From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: linux-integrity@vger.kernel.org,
David Howells <dhowells@redhat.com>,
Mimi Zohar <zohar@linux.ibm.com>,
stable@vger.kernel.org, Sumit Garg <sumit.garg@linaro.org>,
kernel test robot <lkp@intel.com>,
Peter Huewe <peterhuewe@gmx.de>, Jason Gunthorpe <jgg@ziepe.ca>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Jerry Snitselaar <jsnitsel@redhat.com>,
Alexey Klimov <aklimov@redhat.com>,
open list <linux-kernel@vger.kernel.org>,
"open list:KEYS-TRUSTED" <keyrings@vger.kernel.org>,
"open list:SECURITY SUBSYSTEM"
<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v3 3/3] KEYS: trusted: Reserve TPM for seal and unseal operations
Date: Tue, 13 Oct 2020 02:39:27 +0000 [thread overview]
Message-ID: <20201013023927.GA71954@linux.intel.com> (raw)
In-Reply-To: <b56dd2e9f3934e24f08005b9c5588c54b4837ff6.camel@HansenPartnership.com>
On Mon, Oct 12, 2020 at 05:58:04PM -0700, James Bottomley wrote:
> On Tue, 2020-10-13 at 03:28 +0300, Jarkko Sakkinen wrote:
> [...]
> > diff --git a/include/linux/tpm.h b/include/linux/tpm.h
> > index 8f4ff39f51e7..f0ebce14d2f8 100644
> > --- a/include/linux/tpm.h
> > +++ b/include/linux/tpm.h
> > @@ -397,6 +397,10 @@ static inline u32 tpm2_rc_value(u32 rc)
> > #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
> >
> > extern int tpm_is_tpm2(struct tpm_chip *chip);
> > +extern __must_check int tpm_try_get_ops(struct tpm_chip *chip);
> > +extern void tpm_put_ops(struct tpm_chip *chip);
> > +extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct
> > tpm_buf *buf,
> > + size_t min_rsp_body_length, const char
> > *desc);
> > extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
> > struct tpm_digest *digest);
> > extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
> > @@ -410,7 +414,18 @@ static inline int tpm_is_tpm2(struct tpm_chip
> > *chip)
> > {
> > return -ENODEV;
> > }
> > -
> > +static inline int tpm_try_get_ops(struct tpm_chip *chip)
> > +{
> > + return -ENODEV;
> > +}
> > +static inline void tpm_put_ops(struct tpm_chip *chip)
> > +{
> > +}
> > +static inline ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct
> > tpm_buf *buf,
> > + size_t min_rsp_body_length,
> > const char *desc)
> > +{
> > + return -ENODEV;
> > +}
> > static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
>
> I don't think we want this, do we? That's only for API access which
> should be available when the TPM isn't selected. Given that get/put
> are TPM critical operations, they should only appear when inside code
> where the TPM has already been selected. If they appear outside TPM
> selected code, I think we want the compile to fail, which is why we
> don't want these backup definitions.
>
> James
OK, I'll change it.
Thanks.
/Jarkko
WARNING: multiple messages have this Message-ID (diff)
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: linux-integrity@vger.kernel.org,
David Howells <dhowells@redhat.com>,
Mimi Zohar <zohar@linux.ibm.com>,
stable@vger.kernel.org, Sumit Garg <sumit.garg@linaro.org>,
kernel test robot <lkp@intel.com>,
Peter Huewe <peterhuewe@gmx.de>, Jason Gunthorpe <jgg@ziepe.ca>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Jerry Snitselaar <jsnitsel@redhat.com>,
Alexey Klimov <aklimov@redhat.com>,
open list <linux-kernel@vger.kernel.org>,
"open list:KEYS-TRUSTED" <keyrings@vger.kernel.org>,
"open list:SECURITY SUBSYSTEM"
<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v3 3/3] KEYS: trusted: Reserve TPM for seal and unseal operations
Date: Tue, 13 Oct 2020 05:39:27 +0300 [thread overview]
Message-ID: <20201013023927.GA71954@linux.intel.com> (raw)
In-Reply-To: <b56dd2e9f3934e24f08005b9c5588c54b4837ff6.camel@HansenPartnership.com>
On Mon, Oct 12, 2020 at 05:58:04PM -0700, James Bottomley wrote:
> On Tue, 2020-10-13 at 03:28 +0300, Jarkko Sakkinen wrote:
> [...]
> > diff --git a/include/linux/tpm.h b/include/linux/tpm.h
> > index 8f4ff39f51e7..f0ebce14d2f8 100644
> > --- a/include/linux/tpm.h
> > +++ b/include/linux/tpm.h
> > @@ -397,6 +397,10 @@ static inline u32 tpm2_rc_value(u32 rc)
> > #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
> >
> > extern int tpm_is_tpm2(struct tpm_chip *chip);
> > +extern __must_check int tpm_try_get_ops(struct tpm_chip *chip);
> > +extern void tpm_put_ops(struct tpm_chip *chip);
> > +extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct
> > tpm_buf *buf,
> > + size_t min_rsp_body_length, const char
> > *desc);
> > extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
> > struct tpm_digest *digest);
> > extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
> > @@ -410,7 +414,18 @@ static inline int tpm_is_tpm2(struct tpm_chip
> > *chip)
> > {
> > return -ENODEV;
> > }
> > -
> > +static inline int tpm_try_get_ops(struct tpm_chip *chip)
> > +{
> > + return -ENODEV;
> > +}
> > +static inline void tpm_put_ops(struct tpm_chip *chip)
> > +{
> > +}
> > +static inline ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct
> > tpm_buf *buf,
> > + size_t min_rsp_body_length,
> > const char *desc)
> > +{
> > + return -ENODEV;
> > +}
> > static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
>
> I don't think we want this, do we? That's only for API access which
> should be available when the TPM isn't selected. Given that get/put
> are TPM critical operations, they should only appear when inside code
> where the TPM has already been selected. If they appear outside TPM
> selected code, I think we want the compile to fail, which is why we
> don't want these backup definitions.
>
> James
OK, I'll change it.
Thanks.
/Jarkko
next prev parent reply other threads:[~2020-10-13 2:39 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-13 0:28 [PATCH v3 0/3] KEYS, trusted: a bunch of bug fixes Jarkko Sakkinen
2020-10-13 0:28 ` [PATCH v3 1/3] KEYS: trusted: Fix incorrect handling of tpm_get_random() Jarkko Sakkinen
2020-10-13 0:28 ` Jarkko Sakkinen
2020-10-13 0:28 ` [PATCH v3 2/3] KEYS: trusted: Fix migratable=1 failing Jarkko Sakkinen
2020-10-13 0:28 ` Jarkko Sakkinen
2020-10-13 0:28 ` [PATCH v3 3/3] KEYS: trusted: Reserve TPM for seal and unseal operations Jarkko Sakkinen
2020-10-13 0:28 ` Jarkko Sakkinen
2020-10-13 0:58 ` James Bottomley
2020-10-13 0:58 ` James Bottomley
2020-10-13 2:39 ` Jarkko Sakkinen [this message]
2020-10-13 2:39 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201013023927.GA71954@linux.intel.com \
--to=jarkko.sakkinen@linux.intel.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=aklimov@redhat.com \
--cc=arnd@arndb.de \
--cc=dhowells@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=jgg@ziepe.ca \
--cc=jmorris@namei.org \
--cc=jsnitsel@redhat.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lkp@intel.com \
--cc=peterhuewe@gmx.de \
--cc=serge@hallyn.com \
--cc=stable@vger.kernel.org \
--cc=sumit.garg@linaro.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.