From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752038AbbJBIjB (ORCPT ); Fri, 2 Oct 2015 04:39:01 -0400 Received: from mga09.intel.com ([134.134.136.24]:63105 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751679AbbJBIi6 (ORCPT ); Fri, 2 Oct 2015 04:38:58 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.17,622,1437462000"; d="scan'208";a="572675380" From: Jarkko Sakkinen To: tpmdd-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Cc: peterhuewe@gmx.de, gregkh@linuxfoundation.org, jgunthorpe@obsidianresearch.com, akpm@linux-foundation.org, mjg59@srcf.ucam.org, Jarkko Sakkinen , Marcel Selhorst , David Safford , Mimi Zohar , David Howells , James Morris , "Serge E. Hallyn" , linux-security-module@vger.kernel.org (open list:KEYS-TRUSTED), keyrings@vger.kernel.org (open list:KEYS-TRUSTED) Subject: [PATCH 4/4] keys, trusted: seal/unseal with TPM 2.0 chips Date: Fri, 2 Oct 2015 11:38:18 +0300 Message-Id: <1443775102-9727-5-git-send-email-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1443775102-9727-1-git-send-email-jarkko.sakkinen@linux.intel.com> References: <1443775102-9727-1-git-send-email-jarkko.sakkinen@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Call tpm_seal_trusted() and tpm_unseal_trusted() for TPM 2.0 chips. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm2-cmd.c | 2 +- include/linux/tpm_command.h | 1 - security/keys/trusted.c | 18 ++++++++++++++---- security/keys/trusted.h | 7 +++++++ 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index 0986c96..0fba698 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -422,7 +422,7 @@ static int tpm2_load(struct tpm_chip *chip, options->keyauth /* hmac */, TPM_DIGEST_SIZE); - tpm_buf_append(&buf, payload->blob, payload->blob_len); + tpm_buf_append(&buf, payload->blob, blob_len); rc = tpm_transmit_cmd(chip, buf.data, TPM_BUF_SIZE, "loading blob"); if (!rc) diff --git a/include/linux/tpm_command.h b/include/linux/tpm_command.h index 727512e..d7b0f82 100644 --- a/include/linux/tpm_command.h +++ b/include/linux/tpm_command.h @@ -22,7 +22,6 @@ #define TPM_ORD_UNSEAL 24 /* Other constants */ -#define SRKHANDLE 0x40000000 #define TPM_NONCE_SIZE 20 #endif diff --git a/security/keys/trusted.c b/security/keys/trusted.c index c0594cb..f6557b1 100644 --- a/security/keys/trusted.c +++ b/security/keys/trusted.c @@ -601,7 +601,7 @@ static int tpm_unseal(struct tpm_buf *tb, } ordinal = htonl(TPM_ORD_UNSEAL); - keyhndl = htonl(SRKHANDLE); + keyhndl = htonl(TPM1_SRKHANDLE); ret = tpm_get_random(TPM_ANY_NUM, nonceodd, TPM_NONCE_SIZE); if (ret != TPM_NONCE_SIZE) { pr_info("trusted_key: tpm_get_random failed (%d)\n", ret); @@ -867,7 +867,11 @@ static struct trusted_key_options *trusted_options_alloc(void) if (options) { /* set any non-zero defaults */ options->keytype = SRK_keytype; - options->keyhandle = SRKHANDLE; + + if (tpm_is_tpm2(TPM_ANY_NUM)) + options->keyhandle = TPM2_SRKHANDLE; + else + options->keyhandle = TPM1_SRKHANDLE; } return options; } @@ -937,7 +941,10 @@ static int trusted_instantiate(struct key *key, switch (key_cmd) { case Opt_load: - ret = key_unseal(payload, options); + if (tpm_is_tpm2(TPM_ANY_NUM)) + ret = tpm_unseal_trusted(TPM_ANY_NUM, payload, options); + else + ret = key_unseal(payload, options); dump_payload(payload); dump_options(options); if (ret < 0) @@ -950,7 +957,10 @@ static int trusted_instantiate(struct key *key, pr_info("trusted_key: key_create failed (%d)\n", ret); goto out; } - ret = key_seal(payload, options); + if (tpm_is_tpm2(TPM_ANY_NUM)) + ret = tpm_seal_trusted(TPM_ANY_NUM, payload, options); + else + ret = key_seal(payload, options); if (ret < 0) pr_info("trusted_key: key_seal failed (%d)\n", ret); break; diff --git a/security/keys/trusted.h b/security/keys/trusted.h index ff001a5..fc32c47 100644 --- a/security/keys/trusted.h +++ b/security/keys/trusted.h @@ -12,6 +12,13 @@ #define TPM_RETURN_OFFSET 6 #define TPM_DATA_OFFSET 10 +/* Transient object handles start from 0x80000000 in TPM 2.0, which makes it + * a sane default. + */ + +#define TPM1_SRKHANDLE 0x40000000 +#define TPM2_SRKHANDLE 0x80000000 + #define LOAD32(buffer, offset) (ntohl(*(uint32_t *)&buffer[offset])) #define LOAD32N(buffer, offset) (*(uint32_t *)&buffer[offset]) #define LOAD16(buffer, offset) (ntohs(*(uint16_t *)&buffer[offset])) -- 2.5.0