From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753490AbbKBMpj (ORCPT <rfc822;w@1wt.eu>);
	Mon, 2 Nov 2015 07:45:39 -0500
Received: from e28smtp09.in.ibm.com ([122.248.162.9]:52165 "EHLO
	e28smtp09.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751372AbbKBMpg (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Mon, 2 Nov 2015 07:45:36 -0500
X-Helo: d28dlp03.in.ibm.com
X-MailFrom: zohar@linux.vnet.ibm.com
X-RcptTo: linux-security-module@vger.kernel.org
Message-ID: <1446466609.2659.50.camel@linux.vnet.ibm.com>
Subject: Re: [PATCH v2 1/3] keys, trusted: select the hash algorithm
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: Peter Huewe <peterhuewe@gmx.de>, Marcel Selhorst <tpmdd@selhorst.net>,
        David Howells <dhowells@redhat.com>, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org,
        keyrings@vger.kernel.org, chris.j.arges@canonical.com,
        seth.forshee@canonical.com, colin.king@canonical.com,
        josh@joshtriplett.org, David Safford <safford@us.ibm.com>,
        Jonathan Corbet <corbet@lwn.net>,
        James Morris <james.l.morris@oracle.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        "open list:DOCUMENTATION" <linux-doc@vger.kernel.org>
In-Reply-To: <1446204910-29948-2-git-send-email-jarkko.sakkinen@linux.intel.com>
References: <1446204910-29948-1-git-send-email-jarkko.sakkinen@linux.intel.com>
	 <1446204910-29948-2-git-send-email-jarkko.sakkinen@linux.intel.com>
Content-Type: text/plain; charset="UTF-8"
Date: Mon, 02 Nov 2015 07:16:49 -0500
Mime-Version: 1.0
X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) 
Content-Transfer-Encoding: 7bit
X-TM-AS-MML: disable
X-Content-Scanned: Fidelis XPS MAILER
x-cbid: 15110212-0033-0000-0000-000008A8D7EE
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, 2015-10-30 at 13:35 +0200, Jarkko Sakkinen wrote:

> @@ -787,6 +791,20 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
>  				return -EINVAL;
>  			opt->pcrlock = lock;
>  			break;
> +		case Opt_hash:
> +			for (i = 0; i < HASH_ALGO__LAST; i++) {
> +				if (!strcmp(args[0].from, hash_algo_name[i])) {
> +					opt->hash = i;
> +					break;
> +				}
> +			}
> +			res = tpm_is_tpm2(TPM_ANY_NUM);

While looking at this, I wanted to verify that chips are still added to
the tail of the tpm_chip_list.  Unfortunately, commit "afb5abc tpm:
two-phase chip management functions" reverted David Howell's commit
"770ab65 TPM: Add new TPMs to the tail of the list to prevent
inadvertent change of dev".

> +			if (res < 0)
> +				return res;
> +			if (i == HASH_ALGO__LAST ||
> +			    (!res && i != HASH_ALGO_SHA1))
> +				return -EINVAL;
> +			break;

If the first TPM registered is a TPM 1.2, then changing the default TPM
2.0 hash algorithm will fail.

Mimi

>  		default:
>  			return -EINVAL;
>  		}