diff mbox series

[v3,09/11] tpm: Add TPM2 support for read/write values

Message ID 20210123172607.2879600-8-sjg@chromium.org
State Superseded
Delegated to: Tom Rini
Headers show
Series tpm: Support using TPM1 and TPM2 from a single API | expand

Commit Message

Simon Glass Jan. 23, 2021, 5:26 p.m. UTC 
Implement this API function for TPM2.

Signed-off-by: Simon Glass <sjg@chromium.org>
---

(no changes since v1)

 include/tpm-common.h |  3 ++
 include/tpm-v2.h     | 38 ++++++++++++++++++++
 lib/tpm-v2.c         | 84 ++++++++++++++++++++++++++++++++++++++++++++
 lib/tpm_api.c        |  4 +--
 4 files changed, 127 insertions(+), 2 deletions(-)

Comments

Ilias Apalodimas Jan. 25, 2021, 8:37 a.m. UTC | #1 
On Sat, Jan 23, 2021 at 10:26:05AM -0700, Simon Glass wrote:
> Implement this API function for TPM2.
> 
> Signed-off-by: Simon Glass <sjg@chromium.org>
> ---
> 
> (no changes since v1)
> 
>  include/tpm-common.h |  3 ++
>  include/tpm-v2.h     | 38 ++++++++++++++++++++
>  lib/tpm-v2.c         | 84 ++++++++++++++++++++++++++++++++++++++++++++
>  lib/tpm_api.c        |  4 +--
>  4 files changed, 127 insertions(+), 2 deletions(-)
> 
> diff --git a/include/tpm-common.h b/include/tpm-common.h
> index e29b10b1766..080183779b3 100644
> --- a/include/tpm-common.h
> +++ b/include/tpm-common.h
> @@ -53,6 +53,8 @@ enum tpm_version {
>   * @buf:		Buffer used during the exchanges with the chip
>   * @pcr_count:		Number of PCR per bank
>   * @pcr_select_min:	Minimum size in bytes of the pcrSelect array
> + * @plat_hier_disabled:	Platform hierarchy has been disabled (TPM is locked
> + *			down until next reboot)
>   */
>  struct tpm_chip_priv {
>  	enum tpm_version version;
> @@ -64,6 +66,7 @@ struct tpm_chip_priv {
>  	/* TPM v2 specific data */
>  	uint pcr_count;
>  	uint pcr_select_min;
> +	bool plat_hier_disabled;
>  };
>  
>  /**
> diff --git a/include/tpm-v2.h b/include/tpm-v2.h
> index 2766dc72a65..6a400771af1 100644
> --- a/include/tpm-v2.h
> +++ b/include/tpm-v2.h
> @@ -240,6 +240,7 @@ enum tpm2_command_codes {
>  	TPM2_CC_HIERCHANGEAUTH	= 0x0129,
>  	TPM2_CC_NV_DEFINE_SPACE	= 0x012a,
>  	TPM2_CC_PCR_SETAUTHPOL	= 0x012C,
> +	TPM2_CC_NV_WRITE	= 0x0137,
>  	TPM2_CC_DAM_RESET	= 0x0139,
>  	TPM2_CC_DAM_PARAMETERS	= 0x013A,
>  	TPM2_CC_NV_READ         = 0x014E,
> @@ -354,6 +355,20 @@ enum {
>  	TPM_MAX_BUF_SIZE	= 1260,
>  };
>  
> +enum {
> +	/* Secure storage for firmware settings */
> +	TPM_HT_PCR = 0,
> +	TPM_HT_NV_INDEX,
> +	TPM_HT_HMAC_SESSION,
> +	TPM_HT_POLICY_SESSION,
> +
> +	HR_SHIFT		= 24,
> +	HR_PCR			= TPM_HT_PCR << HR_SHIFT,
> +	HR_HMAC_SESSION		= TPM_HT_HMAC_SESSION << HR_SHIFT,
> +	HR_POLICY_SESSION	= TPM_HT_POLICY_SESSION << HR_SHIFT,
> +	HR_NV_INDEX		= TPM_HT_NV_INDEX << HR_SHIFT,
> +};
> +
>  /**
>   * Issue a TPM2_Startup command.
>   *
> @@ -418,6 +433,29 @@ u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
>  u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
>  		    const u8 *digest, u32 digest_len);
>  
> +/**
> + * Read data from the secure storage
> + *
> + * @dev		TPM device
> + * @index	Index of data to read
> + * @data	Place to put data
> + * @count	Number of bytes of data
> + * @return code of the operation
> + */
> +u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);
> +
> +/**
> + * Write data to the secure storage
> + *
> + * @dev		TPM device
> + * @index	Index of data to write
> + * @data	Data to write
> + * @count	Number of bytes of data
> + * @return code of the operation
> + */
> +u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
> +			u32 count);
> +
>  /**
>   * Issue a TPM2_PCR_Read command.
>   *
> diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
> index aea1dfb6ba0..7bf43264ab0 100644
> --- a/lib/tpm-v2.c
> +++ b/lib/tpm-v2.c
> @@ -170,6 +170,90 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
>  	return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
>  }
>  
> +u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
> +{
> +	u8 command_v2[COMMAND_BUFFER_SIZE] = {
> +		/* header 10 bytes */
> +		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
> +		tpm_u32(10 + 8 + 4 + 9 + 4),	/* Length */
> +		tpm_u32(TPM2_CC_NV_READ),	/* Command code */
> +
> +		/* handles 8 bytes */
> +		tpm_u32(TPM2_RH_PLATFORM),	/* Primary platform seed */
> +		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
> +
> +		/* AUTH_SESSION */
> +		tpm_u32(9),			/* Authorization size */
> +		tpm_u32(TPM2_RS_PW),		/* Session handle */
> +		tpm_u16(0),			/* Size of <nonce> */
> +						/* <nonce> (if any) */
> +		0,				/* Attributes: Cont/Excl/Rst */
> +		tpm_u16(0),			/* Size of <hmac/password> */
> +						/* <hmac/password> (if any) */
> +
> +		tpm_u16(count),			/* Number of bytes */
> +		tpm_u16(0),			/* Offset */
> +	};
> +	size_t response_len = COMMAND_BUFFER_SIZE;
> +	u8 response[COMMAND_BUFFER_SIZE];
> +	int ret;
> +	u16 tag;
> +	u32 size, code;
> +
> +	ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
> +	if (ret)
> +		return log_msg_ret("read", ret);
> +	if (unpack_byte_string(response, response_len, "wdds",
> +			       0, &tag, 2, &size, 6, &code,
> +			       16, data, count))
> +		return TPM_LIB_ERROR;
> +
> +	return 0;
> +}
> +
> +u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
> +			u32 count)
> +{
> +	struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
> +	uint offset = 10 + 8 + 4 + 9 + 2;
> +	uint len = offset + count + 2;
> +	/* Use empty password auth if platform hierarchy is disabled */
> +	u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index :
> +		TPM2_RH_PLATFORM;
> +	u8 command_v2[COMMAND_BUFFER_SIZE] = {
> +		/* header 10 bytes */
> +		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
> +		tpm_u32(len),			/* Length */
> +		tpm_u32(TPM2_CC_NV_WRITE),	/* Command code */
> +
> +		/* handles 8 bytes */
> +		tpm_u32(auth),			/* Primary platform seed */
> +		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
> +
> +		/* AUTH_SESSION */
> +		tpm_u32(9),			/* Authorization size */
> +		tpm_u32(TPM2_RS_PW),		/* Session handle */
> +		tpm_u16(0),			/* Size of <nonce> */
> +						/* <nonce> (if any) */
> +		0,				/* Attributes: Cont/Excl/Rst */
> +		tpm_u16(0),			/* Size of <hmac/password> */
> +						/* <hmac/password> (if any) */
> +
> +		tpm_u16(count),
> +	};
> +	size_t response_len = COMMAND_BUFFER_SIZE;
> +	u8 response[COMMAND_BUFFER_SIZE];
> +	int ret;
> +
> +	ret = pack_byte_string(command_v2, sizeof(command_v2), "sw",
> +			       offset, data, count,
> +			       offset + count, 0);
> +	if (ret)
> +		return TPM_LIB_ERROR;
> +
> +	return tpm_sendrecv_command(dev, command_v2, response, &response_len);
> +}
> +
>  u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
>  		  void *data, unsigned int *updates)
>  {
> diff --git a/lib/tpm_api.c b/lib/tpm_api.c
> index f1553512cc5..687fc8bc7ee 100644
> --- a/lib/tpm_api.c
> +++ b/lib/tpm_api.c
> @@ -118,7 +118,7 @@ u32 tpm_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
>  	if (is_tpm1(dev))
>  		return tpm1_nv_read_value(dev, index, data, count);
>  	else if (is_tpm2(dev))
> -		return -ENOSYS;
> +		return tpm2_nv_read_value(dev, index, data, count);
>  	else
>  		return -ENOSYS;
>  }
> @@ -129,7 +129,7 @@ u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data,
>  	if (is_tpm1(dev))
>  		return tpm1_nv_write_value(dev, index, data, count);
>  	else if (is_tpm2(dev))
> -		return -ENOSYS;
> +		return tpm2_nv_write_value(dev, index, data, count);
>  	else
>  		return -ENOSYS;
>  }
> -- 
> 2.30.0.280.ga3ce27912f-goog
> 
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
diff mbox series

Patch

diff --git a/include/tpm-common.h b/include/tpm-common.h
index e29b10b1766..080183779b3 100644
--- a/include/tpm-common.h
+++ b/include/tpm-common.h
@@ -53,6 +53,8 @@  enum tpm_version {
  * @buf:		Buffer used during the exchanges with the chip
  * @pcr_count:		Number of PCR per bank
  * @pcr_select_min:	Minimum size in bytes of the pcrSelect array
+ * @plat_hier_disabled:	Platform hierarchy has been disabled (TPM is locked
+ *			down until next reboot)
  */
 struct tpm_chip_priv {
 	enum tpm_version version;
@@ -64,6 +66,7 @@  struct tpm_chip_priv {
 	/* TPM v2 specific data */
 	uint pcr_count;
 	uint pcr_select_min;
+	bool plat_hier_disabled;
 };
 
 /**
diff --git a/include/tpm-v2.h b/include/tpm-v2.h
index 2766dc72a65..6a400771af1 100644
--- a/include/tpm-v2.h
+++ b/include/tpm-v2.h
@@ -240,6 +240,7 @@  enum tpm2_command_codes {
 	TPM2_CC_HIERCHANGEAUTH	= 0x0129,
 	TPM2_CC_NV_DEFINE_SPACE	= 0x012a,
 	TPM2_CC_PCR_SETAUTHPOL	= 0x012C,
+	TPM2_CC_NV_WRITE	= 0x0137,
 	TPM2_CC_DAM_RESET	= 0x0139,
 	TPM2_CC_DAM_PARAMETERS	= 0x013A,
 	TPM2_CC_NV_READ         = 0x014E,
@@ -354,6 +355,20 @@  enum {
 	TPM_MAX_BUF_SIZE	= 1260,
 };
 
+enum {
+	/* Secure storage for firmware settings */
+	TPM_HT_PCR = 0,
+	TPM_HT_NV_INDEX,
+	TPM_HT_HMAC_SESSION,
+	TPM_HT_POLICY_SESSION,
+
+	HR_SHIFT		= 24,
+	HR_PCR			= TPM_HT_PCR << HR_SHIFT,
+	HR_HMAC_SESSION		= TPM_HT_HMAC_SESSION << HR_SHIFT,
+	HR_POLICY_SESSION	= TPM_HT_POLICY_SESSION << HR_SHIFT,
+	HR_NV_INDEX		= TPM_HT_NV_INDEX << HR_SHIFT,
+};
+
 /**
  * Issue a TPM2_Startup command.
  *
@@ -418,6 +433,29 @@  u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
 u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
 		    const u8 *digest, u32 digest_len);
 
+/**
+ * Read data from the secure storage
+ *
+ * @dev		TPM device
+ * @index	Index of data to read
+ * @data	Place to put data
+ * @count	Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);
+
+/**
+ * Write data to the secure storage
+ *
+ * @dev		TPM device
+ * @index	Index of data to write
+ * @data	Data to write
+ * @count	Number of bytes of data
+ * @return code of the operation
+ */
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+			u32 count);
+
 /**
  * Issue a TPM2_PCR_Read command.
  *
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index aea1dfb6ba0..7bf43264ab0 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -170,6 +170,90 @@  u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
 	return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 }
 
+u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
+{
+	u8 command_v2[COMMAND_BUFFER_SIZE] = {
+		/* header 10 bytes */
+		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
+		tpm_u32(10 + 8 + 4 + 9 + 4),	/* Length */
+		tpm_u32(TPM2_CC_NV_READ),	/* Command code */
+
+		/* handles 8 bytes */
+		tpm_u32(TPM2_RH_PLATFORM),	/* Primary platform seed */
+		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
+
+		/* AUTH_SESSION */
+		tpm_u32(9),			/* Authorization size */
+		tpm_u32(TPM2_RS_PW),		/* Session handle */
+		tpm_u16(0),			/* Size of <nonce> */
+						/* <nonce> (if any) */
+		0,				/* Attributes: Cont/Excl/Rst */
+		tpm_u16(0),			/* Size of <hmac/password> */
+						/* <hmac/password> (if any) */
+
+		tpm_u16(count),			/* Number of bytes */
+		tpm_u16(0),			/* Offset */
+	};
+	size_t response_len = COMMAND_BUFFER_SIZE;
+	u8 response[COMMAND_BUFFER_SIZE];
+	int ret;
+	u16 tag;
+	u32 size, code;
+
+	ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+	if (ret)
+		return log_msg_ret("read", ret);
+	if (unpack_byte_string(response, response_len, "wdds",
+			       0, &tag, 2, &size, 6, &code,
+			       16, data, count))
+		return TPM_LIB_ERROR;
+
+	return 0;
+}
+
+u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
+			u32 count)
+{
+	struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
+	uint offset = 10 + 8 + 4 + 9 + 2;
+	uint len = offset + count + 2;
+	/* Use empty password auth if platform hierarchy is disabled */
+	u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index :
+		TPM2_RH_PLATFORM;
+	u8 command_v2[COMMAND_BUFFER_SIZE] = {
+		/* header 10 bytes */
+		tpm_u16(TPM2_ST_SESSIONS),	/* TAG */
+		tpm_u32(len),			/* Length */
+		tpm_u32(TPM2_CC_NV_WRITE),	/* Command code */
+
+		/* handles 8 bytes */
+		tpm_u32(auth),			/* Primary platform seed */
+		tpm_u32(HR_NV_INDEX + index),	/* Password authorisation */
+
+		/* AUTH_SESSION */
+		tpm_u32(9),			/* Authorization size */
+		tpm_u32(TPM2_RS_PW),		/* Session handle */
+		tpm_u16(0),			/* Size of <nonce> */
+						/* <nonce> (if any) */
+		0,				/* Attributes: Cont/Excl/Rst */
+		tpm_u16(0),			/* Size of <hmac/password> */
+						/* <hmac/password> (if any) */
+
+		tpm_u16(count),
+	};
+	size_t response_len = COMMAND_BUFFER_SIZE;
+	u8 response[COMMAND_BUFFER_SIZE];
+	int ret;
+
+	ret = pack_byte_string(command_v2, sizeof(command_v2), "sw",
+			       offset, data, count,
+			       offset + count, 0);
+	if (ret)
+		return TPM_LIB_ERROR;
+
+	return tpm_sendrecv_command(dev, command_v2, response, &response_len);
+}
+
 u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
 		  void *data, unsigned int *updates)
 {
diff --git a/lib/tpm_api.c b/lib/tpm_api.c
index f1553512cc5..687fc8bc7ee 100644
--- a/lib/tpm_api.c
+++ b/lib/tpm_api.c
@@ -118,7 +118,7 @@  u32 tpm_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
 	if (is_tpm1(dev))
 		return tpm1_nv_read_value(dev, index, data, count);
 	else if (is_tpm2(dev))
-		return -ENOSYS;
+		return tpm2_nv_read_value(dev, index, data, count);
 	else
 		return -ENOSYS;
 }
@@ -129,7 +129,7 @@  u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data,
 	if (is_tpm1(dev))
 		return tpm1_nv_write_value(dev, index, data, count);
 	else if (is_tpm2(dev))
-		return -ENOSYS;
+		return tpm2_nv_write_value(dev, index, data, count);
 	else
 		return -ENOSYS;
 }