mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
selftests: tpm2: Determine available PCR bank
Determine an available PCR bank to be used by a test case by querying the capability TPM2_GET_CAP. The TPM2 returns TPML_PCR_SELECTIONS that contains an array of TPMS_PCR_SELECTIONs indicating available PCR banks and the bitmasks that show which PCRs are enabled in each bank. Collect the data in a dictionary. From the dictionary determine the PCR bank that has the PCRs enabled that the test needs. This avoids test failures with TPM2's that either to not have a SHA-1 bank or whose SHA-1 bank is disabled. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
parent
ea4424be16
commit
0d060f230f
2 changed files with 52 additions and 8 deletions
|
@ -56,6 +56,7 @@ TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYER_SHIFT)
|
||||||
|
|
||||||
TPM2_CAP_HANDLES = 0x00000001
|
TPM2_CAP_HANDLES = 0x00000001
|
||||||
TPM2_CAP_COMMANDS = 0x00000002
|
TPM2_CAP_COMMANDS = 0x00000002
|
||||||
|
TPM2_CAP_PCRS = 0x00000005
|
||||||
TPM2_CAP_TPM_PROPERTIES = 0x00000006
|
TPM2_CAP_TPM_PROPERTIES = 0x00000006
|
||||||
|
|
||||||
TPM2_PT_FIXED = 0x100
|
TPM2_PT_FIXED = 0x100
|
||||||
|
@ -712,3 +713,33 @@ class Client:
|
||||||
pt += 1
|
pt += 1
|
||||||
|
|
||||||
return handles
|
return handles
|
||||||
|
|
||||||
|
def get_cap_pcrs(self):
|
||||||
|
pcr_banks = {}
|
||||||
|
|
||||||
|
fmt = '>HII III'
|
||||||
|
|
||||||
|
cmd = struct.pack(fmt,
|
||||||
|
TPM2_ST_NO_SESSIONS,
|
||||||
|
struct.calcsize(fmt),
|
||||||
|
TPM2_CC_GET_CAPABILITY,
|
||||||
|
TPM2_CAP_PCRS, 0, 1)
|
||||||
|
rsp = self.send_cmd(cmd)[10:]
|
||||||
|
_, _, cnt = struct.unpack('>BII', rsp[:9])
|
||||||
|
rsp = rsp[9:]
|
||||||
|
|
||||||
|
# items are TPMS_PCR_SELECTION's
|
||||||
|
for i in range(0, cnt):
|
||||||
|
hash, sizeOfSelect = struct.unpack('>HB', rsp[:3])
|
||||||
|
rsp = rsp[3:]
|
||||||
|
|
||||||
|
pcrSelect = 0
|
||||||
|
if sizeOfSelect > 0:
|
||||||
|
pcrSelect, = struct.unpack('%ds' % sizeOfSelect,
|
||||||
|
rsp[:sizeOfSelect])
|
||||||
|
rsp = rsp[sizeOfSelect:]
|
||||||
|
pcrSelect = int.from_bytes(pcrSelect, byteorder='big')
|
||||||
|
|
||||||
|
pcr_banks[hash] = pcrSelect
|
||||||
|
|
||||||
|
return pcr_banks
|
||||||
|
|
|
@ -27,7 +27,17 @@ class SmokeTest(unittest.TestCase):
|
||||||
result = self.client.unseal(self.root_key, blob, auth, None)
|
result = self.client.unseal(self.root_key, blob, auth, None)
|
||||||
self.assertEqual(data, result)
|
self.assertEqual(data, result)
|
||||||
|
|
||||||
|
def determine_bank_alg(self, mask):
|
||||||
|
pcr_banks = self.client.get_cap_pcrs()
|
||||||
|
for bank_alg, pcrSelection in pcr_banks.items():
|
||||||
|
if pcrSelection & mask == mask:
|
||||||
|
return bank_alg
|
||||||
|
return None
|
||||||
|
|
||||||
def test_seal_with_policy(self):
|
def test_seal_with_policy(self):
|
||||||
|
bank_alg = self.determine_bank_alg(1 << 16)
|
||||||
|
self.assertIsNotNone(bank_alg)
|
||||||
|
|
||||||
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
|
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
|
||||||
|
|
||||||
data = ('X' * 64).encode()
|
data = ('X' * 64).encode()
|
||||||
|
@ -35,7 +45,7 @@ class SmokeTest(unittest.TestCase):
|
||||||
pcrs = [16]
|
pcrs = [16]
|
||||||
|
|
||||||
try:
|
try:
|
||||||
self.client.policy_pcr(handle, pcrs)
|
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
|
||||||
self.client.policy_password(handle)
|
self.client.policy_password(handle)
|
||||||
|
|
||||||
policy_dig = self.client.get_policy_digest(handle)
|
policy_dig = self.client.get_policy_digest(handle)
|
||||||
|
@ -47,7 +57,7 @@ class SmokeTest(unittest.TestCase):
|
||||||
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
self.client.policy_pcr(handle, pcrs)
|
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
|
||||||
self.client.policy_password(handle)
|
self.client.policy_password(handle)
|
||||||
|
|
||||||
result = self.client.unseal(self.root_key, blob, auth, handle)
|
result = self.client.unseal(self.root_key, blob, auth, handle)
|
||||||
|
@ -72,6 +82,9 @@ class SmokeTest(unittest.TestCase):
|
||||||
self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
|
self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
|
||||||
|
|
||||||
def test_unseal_with_wrong_policy(self):
|
def test_unseal_with_wrong_policy(self):
|
||||||
|
bank_alg = self.determine_bank_alg(1 << 16 | 1 << 1)
|
||||||
|
self.assertIsNotNone(bank_alg)
|
||||||
|
|
||||||
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
|
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
|
||||||
|
|
||||||
data = ('X' * 64).encode()
|
data = ('X' * 64).encode()
|
||||||
|
@ -79,7 +92,7 @@ class SmokeTest(unittest.TestCase):
|
||||||
pcrs = [16]
|
pcrs = [16]
|
||||||
|
|
||||||
try:
|
try:
|
||||||
self.client.policy_pcr(handle, pcrs)
|
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
|
||||||
self.client.policy_password(handle)
|
self.client.policy_password(handle)
|
||||||
|
|
||||||
policy_dig = self.client.get_policy_digest(handle)
|
policy_dig = self.client.get_policy_digest(handle)
|
||||||
|
@ -91,13 +104,13 @@ class SmokeTest(unittest.TestCase):
|
||||||
# Extend first a PCR that is not part of the policy and try to unseal.
|
# Extend first a PCR that is not part of the policy and try to unseal.
|
||||||
# This should succeed.
|
# This should succeed.
|
||||||
|
|
||||||
ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
|
ds = tpm2.get_digest_size(bank_alg)
|
||||||
self.client.extend_pcr(1, ('X' * ds).encode())
|
self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
|
||||||
|
|
||||||
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
self.client.policy_pcr(handle, pcrs)
|
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
|
||||||
self.client.policy_password(handle)
|
self.client.policy_password(handle)
|
||||||
|
|
||||||
result = self.client.unseal(self.root_key, blob, auth, handle)
|
result = self.client.unseal(self.root_key, blob, auth, handle)
|
||||||
|
@ -109,14 +122,14 @@ class SmokeTest(unittest.TestCase):
|
||||||
|
|
||||||
# Then, extend a PCR that is part of the policy and try to unseal.
|
# Then, extend a PCR that is part of the policy and try to unseal.
|
||||||
# This should fail.
|
# This should fail.
|
||||||
self.client.extend_pcr(16, ('X' * ds).encode())
|
self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
|
||||||
|
|
||||||
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
|
||||||
|
|
||||||
rc = 0
|
rc = 0
|
||||||
|
|
||||||
try:
|
try:
|
||||||
self.client.policy_pcr(handle, pcrs)
|
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
|
||||||
self.client.policy_password(handle)
|
self.client.policy_password(handle)
|
||||||
|
|
||||||
result = self.client.unseal(self.root_key, blob, auth, handle)
|
result = self.client.unseal(self.root_key, blob, auth, handle)
|
||||||
|
|
Loading…
Reference in a new issue