Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1443870 > unrolled thread

[PATCH 0/2] tpm: driver- and tpm2-specific sysfs attributes

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/2] tpm: driver- and tpm2-specific sysfs attributes Andrey Pronin <apronin@chromium.org> - 2016-07-15 04:00 +0200
    [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core Andrey Pronin <apronin@chromium.org> - 2016-07-15 04:00 +0200
      Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in  tpm_tis_core Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2016-07-15 05:30 +0200
        Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in  tpm_tis_core Andrey Pronin <apronin@chromium.org> - 2016-07-15 05:40 +0200
          Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in  tpm_tis_core Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-07-18 21:30 +0200
      Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in  tpm_tis_core Andrey Pronin <apronin@chromium.org> - 2016-07-18 21:20 +0200
      Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in  tpm_tis_core Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-07-18 21:20 +0200
    [PATCH v2] tpm: add sysfs attributes for tpm2 Andrey Pronin <apronin@chromium.org> - 2016-07-20 05:00 +0200
      Re: [PATCH v2] tpm: add sysfs attributes for tpm2 Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2016-07-20 19:10 +0200
        Re: [PATCH v2] tpm: add sysfs attributes for tpm2 Andrey Pronin <apronin@chromium.org> - 2016-07-20 19:50 +0200

#1443870 — [PATCH 0/2] tpm: driver- and tpm2-specific sysfs attributes

This patchset adds sysfs attributes for the cases not covered by the
existing TPM1.2 support:
 - device-specific attributes provided by drivers like tpm_tis_spi
 - TPM2.0

Andrey Pronin (2):
  tpm: add sysfs attributes for tpm2
  tpm: support driver-specific sysfs attrs in tpm_tis_core

 drivers/char/tpm/tpm-chip.c     | 48 ++++++++++++++++++++++++++---------------
 drivers/char/tpm/tpm-sysfs.c    | 25 ++++++++++++++++++---
 drivers/char/tpm/tpm.h          |  8 ++++++-
 drivers/char/tpm/tpm_tis_core.c |  3 +++
 drivers/char/tpm/tpm_tis_core.h |  1 +
 5 files changed, 64 insertions(+), 21 deletions(-)

-- 
2.6.6

[toc] | [next] | [standalone]

#1443872 — [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

Add attr_group to phy_ops that a driver relying on tpm_tis_core_init
can set to have its specific attributes registered in sysfs.

Signed-off-by: Andrey Pronin <apronin@chromium.org>
---
 drivers/char/tpm/tpm-sysfs.c    | 1 -
 drivers/char/tpm/tpm.h          | 8 +++++++-
 drivers/char/tpm/tpm_tis_core.c | 3 +++
 drivers/char/tpm/tpm_tis_core.h | 1 +
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
index 95ce90d..22c9874 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
@@ -304,7 +304,6 @@ void tpm_sysfs_add_device(struct tpm_chip *chip)
 	 * is called before ops is null'd and the sysfs core synchronizes this
 	 * removal so that no callbacks are running or can run again
 	 */
-	WARN_ON(chip->groups_cnt != 0);
 	chip->groups[chip->groups_cnt++] = &tpm_dev_group;
 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
 		chip->groups[chip->groups_cnt++] = &tpm2_dev_group;
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 8890df2..8c69649 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -173,7 +173,13 @@ struct tpm_chip {
 
 	struct dentry **bios_dir;
 
-	const struct attribute_group *groups[3];
+	/* up to 4 attribute groups:
+	 * - driver-specific
+	 * - common TPM1.2 and TPM2.0
+	 * - TPM1.2/2.0-specific
+	 * - ppi
+	 */
+	const struct attribute_group *groups[5];
 	unsigned int groups_cnt;
 #ifdef CONFIG_ACPI
 	acpi_handle acpi_dev_handle;
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 8110b52..6d5d8f4 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -796,6 +796,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
 		}
 	}
 
+	if (priv->phy_ops->attr_group)
+		chip->groups[chip->groups_cnt++] = priv->phy_ops->attr_group;
+
 	return tpm_chip_register(chip);
 out_err:
 	tpm_tis_remove(chip);
diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
index 9191aab..4417ed9 100644
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -95,6 +95,7 @@ struct tpm_tis_data {
 };
 
 struct tpm_tis_phy_ops {
+	const struct attribute_group *attr_group;
 	int (*read_bytes)(struct tpm_tis_data *data, u32 addr, u16 len,
 			  u8 *result);
 	int (*write_bytes)(struct tpm_tis_data *data, u32 addr, u16 len,
-- 
2.6.6

[toc] | [prev] | [next] | [standalone]

#1443912 — Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

On Thu, Jul 14, 2016 at 06:51:36PM -0700, Andrey Pronin wrote:
> -	WARN_ON(chip->groups_cnt != 0);

Nope.

> -	const struct attribute_group *groups[3];
> +	/* up to 4 attribute groups:
> +	 * - driver-specific
> +	 * - common TPM1.2 and TPM2.0
> +	 * - TPM1.2/2.0-specific
> +	 * - ppi
> +	 */
> +	const struct attribute_group *groups[5];

The prior patch needed to have groups[4], every patch much work.

> +	if (priv->phy_ops->attr_group)
> +		chip->groups[chip->groups_cnt++] = priv->phy_ops->attr_group;

I am really not excited about having driver specific sysfs
files.

What is the justification for this?

Jason

[toc] | [prev] | [next] | [standalone]

#1443919 — Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

On Thu, Jul 14, 2016 at 09:23:27PM -0600, Jason Gunthorpe wrote:
> On Thu, Jul 14, 2016 at 06:51:36PM -0700, Andrey Pronin wrote:
> > -	WARN_ON(chip->groups_cnt != 0);
> 
> Nope.
> 
> > -	const struct attribute_group *groups[3];
> > +	/* up to 4 attribute groups:
> > +	 * - driver-specific
> > +	 * - common TPM1.2 and TPM2.0
> > +	 * - TPM1.2/2.0-specific
> > +	 * - ppi
> > +	 */
> > +	const struct attribute_group *groups[5];
> 
> The prior patch needed to have groups[4], every patch much work.
> 
> > +	if (priv->phy_ops->attr_group)
> > +		chip->groups[chip->groups_cnt++] = priv->phy_ops->attr_group;
> 
> I am really not excited about having driver specific sysfs
> files.
> 
> What is the justification for this?
> 
> Jason

Justification: give access to vendor-specific properties that are
specific to a particular chip and its registers.

Andrey

[toc] | [prev] | [next] | [standalone]

#1445755 — Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

On Thu, Jul 14, 2016 at 08:35:30PM -0700, Andrey Pronin wrote:
> On Thu, Jul 14, 2016 at 09:23:27PM -0600, Jason Gunthorpe wrote:
> > On Thu, Jul 14, 2016 at 06:51:36PM -0700, Andrey Pronin wrote:
> > > -	WARN_ON(chip->groups_cnt != 0);
> > 
> > Nope.
> > 
> > > -	const struct attribute_group *groups[3];
> > > +	/* up to 4 attribute groups:
> > > +	 * - driver-specific
> > > +	 * - common TPM1.2 and TPM2.0
> > > +	 * - TPM1.2/2.0-specific
> > > +	 * - ppi
> > > +	 */
> > > +	const struct attribute_group *groups[5];
> > 
> > The prior patch needed to have groups[4], every patch much work.
> > 
> > > +	if (priv->phy_ops->attr_group)
> > > +		chip->groups[chip->groups_cnt++] = priv->phy_ops->attr_group;
> > 
> > I am really not excited about having driver specific sysfs
> > files.
> > 
> > What is the justification for this?
> > 
> > Jason
> 
> Justification: give access to vendor-specific properties that are
> specific to a particular chip and its registers.

Please come with a vendor specific property or have this part of a
series where the need becomes somehow obvious so that we can talk about
a real problem and not in an abstract level.

Making user API vendor wobbling is almost over my dead body type of
thing but given the context there might be alternatives to consider.

I honestly don't understand why this was even bundled with TPM2 patch.

/Jarkko

[toc] | [prev] | [next] | [standalone]

#1445745 — Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

On Mon, Jul 18, 2016 at 10:11:41PM +0300, Jarkko Sakkinen wrote:
> On Thu, Jul 14, 2016 at 06:51:36PM -0700, Andrey Pronin wrote:
> > Add attr_group to phy_ops that a driver relying on tpm_tis_core_init
> > can set to have its specific attributes registered in sysfs.
> > 
> > Signed-off-by: Andrey Pronin <apronin@chromium.org>
> > ---
> >  drivers/char/tpm/tpm-sysfs.c    | 1 -
> >  drivers/char/tpm/tpm.h          | 8 +++++++-
> >  drivers/char/tpm/tpm_tis_core.c | 3 +++
> >  drivers/char/tpm/tpm_tis_core.h | 1 +
> >  4 files changed, 11 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
> > index 95ce90d..22c9874 100644
> > --- a/drivers/char/tpm/tpm-sysfs.c
> > +++ b/drivers/char/tpm/tpm-sysfs.c
> > @@ -304,7 +304,6 @@ void tpm_sysfs_add_device(struct tpm_chip *chip)
> >  	 * is called before ops is null'd and the sysfs core synchronizes this
> >  	 * removal so that no callbacks are running or can run again
> >  	 */
> > -	WARN_ON(chip->groups_cnt != 0);
> 
> You should explain this in a commit message if you want to remove it.
> 
> In general, this make user space API vendor specific, which is
> unacceptable.
> 
> /Jarkko
>

I will drop the vendor-specific part of the patchset and just submit
tpm2-specific sysfs attributes in the next rev. WARN_ON will not be
removed.

[toc] | [prev] | [next] | [standalone]

#1445746 — Re: [PATCH 2/2] tpm: support driver-specific sysfs attrs in tpm_tis_core

On Thu, Jul 14, 2016 at 06:51:36PM -0700, Andrey Pronin wrote:
> Add attr_group to phy_ops that a driver relying on tpm_tis_core_init
> can set to have its specific attributes registered in sysfs.
> 
> Signed-off-by: Andrey Pronin <apronin@chromium.org>
> ---
>  drivers/char/tpm/tpm-sysfs.c    | 1 -
>  drivers/char/tpm/tpm.h          | 8 +++++++-
>  drivers/char/tpm/tpm_tis_core.c | 3 +++
>  drivers/char/tpm/tpm_tis_core.h | 1 +
>  4 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
> index 95ce90d..22c9874 100644
> --- a/drivers/char/tpm/tpm-sysfs.c
> +++ b/drivers/char/tpm/tpm-sysfs.c
> @@ -304,7 +304,6 @@ void tpm_sysfs_add_device(struct tpm_chip *chip)
>  	 * is called before ops is null'd and the sysfs core synchronizes this
>  	 * removal so that no callbacks are running or can run again
>  	 */
> -	WARN_ON(chip->groups_cnt != 0);

You should explain this in a commit message if you want to remove it.

In general, this make user space API vendor specific, which is
unacceptable.

/Jarkko

>  	chip->groups[chip->groups_cnt++] = &tpm_dev_group;
>  	if (chip->flags & TPM_CHIP_FLAG_TPM2)
>  		chip->groups[chip->groups_cnt++] = &tpm2_dev_group;
> diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
> index 8890df2..8c69649 100644
> --- a/drivers/char/tpm/tpm.h
> +++ b/drivers/char/tpm/tpm.h
> @@ -173,7 +173,13 @@ struct tpm_chip {
>  
>  	struct dentry **bios_dir;
>  
> -	const struct attribute_group *groups[3];
> +	/* up to 4 attribute groups:
> +	 * - driver-specific
> +	 * - common TPM1.2 and TPM2.0
> +	 * - TPM1.2/2.0-specific
> +	 * - ppi
> +	 */
> +	const struct attribute_group *groups[5];
>  	unsigned int groups_cnt;
>  #ifdef CONFIG_ACPI
>  	acpi_handle acpi_dev_handle;
> diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
> index 8110b52..6d5d8f4 100644
> --- a/drivers/char/tpm/tpm_tis_core.c
> +++ b/drivers/char/tpm/tpm_tis_core.c
> @@ -796,6 +796,9 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
>  		}
>  	}
>  
> +	if (priv->phy_ops->attr_group)
> +		chip->groups[chip->groups_cnt++] = priv->phy_ops->attr_group;
> +
>  	return tpm_chip_register(chip);
>  out_err:
>  	tpm_tis_remove(chip);
> diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
> index 9191aab..4417ed9 100644
> --- a/drivers/char/tpm/tpm_tis_core.h
> +++ b/drivers/char/tpm/tpm_tis_core.h
> @@ -95,6 +95,7 @@ struct tpm_tis_data {
>  };
>  
>  struct tpm_tis_phy_ops {
> +	const struct attribute_group *attr_group;
>  	int (*read_bytes)(struct tpm_tis_data *data, u32 addr, u16 len,
>  			  u8 *result);
>  	int (*write_bytes)(struct tpm_tis_data *data, u32 addr, u16 len,
> -- 
> 2.6.6
> 

[toc] | [prev] | [next] | [standalone]

#1446905 — [PATCH v2] tpm: add sysfs attributes for tpm2

Add sysfs attributes in TPM2.0 case for:
 - TPM_PT_PERMANENT flags
 - TPM_PT_STARTUP_CLEAR flags
 - lockout-related properties

v2: Dropped adding driver-specific attributes.
    No legacy links for TPM2 attributes.
    All attributes created in groups[0].
    Added actual attributes for flags and lockout properties.

Signed-off-by: Andrey Pronin <apronin@chromium.org>
---
 drivers/char/tpm/tpm-chip.c  |   4 +-
 drivers/char/tpm/tpm-sysfs.c | 108 +++++++++++++++++++++++++++++++++++++++++--
 drivers/char/tpm/tpm.h       |  30 ++++++++++++
 3 files changed, 136 insertions(+), 6 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index e595013..ede2ca0 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -281,8 +281,6 @@ static int tpm1_chip_register(struct tpm_chip *chip)
 	if (chip->flags & TPM_CHIP_FLAG_TPM2)
 		return 0;
 
-	tpm_sysfs_add_device(chip);
-
 	chip->bios_dir = tpm_bios_log_setup(dev_name(&chip->dev));
 
 	return 0;
@@ -363,6 +361,8 @@ int tpm_chip_register(struct tpm_chip *chip)
 			return rc;
 	}
 
+	tpm_sysfs_add_device(chip);
+
 	rc = tpm1_chip_register(chip);
 	if (rc)
 		return rc;
diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
index b46cf70..fcfc7e0 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
@@ -264,7 +264,7 @@ static ssize_t timeouts_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(timeouts);
 
-static struct attribute *tpm_dev_attrs[] = {
+static struct attribute *tpm1_dev_attrs[] = {
 	&dev_attr_pubek.attr,
 	&dev_attr_pcrs.attr,
 	&dev_attr_enabled.attr,
@@ -278,8 +278,106 @@ static struct attribute *tpm_dev_attrs[] = {
 	NULL,
 };
 
-static const struct attribute_group tpm_dev_group = {
-	.attrs = tpm_dev_attrs,
+static const struct attribute_group tpm1_dev_group = {
+	.attrs = tpm1_dev_attrs,
+};
+
+static ssize_t tpm2_prop_flag_show(struct device *dev, u32 property_id,
+				   u32 flag_mask, char *buf)
+{
+	u32 flags;
+	ssize_t rc;
+
+	rc = tpm2_get_tpm_pt(to_tpm_chip(dev), property_id, &flags,
+			     "reading property");
+	if (rc)
+		return 0;
+
+	return sprintf(buf, "%d\n", !!(flags & flag_mask));
+}
+
+static ssize_t tpm2_prop_u32_show(struct device *dev, u32 property_id,
+				  char *buf)
+{
+	u32 value;
+	ssize_t rc;
+
+	rc = tpm2_get_tpm_pt(to_tpm_chip(dev), property_id, &value,
+			     "reading property");
+	if (rc)
+		return 0;
+
+	return sprintf(buf, "%u\n", value);
+}
+
+#define DEFINE_TPM2_PROP_FLAG_ATTR(name, property_id, flag_mask)      \
+static ssize_t name##_show(struct device *dev,                        \
+			   struct device_attribute *attr, char *buf)  \
+{                                                                     \
+	return tpm2_prop_flag_show(dev, property_id, flag_mask, buf); \
+}                                                                     \
+static DEVICE_ATTR_RO(name)
+
+#define DEFINE_TPM2_PROP_U32_ATTR(name, property_id)                  \
+static ssize_t name##_show(struct device *dev,                        \
+			   struct device_attribute *attr, char *buf)  \
+{                                                                     \
+	return tpm2_prop_u32_show(dev, property_id, buf);             \
+}                                                                     \
+static DEVICE_ATTR_RO(name)
+
+DEFINE_TPM2_PROP_FLAG_ATTR(owner_auth_set,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_OWNER_AUTH_SET);
+DEFINE_TPM2_PROP_FLAG_ATTR(endorsement_auth_set,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_ENDORSEMENT_AUTH_SET);
+DEFINE_TPM2_PROP_FLAG_ATTR(lockout_auth_set,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_LOCKOUT_AUTH_SET);
+DEFINE_TPM2_PROP_FLAG_ATTR(disable_clear,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_DISABLE_CLEAR);
+DEFINE_TPM2_PROP_FLAG_ATTR(in_lockout,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_IN_LOCKOUT);
+DEFINE_TPM2_PROP_FLAG_ATTR(tpm_generated_eps,
+			   TPM2_PT_PERMANENT, TPM2_ATTR_TPM_GENERATED_EPS);
+
+DEFINE_TPM2_PROP_FLAG_ATTR(ph_enable,
+			   TPM2_PT_STARTUP_CLEAR, TPM2_ATTR_PH_ENABLE);
+DEFINE_TPM2_PROP_FLAG_ATTR(sh_enable,
+			   TPM2_PT_STARTUP_CLEAR, TPM2_ATTR_SH_ENABLE);
+DEFINE_TPM2_PROP_FLAG_ATTR(eh_enable,
+			   TPM2_PT_STARTUP_CLEAR, TPM2_ATTR_EH_ENABLE);
+DEFINE_TPM2_PROP_FLAG_ATTR(ph_enable_nv,
+			   TPM2_PT_STARTUP_CLEAR, TPM2_ATTR_PH_ENABLE_NV);
+DEFINE_TPM2_PROP_FLAG_ATTR(orderly,
+			   TPM2_PT_STARTUP_CLEAR, TPM2_ATTR_ORDERLY);
+
+DEFINE_TPM2_PROP_U32_ATTR(lockout_counter, TPM2_PT_LOCKOUT_COUNTER);
+DEFINE_TPM2_PROP_U32_ATTR(max_auth_fail, TPM2_PT_MAX_AUTH_FAIL);
+DEFINE_TPM2_PROP_U32_ATTR(lockout_interval, TPM2_PT_LOCKOUT_INTERVAL);
+DEFINE_TPM2_PROP_U32_ATTR(lockout_recovery, TPM2_PT_LOCKOUT_RECOVERY);
+
+static struct attribute *tpm2_dev_attrs[] = {
+	&dev_attr_owner_auth_set.attr,
+	&dev_attr_endorsement_auth_set.attr,
+	&dev_attr_lockout_auth_set.attr,
+	&dev_attr_disable_clear.attr,
+	&dev_attr_in_lockout.attr,
+	&dev_attr_tpm_generated_eps.attr,
+	&dev_attr_ph_enable.attr,
+	&dev_attr_sh_enable.attr,
+	&dev_attr_eh_enable.attr,
+	&dev_attr_ph_enable_nv.attr,
+	&dev_attr_orderly.attr,
+	&dev_attr_lockout_counter.attr,
+	&dev_attr_max_auth_fail.attr,
+	&dev_attr_lockout_interval.attr,
+	&dev_attr_lockout_recovery.attr,
+	&dev_attr_durations.attr,
+	&dev_attr_timeouts.attr,
+	NULL,
+};
+
+static const struct attribute_group tpm2_dev_group = {
+	.attrs = tpm2_dev_attrs,
 };
 
 void tpm_sysfs_add_device(struct tpm_chip *chip)
@@ -289,5 +387,7 @@ void tpm_sysfs_add_device(struct tpm_chip *chip)
 	 * removal so that no callbacks are running or can run again
 	 */
 	WARN_ON(chip->groups_cnt != 0);
-	chip->groups[chip->groups_cnt++] = &tpm_dev_group;
+	chip->groups[chip->groups_cnt++] =
+		(chip->flags & TPM_CHIP_FLAG_TPM2) ?
+		&tpm2_dev_group : &tpm1_dev_group;
 }
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 3e32d5b..cf4359a 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -127,6 +127,36 @@ enum tpm2_capabilities {
 	TPM2_CAP_TPM_PROPERTIES = 6,
 };
 
+enum tpm2_properties {
+	TPM2_PT_NONE			= 0,
+	TPM2_PT_GROUP			= 0x100,
+	TPM2_PT_FIXED			= TPM2_PT_GROUP,
+	TPM2_PT_VAR			= TPM2_PT_GROUP * 2,
+	TPM2_PT_PERMANENT		= TPM2_PT_VAR + 0,
+	TPM2_PT_STARTUP_CLEAR		= TPM2_PT_VAR + 1,
+	TPM2_PT_LOCKOUT_COUNTER		= TPM2_PT_VAR + 14,
+	TPM2_PT_MAX_AUTH_FAIL		= TPM2_PT_VAR + 15,
+	TPM2_PT_LOCKOUT_INTERVAL	= TPM2_PT_VAR + 16,
+	TPM2_PT_LOCKOUT_RECOVERY	= TPM2_PT_VAR + 17,
+};
+
+enum tpm2_attr_permanent {
+	TPM2_ATTR_OWNER_AUTH_SET	= BIT(0),
+	TPM2_ATTR_ENDORSEMENT_AUTH_SET	= BIT(1),
+	TPM2_ATTR_LOCKOUT_AUTH_SET	= BIT(2),
+	TPM2_ATTR_DISABLE_CLEAR		= BIT(8),
+	TPM2_ATTR_IN_LOCKOUT		= BIT(9),
+	TPM2_ATTR_TPM_GENERATED_EPS	= BIT(10),
+};
+
+enum tpm2_attr_startup_clear {
+	TPM2_ATTR_PH_ENABLE		= BIT(0),
+	TPM2_ATTR_SH_ENABLE		= BIT(1),
+	TPM2_ATTR_EH_ENABLE		= BIT(2),
+	TPM2_ATTR_PH_ENABLE_NV		= BIT(3),
+	TPM2_ATTR_ORDERLY		= BIT(31),
+};
+
 enum tpm2_startup_types {
 	TPM2_SU_CLEAR	= 0x0000,
 	TPM2_SU_STATE	= 0x0001,
-- 
2.6.6

[toc] | [prev] | [next] | [standalone]

#1447364 — Re: [PATCH v2] tpm: add sysfs attributes for tpm2

On Tue, Jul 19, 2016 at 07:51:52PM -0700, Andrey Pronin wrote:
> Add sysfs attributes in TPM2.0 case for:
>  - TPM_PT_PERMANENT flags
>  - TPM_PT_STARTUP_CLEAR flags
>  - lockout-related properties

I'm not completely sure we need to have these sysfs attributes. Do you
have a reason to expose them? Does udev do something based on them? Is
it just for debugging?

Otherwise it looks about right to me.

Jason

[toc] | [prev] | [next] | [standalone]

#1447383 — Re: [PATCH v2] tpm: add sysfs attributes for tpm2

On Wed, Jul 20, 2016 at 11:05:53AM -0600, Jason Gunthorpe wrote:
> On Tue, Jul 19, 2016 at 07:51:52PM -0700, Andrey Pronin wrote:
> > Add sysfs attributes in TPM2.0 case for:
> >  - TPM_PT_PERMANENT flags
> >  - TPM_PT_STARTUP_CLEAR flags
> >  - lockout-related properties
> 
> I'm not completely sure we need to have these sysfs attributes. Do you
> have a reason to expose them? Does udev do something based on them? Is
> it just for debugging?
> 
> Otherwise it looks about right to me.
> 

In practice, useful for scripts that monitor in what state
the system started, was there a lockout, can we use tpm for
attestation, can we rely on data stored in NVRAM, etc. And
then interact with the user accordingly.

I don't know of udev rules that do anything based on them,
but in a multi-tpm system, I can envision one that selects
the tpm that was actually used by firmware as the primary one,
or controls permissions for the device based on the state it's
in.

For TPM1.2 we expose some flags from TPM_PERMANENT_FLAGS and
TPM_CAP_PROP_OWNER, for example, to show if the tpm is owned,
enabled etc. A combination of ph/eh/shEnable and *AuthSet flags
from TPM2 provides info allowing to make similar decisions about
the tpm being 'owned' or 'enabled' for userland scripts.

Andrey

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web