| Message ID | 20211118061751.3334620-3-ruchika.gupta@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | [1/3] efi_loader: Add check for event log passed from firmware | expand |
Hi Ruchika, [...] > - void *data, unsigned int *updates); > + u32 algorithm, void *data, u32 digest_len, This goes into a tpm_u16() call. It doesn't break anything currently, but shouldn't we define this as u16 ? > + unsigned int *updates); > > /** > * Issue a TPM2_GetCapability command. This implementation is limited > diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c > index 235f8c20d4..9f86eab814 100644 > --- a/lib/tpm-v2.c > +++ b/lib/tpm-v2.c > @@ -254,7 +254,8 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data, > } > > u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, > - void *data, unsigned int *updates) > + u32 algorithm, void *data, u32 digest_len, > + unsigned int *updates) > { > u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8)); > u8 command_v2[COMMAND_BUFFER_SIZE] = { > @@ -264,7 +265,7 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, > > /* TPML_PCR_SELECTION */ > tpm_u32(1), /* Number of selections */ > - tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */ > + tpm_u16(algorithm), /* Algorithm of the hash */ > idx_array_sz, /* Array size for selection */ > /* bitmap(idx) Selected PCR bitmap */ > }; > @@ -283,10 +284,13 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, > if (ret) > return ret; > > + if (digest_len > response_len) > + return TPM_LIB_ERROR; > + > if (unpack_byte_string(response, response_len, "ds", > 10, &counter, > - response_len - TPM2_DIGEST_LEN, data, > - TPM2_DIGEST_LEN)) > + response_len - digest_len, data, > + digest_len)) > return TPM_LIB_ERROR; > > if (updates) > -- > 2.25.1 > Cheers /Ilias
diff --git a/cmd/tpm-v2.c b/cmd/tpm-v2.c index daae91100a..4ea5f9f094 100644 --- a/cmd/tpm-v2.c +++ b/cmd/tpm-v2.c @@ -151,7 +151,8 @@ static int do_tpm_pcr_read(struct cmd_tbl *cmdtp, int flag, int argc, data = map_sysmem(simple_strtoul(argv[2], NULL, 0), 0); - rc = tpm2_pcr_read(dev, index, priv->pcr_select_min, data, &updates); + rc = tpm2_pcr_read(dev, index, priv->pcr_select_min, TPM2_ALG_SHA256, + data, TPM2_DIGEST_LEN, &updates); if (!rc) { printf("PCR #%u content (%u known updates):\n", index, updates); print_byte_string(data, TPM2_DIGEST_LEN); diff --git a/include/tpm-v2.h b/include/tpm-v2.h index e6b68769f3..07dfaa64fb 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -518,7 +518,8 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data, * @return code of the operation */ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, - void *data, unsigned int *updates); + u32 algorithm, void *data, u32 digest_len, + unsigned int *updates); /** * Issue a TPM2_GetCapability command. This implementation is limited diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index 235f8c20d4..9f86eab814 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -254,7 +254,8 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data, } u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, - void *data, unsigned int *updates) + u32 algorithm, void *data, u32 digest_len, + unsigned int *updates) { u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8)); u8 command_v2[COMMAND_BUFFER_SIZE] = { @@ -264,7 +265,7 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, /* TPML_PCR_SELECTION */ tpm_u32(1), /* Number of selections */ - tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */ + tpm_u16(algorithm), /* Algorithm of the hash */ idx_array_sz, /* Array size for selection */ /* bitmap(idx) Selected PCR bitmap */ }; @@ -283,10 +284,13 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, if (ret) return ret; + if (digest_len > response_len) + return TPM_LIB_ERROR; + if (unpack_byte_string(response, response_len, "ds", 10, &counter, - response_len - TPM2_DIGEST_LEN, data, - TPM2_DIGEST_LEN)) + response_len - digest_len, data, + digest_len)) return TPM_LIB_ERROR; if (updates)
The current tpm2_pcr_read is hardcoded using SHA256. Make the actual command to TPM configurable to use wider range of algorithms. The current command line is kept as is i.e limited to SHA-256 only. Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org> --- cmd/tpm-v2.c | 3 ++- include/tpm-v2.h | 3 ++- lib/tpm-v2.c | 12 ++++++++---- 3 files changed, 12 insertions(+), 6 deletions(-)