Messages in this thread | | | Subject | Re: [PATCH v6 4/7] tpm: modify tpm_pcr_read() definition to pass a TPM hash algorithm | From | Roberto Sassu <> | Date | Fri, 7 Dec 2018 15:51:33 +0100 |
| |
On 12/6/2018 8:49 PM, Mimi Zohar wrote: > On Wed, 2018-12-05 at 15:31 -0500, Mimi Zohar wrote: >> On Tue, 2018-12-04 at 15:40 -0800, Jarkko Sakkinen wrote: >>> On Tue, Dec 04, 2018 at 09:21:35AM +0100, Roberto Sassu wrote: >>>> Currently the TPM driver allows other kernel subsystems to read only the >>>> SHA1 PCR bank. This patch modifies the parameters of tpm_pcr_read() and >>>> tpm2_pcr_read() to pass a tpm_digest structure, which contains the desired >>>> hash algorithm. Also, since commit 125a22105410 ("tpm: React correctly to >>>> RC_TESTING from TPM 2.0 self tests") removed the call to tpm2_pcr_read(), >>>> the new parameter is expected to be always not NULL. >>>> >>>> Due to the API change, IMA functions have been modified. >>>> >>>> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> >>>> Acked-by: Mimi Zohar <zohar@linux.ibm.com> >>> >>> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> >>> >>> Mimi, Nayna, can you help with testing this (because of the IMA change)? >> >> It's up & running and the measurement list verifies against the TPM >> PCR. Although this system has two algorithms enabled, all of the PCRs >> are allocated for one algorithm and none for the other. I'm still >> looking around for another system with PCR 10 enabled for multiple >> algorithms. > > PCRs for sha1 and sha256 algorithms are being updated and the > measurement list verifies against the SHA1 PCR-10. > > Roberto, have you added support in ima-evm-utils to validate the other > banks?
I modified IMA LTP.
Roberto
> Mimi >
-- HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Bo PENG, Jian LI, Yanli SHI
| |