linux-kernel - RE: [PATCH v7 00/21] tpm: separate tpm 1.x and tpm 2.x commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5B8DA87D05A7694D9FA63FD143655C1B9D9FA974@hasmsx109.ger.corp.intel.com>
Date:   Mon, 22 Oct 2018 17:12:06 +0000
From:   "Winkler, Tomas" <tomas.winkler@...el.com>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
CC:     Jason Gunthorpe <jgg@...pe.ca>,
        Nayna Jain <nayna@...ux.vnet.ibm.com>,
        "Usyskin, Alexander" <alexander.usyskin@...el.com>,
        "Struk, Tadeusz" <tadeusz.struk@...el.com>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v7 00/21] tpm: separate tpm 1.x and tpm 2.x commands

> 
> On Fri, 19 Oct 2018, Tomas Winkler wrote:
> > This patch series provides initial separation of tpm 1.x and tpm 2.x
> > commands, in foresight that the tpm 1.x chips will eventually phase
> > out and can be compiled out for modern systems.
> > A new file is added tpm1-cmd.c that contains tpm 1.x specific commands.
> > In addition, tpm 1.x commands are now implemented using tpm_buf
> > structure and instead of tpm_cmd_t construct. The latter is now removed.
> >
> > Note: my tpm 1.x HW availability is limited hence some more testing is
> needed.
> >
> > This series also contains two trivial cleanups and addition of new
> > commands by TCG spec 1.36, now supported on new Intet's platforms.
> >
> > V6: 1. Dropping tpm: move pcr extend code to tpm2-cmd.c and rebasing
> code over that change
> >    2. Trivial fixes in kdoc and header
> > V7: 1. Add backportable patch for nuvoton duration calculation
> >    2. Rebase durations patches over it.
> >    3. Fix notorious typo tmp->tpm
> >
> >
> > Tomas Winkler (21):
> >  tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
> >  tpm2: add new tpm2 commands according to TCG 1.36
> >  tpm: sort objects in the Makefile
> >  tpm: factor out tpm 1.x duration calculation to tpm1-cmd.c
> >  tpm: add tpm_calc_ordinal_duration() wrapper
> >  tpm: factor out tpm_get_timeouts()
> >  tpm: move tpm1_pcr_extend to tpm1-cmd.c
> >  tpm: move tpm_getcap to tpm1-cmd.c
> >  tpm: factor out tpm1_get_random into tpm1-cmd.c
> >  tpm: move tpm 1.x selftest code from tpm-interface.c tpm1-cmd.c
> >  tpm: factor out tpm 1.x pm suspend flow into tpm1-cmd.c
> >  tpm: factor out tpm_startup function
> >  tpm: add tpm_auto_startup() into tpm-interface.c
> >  tpm: tpm-interface.c drop unused macros
> >  tpm: tpm-space.c remove unneeded semicolon
> >  tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure
> >  tpm1: implement tpm1_pcr_read_dev() using tpm_buf structure
> >  tpm1: rename tpm1_pcr_read_dev to tpm1_pcr_read()
> >  tpm1: reimplement SAVESTATE using tpm_buf
> >  tpm1: reimplement tpm1_continue_selftest() using tpm_buf
> >  tpm: use u32 instead of int for PCR index
> >
> > drivers/char/tpm/Makefile            |  16 +-
> > drivers/char/tpm/st33zp24/st33zp24.c |   2 +-
> > drivers/char/tpm/tpm-chip.c          |  11 +-
> > drivers/char/tpm/tpm-interface.c     | 817 +++--------------------------------
> > drivers/char/tpm/tpm-sysfs.c         |  52 +--
> > drivers/char/tpm/tpm.h               |  97 ++---
> > drivers/char/tpm/tpm1-cmd.c          | 781
> +++++++++++++++++++++++++++++++++
> > drivers/char/tpm/tpm2-cmd.c          | 301 +++++++------
> > drivers/char/tpm/tpm2-space.c        |   2 +-
> > drivers/char/tpm/tpm_i2c_nuvoton.c   |  11 +-
> > drivers/char/tpm/tpm_tis_core.c      |  10 +-
> > include/linux/tpm.h                  |  11 +-
> > security/integrity/ima/ima_crypto.c  |   5 +-
> > 13 files changed, 1082 insertions(+), 1034 deletions(-) create mode
> > 100644 drivers/char/tpm/tpm1-cmd.c
> >
> > --
> > 2.14.4
> >
> >
> 
> Starts to look reosonable:
> 
> https://patchwork.kernel.org/project/linux-integrity/list/?series=33257
> 
> This is the list of patches (assuming that I didn't miss anything) that still
> need tested-by tags:

Those are just code movements, we are running them form months on our systems.

> 
> - tpm: factor out tpm1_get_random into tpm1-cmd.c
> - tpm: factor out tpm 1.x pm suspend flow into tpm1-cmd.c
> - tpm1: rename tpm1_pcr_read_dev to tpm1_pcr_read()
>    (the subsystem tag is wrong in this, just noticed, should be 'tpm:')
When have you established this requirement I missed that and it cannot be deduced from the git history.

> - tpm: use u32 instead of int for PCR index

The last one maybe need some more target testing.

Thanks
Tomas