From: Roberto Sassu <roberto.sassu@huawei.com>
To: <jarkko.sakkinen@linux.intel.com>, <zohar@linux.ibm.com>
Cc: <linux-integrity@vger.kernel.org>,
<linux-security-module@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <silviu.vlasceanu@huawei.com>,
Roberto Sassu <roberto.sassu@huawei.com>
Subject: [PATCH v4 4/6] tpm: modify tpm_pcr_read() definition to pass a TPM hash algorithm
Date: Tue, 6 Nov 2018 16:01:57 +0100 [thread overview]
Message-ID: <20181106150159.1136-5-roberto.sassu@huawei.com> (raw)
In-Reply-To: <20181106150159.1136-1-roberto.sassu@huawei.com>
Currently the TPM driver allows other kernel subsystems to read only the
SHA1 PCR bank. This patch modifies the parameters of tpm_pcr_read() and
tpm2_pcr_read() to pass a tpm_digest structure, which contains the desired
hash algorithm. Also, since commit 125a22105410 ("tpm: React correctly to
RC_TESTING from TPM 2.0 self tests") removed the call to tpm2_pcr_read(),
the new parameter is expected to be always not NULL.
Due to the API change, IMA functions have been modified.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
---
drivers/char/tpm/tpm-interface.c | 9 +++++----
drivers/char/tpm/tpm.h | 3 ++-
drivers/char/tpm/tpm2-cmd.c | 23 ++++++++++++++++-------
include/linux/tpm.h | 6 ++++--
security/integrity/ima/ima_crypto.c | 10 +++++-----
5 files changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 07b62734598c..e341ed9c232a 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -976,11 +976,12 @@ EXPORT_SYMBOL_GPL(tpm_is_tpm2);
* tpm_pcr_read - read a PCR value from SHA1 bank
* @chip: a &struct tpm_chip instance, %NULL for the default chip
* @pcr_idx: the PCR to be retrieved
- * @res_buf: the value of the PCR
+ * @digest_struct: pcr bank and buffer current PCR value is written to
*
* Return: same as with tpm_transmit_cmd()
*/
-int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest_struct)
{
int rc;
@@ -988,9 +989,9 @@ int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
if (!chip)
return -ENODEV;
if (chip->flags & TPM_CHIP_FLAG_TPM2)
- rc = tpm2_pcr_read(chip, pcr_idx, res_buf);
+ rc = tpm2_pcr_read(chip, pcr_idx, digest_struct);
else
- rc = tpm_pcr_read_dev(chip, pcr_idx, res_buf);
+ rc = tpm_pcr_read_dev(chip, pcr_idx, digest_struct->digest);
tpm_put_ops(chip);
return rc;
}
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index fc2cc16e5080..2fd4379e75d6 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -565,7 +565,8 @@ static inline u32 tpm2_rc_value(u32 rc)
return (rc & BIT(7)) ? rc & 0xff : rc;
}
-int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf);
+int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest_struct);
int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, u32 count,
struct tpm_digest *digests);
int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 584dba6cdf3e..499f4f17b3f3 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -179,16 +179,18 @@ struct tpm2_pcr_read_out {
* tpm2_pcr_read() - read a PCR value
* @chip: TPM chip to use.
* @pcr_idx: index of the PCR to read.
- * @res_buf: buffer to store the resulting hash.
+ * @digest_struct: pcr bank and buffer current PCR value is written to.
*
* Return: Same as with tpm_transmit_cmd.
*/
-int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest_struct)
{
int rc;
struct tpm_buf buf;
struct tpm2_pcr_read_out *out;
u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
+ u16 digest_size;
if (pcr_idx >= TPM2_PLATFORM_PCR)
return -EINVAL;
@@ -200,18 +202,25 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
tpm_buf_append_u32(&buf, 1);
- tpm_buf_append_u16(&buf, TPM_ALG_SHA1);
+ tpm_buf_append_u16(&buf, digest_struct->alg_id);
tpm_buf_append_u8(&buf, TPM2_PCR_SELECT_MIN);
tpm_buf_append(&buf, (const unsigned char *)pcr_select,
sizeof(pcr_select));
rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
- res_buf ? "attempting to read a pcr value" : NULL);
- if (rc == 0 && res_buf) {
- out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
- memcpy(res_buf, out->digest, SHA1_DIGEST_SIZE);
+ "attempting to read a pcr value");
+ if (rc)
+ goto out;
+
+ out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
+ digest_size = be16_to_cpu(out->digest_size);
+ if (digest_size > sizeof(digest_struct->digest)) {
+ rc = -EINVAL;
+ goto out;
}
+ memcpy(digest_struct->digest, out->digest, digest_size);
+out:
tpm_buf_destroy(&buf);
return rc;
}
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 71d7bbf5f690..4f00daf44dd2 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -71,7 +71,8 @@ struct tpm_class_ops {
#if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
extern int tpm_is_tpm2(struct tpm_chip *chip);
-extern int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf);
+extern int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest_struct);
extern int tpm_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash);
extern int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen);
extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max);
@@ -87,7 +88,8 @@ static inline int tpm_is_tpm2(struct tpm_chip *chip)
{
return -ENODEV;
}
-static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest_struct)
{
return -ENODEV;
}
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 7e7e7e7c250a..8985e34eb3ac 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -629,12 +629,12 @@ int ima_calc_buffer_hash(const void *buf, loff_t len,
return calc_buffer_shash(buf, len, hash);
}
-static void __init ima_pcrread(int idx, u8 *pcr)
+static void __init ima_pcrread(int idx, struct tpm_digest *d)
{
if (!ima_tpm_chip)
return;
- if (tpm_pcr_read(ima_tpm_chip, idx, pcr) != 0)
+ if (tpm_pcr_read(ima_tpm_chip, idx, d) != 0)
pr_err("Error Communicating to TPM chip\n");
}
@@ -644,7 +644,7 @@ static void __init ima_pcrread(int idx, u8 *pcr)
static int __init ima_calc_boot_aggregate_tfm(char *digest,
struct crypto_shash *tfm)
{
- u8 pcr_i[TPM_DIGEST_SIZE];
+ struct tpm_digest d = { .alg_id = TPM_ALG_SHA1, .digest = {0} };
int rc, i;
SHASH_DESC_ON_STACK(shash, tfm);
@@ -657,9 +657,9 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
/* cumulative sha1 over tpm registers 0-7 */
for (i = TPM_PCR0; i < TPM_PCR8; i++) {
- ima_pcrread(i, pcr_i);
+ ima_pcrread(i, &d);
/* now accumulate with current aggregate */
- rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
+ rc = crypto_shash_update(shash, d.digest, TPM_DIGEST_SIZE);
}
if (!rc)
crypto_shash_final(shash, digest);
--
2.17.1
next prev parent reply other threads:[~2018-11-06 15:06 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-06 15:01 [PATCH v4 0/6] tpm: retrieve digest size of unknown algorithms from TPM Roberto Sassu
2018-11-06 15:01 ` [PATCH v4 1/6] tpm: dynamically allocate active_banks array Roberto Sassu
2018-11-07 6:14 ` Nayna Jain
2018-11-07 9:41 ` Roberto Sassu
2018-11-08 13:50 ` Nayna Jain
2018-11-08 14:40 ` Roberto Sassu
2018-11-08 15:21 ` Jarkko Sakkinen
2018-11-08 15:29 ` Mimi Zohar
2018-11-08 18:57 ` Jarkko Sakkinen
2018-11-08 15:54 ` Ken Goldman
2018-12-13 20:21 ` Ken Goldman
2018-11-07 11:10 ` Mimi Zohar
2018-11-08 13:46 ` Jarkko Sakkinen
2018-11-08 14:24 ` Roberto Sassu
2018-11-08 15:22 ` Jarkko Sakkinen
2018-11-13 13:34 ` Roberto Sassu
2018-11-13 17:04 ` Jarkko Sakkinen
2018-11-13 13:53 ` Roberto Sassu
2018-11-06 15:01 ` [PATCH v4 2/6] tpm: remove definition of TPM2_ACTIVE_PCR_BANKS Roberto Sassu
2018-11-08 14:02 ` Jarkko Sakkinen
2018-11-08 14:03 ` Jarkko Sakkinen
2018-11-08 14:52 ` Roberto Sassu
2018-11-08 19:05 ` Jarkko Sakkinen
2018-11-06 15:01 ` [PATCH v4 3/6] tpm: rename and export tpm2_digest and tpm2_algorithms Roberto Sassu
2018-11-06 15:01 ` Roberto Sassu [this message]
2018-11-08 14:04 ` [PATCH v4 4/6] tpm: modify tpm_pcr_read() definition to pass a TPM hash algorithm Jarkko Sakkinen
2018-11-08 14:16 ` Roberto Sassu
2018-11-08 15:15 ` Jarkko Sakkinen
2018-11-08 15:19 ` Peter Huewe
2018-11-08 19:08 ` Jarkko Sakkinen
2018-11-13 12:34 ` Jarkko Sakkinen
2018-11-13 12:39 ` Roberto Sassu
2018-11-13 16:56 ` Jarkko Sakkinen
2018-11-06 15:01 ` [PATCH v4 5/6] tpm: retrieve digest size of unknown algorithms with PCR read Roberto Sassu
2018-11-06 15:01 ` [PATCH v4 6/6] tpm: ensure that the output of PCR read contains the correct digest size Roberto Sassu
2018-11-08 14:08 ` Jarkko Sakkinen
2018-11-08 14:47 ` Roberto Sassu
2018-11-08 18:52 ` Jarkko Sakkinen
2018-11-13 13:08 ` Roberto Sassu
2018-11-13 16:59 ` Jarkko Sakkinen
2018-11-08 13:51 ` [PATCH v4 0/6] tpm: retrieve digest size of unknown algorithms from TPM Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181106150159.1136-5-roberto.sassu@huawei.com \
--to=roberto.sassu@huawei.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=silviu.vlasceanu@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).