Hi Simon,
On Mon, Dec 5, 2016 at 7:24 AM, Simon Glass <s...@chromium.org> wrote:
> On 1 December 2016 at 01:42, Stefan Roese <s...@denx.de> wrote:
>> (Adding Simon to Cc)
>>
>> On 23.11.2016 16:12, Mario Six wrote:
>>>
>>> This patch adds a function to the TPM library, which allows U-Boot to
>>> flush resources, e.g. keys, from the TPM.
>>>
>>> Signed-off-by: Mario Six <mario....@gdsys.cc>
>>
>>
>> Simon, do you have any comments on this patch please?
>
> Reviewed-by: Simon Glass <s...@chromium.org>
>
> Is it possible to add a new tpm subcommand for this?
>
OK, I'll add a "tpm flush" command in v2.
>>
>>
>>> ---
>>> board/gdsys/p1022/controlcenterd-id.c | 9 -------
>>> include/tpm.h | 45
>>> +++++++++++++++++++++++++++++++++++
>>> lib/tpm.c | 28 ++++++++++++++++++++++
>>> 3 files changed, 73 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/board/gdsys/p1022/controlcenterd-id.c
>>> b/board/gdsys/p1022/controlcenterd-id.c
>>> index 2c6c698..1648f13 100644
>>> --- a/board/gdsys/p1022/controlcenterd-id.c
>>> +++ b/board/gdsys/p1022/controlcenterd-id.c
>>> @@ -43,15 +43,6 @@
>>> #define CCDM_AUTO_FIRST_STAGE
>>> #endif
>>>
>>> -/* enums from TCG specs */
>>> -enum {
>>> - /* capability areas */
>>> - TPM_CAP_NV_INDEX = 0x00000011,
>>> - TPM_CAP_HANDLE = 0x00000014,
>>> - /* resource types */
>>> - TPM_RT_KEY = 0x00000001,
>>> -};
>>> -
>>> /* CCDM specific contants */
>>> enum {
>>> /* NV indices */
>>> diff --git a/include/tpm.h b/include/tpm.h
>>> index 9a6585d..800f29c 100644
>>> --- a/include/tpm.h
>>> +++ b/include/tpm.h
>>> @@ -47,6 +47,42 @@ enum tpm_nv_index {
>>> TPM_NV_INDEX_DIR = 0x10000001,
>>> };
>>>
>>> +enum tpm_resource_type {
>>> + TPM_RT_KEY = 0x00000001,
>>> + TPM_RT_AUTH = 0x00000002,
>>> + TPM_RT_HASH = 0x00000003,
>>> + TPM_RT_TRANS = 0x00000004,
>>> + TPM_RT_CONTEXT = 0x00000005,
>>> + TPM_RT_COUNTER = 0x00000006,
>>> + TPM_RT_DELEGATE = 0x00000007,
>>> + TPM_RT_DAA_TPM = 0x00000008,
>>> + TPM_RT_DAA_V0 = 0x00000009,
>>> + TPM_RT_DAA_V1 = 0x0000000A,
>>> +};
>>> +
>>> +enum tpm_capability_areas {
>>> + TPM_CAP_ORD = 0x00000001,
>>> + TPM_CAP_ALG = 0x00000002,
>>> + TPM_CAP_PID = 0x00000003,
>>> + TPM_CAP_FLAG = 0x00000004,
>>> + TPM_CAP_PROPERTY = 0x00000005,
>>> + TPM_CAP_VERSION = 0x00000006,
>>> + TPM_CAP_KEY_HANDLE = 0x00000007,
>>> + TPM_CAP_CHECK_LOADED = 0x00000008,
>>> + TPM_CAP_SYM_MODE = 0x00000009,
>>> + TPM_CAP_KEY_STATUS = 0x0000000C,
>>> + TPM_CAP_NV_LIST = 0x0000000D,
>>> + TPM_CAP_MFR = 0x00000010,
>>> + TPM_CAP_NV_INDEX = 0x00000011,
>>> + TPM_CAP_TRANS_ALG = 0x00000012,
>>> + TPM_CAP_HANDLE = 0x00000014,
>>> + TPM_CAP_TRANS_ES = 0x00000015,
>>> + TPM_CAP_AUTH_ENCRYPT = 0x00000017,
>>> + TPM_CAP_SELECT_SIZE = 0x00000018,
>>> + TPM_CAP_DA_LOGIC = 0x00000019,
>>> + TPM_CAP_VERSION_VAL = 0x0000001A,
>>> +};
>>> +
>>> #define TPM_NV_PER_GLOBALLOCK (1U << 15)
>>> #define TPM_NV_PER_PPWRITE (1U << 0)
>>> #define TPM_NV_PER_READ_STCLEAR (1U << 31)
>>> @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct
>>> tpm_permanent_flags *pflags);
>>> */
>>> uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm);
>>>
>>> +/**
>>> + * Flush a resource with a given handle and type from the TPM
>>> + *
>>> + * @param key_handle handle of the resource
>>> + * @param resource_type type of the resource
>>> + * @return return code of the operation
>>> + */
>>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type);
>>> +
>>> #endif /* __TPM_H */
>>> diff --git a/lib/tpm.c b/lib/tpm.c
>>> index 88f2406..98c20a0 100644
>>> --- a/lib/tpm.c
>>> +++ b/lib/tpm.c
>>> @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t
>>> *perm)
>>> return 0;
>>> }
>>>
>>> +uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type)
>>> +{
>>> + const uint8_t command[18] = {
>>> + 0x00, 0xc1, /* TPM_TAG */
>>> + 0x00, 0x00, 0x00, 0x12, /* parameter size */
>>> + 0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */
>>> + 0x00, 0x00, 0x00, 0x00, /* key handle */
>>> + 0x00, 0x00, 0x00, 0x00, /* resource type */
>>> + };
>>> + const size_t key_handle_offset = 10;
>>> + const size_t resource_type_offset = 14;
>>> +
>
> Drop blank line
>
Will be fixed in v2.
>>> + uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];
>>> + size_t response_length = sizeof(response);
>>> + uint32_t err;
>>> +
>>> + if (pack_byte_string(buf, sizeof(buf), "sdd",
>>> + 0, command, sizeof(command),
>>> + key_handle_offset, key_handle,
>>> + resource_type_offset, resource_type))
>>> + return TPM_LIB_ERROR;
>>> +
>>> + err = tpm_sendrecv_command(buf, response, &response_length);
>>> + if (err)
>>> + return err;
>>> + return 0;
>>> +}
>>> +
>>> #ifdef CONFIG_TPM_AUTH_SESSIONS
>>>
>>> /**
>>>
>>
>> Thanks,
>> Stefan
>
> Regards,
> Simon
>
Thanks for the review!
Best regards,
Mario
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot
