[coreboot-gerrit] Change in coreboot[master]: tss: implement tlcl_save_state for running TPM_Shutdown(ST_STATE)

[Joel Kitching (Code Review)]

Joel Kitching has uploaded this change for review. ( https://review.coreboot.org/29646


Change subject: tss: implement tlcl_save_state for running TPM_Shutdown(ST_STATE)
......................................................................

tss: implement tlcl_save_state for running TPM_Shutdown(ST_STATE)

When an untrusted OS is running, we would like to use the Cr50
vendor-specific VENDOR_CC_TPM_MODE command to disable TPM.
Before doing this, we should save TPM state.  Implement
tlcl_save_state for this purpose.

This needs to live in coreboot codebase since on S3 resume path,
depthcharge is not reached.

BUG=b:70681930,b:118202153
TEST=None

Signed-off-by: Joel Kitching <kitching at google.com>
Change-Id: I8b51ca68456fc9b655e4dc2d0958b7c040d50510
---
M src/security/tpm/tss.h
M src/security/tpm/tss/tcg-2.0/tss.c
M src/security/tpm/tss/tcg-2.0/tss_marshaling.c
M src/security/tpm/tss/tcg-2.0/tss_structures.h
4 files changed, 48 insertions(+), 0 deletions(-)



  git pull ssh://review.coreboot.org:29418/coreboot refs/changes/46/29646/1

diff --git a/src/security/tpm/tss.h b/src/security/tpm/tss.h
index c053df9..9050ec8 100644
--- a/src/security/tpm/tss.h
+++ b/src/security/tpm/tss.h
@@ -102,6 +102,12 @@
 uint32_t tlcl_resume(void);
 
 /**
+ * Send a TPM_Shutdown(ST_STATE).  The TPM error code is returned (0 for
+ * success).
+ */
+uint32_t tlcl_save_state(void);
+
+/**
  * Run the self test.
  *
  * Note---this is synchronous.  To run this in parallel with other firmware,
diff --git a/src/security/tpm/tss/tcg-2.0/tss.c b/src/security/tpm/tss/tcg-2.0/tss.c
index c67fdfa..e579bff 100644
--- a/src/security/tpm/tss/tcg-2.0/tss.c
+++ b/src/security/tpm/tss/tcg-2.0/tss.c
@@ -87,6 +87,35 @@
 	return tlcl_send_startup(TPM_SU_STATE);
 }
 
+static uint32_t tlcl_send_shutdown(TPM_SU type)
+{
+	struct tpm2_shutdown shutdown;
+	struct tpm2_response *response;
+
+	shutdown.shutdown_type = type;
+	response = tpm_process_command(TPM2_Shutdown, &shutdown);
+
+	/* IO error, tpm2_response pointer is empty. */
+	if (response == NULL) {
+		printk(BIOS_ERR, "%s: TPM communication error\n", __func__);
+		return TPM_E_IOERROR;
+	}
+
+	printk(BIOS_INFO, "%s: Shutdown return code is %x\n",
+	       __func__, response->hdr.tpm_code);
+
+	if (response->hdr.tpm_code == TPM2_RC_SUCCESS)
+		return TPM_SUCCESS;
+
+	/* Collapse any other errors into TPM_E_IOERROR. */
+	return TPM_E_IOERROR;
+}
+
+uint32_t tlcl_save_state(void)
+{
+	return tlcl_send_shutdown(TPM_SU_STATE);
+}
+
 uint32_t tlcl_assert_physical_presence(void)
 {
 	/*
diff --git a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
index ad23d9b..af57248 100644
--- a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
+++ b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
@@ -28,6 +28,11 @@
 	return obuf_write_be16(ob, cmd_body->startup_type);
 }
 
+static int marshal_shutdown(struct obuf *ob, struct tpm2_shutdown *cmd_body)
+{
+	return obuf_write_be16(ob, cmd_body->shutdown_type);
+}
+
 static int marshal_get_capability(struct obuf *ob,
 				   struct tpm2_get_capability *cmd_body)
 {
@@ -302,6 +307,10 @@
 		rc |= marshal_startup(ob, tpm_command_body);
 		break;
 
+	case TPM2_Shutdown:
+		rc |= marshal_shutdown(ob, tpm_command_body);
+		break;
+
 	case TPM2_GetCapability:
 		rc |= marshal_get_capability(ob, tpm_command_body);
 		break;
@@ -499,6 +508,9 @@
 	case TPM2_Startup:
 		break;
 
+	case TPM2_Shutdown:
+		break;
+
 	case TPM2_GetCapability:
 		rc |= unmarshal_get_capability(ib, &tpm2_resp->gc);
 		break;
diff --git a/src/security/tpm/tss/tcg-2.0/tss_structures.h b/src/security/tpm/tss/tcg-2.0/tss_structures.h
index e902f3c..12c84e1 100644
--- a/src/security/tpm/tss/tcg-2.0/tss_structures.h
+++ b/src/security/tpm/tss/tcg-2.0/tss_structures.h
@@ -71,6 +71,7 @@
 #define TPM2_NV_WriteLock      ((TPM_CC)0x00000138)
 #define TPM2_SelfTest          ((TPM_CC)0x00000143)
 #define TPM2_Startup           ((TPM_CC)0x00000144)
+#define TPM2_Shutdown          ((TPM_CC)0x00000145)
 #define TPM2_NV_Read           ((TPM_CC)0x0000014E)
 #define TPM2_GetCapability     ((TPM_CC)0x0000017A)
 #define TPM2_PCR_Extend        ((TPM_CC)0x00000182)

-- 
To view, visit https://review.coreboot.org/29646
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings

Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I8b51ca68456fc9b655e4dc2d0958b7c040d50510
Gerrit-Change-Number: 29646
Gerrit-PatchSet: 1
Gerrit-Owner: Joel Kitching <kitching at google.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.coreboot.org/pipermail/coreboot-gerrit/attachments/20181115/8db9598c/attachment.html>