All of lore.kernel.org
 help / color / mirror / Atom feed
From: Simon Glass <sjg@chromium.org>
To: u-boot@lists.denx.de
Subject: [PATCH v4 09/11] tpm: Add TPM2 support for read/write values
Date: Sat,  6 Feb 2021 14:23:40 -0700	[thread overview]
Message-ID: <20210206212343.3567308-8-sjg@chromium.org> (raw)
In-Reply-To: <20210206212343.3567308-1-sjg@chromium.org>

Implement this API function for TPM2.

Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---

(no changes since v1)

 include/tpm-common.h |  3 ++
 include/tpm-v2.h     | 38 ++++++++++++++++++++
 lib/tpm-v2.c         | 84 ++++++++++++++++++++++++++++++++++++++++++++
 lib/tpm_api.c        |  4 +--
 4 files changed, 127 insertions(+), 2 deletions(-)

diff --git a/include/tpm-common.h b/include/tpm-common.h
index e29b10b1766..080183779b3 100644
--- a/include/tpm-common.h
+++ b/include/tpm-common.h
@@ -53,6 +53,8 @@ enum tpm_version {
  * @buf:		Buffer used during the exchanges with the chip
  * @pcr_count:		Number of PCR per bank
  * @pcr_select_min:	Minimum size in bytes of the pcrSelect array
+ * @plat_hier_disabled:	Platform hierarchy has been disabled (TPM is locked
+ *			down until next reboot)
  */
 struct tpm_chip_priv {
 	enum tpm_version version;
@@ -64,6 +66,7 @@ struct tpm_chip_priv {
 	/* TPM v2 specific data */
 	uint pcr_count;
 	uint pcr_select_min;
+	bool plat_hier_disabled;
 };
 
 /**
diff --git a/include/tpm-v2.h b/include/tpm-v2.h
index 2766dc72a65..6a400771af1 100644
--- a/include/tpm-v2.h
+++ b/include/tpm-v2.h
@@ -240,6 +240,7 @@ enum tpm2_command_codes {
 	TPM2_CC_HIERCHANGEAUTH	= 0x0129,
 	TPM2_CC_NV_DEFINE_SPACE	= 0x012a,
 	TPM2_CC_PCR_SETAUTHPOL	= 0x012C,
+	TPM2_CC_NV_WRITE	= 0x0137,
 	TPM2_CC_DAM_RESET	= 0x0139,
 	TPM2_CC_DAM_PARAMETERS	= 0x013A,
 	TPM2_CC_NV_READ         = 0x014E,
@@ -354,6 +355,20 @@ enum {
 	TPM_MAX_BUF_SIZE	= 1260,
 };
 
+enum {
+	/* Secure storage for firmware settings */
+	TPM_HT_PCR = 0,
+	TPM_HT_NV_INDEX,
+	TPM_HT_HMAC_SESSION,
+	TPM_HT_POLICY_SESSION,
+
+	HR_SHIFT		= 24,
+	HR_PCR			= TPM_HT_PCR << HR_SHIFT,
+	HR_HMAC_SESSION		= TPM_HT_HMAC_SESSION << HR_SHIFT,
+	HR_POLICY_SESSION	= TPM_HT_POLICY_SESSION << HR_SHIFT,
+	HR_NV_INDEX		= TPM_HT_NV_INDEX << HR_SHIFT,
+};
+
 /**
  * Issue a TPM2_Startup command.
  *
@@ -418,6 +433,29 @@ u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
 u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
 		    const u8 *digest, u32 digest_len);
 
+/**
+ * Read data from the secure storage
+ *
+ * @dev		TPM device
+ * @index	Index of data to read
+ * @data	Place to put data
+ * @count	Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);
+
+/**
+ * Write data to the secure storage
+ *
+ * @dev		TPM device
+ * @index	Index of data to write
+ * @data	Data to write
+ * @count	Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+			u32 count);
+
 /**
  * Issue a TPM2_PCR_Read command.
  *
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index e9bf4018fed..9f1699131e1 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -169,6 +169,90 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
 	return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 }
 
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
+{
+	u8 command_v2[COMMAND_BUFFER_SIZE] = {
+		/* header 10 bytes */
+		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
+		tpm_u32(10 + 8 + 4 + 9 + 4),	/* Length */
+		tpm_u32(TPM2_CC_NV_READ),	/* Command code */
+
+		/* handles 8 bytes */
+		tpm_u32(TPM2_RH_PLATFORM),	/* Primary platform seed */
+		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
+
+		/* AUTH_SESSION */
+		tpm_u32(9),			/* Authorization size */
+		tpm_u32(TPM2_RS_PW),		/* Session handle */
+		tpm_u16(0),			/* Size of <nonce> */
+						/* <nonce> (if any) */
+		0,				/* Attributes: Cont/Excl/Rst */
+		tpm_u16(0),			/* Size of <hmac/password> */
+						/* <hmac/password> (if any) */
+
+		tpm_u16(count),			/* Number of bytes */
+		tpm_u16(0),			/* Offset */
+	};
+	size_t response_len = COMMAND_BUFFER_SIZE;
+	u8 response[COMMAND_BUFFER_SIZE];
+	int ret;
+	u16 tag;
+	u32 size, code;
+
+	ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+	if (ret)
+		return log_msg_ret("read", ret);
+	if (unpack_byte_string(response, response_len, "wdds",
+			       0, &tag, 2, &size, 6, &code,
+			       16, data, count))
+		return TPM_LIB_ERROR;
+
+	return 0;
+}
+
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+			u32 count)
+{
+	struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
+	uint offset = 10 + 8 + 4 + 9 + 2;
+	uint len = offset + count + 2;
+	/* Use empty password auth if platform hierarchy is disabled */
+	u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index :
+		TPM2_RH_PLATFORM;
+	u8 command_v2[COMMAND_BUFFER_SIZE] = {
+		/* header 10 bytes */
+		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
+		tpm_u32(len),			/* Length */
+		tpm_u32(TPM2_CC_NV_WRITE),	/* Command code */
+
+		/* handles 8 bytes */
+		tpm_u32(auth),			/* Primary platform seed */
+		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
+
+		/* AUTH_SESSION */
+		tpm_u32(9),			/* Authorization size */
+		tpm_u32(TPM2_RS_PW),		/* Session handle */
+		tpm_u16(0),			/* Size of <nonce> */
+						/* <nonce> (if any) */
+		0,				/* Attributes: Cont/Excl/Rst */
+		tpm_u16(0),			/* Size of <hmac/password> */
+						/* <hmac/password> (if any) */
+
+		tpm_u16(count),
+	};
+	size_t response_len = COMMAND_BUFFER_SIZE;
+	u8 response[COMMAND_BUFFER_SIZE];
+	int ret;
+
+	ret = pack_byte_string(command_v2, sizeof(command_v2), "sw",
+			       offset, data, count,
+			       offset + count, 0);
+	if (ret)
+		return TPM_LIB_ERROR;
+
+	return tpm_sendrecv_command(dev, command_v2, response, &response_len);
+}
+
 u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
 		  void *data, unsigned int *updates)
 {
diff --git a/lib/tpm_api.c b/lib/tpm_api.c
index f1553512cc5..687fc8bc7ee 100644
--- a/lib/tpm_api.c
+++ b/lib/tpm_api.c
@@ -118,7 +118,7 @@ u32 tpm_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
 	if (is_tpm1(dev))
 		return tpm1_nv_read_value(dev, index, data, count);
 	else if (is_tpm2(dev))
-		return -ENOSYS;
+		return tpm2_nv_read_value(dev, index, data, count);
 	else
 		return -ENOSYS;
 }
@@ -129,7 +129,7 @@ u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data,
 	if (is_tpm1(dev))
 		return tpm1_nv_write_value(dev, index, data, count);
 	else if (is_tpm2(dev))
-		return -ENOSYS;
+		return tpm2_nv_write_value(dev, index, data, count);
 	else
 		return -ENOSYS;
 }
-- 
2.30.0.478.g8a0d178c01-goog

  parent reply	other threads:[~2021-02-06 21:23 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-06 21:23 [PATCH v4 00/11] tpm: Support using TPM1 and TPM2 from a single API Simon Glass
2021-02-06 21:23 ` [PATCH v4 01/11] tpm: Don't include cr50 in TPL/SPL Simon Glass
2021-03-03 19:10   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 02/11] tpm: Use logging in the uclass Simon Glass
2021-03-03 19:10   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 03/11] tpm: Add debugging of request in tpm_sendrecv_command() Simon Glass
2021-03-03 19:10   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 04/11] tpm: Add an API that can support v1.2 and v2 Simon Glass
2021-03-03 19:10   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 05/11] tpm: Switch TPMv1 over to use the new API Simon Glass
2021-02-07 11:44   ` Ilias Apalodimas
2021-03-03 19:11   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 06/11] tpm: Add a basic API implementation for TPMv2 Simon Glass
2021-03-03 19:11   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 07/11] tpm: Reduce duplication in a few functions Simon Glass
2021-03-03 19:11   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 08/11] tpm: Add an implementation of define_space Simon Glass
2021-02-07 11:44   ` Ilias Apalodimas
2021-03-03 19:11   ` Tom Rini
2021-02-06 21:23 ` Simon Glass [this message]
2021-03-03 19:11   ` [PATCH v4 09/11] tpm: Add TPM2 support for read/write values Tom Rini
2021-02-06 21:23 ` [PATCH v4 10/11] tpm: Add TPM2 support for write_lock Simon Glass
2021-03-03 19:11   ` Tom Rini
2021-02-06 21:23 ` [PATCH v4 11/11] tpm: Allow disabling platform hierarchy with TPM2 Simon Glass
2021-03-03 19:11   ` Tom Rini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210206212343.3567308-8-sjg@chromium.org \
    --to=sjg@chromium.org \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.