[PATCH 1/2 v2] tpm: add a function that performs selftest + startup

[PATCH 1/2 v2] tpm: add a function that performs selftest + startup

[Ilias Apalodimas]

As described in [0] if a command requires use of an untested algorithm
or functional module, the TPM performs the test and then completes the
command actions.

Since we don't check for TPM_RC_NEEDS_TEST (which is the return code of
the TPM in that case) and even if we would, it would complicate our TPM
code for no apparent reason,  add a wrapper function that performs both
the selftest and the startup sequence of the TPM.

It's worth noting that this is implemented on TPMv2.0.  The code for
1.2 would look similar,  but I don't have a device available to test.

[0]
https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.07-2014-03-13.pdf
§12.3 Self-test modes

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
Changes since v1:
- Remove a superfluous if statement
- Move function comments to the header file

 include/tpm-v2.h  | 19 +++++++++++++++++++
 include/tpm_api.h |  8 ++++++++
 lib/tpm-v2.c      | 17 +++++++++++++++++
 lib/tpm_api.c     |  8 ++++++++
 4 files changed, 52 insertions(+)

diff --git a/include/tpm-v2.h b/include/tpm-v2.h
index 737e57551d73..60031edd275b 100644
--- a/include/tpm-v2.h
+++ b/include/tpm-v2.h
@@ -688,4 +688,23 @@ u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd,
 u32 tpm2_enable_nvcommits(struct udevice *dev, uint vendor_cmd,
 			  uint vendor_subcmd);

+/**
+ * tpm2_auto_start() - start up the TPM and perform selftests.
+ *                     If a testable function has not been tested and is
+ *                     requested the TPM2  will return TPM_RC_NEEDS_TEST.
+ *
+ *
+ *
+ * @param dev		TPM device
+ * Return: TPM_RC_TESTING, if TPM2 self-test has been received and the tests are
+ *         not complete.
+ *         TPM_RC_SUCCESS, if testing of all functions is complete without
+ *         functional failures.
+ *         TPM2_RC_FAILURE, if any test failed.
+ *         TPM2_RC_INITIALIZE, if the TPM has not gone through the Startup
+ *         sequence
+
+ */
+u32 tpm2_auto_start(struct udevice *dev);
+
 #endif /* __TPM_V2_H */
diff --git a/include/tpm_api.h b/include/tpm_api.h
index 8979d9d6df7e..022a8bbaeca6 100644
--- a/include/tpm_api.h
+++ b/include/tpm_api.h
@@ -331,4 +331,12 @@ static inline bool tpm_is_v2(struct udevice *dev)
 	return IS_ENABLED(CONFIG_TPM_V2) && tpm_get_version(dev) == TPM_V2;
 }

+/**
+ * tpm_auto_start() - start up the TPM and perform selftests
+ *
+ * @param dev		TPM device
+ * Return: return code of the operation (0 = success)
+ */
+u32 tpm_auto_start(struct udevice *dev);
+
 #endif /* __TPM_API_H */
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index 697b982e079f..9ab5b46df177 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -44,6 +44,23 @@ u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test)
 	return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 }

+u32 tpm2_auto_start(struct udevice *dev)
+{
+	u32 rc;
+
+	rc = tpm2_self_test(dev, TPMI_YES);
+
+	if (rc == TPM2_RC_INITIALIZE) {
+		rc = tpm2_startup(dev, TPM2_SU_CLEAR);
+		if (rc)
+			return rc;
+
+		rc = tpm2_self_test(dev, TPMI_YES);
+	}
+
+	return rc;
+}
+
 u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
 	       const ssize_t pw_sz)
 {
diff --git a/lib/tpm_api.c b/lib/tpm_api.c
index 7e8df8795ef3..5b2c11a277cc 100644
--- a/lib/tpm_api.c
+++ b/lib/tpm_api.c
@@ -35,6 +35,14 @@ u32 tpm_startup(struct udevice *dev, enum tpm_startup_type mode)
 	}
 }

+u32 tpm_auto_start(struct udevice *dev)
+{
+	if (tpm_is_v2(dev))
+		return tpm2_auto_start(dev);
+
+	return -ENOSYS;
+}
+
 u32 tpm_resume(struct udevice *dev)
 {
 	if (tpm_is_v1(dev))

--
2.38.1

[PATCH 2/2 v2] efi_loader: use tpm_auto_start for the tpm device

[Ilias Apalodimas]

A previous commit is adding a new tpm startup functions which
initializes the TPMv2 and performs all the needed selftests.
Since the TPM selftests might be needed depending on the requested
lgorithm or functional module use that instead.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
---
 lib/efi_loader/efi_tcg2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 918e9a268641..d035a00d98ac 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -2422,7 +2422,7 @@ efi_status_t efi_tcg2_register(void)
 	}

 	/* initialize the TPM as early as possible. */
-	err = tpm_startup(dev, TPM_ST_CLEAR);
+	err = tpm_auto_start(dev);
 	if (err) {
 		log_err("TPM startup failed\n");
 		goto fail;
--
2.38.1