Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 954650ef authored by Jarkko Sakkinen's avatar Jarkko Sakkinen Committed by Peter Huewe
Browse files

tpm: seal/unseal for TPM 2.0 



Added tpm_trusted_seal() and tpm_trusted_unseal() API for sealing
trusted keys.

This patch implements basic sealing and unsealing functionality for
TPM 2.0:

* Seal with a parent key using a 20 byte auth value.
* Unseal with a parent key using a 20 byte auth value.

Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: default avatarPeter Huewe <peterhuewe@gmx.de>
parent fe351e8d

drivers/char/tpm/tpm-interface.c

+76 −0
Original line number Diff line number Diff line
@@ -665,6 +665,30 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf) 
	return rc;

}



/**

 * tpm_is_tpm2 - is the chip a TPM2 chip?

 * @chip_num:	tpm idx # or ANY

 *

 * Returns < 0 on error, and 1 or 0 on success depending whether the chip

 * is a TPM2 chip.

 */

int tpm_is_tpm2(u32 chip_num)

{

	struct tpm_chip *chip;

	int rc;



	chip = tpm_chip_find_get(chip_num);

	if (chip == NULL)

		return -ENODEV;



	rc = (chip->flags & TPM_CHIP_FLAG_TPM2) != 0;



	tpm_chip_put(chip);



	return rc;

}

EXPORT_SYMBOL_GPL(tpm_is_tpm2);



/**

 * tpm_pcr_read - read a pcr value

 * @chip_num:	tpm idx # or ANY
@@ -1021,6 +1045,58 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) 
}

EXPORT_SYMBOL_GPL(tpm_get_random);



/**

 * tpm_seal_trusted() - seal a trusted key

 * @chip_num: A specific chip number for the request or TPM_ANY_NUM

 * @options: authentication values and other options

 * @payload: the key data in clear and encrypted form

 *

 * Returns < 0 on error and 0 on success. At the moment, only TPM 2.0 chips

 * are supported.

 */

int tpm_seal_trusted(u32 chip_num, struct trusted_key_payload *payload,

		     struct trusted_key_options *options)

{

	struct tpm_chip *chip;

	int rc;



	chip = tpm_chip_find_get(chip_num);

	if (chip == NULL || !(chip->flags & TPM_CHIP_FLAG_TPM2))

		return -ENODEV;



	rc = tpm2_seal_trusted(chip, payload, options);



	tpm_chip_put(chip);

	return rc;

}

EXPORT_SYMBOL_GPL(tpm_seal_trusted);



/**

 * tpm_unseal_trusted() - unseal a trusted key

 * @chip_num: A specific chip number for the request or TPM_ANY_NUM

 * @options: authentication values and other options

 * @payload: the key data in clear and encrypted form

 *

 * Returns < 0 on error and 0 on success. At the moment, only TPM 2.0 chips

 * are supported.

 */

int tpm_unseal_trusted(u32 chip_num, struct trusted_key_payload *payload,

		       struct trusted_key_options *options)

{

	struct tpm_chip *chip;

	int rc;



	chip = tpm_chip_find_get(chip_num);

	if (chip == NULL || !(chip->flags & TPM_CHIP_FLAG_TPM2))

		return -ENODEV;



	rc = tpm2_unseal_trusted(chip, payload, options);



	tpm_chip_put(chip);

	return rc;

}

EXPORT_SYMBOL_GPL(tpm_unseal_trusted);



static int __init tpm_init(void)

{

	int rc;

drivers/char/tpm/tpm.h

+14 −1
Original line number Diff line number Diff line
@@ -90,6 +90,9 @@ enum tpm2_return_codes { 


enum tpm2_algorithms {

	TPM2_ALG_SHA1		= 0x0004,

	TPM2_ALG_KEYEDHASH	= 0x0008,

	TPM2_ALG_SHA256		= 0x000B,

	TPM2_ALG_NULL		= 0x0010

};



enum tpm2_command_codes {
@@ -97,6 +100,10 @@ enum tpm2_command_codes { 
	TPM2_CC_SELF_TEST	= 0x0143,

	TPM2_CC_STARTUP		= 0x0144,

	TPM2_CC_SHUTDOWN	= 0x0145,

	TPM2_CC_CREATE		= 0x0153,

	TPM2_CC_LOAD		= 0x0157,

	TPM2_CC_UNSEAL		= 0x015E,

	TPM2_CC_FLUSH_CONTEXT	= 0x0165,

	TPM2_CC_GET_CAPABILITY	= 0x017A,

	TPM2_CC_GET_RANDOM	= 0x017B,

	TPM2_CC_PCR_READ	= 0x017E,
@@ -407,7 +414,7 @@ struct tpm_buf { 
	u8 *data;

};



static inline void tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal)

static inline int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal)

{

	struct tpm_input_header *head;
@@ -527,6 +534,12 @@ static inline void tpm_add_ppi(struct tpm_chip *chip) 
int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf);

int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash);

int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max);

int tpm2_seal_trusted(struct tpm_chip *chip,

		      struct trusted_key_payload *payload,

		      struct trusted_key_options *options);

int tpm2_unseal_trusted(struct tpm_chip *chip,

			struct trusted_key_payload *payload,

			struct trusted_key_options *options);

ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,

			u32 *value, const char *desc);

drivers/char/tpm/tpm2-cmd.c

+249 −1
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2014 Intel Corporation

 * Copyright (C) 2014, 2015 Intel Corporation

 *

 * Authors:

 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
@@ -16,6 +16,11 @@ 
 */



#include "tpm.h"

#include <keys/trusted-type.h>



enum tpm2_object_attributes {

	TPM2_ATTR_USER_WITH_AUTH	= BIT(6),

};



struct tpm2_startup_in {

	__be16	startup_type;
@@ -380,6 +385,249 @@ static const struct tpm_input_header tpm2_get_tpm_pt_header = { 
	.ordinal = cpu_to_be32(TPM2_CC_GET_CAPABILITY)

};



/**

 * Append TPMS_AUTH_COMMAND to the buffer. The buffer must be allocated with

 * tpm_buf_alloc().

 *

 * @param buf: an allocated tpm_buf instance

 * @param nonce: the session nonce, may be NULL if not used

 * @param nonce_len: the session nonce length, may be 0 if not used

 * @param attributes: the session attributes

 * @param hmac: the session HMAC or password, may be NULL if not used

 * @param hmac_len: the session HMAC or password length, maybe 0 if not used

 */

static void tpm2_buf_append_auth(struct tpm_buf *buf, u32 session_handle,

				 const u8 *nonce, u16 nonce_len,

				 u8 attributes,

				 const u8 *hmac, u16 hmac_len)

{

	tpm_buf_append_u32(buf, 9 + nonce_len + hmac_len);

	tpm_buf_append_u32(buf, session_handle);

	tpm_buf_append_u16(buf, nonce_len);



	if (nonce && nonce_len)

		tpm_buf_append(buf, nonce, nonce_len);



	tpm_buf_append_u8(buf, attributes);

	tpm_buf_append_u16(buf, hmac_len);



	if (hmac && hmac_len)

		tpm_buf_append(buf, hmac, hmac_len);

}



/**

 * tpm2_seal_trusted() - seal a trusted key

 * @chip_num: A specific chip number for the request or TPM_ANY_NUM

 * @options: authentication values and other options

 * @payload: the key data in clear and encrypted form

 *

 * Returns < 0 on error and 0 on success.

 */

int tpm2_seal_trusted(struct tpm_chip *chip,

		      struct trusted_key_payload *payload,

		      struct trusted_key_options *options)

{

	unsigned int blob_len;

	struct tpm_buf buf;

	int rc;



	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE);

	if (rc)

		return rc;



	tpm_buf_append_u32(&buf, options->keyhandle);

	tpm2_buf_append_auth(&buf, TPM2_RS_PW,

			     NULL /* nonce */, 0,

			     0 /* session_attributes */,

			     options->keyauth /* hmac */,

			     TPM_DIGEST_SIZE);



	/* sensitive */

	tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len);



	tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE);

	tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE);

	tpm_buf_append_u16(&buf, payload->key_len);

	tpm_buf_append(&buf, payload->key, payload->key_len);



	/* public */

	tpm_buf_append_u16(&buf, 14);



	tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH);

	tpm_buf_append_u16(&buf, TPM2_ALG_SHA256);

	tpm_buf_append_u32(&buf, TPM2_ATTR_USER_WITH_AUTH);

	tpm_buf_append_u16(&buf, 0); /* policy digest size */

	tpm_buf_append_u16(&buf, TPM2_ALG_NULL);

	tpm_buf_append_u16(&buf, 0);



	/* outside info */

	tpm_buf_append_u16(&buf, 0);



	/* creation PCR */

	tpm_buf_append_u32(&buf, 0);



	if (buf.flags & TPM_BUF_OVERFLOW) {

		rc = -E2BIG;

		goto out;

	}



	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "sealing data");

	if (rc)

		goto out;



	blob_len = be32_to_cpup((__be32 *) &buf.data[TPM_HEADER_SIZE]);

	if (blob_len > MAX_BLOB_SIZE) {

		rc = -E2BIG;

		goto out;

	}



	memcpy(payload->blob, &buf.data[TPM_HEADER_SIZE + 4], blob_len);

	payload->blob_len = blob_len;



out:

	tpm_buf_destroy(&buf);



	if (rc > 0)

		rc = -EPERM;



	return rc;

}



static int tpm2_load(struct tpm_chip *chip,

		     struct trusted_key_payload *payload,

		     struct trusted_key_options *options,

		     u32 *blob_handle)

{

	struct tpm_buf buf;

	unsigned int private_len;

	unsigned int public_len;

	unsigned int blob_len;

	int rc;



	private_len = be16_to_cpup((__be16 *) &payload->blob[0]);

	if (private_len > (payload->blob_len - 2))

		return -E2BIG;



	public_len = be16_to_cpup((__be16 *) &payload->blob[2 + private_len]);

	blob_len = private_len + public_len + 4;

	if (blob_len > payload->blob_len)

		return -E2BIG;



	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD);

	if (rc)

		return rc;



	tpm_buf_append_u32(&buf, options->keyhandle);

	tpm2_buf_append_auth(&buf, TPM2_RS_PW,

			     NULL /* nonce */, 0,

			     0 /* session_attributes */,

			     options->keyauth /* hmac */,

			     TPM_DIGEST_SIZE);



	tpm_buf_append(&buf, payload->blob, blob_len);



	if (buf.flags & TPM_BUF_OVERFLOW) {

		rc = -E2BIG;

		goto out;

	}



	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "loading blob");

	if (!rc)

		*blob_handle = be32_to_cpup(

			(__be32 *) &buf.data[TPM_HEADER_SIZE]);



out:

	tpm_buf_destroy(&buf);



	if (rc > 0)

		rc = -EPERM;



	return rc;

}



static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)

{

	struct tpm_buf buf;

	int rc;



	rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT);

	if (rc) {

		dev_warn(chip->pdev, "0x%08x was not flushed, out of memory\n",

			 handle);

		return;

	}



	tpm_buf_append_u32(&buf, handle);



	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "flushing context");

	if (rc)

		dev_warn(chip->pdev, "0x%08x was not flushed, rc=%d\n", handle,

			 rc);



	tpm_buf_destroy(&buf);

}



static int tpm2_unseal(struct tpm_chip *chip,

		       struct trusted_key_payload *payload,

		       struct trusted_key_options *options,

		       u32 blob_handle)

{

	struct tpm_buf buf;

	int rc;



	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);

	if (rc)

		return rc;



	tpm_buf_append_u32(&buf, blob_handle);

	tpm2_buf_append_auth(&buf, TPM2_RS_PW,

			     NULL /* nonce */, 0,

			     0 /* session_attributes */,

			     options->blobauth /* hmac */,

			     TPM_DIGEST_SIZE);



	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "unsealing");

	if (rc > 0)

		rc = -EPERM;



	if (!rc) {

		payload->key_len = be16_to_cpup(

			(__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);



		memcpy(payload->key, &buf.data[TPM_HEADER_SIZE + 6],

		       payload->key_len);

	}



	tpm_buf_destroy(&buf);

	return rc;

}



/**

 * tpm_unseal_trusted() - unseal a trusted key

 * @chip_num: A specific chip number for the request or TPM_ANY_NUM

 * @options: authentication values and other options

 * @payload: the key data in clear and encrypted form

 *

 * Returns < 0 on error and 0 on success.

 */

int tpm2_unseal_trusted(struct tpm_chip *chip,

			struct trusted_key_payload *payload,

			struct trusted_key_options *options)

{

	u32 blob_handle;

	int rc;



	rc = tpm2_load(chip, payload, options, &blob_handle);

	if (rc)

		return rc;



	rc = tpm2_unseal(chip, payload, options, blob_handle);



	tpm2_flush_context(chip, blob_handle);



	return rc;

}



/**

 * tpm2_get_tpm_pt() - get value of a TPM_CAP_TPM_PROPERTIES type property

 * @chip:		TPM chip to use.

include/keys/trusted-type.h

+1 −1
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ 


#define MIN_KEY_SIZE			32

#define MAX_KEY_SIZE			128

#define MAX_BLOB_SIZE			320

#define MAX_BLOB_SIZE			512

#define MAX_PCRINFO_SIZE		64



struct trusted_key_payload {

include/linux/tpm.h

+26 −0
Original line number Diff line number Diff line
@@ -30,6 +30,8 @@ 
#define	TPM_ANY_NUM 0xFFFF



struct tpm_chip;

struct trusted_key_payload;

struct trusted_key_options;



struct tpm_class_ops {

	const u8 req_complete_mask;
@@ -46,11 +48,22 @@ struct tpm_class_ops { 


#if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)



extern int tpm_is_tpm2(u32 chip_num);

extern int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf);

extern int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash);

extern int tpm_send(u32 chip_num, void *cmd, size_t buflen);

extern int tpm_get_random(u32 chip_num, u8 *data, size_t max);

extern int tpm_seal_trusted(u32 chip_num,

			    struct trusted_key_payload *payload,

			    struct trusted_key_options *options);

extern int tpm_unseal_trusted(u32 chip_num,

			      struct trusted_key_payload *payload,

			      struct trusted_key_options *options);

#else

static inline int tpm_is_tpm2(u32 chip_num)

{

	return -ENODEV;

}

static inline int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf) {

	return -ENODEV;

}
@@ -63,5 +76,18 @@ static inline int tpm_send(u32 chip_num, void *cmd, size_t buflen) { 
static inline int tpm_get_random(u32 chip_num, u8 *data, size_t max) {

	return -ENODEV;

}



static inline int tpm_seal_trusted(u32 chip_num,

				   struct trusted_key_payload *payload,

				   struct trusted_key_options *options)

{

	return -ENODEV;

}

static inline int tpm_unseal_trusted(u32 chip_num,

				     struct trusted_key_payload *payload,

				     struct trusted_key_options *options)

{

	return -ENODEV;

}

#endif

#endif