leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

selftests: tpm2: Determine available PCR bank

Browse Source 
Determine an available PCR bank to be used by a test case by querying the
capability TPM2_GET_CAP. The TPM2 returns TPML_PCR_SELECTIONS that
contains an array of TPMS_PCR_SELECTIONs indicating available PCR banks
and the bitmasks that show which PCRs are enabled in each bank. Collect
the data in a dictionary. From the dictionary determine the PCR bank that
has the PCRs enabled that the test needs. This avoids test failures with
TPM2's that either to not have a SHA-1 bank or whose SHA-1 bank is
disabled.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Stefan Berger 2021-11-27 23:10:51 -05:00 committed by Jarkko Sakkinen
parent ea4424be16
commit 0d060f230f
2 changed files with 52 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
tools/testing/selftests/tpm2/tpm2.py
View File

@ -56,6 +56,7 @@ TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYER_SHIFT)
TPM2_CAP_HANDLES = 0x00000001
TPM2_CAP_COMMANDS = 0x00000002
TPM2_CAP_PCRS = 0x00000005
TPM2_CAP_TPM_PROPERTIES = 0x00000006
TPM2_PT_FIXED = 0x100
@ -712,3 +713,33 @@ class Client:
pt += 1
return handles
def get_cap_pcrs(self):
pcr_banks = {}
fmt = '>HII III'
cmd = struct.pack(fmt,
TPM2_ST_NO_SESSIONS,
struct.calcsize(fmt),
TPM2_CC_GET_CAPABILITY,
TPM2_CAP_PCRS, 0, 1)
rsp = self.send_cmd(cmd)[10:]
_, _, cnt = struct.unpack('>BII', rsp[:9])
rsp = rsp[9:]
# items are TPMS_PCR_SELECTION's
for i in range(0, cnt):
hash, sizeOfSelect = struct.unpack('>HB', rsp[:3])
rsp = rsp[3:]
pcrSelect = 0
if sizeOfSelect > 0:
pcrSelect, = struct.unpack('%ds' % sizeOfSelect,
rsp[:sizeOfSelect])
rsp = rsp[sizeOfSelect:]
pcrSelect = int.from_bytes(pcrSelect, byteorder='big')
pcr_banks[hash] = pcrSelect
return pcr_banks

29
tools/testing/selftests/tpm2/tpm2_tests.py
View File

@ -27,7 +27,17 @@ class SmokeTest(unittest.TestCase):
result = self.client.unseal(self.root_key, blob, auth, None)
self.assertEqual(data, result)
def determine_bank_alg(self, mask):
pcr_banks = self.client.get_cap_pcrs()
for bank_alg, pcrSelection in pcr_banks.items():
if pcrSelection & mask == mask:
return bank_alg
return None
def test_seal_with_policy(self):
bank_alg = self.determine_bank_alg(1 << 16)
self.assertIsNotNone(bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@ -35,7 +45,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
self.client.policy_pcr(handle, pcrs)
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@ -47,7 +57,7 @@ class SmokeTest(unittest.TestCase):
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
self.client.policy_pcr(handle, pcrs)
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@ -72,6 +82,9 @@ class SmokeTest(unittest.TestCase):
self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
def test_unseal_with_wrong_policy(self):
bank_alg = self.determine_bank_alg(1 << 16 | 1 << 1)
self.assertIsNotNone(bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@ -79,7 +92,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
self.client.policy_pcr(handle, pcrs)
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@ -91,13 +104,13 @@ class SmokeTest(unittest.TestCase):
# Extend first a PCR that is not part of the policy and try to unseal.
# This should succeed.
ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
self.client.extend_pcr(1, ('X' * ds).encode())
ds = tpm2.get_digest_size(bank_alg)
self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
self.client.policy_pcr(handle, pcrs)
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@ -109,14 +122,14 @@ class SmokeTest(unittest.TestCase):
# Then, extend a PCR that is part of the policy and try to unseal.
# This should fail.
self.client.extend_pcr(16, ('X' * ds).encode())
self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
rc = 0
try:
self.client.policy_pcr(handle, pcrs)
self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)