 281 i = tpm2_find_cc(chip, cc); 282 if (i < 0) { 283 dev_dbg(&chip->dev, "0x%04X is an invalid command\n", 284 cc); 285 return -EOPNOTSUPP; 286 } 287 288 attrs = chip->cc_attrs_tbl[i]; 289 nr_handles = 290 4 * ((attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0)); 291 if (len < TPM_HEADER_SIZE + 4 * nr_handles) 292 goto err_len; 293 294 return cc; 295 err_len: 296 dev_dbg(&chip->dev, "%s: insufficient command length %zu", __func__, 297 len); 298 return -EINVAL; 299 } 300 301 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, 302 size_t cmdsiz) 303 { 304 int rc; 305 int cc; 306 307 if (!space) 308 return 0; 309 310 cc = tpm_find_and_validate_cc(chip, space, cmd, cmdsiz); 311 if (cc < 0) 312 return cc; 313 314 memcpy(&chip->work_space.context_tbl, &space->context_tbl, 315 sizeof(space->context_tbl)); 316 memcpy(&chip->work_space.session_tbl, &space->session_tbl, 317 sizeof(space->session_tbl)); 318 memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE); 319 memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE); 320 321 rc = tpm2_load_space(chip); 322 if (rc) { 323 tpm2_flush_space(chip); 324 return rc; 325 } 326 327 rc = tpm2_map_command(chip, cc, cmd); 328 if (rc) { 329 tpm2_flush_space(chip); 330 return rc; 331 } 332 333 chip->last_cc = cc; 334 return 0; 335 } 336 337 static bool tpm2_add_session(struct tpm_chip *chip, u32 handle) 338 { 339 struct tpm_space *space = &chip->work_space; 340 int i; 341 342 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) 343 if (space->session_tbl[i] == 0) 344 break; 345 346 if (i == ARRAY_SIZE(space->session_tbl)) 347 return false; 348 349 space->session_tbl[i] = handle; 350 return true; 351 } 352 353 static u32 tpm2_map_to_vhandle(struct tpm_space *space, u32 phandle, bool alloc) 354 { 355 int i; 356 357 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 358 if (alloc) { 359 if (!space->context_tbl[i]) { 360 space->context_tbl[i] = phandle; 361 break; 362 } 363 } else if (space->context_tbl[i] == phandle) 364 break; 365 } 366 367 if (i == ARRAY_SIZE(space->context_tbl)) 368 return 0; 369 370 return TPM2_HT_TRANSIENT | (0xFFFFFF - i); 371 } 372 373 static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp, 374 size_t len) 375 { 376 struct tpm_space *space = &chip->work_space; 377 struct tpm_header *header = (struct tpm_header *)rsp; 378 u32 phandle; 379 u32 phandle_type; 380 u32 vhandle; 381 u32 attrs; 382 int i; 383 384 if (be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) 385 return 0; 386 387 i = tpm2_find_cc(chip, cc); 388 /* sanity check, should never happen */ 389 if (i < 0) 390 return -EFAULT; 391 392 attrs = chip->cc_attrs_tbl[i]; 393 if (!((attrs >> TPM2_CC_ATTR_RHANDLE) & 1)) 394 return 0; 395 396 phandle = be32_to_cpup((__be32 *)&rsp[TPM_HEADER_SIZE]); 397 phandle_type = phandle & 0xFF000000; 398 399 switch (phandle_type) { 400 case TPM2_HT_TRANSIENT: 401 vhandle = tpm2_map_to_vhandle(space, phandle, true); 402 if (!vhandle) 403 goto out_no_slots; 404 405 *(__be32 *)&rsp[TPM_HEADER_SIZE] = cpu_to_be32(vhandle); 406 break; 407 case TPM2_HT_HMAC_SESSION: 408 case TPM2_HT_POLICY_SESSION: 409 if (!tpm2_add_session(chip, phandle)) 410 goto out_no_slots; 411 break; 412 default: 413 dev_err(&chip->dev, "%s: unknown handle 0x%08X\n", 414 __func__, phandle); 415 break; 416 } 417 418 return 0; 419 out_no_slots: 420 tpm2_flush_context(chip, phandle); 421 dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__, 422 phandle); 423 return -ENOMEM; 424 } 425 426 struct tpm2_cap_handles { 427 u8 more_data; 428 __be32 capability; 429 __be32 count; 430 __be32 handles[]; 431 } __packed; 432 433 static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp, 434 size_t len) 435 { 436 struct tpm_space *space = &chip->work_space; 437 struct tpm_header *header = (struct tpm_header *)rsp; 438 struct tpm2_cap_handles *data; 439 u32 phandle; 440 u32 phandle_type; 441 u32 vhandle; 442 int i; 443 int j; 444 445 if (cc != TPM2_CC_GET_CAPABILITY || 446 be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) { 447 return 0; 448 } 449 450 if (len < TPM_HEADER_SIZE + 9) 451 return -EFAULT; 452 453 data = (void *)&rsp[TPM_HEADER_SIZE]; 454 if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) 455 return 0; 456 457 if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) 458 return -EFAULT; 459 460 for (i = 0, j = 0; i < be32_to_cpu(data->count); i++) { 461 phandle = be32_to_cpup((__be32 *)&data->handles[i]); 462 phandle_type = phandle & 0xFF000000; 463 464 switch (phandle_type) { 465 case TPM2_HT_TRANSIENT: 466 vhandle = tpm2_map_to_vhandle(space, phandle, false); 467 if (!vhandle) 468 break; 469 470 data->handles[j] = cpu_to_be32(vhandle); 471 j++; 472 break; 473 474 default: 475 data->handles[j] = cpu_to_be32(phandle); 476 j++; 477 break; 478 } 479 480 } 481 482 header->length = cpu_to_be32(TPM_HEADER_SIZE + 9 + 4 * j); 483 data->count = cpu_to_be32(j); 484 return 0; 485 } 486 487 static int tpm2_save_space(struct tpm_chip *chip) 488 { 489 struct tpm_space *space = &chip->work_space; 490 unsigned int offset; 491 int i; 492 int rc; 493 494 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) { 495 if (!(space->context_tbl[i] && ~space->context_tbl[i])) 496 continue; 497 498 rc = tpm2_save_context(chip, space->context_tbl[i], 499 space->context_buf, PAGE_SIZE, 500 &offset); 501 if (rc == -ENOENT) { 502 space->context_tbl[i] = 0; 503 continue; 504 } else if (rc) 505 return rc; 506 507 tpm2_flush_context(chip, space->context_tbl[i]); 508 space->context_tbl[i] = ~0; 509 } 510 511 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) { 512 if (!space->session_tbl[i]) 513 continue; 514 515 rc = tpm2_save_context(chip, space->session_tbl[i], 516 space->session_buf, PAGE_SIZE, 517 &offset); 518 519 if (rc == -ENOENT) { 520 /* handle error saving session, just forget it */ 521 space->session_tbl[i] = 0; 522 } else if (rc < 0) { 523 tpm2_flush_space(chip); 524 return rc; 525 } 526 } 527 528 return 0; 529 } 530 531 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, 532 void *buf, size_t *bufsiz) 533 { 534 struct tpm_header *header = buf; 535 int rc; 536 537 if (!space) 538 return 0; 539 540 rc = tpm2_map_response_header(chip, chip->last_cc, buf, *bufsiz); 541 if (rc) { 542 tpm2_flush_space(chip); 543 goto out; 544 } 545 546 rc = tpm2_map_response_body(chip, chip->last_cc, buf, *bufsiz); 547 if (rc) { 548 tpm2_flush_space(chip); 549 goto out; 550 } 551 552 rc = tpm2_save_space(chip); 553 if (rc) { 554 tpm2_flush_space(chip); 555 goto out; 556 } 557 558 *bufsiz = be32_to_cpu(header->length); 559 560 memcpy(&space->context_tbl, &chip->work_space.context_tbl, 561 sizeof(space->context_tbl)); 562 memcpy(&space->session_tbl, &chip->work_space.session_tbl, 563 sizeof(space->session_tbl)); 564 memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE); 565 memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE); 566 567 return 0; 568 out: 569 dev_err(&chip->dev, "%s: error %d\n", __func__, rc); 570 return rc; 571 } 572