c17e75348a991e355236f2040f931e940541049f
[sfrench/cifs-2.6.git] / drivers / char / tpm / tpm2-cmd.c
1 /*
2  * Copyright (C) 2014, 2015 Intel Corporation
3  *
4  * Authors:
5  * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
6  *
7  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8  *
9  * This file contains TPM2 protocol implementations of the commands
10  * used by the kernel internally.
11  *
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; version 2
15  * of the License.
16  */
17
18 #include "tpm.h"
19 #include <crypto/hash_info.h>
20 #include <keys/trusted-type.h>
21
22 enum tpm2_object_attributes {
23         TPM2_OA_USER_WITH_AUTH          = BIT(6),
24 };
25
26 enum tpm2_session_attributes {
27         TPM2_SA_CONTINUE_SESSION        = BIT(0),
28 };
29
30 struct tpm2_startup_in {
31         __be16  startup_type;
32 } __packed;
33
34 struct tpm2_self_test_in {
35         u8      full_test;
36 } __packed;
37
38 struct tpm2_get_tpm_pt_in {
39         __be32  cap_id;
40         __be32  property_id;
41         __be32  property_cnt;
42 } __packed;
43
44 struct tpm2_get_tpm_pt_out {
45         u8      more_data;
46         __be32  subcap_id;
47         __be32  property_cnt;
48         __be32  property_id;
49         __be32  value;
50 } __packed;
51
52 struct tpm2_get_random_in {
53         __be16  size;
54 } __packed;
55
56 struct tpm2_get_random_out {
57         __be16  size;
58         u8      buffer[TPM_MAX_RNG_DATA];
59 } __packed;
60
61 union tpm2_cmd_params {
62         struct  tpm2_startup_in         startup_in;
63         struct  tpm2_self_test_in       selftest_in;
64         struct  tpm2_get_tpm_pt_in      get_tpm_pt_in;
65         struct  tpm2_get_tpm_pt_out     get_tpm_pt_out;
66         struct  tpm2_get_random_in      getrandom_in;
67         struct  tpm2_get_random_out     getrandom_out;
68 };
69
70 struct tpm2_cmd {
71         tpm_cmd_header          header;
72         union tpm2_cmd_params   params;
73 } __packed;
74
75 struct tpm2_hash {
76         unsigned int crypto_id;
77         unsigned int tpm_id;
78 };
79
80 static struct tpm2_hash tpm2_hash_map[] = {
81         {HASH_ALGO_SHA1, TPM2_ALG_SHA1},
82         {HASH_ALGO_SHA256, TPM2_ALG_SHA256},
83         {HASH_ALGO_SHA384, TPM2_ALG_SHA384},
84         {HASH_ALGO_SHA512, TPM2_ALG_SHA512},
85         {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256},
86 };
87
88 /*
89  * Array with one entry per ordinal defining the maximum amount
90  * of time the chip could take to return the result. The values
91  * of the SHORT, MEDIUM, and LONG durations are taken from the
92  * PC Client Profile (PTP) specification.
93  */
94 static const u8 tpm2_ordinal_duration[TPM2_CC_LAST - TPM2_CC_FIRST + 1] = {
95         TPM_UNDEFINED,          /* 11F */
96         TPM_UNDEFINED,          /* 120 */
97         TPM_LONG,               /* 121 */
98         TPM_UNDEFINED,          /* 122 */
99         TPM_UNDEFINED,          /* 123 */
100         TPM_UNDEFINED,          /* 124 */
101         TPM_UNDEFINED,          /* 125 */
102         TPM_UNDEFINED,          /* 126 */
103         TPM_UNDEFINED,          /* 127 */
104         TPM_UNDEFINED,          /* 128 */
105         TPM_LONG,               /* 129 */
106         TPM_UNDEFINED,          /* 12a */
107         TPM_UNDEFINED,          /* 12b */
108         TPM_UNDEFINED,          /* 12c */
109         TPM_UNDEFINED,          /* 12d */
110         TPM_UNDEFINED,          /* 12e */
111         TPM_UNDEFINED,          /* 12f */
112         TPM_UNDEFINED,          /* 130 */
113         TPM_UNDEFINED,          /* 131 */
114         TPM_UNDEFINED,          /* 132 */
115         TPM_UNDEFINED,          /* 133 */
116         TPM_UNDEFINED,          /* 134 */
117         TPM_UNDEFINED,          /* 135 */
118         TPM_UNDEFINED,          /* 136 */
119         TPM_UNDEFINED,          /* 137 */
120         TPM_UNDEFINED,          /* 138 */
121         TPM_UNDEFINED,          /* 139 */
122         TPM_UNDEFINED,          /* 13a */
123         TPM_UNDEFINED,          /* 13b */
124         TPM_UNDEFINED,          /* 13c */
125         TPM_UNDEFINED,          /* 13d */
126         TPM_MEDIUM,             /* 13e */
127         TPM_UNDEFINED,          /* 13f */
128         TPM_UNDEFINED,          /* 140 */
129         TPM_UNDEFINED,          /* 141 */
130         TPM_UNDEFINED,          /* 142 */
131         TPM_LONG,               /* 143 */
132         TPM_MEDIUM,             /* 144 */
133         TPM_UNDEFINED,          /* 145 */
134         TPM_UNDEFINED,          /* 146 */
135         TPM_UNDEFINED,          /* 147 */
136         TPM_UNDEFINED,          /* 148 */
137         TPM_UNDEFINED,          /* 149 */
138         TPM_UNDEFINED,          /* 14a */
139         TPM_UNDEFINED,          /* 14b */
140         TPM_UNDEFINED,          /* 14c */
141         TPM_UNDEFINED,          /* 14d */
142         TPM_LONG,               /* 14e */
143         TPM_UNDEFINED,          /* 14f */
144         TPM_UNDEFINED,          /* 150 */
145         TPM_UNDEFINED,          /* 151 */
146         TPM_UNDEFINED,          /* 152 */
147         TPM_UNDEFINED,          /* 153 */
148         TPM_UNDEFINED,          /* 154 */
149         TPM_UNDEFINED,          /* 155 */
150         TPM_UNDEFINED,          /* 156 */
151         TPM_UNDEFINED,          /* 157 */
152         TPM_UNDEFINED,          /* 158 */
153         TPM_UNDEFINED,          /* 159 */
154         TPM_UNDEFINED,          /* 15a */
155         TPM_UNDEFINED,          /* 15b */
156         TPM_MEDIUM,             /* 15c */
157         TPM_UNDEFINED,          /* 15d */
158         TPM_UNDEFINED,          /* 15e */
159         TPM_UNDEFINED,          /* 15f */
160         TPM_UNDEFINED,          /* 160 */
161         TPM_UNDEFINED,          /* 161 */
162         TPM_UNDEFINED,          /* 162 */
163         TPM_UNDEFINED,          /* 163 */
164         TPM_UNDEFINED,          /* 164 */
165         TPM_UNDEFINED,          /* 165 */
166         TPM_UNDEFINED,          /* 166 */
167         TPM_UNDEFINED,          /* 167 */
168         TPM_UNDEFINED,          /* 168 */
169         TPM_UNDEFINED,          /* 169 */
170         TPM_UNDEFINED,          /* 16a */
171         TPM_UNDEFINED,          /* 16b */
172         TPM_UNDEFINED,          /* 16c */
173         TPM_UNDEFINED,          /* 16d */
174         TPM_UNDEFINED,          /* 16e */
175         TPM_UNDEFINED,          /* 16f */
176         TPM_UNDEFINED,          /* 170 */
177         TPM_UNDEFINED,          /* 171 */
178         TPM_UNDEFINED,          /* 172 */
179         TPM_UNDEFINED,          /* 173 */
180         TPM_UNDEFINED,          /* 174 */
181         TPM_UNDEFINED,          /* 175 */
182         TPM_UNDEFINED,          /* 176 */
183         TPM_LONG,               /* 177 */
184         TPM_UNDEFINED,          /* 178 */
185         TPM_UNDEFINED,          /* 179 */
186         TPM_MEDIUM,             /* 17a */
187         TPM_LONG,               /* 17b */
188         TPM_UNDEFINED,          /* 17c */
189         TPM_UNDEFINED,          /* 17d */
190         TPM_UNDEFINED,          /* 17e */
191         TPM_UNDEFINED,          /* 17f */
192         TPM_UNDEFINED,          /* 180 */
193         TPM_UNDEFINED,          /* 181 */
194         TPM_MEDIUM,             /* 182 */
195         TPM_UNDEFINED,          /* 183 */
196         TPM_UNDEFINED,          /* 184 */
197         TPM_MEDIUM,             /* 185 */
198         TPM_MEDIUM,             /* 186 */
199         TPM_UNDEFINED,          /* 187 */
200         TPM_UNDEFINED,          /* 188 */
201         TPM_UNDEFINED,          /* 189 */
202         TPM_UNDEFINED,          /* 18a */
203         TPM_UNDEFINED,          /* 18b */
204         TPM_UNDEFINED,          /* 18c */
205         TPM_UNDEFINED,          /* 18d */
206         TPM_UNDEFINED,          /* 18e */
207         TPM_UNDEFINED           /* 18f */
208 };
209
210 struct tpm2_pcr_read_out {
211         __be32  update_cnt;
212         __be32  pcr_selects_cnt;
213         __be16  hash_alg;
214         u8      pcr_select_size;
215         u8      pcr_select[TPM2_PCR_SELECT_MIN];
216         __be32  digests_cnt;
217         __be16  digest_size;
218         u8      digest[];
219 } __packed;
220
221 /**
222  * tpm2_pcr_read() - read a PCR value
223  * @chip:       TPM chip to use.
224  * @pcr_idx:    index of the PCR to read.
225  * @res_buf:    buffer to store the resulting hash.
226  *
227  * Return: Same as with tpm_transmit_cmd.
228  */
229 int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
230 {
231         int rc;
232         struct tpm_buf buf;
233         struct tpm2_pcr_read_out *out;
234         u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
235
236         if (pcr_idx >= TPM2_PLATFORM_PCR)
237                 return -EINVAL;
238
239         rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ);
240         if (rc)
241                 return rc;
242
243         pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
244
245         tpm_buf_append_u32(&buf, 1);
246         tpm_buf_append_u16(&buf, TPM2_ALG_SHA1);
247         tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN);
248         tpm_buf_append(&buf, (const unsigned char *)pcr_select,
249                        sizeof(pcr_select));
250
251         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
252                         res_buf ? "attempting to read a pcr value" : NULL);
253         if (rc == 0 && res_buf) {
254                 out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
255                 memcpy(res_buf, out->digest, SHA1_DIGEST_SIZE);
256         }
257
258         tpm_buf_destroy(&buf);
259         return rc;
260 }
261
262 struct tpm2_null_auth_area {
263         __be32  handle;
264         __be16  nonce_size;
265         u8  attributes;
266         __be16  auth_size;
267 } __packed;
268
269 /**
270  * tpm2_pcr_extend() - extend a PCR value
271  *
272  * @chip:       TPM chip to use.
273  * @pcr_idx:    index of the PCR.
274  * @count:      number of digests passed.
275  * @digests:    list of pcr banks and corresponding digest values to extend.
276  *
277  * Return: Same as with tpm_transmit_cmd.
278  */
279 int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count,
280                     struct tpm2_digest *digests)
281 {
282         struct tpm_buf buf;
283         struct tpm2_null_auth_area auth_area;
284         int rc;
285         int i;
286         int j;
287
288         if (count > ARRAY_SIZE(chip->active_banks))
289                 return -EINVAL;
290
291         rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);
292         if (rc)
293                 return rc;
294
295         tpm_buf_append_u32(&buf, pcr_idx);
296
297         auth_area.handle = cpu_to_be32(TPM2_RS_PW);
298         auth_area.nonce_size = 0;
299         auth_area.attributes = 0;
300         auth_area.auth_size = 0;
301
302         tpm_buf_append_u32(&buf, sizeof(struct tpm2_null_auth_area));
303         tpm_buf_append(&buf, (const unsigned char *)&auth_area,
304                        sizeof(auth_area));
305         tpm_buf_append_u32(&buf, count);
306
307         for (i = 0; i < count; i++) {
308                 for (j = 0; j < ARRAY_SIZE(tpm2_hash_map); j++) {
309                         if (digests[i].alg_id != tpm2_hash_map[j].tpm_id)
310                                 continue;
311                         tpm_buf_append_u16(&buf, digests[i].alg_id);
312                         tpm_buf_append(&buf, (const unsigned char
313                                               *)&digests[i].digest,
314                                hash_digest_size[tpm2_hash_map[j].crypto_id]);
315                 }
316         }
317
318         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
319                               "attempting extend a PCR value");
320
321         tpm_buf_destroy(&buf);
322
323         return rc;
324 }
325
326
327 #define TPM2_GETRANDOM_IN_SIZE \
328         (sizeof(struct tpm_input_header) + \
329          sizeof(struct tpm2_get_random_in))
330
331 static const struct tpm_input_header tpm2_getrandom_header = {
332         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
333         .length = cpu_to_be32(TPM2_GETRANDOM_IN_SIZE),
334         .ordinal = cpu_to_be32(TPM2_CC_GET_RANDOM)
335 };
336
337 /**
338  * tpm2_get_random() - get random bytes from the TPM RNG
339  *
340  * @chip: TPM chip to use
341  * @out: destination buffer for the random bytes
342  * @max: the max number of bytes to write to @out
343  *
344  * Return:
345  *    Size of the output buffer, or -EIO on error.
346  */
347 int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
348 {
349         struct tpm2_cmd cmd;
350         u32 recd, rlength;
351         u32 num_bytes;
352         int err;
353         int total = 0;
354         int retries = 5;
355         u8 *dest = out;
356
357         num_bytes = min_t(u32, max, sizeof(cmd.params.getrandom_out.buffer));
358
359         if (!out || !num_bytes ||
360             max > sizeof(cmd.params.getrandom_out.buffer))
361                 return -EINVAL;
362
363         do {
364                 cmd.header.in = tpm2_getrandom_header;
365                 cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
366
367                 err = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd),
368                                        offsetof(struct tpm2_get_random_out,
369                                                 buffer),
370                                        0, "attempting get random");
371                 if (err)
372                         break;
373
374                 recd = min_t(u32, be16_to_cpu(cmd.params.getrandom_out.size),
375                              num_bytes);
376                 rlength = be32_to_cpu(cmd.header.out.length);
377                 if (rlength < offsetof(struct tpm2_get_random_out, buffer) +
378                               recd)
379                         return -EFAULT;
380                 memcpy(dest, cmd.params.getrandom_out.buffer, recd);
381
382                 dest += recd;
383                 total += recd;
384                 num_bytes -= recd;
385         } while (retries-- && total < max);
386
387         return total ? total : -EIO;
388 }
389
390 #define TPM2_GET_TPM_PT_IN_SIZE \
391         (sizeof(struct tpm_input_header) + \
392          sizeof(struct tpm2_get_tpm_pt_in))
393
394 #define TPM2_GET_TPM_PT_OUT_BODY_SIZE \
395          sizeof(struct tpm2_get_tpm_pt_out)
396
397 static const struct tpm_input_header tpm2_get_tpm_pt_header = {
398         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
399         .length = cpu_to_be32(TPM2_GET_TPM_PT_IN_SIZE),
400         .ordinal = cpu_to_be32(TPM2_CC_GET_CAPABILITY)
401 };
402
403 /**
404  * tpm2_flush_context_cmd() - execute a TPM2_FlushContext command
405  * @chip: TPM chip to use
406  * @payload: the key data in clear and encrypted form
407  * @options: authentication values and other options
408  *
409  * Return: same as with tpm_transmit_cmd
410  */
411 void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
412                             unsigned int flags)
413 {
414         struct tpm_buf buf;
415         int rc;
416
417         rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT);
418         if (rc) {
419                 dev_warn(&chip->dev, "0x%08x was not flushed, out of memory\n",
420                          handle);
421                 return;
422         }
423
424         tpm_buf_append_u32(&buf, handle);
425
426         (void) tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, flags,
427                                 "flushing context");
428
429         tpm_buf_destroy(&buf);
430 }
431
432 /**
433  * tpm_buf_append_auth() - append TPMS_AUTH_COMMAND to the buffer.
434  *
435  * @buf: an allocated tpm_buf instance
436  * @session_handle: session handle
437  * @nonce: the session nonce, may be NULL if not used
438  * @nonce_len: the session nonce length, may be 0 if not used
439  * @attributes: the session attributes
440  * @hmac: the session HMAC or password, may be NULL if not used
441  * @hmac_len: the session HMAC or password length, maybe 0 if not used
442  */
443 static void tpm2_buf_append_auth(struct tpm_buf *buf, u32 session_handle,
444                                  const u8 *nonce, u16 nonce_len,
445                                  u8 attributes,
446                                  const u8 *hmac, u16 hmac_len)
447 {
448         tpm_buf_append_u32(buf, 9 + nonce_len + hmac_len);
449         tpm_buf_append_u32(buf, session_handle);
450         tpm_buf_append_u16(buf, nonce_len);
451
452         if (nonce && nonce_len)
453                 tpm_buf_append(buf, nonce, nonce_len);
454
455         tpm_buf_append_u8(buf, attributes);
456         tpm_buf_append_u16(buf, hmac_len);
457
458         if (hmac && hmac_len)
459                 tpm_buf_append(buf, hmac, hmac_len);
460 }
461
462 /**
463  * tpm2_seal_trusted() - seal the payload of a trusted key
464  *
465  * @chip: TPM chip to use
466  * @payload: the key data in clear and encrypted form
467  * @options: authentication values and other options
468  *
469  * Return: < 0 on error and 0 on success.
470  */
471 int tpm2_seal_trusted(struct tpm_chip *chip,
472                       struct trusted_key_payload *payload,
473                       struct trusted_key_options *options)
474 {
475         unsigned int blob_len;
476         struct tpm_buf buf;
477         u32 hash, rlength;
478         int i;
479         int rc;
480
481         for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
482                 if (options->hash == tpm2_hash_map[i].crypto_id) {
483                         hash = tpm2_hash_map[i].tpm_id;
484                         break;
485                 }
486         }
487
488         if (i == ARRAY_SIZE(tpm2_hash_map))
489                 return -EINVAL;
490
491         rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE);
492         if (rc)
493                 return rc;
494
495         tpm_buf_append_u32(&buf, options->keyhandle);
496         tpm2_buf_append_auth(&buf, TPM2_RS_PW,
497                              NULL /* nonce */, 0,
498                              0 /* session_attributes */,
499                              options->keyauth /* hmac */,
500                              TPM_DIGEST_SIZE);
501
502         /* sensitive */
503         tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1);
504
505         tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE);
506         tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE);
507         tpm_buf_append_u16(&buf, payload->key_len + 1);
508         tpm_buf_append(&buf, payload->key, payload->key_len);
509         tpm_buf_append_u8(&buf, payload->migratable);
510
511         /* public */
512         tpm_buf_append_u16(&buf, 14 + options->policydigest_len);
513         tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH);
514         tpm_buf_append_u16(&buf, hash);
515
516         /* policy */
517         if (options->policydigest_len) {
518                 tpm_buf_append_u32(&buf, 0);
519                 tpm_buf_append_u16(&buf, options->policydigest_len);
520                 tpm_buf_append(&buf, options->policydigest,
521                                options->policydigest_len);
522         } else {
523                 tpm_buf_append_u32(&buf, TPM2_OA_USER_WITH_AUTH);
524                 tpm_buf_append_u16(&buf, 0);
525         }
526
527         /* public parameters */
528         tpm_buf_append_u16(&buf, TPM2_ALG_NULL);
529         tpm_buf_append_u16(&buf, 0);
530
531         /* outside info */
532         tpm_buf_append_u16(&buf, 0);
533
534         /* creation PCR */
535         tpm_buf_append_u32(&buf, 0);
536
537         if (buf.flags & TPM_BUF_OVERFLOW) {
538                 rc = -E2BIG;
539                 goto out;
540         }
541
542         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 4, 0,
543                               "sealing data");
544         if (rc)
545                 goto out;
546
547         blob_len = be32_to_cpup((__be32 *) &buf.data[TPM_HEADER_SIZE]);
548         if (blob_len > MAX_BLOB_SIZE) {
549                 rc = -E2BIG;
550                 goto out;
551         }
552         rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)->header.out.length);
553         if (rlength < TPM_HEADER_SIZE + 4 + blob_len) {
554                 rc = -EFAULT;
555                 goto out;
556         }
557
558         memcpy(payload->blob, &buf.data[TPM_HEADER_SIZE + 4], blob_len);
559         payload->blob_len = blob_len;
560
561 out:
562         tpm_buf_destroy(&buf);
563
564         if (rc > 0) {
565                 if (tpm2_rc_value(rc) == TPM2_RC_HASH)
566                         rc = -EINVAL;
567                 else
568                         rc = -EPERM;
569         }
570
571         return rc;
572 }
573
574 /**
575  * tpm2_load_cmd() - execute a TPM2_Load command
576  *
577  * @chip: TPM chip to use
578  * @payload: the key data in clear and encrypted form
579  * @options: authentication values and other options
580  * @blob_handle: returned blob handle
581  * @flags: tpm transmit flags
582  *
583  * Return: 0 on success.
584  *        -E2BIG on wrong payload size.
585  *        -EPERM on tpm error status.
586  *        < 0 error from tpm_transmit_cmd.
587  */
588 static int tpm2_load_cmd(struct tpm_chip *chip,
589                          struct trusted_key_payload *payload,
590                          struct trusted_key_options *options,
591                          u32 *blob_handle, unsigned int flags)
592 {
593         struct tpm_buf buf;
594         unsigned int private_len;
595         unsigned int public_len;
596         unsigned int blob_len;
597         int rc;
598
599         private_len = be16_to_cpup((__be16 *) &payload->blob[0]);
600         if (private_len > (payload->blob_len - 2))
601                 return -E2BIG;
602
603         public_len = be16_to_cpup((__be16 *) &payload->blob[2 + private_len]);
604         blob_len = private_len + public_len + 4;
605         if (blob_len > payload->blob_len)
606                 return -E2BIG;
607
608         rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD);
609         if (rc)
610                 return rc;
611
612         tpm_buf_append_u32(&buf, options->keyhandle);
613         tpm2_buf_append_auth(&buf, TPM2_RS_PW,
614                              NULL /* nonce */, 0,
615                              0 /* session_attributes */,
616                              options->keyauth /* hmac */,
617                              TPM_DIGEST_SIZE);
618
619         tpm_buf_append(&buf, payload->blob, blob_len);
620
621         if (buf.flags & TPM_BUF_OVERFLOW) {
622                 rc = -E2BIG;
623                 goto out;
624         }
625
626         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 4, flags,
627                               "loading blob");
628         if (!rc)
629                 *blob_handle = be32_to_cpup(
630                         (__be32 *) &buf.data[TPM_HEADER_SIZE]);
631
632 out:
633         tpm_buf_destroy(&buf);
634
635         if (rc > 0)
636                 rc = -EPERM;
637
638         return rc;
639 }
640
641 /**
642  * tpm2_unseal_cmd() - execute a TPM2_Unload command
643  *
644  * @chip: TPM chip to use
645  * @payload: the key data in clear and encrypted form
646  * @options: authentication values and other options
647  * @blob_handle: blob handle
648  * @flags: tpm_transmit_cmd flags
649  *
650  * Return: 0 on success
651  *         -EPERM on tpm error status
652  *         < 0 error from tpm_transmit_cmd
653  */
654 static int tpm2_unseal_cmd(struct tpm_chip *chip,
655                            struct trusted_key_payload *payload,
656                            struct trusted_key_options *options,
657                            u32 blob_handle, unsigned int flags)
658 {
659         struct tpm_buf buf;
660         u16 data_len;
661         u8 *data;
662         int rc;
663         u32 rlength;
664
665         rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
666         if (rc)
667                 return rc;
668
669         tpm_buf_append_u32(&buf, blob_handle);
670         tpm2_buf_append_auth(&buf,
671                              options->policyhandle ?
672                              options->policyhandle : TPM2_RS_PW,
673                              NULL /* nonce */, 0,
674                              TPM2_SA_CONTINUE_SESSION,
675                              options->blobauth /* hmac */,
676                              TPM_DIGEST_SIZE);
677
678         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 6, flags,
679                               "unsealing");
680         if (rc > 0)
681                 rc = -EPERM;
682
683         if (!rc) {
684                 data_len = be16_to_cpup(
685                         (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
686
687                 rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)
688                                         ->header.out.length);
689                 if (rlength < TPM_HEADER_SIZE + 6 + data_len) {
690                         rc = -EFAULT;
691                         goto out;
692                 }
693                 data = &buf.data[TPM_HEADER_SIZE + 6];
694
695                 memcpy(payload->key, data, data_len - 1);
696                 payload->key_len = data_len - 1;
697                 payload->migratable = data[data_len - 1];
698         }
699
700 out:
701         tpm_buf_destroy(&buf);
702         return rc;
703 }
704
705 /**
706  * tpm2_unseal_trusted() - unseal the payload of a trusted key
707  *
708  * @chip: TPM chip to use
709  * @payload: the key data in clear and encrypted form
710  * @options: authentication values and other options
711  *
712  * Return: Same as with tpm_transmit_cmd.
713  */
714 int tpm2_unseal_trusted(struct tpm_chip *chip,
715                         struct trusted_key_payload *payload,
716                         struct trusted_key_options *options)
717 {
718         u32 blob_handle;
719         int rc;
720
721         mutex_lock(&chip->tpm_mutex);
722         rc = tpm2_load_cmd(chip, payload, options, &blob_handle,
723                            TPM_TRANSMIT_UNLOCKED);
724         if (rc)
725                 goto out;
726
727         rc = tpm2_unseal_cmd(chip, payload, options, blob_handle,
728                              TPM_TRANSMIT_UNLOCKED);
729         tpm2_flush_context_cmd(chip, blob_handle, TPM_TRANSMIT_UNLOCKED);
730 out:
731         mutex_unlock(&chip->tpm_mutex);
732         return rc;
733 }
734
735 /**
736  * tpm2_get_tpm_pt() - get value of a TPM_CAP_TPM_PROPERTIES type property
737  * @chip:               TPM chip to use.
738  * @property_id:        property ID.
739  * @value:              output variable.
740  * @desc:               passed to tpm_transmit_cmd()
741  *
742  * Return: Same as with tpm_transmit_cmd.
743  */
744 ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
745                         const char *desc)
746 {
747         struct tpm2_cmd cmd;
748         int rc;
749
750         cmd.header.in = tpm2_get_tpm_pt_header;
751         cmd.params.get_tpm_pt_in.cap_id = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES);
752         cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
753         cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
754
755         rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd),
756                               TPM2_GET_TPM_PT_OUT_BODY_SIZE, 0, desc);
757         if (!rc)
758                 *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
759
760         return rc;
761 }
762 EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt);
763
764 #define TPM2_SHUTDOWN_IN_SIZE \
765         (sizeof(struct tpm_input_header) + \
766          sizeof(struct tpm2_startup_in))
767
768 static const struct tpm_input_header tpm2_shutdown_header = {
769         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
770         .length = cpu_to_be32(TPM2_SHUTDOWN_IN_SIZE),
771         .ordinal = cpu_to_be32(TPM2_CC_SHUTDOWN)
772 };
773
774 /**
775  * tpm2_shutdown() - send shutdown command to the TPM chip
776  *
777  * @chip:               TPM chip to use.
778  * @shutdown_type:      shutdown type. The value is either
779  *                      TPM_SU_CLEAR or TPM_SU_STATE.
780  */
781 void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
782 {
783         struct tpm2_cmd cmd;
784         int rc;
785
786         cmd.header.in = tpm2_shutdown_header;
787         cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
788
789         rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd), 0, 0,
790                               "stopping the TPM");
791
792         /* In places where shutdown command is sent there's no much we can do
793          * except print the error code on a system failure.
794          */
795         if (rc < 0 && rc != -EPIPE)
796                 dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",
797                          rc);
798 }
799
800 /*
801  * tpm2_calc_ordinal_duration() - maximum duration for a command
802  *
803  * @chip:       TPM chip to use.
804  * @ordinal:    command code number.
805  *
806  * Return: maximum duration for a command
807  */
808 unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
809 {
810         int index = TPM_UNDEFINED;
811         int duration = 0;
812
813         if (ordinal >= TPM2_CC_FIRST && ordinal <= TPM2_CC_LAST)
814                 index = tpm2_ordinal_duration[ordinal - TPM2_CC_FIRST];
815
816         if (index != TPM_UNDEFINED)
817                 duration = chip->duration[index];
818
819         if (duration <= 0)
820                 duration = 2 * 60 * HZ;
821
822         return duration;
823 }
824 EXPORT_SYMBOL_GPL(tpm2_calc_ordinal_duration);
825
826 #define TPM2_SELF_TEST_IN_SIZE \
827         (sizeof(struct tpm_input_header) + \
828          sizeof(struct tpm2_self_test_in))
829
830 static const struct tpm_input_header tpm2_selftest_header = {
831         .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
832         .length = cpu_to_be32(TPM2_SELF_TEST_IN_SIZE),
833         .ordinal = cpu_to_be32(TPM2_CC_SELF_TEST)
834 };
835
836 /**
837  * tpm2_do_selftest() - ensure that all self tests have passed
838  *
839  * @chip: TPM chip to use
840  *
841  * Return: Same as with tpm_transmit_cmd.
842  *
843  * The TPM can either run all self tests synchronously and then return
844  * RC_SUCCESS once all tests were successful. Or it can choose to run the tests
845  * asynchronously and return RC_TESTING immediately while the self tests still
846  * execute in the background. This function handles both cases and waits until
847  * all tests have completed.
848  */
849 static int tpm2_do_selftest(struct tpm_chip *chip)
850 {
851         int rc;
852         unsigned int delay_msec = 10;
853         long duration;
854         struct tpm2_cmd cmd;
855
856         duration = jiffies_to_msecs(
857                 tpm2_calc_ordinal_duration(chip, TPM2_CC_SELF_TEST));
858
859         while (1) {
860                 cmd.header.in = tpm2_selftest_header;
861                 cmd.params.selftest_in.full_test = 0;
862
863                 rc = tpm_transmit_cmd(chip, NULL, &cmd, TPM2_SELF_TEST_IN_SIZE,
864                                       0, 0, "continue selftest");
865
866                 if (rc != TPM2_RC_TESTING || delay_msec >= duration)
867                         break;
868
869                 /* wait longer than before */
870                 delay_msec *= 2;
871                 tpm_msleep(delay_msec);
872         }
873
874         return rc;
875 }
876
877 /**
878  * tpm2_probe() - probe TPM 2.0
879  * @chip: TPM chip to use
880  *
881  * Return: < 0 error and 0 on success.
882  *
883  * Send idempotent TPM 2.0 command and see whether TPM 2.0 chip replied based on
884  * the reply tag.
885  */
886 int tpm2_probe(struct tpm_chip *chip)
887 {
888         struct tpm2_cmd cmd;
889         int rc;
890
891         cmd.header.in = tpm2_get_tpm_pt_header;
892         cmd.params.get_tpm_pt_in.cap_id = cpu_to_be32(TPM2_CAP_TPM_PROPERTIES);
893         cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
894         cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
895
896         rc = tpm_transmit_cmd(chip, NULL, &cmd, sizeof(cmd), 0, 0, NULL);
897         if (rc <  0)
898                 return rc;
899
900         if (be16_to_cpu(cmd.header.out.tag) == TPM2_ST_NO_SESSIONS)
901                 chip->flags |= TPM_CHIP_FLAG_TPM2;
902
903         return 0;
904 }
905 EXPORT_SYMBOL_GPL(tpm2_probe);
906
907 struct tpm2_pcr_selection {
908         __be16  hash_alg;
909         u8  size_of_select;
910         u8  pcr_select[3];
911 } __packed;
912
913 static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
914 {
915         struct tpm2_pcr_selection pcr_selection;
916         struct tpm_buf buf;
917         void *marker;
918         void *end;
919         void *pcr_select_offset;
920         unsigned int count;
921         u32 sizeof_pcr_selection;
922         u32 rsp_len;
923         int rc;
924         int i = 0;
925
926         rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
927         if (rc)
928                 return rc;
929
930         tpm_buf_append_u32(&buf, TPM2_CAP_PCRS);
931         tpm_buf_append_u32(&buf, 0);
932         tpm_buf_append_u32(&buf, 1);
933
934         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 9, 0,
935                               "get tpm pcr allocation");
936         if (rc)
937                 goto out;
938
939         count = be32_to_cpup(
940                 (__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
941
942         if (count > ARRAY_SIZE(chip->active_banks)) {
943                 rc = -ENODEV;
944                 goto out;
945         }
946
947         marker = &buf.data[TPM_HEADER_SIZE + 9];
948
949         rsp_len = be32_to_cpup((__be32 *)&buf.data[2]);
950         end = &buf.data[rsp_len];
951
952         for (i = 0; i < count; i++) {
953                 pcr_select_offset = marker +
954                         offsetof(struct tpm2_pcr_selection, size_of_select);
955                 if (pcr_select_offset >= end) {
956                         rc = -EFAULT;
957                         break;
958                 }
959
960                 memcpy(&pcr_selection, marker, sizeof(pcr_selection));
961                 chip->active_banks[i] = be16_to_cpu(pcr_selection.hash_alg);
962                 sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
963                         sizeof(pcr_selection.size_of_select) +
964                         pcr_selection.size_of_select;
965                 marker = marker + sizeof_pcr_selection;
966         }
967
968 out:
969         if (i < ARRAY_SIZE(chip->active_banks))
970                 chip->active_banks[i] = TPM2_ALG_ERROR;
971
972         tpm_buf_destroy(&buf);
973
974         return rc;
975 }
976
977 static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
978 {
979         struct tpm_buf buf;
980         u32 nr_commands;
981         __be32 *attrs;
982         u32 cc;
983         int i;
984         int rc;
985
986         rc = tpm2_get_tpm_pt(chip, TPM_PT_TOTAL_COMMANDS, &nr_commands, NULL);
987         if (rc)
988                 goto out;
989
990         if (nr_commands > 0xFFFFF) {
991                 rc = -EFAULT;
992                 goto out;
993         }
994
995         chip->cc_attrs_tbl = devm_kzalloc(&chip->dev, 4 * nr_commands,
996                                           GFP_KERNEL);
997
998         rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
999         if (rc)
1000                 goto out;
1001
1002         tpm_buf_append_u32(&buf, TPM2_CAP_COMMANDS);
1003         tpm_buf_append_u32(&buf, TPM2_CC_FIRST);
1004         tpm_buf_append_u32(&buf, nr_commands);
1005
1006         rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE,
1007                               9 + 4 * nr_commands, 0, NULL);
1008         if (rc) {
1009                 tpm_buf_destroy(&buf);
1010                 goto out;
1011         }
1012
1013         if (nr_commands !=
1014             be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) {
1015                 tpm_buf_destroy(&buf);
1016                 goto out;
1017         }
1018
1019         chip->nr_commands = nr_commands;
1020
1021         attrs = (__be32 *)&buf.data[TPM_HEADER_SIZE + 9];
1022         for (i = 0; i < nr_commands; i++, attrs++) {
1023                 chip->cc_attrs_tbl[i] = be32_to_cpup(attrs);
1024                 cc = chip->cc_attrs_tbl[i] & 0xFFFF;
1025
1026                 if (cc == TPM2_CC_CONTEXT_SAVE || cc == TPM2_CC_FLUSH_CONTEXT) {
1027                         chip->cc_attrs_tbl[i] &=
1028                                 ~(GENMASK(2, 0) << TPM2_CC_ATTR_CHANDLES);
1029                         chip->cc_attrs_tbl[i] |= 1 << TPM2_CC_ATTR_CHANDLES;
1030                 }
1031         }
1032
1033         tpm_buf_destroy(&buf);
1034
1035 out:
1036         if (rc > 0)
1037                 rc = -ENODEV;
1038         return rc;
1039 }
1040
1041 /**
1042  * tpm2_auto_startup - Perform the standard automatic TPM initialization
1043  *                     sequence
1044  * @chip: TPM chip to use
1045  *
1046  * Returns 0 on success, < 0 in case of fatal error.
1047  */
1048 int tpm2_auto_startup(struct tpm_chip *chip)
1049 {
1050         int rc;
1051
1052         rc = tpm_get_timeouts(chip);
1053         if (rc)
1054                 goto out;
1055
1056         rc = tpm2_do_selftest(chip);
1057         if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
1058                 dev_err(&chip->dev, "TPM self test failed\n");
1059                 goto out;
1060         }
1061
1062         if (rc == TPM2_RC_INITIALIZE) {
1063                 rc = tpm_startup(chip);
1064                 if (rc)
1065                         goto out;
1066
1067                 rc = tpm2_do_selftest(chip);
1068                 if (rc) {
1069                         dev_err(&chip->dev, "TPM self test failed\n");
1070                         goto out;
1071                 }
1072         }
1073
1074         rc = tpm2_get_pcr_allocation(chip);
1075         if (rc)
1076                 goto out;
1077
1078         rc = tpm2_get_cc_attrs_tbl(chip);
1079
1080 out:
1081         if (rc > 0)
1082                 rc = -ENODEV;
1083         return rc;
1084 }
1085
1086 int tpm2_find_cc(struct tpm_chip *chip, u32 cc)
1087 {
1088         int i;
1089
1090         for (i = 0; i < chip->nr_commands; i++)
1091                 if (cc == (chip->cc_attrs_tbl[i] & GENMASK(15, 0)))
1092                         return i;
1093
1094         return -1;
1095 }