Commit a3443cda authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 

Pull security subsystem updates from James Morris:

  SELinux/LSM:
   - overlayfs support, necessary for container filesystems

  LSM:
   - finally remove the kernel_module_from_file hook

  Smack:
   - treat signal delivery as an 'append' operation

  TPM:
   - lots of bugfixes & updates

  Audit:
   - new audit data type: LSM_AUDIT_DATA_FILE

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (47 commits)
  Revert "tpm/tpm_crb: implement tpm crb idle state"
  Revert "tmp/tpm_crb: fix Intel PTT hw bug during idle state"
  Revert "tpm/tpm_crb: open code the crb_init into acpi_add"
  Revert "tmp/tpm_crb: implement runtime pm for tpm_crb"
  lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE
  tmp/tpm_crb: implement runtime pm for tpm_crb
  tpm/tpm_crb: open code the crb_init into acpi_add
  tmp/tpm_crb: fix Intel PTT hw bug during idle state
  tpm/tpm_crb: implement tpm crb idle state
  tpm: add check for minimum buffer size in tpm_transmit()
  tpm: constify TPM 1.x header structures
  tpm/tpm_crb: fix the over 80 characters checkpatch warring
  tpm/tpm_crb: drop useless cpu_to_le32 when writing to registers
  tpm/tpm_crb: cache cmd_size register value.
  tmp/tpm_crb: drop include to platform_device
  tpm/tpm_tis: remove unused itpm variable
  tpm_crb: fix incorrect values of cmdReady and goIdle bits
  tpm_crb: refine the naming of constants
  tpm_crb: remove wmb()'s
  tpm_crb: fix crb_req_canceled behavior
  ...
parents 3cd013ab 1306d8e1

drivers/char/tpm/st33zp24/st33zp24.c

+0 −2
Original line number Diff line number Diff line
@@ -589,8 +589,6 @@ int st33zp24_probe(void *phy_id, const struct st33zp24_phy_ops *ops, 
		chip->flags |= TPM_CHIP_FLAG_IRQ;



		disable_irq_nosync(tpm_dev->irq);



		tpm_gen_interrupt(chip);

	}



	return tpm_chip_register(chip);

drivers/char/tpm/tpm-dev.c

+1 −1
Original line number Diff line number Diff line
@@ -145,7 +145,7 @@ static ssize_t tpm_write(struct file *file, const char __user *buf, 
		return -EPIPE;

	}

	out_size = tpm_transmit(priv->chip, priv->data_buffer,

				sizeof(priv->data_buffer));

				sizeof(priv->data_buffer), 0);



	tpm_put_ops(priv->chip);

	if (out_size < 0) {

drivers/char/tpm/tpm-interface.c

+38 −46
Original line number Diff line number Diff line
@@ -330,13 +330,16 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); 
/*

 * Internal kernel interface to transmit TPM commands

 */

ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,

		     size_t bufsiz)

ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,

		     unsigned int flags)

{

	ssize_t rc;

	u32 count, ordinal;

	unsigned long stop;



	if (bufsiz < TPM_HEADER_SIZE)

		return -EINVAL;



	if (bufsiz > TPM_BUFSIZE)

		bufsiz = TPM_BUFSIZE;
@@ -350,6 +353,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, 
		return -E2BIG;

	}



	if (!(flags & TPM_TRANSMIT_UNLOCKED))

		mutex_lock(&chip->tpm_mutex);



	rc = chip->ops->send(chip, (u8 *) buf, count);
@@ -393,6 +397,7 @@ out_recv: 
		dev_err(&chip->dev,

			"tpm_transmit: tpm_recv: error %zd\n", rc);

out:

	if (!(flags & TPM_TRANSMIT_UNLOCKED))

		mutex_unlock(&chip->tpm_mutex);

	return rc;

}
@@ -400,13 +405,13 @@ out: 
#define TPM_DIGEST_SIZE 20

#define TPM_RET_CODE_IDX 6



ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd,

			 int len, const char *desc)

ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd,

			 int len, unsigned int flags, const char *desc)

{

	struct tpm_output_header *header;

	const struct tpm_output_header *header;

	int err;



	len = tpm_transmit(chip, (u8 *) cmd, len);

	len = tpm_transmit(chip, (const u8 *)cmd, len, flags);

	if (len <  0)

		return len;

	else if (len < TPM_HEADER_SIZE)
@@ -453,26 +458,13 @@ ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap, 
		tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

		tpm_cmd.params.getcap_in.subcap = subcap_id;

	}

	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);

	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,

			      desc);

	if (!rc)

		*cap = tpm_cmd.params.getcap_out.cap;

	return rc;

}



void tpm_gen_interrupt(struct tpm_chip *chip)

{

	struct	tpm_cmd_t tpm_cmd;

	ssize_t rc;



	tpm_cmd.header.in = tpm_getcap_header;

	tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;

	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;



	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,

			      "attempting to determine the timeouts");

}

EXPORT_SYMBOL_GPL(tpm_gen_interrupt);

EXPORT_SYMBOL_GPL(tpm_getcap);



#define TPM_ORD_STARTUP cpu_to_be32(153)

#define TPM_ST_CLEAR cpu_to_be16(1)
@@ -490,7 +482,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type) 
	start_cmd.header.in = tpm_startup_header;



	start_cmd.params.startup_in.startup_type = startup_type;

	return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE,

	return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE, 0,

				"attempting to start the TPM");

}
@@ -521,7 +513,8 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
	tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;

	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;

	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, NULL);

	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,

			      NULL);



	if (rc == TPM_ERR_INVALID_POSTINIT) {

		/* The TPM is not started, we are the first to talk to it.
@@ -535,7 +528,7 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
		tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

		tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;

		rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,

				  NULL);

				      0, NULL);

	}

	if (rc) {

		dev_err(&chip->dev,
@@ -596,7 +589,7 @@ duration: 
	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);

	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;



	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,

	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,

			      "attempting to determine the durations");

	if (rc)

		return rc;
@@ -633,7 +626,7 @@ EXPORT_SYMBOL_GPL(tpm_get_timeouts); 
#define TPM_ORD_CONTINUE_SELFTEST 83

#define CONTINUE_SELFTEST_RESULT_SIZE 10



static struct tpm_input_header continue_selftest_header = {

static const struct tpm_input_header continue_selftest_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(10),

	.ordinal = cpu_to_be32(TPM_ORD_CONTINUE_SELFTEST),
@@ -652,14 +645,14 @@ static int tpm_continue_selftest(struct tpm_chip *chip) 
	struct tpm_cmd_t cmd;



	cmd.header.in = continue_selftest_header;

	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE,

	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE, 0,

			      "continue selftest");

	return rc;

}



#define TPM_ORDINAL_PCRREAD cpu_to_be32(21)

#define READ_PCR_RESULT_SIZE 30

static struct tpm_input_header pcrread_header = {

static const struct tpm_input_header pcrread_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(14),

	.ordinal = TPM_ORDINAL_PCRREAD
@@ -672,7 +665,7 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf) 


	cmd.header.in = pcrread_header;

	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);

	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,

	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, 0,

			      "attempting to read a pcr value");



	if (rc == 0)
@@ -745,7 +738,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read); 
 */

#define TPM_ORD_PCR_EXTEND cpu_to_be32(20)

#define EXTEND_PCR_RESULT_SIZE 34

static struct tpm_input_header pcrextend_header = {

static const struct tpm_input_header pcrextend_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(34),

	.ordinal = TPM_ORD_PCR_EXTEND
@@ -770,7 +763,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash) 
	cmd.header.in = pcrextend_header;

	cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);

	memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);

	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,

	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,

			      "attempting extend a PCR value");



	tpm_put_ops(chip);
@@ -792,7 +785,7 @@ int tpm_do_selftest(struct tpm_chip *chip) 
	unsigned int loops;

	unsigned int delay_msec = 100;

	unsigned long duration;

	struct tpm_cmd_t cmd;

	u8 dummy[TPM_DIGEST_SIZE];



	duration = tpm_calc_ordinal_duration(chip, TPM_ORD_CONTINUE_SELFTEST);
@@ -807,9 +800,8 @@ int tpm_do_selftest(struct tpm_chip *chip) 


	do {

		/* Attempt to read a PCR value */

		cmd.header.in = pcrread_header;

		cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);

		rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE);

		rc = tpm_pcr_read_dev(chip, 0, dummy);



		/* Some buggy TPMs will not respond to tpm_tis_ready() for

		 * around 300ms while the self test is ongoing, keep trying

		 * until the self test duration expires. */
@@ -824,7 +816,6 @@ int tpm_do_selftest(struct tpm_chip *chip) 
		if (rc < TPM_HEADER_SIZE)

			return -EFAULT;



		rc = be32_to_cpu(cmd.header.out.return_code);

		if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) {

			dev_info(&chip->dev,

				 "TPM is disabled/deactivated (0x%X)\n", rc);
@@ -879,7 +870,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen) 
	if (chip == NULL)

		return -ENODEV;



	rc = tpm_transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");

	rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd");



	tpm_put_ops(chip);

	return rc;
@@ -949,7 +940,7 @@ EXPORT_SYMBOL_GPL(wait_for_tpm_stat); 
#define TPM_ORD_SAVESTATE cpu_to_be32(152)

#define SAVESTATE_RESULT_SIZE 10



static struct tpm_input_header savestate_header = {

static const struct tpm_input_header savestate_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(10),

	.ordinal = TPM_ORD_SAVESTATE
@@ -981,14 +972,15 @@ int tpm_pm_suspend(struct device *dev) 
		cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);

		memcpy(cmd.params.pcrextend_in.hash, dummy_hash,

		       TPM_DIGEST_SIZE);

		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,

		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,

				      "extending dummy pcr before suspend");

	}



	/* now do the actual savestate */

	for (try = 0; try < TPM_RETRY; try++) {

		cmd.header.in = savestate_header;

		rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);

		rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, 0,

				      NULL);



		/*

		 * If the TPM indicates that it is too busy to respond to
@@ -1032,7 +1024,7 @@ int tpm_pm_resume(struct device *dev) 
EXPORT_SYMBOL_GPL(tpm_pm_resume);



#define TPM_GETRANDOM_RESULT_SIZE	18

static struct tpm_input_header tpm_getrandom_header = {

static const struct tpm_input_header tpm_getrandom_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(14),

	.ordinal = TPM_ORD_GET_RANDOM
@@ -1073,7 +1065,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) 


		err = tpm_transmit_cmd(chip, &tpm_cmd,

				       TPM_GETRANDOM_RESULT_SIZE + num_bytes,

				   "attempting get random");

				       0, "attempting get random");

		if (err)

			break;

drivers/char/tpm/tpm-sysfs.c

+2 −2
Original line number Diff line number Diff line
@@ -22,7 +22,7 @@ 


#define READ_PUBEK_RESULT_SIZE 314

#define TPM_ORD_READPUBEK cpu_to_be32(124)

static struct tpm_input_header tpm_readpubek_header = {

static const struct tpm_input_header tpm_readpubek_header = {

	.tag = TPM_TAG_RQU_COMMAND,

	.length = cpu_to_be32(30),

	.ordinal = TPM_ORD_READPUBEK
@@ -39,7 +39,7 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr, 
	struct tpm_chip *chip = to_tpm_chip(dev);



	tpm_cmd.header.in = tpm_readpubek_header;

	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,

	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,

			       "attempting to read the PUBEK");

	if (err)

		goto out;

drivers/char/tpm/tpm.h

+24 −22
Original line number Diff line number Diff line
@@ -476,32 +476,35 @@ extern dev_t tpm_devt; 
extern const struct file_operations tpm_fops;

extern struct idr dev_nums_idr;



enum tpm_transmit_flags {

	TPM_TRANSMIT_UNLOCKED	= BIT(0),

};



ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,

		     unsigned int flags);

ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,

			 unsigned int flags, const char *desc);

ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap,

		   const char *desc);

ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,

		     size_t bufsiz);

ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len,

			 const char *desc);

extern int tpm_get_timeouts(struct tpm_chip *);

extern void tpm_gen_interrupt(struct tpm_chip *);

int tpm_get_timeouts(struct tpm_chip *);

int tpm1_auto_startup(struct tpm_chip *chip);

extern int tpm_do_selftest(struct tpm_chip *);

extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);

extern int tpm_pm_suspend(struct device *);

extern int tpm_pm_resume(struct device *);

extern int wait_for_tpm_stat(struct tpm_chip *, u8, unsigned long,

			     wait_queue_head_t *, bool);

int tpm_do_selftest(struct tpm_chip *chip);

unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);

int tpm_pm_suspend(struct device *dev);

int tpm_pm_resume(struct device *dev);

int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,

		      wait_queue_head_t *queue, bool check_cancel);



struct tpm_chip *tpm_chip_find_get(int chip_num);

__must_check int tpm_try_get_ops(struct tpm_chip *chip);

void tpm_put_ops(struct tpm_chip *chip);



extern struct tpm_chip *tpm_chip_alloc(struct device *dev,

struct tpm_chip *tpm_chip_alloc(struct device *dev,

				const struct tpm_class_ops *ops);

extern struct tpm_chip *tpmm_chip_alloc(struct device *pdev,

struct tpm_chip *tpmm_chip_alloc(struct device *pdev,

				 const struct tpm_class_ops *ops);

extern int tpm_chip_register(struct tpm_chip *chip);

extern void tpm_chip_unregister(struct tpm_chip *chip);

int tpm_chip_register(struct tpm_chip *chip);

void tpm_chip_unregister(struct tpm_chip *chip);



void tpm_sysfs_add_device(struct tpm_chip *chip);
@@ -528,8 +531,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, 
			u32 *value, const char *desc);



int tpm2_auto_startup(struct tpm_chip *chip);

extern void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);

extern unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *, u32);

extern int tpm2_gen_interrupt(struct tpm_chip *chip);

extern int tpm2_probe(struct tpm_chip *chip);

void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);

unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);

int tpm2_probe(struct tpm_chip *chip);

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE