[PATCH v4 09/11] tpm: Add TPM2 support for read/write values
Simon Glass
sjg at chromium.org
Sat Feb 6 22:23:40 CET 2021
Implement this API function for TPM2.
Signed-off-by: Simon Glass <sjg at chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas at linaro.org>
---
(no changes since v1)
include/tpm-common.h | 3 ++
include/tpm-v2.h | 38 ++++++++++++++++++++
lib/tpm-v2.c | 84 ++++++++++++++++++++++++++++++++++++++++++++
lib/tpm_api.c | 4 +--
4 files changed, 127 insertions(+), 2 deletions(-)
diff --git a/include/tpm-common.h b/include/tpm-common.h
index e29b10b1766..080183779b3 100644
--- a/include/tpm-common.h
+++ b/include/tpm-common.h
@@ -53,6 +53,8 @@ enum tpm_version {
* @buf: Buffer used during the exchanges with the chip
* @pcr_count: Number of PCR per bank
* @pcr_select_min: Minimum size in bytes of the pcrSelect array
+ * @plat_hier_disabled: Platform hierarchy has been disabled (TPM is locked
+ * down until next reboot)
*/
struct tpm_chip_priv {
enum tpm_version version;
@@ -64,6 +66,7 @@ struct tpm_chip_priv {
/* TPM v2 specific data */
uint pcr_count;
uint pcr_select_min;
+ bool plat_hier_disabled;
};
/**
diff --git a/include/tpm-v2.h b/include/tpm-v2.h
index 2766dc72a65..6a400771af1 100644
--- a/include/tpm-v2.h
+++ b/include/tpm-v2.h
@@ -240,6 +240,7 @@ enum tpm2_command_codes {
TPM2_CC_HIERCHANGEAUTH = 0x0129,
TPM2_CC_NV_DEFINE_SPACE = 0x012a,
TPM2_CC_PCR_SETAUTHPOL = 0x012C,
+ TPM2_CC_NV_WRITE = 0x0137,
TPM2_CC_DAM_RESET = 0x0139,
TPM2_CC_DAM_PARAMETERS = 0x013A,
TPM2_CC_NV_READ = 0x014E,
@@ -354,6 +355,20 @@ enum {
TPM_MAX_BUF_SIZE = 1260,
};
+enum {
+ /* Secure storage for firmware settings */
+ TPM_HT_PCR = 0,
+ TPM_HT_NV_INDEX,
+ TPM_HT_HMAC_SESSION,
+ TPM_HT_POLICY_SESSION,
+
+ HR_SHIFT = 24,
+ HR_PCR = TPM_HT_PCR << HR_SHIFT,
+ HR_HMAC_SESSION = TPM_HT_HMAC_SESSION << HR_SHIFT,
+ HR_POLICY_SESSION = TPM_HT_POLICY_SESSION << HR_SHIFT,
+ HR_NV_INDEX = TPM_HT_NV_INDEX << HR_SHIFT,
+};
+
/**
* Issue a TPM2_Startup command.
*
@@ -418,6 +433,29 @@ u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
const u8 *digest, u32 digest_len);
+/**
+ * Read data from the secure storage
+ *
+ * @dev TPM device
+ * @index Index of data to read
+ * @data Place to put data
+ * @count Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);
+
+/**
+ * Write data to the secure storage
+ *
+ * @dev TPM device
+ * @index Index of data to write
+ * @data Data to write
+ * @count Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+ u32 count);
+
/**
* Issue a TPM2_PCR_Read command.
*
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index e9bf4018fed..9f1699131e1 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -169,6 +169,90 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
}
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
+{
+ u8 command_v2[COMMAND_BUFFER_SIZE] = {
+ /* header 10 bytes */
+ tpm_u16(TPM2_ST_SESSIONS), /* TAG */
+ tpm_u32(10 + 8 + 4 + 9 + 4), /* Length */
+ tpm_u32(TPM2_CC_NV_READ), /* Command code */
+
+ /* handles 8 bytes */
+ tpm_u32(TPM2_RH_PLATFORM), /* Primary platform seed */
+ tpm_u32(HR_NV_INDEX + index), /* Password authorisation */
+
+ /* AUTH_SESSION */
+ tpm_u32(9), /* Authorization size */
+ tpm_u32(TPM2_RS_PW), /* Session handle */
+ tpm_u16(0), /* Size of <nonce> */
+ /* <nonce> (if any) */
+ 0, /* Attributes: Cont/Excl/Rst */
+ tpm_u16(0), /* Size of <hmac/password> */
+ /* <hmac/password> (if any) */
+
+ tpm_u16(count), /* Number of bytes */
+ tpm_u16(0), /* Offset */
+ };
+ size_t response_len = COMMAND_BUFFER_SIZE;
+ u8 response[COMMAND_BUFFER_SIZE];
+ int ret;
+ u16 tag;
+ u32 size, code;
+
+ ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ if (ret)
+ return log_msg_ret("read", ret);
+ if (unpack_byte_string(response, response_len, "wdds",
+ 0, &tag, 2, &size, 6, &code,
+ 16, data, count))
+ return TPM_LIB_ERROR;
+
+ return 0;
+}
+
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+ u32 count)
+{
+ struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
+ uint offset = 10 + 8 + 4 + 9 + 2;
+ uint len = offset + count + 2;
+ /* Use empty password auth if platform hierarchy is disabled */
+ u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index :
+ TPM2_RH_PLATFORM;
+ u8 command_v2[COMMAND_BUFFER_SIZE] = {
+ /* header 10 bytes */
+ tpm_u16(TPM2_ST_SESSIONS), /* TAG */
+ tpm_u32(len), /* Length */
+ tpm_u32(TPM2_CC_NV_WRITE), /* Command code */
+
+ /* handles 8 bytes */
+ tpm_u32(auth), /* Primary platform seed */
+ tpm_u32(HR_NV_INDEX + index), /* Password authorisation */
+
+ /* AUTH_SESSION */
+ tpm_u32(9), /* Authorization size */
+ tpm_u32(TPM2_RS_PW), /* Session handle */
+ tpm_u16(0), /* Size of <nonce> */
+ /* <nonce> (if any) */
+ 0, /* Attributes: Cont/Excl/Rst */
+ tpm_u16(0), /* Size of <hmac/password> */
+ /* <hmac/password> (if any) */
+
+ tpm_u16(count),
+ };
+ size_t response_len = COMMAND_BUFFER_SIZE;
+ u8 response[COMMAND_BUFFER_SIZE];
+ int ret;
+
+ ret = pack_byte_string(command_v2, sizeof(command_v2), "sw",
+ offset, data, count,
+ offset + count, 0);
+ if (ret)
+ return TPM_LIB_ERROR;
+
+ return tpm_sendrecv_command(dev, command_v2, response, &response_len);
+}
+
u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
void *data, unsigned int *updates)
{
diff --git a/lib/tpm_api.c b/lib/tpm_api.c
index f1553512cc5..687fc8bc7ee 100644
--- a/lib/tpm_api.c
+++ b/lib/tpm_api.c
@@ -118,7 +118,7 @@ u32 tpm_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
if (is_tpm1(dev))
return tpm1_nv_read_value(dev, index, data, count);
else if (is_tpm2(dev))
- return -ENOSYS;
+ return tpm2_nv_read_value(dev, index, data, count);
else
return -ENOSYS;
}
@@ -129,7 +129,7 @@ u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data,
if (is_tpm1(dev))
return tpm1_nv_write_value(dev, index, data, count);
else if (is_tpm2(dev))
- return -ENOSYS;
+ return tpm2_nv_write_value(dev, index, data, count);
else
return -ENOSYS;
}
--
2.30.0.478.g8a0d178c01-goog
More information about the U-Boot
mailing list