From patchwork Thu Nov 5 21:58:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 320692 Delivered-To: patch@linaro.org Received: by 2002:a92:7b12:0:0:0:0:0 with SMTP id w18csp807172ilc; Thu, 5 Nov 2020 13:59:00 -0800 (PST) X-Google-Smtp-Source: ABdhPJxKljBcykBfy/Es4lK4pQn1+Wl6ggHfMkAFNKIQ1Ikbvyk2GGgtDBJVt3rVfDkJeeKDXfNg X-Received: by 2002:a05:6402:195:: with SMTP id r21mr4721342edv.164.1604613540450; Thu, 05 Nov 2020 13:59:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604613540; cv=none; d=google.com; s=arc-20160816; b=uPojzOQuxQat63D4ZPOBhWVE52PaRGwSqbivf1JbAk5vJGZG9OmVNyel55vB8pOsQ3 LzmzjLlxVJAd0gyfPm3TeXpHbKTaZ0+pbx7lMFTNQCqJjHagesEtScktSHM9WyXKkX/N pk3BmpDzksNvng6+JtriUN1969q0RpvH9vgeNu8/jWKxzvrwZeKbQYzyoG+xtZY5k436 6K4ByONceTBQEhGPF8HZ/n3oP1+UNN4xhLnXYnHfhE62e+nvtSKwWe309VfyEnUu5TSw HXIDsJRh2BtStHytNvFcTa4t4xjkyDLFqqPhb35jYedVxT/cYi552Qo2FVP1l7ipa31v Ub7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=vxiDkTZMvfvWGtZAeZBENIR8sbr+ypoN8IsIedLSNq0=; b=vImNZnxr1G2r4TW52Tm4UXgbAIMuvZRdfrOPeDlyOdh5E/g2DgrpEQbQD/JUBe50UW lYz+G7qnworNgxSpmQ6/4NSbyyj/Wq1Tblwr5M+o4DwzaOJbRKTDHqWwYX1HBwzxPb4Y z5CNDxa9BxyxSwuHl7N508jpG88Lrq07z4DbvVLz3J44t/J2K1OJPvrpagAsi3ACfbpQ nDQl4JvuwBXyNOzkSWXASjn5k1vggGaj6A4jSgFddGly3XI3GnM18L8y6xDP9F8ATcYB K0t1eGBZuJG23FrzLP5KW2UdIyTv2lE1SBVgS5566LFNmPNp88rNJxnDQYIsrvDsUCBQ 89Pg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=xvyoL32o; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id dn22si2306287edb.239.2020.11.05.13.58.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 13:59:00 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=xvyoL32o; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id E6EB2825C7; Thu, 5 Nov 2020 22:58:57 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="xvyoL32o"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 52F0A825C8; Thu, 5 Nov 2020 22:58:53 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ed1-x542.google.com (mail-ed1-x542.google.com [IPv6:2a00:1450:4864:20::542]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 49E9B825BE for ; Thu, 5 Nov 2020 22:58:50 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x542.google.com with SMTP id w1so3167399edv.11 for ; Thu, 05 Nov 2020 13:58:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=vxiDkTZMvfvWGtZAeZBENIR8sbr+ypoN8IsIedLSNq0=; b=xvyoL32ooWlHLBDQa2R0I2PQ8+hQmYhLgX/5DQNfrUASwXOyVwBw2zxmvcAxJ7AyVG gVas2Q5LINKan7dJOVbM2ExgQmDF3lYi8OUTUh3bInvt+U5oUAU5+U9tzrKKzxZ29NQm FtwEMHuDRJwnBFrlLAnzulRRc92Ptqt0A8IXisoxXIX9AGOg9rzlgkV/CKUgGAJinjbo 1WYSbHu3SZjgo15H5kA8rARqAg4jfCT6/uUiB3KIFDrfFX09qxlw8dw+2I7yMzB+A9Ps UI+dbesD2DtI1iZ3dxgAQI6uaFK3lYjRRDaHUnP9Pqs6NvjvRZb5eUp3s+7+Nb3rt1co kWWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=vxiDkTZMvfvWGtZAeZBENIR8sbr+ypoN8IsIedLSNq0=; b=jN9oucJZqPjt2AvnUkXwZeK/CSiRLHkhXbKwuxhNLFXG+6ebBPnh9P7czVP2HH5WpQ St82PlBmsXVeSLsXSolt0g/A+m9Y6wnbPMVQM7yCmXlwVL/1asFIGO3qaeUA45CGC95F FKVH26jyau+4YWFnrod5aXgPoZH5qhz24sRLmWg+2qE/wNFjr/wU10wbzRcaKRROuFzh BQmUJMXcoCz6kbeEm7P/XsiWXjISYfqq8m+BZFys/DUxmieUYqIGHskaTKJvguKXXARv HCAU0EqRDwBuCQWtMnFmjVdTTuQzxGZQ8G82Gr10uHfHvs1rnilb5MhxIaHmNt5Lb6k5 IbQw== X-Gm-Message-State: AOAM532Lzm2d5iM+j0MHNUacOGiGfqY535alF7+dF9ESCnc3ic1wtngn D8Ghf8hIcMWLK31SkH+rKbzshg== X-Received: by 2002:a05:6402:2d7:: with SMTP id b23mr4637926edx.196.1604613529461; Thu, 05 Nov 2020 13:58:49 -0800 (PST) Received: from apalos.home ([2a02:587:4615:c071:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id o1sm1744383ejc.81.2020.11.05.13.58.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 13:58:48 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: ard.biesheuvel@arm.com, Ilias Apalodimas , Alexander Graf , Miquel Raynal , Philippe Reynes , Simon Glass , Dhananjay Phadke , Bin Meng , u-boot@lists.denx.de Subject: [PATCH 1/3 v2] tpm: Change response length of tpm2_get_capability() Date: Thu, 5 Nov 2020 23:58:43 +0200 Message-Id: <20201105215846.1017178-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean For implementing the EFI_TCG2_PROTOCOL we need the count field returned by the TPM when reading capabilities via tpm2_get_capability(). Adjust the implementation of the 'tpm2 get_capability' command accordingly. Suggested-by: Heinrich Schuchardt Signed-off-by: Ilias Apalodimas --- Changes since v1: - Unconditionally get the extra 4 bytes on the response and account for them in do_tpm_get_capability() cmd/tpm-v2.c | 4 ++-- lib/tpm-v2.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) -- 2.29.2 Reviewed-by: Simon Glass diff --git a/cmd/tpm-v2.c b/cmd/tpm-v2.c index e6742656f578..5fa4788a72de 100644 --- a/cmd/tpm-v2.c +++ b/cmd/tpm-v2.c @@ -191,10 +191,10 @@ static int do_tpm_get_capability(struct cmd_tbl *cmdtp, int flag, int argc, for (i = 0; i < count; i++) { printf("Property 0x"); for (j = 0; j < 4; j++) - printf("%02x", data[(i * 8) + j]); + printf("%02x", data[(i * 8) + j + sizeof(u32)]); printf(": 0x"); for (j = 4; j < 8; j++) - printf("%02x", data[(i * 8) + j]); + printf("%02x", data[(i * 8) + j + sizeof(u32)]); printf("\n"); } diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c index a4c352e3ef75..91759068cf03 100644 --- a/lib/tpm-v2.c +++ b/lib/tpm-v2.c @@ -184,10 +184,10 @@ u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property, /* * In the response buffer, the properties are located after the: * tag (u16), response size (u32), response code (u32), - * YES/NO flag (u8), TPM_CAP (u32) and TPMU_CAPABILITIES (u32). + * YES/NO flag (u8), TPM_CAP (u32). */ properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) + - sizeof(u8) + sizeof(u32) + sizeof(u32); + sizeof(u8) + sizeof(u32); memcpy(buf, &response[properties_off], response_len - properties_off); return 0; From patchwork Thu Nov 5 21:58:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 320693 Delivered-To: patch@linaro.org Received: by 2002:a92:7b12:0:0:0:0:0 with SMTP id w18csp807408ilc; Thu, 5 Nov 2020 13:59:27 -0800 (PST) X-Google-Smtp-Source: ABdhPJy9ijHKYqdFH9KtWcK7smUk0Mt67cnFMXT6ZV6bcdcd3TMDcQ/pkiMVORTmApJH1SPsbgTo X-Received: by 2002:a50:eb45:: with SMTP id z5mr4783227edp.144.1604613567505; Thu, 05 Nov 2020 13:59:27 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604613567; cv=none; d=google.com; s=arc-20160816; b=kxPK/HcWi2EIWLmQ++/lgwPbkAjGwgYnEEnLAolnSjpYPkk+4B42ZmEHSX3DZjFBFg zeCvF7s4HaHwH5K0W4goKXbJRH/yx1b+cViw2AsxN/j75Pq4EcdaPeAcMhxziRp4OssN bT0hgbYDvWX+wjCjWWc6S/ixiz/x4QY/T2/Yjpy49rW895tOY/lxFu+SY4sF1G4spFyt jE2Gh5kGmnEHqvWM5NquQYkdwEkEX1r1vh1uWQesQIRtK22Mewev+LRnSxwF3C5q8j9I xuyrvlRB/OAlaidrh6wSApJYbtOxSaGx7m9MMjjaxjENNbIRnU+/E7gGRRZKoXE9hE0q /xMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=NAu0D3o4r4NRR1r5Cut9M5GI18jQb8j4tB7D3lw7cTo=; b=AaztS5LjZ+ovIczQt/NaQ7/ioYkBqde0WjkztcShUCAMKrf6HrJgubZtdo8yjbobQc yPfQ+1wMN+H+8wSfZOS3TN5Qcr+pIb2zljO2EcDZJTNAe5fEO7yHrHA9O+m2eGCh3nBJ 8ldLpIS083XPJzhl5lMoS9HIvyrPnWpLeETaRSgt3qgJHaTtBYs2c5x9xCKuSy5JvZt+ 8AnwrPnBlfZQRbSSCv+YUtQYq43WXLQSFqDkJfv/zWlsT/qbXp9rQpLZP48fT9UDqlmu aXO/hVFYSo6VMTF8PFhLdd5soklLgnJixs1etK3VDI++rXpl5RtQTj1kZnfxzp+/ZlVZ xrWw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=I5S0GVyF; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id z5si2229657edl.605.2020.11.05.13.59.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 13:59:27 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=I5S0GVyF; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 35C77825D0; Thu, 5 Nov 2020 22:59:00 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="I5S0GVyF"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 11D7E825D0; Thu, 5 Nov 2020 22:58:59 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x641.google.com (mail-ej1-x641.google.com [IPv6:2a00:1450:4864:20::641]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 629F0825C6 for ; Thu, 5 Nov 2020 22:58:52 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x641.google.com with SMTP id o23so3878362ejn.11 for ; Thu, 05 Nov 2020 13:58:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=NAu0D3o4r4NRR1r5Cut9M5GI18jQb8j4tB7D3lw7cTo=; b=I5S0GVyFY+TiN6LFoRni/Ou2rKEcP+DmNe+tNOyBWicDy+I9rynZjSZtAkVI23a5WQ 1NuUyA6DGMOKiMse97DOKBko8RH7AY4o5wLQXf9Pg+9Kdtp7a8Q8LIaKCuzoO4L26Qmz 2s2jmkwvW3lg1QI7pQPA4kv2lF0PWgKu0S+AFGTvifcX7QHcf0XCeIaXF0v/KjHfKQ7u jL2Nwch0NLsubrObIhwG/YZ//nZAEGpVGOpMn/CG65mVIPC5Zi7CPd7rwbyne6KSW+Dh 9TSzcGWWRLQrOTPohjily8iP+JW1gt+xIvMofx6gSmlFOtT5A4Y6hUpUA0dpi51F+X/y fsIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=NAu0D3o4r4NRR1r5Cut9M5GI18jQb8j4tB7D3lw7cTo=; b=iVH+zv/0IbxnDZbCCY99CE6pqtG63Agfh6/JZ0Qmjcp2PaI0bBzRQj7gBT3SDWPuia W1GGMm1oolwIQOAbLxK6RpZQFJeW5CtUNYeNu4vv0UQLBWHXr/tnoZuCFarNl2/pxUu7 aW85LDGcmAdCIv/FsPL4bkYh2z5tbxr4TPO+yL0PEyDsW/gGzWvO+crviR1YHJbl6C+2 gRhfLybX9HWK5fRqiNTdu/9gWv/TlExh6p4rXuoj+z6C9sS4/u5PglhU3uGNqi4Oeb8N 5RL/9C1ukf+KZl67FS0KAxhD5eT8r6ZPLQ3Zwn88n30mJi9geaBur2FJvF7drFyYz/vh qS/A== X-Gm-Message-State: AOAM530SbQ4BMHL94RS8IzWIY8h4YgXNjCufDwy6Y2MDlar+J4unTvkI TgIvWnkePnev5iqhwtJPDbi/rA== X-Received: by 2002:a17:906:814:: with SMTP id e20mr4438520ejd.514.1604613531936; Thu, 05 Nov 2020 13:58:51 -0800 (PST) Received: from apalos.home ([2a02:587:4615:c071:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id o1sm1744383ejc.81.2020.11.05.13.58.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 13:58:51 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: ard.biesheuvel@arm.com, Ilias Apalodimas , Alexander Graf , Miquel Raynal , Simon Glass , Philippe Reynes , Bin Meng , Dhananjay Phadke , u-boot@lists.denx.de Subject: [PATCH 2/3 v2] tpm: Add some headers from the spec Date: Thu, 5 Nov 2020 23:58:44 +0200 Message-Id: <20201105215846.1017178-2-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201105215846.1017178-1-ilias.apalodimas@linaro.org> References: <20201105215846.1017178-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean A following patch introduces EFI_TCG2_PROTOCOL. Add the required TPMv2 headers to support that and remove the (now) redundant definitions from tpm2_tis_sandbox Signed-off-by: Ilias Apalodimas --- include/tpm-v2.h | 69 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) -- 2.29.2 diff --git a/include/tpm-v2.h b/include/tpm-v2.h index f6c045d35480..b62f2c5b0fb8 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -11,6 +11,73 @@ #define TPM2_DIGEST_LEN 32 +#define TPM2_MAX_PCRS 32 +#define TPM2_PCR_SELECT_MAX ((TPM2_MAX_PCRS + 7) / 8) +#define TPM2_MAX_CAP_BUFFER 1024 +#define TPM2_MAX_TPM_PROPERTIES ((TPM2_MAX_CAP_BUFFER - sizeof(u32) /* TPM2_CAP */ - \ + sizeof(u32)) / sizeof(struct tpms_tagged_property)) + +/* + * We deviate from this draft of the specification by increasing the value of TPM2_NUM_PCR_BANKS + * from 3 to 16 to ensure compatibility with TPM2 implementations that have enabled a larger than + * typical number of PCR banks. This larger value for TPM2_NUM_PCR_BANKS is expected to be included + * in a future revision of the specification. + */ +#define TPM2_NUM_PCR_BANKS 16 + +/* Definition of (UINT32) TPM2_CAP Constants */ +#define TPM2_CAP_PCRS 0x00000005U +#define TPM2_CAP_TPM_PROPERTIES 0x00000006U + +/* Definition of (UINT32) TPM2_PT Constants */ +#define PT_GROUP (u32)(0x00000100) +#define PT_FIXED (u32)(PT_GROUP * 1) +#define TPM2_PT_MANUFACTURER (u32)(PT_FIXED + 5) +#define TPM2_PT_PCR_COUNT (u32)(PT_FIXED + 18) +#define TPM2_PT_MAX_COMMAND_SIZE (u32)(PT_FIXED + 30) +#define TPM2_PT_MAX_RESPONSE_SIZE (u32)(PT_FIXED + 31) + +/* TPMS_TAGGED_PROPERTY Structure */ +struct tpms_tagged_property { + u32 property; + u32 value; +} __packed; + +/* TPMS_PCR_SELECTION Structure */ +struct tpms_pcr_selection { + u16 hash; + u8 size_of_select; + u8 pcr_select[TPM2_PCR_SELECT_MAX]; +} __packed; + +/* TPML_PCR_SELECTION Structure */ +struct tpml_pcr_selection { + u32 count; + struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS]; +} __packed; + +/* TPML_TAGGED_TPM_PROPERTY Structure */ +struct tpml_tagged_tpm_property { + u32 count; + struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES]; +} __packed; + +/* TPMU_CAPABILITIES Union */ +union tpmu_capabilities { + /* + * Non exhaustive. Only added the structs needed for our + * current code + */ + struct tpml_pcr_selection assigned_pcr; + struct tpml_tagged_tpm_property tpm_properties; +} __packed; + +/* TPMS_CAPABILITY_DATA Structure */ +struct tpms_capability_data { + u32 capability; + union tpmu_capabilities data; +} __packed; + /** * TPM2 Structure Tags for command/response buffers. * @@ -123,11 +190,13 @@ enum tpm2_return_codes { * TPM2 algorithms. */ enum tpm2_algorithms { + TPM2_ALG_SHA1 = 0x04, TPM2_ALG_XOR = 0x0A, TPM2_ALG_SHA256 = 0x0B, TPM2_ALG_SHA384 = 0x0C, TPM2_ALG_SHA512 = 0x0D, TPM2_ALG_NULL = 0x10, + TPM2_ALG_SM3_256 = 0x12, }; /* NV index attributes */ From patchwork Thu Nov 5 21:58:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 320694 Delivered-To: patch@linaro.org Received: by 2002:a92:7b12:0:0:0:0:0 with SMTP id w18csp807794ilc; Thu, 5 Nov 2020 14:00:09 -0800 (PST) X-Google-Smtp-Source: ABdhPJwTLQ3Zz3fsFiigb2oaw91+/sfw/agmiNobgX5gGL+/DQiwK/izw8QNghCTz6G2moxAT4k4 X-Received: by 2002:a17:906:34c3:: with SMTP id h3mr4526267ejb.132.1604613608953; Thu, 05 Nov 2020 14:00:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604613608; cv=none; d=google.com; s=arc-20160816; b=S8OsOI0hTe6XldmipluaRmeBmYkduDsRZAXK95ceK0+E6ZQVpo+W51yLtAZ3ar2OgM s4KUWwWlCxZ+y2WkhwiIprq298elVcL9bE4mqJ22sK/lea9mw3BmNq97b9ys51DTN1KB JLNVy5s+m+Ie5/h1LO8O6qHlhr1hjNCzJ5GTeZZ8mFPQ9+MajMyR5sLMxfdEjRlKvkLq pxxFEYYO6SBsyii9iblG4R6Lq4IxdjNaMYbKOBa4swUh45uAYtK2o6MfJyRM4WMKCJ4z 501GOoIb4a1M1/hlvXKrIFeSHnPKotPALKw9Ko8V1+cYEH4XkO+T6XgfKu0/A279SWcP 7tHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=DjCQijfceVCeVJeb4OpksY3jb4pokazq3TmsZzuOixc=; b=hAr94kIhbqRMe1iuXBwkHvlr5qnOu5+R6H/6zqpj6IyEH0mbFtiG5V388wBIPO2TPJ 3+q6XI054l2/xOUD9iRyhmKtH1VTvk365N3m6+N6f4iRJKpEiUZkrIpS0CberQGGNC38 9lJSlVHMiz7lshfzEfPS47skhcIdeLnZ3DYIc0UIdtSiroLrqiVULKSTBBZFQtGoqnMZ GJu42kxRmTzuyF8rdqEoVqBXs/VehPIzk8seeR2ABjKS9WDtgHgXEY5F0BMw0VXw0dNi JZnmYrN0hszzX41ZqhFsf4PoFAMvMb/xPTUBCpKr9PZydjZD+a1d4buTruCi6N5h5tuG BOzw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=lMQTA1md; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id u24si1978598eje.619.2020.11.05.14.00.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 14:00:08 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=lMQTA1md; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C1543825DD; Thu, 5 Nov 2020 22:59:08 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="lMQTA1md"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 94CC1825DE; Thu, 5 Nov 2020 22:59:06 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 21C22825C8 for ; Thu, 5 Nov 2020 22:58:58 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x52d.google.com with SMTP id ay21so3198205edb.2 for ; Thu, 05 Nov 2020 13:58:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=DjCQijfceVCeVJeb4OpksY3jb4pokazq3TmsZzuOixc=; b=lMQTA1md1tBv1s+/86BZNGVioUR4xvyora418XntvXrQ7xSu1+IGdBchWaPdLj0LeF S1U3iTgKvgwlMomg96OXxXr+yJBBktuWZcFxWo8AZEiqkI8SED98h1pb2hHiepZBA3qG wM0q1VVAcolP8UdnFNYvicCDMqBYuvN3k/68eB+7cPNV8SI+dr7gGefpOGgz+K6q5TTO Gtp2hO5rvaSU7LZsgeylH1j0Kp286/gmB+7SA8WVGhpw8Ia0xuGu0Eba8hZ8gL3qxOp/ Kz26gFdoeOLOQP6x5+zSFjdUgBninYqSqs/SJRJevODL/Xn2Qp2FGdOCwvFVCNVUTMYp o5UA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=DjCQijfceVCeVJeb4OpksY3jb4pokazq3TmsZzuOixc=; b=LHKVBrPfISwCHDB0FD9+u9jWPlS3bKpLjBIhbZNAVBoJQcLngI9Hs+QD4TtHANokN4 0Q9afm2T8XUis5O1yc09pH/bxH7wldYvVRt3ZJ8sz4Mwdt+DOYANvNYIQ/gI/czOSIJ4 7TNLFpJ7q86CBXYPB5wRPmTqeL+i6Rpd2+ZQ3NiHSe1QlopaXdBotfVtagzkLnp9eDaE 6aWHux2NPg9aaX6XzSAMLieYbiOy6Q3IuDraEVe2HTAAJbp040H70XW5ec9CeEyEsACz gNs8/8ZN3CZmivcD5GoZzaoQhv2ZN3QE5LKqPSBLeOYkUEggtc7q+E/6T2ccOUaZBjh8 BDyg== X-Gm-Message-State: AOAM532CCs89mmNHoqxIijNDFBnJZJhxsR0MCJ3ksHyUnoUyNv8JwcuR AWglEhn5jsDADblBED9WLZ9pmA== X-Received: by 2002:a50:decd:: with SMTP id d13mr4944784edl.202.1604613534332; Thu, 05 Nov 2020 13:58:54 -0800 (PST) Received: from apalos.home ([2a02:587:4615:c071:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id o1sm1744383ejc.81.2020.11.05.13.58.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2020 13:58:53 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: ard.biesheuvel@arm.com, Ilias Apalodimas , Alexander Graf , Miquel Raynal , Philippe Reynes , Simon Glass , Bin Meng , Dhananjay Phadke , u-boot@lists.denx.de Subject: [PATCH 3/3 v2] efi: Add basic EFI_TCG2_PROTOCOL support Date: Thu, 5 Nov 2020 23:58:45 +0200 Message-Id: <20201105215846.1017178-3-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201105215846.1017178-1-ilias.apalodimas@linaro.org> References: <20201105215846.1017178-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean Since U-boot EFI implementation is getting richer it makes sense to add support for EFI_TCG2_PROTOCOL taking advantage of any hardware TPM available on the device. This is the initial implementation of the protocol which only adds support for GetCapability(). It's limited in the newer and safer TPMv2 devices. Signed-off-by: Ilias Apalodimas --- changes since v1: - change return variable of platform_get_tpm2_device() when used - since more headers were included in patch #2 use them in offset calculations for all tpm commands - change the size of the response buffer regardless of what tpm2_get_capability() is doing include/efi_loader.h | 2 + include/efi_tcg2.h | 91 +++++++ lib/efi_loader/Kconfig | 8 + lib/efi_loader/Makefile | 1 + lib/efi_loader/efi_setup.c | 7 + lib/efi_loader/efi_tcg2.c | 493 +++++++++++++++++++++++++++++++++++++ 6 files changed, 602 insertions(+) create mode 100644 include/efi_tcg2.h create mode 100644 lib/efi_loader/efi_tcg2.c -- 2.29.2 diff --git a/include/efi_loader.h b/include/efi_loader.h index f550ced56876..e5015d865ec9 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -405,6 +405,8 @@ efi_status_t efi_console_register(void); efi_status_t efi_disk_register(void); /* Called by efi_init_obj_list() to install EFI_RNG_PROTOCOL */ efi_status_t efi_rng_register(void); +/* Called by efi_init_obj_list() to install EFI_TCG2_PROTOCOL */ +efi_status_t efi_tcg2_register(void); /* Create handles and protocols for the partitions of a block device */ int efi_disk_create_partitions(efi_handle_t parent, struct blk_desc *desc, const char *if_typename, int diskid, diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h new file mode 100644 index 000000000000..9e7b85db058d --- /dev/null +++ b/include/efi_tcg2.h @@ -0,0 +1,91 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2020, Linaro Limited + */ + +#if !defined _EFI_TCG2_PROTOCOL_H_ +#define _EFI_TCG2_PROTOCOL_H_ + +#include + +#define EFI_TCG2_PROTOCOL_GUID \ + EFI_GUID(0x607f766c, 0x7455, 0x42be, 0x93, \ + 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f) + +/* TPMV2 only */ +#define TCG2_EVENT_LOG_FORMAT_TCG_2 0x00000002 + +/* SHA1, SHA256, SHA384, SHA512, TPM_ALG_SM3_256 */ +#define MAX_HASH_COUNT 5 +/* Algorithm Registry */ +#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001 +#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002 +#define EFI_TCG2_BOOT_HASH_ALG_SHA384 0x00000004 +#define EFI_TCG2_BOOT_HASH_ALG_SHA512 0x00000008 +#define EFI_TCG2_BOOT_HASH_ALG_SM3_256 0x00000010 + +typedef u32 efi_tcg_event_log_bitmap; +typedef u32 efi_tcg_event_log_format; +typedef u32 efi_tcg_event_algorithm_bitmap; + +struct efi_tcg2_version { + u8 major; + u8 minor; +}; + +struct efi_tcg2_event_header { + u32 header_size; + u16 header_version; + u32 pcr_index; + u32 event_type; +} __packed; + +struct efi_tcg2_event { + u32 size; + struct efi_tcg2_event_header header; + u8 event[]; +} __packed; + +struct efi_tcg2_boot_service_capability { + u8 size; + struct efi_tcg2_version structure_version; + struct efi_tcg2_version protocol_version; + efi_tcg_event_algorithm_bitmap hash_algorithm_bitmap; + efi_tcg_event_log_bitmap supported_event_logs; + bool tpm_present_flag; + u16 max_command_size; + u16 max_response_size; + u32 manufacturer_id; + u32 number_of_pcr_banks; + efi_tcg_event_algorithm_bitmap active_pcr_banks; +}; + +#define boot_service_capability_min \ + sizeof(struct efi_tcg2_boot_service_capability) - \ + offsetof(struct efi_tcg2_boot_service_capability, number_of_pcr_banks) + +struct efi_tcg2_protocol { + efi_status_t (EFIAPI * get_capability)(struct efi_tcg2_protocol *this, + struct efi_tcg2_boot_service_capability *capability); + efi_status_t (EFIAPI * get_eventlog)(struct efi_tcg2_protocol *this, + efi_tcg_event_log_format log_format, + u64 *event_log_location, u64 *event_log_last_entry, + bool *event_log_truncated); + efi_status_t (EFIAPI * hash_log_extend_event)(struct efi_tcg2_protocol *this, + u64 flags, u64 data_to_hash, + u64 data_to_hash_len, + struct efi_tcg2_event *efi_tcg_event); + efi_status_t (EFIAPI * submit_command)(struct efi_tcg2_protocol *this, + u32 input_parameter_block_size, + u8 *input_parameter_block, + u32 output_parameter_block_size, + u8 *output_parameter_block); + efi_status_t (EFIAPI * get_active_pcr_banks)(struct efi_tcg2_protocol *this, + u32 *active_pcr_banks); + efi_status_t (EFIAPI * set_active_pcr_banks)(struct efi_tcg2_protocol *this, + u32 active_pcr_banks); + efi_status_t (EFIAPI * get_result_of_set_active_pcr_banks)(struct efi_tcg2_protocol *this, + u32 *operation_present, + u32 *response); +}; +#endif diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 075481428cdf..5d5074a4bc41 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -184,6 +184,14 @@ config EFI_RNG_PROTOCOL Provide a EFI_RNG_PROTOCOL implementation using the hardware random number generator of the platform. +config EFI_TCG2_PROTOCOL + bool "EFI_TCG2_PROTOCOL support" + depends on TPM_V2 + default n + help + Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware + of the platform. + config EFI_LOAD_FILE2_INITRD bool "EFI_FILE_LOAD2_PROTOCOL for Linux initial ramdisk" default n diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index 8892fb01e125..cd4b252a417c 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -53,6 +53,7 @@ obj-$(CONFIG_NET) += efi_net.o obj-$(CONFIG_GENERATE_ACPI_TABLE) += efi_acpi.o obj-$(CONFIG_GENERATE_SMBIOS_TABLE) += efi_smbios.o obj-$(CONFIG_EFI_RNG_PROTOCOL) += efi_rng.o +obj-$(CONFIG_EFI_TCG2_PROTOCOL) += efi_tcg2.o obj-$(CONFIG_EFI_LOAD_FILE2_INITRD) += efi_load_initrd.o obj-y += efi_signature.o diff --git a/lib/efi_loader/efi_setup.c b/lib/efi_loader/efi_setup.c index 45226c5c1a53..e206b60bb82c 100644 --- a/lib/efi_loader/efi_setup.c +++ b/lib/efi_loader/efi_setup.c @@ -156,6 +156,13 @@ efi_status_t efi_init_obj_list(void) if (ret != EFI_SUCCESS) goto out; } + + if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { + ret = efi_tcg2_register(); + if (ret != EFI_SUCCESS) + goto out; + } + /* Initialize variable services */ ret = efi_init_variables(); if (ret != EFI_SUCCESS) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c new file mode 100644 index 000000000000..b735f3f2a83d --- /dev/null +++ b/lib/efi_loader/efi_tcg2.c @@ -0,0 +1,493 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2020, Linaro Limited + */ + +#define LOG_CATEGORY LOGC_EFI +#include +#include +#include +#include +#include +#include +#include +#include + +DECLARE_GLOBAL_DATA_PTR; + +/* + * When requesting TPM2_CAP_TPM_PROPERTIES the value is on a standard offset. + * Since the current tpm2_get_capability() response buffers starts at + * 'union tpmu_capabilities data' of 'struct tpms_capability_data', calculate the + * response size and offset once for all consumers + */ +#define TPM2_RESPONSE_BUFFER_SIZE (sizeof(struct tpms_capability_data) - \ + offsetof(struct tpms_capability_data, data)) +#define properties_offset (offsetof(struct tpml_tagged_tpm_property, tpm_property) + \ + offsetof(struct tpms_tagged_property, value)) + +const efi_guid_t efi_guid_tcg2_protocol = EFI_TCG2_PROTOCOL_GUID; + +/** + * platform_get_tpm_device() - retrieve TPM device + * + * This function retrieves the udevice implementing a TPM + * + * This function may be overridden if special initialization is needed. + * + * @dev: udevice + * Return: status code + */ +__weak efi_status_t platform_get_tpm2_device(struct udevice **dev) +{ + int ret; + struct udevice *devp; + + ret = uclass_get_device(UCLASS_TPM, 0, &devp); + if (ret) + return EFI_DEVICE_ERROR; + + *dev = devp; + + return EFI_SUCCESS; +} + +/** + * tpm2_get_max_command_size() - TPM2 command to get the supported max command size + * + * @dev: TPM device + * @max_command_size: output buffer for the size + * + * Return: 0 on success -1 on error + */ +static int tpm2_get_max_command_size(struct udevice *dev, u16 *max_command_size) +{ + u8 response[TPM2_RESPONSE_BUFFER_SIZE]; + u32 ret; + + memset(response, 0, sizeof(response)); + ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, + TPM2_PT_MAX_COMMAND_SIZE, response, 1); + if (ret) + return -1; + + *max_command_size = (uint16_t)get_unaligned_be32(response + properties_offset); + + return 0; +} + +/** + * tpm2_get_max_response_size() - TPM2 command to get the supported max response size + * + * @dev: TPM device + * @max_response_size: output buffer for the size + * + * Return: 0 on success -1 on error + */ +static int tpm2_get_max_response_size(struct udevice *dev, u16 *max_response_size) +{ + u8 response[TPM2_RESPONSE_BUFFER_SIZE]; + u32 ret; + + memset(response, 0, sizeof(response)); + ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, + TPM2_PT_MAX_RESPONSE_SIZE, response, 1); + if (ret) + return -1; + + *max_response_size = (uint16_t)get_unaligned_be32(response + properties_offset); + + return 0; +} + +/** + * tpm2_get_manufacturer_id() - Issue a TPM2 command to get the manufacturer ID + * + * @dev: TPM device + * @manufacturer_id: output buffer for the id + * + * Return: 0 on success -1 on error + */ +static int tpm2_get_manufacturer_id(struct udevice *dev, u32 *manufacturer_id) +{ + u8 response[TPM2_RESPONSE_BUFFER_SIZE]; + u32 ret; + + memset(response, 0, sizeof(response)); + ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, + TPM2_PT_MANUFACTURER, response, 1); + if (ret) + return -1; + + *manufacturer_id = get_unaligned_be32(response + properties_offset); + + return 0; +} + +/** + * tpm2_get_num_pcr() - Issue a TPM2 command to get the number of PCRs + * + * @dev: TPM device + * @manufacturer_id: output buffer for the number + * + * Return: 0 on success -1 on error + */ +static int tpm2_get_num_pcr(struct udevice *dev, u32 *num_pcr) +{ + u8 response[TPM2_RESPONSE_BUFFER_SIZE]; + u32 ret; + + memset(response, 0, sizeof(response)); + ret = tpm2_get_capability(dev, TPM2_CAP_TPM_PROPERTIES, + TPM2_PT_PCR_COUNT, response, 1); + if (ret) + return -1; + + *num_pcr = get_unaligned_be32(response + properties_offset); + + return 0; +} + +/** + * is_active_pcr() - Check if a supported algorithm is active + * + * @dev: TPM device + * @selection: struct of PCR information + * + * Return: true if PCR is active + */ +bool is_active_pcr(struct tpms_pcr_selection *selection) +{ + int i; + /* + * check the pcr_select. If at least one of the PCRs supports the algorithm + * add it on the active ones + */ + for (i = 0; i < selection->size_of_select; i++) { + if (selection->pcr_select[i]) + return true; + } + + return false; +} + +/** + * tpm2_get_pcr_info() - Issue a TPM2 command to get the supported, active PCRs and number of banks + * + * @dev: TPM device + * @supported_pcr: bitmask with the algorithms supported + * @active_pcr: bitmask with the active algorithms + * @pcr_banks: number of PCR banks + * + * Return: 0 on success -1 on error + */ +static int tpm2_get_pcr_info(struct udevice *dev, u32 *supported_pcr, u32 *active_pcr, + u32 *pcr_banks) +{ + u8 response[TPM2_RESPONSE_BUFFER_SIZE]; + struct tpml_pcr_selection pcrs; + u32 ret, num_pcr; + int i, tpm_ret; + + memset(response, 0, sizeof(response)); + ret = tpm2_get_capability(dev, TPM2_CAP_PCRS, 0, response, 1); + if (ret) + return -1; + + pcrs.count = get_unaligned_be32(response); + if (pcrs.count > MAX_HASH_COUNT || pcrs.count < 1) + return -1; + + tpm_ret = tpm2_get_num_pcr(dev, &num_pcr); + if (tpm_ret) + return -1; + for (i = 0; i < pcrs.count; i++) { + /* + * Definition of TPMS_PCR_SELECTION Structure + * hash: u16 + * size_of_select: u8 + * pcr_select: u8 array + * + * The offsets depend on the number of the device PCRs + * so we have to calculate them based on that + */ + u32 hash_offset = offsetof(struct tpml_pcr_selection, selection) + + i * offsetof(struct tpms_pcr_selection, pcr_select) + + i * ((num_pcr + 7) / 8); + u32 size_select_offset = + hash_offset + offsetof(struct tpms_pcr_selection, size_of_select); + u32 pcr_select_offset = + hash_offset + offsetof(struct tpms_pcr_selection, pcr_select); + + pcrs.selection[i].hash = get_unaligned_be16(response + hash_offset); + pcrs.selection[i].size_of_select = + __get_unaligned_be(response + size_select_offset); + /* copy the array of pcr_select */ + memcpy(pcrs.selection[i].pcr_select, response + pcr_select_offset, + pcrs.selection[i].size_of_select); + } + + for (i = 0; i < pcrs.count; i++) { + switch (pcrs.selection[i].hash) { + case TPM2_ALG_SHA1: + *supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA1; + if (is_active_pcr(&pcrs.selection[i])) + *active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA1; + break; + case TPM2_ALG_SHA256: + *supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA256; + if (is_active_pcr(&pcrs.selection[i])) + *active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA256; + break; + case TPM2_ALG_SHA384: + *supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA384; + if (is_active_pcr(&pcrs.selection[i])) + *active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA384; + break; + case TPM2_ALG_SHA512: + *supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA512; + if (is_active_pcr(&pcrs.selection[i])) + *active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SHA512; + break; + case TPM2_ALG_SM3_256: + *supported_pcr |= EFI_TCG2_BOOT_HASH_ALG_SM3_256; + if (is_active_pcr(&pcrs.selection[i])) + *active_pcr |= EFI_TCG2_BOOT_HASH_ALG_SM3_256; + break; + default: + EFI_PRINT("Unknown algorithm %x\n", pcrs.selection[i].hash); + break; + } + } + + *pcr_banks = pcrs.count; + + return 0; +} + +/** + * get_capability() - provide protocol capability information and state information + * + * @this: TCG2 protocol instance + * @capability: caller allocated memory with size field to the size of the + * structure allocated + + * Return: status code + */ +static efi_status_t EFIAPI +get_capability(struct efi_tcg2_protocol *this, + struct efi_tcg2_boot_service_capability *capability) +{ + struct udevice *dev; + efi_status_t efi_ret; + int ret; + + EFI_ENTRY("%p, %p", this, capability); + + if (!this || !capability) + return EFI_EXIT(EFI_INVALID_PARAMETER); + + if (capability->size < boot_service_capability_min) { + capability->size = boot_service_capability_min; + return EFI_EXIT(EFI_BUFFER_TOO_SMALL); + } + + if (capability->size < sizeof(*capability)) { + capability->size = sizeof(*capability); + return EFI_EXIT(EFI_BUFFER_TOO_SMALL); + } + + capability->structure_version.major = 1; + capability->structure_version.minor = 1; + capability->protocol_version.major = 1; + capability->protocol_version.minor = 1; + + efi_ret = platform_get_tpm2_device(&dev); + if (efi_ret != EFI_SUCCESS) { + capability->supported_event_logs = 0; + capability->hash_algorithm_bitmap = 0; + capability->tpm_present_flag = false; + capability->max_command_size = 0; + capability->max_response_size = 0; + capability->manufacturer_id = 0; + capability->number_of_pcr_banks = 0; + capability->active_pcr_banks = 0; + + return EFI_EXIT(EFI_SUCCESS); + } + + /* We only allow a TPMv2 device to register the EFI protocol */ + capability->supported_event_logs = TCG2_EVENT_LOG_FORMAT_TCG_2; + + capability->tpm_present_flag = true; + + /* Supported and active PCRs */ + capability->hash_algorithm_bitmap = 0; + capability->active_pcr_banks = 0; + ret = tpm2_get_pcr_info(dev, &capability->hash_algorithm_bitmap, + &capability->active_pcr_banks, + &capability->number_of_pcr_banks); + if (ret) + return EFI_EXIT(EFI_DEVICE_ERROR); + + /* Max command size */ + ret = tpm2_get_max_command_size(dev, &capability->max_command_size); + if (ret) + return EFI_EXIT(EFI_DEVICE_ERROR); + + /* Max response size */ + ret = tpm2_get_max_response_size(dev, &capability->max_response_size); + if (ret) + return EFI_EXIT(EFI_DEVICE_ERROR); + + /* Manufacturer ID */ + ret = tpm2_get_manufacturer_id(dev, &capability->manufacturer_id); + if (ret) + return EFI_EXIT(EFI_DEVICE_ERROR); + + return EFI_EXIT(EFI_SUCCESS); +} + +/** + * get_eventlog() - retrieve the the address of a given event log and its last entry. + * + * @this: TCG2 protocol instance + * @log_format: type of event log format + * @event_log_location: pointer to the memory address of the event log + * @event_log_last_entry: pointer to the address of the start of the last entry in the + * event log in memory, if log contains more than 1 entry + * @event_log_truncated: set to true, if the Event Log is missing at least one entry + * + * Return: status code + */ +static efi_status_t EFIAPI +get_eventlog(struct efi_tcg2_protocol *this, + efi_tcg_event_log_format log_format, u64 *event_log_location, + u64 *event_log_last_entry, bool *event_log_truncated) +{ + return EFI_UNSUPPORTED; +} + +/** + * hash_log_extend_event()- extend and optionally log events + * + * @this: TCG2 protocol instance + * @flags: bitmap providing additional information on the operation + * @data_to_hash: physical address of the start of the data buffer to be hashed + * @data_to_hash_len: the length in bytes of the buffer referenced by data_to_hash + * @efi_tcg_event: pointer to data buffer containing information about the event + * + * Return: status code + */ +static efi_status_t EFIAPI +hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, + u64 data_to_hash, u64 data_to_hash_len, + struct efi_tcg2_event *efi_tcg_event) +{ + return EFI_UNSUPPORTED; +} + +/** + * submit_command() - Send command to the TPM + * + * @this: TCG2 protocol instance + * @input_param_block_size: size of the TPM input parameter block + * @input_param_block: pointer to the TPM input parameter block + * @output_param_block_size: size of the TPM output parameter block + * @output_param_block: pointer to the TPM output parameter block + * + * Return: status code + */ +efi_status_t EFIAPI +submit_command(struct efi_tcg2_protocol *this, u32 input_param_block_size, + u8 *input_param_block, u32 output_param_block_size, + u8 *output_param_block) +{ + return EFI_UNSUPPORTED; +} + +/** + * get_active_pcr_banks() - returns the currently active PCR banks + * + * @this: TCG2 protocol instance + * @active_pcr_banks: pointer for receiving the bitmap of currently active PCR banks + * + * Return: status code + */ +efi_status_t EFIAPI +get_active_pcr_banks(struct efi_tcg2_protocol *this, u32 *active_pcr_banks) +{ + return EFI_UNSUPPORTED; +} + +/** + * set_active_pcr_banks() - sets the currently active PCR banks + * + * @this: TCG2 protocol instance + * @active_pcr_banks: bitmap of the requested active PCR banks + * + * Return: status code + */ +efi_status_t EFIAPI +set_active_pcr_banks(struct efi_tcg2_protocol *this, u32 active_pcr_banks) +{ + return EFI_UNSUPPORTED; +} + +/** + * get_result_of_set_active_pcr_banks() - retrieves the result of a previous set_active_pcr_banks() + * + * @this: TCG2 protocol instance + * @operation_present: non-zero value to indicate a set_active_pcr_banks operation was + * invoked during last boot + * @response: result value could be returned + * + * Return: status code + */ +efi_status_t EFIAPI +get_result_of_set_active_pcr_banks(struct efi_tcg2_protocol *this, + u32 *operation_present, u32 *response) +{ + return EFI_UNSUPPORTED; +} + +static const struct efi_tcg2_protocol efi_tcg2_protocol = { + .get_capability = get_capability, + .get_eventlog = get_eventlog, + .hash_log_extend_event = hash_log_extend_event, + .submit_command = submit_command, + .get_active_pcr_banks = get_active_pcr_banks, + .set_active_pcr_banks = set_active_pcr_banks, + .get_result_of_set_active_pcr_banks = get_result_of_set_active_pcr_banks, +}; + +/** + * efi_tcg2_register() - register EFI_TCG2_PROTOCOL + * + * If a TPM2 device is available, the TPM TCG2 Protocol is registered + * + * Return: An error status is only returned if adding the protocol fails. + */ +efi_status_t efi_tcg2_register(void) +{ + efi_status_t ret; + struct udevice *dev; + enum tpm_version tpm_ver; + + ret = platform_get_tpm2_device(&dev); + if (ret != EFI_SUCCESS) + return EFI_SUCCESS; + + tpm_ver = tpm_get_version(dev); + if (tpm_ver != TPM_V2) { + log_warning("Only TPMv2 supported for EFI_TCG2_PROTOCOL"); + return EFI_SUCCESS; + } + + ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol, + (void *)&efi_tcg2_protocol); + if (ret != EFI_SUCCESS) + log_err("Cannot install EFI_TCG2_PROTOCOL"); + + return ret; +}