keys, trusted: select hash algorithm for TPM2 chips

[linux-drm-fsl-dcu.git] / security / keys / trusted.c

diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 903dace648a1731b2afbb2dc8b40b8169a05aba2..8f1300cab38ed6bcf5d4b2a8a77e0ae94b46bf91 100644 (file)
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -11,6 +11,7 @@
  * See Documentation/security/keys-trusted-encrypted.txt
  */
 
+#include <crypto/hash_info.h>
 #include <linux/uaccess.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -710,7 +711,8 @@ enum {
        Opt_err = -1,
        Opt_new, Opt_load, Opt_update,
        Opt_keyhandle, Opt_keyauth, Opt_blobauth,
-       Opt_pcrinfo, Opt_pcrlock, Opt_migratable
+       Opt_pcrinfo, Opt_pcrlock, Opt_migratable,
+       Opt_hash,
 };
 
 static const match_table_t key_tokens = {
@@ -723,6 +725,7 @@ static const match_table_t key_tokens = {
        {Opt_pcrinfo, "pcrinfo=%s"},
        {Opt_pcrlock, "pcrlock=%s"},
        {Opt_migratable, "migratable=%s"},
+       {Opt_hash, "hash=%s"},
        {Opt_err, NULL}
 };
 
@@ -736,11 +739,22 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
        int res;
        unsigned long handle;
        unsigned long lock;
+       unsigned long token_mask = 0;
+       int i;
+       int tpm2;
+
+       tpm2 = tpm_is_tpm2(TPM_ANY_NUM);
+       if (tpm2 < 0)
+               return tpm2;
+
+       opt->hash = tpm2 ? HASH_ALGO_SHA256 : HASH_ALGO_SHA1;
 
        while ((p = strsep(&c, " \t"))) {
                if (*p == '\0' || *p == ' ' || *p == '\t')
                        continue;
                token = match_token(p, key_tokens, args);
+               if (test_and_set_bit(token, &token_mask))
+                       return -EINVAL;
 
                switch (token) {
                case Opt_pcrinfo:
@@ -787,6 +801,20 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
                                return -EINVAL;
                        opt->pcrlock = lock;
                        break;
+               case Opt_hash:
+                       for (i = 0; i < HASH_ALGO__LAST; i++) {
+                               if (!strcmp(args[0].from, hash_algo_name[i])) {
+                                       opt->hash = i;
+                                       break;
+                               }
+                       }
+                       if (i == HASH_ALGO__LAST)
+                               return -EINVAL;
+                       if  (!tpm2 && i != HASH_ALGO_SHA1) {
+                               pr_info("trusted_key: TPM 1.x only supports SHA-1.\n");
+                               return -EINVAL;
+                       }
+                       break;
                default:
                        return -EINVAL;
                }