| Age | Commit message (Collapse) | Author |
|---|
|
All the TPM drivers as well as out TCG TIS API for a TPM2.0 device
return -EBUSY if the device has already been opened. Adjust
the sandbox TPM do return the same error code.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
This converts 1 usage of this option to the non-SPL form, since there is
no SPL_TPM_RNG defined in Kconfig
Signed-off-by: Simon Glass <[email protected]>
|
|
commit fe8a4ed0111073 ("tee: optee: discover services dependent on tee-supplicant")
is trying to automatically scan and add TAs that are presented on pseudo
bus from the secure world.
In order to be able to list and compare the scanned devices the available drivers
have to register themselves on the op-tee service list.
Acked-by: Etienne Carriere <[email protected]>
Reviewed-by: Jens Wiklander <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Opens the fTPM session with TEE_LOGIN_REE_KERNEL as fTPM may restrict
access to that login when Linux based OS is running as applications are
expected to got through the Linux TPMv2 driver.
Signed-off-by: Etienne Carriere <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Add a vendor-specific TPM2 command for this and implement it for Cr50.
Note: This is not part of the TPM spec, but is a Cr50 extension.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
It is useful to read information about the current TPM state, where
supported, e.g. for debugging purposes when verified boot fails.
Add support for this to the TPM interface as well as Cr50. Add a simple
sandbox test.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
At present the emulator assumes that the TPM is inited in the same phase
where it is used. But in fact SPL may init the TPM, so we don't want to
complain when U-Boot proper later uses it. Remove this check.
It might be best to save this information into the device state for the
TPM, so that we can make sure the TPM was inited at some point. For now,
this seems good enough.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Move this out of the common header and include it only where needed.
Signed-off-by: Simon Glass <[email protected]>
|
|
The TPM device comes with the random number generator(RNG)
functionality which is built into the TPM device. Add logic to add the
RNG child device in the TPM uclass post probe callback.
The RNG device can then be used to pass a set of random bytes to the
linux kernel, need for address space randomisation through the
EFI_RNG_PROTOCOL interface.
No compatible string is provided because this is not available in
the binding defined by Linux. If multiple rand devices are in the
system, then some method of selecting them (other than device tree)
will need to be used, or a binding will need to be added.
Signed-off-by: Sughosh Ganu <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Add the tpm2_tis_i2c driver that should support any TPMv2 compliant
I2C chips, such as the NPCT75X chip.
[Ilias rename priv_auto_alloc_size to priv_auto]
Signed-off-by: Eddie James <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Requesting the locality uses the timeout values, so they need
to be set beforehand.
Signed-off-by: Eddie James <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Add VPL versions of commonly used Kconfig options.
Signed-off-by: Simon Glass <[email protected]>
|
|
Sphinx expects Return: and not @return to indicate a return value.
find . -name '*.c' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;
find . -name '*.h' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
tpm_tis_remove() leads to calling tpm_tis_ready() with the IO region
unmapped and chip->locality == -1 (locality released). This leads to a
crash in mmio_write_bytes().
The patch implements these changes:
tpm_tis_remove(): Unmap the IO region after calling tpm_tis_cleanup().
tpm_tis_cleanup(): Request locality before IO output and releasing
locality.
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
%d was being used as the specifier for size_t, leading to a
compiler warning
Signed-off-by: Mathew McBride <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Without get_desc, the tpm command will not provide a
description of the device in 'tpm device' or 'tpm info'.
Due to the characteristics of the Atmel TPM it isn't
possible to determine certain attributes (e.g open/close
status) without using the TPM stack (compare Infineon
and ST TPM drivers), so just print out the chip model
and udevice name as the identifier.
Signed-off-by: Mathew McBride <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
This driver was broken due to an empty offset byte being prepended
at the start of every transmission.
The hardware does not mimic an EEPROM device with registers so
an offset byte is not required.
Signed-off-by: Mathew McBride <[email protected]>
Acked-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
There are no users of this driver without DM_I2C
Signed-off-by: Mathew McBride <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Convert our SPI TPM driver and use the newly added API
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Add support for devices that expose a TPMv2 though MMIO.
Apart from those devices, we can use the driver in our QEMU setups and
test TPM related code which is difficult to achieve using the sandbox
driver (e.g test the EFI TCG2 protocol).
It's worth noting that a previous patch added TPMv2 TIS core functions,
which the current driver is consuming.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
There's a lot of code duplication in U-Boot right now. All the TPM TIS
compatible drivers we have at the moment have their own copy of a TIS
implementation.
So let's create a common layer which implements the core TIS functions.
Any driver added from now own, which is compatible with the TIS spec, will
only have to provide the underlying bus communication mechanisms.
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
With the upcoming TPM2 API, some of the functions name are part of the new
header file. So switch conflicting internal function names and defines.
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
With the upcoming TPM2 API, some of the functions name are part of the new
header file. So switch conflicting internal function names and defines.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Use this new Kconfig to simplify the compilation conditions where
appropriate.
Signed-off-by: Simon Glass <[email protected]>
|
|
Use the more generic reset-gpios property name.
Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
Acked-by: Michal Simek <[email protected]>
Acked-by: Ilias Apalodimas <[email protected]>
|
|
It is fairly easy to handle this case and it makes the emulator more
useful, since PCRs are commonly extended several times.
Add support for this, using U-Boot's sha256 support.
For now sandbox only supports a single PCR, but that is enough for the
tests that currently exist.
Signed-off-by: Simon Glass <[email protected]>
|
|
This is the number of PCRs, so the current check is off by one. Also the
map itself should not be checked, just the resulting pcr_index, to avoid
confusing people who read the code.
Fix these problems.
Signed-off-by: Simon Glass <[email protected]>
|
|
At present the tpm2 emulator does not support storing the device state.
Add this so we can handle the normal vboot flow through the sandbox
executables (VPL->SPL etc.) with the TPM contents staying in place.
Note: sandbox has not yet been converted to use livetree for the state
information, since livetree does not yet support writing to the tree.
Signed-off-by: Simon Glass <[email protected]>
|
|
Add support for this feature in the TPM2 emulator, to support Chromium OS
vboot.
Signed-off-by: Simon Glass <[email protected]>
|
|
Add checking as to whether the current TPM state is valid, so we can
implement reading/writing the state.
Signed-off-by: Simon Glass <[email protected]>
|
|
Tidy up the missing comments for this struct.
Signed-off-by: Simon Glass <[email protected]>
|
|
This function current handles the kernel case incorrectly. Fix it, and
use the shorter TPM_HDR_LEN while we are here.
Signed-off-by: Simon Glass <[email protected]>
|
|
Add support for this command, moving away from the previous approach of
hard-coding the initial data in the driver, now that the kernel-space data
has to be set up by the higher-level vboot code.
Signed-off-by: Simon Glass <[email protected]>
|
|
At present this code assumes that the TPM data has been read but this may
not be the case. Refactor the code to use a separate pointer so we know
the current state of the data.
Add error checking for the data size.
Signed-off-by: Simon Glass <[email protected]>
|
|
We want to support nvdata in TPM2 as well. To avoid code duplicating the
associated code, move it into a common file.
Drop the special-case logic for the kernel space. This can be handled by
the higher-level code now, i.e. in vboot itself.
Signed-off-by: Simon Glass <[email protected]>
|
|
These headers are not actually used. Drop them so that this driver can
be used by other boards, e.g. coreboot.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Bin Meng <[email protected]>
|
|
Fix the warning:
drivers/tpm/tpm2_tis_sandbox.c: In function ‘sandbox_tpm2_xfer’:
drivers/tpm/tpm2_tis_sandbox.c:288:48: warning: format ‘%ld’ expects
argument of type ‘long int’, but argument 2 has type ‘size_t’
{aka ‘unsigned int’} [-Wformat=]
printf("TPM2: Unmatching length, received: %ld, expected: %d\n",
~~^
%d
send_size, length);
~~~~~~~~~
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
|
Update this to use log_debug() instead of the old debug().
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
|
|
At present the security chip is not used in these U-Boot phases. Update
the Makefile to exclude it.
Fix a few logging statements while we are here.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
|
|
Use CONFIG_IS_ENABLED() macro, which provides more convenient
way to check $(SPL)DM_I2C/$(SPL)DM_I2C_GPIO configs
for both SPL and U-Boot proper.
CONFIG_IS_ENABLED(DM_I2C) expands to:
- 1 if CONFIG_SPL_BUILD is undefined and CONFIG_DM_I2C is set to 'y',
- 1 if CONFIG_SPL_BUILD is defined and CONFIG_SPL_DM_I2C is set to 'y',
- 0 otherwise.
All occurences were replaced automatically using these bash cmds:
$ find . -type f -exec sed -i
's/ifndef CONFIG_DM_I2C/if !CONFIG_IS_ENABLED(DM_I2C)/g' {} +
$ find . -type f -exec sed -i
's/ifdef CONFIG_DM_I2C/if CONFIG_IS_ENABLED(DM_I2C)/g' {} +
$ find . -type f -exec sed -i
's/defined(CONFIG_DM_I2C)/CONFIG_IS_ENABLED(DM_I2C)/g' {} +
$ find . -type f -exec sed -i
's/ifndef CONFIG_DM_I2C_GPIO/if !CONFIG_IS_ENABLED(DM_I2C_GPIO)/g' {} +
$ find . -type f -exec sed -i
's/ifdef CONFIG_DM_I2C_GPIO/if CONFIG_IS_ENABLED(DM_I2C_GPIO)/g' {} +
$ find . -type f -exec sed -i
's/defined(CONFIG_DM_I2C_GPIO)/CONFIG_IS_ENABLED(DM_I2C_GPIO)/g' {} +
Reviewed-by: Heiko Schocher <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Igor Opaniuk <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Priyanka Jain <[email protected]>
|
|
Update the driver name to match the compatible string, so it can work
with of-platdata.
Signed-off-by: Simon Glass <[email protected]>
|
|
Update the TPM description to include the interrupt mechanicm since this
is useful to know. Also add a warning if the TPM cannot be found and a
debug line if it succeeds.
Signed-off-by: Simon Glass <[email protected]>
|
|
When the Cr50 starts up it doesn't have a valid locality. The driver sets
it to -1 to indicate that. Tracking this allows cr50_i2c_cleanup() to
avoid releasing a locality that was not claimed.
However the helper functions that generate the flags use a u8 type which
cannot support -1, so they return a locality of 0xff.
Fix this by updating the type. With this, 'tpm startup TPM2_SU_CLEAR'
works as expected.
Signed-off-by: Simon Glass <[email protected]>
|
|
This name is far too long. Rename it to remove the 'data' bits. This makes
it consistent with the platdata->plat rename.
Signed-off-by: Simon Glass <[email protected]>
|
|
Rename this to be consistent with the change from 'platdata'.
Signed-off-by: Simon Glass <[email protected]>
|
|
We use 'priv' for private data but often use 'platdata' for platform data.
We can't really use 'pdata' since that is ambiguous (it could mean private
or platform data).
Rename some of the latter variables to end with 'plat' for consistency.
Signed-off-by: Simon Glass <[email protected]>
|
|
This construct is quite long-winded. In earlier days it made some sense
since auto-allocation was a strange concept. But with driver model now
used pretty universally, we can shorten this to 'auto'. This reduces
verbosity and makes it easier to read.
Coincidentally it also ensures that every declaration is on one line,
thus making dtoc's job easier.
Signed-off-by: Simon Glass <[email protected]>
|
|
There is no need for GD to be used and priv variable is unused.
Signed-off-by: Michal Simek <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Fix up some logging statements in this file. Most of them should use
log_debug(), apart from one error.
Signed-off-by: Simon Glass <[email protected]>
|
|
Generate ACPI information for this device so that Linux can use it
correctly.
Signed-off-by: Simon Glass <[email protected]>
|
