github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tpm-buf: Memory-safe allocations

Browse Source 
Decouple kzalloc from buffer creation, so that a managed allocation can be
used:

	struct tpm_buf *buf __free(kfree) buf = kzalloc(TPM_BUFSIZE,
						GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	tpm_buf_init(buf, TPM_BUFSIZE);

Alternatively, other allocations are also possible (static data, stack,
etc) for example:

	u8 buf_data[512];
	struct tpm_buf *buf = (struct tpm_buf *)buf_data;
	tpm_buf_init(buf, sizeof(buf_data));

This is achieved by embedding buffer's header inside the allocated blob,
instead of having an outer wrapper.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com>
Tested-by: Srish Srinivasan <ssrish@linux.ibm.com>
Message-ID: <20260522013555.1063716-1-jarkko@kernel.org>
Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
This commit is contained in:
Jarkko Sakkinen 2026-07-11 09:01:09 -07:00 committed by Jarkko Sakkinen
parent 065cfba1f4
commit 3d9e043dab
10 changed files with 538 additions and 542 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

124
drivers/char/tpm/tpm-buf.c
View File

@ -6,90 +6,118 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/tpm.h> #include <linux/tpm.h>
/** static void __tpm_buf_size_invariant(struct tpm_buf *buf, u16 buf_size)
* tpm_buf_init() - Allocate and initialize a TPM command
* @buf: A &tpm_buf
* @tag: TPM_TAG_RQU_COMMAND, TPM2_ST_NO_SESSIONS or TPM2_ST_SESSIONS
* @ordinal: A command ordinal
*
* Return: 0 or -ENOMEM
*/
int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal)
{ {
buf->data = (u8 *)__get_free_page(GFP_KERNEL); u32 buf_size_2 = (u32)buf->capacity + (u32)sizeof(*buf);
if (!buf->data)
return -ENOMEM;
tpm_buf_reset(buf, tag, ordinal); if (!buf->capacity) {
return 0; if (buf_size > TPM_BUFSIZE) {
WARN(1, "%s: size overflow: %u\n", __func__, buf_size);
buf->flags |= TPM_BUF_INVALID;
}
} else {
if (buf_size != buf_size_2) {
WARN(1, "%s: size mismatch: %u != %u\n", __func__,
buf_size, buf_size_2);
buf->flags |= TPM_BUF_INVALID;
}
}
} }
EXPORT_SYMBOL_GPL(tpm_buf_init);
/** static void __tpm_buf_reset(struct tpm_buf *buf, u16 buf_size, u16 tag,
* tpm_buf_reset() - Initialize a TPM command u32 ordinal)
* @buf: A &tpm_buf
* @tag: TPM_TAG_RQU_COMMAND, TPM2_ST_NO_SESSIONS or TPM2_ST_SESSIONS
* @ordinal: A command ordinal
*/
void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal)
{ {
struct tpm_header *head = (struct tpm_header *)buf->data; struct tpm_header *head = (struct tpm_header *)buf->data;
__tpm_buf_size_invariant(buf, buf_size);
if (buf->flags & TPM_BUF_INVALID)
return;
WARN_ON(tag != TPM_TAG_RQU_COMMAND && tag != TPM2_ST_NO_SESSIONS && WARN_ON(tag != TPM_TAG_RQU_COMMAND && tag != TPM2_ST_NO_SESSIONS &&
tag != TPM2_ST_SESSIONS && tag != 0); tag != TPM2_ST_SESSIONS && tag != 0);
buf->flags = 0; buf->flags = 0;
buf->length = sizeof(*head); buf->length = sizeof(*head);
buf->capacity = buf_size - sizeof(*buf);
buf->handles = 0;
head->tag = cpu_to_be16(tag); head->tag = cpu_to_be16(tag);
head->length = cpu_to_be32(sizeof(*head)); head->length = cpu_to_be32(sizeof(*head));
head->ordinal = cpu_to_be32(ordinal); head->ordinal = cpu_to_be32(ordinal);
buf->handles = 0;
} }
EXPORT_SYMBOL_GPL(tpm_buf_reset);
static void __tpm_buf_reset_sized(struct tpm_buf *buf, u16 buf_size)
{
__tpm_buf_size_invariant(buf, buf_size);
if (buf->flags & TPM_BUF_INVALID)
return;
buf->flags = TPM_BUF_TPM2B;
buf->length = 2;
buf->capacity = buf_size - sizeof(*buf);
buf->handles = 0;
buf->data[0] = 0;
buf->data[1] = 0;
}
/** /**
* tpm_buf_init_sized() - Allocate and initialize a sized (TPM2B) buffer * tpm_buf_init() - Initialize a TPM command
* @buf: A @tpm_buf * @buf: A &tpm_buf
* * @buf_size: Size of the buffer.
* Return: 0 or -ENOMEM
*/ */
int tpm_buf_init_sized(struct tpm_buf *buf) void tpm_buf_init(struct tpm_buf *buf, u16 buf_size)
{ {
buf->data = (u8 *)__get_free_page(GFP_KERNEL); memset(buf, 0, buf_size);
if (!buf->data) __tpm_buf_reset(buf, buf_size, TPM_TAG_RQU_COMMAND, 0);
return -ENOMEM; }
EXPORT_SYMBOL_GPL(tpm_buf_init);
tpm_buf_reset_sized(buf); /**
return 0; * tpm_buf_init_sized() - Initialize a sized buffer
* @buf: A &tpm_buf
* @buf_size: Size of the buffer.
*/
void tpm_buf_init_sized(struct tpm_buf *buf, u16 buf_size)
{
memset(buf, 0, buf_size);
__tpm_buf_reset_sized(buf, buf_size);
} }
EXPORT_SYMBOL_GPL(tpm_buf_init_sized); EXPORT_SYMBOL_GPL(tpm_buf_init_sized);
/** /**
* tpm_buf_reset_sized() - Initialize a sized buffer * tpm_buf_reset() - Re-initialize a TPM command
* @buf: A &tpm_buf
* @tag: TPM_TAG_RQU_COMMAND, TPM2_ST_NO_SESSIONS or TPM2_ST_SESSIONS
* @ordinal: A command ordinal
*/
void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal)
{
u16 buf_size = buf->capacity + sizeof(*buf);
__tpm_buf_reset(buf, buf_size, tag, ordinal);
}
EXPORT_SYMBOL_GPL(tpm_buf_reset);
/**
* tpm_buf_reset_sized() - Re-initialize a sized buffer
* @buf: A &tpm_buf * @buf: A &tpm_buf
*/ */
void tpm_buf_reset_sized(struct tpm_buf *buf) void tpm_buf_reset_sized(struct tpm_buf *buf)
{ {
buf->flags = TPM_BUF_TPM2B; u16 buf_size = buf->capacity + sizeof(*buf);
buf->length = 2;
buf->data[0] = 0; __tpm_buf_reset_sized(buf, buf_size);
buf->data[1] = 0;
} }
EXPORT_SYMBOL_GPL(tpm_buf_reset_sized); EXPORT_SYMBOL_GPL(tpm_buf_reset_sized);
void tpm_buf_destroy(struct tpm_buf *buf)
{
free_page((unsigned long)buf->data);
}
EXPORT_SYMBOL_GPL(tpm_buf_destroy);
/** /**
* tpm_buf_length() - Return the number of bytes consumed by the data * tpm_buf_length() - Return the number of bytes consumed by the data
* @buf: A &tpm_buf * @buf: A &tpm_buf
* *
* Return: The number of bytes consumed by the buffer * Return: The number of bytes consumed by the buffer
*/ */
u32 tpm_buf_length(struct tpm_buf *buf) u16 tpm_buf_length(struct tpm_buf *buf)
{ {
return buf->length; return buf->length;
} }
@ -103,10 +131,12 @@ EXPORT_SYMBOL_GPL(tpm_buf_length);
*/ */
void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length) void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length)
{ {
u32 total_length = (u32)buf->length + (u32)new_length;
if (buf->flags & TPM_BUF_INVALID) if (buf->flags & TPM_BUF_INVALID)
return; return;
if ((buf->length + new_length) > PAGE_SIZE) { if (total_length > (u32)buf->capacity) {
WARN(1, "tpm_buf: write overflow\n"); WARN(1, "tpm_buf: write overflow\n");
buf->flags |= TPM_BUF_INVALID; buf->flags |= TPM_BUF_INVALID;
return; return;

26
drivers/char/tpm/tpm-sysfs.c
View File

@ -32,28 +32,35 @@ struct tpm_readpubek_out {
static ssize_t pubek_show(struct device *dev, struct device_attribute *attr, static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
char *buf) char *buf)
{ {
struct tpm_buf tpm_buf;
struct tpm_readpubek_out *out; struct tpm_readpubek_out *out;
int i; int i;
char *str = buf; char *str = buf;
struct tpm_chip *chip = to_tpm_chip(dev); struct tpm_chip *chip = to_tpm_chip(dev);
char anti_replay[20]; char anti_replay[20];
struct tpm_buf *tpm_buf __free(kfree) = NULL;
memset(&anti_replay, 0, sizeof(anti_replay)); memset(&anti_replay, 0, sizeof(anti_replay));
if (tpm_try_get_ops(chip)) if (tpm_try_get_ops(chip))
return 0; return 0;
if (tpm_buf_init(&tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK)) tpm_buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
goto out_ops; if (!tpm_buf) {
tpm_put_ops(chip);
return 0;
}
tpm_buf_append(&tpm_buf, anti_replay, sizeof(anti_replay)); tpm_buf_init(tpm_buf, TPM_BUFSIZE);
tpm_buf_reset(tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK);
tpm_buf_append(tpm_buf, anti_replay, sizeof(anti_replay));
if (tpm_transmit_cmd(chip, &tpm_buf, READ_PUBEK_RESULT_MIN_BODY_SIZE, if (tpm_transmit_cmd(chip, tpm_buf, READ_PUBEK_RESULT_MIN_BODY_SIZE,
"attempting to read the PUBEK")) "attempting to read the PUBEK")) {
goto out_buf; tpm_put_ops(chip);
return 0;
}
out = (struct tpm_readpubek_out *)&tpm_buf.data[10]; out = (struct tpm_readpubek_out *)&tpm_buf->data[10];
str += str +=
sprintf(str, sprintf(str,
"Algorithm: %4ph\n" "Algorithm: %4ph\n"
@ -71,9 +78,6 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
for (i = 0; i < 256; i += 16) for (i = 0; i < 256; i += 16)
str += sprintf(str, "%16ph\n", &out->modulus[i]); str += sprintf(str, "%16ph\n", &out->modulus[i]);
out_buf:
tpm_buf_destroy(&tpm_buf);
out_ops:
tpm_put_ops(chip); tpm_put_ops(chip);
return str - buf; return str - buf;
} }

167
drivers/char/tpm/tpm1-cmd.c
View File

@ -318,20 +318,18 @@ unsigned long tpm1_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
*/ */
static int tpm1_startup(struct tpm_chip *chip) static int tpm1_startup(struct tpm_chip *chip)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = NULL;
int rc;
dev_info(&chip->dev, "starting up the TPM manually\n"); dev_info(&chip->dev, "starting up the TPM manually\n");
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_STARTUP); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc < 0) if (!buf)
return rc; return -ENOMEM;
tpm_buf_append_u16(&buf, TPM_ST_CLEAR); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_STARTUP);
rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to start the TPM"); tpm_buf_append_u16(buf, TPM_ST_CLEAR);
tpm_buf_destroy(&buf); return tpm_transmit_cmd(chip, buf, 0, "attempting to start the TPM");
return rc;
} }
int tpm1_get_timeouts(struct tpm_chip *chip) int tpm1_get_timeouts(struct tpm_chip *chip)
@ -457,49 +455,49 @@ int tpm1_get_timeouts(struct tpm_chip *chip)
int tpm1_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash, int tpm1_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash,
const char *log_msg) const char *log_msg)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
int rc; if (!buf)
return -ENOMEM;
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_PCR_EXTEND); tpm_buf_init(buf, TPM_BUFSIZE);
if (rc) tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_PCR_EXTEND);
return rc; tpm_buf_append_u32(buf, pcr_idx);
tpm_buf_append(buf, hash, TPM_DIGEST_SIZE);
tpm_buf_append_u32(&buf, pcr_idx); return tpm_transmit_cmd(chip, buf, TPM_DIGEST_SIZE, log_msg);
tpm_buf_append(&buf, hash, TPM_DIGEST_SIZE);
rc = tpm_transmit_cmd(chip, &buf, TPM_DIGEST_SIZE, log_msg);
tpm_buf_destroy(&buf);
return rc;
} }
ssize_t tpm1_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap, ssize_t tpm1_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
const char *desc, size_t min_cap_length) const char *desc, size_t min_cap_length)
{ {
struct tpm_buf buf;
int rc; int rc;
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_CAP); struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_CAP);
if (subcap_id == TPM_CAP_VERSION_1_1 || if (subcap_id == TPM_CAP_VERSION_1_1 ||
subcap_id == TPM_CAP_VERSION_1_2) { subcap_id == TPM_CAP_VERSION_1_2) {
tpm_buf_append_u32(&buf, subcap_id); tpm_buf_append_u32(buf, subcap_id);
tpm_buf_append_u32(&buf, 0); tpm_buf_append_u32(buf, 0);
} else { } else {
if (subcap_id == TPM_CAP_FLAG_PERM || if (subcap_id == TPM_CAP_FLAG_PERM ||
subcap_id == TPM_CAP_FLAG_VOL) subcap_id == TPM_CAP_FLAG_VOL)
tpm_buf_append_u32(&buf, TPM_CAP_FLAG); tpm_buf_append_u32(buf, TPM_CAP_FLAG);
else else
tpm_buf_append_u32(&buf, TPM_CAP_PROP); tpm_buf_append_u32(buf, TPM_CAP_PROP);
tpm_buf_append_u32(&buf, 4); tpm_buf_append_u32(buf, 4);
tpm_buf_append_u32(&buf, subcap_id); tpm_buf_append_u32(buf, subcap_id);
} }
rc = tpm_transmit_cmd(chip, &buf, min_cap_length, desc);
rc = tpm_transmit_cmd(chip, buf, min_cap_length, desc);
if (!rc) if (!rc)
*cap = *(cap_t *)&buf.data[TPM_HEADER_SIZE + 4]; *cap = *(cap_t *)&buf->data[TPM_HEADER_SIZE + 4];
tpm_buf_destroy(&buf);
return rc; return rc;
} }
EXPORT_SYMBOL_GPL(tpm1_getcap); EXPORT_SYMBOL_GPL(tpm1_getcap);
@ -517,81 +515,77 @@ EXPORT_SYMBOL_GPL(tpm1_getcap);
int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
{ {
struct tpm1_get_random_out *out; struct tpm1_get_random_out *out;
struct tpm_buf *buf __free(kfree) = NULL;
u32 num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA); u32 num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA);
struct tpm_buf buf;
u32 total = 0; u32 total = 0;
int retries = 5; int retries = 5;
u32 recd; u32 recd;
int rc; int rc;
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_RANDOM); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_RANDOM);
do { do {
tpm_buf_append_u32(&buf, num_bytes); tpm_buf_append_u32(buf, num_bytes);
rc = tpm_transmit_cmd(chip, &buf, sizeof(out->rng_data_len), rc = tpm_transmit_cmd(chip, buf, sizeof(out->rng_data_len),
"attempting get random"); "attempting get random");
if (rc) { if (rc) {
if (rc > 0) if (rc > 0)
rc = -EIO; rc = -EIO;
goto out; return rc;
} }
out = (struct tpm1_get_random_out *)&buf.data[TPM_HEADER_SIZE]; out = (struct tpm1_get_random_out *)&buf->data[TPM_HEADER_SIZE];
recd = be32_to_cpu(out->rng_data_len); recd = be32_to_cpu(out->rng_data_len);
if (recd > num_bytes) { if (recd > num_bytes)
rc = -EFAULT; return -EFAULT;
goto out;
} if (tpm_buf_length(buf) < TPM_HEADER_SIZE +
sizeof(out->rng_data_len) + recd)
return -EFAULT;
if (tpm_buf_length(&buf) < TPM_HEADER_SIZE +
sizeof(out->rng_data_len) + recd) {
rc = -EFAULT;
goto out;
}
memcpy(dest, out->rng_data, recd); memcpy(dest, out->rng_data, recd);
dest += recd; dest += recd;
total += recd; total += recd;
num_bytes -= recd; num_bytes -= recd;
tpm_buf_reset(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_RANDOM); tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_RANDOM);
} while (retries-- && total < max); } while (retries-- && total < max);
rc = total ? (int)total : -EIO; rc = total ? (int)total : -EIO;
out:
tpm_buf_destroy(&buf);
return rc; return rc;
} }
int tpm1_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf) int tpm1_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
{ {
struct tpm_buf buf;
int rc; int rc;
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_PCR_READ); struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_PCR_READ);
tpm_buf_append_u32(buf, pcr_idx);
rc = tpm_transmit_cmd(chip, buf, TPM_DIGEST_SIZE,
"attempting to read a pcr value");
if (rc) if (rc)
return rc; return rc;
tpm_buf_append_u32(&buf, pcr_idx); if (tpm_buf_length(buf) < TPM_DIGEST_SIZE)
return -EFAULT;
rc = tpm_transmit_cmd(chip, &buf, TPM_DIGEST_SIZE, memcpy(res_buf, &buf->data[TPM_HEADER_SIZE], TPM_DIGEST_SIZE);
"attempting to read a pcr value");
if (rc)
goto out;
if (tpm_buf_length(&buf) < TPM_DIGEST_SIZE) {
rc = -EFAULT;
goto out;
}
memcpy(res_buf, &buf.data[TPM_HEADER_SIZE], TPM_DIGEST_SIZE);
out:
tpm_buf_destroy(&buf);
return rc; return rc;
} }
@ -604,16 +598,13 @@ int tpm1_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
*/ */
static int tpm1_continue_selftest(struct tpm_chip *chip) static int tpm1_continue_selftest(struct tpm_chip *chip)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
int rc; if (!buf)
return -ENOMEM;
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_CONTINUE_SELFTEST); tpm_buf_init(buf, TPM_BUFSIZE);
if (rc) tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_CONTINUE_SELFTEST);
return rc; return tpm_transmit_cmd(chip, buf, 0, "continue selftest");
rc = tpm_transmit_cmd(chip, &buf, 0, "continue selftest");
tpm_buf_destroy(&buf);
return rc;
} }
/** /**
@ -725,22 +716,24 @@ int tpm1_auto_startup(struct tpm_chip *chip)
int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr) int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
{ {
u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 }; u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
struct tpm_buf buf;
unsigned int try; unsigned int try;
struct tpm_buf *buf __free(kfree) = NULL;
int rc; int rc;
/* for buggy tpm, flush pcrs with extend to selected dummy */ /* for buggy tpm, flush pcrs with extend to selected dummy */
if (tpm_suspend_pcr) if (tpm_suspend_pcr)
rc = tpm1_pcr_extend(chip, tpm_suspend_pcr, dummy_hash, rc = tpm1_pcr_extend(chip, tpm_suspend_pcr, dummy_hash,
"extending dummy pcr before suspend"); "extending dummy pcr before suspend");
buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SAVESTATE);
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SAVESTATE);
if (rc)
return rc;
/* now do the actual savestate */ /* now do the actual savestate */
for (try = 0; try < TPM_RETRY; try++) { for (try = 0; try < TPM_RETRY; try++) {
rc = tpm_transmit_cmd(chip, &buf, 0, NULL); rc = tpm_transmit_cmd(chip, buf, 0, NULL);
/* /*
* If the TPM indicates that it is too busy to respond to * If the TPM indicates that it is too busy to respond to
* this command then retry before giving up. It can take * this command then retry before giving up. It can take
@ -755,7 +748,7 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
break; break;
tpm_msleep(TPM_TIMEOUT_RETRY); tpm_msleep(TPM_TIMEOUT_RETRY);
tpm_buf_reset(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SAVESTATE); tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SAVESTATE);
} }
if (rc) if (rc)
@ -765,8 +758,6 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
dev_warn(&chip->dev, "TPM savestate took %dms\n", dev_warn(&chip->dev, "TPM savestate took %dms\n",
try * TPM_TIMEOUT_RETRY); try * TPM_TIMEOUT_RETRY);
tpm_buf_destroy(&buf);
return rc; return rc;
} }

297
drivers/char/tpm/tpm2-cmd.c
View File

@ -108,12 +108,13 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
{ {
int i; int i;
int rc; int rc;
struct tpm_buf buf;
struct tpm2_pcr_read_out *out; struct tpm2_pcr_read_out *out;
u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0}; u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
u16 digest_size; u16 digest_size;
u16 expected_digest_size = 0; u16 expected_digest_size = 0;
struct tpm_buf *buf __free(kfree) = NULL;
if (pcr_idx >= TPM2_PLATFORM_PCR) if (pcr_idx >= TPM2_PLATFORM_PCR)
return -EINVAL; return -EINVAL;
@ -128,36 +129,35 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
expected_digest_size = chip->allocated_banks[i].digest_size; expected_digest_size = chip->allocated_banks[i].digest_size;
} }
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ);
pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7); pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
tpm_buf_append_u32(&buf, 1); tpm_buf_append_u32(buf, 1);
tpm_buf_append_u16(&buf, digest->alg_id); tpm_buf_append_u16(buf, digest->alg_id);
tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN); tpm_buf_append_u8(buf, TPM2_PCR_SELECT_MIN);
tpm_buf_append(&buf, (const unsigned char *)pcr_select, tpm_buf_append(buf, (const unsigned char *)pcr_select,
sizeof(pcr_select)); sizeof(pcr_select));
rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to read a pcr value"); rc = tpm_transmit_cmd(chip, buf, 0, "attempting to read a pcr value");
if (rc) if (rc)
goto out; return rc;
out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE]; out = (struct tpm2_pcr_read_out *)&buf->data[TPM_HEADER_SIZE];
digest_size = be16_to_cpu(out->digest_size); digest_size = be16_to_cpu(out->digest_size);
if (digest_size > sizeof(digest->digest) || if (digest_size > sizeof(digest->digest) ||
(!digest_size_ptr && digest_size != expected_digest_size)) { (!digest_size_ptr && digest_size != expected_digest_size))
rc = -EINVAL; return -EINVAL;
goto out;
}
if (digest_size_ptr) if (digest_size_ptr)
*digest_size_ptr = digest_size; *digest_size_ptr = digest_size;
memcpy(digest->digest, out->digest, digest_size); memcpy(digest->digest, out->digest, digest_size);
out:
tpm_buf_destroy(&buf);
return rc; return rc;
} }
@ -173,7 +173,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digests) struct tpm_digest *digests)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = NULL;
int rc; int rc;
int i; int i;
@ -183,46 +183,45 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
return rc; return rc;
} }
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) { if (!buf) {
if (!disable_pcr_integrity) if (!disable_pcr_integrity)
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
return rc; return -ENOMEM;
} }
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);
if (!disable_pcr_integrity) { if (!disable_pcr_integrity) {
rc = tpm_buf_append_name(chip, &buf, pcr_idx, NULL); rc = tpm_buf_append_name(chip, buf, pcr_idx, NULL);
if (rc) { if (rc) {
tpm_buf_destroy(&buf); tpm2_end_auth_session(chip);
return rc; return rc;
} }
tpm_buf_append_hmac_session(chip, &buf, 0, NULL, 0); tpm_buf_append_hmac_session(chip, buf, 0, NULL, 0);
} else { } else {
tpm_buf_append_handle(&buf, pcr_idx); tpm_buf_append_handle(buf, pcr_idx);
tpm_buf_append_auth(chip, &buf, NULL, 0); tpm_buf_append_auth(chip, buf, NULL, 0);
} }
tpm_buf_append_u32(&buf, chip->nr_allocated_banks); tpm_buf_append_u32(buf, chip->nr_allocated_banks);
for (i = 0; i < chip->nr_allocated_banks; i++) { for (i = 0; i < chip->nr_allocated_banks; i++) {
tpm_buf_append_u16(&buf, digests[i].alg_id); tpm_buf_append_u16(buf, digests[i].alg_id);
tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest, tpm_buf_append(buf, (const unsigned char *)&digests[i].digest,
chip->allocated_banks[i].digest_size); chip->allocated_banks[i].digest_size);
} }
if (!disable_pcr_integrity) { if (!disable_pcr_integrity) {
rc = tpm_buf_fill_hmac_session(chip, &buf); rc = tpm_buf_fill_hmac_session(chip, buf);
if (rc) { if (rc)
tpm_buf_destroy(&buf);
return rc; return rc;
}
} }
rc = tpm_transmit_cmd(chip, &buf, 0, "attempting extend a PCR value"); rc = tpm_transmit_cmd(chip, buf, 0, "attempting extend a PCR value");
if (!disable_pcr_integrity) if (!disable_pcr_integrity)
rc = tpm_buf_check_hmac_response(chip, &buf, rc); rc = tpm_buf_check_hmac_response(chip, buf, rc);
tpm_buf_destroy(&buf);
return rc; return rc;
} }
@ -242,7 +241,6 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
{ {
struct tpm2_get_random_out *out; struct tpm2_get_random_out *out;
struct tpm_header *head; struct tpm_header *head;
struct tpm_buf buf;
u32 recd; u32 recd;
u32 num_bytes = max; u32 num_bytes = max;
int err; int err;
@ -251,6 +249,8 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
u8 *dest_ptr = dest; u8 *dest_ptr = dest;
off_t offset; off_t offset;
struct tpm_buf *buf __free(kfree) = NULL;
if (!num_bytes || max > TPM_MAX_RNG_DATA) if (!num_bytes || max > TPM_MAX_RNG_DATA)
return -EINVAL; return -EINVAL;
@ -258,55 +258,58 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
if (err) if (err)
return err; return err;
err = tpm_buf_init(&buf, 0, 0); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (err) { if (!buf) {
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
return err; return -ENOMEM;
} }
tpm_buf_init(buf, TPM_BUFSIZE);
do { do {
tpm_buf_reset(&buf, TPM2_ST_SESSIONS, TPM2_CC_GET_RANDOM); tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_GET_RANDOM);
if (tpm2_chip_auth(chip)) { if (tpm2_chip_auth(chip)) {
tpm_buf_append_hmac_session(chip, &buf, tpm_buf_append_hmac_session(chip, buf,
TPM2_SA_ENCRYPT | TPM2_SA_ENCRYPT |
TPM2_SA_CONTINUE_SESSION, TPM2_SA_CONTINUE_SESSION,
NULL, 0); NULL, 0);
} else { } else {
offset = buf.handles * 4 + TPM_HEADER_SIZE; offset = buf->handles * 4 + TPM_HEADER_SIZE;
head = (struct tpm_header *)buf.data; head = (struct tpm_header *)buf->data;
if (tpm_buf_length(&buf) == offset) if (tpm_buf_length(buf) == offset)
head->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS); head->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
} }
tpm_buf_append_u16(&buf, num_bytes); tpm_buf_append_u16(buf, num_bytes);
err = tpm_buf_fill_hmac_session(chip, &buf); err = tpm_buf_fill_hmac_session(chip, buf);
if (err) if (err)
goto out; return err;
err = tpm_transmit_cmd(chip, &buf, err = tpm_transmit_cmd(chip, buf,
offsetof(struct tpm2_get_random_out, offsetof(struct tpm2_get_random_out,
buffer), buffer),
"attempting get random"); "attempting get random");
err = tpm_buf_check_hmac_response(chip, &buf, err); err = tpm_buf_check_hmac_response(chip, buf, err);
if (err) { if (err) {
if (err > 0) if (err > 0)
err = -EIO; err = -EIO;
goto out; tpm2_end_auth_session(chip);
return err;
} }
head = (struct tpm_header *)buf.data; head = (struct tpm_header *)buf->data;
offset = TPM_HEADER_SIZE; offset = TPM_HEADER_SIZE;
/* Skip the parameter size field: */ /* Skip the parameter size field: */
if (be16_to_cpu(head->tag) == TPM2_ST_SESSIONS) if (be16_to_cpu(head->tag) == TPM2_ST_SESSIONS)
offset += 4; offset += 4;
out = (struct tpm2_get_random_out *)&buf.data[offset]; out = (struct tpm2_get_random_out *)&buf->data[offset];
recd = min_t(u32, be16_to_cpu(out->size), num_bytes); recd = min_t(u32, be16_to_cpu(out->size), num_bytes);
if (tpm_buf_length(&buf) < if (tpm_buf_length(buf) <
TPM_HEADER_SIZE + TPM_HEADER_SIZE +
offsetof(struct tpm2_get_random_out, buffer) + offsetof(struct tpm2_get_random_out, buffer) +
recd) { recd) {
err = -EFAULT; tpm2_end_auth_session(chip);
goto out; return -EFAULT;
} }
memcpy(dest_ptr, out->buffer, recd); memcpy(dest_ptr, out->buffer, recd);
@ -315,13 +318,7 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
num_bytes -= recd; num_bytes -= recd;
} while (retries-- && total < max); } while (retries-- && total < max);
tpm_buf_destroy(&buf);
return total ? total : -EIO; return total ? total : -EIO;
out:
tpm_buf_destroy(&buf);
tpm2_end_auth_session(chip);
return err;
} }
/** /**
@ -331,20 +328,18 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
*/ */
void tpm2_flush_context(struct tpm_chip *chip, u32 handle) void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
int rc; if (!buf) {
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT);
if (rc) {
dev_warn(&chip->dev, "0x%08x was not flushed, out of memory\n", dev_warn(&chip->dev, "0x%08x was not flushed, out of memory\n",
handle); handle);
return; return;
} }
tpm_buf_append_u32(&buf, handle); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT);
tpm_buf_append_u32(buf, handle);
tpm_transmit_cmd(chip, &buf, 0, "flushing context"); tpm_transmit_cmd(chip, buf, 0, "flushing context");
tpm_buf_destroy(&buf);
} }
EXPORT_SYMBOL_GPL(tpm2_flush_context); EXPORT_SYMBOL_GPL(tpm2_flush_context);
@ -363,19 +358,21 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value,
const char *desc) const char *desc)
{ {
struct tpm2_get_cap_out *out; struct tpm2_get_cap_out *out;
struct tpm_buf buf;
int rc; int rc;
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
tpm_buf_append_u32(&buf, TPM2_CAP_TPM_PROPERTIES);
tpm_buf_append_u32(&buf, property_id); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_append_u32(&buf, 1); tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
rc = tpm_transmit_cmd(chip, &buf, 0, NULL); tpm_buf_append_u32(buf, TPM2_CAP_TPM_PROPERTIES);
tpm_buf_append_u32(buf, property_id);
tpm_buf_append_u32(buf, 1);
rc = tpm_transmit_cmd(chip, buf, 0, NULL);
if (!rc) { if (!rc) {
out = (struct tpm2_get_cap_out *) out = (struct tpm2_get_cap_out *)
&buf.data[TPM_HEADER_SIZE]; &buf->data[TPM_HEADER_SIZE];
/* /*
* To prevent failing boot up of some systems, Infineon TPM2.0 * To prevent failing boot up of some systems, Infineon TPM2.0
* returns SUCCESS on TPM2_Startup in field upgrade mode. Also * returns SUCCESS on TPM2_Startup in field upgrade mode. Also
@ -387,7 +384,6 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value,
else else
rc = -ENODATA; rc = -ENODATA;
} }
tpm_buf_destroy(&buf);
return rc; return rc;
} }
EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt); EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt);
@ -404,15 +400,14 @@ EXPORT_SYMBOL_GPL(tpm2_get_tpm_pt);
*/ */
void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type) void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
int rc; if (!buf)
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SHUTDOWN);
if (rc)
return; return;
tpm_buf_append_u16(&buf, shutdown_type);
tpm_transmit_cmd(chip, &buf, 0, "stopping the TPM"); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_destroy(&buf); tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SHUTDOWN);
tpm_buf_append_u16(buf, shutdown_type);
tpm_transmit_cmd(chip, buf, 0, "stopping the TPM");
} }
/** /**
@ -430,20 +425,21 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
*/ */
static int tpm2_do_selftest(struct tpm_chip *chip) static int tpm2_do_selftest(struct tpm_chip *chip)
{ {
struct tpm_buf buf;
int full; int full;
int rc; int rc;
for (full = 0; full < 2; full++) { for (full = 0; full < 2; full++) {
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SELF_TEST); struct tpm_buf *buf __free(kfree) = NULL;
if (rc)
return rc;
tpm_buf_append_u8(&buf, full); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
rc = tpm_transmit_cmd(chip, &buf, 0, if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SELF_TEST);
tpm_buf_append_u8(buf, full);
rc = tpm_transmit_cmd(chip, buf, 0,
"attempting the self test"); "attempting the self test");
tpm_buf_destroy(&buf);
if (rc == TPM2_RC_TESTING) if (rc == TPM2_RC_TESTING)
rc = TPM2_RC_SUCCESS; rc = TPM2_RC_SUCCESS;
if (rc == TPM2_RC_INITIALIZE || rc == TPM2_RC_SUCCESS) if (rc == TPM2_RC_INITIALIZE || rc == TPM2_RC_SUCCESS)
@ -468,23 +464,24 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
int tpm2_probe(struct tpm_chip *chip) int tpm2_probe(struct tpm_chip *chip)
{ {
struct tpm_header *out; struct tpm_header *out;
struct tpm_buf buf;
int rc; int rc;
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
tpm_buf_append_u32(&buf, TPM2_CAP_TPM_PROPERTIES);
tpm_buf_append_u32(&buf, TPM_PT_TOTAL_COMMANDS); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_append_u32(&buf, 1); tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
rc = tpm_transmit_cmd(chip, &buf, 0, NULL); tpm_buf_append_u32(buf, TPM2_CAP_TPM_PROPERTIES);
tpm_buf_append_u32(buf, TPM_PT_TOTAL_COMMANDS);
tpm_buf_append_u32(buf, 1);
rc = tpm_transmit_cmd(chip, buf, 0, NULL);
/* We ignore TPM return codes on purpose. */ /* We ignore TPM return codes on purpose. */
if (rc >= 0) { if (rc >= 0) {
out = (struct tpm_header *)buf.data; out = (struct tpm_header *)buf->data;
if (be16_to_cpu(out->tag) == TPM2_ST_NO_SESSIONS) if (be16_to_cpu(out->tag) == TPM2_ST_NO_SESSIONS)
chip->flags |= TPM_CHIP_FLAG_TPM2; chip->flags |= TPM_CHIP_FLAG_TPM2;
} }
tpm_buf_destroy(&buf);
return 0; return 0;
} }
EXPORT_SYMBOL_GPL(tpm2_probe); EXPORT_SYMBOL_GPL(tpm2_probe);
@ -518,7 +515,6 @@ static int tpm2_init_bank_info(struct tpm_chip *chip, u32 bank_index)
ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip) ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
{ {
struct tpm2_pcr_selection pcr_selection; struct tpm2_pcr_selection pcr_selection;
struct tpm_buf buf;
void *marker; void *marker;
void *end; void *end;
void *pcr_select_offset; void *pcr_select_offset;
@ -530,31 +526,32 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
int rc; int rc;
int i = 0; int i = 0;
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
tpm_buf_append_u32(buf, TPM2_CAP_PCRS);
tpm_buf_append_u32(buf, 0);
tpm_buf_append_u32(buf, 1);
rc = tpm_transmit_cmd(chip, buf, 9, "get tpm pcr allocation");
if (rc) if (rc)
return rc; return rc;
tpm_buf_append_u32(&buf, TPM2_CAP_PCRS);
tpm_buf_append_u32(&buf, 0);
tpm_buf_append_u32(&buf, 1);
rc = tpm_transmit_cmd(chip, &buf, 9, "get tpm pcr allocation");
if (rc)
goto out;
nr_possible_banks = be32_to_cpup( nr_possible_banks = be32_to_cpup(
(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]); (__be32 *)&buf->data[TPM_HEADER_SIZE + 5]);
if (nr_possible_banks > TPM2_MAX_PCR_BANKS) { if (nr_possible_banks > TPM2_MAX_PCR_BANKS) {
pr_err("tpm: out of bank capacity: %u > %u\n", pr_err("tpm: out of bank capacity: %u > %u\n",
nr_possible_banks, TPM2_MAX_PCR_BANKS); nr_possible_banks, TPM2_MAX_PCR_BANKS);
rc = -ENOMEM; return -ENOMEM;
goto out;
} }
marker = &buf.data[TPM_HEADER_SIZE + 9]; marker = &buf->data[TPM_HEADER_SIZE + 9];
rsp_len = be32_to_cpup((__be32 *)&buf.data[2]); rsp_len = be32_to_cpup((__be32 *)&buf->data[2]);
end = &buf.data[rsp_len]; end = &buf->data[rsp_len];
for (i = 0; i < nr_possible_banks; i++) { for (i = 0; i < nr_possible_banks; i++) {
pcr_select_offset = marker + pcr_select_offset = marker +
@ -586,21 +583,20 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
} }
chip->nr_allocated_banks = nr_alloc_banks; chip->nr_allocated_banks = nr_alloc_banks;
out:
tpm_buf_destroy(&buf);
return rc; return rc;
} }
int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
{ {
struct tpm_buf buf;
u32 nr_commands; u32 nr_commands;
__be32 *attrs; __be32 *attrs;
u32 cc; u32 cc;
int i; int i;
int rc; int rc;
struct tpm_buf *buf __free(kfree) = NULL;
rc = tpm2_get_tpm_pt(chip, TPM_PT_TOTAL_COMMANDS, &nr_commands, NULL); rc = tpm2_get_tpm_pt(chip, TPM_PT_TOTAL_COMMANDS, &nr_commands, NULL);
if (rc) if (rc)
goto out; goto out;
@ -617,30 +613,31 @@ int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
goto out; goto out;
} }
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf) {
goto out; rc = -ENOMEM;
tpm_buf_append_u32(&buf, TPM2_CAP_COMMANDS);
tpm_buf_append_u32(&buf, TPM2_CC_FIRST);
tpm_buf_append_u32(&buf, nr_commands);
rc = tpm_transmit_cmd(chip, &buf, 9 + 4 * nr_commands, NULL);
if (rc) {
tpm_buf_destroy(&buf);
goto out; goto out;
} }
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
tpm_buf_append_u32(buf, TPM2_CAP_COMMANDS);
tpm_buf_append_u32(buf, TPM2_CC_FIRST);
tpm_buf_append_u32(buf, nr_commands);
rc = tpm_transmit_cmd(chip, buf, 9 + 4 * nr_commands, NULL);
if (rc)
goto out;
if (nr_commands != if (nr_commands !=
be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) { be32_to_cpup((__be32 *)&buf->data[TPM_HEADER_SIZE + 5])) {
rc = -EFAULT; rc = -EFAULT;
tpm_buf_destroy(&buf);
goto out; goto out;
} }
chip->nr_commands = nr_commands; chip->nr_commands = nr_commands;
attrs = (__be32 *)&buf.data[TPM_HEADER_SIZE + 9]; attrs = (__be32 *)&buf->data[TPM_HEADER_SIZE + 9];
for (i = 0; i < nr_commands; i++, attrs++) { for (i = 0; i < nr_commands; i++, attrs++) {
chip->cc_attrs_tbl[i] = be32_to_cpup(attrs); chip->cc_attrs_tbl[i] = be32_to_cpup(attrs);
cc = chip->cc_attrs_tbl[i] & 0xFFFF; cc = chip->cc_attrs_tbl[i] & 0xFFFF;
@ -652,8 +649,6 @@ int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
} }
} }
tpm_buf_destroy(&buf);
out: out:
if (rc > 0) if (rc > 0)
rc = -ENODEV; rc = -ENODEV;
@ -674,20 +669,18 @@ EXPORT_SYMBOL_GPL(tpm2_get_cc_attrs_tbl);
static int tpm2_startup(struct tpm_chip *chip) static int tpm2_startup(struct tpm_chip *chip)
{ {
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = NULL;
int rc;
dev_info(&chip->dev, "starting up the TPM manually\n"); dev_info(&chip->dev, "starting up the TPM manually\n");
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_STARTUP); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc < 0) if (!buf)
return rc; return -ENOMEM;
tpm_buf_append_u16(&buf, TPM2_SU_CLEAR); tpm_buf_init(buf, TPM_BUFSIZE);
rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to start the TPM"); tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_STARTUP);
tpm_buf_destroy(&buf); tpm_buf_append_u16(buf, TPM2_SU_CLEAR);
return tpm_transmit_cmd(chip, buf, 0, "attempting to start the TPM");
return rc;
} }
/** /**

164
drivers/char/tpm/tpm2-sessions.c
View File

@ -167,8 +167,8 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name)
{ {
u32 mso = tpm2_handle_mso(handle); u32 mso = tpm2_handle_mso(handle);
off_t offset = TPM_HEADER_SIZE; off_t offset = TPM_HEADER_SIZE;
struct tpm_buf *buf __free(kfree) = NULL;
int rc, name_size_alg; int rc, name_size_alg;
struct tpm_buf buf;
if (mso != TPM2_MSO_PERSISTENT && mso != TPM2_MSO_VOLATILE && if (mso != TPM2_MSO_PERSISTENT && mso != TPM2_MSO_VOLATILE &&
mso != TPM2_MSO_NVRAM) { mso != TPM2_MSO_NVRAM) {
@ -176,50 +176,40 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name)
return sizeof(u32); return sizeof(u32);
} }
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC);
tpm_buf_append_u32(buf, handle);
rc = tpm_transmit_cmd(chip, buf, 0, "TPM2_ReadPublic");
if (rc) if (rc)
return rc;
tpm_buf_append_u32(&buf, handle);
rc = tpm_transmit_cmd(chip, &buf, 0, "TPM2_ReadPublic");
if (rc) {
tpm_buf_destroy(&buf);
return tpm_ret_to_err(rc); return tpm_ret_to_err(rc);
}
/* Skip TPMT_PUBLIC: */ /* Skip TPMT_PUBLIC: */
offset += tpm_buf_read_u16(&buf, &offset); offset += tpm_buf_read_u16(buf, &offset);
/* /*
* Ensure space for the length field of TPM2B_NAME and hashAlg field of * Ensure space for the length field of TPM2B_NAME and hashAlg field of
* TPMT_HA (the extra four bytes). * TPMT_HA (the extra four bytes).
*/ */
if (offset + 4 > tpm_buf_length(&buf)) { if (offset + 4 > tpm_buf_length(buf))
tpm_buf_destroy(&buf);
return -EIO; return -EIO;
}
rc = tpm_buf_read_u16(&buf, &offset); rc = tpm_buf_read_u16(buf, &offset);
name_size_alg = name_size(&buf.data[offset]); name_size_alg = name_size(&buf->data[offset]);
if (name_size_alg < 0)
if (name_size_alg < 0) {
tpm_buf_destroy(&buf);
return name_size_alg; return name_size_alg;
}
if (rc != name_size_alg) { if (rc != name_size_alg)
tpm_buf_destroy(&buf);
return -EIO; return -EIO;
}
if (offset + rc > tpm_buf_length(&buf)) { if (offset + rc > tpm_buf_length(buf))
tpm_buf_destroy(&buf);
return -EIO; return -EIO;
}
memcpy(name, &buf.data[offset], rc); memcpy(name, &buf->data[offset], rc);
tpm_buf_destroy(&buf);
return name_size_alg; return name_size_alg;
} }
#endif /* CONFIG_TCG_TPM2_HMAC */ #endif /* CONFIG_TCG_TPM2_HMAC */
@ -1005,8 +995,8 @@ static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)
*/ */
int tpm2_start_auth_session(struct tpm_chip *chip) int tpm2_start_auth_session(struct tpm_chip *chip)
{ {
struct tpm_buf *buf __free(kfree) = NULL;
struct tpm2_auth *auth; struct tpm2_auth *auth;
struct tpm_buf buf;
u32 null_key; u32 null_key;
int rc; int rc;
@ -1020,58 +1010,61 @@ int tpm2_start_auth_session(struct tpm_chip *chip)
return -ENOMEM; return -ENOMEM;
rc = tpm2_load_null(chip, &null_key); rc = tpm2_load_null(chip, &null_key);
if (rc) if (rc) {
goto out; kfree_sensitive(auth);
return rc;
}
auth->session = TPM_HEADER_SIZE; auth->session = TPM_HEADER_SIZE;
rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_START_AUTH_SESS); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf) {
goto out; kfree_sensitive(auth);
return -ENOMEM;
}
tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_NO_SESSIONS, TPM2_CC_START_AUTH_SESS);
/* salt key handle */ /* salt key handle */
tpm_buf_append_u32(&buf, null_key); tpm_buf_append_u32(buf, null_key);
/* bind key handle */ /* bind key handle */
tpm_buf_append_u32(&buf, TPM2_RH_NULL); tpm_buf_append_u32(buf, TPM2_RH_NULL);
/* nonce caller */ /* nonce caller */
get_random_bytes(auth->our_nonce, sizeof(auth->our_nonce)); get_random_bytes(auth->our_nonce, sizeof(auth->our_nonce));
tpm_buf_append_u16(&buf, sizeof(auth->our_nonce)); tpm_buf_append_u16(buf, sizeof(auth->our_nonce));
tpm_buf_append(&buf, auth->our_nonce, sizeof(auth->our_nonce)); tpm_buf_append(buf, auth->our_nonce, sizeof(auth->our_nonce));
/* append encrypted salt and squirrel away unencrypted in auth */ /* append encrypted salt and squirrel away unencrypted in auth */
rc = tpm_buf_append_salt(&buf, chip, auth); rc = tpm_buf_append_salt(buf, chip, auth);
if (rc) { if (rc) {
tpm2_flush_context(chip, null_key); tpm2_flush_context(chip, null_key);
tpm_buf_destroy(&buf); kfree_sensitive(auth);
goto out; return rc;
} }
/* session type (HMAC, audit or policy) */ /* session type (HMAC, audit or policy) */
tpm_buf_append_u8(&buf, TPM2_SE_HMAC); tpm_buf_append_u8(buf, TPM2_SE_HMAC);
/* symmetric encryption parameters */ /* symmetric encryption parameters */
/* symmetric algorithm */ /* symmetric algorithm */
tpm_buf_append_u16(&buf, TPM_ALG_AES); tpm_buf_append_u16(buf, TPM_ALG_AES);
/* bits for symmetric algorithm */ /* bits for symmetric algorithm */
tpm_buf_append_u16(&buf, AES_KEY_BITS); tpm_buf_append_u16(buf, AES_KEY_BITS);
/* symmetric algorithm mode (must be CFB) */ /* symmetric algorithm mode (must be CFB) */
tpm_buf_append_u16(&buf, TPM_ALG_CFB); tpm_buf_append_u16(buf, TPM_ALG_CFB);
/* hash algorithm for session */ /* hash algorithm for session */
tpm_buf_append_u16(&buf, TPM_ALG_SHA256); tpm_buf_append_u16(buf, TPM_ALG_SHA256);
rc = tpm_ret_to_err(tpm_transmit_cmd(chip, &buf, 0, "StartAuthSession")); rc = tpm_ret_to_err(tpm_transmit_cmd(chip, buf, 0, "StartAuthSession"));
tpm2_flush_context(chip, null_key); tpm2_flush_context(chip, null_key);
if (rc == TPM2_RC_SUCCESS) if (rc == TPM2_RC_SUCCESS)
rc = tpm2_parse_start_auth_session(auth, &buf); rc = tpm2_parse_start_auth_session(auth, buf);
tpm_buf_destroy(&buf);
if (rc == TPM2_RC_SUCCESS) { if (rc == TPM2_RC_SUCCESS) {
chip->auth = auth; chip->auth = auth;
return 0; return 0;
} }
out:
kfree_sensitive(auth); kfree_sensitive(auth);
return rc; return rc;
} }
@ -1285,19 +1278,21 @@ static int tpm2_parse_create_primary(struct tpm_chip *chip, struct tpm_buf *buf,
static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy, static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy,
u32 *handle, u8 *name) u32 *handle, u8 *name)
{ {
struct tpm_buf *template __free(kfree) = NULL;
struct tpm_buf *buf __free(kfree) = NULL;
int rc; int rc;
struct tpm_buf buf;
struct tpm_buf template;
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE_PRIMARY); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!buf)
return rc; return -ENOMEM;
rc = tpm_buf_init_sized(&template); template = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) { if (!template)
tpm_buf_destroy(&buf); return -ENOMEM;
return rc;
} tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE_PRIMARY);
tpm_buf_init_sized(template, TPM_BUFSIZE);
/* /*
* create the template. Note: in order for userspace to * create the template. Note: in order for userspace to
@ -1309,75 +1304,72 @@ static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy,
*/ */
/* key type */ /* key type */
tpm_buf_append_u16(&template, TPM_ALG_ECC); tpm_buf_append_u16(template, TPM_ALG_ECC);
/* name algorithm */ /* name algorithm */
tpm_buf_append_u16(&template, TPM_ALG_SHA256); tpm_buf_append_u16(template, TPM_ALG_SHA256);
/* object properties */ /* object properties */
tpm_buf_append_u32(&template, TPM2_OA_NULL_KEY); tpm_buf_append_u32(template, TPM2_OA_NULL_KEY);
/* sauth policy (empty) */ /* sauth policy (empty) */
tpm_buf_append_u16(&template, 0); tpm_buf_append_u16(template, 0);
/* BEGIN parameters: key specific; for ECC*/ /* BEGIN parameters: key specific; for ECC*/
/* symmetric algorithm */ /* symmetric algorithm */
tpm_buf_append_u16(&template, TPM_ALG_AES); tpm_buf_append_u16(template, TPM_ALG_AES);
/* bits for symmetric algorithm */ /* bits for symmetric algorithm */
tpm_buf_append_u16(&template, AES_KEY_BITS); tpm_buf_append_u16(template, AES_KEY_BITS);
/* algorithm mode (must be CFB) */ /* algorithm mode (must be CFB) */
tpm_buf_append_u16(&template, TPM_ALG_CFB); tpm_buf_append_u16(template, TPM_ALG_CFB);
/* scheme (NULL means any scheme) */ /* scheme (NULL means any scheme) */
tpm_buf_append_u16(&template, TPM_ALG_NULL); tpm_buf_append_u16(template, TPM_ALG_NULL);
/* ECC Curve ID */ /* ECC Curve ID */
tpm_buf_append_u16(&template, TPM2_ECC_NIST_P256); tpm_buf_append_u16(template, TPM2_ECC_NIST_P256);
/* KDF Scheme */ /* KDF Scheme */
tpm_buf_append_u16(&template, TPM_ALG_NULL); tpm_buf_append_u16(template, TPM_ALG_NULL);
/* unique: key specific; for ECC it is two zero size points */ /* unique: key specific; for ECC it is two zero size points */
tpm_buf_append_u16(&template, 0); tpm_buf_append_u16(template, 0);
tpm_buf_append_u16(&template, 0); tpm_buf_append_u16(template, 0);
/* END parameters */ /* END parameters */
/* primary handle */ /* primary handle */
tpm_buf_append_u32(&buf, hierarchy); tpm_buf_append_u32(buf, hierarchy);
tpm_buf_append_empty_auth(&buf, TPM2_RS_PW); tpm_buf_append_empty_auth(buf, TPM2_RS_PW);
/* sensitive create size is 4 for two empty buffers */ /* sensitive create size is 4 for two empty buffers */
tpm_buf_append_u16(&buf, 4); tpm_buf_append_u16(buf, 4);
/* sensitive create auth data (empty) */ /* sensitive create auth data (empty) */
tpm_buf_append_u16(&buf, 0); tpm_buf_append_u16(buf, 0);
/* sensitive create sensitive data (empty) */ /* sensitive create sensitive data (empty) */
tpm_buf_append_u16(&buf, 0); tpm_buf_append_u16(buf, 0);
/* the public template */ /* the public template */
tpm_buf_append(&buf, template.data, template.length); tpm_buf_append(buf, template->data, template->length);
tpm_buf_destroy(&template);
/* outside info (empty) */ /* outside info (empty) */
tpm_buf_append_u16(&buf, 0); tpm_buf_append_u16(buf, 0);
/* creation PCR (none) */ /* creation PCR (none) */
tpm_buf_append_u32(&buf, 0); tpm_buf_append_u32(buf, 0);
rc = tpm_transmit_cmd(chip, &buf, 0, rc = tpm_transmit_cmd(chip, buf, 0,
"attempting to create NULL primary"); "attempting to create NULL primary");
if (rc == TPM2_RC_SUCCESS) if (rc == TPM2_RC_SUCCESS)
rc = tpm2_parse_create_primary(chip, &buf, handle, hierarchy, rc = tpm2_parse_create_primary(chip, buf, handle, hierarchy,
name); name);
tpm_buf_destroy(&buf);
return rc; return rc;
} }

44
drivers/char/tpm/tpm2-space.c
View File

@ -58,24 +58,25 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
int tpm2_load_context(struct tpm_chip *chip, u8 *buf, int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
unsigned int *offset, u32 *handle) unsigned int *offset, u32 *handle)
{ {
struct tpm_buf tbuf;
struct tpm2_context *ctx; struct tpm2_context *ctx;
unsigned int body_size; unsigned int body_size;
int rc; int rc;
rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD); struct tpm_buf *tbuf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!tbuf)
return rc; return -ENOMEM;
tpm_buf_init(tbuf, TPM_BUFSIZE);
tpm_buf_reset(tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD);
ctx = (struct tpm2_context *)&buf[*offset]; ctx = (struct tpm2_context *)&buf[*offset];
body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size); body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size);
tpm_buf_append(&tbuf, &buf[*offset], body_size); tpm_buf_append(tbuf, &buf[*offset], body_size);
rc = tpm_transmit_cmd(chip, &tbuf, 4, NULL); rc = tpm_transmit_cmd(chip, tbuf, 4, NULL);
if (rc < 0) { if (rc < 0) {
dev_warn(&chip->dev, "%s: failed with a system error %d\n", dev_warn(&chip->dev, "%s: failed with a system error %d\n",
__func__, rc); __func__, rc);
tpm_buf_destroy(&tbuf);
return -EFAULT; return -EFAULT;
} else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE || } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE ||
rc == TPM2_RC_REFERENCE_H0) { rc == TPM2_RC_REFERENCE_H0) {
@ -90,64 +91,55 @@ int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
* flushed outside the space * flushed outside the space
*/ */
*handle = 0; *handle = 0;
tpm_buf_destroy(&tbuf);
return -ENOENT; return -ENOENT;
} else if (tpm2_rc_value(rc) == TPM2_RC_INTEGRITY) { } else if (tpm2_rc_value(rc) == TPM2_RC_INTEGRITY) {
tpm_buf_destroy(&tbuf);
return -EINVAL; return -EINVAL;
} else if (rc > 0) { } else if (rc > 0) {
dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
__func__, rc); __func__, rc);
tpm_buf_destroy(&tbuf);
return -EFAULT; return -EFAULT;
} }
*handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]); *handle = be32_to_cpup((__be32 *)&tbuf->data[TPM_HEADER_SIZE]);
*offset += body_size; *offset += body_size;
tpm_buf_destroy(&tbuf);
return 0; return 0;
} }
int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf,
unsigned int buf_size, unsigned int *offset) unsigned int buf_size, unsigned int *offset)
{ {
struct tpm_buf tbuf;
unsigned int body_size; unsigned int body_size;
int rc; int rc;
rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE); struct tpm_buf *tbuf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) if (!tbuf)
return rc; return -ENOMEM;
tpm_buf_append_u32(&tbuf, handle); tpm_buf_init(tbuf, TPM_BUFSIZE);
tpm_buf_reset(tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_SAVE);
tpm_buf_append_u32(tbuf, handle);
rc = tpm_transmit_cmd(chip, &tbuf, 0, NULL); rc = tpm_transmit_cmd(chip, tbuf, 0, NULL);
if (rc < 0) { if (rc < 0) {
dev_warn(&chip->dev, "%s: failed with a system error %d\n", dev_warn(&chip->dev, "%s: failed with a system error %d\n",
__func__, rc); __func__, rc);
tpm_buf_destroy(&tbuf);
return -EFAULT; return -EFAULT;
} else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) { } else if (tpm2_rc_value(rc) == TPM2_RC_REFERENCE_H0) {
tpm_buf_destroy(&tbuf);
return -ENOENT; return -ENOENT;
} else if (rc) { } else if (rc) {
dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n",
__func__, rc); __func__, rc);
tpm_buf_destroy(&tbuf);
return -EFAULT; return -EFAULT;
} }
body_size = tpm_buf_length(&tbuf) - TPM_HEADER_SIZE; body_size = tpm_buf_length(tbuf) - TPM_HEADER_SIZE;
if ((*offset + body_size) > buf_size) { if ((*offset + body_size) > buf_size) {
dev_warn(&chip->dev, "%s: out of backing storage\n", __func__); dev_warn(&chip->dev, "%s: out of backing storage\n", __func__);
tpm_buf_destroy(&tbuf);
return -ENOMEM; return -ENOMEM;
} }
memcpy(&buf[*offset], &tbuf.data[TPM_HEADER_SIZE], body_size); memcpy(&buf[*offset], &tbuf->data[TPM_HEADER_SIZE], body_size);
*offset += body_size; *offset += body_size;
tpm_buf_destroy(&tbuf);
return 0; return 0;
} }

30
drivers/char/tpm/tpm_vtpm_proxy.c
View File

@ -395,40 +395,36 @@ static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status)
static int vtpm_proxy_request_locality(struct tpm_chip *chip, int locality) static int vtpm_proxy_request_locality(struct tpm_chip *chip, int locality)
{ {
struct tpm_buf buf;
int rc; int rc;
const struct tpm_header *header; const struct tpm_header *header;
struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!buf)
return -ENOMEM;
tpm_buf_init(buf, TPM_BUFSIZE);
if (chip->flags & TPM_CHIP_FLAG_TPM2) if (chip->flags & TPM_CHIP_FLAG_TPM2)
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_SET_LOCALITY);
TPM2_CC_SET_LOCALITY);
else else
rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SET_LOCALITY);
TPM_ORD_SET_LOCALITY);
if (rc) tpm_buf_append_u8(buf, locality);
return rc;
tpm_buf_append_u8(&buf, locality);
proxy_dev->state |= STATE_DRIVER_COMMAND; proxy_dev->state |= STATE_DRIVER_COMMAND;
rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to set locality"); rc = tpm_transmit_cmd(chip, buf, 0, "attempting to set locality");
proxy_dev->state &= ~STATE_DRIVER_COMMAND; proxy_dev->state &= ~STATE_DRIVER_COMMAND;
if (rc < 0) { if (rc < 0)
locality = rc; return rc;
goto out;
}
header = (const struct tpm_header *)buf.data; header = (const struct tpm_header *)buf->data;
rc = be32_to_cpu(header->return_code); rc = be32_to_cpu(header->return_code);
if (rc) if (rc)
locality = -1; locality = -1;
out:
tpm_buf_destroy(&buf);
return locality; return locality;
} }

17
include/linux/tpm.h
View File

@ -208,13 +208,15 @@ enum tpm_buf_flags {
}; };
/* /*
* A string buffer type for constructing TPM commands. * A buffer for constructing and parsing TPM commands, responses and sized
* (TPM2B) buffers.
*/ */
struct tpm_buf { struct tpm_buf {
u32 flags; u8 flags;
u32 length; u16 length;
u8 *data; u16 capacity;
u8 handles; u8 handles;
u8 data[];
}; };
struct tpm2_hash { struct tpm2_hash {
@ -222,12 +224,11 @@ struct tpm2_hash {
unsigned int tpm_id; unsigned int tpm_id;
}; };
int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal); void tpm_buf_init(struct tpm_buf *buf, u16 buf_size);
void tpm_buf_init_sized(struct tpm_buf *buf, u16 buf_size);
void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal); void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal);
int tpm_buf_init_sized(struct tpm_buf *buf);
void tpm_buf_reset_sized(struct tpm_buf *buf); void tpm_buf_reset_sized(struct tpm_buf *buf);
void tpm_buf_destroy(struct tpm_buf *buf); u16 tpm_buf_length(struct tpm_buf *buf);
u32 tpm_buf_length(struct tpm_buf *buf);
void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length); void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length);
void tpm_buf_append_u8(struct tpm_buf *buf, const u8 value); void tpm_buf_append_u8(struct tpm_buf *buf, const u8 value);
void tpm_buf_append_u16(struct tpm_buf *buf, const u16 value); void tpm_buf_append_u16(struct tpm_buf *buf, const u16 value);

44
security/keys/trusted-keys/trusted_tpm1.c
View File

@ -316,9 +316,8 @@ static int TSS_checkhmac2(unsigned char *buffer,
* For key specific tpm requests, we will generate and send our * For key specific tpm requests, we will generate and send our
* own TPM command packets using the drivers send function. * own TPM command packets using the drivers send function.
*/ */
static int trusted_tpm_send(unsigned char *cmd, size_t buflen) static int trusted_tpm_send(struct tpm_buf *buf)
{ {
struct tpm_buf buf;
int rc; int rc;
if (!chip) if (!chip)
@ -328,12 +327,9 @@ static int trusted_tpm_send(unsigned char *cmd, size_t buflen)
if (rc) if (rc)
return rc; return rc;
buf.flags = 0; dump_tpm_buf(buf->data);
buf.length = buflen; rc = tpm_transmit_cmd(chip, buf, 4, "sending data");
buf.data = cmd; dump_tpm_buf(buf->data);
dump_tpm_buf(cmd);
rc = tpm_transmit_cmd(chip, &buf, 4, "sending data");
dump_tpm_buf(cmd);
if (rc > 0) if (rc > 0)
/* TPM error */ /* TPM error */
@ -379,7 +375,7 @@ static int osap(struct tpm_buf *tb, struct osapsess *s,
tpm_buf_append_u32(tb, handle); tpm_buf_append_u32(tb, handle);
tpm_buf_append(tb, ononce, TPM_NONCE_SIZE); tpm_buf_append(tb, ononce, TPM_NONCE_SIZE);
ret = trusted_tpm_send(tb->data, tb->length); ret = trusted_tpm_send(tb);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -403,7 +399,7 @@ static int oiap(struct tpm_buf *tb, uint32_t *handle, unsigned char *nonce)
return -ENODEV; return -ENODEV;
tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_OIAP); tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_OIAP);
ret = trusted_tpm_send(tb->data, tb->length); ret = trusted_tpm_send(tb);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -512,7 +508,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
tpm_buf_append_u8(tb, cont); tpm_buf_append_u8(tb, cont);
tpm_buf_append(tb, td->pubauth, SHA1_DIGEST_SIZE); tpm_buf_append(tb, td->pubauth, SHA1_DIGEST_SIZE);
ret = trusted_tpm_send(tb->data, tb->length); ret = trusted_tpm_send(tb);
if (ret < 0) if (ret < 0)
goto out; goto out;
@ -603,7 +599,7 @@ static int tpm_unseal(struct tpm_buf *tb,
tpm_buf_append_u8(tb, cont); tpm_buf_append_u8(tb, cont);
tpm_buf_append(tb, authdata2, SHA1_DIGEST_SIZE); tpm_buf_append(tb, authdata2, SHA1_DIGEST_SIZE);
ret = trusted_tpm_send(tb->data, tb->length); ret = trusted_tpm_send(tb);
if (ret < 0) { if (ret < 0) {
pr_info("authhmac failed (%d)\n", ret); pr_info("authhmac failed (%d)\n", ret);
return ret; return ret;
@ -630,23 +626,23 @@ static int tpm_unseal(struct tpm_buf *tb,
static int key_seal(struct trusted_key_payload *p, static int key_seal(struct trusted_key_payload *p,
struct trusted_key_options *o) struct trusted_key_options *o)
{ {
struct tpm_buf tb;
int ret; int ret;
ret = tpm_buf_init(&tb, 0, 0); struct tpm_buf *tb __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (ret) if (!tb)
return ret; return -ENOMEM;
tpm_buf_init(tb, TPM_BUFSIZE);
/* include migratable flag at end of sealed key */ /* include migratable flag at end of sealed key */
p->key[p->key_len] = p->migratable; p->key[p->key_len] = p->migratable;
ret = tpm_seal(&tb, o->keytype, o->keyhandle, o->keyauth, ret = tpm_seal(tb, o->keytype, o->keyhandle, o->keyauth,
p->key, p->key_len + 1, p->blob, &p->blob_len, p->key, p->key_len + 1, p->blob, &p->blob_len,
o->blobauth, o->pcrinfo, o->pcrinfo_len); o->blobauth, o->pcrinfo, o->pcrinfo_len);
if (ret < 0) if (ret < 0)
pr_info("srkseal failed (%d)\n", ret); pr_info("srkseal failed (%d)\n", ret);
tpm_buf_destroy(&tb);
return ret; return ret;
} }
@ -656,14 +652,15 @@ static int key_seal(struct trusted_key_payload *p,
static int key_unseal(struct trusted_key_payload *p, static int key_unseal(struct trusted_key_payload *p,
struct trusted_key_options *o) struct trusted_key_options *o)
{ {
struct tpm_buf tb;
int ret; int ret;
ret = tpm_buf_init(&tb, 0, 0); struct tpm_buf *tb __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (ret) if (!tb)
return ret; return -ENOMEM;
ret = tpm_unseal(&tb, o->keyhandle, o->keyauth, p->blob, p->blob_len, tpm_buf_init(tb, TPM_BUFSIZE);
ret = tpm_unseal(tb, o->keyhandle, o->keyauth, p->blob, p->blob_len,
o->blobauth, p->key, &p->key_len); o->blobauth, p->key, &p->key_len);
if (ret < 0) if (ret < 0)
pr_info("srkunseal failed (%d)\n", ret); pr_info("srkunseal failed (%d)\n", ret);
@ -671,7 +668,6 @@ static int key_unseal(struct trusted_key_payload *p,
/* pull migratable flag out of sealed key */ /* pull migratable flag out of sealed key */
p->migratable = p->key[--p->key_len]; p->migratable = p->key[--p->key_len];
tpm_buf_destroy(&tb);
return ret; return ret;
} }

167
security/keys/trusted-keys/trusted_tpm2.c
View File

@ -233,7 +233,8 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
struct trusted_key_options *options) struct trusted_key_options *options)
{ {
off_t offset = TPM_HEADER_SIZE; off_t offset = TPM_HEADER_SIZE;
struct tpm_buf buf, sized; struct tpm_buf *buf __free(kfree) = NULL;
struct tpm_buf *sized __free(kfree) = NULL;
int blob_len = 0; int blob_len = 0;
int hash; int hash;
u32 flags; u32 flags;
@ -254,97 +255,100 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
if (rc) if (rc)
goto out_put; goto out_put;
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) { if (!buf) {
rc = -ENOMEM;
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
goto out_put; goto out_put;
} }
rc = tpm_buf_init_sized(&sized); tpm_buf_init(buf, TPM_BUFSIZE);
if (rc) { tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE);
tpm_buf_destroy(&buf);
sized = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (!sized) {
rc = -ENOMEM;
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
goto out_put; goto out_put;
} }
rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); tpm_buf_init_sized(sized, TPM_BUFSIZE);
rc = tpm_buf_append_name(chip, buf, options->keyhandle, NULL);
if (rc) if (rc)
goto out; goto out;
tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_DECRYPT, tpm_buf_append_hmac_session(chip, buf, TPM2_SA_DECRYPT,
options->keyauth, TPM_DIGEST_SIZE); options->keyauth, TPM_DIGEST_SIZE);
/* sensitive */ /* sensitive */
tpm_buf_append_u16(&sized, options->blobauth_len); tpm_buf_append_u16(sized, options->blobauth_len);
if (options->blobauth_len) if (options->blobauth_len)
tpm_buf_append(&sized, options->blobauth, options->blobauth_len); tpm_buf_append(sized, options->blobauth, options->blobauth_len);
tpm_buf_append_u16(&sized, payload->key_len); tpm_buf_append_u16(sized, payload->key_len);
tpm_buf_append(&sized, payload->key, payload->key_len); tpm_buf_append(sized, payload->key, payload->key_len);
tpm_buf_append(&buf, sized.data, sized.length); tpm_buf_append(buf, sized->data, sized->length);
/* public */ /* public */
tpm_buf_reset_sized(&sized); tpm_buf_reset_sized(sized);
tpm_buf_append_u16(&sized, TPM_ALG_KEYEDHASH); tpm_buf_append_u16(sized, TPM_ALG_KEYEDHASH);
tpm_buf_append_u16(&sized, hash); tpm_buf_append_u16(sized, hash);
/* key properties */ /* key properties */
flags = 0; flags = 0;
flags |= options->policydigest_len ? 0 : TPM2_OA_USER_WITH_AUTH; flags |= options->policydigest_len ? 0 : TPM2_OA_USER_WITH_AUTH;
flags |= payload->migratable ? 0 : (TPM2_OA_FIXED_TPM | TPM2_OA_FIXED_PARENT); flags |= payload->migratable ? 0 : (TPM2_OA_FIXED_TPM | TPM2_OA_FIXED_PARENT);
tpm_buf_append_u32(&sized, flags); tpm_buf_append_u32(sized, flags);
/* policy */ /* policy */
tpm_buf_append_u16(&sized, options->policydigest_len); tpm_buf_append_u16(sized, options->policydigest_len);
if (options->policydigest_len) if (options->policydigest_len)
tpm_buf_append(&sized, options->policydigest, options->policydigest_len); tpm_buf_append(sized, options->policydigest, options->policydigest_len);
/* public parameters */ /* public parameters */
tpm_buf_append_u16(&sized, TPM_ALG_NULL); tpm_buf_append_u16(sized, TPM_ALG_NULL);
tpm_buf_append_u16(&sized, 0); tpm_buf_append_u16(sized, 0);
tpm_buf_append(&buf, sized.data, sized.length); tpm_buf_append(buf, sized->data, sized->length);
/* outside info */ /* outside info */
tpm_buf_append_u16(&buf, 0); tpm_buf_append_u16(buf, 0);
/* creation PCR */ /* creation PCR */
tpm_buf_append_u32(&buf, 0); tpm_buf_append_u32(buf, 0);
if (buf.flags & TPM_BUF_INVALID) { if (buf->flags & TPM_BUF_INVALID) {
rc = -E2BIG; rc = -E2BIG;
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
goto out; goto out;
} }
rc = tpm_buf_fill_hmac_session(chip, &buf); rc = tpm_buf_fill_hmac_session(chip, buf);
if (rc) if (rc)
goto out; goto out;
rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data"); rc = tpm_transmit_cmd(chip, buf, 4, "sealing data");
rc = tpm_buf_check_hmac_response(chip, &buf, rc); rc = tpm_buf_check_hmac_response(chip, buf, rc);
if (rc) if (rc)
goto out; goto out;
blob_len = tpm_buf_read_u32(&buf, &offset); blob_len = tpm_buf_read_u32(buf, &offset);
if (blob_len > MAX_BLOB_SIZE || buf.flags & TPM_BUF_INVALID) { if (blob_len > MAX_BLOB_SIZE || buf->flags & TPM_BUF_INVALID) {
rc = -E2BIG; rc = -E2BIG;
goto out; goto out;
} }
if (buf.length - offset < blob_len) { if (buf->length - offset < blob_len) {
rc = -EFAULT; rc = -EFAULT;
goto out; goto out;
} }
blob_len = tpm2_key_encode(payload, options, &buf.data[offset], blob_len); blob_len = tpm2_key_encode(payload, options, &buf->data[offset], blob_len);
if (blob_len < 0) if (blob_len < 0)
rc = blob_len; rc = blob_len;
out: out:
tpm_buf_destroy(&sized);
tpm_buf_destroy(&buf);
if (!rc) if (!rc)
payload->blob_len = blob_len; payload->blob_len = blob_len;
@ -372,7 +376,7 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
u32 *blob_handle) u32 *blob_handle)
{ {
u8 *blob_ref __free(kfree) = NULL; u8 *blob_ref __free(kfree) = NULL;
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = NULL;
unsigned int private_len; unsigned int private_len;
unsigned int public_len; unsigned int public_len;
unsigned int blob_len; unsigned int blob_len;
@ -426,39 +430,38 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
if (rc) if (rc)
return rc; return rc;
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) { if (!buf) {
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
return rc; return -ENOMEM;
} }
rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); tpm_buf_init(buf, TPM_BUFSIZE);
if (rc) tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD);
goto out;
tpm_buf_append_hmac_session(chip, &buf, 0, options->keyauth, rc = tpm_buf_append_name(chip, buf, options->keyhandle, NULL);
if (rc)
return rc;
tpm_buf_append_hmac_session(chip, buf, 0, options->keyauth,
TPM_DIGEST_SIZE); TPM_DIGEST_SIZE);
tpm_buf_append(&buf, blob, blob_len); tpm_buf_append(buf, blob, blob_len);
if (buf.flags & TPM_BUF_INVALID) { if (buf->flags & TPM_BUF_INVALID) {
rc = -E2BIG;
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
goto out; return -E2BIG;
} }
rc = tpm_buf_fill_hmac_session(chip, &buf); rc = tpm_buf_fill_hmac_session(chip, buf);
if (rc) if (rc)
goto out; return rc;
rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob"); rc = tpm_transmit_cmd(chip, buf, 4, "loading blob");
rc = tpm_buf_check_hmac_response(chip, &buf, rc); rc = tpm_buf_check_hmac_response(chip, buf, rc);
if (!rc) if (!rc)
*blob_handle = be32_to_cpup( *blob_handle = be32_to_cpup(
(__be32 *) &buf.data[TPM_HEADER_SIZE]); (__be32 *)&buf->data[TPM_HEADER_SIZE]);
out:
tpm_buf_destroy(&buf);
return tpm_ret_to_err(rc); return tpm_ret_to_err(rc);
} }
@ -481,7 +484,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
u32 blob_handle) u32 blob_handle)
{ {
struct tpm_header *head; struct tpm_header *head;
struct tpm_buf buf; struct tpm_buf *buf __free(kfree) = NULL;
u16 data_len; u16 data_len;
int offset; int offset;
u8 *data; u8 *data;
@ -491,18 +494,21 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
if (rc) if (rc)
return rc; return rc;
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL); buf = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (rc) { if (!buf) {
tpm2_end_auth_session(chip); tpm2_end_auth_session(chip);
return rc; return -ENOMEM;
} }
rc = tpm_buf_append_name(chip, &buf, blob_handle, NULL); tpm_buf_init(buf, TPM_BUFSIZE);
tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
rc = tpm_buf_append_name(chip, buf, blob_handle, NULL);
if (rc) if (rc)
goto out; return rc;
if (!options->policyhandle) { if (!options->policyhandle) {
tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_ENCRYPT, tpm_buf_append_hmac_session(chip, buf, TPM2_SA_ENCRYPT,
options->blobauth, options->blobauth,
options->blobauth_len); options->blobauth_len);
} else { } else {
@ -517,39 +523,36 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
* could repeat our actions with the exfiltrated * could repeat our actions with the exfiltrated
* password. * password.
*/ */
tpm2_buf_append_auth(&buf, options->policyhandle, tpm2_buf_append_auth(buf, options->policyhandle,
NULL /* nonce */, 0, 0, NULL /* nonce */, 0, 0,
options->blobauth, options->blobauth_len); options->blobauth, options->blobauth_len);
if (tpm2_chip_auth(chip)) { if (tpm2_chip_auth(chip)) {
tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_ENCRYPT, NULL, 0); tpm_buf_append_hmac_session(chip, buf, TPM2_SA_ENCRYPT,
NULL, 0);
} else { } else {
offset = buf.handles * 4 + TPM_HEADER_SIZE; offset = buf->handles * 4 + TPM_HEADER_SIZE;
head = (struct tpm_header *)buf.data; head = (struct tpm_header *)buf->data;
if (tpm_buf_length(&buf) == offset) if (tpm_buf_length(buf) == offset)
head->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS); head->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
} }
} }
rc = tpm_buf_fill_hmac_session(chip, &buf); rc = tpm_buf_fill_hmac_session(chip, buf);
if (rc) if (rc)
goto out; return rc;
rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); rc = tpm_transmit_cmd(chip, buf, 6, "unsealing");
rc = tpm_buf_check_hmac_response(chip, &buf, rc); rc = tpm_buf_check_hmac_response(chip, buf, rc);
if (!rc) { if (!rc) {
data_len = be16_to_cpup( data_len = be16_to_cpup(
(__be16 *) &buf.data[TPM_HEADER_SIZE + 4]); (__be16 *)&buf->data[TPM_HEADER_SIZE + 4]);
if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE) { if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE)
rc = -EFAULT; return -EFAULT;
goto out;
}
if (tpm_buf_length(&buf) < TPM_HEADER_SIZE + 6 + data_len) { if (tpm_buf_length(buf) < TPM_HEADER_SIZE + 6 + data_len)
rc = -EFAULT; return -EFAULT;
goto out; data = &buf->data[TPM_HEADER_SIZE + 6];
}
data = &buf.data[TPM_HEADER_SIZE + 6];
if (payload->old_format) { if (payload->old_format) {
/* migratable flag is at the end of the key */ /* migratable flag is at the end of the key */
@ -566,8 +569,6 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
} }
} }
out:
tpm_buf_destroy(&buf);
return tpm_ret_to_err(rc); return tpm_ret_to_err(rc);
} }