linux.git/drivers/char/tpm, branch v4.5

keys, trusted: seal with a TPM2 authorization policy

2015-12-20T13:27:13+00:00

TPM2 supports authorization policies, which are essentially
combinational logic statements repsenting the conditions where the data
can be unsealed based on the TPM state. This patch enables to use
authorization policies to seal trusted keys.

Two following new options have been added for trusted keys:

* 'policydigest=': provide an auth policy digest for sealing.
* 'policyhandle=': provide a policy session handle for unsealing.

If 'hash=' option is supplied after 'policydigest=' option, this
will result an error because the state of the option would become
mixed.

Signed-off-by: Jarkko Sakkinen 
Tested-by: Colin Ian King 
Reviewed-by: Mimi Zohar 
Acked-by: Peter Huewe

keys, trusted: select hash algorithm for TPM2 chips

2015-12-20T13:27:12+00:00

Added 'hash=' option for selecting the hash algorithm for add_key()
syscall and documentation for it.

Added entry for sm3-256 to the following tables in order to support
TPM_ALG_SM3_256:

* hash_algo_name
* hash_digest_size

Includes support for the following hash algorithms:

* sha1
* sha256
* sha384
* sha512
* sm3-256

Signed-off-by: Jarkko Sakkinen 
Tested-by: Colin Ian King 
Reviewed-by: James Morris 
Reviewed-by: Mimi Zohar 
Acked-by: Peter Huewe

tpm_ibmvtpm: properly handle interrupted packet receptions

2015-12-20T13:27:12+00:00

When the TPM response reception is interrupted in the wait_event_interruptable
call, the TPM is still busy processing the command and will only deliver the
response later. So we have to wait for an outstanding response before sending
a new request to avoid trying to put a 2nd request into the CRQ. Also reset
the res_len before sending a command so we will end up in that
wait_event_interruptable() waiting for the response rather than reading the
command packet as a response.

The easiest way to trigger the problem is to run the following

cd /sys/device/vio/71000004

while :; cat pcrs >/dev/null; done

And press Ctrl-C. This will then display an error

tpm_ibmvtpm 71000004: tpm_transmit: tpm_recv: error -4

followed by several other errors once interaction with the TPM resumes.

tpm_ibmvtpm 71000004: A TPM error (101) occurred attempting to determine the number of PCRS.

Signed-off-by: Stefan Berger 
Tested-by: Hon Ching(Vicky) Lo 
Reviewed-by: Jarkko Sakkinen 
Reviewed-by: Ashley Lai 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: Tighten IRQ auto-probing

2015-12-20T13:26:28+00:00

auto-probing doesn't work with shared interrupts, and the auto detection
interrupt range is for x86 only.

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Tested-by: Scot Doyle 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: Refactor the interrupt setup

2015-12-20T13:26:27+00:00

Now that the probe and run cases are merged together we can use a
much simpler setup flow where probe and normal setup are done with
exactly the same code.

Since the new flow always calls tpm_gen_interrupt to confirm the IRQ
there is also no longer any need to call tpm_get_timeouts twice.

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Tested-by: Scot Doyle 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: Get rid of the duplicate IRQ probing code

2015-12-20T13:26:25+00:00

The new code that works directly in tpm_tis_send is able to handle
IRQ probing duties as well, so just use it for everything.

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Tested-by: Scot Doyle 
Signed-off--by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm: rework tpm_get_timeouts()

2015-12-20T13:23:46+00:00

IRQ probing needs to know that the TPM is working before trying to
probe, so move tpm_get_timeouts() to the top of the tpm_tis_init().
This has the advantage of also getting the correct timeouts loaded
before doing IRQ probing.

All the timeout handling code is moved to tpm_get_timeouts() in order to
remove duplicate code in tpm_tis and tpm_crb.

[jarkko.sakkinen@linux.intel.com: squashed two patches together and
improved the commit message.]

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Tested-by: Scot Doyle 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: Ensure interrupts are disabled when the driver starts

2015-12-20T13:23:46+00:00

This should be done very early, before anything could possibly
cause the TPM to generate an interrupt. If the IRQ line is shared
with another driver causing an interrupt before setting up our
handler will be very bad.

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Tested-by: Scot Doyle 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: Use devm_free_irq not free_irq

2015-12-20T13:23:45+00:00

The interrupt is always allocated with devm_request_irq so it
must always be freed with devm_free_irq.

Fixes: 448e9c55c12d ("tpm_tis: verify interrupt during init")
Signed-off-by: Jason Gunthorpe 
Acked-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Tested-by: Martin Wilck 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe

tpm_tis: further simplify calculation of ordinal duration

2015-12-02T17:57:21+00:00

commit 07b133e6060b ("char/tpm: simplify duration calculation and
eliminate smatch warning.") includes a misleading test that is always
false. The tpm_ordinal_duration table is only valid for TPM_PROTECTED
ordinals where the higher 16 bits are all 0, anyway.

Signed-off-by: Martin Wilck 
Reviewed-by: Jarkko Sakkinen 
Tested-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Acked-by: Peter Huewe