drivers/char/tpm/tpm_ftpm_tee.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (C) Microsoft Corporation
   4  *
   5  * Implements a firmware TPM as described here:
   6  * https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/
   7  *
   8  * A reference implementation is available here:
   9  * https://github.com/microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM
  10  */
  11
  12 #include <linux/acpi.h>
  13 #include <linux/of.h>
  14 #include <linux/platform_device.h>
  15 #include <linux/tee_drv.h>
  16 #include <linux/tpm.h>
  17 #include <linux/uuid.h>
  18
  19 #include "tpm.h"
  20 #include "tpm_ftpm_tee.h"
  21
  22 /*
  23  * TA_FTPM_UUID: BC50D971-D4C9-42C4-82CB-343FB7F37896
  24  *
  25  * Randomly generated, and must correspond to the GUID on the TA side.
  26  * Defined here in the reference implementation:
  27  * https://github.com/microsoft/ms-tpm-20-ref/blob/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/include/fTPM.h#L42
  28  */
  29 static const uuid_t ftpm_ta_uuid =
  30         UUID_INIT(0xBC50D971, 0xD4C9, 0x42C4,
  31                   0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96);
  32
  33 /**
  34  * ftpm_tee_tpm_op_recv() - retrieve fTPM response.
  35  * @chip:       the tpm_chip description as specified in driver/char/tpm/tpm.h.
  36  * @buf:        the buffer to store data.
  37  * @count:      the number of bytes to read.
  38  *
  39  * Return:
  40  *      In case of success the number of bytes received.
  41  *      On failure, -errno.
  42  */
  43 static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
  44 {
  45         struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent);
  46         size_t len;
  47
  48         len = pvt_data->resp_len;
  49         if (count < len) {
  50                 dev_err(&chip->dev,
  51                         "%s: Invalid size in recv: count=%zd, resp_len=%zd\n",
  52                         __func__, count, len);
  53                 return -EIO;
  54         }
  55
  56         memcpy(buf, pvt_data->resp_buf, len);
  57         pvt_data->resp_len = 0;
  58
  59         return len;
  60 }
  61
  62 /**
  63  * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory.
  64  * @chip:       the tpm_chip description as specified in driver/char/tpm/tpm.h
  65  * @buf:        the buffer to send.
  66  * @len:        the number of bytes to send.
  67  *
  68  * Return:
  69  *      In case of success, returns 0.
  70  *      On failure, -errno
  71  */
  72 static int ftpm_tee_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t len)
  73 {
  74         struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent);
  75         size_t resp_len;
  76         int rc;
  77         u8 *temp_buf;
  78         struct tpm_header *resp_header;
  79         struct tee_ioctl_invoke_arg transceive_args;
  80         struct tee_param command_params[4];
  81         struct tee_shm *shm = pvt_data->shm;
  82
  83         if (len > MAX_COMMAND_SIZE) {
  84                 dev_err(&chip->dev,
  85                         "%s: len=%zd exceeds MAX_COMMAND_SIZE supported by fTPM TA\n",
  86                         __func__, len);
  87                 return -EIO;
  88         }
  89
  90         memset(&transceive_args, 0, sizeof(transceive_args));
  91         memset(command_params, 0, sizeof(command_params));
  92         pvt_data->resp_len = 0;
  93
  94         /* Invoke FTPM_OPTEE_TA_SUBMIT_COMMAND function of fTPM TA */
  95         transceive_args = (struct tee_ioctl_invoke_arg) {
  96                 .func = FTPM_OPTEE_TA_SUBMIT_COMMAND,
  97                 .session = pvt_data->session,
  98                 .num_params = 4,
  99         };
 100
 101         /* Fill FTPM_OPTEE_TA_SUBMIT_COMMAND parameters */
 102         command_params[0] = (struct tee_param) {
 103                 .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT,
 104                 .u.memref = {
 105                         .shm = shm,
 106                         .size = len,
 107                         .shm_offs = 0,
 108                 },
 109         };
 110
 111         temp_buf = tee_shm_get_va(shm, 0);
 112         if (IS_ERR(temp_buf)) {
 113                 dev_err(&chip->dev, "%s: tee_shm_get_va failed for transmit\n",
 114                         __func__);
 115                 return PTR_ERR(temp_buf);
 116         }
 117         memset(temp_buf, 0, (MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE));
 118         memcpy(temp_buf, buf, len);
 119
 120         command_params[1] = (struct tee_param) {
 121                 .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT,
 122                 .u.memref = {
 123                         .shm = shm,
 124                         .size = MAX_RESPONSE_SIZE,
 125                         .shm_offs = MAX_COMMAND_SIZE,
 126                 },
 127         };
 128
 129         rc = tee_client_invoke_func(pvt_data->ctx, &transceive_args,
 130                                     command_params);
 131         if ((rc < 0) || (transceive_args.ret != 0)) {
 132                 dev_err(&chip->dev, "%s: SUBMIT_COMMAND invoke error: 0x%x\n",
 133                         __func__, transceive_args.ret);
 134                 return (rc < 0) ? rc : transceive_args.ret;
 135         }
 136
 137         temp_buf = tee_shm_get_va(shm, command_params[1].u.memref.shm_offs);
 138         if (IS_ERR(temp_buf)) {
 139                 dev_err(&chip->dev, "%s: tee_shm_get_va failed for receive\n",
 140                         __func__);
 141                 return PTR_ERR(temp_buf);
 142         }
 143
 144         resp_header = (struct tpm_header *)temp_buf;
 145         resp_len = be32_to_cpu(resp_header->length);
 146
 147         /* sanity check resp_len */
 148         if (resp_len < TPM_HEADER_SIZE) {
 149                 dev_err(&chip->dev, "%s: tpm response header too small\n",
 150                         __func__);
 151                 return -EIO;
 152         }
 153         if (resp_len > MAX_RESPONSE_SIZE) {
 154                 dev_err(&chip->dev,
 155                         "%s: resp_len=%zd exceeds MAX_RESPONSE_SIZE\n",
 156                         __func__, resp_len);
 157                 return -EIO;
 158         }
 159
 160         /* sanity checks look good, cache the response */
 161         memcpy(pvt_data->resp_buf, temp_buf, resp_len);
 162         pvt_data->resp_len = resp_len;
 163
 164         return 0;
 165 }
 166
 167 static void ftpm_tee_tpm_op_cancel(struct tpm_chip *chip)
 168 {
 169         /* not supported */
 170 }
 171
 172 static u8 ftpm_tee_tpm_op_status(struct tpm_chip *chip)
 173 {
 174         return 0;
 175 }
 176
 177 static bool ftpm_tee_tpm_req_canceled(struct tpm_chip *chip, u8 status)
 178 {
 179         return false;
 180 }
 181
 182 static const struct tpm_class_ops ftpm_tee_tpm_ops = {
 183         .flags = TPM_OPS_AUTO_STARTUP,
 184         .recv = ftpm_tee_tpm_op_recv,
 185         .send = ftpm_tee_tpm_op_send,
 186         .cancel = ftpm_tee_tpm_op_cancel,
 187         .status = ftpm_tee_tpm_op_status,
 188         .req_complete_mask = 0,
 189         .req_complete_val = 0,
 190         .req_canceled = ftpm_tee_tpm_req_canceled,
 191 };
 192
 193 /*
 194  * Check whether this driver supports the fTPM TA in the TEE instance
 195  * represented by the params (ver/data) to this function.
 196  */
 197 static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data)
 198 {
 199         /*
 200          * Currently this driver only support GP Complaint OPTEE based fTPM TA
 201          */
 202         if ((ver->impl_id == TEE_IMPL_ID_OPTEE) &&
 203                 (ver->gen_caps & TEE_GEN_CAP_GP))
 204                 return 1;
 205         else
 206                 return 0;
 207 }
 208
 209 /**
 210  * ftpm_tee_probe() - initialize the fTPM
 211  * @dev: the device description.
 212  *
 213  * Return:
 214  *      On success, 0. On failure, -errno.
 215  */
 216 static int ftpm_tee_probe(struct device *dev)
 217 {
 218         int rc;
 219         struct tpm_chip *chip;
 220         struct ftpm_tee_private *pvt_data = NULL;
 221         struct tee_ioctl_open_session_arg sess_arg;
 222
 223         pvt_data = devm_kzalloc(dev, sizeof(struct ftpm_tee_private),
 224                                 GFP_KERNEL);
 225         if (!pvt_data)
 226                 return -ENOMEM;
 227
 228         dev_set_drvdata(dev, pvt_data);
 229
 230         /* Open context with TEE driver */
 231         pvt_data->ctx = tee_client_open_context(NULL, ftpm_tee_match, NULL,
 232                                                 NULL);
 233         if (IS_ERR(pvt_data->ctx)) {
 234                 if (PTR_ERR(pvt_data->ctx) == -ENOENT)
 235                         return -EPROBE_DEFER;
 236                 dev_err(dev, "%s: tee_client_open_context failed\n", __func__);
 237                 return PTR_ERR(pvt_data->ctx);
 238         }
 239
 240         /* Open a session with fTPM TA */
 241         memset(&sess_arg, 0, sizeof(sess_arg));
 242         export_uuid(sess_arg.uuid, &ftpm_ta_uuid);
 243         sess_arg.clnt_login = TEE_IOCTL_LOGIN_PUBLIC;
 244         sess_arg.num_params = 0;
 245
 246         rc = tee_client_open_session(pvt_data->ctx, &sess_arg, NULL);
 247         if ((rc < 0) || (sess_arg.ret != 0)) {
 248                 dev_err(dev, "%s: tee_client_open_session failed, err=%x\n",
 249                         __func__, sess_arg.ret);
 250                 rc = -EINVAL;
 251                 goto out_tee_session;
 252         }
 253         pvt_data->session = sess_arg.session;
 254
 255         /* Allocate dynamic shared memory with fTPM TA */
 256         pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx,
 257                                                  MAX_COMMAND_SIZE +
 258                                                  MAX_RESPONSE_SIZE);
 259         if (IS_ERR(pvt_data->shm)) {
 260                 dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__);
 261                 rc = -ENOMEM;
 262                 goto out_shm_alloc;
 263         }
 264
 265         /* Allocate new struct tpm_chip instance */
 266         chip = tpm_chip_alloc(dev, &ftpm_tee_tpm_ops);
 267         if (IS_ERR(chip)) {
 268                 dev_err(dev, "%s: tpm_chip_alloc failed\n", __func__);
 269                 rc = PTR_ERR(chip);
 270                 goto out_chip_alloc;
 271         }
 272
 273         pvt_data->chip = chip;
 274         pvt_data->chip->flags |= TPM_CHIP_FLAG_TPM2;
 275
 276         /* Create a character device for the fTPM */
 277         rc = tpm_chip_register(pvt_data->chip);
 278         if (rc) {
 279                 dev_err(dev, "%s: tpm_chip_register failed with rc=%d\n",
 280                         __func__, rc);
 281                 goto out_chip;
 282         }
 283
 284         return 0;
 285
 286 out_chip:
 287         put_device(&pvt_data->chip->dev);
 288 out_chip_alloc:
 289         tee_shm_free(pvt_data->shm);
 290 out_shm_alloc:
 291         tee_client_close_session(pvt_data->ctx, pvt_data->session);
 292 out_tee_session:
 293         tee_client_close_context(pvt_data->ctx);
 294
 295         return rc;
 296 }
 297
 298 static int ftpm_plat_tee_probe(struct platform_device *pdev)
 299 {
 300         struct device *dev = &pdev->dev;
 301
 302         return ftpm_tee_probe(dev);
 303 }
 304
 305 /**
 306  * ftpm_tee_remove() - remove the TPM device
 307  * @dev: the device description.
 308  *
 309  * Return:
 310  *      0 always.
 311  */
 312 static int ftpm_tee_remove(struct device *dev)
 313 {
 314         struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev);
 315
 316         /* Release the chip */
 317         tpm_chip_unregister(pvt_data->chip);
 318
 319         /* frees chip */
 320         put_device(&pvt_data->chip->dev);
 321
 322         /* Free the shared memory pool */
 323         tee_shm_free(pvt_data->shm);
 324
 325         /* close the existing session with fTPM TA*/
 326         tee_client_close_session(pvt_data->ctx, pvt_data->session);
 327
 328         /* close the context with TEE driver */
 329         tee_client_close_context(pvt_data->ctx);
 330
 331         /* memory allocated with devm_kzalloc() is freed automatically */
 332
 333         return 0;
 334 }
 335
 336 static void ftpm_plat_tee_remove(struct platform_device *pdev)
 337 {
 338         struct device *dev = &pdev->dev;
 339
 340         ftpm_tee_remove(dev);
 341 }
 342
 343 /**
 344  * ftpm_plat_tee_shutdown() - shutdown the TPM device
 345  * @pdev: the platform_device description.
 346  */
 347 static void ftpm_plat_tee_shutdown(struct platform_device *pdev)
 348 {
 349         struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev);
 350
 351         tee_shm_free(pvt_data->shm);
 352         tee_client_close_session(pvt_data->ctx, pvt_data->session);
 353         tee_client_close_context(pvt_data->ctx);
 354 }
 355
 356 static const struct of_device_id of_ftpm_tee_ids[] = {
 357         { .compatible = "microsoft,ftpm" },
 358         { }
 359 };
 360 MODULE_DEVICE_TABLE(of, of_ftpm_tee_ids);
 361
 362 static struct platform_driver ftpm_tee_plat_driver = {
 363         .driver = {
 364                 .name = "ftpm-tee",
 365                 .of_match_table = of_match_ptr(of_ftpm_tee_ids),
 366         },
 367         .shutdown = ftpm_plat_tee_shutdown,
 368         .probe = ftpm_plat_tee_probe,
 369         .remove_new = ftpm_plat_tee_remove,
 370 };
 371
 372 /* UUID of the fTPM TA */
 373 static const struct tee_client_device_id optee_ftpm_id_table[] = {
 374         {UUID_INIT(0xbc50d971, 0xd4c9, 0x42c4,
 375                    0x82, 0xcb, 0x34, 0x3f, 0xb7, 0xf3, 0x78, 0x96)},
 376         {}
 377 };
 378
 379 MODULE_DEVICE_TABLE(tee, optee_ftpm_id_table);
 380
 381 static struct tee_client_driver ftpm_tee_driver = {
 382         .id_table       = optee_ftpm_id_table,
 383         .driver         = {
 384                 .name           = "optee-ftpm",
 385                 .bus            = &tee_bus_type,
 386                 .probe          = ftpm_tee_probe,
 387                 .remove         = ftpm_tee_remove,
 388         },
 389 };
 390
 391 static int __init ftpm_mod_init(void)
 392 {
 393         int rc;
 394
 395         rc = platform_driver_register(&ftpm_tee_plat_driver);
 396         if (rc)
 397                 return rc;
 398
 399         rc = driver_register(&ftpm_tee_driver.driver);
 400         if (rc) {
 401                 platform_driver_unregister(&ftpm_tee_plat_driver);
 402                 return rc;
 403         }
 404
 405         return 0;
 406 }
 407
 408 static void __exit ftpm_mod_exit(void)
 409 {
 410         platform_driver_unregister(&ftpm_tee_plat_driver);
 411         driver_unregister(&ftpm_tee_driver.driver);
 412 }
 413
 414 module_init(ftpm_mod_init);
 415 module_exit(ftpm_mod_exit);
 416
 417 MODULE_AUTHOR("Thirupathaiah Annapureddy <thiruan@microsoft.com>");
 418 MODULE_DESCRIPTION("TPM Driver for fTPM TA in TEE");
 419 MODULE_LICENSE("GPL v2");