All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko@kernel.org>
To: linux-integrity@vger.kernel.org
Cc: Jarkko Sakkinen <jarkko@kernel.org>,
	David Howells <dhowells@redhat.com>,
	Paul Moore <paul@paul-moore.com>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	keyrings@vger.kernel.org (open list:KEYS/KEYRINGS),
	linux-security-module@vger.kernel.org (open list:SECURITY
	SUBSYSTEM), linux-kernel@vger.kernel.org (open list)
Subject: [PATCH v8 00/12] Streamline TPM2 HMAC sessions
Date: Tue, 16 Dec 2025 11:21:34 +0200	[thread overview]
Message-ID: <20251216092147.2326606-1-jarkko@kernel.org> (raw)

This patch set contains accumulated patches, which gradually improve 
TPM2 HMAC session management and TPM driver memory management.

RNG test
========

I run this test both TPM1 and TPM2 chips using QEMU and swtpm:

#!/bin/sh

ctrl_c() {
  set +e
  echo 0 > tracing_on
  echo nop > current_tracer
  echo BYE
  exit
}

trap ctrl_c EXIT INT
mount -t tracefs none /sys/kernel/tracing

set -e
cd /sys/kernel/tracing
echo function > current_tracer
echo p:tpm_get_random tpm_get_random > kprobe_events
echo tpm_get_random > set_ftrace_filter
echo 1 > tracing_on
cat /dev/hwrng > /dev/null &
echo > trace
cat trace_pipe &
sleep 10

Change Log
==========

v8:
- Patch was a bit out-of-sync after piling new stuff. Now it is somewhat
  sane: RNG patches first, then tpm2-sessions and finally managed
  tpm_buf allocations.
- I added inline comment on explaining why unconditional sha256_update()
  call is safe to do when managing only single authorization handle. 
v7:
- Updated cover letter to match better the current state of the patch
  set.
v6:
- OK, so I decided to send one more update with managed allocations
  moved to the tail so that it does not block reviewing more trivial
  patches.
- Trimmed some of the patches and improved commit messages.
v5:
- I decided to add the managed allocation patch to this and take it from
  the master branch for the time being, as it needs more eyes despite
  having already one reviewed-by tag (especially tested-by tags).

Jarkko Sakkinen (12):
  KEYS: trusted: Use get_random-fallback for TPM
  KEYS: trusted: Use get_random_bytes_wait() instead of tpm_get_random()
  tpm: Orchestrate TPM commands in tpm_get_random()
  tpm: Change tpm_get_random() opportunistic
  tpm2-sessions: Define TPM2_NAME_MAX_SIZE
  KEYS: trusted: Open code tpm2_buf_append()
  KEYS: trusted: Remove dead branch from tpm2_unseal_cmd
  KEYS: trusted: Re-orchestrate tpm2_read_public() calls
  tpm2-sessions: Remove the support for more than one authorization
  tpm-buf: Remove tpm_buf_append_handle
  tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
  tpm-buf: Implement managed allocations

 drivers/char/tpm/tpm-buf.c                | 156 ++++-----
 drivers/char/tpm/tpm-interface.c          | 145 ++++++++-
 drivers/char/tpm/tpm-sysfs.c              |  23 +-
 drivers/char/tpm/tpm.h                    |   3 -
 drivers/char/tpm/tpm1-cmd.c               | 198 ++++--------
 drivers/char/tpm/tpm2-cmd.c               | 371 +++++++---------------
 drivers/char/tpm/tpm2-sessions.c          | 281 +++++++---------
 drivers/char/tpm/tpm2-space.c             |  44 ++-
 drivers/char/tpm/tpm_vtpm_proxy.c         |  30 +-
 include/linux/tpm.h                       |  77 +++--
 security/keys/trusted-keys/trusted_tpm1.c |  70 ++--
 security/keys/trusted-keys/trusted_tpm2.c | 329 ++++++++++---------
 12 files changed, 783 insertions(+), 944 deletions(-)

-- 
2.39.5


             reply	other threads:[~2025-12-16  9:21 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-12-16  9:21 Jarkko Sakkinen [this message]
2025-12-16  9:21 ` [PATCH v8 01/12] KEYS: trusted: Use get_random-fallback for TPM Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 02/12] KEYS: trusted: Use get_random_bytes_wait() instead of tpm_get_random() Jarkko Sakkinen
2025-12-19  9:21   ` Jonathan McDowell
2026-01-02 16:34     ` Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 03/12] tpm: Orchestrate TPM commands in tpm_get_random() Jarkko Sakkinen
2025-12-19  9:43   ` Jonathan McDowell
2026-01-02 16:40     ` Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 04/12] tpm: Change tpm_get_random() opportunistic Jarkko Sakkinen
2025-12-16 22:03   ` Jarkko Sakkinen
2025-12-19  9:42   ` Jonathan McDowell
2026-01-02 16:37     ` Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 05/12] tpm2-sessions: Define TPM2_NAME_MAX_SIZE Jarkko Sakkinen
2025-12-19  9:32   ` Jonathan McDowell
2026-01-02 16:35     ` Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 06/12] KEYS: trusted: Open code tpm2_buf_append() Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 07/12] KEYS: trusted: Remove dead branch from tpm2_unseal_cmd Jarkko Sakkinen
2025-12-19  9:37   ` Jonathan McDowell
2025-12-19 20:54   ` James Bottomley
2026-01-02 16:31     ` Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 08/12] KEYS: trusted: Re-orchestrate tpm2_read_public() calls Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 09/12] tpm2-sessions: Remove the support for more than one authorization Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 10/12] tpm-buf: Remove tpm_buf_append_handle Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 11/12] tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW Jarkko Sakkinen
2025-12-16  9:21 ` [PATCH v8 12/12] tpm-buf: Implement managed allocations Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251216092147.2326606-1-jarkko@kernel.org \
    --to=jarkko@kernel.org \
    --cc=dhowells@redhat.com \
    --cc=jmorris@namei.org \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=serge@hallyn.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.