?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
btrfs: Don't clear SGID when inheriting ACLs
[linux/fpc-iii.git] / drivers / char / tpm / tpm2-space.c
blobe2e059d8ffec0c16ec9e106d6c848a036857295f
1 /*
2 * Copyright (C) 2016 Intel Corporation
3 *
4 * Authors:
5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
6 *
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8 *
9 * This file contains TPM2 protocol implementations of the commands
10 * used by the kernel internally.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; version 2
15 * of the License.
16 */
17
18 #include <linux/gfp.h>
19 #include <asm/unaligned.h>
20 #include "tpm.h"
21
22 enum tpm2_handle_types {
23 TPM2_HT_HMAC_SESSION = 0x02000000,
24 TPM2_HT_POLICY_SESSION = 0x03000000,
25 TPM2_HT_TRANSIENT = 0x80000000,
26 };
27
28 struct tpm2_context {
29 __be64 sequence;
30 __be32 saved_handle;
31 __be32 hierarchy;
32 __be16 blob_size;
33 } __packed;
34
35 static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
36 {
37 int i;
38
39 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
40 if (space->session_tbl[i])
41 tpm2_flush_context_cmd(chip, space->session_tbl[i],
42 TPM_TRANSMIT_UNLOCKED);
43 }
44 }
45
46 int tpm2_init_space(struct tpm_space *space)
47 {
48 space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
49 if (!space->context_buf)
50 return -ENOMEM;
51
52 space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
53 if (space->session_buf == NULL) {
54 kfree(space->context_buf);
55 return -ENOMEM;
56 }
57
58 return 0;
59 }
60
61 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
62 {
63 mutex_lock(&chip->tpm_mutex);
64 tpm2_flush_sessions(chip, space);
65 mutex_unlock(&chip->tpm_mutex);
66 kfree(space->context_buf);
67 kfree(space->session_buf);
68 }
69
70 static int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
71 unsigned int *offset, u32 *handle)
72 {
73 struct tpm_buf tbuf;
74 struct tpm2_context *ctx;
75 unsigned int body_size;
76 int rc;
77
78 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD);
79 if (rc)
80 return rc;
81
82 ctx = (struct tpm2_context *)&buf[*offset];
83 body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size);
84 tpm_buf_append(&tbuf, &buf[*offset], body_size);
85
86 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 4,
87 TPM_TRANSMIT_UNLOCKED, NULL);
88 if (rc < 0) {
89 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
90 __func__, rc);
91 tpm_buf_destroy(&tbuf);
92 return -EFAULT;
93 } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE ||
94 rc == TPM2_RC_REFERENCE_H0) {
95 /*
96 * TPM_RC_HANDLE means that the session context can't
97 * be loaded because of an internal counter mismatch
98 * that makes the TPM think there might have been a
99 * replay. This might happen if the context was saved
100 * and loaded outside the space.
101 *
102 * TPM_RC_REFERENCE_H0 means the session has been
103 * flushed outside the space
104 */
105 rc = -ENOENT;
106 tpm_buf_destroy(&tbuf);
107 } else if (rc > 0) {
108 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
109 __func__, rc);
110 tpm_buf_destroy(&tbuf);
111 return -EFAULT;
112 }
113
114 *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]);
115 *offset += body_size;
116
117 tpm_buf_destroy(&tbuf);
118 return 0;
119 }
120
121 static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf,
122 unsigned int buf_size, unsigned int *offset)
123 {
124 struct tpm_buf tbuf;
125 unsigned int body_size;
126 int rc;
127
128 rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE);
129 if (rc)
130 return rc;
131
132 tpm_buf_append_u32(&tbuf, handle);
133
134 rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 0,
135 TPM_TRANSMIT_UNLOCKED, NULL);
136 if (rc < 0) {
137 dev_warn(&chip->dev, "%s: failed with a system error %d\n",
138 __func__, rc);
139 tpm_buf_destroy(&tbuf);
140 return -EFAULT;
141 } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) {
142 tpm_buf_destroy(&tbuf);
143 return -ENOENT;
144 } else if (rc) {
145 dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
146 __func__, rc);
147 tpm_buf_destroy(&tbuf);
148 return -EFAULT;
149 }
150
151 body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE;
152 if ((*offset + body_size) > buf_size) {
153 dev_warn(&chip->dev, "%s: out of backing storage\n", __func__);
154 tpm_buf_destroy(&tbuf);
155 return -ENOMEM;
156 }
157
158 memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size);
159 *offset += body_size;
160 tpm_buf_destroy(&tbuf);
161 return 0;
162 }
163
164 static void tpm2_flush_space(struct tpm_chip *chip)
165 {
166 struct tpm_space *space = &chip->work_space;
167 int i;
168
169 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++)
170 if (space->context_tbl[i] && ~space->context_tbl[i])
171 tpm2_flush_context_cmd(chip, space->context_tbl[i],
172 TPM_TRANSMIT_UNLOCKED);
173
174 tpm2_flush_sessions(chip, space);
175 }
176
177 static int tpm2_load_space(struct tpm_chip *chip)
178 {
179 struct tpm_space *space = &chip->work_space;
180 unsigned int offset;
181 int i;
182 int rc;
183
184 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
185 if (!space->context_tbl[i])
186 continue;
187
188 /* sanity check, should never happen */
189 if (~space->context_tbl[i]) {
190 dev_err(&chip->dev, "context table is inconsistent");
191 return -EFAULT;
192 }
193
194 rc = tpm2_load_context(chip, space->context_buf, &offset,
195 &space->context_tbl[i]);
196 if (rc)
197 return rc;
198 }
199
200 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
201 u32 handle;
202
203 if (!space->session_tbl[i])
204 continue;
205
206 rc = tpm2_load_context(chip, space->session_buf,
207 &offset, &handle);
208 if (rc == -ENOENT) {
209 /* load failed, just forget session */
210 space->session_tbl[i] = 0;
211 } else if (rc) {
212 tpm2_flush_space(chip);
213 return rc;
214 }
215 if (handle != space->session_tbl[i]) {
216 dev_warn(&chip->dev, "session restored to wrong handle\n");
217 tpm2_flush_space(chip);
218 return -EFAULT;
219 }
220 }
221
222 return 0;
223 }
224
225 static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle)
226 {
227 u32 vhandle = be32_to_cpup((__be32 *)handle);
228 u32 phandle;
229 int i;
230
231 i = 0xFFFFFF - (vhandle & 0xFFFFFF);
232 if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i])
233 return false;
234
235 phandle = space->context_tbl[i];
236 *((__be32 *)handle) = cpu_to_be32(phandle);
237 return true;
238 }
239
240 static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd)
241 {
242 struct tpm_space *space = &chip->work_space;
243 unsigned int nr_handles;
244 u32 attrs;
245 u32 *handle;
246 int i;
247
248 i = tpm2_find_cc(chip, cc);
249 if (i < 0)
250 return -EINVAL;
251
252 attrs = chip->cc_attrs_tbl[i];
253 nr_handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0);
254
255 handle = (u32 *)&cmd[TPM_HEADER_SIZE];
256 for (i = 0; i < nr_handles; i++, handle++) {
257 if ((be32_to_cpu(*handle) & 0xFF000000) == TPM2_HT_TRANSIENT) {
258 if (!tpm2_map_to_phandle(space, handle))
259 return -EINVAL;
260 }
261 }
262
263 return 0;
264 }
265
266 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
267 u8 *cmd)
268 {
269 int rc;
270
271 if (!space)
272 return 0;
273
274 memcpy(&chip->work_space.context_tbl, &space->context_tbl,
275 sizeof(space->context_tbl));
276 memcpy(&chip->work_space.session_tbl, &space->session_tbl,
277 sizeof(space->session_tbl));
278 memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE);
279 memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE);
280
281 rc = tpm2_load_space(chip);
282 if (rc) {
283 tpm2_flush_space(chip);
284 return rc;
285 }
286
287 rc = tpm2_map_command(chip, cc, cmd);
288 if (rc) {
289 tpm2_flush_space(chip);
290 return rc;
291 }
292
293 return 0;
294 }
295
296 static bool tpm2_add_session(struct tpm_chip *chip, u32 handle)
297 {
298 struct tpm_space *space = &chip->work_space;
299 int i;
300
301 for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++)
302 if (space->session_tbl[i] == 0)
303 break;
304
305 if (i == ARRAY_SIZE(space->session_tbl))
306 return false;
307
308 space->session_tbl[i] = handle;
309 return true;
310 }
311
312 static u32 tpm2_map_to_vhandle(struct tpm_space *space, u32 phandle, bool alloc)
313 {
314 int i;
315
316 for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
317 if (alloc) {
318 if (!space->context_tbl[i]) {
319 space->context_tbl[i] = phandle;
320 break;
321 }
322 } else if (space->context_tbl[i] == phandle)
323 break;
324 }
325
326 if (i == ARRAY_SIZE(space->context_tbl))
327 return 0;
328
329 return TPM2_HT_TRANSIENT | (0xFFFFFF - i);
330 }
331
332 static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp,
333 size_t len)
334 {
335 struct tpm_space *space = &chip->work_space;
336 struct tpm_output_header *header = (void *)rsp;
337 u32 phandle;
338 u32 phandle_type;
339 u32 vhandle;
340 u32 attrs;
341 int i;
342
343 if (be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS)
344 return 0;
345
346 i = tpm2_find_cc(chip, cc);
347 /* sanity check, should never happen */
348 if (i < 0)
349 return -EFAULT;
350
351 attrs = chip->cc_attrs_tbl[i];
352 if (!((attrs >> TPM2_CC_ATTR_RHANDLE) & 1))
353 return 0;
354
355 phandle = be32_to_cpup((__be32 *)&rsp[TPM_HEADER_SIZE]);
356 phandle_type = phandle & 0xFF000000;
357
358 switch (phandle_type) {
359 case TPM2_HT_TRANSIENT:
360 vhandle = tpm2_map_to_vhandle(space, phandle, true);
361 if (!vhandle)
362 goto out_no_slots;
363
364 *(__be32 *)&rsp[TPM_HEADER_SIZE] = cpu_to_be32(vhandle);
365 break;
366 case TPM2_HT_HMAC_SESSION:
367 case TPM2_HT_POLICY_SESSION:
368 if (!tpm2_add_session(chip, phandle))
369 goto out_no_slots;
370 break;
371 default:
372 dev_err(&chip->dev, "%s: unknown handle 0x%08X\n",
373 __func__, phandle);
374 break;
375 };
376
377 return 0;
378 out_no_slots:
379 tpm2_flush_context_cmd(chip, phandle, TPM_TRANSMIT_UNLOCKED);
380 dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__,
381 phandle);
382 return -ENOMEM;
383 }
384
385 struct tpm2_cap_handles {
386 u8 more_data;
387 __be32 capability;
388 __be32 count;
389 __be32 handles[];
390 } __packed;
391
392 static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp,
393 size_t len)
394 {
395 struct tpm_space *space = &chip->work_space;
396 struct tpm_output_header *header = (void *)rsp;
397 struct tpm2_cap_handles *data;
398 u32 phandle;
399 u32 phandle_type;
400 u32 vhandle;
401 int i;
402 int j;
403
404 if (cc != TPM2_CC_GET_CAPABILITY ||
405 be32_to_cpu(header->return_code) != TPM2_RC_SUCCESS) {
406 return 0;
407 }
408
409 if (len < TPM_HEADER_SIZE + 9)
410 return -EFAULT;
411
412 data = (void *)&rsp[TPM_HEADER_SIZE];
413 if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
414 return 0;
415
416 if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
417 return -EFAULT;
418
419 for (i = 0, j = 0; i < be32_to_cpu(data->count); i++) {
420 phandle = be32_to_cpup((__be32 *)&data->handles[i]);
421 phandle_type = phandle & 0xFF000000;
422
423 switch (phandle_type) {
424 case TPM2_HT_TRANSIENT:
425 vhandle = tpm2_map_to_vhandle(space, phandle, false);
426 if (!vhandle)
427 break;
428
429 data->handles[j] = cpu_to_be32(vhandle);
430 j++;
431 break;
432
433 default:
434 data->handles[j] = cpu_to_be32(phandle);
435 j++;
436 break;
437 }
438
439 }
440
441 header->length = cpu_to_be32(TPM_HEADER_SIZE + 9 + 4 * j);
442 data->count = cpu_to_be32(j);
443 return 0;
444 }
445
446 static int tpm2_save_space(struct tpm_chip *chip)
447 {
448 struct tpm_space *space = &chip->work_space;
449 unsigned int offset;
450 int i;
451 int rc;
452
453 for (i = 0, offset = 0; i < ARRAY_SIZE(space->context_tbl); i++) {
454 if (!(space->context_tbl[i] && ~space->context_tbl[i]))
455 continue;
456
457 rc = tpm2_save_context(chip, space->context_tbl[i],
458 space->context_buf, PAGE_SIZE,
459 &offset);
460 if (rc == -ENOENT) {
461 space->context_tbl[i] = 0;
462 continue;
463 } else if (rc)
464 return rc;
465
466 tpm2_flush_context_cmd(chip, space->context_tbl[i],
467 TPM_TRANSMIT_UNLOCKED);
468 space->context_tbl[i] = ~0;
469 }
470
471 for (i = 0, offset = 0; i < ARRAY_SIZE(space->session_tbl); i++) {
472 if (!space->session_tbl[i])
473 continue;
474
475 rc = tpm2_save_context(chip, space->session_tbl[i],
476 space->session_buf, PAGE_SIZE,
477 &offset);
478
479 if (rc == -ENOENT) {
480 /* handle error saving session, just forget it */
481 space->session_tbl[i] = 0;
482 } else if (rc < 0) {
483 tpm2_flush_space(chip);
484 return rc;
485 }
486 }
487
488 return 0;
489 }
490
491 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
492 u32 cc, u8 *buf, size_t *bufsiz)
493 {
494 struct tpm_output_header *header = (void *)buf;
495 int rc;
496
497 if (!space)
498 return 0;
499
500 rc = tpm2_map_response_header(chip, cc, buf, *bufsiz);
501 if (rc) {
502 tpm2_flush_space(chip);
503 return rc;
504 }
505
506 rc = tpm2_map_response_body(chip, cc, buf, *bufsiz);
507 if (rc) {
508 tpm2_flush_space(chip);
509 return rc;
510 }
511
512 rc = tpm2_save_space(chip);
513 if (rc) {
514 tpm2_flush_space(chip);
515 return rc;
516 }
517
518 *bufsiz = be32_to_cpu(header->length);
519
520 memcpy(&space->context_tbl, &chip->work_space.context_tbl,
521 sizeof(space->context_tbl));
522 memcpy(&space->session_tbl, &chip->work_space.session_tbl,
523 sizeof(space->session_tbl));
524 memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE);
525 memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE);
526
527 return 0;
528 }
Linux with added FPC-III support