From patchwork Mon May 20 18:47:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 797912 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F112D28E7; Mon, 20 May 2024 18:47:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230860; cv=none; b=jzAfRvj4WZIRwF+O+EFIhpaAEPRh5WLIb+6wbt/cYb8pGfiC44gsWQrvDUibTS9MVt5l92hzYdgL6wMI4dCgELbZtLhR3Xh8rkFOca2O6yjqTO4yB/p2lNNkWuRu0433+SQWdlpD8LjULdBpPdmlJaglZjlH7JXSkD1QHSiRhtw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230860; c=relaxed/simple; bh=rQTPLrmfpCPpQ7Zz53PlLkcw1m7mUahOVVqZUGpxmKU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FVFqwrdBIRsvfk3yIBczqnwRTxYuJP4TuVJYDYYvRvDv/xqCZpckKz2T/8SHhxHZ0JffSr3twMkHLqdy0TqQsa4wI7Bij8bUEeCa4zrLVi3IBpXZUgT3+TCS1t9rICXQ00bz5zACzbbvIRPOUJtpj7jELTUAexhd73zYpZBV2zI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=azLfIHUr; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="azLfIHUr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2180CC2BD10; Mon, 20 May 2024 18:47:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716230859; bh=rQTPLrmfpCPpQ7Zz53PlLkcw1m7mUahOVVqZUGpxmKU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=azLfIHUrK0j3/igtwgV6l56nEAGaHF7J0MYCC8C9bEwwJYOnETgOi26Ty29PoWiwb 0PYIclHnvYNsABbTyFnJq5tK66+SIwU0nQ8KOz+d8AgN31s3bDeWBYvgYU3o8jPCJ1 Evad7zQGPbUExQ8yCOyuCbb6R3oZ8a/aAu8S41dcnem7oLqCy+KBTuZbWtMPJp7YcR i+FLHEy/I7qUIO6u7juzeQ0Hd2TqkygQFF/Mwc6sN2RRfo9YiSdfPbPgd4R2HMwYzv +5DlgyEH3NQofBRuEBWSa99lNNkqKRBZLfYlrxOOtgmtfHfJV07mT7JFgAlbh6hB6o wW7AZV0bwGn6g== From: Jarkko Sakkinen To: Herbert Xu Cc: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, Andreas.Fuchs@infineon.com, James Prestwood , David Woodhouse , Jarkko Sakkinen , "David S. Miller" , linux-crypto@vger.kernel.org (open list:CRYPTO API), linux-kernel@vger.kernel.org (open list) Subject: [PATCH 1/6] crypto: rsa-pkcs1pad: export rsa1_asn_lookup() Date: Mon, 20 May 2024 21:47:08 +0300 Message-ID: <20240520184727.22038-2-jarkko@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: <20240520184727.22038-1-jarkko@kernel.org> References: <20240520184727.22038-1-jarkko@kernel.org> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 ASN.1 template is required for TPM2 asymmetric keys, as it needs to be piggy-packed with the input data before applying TPM2_RSA_Decrypt. This patch prepares crypto subsystem for the addition of those keys. Signed-off-by: Jarkko Sakkinen --- crypto/rsa-pkcs1pad.c | 16 ++++++++++------ include/crypto/rsa-pkcs1pad.h | 20 ++++++++++++++++++++ 2 files changed, 30 insertions(+), 6 deletions(-) create mode 100644 include/crypto/rsa-pkcs1pad.h diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c index cd501195f34a..00b6c14f861c 100644 --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -7,6 +7,7 @@ #include #include +#include #include #include #include @@ -79,11 +80,7 @@ static const u8 rsa_digest_info_sha3_512[] = { 0x05, 0x00, 0x04, 0x40 }; -static const struct rsa_asn1_template { - const char *name; - const u8 *data; - size_t size; -} rsa_asn1_templates[] = { +static const struct rsa_asn1_template rsa_asn1_templates[] = { #define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) } _(md5), _(sha1), @@ -101,7 +98,13 @@ static const struct rsa_asn1_template { { NULL } }; -static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name) +/** + * rsa_lookup_asn1() - Lookup the ASN.1 digest info given the hash + * name: hash algorithm name + * + * Returns the ASN.1 digest info on success, and NULL on failure. + */ +const struct rsa_asn1_template *rsa_lookup_asn1(const char *name) { const struct rsa_asn1_template *p; @@ -110,6 +113,7 @@ static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name) return p; return NULL; } +EXPORT_SYMBOL_GPL(rsa_lookup_asn1); struct pkcs1pad_ctx { struct crypto_akcipher *child; diff --git a/include/crypto/rsa-pkcs1pad.h b/include/crypto/rsa-pkcs1pad.h new file mode 100644 index 000000000000..32c7453ff644 --- /dev/null +++ b/include/crypto/rsa-pkcs1pad.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * RSA padding templates. + */ + +#ifndef _CRYPTO_RSA_PKCS1PAD_H +#define _CRYPTO_RSA_PKCS1PAD_H + +/* + * Hash algorithm name to ASN.1 template mapping. + */ +struct rsa_asn1_template { + const char *name; + const u8 *data; + size_t size; +}; + +const struct rsa_asn1_template *rsa_lookup_asn1(const char *name); + +#endif /* _CRYPTO_RSA_PKCS1PAD_H */ From patchwork Mon May 20 18:47:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 797911 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CE21137C2E; Mon, 20 May 2024 18:47:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230872; cv=none; b=awds8FWu81bBT2OV3TmuBVUVeIUTFDiVZW+VLzJtD4CrVuERxhSysS9q+mdWh1PgrW/5R9hSja5pyOMxJnSBM7oJOhrPAwv37eXKyaKGbZ/kyLT0NW5jumXKvjbbVijGNCuAoOuKptBnfCEVokezdaq1gGWonoLRkSFJ4Khed2I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230872; c=relaxed/simple; bh=jec1TbJ+akbpJqkAQc6Azv309XlSmxotrVc7+fbbuXQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L4UztMlM5310feWkKu0xw1zxzXmY3Q23nYPLE7qX8wJL5CG8kFXsr+WB/6F0QII5ObxSXda8Lse5Th/+RyM3CXBWjX1fRquKOmPWhPe8H+JpF48+goI5Tug3p0Lg4/6kLt2XsESjHLiuNpiuTXtID2gjIu/xDt+7INzrSwcs7eA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DurDf+K6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DurDf+K6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84613C2BD10; Mon, 20 May 2024 18:47:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716230871; bh=jec1TbJ+akbpJqkAQc6Azv309XlSmxotrVc7+fbbuXQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DurDf+K6tI8CwTetvZaUheJ6zrWhdD75ECb9521ETi19cqtDb0UmQkMEOcIn8WIm6 LL9E//ffoDKaaA+vXiYobhRX0ad8vx/Oa3Zartdn6PFp5UIrGGMJmIYTJyTsbr5gFU haqKlhs5XtkB1MGw54CwtizMwiYjnNWX1/rZUb+0WqPB7WV3sZsE3Jw7Wfv4YodKTr XnsmG2XgLUwDK8j5RfNp6jz0TburKjLo2HcMgl31cz7ad6C8S/vJKFekSeR5E+f0ee GuyxXAMbPiOpixRVGA1Tr7Z97jdAw4J+w4GLshCcDuWgqEL6S1BmLCMy+BGOOr0V4X U46nLx+bd6bEg== From: Jarkko Sakkinen To: Herbert Xu Cc: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, Andreas.Fuchs@infineon.com, James Prestwood , David Woodhouse , Jarkko Sakkinen , "David S. Miller" , linux-crypto@vger.kernel.org (open list:CRYPTO API), linux-kernel@vger.kernel.org (open list), Peter Huewe , Jason Gunthorpe , James Bottomley , Stefan Berger , Ard Biesheuvel , Mario Limonciello Subject: [PATCH 3/6] tpm: Export tpm2_load_context() Date: Mon, 20 May 2024 21:47:10 +0300 Message-ID: <20240520184727.22038-4-jarkko@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: <20240520184727.22038-1-jarkko@kernel.org> References: <20240520184727.22038-1-jarkko@kernel.org> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Export tpm2_load_context() so that the null key can be loaded as the parent of a asymmetric TPM2 key. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm.h | 2 - drivers/char/tpm/tpm2-cmd.c | 77 +++++++++++++++++++++++++++++++++++ drivers/char/tpm/tpm2-space.c | 61 --------------------------- include/linux/tpm.h | 2 + 4 files changed, 79 insertions(+), 63 deletions(-) diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 6b8b9956ba69..c9c67fe84f33 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -314,8 +314,6 @@ int tpm_devs_add(struct tpm_chip *chip); void tpm_devs_remove(struct tpm_chip *chip); int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, unsigned int buf_size, unsigned int *offset); -int tpm2_load_context(struct tpm_chip *chip, u8 *buf, - unsigned int *offset, u32 *handle); void tpm_bios_log_setup(struct tpm_chip *chip); void tpm_bios_log_teardown(struct tpm_chip *chip); diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index 0cdf892ec2a7..eb07a109e2ba 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -370,6 +370,83 @@ void tpm2_flush_context(struct tpm_chip *chip, u32 handle) } EXPORT_SYMBOL_GPL(tpm2_flush_context); +struct tpm2_context { + __be64 sequence; + __be32 saved_handle; + __be32 hierarchy; + __be16 blob_size; +} __packed; + +/** + * tpm2_load_context() - Load TPM2 object to the TPM memory + * @chip: TPM chip to use + * @buf: Blob containing TPM2 object. + * @offset: Output variable for the offset in @buf reached. + * @handle: Output variable for the handle of the object in TPM memory. + * + * Load a blob encrypted with TPM from the memory to the TPM chip. + * + * Return: + * - 0 when the blob is successfully loaded to the TPM. + * - -EFAULT if the TPM chip itself fails. + * - -ENOENT if the TPM object is replayed. + * - -EINVAL if the TPM object is corrupted. + */ +int tpm2_load_context(struct tpm_chip *chip, const u8 *buf, + unsigned int *offset, u32 *handle) +{ + struct tpm_buf tbuf; + struct tpm2_context *ctx; + unsigned int body_size; + int rc; + + rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD); + if (rc) + return rc; + + ctx = (struct tpm2_context *)&buf[*offset]; + body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size); + tpm_buf_append(&tbuf, &buf[*offset], body_size); + + rc = tpm_transmit_cmd(chip, &tbuf, 4, NULL); + if (rc < 0) { + dev_warn(&chip->dev, "%s: failed with a system error %d\n", + __func__, rc); + tpm_buf_destroy(&tbuf); + return -EFAULT; + } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE || + rc == TPM2_RC_REFERENCE_H0) { + /* + * TPM_RC_HANDLE means that the session context can't + * be loaded because of an internal counter mismatch + * that makes the TPM think there might have been a + * replay. This might happen if the context was saved + * and loaded outside the space. + * + * TPM_RC_REFERENCE_H0 means the session has been + * flushed outside the space + */ + *handle = 0; + tpm_buf_destroy(&tbuf); + return -ENOENT; + } else if (tpm2_rc_value(rc) == TPM2_RC_INTEGRITY) { + tpm_buf_destroy(&tbuf); + return -EINVAL; + } else if (rc > 0) { + dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", + __func__, rc); + tpm_buf_destroy(&tbuf); + return -EFAULT; + } + + *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]); + *offset += body_size; + + tpm_buf_destroy(&tbuf); + return 0; +} +EXPORT_SYMBOL_GPL(tpm2_load_context); + struct tpm2_get_cap_out { u8 more_data; __be32 subcap_id; diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 4892d491da8d..708c6e4d64cd 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -21,13 +21,6 @@ enum tpm2_handle_types { TPM2_HT_TRANSIENT = 0x80000000, }; -struct tpm2_context { - __be64 sequence; - __be32 saved_handle; - __be32 hierarchy; - __be16 blob_size; -} __packed; - static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) { int i; @@ -68,60 +61,6 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) kfree(space->session_buf); } -int tpm2_load_context(struct tpm_chip *chip, u8 *buf, - unsigned int *offset, u32 *handle) -{ - struct tpm_buf tbuf; - struct tpm2_context *ctx; - unsigned int body_size; - int rc; - - rc = tpm_buf_init(&tbuf, TPM2_ST_NO_SESSIONS, TPM2_CC_CONTEXT_LOAD); - if (rc) - return rc; - - ctx = (struct tpm2_context *)&buf[*offset]; - body_size = sizeof(*ctx) + be16_to_cpu(ctx->blob_size); - tpm_buf_append(&tbuf, &buf[*offset], body_size); - - rc = tpm_transmit_cmd(chip, &tbuf, 4, NULL); - if (rc < 0) { - dev_warn(&chip->dev, "%s: failed with a system error %d\n", - __func__, rc); - tpm_buf_destroy(&tbuf); - return -EFAULT; - } else if (tpm2_rc_value(rc) == TPM2_RC_HANDLE || - rc == TPM2_RC_REFERENCE_H0) { - /* - * TPM_RC_HANDLE means that the session context can't - * be loaded because of an internal counter mismatch - * that makes the TPM think there might have been a - * replay. This might happen if the context was saved - * and loaded outside the space. - * - * TPM_RC_REFERENCE_H0 means the session has been - * flushed outside the space - */ - *handle = 0; - tpm_buf_destroy(&tbuf); - return -ENOENT; - } else if (tpm2_rc_value(rc) == TPM2_RC_INTEGRITY) { - tpm_buf_destroy(&tbuf); - return -EINVAL; - } else if (rc > 0) { - dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", - __func__, rc); - tpm_buf_destroy(&tbuf); - return -EFAULT; - } - - *handle = be32_to_cpup((__be32 *)&tbuf.data[TPM_HEADER_SIZE]); - *offset += body_size; - - tpm_buf_destroy(&tbuf); - return 0; -} - int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, unsigned int buf_size, unsigned int *offset) { diff --git a/include/linux/tpm.h b/include/linux/tpm.h index c17e4efbb2e5..2f25ca07127b 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -466,6 +466,8 @@ extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max); extern struct tpm_chip *tpm_default_chip(void); void tpm2_flush_context(struct tpm_chip *chip, u32 handle); +int tpm2_load_context(struct tpm_chip *chip, const u8 *buf, + unsigned int *offset, u32 *handle); static inline void tpm_buf_append_empty_auth(struct tpm_buf *buf, u32 handle) { From patchwork Mon May 20 18:47:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 797910 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABD16139CEF; Mon, 20 May 2024 18:48:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230882; cv=none; b=S5TrOlV01WcCuFJLe00TCfqFI2rrVm2oxDRXeBvnBNaMxEWJANDCefiKLa25T5KBjYtiPRfUaqMZap6S5DGw89R6FJva4sCcfyF/Nvwlf2VoIF5vXUCk8J7Z98Kt9QL+8GPTvLM289V9H/EXz80tXAkpyLCib9kb1w5i2xZzS7Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716230882; c=relaxed/simple; bh=gNU6Lgy9J7HTeRp31thBNRIyKze5WZQpaPwf2uA260I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Tc9vrifcImafJ3LJzDrGnv+fpTO7XNZgo5+i4ex9T/13xeGZwHGU6/BPT3eRxl3ovVG9d92cMJH+w7TP69yXDhHTqCBo5Bl95duBHPt6pw1WOULx6VHKdrF28rbqTgYVjspeil+B6SIKZ6nHZ0RptIJ2IEBWKdxMQylLdmqUekE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rTFHShHl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rTFHShHl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DAE7BC4AF07; Mon, 20 May 2024 18:48:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716230882; bh=gNU6Lgy9J7HTeRp31thBNRIyKze5WZQpaPwf2uA260I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rTFHShHluBudnfubBQ0rhx3PRp1gCsbdi7w59c9ckvX3s8NB5ebJxnRjak+xakXxF BGzdoiBJNn2Ncjq6yJe8JjKLavicOqANOC2MSX9sMHhKmoDXqpr8x2r2GWWTlIMpGz iVG14+61JtBjdp2Sorl3idfgcZFlvz0yM2F3kqMDSJ+Ffhfe0flqTTgc8D37cqk1Z1 5G6roOBmHAaxLXUq5d1IBfk2I97l6T1US1JC0FHVRLwIhhmwQ6Jkvw8NEol4jaYVXX 8DJSjSBMKkg+aIChmrqWzeu3bS7JLvRLH0GYHi/9fTjyubsLslhGHQTMtG2f92z0Q0 Uk2eQbUZ0S+nw== From: Jarkko Sakkinen To: Herbert Xu Cc: linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, Andreas.Fuchs@infineon.com, James Prestwood , David Woodhouse , Jarkko Sakkinen , "David S. Miller" , linux-crypto@vger.kernel.org (open list:CRYPTO API), linux-kernel@vger.kernel.org (open list), Peter Huewe , Jason Gunthorpe , James Bottomley , Mimi Zohar , David Howells , Paul Moore , James Morris , "Serge E. Hallyn" , linux-security-module@vger.kernel.org (open list:SECURITY SUBSYSTEM) Subject: [PATCH 5/6] tpm: tpm2_key: Extend parser to TPM_LoadableKey Date: Mon, 20 May 2024 21:47:12 +0300 Message-ID: <20240520184727.22038-6-jarkko@kernel.org> X-Mailer: git-send-email 2.45.1 In-Reply-To: <20240520184727.22038-1-jarkko@kernel.org> References: <20240520184727.22038-1-jarkko@kernel.org> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Extend parser to TPM_LoadableKey. Add field for oid to struct tpm2_key so that callers can differentiate different key types. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm2_key.c | 14 +++++++++++--- include/crypto/tpm2_key.h | 2 ++ security/keys/trusted-keys/trusted_tpm2.c | 5 +++++ 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/char/tpm/tpm2_key.c b/drivers/char/tpm/tpm2_key.c index 0112362e432e..59797dc232f1 100644 --- a/drivers/char/tpm/tpm2_key.c +++ b/drivers/char/tpm/tpm2_key.c @@ -32,16 +32,24 @@ int tpm2_key_type(void *context, size_t hdrlen, const void *value, size_t vlen) { enum OID oid = look_up_OID(value, vlen); - - if (oid != OID_TPMSealedData) { + struct tpm2_key *key = context; + + switch (oid) { + case OID_TPMSealedData: + pr_info("TPMSealedData\n"); + break; + case OID_TPMLoadableKey: + pr_info("TPMLodableKey\n"); + break; + default: char buffer[50]; - sprint_oid(value, vlen, buffer, sizeof(buffer)); pr_debug("OID is \"%s\" which is not TPMSealedData\n", buffer); return -EINVAL; } + key->oid = oid; return 0; } diff --git a/include/crypto/tpm2_key.h b/include/crypto/tpm2_key.h index acf41b2e0c92..2d2434233000 100644 --- a/include/crypto/tpm2_key.h +++ b/include/crypto/tpm2_key.h @@ -2,12 +2,14 @@ #ifndef __LINUX_TPM2_KEY_H__ #define __LINUX_TPM2_KEY_H__ +#include #include /* * TPM2 ASN.1 key */ struct tpm2_key { + enum OID oid; u32 parent; const u8 *blob; u32 blob_len; diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 49ee2a57797a..842a8e2701e4 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -304,6 +304,11 @@ static int tpm2_load_cmd(struct tpm_chip *chip, blob = payload->blob; payload->old_format = 1; } else { + if (key.oid != OID_TPMSealedData) { + tpm2_key_destroy(&key); + return -EINVAL; + } + blob = kmalloc(key.priv_len + key.pub_len + 4, GFP_KERNEL); if (blob) { options->keyhandle = key.parent;