Attention is currently required from: Michał Żygowski, Christian Walter, Julius Werner, Krystian Hebel, Yu-Ping Wu.
Sergii Dmytruk would like Michał Żygowski, Julius Werner and Krystian Hebel to review this change.
security/tpm: resolve conflicts in TSS implementations
No functional changes. Just code updates to don't have any compiler or
linker errors if TSS 1.2 and TSS 2.0 were both compiled in.
Change-Id: Ia0ea5a917c46ada9fc3274f17240e12bca98db6a
Ticket: https://ticket.coreboot.org/issues/433
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
---
M src/security/tpm/Makefile.inc
M src/security/tpm/tspi/tspi.c
M src/security/tpm/tss.h
M src/security/tpm/tss/tcg-1.2/tss.c
A src/security/tpm/tss/tcg-1.2/tss.h
M src/security/tpm/tss/tcg-2.0/tss.c
A src/security/tpm/tss/tcg-2.0/tss.h
M src/security/tpm/tss/tcg-2.0/tss_marshaling.c
A src/security/tpm/tss/tss.c
M src/security/tpm/tss/vendor/cr50/cr50.c
M src/security/vboot/secdata_tpm.c
11 files changed, 457 insertions(+), 212 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/60/69160/1
diff --git a/src/security/tpm/Makefile.inc b/src/security/tpm/Makefile.inc
index 8f633a8..748896a 100644
--- a/src/security/tpm/Makefile.inc
+++ b/src/security/tpm/Makefile.inc
@@ -10,6 +10,12 @@
verstage-y += tss/tcg-1.2/tss.c
postcar-y += tss/tcg-1.2/tss.c
+ramstage-y += tss/tss.c
+romstage-y += tss/tss.c
+bootblock-y += tss/tss.c
+verstage-y += tss/tss.c
+postcar-y += tss/tss.c
+
## TSPI
ramstage-y += tspi/tspi.c
@@ -24,18 +30,23 @@
ramstage-y += tss/tcg-2.0/tss_marshaling.c
ramstage-y += tss/tcg-2.0/tss.c
+ramstage-y += tss/tss.c
romstage-y += tss/tcg-2.0/tss_marshaling.c
romstage-y += tss/tcg-2.0/tss.c
+romstage-y += tss/tss.c
verstage-$(CONFIG_VBOOT) += tss/tcg-2.0/tss_marshaling.c
verstage-$(CONFIG_VBOOT) += tss/tcg-2.0/tss.c
+verstage-$(CONFIG_VBOOT) += tss/tss.c
postcar-y += tss/tcg-2.0/tss_marshaling.c
postcar-y += tss/tcg-2.0/tss.c
+postcar-y += tss/tss.c
bootblock-y += tss/tcg-2.0/tss_marshaling.c
bootblock-y += tss/tcg-2.0/tss.c
+bootblock-y += tss/tss.c
## TSPI
diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c
index 7bf8d6c..525522b 100644
--- a/src/security/tpm/tspi/tspi.c
+++ b/src/security/tpm/tspi/tspi.c
@@ -17,7 +17,7 @@
uint32_t result = TPM_SUCCESS;
/* Check that the TPM is enabled and activated. */
- result = tlcl_get_flags(&disabled, &deactivated, NULL);
+ result = tlcl12_get_flags(&disabled, &deactivated, NULL);
if (result != TPM_SUCCESS) {
printk(BIOS_ERR, "TPM: Can't read capabilities.\n");
return result;
@@ -26,7 +26,7 @@
if (disabled) {
printk(BIOS_INFO, "TPM: is disabled. Enabling...\n");
- result = tlcl_set_enable();
+ result = tlcl12_set_enable();
if (result != TPM_SUCCESS) {
printk(BIOS_ERR, "TPM: Can't set enabled state.\n");
return result;
@@ -36,7 +36,7 @@
if (!!deactivated != CONFIG(TPM_DEACTIVATE)) {
printk(BIOS_INFO,
"TPM: Unexpected TPM deactivated state. Toggling...\n");
- result = tlcl_set_deactivated(!deactivated);
+ result = tlcl12_set_deactivated(!deactivated);
if (result != TPM_SUCCESS) {
printk(BIOS_ERR,
"TPM: Can't toggle deactivated state.\n");
@@ -201,13 +201,13 @@
}
#if CONFIG(TPM1)
- result = tlcl_set_enable();
+ result = tlcl12_set_enable();
if (result != TPM_SUCCESS) {
printk(BIOS_ERR, "TPM: Can't set enabled state.\n");
return result;
}
- result = tlcl_set_deactivated(0);
+ result = tlcl12_set_deactivated(0);
if (result != TPM_SUCCESS) {
printk(BIOS_ERR, "TPM: Can't set deactivated state.\n");
return result;
diff --git a/src/security/tpm/tss.h b/src/security/tpm/tss.h
index f68e1f4..9d6e55a 100644
--- a/src/security/tpm/tss.h
+++ b/src/security/tpm/tss.h
@@ -14,88 +14,129 @@
#include <security/tpm/tss/common/tss_common.h>
#include <security/tpm/tss_errors.h>
#include <security/tpm/tss/vendor/cr50/cr50.h>
-
-#if CONFIG(TPM1)
-
#include <security/tpm/tss/tcg-1.2/tss_structures.h>
+#include <security/tpm/tss/tcg-2.0/tss_structures.h>
+
+/*
+ * Some operations don't have counterparts in standard and are directly exposed
+ * here.
+ *
+ * Other operations are applicable to both TPM versions and have wrappers which
+ * pick the implementation based on version determined during initialization via
+ * tlcl_lib_init().
+ */
+
+/*
+ * TPM1.2-specific
+ */
/**
* Define a space with permission [perm]. [index] is the index for the space,
* [size] the usable data size. The TPM error code is returned.
*/
-uint32_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size);
+uint32_t tlcl12_define_space(uint32_t index, uint32_t perm, uint32_t size);
/**
* Issue a PhysicalEnable. The TPM error code is returned.
*/
-uint32_t tlcl_set_enable(void);
+uint32_t tlcl12_set_enable(void);
/**
* Issue a SetDeactivated. Pass 0 to activate. Returns result code.
*/
-uint32_t tlcl_set_deactivated(uint8_t flag);
+uint32_t tlcl12_set_deactivated(uint8_t flag);
/**
* Get flags of interest. Pointers for flags you aren't interested in may
* be NULL. The TPM error code is returned.
*/
-uint32_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated,
- uint8_t *nvlocked);
+uint32_t tlcl12_get_flags(uint8_t *disable, uint8_t *deactivated, uint8_t *nvlocked);
+
+/**
+ * Perform a raw TPM request/response transaction.
+ */
+uint32_t tlcl12_send_receive(const uint8_t *request, uint8_t *response, int max_length);
+
+/**
+ * Run the self test in the background.
+ */
+uint32_t tlcl12_continue_self_test(void);
+
+/**
+ * Set the nvLocked bit. The TPM error code is returned.
+ */
+uint32_t tlcl12_set_nv_locked(void);
/**
* Get the entire set of permanent flags.
*/
-uint32_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags);
+uint32_t tlcl12_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags);
-#endif
+/**
+ * Set the bGlobalLock flag, which only a reboot can clear. The TPM error
+ * code is returned.
+ */
+uint32_t tlcl12_set_global_lock(void);
-#if CONFIG(TPM2)
+/**
+ * Get the permission bits for the NVRAM space with |index|.
+ */
+uint32_t tlcl12_get_permissions(uint32_t index, uint32_t *permissions);
-#include <security/tpm/tss/tcg-2.0/tss_structures.h>
+/*
+ * TPM2-specific
+ */
/*
* Define a TPM2 space. The define space command TPM command used by the tlcl
* layer offers the ability to use custom nv attributes and policies.
*/
-uint32_t tlcl_define_space(uint32_t space_index, size_t space_size,
- const TPMA_NV nv_attributes,
- const uint8_t *nv_policy, size_t nv_policy_size);
+uint32_t tlcl2_define_space(uint32_t space_index, size_t space_size,
+ const TPMA_NV nv_attributes,
+ const uint8_t *nv_policy, size_t nv_policy_size);
/*
* Issue TPM2_GetCapability command
*/
-uint32_t tlcl_get_capability(TPM_CAP capability, uint32_t property,
- uint32_t property_count,
- TPMS_CAPABILITY_DATA *capability_data);
+uint32_t tlcl2_get_capability(TPM_CAP capability, uint32_t property,
+ uint32_t property_count,
+ TPMS_CAPABILITY_DATA *capability_data);
/* Issue TPM2_NV_SetBits command */
-uint32_t tlcl_set_bits(uint32_t index, uint64_t bits);
+uint32_t tlcl2_set_bits(uint32_t index, uint64_t bits);
/*
- * Makes tpm_process_command available for on top implementations of
+ * Makes tlcl2_process_command available for on top implementations of
* custom tpm standards like cr50
*/
-void *tpm_process_command(TPM_CC command, void *command_body);
+void *tlcl2_process_command(TPM_CC command, void *command_body);
/* Return digest size of hash algorithm */
-uint16_t tlcl_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo);
+uint16_t tlcl2_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo);
-#endif
+/**
+ * Set Clear Control. The TPM error code is returned.
+ */
+uint32_t tlcl2_clear_control(bool disable);
+
+/**
+ * Make an NV Ram location read_only. The TPM error code is returned.
+ */
+uint32_t tlcl2_lock_nv_write(uint32_t index);
+
+/**
+ * Disable platform hierarchy. Specific to TPM2. The TPM error code is returned.
+ */
+uint32_t tlcl2_disable_platform_hierarchy(void);
/*****************************************************************************/
-/* Generic Functions implemented in tlcl.c */
+/* Generic Functions */
/**
* Call this first. Returns 0 if success, nonzero if error.
*/
uint32_t tlcl_lib_init(void);
-/**
- * Perform a raw TPM request/response transaction.
- */
-uint32_t tlcl_send_receive(const uint8_t *request, uint8_t *response,
- int max_length);
-
/* Commands */
/**
@@ -126,11 +167,6 @@
uint32_t tlcl_self_test_full(void);
/**
- * Run the self test in the background.
- */
-uint32_t tlcl_continue_self_test(void);
-
-/**
* Write [length] bytes of [data] to space at [index]. The TPM error code is
* returned.
*/
@@ -159,45 +195,14 @@
uint32_t tlcl_finalize_physical_presence(void);
/**
- * Set the nvLocked bit. The TPM error code is returned.
- */
-uint32_t tlcl_set_nv_locked(void);
-
-/**
* Issue a ForceClear. The TPM error code is returned.
*/
uint32_t tlcl_force_clear(void);
/**
- * Set Clear Control. The TPM error code is returned.
- */
-uint32_t tlcl_clear_control(bool disable);
-
-/**
- * Set the bGlobalLock flag, which only a reboot can clear. The TPM error
- * code is returned.
- */
-uint32_t tlcl_set_global_lock(void);
-
-/**
- * Make an NV Ram location read_only. The TPM error code is returned.
- */
-uint32_t tlcl_lock_nv_write(uint32_t index);
-
-/**
* Perform a TPM_Extend.
*/
uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
uint8_t *out_digest);
-/**
- * Disable platform hierarchy. Specific to TPM2. The TPM error code is returned.
- */
-uint32_t tlcl_disable_platform_hierarchy(void);
-
-/**
- * Get the permission bits for the NVRAM space with |index|.
- */
-uint32_t tlcl_get_permissions(uint32_t index, uint32_t *permissions);
-
#endif /* TSS_H_ */
diff --git a/src/security/tpm/tss/tcg-1.2/tss.c b/src/security/tpm/tss/tcg-1.2/tss.c
index f7c9788..089cc17 100644
--- a/src/security/tpm/tss/tcg-1.2/tss.c
+++ b/src/security/tpm/tss/tcg-1.2/tss.c
@@ -18,6 +18,7 @@
#include <vb2_api.h>
#include <security/tpm/tss.h>
+#include "tss.h"
#include "tss_internal.h"
#include "tss_commands.h"
@@ -74,8 +75,8 @@
* Like TlclSendReceive below, but do not retry if NEEDS_SELFTEST or
* DOING_SELFTEST errors are returned.
*/
-static uint32_t tlcl_send_receive_no_retry(const uint8_t *request,
- uint8_t *response, int max_length)
+static uint32_t tlcl12_send_receive_no_retry(const uint8_t *request,
+ uint8_t *response, int max_length)
{
uint32_t response_length = max_length;
uint32_t result;
@@ -103,21 +104,18 @@
/* Sends a TPM command and gets a response. Returns 0 if success or the TPM
* error code if error. Waits for the self test to complete if needed. */
-uint32_t tlcl_send_receive(const uint8_t *request, uint8_t *response,
- int max_length)
+uint32_t tlcl12_send_receive(const uint8_t *request, uint8_t *response, int max_length)
{
- uint32_t result = tlcl_send_receive_no_retry(request, response,
- max_length);
+ uint32_t result = tlcl12_send_receive_no_retry(request, response, max_length);
/* If the command fails because the self test has not completed, try it
* again after attempting to ensure that the self test has completed. */
if (result == TPM_E_NEEDS_SELFTEST || result == TPM_E_DOING_SELFTEST) {
- result = tlcl_continue_self_test();
+ result = tlcl12_continue_self_test();
if (result != TPM_SUCCESS)
return result;
#if defined(TPM_BLOCKING_CONTINUESELFTEST) || defined(VB_RECOVERY_MODE)
/* Retry only once */
- result = tlcl_send_receive_no_retry(request, response,
- max_length);
+ result = tlcl12_send_receive_no_retry(request, response, max_length);
#else
/* This needs serious testing. The TPM specification says: "iii.
* The caller MUST wait for the actions of TPM_ContinueSelfTest
@@ -125,8 +123,7 @@
* ContinueSelfTest is non-blocking, how do we know that the
* actions have completed other than trying again? */
do {
- result = tlcl_send_receive_no_retry(request, response,
- max_length);
+ result = tlcl12_send_receive_no_retry(request, response, max_length);
} while (result == TPM_E_DOING_SELFTEST);
#endif
}
@@ -137,64 +134,50 @@
static uint32_t send(const uint8_t *command)
{
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
- return tlcl_send_receive(command, response, sizeof(response));
+ return tlcl12_send_receive(command, response, sizeof(response));
}
/* Exported functions. */
-uint32_t tlcl_lib_init(void)
+void tlcl12_lib_init(tis_sendrecv_fn sendrecv)
{
- int tpm_family;
-
- if (tis_sendrecv != NULL)
- return VB2_SUCCESS;
-
- tis_sendrecv = tis_probe(&tpm_family);
- if (tis_sendrecv == NULL)
- return VB2_ERROR_UNKNOWN;
-
- if (tpm_family != 1) {
- tis_sendrecv = NULL;
- return VB2_ERROR_UNKNOWN;
- }
-
- return VB2_SUCCESS;
+ tis_sendrecv = sendrecv;
}
-uint32_t tlcl_startup(void)
+uint32_t tlcl12_startup(void)
{
VBDEBUG("TPM: Startup\n");
return send(tpm_startup_cmd.buffer);
}
-uint32_t tlcl_resume(void)
+uint32_t tlcl12_resume(void)
{
VBDEBUG("TPM: Resume\n");
return send(tpm_resume_cmd.buffer);
}
-uint32_t tlcl_save_state(void)
+uint32_t tlcl12_save_state(void)
{
VBDEBUG("TPM: Save state\n");
return send(tpm_savestate_cmd.buffer);
}
-uint32_t tlcl_self_test_full(void)
+uint32_t tlcl12_self_test_full(void)
{
VBDEBUG("TPM: Self test full\n");
return send(tpm_selftestfull_cmd.buffer);
}
-uint32_t tlcl_continue_self_test(void)
+uint32_t tlcl12_continue_self_test(void)
{
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
VBDEBUG("TPM: Continue self test\n");
/* Call the No Retry version of SendReceive to avoid recursion. */
- return tlcl_send_receive_no_retry(tpm_continueselftest_cmd.buffer,
- response, sizeof(response));
+ return tlcl12_send_receive_no_retry(tpm_continueselftest_cmd.buffer,
+ response, sizeof(response));
}
-uint32_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size)
+uint32_t tlcl12_define_space(uint32_t index, uint32_t perm, uint32_t size)
{
struct s_tpm_nv_definespace_cmd cmd;
VBDEBUG("TPM: TlclDefineSpace(0x%x, 0x%x, %d)\n", index, perm, size);
@@ -205,7 +188,7 @@
return send(cmd.buffer);
}
-uint32_t tlcl_write(uint32_t index, const void *data, uint32_t length)
+uint32_t tlcl12_write(uint32_t index, const void *data, uint32_t length)
{
struct s_tpm_nv_write_cmd cmd;
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
@@ -222,10 +205,10 @@
if (length > 0)
memcpy(cmd.buffer + tpm_nv_write_cmd.data, data, length);
- return tlcl_send_receive(cmd.buffer, response, sizeof(response));
+ return tlcl12_send_receive(cmd.buffer, response, sizeof(response));
}
-uint32_t tlcl_read(uint32_t index, void *data, uint32_t length)
+uint32_t tlcl12_read(uint32_t index, void *data, uint32_t length)
{
struct s_tpm_nv_read_cmd cmd;
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
@@ -237,7 +220,7 @@
to_tpm_uint32(cmd.buffer + tpm_nv_read_cmd.index, index);
to_tpm_uint32(cmd.buffer + tpm_nv_read_cmd.length, length);
- result = tlcl_send_receive(cmd.buffer, response, sizeof(response));
+ result = tlcl12_send_receive(cmd.buffer, response, sizeof(response));
if (result == TPM_SUCCESS && length > 0) {
uint8_t *nv_read_cursor = response + kTpmResponseHeaderLength;
from_tpm_uint32(nv_read_cursor, &result_length);
@@ -250,43 +233,43 @@
return result;
}
-uint32_t tlcl_assert_physical_presence(void)
+uint32_t tlcl12_assert_physical_presence(void)
{
VBDEBUG("TPM: Asserting physical presence\n");
return send(tpm_ppassert_cmd.buffer);
}
-uint32_t tlcl_physical_presence_cmd_enable(void)
+uint32_t tlcl12_physical_presence_cmd_enable(void)
{
VBDEBUG("TPM: Enable the physical presence command\n");
return send(tpm_ppenable_cmd.buffer);
}
-uint32_t tlcl_finalize_physical_presence(void)
+uint32_t tlcl12_finalize_physical_presence(void)
{
VBDEBUG("TPM: Enable PP cmd, disable HW pp, and set lifetime lock\n");
return send(tpm_finalizepp_cmd.buffer);
}
-uint32_t tlcl_set_nv_locked(void)
+uint32_t tlcl12_set_nv_locked(void)
{
VBDEBUG("TPM: Set NV locked\n");
- return tlcl_define_space(TPM_NV_INDEX_LOCK, 0, 0);
+ return tlcl12_define_space(TPM_NV_INDEX_LOCK, 0, 0);
}
-uint32_t tlcl_force_clear(void)
+uint32_t tlcl12_force_clear(void)
{
VBDEBUG("TPM: Force clear\n");
return send(tpm_forceclear_cmd.buffer);
}
-uint32_t tlcl_set_enable(void)
+uint32_t tlcl12_set_enable(void)
{
VBDEBUG("TPM: Enabling TPM\n");
return send(tpm_physicalenable_cmd.buffer);
}
-uint32_t tlcl_set_deactivated(uint8_t flag)
+uint32_t tlcl12_set_deactivated(uint8_t flag)
{
struct s_tpm_physicalsetdeactivated_cmd cmd;
VBDEBUG("TPM: SetDeactivated(%d)\n", flag);
@@ -295,12 +278,12 @@
return send(cmd.buffer);
}
-uint32_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags)
+uint32_t tlcl12_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags)
{
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
uint32_t size;
- uint32_t result = tlcl_send_receive(tpm_getflags_cmd.buffer, response,
- sizeof(response));
+ uint32_t result = tlcl12_send_receive(tpm_getflags_cmd.buffer, response,
+ sizeof(response));
if (result != TPM_SUCCESS)
return result;
from_tpm_uint32(response + kTpmResponseHeaderLength, &size);
@@ -311,11 +294,10 @@
return result;
}
-uint32_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated,
- uint8_t *nvlocked)
+uint32_t tlcl12_get_flags(uint8_t *disable, uint8_t *deactivated, uint8_t *nvlocked)
{
TPM_PERMANENT_FLAGS pflags;
- uint32_t result = tlcl_get_permanent_flags(&pflags);
+ uint32_t result = tlcl12_get_permanent_flags(&pflags);
if (result == TPM_SUCCESS) {
if (disable)
*disable = pflags.disable;
@@ -329,14 +311,13 @@
return result;
}
-uint32_t tlcl_set_global_lock(void)
+uint32_t tlcl12_set_global_lock(void)
{
VBDEBUG("TPM: Set global lock\n");
- return tlcl_write(TPM_NV_INDEX0, NULL, 0);
+ return tlcl12_write(TPM_NV_INDEX0, NULL, 0);
}
-uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
- uint8_t *out_digest)
+uint32_t tlcl12_extend(int pcr_num, const uint8_t *in_digest, uint8_t *out_digest)
{
struct s_tpm_extend_cmd cmd;
uint8_t response[kTpmResponseHeaderLength + kPcrDigestLength];
@@ -346,7 +327,7 @@
to_tpm_uint32(cmd.buffer + tpm_extend_cmd.pcrNum, pcr_num);
memcpy(cmd.buffer + cmd.inDigest, in_digest, kPcrDigestLength);
- result = tlcl_send_receive(cmd.buffer, response, sizeof(response));
+ result = tlcl12_send_receive(cmd.buffer, response, sizeof(response));
if (result != TPM_SUCCESS)
return result;
@@ -356,7 +337,7 @@
return result;
}
-uint32_t tlcl_get_permissions(uint32_t index, uint32_t *permissions)
+uint32_t tlcl12_get_permissions(uint32_t index, uint32_t *permissions)
{
struct s_tpm_getpermissions_cmd cmd;
uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
@@ -366,7 +347,7 @@
memcpy(&cmd, &tpm_getpermissions_cmd, sizeof(cmd));
to_tpm_uint32(cmd.buffer + tpm_getpermissions_cmd.index, index);
- result = tlcl_send_receive(cmd.buffer, response, sizeof(response));
+ result = tlcl12_send_receive(cmd.buffer, response, sizeof(response));
if (result != TPM_SUCCESS)
return result;
diff --git a/src/security/tpm/tss/tcg-1.2/tss.h b/src/security/tpm/tss/tcg-1.2/tss.h
new file mode 100644
index 0000000..7eba1dd
--- /dev/null
+++ b/src/security/tpm/tss/tcg-1.2/tss.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#ifndef TSS12_H_
+#define TSS12_H_
+
+#include "tss_structures.h"
+
+/*
+ * Declarations for "private" functions which are dispatched to by tss.c in
+ * the parent directory based on TPM family.
+ */
+
+void tlcl12_lib_init(tis_sendrecv_fn sendrecv);
+uint32_t tlcl12_save_state(void);
+uint32_t tlcl12_resume(void);
+uint32_t tlcl12_startup(void);
+uint32_t tlcl12_self_test_full(void);
+uint32_t tlcl12_read(uint32_t index, void *data, uint32_t length);
+uint32_t tlcl12_write(uint32_t index, const void *data, uint32_t length);
+uint32_t tlcl12_assert_physical_presence(void);
+uint32_t tlcl12_physical_presence_cmd_enable(void);
+uint32_t tlcl12_finalize_physical_presence(void);
+uint32_t tlcl12_force_clear(void);
+uint32_t tlcl12_extend(int pcr_num, const uint8_t *in_digest, uint8_t *out_digest);
+
+#endif
diff --git a/src/security/tpm/tss/tcg-2.0/tss.c b/src/security/tpm/tss/tcg-2.0/tss.c
index d270329..bd8f86d 100644
--- a/src/security/tpm/tss/tcg-2.0/tss.c
+++ b/src/security/tpm/tss/tcg-2.0/tss.c
@@ -7,6 +7,7 @@
#include <security/tpm/tis.h>
#include <security/tpm/tss.h>
+#include "tss.h"
#include "tss_structures.h"
#include "tss_marshaling.h"
@@ -18,7 +19,7 @@
static tis_sendrecv_fn tis_sendrecv;
-void *tpm_process_command(TPM_CC command, void *command_body)
+void *tlcl2_process_command(TPM_CC command, void *command_body)
{
struct obuf ob;
struct ibuf ib;
@@ -48,13 +49,13 @@
return tpm_unmarshal_response(command, &ib);
}
-static uint32_t tlcl_send_startup(TPM_SU type)
+static uint32_t tlcl2_send_startup(TPM_SU type)
{
struct tpm2_startup startup;
struct tpm2_response *response;
startup.startup_type = type;
- response = tpm_process_command(TPM2_Startup, &startup);
+ response = tlcl2_process_command(TPM2_Startup, &startup);
/* IO error, tpm2_response pointer is empty. */
if (!response) {
@@ -77,18 +78,18 @@
return TPM_E_IOERROR;
}
-uint32_t tlcl_resume(void)
+uint32_t tlcl2_resume(void)
{
- return tlcl_send_startup(TPM_SU_STATE);
+ return tlcl2_send_startup(TPM_SU_STATE);
}
-static uint32_t tlcl_send_shutdown(TPM_SU type)
+static uint32_t tlcl2_send_shutdown(TPM_SU type)
{
struct tpm2_shutdown shutdown;
struct tpm2_response *response;
shutdown.shutdown_type = type;
- response = tpm_process_command(TPM2_Shutdown, &shutdown);
+ response = tlcl2_process_command(TPM2_Shutdown, &shutdown);
/* IO error, tpm2_response pointer is empty. */
if (!response) {
@@ -106,12 +107,12 @@
return TPM_E_IOERROR;
}
-uint32_t tlcl_save_state(void)
+uint32_t tlcl2_save_state(void)
{
- return tlcl_send_shutdown(TPM_SU_STATE);
+ return tlcl2_send_shutdown(TPM_SU_STATE);
}
-uint32_t tlcl_assert_physical_presence(void)
+uint32_t tlcl2_assert_physical_presence(void)
{
/*
* Nothing to do on TPM2 for this, use platform hierarchy availability
@@ -124,8 +125,7 @@
* The caller will provide the digest in a 32 byte buffer, let's consider it a
* sha256 digest.
*/
-uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
- uint8_t *out_digest)
+uint32_t tlcl2_extend(int pcr_num, const uint8_t *in_digest, uint8_t *out_digest)
{
struct tpm2_pcr_extend_cmd pcr_ext_cmd;
struct tpm2_response *response;
@@ -136,7 +136,7 @@
memcpy(pcr_ext_cmd.digests.digests[0].digest.sha256, in_digest,
sizeof(pcr_ext_cmd.digests.digests[0].digest.sha256));
- response = tpm_process_command(TPM2_PCR_Extend, &pcr_ext_cmd);
+ response = tlcl2_process_command(TPM2_PCR_Extend, &pcr_ext_cmd);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -146,18 +146,18 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_finalize_physical_presence(void)
+uint32_t tlcl2_finalize_physical_presence(void)
{
/* Nothing needs to be done with tpm2. */
printk(BIOS_INFO, "%s:%s:%d\n", __FILE__, __func__, __LINE__);
return TPM_SUCCESS;
}
-uint32_t tlcl_force_clear(void)
+uint32_t tlcl2_force_clear(void)
{
struct tpm2_response *response;
- response = tpm_process_command(TPM2_Clear, NULL);
+ response = tlcl2_process_command(TPM2_Clear, NULL);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -167,14 +167,14 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_clear_control(bool disable)
+uint32_t tlcl2_clear_control(bool disable)
{
struct tpm2_response *response;
struct tpm2_clear_control_cmd cc = {
.disable = 0,
};
- response = tpm_process_command(TPM2_ClearControl, &cc);
+ response = tlcl2_process_command(TPM2_ClearControl, &cc);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -184,37 +184,18 @@
return TPM_SUCCESS;
}
-/* This function is called directly by vboot, uses vboot return types. */
-uint32_t tlcl_lib_init(void)
+void tlcl2_lib_init(tis_sendrecv_fn sendrecv)
{
- int tpm_family;
-
- if (tis_sendrecv != NULL)
- return VB2_SUCCESS;
-
- tis_sendrecv = tis_probe(&tpm_family);
- if (tis_sendrecv == NULL) {
- printk(BIOS_ERR, "%s: tis_probe returned error\n", __func__);
- return VB2_ERROR_UNKNOWN;
- }
-
- if (tpm_family != 2) {
- tis_sendrecv = NULL;
- printk(BIOS_ERR, "%s: tis_probe returned unsupported TPM family: %d\n",
- __func__, tpm_family);
- return VB2_ERROR_UNKNOWN;
- }
-
- return VB2_SUCCESS;
+ tis_sendrecv = sendrecv;
}
-uint32_t tlcl_physical_presence_cmd_enable(void)
+uint32_t tlcl2_physical_presence_cmd_enable(void)
{
printk(BIOS_INFO, "%s:%s:%d\n", __FILE__, __func__, __LINE__);
return TPM_SUCCESS;
}
-uint32_t tlcl_read(uint32_t index, void *data, uint32_t length)
+uint32_t tlcl2_read(uint32_t index, void *data, uint32_t length)
{
struct tpm2_nv_read_cmd nv_readc;
struct tpm2_response *response;
@@ -224,7 +205,7 @@
nv_readc.nvIndex = HR_NV_INDEX + index;
nv_readc.size = length;
- response = tpm_process_command(TPM2_NV_Read, &nv_readc);
+ response = tlcl2_process_command(TPM2_NV_Read, &nv_readc);
/* Need to map tpm error codes into internal values. */
if (!response)
@@ -263,20 +244,20 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_self_test_full(void)
+uint32_t tlcl2_self_test_full(void)
{
struct tpm2_self_test st;
struct tpm2_response *response;
st.yes_no = 1;
- response = tpm_process_command(TPM2_SelfTest, &st);
+ response = tlcl2_process_command(TPM2_SelfTest, &st);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
return TPM_SUCCESS;
}
-uint32_t tlcl_lock_nv_write(uint32_t index)
+uint32_t tlcl2_lock_nv_write(uint32_t index)
{
struct tpm2_response *response;
/* TPM Will reject attempts to write at non-defined index. */
@@ -284,7 +265,7 @@
.nvIndex = HR_NV_INDEX + index,
};
- response = tpm_process_command(TPM2_NV_WriteLock, &nv_wl);
+ response = tlcl2_process_command(TPM2_NV_WriteLock, &nv_wl);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -295,12 +276,12 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_startup(void)
+uint32_t tlcl2_startup(void)
{
- return tlcl_send_startup(TPM_SU_CLEAR);
+ return tlcl2_send_startup(TPM_SU_CLEAR);
}
-uint32_t tlcl_write(uint32_t index, const void *data, uint32_t length)
+uint32_t tlcl2_write(uint32_t index, const void *data, uint32_t length)
{
struct tpm2_nv_write_cmd nv_writec;
struct tpm2_response *response;
@@ -311,7 +292,7 @@
nv_writec.data.t.size = length;
nv_writec.data.t.buffer = data;
- response = tpm_process_command(TPM2_NV_Write, &nv_writec);
+ response = tlcl2_process_command(TPM2_NV_Write, &nv_writec);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -323,7 +304,7 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_set_bits(uint32_t index, uint64_t bits)
+uint32_t tlcl2_set_bits(uint32_t index, uint64_t bits)
{
struct tpm2_nv_setbits_cmd nvsb_cmd;
struct tpm2_response *response;
@@ -334,7 +315,7 @@
nvsb_cmd.nvIndex = HR_NV_INDEX + index;
nvsb_cmd.bits = bits;
- response = tpm_process_command(TPM2_NV_SetBits, &nvsb_cmd);
+ response = tlcl2_process_command(TPM2_NV_SetBits, &nvsb_cmd);
printk(BIOS_INFO, "%s: response is %x\n",
__func__, response ? response->hdr.tpm_code : -1);
@@ -346,9 +327,9 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_define_space(uint32_t space_index, size_t space_size,
- const TPMA_NV nv_attributes,
- const uint8_t *nv_policy, size_t nv_policy_size)
+uint32_t tlcl2_define_space(uint32_t space_index, size_t space_size,
+ const TPMA_NV nv_attributes,
+ const uint8_t *nv_policy, size_t nv_policy_size)
{
struct tpm2_nv_define_space_cmd nvds_cmd;
struct tpm2_response *response;
@@ -371,7 +352,7 @@
nvds_cmd.publicInfo.authPolicy.t.size = nv_policy_size;
}
- response = tpm_process_command(TPM2_NV_DefineSpace, &nvds_cmd);
+ response = tlcl2_process_command(TPM2_NV_DefineSpace, &nvds_cmd);
printk(BIOS_INFO, "%s: response is %x\n", __func__,
response ? response->hdr.tpm_code : -1);
@@ -389,7 +370,7 @@
}
}
-uint16_t tlcl_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo)
+uint16_t tlcl2_get_hash_size_from_algo(TPMI_ALG_HASH hash_algo)
{
uint16_t value;
@@ -421,7 +402,7 @@
return value;
}
-uint32_t tlcl_disable_platform_hierarchy(void)
+uint32_t tlcl2_disable_platform_hierarchy(void)
{
struct tpm2_response *response;
struct tpm2_hierarchy_control_cmd hc = {
@@ -429,7 +410,7 @@
.state = 0,
};
- response = tpm_process_command(TPM2_Hierarchy_Control, &hc);
+ response = tlcl2_process_command(TPM2_Hierarchy_Control, &hc);
if (!response || response->hdr.tpm_code)
return TPM_E_INTERNAL_INCONSISTENCY;
@@ -437,9 +418,9 @@
return TPM_SUCCESS;
}
-uint32_t tlcl_get_capability(TPM_CAP capability, uint32_t property,
- uint32_t property_count,
- TPMS_CAPABILITY_DATA *capability_data)
+uint32_t tlcl2_get_capability(TPM_CAP capability, uint32_t property,
+ uint32_t property_count,
+ TPMS_CAPABILITY_DATA *capability_data)
{
struct tpm2_get_capability cmd;
struct tpm2_response *response;
@@ -454,7 +435,7 @@
return TPM_E_IOERROR;
}
- response = tpm_process_command(TPM2_GetCapability, &cmd);
+ response = tlcl2_process_command(TPM2_GetCapability, &cmd);
if (!response) {
printk(BIOS_ERR, "%s: Command Failed\n", __func__);
diff --git a/src/security/tpm/tss/tcg-2.0/tss.h b/src/security/tpm/tss/tcg-2.0/tss.h
new file mode 100644
index 0000000..48e2454
--- /dev/null
+++ b/src/security/tpm/tss/tcg-2.0/tss.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#ifndef TSS2_H__
+#define TSS2_H__
+
+#include "tss_structures.h"
+
+/*
+ * Declarations for "private" functions which are dispatched to by tss.c in
+ * the parent directory based on TPM family.
+ */
+
+void tlcl2_lib_init(tis_sendrecv_fn sendrecv);
+uint32_t tlcl2_save_state(void);
+uint32_t tlcl2_resume(void);
+uint32_t tlcl2_startup(void);
+uint32_t tlcl2_self_test_full(void);
+uint32_t tlcl2_read(uint32_t index, void *data, uint32_t length);
+uint32_t tlcl2_write(uint32_t index, const void *data, uint32_t length);
+uint32_t tlcl2_assert_physical_presence(void);
+uint32_t tlcl2_physical_presence_cmd_enable(void);
+uint32_t tlcl2_finalize_physical_presence(void);
+uint32_t tlcl2_force_clear(void);
+uint32_t tlcl2_extend(int pcr_num, const uint8_t *in_digest, uint8_t *out_digest);
+
+#endif
diff --git a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
index f1b9522..383c1e6 100644
--- a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
+++ b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
@@ -79,23 +79,23 @@
switch (tpmtha->hashAlg) {
case TPM_ALG_SHA1:
rc |= obuf_write(ob, tpmtha->digest.sha1,
- tlcl_get_hash_size_from_algo(tpmtha->hashAlg));
+ tlcl2_get_hash_size_from_algo(tpmtha->hashAlg));
break;
case TPM_ALG_SHA256:
rc |= obuf_write(ob, tpmtha->digest.sha256,
- tlcl_get_hash_size_from_algo(tpmtha->hashAlg));
+ tlcl2_get_hash_size_from_algo(tpmtha->hashAlg));
break;
case TPM_ALG_SM3_256:
rc |= obuf_write(ob, tpmtha->digest.sm3_256,
- tlcl_get_hash_size_from_algo(tpmtha->hashAlg));
+ tlcl2_get_hash_size_from_algo(tpmtha->hashAlg));
break;
case TPM_ALG_SHA384:
rc |= obuf_write(ob, tpmtha->digest.sha384,
- tlcl_get_hash_size_from_algo(tpmtha->hashAlg));
+ tlcl2_get_hash_size_from_algo(tpmtha->hashAlg));
break;
case TPM_ALG_SHA512:
rc |= obuf_write(ob, tpmtha->digest.sha512,
- tlcl_get_hash_size_from_algo(tpmtha->hashAlg));
+ tlcl2_get_hash_size_from_algo(tpmtha->hashAlg));
break;
default:
rc = -1;
diff --git a/src/security/tpm/tss/tss.c b/src/security/tpm/tss/tss.c
new file mode 100644
index 0000000..36ea575
--- /dev/null
+++ b/src/security/tpm/tss/tss.c
@@ -0,0 +1,203 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+
+#include <console/console.h>
+#include <security/tpm/tis.h>
+#include <security/tpm/tss.h>
+#include <vb2_api.h>
+
+#include "tcg-1.2/tss.h"
+#include "tcg-2.0/tss.h"
+
+/*
+ * This unit dispatches to either TPM1.2 or TPM2.0 implementation based on
+ * TPM family determined on probing during initialization.
+ */
+
+static int tpm_family;
+
+/* Probe for TPM device and chose implementation based on the returned TPM family. */
+uint32_t tlcl_lib_init(void)
+{
+ tis_sendrecv_fn tis_sendrecv;
+
+ if (tpm_family != 0)
+ return VB2_SUCCESS;
+
+ tis_sendrecv = tis_probe(&tpm_family);
+ if (tis_sendrecv == NULL) {
+ printk(BIOS_ERR, "%s: tis_probe returned error\n", __func__);
+ return VB2_ERROR_UNKNOWN;
+ }
+
+#if CONFIG(TPM1)
+ if (tpm_family == 1) {
+ tlcl12_lib_init(tis_sendrecv);
+ return VB2_SUCCESS;
+ }
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2) {
+ tlcl2_lib_init(tis_sendrecv);
+ return VB2_SUCCESS;
+ }
+#endif
+
+ printk(BIOS_ERR, "%s: tis_probe returned incorrect tpm_family: %d\n", __func__,
+ tpm_family);
+ tpm_family = 0;
+ return VB2_ERROR_UNKNOWN;
+}
+
+uint32_t tlcl_startup(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_startup();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_startup();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_resume(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_resume();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_resume();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_save_state(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_save_state();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_save_state();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_self_test_full(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_self_test_full();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_self_test_full();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_write(uint32_t index, const void *data, uint32_t length)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_write(index, data, length);
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_write(index, data, length);
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_read(uint32_t index, void *data, uint32_t length)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_read(index, data, length);
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_read(index, data, length);
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_assert_physical_presence(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_assert_physical_presence();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_assert_physical_presence();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_physical_presence_cmd_enable(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_physical_presence_cmd_enable();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_physical_presence_cmd_enable();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_finalize_physical_presence(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_finalize_physical_presence();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_finalize_physical_presence();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_force_clear(void)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_force_clear();
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_force_clear();
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
+
+uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest, uint8_t *out_digest)
+{
+#if CONFIG(TPM1)
+ if (tpm_family == 1)
+ return tlcl12_extend(pcr_num, in_digest, out_digest);
+#endif
+#if CONFIG(TPM2)
+ if (tpm_family == 2)
+ return tlcl2_extend(pcr_num, in_digest, out_digest);
+#endif
+
+ die("%s: can't be used with TPM %d\n", __func__, tpm_family);
+}
diff --git a/src/security/tpm/tss/vendor/cr50/cr50.c b/src/security/tpm/tss/vendor/cr50/cr50.c
index 57d0b61..3237410 100644
--- a/src/security/tpm/tss/vendor/cr50/cr50.c
+++ b/src/security/tpm/tss/vendor/cr50/cr50.c
@@ -16,7 +16,7 @@
printk(BIOS_INFO, "Enabling cr50 nvmem commits\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command);
if (!response || (response && response->hdr.tpm_code)) {
if (response)
@@ -39,7 +39,7 @@
printk(BIOS_INFO, "Checking cr50 for pending updates\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, command_body);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, command_body);
if (!response || response->hdr.tpm_code)
return TPM_E_IOERROR;
@@ -55,7 +55,7 @@
printk(BIOS_INFO, "Checking cr50 for recovery request\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &sub_command);
if (!response || response->hdr.tpm_code)
return TPM_E_IOERROR;
@@ -72,7 +72,7 @@
printk(BIOS_INFO, "Reading cr50 TPM mode\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command);
if (!response)
return TPM_E_IOERROR;
@@ -112,7 +112,7 @@
printk(BIOS_DEBUG, "Reading cr50 boot mode\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command);
if (!response)
return TPM_E_IOERROR;
@@ -141,8 +141,7 @@
* Issue an immediate reset to the Cr50.
*/
printk(BIOS_INFO, "Issuing cr50 reset\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND,
- &reset_command_body);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_command_body);
if (!response)
return TPM_E_IOERROR;
@@ -157,7 +156,7 @@
printk(BIOS_DEBUG, "Issuing EC reset\n");
- response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_cmd);
+ response = tlcl2_process_command(TPM2_CR50_VENDOR_COMMAND, &reset_cmd);
if (!response)
return TPM_E_IOERROR;
diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c
index 7885069..ad2d812 100644
--- a/src/security/vboot/secdata_tpm.c
+++ b/src/security/vboot/secdata_tpm.c
@@ -216,8 +216,7 @@
{
uint32_t rv;
- rv = tlcl_define_space(index, length, nv_attributes, nv_policy,
- nv_policy_size);
+ rv = tlcl2_define_space(index, length, nv_attributes, nv_policy, nv_policy_size);
if (rv == TPM_E_NV_DEFINED) {
/*
* Continue with writing: it may be defined, but not written
@@ -509,10 +508,10 @@
*/
static uint32_t safe_define_space(uint32_t index, uint32_t perm, uint32_t size)
{
- uint32_t result = tlcl_define_space(index, perm, size);
+ uint32_t result = tlcl12_define_space(index, perm, size);
if (result == TPM_E_MAXNVWRITES) {
RETURN_ON_FAILURE(tpm_clear_and_reenable());
- return tlcl_define_space(index, perm, size);
+ return tlcl12_define_space(index, perm, size);
} else {
return result;
}
To view, visit change 69160. To unsubscribe, or for help writing mail filters, visit settings.