On Fri, Nov 16, 2018 at 04:55:36PM +0100, Roberto Sassu wrote:

On 11/16/2018 4:03 PM, Jarkko Sakkinen wrote:

quoted

On Wed, Nov 14, 2018 at 04:31:08PM +0100, Roberto Sassu wrote:

quoted

Currently, tpm_pcr_extend() accepts as an input only a SHA1 digest.

This patch modifies the definition of tpm_pcr_extend() to allow other
kernel subsystems to pass a digest for each algorithm supported by the TPM.
All digests are processed by the TPM in one operation.

If a tpm_pcr_extend() caller provides a subset of the supported algorithms,
the TPM driver extends the remaining PCR banks with the first digest
passed as an argument to the function.

What is the legit use case for this?

A subset could be chosen for better performance, or when a TPM algorithm
is not supported by the crypto subsystem.

Doesn't extending a subset a security concern?

/Jarkko