November 2021 - U-Boot

[PATCH v3] efi_loader: check tcg2 protocol installation outside the TCG protocol
by Masahisa Kojima 29 Nov '21

29 Nov '21

There are functions that calls tcg2_agile_log_append() outside of the TCG protocol invocation (e.g tcg2_measure_pe_image). These functions must to check that tcg2 protocol is installed. If not, measurement shall be skipped. Together with above change, this commit also removes the unnecessary tcg2_uninit() call in efi_tcg2_register(), refactors efi_tcg2_register() not to include the process that is not related to the tcg2 protocol registration. Signed-off-by: Masahisa Kojima <masahisa.kojima(a)linaro.org> --- Changes in v3: - add static qualifier to is_tcg2_protocol_installed() - simplify is_tcg2_protocol_installed() return handling Changes in v2: - rebased on top of the TF-A eventlog handover support include/efi_loader.h | 4 ++ lib/efi_loader/efi_setup.c | 3 ++ lib/efi_loader/efi_tcg2.c | 89 +++++++++++++++++++++++++++++++------- 3 files changed, 81 insertions(+), 15 deletions(-) diff --git a/include/efi_loader.h b/include/efi_loader.h index d52e399841..fe29c10906 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -525,6 +525,10 @@ efi_status_t efi_disk_register(void); efi_status_t efi_rng_register(void); /* Called by efi_init_obj_list() to install EFI_TCG2_PROTOCOL */ efi_status_t efi_tcg2_register(void); +/* Called by efi_init_obj_list() to do the required setup for the measurement */ +efi_status_t efi_tcg2_setup_measurement(void); +/* Called by efi_init_obj_list() to do initial measurement */ +efi_status_t efi_tcg2_do_initial_measurement(void); /* measure the pe-coff image, extend PCR and add Event Log */ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, struct efi_loaded_image_obj *handle, diff --git a/lib/efi_loader/efi_setup.c b/lib/efi_loader/efi_setup.c index a2338d74af..781d10590d 100644 --- a/lib/efi_loader/efi_setup.c +++ b/lib/efi_loader/efi_setup.c @@ -271,6 +271,9 @@ efi_status_t efi_init_obj_list(void) ret = efi_tcg2_register(); if (ret != EFI_SUCCESS) goto out; + + efi_tcg2_setup_measurement(); + efi_tcg2_do_initial_measurement(); } /* Secure boot */ diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index b44eed0ec9..2196af49a6 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -153,6 +153,20 @@ static u16 alg_to_len(u16 hash_alg) return 0; } +/** + * is_tcg2_protocol_installed - chech whether tcg2 protocol is installed + * + * @Return: true if tcg2 protocol is installed, false if not + */ +static bool is_tcg2_protocol_installed(void) +{ + struct efi_handler *handler; + efi_status_t ret; + + ret = efi_search_protocol(efi_root, &efi_guid_tcg2_protocol, &handler); + return (ret == EFI_SUCCESS); +} + static u32 tcg_event_final_size(struct tpml_digest_values *digest_list) { u32 len; @@ -962,6 +976,9 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size, IMAGE_NT_HEADERS32 *nt; struct efi_handler *handler; + if (!is_tcg2_protocol_installed()) + return EFI_NOT_READY; + ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) return ret; @@ -2140,6 +2157,9 @@ efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *ha u32 event = 0; struct smbios_entry *entry; + if (!is_tcg2_protocol_installed()) + return EFI_NOT_READY; + if (tcg2_efi_app_invoked) return EFI_SUCCESS; @@ -2190,6 +2210,9 @@ efi_status_t efi_tcg2_measure_efi_app_exit(void) efi_status_t ret; struct udevice *dev; + if (!is_tcg2_protocol_installed()) + return EFI_NOT_READY; + ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) return ret; @@ -2214,6 +2237,11 @@ efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context) EFI_ENTRY("%p, %p", event, context); + if (!is_tcg2_protocol_installed()) { + ret = EFI_NOT_READY; + goto out; + } + event_log.ebs_called = true; ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) @@ -2244,6 +2272,9 @@ efi_status_t efi_tcg2_notify_exit_boot_services_failed(void) struct udevice *dev; efi_status_t ret; + if (!is_tcg2_protocol_installed()) + return EFI_NOT_READY; + ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) goto out; @@ -2313,6 +2344,45 @@ error: return ret; } +/** + * efi_tcg2_setup_measurement() - setup for the measurement + * + * Return: status code + */ +efi_status_t efi_tcg2_setup_measurement(void) +{ + efi_status_t ret; + struct efi_event *event; + + ret = efi_create_event(EVT_SIGNAL_EXIT_BOOT_SERVICES, TPL_CALLBACK, + efi_tcg2_notify_exit_boot_services, NULL, + NULL, &event); + + return ret; +} + +/** + * efi_tcg2_do_initial_measurement() - do initial measurement + * + * Return: status code + */ +efi_status_t efi_tcg2_do_initial_measurement(void) +{ + efi_status_t ret; + struct udevice *dev; + + ret = platform_get_tpm2_device(&dev); + if (ret != EFI_SUCCESS) + goto out; + + ret = tcg2_measure_secure_boot_variable(dev); + if (ret != EFI_SUCCESS) + goto out; + +out: + return ret; +} + /** * efi_tcg2_register() - register EFI_TCG2_PROTOCOL * @@ -2324,7 +2394,6 @@ efi_status_t efi_tcg2_register(void) { efi_status_t ret = EFI_SUCCESS; struct udevice *dev; - struct efi_event *event; u32 err; ret = platform_get_tpm2_device(&dev); @@ -2344,6 +2413,10 @@ efi_status_t efi_tcg2_register(void) if (ret != EFI_SUCCESS) goto fail; + /* + * efi_add_protocol() is called at last on purpose. + * tcg2_uninit() does not uninstall the tcg2 protocol, but it is intended. + */ ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol, (void *)&efi_tcg2_protocol); if (ret != EFI_SUCCESS) { @@ -2351,20 +2424,6 @@ efi_status_t efi_tcg2_register(void) goto fail; } - ret = efi_create_event(EVT_SIGNAL_EXIT_BOOT_SERVICES, TPL_CALLBACK, - efi_tcg2_notify_exit_boot_services, NULL, - NULL, &event); - if (ret != EFI_SUCCESS) { - tcg2_uninit(); - goto fail; - } - - ret = tcg2_measure_secure_boot_variable(dev); - if (ret != EFI_SUCCESS) { - tcg2_uninit(); - goto fail; - } - return ret; fail: -- 2.17.1

2 3

[PATCH 1/1] tis: fix tpm_tis_remove()
by Heinrich Schuchardt 29 Nov '21

29 Nov '21

tpm_tis_remove() leads to calling tpm_tis_ready() with the IO region unmapped and chip->locality == -1 (locality released). This leads to a crash in mmio_write_bytes(). The patch implements these changes: tpm_tis_remove(): Unmap the IO region after calling tpm_tis_cleanup(). tpm_tis_cleanup(): Request locality before IO output and releasing locality. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- drivers/tpm/tpm2_tis_core.c | 6 ++++++ drivers/tpm/tpm2_tis_mmio.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/tpm/tpm2_tis_core.c b/drivers/tpm/tpm2_tis_core.c index ec8c730fe9..51392c4584 100644 --- a/drivers/tpm/tpm2_tis_core.c +++ b/drivers/tpm/tpm2_tis_core.c @@ -378,8 +378,14 @@ out: int tpm_tis_cleanup(struct udevice *dev) { struct tpm_chip *chip = dev_get_priv(dev); + int ret; + + ret = tpm_tis_request_locality(dev, 0); + if (ret) + return ret; tpm_tis_ready(dev); + tpm_tis_release_locality(dev, chip->locality); return 0; diff --git a/drivers/tpm/tpm2_tis_mmio.c b/drivers/tpm/tpm2_tis_mmio.c index 9cedff2225..a646ce41ff 100644 --- a/drivers/tpm/tpm2_tis_mmio.c +++ b/drivers/tpm/tpm2_tis_mmio.c @@ -118,10 +118,13 @@ iounmap: static int tpm_tis_remove(struct udevice *dev) { struct tpm_tis_chip_data *drv_data = (void *)dev_get_driver_data(dev); + int ret; + + ret = tpm_tis_cleanup(dev); iounmap(drv_data->iobase); - return tpm_tis_cleanup(dev); + return ret; } static const struct tpm_ops tpm_tis_ops = { -- 2.32.0

2 1

[PATCH 1/1] doc: qemu-arm peripherials
by Heinrich Schuchardt 29 Nov '21

29 Nov '21

* add description how to add RNG device * for a disk specify format=raw to avoid a warning * fix a typo Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- doc/board/emulation/qemu-arm.rst | 9 +++++++-- drivers/tpm/tpm2_tis_mmio.c | 5 ++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/doc/board/emulation/qemu-arm.rst b/doc/board/emulation/qemu-arm.rst index 584ef0a7e1..7c24e29410 100644 --- a/doc/board/emulation/qemu-arm.rst +++ b/doc/board/emulation/qemu-arm.rst @@ -65,7 +65,8 @@ can be enabled with the following command line parameters: - To add a Serial ATA disk via an Intel ICH9 AHCI controller, pass e.g.:: - -drive if=none,file=disk.img,id=mydisk -device ich9-ahci,id=ahci -device ide-drive,drive=mydisk,bus=ahci.0 + -drive if=none,file=disk.img,format=raw,id=mydisk \ + -device ich9-ahci,id=ahci -device ide-drive,drive=mydisk,bus=ahci.0 - To add an Intel E1000 network adapter, pass e.g.:: @@ -75,10 +76,14 @@ can be enabled with the following command line parameters: -device usb-ehci,id=ehci -- To add a NVMe disk, pass e.g.:: +- To add an NVMe disk, pass e.g.:: -drive if=none,file=disk.img,id=mydisk -device nvme,drive=mydisk,serial=foo +- To add a random number generator, pass e.g.:: + + -device virtio-rng-pci + These have been tested in QEMU 2.9.0 but should work in at least 2.5.0 as well. Enabling TPMv2 support diff --git a/drivers/tpm/tpm2_tis_mmio.c b/drivers/tpm/tpm2_tis_mmio.c index 9cedff2225..f04aab2e6e 100644 --- a/drivers/tpm/tpm2_tis_mmio.c +++ b/drivers/tpm/tpm2_tis_mmio.c @@ -118,10 +118,13 @@ iounmap: static int tpm_tis_remove(struct udevice *dev) { struct tpm_tis_chip_data *drv_data = (void *)dev_get_driver_data(dev); + int ret; + + ret = tpm_tis_cleanup(dev); iounmap(drv_data->iobase); - return tpm_tis_cleanup(dev); + return ret; } static const struct tpm_ops tpm_tis_ops = { -- 2.32.0

2 2

[PATCH v4] env: Avoid using GNU features in awk
by Simon Glass 29 Nov '21

29 Nov '21

GNU has a very useful third argument to match() but this is not supported in the POSIX awk. Update the code to cope, so that the script is POSIX-compliant. Signed-off-by: Simon Glass <sjg(a)chromium.org> --- Changes in v4: - Avoid using length() to access the length of the array Changes in v3: - Reword commit message and comment to avoid casting aspersions Changes in v2: - Fix the has_var match() that had left-over test code scripts/env2string.awk | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/scripts/env2string.awk b/scripts/env2string.awk index 57d0fc8f3ba..1bfe9ed07a4 100644 --- a/scripts/env2string.awk +++ b/scripts/env2string.awk @@ -21,29 +21,39 @@ BEGIN { # Skip empty lines, as these are generated by the clang preprocessor NF { + do_output = 0 + # Quote quotes gsub("\"", "\\\"") + # Avoid using the non-POSIX third parameter to match(), by splitting + # the work into several steps. + has_var = match($0, "^([^ \t=][^ =]*)=(.*)$") + # Is this the start of a new environment variable? - if (match($0, "^([^ \t=][^ =]*)=(.*)$", arr)) { + if (has_var) { if (length(env) != 0) { # Record the value of the variable now completed vars[var] = env + do_output = 1 } - var = arr[1] - env = arr[2] + + # Collect the variable name. The value follows the '=' + match($0, "^([^ \t=][^ =]*)=") + var = substr($0, 1, RLENGTH - 1) + env = substr($0, RLENGTH + 1) # Deal with += which concatenates the new string to the existing - # variable - if (length(env) != 0 && match(var, "^(.*)[+]$", var_arr)) - { + # variable. Again we are careful to use POSIX match() + if (length(env) != 0 && match(var, "^(.*)[+]$")) { + plusname = substr(var, RSTART, RLENGTH - 1) # Allow var\+=val to indicate that the variable name is # var+ and this is not actually a concatenation - if (substr(var_arr[1], length(var_arr[1])) == "\\") { + if (substr(plusname, length(plusname)) == "\\") { # Drop the backslash sub(/\\[+]$/, "+", var) } else { - var = var_arr[1] + var = plusname env = vars[var] env } } @@ -65,9 +75,10 @@ END { # empty it is not set. if (length(env) != 0) { vars[var] = env + do_output = 1 } - if (length(vars) != 0) { + if (do_output) { printf("%s", "#define CONFIG_EXTRA_ENV_TEXT \"") # Print out all the variables -- 2.34.0.rc2.393.gf8c9666880-goog

2 3

[PATCH V2] cmd_nandbcb: Support secondary boot address of imx8mn
by Michael Trimarchi 28 Nov '21

28 Nov '21

Add support of secondary boot address for imx8mn. The secondary boot address is hardcoded in the fuse. The value is calculated from there according to the following description: The fuse IMG_CNTN_SET1_OFFSET (0x490[22:19]) is defined as follows: • Secondary boot is disabled if fuse value is bigger than 10, n = fuse value bigger than 10. • n == 0: Offset = 4MB • n == 2: Offset = 1MB • Others & n <= 10 : Offset = 1MB*2^n • For FlexSPI boot, the valid values are: 0, 1, 2, 3, 4, 5, 6, and 7. Signed-off-by: Michael Trimarchi <michael(a)amarulasolutions.com> --- Changes V1->V2: - adjust commit message - drop and extra blank line --- arch/arm/mach-imx/cmd_nandbcb.c | 40 +++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/arch/arm/mach-imx/cmd_nandbcb.c b/arch/arm/mach-imx/cmd_nandbcb.c index 09622c13c9..bd14b8583a 100644 --- a/arch/arm/mach-imx/cmd_nandbcb.c +++ b/arch/arm/mach-imx/cmd_nandbcb.c @@ -132,6 +132,7 @@ static struct platform_config imx8q_plat_config = { /* boot search related variables and definitions */ static int g_boot_search_count = 4; +static int g_boot_secondary_offset; static int g_boot_search_stride; static int g_pages_per_stride; @@ -275,9 +276,9 @@ static int nandbcb_set_boot_config(int argc, char * const argv[], boot_stream2_address = ((maxsize - boot_stream1_address) / 2 + boot_stream1_address); - if (boot_cfg->secondary_boot_stream_off_in_MB) + if (g_boot_secondary_offset) boot_stream2_address = - (loff_t)boot_cfg->secondary_boot_stream_off_in_MB * 1024 * 1024; + (loff_t)g_boot_secondary_offset * 1024 * 1024; max_boot_stream_size = boot_stream2_address - boot_stream1_address; @@ -1269,6 +1270,36 @@ static bool check_fingerprint(void *data, int fingerprint) return (*(int *)(data + off) == fingerprint); } +static int fuse_secondary_boot(u32 bank, u32 word, u32 mask, u32 off) +{ + int err; + u32 val; + int ret; + + err = fuse_read(bank, word, &val); + if (err) + return 0; + + val = (val & mask) >> off; + + if (val > 10) + return 0; + + switch (val) { + case 0: + ret = 4; + break; + case 1: + ret = 1; + break; + default: + ret = 2 << val; + break; + } + + return ret; +}; + static int fuse_to_search_count(u32 bank, u32 word, u32 mask, u32 off) { int err; @@ -1506,6 +1537,11 @@ static int do_nandbcb(struct cmd_tbl *cmdtp, int flag, int argc, g_boot_search_count); } + if ((plat_config.misc_flags) & FIRMWARE_SECONDARY_FIXED_ADDR) { + if (is_imx8mn()) + g_boot_secondary_offset = fuse_secondary_boot(2, 1, 0xff0000, 16); + } + cmd = argv[1]; --argc; ++argv; -- 2.25.1

3 3

[BUG] tpm2_tis_mmio driver crashes on device_remove()
by Heinrich Schuchardt 28 Nov '21

28 Nov '21

Hello Ilias, I have compiled qemu_arm64_defconfig with CONFIG_CMD_EFIDEBUG=y and CONFIG_CMD_UNBIND. When I execute the commands efidebug dh unbind tpm 0 a crash occurs in tpm_tis_ready(). tpm_tis_remove() calls iounmmap() before calling tpm_tis_cleanup() which invokes tpm_tis_ready(). tpm_tis_ready() writes to the unmapped IO. You should not unmap the IO region before accessing it in tpm_tis_ready(). But swapping these calls is not enough to fix the problem. Best regards Heinrich

1 1

Altera Socfpga reset issue
by Henk Medenblik 28 Nov '21

28 Nov '21

Hi all, I am porting an old yocto project that used 2018.11 version of u-boot on a Cyclone V socfpga. I recently switched to u-boot 2021.04 and experienced one issue now on my board which I am trying to tackle now. The issue that I have is that when I am in the u-boot shell and try to command a reset that I only remain with some text like: 'resetting ...' and an endless stuck. So I fired up ARM-DS5 and tried to debug both versions of u-boot ,the old 2018.11 and the new 2021.04 The difference that I see is that the 2018.11 ends up with the do_reset() call inside arch/arm/lib/reset.c while the 2021.04 version ends with a do_reset() from sysreset-uclass.c. In effect, the 2018.11 version ends up with code issuing a warm reset (which I believe is correct) and the one that I have trouble with (2021.04) ends up with code issuing a cold reset. I believe the latter is not correct right? And if it is correct due to a main change of the reset sequence in the new u-boot, what could be the reason that it remains in a hang situation? Is this a configuration error for my board? Regards Henk -- “Do. Or do not. There is no try.”...

1 0

[u-boot-test-hooks] writer: Add imx_raw variant
by Tom Rini 27 Nov '21

27 Nov '21

When flashing the SD card for an imx platform, we need to use u-boot-with-spl.imx at an offset of 1024 bytes in to the device. Signed-off-by: Tom Rini <trini(a)konsulko.com> --- bin/writer.imx_raw | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100755 bin/writer.imx_raw diff --git a/bin/writer.imx_raw b/bin/writer.imx_raw new file mode 100755 index 000000000000..4708bab3ca28 --- /dev/null +++ b/bin/writer.imx_raw @@ -0,0 +1,39 @@ +# Copyright 2021 Konsulko Group, All rights reserved. +# Based on writer.sunxi_raw which is +# Copyright 2019 Google LLC. All rights reserved. +# +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL +# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. + +# Writes raw imx images to the board + +# Args: +# $1: Device path of the sdcard when board is off (e.g. /dev/sdcard0) +# $2: U-Boot build directory + +set -e + +device=$1 +build=$2 + +echo "Writing to ${device} from build at ${build}" + +# At least partially zero out the previous image +dd if=/dev/zero of=$device bs=1k seek=1 count=128 +dd if=${build}/u-boot-with-spl.imx of=$device bs=1024 seek=1 +sync $device -- 2.25.1

1 1

[PATCH v2 1/1] Enable TPMv2 emulation
by Heinrich Schuchardt 27 Nov '21

27 Nov '21

Provide a QEMU helper script to launch swtpm and add extra parameters to conf.qemu_arm64_na and conf.qemu_arm_na to provide an emulated TPMv2. Reviewed-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- v2: daemonize swtpm --- bin/qemu.swtpm | 23 +++++++++++++++++++++++ bin/travis-ci/conf.qemu_arm64_na | 3 ++- bin/travis-ci/conf.qemu_arm_na | 3 ++- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100755 bin/qemu.swtpm diff --git a/bin/qemu.swtpm b/bin/qemu.swtpm new file mode 100755 index 0000000..c40c537 --- /dev/null +++ b/bin/qemu.swtpm @@ -0,0 +1,23 @@ +#!/bin/sh +# SPDX-License-Identifier: BSD-2 +# +# This script launches swtpm to emulate a TPMv2. +# +# The parameter -t makes it unload when the connection to QEMU is +# terminated. +# +# To make use of it add +# +# qemu_helper_script="swtpm" +# +# to the board script and the following arguments to qemu_extra_args +# +# -chardev socket,id=chrtpm,path=/tmp/tpm/swtpm-sock \ +# -tpmdev emulator,id=tpm0,chardev=chrtpm \ +# -device tpm-tis-device,tpmdev=tpm0 +# +# U-Boot must be built with CONFIG_TPM2_MMIO=y. + +mkdir -p /tmp/tpm +swtpm socket -d -t --tpmstate dir=/tmp/tpm --tpm2 \ +--ctrl type=unixio,path=/tmp/tpm/swtpm-sock diff --git a/bin/travis-ci/conf.qemu_arm64_na b/bin/travis-ci/conf.qemu_arm64_na index e7c9426..14577d8 100644 --- a/bin/travis-ci/conf.qemu_arm64_na +++ b/bin/travis-ci/conf.qemu_arm64_na @@ -22,8 +22,9 @@ console_impl=qemu qemu_machine="virt" +qemu_helper_script="swtpm" qemu_binary="qemu-system-aarch64" -qemu_extra_args="-cpu cortex-a57 -nographic -netdev user,id=net0,tftp=${UBOOT_TRAVIS_BUILD_DIR} -device e1000,netdev=net0 -device virtio-rng-pci" +qemu_extra_args="-cpu cortex-a57 -nographic -netdev user,id=net0,tftp=${UBOOT_TRAVIS_BUILD_DIR} -device e1000,netdev=net0 -device virtio-rng-pci -chardev socket,id=chrtpm,path=/tmp/tpm/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-device,tpmdev=tpm0" qemu_kernel_args="-bios ${U_BOOT_BUILD_DIR}/u-boot.bin" reset_impl=none flash_impl=none diff --git a/bin/travis-ci/conf.qemu_arm_na b/bin/travis-ci/conf.qemu_arm_na index 0f07c80..de0694d 100644 --- a/bin/travis-ci/conf.qemu_arm_na +++ b/bin/travis-ci/conf.qemu_arm_na @@ -22,8 +22,9 @@ console_impl=qemu qemu_machine="virt" +qemu_helper_script="swtpm" qemu_binary="qemu-system-arm" -qemu_extra_args="-nographic -netdev user,id=net0,tftp=${UBOOT_TRAVIS_BUILD_DIR} -device e1000,netdev=net0 -device virtio-rng-pci" +qemu_extra_args="-nographic -netdev user,id=net0,tftp=${UBOOT_TRAVIS_BUILD_DIR} -device e1000,netdev=net0 -device virtio-rng-pci -chardev socket,id=chrtpm,path=/tmp/tpm/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-device,tpmdev=tpm0" qemu_kernel_args="-bios ${U_BOOT_BUILD_DIR}/u-boot.bin" reset_impl=none flash_impl=none -- 2.32.0

2 1

[PATCH] tpm: avoid NULL pointer dereference in tpm_tis_send()
by Heinrich Schuchardt 27 Nov '21

27 Nov '21

You should not dereference a pointer before checking if it is NULL. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- drivers/tpm/tpm2_tis_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tpm/tpm2_tis_core.c b/drivers/tpm/tpm2_tis_core.c index ec8c730fe9..0ff21a1ef7 100644 --- a/drivers/tpm/tpm2_tis_core.c +++ b/drivers/tpm/tpm2_tis_core.c @@ -218,7 +218,7 @@ static int tpm_tis_ready(struct udevice *dev) int tpm_tis_send(struct udevice *dev, const u8 *buf, size_t len) { struct tpm_chip *chip = dev_get_priv(dev); - struct tpm_tis_phy_ops *phy_ops = chip->phy_ops; + struct tpm_tis_phy_ops *phy_ops; size_t burstcnt, wr_size, sent = 0; u8 data = TPM_STS_GO; u8 status; @@ -227,6 +227,8 @@ int tpm_tis_send(struct udevice *dev, const u8 *buf, size_t len) if (!chip) return -ENODEV; + phy_ops = chip->phy_ops; + ret = tpm_tis_request_locality(dev, 0); if (ret < 0) return -EBUSY; -- 2.32.0

2 3