[U-Boot] [PATCH 07/17] lib: tpm: Add command to flush resources

[Simon Glass]

On 1 December 2016 at 01:42, Stefan Roese <sr at denx.de> wrote:
> (Adding Simon to Cc)
>
> On 23.11.2016 16:12, Mario Six wrote:
>>
>> This patch adds a function to the TPM library, which allows U-Boot to
>> flush resources, e.g. keys, from the TPM.
>>
>> Signed-off-by: Mario Six <mario.six at gdsys.cc>
>
>
> Simon, do you have any comments on this patch please?

Reviewed-by: Simon Glass <sjg at chromium.org>

Is it possible to add a new tpm subcommand for this?

>
>
>> ---
>>  board/gdsys/p1022/controlcenterd-id.c |  9 -------
>>  include/tpm.h                         | 45
>> +++++++++++++++++++++++++++++++++++
>>  lib/tpm.c                             | 28 ++++++++++++++++++++++
>>  3 files changed, 73 insertions(+), 9 deletions(-)
>>
>> diff --git a/board/gdsys/p1022/controlcenterd-id.c
>> b/board/gdsys/p1022/controlcenterd-id.c
>> index 2c6c698..1648f13 100644
>> --- a/board/gdsys/p1022/controlcenterd-id.c
>> +++ b/board/gdsys/p1022/controlcenterd-id.c
>> @@ -43,15 +43,6 @@
>>  #define CCDM_AUTO_FIRST_STAGE
>>  #endif
>>
>> -/* enums from TCG specs */
>> -enum {
>> -       /* capability areas */
>> -       TPM_CAP_NV_INDEX        = 0x00000011,
>> -       TPM_CAP_HANDLE          = 0x00000014,
>> -       /* resource types */
>> -       TPM_RT_KEY      = 0x00000001,
>> -};
>> -
>>  /* CCDM specific contants */
>>  enum {
>>         /* NV indices */
>> diff --git a/include/tpm.h b/include/tpm.h
>> index 9a6585d..800f29c 100644
>> --- a/include/tpm.h
>> +++ b/include/tpm.h
>> @@ -47,6 +47,42 @@ enum tpm_nv_index {
>>         TPM_NV_INDEX_DIR        = 0x10000001,
>>  };
>>
>> +enum tpm_resource_type {
>> +       TPM_RT_KEY      = 0x00000001,
>> +       TPM_RT_AUTH     = 0x00000002,
>> +       TPM_RT_HASH     = 0x00000003,
>> +       TPM_RT_TRANS    = 0x00000004,
>> +       TPM_RT_CONTEXT  = 0x00000005,
>> +       TPM_RT_COUNTER  = 0x00000006,
>> +       TPM_RT_DELEGATE = 0x00000007,
>> +       TPM_RT_DAA_TPM  = 0x00000008,
>> +       TPM_RT_DAA_V0   = 0x00000009,
>> +       TPM_RT_DAA_V1   = 0x0000000A,
>> +};
>> +
>> +enum tpm_capability_areas {
>> +       TPM_CAP_ORD             = 0x00000001,
>> +       TPM_CAP_ALG             = 0x00000002,
>> +       TPM_CAP_PID             = 0x00000003,
>> +       TPM_CAP_FLAG            = 0x00000004,
>> +       TPM_CAP_PROPERTY        = 0x00000005,
>> +       TPM_CAP_VERSION         = 0x00000006,
>> +       TPM_CAP_KEY_HANDLE      = 0x00000007,
>> +       TPM_CAP_CHECK_LOADED    = 0x00000008,
>> +       TPM_CAP_SYM_MODE        = 0x00000009,
>> +       TPM_CAP_KEY_STATUS      = 0x0000000C,
>> +       TPM_CAP_NV_LIST         = 0x0000000D,
>> +       TPM_CAP_MFR             = 0x00000010,
>> +       TPM_CAP_NV_INDEX        = 0x00000011,
>> +       TPM_CAP_TRANS_ALG       = 0x00000012,
>> +       TPM_CAP_HANDLE          = 0x00000014,
>> +       TPM_CAP_TRANS_ES        = 0x00000015,
>> +       TPM_CAP_AUTH_ENCRYPT    = 0x00000017,
>> +       TPM_CAP_SELECT_SIZE     = 0x00000018,
>> +       TPM_CAP_DA_LOGIC        = 0x00000019,
>> +       TPM_CAP_VERSION_VAL     = 0x0000001A,
>> +};
>> +
>>  #define TPM_NV_PER_GLOBALLOCK          (1U << 15)
>>  #define TPM_NV_PER_PPWRITE             (1U << 0)
>>  #define TPM_NV_PER_READ_STCLEAR                (1U << 31)
>> @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct
>> tpm_permanent_flags *pflags);
>>   */
>>  uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm);
>>
>> +/**
>> + * Flush a resource with a given handle and type from the TPM
>> + *
>> + * @param key_handle           handle of the resource
>> + * @param resource_type                type of the resource
>> + * @return return code of the operation
>> + */
>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type);
>> +
>>  #endif /* __TPM_H */
>> diff --git a/lib/tpm.c b/lib/tpm.c
>> index 88f2406..98c20a0 100644
>> --- a/lib/tpm.c
>> +++ b/lib/tpm.c
>> @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t
>> *perm)
>>         return 0;
>>  }
>>
>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type)
>> +{
>> +       const uint8_t command[18] = {
>> +               0x00, 0xc1,             /* TPM_TAG */
>> +               0x00, 0x00, 0x00, 0x12, /* parameter size */
>> +               0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */
>> +               0x00, 0x00, 0x00, 0x00, /* key handle */
>> +               0x00, 0x00, 0x00, 0x00, /* resource type */
>> +       };
>> +       const size_t key_handle_offset = 10;
>> +       const size_t resource_type_offset = 14;
>> +

Drop blank line

>> +       uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];
>> +       size_t response_length = sizeof(response);
>> +       uint32_t err;
>> +
>> +       if (pack_byte_string(buf, sizeof(buf), "sdd",
>> +                            0, command, sizeof(command),
>> +                            key_handle_offset, key_handle,
>> +                            resource_type_offset, resource_type))
>> +               return TPM_LIB_ERROR;
>> +
>> +       err = tpm_sendrecv_command(buf, response, &response_length);
>> +       if (err)
>> +               return err;
>> +       return 0;
>> +}
>> +
>>  #ifdef CONFIG_TPM_AUTH_SESSIONS
>>
>>  /**
>>
>
> Thanks,
> Stefan

Regards,
Simon