1 /* SPDX-License-Identifier: GPL-2.0-only */
2
3 #include <console/console.h>
4 #include <security/tpm/tspi/crtm.h>
5 #include <security/tpm/tspi/logs.h>
6 #include <security/tpm/tspi.h>
7 #include <security/tpm/tss.h>
8 #include <assert.h>
9 #include <security/vboot/misc.h>
10 #include <vb2_api.h>
11 #include <vb2_sha.h>
12
13 #if CONFIG(TPM1)
tpm1_invoke_state_machine(void)14 static tpm_result_t tpm1_invoke_state_machine(void)
15 {
16 uint8_t disabled;
17 uint8_t deactivated;
18 tpm_result_t rc = TPM_SUCCESS;
19
20 if (tlcl_get_family() != TPM_1)
21 return rc;
22
23 /* Check that the TPM is enabled and activated. */
24 rc = tlcl1_get_flags(&disabled, &deactivated, NULL);
25 if (rc != TPM_SUCCESS) {
26 printk(BIOS_ERR, "TPM Error (%#x): Can't read capabilities.\n", rc);
27 return rc;
28 }
29
30 if (disabled) {
31 printk(BIOS_INFO, "TPM: is disabled. Enabling...\n");
32
33 rc = tlcl1_set_enable();
34 if (rc != TPM_SUCCESS) {
35 printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc);
36 return rc;
37 }
38 }
39
40 if (!!deactivated != CONFIG(TPM_DEACTIVATE)) {
41 printk(BIOS_INFO,
42 "TPM: Unexpected TPM deactivated state. Toggling...\n");
43 rc = tlcl1_set_deactivated(!deactivated);
44 if (rc != TPM_SUCCESS) {
45 printk(BIOS_ERR,
46 "TPM Error (%#x): Can't toggle deactivated state.\n", rc);
47 return rc;
48 }
49
50 deactivated = !deactivated;
51 rc = TPM_CB_MUST_REBOOT;
52 }
53
54 return rc;
55 }
56 #endif
57
tpm_setup_s3_helper(void)58 static tpm_result_t tpm_setup_s3_helper(void)
59 {
60 tpm_result_t rc = tlcl_resume();
61 switch (rc) {
62 case TPM_SUCCESS:
63 break;
64
65 case TPM_INVALID_POSTINIT:
66 /*
67 * We're on a platform where the TPM maintains power
68 * in S3, so it's already initialized.
69 */
70 printk(BIOS_INFO, "TPM: Already initialized.\n");
71 rc = TPM_SUCCESS;
72 break;
73
74 default:
75 printk(BIOS_ERR, "TPM: Resume failed (%#x).\n", rc);
76 break;
77 }
78
79 return rc;
80 }
81
tpm_setup_epilogue(tpm_result_t rc)82 static tpm_result_t tpm_setup_epilogue(tpm_result_t rc)
83 {
84 if (rc != TPM_SUCCESS)
85 post_code(POSTCODE_TPM_FAILURE);
86 else
87 printk(BIOS_INFO, "TPM: setup succeeded\n");
88
89 return rc;
90 }
91
92 static int tpm_is_setup;
tspi_tpm_is_setup(void)93 static inline int tspi_tpm_is_setup(void)
94 {
95 /*
96 * vboot_logic_executed() only starts returning true at the end of
97 * verstage, but the vboot logic itself already wants to extend PCRs
98 * before that. So in the stage where verification actually runs, we
99 * need to check tpm_is_setup. Skip that check in all other stages so
100 * this whole function can be evaluated at compile time.
101 */
102 if (CONFIG(VBOOT)) {
103 if (verification_should_run())
104 return tpm_is_setup;
105 return vboot_logic_executed();
106 }
107
108 if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
109 return ENV_BOOTBLOCK ? tpm_is_setup : 1;
110
111 if (ENV_RAMSTAGE)
112 return tpm_is_setup;
113
114 return 0;
115 }
116
117 /*
118 * tpm_setup starts the TPM and establishes the root of trust for the
119 * anti-rollback mechanism. tpm_setup can fail for three reasons. 1 A bug.
120 * 2 a TPM hardware failure. 3 An unexpected TPM state due to some attack. In
121 * general we cannot easily distinguish the kind of failure, so our strategy is
122 * to reboot in recovery mode in all cases. The recovery mode calls tpm_setup
123 * again, which executes (almost) the same sequence of operations. There is a
124 * good chance that, if recovery mode was entered because of a TPM failure, the
125 * failure will repeat itself. (In general this is impossible to guarantee
126 * because we have no way of creating the exact TPM initial state at the
127 * previous boot.) In recovery mode, we ignore the failure and continue, thus
128 * giving the recovery kernel a chance to fix things (that's why we don't set
129 * bGlobalLock). The choice is between a knowingly insecure device and a
130 * bricked device.
131 *
132 * As a side note, observe that we go through considerable hoops to avoid using
133 * the STCLEAR permissions for the index spaces. We do this to avoid writing
134 * to the TPM flashram at every reboot or wake-up, because of concerns about
135 * the durability of the NVRAM.
136 */
tpm_setup(int s3flag)137 tpm_result_t tpm_setup(int s3flag)
138 {
139 tpm_result_t rc;
140
141 rc = tlcl_lib_init();
142 if (rc != TPM_SUCCESS) {
143 printk(BIOS_ERR, "TPM Error (%#x): Can't initialize.\n", rc);
144 return tpm_setup_epilogue(rc);
145 }
146
147 /* Handle special init for S3 resume path */
148 if (s3flag) {
149 printk(BIOS_INFO, "TPM: Handle S3 resume.\n");
150 return tpm_setup_epilogue(tpm_setup_s3_helper());
151 }
152
153 rc = tlcl_startup();
154 if (CONFIG(TPM_STARTUP_IGNORE_POSTINIT)
155 && rc == TPM_INVALID_POSTINIT) {
156 printk(BIOS_DEBUG, "TPM Warn(%#x): ignoring invalid POSTINIT\n", rc);
157 rc = TPM_SUCCESS;
158 }
159 if (rc != TPM_SUCCESS) {
160 printk(BIOS_ERR, "TPM Error (%#x): Can't run startup command.\n", rc);
161 return tpm_setup_epilogue(rc);
162 }
163
164 rc = tlcl_assert_physical_presence();
165 if (rc != TPM_SUCCESS) {
166 /*
167 * It is possible that the TPM was delivered with the physical
168 * presence command disabled. This tries enabling it, then
169 * tries asserting PP again.
170 */
171 rc = tlcl_physical_presence_cmd_enable();
172 if (rc != TPM_SUCCESS) {
173 printk(BIOS_ERR, "TPM Error (%#x): Can't enable physical presence command.\n", rc);
174 return tpm_setup_epilogue(rc);
175 }
176
177 rc = tlcl_assert_physical_presence();
178 if (rc != TPM_SUCCESS) {
179 printk(BIOS_ERR, "TPM Error (%#x): Can't assert physical presence.\n", rc);
180 return tpm_setup_epilogue(rc);
181 }
182 }
183
184 #if CONFIG(TPM1)
185 rc = tpm1_invoke_state_machine();
186 #endif
187 if (CONFIG(TPM_MEASURED_BOOT))
188 rc = tspi_measure_cache_to_pcr();
189
190 tpm_is_setup = 1;
191 return tpm_setup_epilogue(rc);
192 }
193
tpm_clear_and_reenable(void)194 tpm_result_t tpm_clear_and_reenable(void)
195 {
196 tpm_result_t rc;
197
198 printk(BIOS_INFO, "TPM: Clear and re-enable\n");
199 rc = tlcl_force_clear();
200 if (rc != TPM_SUCCESS) {
201 printk(BIOS_ERR, "TPM Error (%#x): Can't initiate a force clear.\n", rc);
202 return rc;
203 }
204
205 if (tlcl_get_family() == TPM_1) {
206 rc = tlcl1_set_enable();
207 if (rc != TPM_SUCCESS) {
208 printk(BIOS_ERR, "TPM Error (%#x): Can't set enabled state.\n", rc);
209 return rc;
210 }
211
212 rc = tlcl1_set_deactivated(0);
213 if (rc != TPM_SUCCESS) {
214 printk(BIOS_ERR, "TPM Error (%#x): Can't set deactivated state.\n", rc);
215 return rc;
216 }
217 }
218
219 return TPM_SUCCESS;
220 }
221
tpm_extend_pcr(int pcr,enum vb2_hash_algorithm digest_algo,const uint8_t * digest,size_t digest_len,const char * name)222 tpm_result_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo,
223 const uint8_t *digest, size_t digest_len, const char *name)
224 {
225 tpm_result_t rc;
226
227 if (!digest)
228 return TPM_IOERROR;
229
230 if (tspi_tpm_is_setup()) {
231 rc = tlcl_lib_init();
232 if (rc != TPM_SUCCESS) {
233 printk(BIOS_ERR, "TPM Error (%#x): Can't initialize library.\n", rc);
234 return rc;
235 }
236
237 printk(BIOS_DEBUG, "TPM: Extending digest for `%s` into PCR %d\n", name, pcr);
238 rc = tlcl_extend(pcr, digest, digest_algo);
239 if (rc != TPM_SUCCESS) {
240 printk(BIOS_ERR, "TPM Error (%#x): Extending hash for `%s` into PCR %d failed.\n",
241 rc, name, pcr);
242 return rc;
243 }
244 }
245
246 if (CONFIG(TPM_MEASURED_BOOT))
247 tpm_log_add_table_entry(name, pcr, digest_algo, digest, digest_len);
248
249 printk(BIOS_DEBUG, "TPM: Digest of `%s` to PCR %d %s\n",
250 name, pcr, tspi_tpm_is_setup() ? "measured" : "logged");
251
252 return TPM_SUCCESS;
253 }
254
255 #if CONFIG(VBOOT_LIB)
tpm_measure_region(const struct region_device * rdev,uint8_t pcr,const char * rname)256 tpm_result_t tpm_measure_region(const struct region_device *rdev, uint8_t pcr,
257 const char *rname)
258 {
259 uint8_t digest[TPM_PCR_MAX_LEN], digest_len;
260 uint8_t buf[HASH_DATA_CHUNK_SIZE];
261 uint32_t offset;
262 size_t len;
263 struct vb2_digest_context ctx;
264
265 if (!rdev || !rname)
266 return TPM_CB_INVALID_ARG;
267
268 digest_len = vb2_digest_size(TPM_MEASURE_ALGO);
269 assert(digest_len <= sizeof(digest));
270 if (vb2_digest_init(&ctx, vboot_hwcrypto_allowed(), TPM_MEASURE_ALGO,
271 region_device_sz(rdev))) {
272 printk(BIOS_ERR, "TPM: Error initializing hash.\n");
273 return TPM_CB_HASH_ERROR;
274 }
275 /*
276 * Though one can mmap the full needed region on x86 this is not the
277 * case for e.g. ARM. In order to make this code as universal as
278 * possible across different platforms read the data to hash in chunks.
279 */
280 for (offset = 0; offset < region_device_sz(rdev); offset += len) {
281 len = MIN(sizeof(buf), region_device_sz(rdev) - offset);
282 if (rdev_readat(rdev, buf, offset, len) < 0) {
283 printk(BIOS_ERR, "TPM: Not able to read region %s.\n",
284 rname);
285 return TPM_CB_READ_FAILURE;
286 }
287 if (vb2_digest_extend(&ctx, buf, len)) {
288 printk(BIOS_ERR, "TPM: Error extending hash.\n");
289 return TPM_CB_HASH_ERROR;
290 }
291 }
292 if (vb2_digest_finalize(&ctx, digest, digest_len)) {
293 printk(BIOS_ERR, "TPM: Error finalizing hash.\n");
294 return TPM_CB_HASH_ERROR;
295 }
296 return tpm_extend_pcr(pcr, TPM_MEASURE_ALGO, digest, digest_len, rname);
297 }
298 #endif /* VBOOT_LIB */
299