Re: [v2] [PATCH 2/3] tpm: use more algorithms than sha256 on pcr_read

[Ilias Apalodimas <ilias.apalodimas@linaro.org>]

On Tue, Nov 23, 2021 at 05:23:34PM +0530, Ruchika Gupta wrote:
> The current tpm2_pcr_read is hardcoded using SHA256. Make the
> actual command to TPM configurable to use wider range of algorithms.
> The current command line is kept as is i.e limited to SHA-256 only.
> 
> Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
> ---
> v2:
> Change algorithm from u32 to u16
> Add parameter description in function declaration
> 
>  cmd/tpm-v2.c     |  3 ++-
>  include/tpm-v2.h |  5 ++++-
>  lib/tpm-v2.c     | 12 ++++++++----
>  3 files changed, 14 insertions(+), 6 deletions(-)
> 
> diff --git a/cmd/tpm-v2.c b/cmd/tpm-v2.c
> index daae91100a..4ea5f9f094 100644
> --- a/cmd/tpm-v2.c
> +++ b/cmd/tpm-v2.c
> @@ -151,7 +151,8 @@ static int do_tpm_pcr_read(struct cmd_tbl *cmdtp, int flag, int argc,
>  
>  	data = map_sysmem(simple_strtoul(argv[2], NULL, 0), 0);
>  
> -	rc = tpm2_pcr_read(dev, index, priv->pcr_select_min, data, &updates);
> +	rc = tpm2_pcr_read(dev, index, priv->pcr_select_min, TPM2_ALG_SHA256,
> +			   data, TPM2_DIGEST_LEN, &updates);
>  	if (!rc) {
>  		printf("PCR #%u content (%u known updates):\n", index, updates);
>  		print_byte_string(data, TPM2_DIGEST_LEN);
> diff --git a/include/tpm-v2.h b/include/tpm-v2.h
> index ceff7d245e..4e9dd52cb6 100644
> --- a/include/tpm-v2.h
> +++ b/include/tpm-v2.h
> @@ -512,13 +512,16 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
>   * @dev		TPM device
>   * @idx		Index of the PCR
>   * @idx_min_sz	Minimum size in bytes of the pcrSelect array
> + * @algorithm	Algorithm used, defined in 'enum tpm2_algorithms'
>   * @data	Output buffer for contents of the named PCR
> + * @digest_len  len of the data
>   * @updates	Optional out parameter: number of updates for this PCR
>   *
>   * @return code of the operation
>   */
>  u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
> -		  void *data, unsigned int *updates);
> +		  u16 algorithm, void *data, u32 digest_len,
> +		  unsigned int *updates);
>  
>  /**
>   * Issue a TPM2_GetCapability command.  This implementation is limited
> diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
> index 2e7b27bd6b..1bf627853a 100644
> --- a/lib/tpm-v2.c
> +++ b/lib/tpm-v2.c
> @@ -254,7 +254,8 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
>  }
>  
>  u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
> -		  void *data, unsigned int *updates)
> +		  u16 algorithm, void *data, u32 digest_len,
> +		  unsigned int *updates)
>  {
>  	u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
>  	u8 command_v2[COMMAND_BUFFER_SIZE] = {
> @@ -264,7 +265,7 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
>  
>  		/* TPML_PCR_SELECTION */
>  		tpm_u32(1),			/* Number of selections */
> -		tpm_u16(TPM2_ALG_SHA256),	/* Algorithm of the hash */
> +		tpm_u16(algorithm),		/* Algorithm of the hash */
>  		idx_array_sz,			/* Array size for selection */
>  		/* bitmap(idx)			   Selected PCR bitmap */
>  	};
> @@ -283,10 +284,13 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
>  	if (ret)
>  		return ret;
>  
> +	if (digest_len > response_len)
> +		return TPM_LIB_ERROR;
> +
>  	if (unpack_byte_string(response, response_len, "ds",
>  			       10, &counter,
> -			       response_len - TPM2_DIGEST_LEN, data,
> -			       TPM2_DIGEST_LEN))
> +			       response_len - digest_len, data,
> +			       digest_len))
>  		return TPM_LIB_ERROR;
>  
>  	if (updates)
> -- 
> 2.25.1
> 

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>