linux-kernel - Re: [RFC PATCH v2 07/13] tpm: enable bank selection for PCR extend

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4021363dd955236ad55b5d0c26bcf788fa782d79.camel@linux.ibm.com>
Date: Tue, 25 Mar 2025 21:18:38 -0400
From: Mimi Zohar <zohar@...ux.ibm.com>
To: Nicolai Stange <nstange@...e.de>,
        Roberto Sassu
 <roberto.sassu@...wei.com>,
        Dmitry Kasatkin <dmitry.kasatkin@...il.com>
Cc: Eric Snowberg <eric.snowberg@...cle.com>,
        Jarkko Sakkinen
 <jarkko@...nel.org>,
        James Bottomley
 <James.Bottomley@...senPartnership.com>,
        linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH v2 07/13] tpm: enable bank selection for PCR extend

On Sun, 2025-03-23 at 15:09 +0100, Nicolai Stange wrote:

> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index dfdcbd009720..23ded8ea47dc 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -226,16 +226,34 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
>   * @chip:	TPM chip to use.
>   * @pcr_idx:	index of the PCR.
>   * @digests:	list of pcr banks and corresponding digest values to extend.
> + * @banks_skip_mask:	pcr banks to skip
>   *
>   * Return: Same as with tpm_transmit_cmd.
>   */
>  int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
> -		    struct tpm_digest *digests)
> +		    struct tpm_digest *digests,
> +		    unsigned long banks_skip_mask)
>  {
>  	struct tpm_buf buf;
> +	unsigned long skip_mask;
> +	u32 banks_count;
>  	int rc;
>  	int i;
>  
> +	banks_count = 0;
> +	skip_mask = banks_skip_mask;
> +	for (i = 0; i < chip->nr_allocated_banks; i++) {
> +		const bool skip_bank = skip_mask & 1;
> +
> +		skip_mask >>= 1;
> +		if (skip_bank)
> +			continue;
> +		banks_count++;
> +	}

Setting ima_unsupported_pcr_banks_mask used BIT(i).  Testing the bit should be
as straight forward here and below.

The first TPM extend after boot is the boot_aggregate.  Afterwards the number of
banks being extended should always be the same.  Do we really need to re-
calculate the number of banks needing to be extended each time?

> +
> +	if (banks_count == 0)
> +		return 0;
> +
>  	if (!disable_pcr_integrity) {
>  		rc = tpm2_start_auth_session(chip);
>  		if (rc)
> @@ -257,9 +275,16 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
>  		tpm_buf_append_auth(chip, &buf, 0, NULL, 0);
>  	}
>  
> -	tpm_buf_append_u32(&buf, chip->nr_allocated_banks);
> +	tpm_buf_append_u32(&buf, banks_count);
>  
> +	skip_mask = banks_skip_mask;
>  	for (i = 0; i < chip->nr_allocated_banks; i++) {
> +		const bool skip_bank = skip_mask & 1;
> +
> +		skip_mask >>= 1;
> +		if (skip_bank)
> +			continue;
> +

>  		tpm_buf_append_u16(&buf, digests[i].alg_id);
>  		tpm_buf_append(&buf, (const unsigned char *)&digests[i].digest,
>  			       chip->allocated_banks[i].digest_size);