| Message ID | 93e3f747dd138fa1aef9d4b0663ab73f03a6498c.1479913469.git.mario.six@gdsys.cc |
|---|---|
| State | Superseded |
| Delegated to: | Stefan Roese |
| Headers | show |
(Adding Simon to Cc) On 23.11.2016 16:12, Mario Six wrote: > This patch adds a function to the TPM library, which allows U-Boot to > flush resources, e.g. keys, from the TPM. > > Signed-off-by: Mario Six <mario.six@gdsys.cc> Simon, do you have any comments on this patch please? > --- > board/gdsys/p1022/controlcenterd-id.c | 9 ------- > include/tpm.h | 45 +++++++++++++++++++++++++++++++++++ > lib/tpm.c | 28 ++++++++++++++++++++++ > 3 files changed, 73 insertions(+), 9 deletions(-) > > diff --git a/board/gdsys/p1022/controlcenterd-id.c b/board/gdsys/p1022/controlcenterd-id.c > index 2c6c698..1648f13 100644 > --- a/board/gdsys/p1022/controlcenterd-id.c > +++ b/board/gdsys/p1022/controlcenterd-id.c > @@ -43,15 +43,6 @@ > #define CCDM_AUTO_FIRST_STAGE > #endif > > -/* enums from TCG specs */ > -enum { > - /* capability areas */ > - TPM_CAP_NV_INDEX = 0x00000011, > - TPM_CAP_HANDLE = 0x00000014, > - /* resource types */ > - TPM_RT_KEY = 0x00000001, > -}; > - > /* CCDM specific contants */ > enum { > /* NV indices */ > diff --git a/include/tpm.h b/include/tpm.h > index 9a6585d..800f29c 100644 > --- a/include/tpm.h > +++ b/include/tpm.h > @@ -47,6 +47,42 @@ enum tpm_nv_index { > TPM_NV_INDEX_DIR = 0x10000001, > }; > > +enum tpm_resource_type { > + TPM_RT_KEY = 0x00000001, > + TPM_RT_AUTH = 0x00000002, > + TPM_RT_HASH = 0x00000003, > + TPM_RT_TRANS = 0x00000004, > + TPM_RT_CONTEXT = 0x00000005, > + TPM_RT_COUNTER = 0x00000006, > + TPM_RT_DELEGATE = 0x00000007, > + TPM_RT_DAA_TPM = 0x00000008, > + TPM_RT_DAA_V0 = 0x00000009, > + TPM_RT_DAA_V1 = 0x0000000A, > +}; > + > +enum tpm_capability_areas { > + TPM_CAP_ORD = 0x00000001, > + TPM_CAP_ALG = 0x00000002, > + TPM_CAP_PID = 0x00000003, > + TPM_CAP_FLAG = 0x00000004, > + TPM_CAP_PROPERTY = 0x00000005, > + TPM_CAP_VERSION = 0x00000006, > + TPM_CAP_KEY_HANDLE = 0x00000007, > + TPM_CAP_CHECK_LOADED = 0x00000008, > + TPM_CAP_SYM_MODE = 0x00000009, > + TPM_CAP_KEY_STATUS = 0x0000000C, > + TPM_CAP_NV_LIST = 0x0000000D, > + TPM_CAP_MFR = 0x00000010, > + TPM_CAP_NV_INDEX = 0x00000011, > + TPM_CAP_TRANS_ALG = 0x00000012, > + TPM_CAP_HANDLE = 0x00000014, > + TPM_CAP_TRANS_ES = 0x00000015, > + TPM_CAP_AUTH_ENCRYPT = 0x00000017, > + TPM_CAP_SELECT_SIZE = 0x00000018, > + TPM_CAP_DA_LOGIC = 0x00000019, > + TPM_CAP_VERSION_VAL = 0x0000001A, > +}; > + > #define TPM_NV_PER_GLOBALLOCK (1U << 15) > #define TPM_NV_PER_PPWRITE (1U << 0) > #define TPM_NV_PER_READ_STCLEAR (1U << 31) > @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct tpm_permanent_flags *pflags); > */ > uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm); > > +/** > + * Flush a resource with a given handle and type from the TPM > + * > + * @param key_handle handle of the resource > + * @param resource_type type of the resource > + * @return return code of the operation > + */ > +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type); > + > #endif /* __TPM_H */ > diff --git a/lib/tpm.c b/lib/tpm.c > index 88f2406..98c20a0 100644 > --- a/lib/tpm.c > +++ b/lib/tpm.c > @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm) > return 0; > } > > +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type) > +{ > + const uint8_t command[18] = { > + 0x00, 0xc1, /* TPM_TAG */ > + 0x00, 0x00, 0x00, 0x12, /* parameter size */ > + 0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */ > + 0x00, 0x00, 0x00, 0x00, /* key handle */ > + 0x00, 0x00, 0x00, 0x00, /* resource type */ > + }; > + const size_t key_handle_offset = 10; > + const size_t resource_type_offset = 14; > + > + uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE]; > + size_t response_length = sizeof(response); > + uint32_t err; > + > + if (pack_byte_string(buf, sizeof(buf), "sdd", > + 0, command, sizeof(command), > + key_handle_offset, key_handle, > + resource_type_offset, resource_type)) > + return TPM_LIB_ERROR; > + > + err = tpm_sendrecv_command(buf, response, &response_length); > + if (err) > + return err; > + return 0; > +} > + > #ifdef CONFIG_TPM_AUTH_SESSIONS > > /** > Thanks, Stefan
On 1 December 2016 at 01:42, Stefan Roese <sr@denx.de> wrote: > (Adding Simon to Cc) > > On 23.11.2016 16:12, Mario Six wrote: >> >> This patch adds a function to the TPM library, which allows U-Boot to >> flush resources, e.g. keys, from the TPM. >> >> Signed-off-by: Mario Six <mario.six@gdsys.cc> > > > Simon, do you have any comments on this patch please? Reviewed-by: Simon Glass <sjg@chromium.org> Is it possible to add a new tpm subcommand for this? > > >> --- >> board/gdsys/p1022/controlcenterd-id.c | 9 ------- >> include/tpm.h | 45 >> +++++++++++++++++++++++++++++++++++ >> lib/tpm.c | 28 ++++++++++++++++++++++ >> 3 files changed, 73 insertions(+), 9 deletions(-) >> >> diff --git a/board/gdsys/p1022/controlcenterd-id.c >> b/board/gdsys/p1022/controlcenterd-id.c >> index 2c6c698..1648f13 100644 >> --- a/board/gdsys/p1022/controlcenterd-id.c >> +++ b/board/gdsys/p1022/controlcenterd-id.c >> @@ -43,15 +43,6 @@ >> #define CCDM_AUTO_FIRST_STAGE >> #endif >> >> -/* enums from TCG specs */ >> -enum { >> - /* capability areas */ >> - TPM_CAP_NV_INDEX = 0x00000011, >> - TPM_CAP_HANDLE = 0x00000014, >> - /* resource types */ >> - TPM_RT_KEY = 0x00000001, >> -}; >> - >> /* CCDM specific contants */ >> enum { >> /* NV indices */ >> diff --git a/include/tpm.h b/include/tpm.h >> index 9a6585d..800f29c 100644 >> --- a/include/tpm.h >> +++ b/include/tpm.h >> @@ -47,6 +47,42 @@ enum tpm_nv_index { >> TPM_NV_INDEX_DIR = 0x10000001, >> }; >> >> +enum tpm_resource_type { >> + TPM_RT_KEY = 0x00000001, >> + TPM_RT_AUTH = 0x00000002, >> + TPM_RT_HASH = 0x00000003, >> + TPM_RT_TRANS = 0x00000004, >> + TPM_RT_CONTEXT = 0x00000005, >> + TPM_RT_COUNTER = 0x00000006, >> + TPM_RT_DELEGATE = 0x00000007, >> + TPM_RT_DAA_TPM = 0x00000008, >> + TPM_RT_DAA_V0 = 0x00000009, >> + TPM_RT_DAA_V1 = 0x0000000A, >> +}; >> + >> +enum tpm_capability_areas { >> + TPM_CAP_ORD = 0x00000001, >> + TPM_CAP_ALG = 0x00000002, >> + TPM_CAP_PID = 0x00000003, >> + TPM_CAP_FLAG = 0x00000004, >> + TPM_CAP_PROPERTY = 0x00000005, >> + TPM_CAP_VERSION = 0x00000006, >> + TPM_CAP_KEY_HANDLE = 0x00000007, >> + TPM_CAP_CHECK_LOADED = 0x00000008, >> + TPM_CAP_SYM_MODE = 0x00000009, >> + TPM_CAP_KEY_STATUS = 0x0000000C, >> + TPM_CAP_NV_LIST = 0x0000000D, >> + TPM_CAP_MFR = 0x00000010, >> + TPM_CAP_NV_INDEX = 0x00000011, >> + TPM_CAP_TRANS_ALG = 0x00000012, >> + TPM_CAP_HANDLE = 0x00000014, >> + TPM_CAP_TRANS_ES = 0x00000015, >> + TPM_CAP_AUTH_ENCRYPT = 0x00000017, >> + TPM_CAP_SELECT_SIZE = 0x00000018, >> + TPM_CAP_DA_LOGIC = 0x00000019, >> + TPM_CAP_VERSION_VAL = 0x0000001A, >> +}; >> + >> #define TPM_NV_PER_GLOBALLOCK (1U << 15) >> #define TPM_NV_PER_PPWRITE (1U << 0) >> #define TPM_NV_PER_READ_STCLEAR (1U << 31) >> @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct >> tpm_permanent_flags *pflags); >> */ >> uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm); >> >> +/** >> + * Flush a resource with a given handle and type from the TPM >> + * >> + * @param key_handle handle of the resource >> + * @param resource_type type of the resource >> + * @return return code of the operation >> + */ >> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type); >> + >> #endif /* __TPM_H */ >> diff --git a/lib/tpm.c b/lib/tpm.c >> index 88f2406..98c20a0 100644 >> --- a/lib/tpm.c >> +++ b/lib/tpm.c >> @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t >> *perm) >> return 0; >> } >> >> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type) >> +{ >> + const uint8_t command[18] = { >> + 0x00, 0xc1, /* TPM_TAG */ >> + 0x00, 0x00, 0x00, 0x12, /* parameter size */ >> + 0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */ >> + 0x00, 0x00, 0x00, 0x00, /* key handle */ >> + 0x00, 0x00, 0x00, 0x00, /* resource type */ >> + }; >> + const size_t key_handle_offset = 10; >> + const size_t resource_type_offset = 14; >> + Drop blank line >> + uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE]; >> + size_t response_length = sizeof(response); >> + uint32_t err; >> + >> + if (pack_byte_string(buf, sizeof(buf), "sdd", >> + 0, command, sizeof(command), >> + key_handle_offset, key_handle, >> + resource_type_offset, resource_type)) >> + return TPM_LIB_ERROR; >> + >> + err = tpm_sendrecv_command(buf, response, &response_length); >> + if (err) >> + return err; >> + return 0; >> +} >> + >> #ifdef CONFIG_TPM_AUTH_SESSIONS >> >> /** >> > > Thanks, > Stefan Regards, Simon
Hi Simon, On Mon, Dec 5, 2016 at 7:24 AM, Simon Glass <sjg@chromium.org> wrote: > On 1 December 2016 at 01:42, Stefan Roese <sr@denx.de> wrote: >> (Adding Simon to Cc) >> >> On 23.11.2016 16:12, Mario Six wrote: >>> >>> This patch adds a function to the TPM library, which allows U-Boot to >>> flush resources, e.g. keys, from the TPM. >>> >>> Signed-off-by: Mario Six <mario.six@gdsys.cc> >> >> >> Simon, do you have any comments on this patch please? > > Reviewed-by: Simon Glass <sjg@chromium.org> > > Is it possible to add a new tpm subcommand for this? > OK, I'll add a "tpm flush" command in v2. >> >> >>> --- >>> board/gdsys/p1022/controlcenterd-id.c | 9 ------- >>> include/tpm.h | 45 >>> +++++++++++++++++++++++++++++++++++ >>> lib/tpm.c | 28 ++++++++++++++++++++++ >>> 3 files changed, 73 insertions(+), 9 deletions(-) >>> >>> diff --git a/board/gdsys/p1022/controlcenterd-id.c >>> b/board/gdsys/p1022/controlcenterd-id.c >>> index 2c6c698..1648f13 100644 >>> --- a/board/gdsys/p1022/controlcenterd-id.c >>> +++ b/board/gdsys/p1022/controlcenterd-id.c >>> @@ -43,15 +43,6 @@ >>> #define CCDM_AUTO_FIRST_STAGE >>> #endif >>> >>> -/* enums from TCG specs */ >>> -enum { >>> - /* capability areas */ >>> - TPM_CAP_NV_INDEX = 0x00000011, >>> - TPM_CAP_HANDLE = 0x00000014, >>> - /* resource types */ >>> - TPM_RT_KEY = 0x00000001, >>> -}; >>> - >>> /* CCDM specific contants */ >>> enum { >>> /* NV indices */ >>> diff --git a/include/tpm.h b/include/tpm.h >>> index 9a6585d..800f29c 100644 >>> --- a/include/tpm.h >>> +++ b/include/tpm.h >>> @@ -47,6 +47,42 @@ enum tpm_nv_index { >>> TPM_NV_INDEX_DIR = 0x10000001, >>> }; >>> >>> +enum tpm_resource_type { >>> + TPM_RT_KEY = 0x00000001, >>> + TPM_RT_AUTH = 0x00000002, >>> + TPM_RT_HASH = 0x00000003, >>> + TPM_RT_TRANS = 0x00000004, >>> + TPM_RT_CONTEXT = 0x00000005, >>> + TPM_RT_COUNTER = 0x00000006, >>> + TPM_RT_DELEGATE = 0x00000007, >>> + TPM_RT_DAA_TPM = 0x00000008, >>> + TPM_RT_DAA_V0 = 0x00000009, >>> + TPM_RT_DAA_V1 = 0x0000000A, >>> +}; >>> + >>> +enum tpm_capability_areas { >>> + TPM_CAP_ORD = 0x00000001, >>> + TPM_CAP_ALG = 0x00000002, >>> + TPM_CAP_PID = 0x00000003, >>> + TPM_CAP_FLAG = 0x00000004, >>> + TPM_CAP_PROPERTY = 0x00000005, >>> + TPM_CAP_VERSION = 0x00000006, >>> + TPM_CAP_KEY_HANDLE = 0x00000007, >>> + TPM_CAP_CHECK_LOADED = 0x00000008, >>> + TPM_CAP_SYM_MODE = 0x00000009, >>> + TPM_CAP_KEY_STATUS = 0x0000000C, >>> + TPM_CAP_NV_LIST = 0x0000000D, >>> + TPM_CAP_MFR = 0x00000010, >>> + TPM_CAP_NV_INDEX = 0x00000011, >>> + TPM_CAP_TRANS_ALG = 0x00000012, >>> + TPM_CAP_HANDLE = 0x00000014, >>> + TPM_CAP_TRANS_ES = 0x00000015, >>> + TPM_CAP_AUTH_ENCRYPT = 0x00000017, >>> + TPM_CAP_SELECT_SIZE = 0x00000018, >>> + TPM_CAP_DA_LOGIC = 0x00000019, >>> + TPM_CAP_VERSION_VAL = 0x0000001A, >>> +}; >>> + >>> #define TPM_NV_PER_GLOBALLOCK (1U << 15) >>> #define TPM_NV_PER_PPWRITE (1U << 0) >>> #define TPM_NV_PER_READ_STCLEAR (1U << 31) >>> @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct >>> tpm_permanent_flags *pflags); >>> */ >>> uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm); >>> >>> +/** >>> + * Flush a resource with a given handle and type from the TPM >>> + * >>> + * @param key_handle handle of the resource >>> + * @param resource_type type of the resource >>> + * @return return code of the operation >>> + */ >>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type); >>> + >>> #endif /* __TPM_H */ >>> diff --git a/lib/tpm.c b/lib/tpm.c >>> index 88f2406..98c20a0 100644 >>> --- a/lib/tpm.c >>> +++ b/lib/tpm.c >>> @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t >>> *perm) >>> return 0; >>> } >>> >>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type) >>> +{ >>> + const uint8_t command[18] = { >>> + 0x00, 0xc1, /* TPM_TAG */ >>> + 0x00, 0x00, 0x00, 0x12, /* parameter size */ >>> + 0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */ >>> + 0x00, 0x00, 0x00, 0x00, /* key handle */ >>> + 0x00, 0x00, 0x00, 0x00, /* resource type */ >>> + }; >>> + const size_t key_handle_offset = 10; >>> + const size_t resource_type_offset = 14; >>> + > > Drop blank line > Will be fixed in v2. >>> + uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE]; >>> + size_t response_length = sizeof(response); >>> + uint32_t err; >>> + >>> + if (pack_byte_string(buf, sizeof(buf), "sdd", >>> + 0, command, sizeof(command), >>> + key_handle_offset, key_handle, >>> + resource_type_offset, resource_type)) >>> + return TPM_LIB_ERROR; >>> + >>> + err = tpm_sendrecv_command(buf, response, &response_length); >>> + if (err) >>> + return err; >>> + return 0; >>> +} >>> + >>> #ifdef CONFIG_TPM_AUTH_SESSIONS >>> >>> /** >>> >> >> Thanks, >> Stefan > > Regards, > Simon > Thanks for the review! Best regards, Mario
diff --git a/board/gdsys/p1022/controlcenterd-id.c b/board/gdsys/p1022/controlcenterd-id.c index 2c6c698..1648f13 100644 --- a/board/gdsys/p1022/controlcenterd-id.c +++ b/board/gdsys/p1022/controlcenterd-id.c @@ -43,15 +43,6 @@ #define CCDM_AUTO_FIRST_STAGE #endif -/* enums from TCG specs */ -enum { - /* capability areas */ - TPM_CAP_NV_INDEX = 0x00000011, - TPM_CAP_HANDLE = 0x00000014, - /* resource types */ - TPM_RT_KEY = 0x00000001, -}; - /* CCDM specific contants */ enum { /* NV indices */ diff --git a/include/tpm.h b/include/tpm.h index 9a6585d..800f29c 100644 --- a/include/tpm.h +++ b/include/tpm.h @@ -47,6 +47,42 @@ enum tpm_nv_index { TPM_NV_INDEX_DIR = 0x10000001, }; +enum tpm_resource_type { + TPM_RT_KEY = 0x00000001, + TPM_RT_AUTH = 0x00000002, + TPM_RT_HASH = 0x00000003, + TPM_RT_TRANS = 0x00000004, + TPM_RT_CONTEXT = 0x00000005, + TPM_RT_COUNTER = 0x00000006, + TPM_RT_DELEGATE = 0x00000007, + TPM_RT_DAA_TPM = 0x00000008, + TPM_RT_DAA_V0 = 0x00000009, + TPM_RT_DAA_V1 = 0x0000000A, +}; + +enum tpm_capability_areas { + TPM_CAP_ORD = 0x00000001, + TPM_CAP_ALG = 0x00000002, + TPM_CAP_PID = 0x00000003, + TPM_CAP_FLAG = 0x00000004, + TPM_CAP_PROPERTY = 0x00000005, + TPM_CAP_VERSION = 0x00000006, + TPM_CAP_KEY_HANDLE = 0x00000007, + TPM_CAP_CHECK_LOADED = 0x00000008, + TPM_CAP_SYM_MODE = 0x00000009, + TPM_CAP_KEY_STATUS = 0x0000000C, + TPM_CAP_NV_LIST = 0x0000000D, + TPM_CAP_MFR = 0x00000010, + TPM_CAP_NV_INDEX = 0x00000011, + TPM_CAP_TRANS_ALG = 0x00000012, + TPM_CAP_HANDLE = 0x00000014, + TPM_CAP_TRANS_ES = 0x00000015, + TPM_CAP_AUTH_ENCRYPT = 0x00000017, + TPM_CAP_SELECT_SIZE = 0x00000018, + TPM_CAP_DA_LOGIC = 0x00000019, + TPM_CAP_VERSION_VAL = 0x0000001A, +}; + #define TPM_NV_PER_GLOBALLOCK (1U << 15) #define TPM_NV_PER_PPWRITE (1U << 0) #define TPM_NV_PER_READ_STCLEAR (1U << 31) @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct tpm_permanent_flags *pflags); */ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm); +/** + * Flush a resource with a given handle and type from the TPM + * + * @param key_handle handle of the resource + * @param resource_type type of the resource + * @return return code of the operation + */ +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type); + #endif /* __TPM_H */ diff --git a/lib/tpm.c b/lib/tpm.c index 88f2406..98c20a0 100644 --- a/lib/tpm.c +++ b/lib/tpm.c @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm) return 0; } +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type) +{ + const uint8_t command[18] = { + 0x00, 0xc1, /* TPM_TAG */ + 0x00, 0x00, 0x00, 0x12, /* parameter size */ + 0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */ + 0x00, 0x00, 0x00, 0x00, /* key handle */ + 0x00, 0x00, 0x00, 0x00, /* resource type */ + }; + const size_t key_handle_offset = 10; + const size_t resource_type_offset = 14; + + uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE]; + size_t response_length = sizeof(response); + uint32_t err; + + if (pack_byte_string(buf, sizeof(buf), "sdd", + 0, command, sizeof(command), + key_handle_offset, key_handle, + resource_type_offset, resource_type)) + return TPM_LIB_ERROR; + + err = tpm_sendrecv_command(buf, response, &response_length); + if (err) + return err; + return 0; +} + #ifdef CONFIG_TPM_AUTH_SESSIONS /**
This patch adds a function to the TPM library, which allows U-Boot to flush resources, e.g. keys, from the TPM. Signed-off-by: Mario Six <mario.six@gdsys.cc> --- board/gdsys/p1022/controlcenterd-id.c | 9 ------- include/tpm.h | 45 +++++++++++++++++++++++++++++++++++ lib/tpm.c | 28 ++++++++++++++++++++++ 3 files changed, 73 insertions(+), 9 deletions(-)