From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7E8D9C25B06 for ; Sun, 14 Aug 2022 23:29:49 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 2BB7E845D6; Mon, 15 Aug 2022 01:29:47 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="Hbmwn9pS"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id B306D8461F; Mon, 15 Aug 2022 01:29:45 +0200 (CEST) Received: from mail-yw1-x112f.google.com (mail-yw1-x112f.google.com [IPv6:2607:f8b0:4864:20::112f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 955E78402F for ; Mon, 15 Aug 2022 01:29:42 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=sjg@google.com Received: by mail-yw1-x112f.google.com with SMTP id 00721157ae682-328303afa6eso53378097b3.10 for ; Sun, 14 Aug 2022 16:29:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=WrcLQ1Ij4prT1bn5iPBqHWMEz8Q5cqzpmFfhLFKZpzA=; b=Hbmwn9pSYMdnQPrvfAC1YLWCx43kWpCeYiqS/0lmrnIsbC07rFM3DqPT0WQ6m47Vr+ GAnTljtU81XvWc/+Z+r/uRSGj0Vr74jF7mLIcyd0habUJ7++v6IxE1e7fR05ZalbAb7D 7ZerBvunVGHZTGrJt8qPHLNznYZ/Wl6ccbgNI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=WrcLQ1Ij4prT1bn5iPBqHWMEz8Q5cqzpmFfhLFKZpzA=; b=HrPF4/mG03vrNEfHwfFb3yr12YM5WGsu1suROvlpxbAnDR8z7LDg4eZL5Xbs5i4nhG 49bs7BqnFbeK9Ng7CArTI+ytWt6skifDP4PDI9slHsizvlOpNO5ZHjq2lPwOVIb7SD6y y+yYHc2vA+ukk146qwK2tyEmkgNzrl/cgYqJ6Qx7MClThEHizMbSFDv0xkbxWqButAbS G4eyx6b3loD0kOR8vpGMsy//Z7NN9CmAYoepuT1ATB1N8jJa/JIjtFBGuQHySJe3nI0o OU9jLejjAnsn5YzfXdOiOYE0TniWuYC799KVFXftIE/mrfVh5YMhY7mflRUiDW0Xme5S tHgg== X-Gm-Message-State: ACgBeo13Q4RikdJ/azZN+11HvXEcQVcBY2B/lyDJHy9EjGYxhxmJWRnx B9CvQGNuzU4ZtKGc90aq78/DMv0V0HhX0QOYlw0Brg== X-Google-Smtp-Source: AA6agR6xAa6lVwsCw1vJ7LRAeNuZK9hqo+Mb0w/sy6RsMD9WijNVIU6pd04bIAGDlGRncwvILSSS194hgEGg358sn0Q= X-Received: by 2002:a81:19c2:0:b0:32f:b91c:f43a with SMTP id 185-20020a8119c2000000b0032fb91cf43amr8090915ywz.402.1660519781034; Sun, 14 Aug 2022 16:29:41 -0700 (PDT) MIME-Version: 1.0 References: <20220301001125.1554442-1-sjg@chromium.org> <20220301001125.1554442-3-sjg@chromium.org> In-Reply-To: From: Simon Glass Date: Sun, 14 Aug 2022 17:29:30 -0600 Message-ID: Subject: Re: [PATCH 2/8] tpm: Require a digest source when extending the PCR To: Ilias Apalodimas Cc: U-Boot Mailing List Content-Type: text/plain; charset="UTF-8" X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Hi Ilias, On Tue, 7 Jun 2022 at 02:42, Ilias Apalodimas wrote: > > On Mon, Feb 28, 2022 at 05:11:19PM -0700, Simon Glass wrote: > > This feature is used for measured boot. It is not currently supported in > > the TPM drivers, but add it to the API so that code which expects it can > > signal its request. > > > > Signed-off-by: Simon Glass > > --- > > > > cmd/tpm-v1.c | 3 ++- > > cmd/tpm_test.c | 5 +++-- > > include/tpm_api.h | 8 +++++--- > > lib/tpm-v2.c | 2 ++ > > lib/tpm_api.c | 14 ++++++++++---- > > 5 files changed, 22 insertions(+), 10 deletions(-) (long pause as I forgot about this and only just discovered it was not applied) > > > > diff --git a/cmd/tpm-v1.c b/cmd/tpm-v1.c > > index bf238a9f2e..0869b70775 100644 > > --- a/cmd/tpm-v1.c > > +++ b/cmd/tpm-v1.c > > @@ -131,7 +131,8 @@ static int do_tpm_extend(struct cmd_tbl *cmdtp, int flag, int argc, > > return CMD_RET_FAILURE; > > } > > > > - rc = tpm_pcr_extend(dev, index, in_digest, out_digest); > > + rc = tpm_pcr_extend(dev, index, in_digest, sizeof(in_digest), > > + out_digest, "test"); > > Where is the output value of an extended PCR needed in measured boot? > IMHO this out_digest seems pointless. I'd be happier if we just completely > removed it and make the v2 variant look like v1 more. It is used by the tpm command to display the digest value. > > > if (!rc) { > > puts("PCR value after execution of the command:\n"); > > print_byte_string(out_digest, sizeof(out_digest)); > > diff --git a/cmd/tpm_test.c b/cmd/tpm_test.c > > index a3ccb12f53..b35eae81dc 100644 > > --- a/cmd/tpm_test.c > > +++ b/cmd/tpm_test.c > > @@ -91,7 +91,8 @@ static int test_early_extend(struct udevice *dev) > > tpm_init(dev); > > TPM_CHECK(tpm_startup(dev, TPM_ST_CLEAR)); > > TPM_CHECK(tpm_continue_self_test(dev)); > > - TPM_CHECK(tpm_pcr_extend(dev, 1, value_in, value_out)); > > + TPM_CHECK(tpm_pcr_extend(dev, 1, value_in, sizeof(value_in), value_out, > > + "test")); > > printf("done\n"); > > return 0; > > } > > @@ -438,7 +439,7 @@ static int test_timing(struct udevice *dev) > > 100); > > TTPM_CHECK(tpm_nv_read_value(dev, INDEX0, (uint8_t *)&x, sizeof(x)), > > 100); > > - TTPM_CHECK(tpm_pcr_extend(dev, 0, in, out), 200); > > + TTPM_CHECK(tpm_pcr_extend(dev, 0, in, sizeof(in), out, "test"), 200); > > TTPM_CHECK(tpm_set_global_lock(dev), 50); > > TTPM_CHECK(tpm_tsc_physical_presence(dev, PHYS_PRESENCE), 100); > > printf("done\n"); > > diff --git a/include/tpm_api.h b/include/tpm_api.h > > index 11aa14eb79..3c8e48bc25 100644 > > --- a/include/tpm_api.h > > +++ b/include/tpm_api.h > > @@ -81,14 +81,16 @@ u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data, > > * > > * @param dev TPM device > > * @param index index of the PCR > > - * @param in_digest 160-bit value representing the event to be > > + * @param in_digest 160/256-bit value representing the event to be > > * recorded > > - * @param out_digest 160-bit PCR value after execution of the > > + * @param size size of digest in bytes > > + * @param out_digest 160/256-bit PCR value after execution of the > > * command > > + * @param name additional info about where the digest comes from > > * Return: return code of the operation > > */ > > u32 tpm_pcr_extend(struct udevice *dev, u32 index, const void *in_digest, > > - void *out_digest); > > + uint size, void *out_digest, const char *name); > > > > /** > > * Issue a TPM_PCRRead command. > > diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > > index 1bf627853a..6058f2e1e4 100644 > > --- a/lib/tpm-v2.c > > +++ b/lib/tpm-v2.c > > @@ -157,6 +157,8 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm, > > }; > > int ret; > > > > + if (!digest) > > + return -EINVAL; > > /* > > * Fill the command structure starting from the first buffer: > > * - the digest > > diff --git a/lib/tpm_api.c b/lib/tpm_api.c > > index 4ac4612c81..a8d3731d3a 100644 > > --- a/lib/tpm_api.c > > +++ b/lib/tpm_api.c > > @@ -140,15 +140,21 @@ u32 tpm_write_lock(struct udevice *dev, u32 index) > > } > > > > u32 tpm_pcr_extend(struct udevice *dev, u32 index, const void *in_digest, > > - void *out_digest) > > + uint size, void *out_digest, const char *name) > > { > > - if (tpm_is_v1(dev)) > > + if (tpm_is_v1(dev)) { > > + if (size != PCR_DIGEST_LENGTH || !out_digest) > > + return -EINVAL; > > return tpm1_extend(dev, index, in_digest, out_digest); > > - else if (tpm_is_v2(dev)) > > + } else if (tpm_is_v2(dev)) { > > + if (size != TPM2_SHA256_DIGEST_SIZE) > > + return -EINVAL; > > Why are we limiting this? This is supposed to be dictated by the PCR bank > configuration of each hardware OK I can drop this. Normally we use SHA256 for TPMv2 and I'm not sure we suppose anything else. But we don't have to.... > > > return tpm2_pcr_extend(dev, index, TPM2_ALG_SHA256, in_digest, > > TPM2_DIGEST_LEN); > > - else > > + /* @name is ignored as we do not support measured boot */ > > + } else { > > return -ENOSYS; > > + } > > } > > > > u32 tpm_pcr_read(struct udevice *dev, u32 index, void *data, size_t count) > > -- > > 2.35.1.574.g5d30c73bfb-goog Regards, Simon