From patchwork Sun Jan 22 18:48:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Bottomley X-Patchwork-Id: 9531429 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 94FE360431 for ; Sun, 22 Jan 2017 18:48:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7324327F54 for ; Sun, 22 Jan 2017 18:48:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5598D27F99; Sun, 22 Jan 2017 18:48:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B780A27F54 for ; Sun, 22 Jan 2017 18:48:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751484AbdAVSsP (ORCPT ); Sun, 22 Jan 2017 13:48:15 -0500 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:44662 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751338AbdAVSsP (ORCPT ); Sun, 22 Jan 2017 13:48:15 -0500 Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 2CFD08EE212; Sun, 22 Jan 2017 10:48:14 -0800 (PST) Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08Hw-LPFrl4L; Sun, 22 Jan 2017 10:48:14 -0800 (PST) Received: from [153.66.254.194] (unknown [50.46.144.141]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by bedivere.hansenpartnership.com (Postfix) with ESMTPSA id BB5B38EE10C; Sun, 22 Jan 2017 10:48:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=hansenpartnership.com; s=20151216; t=1485110894; bh=S1nRZ4/ZWMFOTr3/YmFuauhr3PC8J2j97quYGPoOibk=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=MgeIoH/TEWSFuqO1gf5H9lcssL73uyOExVB5xN9647gP7L54YXIQqMBbRY+X1fPhk gwpCCnswbWw9iy58uE997wzk0045VUEkWiTKAYkuYbQjAS4id84mqNtDBq1QJ2BF9X Sb/XfwbiDxU/yTpZgsTlS+lnZPP/o3HX+iFJDTbA= Message-ID: <1485110892.2504.12.camel@HansenPartnership.com> Subject: Re: [tpmdd-devel] [PATCH RFC v3 5/5] tpm2: expose resource manager via a device link /dev/tpms From: James Bottomley To: Jarkko Sakkinen Cc: linux-security-module@vger.kernel.org, tpmdd-devel@lists.sourceforge.net, open list Date: Sun, 22 Jan 2017 10:48:12 -0800 In-Reply-To: <1485107342.2504.7.camel@HansenPartnership.com> References: <20170116131215.28930-1-jarkko.sakkinen@linux.intel.com> <20170116131215.28930-6-jarkko.sakkinen@linux.intel.com> <1484751663.2717.10.camel@HansenPartnership.com> <20170119104922.vhgz4rxw6yzdrxqt@intel.com> <1484828380.3140.11.camel@HansenPartnership.com> <20170120133914.2wk43nteh2hh7n3c@intel.com> <20170120210522.glx4y4oui36oimld@intel.com> <1485107342.2504.7.camel@HansenPartnership.com> X-Mailer: Evolution 3.16.5 Mime-Version: 1.0 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP On Sun, 2017-01-22 at 09:49 -0800, James Bottomley wrote: > On Fri, 2017-01-20 at 23:05 +0200, Jarkko Sakkinen wrote: > > 'tabrm4' branch has been now rebased. It's now on top of master > > branch that contains Stefan's latest patch (min body length check) > > that I've reviewed and tested. It also contains your updated > > /dev/tpms patch. > > > > I guess the 5 commits that are there now are such that we have > > fairly good consensus, don't we? If so, can I add your reviewed-by > > and tested-by to my commits and vice versa? > > We're still failing my test_transients. This is the full python of > the test case: > > > def test_transients(self): > k = self.open_transients() > self.c.flush_context(k[0]) > self.c.change_auth(self.c.SRK, k[1], None, pwd1) > ... > > It's failing at self.c.flush_context(k[0]) with TPM_RC_VALUE. It's > the same problem Ken complained about: TPM2_FlushContext doesn't have > a declared handle area so we don't translate the handle being sent > down. We have to fix this either by intercepting the flush and > manually translating the context, or by being dangerously clever and > marking flush as a command which takes one handle. This is what the dangerously clever fix looks like. With this and a few other changes, my smoke tests now pass. James --- -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index f54226d..d5517f1 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -1053,9 +1053,16 @@ int tpm2_auto_startup(struct tpm_chip *chip) goto out; } - for (i = 0; i < nr_commands; i++) - chip->cc_attrs_tbl[i] = be32_to_cpup( - (u32 *)&buf.data[TPM_HEADER_SIZE + 9 + 4 * i]); + for (i = 0; i < nr_commands; i++) { + u32 attr = be32_to_cpup((u32 *)&buf.data[TPM_HEADER_SIZE + + 9 + 4 * i]); + if ((attr & GENMASK(15,0)) == TPM2_CC_FLUSH_CONTEXT) + /* Warning: dangerous cleverness here. + * Mark flush as taking a handle argument so + * it gets correctly translated */ + attr |= 1 << TPM2_CC_ATTR_CHANDLES; + chip->cc_attrs_tbl[i] = attr; + } chip->nr_commands = nr_commands; tpm_buf_destroy(&buf);