1395 lines · c
1// SPDX-License-Identifier: GPL-2.02 3/*4 * Copyright (C) 2018 James.Bottomley@HansenPartnership.com5 *6 * Cryptographic helper routines for handling TPM2 sessions for7 * authorization HMAC and request response encryption.8 *9 * The idea is to ensure that every TPM command is HMAC protected by a10 * session, meaning in-flight tampering would be detected and in11 * addition all sensitive inputs and responses should be encrypted.12 *13 * The basic way this works is to use a TPM feature called salted14 * sessions where a random secret used in session construction is15 * encrypted to the public part of a known TPM key. The problem is we16 * have no known keys, so initially a primary Elliptic Curve key is17 * derived from the NULL seed (we use EC because most TPMs generate18 * these keys much faster than RSA ones). The curve used is NIST_P25619 * because that's now mandated to be present in 'TCG TPM v2.020 * Provisioning Guidance'21 *22 * Threat problems: the initial TPM2_CreatePrimary is not (and cannot23 * be) session protected, so a clever Man in the Middle could return a24 * public key they control to this command and from there intercept25 * and decode all subsequent session based transactions. The kernel26 * cannot mitigate this threat but, after boot, userspace can get27 * proof this has not happened by asking the TPM to certify the NULL28 * key. This certification would chain back to the TPM Endorsement29 * Certificate and prove the NULL seed primary had not been tampered30 * with and thus all sessions must have been cryptographically secure.31 * To assist with this, the initial NULL seed public key name is made32 * available in a sysfs file.33 *34 * Use of these functions:35 *36 * The design is all the crypto, hash and hmac gunk is confined in this37 * file and never needs to be seen even by the kernel internal user. To38 * the user there's an init function tpm2_sessions_init() that needs to39 * be called once per TPM which generates the NULL seed primary key.40 *41 * These are the usage functions:42 *43 * tpm2_start_auth_session() which allocates the opaque auth structure44 * and gets a session from the TPM. This must be called before45 * any of the following functions. The session is protected by a46 * session_key which is derived from a random salt value47 * encrypted to the NULL seed.48 * tpm2_end_auth_session() kills the session and frees the resources.49 * Under normal operation this function is done by50 * tpm_buf_check_hmac_response(), so this is only to be used on51 * error legs where the latter is not executed.52 * tpm_buf_append_name() to add a handle to the buffer. This must be53 * used in place of the usual tpm_buf_append_u32() for adding54 * handles because handles have to be processed specially when55 * calculating the HMAC. In particular, for NV, volatile and56 * permanent objects you now need to provide the name.57 * tpm_buf_append_hmac_session() which appends the hmac session to the58 * buf in the same way tpm_buf_append_auth does().59 * tpm_buf_fill_hmac_session() This calculates the correct hash and60 * places it in the buffer. It must be called after the complete61 * command buffer is finalized so it can fill in the correct HMAC62 * based on the parameters.63 * tpm_buf_check_hmac_response() which checks the session response in64 * the buffer and calculates what it should be. If there's a65 * mismatch it will log a warning and return an error. If66 * tpm_buf_append_hmac_session() did not specify67 * TPM_SA_CONTINUE_SESSION then the session will be closed (if it68 * hasn't been consumed) and the auth structure freed.69 */70 71#include "tpm.h"72#include <linux/random.h>73#include <linux/scatterlist.h>74#include <linux/unaligned.h>75#include <crypto/kpp.h>76#include <crypto/ecdh.h>77#include <crypto/hash.h>78#include <crypto/hmac.h>79 80/* maximum number of names the TPM must remember for authorization */81#define AUTH_MAX_NAMES 382 83#define AES_KEY_BYTES AES_KEYSIZE_12884#define AES_KEY_BITS (AES_KEY_BYTES*8)85 86/*87 * This is the structure that carries all the auth information (like88 * session handle, nonces, session key and auth) from use to use it is89 * designed to be opaque to anything outside.90 */91struct tpm2_auth {92 u32 handle;93 /*94 * This has two meanings: before tpm_buf_fill_hmac_session()95 * it marks the offset in the buffer of the start of the96 * sessions (i.e. after all the handles). Once the buffer has97 * been filled it markes the session number of our auth98 * session so we can find it again in the response buffer.99 *100 * The two cases are distinguished because the first offset101 * must always be greater than TPM_HEADER_SIZE and the second102 * must be less than or equal to 5.103 */104 u32 session;105 /*106 * the size here is variable and set by the size of our_nonce107 * which must be between 16 and the name hash length. we set108 * the maximum sha256 size for the greatest protection109 */110 u8 our_nonce[SHA256_DIGEST_SIZE];111 u8 tpm_nonce[SHA256_DIGEST_SIZE];112 /*113 * the salt is only used across the session command/response114 * after that it can be used as a scratch area115 */116 union {117 u8 salt[EC_PT_SZ];118 /* scratch for key + IV */119 u8 scratch[AES_KEY_BYTES + AES_BLOCK_SIZE];120 };121 /*122 * the session key and passphrase are the same size as the123 * name digest (sha256 again). The session key is constant124 * for the use of the session and the passphrase can change125 * with every invocation.126 *127 * Note: these fields must be adjacent and in this order128 * because several HMAC/KDF schemes use the combination of the129 * session_key and passphrase.130 */131 u8 session_key[SHA256_DIGEST_SIZE];132 u8 passphrase[SHA256_DIGEST_SIZE];133 int passphrase_len;134 struct crypto_aes_ctx aes_ctx;135 /* saved session attributes: */136 u8 attrs;137 __be32 ordinal;138 139 /*140 * memory for three authorization handles. We know them by141 * handle, but they are part of the session by name, which142 * we must compute and remember143 */144 u32 name_h[AUTH_MAX_NAMES];145 u8 name[AUTH_MAX_NAMES][2 + SHA512_DIGEST_SIZE];146};147 148#ifdef CONFIG_TCG_TPM2_HMAC149/*150 * Name Size based on TPM algorithm (assumes no hash bigger than 255)151 */152static u8 name_size(const u8 *name)153{154 static u8 size_map[] = {155 [TPM_ALG_SHA1] = SHA1_DIGEST_SIZE,156 [TPM_ALG_SHA256] = SHA256_DIGEST_SIZE,157 [TPM_ALG_SHA384] = SHA384_DIGEST_SIZE,158 [TPM_ALG_SHA512] = SHA512_DIGEST_SIZE,159 };160 u16 alg = get_unaligned_be16(name);161 return size_map[alg] + 2;162}163 164static int tpm2_parse_read_public(char *name, struct tpm_buf *buf)165{166 struct tpm_header *head = (struct tpm_header *)buf->data;167 off_t offset = TPM_HEADER_SIZE;168 u32 tot_len = be32_to_cpu(head->length);169 u32 val;170 171 /* we're starting after the header so adjust the length */172 tot_len -= TPM_HEADER_SIZE;173 174 /* skip public */175 val = tpm_buf_read_u16(buf, &offset);176 if (val > tot_len)177 return -EINVAL;178 offset += val;179 /* name */180 val = tpm_buf_read_u16(buf, &offset);181 if (val != name_size(&buf->data[offset]))182 return -EINVAL;183 memcpy(name, &buf->data[offset], val);184 /* forget the rest */185 return 0;186}187 188static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name)189{190 struct tpm_buf buf;191 int rc;192 193 rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC);194 if (rc)195 return rc;196 197 tpm_buf_append_u32(&buf, handle);198 rc = tpm_transmit_cmd(chip, &buf, 0, "read public");199 if (rc == TPM2_RC_SUCCESS)200 rc = tpm2_parse_read_public(name, &buf);201 202 tpm_buf_destroy(&buf);203 204 return rc;205}206#endif /* CONFIG_TCG_TPM2_HMAC */207 208/**209 * tpm_buf_append_name() - add a handle area to the buffer210 * @chip: the TPM chip structure211 * @buf: The buffer to be appended212 * @handle: The handle to be appended213 * @name: The name of the handle (may be NULL)214 *215 * In order to compute session HMACs, we need to know the names of the216 * objects pointed to by the handles. For most objects, this is simply217 * the actual 4 byte handle or an empty buf (in these cases @name218 * should be NULL) but for volatile objects, permanent objects and NV219 * areas, the name is defined as the hash (according to the name220 * algorithm which should be set to sha256) of the public area to221 * which the two byte algorithm id has been appended. For these222 * objects, the @name pointer should point to this. If a name is223 * required but @name is NULL, then TPM2_ReadPublic() will be called224 * on the handle to obtain the name.225 *226 * As with most tpm_buf operations, success is assumed because failure227 * will be caused by an incorrect programming model and indicated by a228 * kernel message.229 */230void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf,231 u32 handle, u8 *name)232{233#ifdef CONFIG_TCG_TPM2_HMAC234 enum tpm2_mso_type mso = tpm2_handle_mso(handle);235 struct tpm2_auth *auth;236 int slot;237#endif238 239 if (!tpm2_chip_auth(chip)) {240 tpm_buf_append_handle(chip, buf, handle);241 return;242 }243 244#ifdef CONFIG_TCG_TPM2_HMAC245 slot = (tpm_buf_length(buf) - TPM_HEADER_SIZE) / 4;246 if (slot >= AUTH_MAX_NAMES) {247 dev_err(&chip->dev, "TPM: too many handles\n");248 return;249 }250 auth = chip->auth;251 WARN(auth->session != tpm_buf_length(buf),252 "name added in wrong place\n");253 tpm_buf_append_u32(buf, handle);254 auth->session += 4;255 256 if (mso == TPM2_MSO_PERSISTENT ||257 mso == TPM2_MSO_VOLATILE ||258 mso == TPM2_MSO_NVRAM) {259 if (!name)260 tpm2_read_public(chip, handle, auth->name[slot]);261 } else {262 if (name)263 dev_err(&chip->dev, "TPM: Handle does not require name but one is specified\n");264 }265 266 auth->name_h[slot] = handle;267 if (name)268 memcpy(auth->name[slot], name, name_size(name));269#endif270}271EXPORT_SYMBOL_GPL(tpm_buf_append_name);272 273void tpm_buf_append_auth(struct tpm_chip *chip, struct tpm_buf *buf,274 u8 attributes, u8 *passphrase, int passphrase_len)275{276 /* offset tells us where the sessions area begins */277 int offset = buf->handles * 4 + TPM_HEADER_SIZE;278 u32 len = 9 + passphrase_len;279 280 if (tpm_buf_length(buf) != offset) {281 /* not the first session so update the existing length */282 len += get_unaligned_be32(&buf->data[offset]);283 put_unaligned_be32(len, &buf->data[offset]);284 } else {285 tpm_buf_append_u32(buf, len);286 }287 /* auth handle */288 tpm_buf_append_u32(buf, TPM2_RS_PW);289 /* nonce */290 tpm_buf_append_u16(buf, 0);291 /* attributes */292 tpm_buf_append_u8(buf, 0);293 /* passphrase */294 tpm_buf_append_u16(buf, passphrase_len);295 tpm_buf_append(buf, passphrase, passphrase_len);296}297 298/**299 * tpm_buf_append_hmac_session() - Append a TPM session element300 * @chip: the TPM chip structure301 * @buf: The buffer to be appended302 * @attributes: The session attributes303 * @passphrase: The session authority (NULL if none)304 * @passphrase_len: The length of the session authority (0 if none)305 *306 * This fills in a session structure in the TPM command buffer, except307 * for the HMAC which cannot be computed until the command buffer is308 * complete. The type of session is controlled by the @attributes,309 * the main ones of which are TPM2_SA_CONTINUE_SESSION which means the310 * session won't terminate after tpm_buf_check_hmac_response(),311 * TPM2_SA_DECRYPT which means this buffers first parameter should be312 * encrypted with a session key and TPM2_SA_ENCRYPT, which means the313 * response buffer's first parameter needs to be decrypted (confusing,314 * but the defines are written from the point of view of the TPM).315 *316 * Any session appended by this command must be finalized by calling317 * tpm_buf_fill_hmac_session() otherwise the HMAC will be incorrect318 * and the TPM will reject the command.319 *320 * As with most tpm_buf operations, success is assumed because failure321 * will be caused by an incorrect programming model and indicated by a322 * kernel message.323 */324void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf,325 u8 attributes, u8 *passphrase,326 int passphrase_len)327{328#ifdef CONFIG_TCG_TPM2_HMAC329 u8 nonce[SHA256_DIGEST_SIZE];330 struct tpm2_auth *auth;331 u32 len;332#endif333 334 if (!tpm2_chip_auth(chip)) {335 tpm_buf_append_auth(chip, buf, attributes, passphrase,336 passphrase_len);337 return;338 }339 340#ifdef CONFIG_TCG_TPM2_HMAC341 /* The first write to /dev/tpm{rm0} will flush the session. */342 attributes |= TPM2_SA_CONTINUE_SESSION;343 344 /*345 * The Architecture Guide requires us to strip trailing zeros346 * before computing the HMAC347 */348 while (passphrase && passphrase_len > 0 && passphrase[passphrase_len - 1] == '\0')349 passphrase_len--;350 351 auth = chip->auth;352 auth->attrs = attributes;353 auth->passphrase_len = passphrase_len;354 if (passphrase_len)355 memcpy(auth->passphrase, passphrase, passphrase_len);356 357 if (auth->session != tpm_buf_length(buf)) {358 /* we're not the first session */359 len = get_unaligned_be32(&buf->data[auth->session]);360 if (4 + len + auth->session != tpm_buf_length(buf)) {361 WARN(1, "session length mismatch, cannot append");362 return;363 }364 365 /* add our new session */366 len += 9 + 2 * SHA256_DIGEST_SIZE;367 put_unaligned_be32(len, &buf->data[auth->session]);368 } else {369 tpm_buf_append_u32(buf, 9 + 2 * SHA256_DIGEST_SIZE);370 }371 372 /* random number for our nonce */373 get_random_bytes(nonce, sizeof(nonce));374 memcpy(auth->our_nonce, nonce, sizeof(nonce));375 tpm_buf_append_u32(buf, auth->handle);376 /* our new nonce */377 tpm_buf_append_u16(buf, SHA256_DIGEST_SIZE);378 tpm_buf_append(buf, nonce, SHA256_DIGEST_SIZE);379 tpm_buf_append_u8(buf, auth->attrs);380 /* and put a placeholder for the hmac */381 tpm_buf_append_u16(buf, SHA256_DIGEST_SIZE);382 tpm_buf_append(buf, nonce, SHA256_DIGEST_SIZE);383#endif384}385EXPORT_SYMBOL_GPL(tpm_buf_append_hmac_session);386 387#ifdef CONFIG_TCG_TPM2_HMAC388 389static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy,390 u32 *handle, u8 *name);391 392/*393 * It turns out the crypto hmac(sha256) is hard for us to consume394 * because it assumes a fixed key and the TPM seems to change the key395 * on every operation, so we weld the hmac init and final functions in396 * here to give it the same usage characteristics as a regular hash397 */398static void tpm2_hmac_init(struct sha256_state *sctx, u8 *key, u32 key_len)399{400 u8 pad[SHA256_BLOCK_SIZE];401 int i;402 403 sha256_init(sctx);404 for (i = 0; i < sizeof(pad); i++) {405 if (i < key_len)406 pad[i] = key[i];407 else408 pad[i] = 0;409 pad[i] ^= HMAC_IPAD_VALUE;410 }411 sha256_update(sctx, pad, sizeof(pad));412}413 414static void tpm2_hmac_final(struct sha256_state *sctx, u8 *key, u32 key_len,415 u8 *out)416{417 u8 pad[SHA256_BLOCK_SIZE];418 int i;419 420 for (i = 0; i < sizeof(pad); i++) {421 if (i < key_len)422 pad[i] = key[i];423 else424 pad[i] = 0;425 pad[i] ^= HMAC_OPAD_VALUE;426 }427 428 /* collect the final hash; use out as temporary storage */429 sha256_final(sctx, out);430 431 sha256_init(sctx);432 sha256_update(sctx, pad, sizeof(pad));433 sha256_update(sctx, out, SHA256_DIGEST_SIZE);434 sha256_final(sctx, out);435}436 437/*438 * assume hash sha256 and nonces u, v of size SHA256_DIGEST_SIZE but439 * otherwise standard tpm2_KDFa. Note output is in bytes not bits.440 */441static void tpm2_KDFa(u8 *key, u32 key_len, const char *label, u8 *u,442 u8 *v, u32 bytes, u8 *out)443{444 u32 counter = 1;445 const __be32 bits = cpu_to_be32(bytes * 8);446 447 while (bytes > 0) {448 struct sha256_state sctx;449 __be32 c = cpu_to_be32(counter);450 451 tpm2_hmac_init(&sctx, key, key_len);452 sha256_update(&sctx, (u8 *)&c, sizeof(c));453 sha256_update(&sctx, label, strlen(label)+1);454 sha256_update(&sctx, u, SHA256_DIGEST_SIZE);455 sha256_update(&sctx, v, SHA256_DIGEST_SIZE);456 sha256_update(&sctx, (u8 *)&bits, sizeof(bits));457 tpm2_hmac_final(&sctx, key, key_len, out);458 459 bytes -= SHA256_DIGEST_SIZE;460 counter++;461 out += SHA256_DIGEST_SIZE;462 }463}464 465/*466 * Somewhat of a bastardization of the real KDFe. We're assuming467 * we're working with known point sizes for the input parameters and468 * the hash algorithm is fixed at sha256. Because we know that the469 * point size is 32 bytes like the hash size, there's no need to loop470 * in this KDF.471 */472static void tpm2_KDFe(u8 z[EC_PT_SZ], const char *str, u8 *pt_u, u8 *pt_v,473 u8 *out)474{475 struct sha256_state sctx;476 /*477 * this should be an iterative counter, but because we know478 * we're only taking 32 bytes for the point using a sha256479 * hash which is also 32 bytes, there's only one loop480 */481 __be32 c = cpu_to_be32(1);482 483 sha256_init(&sctx);484 /* counter (BE) */485 sha256_update(&sctx, (u8 *)&c, sizeof(c));486 /* secret value */487 sha256_update(&sctx, z, EC_PT_SZ);488 /* string including trailing zero */489 sha256_update(&sctx, str, strlen(str)+1);490 sha256_update(&sctx, pt_u, EC_PT_SZ);491 sha256_update(&sctx, pt_v, EC_PT_SZ);492 sha256_final(&sctx, out);493}494 495static void tpm_buf_append_salt(struct tpm_buf *buf, struct tpm_chip *chip,496 struct tpm2_auth *auth)497{498 struct crypto_kpp *kpp;499 struct kpp_request *req;500 struct scatterlist s[2], d[1];501 struct ecdh p = {0};502 u8 encoded_key[EC_PT_SZ], *x, *y;503 unsigned int buf_len;504 505 /* secret is two sized points */506 tpm_buf_append_u16(buf, (EC_PT_SZ + 2)*2);507 /*508 * we cheat here and append uninitialized data to form509 * the points. All we care about is getting the two510 * co-ordinate pointers, which will be used to overwrite511 * the uninitialized data512 */513 tpm_buf_append_u16(buf, EC_PT_SZ);514 x = &buf->data[tpm_buf_length(buf)];515 tpm_buf_append(buf, encoded_key, EC_PT_SZ);516 tpm_buf_append_u16(buf, EC_PT_SZ);517 y = &buf->data[tpm_buf_length(buf)];518 tpm_buf_append(buf, encoded_key, EC_PT_SZ);519 sg_init_table(s, 2);520 sg_set_buf(&s[0], x, EC_PT_SZ);521 sg_set_buf(&s[1], y, EC_PT_SZ);522 523 kpp = crypto_alloc_kpp("ecdh-nist-p256", CRYPTO_ALG_INTERNAL, 0);524 if (IS_ERR(kpp)) {525 dev_err(&chip->dev, "crypto ecdh allocation failed\n");526 return;527 }528 529 buf_len = crypto_ecdh_key_len(&p);530 if (sizeof(encoded_key) < buf_len) {531 dev_err(&chip->dev, "salt buffer too small needs %d\n",532 buf_len);533 goto out;534 }535 crypto_ecdh_encode_key(encoded_key, buf_len, &p);536 /* this generates a random private key */537 crypto_kpp_set_secret(kpp, encoded_key, buf_len);538 539 /* salt is now the public point of this private key */540 req = kpp_request_alloc(kpp, GFP_KERNEL);541 if (!req)542 goto out;543 kpp_request_set_input(req, NULL, 0);544 kpp_request_set_output(req, s, EC_PT_SZ*2);545 crypto_kpp_generate_public_key(req);546 /*547 * we're not done: now we have to compute the shared secret548 * which is our private key multiplied by the tpm_key public549 * point, we actually only take the x point and discard the y550 * point and feed it through KDFe to get the final secret salt551 */552 sg_set_buf(&s[0], chip->null_ec_key_x, EC_PT_SZ);553 sg_set_buf(&s[1], chip->null_ec_key_y, EC_PT_SZ);554 kpp_request_set_input(req, s, EC_PT_SZ*2);555 sg_init_one(d, auth->salt, EC_PT_SZ);556 kpp_request_set_output(req, d, EC_PT_SZ);557 crypto_kpp_compute_shared_secret(req);558 kpp_request_free(req);559 560 /*561 * pass the shared secret through KDFe for salt. Note salt562 * area is used both for input shared secret and output salt.563 * This works because KDFe fully consumes the secret before it564 * writes the salt565 */566 tpm2_KDFe(auth->salt, "SECRET", x, chip->null_ec_key_x, auth->salt);567 568 out:569 crypto_free_kpp(kpp);570}571 572/**573 * tpm_buf_fill_hmac_session() - finalize the session HMAC574 * @chip: the TPM chip structure575 * @buf: The buffer to be appended576 *577 * This command must not be called until all of the parameters have578 * been appended to @buf otherwise the computed HMAC will be579 * incorrect.580 *581 * This function computes and fills in the session HMAC using the582 * session key and, if TPM2_SA_DECRYPT was specified, computes the583 * encryption key and encrypts the first parameter of the command584 * buffer with it.585 *586 * As with most tpm_buf operations, success is assumed because failure587 * will be caused by an incorrect programming model and indicated by a588 * kernel message.589 */590void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf)591{592 u32 cc, handles, val;593 struct tpm2_auth *auth = chip->auth;594 int i;595 struct tpm_header *head = (struct tpm_header *)buf->data;596 off_t offset_s = TPM_HEADER_SIZE, offset_p;597 u8 *hmac = NULL;598 u32 attrs;599 u8 cphash[SHA256_DIGEST_SIZE];600 struct sha256_state sctx;601 602 if (!auth)603 return;604 605 /* save the command code in BE format */606 auth->ordinal = head->ordinal;607 608 cc = be32_to_cpu(head->ordinal);609 610 i = tpm2_find_cc(chip, cc);611 if (i < 0) {612 dev_err(&chip->dev, "Command 0x%x not found in TPM\n", cc);613 return;614 }615 attrs = chip->cc_attrs_tbl[i];616 617 handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0);618 619 /*620 * just check the names, it's easy to make mistakes. This621 * would happen if someone added a handle via622 * tpm_buf_append_u32() instead of tpm_buf_append_name()623 */624 for (i = 0; i < handles; i++) {625 u32 handle = tpm_buf_read_u32(buf, &offset_s);626 627 if (auth->name_h[i] != handle) {628 dev_err(&chip->dev, "TPM: handle %d wrong for name\n",629 i);630 return;631 }632 }633 /* point offset_s to the start of the sessions */634 val = tpm_buf_read_u32(buf, &offset_s);635 /* point offset_p to the start of the parameters */636 offset_p = offset_s + val;637 for (i = 1; offset_s < offset_p; i++) {638 u32 handle = tpm_buf_read_u32(buf, &offset_s);639 u16 len;640 u8 a;641 642 /* nonce (already in auth) */643 len = tpm_buf_read_u16(buf, &offset_s);644 offset_s += len;645 646 a = tpm_buf_read_u8(buf, &offset_s);647 648 len = tpm_buf_read_u16(buf, &offset_s);649 if (handle == auth->handle && auth->attrs == a) {650 hmac = &buf->data[offset_s];651 /*652 * save our session number so we know which653 * session in the response belongs to us654 */655 auth->session = i;656 }657 658 offset_s += len;659 }660 if (offset_s != offset_p) {661 dev_err(&chip->dev, "TPM session length is incorrect\n");662 return;663 }664 if (!hmac) {665 dev_err(&chip->dev, "TPM could not find HMAC session\n");666 return;667 }668 669 /* encrypt before HMAC */670 if (auth->attrs & TPM2_SA_DECRYPT) {671 u16 len;672 673 /* need key and IV */674 tpm2_KDFa(auth->session_key, SHA256_DIGEST_SIZE675 + auth->passphrase_len, "CFB", auth->our_nonce,676 auth->tpm_nonce, AES_KEY_BYTES + AES_BLOCK_SIZE,677 auth->scratch);678 679 len = tpm_buf_read_u16(buf, &offset_p);680 aes_expandkey(&auth->aes_ctx, auth->scratch, AES_KEY_BYTES);681 aescfb_encrypt(&auth->aes_ctx, &buf->data[offset_p],682 &buf->data[offset_p], len,683 auth->scratch + AES_KEY_BYTES);684 /* reset p to beginning of parameters for HMAC */685 offset_p -= 2;686 }687 688 sha256_init(&sctx);689 /* ordinal is already BE */690 sha256_update(&sctx, (u8 *)&head->ordinal, sizeof(head->ordinal));691 /* add the handle names */692 for (i = 0; i < handles; i++) {693 enum tpm2_mso_type mso = tpm2_handle_mso(auth->name_h[i]);694 695 if (mso == TPM2_MSO_PERSISTENT ||696 mso == TPM2_MSO_VOLATILE ||697 mso == TPM2_MSO_NVRAM) {698 sha256_update(&sctx, auth->name[i],699 name_size(auth->name[i]));700 } else {701 __be32 h = cpu_to_be32(auth->name_h[i]);702 703 sha256_update(&sctx, (u8 *)&h, 4);704 }705 }706 if (offset_s != tpm_buf_length(buf))707 sha256_update(&sctx, &buf->data[offset_s],708 tpm_buf_length(buf) - offset_s);709 sha256_final(&sctx, cphash);710 711 /* now calculate the hmac */712 tpm2_hmac_init(&sctx, auth->session_key, sizeof(auth->session_key)713 + auth->passphrase_len);714 sha256_update(&sctx, cphash, sizeof(cphash));715 sha256_update(&sctx, auth->our_nonce, sizeof(auth->our_nonce));716 sha256_update(&sctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));717 sha256_update(&sctx, &auth->attrs, 1);718 tpm2_hmac_final(&sctx, auth->session_key, sizeof(auth->session_key)719 + auth->passphrase_len, hmac);720}721EXPORT_SYMBOL(tpm_buf_fill_hmac_session);722 723/**724 * tpm_buf_check_hmac_response() - check the TPM return HMAC for correctness725 * @chip: the TPM chip structure726 * @buf: the original command buffer (which now contains the response)727 * @rc: the return code from tpm_transmit_cmd728 *729 * If @rc is non zero, @buf may not contain an actual return, so @rc730 * is passed through as the return and the session cleaned up and731 * de-allocated if required (this is required if732 * TPM2_SA_CONTINUE_SESSION was not specified as a session flag).733 *734 * If @rc is zero, the response HMAC is computed against the returned735 * @buf and matched to the TPM one in the session area. If there is a736 * mismatch, an error is logged and -EINVAL returned.737 *738 * The reason for this is that the command issue and HMAC check739 * sequence should look like:740 *741 * rc = tpm_transmit_cmd(...);742 * rc = tpm_buf_check_hmac_response(&buf, auth, rc);743 * if (rc)744 * ...745 *746 * Which is easily layered into the current contrl flow.747 *748 * Returns: 0 on success or an error.749 */750int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,751 int rc)752{753 struct tpm_header *head = (struct tpm_header *)buf->data;754 struct tpm2_auth *auth = chip->auth;755 off_t offset_s, offset_p;756 u8 rphash[SHA256_DIGEST_SIZE];757 u32 attrs, cc;758 struct sha256_state sctx;759 u16 tag = be16_to_cpu(head->tag);760 int parm_len, len, i, handles;761 762 if (!auth)763 return rc;764 765 cc = be32_to_cpu(auth->ordinal);766 767 if (auth->session >= TPM_HEADER_SIZE) {768 WARN(1, "tpm session not filled correctly\n");769 goto out;770 }771 772 if (rc != 0)773 /* pass non success rc through and close the session */774 goto out;775 776 rc = -EINVAL;777 if (tag != TPM2_ST_SESSIONS) {778 dev_err(&chip->dev, "TPM: HMAC response check has no sessions tag\n");779 goto out;780 }781 782 i = tpm2_find_cc(chip, cc);783 if (i < 0)784 goto out;785 attrs = chip->cc_attrs_tbl[i];786 handles = (attrs >> TPM2_CC_ATTR_RHANDLE) & 1;787 788 /* point to area beyond handles */789 offset_s = TPM_HEADER_SIZE + handles * 4;790 parm_len = tpm_buf_read_u32(buf, &offset_s);791 offset_p = offset_s;792 offset_s += parm_len;793 /* skip over any sessions before ours */794 for (i = 0; i < auth->session - 1; i++) {795 len = tpm_buf_read_u16(buf, &offset_s);796 offset_s += len + 1;797 len = tpm_buf_read_u16(buf, &offset_s);798 offset_s += len;799 }800 /* TPM nonce */801 len = tpm_buf_read_u16(buf, &offset_s);802 if (offset_s + len > tpm_buf_length(buf))803 goto out;804 if (len != SHA256_DIGEST_SIZE)805 goto out;806 memcpy(auth->tpm_nonce, &buf->data[offset_s], len);807 offset_s += len;808 attrs = tpm_buf_read_u8(buf, &offset_s);809 len = tpm_buf_read_u16(buf, &offset_s);810 if (offset_s + len != tpm_buf_length(buf))811 goto out;812 if (len != SHA256_DIGEST_SIZE)813 goto out;814 /*815 * offset_s points to the HMAC. now calculate comparison, beginning816 * with rphash817 */818 sha256_init(&sctx);819 /* yes, I know this is now zero, but it's what the standard says */820 sha256_update(&sctx, (u8 *)&head->return_code,821 sizeof(head->return_code));822 /* ordinal is already BE */823 sha256_update(&sctx, (u8 *)&auth->ordinal, sizeof(auth->ordinal));824 sha256_update(&sctx, &buf->data[offset_p], parm_len);825 sha256_final(&sctx, rphash);826 827 /* now calculate the hmac */828 tpm2_hmac_init(&sctx, auth->session_key, sizeof(auth->session_key)829 + auth->passphrase_len);830 sha256_update(&sctx, rphash, sizeof(rphash));831 sha256_update(&sctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));832 sha256_update(&sctx, auth->our_nonce, sizeof(auth->our_nonce));833 sha256_update(&sctx, &auth->attrs, 1);834 /* we're done with the rphash, so put our idea of the hmac there */835 tpm2_hmac_final(&sctx, auth->session_key, sizeof(auth->session_key)836 + auth->passphrase_len, rphash);837 if (memcmp(rphash, &buf->data[offset_s], SHA256_DIGEST_SIZE) == 0) {838 rc = 0;839 } else {840 dev_err(&chip->dev, "TPM: HMAC check failed\n");841 goto out;842 }843 844 /* now do response decryption */845 if (auth->attrs & TPM2_SA_ENCRYPT) {846 /* need key and IV */847 tpm2_KDFa(auth->session_key, SHA256_DIGEST_SIZE848 + auth->passphrase_len, "CFB", auth->tpm_nonce,849 auth->our_nonce, AES_KEY_BYTES + AES_BLOCK_SIZE,850 auth->scratch);851 852 len = tpm_buf_read_u16(buf, &offset_p);853 aes_expandkey(&auth->aes_ctx, auth->scratch, AES_KEY_BYTES);854 aescfb_decrypt(&auth->aes_ctx, &buf->data[offset_p],855 &buf->data[offset_p], len,856 auth->scratch + AES_KEY_BYTES);857 }858 859 out:860 if ((auth->attrs & TPM2_SA_CONTINUE_SESSION) == 0) {861 if (rc)862 /* manually close the session if it wasn't consumed */863 tpm2_flush_context(chip, auth->handle);864 865 kfree_sensitive(auth);866 chip->auth = NULL;867 } else {868 /* reset for next use */869 auth->session = TPM_HEADER_SIZE;870 }871 872 return rc;873}874EXPORT_SYMBOL(tpm_buf_check_hmac_response);875 876/**877 * tpm2_end_auth_session() - kill the allocated auth session878 * @chip: the TPM chip structure879 *880 * ends the session started by tpm2_start_auth_session and frees all881 * the resources. Under normal conditions,882 * tpm_buf_check_hmac_response() will correctly end the session if883 * required, so this function is only for use in error legs that will884 * bypass the normal invocation of tpm_buf_check_hmac_response().885 */886void tpm2_end_auth_session(struct tpm_chip *chip)887{888 struct tpm2_auth *auth = chip->auth;889 890 if (!auth)891 return;892 893 tpm2_flush_context(chip, auth->handle);894 kfree_sensitive(auth);895 chip->auth = NULL;896}897EXPORT_SYMBOL(tpm2_end_auth_session);898 899static int tpm2_parse_start_auth_session(struct tpm2_auth *auth,900 struct tpm_buf *buf)901{902 struct tpm_header *head = (struct tpm_header *)buf->data;903 u32 tot_len = be32_to_cpu(head->length);904 off_t offset = TPM_HEADER_SIZE;905 u32 val;906 907 /* we're starting after the header so adjust the length */908 tot_len -= TPM_HEADER_SIZE;909 910 /* should have handle plus nonce */911 if (tot_len != 4 + 2 + sizeof(auth->tpm_nonce))912 return -EINVAL;913 914 auth->handle = tpm_buf_read_u32(buf, &offset);915 val = tpm_buf_read_u16(buf, &offset);916 if (val != sizeof(auth->tpm_nonce))917 return -EINVAL;918 memcpy(auth->tpm_nonce, &buf->data[offset], sizeof(auth->tpm_nonce));919 /* now compute the session key from the nonces */920 tpm2_KDFa(auth->salt, sizeof(auth->salt), "ATH", auth->tpm_nonce,921 auth->our_nonce, sizeof(auth->session_key),922 auth->session_key);923 924 return 0;925}926 927static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)928{929 unsigned int offset = 0; /* dummy offset for null seed context */930 u8 name[SHA256_DIGEST_SIZE + 2];931 u32 tmp_null_key;932 int rc;933 934 rc = tpm2_load_context(chip, chip->null_key_context, &offset,935 &tmp_null_key);936 if (rc != -EINVAL) {937 if (!rc)938 *null_key = tmp_null_key;939 goto err;940 }941 942 /* Try to re-create null key, given the integrity failure: */943 rc = tpm2_create_primary(chip, TPM2_RH_NULL, &tmp_null_key, name);944 if (rc)945 goto err;946 947 /* Return null key if the name has not been changed: */948 if (!memcmp(name, chip->null_key_name, sizeof(name))) {949 *null_key = tmp_null_key;950 return 0;951 }952 953 /* Deduce from the name change TPM interference: */954 dev_err(&chip->dev, "null key integrity check failed\n");955 tpm2_flush_context(chip, tmp_null_key);956 957err:958 if (rc) {959 chip->flags |= TPM_CHIP_FLAG_DISABLE;960 rc = -ENODEV;961 }962 return rc;963}964 965/**966 * tpm2_start_auth_session() - create a HMAC authentication session with the TPM967 * @chip: the TPM chip structure to create the session with968 *969 * This function loads the NULL seed from its saved context and starts970 * an authentication session on the null seed, fills in the971 * @chip->auth structure to contain all the session details necessary972 * for performing the HMAC, encrypt and decrypt operations and973 * returns. The NULL seed is flushed before this function returns.974 *975 * Return: zero on success or actual error encountered.976 */977int tpm2_start_auth_session(struct tpm_chip *chip)978{979 struct tpm2_auth *auth;980 struct tpm_buf buf;981 u32 null_key;982 int rc;983 984 if (chip->auth) {985 dev_warn_once(&chip->dev, "auth session is active\n");986 return 0;987 }988 989 auth = kzalloc(sizeof(*auth), GFP_KERNEL);990 if (!auth)991 return -ENOMEM;992 993 rc = tpm2_load_null(chip, &null_key);994 if (rc)995 goto out;996 997 auth->session = TPM_HEADER_SIZE;998 999 rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_START_AUTH_SESS);1000 if (rc)1001 goto out;1002 1003 /* salt key handle */1004 tpm_buf_append_u32(&buf, null_key);1005 /* bind key handle */1006 tpm_buf_append_u32(&buf, TPM2_RH_NULL);1007 /* nonce caller */1008 get_random_bytes(auth->our_nonce, sizeof(auth->our_nonce));1009 tpm_buf_append_u16(&buf, sizeof(auth->our_nonce));1010 tpm_buf_append(&buf, auth->our_nonce, sizeof(auth->our_nonce));1011 1012 /* append encrypted salt and squirrel away unencrypted in auth */1013 tpm_buf_append_salt(&buf, chip, auth);1014 /* session type (HMAC, audit or policy) */1015 tpm_buf_append_u8(&buf, TPM2_SE_HMAC);1016 1017 /* symmetric encryption parameters */1018 /* symmetric algorithm */1019 tpm_buf_append_u16(&buf, TPM_ALG_AES);1020 /* bits for symmetric algorithm */1021 tpm_buf_append_u16(&buf, AES_KEY_BITS);1022 /* symmetric algorithm mode (must be CFB) */1023 tpm_buf_append_u16(&buf, TPM_ALG_CFB);1024 /* hash algorithm for session */1025 tpm_buf_append_u16(&buf, TPM_ALG_SHA256);1026 1027 rc = tpm_transmit_cmd(chip, &buf, 0, "start auth session");1028 tpm2_flush_context(chip, null_key);1029 1030 if (rc == TPM2_RC_SUCCESS)1031 rc = tpm2_parse_start_auth_session(auth, &buf);1032 1033 tpm_buf_destroy(&buf);1034 1035 if (rc == TPM2_RC_SUCCESS) {1036 chip->auth = auth;1037 return 0;1038 }1039 1040out:1041 kfree_sensitive(auth);1042 return rc;1043}1044EXPORT_SYMBOL(tpm2_start_auth_session);1045 1046/*1047 * A mask containing the object attributes for the kernel held null primary key1048 * used in HMAC encryption. For more information on specific attributes look up1049 * to "8.3 TPMA_OBJECT (Object Attributes)".1050 */1051#define TPM2_OA_NULL_KEY ( \1052 TPM2_OA_NO_DA | \1053 TPM2_OA_FIXED_TPM | \1054 TPM2_OA_FIXED_PARENT | \1055 TPM2_OA_SENSITIVE_DATA_ORIGIN | \1056 TPM2_OA_USER_WITH_AUTH | \1057 TPM2_OA_DECRYPT | \1058 TPM2_OA_RESTRICTED)1059 1060/**1061 * tpm2_parse_create_primary() - parse the data returned from TPM_CC_CREATE_PRIMARY1062 *1063 * @chip: The TPM the primary was created under1064 * @buf: The response buffer from the chip1065 * @handle: pointer to be filled in with the return handle of the primary1066 * @hierarchy: The hierarchy the primary was created for1067 * @name: pointer to be filled in with the primary key name1068 *1069 * Return:1070 * * 0 - OK1071 * * -errno - A system error1072 * * TPM_RC - A TPM error1073 */1074static int tpm2_parse_create_primary(struct tpm_chip *chip, struct tpm_buf *buf,1075 u32 *handle, u32 hierarchy, u8 *name)1076{1077 struct tpm_header *head = (struct tpm_header *)buf->data;1078 off_t offset_r = TPM_HEADER_SIZE, offset_t;1079 u16 len = TPM_HEADER_SIZE;1080 u32 total_len = be32_to_cpu(head->length);1081 u32 val, param_len, keyhandle;1082 1083 keyhandle = tpm_buf_read_u32(buf, &offset_r);1084 if (handle)1085 *handle = keyhandle;1086 else1087 tpm2_flush_context(chip, keyhandle);1088 1089 param_len = tpm_buf_read_u32(buf, &offset_r);1090 /*1091 * param_len doesn't include the header, but all the other1092 * lengths and offsets do, so add it to parm len to make1093 * the comparisons easier1094 */1095 param_len += TPM_HEADER_SIZE;1096 1097 if (param_len + 8 > total_len)1098 return -EINVAL;1099 len = tpm_buf_read_u16(buf, &offset_r);1100 offset_t = offset_r;1101 if (name) {1102 /*1103 * now we have the public area, compute the name of1104 * the object1105 */1106 put_unaligned_be16(TPM_ALG_SHA256, name);1107 sha256(&buf->data[offset_r], len, name + 2);1108 }1109 1110 /* validate the public key */1111 val = tpm_buf_read_u16(buf, &offset_t);1112 1113 /* key type (must be what we asked for) */1114 if (val != TPM_ALG_ECC)1115 return -EINVAL;1116 val = tpm_buf_read_u16(buf, &offset_t);1117 1118 /* name algorithm */1119 if (val != TPM_ALG_SHA256)1120 return -EINVAL;1121 val = tpm_buf_read_u32(buf, &offset_t);1122 1123 /* object properties */1124 if (val != TPM2_OA_NULL_KEY)1125 return -EINVAL;1126 1127 /* auth policy (empty) */1128 val = tpm_buf_read_u16(buf, &offset_t);1129 if (val != 0)1130 return -EINVAL;1131 1132 /* symmetric key parameters */1133 val = tpm_buf_read_u16(buf, &offset_t);1134 if (val != TPM_ALG_AES)1135 return -EINVAL;1136 1137 /* symmetric key length */1138 val = tpm_buf_read_u16(buf, &offset_t);1139 if (val != AES_KEY_BITS)1140 return -EINVAL;1141 1142 /* symmetric encryption scheme */1143 val = tpm_buf_read_u16(buf, &offset_t);1144 if (val != TPM_ALG_CFB)1145 return -EINVAL;1146 1147 /* signing scheme */1148 val = tpm_buf_read_u16(buf, &offset_t);1149 if (val != TPM_ALG_NULL)1150 return -EINVAL;1151 1152 /* ECC Curve */1153 val = tpm_buf_read_u16(buf, &offset_t);1154 if (val != TPM2_ECC_NIST_P256)1155 return -EINVAL;1156 1157 /* KDF Scheme */1158 val = tpm_buf_read_u16(buf, &offset_t);1159 if (val != TPM_ALG_NULL)1160 return -EINVAL;1161 1162 /* extract public key (x and y points) */1163 val = tpm_buf_read_u16(buf, &offset_t);1164 if (val != EC_PT_SZ)1165 return -EINVAL;1166 memcpy(chip->null_ec_key_x, &buf->data[offset_t], val);1167 offset_t += val;1168 val = tpm_buf_read_u16(buf, &offset_t);1169 if (val != EC_PT_SZ)1170 return -EINVAL;1171 memcpy(chip->null_ec_key_y, &buf->data[offset_t], val);1172 offset_t += val;1173 1174 /* original length of the whole TPM2B */1175 offset_r += len;1176 1177 /* should have exactly consumed the TPM2B public structure */1178 if (offset_t != offset_r)1179 return -EINVAL;1180 if (offset_r > param_len)1181 return -EINVAL;1182 1183 /* creation data (skip) */1184 len = tpm_buf_read_u16(buf, &offset_r);1185 offset_r += len;1186 if (offset_r > param_len)1187 return -EINVAL;1188 1189 /* creation digest (must be sha256) */1190 len = tpm_buf_read_u16(buf, &offset_r);1191 offset_r += len;1192 if (len != SHA256_DIGEST_SIZE || offset_r > param_len)1193 return -EINVAL;1194 1195 /* TPMT_TK_CREATION follows */1196 /* tag, must be TPM_ST_CREATION (0x8021) */1197 val = tpm_buf_read_u16(buf, &offset_r);1198 if (val != TPM2_ST_CREATION || offset_r > param_len)1199 return -EINVAL;1200 1201 /* hierarchy */1202 val = tpm_buf_read_u32(buf, &offset_r);1203 if (val != hierarchy || offset_r > param_len)1204 return -EINVAL;1205 1206 /* the ticket digest HMAC (might not be sha256) */1207 len = tpm_buf_read_u16(buf, &offset_r);1208 offset_r += len;1209 if (offset_r > param_len)1210 return -EINVAL;1211 1212 /*1213 * finally we have the name, which is a sha256 digest plus a 21214 * byte algorithm type1215 */1216 len = tpm_buf_read_u16(buf, &offset_r);1217 if (offset_r + len != param_len + 8)1218 return -EINVAL;1219 if (len != SHA256_DIGEST_SIZE + 2)1220 return -EINVAL;1221 1222 if (memcmp(chip->null_key_name, &buf->data[offset_r],1223 SHA256_DIGEST_SIZE + 2) != 0) {1224 dev_err(&chip->dev, "NULL Seed name comparison failed\n");1225 return -EINVAL;1226 }1227 1228 return 0;1229}1230 1231/**1232 * tpm2_create_primary() - create a primary key using a fixed P-256 template1233 *1234 * @chip: the TPM chip to create under1235 * @hierarchy: The hierarchy handle to create under1236 * @handle: The returned volatile handle on success1237 * @name: The name of the returned key1238 *1239 * For platforms that might not have a persistent primary, this can be1240 * used to create one quickly on the fly (it uses Elliptic Curve not1241 * RSA, so even slow TPMs can create one fast). The template uses the1242 * TCG mandated H one for non-endorsement ECC primaries, i.e. P-2561243 * elliptic curve (the only current one all TPM2s are required to1244 * have) a sha256 name hash and no policy.1245 *1246 * Return:1247 * * 0 - OK1248 * * -errno - A system error1249 * * TPM_RC - A TPM error1250 */1251static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy,1252 u32 *handle, u8 *name)1253{1254 int rc;1255 struct tpm_buf buf;1256 struct tpm_buf template;1257 1258 rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE_PRIMARY);1259 if (rc)1260 return rc;1261 1262 rc = tpm_buf_init_sized(&template);1263 if (rc) {1264 tpm_buf_destroy(&buf);1265 return rc;1266 }1267 1268 /*1269 * create the template. Note: in order for userspace to1270 * verify the security of the system, it will have to create1271 * and certify this NULL primary, meaning all the template1272 * parameters will have to be identical, so conform exactly to1273 * the TCG TPM v2.0 Provisioning Guidance for the SRK ECC1274 * key H template (H has zero size unique points)1275 */1276 1277 /* key type */1278 tpm_buf_append_u16(&template, TPM_ALG_ECC);1279 1280 /* name algorithm */1281 tpm_buf_append_u16(&template, TPM_ALG_SHA256);1282 1283 /* object properties */1284 tpm_buf_append_u32(&template, TPM2_OA_NULL_KEY);1285 1286 /* sauth policy (empty) */1287 tpm_buf_append_u16(&template, 0);1288 1289 /* BEGIN parameters: key specific; for ECC*/1290 1291 /* symmetric algorithm */1292 tpm_buf_append_u16(&template, TPM_ALG_AES);1293 1294 /* bits for symmetric algorithm */1295 tpm_buf_append_u16(&template, AES_KEY_BITS);1296 1297 /* algorithm mode (must be CFB) */1298 tpm_buf_append_u16(&template, TPM_ALG_CFB);1299 1300 /* scheme (NULL means any scheme) */1301 tpm_buf_append_u16(&template, TPM_ALG_NULL);1302 1303 /* ECC Curve ID */1304 tpm_buf_append_u16(&template, TPM2_ECC_NIST_P256);1305 1306 /* KDF Scheme */1307 tpm_buf_append_u16(&template, TPM_ALG_NULL);1308 1309 /* unique: key specific; for ECC it is two zero size points */1310 tpm_buf_append_u16(&template, 0);1311 tpm_buf_append_u16(&template, 0);1312 1313 /* END parameters */1314 1315 /* primary handle */1316 tpm_buf_append_u32(&buf, hierarchy);1317 tpm_buf_append_empty_auth(&buf, TPM2_RS_PW);1318 1319 /* sensitive create size is 4 for two empty buffers */1320 tpm_buf_append_u16(&buf, 4);1321 1322 /* sensitive create auth data (empty) */1323 tpm_buf_append_u16(&buf, 0);1324 1325 /* sensitive create sensitive data (empty) */1326 tpm_buf_append_u16(&buf, 0);1327 1328 /* the public template */1329 tpm_buf_append(&buf, template.data, template.length);1330 tpm_buf_destroy(&template);1331 1332 /* outside info (empty) */1333 tpm_buf_append_u16(&buf, 0);1334 1335 /* creation PCR (none) */1336 tpm_buf_append_u32(&buf, 0);1337 1338 rc = tpm_transmit_cmd(chip, &buf, 0,1339 "attempting to create NULL primary");1340 1341 if (rc == TPM2_RC_SUCCESS)1342 rc = tpm2_parse_create_primary(chip, &buf, handle, hierarchy,1343 name);1344 1345 tpm_buf_destroy(&buf);1346 1347 return rc;1348}1349 1350static int tpm2_create_null_primary(struct tpm_chip *chip)1351{1352 u32 null_key;1353 int rc;1354 1355 rc = tpm2_create_primary(chip, TPM2_RH_NULL, &null_key,1356 chip->null_key_name);1357 1358 if (rc == TPM2_RC_SUCCESS) {1359 unsigned int offset = 0; /* dummy offset for null key context */1360 1361 rc = tpm2_save_context(chip, null_key, chip->null_key_context,1362 sizeof(chip->null_key_context), &offset);1363 tpm2_flush_context(chip, null_key);1364 }1365 1366 return rc;1367}1368 1369/**1370 * tpm2_sessions_init() - start of day initialization for the sessions code1371 * @chip: TPM chip1372 *1373 * Derive and context save the null primary and allocate memory in the1374 * struct tpm_chip for the authorizations.1375 *1376 * Return:1377 * * 0 - OK1378 * * -errno - A system error1379 * * TPM_RC - A TPM error1380 */1381int tpm2_sessions_init(struct tpm_chip *chip)1382{1383 int rc;1384 1385 rc = tpm2_create_null_primary(chip);1386 if (rc) {1387 dev_err(&chip->dev, "null key creation failed with %d\n", rc);1388 return rc;1389 }1390 1391 return rc;1392}1393EXPORT_SYMBOL(tpm2_sessions_init);1394#endif /* CONFIG_TCG_TPM2_HMAC */1395