Skip to content

Commit

Permalink
Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/…
Browse files Browse the repository at this point in the history 
…git/jmorris/linux-security

Pull TPM updates from James Morris:

 - Migrate away from PM runtime as explicit cmdReady/goIdle transactions
   for every command is a spec requirement. PM runtime adds only a layer
   of complexity on our case.

 - tpm_tis drivers can now specify the hwrng quality.

 - TPM 2.0 code uses now tpm_buf for constructing messages. Jarkko
   thinks Tomas Winkler has done the same for TPM 1.2, and will start
   digging those changes from the patchwork in the near future.

 - Bug fixes and clean ups

* 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  ima: Get rid of ima_used_chip and use ima_tpm_chip != NULL instead
  ima: Use tpm_default_chip() and call TPM functions with a tpm_chip
  tpm: replace TPM_TRANSMIT_RAW with TPM_TRANSMIT_NESTED
  tpm: Convert tpm_find_get_ops() to use tpm_default_chip()
  tpm: Implement tpm_default_chip() to find a TPM chip
  tpm: rename tpm_chip_find_get() to tpm_find_get_ops()
  tpm: Allow tpm_tis drivers to set hwrng quality.
  tpm: Return the actual size when receiving an unsupported command
  tpm: separate cmd_ready/go_idle from runtime_pm
  tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
  tpm_tis_spi: Pass the SPI IRQ down to the driver
  tpm: migrate tpm2_get_random() to use struct tpm_buf
  tpm: migrate tpm2_get_tpm_pt() to use struct tpm_buf
  tpm: migrate tpm2_probe() to use struct tpm_buf
  tpm: migrate tpm2_shutdown() to use struct tpm_buf
  • Loading branch information
@torvalds
torvalds committed Aug 16, 2018
2 parents 04743f8 + 5da08f7 commit c715ebe
Show file tree
Hide file tree
Showing 16 changed files with 289 additions and 308 deletions.
68 changes: 46 additions & 22 deletions drivers/char/tpm/tpm-chip.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,42 +81,66 @@ void tpm_put_ops(struct tpm_chip *chip)
EXPORT_SYMBOL_GPL(tpm_put_ops);

/**
* tpm_chip_find_get() - find and reserve a TPM chip
* tpm_default_chip() - find a TPM chip and get a reference to it
*/
struct tpm_chip *tpm_default_chip(void)
{
struct tpm_chip *chip, *res = NULL;
int chip_num = 0;
int chip_prev;

mutex_lock(&idr_lock);

do {
chip_prev = chip_num;
chip = idr_get_next(&dev_nums_idr, &chip_num);
if (chip) {
get_device(&chip->dev);
res = chip;
break;
}
} while (chip_prev != chip_num);

mutex_unlock(&idr_lock);

return res;
}
EXPORT_SYMBOL_GPL(tpm_default_chip);

/**
* tpm_find_get_ops() - find and reserve a TPM chip
* @chip: a &struct tpm_chip instance, %NULL for the default chip
*
* Finds a TPM chip and reserves its class device and operations. The chip must
* be released with tpm_chip_put_ops() after use.
* be released with tpm_put_ops() after use.
* This function is for internal use only. It supports existing TPM callers
* by accepting NULL, but those callers should be converted to pass in a chip
* directly.
*
* Return:
* A reserved &struct tpm_chip instance.
* %NULL if a chip is not found.
* %NULL if the chip is not available.
*/
struct tpm_chip *tpm_chip_find_get(struct tpm_chip *chip)
struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip)
{
struct tpm_chip *res = NULL;
int chip_num = 0;
int chip_prev;

mutex_lock(&idr_lock);
int rc;

if (!chip) {
do {
chip_prev = chip_num;
chip = idr_get_next(&dev_nums_idr, &chip_num);
if (chip && !tpm_try_get_ops(chip)) {
res = chip;
break;
}
} while (chip_prev != chip_num);
} else {
if (chip) {
if (!tpm_try_get_ops(chip))
res = chip;
return chip;
return NULL;
}

mutex_unlock(&idr_lock);

return res;
chip = tpm_default_chip();
if (!chip)
return NULL;
rc = tpm_try_get_ops(chip);
/* release additional reference we got from tpm_default_chip() */
put_device(&chip->dev);
if (rc)
return NULL;
return chip;
}

/**
Expand Down
72 changes: 51 additions & 21 deletions drivers/char/tpm/tpm-interface.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@
#include <linux/mutex.h>
#include <linux/spinlock.h>
#include <linux/freezer.h>
#include <linux/pm_runtime.h>
#include <linux/tpm_eventlog.h>

#include "tpm.h"
Expand Down Expand Up @@ -369,10 +368,13 @@ static int tpm_validate_command(struct tpm_chip *chip,
return -EINVAL;
}

static int tpm_request_locality(struct tpm_chip *chip)
static int tpm_request_locality(struct tpm_chip *chip, unsigned int flags)
{
int rc;

if (flags & TPM_TRANSMIT_NESTED)
return 0;

if (!chip->ops->request_locality)
return 0;

Expand All @@ -385,10 +387,13 @@ static int tpm_request_locality(struct tpm_chip *chip)
return 0;
}

static void tpm_relinquish_locality(struct tpm_chip *chip)
static void tpm_relinquish_locality(struct tpm_chip *chip, unsigned int flags)
{
int rc;

if (flags & TPM_TRANSMIT_NESTED)
return;

if (!chip->ops->relinquish_locality)
return;

Expand All @@ -399,6 +404,28 @@ static void tpm_relinquish_locality(struct tpm_chip *chip)
chip->locality = -1;
}

static int tpm_cmd_ready(struct tpm_chip *chip, unsigned int flags)
{
if (flags & TPM_TRANSMIT_NESTED)
return 0;

if (!chip->ops->cmd_ready)
return 0;

return chip->ops->cmd_ready(chip);
}

static int tpm_go_idle(struct tpm_chip *chip, unsigned int flags)
{
if (flags & TPM_TRANSMIT_NESTED)
return 0;

if (!chip->ops->go_idle)
return 0;

return chip->ops->go_idle(chip);
}

static ssize_t tpm_try_transmit(struct tpm_chip *chip,
struct tpm_space *space,
u8 *buf, size_t bufsiz,
Expand All @@ -423,7 +450,7 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
TSS2_RESMGR_TPM_RC_LAYER);
return bufsiz;
return sizeof(*header);
}

if (bufsiz > TPM_BUFSIZE)
Expand All @@ -439,24 +466,24 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
return -E2BIG;
}

if (!(flags & TPM_TRANSMIT_UNLOCKED))
if (!(flags & TPM_TRANSMIT_UNLOCKED) && !(flags & TPM_TRANSMIT_NESTED))
mutex_lock(&chip->tpm_mutex);


if (chip->ops->clk_enable != NULL)
chip->ops->clk_enable(chip, true);

/* Store the decision as chip->locality will be changed. */
need_locality = chip->locality == -1;

if (!(flags & TPM_TRANSMIT_RAW) && need_locality) {
rc = tpm_request_locality(chip);
if (need_locality) {
rc = tpm_request_locality(chip, flags);
if (rc < 0)
goto out_no_locality;
}

if (chip->dev.parent)
pm_runtime_get_sync(chip->dev.parent);
rc = tpm_cmd_ready(chip, flags);
if (rc)
goto out;

rc = tpm2_prepare_space(chip, space, ordinal, buf);
if (rc)
Expand Down Expand Up @@ -516,19 +543,22 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
}

rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
if (rc)
dev_err(&chip->dev, "tpm2_commit_space: error %d\n", rc);

out:
if (chip->dev.parent)
pm_runtime_put_sync(chip->dev.parent);
rc = tpm_go_idle(chip, flags);
if (rc)
goto out;

if (need_locality)
tpm_relinquish_locality(chip);
tpm_relinquish_locality(chip, flags);

out_no_locality:
if (chip->ops->clk_enable != NULL)
chip->ops->clk_enable(chip, false);

if (!(flags & TPM_TRANSMIT_UNLOCKED))
if (!(flags & TPM_TRANSMIT_UNLOCKED) && !(flags & TPM_TRANSMIT_NESTED))
mutex_unlock(&chip->tpm_mutex);
return rc ? rc : len;
}
Expand Down Expand Up @@ -930,7 +960,7 @@ int tpm_is_tpm2(struct tpm_chip *chip)
{
int rc;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip)
return -ENODEV;

Expand All @@ -954,7 +984,7 @@ int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
{
int rc;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip)
return -ENODEV;
if (chip->flags & TPM_CHIP_FLAG_TPM2)
Expand Down Expand Up @@ -1013,7 +1043,7 @@ int tpm_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash)
u32 count = 0;
int i;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip)
return -ENODEV;

Expand Down Expand Up @@ -1142,7 +1172,7 @@ int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen)
{
int rc;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip)
return -ENODEV;

Expand Down Expand Up @@ -1262,7 +1292,7 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
return -EINVAL;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip)
return -ENODEV;

Expand Down Expand Up @@ -1324,7 +1354,7 @@ int tpm_seal_trusted(struct tpm_chip *chip, struct trusted_key_payload *payload,
{
int rc;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip || !(chip->flags & TPM_CHIP_FLAG_TPM2))
return -ENODEV;

Expand Down Expand Up @@ -1352,7 +1382,7 @@ int tpm_unseal_trusted(struct tpm_chip *chip,
{
int rc;

chip = tpm_chip_find_get(chip);
chip = tpm_find_get_ops(chip);
if (!chip || !(chip->flags & TPM_CHIP_FLAG_TPM2))
return -ENODEV;

Expand Down
31 changes: 20 additions & 11 deletions drivers/char/tpm/tpm.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -424,23 +424,24 @@ struct tpm_buf {
u8 *data;
};

static inline int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal)
static inline void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal)
{
struct tpm_input_header *head;
head = (struct tpm_input_header *)buf->data;
head->tag = cpu_to_be16(tag);
head->length = cpu_to_be32(sizeof(*head));
head->ordinal = cpu_to_be32(ordinal);
}

static inline int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal)
{
buf->data_page = alloc_page(GFP_HIGHUSER);
if (!buf->data_page)
return -ENOMEM;

buf->flags = 0;
buf->data = kmap(buf->data_page);

head = (struct tpm_input_header *) buf->data;

head->tag = cpu_to_be16(tag);
head->length = cpu_to_be32(sizeof(*head));
head->ordinal = cpu_to_be32(ordinal);

tpm_buf_reset(buf, tag, ordinal);
return 0;
}

Expand Down Expand Up @@ -511,9 +512,17 @@ extern const struct file_operations tpm_fops;
extern const struct file_operations tpmrm_fops;
extern struct idr dev_nums_idr;

/**
* enum tpm_transmit_flags - flags for tpm_transmit()
*
* @TPM_TRANSMIT_UNLOCKED: do not lock the chip
* @TPM_TRANSMIT_NESTED: discard setup steps (power management,
* locality) including locking (i.e. implicit
* UNLOCKED)
*/
enum tpm_transmit_flags {
TPM_TRANSMIT_UNLOCKED = BIT(0),
TPM_TRANSMIT_RAW = BIT(1),
TPM_TRANSMIT_NESTED = BIT(1),
};

ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
Expand All @@ -538,7 +547,7 @@ static inline void tpm_msleep(unsigned int delay_msec)
delay_msec * 1000);
};

struct tpm_chip *tpm_chip_find_get(struct tpm_chip *chip);
struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip);
__must_check int tpm_try_get_ops(struct tpm_chip *chip);
void tpm_put_ops(struct tpm_chip *chip);

Expand Down Expand Up @@ -569,7 +578,7 @@ static inline u32 tpm2_rc_value(u32 rc)
int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf);
int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count,
struct tpm2_digest *digests);
int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max);
int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
unsigned int flags);
int tpm2_seal_trusted(struct tpm_chip *chip,
Expand Down
Loading

0 comments on commit c715ebe

Please sign in to comment.