subject:"\[PATCH v7 2\/2\] tpm\: add securityfs support for TPM 2.0 firmware event log"

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-04 Thread Jarkko Sakkinen

On Wed, Jan 04, 2017 at 02:08:06PM +0530, Nayna wrote:
> 
> 
> On 01/03/2017 07:03 PM, Jarkko Sakkinen wrote:
> > On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:
> > > 
> > > 
> > > On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:
> > > > On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> > > > > Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> > > > > not support the securityfs pseudo files for displaying the
> > > > > firmware event log.
> > > > > 
> > > > > This patch enables support for providing the TPM 2.0 event log in
> > > > > binary form. TPM 2.0 event log supports a crypto agile format that
> > > > > records multiple digests, which is different from TPM 1.2. This
> > > > > patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> > > > > event log parser which understand the TPM 2.0 crypto agile format.
> > > > > 
> > > > > Signed-off-by: Nayna Jain 
> > > > 
> > > > There is something fundamentally wrong in this commit.
> > > > 
> > > > You must not allow this feature unless CONFIG_OF is set. It is the only
> > > > interface where the supply path of the event log is well defined on
> > > > platforms that include a TPM 2.0 chip.
> > > 
> > > As per current implementation, if ACPI with TPM 2.0 doesn't support event
> > > log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
> > > will not create securityfs. This is inline with our design for TPM 1.2 
> > > event
> > > log.
> > 
> > At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
> > of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.
> 
> Sure, will add this check and return -ENODEV if check passes.

Yeah, this is acceptable for me.

> Thanks & Regards,
> - Nayna

/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-04 Thread Jarkko Sakkinen

On Wed, Jan 04, 2017 at 02:08:06PM +0530, Nayna wrote:
> 
> 
> On 01/03/2017 07:03 PM, Jarkko Sakkinen wrote:
> > On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:
> > > 
> > > 
> > > On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:
> > > > On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> > > > > Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> > > > > not support the securityfs pseudo files for displaying the
> > > > > firmware event log.
> > > > > 
> > > > > This patch enables support for providing the TPM 2.0 event log in
> > > > > binary form. TPM 2.0 event log supports a crypto agile format that
> > > > > records multiple digests, which is different from TPM 1.2. This
> > > > > patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> > > > > event log parser which understand the TPM 2.0 crypto agile format.
> > > > > 
> > > > > Signed-off-by: Nayna Jain 
> > > > 
> > > > There is something fundamentally wrong in this commit.
> > > > 
> > > > You must not allow this feature unless CONFIG_OF is set. It is the only
> > > > interface where the supply path of the event log is well defined on
> > > > platforms that include a TPM 2.0 chip.
> > > 
> > > As per current implementation, if ACPI with TPM 2.0 doesn't support event
> > > log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
> > > will not create securityfs. This is inline with our design for TPM 1.2 
> > > event
> > > log.
> > 
> > At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
> > of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.
> 
> Sure, will add this check and return -ENODEV if check passes.

Yeah, this is acceptable for me.

> Thanks & Regards,
> - Nayna

/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-04 Thread Nayna




On 01/03/2017 07:03 PM, Jarkko Sakkinen wrote:

On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:



On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 


There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.


As per current implementation, if ACPI with TPM 2.0 doesn't support event
log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
will not create securityfs. This is inline with our design for TPM 1.2 event
log.


At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.


Sure, will add this check and return -ENODEV if check passes.

Thanks & Regards,
- Nayna



/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-04 Thread Nayna




On 01/03/2017 07:03 PM, Jarkko Sakkinen wrote:

On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:



On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 


There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.


As per current implementation, if ACPI with TPM 2.0 doesn't support event
log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
will not create securityfs. This is inline with our design for TPM 1.2 event
log.


At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.


Sure, will add this check and return -ENODEV if check passes.

Thanks & Regards,
- Nayna



/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-03 Thread Jarkko Sakkinen

On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:
> 
> 
> On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:
> > On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> > > Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> > > not support the securityfs pseudo files for displaying the
> > > firmware event log.
> > > 
> > > This patch enables support for providing the TPM 2.0 event log in
> > > binary form. TPM 2.0 event log supports a crypto agile format that
> > > records multiple digests, which is different from TPM 1.2. This
> > > patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> > > event log parser which understand the TPM 2.0 crypto agile format.
> > > 
> > > Signed-off-by: Nayna Jain 
> > 
> > There is something fundamentally wrong in this commit.
> > 
> > You must not allow this feature unless CONFIG_OF is set. It is the only
> > interface where the supply path of the event log is well defined on
> > platforms that include a TPM 2.0 chip.
> 
> As per current implementation, if ACPI with TPM 2.0 doesn't support event
> log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
> will not create securityfs. This is inline with our design for TPM 1.2 event
> log.

At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.

/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-03 Thread Jarkko Sakkinen

On Tue, Jan 03, 2017 at 01:09:18PM +0530, Nayna wrote:
> 
> 
> On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:
> > On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> > > Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> > > not support the securityfs pseudo files for displaying the
> > > firmware event log.
> > > 
> > > This patch enables support for providing the TPM 2.0 event log in
> > > binary form. TPM 2.0 event log supports a crypto agile format that
> > > records multiple digests, which is different from TPM 1.2. This
> > > patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> > > event log parser which understand the TPM 2.0 crypto agile format.
> > > 
> > > Signed-off-by: Nayna Jain 
> > 
> > There is something fundamentally wrong in this commit.
> > 
> > You must not allow this feature unless CONFIG_OF is set. It is the only
> > interface where the supply path of the event log is well defined on
> > platforms that include a TPM 2.0 chip.
> 
> As per current implementation, if ACPI with TPM 2.0 doesn't support event
> log, tpm_read_log_acpi() is expected to return rc and tpm_bios_log_setup
> will not create securityfs. This is inline with our design for TPM 1.2 event
> log.

At minimum you must have a check for TPM_CHIP_FLAG_TPM2 in the beginning
of tpm_read_log_acpi. It is wrong to even try to open TCPA in this case.

/Jarkko

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-02 Thread Nayna




On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 


There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.


As per current implementation, if ACPI with TPM 2.0 doesn't support 
event log, tpm_read_log_acpi() is expected to return rc and 
tpm_bios_log_setup will not create securityfs. This is inline with our 
design for TPM 1.2 event log.




There's buch casts in the form '(char *) foo'. They should be
'(char *)foo'.


Will fix these and other comments.

Thanks & Regards,
- Nayna




---
  drivers/char/tpm/Makefile  |   2 +-
  .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
  drivers/char/tpm/tpm2_eventlog.c   | 203 +
  drivers/char/tpm/tpm_eventlog.h|  70 +++
  4 files changed, 295 insertions(+), 15 deletions(-)
  rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
  create mode 100644 drivers/char/tpm/tpm2_eventlog.c

diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index a05b1eb..3d386a8 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -3,7 +3,7 @@
  #
  obj-$(CONFIG_TCG_TPM) += tpm.o
  tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
-   tpm_eventlog.o
+   tpm1_eventlog.o tpm2_eventlog.o
  tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
  tpm-$(CONFIG_OF) += tpm_of.o
  obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm1_eventlog.c
similarity index 95%
rename from drivers/char/tpm/tpm_eventlog.c
rename to drivers/char/tpm/tpm1_eventlog.c
index 11bb113..9a8605e 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm1_eventlog.c
@@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
unsigned int cnt;
int rc = 0;

-   if (chip->flags & TPM_CHIP_FLAG_TPM2)
-   return 0;
-
rc = tpm_read_log(chip);
if (rc)
return rc;
@@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
cnt++;

chip->bin_log_seqops.chip = chip;
-   chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
+   if (chip->flags & TPM_CHIP_FLAG_TPM2)
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+   else
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+

chip->bios_dir[cnt] =
securityfs_create_file("binary_bios_measurements",
@@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
goto err;
cnt++;

-   chip->ascii_log_seqops.chip = chip;
-   chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
+   if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {

-   chip->bios_dir[cnt] =
-   securityfs_create_file("ascii_bios_measurements",
-  0440, chip->bios_dir[0],
-  (void *)>ascii_log_seqops,
-  _bios_measurements_ops);
-   if (IS_ERR(chip->bios_dir[cnt]))
-   goto err;
-   cnt++;
+   chip->ascii_log_seqops.chip = chip;
+   chip->ascii_log_seqops.seqops =
+   _ascii_b_measurements_seqops;
+
+   chip->bios_dir[cnt] =
+   securityfs_create_file("ascii_bios_measurements",
+  0440, chip->bios_dir[0],
+  (void *)>ascii_log_seqops,
+  _bios_measurements_ops);
+   if (IS_ERR(chip->bios_dir[cnt]))
+   goto err;
+   cnt++;
+   }

return 0;

diff --git a/drivers/char/tpm/tpm2_eventlog.c b/drivers/char/tpm/tpm2_eventlog.c
new file mode 100644
index 000..63690d3
--- /dev/null
+++ b/drivers/char/tpm/tpm2_eventlog.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2016 IBM Corporation
+ *
+ * Authors:
+ *  Nayna Jain 
+ *
+ * Access to TPM 2.0 event log as written by Firmware.
+ * It assumes that writer of event log has followed TCG

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-02 Thread Nayna




On 01/03/2017 03:42 AM, Jarkko Sakkinen wrote:

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 


There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.


As per current implementation, if ACPI with TPM 2.0 doesn't support 
event log, tpm_read_log_acpi() is expected to return rc and 
tpm_bios_log_setup will not create securityfs. This is inline with our 
design for TPM 1.2 event log.




There's buch casts in the form '(char *) foo'. They should be
'(char *)foo'.


Will fix these and other comments.

Thanks & Regards,
- Nayna




---
  drivers/char/tpm/Makefile  |   2 +-
  .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
  drivers/char/tpm/tpm2_eventlog.c   | 203 +
  drivers/char/tpm/tpm_eventlog.h|  70 +++
  4 files changed, 295 insertions(+), 15 deletions(-)
  rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
  create mode 100644 drivers/char/tpm/tpm2_eventlog.c

diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index a05b1eb..3d386a8 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -3,7 +3,7 @@
  #
  obj-$(CONFIG_TCG_TPM) += tpm.o
  tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
-   tpm_eventlog.o
+   tpm1_eventlog.o tpm2_eventlog.o
  tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
  tpm-$(CONFIG_OF) += tpm_of.o
  obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm1_eventlog.c
similarity index 95%
rename from drivers/char/tpm/tpm_eventlog.c
rename to drivers/char/tpm/tpm1_eventlog.c
index 11bb113..9a8605e 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm1_eventlog.c
@@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
unsigned int cnt;
int rc = 0;

-   if (chip->flags & TPM_CHIP_FLAG_TPM2)
-   return 0;
-
rc = tpm_read_log(chip);
if (rc)
return rc;
@@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
cnt++;

chip->bin_log_seqops.chip = chip;
-   chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
+   if (chip->flags & TPM_CHIP_FLAG_TPM2)
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+   else
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+

chip->bios_dir[cnt] =
securityfs_create_file("binary_bios_measurements",
@@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
goto err;
cnt++;

-   chip->ascii_log_seqops.chip = chip;
-   chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
+   if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {

-   chip->bios_dir[cnt] =
-   securityfs_create_file("ascii_bios_measurements",
-  0440, chip->bios_dir[0],
-  (void *)>ascii_log_seqops,
-  _bios_measurements_ops);
-   if (IS_ERR(chip->bios_dir[cnt]))
-   goto err;
-   cnt++;
+   chip->ascii_log_seqops.chip = chip;
+   chip->ascii_log_seqops.seqops =
+   _ascii_b_measurements_seqops;
+
+   chip->bios_dir[cnt] =
+   securityfs_create_file("ascii_bios_measurements",
+  0440, chip->bios_dir[0],
+  (void *)>ascii_log_seqops,
+  _bios_measurements_ops);
+   if (IS_ERR(chip->bios_dir[cnt]))
+   goto err;
+   cnt++;
+   }

return 0;

diff --git a/drivers/char/tpm/tpm2_eventlog.c b/drivers/char/tpm/tpm2_eventlog.c
new file mode 100644
index 000..63690d3
--- /dev/null
+++ b/drivers/char/tpm/tpm2_eventlog.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2016 IBM Corporation
+ *
+ * Authors:
+ *  Nayna Jain 
+ *
+ * Access to TPM 2.0 event log as written by Firmware.
+ * It assumes that writer of event log has followed TCG Specification
+ * for Family "2.0" and written the event data

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-02 Thread Jarkko Sakkinen

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> not support the securityfs pseudo files for displaying the
> firmware event log.
> 
> This patch enables support for providing the TPM 2.0 event log in
> binary form. TPM 2.0 event log supports a crypto agile format that
> records multiple digests, which is different from TPM 1.2. This
> patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> event log parser which understand the TPM 2.0 crypto agile format.
> 
> Signed-off-by: Nayna Jain 

There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.

There's buch casts in the form '(char *) foo'. They should be
'(char *)foo'.

> ---
>  drivers/char/tpm/Makefile  |   2 +-
>  .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
>  drivers/char/tpm/tpm2_eventlog.c   | 203 
> +
>  drivers/char/tpm/tpm_eventlog.h|  70 +++
>  4 files changed, 295 insertions(+), 15 deletions(-)
>  rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
>  create mode 100644 drivers/char/tpm/tpm2_eventlog.c
> 
> diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
> index a05b1eb..3d386a8 100644
> --- a/drivers/char/tpm/Makefile
> +++ b/drivers/char/tpm/Makefile
> @@ -3,7 +3,7 @@
>  #
>  obj-$(CONFIG_TCG_TPM) += tpm.o
>  tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
> - tpm_eventlog.o
> + tpm1_eventlog.o tpm2_eventlog.o
>  tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
>  tpm-$(CONFIG_OF) += tpm_of.o
>  obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
> diff --git a/drivers/char/tpm/tpm_eventlog.c 
> b/drivers/char/tpm/tpm1_eventlog.c
> similarity index 95%
> rename from drivers/char/tpm/tpm_eventlog.c
> rename to drivers/char/tpm/tpm1_eventlog.c
> index 11bb113..9a8605e 100644
> --- a/drivers/char/tpm/tpm_eventlog.c
> +++ b/drivers/char/tpm/tpm1_eventlog.c
> @@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   unsigned int cnt;
>   int rc = 0;
>  
> - if (chip->flags & TPM_CHIP_FLAG_TPM2)
> - return 0;
> -
>   rc = tpm_read_log(chip);
>   if (rc)
>   return rc;
> @@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   cnt++;
>  
>   chip->bin_log_seqops.chip = chip;
> - chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
> + if (chip->flags & TPM_CHIP_FLAG_TPM2)
> + chip->bin_log_seqops.seqops =
> + _binary_b_measurements_seqops;
> + else
> + chip->bin_log_seqops.seqops =
> + _binary_b_measurements_seqops;
> +
>  
>   chip->bios_dir[cnt] =
>   securityfs_create_file("binary_bios_measurements",
> @@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   goto err;
>   cnt++;
>  
> - chip->ascii_log_seqops.chip = chip;
> - chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
> + if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
>  
> - chip->bios_dir[cnt] =
> - securityfs_create_file("ascii_bios_measurements",
> -0440, chip->bios_dir[0],
> -(void *)>ascii_log_seqops,
> -_bios_measurements_ops);
> - if (IS_ERR(chip->bios_dir[cnt]))
> - goto err;
> - cnt++;
> + chip->ascii_log_seqops.chip = chip;
> + chip->ascii_log_seqops.seqops =
> + _ascii_b_measurements_seqops;
> +
> + chip->bios_dir[cnt] =
> + securityfs_create_file("ascii_bios_measurements",
> +0440, chip->bios_dir[0],
> +(void *)>ascii_log_seqops,
> +_bios_measurements_ops);
> + if (IS_ERR(chip->bios_dir[cnt]))
> + goto err;
> + cnt++;
> + }
>  
>   return 0;
>  
> diff --git a/drivers/char/tpm/tpm2_eventlog.c 
> b/drivers/char/tpm/tpm2_eventlog.c
> new file mode 100644
> index 000..63690d3
> --- /dev/null
> +++ b/drivers/char/tpm/tpm2_eventlog.c
> @@ -0,0 +1,203 @@
> +/*
> + * Copyright (C) 2016 IBM Corporation
> + *
> + * Authors:
> + *  Nayna Jain 
> + *
> + * Access to TPM 2.0 event log as written by Firmware.
> + * It assumes that writer of event log has followed TCG Specification
> + * for Family "2.0" and written the event data in little endian.
> + * With that, it doesn't need any endian conversion for structure
> + * content.
> + *
> + * This program is free software; you can redistribute it and/or

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2017-01-02 Thread Jarkko Sakkinen

On Sun, Dec 11, 2016 at 12:35:33AM -0500, Nayna Jain wrote:
> Unlike the device driver support for TPM 1.2, the TPM 2.0 does
> not support the securityfs pseudo files for displaying the
> firmware event log.
> 
> This patch enables support for providing the TPM 2.0 event log in
> binary form. TPM 2.0 event log supports a crypto agile format that
> records multiple digests, which is different from TPM 1.2. This
> patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
> event log parser which understand the TPM 2.0 crypto agile format.
> 
> Signed-off-by: Nayna Jain 

There is something fundamentally wrong in this commit.

You must not allow this feature unless CONFIG_OF is set. It is the only
interface where the supply path of the event log is well defined on
platforms that include a TPM 2.0 chip.

There's buch casts in the form '(char *) foo'. They should be
'(char *)foo'.

> ---
>  drivers/char/tpm/Makefile  |   2 +-
>  .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
>  drivers/char/tpm/tpm2_eventlog.c   | 203 
> +
>  drivers/char/tpm/tpm_eventlog.h|  70 +++
>  4 files changed, 295 insertions(+), 15 deletions(-)
>  rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
>  create mode 100644 drivers/char/tpm/tpm2_eventlog.c
> 
> diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
> index a05b1eb..3d386a8 100644
> --- a/drivers/char/tpm/Makefile
> +++ b/drivers/char/tpm/Makefile
> @@ -3,7 +3,7 @@
>  #
>  obj-$(CONFIG_TCG_TPM) += tpm.o
>  tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
> - tpm_eventlog.o
> + tpm1_eventlog.o tpm2_eventlog.o
>  tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
>  tpm-$(CONFIG_OF) += tpm_of.o
>  obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
> diff --git a/drivers/char/tpm/tpm_eventlog.c 
> b/drivers/char/tpm/tpm1_eventlog.c
> similarity index 95%
> rename from drivers/char/tpm/tpm_eventlog.c
> rename to drivers/char/tpm/tpm1_eventlog.c
> index 11bb113..9a8605e 100644
> --- a/drivers/char/tpm/tpm_eventlog.c
> +++ b/drivers/char/tpm/tpm1_eventlog.c
> @@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   unsigned int cnt;
>   int rc = 0;
>  
> - if (chip->flags & TPM_CHIP_FLAG_TPM2)
> - return 0;
> -
>   rc = tpm_read_log(chip);
>   if (rc)
>   return rc;
> @@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   cnt++;
>  
>   chip->bin_log_seqops.chip = chip;
> - chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
> + if (chip->flags & TPM_CHIP_FLAG_TPM2)
> + chip->bin_log_seqops.seqops =
> + _binary_b_measurements_seqops;
> + else
> + chip->bin_log_seqops.seqops =
> + _binary_b_measurements_seqops;
> +
>  
>   chip->bios_dir[cnt] =
>   securityfs_create_file("binary_bios_measurements",
> @@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
>   goto err;
>   cnt++;
>  
> - chip->ascii_log_seqops.chip = chip;
> - chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
> + if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
>  
> - chip->bios_dir[cnt] =
> - securityfs_create_file("ascii_bios_measurements",
> -0440, chip->bios_dir[0],
> -(void *)>ascii_log_seqops,
> -_bios_measurements_ops);
> - if (IS_ERR(chip->bios_dir[cnt]))
> - goto err;
> - cnt++;
> + chip->ascii_log_seqops.chip = chip;
> + chip->ascii_log_seqops.seqops =
> + _ascii_b_measurements_seqops;
> +
> + chip->bios_dir[cnt] =
> + securityfs_create_file("ascii_bios_measurements",
> +0440, chip->bios_dir[0],
> +(void *)>ascii_log_seqops,
> +_bios_measurements_ops);
> + if (IS_ERR(chip->bios_dir[cnt]))
> + goto err;
> + cnt++;
> + }
>  
>   return 0;
>  
> diff --git a/drivers/char/tpm/tpm2_eventlog.c 
> b/drivers/char/tpm/tpm2_eventlog.c
> new file mode 100644
> index 000..63690d3
> --- /dev/null
> +++ b/drivers/char/tpm/tpm2_eventlog.c
> @@ -0,0 +1,203 @@
> +/*
> + * Copyright (C) 2016 IBM Corporation
> + *
> + * Authors:
> + *  Nayna Jain 
> + *
> + * Access to TPM 2.0 event log as written by Firmware.
> + * It assumes that writer of event log has followed TCG Specification
> + * for Family "2.0" and written the event data in little endian.
> + * With that, it doesn't need any endian conversion for structure
> + * content.
> + *
> + * This program is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU General

[PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2016-12-10 Thread Nayna Jain

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 
---
 drivers/char/tpm/Makefile  |   2 +-
 .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
 drivers/char/tpm/tpm2_eventlog.c   | 203 +
 drivers/char/tpm/tpm_eventlog.h|  70 +++
 4 files changed, 295 insertions(+), 15 deletions(-)
 rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
 create mode 100644 drivers/char/tpm/tpm2_eventlog.c

diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index a05b1eb..3d386a8 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -3,7 +3,7 @@
 #
 obj-$(CONFIG_TCG_TPM) += tpm.o
 tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
-   tpm_eventlog.o
+   tpm1_eventlog.o tpm2_eventlog.o
 tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
 tpm-$(CONFIG_OF) += tpm_of.o
 obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm1_eventlog.c
similarity index 95%
rename from drivers/char/tpm/tpm_eventlog.c
rename to drivers/char/tpm/tpm1_eventlog.c
index 11bb113..9a8605e 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm1_eventlog.c
@@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
unsigned int cnt;
int rc = 0;
 
-   if (chip->flags & TPM_CHIP_FLAG_TPM2)
-   return 0;
-
rc = tpm_read_log(chip);
if (rc)
return rc;
@@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
cnt++;
 
chip->bin_log_seqops.chip = chip;
-   chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
+   if (chip->flags & TPM_CHIP_FLAG_TPM2)
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+   else
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+
 
chip->bios_dir[cnt] =
securityfs_create_file("binary_bios_measurements",
@@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
goto err;
cnt++;
 
-   chip->ascii_log_seqops.chip = chip;
-   chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
+   if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
 
-   chip->bios_dir[cnt] =
-   securityfs_create_file("ascii_bios_measurements",
-  0440, chip->bios_dir[0],
-  (void *)>ascii_log_seqops,
-  _bios_measurements_ops);
-   if (IS_ERR(chip->bios_dir[cnt]))
-   goto err;
-   cnt++;
+   chip->ascii_log_seqops.chip = chip;
+   chip->ascii_log_seqops.seqops =
+   _ascii_b_measurements_seqops;
+
+   chip->bios_dir[cnt] =
+   securityfs_create_file("ascii_bios_measurements",
+  0440, chip->bios_dir[0],
+  (void *)>ascii_log_seqops,
+  _bios_measurements_ops);
+   if (IS_ERR(chip->bios_dir[cnt]))
+   goto err;
+   cnt++;
+   }
 
return 0;
 
diff --git a/drivers/char/tpm/tpm2_eventlog.c b/drivers/char/tpm/tpm2_eventlog.c
new file mode 100644
index 000..63690d3
--- /dev/null
+++ b/drivers/char/tpm/tpm2_eventlog.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2016 IBM Corporation
+ *
+ * Authors:
+ *  Nayna Jain 
+ *
+ * Access to TPM 2.0 event log as written by Firmware.
+ * It assumes that writer of event log has followed TCG Specification
+ * for Family "2.0" and written the event data in little endian.
+ * With that, it doesn't need any endian conversion for structure
+ * content.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#include "tpm.h"
+#include "tpm_eventlog.h"
+
+static int calc_tpm2_event_size(struct tcg_pcr_event2 *event,
+   struct tcg_pcr_event *event_header)
+{
+   struct tcg_efi_specid_event *efispecid;
+   struct tcg_event_field *event_field;
+

[PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

2016-12-10 Thread Nayna Jain

Unlike the device driver support for TPM 1.2, the TPM 2.0 does
not support the securityfs pseudo files for displaying the
firmware event log.

This patch enables support for providing the TPM 2.0 event log in
binary form. TPM 2.0 event log supports a crypto agile format that
records multiple digests, which is different from TPM 1.2. This
patch enables the tpm_bios_log_setup for TPM 2.0  and adds the
event log parser which understand the TPM 2.0 crypto agile format.

Signed-off-by: Nayna Jain 
---
 drivers/char/tpm/Makefile  |   2 +-
 .../char/tpm/{tpm_eventlog.c => tpm1_eventlog.c}   |  35 ++--
 drivers/char/tpm/tpm2_eventlog.c   | 203 +
 drivers/char/tpm/tpm_eventlog.h|  70 +++
 4 files changed, 295 insertions(+), 15 deletions(-)
 rename drivers/char/tpm/{tpm_eventlog.c => tpm1_eventlog.c} (95%)
 create mode 100644 drivers/char/tpm/tpm2_eventlog.c

diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index a05b1eb..3d386a8 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -3,7 +3,7 @@
 #
 obj-$(CONFIG_TCG_TPM) += tpm.o
 tpm-y := tpm-interface.o tpm-dev.o tpm-sysfs.o tpm-chip.o tpm2-cmd.o \
-   tpm_eventlog.o
+   tpm1_eventlog.o tpm2_eventlog.o
 tpm-$(CONFIG_ACPI) += tpm_ppi.o tpm_acpi.o
 tpm-$(CONFIG_OF) += tpm_of.o
 obj-$(CONFIG_TCG_TIS_CORE) += tpm_tis_core.o
diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm1_eventlog.c
similarity index 95%
rename from drivers/char/tpm/tpm_eventlog.c
rename to drivers/char/tpm/tpm1_eventlog.c
index 11bb113..9a8605e 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm1_eventlog.c
@@ -390,9 +390,6 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
unsigned int cnt;
int rc = 0;
 
-   if (chip->flags & TPM_CHIP_FLAG_TPM2)
-   return 0;
-
rc = tpm_read_log(chip);
if (rc)
return rc;
@@ -407,7 +404,13 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
cnt++;
 
chip->bin_log_seqops.chip = chip;
-   chip->bin_log_seqops.seqops = _binary_b_measurements_seqops;
+   if (chip->flags & TPM_CHIP_FLAG_TPM2)
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+   else
+   chip->bin_log_seqops.seqops =
+   _binary_b_measurements_seqops;
+
 
chip->bios_dir[cnt] =
securityfs_create_file("binary_bios_measurements",
@@ -418,17 +421,21 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
goto err;
cnt++;
 
-   chip->ascii_log_seqops.chip = chip;
-   chip->ascii_log_seqops.seqops = _ascii_b_measurements_seqops;
+   if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
 
-   chip->bios_dir[cnt] =
-   securityfs_create_file("ascii_bios_measurements",
-  0440, chip->bios_dir[0],
-  (void *)>ascii_log_seqops,
-  _bios_measurements_ops);
-   if (IS_ERR(chip->bios_dir[cnt]))
-   goto err;
-   cnt++;
+   chip->ascii_log_seqops.chip = chip;
+   chip->ascii_log_seqops.seqops =
+   _ascii_b_measurements_seqops;
+
+   chip->bios_dir[cnt] =
+   securityfs_create_file("ascii_bios_measurements",
+  0440, chip->bios_dir[0],
+  (void *)>ascii_log_seqops,
+  _bios_measurements_ops);
+   if (IS_ERR(chip->bios_dir[cnt]))
+   goto err;
+   cnt++;
+   }
 
return 0;
 
diff --git a/drivers/char/tpm/tpm2_eventlog.c b/drivers/char/tpm/tpm2_eventlog.c
new file mode 100644
index 000..63690d3
--- /dev/null
+++ b/drivers/char/tpm/tpm2_eventlog.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2016 IBM Corporation
+ *
+ * Authors:
+ *  Nayna Jain 
+ *
+ * Access to TPM 2.0 event log as written by Firmware.
+ * It assumes that writer of event log has followed TCG Specification
+ * for Family "2.0" and written the event data in little endian.
+ * With that, it doesn't need any endian conversion for structure
+ * content.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#include "tpm.h"
+#include "tpm_eventlog.h"
+
+static int calc_tpm2_event_size(struct tcg_pcr_event2 *event,
+   struct tcg_pcr_event *event_header)
+{
+   struct tcg_efi_specid_event *efispecid;
+   struct tcg_event_field *event_field;
+   void *marker;
+   void *marker_start;
+   int

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

Re: [PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

[PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

[PATCH v7 2/2] tpm: add securityfs support for TPM 2.0 firmware event log

12 matches

Site Navigation

Mail list logo

Footer information