@@ -6727,6 +6727,11 @@
torture.verbose_sleep_duration= [KNL]
Duration of each verbose-printk() sleep in jiffies.
+ tpm.set_locality_enabled= [HW,TPM]
+ Enable one-shot locality setting after the boot. It can
+ can be set with the TPM_IOC_SET_LOCALE ioctl applied to
+ /dev/tpm0. The parameter is set by default as '0'.
+
tpm_suspend_pcr=[HW,TPM]
Format: integer pcr id
Specify that at suspend time, the tpm driver
@@ -338,6 +338,8 @@ Code Seq# Include File Comments
0xA3 90-9F linux/dtlk.h
0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
0xA4 00-1F uapi/asm/sgx.h <mailto:linux-sgx@vger.kernel.org>
+0xA4 00-1F uapi/linux/tpm.h TPM
+ <mailto:linux-integrity@vger.kernel.org>
0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator
<mailto:luzmaximilian@gmail.com>
0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver
@@ -44,7 +44,7 @@ static int tpm_request_locality(struct tpm_chip *chip)
if (!chip->ops->request_locality)
return 0;
- rc = chip->ops->request_locality(chip, 0);
+ rc = chip->ops->request_locality(chip, chip->default_locality);
if (rc < 0)
return rc;
@@ -13,8 +13,74 @@
* Device file system interface to the TPM
*/
#include <linux/slab.h>
+#include <uapi/linux/tpm.h>
#include "tpm-dev.h"
+static bool set_locality_enabled;
+module_param(set_locality_enabled, bool, 0644);
+
+/*
+ * Set a locality as a one-shot operation. A chip must declare support for it
+ * with %TPM_CHIP_FLAG_SET_LOCALITY_ENABLED, which will cleared after setting
+ * the locality.
+ */
+static long tpm_ioc_set_locality(struct tpm_chip *chip, u8 __user *localityp)
+{
+ u8 locality;
+
+ if (!set_locality_enabled)
+ return -ENOIOCTLCMD;
+
+ if (chip->flags & TPM_CHIP_FLAG_SET_LOCALITY_ENABLED)
+ return -EOPNOTSUPP;
+
+ if (copy_from_user(&locality, localityp, sizeof(locality)))
+ return -EFAULT;
+
+ if (locality >= TPM_MAX_LOCALITY)
+ return -EINVAL;
+
+ chip->default_locality = locality;
+ chip->flags &= ~TPM_CHIP_FLAG_SET_LOCALITY_ENABLED;
+ return 0;
+}
+
+static long tpm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+ struct file_priv *priv = file->private_data;
+ void __user *argp = (void __user *)arg;
+ struct tpm_chip *chip = priv->chip;
+ int ret;
+
+ mutex_lock(&priv->buffer_mutex);
+
+ ret = tpm_try_get_ops(chip);
+ if (ret)
+ goto out;
+
+ switch (cmd) {
+ case TPM_IOC_SET_LOCALITY:
+ tpm_ioc_set_locality(chip, argp);
+ break;
+ default:
+ ret = -ENOIOCTLCMD;
+ break;
+ }
+
+ tpm_put_ops(chip);
+
+out:
+ mutex_unlock(&priv->buffer_mutex);
+ return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long tpm_compat_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+ return tpm_ioctl(filep, cmd, arg);
+}
+#endif
+
static int tpm_open(struct inode *inode, struct file *file)
{
struct tpm_chip *chip;
@@ -59,6 +125,10 @@ static int tpm_release(struct inode *inode, struct file *file)
const struct file_operations tpm_fops = {
.owner = THIS_MODULE,
+ .unlocked_ioctl = tpm_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = tpm_compat_ioctl,
+#endif
.open = tpm_open,
.read = tpm_common_read,
.write = tpm_common_write,
@@ -1111,6 +1111,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
if (IS_ERR(chip))
return PTR_ERR(chip);
+ chip->flags |= TPM_CHIP_FLAG_SET_LOCALITY_ENABLED;
+
#ifdef CONFIG_ACPI
chip->acpi_dev_handle = acpi_dev_handle;
#endif
@@ -147,6 +147,12 @@ struct tpm_chip_seqops {
*/
#define TPM2_MAX_CONTEXT_SIZE 4096
+/*
+ * The maximum locality (0 - 4) for a TPM, as defined in section 3.2 of the
+ * Client Platform Profile Specification.
+ */
+#define TPM_MAX_LOCALITY 4
+
struct tpm_chip {
struct device dev;
struct device devs;
@@ -202,6 +208,9 @@ struct tpm_chip {
/* active locality */
int locality;
+ /* the default locality used by the kernel (default 0) */
+ u8 default_locality;
+
#ifdef CONFIG_TCG_TPM2_HMAC
/* details for communication security via sessions */
@@ -348,6 +357,7 @@ enum tpm_chip_flags {
TPM_CHIP_FLAG_SUSPENDED = BIT(8),
TPM_CHIP_FLAG_HWRNG_DISABLED = BIT(9),
TPM_CHIP_FLAG_DISABLE = BIT(10),
+ TPM_CHIP_FLAG_SET_LOCALITY_ENABLED = BIT(11),
};
#define to_tpm_chip(d) container_of(d, struct tpm_chip, dev)
new file mode 100644
@@ -0,0 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI_TPM_H
+#define _UAPI_TPM_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define TPM_MAGIC 0xA4
+#define TPM_IOC_SET_LOCALITY _IOW(TPM_MAGIC, 0x00, u8)
+
+#endif /* _UAPI_TPM_H */
DRTM needs to be able to set the locality used by kernel. Provide TPM_IOC_SET_LOCALITY operation for this purpose. It is enabled only if the kernel command-line has 'tpm.set_locality_enabled=1'. The operation is one-shot allowed only for tpm_tis for the moment. Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> --- NOTE: Only compile-tested. --- .../admin-guide/kernel-parameters.txt | 5 ++ .../userspace-api/ioctl/ioctl-number.rst | 2 + drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm-dev.c | 70 +++++++++++++++++++ drivers/char/tpm/tpm_tis_core.c | 2 + include/linux/tpm.h | 10 +++ include/uapi/linux/tpm.h | 11 +++ 7 files changed, 101 insertions(+), 1 deletion(-) create mode 100644 include/uapi/linux/tpm.h