[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240916110714.1396407-7-jarkko@kernel.org>
Date: Mon, 16 Sep 2024 14:07:11 +0300
From: Jarkko Sakkinen <jarkko@...nel.org>
To: linux-integrity@...r.kernel.org
Cc: James.Bottomley@...senPartnership.com,
roberto.sassu@...wei.com,
mapengyu@...il.com,
Jarkko Sakkinen <jarkko@...nel.org>,
Peter Huewe <peterhuewe@....de>,
Jason Gunthorpe <jgg@...pe.ca>,
Mimi Zohar <zohar@...ux.ibm.com>,
David Howells <dhowells@...hat.com>,
Paul Moore <paul@...l-moore.com>,
James Morris <jmorris@...ei.org>,
"Serge E. Hallyn" <serge@...lyn.com>,
linux-kernel@...r.kernel.org (open list),
keyrings@...r.kernel.org (open list:KEYS-TRUSTED),
linux-security-module@...r.kernel.org (open list:SECURITY SUBSYSTEM)
Subject: [PATCH v2 6/6] tpm: flush the auth session only when /dev/tpm0 is open
Instead of flushing and reloading the auth session for every single
transaction, keep the session open unless /dev/tpm0 is open. In practice
this means applying TPM2_SA_CONTINUE_SESSION to the session attributes.
Flush the session always when /dev/tpm0 is written.
Signed-off-by: Jarkko Sakkinen <jarkko@...nel.org>
---
drivers/char/tpm/tpm-chip.c | 1 +
drivers/char/tpm/tpm-dev-common.c | 1 +
drivers/char/tpm/tpm-interface.c | 1 +
drivers/char/tpm/tpm2-sessions.c | 4 ++++
4 files changed, 7 insertions(+)
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 0ea00e32f575..7a6bb30d1f32 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -680,6 +680,7 @@ void tpm_chip_unregister(struct tpm_chip *chip)
rc = tpm_try_get_ops(chip);
if (!rc) {
if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+ tpm2_end_auth_session(chip);
tpm2_flush_context(chip, chip->null_key);
chip->null_key = 0;
}
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 4bc07963e260..c6fdeb4feaef 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -29,6 +29,7 @@ static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
#ifdef CONFIG_TCG_TPM2_HMAC
if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+ tpm2_end_auth_session(chip);
tpm2_flush_context(chip, chip->null_key);
chip->null_key = 0;
}
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index bfa47d48b0f2..2363018fa8fb 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -381,6 +381,7 @@ int tpm_pm_suspend(struct device *dev)
if (!rc) {
if (chip->flags & TPM_CHIP_FLAG_TPM2) {
#ifdef CONFIG_TCG_TPM2_HMAC
+ tpm2_end_auth_session(chip);
tpm2_flush_context(chip, chip->null_key);
chip->null_key = 0;
#endif
diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index f7746a165695..efe4b0017a83 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -268,6 +268,10 @@ void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf,
}
#ifdef CONFIG_TCG_TPM2_HMAC
+ /* The first write to /dev/tpm{rm0} will flush the session. */
+ if (!chip->is_open)
+ attributes |= TPM2_SA_CONTINUE_SESSION;
+
/*
* The Architecture Guide requires us to strip trailing zeros
* before computing the HMAC
--
2.46.0
Powered by blists - more mailing lists