[U-Boot] [PATCH v2 06/18] lib: tpm: Add command to flush resources

Stefan Roese sr at denx.de
Wed Jan 18 17:07:30 CET 2017


On 11.01.2017 16:00, Mario Six wrote:
> This patch adds a function to the TPM library, which allows U-Boot to
> flush resources, e.g. keys, from the TPM.
>
> Signed-off-by: Mario Six <mario.six at gdsys.cc>
> ---
> Changes in v2:
>
> * Added U-Boot command for resource flushing ("tpm flush"), and made the
>   command and the library function deactivate-able via config
> ---
>  board/gdsys/p1022/controlcenterd-id.c |  9 -----
>  cmd/tpm.c                             | 70 +++++++++++++++++++++++++++++++++++
>  drivers/tpm/Kconfig                   |  6 +++
>  include/tpm.h                         | 45 ++++++++++++++++++++++
>  lib/tpm.c                             | 29 +++++++++++++++
>  5 files changed, 150 insertions(+), 9 deletions(-)
>
> diff --git a/board/gdsys/p1022/controlcenterd-id.c b/board/gdsys/p1022/controlcenterd-id.c
> index 2c6c698..1648f13 100644
> --- a/board/gdsys/p1022/controlcenterd-id.c
> +++ b/board/gdsys/p1022/controlcenterd-id.c
> @@ -43,15 +43,6 @@
>  #define CCDM_AUTO_FIRST_STAGE
>  #endif
>
> -/* enums from TCG specs */
> -enum {
> -	/* capability areas */
> -	TPM_CAP_NV_INDEX	= 0x00000011,
> -	TPM_CAP_HANDLE		= 0x00000014,
> -	/* resource types */
> -	TPM_RT_KEY	= 0x00000001,
> -};
> -
>  /* CCDM specific contants */
>  enum {
>  	/* NV indices */
> diff --git a/cmd/tpm.c b/cmd/tpm.c
> index 312503f..625fc43 100644
> --- a/cmd/tpm.c
> +++ b/cmd/tpm.c
> @@ -646,6 +646,64 @@ TPM_COMMAND_NO_ARG(tpm_end_oiap)
>
>  #endif /* CONFIG_TPM_AUTH_SESSIONS */
>
> +#ifdef CONFIG_TPM_FLUSH_RESOURCES
> +static int do_tpm_flush(cmd_tbl_t *cmdtp, int flag, int argc,
> +			char * const argv[])
> +{
> +	int type = 0;
> +
> +	if (argc != 2)
> +		return CMD_RET_USAGE;
> +
> +	if (strcasecmp(argv[1], "key"))
> +		type = TPM_RT_KEY;
> +	else if (strcasecmp(argv[1], "auth"))
> +		type = TPM_RT_AUTH;
> +	else if (strcasecmp(argv[1], "hash"))
> +		type = TPM_RT_HASH;
> +	else if (strcasecmp(argv[1], "trans"))
> +		type = TPM_RT_TRANS;
> +	else if (strcasecmp(argv[1], "context"))
> +		type = TPM_RT_CONTEXT;
> +	else if (strcasecmp(argv[1], "counter"))
> +		type = TPM_RT_COUNTER;
> +	else if (strcasecmp(argv[1], "delegate"))
> +		type = TPM_RT_DELEGATE;
> +	else if (strcasecmp(argv[1], "daa_tpm"))
> +		type = TPM_RT_DAA_TPM;
> +	else if (strcasecmp(argv[1], "daa_v0"))
> +		type = TPM_RT_DAA_V0;
> +	else if (strcasecmp(argv[1], "daa_v1"))
> +		type = TPM_RT_DAA_V1;
> +
> +	if (strcasecmp(argv[2], "all")) {
> +		uint16_t res_count;
> +		uint8_t buf[288];
> +		uint8_t *ptr;
> +		int err;
> +		uint i;
> +
> +		/* fetch list of already loaded resources in the TPM */
> +		err = tpm_get_capability(TPM_CAP_HANDLE, type, buf,
> +					 sizeof(buf));
> +		if (err)
> +			return -1;
> +		res_count = get_unaligned_be16(buf);
> +		ptr = buf + 2;
> +		for (i = 0; i < res_count; ++i, ptr += 4)
> +			tpm_flush_specific(get_unaligned_be32(ptr), type);
> +	} else {
> +		uint32_t handle = simple_strtoul(argv[2], NULL, 0);
> +
> +		if (!handle)
> +			return -1;
> +		tpm_flush_specific(cpu_to_be32(handle), type);
> +	}
> +
> +	return 0;
> +}
> +#endif /* CONFIG_TPM_FLUSH_RESOURCES */
> +
>  #define MAKE_TPM_CMD_ENTRY(cmd) \
>  	U_BOOT_CMD_MKENT(cmd, 0, 1, do_tpm_ ## cmd, "", "")
>
> @@ -701,6 +759,10 @@ static cmd_tbl_t tpm_commands[] = {
>  	U_BOOT_CMD_MKENT(get_pub_key_oiap, 0, 1,
>  			 do_tpm_get_pub_key_oiap, "", ""),
>  #endif /* CONFIG_TPM_AUTH_SESSIONS */
> +#ifdef CONFIG_TPM_FLUSH_RESOURCES
> +	U_BOOT_CMD_MKENT(flush, 0, 1,
> +			 do_tpm_flush, "", ""),
> +#endif /* CONFIG_TPM_FLUSH_RESOURCES */
>  };
>
>  static int do_tpm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
> @@ -750,6 +812,14 @@ U_BOOT_CMD(tpm, CONFIG_SYS_MAXARGS, 1, do_tpm,
>  "  get_capability cap_area sub_cap addr count\n"
>  "    - Read <count> bytes of TPM capability indexed by <cap_area> and\n"
>  "      <sub_cap> to memory address <addr>.\n"
> +#ifdef CONFIG_TPM_FLUSH_RESOURCES
> +"Resource management functions\n"
> +"  flush resource_type id\n"
> +"    - flushes a resource of type <resource_type> (may be one of key, auth,\n"
> +"      hash, trans, context, counter, delegate, daa_tpm, daa_v0, daa_v1),\n"
> +"      and id <id> from the TPM. Use an <id> of \"all\" to flush all\n"
> +"      resources of that type.\n"
> +#endif /* CONFIG_TPM_FLUSH_RESOURCES */
>  #ifdef CONFIG_TPM_AUTH_SESSIONS
>  "Storage functions\n"
>  "  loadkey2_oiap parent_handle key_addr key_len usage_auth\n"
> diff --git a/drivers/tpm/Kconfig b/drivers/tpm/Kconfig
> index 7ab34ce..3490ee0 100644
> --- a/drivers/tpm/Kconfig
> +++ b/drivers/tpm/Kconfig
> @@ -82,4 +82,10 @@ config TPM_ST33ZP24_SPI
>  	  to the device using the standard TPM Interface Specification (TIS)
>  	  protocol
>
> +config TPM_FLUSH_RESOURCES
> +	bool "Enable TPM resource flushing support"
> +	depends on TPM
> +	help
> +	  Enable support to flush specific resources (e.g. keys) from the TPM.
> +	  The functionality is available via the 'tpm' command as well.
>  endmenu
> diff --git a/include/tpm.h b/include/tpm.h
> index 9a6585d..800f29c 100644
> --- a/include/tpm.h
> +++ b/include/tpm.h
> @@ -47,6 +47,42 @@ enum tpm_nv_index {
>  	TPM_NV_INDEX_DIR	= 0x10000001,
>  };
>
> +enum tpm_resource_type {
> +	TPM_RT_KEY	= 0x00000001,
> +	TPM_RT_AUTH	= 0x00000002,
> +	TPM_RT_HASH	= 0x00000003,
> +	TPM_RT_TRANS	= 0x00000004,
> +	TPM_RT_CONTEXT	= 0x00000005,
> +	TPM_RT_COUNTER	= 0x00000006,
> +	TPM_RT_DELEGATE	= 0x00000007,
> +	TPM_RT_DAA_TPM	= 0x00000008,
> +	TPM_RT_DAA_V0	= 0x00000009,
> +	TPM_RT_DAA_V1	= 0x0000000A,
> +};
> +
> +enum tpm_capability_areas {
> +	TPM_CAP_ORD		= 0x00000001,
> +	TPM_CAP_ALG		= 0x00000002,
> +	TPM_CAP_PID		= 0x00000003,
> +	TPM_CAP_FLAG		= 0x00000004,
> +	TPM_CAP_PROPERTY	= 0x00000005,
> +	TPM_CAP_VERSION		= 0x00000006,
> +	TPM_CAP_KEY_HANDLE	= 0x00000007,
> +	TPM_CAP_CHECK_LOADED	= 0x00000008,
> +	TPM_CAP_SYM_MODE	= 0x00000009,
> +	TPM_CAP_KEY_STATUS	= 0x0000000C,
> +	TPM_CAP_NV_LIST		= 0x0000000D,
> +	TPM_CAP_MFR		= 0x00000010,
> +	TPM_CAP_NV_INDEX	= 0x00000011,
> +	TPM_CAP_TRANS_ALG	= 0x00000012,
> +	TPM_CAP_HANDLE		= 0x00000014,
> +	TPM_CAP_TRANS_ES	= 0x00000015,
> +	TPM_CAP_AUTH_ENCRYPT	= 0x00000017,
> +	TPM_CAP_SELECT_SIZE	= 0x00000018,
> +	TPM_CAP_DA_LOGIC	= 0x00000019,
> +	TPM_CAP_VERSION_VAL	= 0x0000001A,
> +};
> +
>  #define TPM_NV_PER_GLOBALLOCK		(1U << 15)
>  #define TPM_NV_PER_PPWRITE		(1U << 0)
>  #define TPM_NV_PER_READ_STCLEAR		(1U << 31)
> @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct tpm_permanent_flags *pflags);
>   */
>  uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm);
>
> +/**
> + * Flush a resource with a given handle and type from the TPM
> + *
> + * @param key_handle           handle of the resource
> + * @param resource_type                type of the resource
> + * @return return code of the operation
> + */
> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type);
> +
>  #endif /* __TPM_H */
> diff --git a/lib/tpm.c b/lib/tpm.c
> index 88f2406..fb12214 100644
> --- a/lib/tpm.c
> +++ b/lib/tpm.c
> @@ -645,6 +645,35 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm)
>  	return 0;
>  }
>
> +#ifdef CONFIG_TPM_FLUSH_RESOURCES
> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type)
> +{
> +	const uint8_t command[18] = {
> +		0x00, 0xc1,             /* TPM_TAG */
> +		0x00, 0x00, 0x00, 0x12, /* parameter size */
> +		0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */
> +		0x00, 0x00, 0x00, 0x00, /* key handle */
> +		0x00, 0x00, 0x00, 0x00, /* resource type */
> +	};
> +	const size_t key_handle_offset = 10;
> +	const size_t resource_type_offset = 14;
> +	uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];
> +	size_t response_length = sizeof(response);
> +	uint32_t err;
> +
> +	if (pack_byte_string(buf, sizeof(buf), "sdd",
> +			     0, command, sizeof(command),
> +			     key_handle_offset, key_handle,
> +			     resource_type_offset, resource_type))
> +		return TPM_LIB_ERROR;
> +
> +	err = tpm_sendrecv_command(buf, response, &response_length);
> +	if (err)
> +		return err;
> +	return 0;
> +}

You don't need "err" here. Simpler is this version:

	return tpm_sendrecv_command(buf, response, &response_length);

Other than this:

Reviewed-by: Stefan Roese <sr at denx.de>

Thanks,
Stefan


More information about the U-Boot mailing list