1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) Microsoft Corporation 4 * 5 * Implements a firmware TPM as described here: 6 * https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/ 7 * 8 * A reference implementation is available here: 9 * https://github.com/microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM 10 */ 11 12 #include <linux/acpi.h> 13 #include <linux/of.h> 14 #include <linux/platform_device.h> 15 #include <linux/tee_drv.h> 16 #include <linux/tpm.h> 17 #include <linux/uuid.h> 18 19 #include "tpm.h" 20 #include "tpm_ftpm_tee.h" 21 22 /* 23 * TA_FTPM_UUID: BC50D971-D4C9-42C4-82CB-343FB7F37896 24 * 25 * Randomly generated, and must correspond to the GUID on the TA side. 26 * Defined here in the reference implementation: 27 * https://github.com/microsoft/ms-tpm-20-ref/blob/master/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/include/fTPM.h#L42 28 */ 29 static const uuid_t ftpm_ta_uuid = 30 UUID_INIT(0xBC50D971, 0xD4C9, 0x42C4, 31 0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96); 32 33 /** 34 * ftpm_tee_tpm_op_recv() - retrieve fTPM response. 35 * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h. 36 * @buf: the buffer to store data. 37 * @count: the number of bytes to read. 38 * 39 * Return: 40 * In case of success the number of bytes received. 41 * On failure, -errno. 42 */ 43 static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) 44 { 45 struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent); 46 size_t len; 47 48 len = pvt_data->resp_len; 49 if (count < len) { 50 dev_err(&chip->dev, 51 "%s: Invalid size in recv: count=%zd, resp_len=%zd\n", 52 __func__, count, len); 53 return -EIO; 54 } 55 56 memcpy(buf, pvt_data->resp_buf, len); 57 pvt_data->resp_len = 0; 58 59 return len; 60 } 61 62 /** 63 * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory. 64 * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h 65 * @buf: the buffer to send. 66 * @len: the number of bytes to send. 67 * 68 * Return: 69 * In case of success, returns 0. 70 * On failure, -errno 71 */ 72 static int ftpm_tee_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t len) 73 { 74 struct ftpm_tee_private *pvt_data = dev_get_drvdata(chip->dev.parent); 75 size_t resp_len; 76 int rc; 77 u8 *temp_buf; 78 struct tpm_header *resp_header; 79 struct tee_ioctl_invoke_arg transceive_args; 80 struct tee_param command_params[4]; 81 struct tee_shm *shm = pvt_data->shm; 82 83 if (len > MAX_COMMAND_SIZE) { 84 dev_err(&chip->dev, 85 "%s: len=%zd exceeds MAX_COMMAND_SIZE supported by fTPM TA\n", 86 __func__, len); 87 return -EIO; 88 } 89 90 memset(&transceive_args, 0, sizeof(transceive_args)); 91 memset(command_params, 0, sizeof(command_params)); 92 pvt_data->resp_len = 0; 93 94 /* Invoke FTPM_OPTEE_TA_SUBMIT_COMMAND function of fTPM TA */ 95 transceive_args = (struct tee_ioctl_invoke_arg) { 96 .func = FTPM_OPTEE_TA_SUBMIT_COMMAND, 97 .session = pvt_data->session, 98 .num_params = 4, 99 }; 100 101 /* Fill FTPM_OPTEE_TA_SUBMIT_COMMAND parameters */ 102 command_params[0] = (struct tee_param) { 103 .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT, 104 .u.memref = { 105 .shm = shm, 106 .size = len, 107 .shm_offs = 0, 108 }, 109 }; 110 111 temp_buf = tee_shm_get_va(shm, 0); 112 if (IS_ERR(temp_buf)) { 113 dev_err(&chip->dev, "%s: tee_shm_get_va failed for transmit\n", 114 __func__); 115 return PTR_ERR(temp_buf); 116 } 117 memset(temp_buf, 0, (MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE)); 118 memcpy(temp_buf, buf, len); 119 120 command_params[1] = (struct tee_param) { 121 .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT, 122 .u.memref = { 123 .shm = shm, 124 .size = MAX_RESPONSE_SIZE, 125 .shm_offs = MAX_COMMAND_SIZE, 126 }, 127 }; 128 129 rc = tee_client_invoke_func(pvt_data->ctx, &transceive_args, 130 command_params); 131 if ((rc < 0) || (transceive_args.ret != 0)) { 132 dev_err(&chip->dev, "%s: SUBMIT_COMMAND invoke error: 0x%x\n", 133 __func__, transceive_args.ret); 134 return (rc < 0) ? rc : transceive_args.ret; 135 } 136 137 temp_buf = tee_shm_get_va(shm, command_params[1].u.memref.shm_offs); 138 if (IS_ERR(temp_buf)) { 139 dev_err(&chip->dev, "%s: tee_shm_get_va failed for receive\n", 140 __func__); 141 return PTR_ERR(temp_buf); 142 } 143 144 resp_header = (struct tpm_header *)temp_buf; 145 resp_len = be32_to_cpu(resp_header->length); 146 147 /* sanity check resp_len */ 148 if (resp_len < TPM_HEADER_SIZE) { 149 dev_err(&chip->dev, "%s: tpm response header too small\n", 150 __func__); 151 return -EIO; 152 } 153 if (resp_len > MAX_RESPONSE_SIZE) { 154 dev_err(&chip->dev, 155 "%s: resp_len=%zd exceeds MAX_RESPONSE_SIZE\n", 156 __func__, resp_len); 157 return -EIO; 158 } 159 160 /* sanity checks look good, cache the response */ 161 memcpy(pvt_data->resp_buf, temp_buf, resp_len); 162 pvt_data->resp_len = resp_len; 163 164 return 0; 165 } 166 167 static void ftpm_tee_tpm_op_cancel(struct tpm_chip *chip) 168 { 169 /* not supported */ 170 } 171 172 static u8 ftpm_tee_tpm_op_status(struct tpm_chip *chip) 173 { 174 return 0; 175 } 176 177 static bool ftpm_tee_tpm_req_canceled(struct tpm_chip *chip, u8 status) 178 { 179 return false; 180 } 181 182 static const struct tpm_class_ops ftpm_tee_tpm_ops = { 183 .flags = TPM_OPS_AUTO_STARTUP, 184 .recv = ftpm_tee_tpm_op_recv, 185 .send = ftpm_tee_tpm_op_send, 186 .cancel = ftpm_tee_tpm_op_cancel, 187 .status = ftpm_tee_tpm_op_status, 188 .req_complete_mask = 0, 189 .req_complete_val = 0, 190 .req_canceled = ftpm_tee_tpm_req_canceled, 191 }; 192 193 /* 194 * Check whether this driver supports the fTPM TA in the TEE instance 195 * represented by the params (ver/data) to this function. 196 */ 197 static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data) 198 { 199 /* 200 * Currently this driver only support GP Complaint OPTEE based fTPM TA 201 */ 202 if ((ver->impl_id == TEE_IMPL_ID_OPTEE) && 203 (ver->gen_caps & TEE_GEN_CAP_GP)) 204 return 1; 205 else 206 return 0; 207 } 208 209 /** 210 * ftpm_tee_probe() - initialize the fTPM 211 * @dev: the device description. 212 * 213 * Return: 214 * On success, 0. On failure, -errno. 215 */ 216 static int ftpm_tee_probe(struct device *dev) 217 { 218 int rc; 219 struct tpm_chip *chip; 220 struct ftpm_tee_private *pvt_data = NULL; 221 struct tee_ioctl_open_session_arg sess_arg; 222 223 pvt_data = devm_kzalloc(dev, sizeof(struct ftpm_tee_private), 224 GFP_KERNEL); 225 if (!pvt_data) 226 return -ENOMEM; 227 228 dev_set_drvdata(dev, pvt_data); 229 230 /* Open context with TEE driver */ 231 pvt_data->ctx = tee_client_open_context(NULL, ftpm_tee_match, NULL, 232 NULL); 233 if (IS_ERR(pvt_data->ctx)) { 234 if (PTR_ERR(pvt_data->ctx) == -ENOENT) 235 return -EPROBE_DEFER; 236 dev_err(dev, "%s: tee_client_open_context failed\n", __func__); 237 return PTR_ERR(pvt_data->ctx); 238 } 239 240 /* Open a session with fTPM TA */ 241 memset(&sess_arg, 0, sizeof(sess_arg)); 242 export_uuid(sess_arg.uuid, &ftpm_ta_uuid); 243 sess_arg.clnt_login = TEE_IOCTL_LOGIN_PUBLIC; 244 sess_arg.num_params = 0; 245 246 rc = tee_client_open_session(pvt_data->ctx, &sess_arg, NULL); 247 if ((rc < 0) || (sess_arg.ret != 0)) { 248 dev_err(dev, "%s: tee_client_open_session failed, err=%x\n", 249 __func__, sess_arg.ret); 250 rc = -EINVAL; 251 goto out_tee_session; 252 } 253 pvt_data->session = sess_arg.session; 254 255 /* Allocate dynamic shared memory with fTPM TA */ 256 pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx, 257 MAX_COMMAND_SIZE + 258 MAX_RESPONSE_SIZE); 259 if (IS_ERR(pvt_data->shm)) { 260 dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__); 261 rc = -ENOMEM; 262 goto out_shm_alloc; 263 } 264 265 /* Allocate new struct tpm_chip instance */ 266 chip = tpm_chip_alloc(dev, &ftpm_tee_tpm_ops); 267 if (IS_ERR(chip)) { 268 dev_err(dev, "%s: tpm_chip_alloc failed\n", __func__); 269 rc = PTR_ERR(chip); 270 goto out_chip_alloc; 271 } 272 273 pvt_data->chip = chip; 274 pvt_data->chip->flags |= TPM_CHIP_FLAG_TPM2; 275 276 /* Create a character device for the fTPM */ 277 rc = tpm_chip_register(pvt_data->chip); 278 if (rc) { 279 dev_err(dev, "%s: tpm_chip_register failed with rc=%d\n", 280 __func__, rc); 281 goto out_chip; 282 } 283 284 return 0; 285 286 out_chip: 287 put_device(&pvt_data->chip->dev); 288 out_chip_alloc: 289 tee_shm_free(pvt_data->shm); 290 out_shm_alloc: 291 tee_client_close_session(pvt_data->ctx, pvt_data->session); 292 out_tee_session: 293 tee_client_close_context(pvt_data->ctx); 294 295 return rc; 296 } 297 298 static int ftpm_plat_tee_probe(struct platform_device *pdev) 299 { 300 struct device *dev = &pdev->dev; 301 302 return ftpm_tee_probe(dev); 303 } 304 305 /** 306 * ftpm_tee_remove() - remove the TPM device 307 * @dev: the device description. 308 * 309 * Return: 310 * 0 always. 311 */ 312 static int ftpm_tee_remove(struct device *dev) 313 { 314 struct ftpm_tee_private *pvt_data = dev_get_drvdata(dev); 315 316 /* Release the chip */ 317 tpm_chip_unregister(pvt_data->chip); 318 319 /* frees chip */ 320 put_device(&pvt_data->chip->dev); 321 322 /* Free the shared memory pool */ 323 tee_shm_free(pvt_data->shm); 324 325 /* close the existing session with fTPM TA*/ 326 tee_client_close_session(pvt_data->ctx, pvt_data->session); 327 328 /* close the context with TEE driver */ 329 tee_client_close_context(pvt_data->ctx); 330 331 /* memory allocated with devm_kzalloc() is freed automatically */ 332 333 return 0; 334 } 335 336 static void ftpm_plat_tee_remove(struct platform_device *pdev) 337 { 338 struct device *dev = &pdev->dev; 339 340 ftpm_tee_remove(dev); 341 } 342 343 /** 344 * ftpm_plat_tee_shutdown() - shutdown the TPM device 345 * @pdev: the platform_device description. 346 */ 347 static void ftpm_plat_tee_shutdown(struct platform_device *pdev) 348 { 349 struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev); 350 351 tee_shm_free(pvt_data->shm); 352 tee_client_close_session(pvt_data->ctx, pvt_data->session); 353 tee_client_close_context(pvt_data->ctx); 354 } 355 356 static const struct of_device_id of_ftpm_tee_ids[] = { 357 { .compatible = "microsoft,ftpm" }, 358 { } 359 }; 360 MODULE_DEVICE_TABLE(of, of_ftpm_tee_ids); 361 362 static struct platform_driver ftpm_tee_plat_driver = { 363 .driver = { 364 .name = "ftpm-tee", 365 .of_match_table = of_match_ptr(of_ftpm_tee_ids), 366 }, 367 .shutdown = ftpm_plat_tee_shutdown, 368 .probe = ftpm_plat_tee_probe, 369 .remove_new = ftpm_plat_tee_remove, 370 }; 371 372 /* UUID of the fTPM TA */ 373 static const struct tee_client_device_id optee_ftpm_id_table[] = { 374 {UUID_INIT(0xbc50d971, 0xd4c9, 0x42c4, 375 0x82, 0xcb, 0x34, 0x3f, 0xb7, 0xf3, 0x78, 0x96)}, 376 {} 377 }; 378 379 MODULE_DEVICE_TABLE(tee, optee_ftpm_id_table); 380 381 static struct tee_client_driver ftpm_tee_driver = { 382 .id_table = optee_ftpm_id_table, 383 .driver = { 384 .name = "optee-ftpm", 385 .bus = &tee_bus_type, 386 .probe = ftpm_tee_probe, 387 .remove = ftpm_tee_remove, 388 }, 389 }; 390 391 static int __init ftpm_mod_init(void) 392 { 393 int rc; 394 395 rc = platform_driver_register(&ftpm_tee_plat_driver); 396 if (rc) 397 return rc; 398 399 rc = driver_register(&ftpm_tee_driver.driver); 400 if (rc) { 401 platform_driver_unregister(&ftpm_tee_plat_driver); 402 return rc; 403 } 404 405 return 0; 406 } 407 408 static void __exit ftpm_mod_exit(void) 409 { 410 platform_driver_unregister(&ftpm_tee_plat_driver); 411 driver_unregister(&ftpm_tee_driver.driver); 412 } 413 414 module_init(ftpm_mod_init); 415 module_exit(ftpm_mod_exit); 416 417 MODULE_AUTHOR("Thirupathaiah Annapureddy <thiruan@microsoft.com>"); 418 MODULE_DESCRIPTION("TPM Driver for fTPM TA in TEE"); 419 MODULE_LICENSE("GPL v2"); 420