From mboxrd@z Thu Jan 1 00:00:00 1970 From: Miquel Raynal Date: Wed, 2 May 2018 10:59:34 +0200 Subject: [U-Boot] [PATCH v3 25/25] tpm: allow Sandbox to run TPMv2.x commands In-Reply-To: <20180502085934.29292-1-miquel.raynal@bootlin.com> References: <20180502085934.29292-1-miquel.raynal@bootlin.com> Message-ID: <20180502085934.29292-26-miquel.raynal@bootlin.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Sandbx is run in userspace. What is done in baremetal applications like U-Boot is using an address in memory which is supposedly free to load and store data to it. The user interaction in U-Boot's shell works like that and it is hard to find another way to transfer a 'buffer' from one side to the other. It is always possible to fill an environment variable, but not that easy to use. Of course our Linux distributions do not allow such salvage accesses and Sandbox will simply be killed. To avoid such scenario, it is possible, when compiling the Sandbox driver, to allocate some memory so the pointer that is given does not point to an unauthorized area anymore. This just give the possibility to run all the TPM commands without killing Sandbox. Signed-off-by: Miquel Raynal --- cmd/tpm-v2.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/cmd/tpm-v2.c b/cmd/tpm-v2.c index 5dde2cb307..49d67034c9 100644 --- a/cmd/tpm-v2.c +++ b/cmd/tpm-v2.c @@ -79,11 +79,22 @@ static int do_tpm2_pcr_extend(cmd_tbl_t *cmdtp, int flag, int argc, { u32 index = simple_strtoul(argv[1], NULL, 0); void *digest = (void *)simple_strtoul(argv[2], NULL, 0); + u32 rc; if (argc != 3) return CMD_RET_USAGE; - return report_return_code(tpm2_pcr_extend(index, digest)); +#if defined(CONFIG_TPM2_TIS_SANDBOX) + digest = calloc(1, TPM2_DIGEST_LEN); +#endif + + rc = tpm2_pcr_extend(index, digest); + +#if defined(CONFIG_TPM2_TIS_SANDBOX) + free(digest); +#endif + + return report_return_code(rc); } static int do_tpm_pcr_read(cmd_tbl_t *cmdtp, int flag, int argc, @@ -99,12 +110,20 @@ static int do_tpm_pcr_read(cmd_tbl_t *cmdtp, int flag, int argc, index = simple_strtoul(argv[1], NULL, 0); data = (void *)simple_strtoul(argv[2], NULL, 0); +#if defined(CONFIG_TPM2_TIS_SANDBOX) + data = malloc(256); +#endif + rc = tpm2_pcr_read(index, data, &updates); if (!rc) { printf("PCR #%u content (%d known updates):\n", index, updates); print_byte_string(data, TPM2_DIGEST_LEN); } +#if defined(CONFIG_TPM2_TIS_SANDBOX) + free(data); +#endif + return report_return_code(rc); } @@ -124,6 +143,10 @@ static int do_tpm_get_capability(cmd_tbl_t *cmdtp, int flag, int argc, data = (void *)simple_strtoul(argv[3], NULL, 0); count = simple_strtoul(argv[4], NULL, 0); +#if defined(CONFIG_TPM2_TIS_SANDBOX) + data = malloc(256); +#endif + rc = tpm2_get_capability(capability, property, data, count); if (!rc) { printf("Capabilities read from TPM:\n"); @@ -138,6 +161,10 @@ static int do_tpm_get_capability(cmd_tbl_t *cmdtp, int flag, int argc, } } +#if defined(CONFIG_TPM2_TIS_SANDBOX) + free(data); +#endif + return report_return_code(rc); } -- 2.14.1