tpm2_tis_sandbox.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018, Bootlin
  4. * Author: Miquel Raynal <miquel.raynal@bootlin.com>
  5. */
  6. #include <common.h>
  7. #include <dm.h>
  8. #include <tpm-v2.h>
  9. #include <asm/state.h>
  10. #include <asm/unaligned.h>
  11. #include <linux/bitops.h>
  12. #include <u-boot/crc.h>
  13. /* Hierarchies */
  14. enum tpm2_hierarchy {
  15. TPM2_HIERARCHY_LOCKOUT = 0,
  16. TPM2_HIERARCHY_ENDORSEMENT,
  17. TPM2_HIERARCHY_PLATFORM,
  18. TPM2_HIERARCHY_NB,
  19. };
  20. /* Subset of supported capabilities */
  21. enum tpm2_capability {
  22. TPM_CAP_TPM_PROPERTIES = 0x6,
  23. };
  24. /* Subset of supported properties */
  25. #define TPM2_PROPERTIES_OFFSET 0x0000020E
  26. enum tpm2_cap_tpm_property {
  27. TPM2_FAIL_COUNTER = 0,
  28. TPM2_PROP_MAX_TRIES,
  29. TPM2_RECOVERY_TIME,
  30. TPM2_LOCKOUT_RECOVERY,
  31. TPM2_PROPERTY_NB,
  32. };
  33. #define SANDBOX_TPM_PCR_NB 1
  34. static const u8 sandbox_extended_once_pcr[] = {
  35. 0xf5, 0xa5, 0xfd, 0x42, 0xd1, 0x6a, 0x20, 0x30,
  36. 0x27, 0x98, 0xef, 0x6e, 0xd3, 0x09, 0x97, 0x9b,
  37. 0x43, 0x00, 0x3d, 0x23, 0x20, 0xd9, 0xf0, 0xe8,
  38. 0xea, 0x98, 0x31, 0xa9, 0x27, 0x59, 0xfb, 0x4b,
  39. };
  40. struct sandbox_tpm2 {
  41. /* TPM internal states */
  42. bool init_done;
  43. bool startup_done;
  44. bool tests_done;
  45. /* TPM password per hierarchy */
  46. char pw[TPM2_HIERARCHY_NB][TPM2_DIGEST_LEN + 1];
  47. int pw_sz[TPM2_HIERARCHY_NB];
  48. /* TPM properties */
  49. u32 properties[TPM2_PROPERTY_NB];
  50. /* TPM PCRs */
  51. u8 pcr[SANDBOX_TPM_PCR_NB][TPM2_DIGEST_LEN];
  52. /* TPM PCR extensions */
  53. u32 pcr_extensions[SANDBOX_TPM_PCR_NB];
  54. };
  55. /*
  56. * Check the tag validity depending on the command (authentication required or
  57. * not). If authentication is required, check it is valid. Update the auth
  58. * pointer to point to the next chunk of data to process if needed.
  59. */
  60. static int sandbox_tpm2_check_session(struct udevice *dev, u32 command, u16 tag,
  61. const u8 **auth,
  62. enum tpm2_hierarchy *hierarchy)
  63. {
  64. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  65. u32 handle, auth_sz, session_handle;
  66. u16 nonce_sz, pw_sz;
  67. const char *pw;
  68. switch (command) {
  69. case TPM2_CC_STARTUP:
  70. case TPM2_CC_SELF_TEST:
  71. case TPM2_CC_GET_CAPABILITY:
  72. case TPM2_CC_PCR_READ:
  73. if (tag != TPM2_ST_NO_SESSIONS) {
  74. printf("No session required for command 0x%x\n",
  75. command);
  76. return TPM2_RC_BAD_TAG;
  77. }
  78. return 0;
  79. case TPM2_CC_CLEAR:
  80. case TPM2_CC_HIERCHANGEAUTH:
  81. case TPM2_CC_DAM_RESET:
  82. case TPM2_CC_DAM_PARAMETERS:
  83. case TPM2_CC_PCR_EXTEND:
  84. if (tag != TPM2_ST_SESSIONS) {
  85. printf("Session required for command 0x%x\n", command);
  86. return TPM2_RC_AUTH_CONTEXT;
  87. }
  88. handle = get_unaligned_be32(*auth);
  89. *auth += sizeof(handle);
  90. /*
  91. * PCR_Extend had a different protection mechanism and does not
  92. * use the same standards as other commands.
  93. */
  94. if (command == TPM2_CC_PCR_EXTEND)
  95. break;
  96. switch (handle) {
  97. case TPM2_RH_LOCKOUT:
  98. *hierarchy = TPM2_HIERARCHY_LOCKOUT;
  99. break;
  100. case TPM2_RH_ENDORSEMENT:
  101. if (command == TPM2_CC_CLEAR) {
  102. printf("Endorsement hierarchy unsupported\n");
  103. return TPM2_RC_AUTH_MISSING;
  104. }
  105. *hierarchy = TPM2_HIERARCHY_ENDORSEMENT;
  106. break;
  107. case TPM2_RH_PLATFORM:
  108. *hierarchy = TPM2_HIERARCHY_PLATFORM;
  109. break;
  110. default:
  111. printf("Wrong handle 0x%x\n", handle);
  112. return TPM2_RC_VALUE;
  113. }
  114. break;
  115. default:
  116. printf("Command code not recognized: 0x%x\n", command);
  117. return TPM2_RC_COMMAND_CODE;
  118. }
  119. auth_sz = get_unaligned_be32(*auth);
  120. *auth += sizeof(auth_sz);
  121. session_handle = get_unaligned_be32(*auth);
  122. *auth += sizeof(session_handle);
  123. if (session_handle != TPM2_RS_PW) {
  124. printf("Wrong session handle 0x%x\n", session_handle);
  125. return TPM2_RC_VALUE;
  126. }
  127. nonce_sz = get_unaligned_be16(*auth);
  128. *auth += sizeof(nonce_sz);
  129. if (nonce_sz) {
  130. printf("Nonces not supported in Sandbox, aborting\n");
  131. return TPM2_RC_HANDLE;
  132. }
  133. /* Ignore attributes */
  134. *auth += sizeof(u8);
  135. pw_sz = get_unaligned_be16(*auth);
  136. *auth += sizeof(pw_sz);
  137. if (auth_sz != (9 + nonce_sz + pw_sz)) {
  138. printf("Authentication size (%d) do not match %d\n",
  139. auth_sz, 9 + nonce_sz + pw_sz);
  140. return TPM2_RC_SIZE;
  141. }
  142. /* No passwork is acceptable */
  143. if (!pw_sz && !tpm->pw_sz[*hierarchy])
  144. return TPM2_RC_SUCCESS;
  145. /* Password is too long */
  146. if (pw_sz > TPM2_DIGEST_LEN) {
  147. printf("Password should not be more than %dB\n",
  148. TPM2_DIGEST_LEN);
  149. return TPM2_RC_AUTHSIZE;
  150. }
  151. pw = (const char *)*auth;
  152. *auth += pw_sz;
  153. /* Password is wrong */
  154. if (pw_sz != tpm->pw_sz[*hierarchy] ||
  155. strncmp(pw, tpm->pw[*hierarchy], tpm->pw_sz[*hierarchy])) {
  156. printf("Authentication failed: wrong password.\n");
  157. return TPM2_RC_BAD_AUTH;
  158. }
  159. return TPM2_RC_SUCCESS;
  160. }
  161. static int sandbox_tpm2_check_readyness(struct udevice *dev, int command)
  162. {
  163. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  164. switch (command) {
  165. case TPM2_CC_STARTUP:
  166. if (!tpm->init_done || tpm->startup_done)
  167. return TPM2_RC_INITIALIZE;
  168. break;
  169. case TPM2_CC_GET_CAPABILITY:
  170. if (!tpm->init_done || !tpm->startup_done)
  171. return TPM2_RC_INITIALIZE;
  172. break;
  173. case TPM2_CC_SELF_TEST:
  174. if (!tpm->startup_done)
  175. return TPM2_RC_INITIALIZE;
  176. break;
  177. default:
  178. if (!tpm->tests_done)
  179. return TPM2_RC_NEEDS_TEST;
  180. break;
  181. }
  182. return 0;
  183. }
  184. static int sandbox_tpm2_fill_buf(u8 *recv, size_t *recv_len, u16 tag, u32 rc)
  185. {
  186. *recv_len = sizeof(tag) + sizeof(u32) + sizeof(rc);
  187. /* Write tag */
  188. put_unaligned_be16(tag, recv);
  189. recv += sizeof(tag);
  190. /* Write length */
  191. put_unaligned_be32(*recv_len, recv);
  192. recv += sizeof(u32);
  193. /* Write return code */
  194. put_unaligned_be32(rc, recv);
  195. recv += sizeof(rc);
  196. /* Add trailing \0 */
  197. *recv = '\0';
  198. return 0;
  199. }
  200. static int sandbox_tpm2_extend(struct udevice *dev, int pcr_index,
  201. const u8 *extension)
  202. {
  203. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  204. int i;
  205. /* Only simulate the first extensions from all '0' with only '0' */
  206. for (i = 0; i < TPM2_DIGEST_LEN; i++)
  207. if (tpm->pcr[pcr_index][i] || extension[i])
  208. return TPM2_RC_FAILURE;
  209. memcpy(tpm->pcr[pcr_index], sandbox_extended_once_pcr,
  210. TPM2_DIGEST_LEN);
  211. tpm->pcr_extensions[pcr_index]++;
  212. return 0;
  213. };
  214. static int sandbox_tpm2_xfer(struct udevice *dev, const u8 *sendbuf,
  215. size_t send_size, u8 *recvbuf,
  216. size_t *recv_len)
  217. {
  218. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  219. enum tpm2_hierarchy hierarchy = 0;
  220. const u8 *sent = sendbuf;
  221. u8 *recv = recvbuf;
  222. u32 length, command, rc = 0;
  223. u16 tag, mode, new_pw_sz;
  224. u8 yes_no;
  225. int i, j;
  226. /* TPM2_GetProperty */
  227. u32 capability, property, property_count;
  228. /* TPM2_PCR_Read/Extend variables */
  229. int pcr_index = 0;
  230. u64 pcr_map = 0;
  231. u32 selections, pcr_nb;
  232. u16 alg;
  233. u8 pcr_array_sz;
  234. tag = get_unaligned_be16(sent);
  235. sent += sizeof(tag);
  236. length = get_unaligned_be32(sent);
  237. sent += sizeof(length);
  238. if (length != send_size) {
  239. printf("TPM2: Unmatching length, received: %ld, expected: %d\n",
  240. send_size, length);
  241. rc = TPM2_RC_SIZE;
  242. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  243. return 0;
  244. }
  245. command = get_unaligned_be32(sent);
  246. sent += sizeof(command);
  247. rc = sandbox_tpm2_check_readyness(dev, command);
  248. if (rc) {
  249. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  250. return 0;
  251. }
  252. rc = sandbox_tpm2_check_session(dev, command, tag, &sent, &hierarchy);
  253. if (rc) {
  254. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  255. return 0;
  256. }
  257. switch (command) {
  258. case TPM2_CC_STARTUP:
  259. mode = get_unaligned_be16(sent);
  260. sent += sizeof(mode);
  261. switch (mode) {
  262. case TPM2_SU_CLEAR:
  263. case TPM2_SU_STATE:
  264. break;
  265. default:
  266. rc = TPM2_RC_VALUE;
  267. }
  268. tpm->startup_done = true;
  269. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  270. break;
  271. case TPM2_CC_SELF_TEST:
  272. yes_no = *sent;
  273. sent += sizeof(yes_no);
  274. switch (yes_no) {
  275. case TPMI_YES:
  276. case TPMI_NO:
  277. break;
  278. default:
  279. rc = TPM2_RC_VALUE;
  280. }
  281. tpm->tests_done = true;
  282. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  283. break;
  284. case TPM2_CC_CLEAR:
  285. /* Reset this hierarchy password */
  286. tpm->pw_sz[hierarchy] = 0;
  287. /* Reset all password if thisis the PLATFORM hierarchy */
  288. if (hierarchy == TPM2_HIERARCHY_PLATFORM)
  289. for (i = 0; i < TPM2_HIERARCHY_NB; i++)
  290. tpm->pw_sz[i] = 0;
  291. /* Reset the properties */
  292. for (i = 0; i < TPM2_PROPERTY_NB; i++)
  293. tpm->properties[i] = 0;
  294. /* Reset the PCRs and their number of extensions */
  295. for (i = 0; i < SANDBOX_TPM_PCR_NB; i++) {
  296. tpm->pcr_extensions[i] = 0;
  297. for (j = 0; j < TPM2_DIGEST_LEN; j++)
  298. tpm->pcr[i][j] = 0;
  299. }
  300. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  301. break;
  302. case TPM2_CC_HIERCHANGEAUTH:
  303. new_pw_sz = get_unaligned_be16(sent);
  304. sent += sizeof(new_pw_sz);
  305. if (new_pw_sz > TPM2_DIGEST_LEN) {
  306. rc = TPM2_RC_SIZE;
  307. } else if (new_pw_sz) {
  308. tpm->pw_sz[hierarchy] = new_pw_sz;
  309. memcpy(tpm->pw[hierarchy], sent, new_pw_sz);
  310. sent += new_pw_sz;
  311. }
  312. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  313. break;
  314. case TPM2_CC_GET_CAPABILITY:
  315. capability = get_unaligned_be32(sent);
  316. sent += sizeof(capability);
  317. if (capability != TPM_CAP_TPM_PROPERTIES) {
  318. printf("Sandbox TPM only support TPM_CAPABILITIES\n");
  319. return TPM2_RC_HANDLE;
  320. }
  321. property = get_unaligned_be32(sent);
  322. sent += sizeof(property);
  323. property -= TPM2_PROPERTIES_OFFSET;
  324. property_count = get_unaligned_be32(sent);
  325. sent += sizeof(property_count);
  326. if (!property_count ||
  327. property + property_count > TPM2_PROPERTY_NB) {
  328. rc = TPM2_RC_HANDLE;
  329. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  330. }
  331. /* Write tag */
  332. put_unaligned_be16(tag, recv);
  333. recv += sizeof(tag);
  334. /* Ignore length for now */
  335. recv += sizeof(u32);
  336. /* Write return code */
  337. put_unaligned_be32(rc, recv);
  338. recv += sizeof(rc);
  339. /* Tell there is more data to read */
  340. *recv = TPMI_YES;
  341. recv += sizeof(yes_no);
  342. /* Repeat the capability */
  343. put_unaligned_be32(capability, recv);
  344. recv += sizeof(capability);
  345. /* Give the number of properties that follow */
  346. put_unaligned_be32(property_count, recv);
  347. recv += sizeof(property_count);
  348. /* Fill with the properties */
  349. for (i = 0; i < property_count; i++) {
  350. put_unaligned_be32(TPM2_PROPERTIES_OFFSET + property +
  351. i, recv);
  352. recv += sizeof(property);
  353. put_unaligned_be32(tpm->properties[property + i],
  354. recv);
  355. recv += sizeof(property);
  356. }
  357. /* Add trailing \0 */
  358. *recv = '\0';
  359. /* Write response length */
  360. *recv_len = recv - recvbuf;
  361. put_unaligned_be32(*recv_len, recvbuf + sizeof(tag));
  362. break;
  363. case TPM2_CC_DAM_PARAMETERS:
  364. tpm->properties[TPM2_PROP_MAX_TRIES] = get_unaligned_be32(sent);
  365. sent += sizeof(*tpm->properties);
  366. tpm->properties[TPM2_RECOVERY_TIME] = get_unaligned_be32(sent);
  367. sent += sizeof(*tpm->properties);
  368. tpm->properties[TPM2_LOCKOUT_RECOVERY] = get_unaligned_be32(sent);
  369. sent += sizeof(*tpm->properties);
  370. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  371. break;
  372. case TPM2_CC_PCR_READ:
  373. selections = get_unaligned_be32(sent);
  374. sent += sizeof(selections);
  375. if (selections != 1) {
  376. printf("Sandbox cannot handle more than one PCR\n");
  377. rc = TPM2_RC_VALUE;
  378. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  379. }
  380. alg = get_unaligned_be16(sent);
  381. sent += sizeof(alg);
  382. if (alg != TPM2_ALG_SHA256) {
  383. printf("Sandbox TPM only handle SHA256 algorithm\n");
  384. rc = TPM2_RC_VALUE;
  385. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  386. }
  387. pcr_array_sz = *sent;
  388. sent += sizeof(pcr_array_sz);
  389. if (!pcr_array_sz || pcr_array_sz > 8) {
  390. printf("Sandbox TPM cannot handle so much PCRs\n");
  391. rc = TPM2_RC_VALUE;
  392. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  393. }
  394. for (i = 0; i < pcr_array_sz; i++)
  395. pcr_map += (u64)sent[i] << (i * 8);
  396. if (pcr_map >> SANDBOX_TPM_PCR_NB) {
  397. printf("Sandbox TPM handles up to %d PCR(s)\n",
  398. SANDBOX_TPM_PCR_NB);
  399. rc = TPM2_RC_VALUE;
  400. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  401. }
  402. if (!pcr_map) {
  403. printf("Empty PCR map.\n");
  404. rc = TPM2_RC_VALUE;
  405. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  406. }
  407. for (i = 0; i < SANDBOX_TPM_PCR_NB; i++)
  408. if (pcr_map & BIT(i))
  409. pcr_index = i;
  410. /* Write tag */
  411. put_unaligned_be16(tag, recv);
  412. recv += sizeof(tag);
  413. /* Ignore length for now */
  414. recv += sizeof(u32);
  415. /* Write return code */
  416. put_unaligned_be32(rc, recv);
  417. recv += sizeof(rc);
  418. /* Number of extensions */
  419. put_unaligned_be32(tpm->pcr_extensions[pcr_index], recv);
  420. recv += sizeof(u32);
  421. /* Copy the PCR */
  422. memcpy(recv, tpm->pcr[pcr_index], TPM2_DIGEST_LEN);
  423. recv += TPM2_DIGEST_LEN;
  424. /* Add trailing \0 */
  425. *recv = '\0';
  426. /* Write response length */
  427. *recv_len = recv - recvbuf;
  428. put_unaligned_be32(*recv_len, recvbuf + sizeof(tag));
  429. break;
  430. case TPM2_CC_PCR_EXTEND:
  431. /* Get the PCR index */
  432. pcr_index = get_unaligned_be32(sendbuf + sizeof(tag) +
  433. sizeof(length) +
  434. sizeof(command));
  435. if (pcr_index > SANDBOX_TPM_PCR_NB) {
  436. printf("Sandbox TPM handles up to %d PCR(s)\n",
  437. SANDBOX_TPM_PCR_NB);
  438. rc = TPM2_RC_VALUE;
  439. }
  440. /* Check the number of hashes */
  441. pcr_nb = get_unaligned_be32(sent);
  442. sent += sizeof(pcr_nb);
  443. if (pcr_nb != 1) {
  444. printf("Sandbox cannot handle more than one PCR\n");
  445. rc = TPM2_RC_VALUE;
  446. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  447. }
  448. /* Check the hash algorithm */
  449. alg = get_unaligned_be16(sent);
  450. sent += sizeof(alg);
  451. if (alg != TPM2_ALG_SHA256) {
  452. printf("Sandbox TPM only handle SHA256 algorithm\n");
  453. rc = TPM2_RC_VALUE;
  454. return sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  455. }
  456. /* Extend the PCR */
  457. rc = sandbox_tpm2_extend(dev, pcr_index, sent);
  458. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  459. break;
  460. default:
  461. printf("TPM2 command %02x unknown in Sandbox\n", command);
  462. rc = TPM2_RC_COMMAND_CODE;
  463. sandbox_tpm2_fill_buf(recv, recv_len, tag, rc);
  464. }
  465. return 0;
  466. }
  467. static int sandbox_tpm2_get_desc(struct udevice *dev, char *buf, int size)
  468. {
  469. if (size < 15)
  470. return -ENOSPC;
  471. return snprintf(buf, size, "Sandbox TPM2.x");
  472. }
  473. static int sandbox_tpm2_open(struct udevice *dev)
  474. {
  475. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  476. if (tpm->init_done)
  477. return -EIO;
  478. tpm->init_done = true;
  479. return 0;
  480. }
  481. static int sandbox_tpm2_probe(struct udevice *dev)
  482. {
  483. struct sandbox_tpm2 *tpm = dev_get_priv(dev);
  484. struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
  485. /* Use the TPM v2 stack */
  486. priv->version = TPM_V2;
  487. memset(tpm, 0, sizeof(*tpm));
  488. priv->pcr_count = 32;
  489. priv->pcr_select_min = 2;
  490. return 0;
  491. }
  492. static int sandbox_tpm2_close(struct udevice *dev)
  493. {
  494. return 0;
  495. }
  496. static const struct tpm_ops sandbox_tpm2_ops = {
  497. .open = sandbox_tpm2_open,
  498. .close = sandbox_tpm2_close,
  499. .get_desc = sandbox_tpm2_get_desc,
  500. .xfer = sandbox_tpm2_xfer,
  501. };
  502. static const struct udevice_id sandbox_tpm2_ids[] = {
  503. { .compatible = "sandbox,tpm2" },
  504. { }
  505. };
  506. U_BOOT_DRIVER(sandbox_tpm2) = {
  507. .name = "sandbox_tpm2",
  508. .id = UCLASS_TPM,
  509. .of_match = sandbox_tpm2_ids,
  510. .ops = &sandbox_tpm2_ops,
  511. .probe = sandbox_tpm2_probe,
  512. .priv_auto_alloc_size = sizeof(struct sandbox_tpm2),
  513. };