SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tpm2-setup: introduce a 'priority' concept for NvPCRs

Browse Source
This commit is contained in:
Lennart Poettering
2026-05-21 16:09:25 +02:00
parent b6d1dd4ddb
commit 2de1322dc2
4 changed files with 74 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/tpm2-util.c
+14 -4
View File
@@ -6991,6 +6991,7 @@ typedef struct NvPCRData {
char *name;
uint16_t algorithm;
uint32_t nv_index;
uint64_t priority;
} NvPCRData;
static void nvpcr_data_done(NvPCRData *d) {
@@ -7030,11 +7031,13 @@ static int nvpcr_data_load(const char *name, NvPCRData *ret) {
{ "name", SD_JSON_VARIANT_STRING, sd_json_dispatch_string, offsetof(NvPCRData, name), SD_JSON_MANDATORY },
{ "algorithm", _SD_JSON_VARIANT_TYPE_INVALID, json_dispatch_tpm2_algorithm, offsetof(NvPCRData, algorithm), 0 },
{ "nvIndex", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint32, offsetof(NvPCRData, nv_index), SD_JSON_MANDATORY },
{ "priority", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint64, offsetof(NvPCRData, priority), 0 },
{},
};
_cleanup_(nvpcr_data_done) NvPCRData p = {
.algorithm = TPM2_ALG_SHA256,
.priority = TPM2_NVPCR_PRIORITY_DEFAULT,
};
r = sd_json_dispatch(v, dispatch_table, SD_JSON_ALLOW_EXTENSIONS, &p);
if (r < 0)
@@ -7047,7 +7050,7 @@ static int nvpcr_data_load(const char *name, NvPCRData *ret) {
return 0;
}
int tpm2_nvpcr_get_index(const char *name, uint32_t *ret) {
int tpm2_nvpcr_get_index(const char *name, uint32_t *ret_nv_index, uint64_t *ret_priority) {
int r;
_cleanup_(nvpcr_data_done) NvPCRData p = {};
@@ -7055,8 +7058,10 @@ int tpm2_nvpcr_get_index(const char *name, uint32_t *ret) {
if (r < 0)
return r;
if (ret)
*ret = p.nv_index;
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return 0;
}
@@ -7748,7 +7753,8 @@ int tpm2_nvpcr_read(
const Tpm2Handle *session,
const char *name,
struct iovec *ret_value,
uint32_t *ret_nv_index) {
uint32_t *ret_nv_index,
uint64_t *ret_priority) {
#if HAVE_OPENSSL
int r;
@@ -7775,6 +7781,8 @@ int tpm2_nvpcr_read(
*ret_value = (struct iovec) {};
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return 0;
}
@@ -7811,6 +7819,8 @@ int tpm2_nvpcr_read(
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return r;
#else /* HAVE_OPENSSL */
src/shared/tpm2-util.h
+7 -2
View File
@@ -158,11 +158,16 @@ typedef enum Tpm2UserspaceEventType {
DECLARE_STRING_TABLE_LOOKUP(tpm2_userspace_event_type, Tpm2UserspaceEventType);
int tpm2_pcr_extend_bytes(Tpm2Context *c, char **banks, unsigned pcr_index, const struct iovec *data, const struct iovec *secret, Tpm2UserspaceEventType event_type, const char *description);
int tpm2_nvpcr_get_index(const char *name, uint32_t *ret);
/* Default allocation priority for NvPCRs that do not specify one explicitly. Lower values are more
* important and are allocated first when the TPM's NV index space is constrained. */
#define TPM2_NVPCR_PRIORITY_DEFAULT UINT64_C(1000)
int tpm2_nvpcr_get_index(const char *name, uint32_t *ret_nv_index, uint64_t *ret_priority);
int tpm2_nvpcr_extend_bytes(Tpm2Context *c, const Tpm2Handle *session, const char *name, const struct iovec *data, const struct iovec *secret, Tpm2UserspaceEventType event_type, const char *description);
int tpm2_nvpcr_acquire_anchor_secret(struct iovec *ret, bool sync_secondary);
int tpm2_nvpcr_initialize(Tpm2Context *c, const Tpm2Handle *session, const char *name, const struct iovec *anchor_secret);
int tpm2_nvpcr_read(Tpm2Context *c, const Tpm2Handle *session, const char *name, struct iovec *ret, uint32_t *ret_nv_index);
int tpm2_nvpcr_read(Tpm2Context *c, const Tpm2Handle *session, const char *name, struct iovec *ret, uint32_t *ret_nv_index, uint64_t *ret_priority);
uint32_t tpm2_tpms_pcr_selection_to_mask(const TPMS_PCR_SELECTION *s);
void tpm2_tpms_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash, TPMS_PCR_SELECTION *ret);