Commit 0b6cf6b9 authored by Roberto Sassu's avatar Roberto Sassu Committed by Jarkko Sakkinen
Browse files

tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend() 



Currently, tpm_pcr_extend() accepts as an input only a SHA1 digest.

This patch replaces the hash parameter of tpm_pcr_extend() with an array of
tpm_digest structures, so that the caller can provide a digest for each PCR
bank currently allocated in the TPM.

tpm_pcr_extend() will not extend banks for which no digest was provided,
as it happened before this patch, but instead it requires that callers
provide the full set of digests. Since the number of digests will always be
chip->nr_allocated_banks, the count parameter has been removed.

Due to the API change, ima_pcr_extend() and pcrlock() have been modified.
Since the number of allocated banks is not known in advance, the memory for
the digests must be dynamically allocated. To avoid performance degradation
and to avoid that a PCR extend is not done due to lack of memory, the array
of tpm_digest structures is allocated by the users of the TPM driver at
initialization time.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Mimi Zohar <zohar@linux.ibm.com> (on x86 for TPM 1.2 & PTT TPM 2.0)
Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
parent 24073043

drivers/char/tpm/tpm-interface.c

+11 −19
Original line number Diff line number Diff line
@@ -308,42 +308,34 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read); 
 * tpm_pcr_extend - extend a PCR value in SHA1 bank.

 * @chip:	a &struct tpm_chip instance, %NULL for the default chip

 * @pcr_idx:	the PCR to be retrieved

 * @hash:	the hash value used to extend the PCR value

 * @digests:	array of tpm_digest structures used to extend PCRs

 *

 * Note: with TPM 2.0 extends also those banks for which no digest was

 * specified in order to prevent malicious use of those PCR banks.

 * Note: callers must pass a digest for every allocated PCR bank, in the same

 * order of the banks in chip->allocated_banks.

 *

 * Return: same as with tpm_transmit_cmd()

 */

int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash)

int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,

		   struct tpm_digest *digests)

{

	int rc;

	struct tpm_digest *digest_list;

	int i;



	chip = tpm_find_get_ops(chip);

	if (!chip)

		return -ENODEV;



	if (chip->flags & TPM_CHIP_FLAG_TPM2) {

		digest_list = kcalloc(chip->nr_allocated_banks,

				      sizeof(*digest_list), GFP_KERNEL);

		if (!digest_list)

			return -ENOMEM;



		for (i = 0; i < chip->nr_allocated_banks; i++) {

			digest_list[i].alg_id = chip->allocated_banks[i].alg_id;

			memcpy(digest_list[i].digest, hash, TPM_DIGEST_SIZE);

		}

	for (i = 0; i < chip->nr_allocated_banks; i++)

		if (digests[i].alg_id != chip->allocated_banks[i].alg_id)

			return -EINVAL;



		rc = tpm2_pcr_extend(chip, pcr_idx, chip->nr_allocated_banks,

				     digest_list);

		kfree(digest_list);

	if (chip->flags & TPM_CHIP_FLAG_TPM2) {

		rc = tpm2_pcr_extend(chip, pcr_idx, digests);

		tpm_put_ops(chip);

		return rc;

	}



	rc = tpm1_pcr_extend(chip, pcr_idx, hash,

	rc = tpm1_pcr_extend(chip, pcr_idx, digests[0].digest,

			     "attempting extend a PCR value");

	tpm_put_ops(chip);

	return rc;

drivers/char/tpm/tpm.h

+1 −1
Original line number Diff line number Diff line
@@ -441,7 +441,7 @@ static inline u32 tpm2_rc_value(u32 rc) 
int tpm2_get_timeouts(struct tpm_chip *chip);

int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,

		  struct tpm_digest *digest, u16 *digest_size_ptr);

int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,

int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,

		    struct tpm_digest *digests);

int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);

void tpm2_flush_context(struct tpm_chip *chip, u32 handle);

drivers/char/tpm/tpm2-cmd.c

+3 −7
Original line number Diff line number Diff line
@@ -246,12 +246,11 @@ struct tpm2_null_auth_area { 
 *

 * @chip:	TPM chip to use.

 * @pcr_idx:	index of the PCR.

 * @count:	number of digests passed.

 * @digests:	list of pcr banks and corresponding digest values to extend.

 *

 * Return: Same as with tpm_transmit_cmd.

 */

int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count,

int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,

		    struct tpm_digest *digests)

{

	struct tpm_buf buf;
@@ -259,9 +258,6 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count, 
	int rc;

	int i;



	if (count > chip->nr_allocated_banks)

		return -EINVAL;



	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_PCR_EXTEND);

	if (rc)

		return rc;
@@ -276,9 +272,9 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, u32 count, 
	tpm_buf_append_u32(&buf, sizeof(struct tpm2_null_auth_area));

	tpm_buf_append(&buf, (const unsigned char *)&auth_area,

		       sizeof(auth_area));

	tpm_buf_append_u32(&buf, count);

	tpm_buf_append_u32(&buf, chip->nr_allocated_banks);



	for (i = 0; i < count; i++) {

	for (i = 0; i < chip->nr_allocated_banks; i++) {

		tpm_buf_append_u16(&buf, digests[i].alg_id);

		tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest,

			       chip->allocated_banks[i].digest_size);

include/linux/tpm.h

+3 −2
Original line number Diff line number Diff line
@@ -171,7 +171,8 @@ struct tpm_chip { 
extern int tpm_is_tpm2(struct tpm_chip *chip);

extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,

			struct tpm_digest *digest);

extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, const u8 *hash);

extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,

			  struct tpm_digest *digests);

extern int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen);

extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max);

extern int tpm_seal_trusted(struct tpm_chip *chip,
@@ -194,7 +195,7 @@ static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, 
}



static inline int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,

				 const u8 *hash)

				 struct tpm_digest *digests)

{

	return -ENODEV;

}

security/integrity/ima/ima.h

+1 −0
Original line number Diff line number Diff line
@@ -153,6 +153,7 @@ int ima_measurements_show(struct seq_file *m, void *v); 
unsigned long ima_get_binary_runtime_size(void);

int ima_init_template(void);

void ima_init_template_list(void);

int __init ima_init_digests(void);



/*

 * used to protect h_table and sha_table

CRA Git | Maintained and supported by SUSTech CRA and CCSE