Linux-Security-Module Archive on lore.kernel.org
 help / Atom feed
* [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
@ 2019-02-06 10:57 Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 1/6] tpm: dynamically allocate the allocated_banks array Roberto Sassu
                   ` (6 more replies)
  0 siblings, 7 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

Update

This version of the patch set includes three additional patches (5-7/7)
that allow users of the TPM driver to provide a digest for each PCR bank to
tpm_pcr_extend(). The new patches have been included to facilitate the
review of all the changes to support TPM 2.0 crypto agility for reading and
extending PCRs.


Original patch set description

The TPM driver currently relies on the crypto subsystem to determine the
digest size of supported TPM algorithms. In the future, TPM vendors might
implement new algorithms in their chips, and those algorithms might not
be supported by the crypto subsystem.

Usually, vendors provide patches for the new hardware, and likely
the crypto subsystem will be updated before the new algorithm is
introduced. However, old kernels might be updated later, after patches
are included in the mainline kernel. This would leave the opportunity
for attackers to misuse PCRs, as PCR banks with an unknown algorithm
are not extended.

This patch set provides a long term solution for this issue. If a TPM
algorithm is not known by the crypto subsystem, the TPM driver retrieves
the digest size from the TPM with a PCR read. All the PCR banks are
extended, even if the algorithm is not yet supported by the crypto
subsystem.

PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
is stored in the tpm_chip structure and available for users of the TPM
driver.

Changelog

v9:
- add comment for ima_load_kexec_buffer() in ima_init()
- move 'digests' and ima_init_digests() to ima_queue.c
- remove comment for TPM_RETRY

v8:
- set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
- replace enum tpm_const with #define
- rename labels in init_trusted()
- allocate tpm_digest array after retrieving random data in init_digests()

v7:
- use memchr_inv() in tpm2_get_pcr_allocation()
- add patch to move tpm_chip to include/linux/tpm.h
- add patch to set the tpm_chip argument in trusted.c to a pointer from
  tpm_default_chip()
- remove definition of tpm_extend_digest
- remove code in tpm2_pcr_extend() to extend unused PCR banks with the
  first digest passed by the caller of tpm_pcr_extend()
- remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
- remove padding of SHA1 digest in tpm_pcr_extend()
- pre-allocate and initialize array of tpm_digest structures in
  security/keys/trusted.c and security/integrity/ima/ima_init.c 

v6:
- squash patches 4-6
- rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
  members to size and data
- add comment in tpm2_init_bank_info()

v5:
- rename digest_struct variable to digest
- add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
- rename digest_size member of tpm_bank_list to extend_size
- change type of alg_id member of tpm_bank_list from u8 to u16
- add missing semi-colon in pcrlock()

v4:
- rename active_banks to allocated_banks
- replace kmalloc_array() with kcalloc()
- increment nr_allocated_banks if at least one PCR in the bank is selected
- pass multiple digests to tpm_pcr_extend()

v3:
- remove end marker change
- replace active_banks static array with pointer to dynamic array
- remove TPM2_ACTIVE_PCR_BANKS

v2:
- change the end marker of the active_banks array
- check digest size from output of PCR read command
- remove count parameter from tpm_pcr_read() and tpm2_pcr_read()

v1:
- modify definition of tpm_pcr_read()
- move hash algorithms and definition of tpm2_digest to include/linux/tpm.h


Roberto Sassu (6):
  tpm: dynamically allocate the allocated_banks array
  tpm: rename and export tpm2_digest and tpm2_algorithms
  tpm: retrieve digest size of unknown algorithms with PCR read
  tpm: move tpm_chip definition to include/linux/tpm.h
  KEYS: trusted: explicitly use tpm_chip structure from
    tpm_default_chip()
  tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()

 drivers/char/tpm/tpm-chip.c         |   1 +
 drivers/char/tpm/tpm-interface.c    |  38 ++++----
 drivers/char/tpm/tpm.h              | 117 ++---------------------
 drivers/char/tpm/tpm1-cmd.c         |  12 +++
 drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
 include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
 include/linux/tpm_eventlog.h        |   9 +-
 security/integrity/ima/ima.h        |   1 +
 security/integrity/ima/ima_crypto.c |  10 +-
 security/integrity/ima/ima_init.c   |   4 +
 security/integrity/ima/ima_queue.c  |  27 +++++-
 security/keys/trusted.c             |  73 +++++++++++----
 12 files changed, 349 insertions(+), 208 deletions(-)

-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 1/6] tpm: dynamically allocate the allocated_banks array
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 2/6] tpm: rename and export tpm2_digest and tpm2_algorithms Roberto Sassu
                   ` (5 subsequent siblings)
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

This patch renames active_banks (member of tpm_chip) to allocated_banks,
stores the number of allocated PCR banks in nr_allocated_banks (new member
of tpm_chip), and replaces the static array with a pointer to a dynamically
allocated array.

tpm2_get_pcr_allocation() determines if a PCR bank is allocated by checking
the mask in the TPML_PCR_SELECTION structure returned by the TPM for
TPM2_Get_Capability(). If a bank is not allocated, the TPM returns that
bank in TPML_PCR_SELECTION, with all bits in the mask set to zero. In this
case, the bank is not included in chip->allocated_banks, to avoid that TPM
driver users unnecessarily calculate a digest for that bank.

One PCR bank with algorithm set to SHA1 is always allocated for TPM 1.x.

As a consequence of the introduction of nr_allocated_banks,
tpm_pcr_extend() does not check anymore if the algorithm stored in tpm_chip
is equal to zero.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/tpm-chip.c      |  1 +
 drivers/char/tpm/tpm-interface.c | 18 ++++++++++--------
 drivers/char/tpm/tpm.h           |  3 ++-
 drivers/char/tpm/tpm1-cmd.c      | 10 ++++++++++
 drivers/char/tpm/tpm2-cmd.c      | 31 +++++++++++++++++++++----------
 5 files changed, 44 insertions(+), 19 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 32db84683c40..ce851c62bb68 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -160,6 +160,7 @@ static void tpm_dev_release(struct device *dev)
 	kfree(chip->log.bios_event_log);
 	kfree(chip->work_space.context_buf);
 	kfree(chip->work_space.session_buf);
+	kfree(chip->allocated_banks);
 	kfree(chip);
 }
 
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 6339a2e289ae..619a2ad3bece 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -488,8 +488,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
 int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)
 {
 	int rc;
-	struct tpm2_digest digest_list[ARRAY_SIZE(chip->active_banks)];
-	u32 count = 0;
+	struct tpm2_digest *digest_list;
 	int i;
 
 	chip = tpm_find_get_ops(chip);
@@ -497,16 +496,19 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)
 		return -ENODEV;
 
 	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-		memset(digest_list, 0, sizeof(digest_list));
+		digest_list = kcalloc(chip->nr_allocated_banks,
+				      sizeof(*digest_list), GFP_KERNEL);
+		if (!digest_list)
+			return -ENOMEM;
 
-		for (i = 0; i < ARRAY_SIZE(chip->active_banks) &&
-			    chip->active_banks[i] != TPM2_ALG_ERROR; i++) {
-			digest_list[i].alg_id = chip->active_banks[i];
+		for (i = 0; i < chip->nr_allocated_banks; i++) {
+			digest_list[i].alg_id = chip->allocated_banks[i];
 			memcpy(digest_list[i].digest, hash, TPM_DIGEST_SIZE);
-			count++;
 		}
 
-		rc = tpm2_pcr_extend(chip, pcr_idx, count, digest_list);
+		rc = tpm2_pcr_extend(chip, pcr_idx, chip->nr_allocated_banks,
+				     digest_list);
+		kfree(digest_list);
 		tpm_put_ops(chip);
 		return rc;
 	}
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index f27d1f38a93d..6b94306ab7c5 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -257,7 +257,8 @@ struct tpm_chip {
 	const struct attribute_group *groups[3];
 	unsigned int groups_cnt;
 
-	u16 active_banks[7];
+	u32 nr_allocated_banks;
+	u16 *allocated_banks;
 #ifdef CONFIG_ACPI
 	acpi_handle acpi_dev_handle;
 	char ppi_version[TPM_PPI_VERSION_LEN + 1];
diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c
index bda9a16b44f6..564d599e89ea 100644
--- a/drivers/char/tpm/tpm1-cmd.c
+++ b/drivers/char/tpm/tpm1-cmd.c
@@ -708,6 +708,16 @@ int tpm1_auto_startup(struct tpm_chip *chip)
 		goto out;
 	}
 
+	chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),
+					GFP_KERNEL);
+	if (!chip->allocated_banks) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	chip->allocated_banks[0] = TPM2_ALG_SHA1;
+	chip->nr_allocated_banks = 1;
+
 	return rc;
 out:
 	if (rc > 0)
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index a6bec13afa69..158c34721c8a 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -234,7 +234,7 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 	int i;
 	int j;
 
-	if (count > ARRAY_SIZE(chip->active_banks))
+	if (count > chip->nr_allocated_banks)
 		return -EINVAL;
 
 	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);
@@ -825,8 +825,10 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 	void *marker;
 	void *end;
 	void *pcr_select_offset;
-	unsigned int count;
 	u32 sizeof_pcr_selection;
+	u32 nr_possible_banks;
+	u32 nr_alloc_banks = 0;
+	u16 hash_alg;
 	u32 rsp_len;
 	int rc;
 	int i = 0;
@@ -844,11 +846,14 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 	if (rc)
 		goto out;
 
-	count = be32_to_cpup(
+	nr_possible_banks = be32_to_cpup(
 		(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
 
-	if (count > ARRAY_SIZE(chip->active_banks)) {
-		rc = -ENODEV;
+	chip->allocated_banks = kcalloc(nr_possible_banks,
+					sizeof(*chip->allocated_banks),
+					GFP_KERNEL);
+	if (!chip->allocated_banks) {
+		rc = -ENOMEM;
 		goto out;
 	}
 
@@ -857,7 +862,7 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 	rsp_len = be32_to_cpup((__be32 *)&buf.data[2]);
 	end = &buf.data[rsp_len];
 
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < nr_possible_banks; i++) {
 		pcr_select_offset = marker +
 			offsetof(struct tpm2_pcr_selection, size_of_select);
 		if (pcr_select_offset >= end) {
@@ -866,17 +871,23 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 		}
 
 		memcpy(&pcr_selection, marker, sizeof(pcr_selection));
-		chip->active_banks[i] = be16_to_cpu(pcr_selection.hash_alg);
+		hash_alg = be16_to_cpu(pcr_selection.hash_alg);
+
+		pcr_select_offset = memchr_inv(pcr_selection.pcr_select, 0,
+					       pcr_selection.size_of_select);
+		if (pcr_select_offset) {
+			chip->allocated_banks[nr_alloc_banks] = hash_alg;
+			nr_alloc_banks++;
+		}
+
 		sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
 			sizeof(pcr_selection.size_of_select) +
 			pcr_selection.size_of_select;
 		marker = marker + sizeof_pcr_selection;
 	}
 
+	chip->nr_allocated_banks = nr_alloc_banks;
 out:
-	if (i < ARRAY_SIZE(chip->active_banks))
-		chip->active_banks[i] = TPM2_ALG_ERROR;
-
 	tpm_buf_destroy(&buf);
 
 	return rc;
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 2/6] tpm: rename and export tpm2_digest and tpm2_algorithms
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 1/6] tpm: dynamically allocate the allocated_banks array Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 3/6] tpm: retrieve digest size of unknown algorithms with PCR read Roberto Sassu
                   ` (4 subsequent siblings)
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

Rename tpm2_* to tpm_* and move the definitions to include/linux/tpm.h so
that these can be used by other kernel subsystems (e.g. IMA).

Also, set the length of the digest array in tpm_digest to a new constant
named TPM_MAX_DIGEST_SIZE, equal to SHA512_DIGEST_SIZE.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
---
 drivers/char/tpm/tpm-interface.c |  2 +-
 drivers/char/tpm/tpm.h           | 13 +------------
 drivers/char/tpm/tpm1-cmd.c      |  2 +-
 drivers/char/tpm/tpm2-cmd.c      | 18 +++++++++---------
 include/linux/tpm.h              | 19 +++++++++++++++++++
 include/linux/tpm_eventlog.h     |  9 ++-------
 6 files changed, 33 insertions(+), 30 deletions(-)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 619a2ad3bece..2a85194413e2 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -488,7 +488,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
 int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)
 {
 	int rc;
-	struct tpm2_digest *digest_list;
+	struct tpm_digest *digest_list;
 	int i;
 
 	chip = tpm_find_get_ops(chip);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 6b94306ab7c5..e961e5c5d197 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -122,17 +122,6 @@ enum tpm2_return_codes {
 	TPM2_RC_RETRY		= 0x0922,
 };
 
-enum tpm2_algorithms {
-	TPM2_ALG_ERROR		= 0x0000,
-	TPM2_ALG_SHA1		= 0x0004,
-	TPM2_ALG_KEYEDHASH	= 0x0008,
-	TPM2_ALG_SHA256		= 0x000B,
-	TPM2_ALG_SHA384		= 0x000C,
-	TPM2_ALG_SHA512		= 0x000D,
-	TPM2_ALG_NULL		= 0x0010,
-	TPM2_ALG_SM3_256	= 0x0012,
-};
-
 enum tpm2_command_codes {
 	TPM2_CC_FIRST		        = 0x011F,
 	TPM2_CC_HIERARCHY_CONTROL       = 0x0121,
@@ -561,7 +550,7 @@ static inline u32 tpm2_rc_value(u32 rc)
 int tpm2_get_timeouts(struct tpm_chip *chip);
 int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf);
 int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
-		    struct tpm2_digest *digests);
+		    struct tpm_digest *digests);
 int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
 void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
 			    unsigned int flags);
diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c
index 564d599e89ea..1f8699d428be 100644
--- a/drivers/char/tpm/tpm1-cmd.c
+++ b/drivers/char/tpm/tpm1-cmd.c
@@ -715,7 +715,7 @@ int tpm1_auto_startup(struct tpm_chip *chip)
 		goto out;
 	}
 
-	chip->allocated_banks[0] = TPM2_ALG_SHA1;
+	chip->allocated_banks[0] = TPM_ALG_SHA1;
 	chip->nr_allocated_banks = 1;
 
 	return rc;
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 158c34721c8a..db8e05c8dad3 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -33,11 +33,11 @@ struct tpm2_hash {
 };
 
 static struct tpm2_hash tpm2_hash_map[] = {
-	{HASH_ALGO_SHA1, TPM2_ALG_SHA1},
-	{HASH_ALGO_SHA256, TPM2_ALG_SHA256},
-	{HASH_ALGO_SHA384, TPM2_ALG_SHA384},
-	{HASH_ALGO_SHA512, TPM2_ALG_SHA512},
-	{HASH_ALGO_SM3_256, TPM2_ALG_SM3_256},
+	{HASH_ALGO_SHA1, TPM_ALG_SHA1},
+	{HASH_ALGO_SHA256, TPM_ALG_SHA256},
+	{HASH_ALGO_SHA384, TPM_ALG_SHA384},
+	{HASH_ALGO_SHA512, TPM_ALG_SHA512},
+	{HASH_ALGO_SM3_256, TPM_ALG_SM3_256},
 };
 
 int tpm2_get_timeouts(struct tpm_chip *chip)
@@ -192,7 +192,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
 	pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
 
 	tpm_buf_append_u32(&buf, 1);
-	tpm_buf_append_u16(&buf, TPM2_ALG_SHA1);
+	tpm_buf_append_u16(&buf, TPM_ALG_SHA1);
 	tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN);
 	tpm_buf_append(&buf, (const unsigned char *)pcr_select,
 		       sizeof(pcr_select));
@@ -226,7 +226,7 @@ struct tpm2_null_auth_area {
  * Return: Same as with tpm_transmit_cmd.
  */
 int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
-		    struct tpm2_digest *digests)
+		    struct tpm_digest *digests)
 {
 	struct tpm_buf buf;
 	struct tpm2_null_auth_area auth_area;
@@ -449,7 +449,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
 
 	/* public */
 	tpm_buf_append_u16(&buf, 14 + options->policydigest_len);
-	tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH);
+	tpm_buf_append_u16(&buf, TPM_ALG_KEYEDHASH);
 	tpm_buf_append_u16(&buf, hash);
 
 	/* policy */
@@ -464,7 +464,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
 	}
 
 	/* public parameters */
-	tpm_buf_append_u16(&buf, TPM2_ALG_NULL);
+	tpm_buf_append_u16(&buf, TPM_ALG_NULL);
 	tpm_buf_append_u16(&buf, 0);
 
 	/* outside info */
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 13563b8c0c3a..9fe8c9816cf0 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -22,12 +22,31 @@
 #ifndef __LINUX_TPM_H__
 #define __LINUX_TPM_H__
 
+#include <crypto/hash_info.h>
+
 #define TPM_DIGEST_SIZE 20	/* Max TPM v1.2 PCR size */
+#define TPM_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
 
 struct tpm_chip;
 struct trusted_key_payload;
 struct trusted_key_options;
 
+enum tpm_algorithms {
+	TPM_ALG_ERROR		= 0x0000,
+	TPM_ALG_SHA1		= 0x0004,
+	TPM_ALG_KEYEDHASH	= 0x0008,
+	TPM_ALG_SHA256		= 0x000B,
+	TPM_ALG_SHA384		= 0x000C,
+	TPM_ALG_SHA512		= 0x000D,
+	TPM_ALG_NULL		= 0x0010,
+	TPM_ALG_SM3_256		= 0x0012,
+};
+
+struct tpm_digest {
+	u16 alg_id;
+	u8 digest[TPM_MAX_DIGEST_SIZE];
+} __packed;
+
 enum TPM_OPS_FLAGS {
 	TPM_OPS_AUTO_STARTUP = BIT(0),
 };
diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
index f47342361e87..81519f163211 100644
--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -3,7 +3,7 @@
 #ifndef __LINUX_TPM_EVENTLOG_H__
 #define __LINUX_TPM_EVENTLOG_H__
 
-#include <crypto/hash_info.h>
+#include <linux/tpm.h>
 
 #define TCG_EVENT_NAME_LEN_MAX	255
 #define MAX_TEXT_EVENT		1000	/* Max event string length */
@@ -105,16 +105,11 @@ struct tcg_event_field {
 	u8 event[0];
 } __packed;
 
-struct tpm2_digest {
-	u16 alg_id;
-	u8 digest[SHA512_DIGEST_SIZE];
-} __packed;
-
 struct tcg_pcr_event2_head {
 	u32 pcr_idx;
 	u32 event_type;
 	u32 count;
-	struct tpm2_digest digests[];
+	struct tpm_digest digests[];
 } __packed;
 
 #endif
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 3/6] tpm: retrieve digest size of unknown algorithms with PCR read
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 1/6] tpm: dynamically allocate the allocated_banks array Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 2/6] tpm: rename and export tpm2_digest and tpm2_algorithms Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 4/6] tpm: move tpm_chip definition to include/linux/tpm.h Roberto Sassu
                   ` (3 subsequent siblings)
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

Currently, the TPM driver retrieves the digest size from a table mapping
TPM algorithms identifiers to identifiers defined by the crypto subsystem.
If the algorithm is not defined by the latter, the digest size can be
retrieved from the output of the PCR read command.

The patch modifies the definition of tpm_pcr_read() and tpm2_pcr_read() to
pass the desired hash algorithm and obtain the digest size at TPM startup.
Algorithms and corresponding digest sizes are stored in the new structure
tpm_bank_info, member of tpm_chip, so that the information can be used by
other kernel subsystems.

tpm_bank_info contains: the TPM algorithm identifier, necessary to generate
the event log as defined by Trusted Computing Group (TCG); the digest size,
to pad/truncate a digest calculated with a different algorithm; the crypto
subsystem identifier, to calculate the digest of event data.

This patch also protects against data corruption that could happen in the
bus, by checking that the digest size returned by the TPM during a PCR read
matches the size of the algorithm passed to tpm2_pcr_read().

For the initial PCR read, when digest sizes are not yet available, this
patch ensures that the amount of data copied from the output returned by
the TPM does not exceed the size of the array data are copied to.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
---
 drivers/char/tpm/tpm-interface.c    | 16 +++---
 drivers/char/tpm/tpm.h              |  5 +-
 drivers/char/tpm/tpm1-cmd.c         |  4 +-
 drivers/char/tpm/tpm2-cmd.c         | 84 +++++++++++++++++++++++------
 include/linux/tpm.h                 | 12 ++++-
 security/integrity/ima/ima_crypto.c | 10 ++--
 6 files changed, 96 insertions(+), 35 deletions(-)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 2a85194413e2..cde2f7cbe0cf 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -451,11 +451,12 @@ EXPORT_SYMBOL_GPL(tpm_is_tpm2);
  * tpm_pcr_read - read a PCR value from SHA1 bank
  * @chip:	a &struct tpm_chip instance, %NULL for the default chip
  * @pcr_idx:	the PCR to be retrieved
- * @res_buf:	the value of the PCR
+ * @digest:	the PCR bank and buffer current PCR value is written to
  *
  * Return: same as with tpm_transmit_cmd()
  */
-int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
+int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
+		 struct tpm_digest *digest)
 {
 	int rc;
 
@@ -464,9 +465,9 @@ int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
 		return -ENODEV;
 
 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
-		rc = tpm2_pcr_read(chip, pcr_idx, res_buf);
+		rc = tpm2_pcr_read(chip, pcr_idx, digest, NULL);
 	else
-		rc = tpm1_pcr_read(chip, pcr_idx, res_buf);
+		rc = tpm1_pcr_read(chip, pcr_idx, digest->digest);
 
 	tpm_put_ops(chip);
 	return rc;
@@ -479,9 +480,8 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
  * @pcr_idx:	the PCR to be retrieved
  * @hash:	the hash value used to extend the PCR value
  *
- * Note: with TPM 2.0 extends also those banks with a known digest size to the
- * cryto subsystem in order to prevent malicious use of those PCR banks. In the
- * future we should dynamically determine digest sizes.
+ * Note: with TPM 2.0 extends also those banks for which no digest was
+ * specified in order to prevent malicious use of those PCR banks.
  *
  * Return: same as with tpm_transmit_cmd()
  */
@@ -502,7 +502,7 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)
 			return -ENOMEM;
 
 		for (i = 0; i < chip->nr_allocated_banks; i++) {
-			digest_list[i].alg_id = chip->allocated_banks[i];
+			digest_list[i].alg_id = chip->allocated_banks[i].alg_id;
 			memcpy(digest_list[i].digest, hash, TPM_DIGEST_SIZE);
 		}
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index e961e5c5d197..64d93d26087f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -247,7 +247,7 @@ struct tpm_chip {
 	unsigned int groups_cnt;
 
 	u32 nr_allocated_banks;
-	u16 *allocated_banks;
+	struct tpm_bank_info *allocated_banks;
 #ifdef CONFIG_ACPI
 	acpi_handle acpi_dev_handle;
 	char ppi_version[TPM_PPI_VERSION_LEN + 1];
@@ -548,7 +548,8 @@ static inline u32 tpm2_rc_value(u32 rc)
 }
 
 int tpm2_get_timeouts(struct tpm_chip *chip);
-int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf);
+int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
+		  struct tpm_digest *digest, u16 *digest_size_ptr);
 int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 		    struct tpm_digest *digests);
 int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c
index 1f8699d428be..51ac06d1d2be 100644
--- a/drivers/char/tpm/tpm1-cmd.c
+++ b/drivers/char/tpm/tpm1-cmd.c
@@ -715,7 +715,9 @@ int tpm1_auto_startup(struct tpm_chip *chip)
 		goto out;
 	}
 
-	chip->allocated_banks[0] = TPM_ALG_SHA1;
+	chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;
+	chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];
+	chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;
 	chip->nr_allocated_banks = 1;
 
 	return rc;
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index db8e05c8dad3..760893957f13 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -171,20 +171,36 @@ struct tpm2_pcr_read_out {
  * tpm2_pcr_read() - read a PCR value
  * @chip:	TPM chip to use.
  * @pcr_idx:	index of the PCR to read.
- * @res_buf:	buffer to store the resulting hash.
+ * @digest:	PCR bank and buffer current PCR value is written to.
+ * @digest_size_ptr:	pointer to variable that stores the digest size.
  *
  * Return: Same as with tpm_transmit_cmd.
  */
-int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
+int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
+		  struct tpm_digest *digest, u16 *digest_size_ptr)
 {
+	int i;
 	int rc;
 	struct tpm_buf buf;
 	struct tpm2_pcr_read_out *out;
 	u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
+	u16 digest_size;
+	u16 expected_digest_size = 0;
 
 	if (pcr_idx >= TPM2_PLATFORM_PCR)
 		return -EINVAL;
 
+	if (!digest_size_ptr) {
+		for (i = 0; i < chip->nr_allocated_banks &&
+		     chip->allocated_banks[i].alg_id != digest->alg_id; i++)
+			;
+
+		if (i == chip->nr_allocated_banks)
+			return -EINVAL;
+
+		expected_digest_size = chip->allocated_banks[i].digest_size;
+	}
+
 	rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ);
 	if (rc)
 		return rc;
@@ -192,18 +208,29 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
 	pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
 
 	tpm_buf_append_u32(&buf, 1);
-	tpm_buf_append_u16(&buf, TPM_ALG_SHA1);
+	tpm_buf_append_u16(&buf, digest->alg_id);
 	tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN);
 	tpm_buf_append(&buf, (const unsigned char *)pcr_select,
 		       sizeof(pcr_select));
 
 	rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
-			res_buf ? "attempting to read a pcr value" : NULL);
-	if (rc == 0 && res_buf) {
-		out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
-		memcpy(res_buf, out->digest, SHA1_DIGEST_SIZE);
+			      "attempting to read a pcr value");
+	if (rc)
+		goto out;
+
+	out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
+	digest_size = be16_to_cpu(out->digest_size);
+	if (digest_size > sizeof(digest->digest) ||
+	    (!digest_size_ptr && digest_size != expected_digest_size)) {
+		rc = -EINVAL;
+		goto out;
 	}
 
+	if (digest_size_ptr)
+		*digest_size_ptr = digest_size;
+
+	memcpy(digest->digest, out->digest, digest_size);
+out:
 	tpm_buf_destroy(&buf);
 	return rc;
 }
@@ -232,7 +259,6 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 	struct tpm2_null_auth_area auth_area;
 	int rc;
 	int i;
-	int j;
 
 	if (count > chip->nr_allocated_banks)
 		return -EINVAL;
@@ -254,14 +280,9 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 	tpm_buf_append_u32(&buf, count);
 
 	for (i = 0; i < count; i++) {
-		for (j = 0; j < ARRAY_SIZE(tpm2_hash_map); j++) {
-			if (digests[i].alg_id != tpm2_hash_map[j].tpm_id)
-				continue;
-			tpm_buf_append_u16(&buf, digests[i].alg_id);
-			tpm_buf_append(&buf, (const unsigned char
-					      *)&digests[i].digest,
-			       hash_digest_size[tpm2_hash_map[j].crypto_id]);
-		}
+		tpm_buf_append_u16(&buf, digests[i].alg_id);
+		tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest,
+			       chip->allocated_banks[i].digest_size);
 	}
 
 	rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
@@ -812,6 +833,30 @@ int tpm2_probe(struct tpm_chip *chip)
 }
 EXPORT_SYMBOL_GPL(tpm2_probe);
 
+static int tpm2_init_bank_info(struct tpm_chip *chip, u32 bank_index)
+{
+	struct tpm_bank_info *bank = chip->allocated_banks + bank_index;
+	struct tpm_digest digest = { .alg_id = bank->alg_id };
+	int i;
+
+	/*
+	 * Avoid unnecessary PCR read operations to reduce overhead
+	 * and obtain identifiers of the crypto subsystem.
+	 */
+	for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
+		enum hash_algo crypto_algo = tpm2_hash_map[i].crypto_id;
+
+		if (bank->alg_id != tpm2_hash_map[i].tpm_id)
+			continue;
+
+		bank->digest_size = hash_digest_size[crypto_algo];
+		bank->crypto_id = crypto_algo;
+		return 0;
+	}
+
+	return tpm2_pcr_read(chip, 0, &digest, &bank->digest_size);
+}
+
 struct tpm2_pcr_selection {
 	__be16  hash_alg;
 	u8  size_of_select;
@@ -876,7 +921,12 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 		pcr_select_offset = memchr_inv(pcr_selection.pcr_select, 0,
 					       pcr_selection.size_of_select);
 		if (pcr_select_offset) {
-			chip->allocated_banks[nr_alloc_banks] = hash_alg;
+			chip->allocated_banks[nr_alloc_banks].alg_id = hash_alg;
+
+			rc = tpm2_init_bank_info(chip, nr_alloc_banks);
+			if (rc < 0)
+				break;
+
 			nr_alloc_banks++;
 		}
 
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 9fe8c9816cf0..afd022fc9d3d 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -47,6 +47,12 @@ struct tpm_digest {
 	u8 digest[TPM_MAX_DIGEST_SIZE];
 } __packed;
 
+struct tpm_bank_info {
+	u16 alg_id;
+	u16 digest_size;
+	u16 crypto_id;
+};
+
 enum TPM_OPS_FLAGS {
 	TPM_OPS_AUTO_STARTUP = BIT(0),
 };
@@ -72,7 +78,8 @@ struct tpm_class_ops {
 #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
 
 extern int tpm_is_tpm2(struct tpm_chip *chip);
-extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf);
+extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
+			struct tpm_digest *digest);
 extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash);
 extern int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen);
 extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max);
@@ -89,7 +96,8 @@ static inline int tpm_is_tpm2(struct tpm_chip *chip)
 	return -ENODEV;
 }
 
-static inline int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf)
+static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
+			       struct tpm_digest *digest)
 {
 	return -ENODEV;
 }
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index acf2c7df7145..16a4f45863b1 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -643,12 +643,12 @@ int ima_calc_buffer_hash(const void *buf, loff_t len,
 	return calc_buffer_shash(buf, len, hash);
 }
 
-static void __init ima_pcrread(u32 idx, u8 *pcr)
+static void __init ima_pcrread(u32 idx, struct tpm_digest *d)
 {
 	if (!ima_tpm_chip)
 		return;
 
-	if (tpm_pcr_read(ima_tpm_chip, idx, pcr) != 0)
+	if (tpm_pcr_read(ima_tpm_chip, idx, d) != 0)
 		pr_err("Error Communicating to TPM chip\n");
 }
 
@@ -658,7 +658,7 @@ static void __init ima_pcrread(u32 idx, u8 *pcr)
 static int __init ima_calc_boot_aggregate_tfm(char *digest,
 					      struct crypto_shash *tfm)
 {
-	u8 pcr_i[TPM_DIGEST_SIZE];
+	struct tpm_digest d = { .alg_id = TPM_ALG_SHA1, .digest = {0} };
 	int rc;
 	u32 i;
 	SHASH_DESC_ON_STACK(shash, tfm);
@@ -672,9 +672,9 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
 
 	/* cumulative sha1 over tpm registers 0-7 */
 	for (i = TPM_PCR0; i < TPM_PCR8; i++) {
-		ima_pcrread(i, pcr_i);
+		ima_pcrread(i, &d);
 		/* now accumulate with current aggregate */
-		rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
+		rc = crypto_shash_update(shash, d.digest, TPM_DIGEST_SIZE);
 	}
 	if (!rc)
 		crypto_shash_final(shash, digest);
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 4/6] tpm: move tpm_chip definition to include/linux/tpm.h
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
                   ` (2 preceding siblings ...)
  2019-02-06 10:57 ` [PATCH v10 3/6] tpm: retrieve digest size of unknown algorithms with PCR read Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 5/6] KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip() Roberto Sassu
                   ` (2 subsequent siblings)
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

The tpm_chip structure contains the list of PCR banks currently allocated
in the TPM. When support for crypto agility will be added to the TPM
driver, users of the driver have to provide a digest for each allocated
bank to tpm_pcr_extend(). With this patch, they can obtain the PCR bank
algorithms directly from chip->allocated_banks.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/tpm.h | 100 ++---------------------------------------
 include/linux/tpm.h    |  90 +++++++++++++++++++++++++++++++++++++
 2 files changed, 94 insertions(+), 96 deletions(-)

diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 64d93d26087f..f20433946ca5 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -25,30 +25,22 @@
 
 #include <linux/module.h>
 #include <linux/delay.h>
-#include <linux/fs.h>
-#include <linux/hw_random.h>
 #include <linux/mutex.h>
 #include <linux/sched.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
 #include <linux/tpm.h>
-#include <linux/acpi.h>
-#include <linux/cdev.h>
 #include <linux/highmem.h>
 #include <linux/tpm_eventlog.h>
-#include <crypto/hash_info.h>
 
 #ifdef CONFIG_X86
 #include <asm/intel-family.h>
 #endif
 
-enum tpm_const {
-	TPM_MINOR = 224,	/* officially assigned */
-	TPM_BUFSIZE = 4096,
-	TPM_NUM_DEVICES = 65536,
-	TPM_RETRY = 50,		/* 5 seconds */
-	TPM_NUM_EVENT_LOG_FILES = 3,
-};
+#define TPM_MINOR		224	/* officially assigned */
+#define TPM_BUFSIZE		4096
+#define TPM_NUM_DEVICES		65536
+#define TPM_RETRY		50
 
 enum tpm_timeout {
 	TPM_TIMEOUT = 5,	/* msecs */
@@ -65,16 +57,6 @@ enum tpm_addr {
 	TPM_ADDR = 0x4E,
 };
 
-/* Indexes the duration array */
-enum tpm_duration {
-	TPM_SHORT = 0,
-	TPM_MEDIUM = 1,
-	TPM_LONG = 2,
-	TPM_LONG_LONG = 3,
-	TPM_UNDEFINED,
-	TPM_NUM_DURATIONS = TPM_UNDEFINED,
-};
-
 #define TPM_WARN_RETRY          0x800
 #define TPM_WARN_DOING_SELFTEST 0x802
 #define TPM_ERR_DEACTIVATED     0x6
@@ -179,15 +161,6 @@ enum tpm2_cc_attrs {
 #define TPM_VID_WINBOND  0x1050
 #define TPM_VID_STM      0x104A
 
-#define TPM_PPI_VERSION_LEN		3
-
-struct tpm_space {
-	u32 context_tbl[3];
-	u8 *context_buf;
-	u32 session_tbl[3];
-	u8 *session_buf;
-};
-
 enum tpm_chip_flags {
 	TPM_CHIP_FLAG_TPM2		= BIT(1),
 	TPM_CHIP_FLAG_IRQ		= BIT(2),
@@ -196,71 +169,6 @@ enum tpm_chip_flags {
 	TPM_CHIP_FLAG_ALWAYS_POWERED	= BIT(5),
 };
 
-struct tpm_bios_log {
-	void *bios_event_log;
-	void *bios_event_log_end;
-};
-
-struct tpm_chip_seqops {
-	struct tpm_chip *chip;
-	const struct seq_operations *seqops;
-};
-
-struct tpm_chip {
-	struct device dev;
-	struct device devs;
-	struct cdev cdev;
-	struct cdev cdevs;
-
-	/* A driver callback under ops cannot be run unless ops_sem is held
-	 * (sometimes implicitly, eg for the sysfs code). ops becomes null
-	 * when the driver is unregistered, see tpm_try_get_ops.
-	 */
-	struct rw_semaphore ops_sem;
-	const struct tpm_class_ops *ops;
-
-	struct tpm_bios_log log;
-	struct tpm_chip_seqops bin_log_seqops;
-	struct tpm_chip_seqops ascii_log_seqops;
-
-	unsigned int flags;
-
-	int dev_num;		/* /dev/tpm# */
-	unsigned long is_open;	/* only one allowed */
-
-	char hwrng_name[64];
-	struct hwrng hwrng;
-
-	struct mutex tpm_mutex;	/* tpm is processing */
-
-	unsigned long timeout_a; /* jiffies */
-	unsigned long timeout_b; /* jiffies */
-	unsigned long timeout_c; /* jiffies */
-	unsigned long timeout_d; /* jiffies */
-	bool timeout_adjusted;
-	unsigned long duration[TPM_NUM_DURATIONS]; /* jiffies */
-	bool duration_adjusted;
-
-	struct dentry *bios_dir[TPM_NUM_EVENT_LOG_FILES];
-
-	const struct attribute_group *groups[3];
-	unsigned int groups_cnt;
-
-	u32 nr_allocated_banks;
-	struct tpm_bank_info *allocated_banks;
-#ifdef CONFIG_ACPI
-	acpi_handle acpi_dev_handle;
-	char ppi_version[TPM_PPI_VERSION_LEN + 1];
-#endif /* CONFIG_ACPI */
-
-	struct tpm_space work_space;
-	u32 nr_commands;
-	u32 *cc_attrs_tbl;
-
-	/* active locality */
-	int locality;
-};
-
 #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev)
 
 struct tpm_input_header {
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index afd022fc9d3d..f9fea1e4075e 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -22,6 +22,10 @@
 #ifndef __LINUX_TPM_H__
 #define __LINUX_TPM_H__
 
+#include <linux/hw_random.h>
+#include <linux/acpi.h>
+#include <linux/cdev.h>
+#include <linux/fs.h>
 #include <crypto/hash_info.h>
 
 #define TPM_DIGEST_SIZE 20	/* Max TPM v1.2 PCR size */
@@ -75,6 +79,92 @@ struct tpm_class_ops {
 	void (*clk_enable)(struct tpm_chip *chip, bool value);
 };
 
+#define TPM_NUM_EVENT_LOG_FILES		3
+
+/* Indexes the duration array */
+enum tpm_duration {
+	TPM_SHORT = 0,
+	TPM_MEDIUM = 1,
+	TPM_LONG = 2,
+	TPM_LONG_LONG = 3,
+	TPM_UNDEFINED,
+	TPM_NUM_DURATIONS = TPM_UNDEFINED,
+};
+
+#define TPM_PPI_VERSION_LEN		3
+
+struct tpm_space {
+	u32 context_tbl[3];
+	u8 *context_buf;
+	u32 session_tbl[3];
+	u8 *session_buf;
+};
+
+struct tpm_bios_log {
+	void *bios_event_log;
+	void *bios_event_log_end;
+};
+
+struct tpm_chip_seqops {
+	struct tpm_chip *chip;
+	const struct seq_operations *seqops;
+};
+
+struct tpm_chip {
+	struct device dev;
+	struct device devs;
+	struct cdev cdev;
+	struct cdev cdevs;
+
+	/* A driver callback under ops cannot be run unless ops_sem is held
+	 * (sometimes implicitly, eg for the sysfs code). ops becomes null
+	 * when the driver is unregistered, see tpm_try_get_ops.
+	 */
+	struct rw_semaphore ops_sem;
+	const struct tpm_class_ops *ops;
+
+	struct tpm_bios_log log;
+	struct tpm_chip_seqops bin_log_seqops;
+	struct tpm_chip_seqops ascii_log_seqops;
+
+	unsigned int flags;
+
+	int dev_num;		/* /dev/tpm# */
+	unsigned long is_open;	/* only one allowed */
+
+	char hwrng_name[64];
+	struct hwrng hwrng;
+
+	struct mutex tpm_mutex;	/* tpm is processing */
+
+	unsigned long timeout_a; /* jiffies */
+	unsigned long timeout_b; /* jiffies */
+	unsigned long timeout_c; /* jiffies */
+	unsigned long timeout_d; /* jiffies */
+	bool timeout_adjusted;
+	unsigned long duration[TPM_NUM_DURATIONS]; /* jiffies */
+	bool duration_adjusted;
+
+	struct dentry *bios_dir[TPM_NUM_EVENT_LOG_FILES];
+
+	const struct attribute_group *groups[3];
+	unsigned int groups_cnt;
+
+	u32 nr_allocated_banks;
+	struct tpm_bank_info *allocated_banks;
+#ifdef CONFIG_ACPI
+	acpi_handle acpi_dev_handle;
+	char ppi_version[TPM_PPI_VERSION_LEN + 1];
+#endif /* CONFIG_ACPI */
+
+	struct tpm_space work_space;
+	u32 nr_commands;
+	u32 *cc_attrs_tbl;
+
+	/* active locality */
+	int locality;
+};
+
 #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
 
 extern int tpm_is_tpm2(struct tpm_chip *chip);
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 5/6] KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip()
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
                   ` (3 preceding siblings ...)
  2019-02-06 10:57 ` [PATCH v10 4/6] tpm: move tpm_chip definition to include/linux/tpm.h Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 10:57 ` [PATCH v10 6/6] tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend() Roberto Sassu
  2019-02-06 12:57 ` [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Jarkko Sakkinen
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

When crypto agility support will be added to the TPM driver, users of the
driver have to retrieve the allocated banks from chip->allocated_banks and
use this information to prepare the array of tpm_digest structures to be
passed to tpm_pcr_extend().

This patch retrieves a tpm_chip pointer from tpm_default_chip() so that the
pointer can be used to prepare the array of tpm_digest structures.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 security/keys/trusted.c | 38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 4d98f4f87236..5b852263eae1 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -34,6 +34,7 @@
 
 static const char hmac_alg[] = "hmac(sha1)";
 static const char hash_alg[] = "sha1";
+static struct tpm_chip *chip;
 
 struct sdesc {
 	struct shash_desc shash;
@@ -362,7 +363,7 @@ int trusted_tpm_send(unsigned char *cmd, size_t buflen)
 	int rc;
 
 	dump_tpm_buf(cmd);
-	rc = tpm_send(NULL, cmd, buflen);
+	rc = tpm_send(chip, cmd, buflen);
 	dump_tpm_buf(cmd);
 	if (rc > 0)
 		/* Can't return positive return codes values to keyctl */
@@ -384,10 +385,10 @@ static int pcrlock(const int pcrnum)
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-	ret = tpm_get_random(NULL, hash, SHA1_DIGEST_SIZE);
+	ret = tpm_get_random(chip, hash, SHA1_DIGEST_SIZE);
 	if (ret != SHA1_DIGEST_SIZE)
 		return ret;
-	return tpm_pcr_extend(NULL, pcrnum, hash) ? -EINVAL : 0;
+	return tpm_pcr_extend(chip, pcrnum, hash) ? -EINVAL : 0;
 }
 
 /*
@@ -400,7 +401,7 @@ static int osap(struct tpm_buf *tb, struct osapsess *s,
 	unsigned char ononce[TPM_NONCE_SIZE];
 	int ret;
 
-	ret = tpm_get_random(NULL, ononce, TPM_NONCE_SIZE);
+	ret = tpm_get_random(chip, ononce, TPM_NONCE_SIZE);
 	if (ret != TPM_NONCE_SIZE)
 		return ret;
 
@@ -496,7 +497,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
 	if (ret < 0)
 		goto out;
 
-	ret = tpm_get_random(NULL, td->nonceodd, TPM_NONCE_SIZE);
+	ret = tpm_get_random(chip, td->nonceodd, TPM_NONCE_SIZE);
 	if (ret != TPM_NONCE_SIZE)
 		goto out;
 	ordinal = htonl(TPM_ORD_SEAL);
@@ -606,7 +607,7 @@ static int tpm_unseal(struct tpm_buf *tb,
 
 	ordinal = htonl(TPM_ORD_UNSEAL);
 	keyhndl = htonl(SRKHANDLE);
-	ret = tpm_get_random(NULL, nonceodd, TPM_NONCE_SIZE);
+	ret = tpm_get_random(chip, nonceodd, TPM_NONCE_SIZE);
 	if (ret != TPM_NONCE_SIZE) {
 		pr_info("trusted_key: tpm_get_random failed (%d)\n", ret);
 		return ret;
@@ -751,7 +752,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
 	int i;
 	int tpm2;
 
-	tpm2 = tpm_is_tpm2(NULL);
+	tpm2 = tpm_is_tpm2(chip);
 	if (tpm2 < 0)
 		return tpm2;
 
@@ -920,7 +921,7 @@ static struct trusted_key_options *trusted_options_alloc(void)
 	struct trusted_key_options *options;
 	int tpm2;
 
-	tpm2 = tpm_is_tpm2(NULL);
+	tpm2 = tpm_is_tpm2(chip);
 	if (tpm2 < 0)
 		return NULL;
 
@@ -970,7 +971,7 @@ static int trusted_instantiate(struct key *key,
 	size_t key_len;
 	int tpm2;
 
-	tpm2 = tpm_is_tpm2(NULL);
+	tpm2 = tpm_is_tpm2(chip);
 	if (tpm2 < 0)
 		return tpm2;
 
@@ -1011,7 +1012,7 @@ static int trusted_instantiate(struct key *key,
 	switch (key_cmd) {
 	case Opt_load:
 		if (tpm2)
-			ret = tpm_unseal_trusted(NULL, payload, options);
+			ret = tpm_unseal_trusted(chip, payload, options);
 		else
 			ret = key_unseal(payload, options);
 		dump_payload(payload);
@@ -1021,13 +1022,13 @@ static int trusted_instantiate(struct key *key,
 		break;
 	case Opt_new:
 		key_len = payload->key_len;
-		ret = tpm_get_random(NULL, payload->key, key_len);
+		ret = tpm_get_random(chip, payload->key, key_len);
 		if (ret != key_len) {
 			pr_info("trusted_key: key_create failed (%d)\n", ret);
 			goto out;
 		}
 		if (tpm2)
-			ret = tpm_seal_trusted(NULL, payload, options);
+			ret = tpm_seal_trusted(chip, payload, options);
 		else
 			ret = key_seal(payload, options);
 		if (ret < 0)
@@ -1225,17 +1226,26 @@ static int __init init_trusted(void)
 {
 	int ret;
 
+	chip = tpm_default_chip();
+	if (!chip)
+		return -ENOENT;
 	ret = trusted_shash_alloc();
 	if (ret < 0)
-		return ret;
+		goto err_put;
 	ret = register_key_type(&key_type_trusted);
 	if (ret < 0)
-		trusted_shash_release();
+		goto err_release;
+	return 0;
+err_release:
+	trusted_shash_release();
+err_put:
+	put_device(&chip->dev);
 	return ret;
 }
 
 static void __exit cleanup_trusted(void)
 {
+	put_device(&chip->dev);
 	trusted_shash_release();
 	unregister_key_type(&key_type_trusted);
 }
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v10 6/6] tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
                   ` (4 preceding siblings ...)
  2019-02-06 10:57 ` [PATCH v10 5/6] KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip() Roberto Sassu
@ 2019-02-06 10:57 ` Roberto Sassu
  2019-02-06 12:57 ` [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Jarkko Sakkinen
  6 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 10:57 UTC (permalink / raw)
  To: jarkko.sakkinen, zohar, david.safford, monty.wiseman, matthewgarrett
  Cc: linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu, Roberto Sassu

Currently, tpm_pcr_extend() accepts as an input only a SHA1 digest.

This patch replaces the hash parameter of tpm_pcr_extend() with an array of
tpm_digest structures, so that the caller can provide a digest for each PCR
bank currently allocated in the TPM.

tpm_pcr_extend() will not extend banks for which no digest was provided,
as it happened before this patch, but instead it requires that callers
provide the full set of digests. Since the number of digests will always be
chip->nr_allocated_banks, the count parameter has been removed.

Due to the API change, ima_pcr_extend() and pcrlock() have been modified.
Since the number of allocated banks is not known in advance, the memory for
the digests must be dynamically allocated. To avoid performance degradation
and to avoid that a PCR extend is not done due to lack of memory, the array
of tpm_digest structures is allocated by the users of the TPM driver at
initialization time.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Mimi Zohar <zohar@linux.ibm.com> (on x86 for TPM 1.2 & PTT TPM 2.0)
---
 drivers/char/tpm/tpm-interface.c   | 30 ++++++++--------------
 drivers/char/tpm/tpm.h             |  2 +-
 drivers/char/tpm/tpm2-cmd.c        | 10 +++-----
 include/linux/tpm.h                |  5 ++--
 security/integrity/ima/ima.h       |  1 +
 security/integrity/ima/ima_init.c  |  4 +++
 security/integrity/ima/ima_queue.c | 27 +++++++++++++++++++-
 security/keys/trusted.c            | 41 ++++++++++++++++++++++++------
 8 files changed, 82 insertions(+), 38 deletions(-)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index cde2f7cbe0cf..1cef63d6519e 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -478,42 +478,34 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
  * tpm_pcr_extend - extend a PCR value in SHA1 bank.
  * @chip:	a &struct tpm_chip instance, %NULL for the default chip
  * @pcr_idx:	the PCR to be retrieved
- * @hash:	the hash value used to extend the PCR value
+ * @digests:	array of tpm_digest structures used to extend PCRs
  *
- * Note: with TPM 2.0 extends also those banks for which no digest was
- * specified in order to prevent malicious use of those PCR banks.
+ * Note: callers must pass a digest for every allocated PCR bank, in the same
+ * order of the banks in chip->allocated_banks.
  *
  * Return: same as with tpm_transmit_cmd()
  */
-int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)
+int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
+		   struct tpm_digest *digests)
 {
 	int rc;
-	struct tpm_digest *digest_list;
 	int i;
 
 	chip = tpm_find_get_ops(chip);
 	if (!chip)
 		return -ENODEV;
 
-	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-		digest_list = kcalloc(chip->nr_allocated_banks,
-				      sizeof(*digest_list), GFP_KERNEL);
-		if (!digest_list)
-			return -ENOMEM;
-
-		for (i = 0; i < chip->nr_allocated_banks; i++) {
-			digest_list[i].alg_id = chip->allocated_banks[i].alg_id;
-			memcpy(digest_list[i].digest, hash, TPM_DIGEST_SIZE);
-		}
+	for (i = 0; i < chip->nr_allocated_banks; i++)
+		if (digests[i].alg_id != chip->allocated_banks[i].alg_id)
+			return -EINVAL;
 
-		rc = tpm2_pcr_extend(chip, pcr_idx, chip->nr_allocated_banks,
-				     digest_list);
-		kfree(digest_list);
+	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+		rc = tpm2_pcr_extend(chip, pcr_idx, digests);
 		tpm_put_ops(chip);
 		return rc;
 	}
 
-	rc = tpm1_pcr_extend(chip, pcr_idx, hash,
+	rc = tpm1_pcr_extend(chip, pcr_idx, digests[0].digest,
 			     "attempting extend a PCR value");
 	tpm_put_ops(chip);
 	return rc;
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index f20433946ca5..db91423430e4 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -458,7 +458,7 @@ static inline u32 tpm2_rc_value(u32 rc)
 int tpm2_get_timeouts(struct tpm_chip *chip);
 int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
 		  struct tpm_digest *digest, u16 *digest_size_ptr);
-int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
+int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
 		    struct tpm_digest *digests);
 int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
 void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 760893957f13..dc115096e280 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -247,12 +247,11 @@ struct tpm2_null_auth_area {
  *
  * @chip:	TPM chip to use.
  * @pcr_idx:	index of the PCR.
- * @count:	number of digests passed.
  * @digests:	list of pcr banks and corresponding digest values to extend.
  *
  * Return: Same as with tpm_transmit_cmd.
  */
-int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
+int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
 		    struct tpm_digest *digests)
 {
 	struct tpm_buf buf;
@@ -260,9 +259,6 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 	int rc;
 	int i;
 
-	if (count > chip->nr_allocated_banks)
-		return -EINVAL;
-
 	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);
 	if (rc)
 		return rc;
@@ -277,9 +273,9 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,
 	tpm_buf_append_u32(&buf, sizeof(struct tpm2_null_auth_area));
 	tpm_buf_append(&buf, (const unsigned char *)&auth_area,
 		       sizeof(auth_area));
-	tpm_buf_append_u32(&buf, count);
+	tpm_buf_append_u32(&buf, chip->nr_allocated_banks);
 
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < chip->nr_allocated_banks; i++) {
 		tpm_buf_append_u16(&buf, digests[i].alg_id);
 		tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest,
 			       chip->allocated_banks[i].digest_size);
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index f9fea1e4075e..6051d479a44d 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -170,7 +170,8 @@ struct tpm_chip {
 extern int tpm_is_tpm2(struct tpm_chip *chip);
 extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
 			struct tpm_digest *digest);
-extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash);
+extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
+			  struct tpm_digest *digests);
 extern int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen);
 extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max);
 extern int tpm_seal_trusted(struct tpm_chip *chip,
@@ -193,7 +194,7 @@ static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
 }
 
 static inline int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
-				 const u8 *hash)
+				 struct tpm_digest *digests)
 {
 	return -ENODEV;
 }
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index cc12f3449a72..89d65cf8053d 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -153,6 +153,7 @@ int ima_measurements_show(struct seq_file *m, void *v);
 unsigned long ima_get_binary_runtime_size(void);
 int ima_init_template(void);
 void ima_init_template_list(void);
+int __init ima_init_digests(void);
 
 /*
  * used to protect h_table and sha_table
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index 6bb42a9c5e47..6c9295449751 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -123,8 +123,12 @@ int __init ima_init(void)
 	if (rc != 0)
 		return rc;
 
+	/* It can be called before ima_init_digests(), it does not use TPM. */
 	ima_load_kexec_buffer();
 
+	rc = ima_init_digests();
+	if (rc != 0)
+		return rc;
 	rc = ima_add_boot_aggregate();	/* boot aggregate must be first entry */
 	if (rc != 0)
 		return rc;
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index 0e41dc1df1d4..6b6d044e0440 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -27,6 +27,9 @@
 
 #define AUDIT_CAUSE_LEN_MAX 32
 
+/* pre-allocated array of tpm_digest structures to extend a PCR */
+static struct tpm_digest *digests;
+
 LIST_HEAD(ima_measurements);	/* list of all measurements */
 #ifdef CONFIG_IMA_KEXEC
 static unsigned long binary_runtime_size;
@@ -140,11 +143,15 @@ unsigned long ima_get_binary_runtime_size(void)
 static int ima_pcr_extend(const u8 *hash, int pcr)
 {
 	int result = 0;
+	int i;
 
 	if (!ima_tpm_chip)
 		return result;
 
-	result = tpm_pcr_extend(ima_tpm_chip, pcr, hash);
+	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
+		memcpy(digests[i].digest, hash, TPM_DIGEST_SIZE);
+
+	result = tpm_pcr_extend(ima_tpm_chip, pcr, digests);
 	if (result != 0)
 		pr_err("Error Communicating to TPM chip, result: %d\n", result);
 	return result;
@@ -211,3 +218,21 @@ int ima_restore_measurement_entry(struct ima_template_entry *entry)
 	mutex_unlock(&ima_extend_list_mutex);
 	return result;
 }
+
+int __init ima_init_digests(void)
+{
+	int i;
+
+	if (!ima_tpm_chip)
+		return 0;
+
+	digests = kcalloc(ima_tpm_chip->nr_allocated_banks, sizeof(*digests),
+			  GFP_NOFS);
+	if (!digests)
+		return -ENOMEM;
+
+	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
+		digests[i].alg_id = ima_tpm_chip->allocated_banks[i].alg_id;
+
+	return 0;
+}
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 5b852263eae1..bcc9c6ead7fd 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -35,6 +35,7 @@
 static const char hmac_alg[] = "hmac(sha1)";
 static const char hash_alg[] = "sha1";
 static struct tpm_chip *chip;
+static struct tpm_digest *digests;
 
 struct sdesc {
 	struct shash_desc shash;
@@ -380,15 +381,10 @@ EXPORT_SYMBOL_GPL(trusted_tpm_send);
  */
 static int pcrlock(const int pcrnum)
 {
-	unsigned char hash[SHA1_DIGEST_SIZE];
-	int ret;
-
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-	ret = tpm_get_random(chip, hash, SHA1_DIGEST_SIZE);
-	if (ret != SHA1_DIGEST_SIZE)
-		return ret;
-	return tpm_pcr_extend(chip, pcrnum, hash) ? -EINVAL : 0;
+
+	return tpm_pcr_extend(chip, pcrnum, digests) ? -EINVAL : 0;
 }
 
 /*
@@ -1222,6 +1218,29 @@ static int __init trusted_shash_alloc(void)
 	return ret;
 }
 
+static int __init init_digests(void)
+{
+	u8 digest[TPM_MAX_DIGEST_SIZE];
+	int ret;
+	int i;
+
+	ret = tpm_get_random(chip, digest, TPM_MAX_DIGEST_SIZE);
+	if (ret < 0)
+		return ret;
+	if (ret < TPM_MAX_DIGEST_SIZE)
+		return -EFAULT;
+
+	digests = kcalloc(chip->nr_allocated_banks, sizeof(*digests),
+			  GFP_KERNEL);
+	if (!digests)
+		return -ENOMEM;
+
+	for (i = 0; i < chip->nr_allocated_banks; i++)
+		memcpy(digests[i].digest, digest, TPM_MAX_DIGEST_SIZE);
+
+	return 0;
+}
+
 static int __init init_trusted(void)
 {
 	int ret;
@@ -1229,15 +1248,20 @@ static int __init init_trusted(void)
 	chip = tpm_default_chip();
 	if (!chip)
 		return -ENOENT;
-	ret = trusted_shash_alloc();
+	ret = init_digests();
 	if (ret < 0)
 		goto err_put;
+	ret = trusted_shash_alloc();
+	if (ret < 0)
+		goto err_free;
 	ret = register_key_type(&key_type_trusted);
 	if (ret < 0)
 		goto err_release;
 	return 0;
 err_release:
 	trusted_shash_release();
+err_free:
+	kfree(digests);
 err_put:
 	put_device(&chip->dev);
 	return ret;
@@ -1246,6 +1270,7 @@ static int __init init_trusted(void)
 static void __exit cleanup_trusted(void)
 {
 	put_device(&chip->dev);
+	kfree(digests);
 	trusted_shash_release();
 	unregister_key_type(&key_type_trusted);
 }
-- 
2.17.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
                   ` (5 preceding siblings ...)
  2019-02-06 10:57 ` [PATCH v10 6/6] tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend() Roberto Sassu
@ 2019-02-06 12:57 ` Jarkko Sakkinen
  2019-02-06 13:07   ` Roberto Sassu
  6 siblings, 1 reply; 15+ messages in thread
From: Jarkko Sakkinen @ 2019-02-06 12:57 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
> Update
> 
> This version of the patch set includes three additional patches (5-7/7)
> that allow users of the TPM driver to provide a digest for each PCR bank to
> tpm_pcr_extend(). The new patches have been included to facilitate the
> review of all the changes to support TPM 2.0 crypto agility for reading and
> extending PCRs.
> 
> 
> Original patch set description
> 
> The TPM driver currently relies on the crypto subsystem to determine the
> digest size of supported TPM algorithms. In the future, TPM vendors might
> implement new algorithms in their chips, and those algorithms might not
> be supported by the crypto subsystem.
> 
> Usually, vendors provide patches for the new hardware, and likely
> the crypto subsystem will be updated before the new algorithm is
> introduced. However, old kernels might be updated later, after patches
> are included in the mainline kernel. This would leave the opportunity
> for attackers to misuse PCRs, as PCR banks with an unknown algorithm
> are not extended.
> 
> This patch set provides a long term solution for this issue. If a TPM
> algorithm is not known by the crypto subsystem, the TPM driver retrieves
> the digest size from the TPM with a PCR read. All the PCR banks are
> extended, even if the algorithm is not yet supported by the crypto
> subsystem.
> 
> PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
> is stored in the tpm_chip structure and available for users of the TPM
> driver.
> 
> Changelog
> 
> v9:
> - add comment for ima_load_kexec_buffer() in ima_init()
> - move 'digests' and ima_init_digests() to ima_queue.c
> - remove comment for TPM_RETRY
> 
> v8:
> - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
> - replace enum tpm_const with #define
> - rename labels in init_trusted()
> - allocate tpm_digest array after retrieving random data in init_digests()
> 
> v7:
> - use memchr_inv() in tpm2_get_pcr_allocation()
> - add patch to move tpm_chip to include/linux/tpm.h
> - add patch to set the tpm_chip argument in trusted.c to a pointer from
>   tpm_default_chip()
> - remove definition of tpm_extend_digest
> - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
>   first digest passed by the caller of tpm_pcr_extend()
> - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
> - remove padding of SHA1 digest in tpm_pcr_extend()
> - pre-allocate and initialize array of tpm_digest structures in
>   security/keys/trusted.c and security/integrity/ima/ima_init.c 
> 
> v6:
> - squash patches 4-6
> - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
>   members to size and data
> - add comment in tpm2_init_bank_info()
> 
> v5:
> - rename digest_struct variable to digest
> - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
> - rename digest_size member of tpm_bank_list to extend_size
> - change type of alg_id member of tpm_bank_list from u8 to u16
> - add missing semi-colon in pcrlock()
> 
> v4:
> - rename active_banks to allocated_banks
> - replace kmalloc_array() with kcalloc()
> - increment nr_allocated_banks if at least one PCR in the bank is selected
> - pass multiple digests to tpm_pcr_extend()
> 
> v3:
> - remove end marker change
> - replace active_banks static array with pointer to dynamic array
> - remove TPM2_ACTIVE_PCR_BANKS
> 
> v2:
> - change the end marker of the active_banks array
> - check digest size from output of PCR read command
> - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
> 
> v1:
> - modify definition of tpm_pcr_read()
> - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
> 
> 
> Roberto Sassu (6):
>   tpm: dynamically allocate the allocated_banks array
>   tpm: rename and export tpm2_digest and tpm2_algorithms
>   tpm: retrieve digest size of unknown algorithms with PCR read
>   tpm: move tpm_chip definition to include/linux/tpm.h
>   KEYS: trusted: explicitly use tpm_chip structure from
>     tpm_default_chip()
>   tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
> 
>  drivers/char/tpm/tpm-chip.c         |   1 +
>  drivers/char/tpm/tpm-interface.c    |  38 ++++----
>  drivers/char/tpm/tpm.h              | 117 ++---------------------
>  drivers/char/tpm/tpm1-cmd.c         |  12 +++
>  drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
>  include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
>  include/linux/tpm_eventlog.h        |   9 +-
>  security/integrity/ima/ima.h        |   1 +
>  security/integrity/ima/ima_crypto.c |  10 +-
>  security/integrity/ima/ima_init.c   |   4 +
>  security/integrity/ima/ima_queue.c  |  27 +++++-
>  security/keys/trusted.c             |  73 +++++++++++----
>  12 files changed, 349 insertions(+), 208 deletions(-)
> 
> -- 
> 2.17.1
> 

Can you do two things:

1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
to be applied first.
2. Check that this does not cause merge conflicts with the current
   imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".

Thanks.

/Jarkko

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 12:57 ` [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Jarkko Sakkinen
@ 2019-02-06 13:07   ` Roberto Sassu
  2019-02-06 13:54     ` Jarkko Sakkinen
  0 siblings, 1 reply; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 13:07 UTC (permalink / raw)
  To: Jarkko Sakkinen
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On 2/6/2019 1:57 PM, Jarkko Sakkinen wrote:
> On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
>> Update
>>
>> This version of the patch set includes three additional patches (5-7/7)
>> that allow users of the TPM driver to provide a digest for each PCR bank to
>> tpm_pcr_extend(). The new patches have been included to facilitate the
>> review of all the changes to support TPM 2.0 crypto agility for reading and
>> extending PCRs.
>>
>>
>> Original patch set description
>>
>> The TPM driver currently relies on the crypto subsystem to determine the
>> digest size of supported TPM algorithms. In the future, TPM vendors might
>> implement new algorithms in their chips, and those algorithms might not
>> be supported by the crypto subsystem.
>>
>> Usually, vendors provide patches for the new hardware, and likely
>> the crypto subsystem will be updated before the new algorithm is
>> introduced. However, old kernels might be updated later, after patches
>> are included in the mainline kernel. This would leave the opportunity
>> for attackers to misuse PCRs, as PCR banks with an unknown algorithm
>> are not extended.
>>
>> This patch set provides a long term solution for this issue. If a TPM
>> algorithm is not known by the crypto subsystem, the TPM driver retrieves
>> the digest size from the TPM with a PCR read. All the PCR banks are
>> extended, even if the algorithm is not yet supported by the crypto
>> subsystem.
>>
>> PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
>> is stored in the tpm_chip structure and available for users of the TPM
>> driver.
>>
>> Changelog
>>
>> v9:
>> - add comment for ima_load_kexec_buffer() in ima_init()
>> - move 'digests' and ima_init_digests() to ima_queue.c
>> - remove comment for TPM_RETRY
>>
>> v8:
>> - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
>> - replace enum tpm_const with #define
>> - rename labels in init_trusted()
>> - allocate tpm_digest array after retrieving random data in init_digests()
>>
>> v7:
>> - use memchr_inv() in tpm2_get_pcr_allocation()
>> - add patch to move tpm_chip to include/linux/tpm.h
>> - add patch to set the tpm_chip argument in trusted.c to a pointer from
>>    tpm_default_chip()
>> - remove definition of tpm_extend_digest
>> - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
>>    first digest passed by the caller of tpm_pcr_extend()
>> - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
>> - remove padding of SHA1 digest in tpm_pcr_extend()
>> - pre-allocate and initialize array of tpm_digest structures in
>>    security/keys/trusted.c and security/integrity/ima/ima_init.c
>>
>> v6:
>> - squash patches 4-6
>> - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
>>    members to size and data
>> - add comment in tpm2_init_bank_info()
>>
>> v5:
>> - rename digest_struct variable to digest
>> - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
>> - rename digest_size member of tpm_bank_list to extend_size
>> - change type of alg_id member of tpm_bank_list from u8 to u16
>> - add missing semi-colon in pcrlock()
>>
>> v4:
>> - rename active_banks to allocated_banks
>> - replace kmalloc_array() with kcalloc()
>> - increment nr_allocated_banks if at least one PCR in the bank is selected
>> - pass multiple digests to tpm_pcr_extend()
>>
>> v3:
>> - remove end marker change
>> - replace active_banks static array with pointer to dynamic array
>> - remove TPM2_ACTIVE_PCR_BANKS
>>
>> v2:
>> - change the end marker of the active_banks array
>> - check digest size from output of PCR read command
>> - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
>>
>> v1:
>> - modify definition of tpm_pcr_read()
>> - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
>>
>>
>> Roberto Sassu (6):
>>    tpm: dynamically allocate the allocated_banks array
>>    tpm: rename and export tpm2_digest and tpm2_algorithms
>>    tpm: retrieve digest size of unknown algorithms with PCR read
>>    tpm: move tpm_chip definition to include/linux/tpm.h
>>    KEYS: trusted: explicitly use tpm_chip structure from
>>      tpm_default_chip()
>>    tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
>>
>>   drivers/char/tpm/tpm-chip.c         |   1 +
>>   drivers/char/tpm/tpm-interface.c    |  38 ++++----
>>   drivers/char/tpm/tpm.h              | 117 ++---------------------
>>   drivers/char/tpm/tpm1-cmd.c         |  12 +++
>>   drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
>>   include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
>>   include/linux/tpm_eventlog.h        |   9 +-
>>   security/integrity/ima/ima.h        |   1 +
>>   security/integrity/ima/ima_crypto.c |  10 +-
>>   security/integrity/ima/ima_init.c   |   4 +
>>   security/integrity/ima/ima_queue.c  |  27 +++++-
>>   security/keys/trusted.c             |  73 +++++++++++----
>>   12 files changed, 349 insertions(+), 208 deletions(-)
>>
>> -- 
>> 2.17.1
>>
> 
> Can you do two things:
> 
> 1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
> to be applied first.
> 2. Check that this does not cause merge conflicts with the current
>     imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".
> 
> Thanks.

I already applied the patch set on top of linux-tpmdd/next
(41ac27d19b07) and your patch.

Also, there are no conflicts with the current master.

Roberto


> /Jarkko
> 

-- 
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 13:07   ` Roberto Sassu
@ 2019-02-06 13:54     ` Jarkko Sakkinen
  2019-02-06 14:25       ` Roberto Sassu
  0 siblings, 1 reply; 15+ messages in thread
From: Jarkko Sakkinen @ 2019-02-06 13:54 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On Wed, Feb 06, 2019 at 02:07:04PM +0100, Roberto Sassu wrote:
> On 2/6/2019 1:57 PM, Jarkko Sakkinen wrote:
> > On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
> > > Update
> > > 
> > > This version of the patch set includes three additional patches (5-7/7)
> > > that allow users of the TPM driver to provide a digest for each PCR bank to
> > > tpm_pcr_extend(). The new patches have been included to facilitate the
> > > review of all the changes to support TPM 2.0 crypto agility for reading and
> > > extending PCRs.
> > > 
> > > 
> > > Original patch set description
> > > 
> > > The TPM driver currently relies on the crypto subsystem to determine the
> > > digest size of supported TPM algorithms. In the future, TPM vendors might
> > > implement new algorithms in their chips, and those algorithms might not
> > > be supported by the crypto subsystem.
> > > 
> > > Usually, vendors provide patches for the new hardware, and likely
> > > the crypto subsystem will be updated before the new algorithm is
> > > introduced. However, old kernels might be updated later, after patches
> > > are included in the mainline kernel. This would leave the opportunity
> > > for attackers to misuse PCRs, as PCR banks with an unknown algorithm
> > > are not extended.
> > > 
> > > This patch set provides a long term solution for this issue. If a TPM
> > > algorithm is not known by the crypto subsystem, the TPM driver retrieves
> > > the digest size from the TPM with a PCR read. All the PCR banks are
> > > extended, even if the algorithm is not yet supported by the crypto
> > > subsystem.
> > > 
> > > PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
> > > is stored in the tpm_chip structure and available for users of the TPM
> > > driver.
> > > 
> > > Changelog
> > > 
> > > v9:
> > > - add comment for ima_load_kexec_buffer() in ima_init()
> > > - move 'digests' and ima_init_digests() to ima_queue.c
> > > - remove comment for TPM_RETRY
> > > 
> > > v8:
> > > - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
> > > - replace enum tpm_const with #define
> > > - rename labels in init_trusted()
> > > - allocate tpm_digest array after retrieving random data in init_digests()
> > > 
> > > v7:
> > > - use memchr_inv() in tpm2_get_pcr_allocation()
> > > - add patch to move tpm_chip to include/linux/tpm.h
> > > - add patch to set the tpm_chip argument in trusted.c to a pointer from
> > >    tpm_default_chip()
> > > - remove definition of tpm_extend_digest
> > > - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
> > >    first digest passed by the caller of tpm_pcr_extend()
> > > - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
> > > - remove padding of SHA1 digest in tpm_pcr_extend()
> > > - pre-allocate and initialize array of tpm_digest structures in
> > >    security/keys/trusted.c and security/integrity/ima/ima_init.c
> > > 
> > > v6:
> > > - squash patches 4-6
> > > - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
> > >    members to size and data
> > > - add comment in tpm2_init_bank_info()
> > > 
> > > v5:
> > > - rename digest_struct variable to digest
> > > - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
> > > - rename digest_size member of tpm_bank_list to extend_size
> > > - change type of alg_id member of tpm_bank_list from u8 to u16
> > > - add missing semi-colon in pcrlock()
> > > 
> > > v4:
> > > - rename active_banks to allocated_banks
> > > - replace kmalloc_array() with kcalloc()
> > > - increment nr_allocated_banks if at least one PCR in the bank is selected
> > > - pass multiple digests to tpm_pcr_extend()
> > > 
> > > v3:
> > > - remove end marker change
> > > - replace active_banks static array with pointer to dynamic array
> > > - remove TPM2_ACTIVE_PCR_BANKS
> > > 
> > > v2:
> > > - change the end marker of the active_banks array
> > > - check digest size from output of PCR read command
> > > - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
> > > 
> > > v1:
> > > - modify definition of tpm_pcr_read()
> > > - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
> > > 
> > > 
> > > Roberto Sassu (6):
> > >    tpm: dynamically allocate the allocated_banks array
> > >    tpm: rename and export tpm2_digest and tpm2_algorithms
> > >    tpm: retrieve digest size of unknown algorithms with PCR read
> > >    tpm: move tpm_chip definition to include/linux/tpm.h
> > >    KEYS: trusted: explicitly use tpm_chip structure from
> > >      tpm_default_chip()
> > >    tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
> > > 
> > >   drivers/char/tpm/tpm-chip.c         |   1 +
> > >   drivers/char/tpm/tpm-interface.c    |  38 ++++----
> > >   drivers/char/tpm/tpm.h              | 117 ++---------------------
> > >   drivers/char/tpm/tpm1-cmd.c         |  12 +++
> > >   drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
> > >   include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
> > >   include/linux/tpm_eventlog.h        |   9 +-
> > >   security/integrity/ima/ima.h        |   1 +
> > >   security/integrity/ima/ima_crypto.c |  10 +-
> > >   security/integrity/ima/ima_init.c   |   4 +
> > >   security/integrity/ima/ima_queue.c  |  27 +++++-
> > >   security/keys/trusted.c             |  73 +++++++++++----
> > >   12 files changed, 349 insertions(+), 208 deletions(-)
> > > 
> > > -- 
> > > 2.17.1
> > > 
> > 
> > Can you do two things:
> > 
> > 1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
> > to be applied first.
> > 2. Check that this does not cause merge conflicts with the current
> >     imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".
> > 
> > Thanks.
> 
> I already applied the patch set on top of linux-tpmdd/next
> (41ac27d19b07) and your patch.
> 
> Also, there are no conflicts with the current master.
> 
> Roberto

Before getting your new version, I applied:

https://patchwork.kernel.org/project/linux-integrity/list/?series=76223

This causes some merge conflicts:

error: Failed to merge in the changes.
Patch failed at 0003 tpm: retrieve digest size of unknown algorithms with PCR read

/Jarkko

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 13:54     ` Jarkko Sakkinen
@ 2019-02-06 14:25       ` Roberto Sassu
  2019-02-06 15:34         ` Jarkko Sakkinen
  0 siblings, 1 reply; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 14:25 UTC (permalink / raw)
  To: Jarkko Sakkinen
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On 2/6/2019 2:54 PM, Jarkko Sakkinen wrote:
> On Wed, Feb 06, 2019 at 02:07:04PM +0100, Roberto Sassu wrote:
>> On 2/6/2019 1:57 PM, Jarkko Sakkinen wrote:
>>> On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
>>>> Update
>>>>
>>>> This version of the patch set includes three additional patches (5-7/7)
>>>> that allow users of the TPM driver to provide a digest for each PCR bank to
>>>> tpm_pcr_extend(). The new patches have been included to facilitate the
>>>> review of all the changes to support TPM 2.0 crypto agility for reading and
>>>> extending PCRs.
>>>>
>>>>
>>>> Original patch set description
>>>>
>>>> The TPM driver currently relies on the crypto subsystem to determine the
>>>> digest size of supported TPM algorithms. In the future, TPM vendors might
>>>> implement new algorithms in their chips, and those algorithms might not
>>>> be supported by the crypto subsystem.
>>>>
>>>> Usually, vendors provide patches for the new hardware, and likely
>>>> the crypto subsystem will be updated before the new algorithm is
>>>> introduced. However, old kernels might be updated later, after patches
>>>> are included in the mainline kernel. This would leave the opportunity
>>>> for attackers to misuse PCRs, as PCR banks with an unknown algorithm
>>>> are not extended.
>>>>
>>>> This patch set provides a long term solution for this issue. If a TPM
>>>> algorithm is not known by the crypto subsystem, the TPM driver retrieves
>>>> the digest size from the TPM with a PCR read. All the PCR banks are
>>>> extended, even if the algorithm is not yet supported by the crypto
>>>> subsystem.
>>>>
>>>> PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
>>>> is stored in the tpm_chip structure and available for users of the TPM
>>>> driver.
>>>>
>>>> Changelog
>>>>
>>>> v9:
>>>> - add comment for ima_load_kexec_buffer() in ima_init()
>>>> - move 'digests' and ima_init_digests() to ima_queue.c
>>>> - remove comment for TPM_RETRY
>>>>
>>>> v8:
>>>> - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
>>>> - replace enum tpm_const with #define
>>>> - rename labels in init_trusted()
>>>> - allocate tpm_digest array after retrieving random data in init_digests()
>>>>
>>>> v7:
>>>> - use memchr_inv() in tpm2_get_pcr_allocation()
>>>> - add patch to move tpm_chip to include/linux/tpm.h
>>>> - add patch to set the tpm_chip argument in trusted.c to a pointer from
>>>>     tpm_default_chip()
>>>> - remove definition of tpm_extend_digest
>>>> - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
>>>>     first digest passed by the caller of tpm_pcr_extend()
>>>> - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
>>>> - remove padding of SHA1 digest in tpm_pcr_extend()
>>>> - pre-allocate and initialize array of tpm_digest structures in
>>>>     security/keys/trusted.c and security/integrity/ima/ima_init.c
>>>>
>>>> v6:
>>>> - squash patches 4-6
>>>> - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
>>>>     members to size and data
>>>> - add comment in tpm2_init_bank_info()
>>>>
>>>> v5:
>>>> - rename digest_struct variable to digest
>>>> - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
>>>> - rename digest_size member of tpm_bank_list to extend_size
>>>> - change type of alg_id member of tpm_bank_list from u8 to u16
>>>> - add missing semi-colon in pcrlock()
>>>>
>>>> v4:
>>>> - rename active_banks to allocated_banks
>>>> - replace kmalloc_array() with kcalloc()
>>>> - increment nr_allocated_banks if at least one PCR in the bank is selected
>>>> - pass multiple digests to tpm_pcr_extend()
>>>>
>>>> v3:
>>>> - remove end marker change
>>>> - replace active_banks static array with pointer to dynamic array
>>>> - remove TPM2_ACTIVE_PCR_BANKS
>>>>
>>>> v2:
>>>> - change the end marker of the active_banks array
>>>> - check digest size from output of PCR read command
>>>> - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
>>>>
>>>> v1:
>>>> - modify definition of tpm_pcr_read()
>>>> - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
>>>>
>>>>
>>>> Roberto Sassu (6):
>>>>     tpm: dynamically allocate the allocated_banks array
>>>>     tpm: rename and export tpm2_digest and tpm2_algorithms
>>>>     tpm: retrieve digest size of unknown algorithms with PCR read
>>>>     tpm: move tpm_chip definition to include/linux/tpm.h
>>>>     KEYS: trusted: explicitly use tpm_chip structure from
>>>>       tpm_default_chip()
>>>>     tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
>>>>
>>>>    drivers/char/tpm/tpm-chip.c         |   1 +
>>>>    drivers/char/tpm/tpm-interface.c    |  38 ++++----
>>>>    drivers/char/tpm/tpm.h              | 117 ++---------------------
>>>>    drivers/char/tpm/tpm1-cmd.c         |  12 +++
>>>>    drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
>>>>    include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
>>>>    include/linux/tpm_eventlog.h        |   9 +-
>>>>    security/integrity/ima/ima.h        |   1 +
>>>>    security/integrity/ima/ima_crypto.c |  10 +-
>>>>    security/integrity/ima/ima_init.c   |   4 +
>>>>    security/integrity/ima/ima_queue.c  |  27 +++++-
>>>>    security/keys/trusted.c             |  73 +++++++++++----
>>>>    12 files changed, 349 insertions(+), 208 deletions(-)
>>>>
>>>> -- 
>>>> 2.17.1
>>>>
>>>
>>> Can you do two things:
>>>
>>> 1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
>>> to be applied first.
>>> 2. Check that this does not cause merge conflicts with the current
>>>      imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".
>>>
>>> Thanks.
>>
>> I already applied the patch set on top of linux-tpmdd/next
>> (41ac27d19b07) and your patch.
>>
>> Also, there are no conflicts with the current master.
>>
>> Roberto
> 
> Before getting your new version, I applied:
> 
> https://patchwork.kernel.org/project/linux-integrity/list/?series=76223
> 
> This causes some merge conflicts:
> 
> error: Failed to merge in the changes.
> Patch failed at 0003 tpm: retrieve digest size of unknown algorithms with PCR read

I fixed it and patch 4/6. But, I think there is a problem in your patch
'tpm: move tpm_validate_commmand() to tpm2-space.c':

---
-int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, 
u32 cc,
-                      u8 *cmd)
+static int tpm_validate_command(struct tpm_chip *chip, struct tpm_space 
*space,
+                               const void *cmd, size_t len)
+{
+       const struct tpm_header *header = (const void *)cmd;
+       int i;
+       u32 cc;
+       u32 attrs;
+       unsigned int nr_handles;
+
+       if (len < TPM_HEADER_SIZE)
+               return -EINVAL;
+
+       if (chip->nr_commands) {

[...]

+       }
+
+       return cc;
+
---

'cc' may be not initialized before returning the value.

Roberto


> /Jarkko
> 

-- 
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 14:25       ` Roberto Sassu
@ 2019-02-06 15:34         ` Jarkko Sakkinen
  2019-02-06 16:07           ` Roberto Sassu
  0 siblings, 1 reply; 15+ messages in thread
From: Jarkko Sakkinen @ 2019-02-06 15:34 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

[-- Attachment #1: Type: text/plain, Size: 7915 bytes --]

On Wed, Feb 06, 2019 at 03:25:48PM +0100, Roberto Sassu wrote:
> On 2/6/2019 2:54 PM, Jarkko Sakkinen wrote:
> > On Wed, Feb 06, 2019 at 02:07:04PM +0100, Roberto Sassu wrote:
> > > On 2/6/2019 1:57 PM, Jarkko Sakkinen wrote:
> > > > On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
> > > > > Update
> > > > > 
> > > > > This version of the patch set includes three additional patches (5-7/7)
> > > > > that allow users of the TPM driver to provide a digest for each PCR bank to
> > > > > tpm_pcr_extend(). The new patches have been included to facilitate the
> > > > > review of all the changes to support TPM 2.0 crypto agility for reading and
> > > > > extending PCRs.
> > > > > 
> > > > > 
> > > > > Original patch set description
> > > > > 
> > > > > The TPM driver currently relies on the crypto subsystem to determine the
> > > > > digest size of supported TPM algorithms. In the future, TPM vendors might
> > > > > implement new algorithms in their chips, and those algorithms might not
> > > > > be supported by the crypto subsystem.
> > > > > 
> > > > > Usually, vendors provide patches for the new hardware, and likely
> > > > > the crypto subsystem will be updated before the new algorithm is
> > > > > introduced. However, old kernels might be updated later, after patches
> > > > > are included in the mainline kernel. This would leave the opportunity
> > > > > for attackers to misuse PCRs, as PCR banks with an unknown algorithm
> > > > > are not extended.
> > > > > 
> > > > > This patch set provides a long term solution for this issue. If a TPM
> > > > > algorithm is not known by the crypto subsystem, the TPM driver retrieves
> > > > > the digest size from the TPM with a PCR read. All the PCR banks are
> > > > > extended, even if the algorithm is not yet supported by the crypto
> > > > > subsystem.
> > > > > 
> > > > > PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
> > > > > is stored in the tpm_chip structure and available for users of the TPM
> > > > > driver.
> > > > > 
> > > > > Changelog
> > > > > 
> > > > > v9:
> > > > > - add comment for ima_load_kexec_buffer() in ima_init()
> > > > > - move 'digests' and ima_init_digests() to ima_queue.c
> > > > > - remove comment for TPM_RETRY
> > > > > 
> > > > > v8:
> > > > > - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
> > > > > - replace enum tpm_const with #define
> > > > > - rename labels in init_trusted()
> > > > > - allocate tpm_digest array after retrieving random data in init_digests()
> > > > > 
> > > > > v7:
> > > > > - use memchr_inv() in tpm2_get_pcr_allocation()
> > > > > - add patch to move tpm_chip to include/linux/tpm.h
> > > > > - add patch to set the tpm_chip argument in trusted.c to a pointer from
> > > > >     tpm_default_chip()
> > > > > - remove definition of tpm_extend_digest
> > > > > - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
> > > > >     first digest passed by the caller of tpm_pcr_extend()
> > > > > - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
> > > > > - remove padding of SHA1 digest in tpm_pcr_extend()
> > > > > - pre-allocate and initialize array of tpm_digest structures in
> > > > >     security/keys/trusted.c and security/integrity/ima/ima_init.c
> > > > > 
> > > > > v6:
> > > > > - squash patches 4-6
> > > > > - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
> > > > >     members to size and data
> > > > > - add comment in tpm2_init_bank_info()
> > > > > 
> > > > > v5:
> > > > > - rename digest_struct variable to digest
> > > > > - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
> > > > > - rename digest_size member of tpm_bank_list to extend_size
> > > > > - change type of alg_id member of tpm_bank_list from u8 to u16
> > > > > - add missing semi-colon in pcrlock()
> > > > > 
> > > > > v4:
> > > > > - rename active_banks to allocated_banks
> > > > > - replace kmalloc_array() with kcalloc()
> > > > > - increment nr_allocated_banks if at least one PCR in the bank is selected
> > > > > - pass multiple digests to tpm_pcr_extend()
> > > > > 
> > > > > v3:
> > > > > - remove end marker change
> > > > > - replace active_banks static array with pointer to dynamic array
> > > > > - remove TPM2_ACTIVE_PCR_BANKS
> > > > > 
> > > > > v2:
> > > > > - change the end marker of the active_banks array
> > > > > - check digest size from output of PCR read command
> > > > > - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
> > > > > 
> > > > > v1:
> > > > > - modify definition of tpm_pcr_read()
> > > > > - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
> > > > > 
> > > > > 
> > > > > Roberto Sassu (6):
> > > > >     tpm: dynamically allocate the allocated_banks array
> > > > >     tpm: rename and export tpm2_digest and tpm2_algorithms
> > > > >     tpm: retrieve digest size of unknown algorithms with PCR read
> > > > >     tpm: move tpm_chip definition to include/linux/tpm.h
> > > > >     KEYS: trusted: explicitly use tpm_chip structure from
> > > > >       tpm_default_chip()
> > > > >     tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
> > > > > 
> > > > >    drivers/char/tpm/tpm-chip.c         |   1 +
> > > > >    drivers/char/tpm/tpm-interface.c    |  38 ++++----
> > > > >    drivers/char/tpm/tpm.h              | 117 ++---------------------
> > > > >    drivers/char/tpm/tpm1-cmd.c         |  12 +++
> > > > >    drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
> > > > >    include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
> > > > >    include/linux/tpm_eventlog.h        |   9 +-
> > > > >    security/integrity/ima/ima.h        |   1 +
> > > > >    security/integrity/ima/ima_crypto.c |  10 +-
> > > > >    security/integrity/ima/ima_init.c   |   4 +
> > > > >    security/integrity/ima/ima_queue.c  |  27 +++++-
> > > > >    security/keys/trusted.c             |  73 +++++++++++----
> > > > >    12 files changed, 349 insertions(+), 208 deletions(-)
> > > > > 
> > > > > -- 
> > > > > 2.17.1
> > > > > 
> > > > 
> > > > Can you do two things:
> > > > 
> > > > 1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
> > > > to be applied first.
> > > > 2. Check that this does not cause merge conflicts with the current
> > > >      imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".
> > > > 
> > > > Thanks.
> > > 
> > > I already applied the patch set on top of linux-tpmdd/next
> > > (41ac27d19b07) and your patch.
> > > 
> > > Also, there are no conflicts with the current master.
> > > 
> > > Roberto
> > 
> > Before getting your new version, I applied:
> > 
> > https://patchwork.kernel.org/project/linux-integrity/list/?series=76223
> > 
> > This causes some merge conflicts:
> > 
> > error: Failed to merge in the changes.
> > Patch failed at 0003 tpm: retrieve digest size of unknown algorithms with PCR read
> 
> I fixed it and patch 4/6. But, I think there is a problem in your patch
> 'tpm: move tpm_validate_commmand() to tpm2-space.c':
> 
> ---
> -int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32
> cc,
> -                      u8 *cmd)
> +static int tpm_validate_command(struct tpm_chip *chip, struct tpm_space
> *space,
> +                               const void *cmd, size_t len)
> +{
> +       const struct tpm_header *header = (const void *)cmd;
> +       int i;
> +       u32 cc;
> +       u32 attrs;
> +       unsigned int nr_handles;
> +
> +       if (len < TPM_HEADER_SIZE)
> +               return -EINVAL;
> +
> +       if (chip->nr_commands) {
> 
> [...]
> 
> +       }
> +
> +       return cc;
> +
> ---
> 
> 'cc' may be not initialized before returning the value.

Ah. Thank you for catching that one. Can you quickly check the attached
commit? I'll squash it to the corresponding commit.

/Jarkko

[-- Attachment #2: 0001-tpm-fail-tpm_validate_command-if-chip-nr_commands-is.patch --]
[-- Type: text/x-diff, Size: 2704 bytes --]

From 6aa9a3a16a9f4e93d67859c634742b00d743ecb5 Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Date: Wed, 6 Feb 2019 17:26:55 +0200
Subject: [PATCH] tpm: fail tpm_validate_command() if chip->nr_commands is zero

Now that tpm_validate_command() is only on TPM2 space code path, it
should return -EINVAL in the case nr_command is zero, as it should never
be. Not doing this could cause cc to be uninitialized. This commit fixes
the issue.

Fixes: a4bfd02c6b00 ("tpm: move tpm_validate_commmand() to tpm2-space.c")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/tpm2-space.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index a9ced49546ad..4a2773c3374f 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -263,8 +263,9 @@ static int tpm2_map_command(struct tpm_chip *chip, u32 cc, u8 *cmd)
 	return 0;
 }
 
-static int tpm_validate_command(struct tpm_chip *chip, struct tpm_space *space,
-				const void *cmd, size_t len)
+static int tpm_find_and_validate_cc(struct tpm_chip *chip,
+				    struct tpm_space *space,
+				    const void *cmd, size_t len)
 {
 	const struct tpm_header *header = (const void *)cmd;
 	int i;
@@ -272,26 +273,24 @@ static int tpm_validate_command(struct tpm_chip *chip, struct tpm_space *space,
 	u32 attrs;
 	unsigned int nr_handles;
 
-	if (len < TPM_HEADER_SIZE)
+	if (len < TPM_HEADER_SIZE || !chip->nr_commands)
 		return -EINVAL;
 
-	if (chip->nr_commands) {
-		cc = be32_to_cpu(header->ordinal);
+	cc = be32_to_cpu(header->ordinal);
 
-		i = tpm2_find_cc(chip, cc);
-		if (i < 0) {
-			dev_dbg(&chip->dev, "0x%04X is an invalid command\n",
-				cc);
-			return -EOPNOTSUPP;
-		}
-
-		attrs = chip->cc_attrs_tbl[i];
-		nr_handles =
-			4 * ((attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0));
-		if (len < TPM_HEADER_SIZE + 4 * nr_handles)
-			goto err_len;
+	i = tpm2_find_cc(chip, cc);
+	if (i < 0) {
+		dev_dbg(&chip->dev, "0x%04X is an invalid command\n",
+			cc);
+		return -EOPNOTSUPP;
 	}
 
+	attrs = chip->cc_attrs_tbl[i];
+	nr_handles =
+		4 * ((attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0));
+	if (len < TPM_HEADER_SIZE + 4 * nr_handles)
+		goto err_len;
+
 	return cc;
 err_len:
 	dev_dbg(&chip->dev, "%s: insufficient command length %zu", __func__,
@@ -308,7 +307,7 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd,
 	if (!space)
 		return 0;
 
-	cc = tpm_validate_command(chip, space, cmd, cmdsiz);
+	cc = tpm_find_and_validate_cc(chip, space, cmd, cmdsiz);
 	if (cc < 0)
 		return cc;
 
-- 
2.19.1


^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 15:34         ` Jarkko Sakkinen
@ 2019-02-06 16:07           ` Roberto Sassu
  2019-02-06 17:10             ` Jarkko Sakkinen
  0 siblings, 1 reply; 15+ messages in thread
From: Roberto Sassu @ 2019-02-06 16:07 UTC (permalink / raw)
  To: Jarkko Sakkinen
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On 2/6/2019 4:34 PM, Jarkko Sakkinen wrote:
> On Wed, Feb 06, 2019 at 03:25:48PM +0100, Roberto Sassu wrote:
>> On 2/6/2019 2:54 PM, Jarkko Sakkinen wrote:
>>> On Wed, Feb 06, 2019 at 02:07:04PM +0100, Roberto Sassu wrote:
>>>> On 2/6/2019 1:57 PM, Jarkko Sakkinen wrote:
>>>>> On Wed, Feb 06, 2019 at 11:57:18AM +0100, Roberto Sassu wrote:
>>>>>> Update
>>>>>>
>>>>>> This version of the patch set includes three additional patches (5-7/7)
>>>>>> that allow users of the TPM driver to provide a digest for each PCR bank to
>>>>>> tpm_pcr_extend(). The new patches have been included to facilitate the
>>>>>> review of all the changes to support TPM 2.0 crypto agility for reading and
>>>>>> extending PCRs.
>>>>>>
>>>>>>
>>>>>> Original patch set description
>>>>>>
>>>>>> The TPM driver currently relies on the crypto subsystem to determine the
>>>>>> digest size of supported TPM algorithms. In the future, TPM vendors might
>>>>>> implement new algorithms in their chips, and those algorithms might not
>>>>>> be supported by the crypto subsystem.
>>>>>>
>>>>>> Usually, vendors provide patches for the new hardware, and likely
>>>>>> the crypto subsystem will be updated before the new algorithm is
>>>>>> introduced. However, old kernels might be updated later, after patches
>>>>>> are included in the mainline kernel. This would leave the opportunity
>>>>>> for attackers to misuse PCRs, as PCR banks with an unknown algorithm
>>>>>> are not extended.
>>>>>>
>>>>>> This patch set provides a long term solution for this issue. If a TPM
>>>>>> algorithm is not known by the crypto subsystem, the TPM driver retrieves
>>>>>> the digest size from the TPM with a PCR read. All the PCR banks are
>>>>>> extended, even if the algorithm is not yet supported by the crypto
>>>>>> subsystem.
>>>>>>
>>>>>> PCR bank information (TPM algorithm ID, digest size, crypto subsystem ID)
>>>>>> is stored in the tpm_chip structure and available for users of the TPM
>>>>>> driver.
>>>>>>
>>>>>> Changelog
>>>>>>
>>>>>> v9:
>>>>>> - add comment for ima_load_kexec_buffer() in ima_init()
>>>>>> - move 'digests' and ima_init_digests() to ima_queue.c
>>>>>> - remove comment for TPM_RETRY
>>>>>>
>>>>>> v8:
>>>>>> - set digest array length in tpm_digest to new constant TPM_MAX_DIGEST_SIZE
>>>>>> - replace enum tpm_const with #define
>>>>>> - rename labels in init_trusted()
>>>>>> - allocate tpm_digest array after retrieving random data in init_digests()
>>>>>>
>>>>>> v7:
>>>>>> - use memchr_inv() in tpm2_get_pcr_allocation()
>>>>>> - add patch to move tpm_chip to include/linux/tpm.h
>>>>>> - add patch to set the tpm_chip argument in trusted.c to a pointer from
>>>>>>      tpm_default_chip()
>>>>>> - remove definition of tpm_extend_digest
>>>>>> - remove code in tpm2_pcr_extend() to extend unused PCR banks with the
>>>>>>      first digest passed by the caller of tpm_pcr_extend()
>>>>>> - remove count parameter from tpm_pcr_extend() and tpm2_pcr_extend()
>>>>>> - remove padding of SHA1 digest in tpm_pcr_extend()
>>>>>> - pre-allocate and initialize array of tpm_digest structures in
>>>>>>      security/keys/trusted.c and security/integrity/ima/ima_init.c
>>>>>>
>>>>>> v6:
>>>>>> - squash patches 4-6
>>>>>> - rename tpm_bank_list to tpm_extend_digest, extend_size and extend_data
>>>>>>      members to size and data
>>>>>> - add comment in tpm2_init_bank_info()
>>>>>>
>>>>>> v5:
>>>>>> - rename digest_struct variable to digest
>>>>>> - add _head suffix to tcg_efi_specid_event and tcg_pcr_event2
>>>>>> - rename digest_size member of tpm_bank_list to extend_size
>>>>>> - change type of alg_id member of tpm_bank_list from u8 to u16
>>>>>> - add missing semi-colon in pcrlock()
>>>>>>
>>>>>> v4:
>>>>>> - rename active_banks to allocated_banks
>>>>>> - replace kmalloc_array() with kcalloc()
>>>>>> - increment nr_allocated_banks if at least one PCR in the bank is selected
>>>>>> - pass multiple digests to tpm_pcr_extend()
>>>>>>
>>>>>> v3:
>>>>>> - remove end marker change
>>>>>> - replace active_banks static array with pointer to dynamic array
>>>>>> - remove TPM2_ACTIVE_PCR_BANKS
>>>>>>
>>>>>> v2:
>>>>>> - change the end marker of the active_banks array
>>>>>> - check digest size from output of PCR read command
>>>>>> - remove count parameter from tpm_pcr_read() and tpm2_pcr_read()
>>>>>>
>>>>>> v1:
>>>>>> - modify definition of tpm_pcr_read()
>>>>>> - move hash algorithms and definition of tpm2_digest to include/linux/tpm.h
>>>>>>
>>>>>>
>>>>>> Roberto Sassu (6):
>>>>>>      tpm: dynamically allocate the allocated_banks array
>>>>>>      tpm: rename and export tpm2_digest and tpm2_algorithms
>>>>>>      tpm: retrieve digest size of unknown algorithms with PCR read
>>>>>>      tpm: move tpm_chip definition to include/linux/tpm.h
>>>>>>      KEYS: trusted: explicitly use tpm_chip structure from
>>>>>>        tpm_default_chip()
>>>>>>      tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()
>>>>>>
>>>>>>     drivers/char/tpm/tpm-chip.c         |   1 +
>>>>>>     drivers/char/tpm/tpm-interface.c    |  38 ++++----
>>>>>>     drivers/char/tpm/tpm.h              | 117 ++---------------------
>>>>>>     drivers/char/tpm/tpm1-cmd.c         |  12 +++
>>>>>>     drivers/char/tpm/tpm2-cmd.c         | 139 ++++++++++++++++++++--------
>>>>>>     include/linux/tpm.h                 | 126 ++++++++++++++++++++++++-
>>>>>>     include/linux/tpm_eventlog.h        |   9 +-
>>>>>>     security/integrity/ima/ima.h        |   1 +
>>>>>>     security/integrity/ima/ima_crypto.c |  10 +-
>>>>>>     security/integrity/ima/ima_init.c   |   4 +
>>>>>>     security/integrity/ima/ima_queue.c  |  27 +++++-
>>>>>>     security/keys/trusted.c             |  73 +++++++++++----
>>>>>>     12 files changed, 349 insertions(+), 208 deletions(-)
>>>>>>
>>>>>> -- 
>>>>>> 2.17.1
>>>>>>
>>>>>
>>>>> Can you do two things:
>>>>>
>>>>> 1. Check the v3: https://patchwork.kernel.org/patch/10797181/. Needs
>>>>> to be applied first.
>>>>> 2. Check that this does not cause merge conflicts with the current
>>>>>       imaster? If it does, fix them, and use --subject-prefix="RESEND,PATCH v10".
>>>>>
>>>>> Thanks.
>>>>
>>>> I already applied the patch set on top of linux-tpmdd/next
>>>> (41ac27d19b07) and your patch.
>>>>
>>>> Also, there are no conflicts with the current master.
>>>>
>>>> Roberto
>>>
>>> Before getting your new version, I applied:
>>>
>>> https://patchwork.kernel.org/project/linux-integrity/list/?series=76223
>>>
>>> This causes some merge conflicts:
>>>
>>> error: Failed to merge in the changes.
>>> Patch failed at 0003 tpm: retrieve digest size of unknown algorithms with PCR read
>>
>> I fixed it and patch 4/6. But, I think there is a problem in your patch
>> 'tpm: move tpm_validate_commmand() to tpm2-space.c':
>>
>> ---
>> -int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32
>> cc,
>> -                      u8 *cmd)
>> +static int tpm_validate_command(struct tpm_chip *chip, struct tpm_space
>> *space,
>> +                               const void *cmd, size_t len)
>> +{
>> +       const struct tpm_header *header = (const void *)cmd;
>> +       int i;
>> +       u32 cc;
>> +       u32 attrs;
>> +       unsigned int nr_handles;
>> +
>> +       if (len < TPM_HEADER_SIZE)
>> +               return -EINVAL;
>> +
>> +       if (chip->nr_commands) {
>>
>> [...]
>>
>> +       }
>> +
>> +       return cc;
>> +
>> ---
>>
>> 'cc' may be not initialized before returning the value.
> 
> Ah. Thank you for catching that one. Can you quickly check the attached
> commit? I'll squash it to the corresponding commit.

Seems ok to me. I'll send patch 3/6 and 4/6.

Roberto


> /Jarkko
> 

-- 
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 16:07           ` Roberto Sassu
@ 2019-02-06 17:10             ` Jarkko Sakkinen
  2019-02-07 10:58               ` Roberto Sassu
  0 siblings, 1 reply; 15+ messages in thread
From: Jarkko Sakkinen @ 2019-02-06 17:10 UTC (permalink / raw)
  To: Roberto Sassu
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On Wed, Feb 06, 2019 at 05:07:49PM +0100, Roberto Sassu wrote:
> Seems ok to me. I'll send patch 3/6 and 4/6.

Your series has been applied to master and next. Thank you.

/Jarkko

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM
  2019-02-06 17:10             ` Jarkko Sakkinen
@ 2019-02-07 10:58               ` Roberto Sassu
  0 siblings, 0 replies; 15+ messages in thread
From: Roberto Sassu @ 2019-02-07 10:58 UTC (permalink / raw)
  To: Jarkko Sakkinen
  Cc: zohar, david.safford, monty.wiseman, matthewgarrett,
	linux-integrity, linux-security-module, keyrings, linux-kernel,
	silviu.vlasceanu

On 2/6/2019 6:10 PM, Jarkko Sakkinen wrote:
> On Wed, Feb 06, 2019 at 05:07:49PM +0100, Roberto Sassu wrote:
>> Seems ok to me. I'll send patch 3/6 and 4/6.
> 
> Your series has been applied to master and next. Thank you.

Thanks.

Roberto


> /Jarkko
> 

-- 
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, back to index

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-06 10:57 [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 1/6] tpm: dynamically allocate the allocated_banks array Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 2/6] tpm: rename and export tpm2_digest and tpm2_algorithms Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 3/6] tpm: retrieve digest size of unknown algorithms with PCR read Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 4/6] tpm: move tpm_chip definition to include/linux/tpm.h Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 5/6] KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip() Roberto Sassu
2019-02-06 10:57 ` [PATCH v10 6/6] tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend() Roberto Sassu
2019-02-06 12:57 ` [PATCH v10 0/6] tpm: retrieve digest size of unknown algorithms from TPM Jarkko Sakkinen
2019-02-06 13:07   ` Roberto Sassu
2019-02-06 13:54     ` Jarkko Sakkinen
2019-02-06 14:25       ` Roberto Sassu
2019-02-06 15:34         ` Jarkko Sakkinen
2019-02-06 16:07           ` Roberto Sassu
2019-02-06 17:10             ` Jarkko Sakkinen
2019-02-07 10:58               ` Roberto Sassu

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org linux-security-module@archiver.kernel.org
	public-inbox-index linux-security-module


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/ public-inbox