src/security/tpm/tspi/tspi.c

   1 /* SPDX-License-Identifier: GPL-2.0-only */
   2
   3 #include <console/console.h>
   4 #include <security/tpm/tspi/crtm.h>
   5 #include <security/tpm/tspi/logs.h>
   6 #include <security/tpm/tspi.h>
   7 #include <security/tpm/tss.h>
   8 #include <assert.h>
   9 #include <security/vboot/misc.h>
  10 #include <vb2_api.h>
  11 #include <vb2_sha.h>
  12
  13 #if CONFIG(TPM1)
  14 static tpm_result_t tpm1_invoke_state_machine(void)
  15 {
  16         uint8_t disabled;
  17         uint8_t deactivated;
  18         tpm_result_t rc = TPM_SUCCESS;
  19
  20         if (tlcl_get_family() != TPM_1)
  21                 return rc;
  22
  23         /* Check that the TPM is enabled and activated. */
  24         rc = tlcl1_get_flags(&disabled, &deactivated, NULL);
  25         if (rc != TPM_SUCCESS) {
  26                 printk(BIOS_ERR, "TPM Error (%#x): Can't read capabilities.\n", rc);
  27                 return rc;
  28         }
  29
  30         if (disabled) {
  31                 printk(BIOS_INFO, "TPM: is disabled. Enabling...\n");
  32
  33                 rc = tlcl1_set_enable();
  34                 if (rc != TPM_SUCCESS) {
  35                         printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc);
  36                         return rc;
  37                 }
  38         }
  39
  40         if (!!deactivated != CONFIG(TPM_DEACTIVATE)) {
  41                 printk(BIOS_INFO,
  42                        "TPM: Unexpected TPM deactivated state. Toggling...\n");
  43                 rc = tlcl1_set_deactivated(!deactivated);
  44                 if (rc != TPM_SUCCESS) {
  45                         printk(BIOS_ERR,
  46                                "TPM Error (%#x): Can't toggle deactivated state.\n", rc);
  47                         return rc;
  48                 }
  49
  50                 deactivated = !deactivated;
  51                 rc = TPM_CB_MUST_REBOOT;
  52         }
  53
  54         return rc;
  55 }
  56 #endif
  57
  58 static tpm_result_t tpm_setup_s3_helper(void)
  59 {
  60         tpm_result_t rc = tlcl_resume();
  61         switch (rc) {
  62         case TPM_SUCCESS:
  63                 break;
  64
  65         case TPM_INVALID_POSTINIT:
  66                 /*
  67                  * We're on a platform where the TPM maintains power
  68                  * in S3, so it's already initialized.
  69                  */
  70                 printk(BIOS_INFO, "TPM: Already initialized.\n");
  71                 rc = TPM_SUCCESS;
  72                 break;
  73
  74         default:
  75                 printk(BIOS_ERR, "TPM: Resume failed (%#x).\n", rc);
  76                 break;
  77         }
  78
  79         return rc;
  80 }
  81
  82 static tpm_result_t tpm_setup_epilogue(tpm_result_t rc)
  83 {
  84         if (rc != TPM_SUCCESS)
  85                 post_code(POSTCODE_TPM_FAILURE);
  86         else
  87                 printk(BIOS_INFO, "TPM: setup succeeded\n");
  88
  89         return rc;
  90 }
  91
  92 static int tpm_is_setup;
  93 static inline int tspi_tpm_is_setup(void)
  94 {
  95         /*
  96          * vboot_logic_executed() only starts returning true at the end of
  97          * verstage, but the vboot logic itself already wants to extend PCRs
  98          * before that. So in the stage where verification actually runs, we
  99          * need to check tpm_is_setup. Skip that check in all other stages so
 100          * this whole function can be evaluated at compile time.
 101          */
 102         if (CONFIG(VBOOT)) {
 103                 if (verification_should_run())
 104                         return tpm_is_setup;
 105                 return vboot_logic_executed();
 106         }
 107
 108         if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
 109                 return ENV_BOOTBLOCK ? tpm_is_setup : 1;
 110
 111         if (ENV_RAMSTAGE)
 112                 return tpm_is_setup;
 113
 114         return 0;
 115 }
 116
 117 /*
 118  * tpm_setup starts the TPM and establishes the root of trust for the
 119  * anti-rollback mechanism.  tpm_setup can fail for three reasons.  1 A bug.
 120  * 2 a TPM hardware failure. 3 An unexpected TPM state due to some attack.  In
 121  * general we cannot easily distinguish the kind of failure, so our strategy is
 122  * to reboot in recovery mode in all cases.  The recovery mode calls tpm_setup
 123  * again, which executes (almost) the same sequence of operations.  There is a
 124  * good chance that, if recovery mode was entered because of a TPM failure, the
 125  * failure will repeat itself.  (In general this is impossible to guarantee
 126  * because we have no way of creating the exact TPM initial state at the
 127  * previous boot.)  In recovery mode, we ignore the failure and continue, thus
 128  * giving the recovery kernel a chance to fix things (that's why we don't set
 129  * bGlobalLock).  The choice is between a knowingly insecure device and a
 130  * bricked device.
 131  *
 132  * As a side note, observe that we go through considerable hoops to avoid using
 133  * the STCLEAR permissions for the index spaces.  We do this to avoid writing
 134  * to the TPM flashram at every reboot or wake-up, because of concerns about
 135  * the durability of the NVRAM.
 136  */
 137 tpm_result_t tpm_setup(int s3flag)
 138 {
 139         tpm_result_t rc;
 140
 141         rc = tlcl_lib_init();
 142         if (rc != TPM_SUCCESS) {
 143                 printk(BIOS_ERR, "TPM Error (%#x): Can't initialize.\n", rc);
 144                 return tpm_setup_epilogue(rc);
 145         }
 146
 147         /* Handle special init for S3 resume path */
 148         if (s3flag) {
 149                 printk(BIOS_INFO, "TPM: Handle S3 resume.\n");
 150                 return tpm_setup_epilogue(tpm_setup_s3_helper());
 151         }
 152
 153         rc = tlcl_startup();
 154         if (CONFIG(TPM_STARTUP_IGNORE_POSTINIT)
 155             && rc == TPM_INVALID_POSTINIT) {
 156                 printk(BIOS_DEBUG, "TPM Warn(%#x): ignoring invalid POSTINIT\n", rc);
 157                 rc = TPM_SUCCESS;
 158         }
 159         if (rc != TPM_SUCCESS) {
 160                 printk(BIOS_ERR, "TPM Error (%#x): Can't run startup command.\n", rc);
 161                 return tpm_setup_epilogue(rc);
 162         }
 163
 164         rc = tlcl_assert_physical_presence();
 165         if (rc != TPM_SUCCESS) {
 166                 /*
 167                  * It is possible that the TPM was delivered with the physical
 168                  * presence command disabled.  This tries enabling it, then
 169                  * tries asserting PP again.
 170                  */
 171                 rc = tlcl_physical_presence_cmd_enable();
 172                 if (rc != TPM_SUCCESS) {
 173                         printk(BIOS_ERR, "TPM Error (%#x): Can't enable physical presence command.\n", rc);
 174                         return tpm_setup_epilogue(rc);
 175                 }
 176
 177                 rc = tlcl_assert_physical_presence();
 178                 if (rc != TPM_SUCCESS) {
 179                         printk(BIOS_ERR, "TPM Error (%#x): Can't assert physical presence.\n", rc);
 180                         return tpm_setup_epilogue(rc);
 181                 }
 182         }
 183
 184 #if CONFIG(TPM1)
 185         rc = tpm1_invoke_state_machine();
 186 #endif
 187         if (CONFIG(TPM_MEASURED_BOOT))
 188                 rc = tspi_measure_cache_to_pcr();
 189
 190         tpm_is_setup = 1;
 191         return tpm_setup_epilogue(rc);
 192 }
 193
 194 tpm_result_t tpm_clear_and_reenable(void)
 195 {
 196         tpm_result_t rc;
 197
 198         printk(BIOS_INFO, "TPM: Clear and re-enable\n");
 199         rc = tlcl_force_clear();
 200         if (rc != TPM_SUCCESS) {
 201                 printk(BIOS_ERR, "TPM Error (%#x): Can't initiate a force clear.\n", rc);
 202                 return rc;
 203         }
 204
 205         if (tlcl_get_family() == TPM_1) {
 206                 rc = tlcl1_set_enable();
 207                 if (rc != TPM_SUCCESS) {
 208                         printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc);
 209                         return rc;
 210                 }
 211
 212                 rc = tlcl1_set_deactivated(0);
 213                 if (rc != TPM_SUCCESS) {
 214                         printk(BIOS_ERR, "TPM Error (%#x): Can't set deactivated state.\n", rc);
 215                         return rc;
 216                 }
 217         }
 218
 219         return TPM_SUCCESS;
 220 }
 221
 222 tpm_result_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo,
 223                         const uint8_t *digest, size_t digest_len, const char *name)
 224 {
 225         tpm_result_t rc;
 226
 227         if (!digest)
 228                 return TPM_IOERROR;
 229
 230         if (tspi_tpm_is_setup()) {
 231                 rc = tlcl_lib_init();
 232                 if (rc != TPM_SUCCESS) {
 233                         printk(BIOS_ERR, "TPM Error (%#x): Can't initialize library.\n", rc);
 234                         return rc;
 235                 }
 236
 237                 printk(BIOS_DEBUG, "TPM: Extending digest for `%s` into PCR %d\n", name, pcr);
 238                 rc = tlcl_extend(pcr, digest, digest_algo);
 239                 if (rc != TPM_SUCCESS) {
 240                         printk(BIOS_ERR, "TPM Error (%#x): Extending hash for `%s` into PCR %d failed.\n",
 241                                rc, name, pcr);
 242                         return rc;
 243                 }
 244         }
 245
 246         if (CONFIG(TPM_MEASURED_BOOT))
 247                 tpm_log_add_table_entry(name, pcr, digest_algo, digest, digest_len);
 248
 249         printk(BIOS_DEBUG, "TPM: Digest of `%s` to PCR %d %s\n",
 250                name, pcr, tspi_tpm_is_setup() ? "measured" : "logged");
 251
 252         return TPM_SUCCESS;
 253 }
 254
 255 #if CONFIG(VBOOT_LIB)
 256 tpm_result_t tpm_measure_region(const struct region_device *rdev, uint8_t pcr,
 257                             const char *rname)
 258 {
 259         uint8_t digest[TPM_PCR_MAX_LEN], digest_len;
 260         uint8_t buf[HASH_DATA_CHUNK_SIZE];
 261         uint32_t offset;
 262         size_t len;
 263         struct vb2_digest_context ctx;
 264
 265         if (!rdev || !rname)
 266                 return TPM_CB_INVALID_ARG;
 267
 268         digest_len = vb2_digest_size(TPM_MEASURE_ALGO);
 269         assert(digest_len <= sizeof(digest));
 270         if (vb2_digest_init(&ctx, vboot_hwcrypto_allowed(), TPM_MEASURE_ALGO,
 271                             region_device_sz(rdev))) {
 272                 printk(BIOS_ERR, "TPM: Error initializing hash.\n");
 273                 return TPM_CB_HASH_ERROR;
 274         }
 275         /*
 276          * Though one can mmap the full needed region on x86 this is not the
 277          * case for e.g. ARM. In order to make this code as universal as
 278          * possible across different platforms read the data to hash in chunks.
 279          */
 280         for (offset = 0; offset < region_device_sz(rdev); offset += len) {
 281                 len = MIN(sizeof(buf), region_device_sz(rdev) - offset);
 282                 if (rdev_readat(rdev, buf, offset, len) < 0) {
 283                         printk(BIOS_ERR, "TPM: Not able to read region %s.\n",
 284                                rname);
 285                         return TPM_CB_READ_FAILURE;
 286                 }
 287                 if (vb2_digest_extend(&ctx, buf, len)) {
 288                         printk(BIOS_ERR, "TPM: Error extending hash.\n");
 289                         return TPM_CB_HASH_ERROR;
 290                 }
 291         }
 292         if (vb2_digest_finalize(&ctx, digest, digest_len)) {
 293                 printk(BIOS_ERR, "TPM: Error finalizing hash.\n");
 294                 return TPM_CB_HASH_ERROR;
 295         }
 296         return tpm_extend_pcr(pcr, TPM_MEASURE_ALGO, digest, digest_len, rname);
 297 }
 298 #endif /* VBOOT_LIB */