1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * Copyright (C) Microsoft Corporation |
4 | * |
5 | * Implements a firmware TPM as described here: |
6 | * https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/ |
7 | * |
8 | * A reference implementation is available here: |
9 | * https://github.com/microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM |
10 | */ |
11 | |
12 | #include <linux/acpi.h> |
13 | #include <linux/of.h> |
14 | #include <linux/platform_device.h> |
15 | #include <linux/tee_drv.h> |
16 | #include <linux/tpm.h> |
17 | #include <linux/uuid.h> |
18 | |
19 | #include "tpm.h" |
20 | #include "tpm_ftpm_tee.h" |
21 | |
22 | /* |
23 | * TA_FTPM_UUID: BC50D971-D4C9-42C4-82CB-343FB7F37896 |
24 | * |
25 | * Randomly generated, and must correspond to the GUID on the TA side. |
26 | * Defined here in the reference implementation: |
27 | * https://github.com/microsoft/ms-tpm-20-ref/blob/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/include/fTPM.h#L42 |
28 | */ |
29 | static const uuid_t ftpm_ta_uuid = |
30 | UUID_INIT(0xBC50D971, 0xD4C9, 0x42C4, |
31 | 0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96); |
32 | |
33 | /** |
34 | * ftpm_tee_tpm_op_recv() - retrieve fTPM response. |
35 | * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h. |
36 | * @buf: the buffer to store data. |
37 | * @count: the number of bytes to read. |
38 | * |
39 | * Return: |
40 | * In case of success the number of bytes received. |
41 | * On failure, -errno. |
42 | */ |
43 | static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
44 | { |
45 | struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev: chip->dev.parent); |
46 | size_t len; |
47 | |
48 | len = pvt_data->resp_len; |
49 | if (count < len) { |
50 | dev_err(&chip->dev, |
51 | "%s: Invalid size in recv: count=%zd, resp_len=%zd\n" , |
52 | __func__, count, len); |
53 | return -EIO; |
54 | } |
55 | |
56 | memcpy(buf, pvt_data->resp_buf, len); |
57 | pvt_data->resp_len = 0; |
58 | |
59 | return len; |
60 | } |
61 | |
62 | /** |
63 | * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory. |
64 | * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h |
65 | * @buf: the buffer to send. |
66 | * @len: the number of bytes to send. |
67 | * |
68 | * Return: |
69 | * In case of success, returns 0. |
70 | * On failure, -errno |
71 | */ |
72 | static int ftpm_tee_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t len) |
73 | { |
74 | struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev: chip->dev.parent); |
75 | size_t resp_len; |
76 | int rc; |
77 | u8 *temp_buf; |
78 | struct tpm_header *; |
79 | struct tee_ioctl_invoke_arg transceive_args; |
80 | struct tee_param command_params[4]; |
81 | struct tee_shm *shm = pvt_data->shm; |
82 | |
83 | if (len > MAX_COMMAND_SIZE) { |
84 | dev_err(&chip->dev, |
85 | "%s: len=%zd exceeds MAX_COMMAND_SIZE supported by fTPM TA\n" , |
86 | __func__, len); |
87 | return -EIO; |
88 | } |
89 | |
90 | memset(&transceive_args, 0, sizeof(transceive_args)); |
91 | memset(command_params, 0, sizeof(command_params)); |
92 | pvt_data->resp_len = 0; |
93 | |
94 | /* Invoke FTPM_OPTEE_TA_SUBMIT_COMMAND function of fTPM TA */ |
95 | transceive_args = (struct tee_ioctl_invoke_arg) { |
96 | .func = FTPM_OPTEE_TA_SUBMIT_COMMAND, |
97 | .session = pvt_data->session, |
98 | .num_params = 4, |
99 | }; |
100 | |
101 | /* Fill FTPM_OPTEE_TA_SUBMIT_COMMAND parameters */ |
102 | command_params[0] = (struct tee_param) { |
103 | .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT, |
104 | .u.memref = { |
105 | .shm = shm, |
106 | .size = len, |
107 | .shm_offs = 0, |
108 | }, |
109 | }; |
110 | |
111 | temp_buf = tee_shm_get_va(shm, offs: 0); |
112 | if (IS_ERR(ptr: temp_buf)) { |
113 | dev_err(&chip->dev, "%s: tee_shm_get_va failed for transmit\n" , |
114 | __func__); |
115 | return PTR_ERR(ptr: temp_buf); |
116 | } |
117 | memset(temp_buf, 0, (MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE)); |
118 | memcpy(temp_buf, buf, len); |
119 | |
120 | command_params[1] = (struct tee_param) { |
121 | .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT, |
122 | .u.memref = { |
123 | .shm = shm, |
124 | .size = MAX_RESPONSE_SIZE, |
125 | .shm_offs = MAX_COMMAND_SIZE, |
126 | }, |
127 | }; |
128 | |
129 | rc = tee_client_invoke_func(ctx: pvt_data->ctx, arg: &transceive_args, |
130 | param: command_params); |
131 | if ((rc < 0) || (transceive_args.ret != 0)) { |
132 | dev_err(&chip->dev, "%s: SUBMIT_COMMAND invoke error: 0x%x\n" , |
133 | __func__, transceive_args.ret); |
134 | return (rc < 0) ? rc : transceive_args.ret; |
135 | } |
136 | |
137 | temp_buf = tee_shm_get_va(shm, offs: command_params[1].u.memref.shm_offs); |
138 | if (IS_ERR(ptr: temp_buf)) { |
139 | dev_err(&chip->dev, "%s: tee_shm_get_va failed for receive\n" , |
140 | __func__); |
141 | return PTR_ERR(ptr: temp_buf); |
142 | } |
143 | |
144 | resp_header = (struct tpm_header *)temp_buf; |
145 | resp_len = be32_to_cpu(resp_header->length); |
146 | |
147 | /* sanity check resp_len */ |
148 | if (resp_len < TPM_HEADER_SIZE) { |
149 | dev_err(&chip->dev, "%s: tpm response header too small\n" , |
150 | __func__); |
151 | return -EIO; |
152 | } |
153 | if (resp_len > MAX_RESPONSE_SIZE) { |
154 | dev_err(&chip->dev, |
155 | "%s: resp_len=%zd exceeds MAX_RESPONSE_SIZE\n" , |
156 | __func__, resp_len); |
157 | return -EIO; |
158 | } |
159 | |
160 | /* sanity checks look good, cache the response */ |
161 | memcpy(pvt_data->resp_buf, temp_buf, resp_len); |
162 | pvt_data->resp_len = resp_len; |
163 | |
164 | return 0; |
165 | } |
166 | |
167 | static void ftpm_tee_tpm_op_cancel(struct tpm_chip *chip) |
168 | { |
169 | /* not supported */ |
170 | } |
171 | |
172 | static u8 ftpm_tee_tpm_op_status(struct tpm_chip *chip) |
173 | { |
174 | return 0; |
175 | } |
176 | |
177 | static bool ftpm_tee_tpm_req_canceled(struct tpm_chip *chip, u8 status) |
178 | { |
179 | return false; |
180 | } |
181 | |
182 | static const struct tpm_class_ops ftpm_tee_tpm_ops = { |
183 | .flags = TPM_OPS_AUTO_STARTUP, |
184 | .recv = ftpm_tee_tpm_op_recv, |
185 | .send = ftpm_tee_tpm_op_send, |
186 | .cancel = ftpm_tee_tpm_op_cancel, |
187 | .status = ftpm_tee_tpm_op_status, |
188 | .req_complete_mask = 0, |
189 | .req_complete_val = 0, |
190 | .req_canceled = ftpm_tee_tpm_req_canceled, |
191 | }; |
192 | |
193 | /* |
194 | * Check whether this driver supports the fTPM TA in the TEE instance |
195 | * represented by the params (ver/data) to this function. |
196 | */ |
197 | static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data) |
198 | { |
199 | /* |
200 | * Currently this driver only support GP Complaint OPTEE based fTPM TA |
201 | */ |
202 | if ((ver->impl_id == TEE_IMPL_ID_OPTEE) && |
203 | (ver->gen_caps & TEE_GEN_CAP_GP)) |
204 | return 1; |
205 | else |
206 | return 0; |
207 | } |
208 | |
209 | /** |
210 | * ftpm_tee_probe() - initialize the fTPM |
211 | * @dev: the device description. |
212 | * |
213 | * Return: |
214 | * On success, 0. On failure, -errno. |
215 | */ |
216 | static int ftpm_tee_probe(struct device *dev) |
217 | { |
218 | int rc; |
219 | struct tpm_chip *chip; |
220 | struct ftpm_tee_private *pvt_data = NULL; |
221 | struct tee_ioctl_open_session_arg sess_arg; |
222 | |
223 | pvt_data = devm_kzalloc(dev, size: sizeof(struct ftpm_tee_private), |
224 | GFP_KERNEL); |
225 | if (!pvt_data) |
226 | return -ENOMEM; |
227 | |
228 | dev_set_drvdata(dev, data: pvt_data); |
229 | |
230 | /* Open context with TEE driver */ |
231 | pvt_data->ctx = tee_client_open_context(NULL, match: ftpm_tee_match, NULL, |
232 | NULL); |
233 | if (IS_ERR(ptr: pvt_data->ctx)) { |
234 | if (PTR_ERR(ptr: pvt_data->ctx) == -ENOENT) |
235 | return -EPROBE_DEFER; |
236 | dev_err(dev, "%s: tee_client_open_context failed\n" , __func__); |
237 | return PTR_ERR(ptr: pvt_data->ctx); |
238 | } |
239 | |
240 | /* Open a session with fTPM TA */ |
241 | memset(&sess_arg, 0, sizeof(sess_arg)); |
242 | export_uuid(dst: sess_arg.uuid, src: &ftpm_ta_uuid); |
243 | sess_arg.clnt_login = TEE_IOCTL_LOGIN_PUBLIC; |
244 | sess_arg.num_params = 0; |
245 | |
246 | rc = tee_client_open_session(ctx: pvt_data->ctx, arg: &sess_arg, NULL); |
247 | if ((rc < 0) || (sess_arg.ret != 0)) { |
248 | dev_err(dev, "%s: tee_client_open_session failed, err=%x\n" , |
249 | __func__, sess_arg.ret); |
250 | rc = -EINVAL; |
251 | goto out_tee_session; |
252 | } |
253 | pvt_data->session = sess_arg.session; |
254 | |
255 | /* Allocate dynamic shared memory with fTPM TA */ |
256 | pvt_data->shm = tee_shm_alloc_kernel_buf(ctx: pvt_data->ctx, |
257 | MAX_COMMAND_SIZE + |
258 | MAX_RESPONSE_SIZE); |
259 | if (IS_ERR(ptr: pvt_data->shm)) { |
260 | dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n" , __func__); |
261 | rc = -ENOMEM; |
262 | goto out_shm_alloc; |
263 | } |
264 | |
265 | /* Allocate new struct tpm_chip instance */ |
266 | chip = tpm_chip_alloc(dev, ops: &ftpm_tee_tpm_ops); |
267 | if (IS_ERR(ptr: chip)) { |
268 | dev_err(dev, "%s: tpm_chip_alloc failed\n" , __func__); |
269 | rc = PTR_ERR(ptr: chip); |
270 | goto out_chip_alloc; |
271 | } |
272 | |
273 | pvt_data->chip = chip; |
274 | pvt_data->chip->flags |= TPM_CHIP_FLAG_TPM2; |
275 | |
276 | /* Create a character device for the fTPM */ |
277 | rc = tpm_chip_register(chip: pvt_data->chip); |
278 | if (rc) { |
279 | dev_err(dev, "%s: tpm_chip_register failed with rc=%d\n" , |
280 | __func__, rc); |
281 | goto out_chip; |
282 | } |
283 | |
284 | return 0; |
285 | |
286 | out_chip: |
287 | put_device(dev: &pvt_data->chip->dev); |
288 | out_chip_alloc: |
289 | tee_shm_free(shm: pvt_data->shm); |
290 | out_shm_alloc: |
291 | tee_client_close_session(ctx: pvt_data->ctx, session: pvt_data->session); |
292 | out_tee_session: |
293 | tee_client_close_context(ctx: pvt_data->ctx); |
294 | |
295 | return rc; |
296 | } |
297 | |
298 | static int ftpm_plat_tee_probe(struct platform_device *pdev) |
299 | { |
300 | struct device *dev = &pdev->dev; |
301 | |
302 | return ftpm_tee_probe(dev); |
303 | } |
304 | |
305 | /** |
306 | * ftpm_tee_remove() - remove the TPM device |
307 | * @dev: the device description. |
308 | * |
309 | * Return: |
310 | * 0 always. |
311 | */ |
312 | static int ftpm_tee_remove(struct device *dev) |
313 | { |
314 | struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev); |
315 | |
316 | /* Release the chip */ |
317 | tpm_chip_unregister(chip: pvt_data->chip); |
318 | |
319 | /* frees chip */ |
320 | put_device(dev: &pvt_data->chip->dev); |
321 | |
322 | /* Free the shared memory pool */ |
323 | tee_shm_free(shm: pvt_data->shm); |
324 | |
325 | /* close the existing session with fTPM TA*/ |
326 | tee_client_close_session(ctx: pvt_data->ctx, session: pvt_data->session); |
327 | |
328 | /* close the context with TEE driver */ |
329 | tee_client_close_context(ctx: pvt_data->ctx); |
330 | |
331 | /* memory allocated with devm_kzalloc() is freed automatically */ |
332 | |
333 | return 0; |
334 | } |
335 | |
336 | static void ftpm_plat_tee_remove(struct platform_device *pdev) |
337 | { |
338 | struct device *dev = &pdev->dev; |
339 | |
340 | ftpm_tee_remove(dev); |
341 | } |
342 | |
343 | /** |
344 | * ftpm_plat_tee_shutdown() - shutdown the TPM device |
345 | * @pdev: the platform_device description. |
346 | */ |
347 | static void ftpm_plat_tee_shutdown(struct platform_device *pdev) |
348 | { |
349 | struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev: &pdev->dev); |
350 | |
351 | tee_shm_free(shm: pvt_data->shm); |
352 | tee_client_close_session(ctx: pvt_data->ctx, session: pvt_data->session); |
353 | tee_client_close_context(ctx: pvt_data->ctx); |
354 | } |
355 | |
356 | static const struct of_device_id of_ftpm_tee_ids[] = { |
357 | { .compatible = "microsoft,ftpm" }, |
358 | { } |
359 | }; |
360 | MODULE_DEVICE_TABLE(of, of_ftpm_tee_ids); |
361 | |
362 | static struct platform_driver ftpm_tee_plat_driver = { |
363 | .driver = { |
364 | .name = "ftpm-tee" , |
365 | .of_match_table = of_match_ptr(of_ftpm_tee_ids), |
366 | }, |
367 | .shutdown = ftpm_plat_tee_shutdown, |
368 | .probe = ftpm_plat_tee_probe, |
369 | .remove_new = ftpm_plat_tee_remove, |
370 | }; |
371 | |
372 | /* UUID of the fTPM TA */ |
373 | static const struct tee_client_device_id optee_ftpm_id_table[] = { |
374 | {UUID_INIT(0xbc50d971, 0xd4c9, 0x42c4, |
375 | 0x82, 0xcb, 0x34, 0x3f, 0xb7, 0xf3, 0x78, 0x96)}, |
376 | {} |
377 | }; |
378 | |
379 | MODULE_DEVICE_TABLE(tee, optee_ftpm_id_table); |
380 | |
381 | static struct tee_client_driver ftpm_tee_driver = { |
382 | .id_table = optee_ftpm_id_table, |
383 | .driver = { |
384 | .name = "optee-ftpm" , |
385 | .bus = &tee_bus_type, |
386 | .probe = ftpm_tee_probe, |
387 | .remove = ftpm_tee_remove, |
388 | }, |
389 | }; |
390 | |
391 | static int __init ftpm_mod_init(void) |
392 | { |
393 | int rc; |
394 | |
395 | rc = platform_driver_register(&ftpm_tee_plat_driver); |
396 | if (rc) |
397 | return rc; |
398 | |
399 | rc = driver_register(drv: &ftpm_tee_driver.driver); |
400 | if (rc) { |
401 | platform_driver_unregister(&ftpm_tee_plat_driver); |
402 | return rc; |
403 | } |
404 | |
405 | return 0; |
406 | } |
407 | |
408 | static void __exit ftpm_mod_exit(void) |
409 | { |
410 | platform_driver_unregister(&ftpm_tee_plat_driver); |
411 | driver_unregister(drv: &ftpm_tee_driver.driver); |
412 | } |
413 | |
414 | module_init(ftpm_mod_init); |
415 | module_exit(ftpm_mod_exit); |
416 | |
417 | MODULE_AUTHOR("Thirupathaiah Annapureddy <thiruan@microsoft.com>" ); |
418 | MODULE_DESCRIPTION("TPM Driver for fTPM TA in TEE" ); |
419 | MODULE_LICENSE("GPL v2" ); |
420 | |