On 1 December 2016 at 01:42, Stefan Roese sr@denx.de wrote:
(Adding Simon to Cc)
On 23.11.2016 16:12, Mario Six wrote:
This patch adds a function to the TPM library, which allows U-Boot to flush resources, e.g. keys, from the TPM.
Signed-off-by: Mario Six mario.six@gdsys.cc
Simon, do you have any comments on this patch please?
Reviewed-by: Simon Glass sjg@chromium.org
Is it possible to add a new tpm subcommand for this?
board/gdsys/p1022/controlcenterd-id.c | 9 ------- include/tpm.h | 45 +++++++++++++++++++++++++++++++++++ lib/tpm.c | 28 ++++++++++++++++++++++ 3 files changed, 73 insertions(+), 9 deletions(-)
diff --git a/board/gdsys/p1022/controlcenterd-id.c b/board/gdsys/p1022/controlcenterd-id.c index 2c6c698..1648f13 100644 --- a/board/gdsys/p1022/controlcenterd-id.c +++ b/board/gdsys/p1022/controlcenterd-id.c @@ -43,15 +43,6 @@ #define CCDM_AUTO_FIRST_STAGE #endif
-/* enums from TCG specs */ -enum {
/* capability areas */TPM_CAP_NV_INDEX = 0x00000011,TPM_CAP_HANDLE = 0x00000014,/* resource types */TPM_RT_KEY = 0x00000001,-};
/* CCDM specific contants */ enum { /* NV indices */ diff --git a/include/tpm.h b/include/tpm.h index 9a6585d..800f29c 100644 --- a/include/tpm.h +++ b/include/tpm.h @@ -47,6 +47,42 @@ enum tpm_nv_index { TPM_NV_INDEX_DIR = 0x10000001, };
+enum tpm_resource_type {
TPM_RT_KEY = 0x00000001,TPM_RT_AUTH = 0x00000002,TPM_RT_HASH = 0x00000003,TPM_RT_TRANS = 0x00000004,TPM_RT_CONTEXT = 0x00000005,TPM_RT_COUNTER = 0x00000006,TPM_RT_DELEGATE = 0x00000007,TPM_RT_DAA_TPM = 0x00000008,TPM_RT_DAA_V0 = 0x00000009,TPM_RT_DAA_V1 = 0x0000000A,+};
+enum tpm_capability_areas {
TPM_CAP_ORD = 0x00000001,TPM_CAP_ALG = 0x00000002,TPM_CAP_PID = 0x00000003,TPM_CAP_FLAG = 0x00000004,TPM_CAP_PROPERTY = 0x00000005,TPM_CAP_VERSION = 0x00000006,TPM_CAP_KEY_HANDLE = 0x00000007,TPM_CAP_CHECK_LOADED = 0x00000008,TPM_CAP_SYM_MODE = 0x00000009,TPM_CAP_KEY_STATUS = 0x0000000C,TPM_CAP_NV_LIST = 0x0000000D,TPM_CAP_MFR = 0x00000010,TPM_CAP_NV_INDEX = 0x00000011,TPM_CAP_TRANS_ALG = 0x00000012,TPM_CAP_HANDLE = 0x00000014,TPM_CAP_TRANS_ES = 0x00000015,TPM_CAP_AUTH_ENCRYPT = 0x00000017,TPM_CAP_SELECT_SIZE = 0x00000018,TPM_CAP_DA_LOGIC = 0x00000019,TPM_CAP_VERSION_VAL = 0x0000001A,+};
#define TPM_NV_PER_GLOBALLOCK (1U << 15) #define TPM_NV_PER_PPWRITE (1U << 0) #define TPM_NV_PER_READ_STCLEAR (1U << 31) @@ -594,4 +630,13 @@ uint32_t tpm_get_permanent_flags(struct tpm_permanent_flags *pflags); */ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm);
+/**
- Flush a resource with a given handle and type from the TPM
- @param key_handle handle of the resource
- @param resource_type type of the resource
- @return return code of the operation
- */
+uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type);
#endif /* __TPM_H */ diff --git a/lib/tpm.c b/lib/tpm.c index 88f2406..98c20a0 100644 --- a/lib/tpm.c +++ b/lib/tpm.c @@ -645,6 +645,34 @@ uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm) return 0; }
+uint32_t tpm_flush_specific(uint32_t key_handle, uint32_t resource_type) +{
const uint8_t command[18] = {0x00, 0xc1, /* TPM_TAG */0x00, 0x00, 0x00, 0x12, /* parameter size */0x00, 0x00, 0x00, 0xba, /* TPM_COMMAND_CODE */0x00, 0x00, 0x00, 0x00, /* key handle */0x00, 0x00, 0x00, 0x00, /* resource type */};const size_t key_handle_offset = 10;const size_t resource_type_offset = 14;
Drop blank line
uint8_t buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];size_t response_length = sizeof(response);uint32_t err;if (pack_byte_string(buf, sizeof(buf), "sdd",0, command, sizeof(command),key_handle_offset, key_handle,resource_type_offset, resource_type))return TPM_LIB_ERROR;err = tpm_sendrecv_command(buf, response, &response_length);if (err)return err;return 0;+}
#ifdef CONFIG_TPM_AUTH_SESSIONS
/**
Thanks, Stefan
Regards, Simon