Re: [PATCH 9/9] sandbox: tpm: Support extending a PCR multiple times

[Ilias Apalodimas <ilias.apalodimas@linaro.org>]

On Mon, Jul 05, 2021 at 09:48:49AM -0600, Simon Glass wrote:
> It is fairly easy to handle this case and it makes the emulator more
> useful, since PCRs are commonly extended several times.
> 
> Add support for this, using U-Boot's sha256 support.
> 
> Signed-off-by: Simon Glass <sjg@chromium.org>
> ---
> 
>  drivers/tpm/tpm2_tis_sandbox.c | 19 ++++++++++++-------
>  1 file changed, 12 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/tpm/tpm2_tis_sandbox.c b/drivers/tpm/tpm2_tis_sandbox.c
> index ed9c9a0bc9f..e84bcc7c4c8 100644
> --- a/drivers/tpm/tpm2_tis_sandbox.c
> +++ b/drivers/tpm/tpm2_tis_sandbox.c
> @@ -11,6 +11,7 @@
>  #include <asm/unaligned.h>
>  #include <linux/bitops.h>
>  #include <u-boot/crc.h>
> +#include <u-boot/sha256.h>
>  #include "sandbox_common.h"
>  
>  /* Hierarchies */
> @@ -407,15 +408,19 @@ static int sandbox_tpm2_extend(struct udevice *dev, int pcr_index,
>  			       const u8 *extension)
>  {
>  	struct sandbox_tpm2 *tpm = dev_get_priv(dev);
> -	int i;
>  
> -	/* Only simulate the first extensions from all '0' with only '0' */
> -	for (i = 0; i < TPM2_DIGEST_LEN; i++)
> -		if (tpm->pcr[pcr_index][i] || extension[i])
> -			return TPM2_RC_FAILURE;
> +	if (!pcr_index) {
> +		memcpy(tpm->pcr[pcr_index], sandbox_extended_once_pcr,
> +		       TPM2_DIGEST_LEN);

Why do we have to treat pcr 0 specially?
Can't we just get rid of sandbox_extended_once_pcr and just extend all the
PCRs with the value wee get?

> +	} else {
> +		sha256_context ctx;
> +
> +		sha256_starts(&ctx);
> +		sha256_update(&ctx, tpm->pcr[pcr_index], TPM2_DIGEST_LEN);
> +		sha256_update(&ctx, extension, TPM2_DIGEST_LEN);
> +		sha256_finish(&ctx, tpm->pcr[pcr_index]);
> +	}
>  
> -	memcpy(tpm->pcr[pcr_index], sandbox_extended_once_pcr,
> -	       TPM2_DIGEST_LEN);
>  	tpm->pcr_extensions[pcr_index]++;
>  
>  	return 0;
> -- 
> 2.32.0.93.g670b81a890-goog
>