wireguard-linux/drivers/char/tpm/Kconfig, branch jd/unified-crypt-queue

tpm: tpm_tis_spi: Support cr50 devices

2019-11-12T19:45:37Z

Add TPM2.0 PTP FIFO compatible SPI interface for chips with Cr50 firmware. The firmware running on the currently supported H1 Secure Microcontroller requires a special driver to handle its specifics: - need to ensure a certain delay between SPI transactions, or else the chip may miss some part of the next transaction - if there is no SPI activity for some time, it may go to sleep, and needs to be waken up before sending further commands - access to vendor-specific registers Cr50 firmware has a requirement to wait for the TPM to wakeup before sending commands over the SPI bus. Otherwise, the firmware could be in deep sleep and not respond. The method to wait for the device to wakeup is slightly different than the usual flow control mechanism described in the TCG SPI spec. Add a completion to tpm_tis_spi_transfer() before we start a SPI transfer so we can keep track of the last time the TPM driver accessed the SPI bus to support the flow control mechanism. Split the cr50 logic off into a different file to keep it out of the normal code flow of the existing SPI driver while making it all part of the same module when the code is optionally compiled into the same module. Export a new function, tpm_tis_spi_init(), and the associated read/write/transfer APIs so that we can do this. Make the cr50 code wrap the tpm_tis_spi_phy struct with its own struct to override the behavior of tpm_tis_spi_transfer() by supplying a custom flow control hook. This shares the most code between the core driver and the cr50 support without combining everything into the core driver or exporting module symbols. Signed-off-by: Andrey Pronin Cc: Andrey Pronin Cc: Duncan Laurie Cc: Jason Gunthorpe Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Guenter Roeck Cc: Alexander Steffen Cc: Heiko Stuebner [swboyd@chromium.org: Replace boilerplate with SPDX tag, drop suspended bit and remove ifdef checks in cr50.h, migrate to functions exported in tpm_tis_spi.h, combine into one module instead of two] Signed-off-by: Stephen Boyd Tested-by: Heiko Stuebner Reviewed-by: Heiko Stuebner Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen

tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE

2019-09-02T14:08:35Z

Add a driver for a firmware TPM running inside TEE. Documentation of the firmware TPM: https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/ . Implementation of the firmware TPM: https://github.com/Microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM Tested-by: Ilias Apalodimas Tested-by: Thirupathaiah Annapureddy Signed-off-by: Thirupathaiah Annapureddy Co-authored-by: Sasha Levin Signed-off-by: Sasha Levin Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21T08:50:46Z

Add SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any form These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman

Make anon_inodes unconditional

2019-04-19T12:03:11Z

Make the anon_inodes facility unconditional so that it can be used by core VFS code and pidfd code. Signed-off-by: David Howells Signed-off-by: Al Viro [christian@brauner.io: adapt commit message to mention pidfds] Signed-off-by: Christian Brauner

tpm: Make SECURITYFS a weak dependency

2018-10-05T10:47:33Z

While having SECURITYFS enabled for the tpm subsystem is beneficial in most cases, it is not strictly necessary to have it enabled at all. Especially on platforms without any boot firmware integration of the TPM (e.g. raspberry pi) it does not add any value for the tpm subsystem, as there is no eventlog present. By turning it from 'select' to 'imply' it still gets selected per default, but enables users who want to save some kb of ram by turning SECURITYFS off. Signed-off-by: Peter Huewe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen

tpm: Move Linux RNG connection to hwrng

2018-01-08T10:58:36Z

The tpm-rng.c approach is completely inconsistent with how the kernel handles hotplug. Instead manage a hwrng device for each TPM. This will cause the kernel to read entropy from the TPM when it is plugged in, and allow access to the TPM rng via /dev/hwrng. Signed-off-by: Jason Gunthorpe Tested-by: PrasannaKumar Muralidharan Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen

tpm/tpm_crb: Enable TPM CRB interface for ARM64

2017-04-03T19:46:03Z

This enables TPM Command Response Buffer interface driver for ARM64 and implements an ARM specific TPM CRB start method that invokes a Secure Monitor Call (SMC) to request the TrustZone Firmware to execute or cancel a TPM 2.0 command. In ARM, TrustZone security extensions enable a secure software environment with Secure Monitor mode. A Secure Monitor Call (SMC) is used to enter the Secure Monitor mode and perform a Secure Monitor service to communicate with TrustZone firmware which has control over the TPM hardware. Signed-off-by: Jiandi An Tested-by: Shanker Donthineni Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen (on x86/PTT) Signed-off-by: Jarkko Sakkinen

tpm: select CONFIG_CRYPTO

2017-04-03T19:46:00Z

We get a newly introduced harmless warning when CONFIG_CRYPTO is disabled: warning: (TCG_TPM && TRUSTED_KEYS && IMA) selects CRYPTO_HASH_INFO which has unmet direct dependencies (CRYPTO) This adds another select to avoid the warning, consistent with other users of the crypto code. Fixes: c1f92b4b04ad ("tpm: enhance TPM 2.0 PCR extend to support multiple banks") Signed-off-by: Arnd Bergmann Reviewed-by: Peter Huewe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen

tpm: enhance TPM 2.0 PCR extend to support multiple banks

2017-02-03T20:03:14Z

The current TPM 2.0 device driver extends only the SHA1 PCR bank but the TCG Specification[1] recommends extending all active PCR banks, to prevent malicious users from setting unused PCR banks with fake measurements and quoting them. The existing in-kernel interface(tpm_pcr_extend()) expects only a SHA1 digest. To extend all active PCR banks with differing digest sizes, the SHA1 digest is padded with trailing 0's as needed. This patch reuses the defined digest sizes from the crypto subsystem, adding a dependency on CRYPTO_HASH_INFO module. [1] TPM 2.0 Specification referred here is "TCG PC Client Specific Platform Firmware Profile for TPM 2.0" Signed-off-by: Nayna Jain Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Tested-by: Kenneth Goldman Signed-off-by: Jarkko Sakkinen

tpm_tis: Allow tpm_tis to be bound using DT

2016-11-27T23:31:31Z

This provides an open firwmare driver binding for tpm_tis. OF is useful on arches where ACPI/PNP is not used. The tcg,tpm-tis-mmio register map interface is specified by the TCG. Reviewed-by: Rob Herring Signed-off-by: Jason Gunthorpe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen