| Message ID | 20170329102452.32212-3-roberto.sassu@huawei.com |
|---|---|
| State | New |
| Headers | show |
On Wed, Mar 29, 2017 at 12:24:50PM +0200, Roberto Sassu wrote: > Introduce these functions to convert between TPM and crypto algorithm IDs. Why is this needed? /Jarkko > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > --- > drivers/char/tpm/tpm-interface.c | 51 ++++++++++++++++++++++++++++++++++++++++ > drivers/char/tpm/tpm.h | 11 --------- > drivers/char/tpm/tpm2-cmd.c | 42 +++++++++------------------------ > include/linux/tpm.h | 22 +++++++++++++++++ > 4 files changed, 84 insertions(+), 42 deletions(-) > > diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c > index bd2128e..0b6cb87 100644 > --- a/drivers/char/tpm/tpm-interface.c > +++ b/drivers/char/tpm/tpm-interface.c > @@ -328,6 +328,57 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, > } > EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); > > +struct tpm2_hash { > + unsigned int crypto_id; > + unsigned int tpm_id; > +}; > + > +static struct tpm2_hash tpm2_hash_map[] = { > + {HASH_ALGO_SHA1, TPM2_ALG_SHA1}, > + {HASH_ALGO_SHA256, TPM2_ALG_SHA256}, > + {HASH_ALGO_SHA384, TPM2_ALG_SHA384}, > + {HASH_ALGO_SHA512, TPM2_ALG_SHA512}, > + {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256}, > +}; > + > +/** > + * tpm2_pcr_algo_to_crypto() - convert from TPM ID to crypto ID > + * @tpm_id: TPM ID > + * > + * Return: crypto ID > + */ > +enum hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id) > +{ > + int i; > + > + for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { > + if (tpm_id == tpm2_hash_map[i].tpm_id) > + return tpm2_hash_map[i].crypto_id; > + } > + > + return HASH_ALGO__LAST; > +} > +EXPORT_SYMBOL_GPL(tpm2_pcr_algo_to_crypto); > + > +/** > + * tpm2_pcr_algo_from_crypto() - convert from crypto ID to TPM ID > + * @crypto_id: crypto ID > + * > + * Return: TPM ID > + */ > +enum tpm2_algorithms tpm2_pcr_algo_from_crypto(enum hash_algo crypto_id) > +{ > + int i; > + > + for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { > + if (crypto_id == tpm2_hash_map[i].crypto_id) > + return tpm2_hash_map[i].tpm_id; > + } > + > + return TPM2_ALG_ERROR; > +} > +EXPORT_SYMBOL_GPL(tpm2_pcr_algo_from_crypto); > + > /** > * tmp_transmit - Internal kernel interface to transmit TPM commands. > * > diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h > index 4937b56..e20f3ae 100644 > --- a/drivers/char/tpm/tpm.h > +++ b/drivers/char/tpm/tpm.h > @@ -95,17 +95,6 @@ enum tpm2_return_codes { > TPM2_RC_TESTING = 0x090A, /* RC_WARN */ > }; > > -enum tpm2_algorithms { > - TPM2_ALG_ERROR = 0x0000, > - TPM2_ALG_SHA1 = 0x0004, > - TPM2_ALG_KEYEDHASH = 0x0008, > - TPM2_ALG_SHA256 = 0x000B, > - TPM2_ALG_SHA384 = 0x000C, > - TPM2_ALG_SHA512 = 0x000D, > - TPM2_ALG_NULL = 0x0010, > - TPM2_ALG_SM3_256 = 0x0012, > -}; > - > enum tpm2_command_codes { > TPM2_CC_FIRST = 0x011F, > TPM2_CC_SELF_TEST = 0x0143, > diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c > index f4d534c..e2ff95a 100644 > --- a/drivers/char/tpm/tpm2-cmd.c > +++ b/drivers/char/tpm/tpm2-cmd.c > @@ -92,19 +92,6 @@ struct tpm2_cmd { > union tpm2_cmd_params params; > } __packed; > > -struct tpm2_hash { > - unsigned int crypto_id; > - unsigned int tpm_id; > -}; > - > -static struct tpm2_hash tpm2_hash_map[] = { > - {HASH_ALGO_SHA1, TPM2_ALG_SHA1}, > - {HASH_ALGO_SHA256, TPM2_ALG_SHA256}, > - {HASH_ALGO_SHA384, TPM2_ALG_SHA384}, > - {HASH_ALGO_SHA512, TPM2_ALG_SHA512}, > - {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256}, > -}; > - > /* > * Array with one entry per ordinal defining the maximum amount > * of time the chip could take to return the result. The values > @@ -321,7 +308,6 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count, > struct tpm2_null_auth_area auth_area; > int rc; > int i; > - int j; > > if (count > ARRAY_SIZE(chip->active_banks)) > return -EINVAL; > @@ -346,14 +332,15 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count, > tpm_buf_append_u32(&buf, count); > > for (i = 0; i < count; i++) { > - for (j = 0; j < ARRAY_SIZE(tpm2_hash_map); j++) { > - if (digests[i].alg_id != tpm2_hash_map[j].tpm_id) > - continue; > - tpm_buf_append_u16(&buf, digests[i].alg_id); > - tpm_buf_append(&buf, (const unsigned char > - *)&digests[i].digest, > - hash_digest_size[tpm2_hash_map[j].crypto_id]); > - } > + enum tpm2_algorithms tpm_id = digests[i].alg_id; > + enum hash_algo crypto_id = tpm2_pcr_algo_to_crypto(tpm_id); > + > + if (crypto_id == HASH_ALGO__LAST) > + continue; > + > + tpm_buf_append_u16(&buf, digests[i].alg_id); > + tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest, > + hash_digest_size[crypto_id]); > } > > rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, 0, > @@ -487,17 +474,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, > unsigned int blob_len; > struct tpm_buf buf; > u32 hash, rlength; > - int i; > int rc; > > - for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { > - if (options->hash == tpm2_hash_map[i].crypto_id) { > - hash = tpm2_hash_map[i].tpm_id; > - break; > - } > - } > - > - if (i == ARRAY_SIZE(tpm2_hash_map)) > + hash = tpm2_pcr_algo_from_crypto(options->hash); > + if (hash == TPM2_ALG_ERROR) > return -EINVAL; > > rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); > diff --git a/include/linux/tpm.h b/include/linux/tpm.h > index da158f0..14b4a42 100644 > --- a/include/linux/tpm.h > +++ b/include/linux/tpm.h > @@ -37,6 +37,17 @@ enum TPM_OPS_FLAGS { > TPM_OPS_AUTO_STARTUP = BIT(0), > }; > > +enum tpm2_algorithms { > + TPM2_ALG_ERROR = 0x0000, > + TPM2_ALG_SHA1 = 0x0004, > + TPM2_ALG_KEYEDHASH = 0x0008, > + TPM2_ALG_SHA256 = 0x000B, > + TPM2_ALG_SHA384 = 0x000C, > + TPM2_ALG_SHA512 = 0x000D, > + TPM2_ALG_NULL = 0x0010, > + TPM2_ALG_SM3_256 = 0x0012, > +}; > + > struct tpm_class_ops { > unsigned int flags; > const u8 req_complete_mask; > @@ -53,6 +64,8 @@ struct tpm_class_ops { > > #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) > > +extern enum hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id); > +extern enum tpm2_algorithms tpm2_pcr_algo_from_crypto(enum hash_algo crypto_id); > extern int tpm_is_tpm2(u32 chip_num); > extern int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf); > extern int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash); > @@ -65,6 +78,15 @@ extern int tpm_unseal_trusted(u32 chip_num, > struct trusted_key_payload *payload, > struct trusted_key_options *options); > #else > +static inline hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id) > +{ > + return -ENODEV; > +} > +static inline enum tpm2_algorithms tpm2_pcr_algo_from_crypto( > + enum hash_algo crypto_id); > +{ > + return -ENODEV; > +} > static inline int tpm_is_tpm2(u32 chip_num) > { > return -ENODEV; > -- > 2.9.3 > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > tpmdd-devel mailing list > tpmdd-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/tpmdd-devel ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
On 4/5/2017 2:12 PM, Jarkko Sakkinen wrote: > On Wed, Mar 29, 2017 at 12:24:50PM +0200, Roberto Sassu wrote: >> Introduce these functions to convert between TPM and crypto algorithm IDs. > > Why is this needed? I'm sorry for the short explanation. I will provide a detailed description in the reply of your emails and add the text in the next version of the patch set. Currently, tpm_pcr_extend(), for extending a PCR, accepts as input the SHA1 of an event data. Extending PCRs is needed in order to protect the integrity of an event log (e.g. the IMA measurements list). With TPM 2.0, it is necessary to expose new functions because the event data digest can be calculated with multiple algorithms. TPM 2.0 introduced new challenges that were not present before. How users of the TPM: - know which algorithms the TPM supports? - can provide multiple digests to the TPM driver interface? - can calculate the digest of event data, since the TPM driver stores TPM algorithm IDs, which are different from IDs defined by the crypto subsystem? The patch set I published tries to address these challenges. Regarding the type of data that should be returned to TPM users, the choice I made was to return to TPM users the TPM algorithms IDs (instead of IDs defined by the crypto subsystem). This way, I give to TPM users the flexibility to decide what information they provide to consumers of the event log (TPM or crypto IDs) and the possibility to calculate the event data digest with the crypto subsystem. Roberto ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
On Wed, Apr 05, 2017 at 03:03:16PM +0200, Roberto Sassu wrote: > On 4/5/2017 2:12 PM, Jarkko Sakkinen wrote: > > On Wed, Mar 29, 2017 at 12:24:50PM +0200, Roberto Sassu wrote: > > > Introduce these functions to convert between TPM and crypto algorithm IDs. > > > > Why is this needed? > > I'm sorry for the short explanation. I will provide a detailed > description in the reply of your emails and add the text in > the next version of the patch set. > > Currently, tpm_pcr_extend(), for extending a PCR, accepts as input > the SHA1 of an event data. Extending PCRs is needed in order to protect > the integrity of an event log (e.g. the IMA measurements list). > > With TPM 2.0, it is necessary to expose new functions because > the event data digest can be calculated with multiple algorithms. > > TPM 2.0 introduced new challenges that were not present before. > How users of the TPM: > > - know which algorithms the TPM supports? > > - can provide multiple digests to the TPM driver interface? > > - can calculate the digest of event data, since the TPM driver > stores TPM algorithm IDs, which are different from IDs defined > by the crypto subsystem? > > The patch set I published tries to address these challenges. > > Regarding the type of data that should be returned to TPM users, > the choice I made was to return to TPM users the TPM algorithms IDs > (instead of IDs defined by the crypto subsystem). > > This way, I give to TPM users the flexibility to decide what > information they provide to consumers of the event log (TPM or > crypto IDs) and the possibility to calculate the event data > digest with the crypto subsystem. > > Roberto Which one is needed for IMA? I mean for in-kernel API you should not add any extra flexibility. Please implement the patch set with the minimal flexibility in mind. Just enough to get IMA uses cases done and explain in the commit messages your rationale based on requirements of the IMA. /Jarkko ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
On 4/5/2017 3:43 PM, Jarkko Sakkinen wrote: > Which one is needed for IMA? I mean for in-kernel API you should not add > any extra flexibility. Please implement the patch set with the minimal > flexibility in mind. Just enough to get IMA uses cases done and explain > in the commit messages your rationale based on requirements of the IMA. Currently IMA is using crypto IDs, but if a TPM algorithm is not supported by the crypto subsystem, its TPM ID could be used to perform the hash operation directly with the TPM. I was thinking to send to TPM users crypto IDs. However, tpm2_pcr_extend() accepts as input a tpm2_digest structure, which includes a TPM ID. To use crypto IDs, TPM users could provide concatenated digests in an array of unsigned chars. But then, tpm_pcr_extend() would have to extract each digest and place it in a tpm2_digest structure, before calling tpm2_pcr_extend(). Roberto ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index bd2128e..0b6cb87 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -328,6 +328,57 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, } EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); +struct tpm2_hash { + unsigned int crypto_id; + unsigned int tpm_id; +}; + +static struct tpm2_hash tpm2_hash_map[] = { + {HASH_ALGO_SHA1, TPM2_ALG_SHA1}, + {HASH_ALGO_SHA256, TPM2_ALG_SHA256}, + {HASH_ALGO_SHA384, TPM2_ALG_SHA384}, + {HASH_ALGO_SHA512, TPM2_ALG_SHA512}, + {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256}, +}; + +/** + * tpm2_pcr_algo_to_crypto() - convert from TPM ID to crypto ID + * @tpm_id: TPM ID + * + * Return: crypto ID + */ +enum hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { + if (tpm_id == tpm2_hash_map[i].tpm_id) + return tpm2_hash_map[i].crypto_id; + } + + return HASH_ALGO__LAST; +} +EXPORT_SYMBOL_GPL(tpm2_pcr_algo_to_crypto); + +/** + * tpm2_pcr_algo_from_crypto() - convert from crypto ID to TPM ID + * @crypto_id: crypto ID + * + * Return: TPM ID + */ +enum tpm2_algorithms tpm2_pcr_algo_from_crypto(enum hash_algo crypto_id) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { + if (crypto_id == tpm2_hash_map[i].crypto_id) + return tpm2_hash_map[i].tpm_id; + } + + return TPM2_ALG_ERROR; +} +EXPORT_SYMBOL_GPL(tpm2_pcr_algo_from_crypto); + /** * tmp_transmit - Internal kernel interface to transmit TPM commands. * diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 4937b56..e20f3ae 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -95,17 +95,6 @@ enum tpm2_return_codes { TPM2_RC_TESTING = 0x090A, /* RC_WARN */ }; -enum tpm2_algorithms { - TPM2_ALG_ERROR = 0x0000, - TPM2_ALG_SHA1 = 0x0004, - TPM2_ALG_KEYEDHASH = 0x0008, - TPM2_ALG_SHA256 = 0x000B, - TPM2_ALG_SHA384 = 0x000C, - TPM2_ALG_SHA512 = 0x000D, - TPM2_ALG_NULL = 0x0010, - TPM2_ALG_SM3_256 = 0x0012, -}; - enum tpm2_command_codes { TPM2_CC_FIRST = 0x011F, TPM2_CC_SELF_TEST = 0x0143, diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index f4d534c..e2ff95a 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -92,19 +92,6 @@ struct tpm2_cmd { union tpm2_cmd_params params; } __packed; -struct tpm2_hash { - unsigned int crypto_id; - unsigned int tpm_id; -}; - -static struct tpm2_hash tpm2_hash_map[] = { - {HASH_ALGO_SHA1, TPM2_ALG_SHA1}, - {HASH_ALGO_SHA256, TPM2_ALG_SHA256}, - {HASH_ALGO_SHA384, TPM2_ALG_SHA384}, - {HASH_ALGO_SHA512, TPM2_ALG_SHA512}, - {HASH_ALGO_SM3_256, TPM2_ALG_SM3_256}, -}; - /* * Array with one entry per ordinal defining the maximum amount * of time the chip could take to return the result. The values @@ -321,7 +308,6 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count, struct tpm2_null_auth_area auth_area; int rc; int i; - int j; if (count > ARRAY_SIZE(chip->active_banks)) return -EINVAL; @@ -346,14 +332,15 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count, tpm_buf_append_u32(&buf, count); for (i = 0; i < count; i++) { - for (j = 0; j < ARRAY_SIZE(tpm2_hash_map); j++) { - if (digests[i].alg_id != tpm2_hash_map[j].tpm_id) - continue; - tpm_buf_append_u16(&buf, digests[i].alg_id); - tpm_buf_append(&buf, (const unsigned char - *)&digests[i].digest, - hash_digest_size[tpm2_hash_map[j].crypto_id]); - } + enum tpm2_algorithms tpm_id = digests[i].alg_id; + enum hash_algo crypto_id = tpm2_pcr_algo_to_crypto(tpm_id); + + if (crypto_id == HASH_ALGO__LAST) + continue; + + tpm_buf_append_u16(&buf, digests[i].alg_id); + tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest, + hash_digest_size[crypto_id]); } rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, 0, @@ -487,17 +474,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, unsigned int blob_len; struct tpm_buf buf; u32 hash, rlength; - int i; int rc; - for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { - if (options->hash == tpm2_hash_map[i].crypto_id) { - hash = tpm2_hash_map[i].tpm_id; - break; - } - } - - if (i == ARRAY_SIZE(tpm2_hash_map)) + hash = tpm2_pcr_algo_from_crypto(options->hash); + if (hash == TPM2_ALG_ERROR) return -EINVAL; rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index da158f0..14b4a42 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -37,6 +37,17 @@ enum TPM_OPS_FLAGS { TPM_OPS_AUTO_STARTUP = BIT(0), }; +enum tpm2_algorithms { + TPM2_ALG_ERROR = 0x0000, + TPM2_ALG_SHA1 = 0x0004, + TPM2_ALG_KEYEDHASH = 0x0008, + TPM2_ALG_SHA256 = 0x000B, + TPM2_ALG_SHA384 = 0x000C, + TPM2_ALG_SHA512 = 0x000D, + TPM2_ALG_NULL = 0x0010, + TPM2_ALG_SM3_256 = 0x0012, +}; + struct tpm_class_ops { unsigned int flags; const u8 req_complete_mask; @@ -53,6 +64,8 @@ struct tpm_class_ops { #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) +extern enum hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id); +extern enum tpm2_algorithms tpm2_pcr_algo_from_crypto(enum hash_algo crypto_id); extern int tpm_is_tpm2(u32 chip_num); extern int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf); extern int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash); @@ -65,6 +78,15 @@ extern int tpm_unseal_trusted(u32 chip_num, struct trusted_key_payload *payload, struct trusted_key_options *options); #else +static inline hash_algo tpm2_pcr_algo_to_crypto(enum tpm2_algorithms tpm_id) +{ + return -ENODEV; +} +static inline enum tpm2_algorithms tpm2_pcr_algo_from_crypto( + enum hash_algo crypto_id); +{ + return -ENODEV; +} static inline int tpm_is_tpm2(u32 chip_num) { return -ENODEV;
Introduce these functions to convert between TPM and crypto algorithm IDs. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> --- drivers/char/tpm/tpm-interface.c | 51 ++++++++++++++++++++++++++++++++++++++++ drivers/char/tpm/tpm.h | 11 --------- drivers/char/tpm/tpm2-cmd.c | 42 +++++++++------------------------ include/linux/tpm.h | 22 +++++++++++++++++ 4 files changed, 84 insertions(+), 42 deletions(-)