Upstreaming TigerLake TPM improvements.

Author: dgarske

include/tpm.h

@@ -52,6 +52,8 @@ extern WOLFTPM2_KEY     wolftpm_srk;
 int  wolfBoot_tpm2_init(void);
 void wolfBoot_tpm2_deinit(void);
 
+int wolfBoot_tpm2_clear(void);
+
 #if defined(WOLFBOOT_TPM_VERIFY) || defined(WOLFBOOT_TPM_SEAL)
 int wolfBoot_load_pubkey(const uint8_t* pubkey_hint, WOLFTPM2_KEY* pubKey,
     TPM_ALG_ID* pAlg);
@@ -83,6 +85,7 @@ int wolfBoot_unseal_auth(const uint8_t* pubkey_hint, const uint8_t* policy, uint
 int wolfBoot_unseal_blob(const uint8_t* pubkey_hint, const uint8_t* policy, uint16_t policySz,
     WOLFTPM2_KEYBLOB* seal_blob, uint8_t* secret, int* secret_sz, const uint8_t* auth, int authSz);
 
+int wolfBoot_delete_seal(int index);
 int wolfBoot_read_blob(uint32_t nvIndex, WOLFTPM2_KEYBLOB* blob,
     const uint8_t* auth, uint32_t authSz);
 int wolfBoot_store_blob(TPMI_RH_NV_AUTH authHandle, uint32_t nvIndex,

src/tpm.c

@@ -591,8 +591,12 @@ int wolfBoot_store_blob(TPMI_RH_NV_AUTH authHandle, uint32_t nvIndex,
     memset(&nv, 0, sizeof(nv));
 
     nv.handle.hndl = nvIndex;
-    nv.handle.auth.size = authSz;
-    memcpy(nv.handle.auth.buffer, auth, authSz);
+    if (authSz > 0) {
+        if (auth == NULL)
+            return BAD_FUNC_ARG;
+        nv.handle.auth.size = authSz;
+        memcpy(nv.handle.auth.buffer, auth, authSz);
+    }
 
     parent.hndl = authHandle;
 
@@ -667,8 +671,12 @@ int wolfBoot_read_blob(uint32_t nvIndex, WOLFTPM2_KEYBLOB* blob,
     memset(&nv, 0, sizeof(nv));
 
     nv.handle.hndl = nvIndex;
-    nv.handle.auth.size = authSz;
-    memcpy(nv.handle.auth.buffer, auth, authSz);
+    if (authSz > 0) {
+        if (auth == NULL)
+            return BAD_FUNC_ARG;
+        nv.handle.auth.size = authSz;
+        memcpy(nv.handle.auth.buffer, auth, authSz);
+    }
     wolfTPM2_SetAuthHandle(&wolftpm_dev, 0, &nv.handle);
 
     pos = 0;
@@ -722,8 +730,12 @@ int wolfBoot_delete_blob(TPMI_RH_NV_AUTH authHandle, uint32_t nvIndex,
     memset(&nv, 0, sizeof(nv));
 
     nv.handle.hndl = nvIndex;
-    nv.handle.auth.size = authSz;
-    memcpy(nv.handle.auth.buffer, auth, authSz);
+    if (authSz > 0) {
+        if (auth == NULL)
+            return BAD_FUNC_ARG;
+        nv.handle.auth.size = authSz;
+        memcpy(nv.handle.auth.buffer, auth, authSz);
+    }
 
     parent.hndl = authHandle;
 
@@ -822,6 +834,12 @@ int wolfBoot_seal_blob(const uint8_t* pubkey_hint,
     return rc;
 }
 
+int wolfBoot_delete_seal(int index)
+{
+    return wolfBoot_delete_blob(TPM_RH_PLATFORM,
+            WOLFBOOT_TPM_SEAL_NV_BASE + index, NULL, 0);
+}
+
 /* Index (0-X) determines location in NV from WOLFBOOT_TPM_SEAL_NV_BASE to
  * store sealed blob */
 int wolfBoot_seal_auth(const uint8_t* pubkey_hint,
@@ -991,15 +1009,15 @@ int wolfBoot_unseal_blob(const uint8_t* pubkey_hint,
         rc = wolfTPM2_PolicyAuthorize(&wolftpm_dev, policy_session.handle.hndl,
             &authKey.pub, &checkTicket, pcrDigest, pcrDigestSz,
             policyRef, policyRefSz);
-    }
-    else {
-        /* A failure here means the signed policy did not match expected policy.
-         * Use this PCR mask and policy digest with the sign tool --policy=
-         * argument to sign */
-        wolfBoot_printf("Policy signature failed!\n");
-        wolfBoot_printf("Expected PCR Mask (0x%08x) and PCR Policy (%d)\n",
-            pcrMask, policyDigestSz);
-        wolfBoot_print_hexstr(policyDigest, policyDigestSz, 0);
+        if (rc != 0) {
+            /* A failure here means the signed policy did not match expected
+             * policy. Use this PCR mask and policy digest with the sign tool
+             * --policy= argument to sign */
+            wolfBoot_printf("Policy signature failed!\n");
+            wolfBoot_printf("Expected PCR Mask (0x%08x) and PCR Policy (%d)\n",
+                            pcrMask, policyDigestSz);
+            wolfBoot_print_hexstr(policyDigest, policyDigestSz, 0);
+        }
     }
 
     /* done with authorization public key */
@@ -1237,6 +1255,20 @@ void wolfBoot_tpm2_deinit(void)
     wolfTPM2_Cleanup(&wolftpm_dev);
 }
 
+/**
+ * @brief Clear the content of the TPM2 device.
+ *
+ * This function clears the TPM2 device and remove all stored secrets.
+ *
+ * @return BAD_FUNC_ARG if any of the underlying functions has passed an invalid
+ *          argument, e.g. wolftpm_dev is not initialized
+ * @return TPM_RC_SUCCESS in case of success
+ */
+int wolfBoot_tpm2_clear(void)
+{
+    return wolfTPM2_Clear(&wolftpm_dev);
+}
+
 
 #ifdef WOLFBOOT_TPM_KEYSTORE
 /* check root of trust based on key_slot (index) and public key hint */