Skip to content

Commit 84d4e8b

Browse files
torvaldstorvalds
committed
Merge tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull tpm updates from Jarkko Sakkinen: - Disable TCG_TPM2_HMAC from defconfig It causes performance issues, and breaks some atypical configurations. - simplify code using the new crypto library - misc fixes and cleanups * tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Prevent local DOS via tpm/tpm0/ppi/*operations tpm: use a map for tpm2_calc_ordinal_duration() tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single tpm: Use HMAC-SHA256 library instead of open-coded HMAC tpm: Compare HMAC values in constant time tpm: Disable TPM2_TCG_HMAC by default
2 parents 5472d60 + a29ad21 commit 84d4e8b

File tree

8 files changed

+137
-199
lines changed

8 files changed

+137
-199
lines changed

‎drivers/char/tpm/Kconfig‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,11 @@ if TCG_TPM
2929

3030
config TCG_TPM2_HMAC
3131
bool "Use HMAC and encrypted transactions on the TPM bus"
32-
default X86_64
32+
default n
3333
select CRYPTO_ECDH
3434
select CRYPTO_LIB_AESCFB
3535
select CRYPTO_LIB_SHA256
36+
select CRYPTO_LIB_UTILS
3637
help
3738
Setting this causes us to deploy a scheme which uses request
3839
and response HMACs in addition to encryption for

‎drivers/char/tpm/tpm-interface.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ MODULE_PARM_DESC(suspend_pcr,
5252
unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
5353
{
5454
if (chip->flags & TPM_CHIP_FLAG_TPM2)
55-
return tpm2_calc_ordinal_duration(chip, ordinal);
55+
return tpm2_calc_ordinal_duration(ordinal);
5656
else
5757
return tpm1_calc_ordinal_duration(chip, ordinal);
5858
}

‎drivers/char/tpm/tpm.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,
299299
ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip);
300300
int tpm2_auto_startup(struct tpm_chip *chip);
301301
void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
302-
unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
302+
unsigned long tpm2_calc_ordinal_duration(u32 ordinal);
303303
int tpm2_probe(struct tpm_chip *chip);
304304
int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip);
305305
int tpm2_find_cc(struct tpm_chip *chip, u32 cc);

‎drivers/char/tpm/tpm2-cmd.c‎

Lines changed: 32 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -28,120 +28,57 @@ static struct tpm2_hash tpm2_hash_map[] = {
2828

2929
int tpm2_get_timeouts(struct tpm_chip *chip)
3030
{
31-
/* Fixed timeouts for TPM2 */
3231
chip->timeout_a = msecs_to_jiffies(TPM2_TIMEOUT_A);
3332
chip->timeout_b = msecs_to_jiffies(TPM2_TIMEOUT_B);
3433
chip->timeout_c = msecs_to_jiffies(TPM2_TIMEOUT_C);
3534
chip->timeout_d = msecs_to_jiffies(TPM2_TIMEOUT_D);
36-
37-
/* PTP spec timeouts */
38-
chip->duration[TPM_SHORT] = msecs_to_jiffies(TPM2_DURATION_SHORT);
39-
chip->duration[TPM_MEDIUM] = msecs_to_jiffies(TPM2_DURATION_MEDIUM);
40-
chip->duration[TPM_LONG] = msecs_to_jiffies(TPM2_DURATION_LONG);
41-
42-
/* Key creation commands long timeouts */
43-
chip->duration[TPM_LONG_LONG] =
44-
msecs_to_jiffies(TPM2_DURATION_LONG_LONG);
45-
4635
chip->flags |= TPM_CHIP_FLAG_HAVE_TIMEOUTS;
47-
4836
return 0;
4937
}
5038

51-
/**
52-
* tpm2_ordinal_duration_index() - returns an index to the chip duration table
53-
* @ordinal: TPM command ordinal.
54-
*
55-
* The function returns an index to the chip duration table
56-
* (enum tpm_duration), that describes the maximum amount of
57-
* time the chip could take to return the result for a particular ordinal.
58-
*
59-
* The values of the MEDIUM, and LONG durations are taken
60-
* from the PC Client Profile (PTP) specification (750, 2000 msec)
61-
*
62-
* LONG_LONG is for commands that generates keys which empirically takes
63-
* a longer time on some systems.
64-
*
65-
* Return:
66-
* * TPM_MEDIUM
67-
* * TPM_LONG
68-
* * TPM_LONG_LONG
69-
* * TPM_UNDEFINED
39+
/*
40+
* Contains the maximum durations in milliseconds for TPM2 commands.
7041
*/
71-
static u8 tpm2_ordinal_duration_index(u32 ordinal)
72-
{
73-
switch (ordinal) {
74-
/* Startup */
75-
case TPM2_CC_STARTUP: /* 144 */
76-
return TPM_MEDIUM;
77-
78-
case TPM2_CC_SELF_TEST: /* 143 */
79-
return TPM_LONG;
80-
81-
case TPM2_CC_GET_RANDOM: /* 17B */
82-
return TPM_LONG;
83-
84-
case TPM2_CC_SEQUENCE_UPDATE: /* 15C */
85-
return TPM_MEDIUM;
86-
case TPM2_CC_SEQUENCE_COMPLETE: /* 13E */
87-
return TPM_MEDIUM;
88-
case TPM2_CC_EVENT_SEQUENCE_COMPLETE: /* 185 */
89-
return TPM_MEDIUM;
90-
case TPM2_CC_HASH_SEQUENCE_START: /* 186 */
91-
return TPM_MEDIUM;
92-
93-
case TPM2_CC_VERIFY_SIGNATURE: /* 177 */
94-
return TPM_LONG_LONG;
95-
96-
case TPM2_CC_PCR_EXTEND: /* 182 */
97-
return TPM_MEDIUM;
98-
99-
case TPM2_CC_HIERARCHY_CONTROL: /* 121 */
100-
return TPM_LONG;
101-
case TPM2_CC_HIERARCHY_CHANGE_AUTH: /* 129 */
102-
return TPM_LONG;
103-
104-
case TPM2_CC_GET_CAPABILITY: /* 17A */
105-
return TPM_MEDIUM;
106-
107-
case TPM2_CC_NV_READ: /* 14E */
108-
return TPM_LONG;
109-
110-
case TPM2_CC_CREATE_PRIMARY: /* 131 */
111-
return TPM_LONG_LONG;
112-
case TPM2_CC_CREATE: /* 153 */
113-
return TPM_LONG_LONG;
114-
case TPM2_CC_CREATE_LOADED: /* 191 */
115-
return TPM_LONG_LONG;
116-
117-
default:
118-
return TPM_UNDEFINED;
119-
}
120-
}
42+
static const struct {
43+
unsigned long ordinal;
44+
unsigned long duration;
45+
} tpm2_ordinal_duration_map[] = {
46+
{TPM2_CC_STARTUP, 750},
47+
{TPM2_CC_SELF_TEST, 3000},
48+
{TPM2_CC_GET_RANDOM, 2000},
49+
{TPM2_CC_SEQUENCE_UPDATE, 750},
50+
{TPM2_CC_SEQUENCE_COMPLETE, 750},
51+
{TPM2_CC_EVENT_SEQUENCE_COMPLETE, 750},
52+
{TPM2_CC_HASH_SEQUENCE_START, 750},
53+
{TPM2_CC_VERIFY_SIGNATURE, 30000},
54+
{TPM2_CC_PCR_EXTEND, 750},
55+
{TPM2_CC_HIERARCHY_CONTROL, 2000},
56+
{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
57+
{TPM2_CC_GET_CAPABILITY, 750},
58+
{TPM2_CC_NV_READ, 2000},
59+
{TPM2_CC_CREATE_PRIMARY, 30000},
60+
{TPM2_CC_CREATE, 30000},
61+
{TPM2_CC_CREATE_LOADED, 30000},
62+
};
12163

12264
/**
123-
* tpm2_calc_ordinal_duration() - calculate the maximum command duration
124-
* @chip: TPM chip to use.
65+
* tpm2_calc_ordinal_duration() - Calculate the maximum command duration
12566
* @ordinal: TPM command ordinal.
12667
*
127-
* The function returns the maximum amount of time the chip could take
128-
* to return the result for a particular ordinal in jiffies.
129-
*
130-
* Return: A maximal duration time for an ordinal in jiffies.
68+
* Returns the maximum amount of time the chip is expected by kernel to
69+
* take in jiffies.
13170
*/
132-
unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
71+
unsigned long tpm2_calc_ordinal_duration(u32 ordinal)
13372
{
134-
unsigned int index;
73+
int i;
13574

136-
index = tpm2_ordinal_duration_index(ordinal);
75+
for (i = 0; i < ARRAY_SIZE(tpm2_ordinal_duration_map); i++)
76+
if (ordinal == tpm2_ordinal_duration_map[i].ordinal)
77+
return msecs_to_jiffies(tpm2_ordinal_duration_map[i].duration);
13778

138-
if (index != TPM_UNDEFINED)
139-
return chip->duration[index];
140-
else
141-
return msecs_to_jiffies(TPM2_DURATION_DEFAULT);
79+
return msecs_to_jiffies(TPM2_DURATION_DEFAULT);
14280
}
14381

144-
14582
struct tpm2_pcr_read_out {
14683
__be32 update_cnt;
14784
__be32 pcr_selects_cnt;

‎drivers/char/tpm/tpm2-sessions.c‎

Lines changed: 30 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@
6969
#include <linux/unaligned.h>
7070
#include <crypto/kpp.h>
7171
#include <crypto/ecdh.h>
72-
#include <crypto/hash.h>
73-
#include <crypto/hmac.h>
72+
#include <crypto/sha2.h>
73+
#include <crypto/utils.h>
7474

7575
/* maximum number of names the TPM must remember for authorization */
7676
#define AUTH_MAX_NAMES 3
@@ -384,51 +384,6 @@ EXPORT_SYMBOL_GPL(tpm_buf_append_hmac_session);
384384
static int tpm2_create_primary(struct tpm_chip *chip, u32 hierarchy,
385385
u32 *handle, u8 *name);
386386

387-
/*
388-
* It turns out the crypto hmac(sha256) is hard for us to consume
389-
* because it assumes a fixed key and the TPM seems to change the key
390-
* on every operation, so we weld the hmac init and final functions in
391-
* here to give it the same usage characteristics as a regular hash
392-
*/
393-
static void tpm2_hmac_init(struct sha256_ctx *sctx, u8 *key, u32 key_len)
394-
{
395-
u8 pad[SHA256_BLOCK_SIZE];
396-
int i;
397-
398-
sha256_init(sctx);
399-
for (i = 0; i < sizeof(pad); i++) {
400-
if (i < key_len)
401-
pad[i] = key[i];
402-
else
403-
pad[i] = 0;
404-
pad[i] ^= HMAC_IPAD_VALUE;
405-
}
406-
sha256_update(sctx, pad, sizeof(pad));
407-
}
408-
409-
static void tpm2_hmac_final(struct sha256_ctx *sctx, u8 *key, u32 key_len,
410-
u8 *out)
411-
{
412-
u8 pad[SHA256_BLOCK_SIZE];
413-
int i;
414-
415-
for (i = 0; i < sizeof(pad); i++) {
416-
if (i < key_len)
417-
pad[i] = key[i];
418-
else
419-
pad[i] = 0;
420-
pad[i] ^= HMAC_OPAD_VALUE;
421-
}
422-
423-
/* collect the final hash; use out as temporary storage */
424-
sha256_final(sctx, out);
425-
426-
sha256_init(sctx);
427-
sha256_update(sctx, pad, sizeof(pad));
428-
sha256_update(sctx, out, SHA256_DIGEST_SIZE);
429-
sha256_final(sctx, out);
430-
}
431-
432387
/*
433388
* assume hash sha256 and nonces u, v of size SHA256_DIGEST_SIZE but
434389
* otherwise standard tpm2_KDFa. Note output is in bytes not bits.
@@ -440,16 +395,16 @@ static void tpm2_KDFa(u8 *key, u32 key_len, const char *label, u8 *u,
440395
const __be32 bits = cpu_to_be32(bytes * 8);
441396

442397
while (bytes > 0) {
443-
struct sha256_ctx sctx;
398+
struct hmac_sha256_ctx hctx;
444399
__be32 c = cpu_to_be32(counter);
445400

446-
tpm2_hmac_init(&sctx, key, key_len);
447-
sha256_update(&sctx, (u8 *)&c, sizeof(c));
448-
sha256_update(&sctx, label, strlen(label)+1);
449-
sha256_update(&sctx, u, SHA256_DIGEST_SIZE);
450-
sha256_update(&sctx, v, SHA256_DIGEST_SIZE);
451-
sha256_update(&sctx, (u8 *)&bits, sizeof(bits));
452-
tpm2_hmac_final(&sctx, key, key_len, out);
401+
hmac_sha256_init_usingrawkey(&hctx, key, key_len);
402+
hmac_sha256_update(&hctx, (u8 *)&c, sizeof(c));
403+
hmac_sha256_update(&hctx, label, strlen(label) + 1);
404+
hmac_sha256_update(&hctx, u, SHA256_DIGEST_SIZE);
405+
hmac_sha256_update(&hctx, v, SHA256_DIGEST_SIZE);
406+
hmac_sha256_update(&hctx, (u8 *)&bits, sizeof(bits));
407+
hmac_sha256_final(&hctx, out);
453408

454409
bytes -= SHA256_DIGEST_SIZE;
455410
counter++;
@@ -593,6 +548,7 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf)
593548
u32 attrs;
594549
u8 cphash[SHA256_DIGEST_SIZE];
595550
struct sha256_ctx sctx;
551+
struct hmac_sha256_ctx hctx;
596552

597553
if (!auth)
598554
return;
@@ -704,14 +660,14 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf)
704660
sha256_final(&sctx, cphash);
705661

706662
/* now calculate the hmac */
707-
tpm2_hmac_init(&sctx, auth->session_key, sizeof(auth->session_key)
708-
+ auth->passphrase_len);
709-
sha256_update(&sctx, cphash, sizeof(cphash));
710-
sha256_update(&sctx, auth->our_nonce, sizeof(auth->our_nonce));
711-
sha256_update(&sctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));
712-
sha256_update(&sctx, &auth->attrs, 1);
713-
tpm2_hmac_final(&sctx, auth->session_key, sizeof(auth->session_key)
714-
+ auth->passphrase_len, hmac);
663+
hmac_sha256_init_usingrawkey(&hctx, auth->session_key,
664+
sizeof(auth->session_key) +
665+
auth->passphrase_len);
666+
hmac_sha256_update(&hctx, cphash, sizeof(cphash));
667+
hmac_sha256_update(&hctx, auth->our_nonce, sizeof(auth->our_nonce));
668+
hmac_sha256_update(&hctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));
669+
hmac_sha256_update(&hctx, &auth->attrs, 1);
670+
hmac_sha256_final(&hctx, hmac);
715671
}
716672
EXPORT_SYMBOL(tpm_buf_fill_hmac_session);
717673

@@ -751,6 +707,7 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
751707
u8 rphash[SHA256_DIGEST_SIZE];
752708
u32 attrs, cc;
753709
struct sha256_ctx sctx;
710+
struct hmac_sha256_ctx hctx;
754711
u16 tag = be16_to_cpu(head->tag);
755712
int parm_len, len, i, handles;
756713

@@ -820,21 +777,20 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
820777
sha256_final(&sctx, rphash);
821778

822779
/* now calculate the hmac */
823-
tpm2_hmac_init(&sctx, auth->session_key, sizeof(auth->session_key)
824-
+ auth->passphrase_len);
825-
sha256_update(&sctx, rphash, sizeof(rphash));
826-
sha256_update(&sctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));
827-
sha256_update(&sctx, auth->our_nonce, sizeof(auth->our_nonce));
828-
sha256_update(&sctx, &auth->attrs, 1);
780+
hmac_sha256_init_usingrawkey(&hctx, auth->session_key,
781+
sizeof(auth->session_key) +
782+
auth->passphrase_len);
783+
hmac_sha256_update(&hctx, rphash, sizeof(rphash));
784+
hmac_sha256_update(&hctx, auth->tpm_nonce, sizeof(auth->tpm_nonce));
785+
hmac_sha256_update(&hctx, auth->our_nonce, sizeof(auth->our_nonce));
786+
hmac_sha256_update(&hctx, &auth->attrs, 1);
829787
/* we're done with the rphash, so put our idea of the hmac there */
830-
tpm2_hmac_final(&sctx, auth->session_key, sizeof(auth->session_key)
831-
+ auth->passphrase_len, rphash);
832-
if (memcmp(rphash, &buf->data[offset_s], SHA256_DIGEST_SIZE) == 0) {
833-
rc = 0;
834-
} else {
788+
hmac_sha256_final(&hctx, rphash);
789+
if (crypto_memneq(rphash, &buf->data[offset_s], SHA256_DIGEST_SIZE)) {
835790
dev_err(&chip->dev, "TPM: HMAC check failed\n");
836791
goto out;
837792
}
793+
rc = 0;
838794

839795
/* now do response decryption */
840796
if (auth->attrs & TPM2_SA_ENCRYPT) {

0 commit comments

Comments
 (0)