Add support for the TPM2_PCR_Read command.
Change the command file and the help accordingly.
Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com --- cmd/tpm.c | 23 ++++++++++++++--------- include/tpm.h | 4 ++-- lib/tpm.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 71 insertions(+), 12 deletions(-)
diff --git a/cmd/tpm.c b/cmd/tpm.c index 3f284f0adf..8630571b1a 100644 --- a/cmd/tpm.c +++ b/cmd/tpm.c @@ -362,21 +362,25 @@ static int do_tpm_pcr_extend(cmd_tbl_t *cmdtp, int flag, }
static int do_tpm_pcr_read(cmd_tbl_t *cmdtp, int flag, - int argc, char * const argv[]) + int argc, char * const argv[]) { - uint32_t index, count, rc; + bool is_tpmv2 = (tpm_get_specification() == 2); + u32 index, rc; + unsigned int updates; void *data;
- if (argc != 4) + if (argc != 3) return CMD_RET_USAGE; + index = simple_strtoul(argv[1], NULL, 0); data = (void *)simple_strtoul(argv[2], NULL, 0); - count = simple_strtoul(argv[3], NULL, 0);
- rc = tpm_pcr_read(index, data, count); + rc = tpm_pcr_read(index, data, &updates); if (!rc) { - puts("Named PCR content:\n"); - print_byte_string(data, count); + printf("Named PCR %u content (known updates: %d):\n", index, + is_tpmv2 ? updates : -1); + print_byte_string(data, !is_tpmv2 ? TPM1_DIGEST_LENGTH : + TPM2_DIGEST_LENGTH); }
return report_return_code(rc); @@ -1038,12 +1042,13 @@ U_BOOT_CMD(tpm, CONFIG_SYS_MAXARGS, 1, do_tpm, " - Add a new measurement to a PCR. Update PCR <index> with\n" " <digest_in>. It must be a 20 byte digest for TPMv1 or a SHA256\n" " digest of 32 bytes for TPMv2. Value of the PCR is given at <digest_out>\n" -" pcr_read index addr count\n" -" - Read <count> bytes from PCR <index> to memory address <addr>.\n" " pcr_extend index <digest_in>\n" " - Add a new measurement to a PCR. Update PCR <index> with\n" " <digest_in>. It must be a 20 byte digest for TPMv1 or a SHA256\n" " digest of 32 bytes for TPMv2.\n" +" pcr_read <index> <digest_in>\n" +" - Read PCR <index> to memory address <digest_in> (20B with TPMv1, 64B with\n" +" TPMv2).\n" #ifdef CONFIG_TPM_AUTH_SESSIONS "Authorization Sessions\n" " oiap\n" diff --git a/include/tpm.h b/include/tpm.h index b88ad4b2f4..2df2ea3c5b 100644 --- a/include/tpm.h +++ b/include/tpm.h @@ -571,10 +571,10 @@ int tpm2_pcr_extend(u32 index, const uint8_t *digest); * * @param index index of the PCR * @param data output buffer for contents of the named PCR - * @param count size of output buffer + * @param updates optional out parameter: number of updates for this PCR * @return return code of the operation */ -uint32_t tpm_pcr_read(uint32_t index, void *data, size_t count); +int tpm_pcr_read(u32 index, void *data, unsigned int *updates);
/** * Issue a TSC_PhysicalPresence command. TPM physical presence flag diff --git a/lib/tpm.c b/lib/tpm.c index e74530d538..925b21e2d6 100644 --- a/lib/tpm.c +++ b/lib/tpm.c @@ -568,7 +568,7 @@ int tpm2_pcr_extend(u32 index, const uint8_t *digest) return tpm_sendrecv_command(command_v2, NULL, NULL); }
-uint32_t tpm_pcr_read(uint32_t index, void *data, size_t count) +int tpm1_pcr_read(u32 index, void *data) { const uint8_t command[14] = { 0x0, 0xc1, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x15, @@ -596,6 +596,60 @@ uint32_t tpm_pcr_read(uint32_t index, void *data, size_t count) return 0; }
+int tpm2_pcr_read(u32 index, void *data, unsigned int *updates) +{ + u8 command_v2[COMMAND_BUFFER_SIZE] = { + STRINGIFY16(TPM2_ST_NO_SESSIONS), /* TAG */ + STRINGIFY32(20), /* Command size */ + STRINGIFY32(TPM2_CC_PCR_READ), /* Command code */ + + /* TPML_PCR_SELECTION */ + STRINGIFY32(1), /* Number of selections */ + STRINGIFY16(TPM2_ALG_SHA256), /* Algorithm of the hash */ + 3, /* Array size for selection */ + /* STRINGIFY32(bitmap(index) << 8) Selected PCR bitmap */ + }; + size_t response_len = COMMAND_BUFFER_SIZE; + u8 response[COMMAND_BUFFER_SIZE]; + unsigned int counter = 0; + u8 pcr_sel[3] = {}; + int ret; + + if (!is_tpmv2) + return TPM_LIB_ERROR; + + if (index >= 24) + return TPM_LIB_ERROR; + + pcr_sel[index / 8] = BIT(index % 8); + if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "bbb", + 17, pcr_sel[0], 18, pcr_sel[1], 19, pcr_sel[2])) + return TPM_LIB_ERROR; + + ret = tpm_sendrecv_command(command_v2, response, &response_len); + if (ret) + return ret; + + if (unpack_byte_string(response, response_len, "ds", + 10, &counter, + response_len - TPM2_DIGEST_LENGTH, data, + TPM2_DIGEST_LENGTH)) + return TPM_LIB_ERROR; + + if (updates) + *updates = counter; + + return 0; +} + +int tpm_pcr_read(u32 index, void *data, unsigned int *updates) +{ + if (!is_tpmv2) + return tpm1_pcr_read(index, data); + else + return tpm2_pcr_read(index, data, updates); +} + uint32_t tpm_tsc_physical_presence(uint16_t presence) { const uint8_t command[12] = {