| Message ID | 1563449086-13183-2-git-send-email-sumit.garg@linaro.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KEYS: trusted: Add generic trusted keys framework | expand |
On Thu, Jul 18, 2019 at 04:54:45PM +0530, Sumit Garg wrote: > Move existing code to trusted keys subsystem. Also, rename files with > "tpm" as suffix which provides the underlying implementation. > > Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > Signed-off-by: Sumit Garg <sumit.garg@linaro.org> What about TPM2 trusted keys code? /Jarkko
On Thu, 1 Aug 2019 at 22:54, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> wrote: > > On Thu, Jul 18, 2019 at 04:54:45PM +0530, Sumit Garg wrote: > > Move existing code to trusted keys subsystem. Also, rename files with > > "tpm" as suffix which provides the underlying implementation. > > > > Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > > Signed-off-by: Sumit Garg <sumit.garg@linaro.org> > > What about TPM2 trusted keys code? Isn't TPM2 code located here: "drivers/char/tpm/"? Would you like to move that code under trusted keys subsystem only? -Sumit > > /Jarkko
On Fri, Aug 02, 2019 at 11:20:09AM +0530, Sumit Garg wrote: > On Thu, 1 Aug 2019 at 22:54, Jarkko Sakkinen > <jarkko.sakkinen@linux.intel.com> wrote: > > > > On Thu, Jul 18, 2019 at 04:54:45PM +0530, Sumit Garg wrote: > > > Move existing code to trusted keys subsystem. Also, rename files with > > > "tpm" as suffix which provides the underlying implementation. > > > > > > Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > > > Signed-off-by: Sumit Garg <sumit.garg@linaro.org> > > > > What about TPM2 trusted keys code? > > Isn't TPM2 code located here: "drivers/char/tpm/"? Would you like to > move that code under trusted keys subsystem only? Yeah, we need a design decision here. What I care is that they should be in the same subsystem. I did trusted keys directly to TPM 2.0 subsys because the subsystem was not too robust back then. Right now I think it would be feasible to implement TPM2 trusted keys outside TPM driver since the whole transmit functionality is way more robust. /Jarkko
On Sat, 3 Aug 2019 at 01:08, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> wrote: > > On Fri, Aug 02, 2019 at 11:20:09AM +0530, Sumit Garg wrote: > > On Thu, 1 Aug 2019 at 22:54, Jarkko Sakkinen > > <jarkko.sakkinen@linux.intel.com> wrote: > > > > > > On Thu, Jul 18, 2019 at 04:54:45PM +0530, Sumit Garg wrote: > > > > Move existing code to trusted keys subsystem. Also, rename files with > > > > "tpm" as suffix which provides the underlying implementation. > > > > > > > > Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > > > > Signed-off-by: Sumit Garg <sumit.garg@linaro.org> > > > > > > What about TPM2 trusted keys code? > > > > Isn't TPM2 code located here: "drivers/char/tpm/"? Would you like to > > move that code under trusted keys subsystem only? > > Yeah, we need a design decision here. What I care is that they should > be in the same subsystem. I did trusted keys directly to TPM 2.0 subsys > because the subsystem was not too robust back then. > > Right now I think it would be feasible to implement TPM2 trusted keys > outside TPM driver since the whole transmit functionality is way more > robust. > Okay, I will try to move TPM2 trusted keys code also. -Sumit > /Jarkko
On Mon, Aug 05, 2019 at 10:32:59AM +0530, Sumit Garg wrote:
> Okay, I will try to move TPM2 trusted keys code also.
I'm definitely for extending trusted keys beyond TPMs. Before that can be
done, however, the current mess needs to be cleaned up.
I did a lot of work recently [1] to clean up TPM transmit code to better
suited to be used outside of the TPM drivers (remove recursive calls,
put the whole stack use tpm_buf for everything).
What still needs to be done is to move tpm_buf stuff to include/linux in
order to be usable in the keyring code. Also for TPM 2.0 trusted keys,
TPM2 constants need to be moved to include/linux. For the latter, I'd
suggest to move all protocol constants there and not just what is
required for trusted keys. Better to have them in one place.
[1] https://lkml.org/lkml/2019/2/13/176
/Jarkko
diff --git a/crypto/asymmetric_keys/asym_tpm.c b/crypto/asymmetric_keys/asym_tpm.c index 76d2ce3..ec3f309 100644 --- a/crypto/asymmetric_keys/asym_tpm.c +++ b/crypto/asymmetric_keys/asym_tpm.c @@ -13,7 +13,7 @@ #include <crypto/sha.h> #include <asm/unaligned.h> #include <keys/asymmetric-subtype.h> -#include <keys/trusted.h> +#include <keys/trusted_tpm.h> #include <crypto/asym_tpm_subtype.h> #include <crypto/public_key.h> diff --git a/include/keys/trusted.h b/include/keys/trusted_tpm.h similarity index 98% rename from include/keys/trusted.h rename to include/keys/trusted_tpm.h index 0071298..7d7b108 100644 --- a/include/keys/trusted.h +++ b/include/keys/trusted_tpm.h @@ -1,6 +1,6 @@ /* SPDX-License-Identifier: GPL-2.0 */ -#ifndef __TRUSTED_KEY_H -#define __TRUSTED_KEY_H +#ifndef __TRUSTED_TPM_H +#define __TRUSTED_TPM_H /* implementation specific TPM constants */ #define MAX_BUF_SIZE 1024 diff --git a/security/keys/Makefile b/security/keys/Makefile index 9cef540..074f275 100644 --- a/security/keys/Makefile +++ b/security/keys/Makefile @@ -28,5 +28,5 @@ obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += keyctl_pkey.o # Key types # obj-$(CONFIG_BIG_KEYS) += big_key.o -obj-$(CONFIG_TRUSTED_KEYS) += trusted.o +obj-$(CONFIG_TRUSTED_KEYS) += trusted-keys/ obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted-keys/ diff --git a/security/keys/trusted-keys/Makefile b/security/keys/trusted-keys/Makefile new file mode 100644 index 0000000..ad34d17 --- /dev/null +++ b/security/keys/trusted-keys/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for trusted keys +# + +obj-$(CONFIG_TRUSTED_KEYS) += trusted-tpm.o diff --git a/security/keys/trusted.c b/security/keys/trusted-keys/trusted-tpm.c similarity index 99% rename from security/keys/trusted.c rename to security/keys/trusted-keys/trusted-tpm.c index 9a94672..b7e53a3 100644 --- a/security/keys/trusted.c +++ b/security/keys/trusted-keys/trusted-tpm.c @@ -27,7 +27,7 @@ #include <linux/tpm.h> #include <linux/tpm_command.h> -#include <keys/trusted.h> +#include <keys/trusted_tpm.h> static const char hmac_alg[] = "hmac(sha1)"; static const char hash_alg[] = "sha1";
Move existing code to trusted keys subsystem. Also, rename files with "tpm" as suffix which provides the underlying implementation. Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Sumit Garg <sumit.garg@linaro.org> --- crypto/asymmetric_keys/asym_tpm.c | 2 +- include/keys/{trusted.h => trusted_tpm.h} | 4 ++-- security/keys/Makefile | 2 +- security/keys/trusted-keys/Makefile | 6 ++++++ security/keys/{trusted.c => trusted-keys/trusted-tpm.c} | 2 +- 5 files changed, 11 insertions(+), 5 deletions(-) rename include/keys/{trusted.h => trusted_tpm.h} (98%) create mode 100644 security/keys/trusted-keys/Makefile rename security/keys/{trusted.c => trusted-keys/trusted-tpm.c} (99%)