From patchwork Thu Mar 29 07:43:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miquel Raynal X-Patchwork-Id: 892627 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=bootlin.com Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 40BcYr0T86z9ry1 for ; Thu, 29 Mar 2018 18:58:07 +1100 (AEDT) Received: by lists.denx.de (Postfix, from userid 105) id AF2A6C22014; Thu, 29 Mar 2018 07:49:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 74F40C22080; Thu, 29 Mar 2018 07:45:39 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 8981FC22054; Thu, 29 Mar 2018 07:44:39 +0000 (UTC) Received: from mail.bootlin.com (mail.bootlin.com [62.4.15.54]) by lists.denx.de (Postfix) with ESMTP id 782C2C21FD3 for ; Thu, 29 Mar 2018 07:44:34 +0000 (UTC) Received: by mail.bootlin.com (Postfix, from userid 110) id 4767E20898; Thu, 29 Mar 2018 09:44:34 +0200 (CEST) Received: from localhost.localdomain (LStLambert-657-1-97-87.w90-63.abo.wanadoo.fr [90.63.216.87]) by mail.bootlin.com (Postfix) with ESMTPSA id 034E8208B2; Thu, 29 Mar 2018 09:44:05 +0200 (CEST) From: Miquel Raynal To: Tom Rini , Simon Glass Date: Thu, 29 Mar 2018 09:43:55 +0200 Message-Id: <20180329074401.8691-14-miquel.raynal@bootlin.com> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20180329074401.8691-1-miquel.raynal@bootlin.com> References: <20180329074401.8691-1-miquel.raynal@bootlin.com> Cc: u-boot@lists.denx.de Subject: [U-Boot] [PATCH v2 13/19] tpm: add TPM2_PCR_Extend command support X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" Add support for the TPM2_PCR_Extend command. Change the command file and the help accordingly. Signed-off-by: Miquel Raynal --- cmd/tpm.c | 18 ++++++++++++++++++ include/tpm.h | 18 ++++++++++++++++++ lib/tpm.c | 41 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 77 insertions(+) diff --git a/cmd/tpm.c b/cmd/tpm.c index 93dcd1a65c..3f284f0adf 100644 --- a/cmd/tpm.c +++ b/cmd/tpm.c @@ -349,6 +349,18 @@ static int do_tpm_pcr_event(cmd_tbl_t *cmdtp, int flag, return report_return_code(rc); } +static int do_tpm_pcr_extend(cmd_tbl_t *cmdtp, int flag, + int argc, char * const argv[]) +{ + u32 index = simple_strtoul(argv[1], NULL, 0); + void *digest = (void *)simple_strtoul(argv[2], NULL, 0); + + if (argc != 3) + return CMD_RET_USAGE; + + return report_return_code(tpm2_pcr_extend(index, digest)); +} + static int do_tpm_pcr_read(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { @@ -890,6 +902,8 @@ static cmd_tbl_t tpm_commands[] = { do_tpm_nv_write_value, "", ""), U_BOOT_CMD_MKENT(pcr_event, 0, 1, do_tpm_pcr_event, "", ""), + U_BOOT_CMD_MKENT(pcr_extend, 0, 1, + do_tpm_pcr_extend, "", ""), U_BOOT_CMD_MKENT(pcr_read, 0, 1, do_tpm_pcr_read, "", ""), U_BOOT_CMD_MKENT(tsc_physical_presence, 0, 1, @@ -1026,6 +1040,10 @@ U_BOOT_CMD(tpm, CONFIG_SYS_MAXARGS, 1, do_tpm, " digest of 32 bytes for TPMv2. Value of the PCR is given at \n" " pcr_read index addr count\n" " - Read bytes from PCR to memory address .\n" +" pcr_extend index \n" +" - Add a new measurement to a PCR. Update PCR with\n" +" . It must be a 20 byte digest for TPMv1 or a SHA256\n" +" digest of 32 bytes for TPMv2.\n" #ifdef CONFIG_TPM_AUTH_SESSIONS "Authorization Sessions\n" " oiap\n" diff --git a/include/tpm.h b/include/tpm.h index a863ac6196..b88ad4b2f4 100644 --- a/include/tpm.h +++ b/include/tpm.h @@ -76,6 +76,14 @@ enum tpm2_return_codes { TPM2_RC_LOCKOUT = 0x0921, }; +enum tpm_algorithms { + TPM2_ALG_XOR = 0x0A, + TPM2_ALG_SHA256 = 0x0B, + TPM2_ALG_SHA384 = 0x0C, + TPM2_ALG_SHA512 = 0x0D, + TPM2_ALG_NULL = 0x10, +}; + enum tpm_physical_presence { TPM_PHYSICAL_PRESENCE_HW_DISABLE = 0x0200, TPM_PHYSICAL_PRESENCE_CMD_DISABLE = 0x0100, @@ -548,6 +556,16 @@ uint32_t tpm_nv_write_value(uint32_t index, const void *data, uint32_t length); */ int tpm_pcr_event(u32 index, const void *in_digest, void *out_digest); +/** + * Issue a TPM_PCR_Extend command. + * + * @param index Index of the PCR + * @param digest Value representing the event to be recorded + * + * @return return code of the operation + */ +int tpm2_pcr_extend(u32 index, const uint8_t *digest); + /** * Issue a TPM_PCRRead command. * diff --git a/lib/tpm.c b/lib/tpm.c index 46250a86cf..0cde8695b9 100644 --- a/lib/tpm.c +++ b/lib/tpm.c @@ -527,6 +527,47 @@ int tpm_pcr_event(u32 index, const void *in_digest, void *out_digest) return 0; } +int tpm2_pcr_extend(u32 index, const uint8_t *digest) +{ + u8 command_v2[COMMAND_BUFFER_SIZE] = { + U16_TO_ARRAY(TPM2_ST_SESSIONS), /* TAG */ + U32_TO_ARRAY(33 + TPM2_DIGEST_LENGTH), /* Length */ + U32_TO_ARRAY(TPM2_CC_PCR_EXTEND), /* Command code */ + + /* HANDLE */ + U32_TO_ARRAY(index), /* Handle (PCR Index) */ + + /* AUTH_SESSION */ + U32_TO_ARRAY(9), /* Authorization size */ + U32_TO_ARRAY(TPM2_RS_PW), /* Session handle */ + U16_TO_ARRAY(0), /* Size of */ + /* (if any) */ + 0, /* Attributes: Cont/Excl/Rst */ + U16_TO_ARRAY(0), /* Size of */ + /* (if any) */ + U32_TO_ARRAY(1), /* Count (number of hashes) */ + U16_TO_ARRAY(TPM2_ALG_SHA256), /* Algorithm of the hash */ + /* STRING(digest) Digest */ + }; + unsigned int offset = 33; + int ret; + + if (!is_tpmv2) + return TPM_LIB_ERROR; + + /* + * Fill the command structure starting from the first buffer: + * - the digest + */ + ret = pack_byte_string(command_v2, sizeof(command_v2), "s", + offset, digest, TPM2_DIGEST_LENGTH); + offset += TPM2_DIGEST_LENGTH; + if (ret) + return TPM_LIB_ERROR; + + return tpm_sendrecv_command(command_v2, NULL, NULL); +} + uint32_t tpm_pcr_read(uint32_t index, void *data, size_t count) { const uint8_t command[14] = {