1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2014, 2015 Intel Corporation
6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
8 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
10 * This file contains TPM2 protocol implementations of the commands
11 * used by the kernel internally.
15 #include <crypto/hash_info.h>
17 static struct tpm2_hash tpm2_hash_map
[] = {
18 {HASH_ALGO_SHA1
, TPM_ALG_SHA1
},
19 {HASH_ALGO_SHA256
, TPM_ALG_SHA256
},
20 {HASH_ALGO_SHA384
, TPM_ALG_SHA384
},
21 {HASH_ALGO_SHA512
, TPM_ALG_SHA512
},
22 {HASH_ALGO_SM3_256
, TPM_ALG_SM3_256
},
25 int tpm2_get_timeouts(struct tpm_chip
*chip
)
27 /* Fixed timeouts for TPM2 */
28 chip
->timeout_a
= msecs_to_jiffies(TPM2_TIMEOUT_A
);
29 chip
->timeout_b
= msecs_to_jiffies(TPM2_TIMEOUT_B
);
30 chip
->timeout_c
= msecs_to_jiffies(TPM2_TIMEOUT_C
);
31 chip
->timeout_d
= msecs_to_jiffies(TPM2_TIMEOUT_D
);
33 /* PTP spec timeouts */
34 chip
->duration
[TPM_SHORT
] = msecs_to_jiffies(TPM2_DURATION_SHORT
);
35 chip
->duration
[TPM_MEDIUM
] = msecs_to_jiffies(TPM2_DURATION_MEDIUM
);
36 chip
->duration
[TPM_LONG
] = msecs_to_jiffies(TPM2_DURATION_LONG
);
38 /* Key creation commands long timeouts */
39 chip
->duration
[TPM_LONG_LONG
] =
40 msecs_to_jiffies(TPM2_DURATION_LONG_LONG
);
42 chip
->flags
|= TPM_CHIP_FLAG_HAVE_TIMEOUTS
;
48 * tpm2_ordinal_duration_index() - returns an index to the chip duration table
49 * @ordinal: TPM command ordinal.
51 * The function returns an index to the chip duration table
52 * (enum tpm_duration), that describes the maximum amount of
53 * time the chip could take to return the result for a particular ordinal.
55 * The values of the MEDIUM, and LONG durations are taken
56 * from the PC Client Profile (PTP) specification (750, 2000 msec)
58 * LONG_LONG is for commands that generates keys which empirically takes
59 * a longer time on some systems.
67 static u8
tpm2_ordinal_duration_index(u32 ordinal
)
71 case TPM2_CC_STARTUP
: /* 144 */
74 case TPM2_CC_SELF_TEST
: /* 143 */
77 case TPM2_CC_GET_RANDOM
: /* 17B */
80 case TPM2_CC_SEQUENCE_UPDATE
: /* 15C */
82 case TPM2_CC_SEQUENCE_COMPLETE
: /* 13E */
84 case TPM2_CC_EVENT_SEQUENCE_COMPLETE
: /* 185 */
86 case TPM2_CC_HASH_SEQUENCE_START
: /* 186 */
89 case TPM2_CC_VERIFY_SIGNATURE
: /* 177 */
92 case TPM2_CC_PCR_EXTEND
: /* 182 */
95 case TPM2_CC_HIERARCHY_CONTROL
: /* 121 */
97 case TPM2_CC_HIERARCHY_CHANGE_AUTH
: /* 129 */
100 case TPM2_CC_GET_CAPABILITY
: /* 17A */
103 case TPM2_CC_NV_READ
: /* 14E */
106 case TPM2_CC_CREATE_PRIMARY
: /* 131 */
107 return TPM_LONG_LONG
;
108 case TPM2_CC_CREATE
: /* 153 */
109 return TPM_LONG_LONG
;
110 case TPM2_CC_CREATE_LOADED
: /* 191 */
111 return TPM_LONG_LONG
;
114 return TPM_UNDEFINED
;
119 * tpm2_calc_ordinal_duration() - calculate the maximum command duration
120 * @chip: TPM chip to use.
121 * @ordinal: TPM command ordinal.
123 * The function returns the maximum amount of time the chip could take
124 * to return the result for a particular ordinal in jiffies.
126 * Return: A maximal duration time for an ordinal in jiffies.
128 unsigned long tpm2_calc_ordinal_duration(struct tpm_chip
*chip
, u32 ordinal
)
132 index
= tpm2_ordinal_duration_index(ordinal
);
134 if (index
!= TPM_UNDEFINED
)
135 return chip
->duration
[index
];
137 return msecs_to_jiffies(TPM2_DURATION_DEFAULT
);
141 struct tpm2_pcr_read_out
{
143 __be32 pcr_selects_cnt
;
146 u8 pcr_select
[TPM2_PCR_SELECT_MIN
];
153 * tpm2_pcr_read() - read a PCR value
154 * @chip: TPM chip to use.
155 * @pcr_idx: index of the PCR to read.
156 * @digest: PCR bank and buffer current PCR value is written to.
157 * @digest_size_ptr: pointer to variable that stores the digest size.
159 * Return: Same as with tpm_transmit_cmd.
161 int tpm2_pcr_read(struct tpm_chip
*chip
, u32 pcr_idx
,
162 struct tpm_digest
*digest
, u16
*digest_size_ptr
)
167 struct tpm2_pcr_read_out
*out
;
168 u8 pcr_select
[TPM2_PCR_SELECT_MIN
] = {0};
170 u16 expected_digest_size
= 0;
172 if (pcr_idx
>= TPM2_PLATFORM_PCR
)
175 if (!digest_size_ptr
) {
176 for (i
= 0; i
< chip
->nr_allocated_banks
&&
177 chip
->allocated_banks
[i
].alg_id
!= digest
->alg_id
; i
++)
180 if (i
== chip
->nr_allocated_banks
)
183 expected_digest_size
= chip
->allocated_banks
[i
].digest_size
;
186 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_PCR_READ
);
190 pcr_select
[pcr_idx
>> 3] = 1 << (pcr_idx
& 0x7);
192 tpm_buf_append_u32(&buf
, 1);
193 tpm_buf_append_u16(&buf
, digest
->alg_id
);
194 tpm_buf_append_u8(&buf
, TPM2_PCR_SELECT_MIN
);
195 tpm_buf_append(&buf
, (const unsigned char *)pcr_select
,
198 rc
= tpm_transmit_cmd(chip
, &buf
, 0, "attempting to read a pcr value");
202 out
= (struct tpm2_pcr_read_out
*)&buf
.data
[TPM_HEADER_SIZE
];
203 digest_size
= be16_to_cpu(out
->digest_size
);
204 if (digest_size
> sizeof(digest
->digest
) ||
205 (!digest_size_ptr
&& digest_size
!= expected_digest_size
)) {
211 *digest_size_ptr
= digest_size
;
213 memcpy(digest
->digest
, out
->digest
, digest_size
);
215 tpm_buf_destroy(&buf
);
219 struct tpm2_null_auth_area
{
227 * tpm2_pcr_extend() - extend a PCR value
229 * @chip: TPM chip to use.
230 * @pcr_idx: index of the PCR.
231 * @digests: list of pcr banks and corresponding digest values to extend.
233 * Return: Same as with tpm_transmit_cmd.
235 int tpm2_pcr_extend(struct tpm_chip
*chip
, u32 pcr_idx
,
236 struct tpm_digest
*digests
)
239 struct tpm2_null_auth_area auth_area
;
243 rc
= tpm_buf_init(&buf
, TPM2_ST_SESSIONS
, TPM2_CC_PCR_EXTEND
);
247 tpm_buf_append_u32(&buf
, pcr_idx
);
249 auth_area
.handle
= cpu_to_be32(TPM2_RS_PW
);
250 auth_area
.nonce_size
= 0;
251 auth_area
.attributes
= 0;
252 auth_area
.auth_size
= 0;
254 tpm_buf_append_u32(&buf
, sizeof(struct tpm2_null_auth_area
));
255 tpm_buf_append(&buf
, (const unsigned char *)&auth_area
,
257 tpm_buf_append_u32(&buf
, chip
->nr_allocated_banks
);
259 for (i
= 0; i
< chip
->nr_allocated_banks
; i
++) {
260 tpm_buf_append_u16(&buf
, digests
[i
].alg_id
);
261 tpm_buf_append(&buf
, (const unsigned char *)&digests
[i
].digest
,
262 chip
->allocated_banks
[i
].digest_size
);
265 rc
= tpm_transmit_cmd(chip
, &buf
, 0, "attempting extend a PCR value");
267 tpm_buf_destroy(&buf
);
272 struct tpm2_get_random_out
{
274 u8 buffer
[TPM_MAX_RNG_DATA
];
278 * tpm2_get_random() - get random bytes from the TPM RNG
280 * @chip: a &tpm_chip instance
281 * @dest: destination buffer
282 * @max: the max number of random bytes to pull
285 * size of the buffer on success,
286 * -errno otherwise (positive TPM return codes are masked to -EIO)
288 int tpm2_get_random(struct tpm_chip
*chip
, u8
*dest
, size_t max
)
290 struct tpm2_get_random_out
*out
;
299 if (!num_bytes
|| max
> TPM_MAX_RNG_DATA
)
302 err
= tpm_buf_init(&buf
, 0, 0);
307 tpm_buf_reset(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_GET_RANDOM
);
308 tpm_buf_append_u16(&buf
, num_bytes
);
309 err
= tpm_transmit_cmd(chip
, &buf
,
310 offsetof(struct tpm2_get_random_out
,
312 "attempting get random");
319 out
= (struct tpm2_get_random_out
*)
320 &buf
.data
[TPM_HEADER_SIZE
];
321 recd
= min_t(u32
, be16_to_cpu(out
->size
), num_bytes
);
322 if (tpm_buf_length(&buf
) <
324 offsetof(struct tpm2_get_random_out
, buffer
) +
329 memcpy(dest_ptr
, out
->buffer
, recd
);
334 } while (retries
-- && total
< max
);
336 tpm_buf_destroy(&buf
);
337 return total
? total
: -EIO
;
339 tpm_buf_destroy(&buf
);
344 * tpm2_flush_context() - execute a TPM2_FlushContext command
345 * @chip: TPM chip to use
346 * @handle: context handle
348 void tpm2_flush_context(struct tpm_chip
*chip
, u32 handle
)
353 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_FLUSH_CONTEXT
);
355 dev_warn(&chip
->dev
, "0x%08x was not flushed, out of memory\n",
360 tpm_buf_append_u32(&buf
, handle
);
362 tpm_transmit_cmd(chip
, &buf
, 0, "flushing context");
363 tpm_buf_destroy(&buf
);
365 EXPORT_SYMBOL_GPL(tpm2_flush_context
);
367 struct tpm2_get_cap_out
{
376 * tpm2_get_tpm_pt() - get value of a TPM_CAP_TPM_PROPERTIES type property
377 * @chip: a &tpm_chip instance
378 * @property_id: property ID.
379 * @value: output variable.
380 * @desc: passed to tpm_transmit_cmd()
384 * -errno or a TPM return code otherwise
386 ssize_t
tpm2_get_tpm_pt(struct tpm_chip
*chip
, u32 property_id
, u32
*value
,
389 struct tpm2_get_cap_out
*out
;
393 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_GET_CAPABILITY
);
396 tpm_buf_append_u32(&buf
, TPM2_CAP_TPM_PROPERTIES
);
397 tpm_buf_append_u32(&buf
, property_id
);
398 tpm_buf_append_u32(&buf
, 1);
399 rc
= tpm_transmit_cmd(chip
, &buf
, 0, NULL
);
401 out
= (struct tpm2_get_cap_out
*)
402 &buf
.data
[TPM_HEADER_SIZE
];
403 *value
= be32_to_cpu(out
->value
);
405 tpm_buf_destroy(&buf
);
408 EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt
);
411 * tpm2_shutdown() - send a TPM shutdown command
413 * Sends a TPM shutdown command. The shutdown command is used in call
414 * sites where the system is going down. If it fails, there is not much
415 * that can be done except print an error message.
417 * @chip: a &tpm_chip instance
418 * @shutdown_type: TPM_SU_CLEAR or TPM_SU_STATE.
420 void tpm2_shutdown(struct tpm_chip
*chip
, u16 shutdown_type
)
425 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_SHUTDOWN
);
428 tpm_buf_append_u16(&buf
, shutdown_type
);
429 tpm_transmit_cmd(chip
, &buf
, 0, "stopping the TPM");
430 tpm_buf_destroy(&buf
);
434 * tpm2_do_selftest() - ensure that all self tests have passed
436 * @chip: TPM chip to use
438 * Return: Same as with tpm_transmit_cmd.
440 * The TPM can either run all self tests synchronously and then return
441 * RC_SUCCESS once all tests were successful. Or it can choose to run the tests
442 * asynchronously and return RC_TESTING immediately while the self tests still
443 * execute in the background. This function handles both cases and waits until
444 * all tests have completed.
446 static int tpm2_do_selftest(struct tpm_chip
*chip
)
452 for (full
= 0; full
< 2; full
++) {
453 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_SELF_TEST
);
457 tpm_buf_append_u8(&buf
, full
);
458 rc
= tpm_transmit_cmd(chip
, &buf
, 0,
459 "attempting the self test");
460 tpm_buf_destroy(&buf
);
462 if (rc
== TPM2_RC_TESTING
)
463 rc
= TPM2_RC_SUCCESS
;
464 if (rc
== TPM2_RC_INITIALIZE
|| rc
== TPM2_RC_SUCCESS
)
472 * tpm2_probe() - probe for the TPM 2.0 protocol
473 * @chip: a &tpm_chip instance
475 * Send an idempotent TPM 2.0 command and see whether there is TPM2 chip in the
476 * other end based on the response tag. The flag TPM_CHIP_FLAG_TPM2 is set by
477 * this function if this is the case.
483 int tpm2_probe(struct tpm_chip
*chip
)
485 struct tpm_header
*out
;
489 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_GET_CAPABILITY
);
492 tpm_buf_append_u32(&buf
, TPM2_CAP_TPM_PROPERTIES
);
493 tpm_buf_append_u32(&buf
, TPM_PT_TOTAL_COMMANDS
);
494 tpm_buf_append_u32(&buf
, 1);
495 rc
= tpm_transmit_cmd(chip
, &buf
, 0, NULL
);
496 /* We ignore TPM return codes on purpose. */
498 out
= (struct tpm_header
*)buf
.data
;
499 if (be16_to_cpu(out
->tag
) == TPM2_ST_NO_SESSIONS
)
500 chip
->flags
|= TPM_CHIP_FLAG_TPM2
;
502 tpm_buf_destroy(&buf
);
505 EXPORT_SYMBOL_GPL(tpm2_probe
);
507 static int tpm2_init_bank_info(struct tpm_chip
*chip
, u32 bank_index
)
509 struct tpm_bank_info
*bank
= chip
->allocated_banks
+ bank_index
;
510 struct tpm_digest digest
= { .alg_id
= bank
->alg_id
};
514 * Avoid unnecessary PCR read operations to reduce overhead
515 * and obtain identifiers of the crypto subsystem.
517 for (i
= 0; i
< ARRAY_SIZE(tpm2_hash_map
); i
++) {
518 enum hash_algo crypto_algo
= tpm2_hash_map
[i
].crypto_id
;
520 if (bank
->alg_id
!= tpm2_hash_map
[i
].tpm_id
)
523 bank
->digest_size
= hash_digest_size
[crypto_algo
];
524 bank
->crypto_id
= crypto_algo
;
528 bank
->crypto_id
= HASH_ALGO__LAST
;
530 return tpm2_pcr_read(chip
, 0, &digest
, &bank
->digest_size
);
533 struct tpm2_pcr_selection
{
539 ssize_t
tpm2_get_pcr_allocation(struct tpm_chip
*chip
)
541 struct tpm2_pcr_selection pcr_selection
;
545 void *pcr_select_offset
;
546 u32 sizeof_pcr_selection
;
547 u32 nr_possible_banks
;
548 u32 nr_alloc_banks
= 0;
554 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_GET_CAPABILITY
);
558 tpm_buf_append_u32(&buf
, TPM2_CAP_PCRS
);
559 tpm_buf_append_u32(&buf
, 0);
560 tpm_buf_append_u32(&buf
, 1);
562 rc
= tpm_transmit_cmd(chip
, &buf
, 9, "get tpm pcr allocation");
566 nr_possible_banks
= be32_to_cpup(
567 (__be32
*)&buf
.data
[TPM_HEADER_SIZE
+ 5]);
569 chip
->allocated_banks
= kcalloc(nr_possible_banks
,
570 sizeof(*chip
->allocated_banks
),
572 if (!chip
->allocated_banks
) {
577 marker
= &buf
.data
[TPM_HEADER_SIZE
+ 9];
579 rsp_len
= be32_to_cpup((__be32
*)&buf
.data
[2]);
580 end
= &buf
.data
[rsp_len
];
582 for (i
= 0; i
< nr_possible_banks
; i
++) {
583 pcr_select_offset
= marker
+
584 offsetof(struct tpm2_pcr_selection
, size_of_select
);
585 if (pcr_select_offset
>= end
) {
590 memcpy(&pcr_selection
, marker
, sizeof(pcr_selection
));
591 hash_alg
= be16_to_cpu(pcr_selection
.hash_alg
);
593 pcr_select_offset
= memchr_inv(pcr_selection
.pcr_select
, 0,
594 pcr_selection
.size_of_select
);
595 if (pcr_select_offset
) {
596 chip
->allocated_banks
[nr_alloc_banks
].alg_id
= hash_alg
;
598 rc
= tpm2_init_bank_info(chip
, nr_alloc_banks
);
605 sizeof_pcr_selection
= sizeof(pcr_selection
.hash_alg
) +
606 sizeof(pcr_selection
.size_of_select
) +
607 pcr_selection
.size_of_select
;
608 marker
= marker
+ sizeof_pcr_selection
;
611 chip
->nr_allocated_banks
= nr_alloc_banks
;
613 tpm_buf_destroy(&buf
);
618 int tpm2_get_cc_attrs_tbl(struct tpm_chip
*chip
)
627 rc
= tpm2_get_tpm_pt(chip
, TPM_PT_TOTAL_COMMANDS
, &nr_commands
, NULL
);
631 if (nr_commands
> 0xFFFFF) {
636 chip
->cc_attrs_tbl
= devm_kcalloc(&chip
->dev
, 4, nr_commands
,
638 if (!chip
->cc_attrs_tbl
) {
643 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_GET_CAPABILITY
);
647 tpm_buf_append_u32(&buf
, TPM2_CAP_COMMANDS
);
648 tpm_buf_append_u32(&buf
, TPM2_CC_FIRST
);
649 tpm_buf_append_u32(&buf
, nr_commands
);
651 rc
= tpm_transmit_cmd(chip
, &buf
, 9 + 4 * nr_commands
, NULL
);
653 tpm_buf_destroy(&buf
);
658 be32_to_cpup((__be32
*)&buf
.data
[TPM_HEADER_SIZE
+ 5])) {
659 tpm_buf_destroy(&buf
);
663 chip
->nr_commands
= nr_commands
;
665 attrs
= (__be32
*)&buf
.data
[TPM_HEADER_SIZE
+ 9];
666 for (i
= 0; i
< nr_commands
; i
++, attrs
++) {
667 chip
->cc_attrs_tbl
[i
] = be32_to_cpup(attrs
);
668 cc
= chip
->cc_attrs_tbl
[i
] & 0xFFFF;
670 if (cc
== TPM2_CC_CONTEXT_SAVE
|| cc
== TPM2_CC_FLUSH_CONTEXT
) {
671 chip
->cc_attrs_tbl
[i
] &=
672 ~(GENMASK(2, 0) << TPM2_CC_ATTR_CHANDLES
);
673 chip
->cc_attrs_tbl
[i
] |= 1 << TPM2_CC_ATTR_CHANDLES
;
677 tpm_buf_destroy(&buf
);
684 EXPORT_SYMBOL_GPL(tpm2_get_cc_attrs_tbl
);
687 * tpm2_startup - turn on the TPM
688 * @chip: TPM chip to use
690 * Normally the firmware should start the TPM. This function is provided as a
691 * workaround if this does not happen. A legal case for this could be for
692 * example when a TPM emulator is used.
694 * Return: same as tpm_transmit_cmd()
697 static int tpm2_startup(struct tpm_chip
*chip
)
702 dev_info(&chip
->dev
, "starting up the TPM manually\n");
704 rc
= tpm_buf_init(&buf
, TPM2_ST_NO_SESSIONS
, TPM2_CC_STARTUP
);
708 tpm_buf_append_u16(&buf
, TPM2_SU_CLEAR
);
709 rc
= tpm_transmit_cmd(chip
, &buf
, 0, "attempting to start the TPM");
710 tpm_buf_destroy(&buf
);
716 * tpm2_auto_startup - Perform the standard automatic TPM initialization
718 * @chip: TPM chip to use
720 * Returns 0 on success, < 0 in case of fatal error.
722 int tpm2_auto_startup(struct tpm_chip
*chip
)
726 rc
= tpm2_get_timeouts(chip
);
730 rc
= tpm2_do_selftest(chip
);
731 if (rc
&& rc
!= TPM2_RC_INITIALIZE
)
734 if (rc
== TPM2_RC_INITIALIZE
) {
735 rc
= tpm2_startup(chip
);
739 rc
= tpm2_do_selftest(chip
);
744 rc
= tpm2_get_cc_attrs_tbl(chip
);
752 int tpm2_find_cc(struct tpm_chip
*chip
, u32 cc
)
756 for (i
= 0; i
< chip
->nr_commands
; i
++)
757 if (cc
== (chip
->cc_attrs_tbl
[i
] & GENMASK(15, 0)))