Commit graph

12 commits

Author SHA1 Message Date
Tom Rini
667d685697 tpm: Fix comparison of unsigned expression warning
The function tpm_xfer returns int so make 'err' be int rather than
uint32_t so that we can catch an error condition.  Reported by
clang-3.8.

Signed-off-by: Tom Rini <trini@konsulko.com>
2017-05-12 08:37:40 -04:00
mario.six@gdsys.cc
0f4b2ba176 tpm: Add function to load keys via their parent's SHA1 hash
If we want to load a key into a TPM, we need to know the designated parent
key's handle, so that the TPM is able to insert the key at the correct place in
the key hierarchy.

However, if we want to load a key whose designated parent key we also
previously loaded ourselves, we first need to memorize this parent key's handle
(since the handles for the key are chosen at random when they are inserted into
the TPM). If we are, however, unable to do so, for example if the parent key is
loaded into the TPM during production, and its child key during the actual
boot, we must find a different mechanism to identify the parent key.

To solve this problem, we add a function that allows U-Boot to load a key into
the TPM using their designated parent key's SHA1 hash, and the corresponding
auth data.

Signed-off-by: Mario Six <mario.six@gdsys.cc>
Reviewed-by: Simon Glass <sjg@chromium.org>
2017-03-26 13:22:58 -06:00
Mario Six
7690be35de lib: tpm: Add command to flush resources
This patch adds a function to the TPM library, which allows U-Boot to
flush resources, e.g. keys, from the TPM.

Signed-off-by: Mario Six <mario.six@gdsys.cc>
Reviewed-by: Stefan Roese <sr@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Stefan Roese <sr@denx.de>
2017-02-01 09:02:57 +01:00
Simon Glass
3f603cbbb8 dm: Use uclass_first_device_err() where it is useful
Use this new function in places where it simplifies the code.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-03-14 15:34:50 -06:00
Christophe Ricard
0e37d4c2c6 tpm: Fix fault in case CONFIG_DM_TPM is set without any TPM
In case CONFIG_DM_TPM was set without any TPM chipset configured a fault
was generated (NULL pointer access).

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
2016-01-28 21:01:22 -07:00
Christophe Ricard
c2b0f600a1 dm: tpm: Remove every compilation switch for TPM driver model
As every TPM drivers support UCLASS_TPM, we can only rely on DM_TPM
functions.

This simplify a bit the code.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Acked-by: Simon Glass <sjg@chromium.org>
2015-10-23 09:42:28 -06:00
Simon Glass
2132f971ba tpm: Add functions to access flags and permissions
Add a few new functions which will be used by the test command in a future
patch.

Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Christophe Ricard<christophe-h.ricard@st.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
2015-08-31 07:57:29 -06:00
Simon Glass
c8a8c51039 dm: tpm: Convert the TPM command and library to driver model
Add driver model support to the TPM command and the TPM library. Both
support only a single TPM at present.

Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Christophe Ricard<christophe-h.ricard@st.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
2015-08-31 07:57:28 -06:00
Jeroen Hofstee
2b9912e6a7 includes: move openssl headers to include/u-boot
commit 18b06652cd "tools: include u-boot version of sha256.h"
unconditionally forced the sha256.h from u-boot to be used
for tools instead of the host version. This is fragile though
as it will also include the host version. Therefore move it
to include/u-boot to join u-boot/md5.h etc which were renamed
for the same reason.

cc: Simon Glass <sjg@chromium.org>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>
2014-06-19 11:19:04 -04:00
Wolfgang Denk
1a4596601f Add GPL-2.0+ SPDX-License-Identifier to source files
Signed-off-by: Wolfgang Denk <wd@denx.de>
[trini: Fixup common/cmd_io.c]
Signed-off-by: Tom Rini <trini@ti.com>
2013-07-24 09:44:38 -04:00
Reinhard Pfau
be6c1529c1 tpm: add AUTH1 cmds for LoadKey2 and GetPubKey
Extend the tpm library with support for single authorized (AUTH1) commands
as specified in the TCG Main Specification 1.2. (The internally used helper
functions are implemented in a way that they could also be used for double
authorized commands if someone needs it.)

Provide enums with the return codes from the TCG Main specification.

For now only a single OIAP session is supported.

OIAP authorized version of the commands TPM_LoadKey2 and TPM_GetPubKey are
provided. Both features are available using the 'tpm' command, too.

Authorized commands are enabled with CONFIG_TPM_AUTH_SESSIONS. (Note that
this also requires CONFIG_SHA1 to be enabled.)

Signed-off-by: Reinhard Pfau <reinhard.pfau@gdsys.cc>
Signed-off-by: Dirk Eibach <dirk.eibach@gdsys.cc>
Acked-by: Che-Liang Chiou <clchiou@chromium.org>
Signed-off-by: Andy Fleming <afleming@freescale.com>
2013-07-16 17:44:29 -05:00
Che-liang Chiou
8732b0700d tpm: Add TPM command library
TPM command library implements a subset of TPM commands defined in TCG
Main Specification 1.2 that are useful for implementing secure boot.
More TPM commands could be added out of necessity.

You may exercise these commands through the 'tpm' command.  However, the
raw TPM commands are too primitive for writing secure boot in command
interpreter scripts; so the 'tpm' command also provides helper functions
to make scripting easier.

For example, to define a counter in TPM non-volatile storage and
initialize it to zero:

$ tpm init
$ tpm startup TPM_ST_CLEAR
$ tpm nv_define d 0x1001 0x1
$ tpm nv_write d 0x1001 0

And then increment the counter by one:

$ tpm nv_read d 0x1001 i
$ setexpr.l i $i + 1
$ tpm nv_write d 0x1001 $i

Signed-off-by: Che-Liang Chiou <clchiou@chromium.org>
2013-04-12 14:13:13 -07:00