2 * Copyright (C) 2016 Intel Corporation
5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 * This file contains TPM2 protocol implementations of the commands
10 * used by the kernel internally.
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; version 2
18 #include <linux/gfp.h>
19 #include <asm/unaligned.h>
22 enum tpm2_handle_types {
23 TPM2_HT_HMAC_SESSION = 0x02000000,
24 TPM2_HT_POLICY_SESSION = 0x03000000,
25 TPM2_HT_TRANSIENT = 0x80000000,
35 static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
39 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
40 if (space->session_tbl[i])
41 tpm2_flush_context(chip, space->session_tbl[i]);
45 int tpm2_init_space(struct tpm_space *space)
47 space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
48 if (!space->context_buf)
51 space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
52 if (space->session_buf == NULL) {
53 kfree(space->context_buf);
60 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
62 mutex_lock(&chip->tpm_mutex);
63 if (!tpm_chip_start(chip)) {
64 tpm2_flush_sessions(chip, space);
67 mutex_unlock(&chip->tpm_mutex);
68 kfree(space->context_buf);
69 kfree(space->session_buf);
72 static int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
73 unsigned int *offset, u32 *handle)
76 struct tpm2_context *ctx;
77 unsigned int body_size;
80 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD);
84 ctx = (struct tpm2_context *)&buf[*offset];
85 body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size);
86 tpm_buf_append(&tbuf, &buf[*offset], body_size);
88 rc = tpm_transmit_cmd(chip, &tbuf, 4, NULL);
90 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
92 tpm_buf_destroy(&tbuf);
94 } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE ||
95 rc == TPM2_RC_REFERENCE_H0) {
97 * TPM_RC_HANDLE means that the session context can't
98 * be loaded because of an internal counter mismatch
99 * that makes the TPM think there might have been a
100 * replay. This might happen if the context was saved
101 * and loaded outside the space.
103 * TPM_RC_REFERENCE_H0 means the session has been
104 * flushed outside the space
107 tpm_buf_destroy(&tbuf);
110 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
112 tpm_buf_destroy(&tbuf);
116 *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]);
117 *offset += body_size;
119 tpm_buf_destroy(&tbuf);
123 static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf,
124 unsigned int buf_size, unsigned int *offset)
127 unsigned int body_size;
130 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE);
134 tpm_buf_append_u32(&tbuf, handle);
136 rc = tpm_transmit_cmd(chip, &tbuf, 0, NULL);
138 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
140 tpm_buf_destroy(&tbuf);
142 } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) {
143 tpm_buf_destroy(&tbuf);
146 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
148 tpm_buf_destroy(&tbuf);
152 body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE;
153 if ((*offset + body_size) > buf_size) {
154 dev_warn(&chip->dev, "%s: out of backing storage\n", __func__);
155 tpm_buf_destroy(&tbuf);
159 memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size);
160 *offset += body_size;
161 tpm_buf_destroy(&tbuf);
165 void tpm2_flush_space(struct tpm_chip *chip)
167 struct tpm_space *space = &chip->work_space;
170 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++)
171 if (space->context_tbl[i] && ~space->context_tbl[i])
172 tpm2_flush_context(chip, space->context_tbl[i]);
174 tpm2_flush_sessions(chip, space);
177 static int tpm2_load_space(struct tpm_chip *chip)
179 struct tpm_space *space = &chip->work_space;
184 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
185 if (!space->context_tbl[i])
188 /* sanity check, should never happen */
189 if (~space->context_tbl[i]) {
190 dev_err(&chip->dev, "context table is inconsistent");
194 rc = tpm2_load_context(chip, space->context_buf, &offset,
195 &space->context_tbl[i]);
200 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
203 if (!space->session_tbl[i])
206 rc = tpm2_load_context(chip, space->session_buf,
209 /* load failed, just forget session */
210 space->session_tbl[i] = 0;
212 tpm2_flush_space(chip);
215 if (handle != space->session_tbl[i]) {
216 dev_warn(&chip->dev, "session restored to wrong handle\n");
217 tpm2_flush_space(chip);
225 static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle)
227 u32 vhandle = be32_to_cpup((__be32 *)handle);
231 i = 0xFFFFFF - (vhandle & 0xFFFFFF);
232 if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i])
235 phandle = space->context_tbl[i];
236 *((__be32 *)handle) = cpu_to_be32(phandle);
240 static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd)
242 struct tpm_space *space = &chip->work_space;
243 unsigned int nr_handles;
248 i = tpm2_find_cc(chip, cc);
252 attrs = chip->cc_attrs_tbl[i];
253 nr_handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0);
255 handle = (__be32 *)&cmd[TPM_HEADER_SIZE];
256 for (i = 0; i < nr_handles; i++, handle++) {
257 if ((be32_to_cpu(*handle) & 0xFF000000) == TPM2_HT_TRANSIENT) {
258 if (!tpm2_map_to_phandle(space, handle))
266 static int tpm_find_and_validate_cc(struct tpm_chip *chip,
267 struct tpm_space *space,
268 const void *cmd, size_t len)
270 const struct tpm_header *header = (const void *)cmd;
274 unsigned int nr_handles;
276 if (len < TPM_HEADER_SIZE || !chip->nr_commands)
279 cc = be32_to_cpu(header->ordinal);
281 i = tpm2_find_cc(chip, cc);
283 dev_dbg(&chip->dev, "0x%04X is an invalid command\n",
288 attrs = chip->cc_attrs_tbl[i];
290 4 * ((attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0));
291 if (len < TPM_HEADER_SIZE + 4 * nr_handles)
296 dev_dbg(&chip->dev, "%s: insufficient command length %zu", __func__,
301 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd,
310 cc = tpm_find_and_validate_cc(chip, space, cmd, cmdsiz);
314 memcpy(&chip->work_space.context_tbl, &space->context_tbl,
315 sizeof(space->context_tbl));
316 memcpy(&chip->work_space.session_tbl, &space->session_tbl,
317 sizeof(space->session_tbl));
318 memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE);
319 memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE);
321 rc = tpm2_load_space(chip);
323 tpm2_flush_space(chip);
327 rc = tpm2_map_command(chip, cc, cmd);
329 tpm2_flush_space(chip);
337 static bool tpm2_add_session(struct tpm_chip *chip, u32 handle)
339 struct tpm_space *space = &chip->work_space;
342 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++)
343 if (space->session_tbl[i] == 0)
346 if (i == ARRAY_SIZE(space->session_tbl))
349 space->session_tbl[i] = handle;
353 static u32 tpm2_map_to_vhandle(struct tpm_space *space, u32 phandle, bool alloc)
357 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
359 if (!space->context_tbl[i]) {
360 space->context_tbl[i] = phandle;
363 } else if (space->context_tbl[i] == phandle)
367 if (i == ARRAY_SIZE(space->context_tbl))
370 return TPM2_HT_TRANSIENT | (0xFFFFFF - i);
373 static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp,
376 struct tpm_space *space = &chip->work_space;
377 struct tpm_header *header = (struct tpm_header *)rsp;
384 if (be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS)
387 i = tpm2_find_cc(chip, cc);
388 /* sanity check, should never happen */
392 attrs = chip->cc_attrs_tbl[i];
393 if (!((attrs >> TPM2_CC_ATTR_RHANDLE) & 1))
396 phandle = be32_to_cpup((__be32 *)&rsp[TPM_HEADER_SIZE]);
397 phandle_type = phandle & 0xFF000000;
399 switch (phandle_type) {
400 case TPM2_HT_TRANSIENT:
401 vhandle = tpm2_map_to_vhandle(space, phandle, true);
405 *(__be32 *)&rsp[TPM_HEADER_SIZE] = cpu_to_be32(vhandle);
407 case TPM2_HT_HMAC_SESSION:
408 case TPM2_HT_POLICY_SESSION:
409 if (!tpm2_add_session(chip, phandle))
413 dev_err(&chip->dev, "%s: unknown handle 0x%08X\n",
420 tpm2_flush_context(chip, phandle);
421 dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__,
426 struct tpm2_cap_handles {
433 static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp,
436 struct tpm_space *space = &chip->work_space;
437 struct tpm_header *header = (struct tpm_header *)rsp;
438 struct tpm2_cap_handles *data;
445 if (cc != TPM2_CC_GET_CAPABILITY ||
446 be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) {
450 if (len < TPM_HEADER_SIZE + 9)
453 data = (void *)&rsp[TPM_HEADER_SIZE];
454 if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
457 if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
460 for (i = 0, j = 0; i < be32_to_cpu(data->count); i++) {
461 phandle = be32_to_cpup((__be32 *)&data->handles[i]);
462 phandle_type = phandle & 0xFF000000;
464 switch (phandle_type) {
465 case TPM2_HT_TRANSIENT:
466 vhandle = tpm2_map_to_vhandle(space, phandle, false);
470 data->handles[j] = cpu_to_be32(vhandle);
475 data->handles[j] = cpu_to_be32(phandle);
482 header->length = cpu_to_be32(TPM_HEADER_SIZE + 9 + 4 * j);
483 data->count = cpu_to_be32(j);
487 static int tpm2_save_space(struct tpm_chip *chip)
489 struct tpm_space *space = &chip->work_space;
494 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
495 if (!(space->context_tbl[i] && ~space->context_tbl[i]))
498 rc = tpm2_save_context(chip, space->context_tbl[i],
499 space->context_buf, PAGE_SIZE,
502 space->context_tbl[i] = 0;
507 tpm2_flush_context(chip, space->context_tbl[i]);
508 space->context_tbl[i] = ~0;
511 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
512 if (!space->session_tbl[i])
515 rc = tpm2_save_context(chip, space->session_tbl[i],
516 space->session_buf, PAGE_SIZE,
520 /* handle error saving session, just forget it */
521 space->session_tbl[i] = 0;
523 tpm2_flush_space(chip);
531 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
532 void *buf, size_t *bufsiz)
534 struct tpm_header *header = buf;
540 rc = tpm2_map_response_header(chip, chip->last_cc, buf, *bufsiz);
542 tpm2_flush_space(chip);
546 rc = tpm2_map_response_body(chip, chip->last_cc, buf, *bufsiz);
548 tpm2_flush_space(chip);
552 rc = tpm2_save_space(chip);
554 tpm2_flush_space(chip);
558 *bufsiz = be32_to_cpu(header->length);
560 memcpy(&space->context_tbl, &chip->work_space.context_tbl,
561 sizeof(space->context_tbl));
562 memcpy(&space->session_tbl, &chip->work_space.session_tbl,
563 sizeof(space->session_tbl));
564 memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE);
565 memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE);
569 dev_err(&chip->dev, "%s: error %d\n", __func__, rc);