From: Evan Green <evgreen@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: linux-integrity@vger.kernel.org, apronin@chromium.org,
dlunev@google.com, jarkko@kernel.org, Pavel Machek <pavel@ucw.cz>,
Ben Boeckel <me@benboeckel.net>,
rjw@rjwysocki.net, corbet@lwn.net, linux-pm@vger.kernel.org,
zohar@linux.ibm.com, Kees Cook <keescook@chromium.org>,
Eric Biggers <ebiggers@kernel.org>,
jejb@linux.ibm.com, gwendal@chromium.org,
Matthew Garrett <mgarrett@aurora.tech>,
Matthew Garrett <matthewgarrett@google.com>,
Matthew Garrett <mjg59@google.com>,
Evan Green <evgreen@chromium.org>, Hao Wu <hao.wu@rubrik.com>,
Jason Gunthorpe <jgg@ziepe.ca>, Peter Huewe <peterhuewe@gmx.de>,
axelj <axelj@axis.com>
Subject: [PATCH v3 01/11] tpm: Add support for in-kernel resetting of PCRs
Date: Tue, 27 Sep 2022 09:49:12 -0700 [thread overview]
Message-ID: <20220927094559.v3.1.I776854f47e3340cc2913ed4d8ecdd328048b73c3@changeid> (raw)
In-Reply-To: <20220927164922.3383711-1-evgreen@chromium.org>
From: Matthew Garrett <matthewgarrett@google.com>
Add an internal command for resetting a PCR. This will be used by the
encrypted hibernation code to set PCR23 to a known value. The
hibernation code will seal the hibernation key with a policy specifying
PCR23 be set to this known value as a mechanism to ensure that the
hibernation key is genuine. But to do this repeatedly, resetting the PCR
is necessary as well.
Link: https://lore.kernel.org/lkml/20210220013255.1083202-2-matthewgarrett@google.com/
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: Evan Green <evgreen@chromium.org>
---
Changes in v3:
- Unify tpm1/2_pcr_reset prototypes (Jarkko)
- Wait no, remove the TPM1 stuff altogether (Jarkko)
- Remove extra From tag and blank in commit msg (Jarkko).
drivers/char/tpm/tpm-interface.c | 25 ++++++++++++++++++++++
drivers/char/tpm/tpm.h | 1 +
drivers/char/tpm/tpm2-cmd.c | 36 ++++++++++++++++++++++++++++++++
include/linux/tpm.h | 7 +++++++
4 files changed, 69 insertions(+)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 1621ce8187052c..2ac9079860b1e0 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -342,6 +342,31 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
}
EXPORT_SYMBOL_GPL(tpm_pcr_extend);
+/**
+ * tpm_pcr_reset - reset the specified PCR
+ * @chip: a &struct tpm_chip instance, %NULL for the default chip
+ * @pcr_idx: the PCR to be reset
+ *
+ * Return: same as with tpm_transmit_cmd(), or ENOTTY for TPM1 devices.
+ */
+int tpm_pcr_reset(struct tpm_chip *chip, u32 pcr_idx)
+{
+ int rc;
+
+ chip = tpm_find_get_ops(chip);
+ if (!chip)
+ return -ENODEV;
+
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ rc = tpm2_pcr_reset(chip, pcr_idx);
+ else
+ rc = -ENOTTY;
+
+ tpm_put_ops(chip);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(tpm_pcr_reset);
+
/**
* tpm_send - send a TPM command
* @chip: a &struct tpm_chip instance, %NULL for the default chip
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 24ee4e1cc452a0..34e20b3192f833 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -217,6 +217,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digest, u16 *digest_size_ptr);
int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digests);
+int tpm2_pcr_reset(struct tpm_chip *chip, u32 pcr_idx);
int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,
u32 *value, const char *desc);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 65d03867e114c5..69126a6770386e 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -269,6 +269,42 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
return rc;
}
+/**
+ * tpm2_pcr_reset() - reset a PCR
+ *
+ * @chip: TPM chip to use.
+ * @pcr_idx: index of the PCR.
+ *
+ * Return: Same as with tpm_transmit_cmd.
+ */
+int tpm2_pcr_reset(struct tpm_chip *chip, u32 pcr_idx)
+{
+ struct tpm_buf buf;
+ struct tpm2_null_auth_area auth_area;
+ int rc;
+
+ rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_RESET);
+ if (rc)
+ return rc;
+
+ tpm_buf_append_u32(&buf, pcr_idx);
+
+ auth_area.handle = cpu_to_be32(TPM2_RS_PW);
+ auth_area.nonce_size = 0;
+ auth_area.attributes = 0;
+ auth_area.auth_size = 0;
+
+ tpm_buf_append_u32(&buf, sizeof(struct tpm2_null_auth_area));
+ tpm_buf_append(&buf, (const unsigned char *)&auth_area,
+ sizeof(auth_area));
+
+ rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to reset a PCR");
+
+ tpm_buf_destroy(&buf);
+
+ return rc;
+}
+
struct tpm2_get_random_out {
__be16 size;
u8 buffer[TPM_MAX_RNG_DATA];
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index dfeb25a0362dee..8320cbac6f4009 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -219,6 +219,7 @@ enum tpm2_command_codes {
TPM2_CC_HIERARCHY_CONTROL = 0x0121,
TPM2_CC_HIERARCHY_CHANGE_AUTH = 0x0129,
TPM2_CC_CREATE_PRIMARY = 0x0131,
+ TPM2_CC_PCR_RESET = 0x013D,
TPM2_CC_SEQUENCE_COMPLETE = 0x013E,
TPM2_CC_SELF_TEST = 0x0143,
TPM2_CC_STARTUP = 0x0144,
@@ -423,6 +424,7 @@ extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
size_t min_rsp_body_length, const char *desc);
extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digest);
+extern int tpm_pcr_reset(struct tpm_chip *chip, u32 pcr_idx);
extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digests);
extern int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen);
@@ -440,6 +442,11 @@ static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
return -ENODEV;
}
+static inline int tpm_pcr_reset(struct tpm_chip *chip, int pcr_idx)
+{
+ return -ENODEV;
+}
+
static inline int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
struct tpm_digest *digests)
{
--
2.31.0
next prev parent reply other threads:[~2022-09-27 16:50 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-27 16:49 [PATCH v3 00/11] Encrypted Hibernation Evan Green
2022-09-27 16:49 ` Evan Green [this message]
2022-09-30 20:52 ` [PATCH v3 01/11] tpm: Add support for in-kernel resetting of PCRs Jarkko Sakkinen
2022-09-27 16:49 ` [PATCH v3 02/11] tpm: Export and rename tpm2_find_and_validate_cc() Evan Green
2022-09-27 16:49 ` [PATCH v3 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use Evan Green
2022-09-30 20:57 ` Jarkko Sakkinen
2022-09-27 16:49 ` [PATCH v3 04/11] security: keys: trusted: Include TPM2 creation data Evan Green
2022-09-27 16:49 ` [PATCH v3 05/11] security: keys: trusted: Allow storage of PCR values in " Evan Green
2022-09-27 16:58 ` Ben Boeckel
2022-09-27 16:49 ` [PATCH v3 06/11] security: keys: trusted: Verify " Evan Green
2022-09-27 16:49 ` [PATCH v3 07/11] PM: hibernate: Add kernel-based encryption Evan Green
2022-09-30 21:30 ` Jarkko Sakkinen
2022-09-27 16:49 ` [PATCH v3 08/11] PM: hibernate: Use TPM-backed keys to encrypt image Evan Green
2022-09-30 21:35 ` Jarkko Sakkinen
2022-10-21 19:56 ` Evan Green
2022-10-23 21:55 ` Jarkko Sakkinen
2022-09-27 16:49 ` [PATCH v3 09/11] PM: hibernate: Mix user key in encrypted hibernate Evan Green
2022-09-27 16:49 ` [PATCH v3 10/11] PM: hibernate: Verify the digest encryption key Evan Green
2022-09-27 16:49 ` [PATCH v3 11/11] PM: hibernate: seal the encryption key with a PCR policy Evan Green
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220927094559.v3.1.I776854f47e3340cc2913ed4d8ecdd328048b73c3@changeid \
--to=evgreen@chromium.org \
--cc=apronin@chromium.org \
--cc=axelj@axis.com \
--cc=corbet@lwn.net \
--cc=dlunev@google.com \
--cc=ebiggers@kernel.org \
--cc=gwendal@chromium.org \
--cc=hao.wu@rubrik.com \
--cc=jarkko@kernel.org \
--cc=jejb@linux.ibm.com \
--cc=jgg@ziepe.ca \
--cc=keescook@chromium.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=matthewgarrett@google.com \
--cc=me@benboeckel.net \
--cc=mgarrett@aurora.tech \
--cc=mjg59@google.com \
--cc=pavel@ucw.cz \
--cc=peterhuewe@gmx.de \
--cc=rjw@rjwysocki.net \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).