Star0
6
代码
代码
Issues1
Pull Requests2
项目讨论
Wiki
分析
Star0
6
已开启
update to version 4.2.0 #95
Funda Wang创建于 2月19日
update to version 4.2.0 #95
已开启
Funda Wang创建于 2月19日
从fundawang/tpm2-tssmaster合入到src-openeuler/tpm2-tssmaster
共 11 个文件变更+16-2237
A.gitattributes+1-0
@@ -0,0 +1 @@
1+*.gz filter=lfs diff=lfs merge=lfs -text
A.lfsconfig+2-0
@@ -0,0 +1,2 @@
1+[lfs]
2+ url = https://artlfs.openeuler.openatom.cn/src-openEuler/tpm2-tss
DHygon-Add-support-for-udev-to-create-tcm-de.patch+0-23
@@ -1,23 +0,0 @@
1-From 61a3e15944eff1acb7f17528ea71d30db09405b5 Mon Sep 17 00:00:00 2001
2-From: chench <chench@hygon.cn>
3-Date: Fri, 5 Jul 2024 16:25:08 +0800
4-Subject: [PATCH] [newfeature][tcm] Add support for udev to create tcm devices
5- 
6-Change-Id: I15958fd5864a7688655d8b2933280237c63c4e86
7----
8- dist/tpm-udev.rules | 2 ++
9- 1 file changed, 2 insertions(+)
10- 
11-diff --git a/dist/tpm-udev.rules b/dist/tpm-udev.rules
12-index d7745b4..fde36bb 100644
13---- a/dist/tpm-udev.rules
14-+++ b/dist/tpm-udev.rules
15-@@ -2,3 +2,5 @@
16- # group members can access tpmrm devices
17- KERNEL=="tpm[0-9]*", TAG+="systemd", MODE="0660", OWNER="tss"
18- KERNEL=="tpmrm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
19-+KERNEL=="tcm[0-9]*", TAG+="systemd", MODE="0660", OWNER="tss"
20-+KERNEL=="tcmrm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
21---
22-2.17.1
23- 
DHygon-add-ecc-encrypt-decrypt-support.patch+0-1355
@@ -1,1355 +0,0 @@
1-From 406ee12062de2f8132ff10f1abc6887f32e6c03b Mon Sep 17 00:00:00 2001
2-From: mayuanchen <mayuanchen@hygon.cn>
3-Date: Tue, 9 May 2023 18:39:47 -0400
4-Subject: [PATCH 1/3] newfeature: tpm: add ecc encrypt/decrypt support.
5- 
6-Change-Id: I0176b508015a907e6dff48b8d8c90427b59f7a5e
7----
8- include/tss2/tss2_esys.h | 61 +++++
9- include/tss2/tss2_mu.h | 14 +
10- include/tss2/tss2_sys.h | 46 ++++
11- include/tss2/tss2_tpm2_types.h | 13 +-
12- lib/tss2-esys.def | 6 +
13- lib/tss2-esys.map | 6 +
14- lib/tss2-mu.def | 2 +
15- lib/tss2-mu.map | 2 +
16- lib/tss2-sys.def | 6 +
17- lib/tss2-sys.map | 6 +
18- src/tss2-esys/api/Esys_ECC_Decrypt.c | 347 ++++++++++++++++++++++++
19- src/tss2-esys/api/Esys_ECC_Encrypt.c | 341 +++++++++++++++++++++++
20- src/tss2-mu/tpmt-types.c | 6 +
21- src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c | 153 +++++++++++
22- src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c | 153 +++++++++++
23- src/tss2-sys/sysapi_util.c | 4 +-
24- 16 files changed, 1164 insertions(+), 2 deletions(-)
25- create mode 100644 src/tss2-esys/api/Esys_ECC_Decrypt.c
26- create mode 100644 src/tss2-esys/api/Esys_ECC_Encrypt.c
27- create mode 100644 src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c
28- create mode 100644 src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c
29- 
30-diff --git a/include/tss2/tss2_esys.h b/include/tss2/tss2_esys.h
31-index 6641f8d..fd06eeb 100644
32---- a/include/tss2/tss2_esys.h
33-+++ b/include/tss2/tss2_esys.h
34-@@ -3759,6 +3759,67 @@ Esys_NV_Certify_Finish(
35- TPM2B_ATTEST **certifyInfo,
36- TPMT_SIGNATURE **signature);
37-
38-+TSS2_RC
39-+Esys_ECC_Encrypt(
40-+ ESYS_CONTEXT *esysContext,
41-+ ESYS_TR keyHandle,
42-+ ESYS_TR shandle1,
43-+ ESYS_TR shandle2,
44-+ ESYS_TR shandle3,
45-+ const TPMT_ECC_DECRYPT *inScheme,
46-+ const TPM2B_MAX_BUFFER *message,
47-+ const TPM2B_DATA *sharedData1,
48-+ const TPM2B_DATA *sharedData2,
49-+ TPM2B_MAX_BUFFER **outData);
50-+
51-+TSS2_RC
52-+Esys_ECC_Encrypt_Async(
53-+ ESYS_CONTEXT *esysContext,
54-+ ESYS_TR keyHandle,
55-+ ESYS_TR shandle1,
56-+ ESYS_TR shandle2,
57-+ ESYS_TR shandle3,
58-+ const TPMT_ECC_DECRYPT *inScheme,
59-+ const TPM2B_MAX_BUFFER *message,
60-+ const TPM2B_DATA *sharedData1,
61-+ const TPM2B_DATA *sharedData2);
62-+
63-+TSS2_RC
64-+Esys_ECC_Encrypt_Finish(
65-+ ESYS_CONTEXT *esysContext,
66-+ TPM2B_MAX_BUFFER **outData);
67-+
68-+TSS2_RC
69-+Esys_ECC_Decrypt(
70-+ ESYS_CONTEXT *esysContext,
71-+ ESYS_TR keyHandle,
72-+ ESYS_TR shandle1,
73-+ ESYS_TR shandle2,
74-+ ESYS_TR shandle3,
75-+ const TPMT_ECC_DECRYPT *inScheme,
76-+ const TPM2B_MAX_BUFFER *message,
77-+ const TPM2B_DATA *sharedData1,
78-+ const TPM2B_DATA *sharedData2,
79-+ TPM2B_MAX_BUFFER **outData);
80-+
81-+TSS2_RC
82-+Esys_ECC_Decrypt_Async(
83-+ ESYS_CONTEXT *esysContext,
84-+ ESYS_TR keyHandle,
85-+ ESYS_TR shandle1,
86-+ ESYS_TR shandle2,
87-+ ESYS_TR shandle3,
88-+ const TPMT_ECC_DECRYPT *inScheme,
89-+ const TPM2B_MAX_BUFFER *message,
90-+ const TPM2B_DATA *sharedData1,
91-+ const TPM2B_DATA *sharedData2);
92-+
93-+TSS2_RC
94-+Esys_ECC_Decrypt_Finish(
95-+ ESYS_CONTEXT *esysContext,
96-+ TPM2B_MAX_BUFFER **outData);
97-+
98-+
99- /* Table 233 - TPM2_Vendor_TCG_Test Command */
100-
101- TSS2_RC
102-diff --git a/include/tss2/tss2_mu.h b/include/tss2/tss2_mu.h
103-index 8933efc..25717d7 100644
104---- a/include/tss2/tss2_mu.h
105-+++ b/include/tss2/tss2_mu.h
106-@@ -1800,6 +1800,20 @@ Tss2_MU_TPMT_RSA_DECRYPT_Unmarshal(
107- size_t *offset,
108- TPMT_RSA_DECRYPT *dest);
109-
110-+TSS2_RC
111-+Tss2_MU_TPMT_ECC_DECRYPT_Marshal(
112-+ TPMT_ECC_DECRYPT const *src,
113-+ uint8_t buffer[],
114-+ size_t buffer_size,
115-+ size_t *offset);
116-+
117-+TSS2_RC
118-+Tss2_MU_TPMT_ECC_DECRYPT_Unmarshal(
119-+ uint8_t const buffer[],
120-+ size_t buffer_size,
121-+ size_t *offset,
122-+ TPMT_ECC_DECRYPT *dest);
123-+
124- TSS2_RC
125- Tss2_MU_TPMT_ECC_SCHEME_Marshal(
126- TPMT_ECC_SCHEME const *src,
127-diff --git a/include/tss2/tss2_sys.h b/include/tss2/tss2_sys.h
128-index a672898..80e42f6 100644
129---- a/include/tss2/tss2_sys.h
130-+++ b/include/tss2/tss2_sys.h
131-@@ -2319,6 +2319,52 @@ TSS2_RC Tss2_Sys_PolicyAuthorizeNV(
132- TSS2L_SYS_AUTH_COMMAND const *cmdAuthsArray,
133- TSS2L_SYS_AUTH_RESPONSE *rspAuthsArray);
134-
135-+TSS2_RC Tss2_Sys_ECC_Encrypt_Prepare(
136-+ TSS2_SYS_CONTEXT *sysContext,
137-+ TPMI_DH_OBJECT keyHandle,
138-+ const TPMT_ECC_DECRYPT *inScheme,
139-+ const TPM2B_MAX_BUFFER *message,
140-+ const TPM2B_DATA *sharedData1,
141-+ const TPM2B_DATA *sharedData2);
142-+
143-+TSS2_RC Tss2_Sys_ECC_Encrypt_Complete(
144-+ TSS2_SYS_CONTEXT *sysContext,
145-+ TPM2B_MAX_BUFFER *outData);
146-+
147-+TSS2_RC Tss2_Sys_ECC_Encrypt(
148-+ TSS2_SYS_CONTEXT *sysContext,
149-+ TPMI_DH_OBJECT keyHandle,
150-+ TSS2L_SYS_AUTH_COMMAND const *cmdAuthsArray,
151-+ const TPMT_ECC_DECRYPT *inScheme,
152-+ const TPM2B_MAX_BUFFER *message,
153-+ const TPM2B_DATA *sharedData1,
154-+ const TPM2B_DATA *sharedData2,
155-+ TPM2B_MAX_BUFFER *outData,
156-+ TSS2L_SYS_AUTH_RESPONSE *rspAuthsArray);
157-+
158-+TSS2_RC Tss2_Sys_ECC_Decrypt_Prepare(
159-+ TSS2_SYS_CONTEXT *sysContext,
160-+ TPMI_DH_OBJECT keyHandle,
161-+ const TPMT_ECC_DECRYPT *inScheme,
162-+ const TPM2B_MAX_BUFFER *message,
163-+ const TPM2B_DATA *sharedData1,
164-+ const TPM2B_DATA *sharedData2);
165-+
166-+TSS2_RC Tss2_Sys_ECC_Decrypt_Complete(
167-+ TSS2_SYS_CONTEXT *sysContext,
168-+ TPM2B_MAX_BUFFER *outData);
169-+
170-+TSS2_RC Tss2_Sys_ECC_Decrypt(
171-+ TSS2_SYS_CONTEXT *sysContext,
172-+ TPMI_DH_OBJECT keyHandle,
173-+ TSS2L_SYS_AUTH_COMMAND const *cmdAuthsArray,
174-+ const TPMT_ECC_DECRYPT *inScheme,
175-+ const TPM2B_MAX_BUFFER *message,
176-+ const TPM2B_DATA *sharedData1,
177-+ const TPM2B_DATA *sharedData2,
178-+ TPM2B_MAX_BUFFER *outData,
179-+ TSS2L_SYS_AUTH_RESPONSE *rspAuthsArray);
180-+
181- #ifdef __cplusplus
182- }
183- #endif
184-diff --git a/include/tss2/tss2_tpm2_types.h b/include/tss2/tss2_tpm2_types.h
185-index 1ce737e..c5f53d9 100644
186---- a/include/tss2/tss2_tpm2_types.h
187-+++ b/include/tss2/tss2_tpm2_types.h
188-@@ -249,7 +249,9 @@ typedef UINT32 TPM2_CC;
189- #define TPM2_CC_Policy_AC_SendSelect ((TPM2_CC) 0x00000196)
190- #define TPM2_CC_CertifyX509 ((TPM2_CC) 0x00000197)
191- #define TPM2_CC_ACT_SetTimeout ((TPM2_CC) 0x00000198)
192--#define TPM2_CC_LAST ((TPM2_CC) 0x00000198)
193-+#define TPM2_CC_ECC_Encrypt ((TPM2_CC) 0x00000199)
194-+#define TPM2_CC_ECC_Decrypt ((TPM2_CC) 0x0000019a)
195-+#define TPM2_CC_LAST ((TPM2_CC) 0x0000019a)
196- #define TPM2_CC_Vendor_TCG_Test ((TPM2_CC) 0x20000000)
197-
198- /* Definition of Types for Documentation Clarity */
199-@@ -1630,6 +1632,15 @@ struct TPM2B_PRIVATE_KEY_RSA {
200- BYTE buffer[TPM2_MAX_RSA_KEY_BYTES/2 * 5];
201- };
202-
203-+/* Definition of TPM2_ALG_ID ECC TPMI_ALG_ECC_DECRYPT Type */
204-+typedef TPM2_ALG_ID TPMI_ALG_ECC_DECRYPT;
205-+
206-+/* Definition of ECC TPMT_ECC_DECRYPT Structure */
207-+typedef struct {
208-+ TPMI_ALG_ECC_DECRYPT scheme; /* scheme selector */
209-+ TPMU_ASYM_SCHEME details; /* scheme parameters */
210-+} TPMT_ECC_DECRYPT;
211-+
212- /* Definition of ECC TPM2B_ECC_PARAMETER Structure */
213- typedef struct TPM2B_ECC_PARAMETER TPM2B_ECC_PARAMETER;
214- struct TPM2B_ECC_PARAMETER {
215-diff --git a/lib/tss2-esys.def b/lib/tss2-esys.def
216-index c6890d8..3b762f7 100644
217---- a/lib/tss2-esys.def
218-+++ b/lib/tss2-esys.def
219-@@ -66,6 +66,12 @@ EXPORTS
220- Esys_Duplicate
221- Esys_Duplicate_Async
222- Esys_Duplicate_Finish
223-+ Esys_ECC_Decrypt
224-+ Esys_ECC_Decrypt_Async
225-+ Esys_ECC_Decrypt_Finish
226-+ Esys_ECC_Encrypt
227-+ Esys_ECC_Encrypt_Async
228-+ Esys_ECC_Encrypt_Finish
229- Esys_ECC_Parameters
230- Esys_ECC_Parameters_Async
231- Esys_ECC_Parameters_Finish
232-diff --git a/lib/tss2-esys.map b/lib/tss2-esys.map
233-index 2062cc3..6884075 100644
234---- a/lib/tss2-esys.map
235-+++ b/lib/tss2-esys.map
236-@@ -66,6 +66,12 @@
237- Esys_Duplicate;
238- Esys_Duplicate_Async;
239- Esys_Duplicate_Finish;
240-+ Esys_ECC_Decrypt;
241-+ Esys_ECC_Decrypt_Async;
242-+ Esys_ECC_Decrypt_Finish;
243-+ Esys_ECC_Encrypt;
244-+ Esys_ECC_Encrypt_Async;
245-+ Esys_ECC_Encrypt_Finish;
246- Esys_ECC_Parameters;
247- Esys_ECC_Parameters_Async;
248- Esys_ECC_Parameters_Finish;
249-diff --git a/lib/tss2-mu.def b/lib/tss2-mu.def
250-index d978c83..7b2e957 100644
251---- a/lib/tss2-mu.def
252-+++ b/lib/tss2-mu.def
253-@@ -284,3 +284,5 @@ EXPORTS
254- Tss2_MU_TPM2_NT_Unmarshal
255- Tss2_MU_TPMI_ALG_HASH_Marshal
256- Tss2_MU_TPMI_ALG_HASH_Unmarshal
257-+ Tss2_MU_TPMT_ECC_DECRYPT_Marshal
258-+ Tss2_MU_TPMT_ECC_DECRYPT_Unmarshal
259-diff --git a/lib/tss2-mu.map b/lib/tss2-mu.map
260-index 3f4c8cb..2149a5f 100644
261---- a/lib/tss2-mu.map
262-+++ b/lib/tss2-mu.map
263-@@ -284,6 +284,8 @@
264- Tss2_MU_TPM2_NT_Unmarshal;
265- Tss2_MU_TPMI_ALG_HASH_Marshal;
266- Tss2_MU_TPMI_ALG_HASH_Unmarshal;
267-+ Tss2_MU_TPMT_ECC_DECRYPT_Marshal;
268-+ Tss2_MU_TPMT_ECC_DECRYPT_Unmarshal;
269- local:
270- *;
271- };
272-diff --git a/lib/tss2-sys.def b/lib/tss2-sys.def
273-index 751ef33..b25dcd9 100644
274---- a/lib/tss2-sys.def
275-+++ b/lib/tss2-sys.def
276-@@ -372,3 +372,9 @@ EXPORTS
277- Tss2_Sys_ZGen_2Phase_Prepare
278- Tss2_Sys_ZGen_2Phase_Complete
279- Tss2_Sys_ZGen_2Phase
280-+ Tss2_Sys_ECC_Encrypt_Prepare
281-+ Tss2_Sys_ECC_Encrypt_Complete
282-+ Tss2_Sys_ECC_Encrypt
283-+ Tss2_Sys_ECC_Decrypt_Prepare
284-+ Tss2_Sys_ECC_Decrypt_Complete
285-+ Tss2_Sys_ECC_Decrypt
286-diff --git a/lib/tss2-sys.map b/lib/tss2-sys.map
287-index 0027df9..eba70f7 100644
288---- a/lib/tss2-sys.map
289-+++ b/lib/tss2-sys.map
290-@@ -376,6 +376,12 @@
291- Tss2_Sys_ZGen_2Phase_Prepare;
292- Tss2_Sys_ZGen_2Phase_Complete;
293- Tss2_Sys_ZGen_2Phase;
294-+ Tss2_Sys_ECC_Encrypt_Prepare;
295-+ Tss2_Sys_ECC_Encrypt_Complete;
296-+ Tss2_Sys_ECC_Encrypt;
297-+ Tss2_Sys_ECC_Decrypt_Prepare;
298-+ Tss2_Sys_ECC_Decrypt_Complete;
299-+ Tss2_Sys_ECC_Decrypt;
300- local:
301- *;
302- };
303-diff --git a/src/tss2-esys/api/Esys_ECC_Decrypt.c b/src/tss2-esys/api/Esys_ECC_Decrypt.c
304-new file mode 100644
305-index 0000000..1515563
306---- /dev/null
307-+++ b/src/tss2-esys/api/Esys_ECC_Decrypt.c
308-@@ -0,0 +1,347 @@
309-+/* SPDX-License-Identifier: BSD-2-Clause */
310-+/*******************************************************************************
311-+ * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
312-+ * All rights reserved.
313-+ ******************************************************************************/
314-+
315-+#ifdef HAVE_CONFIG_H
316-+#include <config.h>
317-+#endif
318-+
319-+#include "tss2_mu.h"
320-+#include "tss2_sys.h"
321-+#include "tss2_esys.h"
322-+
323-+#include "esys_types.h"
324-+#include "esys_iutil.h"
325-+#include "esys_mu.h"
326-+#define LOGMODULE esys
327-+#include "util/log.h"
328-+#include "util/aux_util.h"
329-+
330-+/** One-Call function for TPM2_ECC_Decrypt
331-+ *
332-+ * This function invokes the TPM2_ECC_Decrypt command in a one-call
333-+ * variant. This means the function will block until the TPM response is
334-+ * available. All input parameters are const. The memory for non-simple output
335-+ * parameters is allocated by the function implementation.
336-+ *
337-+ * @param[in,out] esysContext The ESYS_CONTEXT.
338-+ * @param[in] keyHandle Reference to public portion of ECC key to use for
339-+ * encryption.
340-+ * @param[in] shandle1 First session handle.
341-+ * @param[in] shandle2 Second session handle.
342-+ * @param[in] shandle3 Third session handle.
343-+ * @param[in] inScheme TPM2_The padding scheme to use if scheme associated with
344-+ * keyHandle is TPM2_ALG_NULL.
345-+ * @param[in] cipherText Cipher text to be decrypted.
346-+ * @param[in] sharedData1 Optional sharedData1 to be associated with the inScheme.
347-+ * @param[in] sharedData2 Optional sharedData2 to be associated with the inScheme.
348-+ * @param[out] outData Encrypted output.
349-+ * (callee-allocated)
350-+ * @retval TSS2_RC_SUCCESS if the function call was a success.
351-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
352-+ * pointers or required output handle references are NULL.
353-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
354-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
355-+ * internal operations or return parameters.
356-+ * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
357-+ * operation already pending.
358-+ * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
359-+ * at least contain the tag, response length, and response code.
360-+ * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
361-+ * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM
362-+ did not verify.
363-+ * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
364-+ * the 'decrypt' attribute bit set.
365-+ * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
366-+ * the 'encrypt' attribute bit set.
367-+ * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
368-+ * to the ESYS_CONTEXT or are of the wrong type or if required
369-+ * ESYS_TR objects are ESYS_TR_NONE.
370-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
371-+ * returned to the caller unaltered unless handled internally.
372-+ */
373-+TSS2_RC
374-+Esys_ECC_Decrypt(
375-+ ESYS_CONTEXT *esysContext,
376-+ ESYS_TR keyHandle,
377-+ ESYS_TR shandle1,
378-+ ESYS_TR shandle2,
379-+ ESYS_TR shandle3,
380-+ const TPMT_ECC_DECRYPT *inScheme,
381-+ const TPM2B_MAX_BUFFER *cipherText,
382-+ const TPM2B_DATA *sharedData1,
383-+ const TPM2B_DATA *sharedData2,
384-+ TPM2B_MAX_BUFFER **outData)
385-+{
386-+ TSS2_RC r;
387-+
388-+ r = Esys_ECC_Decrypt_Async(esysContext, keyHandle, shandle1, shandle2,
389-+ shandle3, inScheme, cipherText, sharedData1, sharedData2);
390-+ return_if_error(r, "Error in async function");
391-+
392-+ /* Set the timeout to indefinite for now, since we want _Finish to block */
393-+ int32_t timeouttmp = esysContext->timeout;
394-+ esysContext->timeout = -1;
395-+ /*
396-+ * Now we call the finish function, until return code is not equal to
397-+ * from TSS2_BASE_RC_TRY_AGAIN.
398-+ * Note that the finish function may return TSS2_RC_TRY_AGAIN, even if we
399-+ * have set the timeout to -1. This occurs for example if the TPM requests
400-+ * a retransmission of the command via TPM2_RC_YIELDED.
401-+ */
402-+ do {
403-+ r = Esys_ECC_Decrypt_Finish(esysContext, outData);
404-+ /* This is just debug information about the reattempt to finish the
405-+ command */
406-+ if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN)
407-+ LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32
408-+ " => resubmitting command", r);
409-+ } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
410-+
411-+ /* Restore the timeout value to the original value */
412-+ esysContext->timeout = timeouttmp;
413-+ return_if_error(r, "Esys Finish");
414-+
415-+ return TSS2_RC_SUCCESS;
416-+}
417-+
418-+/** Asynchronous function for TPM2_ECC_Decrypt
419-+ *
420-+ * This function invokes the TPM2_ECC_Decrypt command in a asynchronous
421-+ * variant. This means the function will return as soon as the command has been
422-+ * sent downwards the stack to the TPM. All input parameters are const.
423-+ * In order to retrieve the TPM's response call Esys_ECC_Decrypt_Finish.
424-+ *
425-+ * @param[in,out] esysContext The ESYS_CONTEXT.
426-+ * @param[in] keyHandle Reference to public portion of ECC key to use for
427-+ * encryption.
428-+ * @param[in] shandle1 First session handle.
429-+ * @param[in] shandle2 Second session handle.
430-+ * @param[in] shandle3 Third session handle.
431-+ * @param[in] inScheme TPM2_The padding scheme to use if scheme associated with
432-+ * keyHandle is TPM2_ALG_NULL.
433-+ * @param[in] cipherText Cipher text to be decrypted.
434-+ * @param[in] sharedData1 Optional sharedData1 to be associated with the inScheme.
435-+ * @param[in] sharedData2 Optional sharedData2 to be associated with the inScheme.
436-+ * @retval ESYS_RC_SUCCESS if the function call was a success.
437-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
438-+ * pointers or required output handle references are NULL.
439-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
440-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
441-+ * internal operations or return parameters.
442-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
443-+ returned to the caller unaltered unless handled internally.
444-+ * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
445-+ * the 'decrypt' attribute bit set.
446-+ * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
447-+ * the 'encrypt' attribute bit set.
448-+ * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
449-+ * to the ESYS_CONTEXT or are of the wrong type or if required
450-+ * ESYS_TR objects are ESYS_TR_NONE.
451-+ */
452-+TSS2_RC
453-+Esys_ECC_Decrypt_Async(
454-+ ESYS_CONTEXT *esysContext,
455-+ ESYS_TR keyHandle,
456-+ ESYS_TR shandle1,
457-+ ESYS_TR shandle2,
458-+ ESYS_TR shandle3,
459-+ const TPMT_ECC_DECRYPT *inScheme,
460-+ const TPM2B_MAX_BUFFER *cipherText,
461-+ const TPM2B_DATA *sharedData1,
462-+ const TPM2B_DATA *sharedData2)
463-+{
464-+ TSS2_RC r;
465-+ LOG_TRACE("context=%p, keyHandle=%"PRIx32 ", cipherText=%p,"
466-+ "inScheme=%p, sharedData1=%p, sharedData2=%p",
467-+ esysContext, keyHandle, cipherText, inScheme, sharedData1, sharedData2);
468-+ TSS2L_SYS_AUTH_COMMAND auths;
469-+ RSRC_NODE_T *keyHandleNode;
470-+
471-+ /* Check context, sequence correctness and set state to error for now */
472-+ if (esysContext == NULL) {
473-+ LOG_ERROR("esyscontext is NULL.");
474-+ return TSS2_ESYS_RC_BAD_REFERENCE;
475-+ }
476-+ r = iesys_check_sequence_async(esysContext);
477-+ if (r != TSS2_RC_SUCCESS)
478-+ return r;
479-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
480-+
481-+ /* Check input parameters */
482-+ r = check_session_feasibility(shandle1, shandle2, shandle3, 1);
483-+ return_state_if_error(r, _ESYS_STATE_INIT, "Check session usage");
484-+
485-+ /* Retrieve the metadata objects for provided handles */
486-+ r = esys_GetResourceObject(esysContext, keyHandle, &keyHandleNode);
487-+ return_state_if_error(r, _ESYS_STATE_INIT, "keyHandle unknown.");
488-+
489-+ /* Initial invocation of SAPI to prepare the command buffer with parameters */
490-+ r = Tss2_Sys_ECC_Decrypt_Prepare(esysContext->sys,
491-+ (keyHandleNode == NULL) ? TPM2_RH_NULL
492-+ : keyHandleNode->rsrc.handle, inScheme,
493-+ cipherText, sharedData1, sharedData2);
494-+ return_state_if_error(r, _ESYS_STATE_INIT, "SAPI Prepare returned error.");
495-+
496-+ /* Calculate the cpHash Values */
497-+ r = init_session_tab(esysContext, shandle1, shandle2, shandle3);
498-+ return_state_if_error(r, _ESYS_STATE_INIT, "Initialize session resources");
499-+ if (keyHandleNode != NULL)
500-+ iesys_compute_session_value(esysContext->session_tab[0],
501-+ &keyHandleNode->rsrc.name, &keyHandleNode->auth);
502-+ else
503-+ iesys_compute_session_value(esysContext->session_tab[0], NULL, NULL);
504-+
505-+ iesys_compute_session_value(esysContext->session_tab[1], NULL, NULL);
506-+ iesys_compute_session_value(esysContext->session_tab[2], NULL, NULL);
507-+
508-+ /* Generate the auth values and set them in the SAPI command buffer */
509-+ r = iesys_gen_auths(esysContext, keyHandleNode, NULL, NULL, &auths);
510-+ return_state_if_error(r, _ESYS_STATE_INIT,
511-+ "Error in computation of auth values");
512-+
513-+ esysContext->authsCount = auths.count;
514-+ if (auths.count > 0) {
515-+ r = Tss2_Sys_SetCmdAuths(esysContext->sys, &auths);
516-+ return_state_if_error(r, _ESYS_STATE_INIT, "SAPI error on SetCmdAuths");
517-+ }
518-+
519-+ /* Trigger execution and finish the async invocation */
520-+ r = Tss2_Sys_ExecuteAsync(esysContext->sys);
521-+ return_state_if_error(r, _ESYS_STATE_INTERNALERROR,
522-+ "Finish (Execute Async)");
523-+
524-+ esysContext->state = _ESYS_STATE_SENT;
525-+
526-+ return r;
527-+}
528-+
529-+/** Asynchronous finish function for TPM2_ECC_Decrypt
530-+ *
531-+ * This function returns the results of a TPM2_ECC_Decrypt command
532-+ * invoked via Esys_ECC_Decrypt_Finish. All non-simple output parameters
533-+ * are allocated by the function's implementation. NULL can be passed for every
534-+ * output parameter if the value is not required.
535-+ *
536-+ * @param[in,out] esysContext The ESYS_CONTEXT.
537-+ * @param[out] outData Decrypted output.
538-+ * (callee-allocated)
539-+ * @retval TSS2_RC_SUCCESS on success
540-+ * @retval ESYS_RC_SUCCESS if the function call was a success.
541-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
542-+ * pointers or required output handle references are NULL.
543-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
544-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
545-+ * internal operations or return parameters.
546-+ * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
547-+ * operation already pending.
548-+ * @retval TSS2_ESYS_RC_TRY_AGAIN: if the timeout counter expires before the
549-+ * TPM response is received.
550-+ * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
551-+ * at least contain the tag, response length, and response code.
552-+ * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM did
553-+ * not verify.
554-+ * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
555-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
556-+ * returned to the caller unaltered unless handled internally.
557-+ */
558-+TSS2_RC
559-+Esys_ECC_Decrypt_Finish(
560-+ ESYS_CONTEXT *esysContext,
561-+ TPM2B_MAX_BUFFER **outData)
562-+{
563-+ TSS2_RC r;
564-+ LOG_TRACE("context=%p, outData=%p",
565-+ esysContext, outData);
566-+
567-+ if (esysContext == NULL) {
568-+ LOG_ERROR("esyscontext is NULL.");
569-+ return TSS2_ESYS_RC_BAD_REFERENCE;
570-+ }
571-+
572-+ /* Check for correct sequence and set sequence to irregular for now */
573-+ if (esysContext->state != _ESYS_STATE_SENT &&
574-+ esysContext->state != _ESYS_STATE_RESUBMISSION) {
575-+ LOG_ERROR("Esys called in bad sequence.");
576-+ return TSS2_ESYS_RC_BAD_SEQUENCE;
577-+ }
578-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
579-+
580-+ /* Allocate memory for response parameters */
581-+ if (outData != NULL) {
582-+ *outData = calloc(sizeof(TPM2B_MAX_BUFFER), 1);
583-+ if (*outData == NULL) {
584-+ return_error(TSS2_ESYS_RC_MEMORY, "Out of memory");
585-+ }
586-+ }
587-+
588-+ /*Receive the TPM response and handle resubmissions if necessary. */
589-+ r = Tss2_Sys_ExecuteFinish(esysContext->sys, esysContext->timeout);
590-+ if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN) {
591-+ LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32, r);
592-+ esysContext->state = _ESYS_STATE_SENT;
593-+ goto error_cleanup;
594-+ }
595-+ /* This block handle the resubmission of TPM commands given a certain set of
596-+ * TPM response codes. */
597-+ if (r == TPM2_RC_RETRY || r == TPM2_RC_TESTING || r == TPM2_RC_YIELDED) {
598-+ LOG_DEBUG("TPM returned RETRY, TESTING or YIELDED, which triggers a "
599-+ "resubmission: %" PRIx32, r);
600-+ if (esysContext->submissionCount++ >= _ESYS_MAX_SUBMISSIONS) {
601-+ LOG_WARNING("Maximum number of (re)submissions has been reached.");
602-+ esysContext->state = _ESYS_STATE_INIT;
603-+ goto error_cleanup;
604-+ }
605-+ esysContext->state = _ESYS_STATE_RESUBMISSION;
606-+ r = Tss2_Sys_ExecuteAsync(esysContext->sys);
607-+ if (r != TSS2_RC_SUCCESS) {
608-+ LOG_WARNING("Error attempting to resubmit");
609-+ /* We do not set esysContext->state here but inherit the most recent
610-+ * state of the _async function. */
611-+ goto error_cleanup;
612-+ }
613-+ r = TSS2_ESYS_RC_TRY_AGAIN;
614-+ LOG_DEBUG("Resubmission initiated and returning RC_TRY_AGAIN.");
615-+ goto error_cleanup;
616-+ }
617-+ /* The following is the "regular error" handling. */
618-+ if (iesys_tpm_error(r)) {
619-+ LOG_WARNING("Received TPM Error");
620-+ esysContext->state = _ESYS_STATE_INIT;
621-+ goto error_cleanup;
622-+ } else if (r != TSS2_RC_SUCCESS) {
623-+ LOG_ERROR("Received a non-TPM Error");
624-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
625-+ goto error_cleanup;
626-+ }
627-+
628-+ /*
629-+ * Now the verification of the response (hmac check) and if necessary the
630-+ * parameter decryption have to be done.
631-+ */
632-+ r = iesys_check_response(esysContext);
633-+ goto_state_if_error(r, _ESYS_STATE_INTERNALERROR, "Error: check response",
634-+ error_cleanup);
635-+
636-+ /*
637-+ * After the verification of the response we call the complete function
638-+ * to deliver the result.
639-+ */
640-+ r = Tss2_Sys_ECC_Decrypt_Complete(esysContext->sys,
641-+ (outData != NULL) ? *outData : NULL);
642-+ goto_state_if_error(r, _ESYS_STATE_INTERNALERROR,
643-+ "Received error from SAPI unmarshaling" ,
644-+ error_cleanup);
645-+
646-+ esysContext->state = _ESYS_STATE_INIT;
647-+
648-+ return TSS2_RC_SUCCESS;
649-+
650-+error_cleanup:
651-+ if (outData != NULL)
652-+ SAFE_FREE(*outData);
653-+
654-+ return r;
655-+}
656-diff --git a/src/tss2-esys/api/Esys_ECC_Encrypt.c b/src/tss2-esys/api/Esys_ECC_Encrypt.c
657-new file mode 100644
658-index 0000000..498bca6
659---- /dev/null
660-+++ b/src/tss2-esys/api/Esys_ECC_Encrypt.c
661-@@ -0,0 +1,341 @@
662-+/* SPDX-License-Identifier: BSD-2-Clause */
663-+/*******************************************************************************
664-+ * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
665-+ * All rights reserved.
666-+ ******************************************************************************/
667-+
668-+#ifdef HAVE_CONFIG_H
669-+#include <config.h>
670-+#endif
671-+
672-+#include "tss2_mu.h"
673-+#include "tss2_sys.h"
674-+#include "tss2_esys.h"
675-+
676-+#include "esys_types.h"
677-+#include "esys_iutil.h"
678-+#include "esys_mu.h"
679-+#define LOGMODULE esys
680-+#include "util/log.h"
681-+#include "util/aux_util.h"
682-+
683-+/** One-Call function for TPM2_ECC_Encrypt
684-+ *
685-+ * This function invokes the TPM2_ECC_Encrypt command in a one-call
686-+ * variant. This means the function will block until the TPM response is
687-+ * available. All input parameters are const. The memory for non-simple output
688-+ * parameters is allocated by the function implementation.
689-+ *
690-+ * @param[in,out] esysContext The ESYS_CONTEXT.
691-+ * @param[in] keyHandle Reference to public portion of ECC key to use for
692-+ * encryption.
693-+ * @param[in] shandle1 First session handle.
694-+ * @param[in] shandle2 Second session handle.
695-+ * @param[in] shandle3 Third session handle.
696-+ * @param[in] inScheme TPM2_The padding scheme to use if scheme associated with
697-+ * keyHandle is TPM2_ALG_NULL.
698-+ * @param[in] message Message to be encrypted.
699-+ * @param[in] sharedData1 Optional sharedData1 to be associated with the inScheme.
700-+ * @param[in] sharedData2 Optional sharedData2 to be associated with the inScheme.
701-+ * @param[out] outData Encrypted output.
702-+ * (callee-allocated)
703-+ * @retval TSS2_RC_SUCCESS if the function call was a success.
704-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
705-+ * pointers or required output handle references are NULL.
706-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
707-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
708-+ * internal operations or return parameters.
709-+ * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
710-+ * operation already pending.
711-+ * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
712-+ * at least contain the tag, response length, and response code.
713-+ * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
714-+ * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM
715-+ did not verify.
716-+ * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
717-+ * the 'decrypt' attribute bit set.
718-+ * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
719-+ * the 'encrypt' attribute bit set.
720-+ * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
721-+ * to the ESYS_CONTEXT or are of the wrong type or if required
722-+ * ESYS_TR objects are ESYS_TR_NONE.
723-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
724-+ * returned to the caller unaltered unless handled internally.
725-+ */
726-+TSS2_RC
727-+Esys_ECC_Encrypt(
728-+ ESYS_CONTEXT *esysContext,
729-+ ESYS_TR keyHandle,
730-+ ESYS_TR shandle1,
731-+ ESYS_TR shandle2,
732-+ ESYS_TR shandle3,
733-+ const TPMT_ECC_DECRYPT *inScheme,
734-+ const TPM2B_MAX_BUFFER *message,
735-+ const TPM2B_DATA *sharedData1,
736-+ const TPM2B_DATA *sharedData2,
737-+ TPM2B_MAX_BUFFER **outData)
738-+{
739-+ TSS2_RC r;
740-+
741-+ r = Esys_ECC_Encrypt_Async(esysContext, keyHandle, shandle1, shandle2,
742-+ shandle3, inScheme, message, sharedData1, sharedData2);
743-+ return_if_error(r, "Error in async function");
744-+
745-+ /* Set the timeout to indefinite for now, since we want _Finish to block */
746-+ int32_t timeouttmp = esysContext->timeout;
747-+ esysContext->timeout = -1;
748-+ /*
749-+ * Now we call the finish function, until return code is not equal to
750-+ * from TSS2_BASE_RC_TRY_AGAIN.
751-+ * Note that the finish function may return TSS2_RC_TRY_AGAIN, even if we
752-+ * have set the timeout to -1. This occurs for example if the TPM requests
753-+ * a retransmission of the command via TPM2_RC_YIELDED.
754-+ */
755-+ do {
756-+ r = Esys_ECC_Encrypt_Finish(esysContext, outData);
757-+ /* This is just debug information about the reattempt to finish the
758-+ command */
759-+ if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN)
760-+ LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32
761-+ " => resubmitting command", r);
762-+ } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
763-+
764-+ /* Restore the timeout value to the original value */
765-+ esysContext->timeout = timeouttmp;
766-+ return_if_error(r, "Esys Finish");
767-+
768-+ return TSS2_RC_SUCCESS;
769-+}
770-+
771-+/** Asynchronous function for TPM2_ECC_Encrypt
772-+ *
773-+ * This function invokes the TPM2_ECC_Encrypt command in a asynchronous
774-+ * variant. This means the function will return as soon as the command has been
775-+ * sent downwards the stack to the TPM. All input parameters are const.
776-+ * In order to retrieve the TPM's response call Esys_ECC_Encrypt_Finish.
777-+ *
778-+ * @param[in,out] esysContext The ESYS_CONTEXT.
779-+ * @param[in] keyHandle Reference to public portion of ECC key to use for
780-+ * encryption.
781-+ * @param[in] shandle1 First session handle.
782-+ * @param[in] shandle2 Second session handle.
783-+ * @param[in] shandle3 Third session handle.
784-+ * @param[in] message Message to be encrypted.
785-+ * @param[in] inScheme TPM2_The padding scheme to use if scheme associated with
786-+ * keyHandle is TPM2_ALG_NULL.
787-+ * @param[in] label Optional label L to be associated with the message.
788-+ * @retval ESYS_RC_SUCCESS if the function call was a success.
789-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
790-+ * pointers or required output handle references are NULL.
791-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
792-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
793-+ * internal operations or return parameters.
794-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
795-+ returned to the caller unaltered unless handled internally.
796-+ * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
797-+ * the 'decrypt' attribute bit set.
798-+ * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
799-+ * the 'encrypt' attribute bit set.
800-+ * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
801-+ * to the ESYS_CONTEXT or are of the wrong type or if required
802-+ * ESYS_TR objects are ESYS_TR_NONE.
803-+ */
804-+TSS2_RC
805-+Esys_ECC_Encrypt_Async(
806-+ ESYS_CONTEXT *esysContext,
807-+ ESYS_TR keyHandle,
808-+ ESYS_TR shandle1,
809-+ ESYS_TR shandle2,
810-+ ESYS_TR shandle3,
811-+ const TPMT_ECC_DECRYPT *inScheme,
812-+ const TPM2B_MAX_BUFFER *message,
813-+ const TPM2B_DATA *sharedData1,
814-+ const TPM2B_DATA *sharedData2)
815-+{
816-+ TSS2_RC r;
817-+ LOG_TRACE("context=%p, keyHandle=%"PRIx32 ", message=%p,"
818-+ "inScheme=%p, sharedData1=%p, sharedData2=%p",
819-+ esysContext, keyHandle, message, inScheme, sharedData1, sharedData2);
820-+ TSS2L_SYS_AUTH_COMMAND auths;
821-+ RSRC_NODE_T *keyHandleNode;
822-+
823-+ /* Check context, sequence correctness and set state to error for now */
824-+ if (esysContext == NULL) {
825-+ LOG_ERROR("esyscontext is NULL.");
826-+ return TSS2_ESYS_RC_BAD_REFERENCE;
827-+ }
828-+ r = iesys_check_sequence_async(esysContext);
829-+ if (r != TSS2_RC_SUCCESS)
830-+ return r;
831-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
832-+
833-+ /* Check input parameters */
834-+ r = check_session_feasibility(shandle1, shandle2, shandle3, 0);
835-+ return_state_if_error(r, _ESYS_STATE_INIT, "Check session usage");
836-+
837-+ /* Retrieve the metadata objects for provided handles */
838-+ r = esys_GetResourceObject(esysContext, keyHandle, &keyHandleNode);
839-+ return_state_if_error(r, _ESYS_STATE_INIT, "keyHandle unknown.");
840-+
841-+ /* Initial invocation of SAPI to prepare the command buffer with parameters */
842-+ r = Tss2_Sys_ECC_Encrypt_Prepare(esysContext->sys,
843-+ (keyHandleNode == NULL) ? TPM2_RH_NULL
844-+ : keyHandleNode->rsrc.handle, inScheme,
845-+ message, sharedData1, sharedData2);
846-+ return_state_if_error(r, _ESYS_STATE_INIT, "SAPI Prepare returned error.");
847-+
848-+ /* Calculate the cpHash Values */
849-+ r = init_session_tab(esysContext, shandle1, shandle2, shandle3);
850-+ return_state_if_error(r, _ESYS_STATE_INIT, "Initialize session resources");
851-+ iesys_compute_session_value(esysContext->session_tab[0], NULL, NULL);
852-+ iesys_compute_session_value(esysContext->session_tab[1], NULL, NULL);
853-+ iesys_compute_session_value(esysContext->session_tab[2], NULL, NULL);
854-+
855-+ /* Generate the auth values and set them in the SAPI command buffer */
856-+ r = iesys_gen_auths(esysContext, keyHandleNode, NULL, NULL, &auths);
857-+ return_state_if_error(r, _ESYS_STATE_INIT,
858-+ "Error in computation of auth values");
859-+
860-+ esysContext->authsCount = auths.count;
861-+ if (auths.count > 0) {
862-+ r = Tss2_Sys_SetCmdAuths(esysContext->sys, &auths);
863-+ return_state_if_error(r, _ESYS_STATE_INIT, "SAPI error on SetCmdAuths");
864-+ }
865-+
866-+ /* Trigger execution and finish the async invocation */
867-+ r = Tss2_Sys_ExecuteAsync(esysContext->sys);
868-+ return_state_if_error(r, _ESYS_STATE_INTERNALERROR,
869-+ "Finish (Execute Async)");
870-+
871-+ esysContext->state = _ESYS_STATE_SENT;
872-+
873-+ return r;
874-+}
875-+
876-+/** Asynchronous finish function for TPM2_ECC_Encrypt
877-+ *
878-+ * This function returns the results of a TPM2_ECC_Encrypt command
879-+ * invoked via Esys_ECC_Encrypt_Finish. All non-simple output parameters
880-+ * are allocated by the function's implementation. NULL can be passed for every
881-+ * output parameter if the value is not required.
882-+ *
883-+ * @param[in,out] esysContext The ESYS_CONTEXT.
884-+ * @param[out] outData Encrypted output.
885-+ * (callee-allocated)
886-+ * @retval TSS2_RC_SUCCESS on success
887-+ * @retval ESYS_RC_SUCCESS if the function call was a success.
888-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
889-+ * pointers or required output handle references are NULL.
890-+ * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
891-+ * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
892-+ * internal operations or return parameters.
893-+ * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
894-+ * operation already pending.
895-+ * @retval TSS2_ESYS_RC_TRY_AGAIN: if the timeout counter expires before the
896-+ * TPM response is received.
897-+ * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
898-+ * at least contain the tag, response length, and response code.
899-+ * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM did
900-+ * not verify.
901-+ * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
902-+ * @retval TSS2_RCs produced by lower layers of the software stack may be
903-+ * returned to the caller unaltered unless handled internally.
904-+ */
905-+TSS2_RC
906-+Esys_ECC_Encrypt_Finish(
907-+ ESYS_CONTEXT *esysContext,
908-+ TPM2B_MAX_BUFFER **outData)
909-+{
910-+ TSS2_RC r;
911-+ LOG_TRACE("context=%p, outData=%p",
912-+ esysContext, outData);
913-+
914-+ if (esysContext == NULL) {
915-+ LOG_ERROR("esyscontext is NULL.");
916-+ return TSS2_ESYS_RC_BAD_REFERENCE;
917-+ }
918-+
919-+ /* Check for correct sequence and set sequence to irregular for now */
920-+ if (esysContext->state != _ESYS_STATE_SENT &&
921-+ esysContext->state != _ESYS_STATE_RESUBMISSION) {
922-+ LOG_ERROR("Esys called in bad sequence.");
923-+ return TSS2_ESYS_RC_BAD_SEQUENCE;
924-+ }
925-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
926-+
927-+ /* Allocate memory for response parameters */
928-+ if (outData != NULL) {
929-+ *outData = calloc(sizeof(TPM2B_MAX_BUFFER), 1);
930-+ if (*outData == NULL) {
931-+ return_error(TSS2_ESYS_RC_MEMORY, "Out of memory");
932-+ }
933-+ }
934-+
935-+ /*Receive the TPM response and handle resubmissions if necessary. */
936-+ r = Tss2_Sys_ExecuteFinish(esysContext->sys, esysContext->timeout);
937-+ if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN) {
938-+ LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32, r);
939-+ esysContext->state = _ESYS_STATE_SENT;
940-+ goto error_cleanup;
941-+ }
942-+ /* This block handle the resubmission of TPM commands given a certain set of
943-+ * TPM response codes. */
944-+ if (r == TPM2_RC_RETRY || r == TPM2_RC_TESTING || r == TPM2_RC_YIELDED) {
945-+ LOG_DEBUG("TPM returned RETRY, TESTING or YIELDED, which triggers a "
946-+ "resubmission: %" PRIx32, r);
947-+ if (esysContext->submissionCount++ >= _ESYS_MAX_SUBMISSIONS) {
948-+ LOG_WARNING("Maximum number of (re)submissions has been reached.");
949-+ esysContext->state = _ESYS_STATE_INIT;
950-+ goto error_cleanup;
951-+ }
952-+ esysContext->state = _ESYS_STATE_RESUBMISSION;
953-+ r = Tss2_Sys_ExecuteAsync(esysContext->sys);
954-+ if (r != TSS2_RC_SUCCESS) {
955-+ LOG_WARNING("Error attempting to resubmit");
956-+ /* We do not set esysContext->state here but inherit the most recent
957-+ * state of the _async function. */
958-+ goto error_cleanup;
959-+ }
960-+ r = TSS2_ESYS_RC_TRY_AGAIN;
961-+ LOG_DEBUG("Resubmission initiated and returning RC_TRY_AGAIN.");
962-+ goto error_cleanup;
963-+ }
964-+ /* The following is the "regular error" handling. */
965-+ if (iesys_tpm_error(r)) {
966-+ LOG_WARNING("Received TPM Error");
967-+ esysContext->state = _ESYS_STATE_INIT;
968-+ goto error_cleanup;
969-+ } else if (r != TSS2_RC_SUCCESS) {
970-+ LOG_ERROR("Received a non-TPM Error");
971-+ esysContext->state = _ESYS_STATE_INTERNALERROR;
972-+ goto error_cleanup;
973-+ }
974-+
975-+ /*
976-+ * Now the verification of the response (hmac check) and if necessary the
977-+ * parameter decryption have to be done.
978-+ */
979-+ r = iesys_check_response(esysContext);
980-+ goto_state_if_error(r, _ESYS_STATE_INTERNALERROR, "Error: check response",
981-+ error_cleanup);
982-+
983-+ /*
984-+ * After the verification of the response we call the complete function
985-+ * to deliver the result.
986-+ */
987-+ r = Tss2_Sys_ECC_Encrypt_Complete(esysContext->sys,
988-+ (outData != NULL) ? *outData : NULL);
989-+ goto_state_if_error(r, _ESYS_STATE_INTERNALERROR,
990-+ "Received error from SAPI unmarshaling" ,
991-+ error_cleanup);
992-+
993-+ esysContext->state = _ESYS_STATE_INIT;
994-+
995-+ return TSS2_RC_SUCCESS;
996-+
997-+error_cleanup:
998-+ if (outData != NULL)
999-+ SAFE_FREE(*outData);
1000-+
1001-+ return r;
1002-+}
1003-diff --git a/src/tss2-mu/tpmt-types.c b/src/tss2-mu/tpmt-types.c
1004-index df899a6..41cdf36 100644
1005---- a/src/tss2-mu/tpmt-types.c
1006-+++ b/src/tss2-mu/tpmt-types.c
1007-@@ -552,6 +552,12 @@ TPMT_MARSHAL_2(TPMT_RSA_DECRYPT, scheme, VAL, Tss2_MU_UINT16_Marshal,
1008- TPMT_UNMARSHAL_2(TPMT_RSA_DECRYPT, scheme, Tss2_MU_UINT16_Unmarshal,
1009- details, scheme, Tss2_MU_TPMU_ASYM_SCHEME_Unmarshal)
1010-
1011-+TPMT_MARSHAL_2(TPMT_ECC_DECRYPT, scheme, VAL, Tss2_MU_UINT16_Marshal,
1012-+ details, ADDR, scheme, Tss2_MU_TPMU_ASYM_SCHEME_Marshal)
1013-+
1014-+TPMT_UNMARSHAL_2(TPMT_ECC_DECRYPT, scheme, Tss2_MU_UINT16_Unmarshal,
1015-+ details, scheme, Tss2_MU_TPMU_ASYM_SCHEME_Unmarshal)
1016-+
1017- TPMT_MARSHAL_2(TPMT_ECC_SCHEME, scheme, VAL, Tss2_MU_UINT16_Marshal,
1018- details, ADDR, scheme, Tss2_MU_TPMU_ASYM_SCHEME_Marshal)
1019-
1020-diff --git a/src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c b/src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c
1021-new file mode 100644
1022-index 0000000..9f6a596
1023---- /dev/null
1024-+++ b/src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c
1025-@@ -0,0 +1,153 @@
1026-+/* SPDX-License-Identifier: BSD-2-Clause */
1027-+/***********************************************************************;
1028-+ * Copyright (c) 2015 - 2017, Intel Corporation
1029-+ * All rights reserved.
1030-+ ***********************************************************************/
1031-+
1032-+#ifdef HAVE_CONFIG_H
1033-+#include <config.h>
1034-+#endif
1035-+
1036-+#include "tss2_tpm2_types.h"
1037-+#include "tss2_mu.h"
1038-+#include "sysapi_util.h"
1039-+
1040-+TSS2_RC Tss2_Sys_ECC_Decrypt_Prepare(
1041-+ TSS2_SYS_CONTEXT *sysContext,
1042-+ TPMI_DH_OBJECT keyHandle,
1043-+ const TPMT_ECC_DECRYPT *inScheme,
1044-+ const TPM2B_MAX_BUFFER *cipherText,
1045-+ const TPM2B_DATA *sharedData1,
1046-+ const TPM2B_DATA *sharedData2)
1047-+{
1048-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1049-+ TSS2_RC rval;
1050-+
1051-+ if (!ctx || !inScheme)
1052-+ return TSS2_SYS_RC_BAD_REFERENCE;
1053-+
1054-+ rval = CommonPreparePrologue(ctx, TPM2_CC_ECC_Decrypt);
1055-+ if (rval)
1056-+ return rval;
1057-+
1058-+ rval = Tss2_MU_UINT32_Marshal(keyHandle, ctx->cmdBuffer,
1059-+ ctx->maxCmdSize,
1060-+ &ctx->nextData);
1061-+ if (rval)
1062-+ return rval;
1063-+
1064-+ /* Encryption is not possible because the exchange of parameter inScheme
1065-+ and cipherText in tcm2.0 spec. so disable decryptAllowed in the following code.
1066-+ */
1067-+ rval = Tss2_MU_TPMT_ECC_DECRYPT_Marshal(inScheme, ctx->cmdBuffer,
1068-+ ctx->maxCmdSize,
1069-+ &ctx->nextData);
1070-+ if (rval)
1071-+ return rval;
1072-+
1073-+ if (!cipherText) {
1074-+ ctx->decryptNull = 1;
1075-+
1076-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1077-+ ctx->maxCmdSize,
1078-+ &ctx->nextData);
1079-+ } else {
1080-+
1081-+ rval = Tss2_MU_TPM2B_MAX_BUFFER_Marshal(cipherText, ctx->cmdBuffer,
1082-+ ctx->maxCmdSize,
1083-+ &ctx->nextData);
1084-+ }
1085-+
1086-+ if (rval)
1087-+ return rval;
1088-+
1089-+#if 0
1090-+ rval = Tss2_MU_TPMT_ECC_DECRYPT_Marshal(inScheme, ctx->cmdBuffer,
1091-+ ctx->maxCmdSize,
1092-+ &ctx->nextData);
1093-+ if (rval)
1094-+ return rval;
1095-+#endif
1096-+
1097-+ if (!sharedData1) {
1098-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1099-+ ctx->maxCmdSize,
1100-+ &ctx->nextData);
1101-+
1102-+ } else {
1103-+
1104-+ rval = Tss2_MU_TPM2B_DATA_Marshal(sharedData1, ctx->cmdBuffer,
1105-+ ctx->maxCmdSize,
1106-+ &ctx->nextData);
1107-+ }
1108-+ if (rval)
1109-+ return rval;
1110-+
1111-+ if (!sharedData2) {
1112-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1113-+ ctx->maxCmdSize,
1114-+ &ctx->nextData);
1115-+
1116-+ } else {
1117-+
1118-+ rval = Tss2_MU_TPM2B_DATA_Marshal(sharedData2, ctx->cmdBuffer,
1119-+ ctx->maxCmdSize,
1120-+ &ctx->nextData);
1121-+ }
1122-+ if (rval)
1123-+ return rval;
1124-+
1125-+ //ctx->decryptAllowed = 1;
1126-+ ctx->decryptAllowed = 0;
1127-+ ctx->encryptAllowed = 1;
1128-+ ctx->authAllowed = 1;
1129-+
1130-+ return CommonPrepareEpilogue(ctx);
1131-+}
1132-+
1133-+TSS2_RC Tss2_Sys_ECC_Decrypt_Complete(
1134-+ TSS2_SYS_CONTEXT *sysContext,
1135-+ TPM2B_MAX_BUFFER *outData)
1136-+{
1137-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1138-+ TSS2_RC rval;
1139-+
1140-+ if (!ctx)
1141-+ return TSS2_SYS_RC_BAD_REFERENCE;
1142-+
1143-+ rval = CommonComplete(ctx);
1144-+ if (rval)
1145-+ return rval;
1146-+
1147-+ return Tss2_MU_TPM2B_MAX_BUFFER_Unmarshal(ctx->cmdBuffer,
1148-+ ctx->maxCmdSize,
1149-+ &ctx->nextData, outData);
1150-+}
1151-+
1152-+TSS2_RC Tss2_Sys_ECC_Decrypt(
1153-+ TSS2_SYS_CONTEXT *sysContext,
1154-+ TPMI_DH_OBJECT keyHandle,
1155-+ TSS2L_SYS_AUTH_COMMAND const *cmdAuthsArray,
1156-+ const TPMT_ECC_DECRYPT *inScheme,
1157-+ const TPM2B_MAX_BUFFER *message,
1158-+ const TPM2B_DATA *sharedData1,
1159-+ const TPM2B_DATA *sharedData2,
1160-+ TPM2B_MAX_BUFFER *outData,
1161-+ TSS2L_SYS_AUTH_RESPONSE *rspAuthsArray)
1162-+{
1163-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1164-+ TSS2_RC rval;
1165-+
1166-+ if (!inScheme)
1167-+ return TSS2_SYS_RC_BAD_REFERENCE;
1168-+
1169-+ rval = Tss2_Sys_ECC_Decrypt_Prepare(sysContext, keyHandle, inScheme, message, sharedData1, sharedData2);
1170-+ if (rval)
1171-+ return rval;
1172-+
1173-+ rval = CommonOneCall(ctx, cmdAuthsArray, rspAuthsArray);
1174-+ if (rval)
1175-+ return rval;
1176-+
1177-+ return Tss2_Sys_ECC_Decrypt_Complete(sysContext, outData);
1178-+}
1179-diff --git a/src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c b/src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c
1180-new file mode 100644
1181-index 0000000..af02d4c
1182---- /dev/null
1183-+++ b/src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c
1184-@@ -0,0 +1,153 @@
1185-+/* SPDX-License-Identifier: BSD-2-Clause */
1186-+/***********************************************************************;
1187-+ * Copyright (c) 2015 - 2017, Intel Corporation
1188-+ * All rights reserved.
1189-+ ***********************************************************************/
1190-+
1191-+#ifdef HAVE_CONFIG_H
1192-+#include <config.h>
1193-+#endif
1194-+
1195-+#include "tss2_tpm2_types.h"
1196-+#include "tss2_mu.h"
1197-+#include "sysapi_util.h"
1198-+
1199-+TSS2_RC Tss2_Sys_ECC_Encrypt_Prepare(
1200-+ TSS2_SYS_CONTEXT *sysContext,
1201-+ TPMI_DH_OBJECT keyHandle,
1202-+ const TPMT_ECC_DECRYPT *inScheme,
1203-+ const TPM2B_MAX_BUFFER *message,
1204-+ const TPM2B_DATA *sharedData1,
1205-+ const TPM2B_DATA *sharedData2)
1206-+{
1207-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1208-+ TSS2_RC rval;
1209-+
1210-+ if (!ctx || !inScheme)
1211-+ return TSS2_SYS_RC_BAD_REFERENCE;
1212-+
1213-+ rval = CommonPreparePrologue(ctx, TPM2_CC_ECC_Encrypt);
1214-+ if (rval)
1215-+ return rval;
1216-+
1217-+ rval = Tss2_MU_UINT32_Marshal(keyHandle, ctx->cmdBuffer,
1218-+ ctx->maxCmdSize,
1219-+ &ctx->nextData);
1220-+ if (rval)
1221-+ return rval;
1222-+
1223-+ /* Encryption is not possible because the exchange of parameter inScheme
1224-+ and message in tcm2.0 spec. so disable decryptAllowed in the following code.
1225-+ */
1226-+ rval = Tss2_MU_TPMT_ECC_DECRYPT_Marshal(inScheme, ctx->cmdBuffer,
1227-+ ctx->maxCmdSize,
1228-+ &ctx->nextData);
1229-+ if (rval)
1230-+ return rval;
1231-+
1232-+ if (!message) {
1233-+ ctx->decryptNull = 1;
1234-+
1235-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1236-+ ctx->maxCmdSize,
1237-+ &ctx->nextData);
1238-+ } else {
1239-+
1240-+ rval = Tss2_MU_TPM2B_MAX_BUFFER_Marshal(message, ctx->cmdBuffer,
1241-+ ctx->maxCmdSize,
1242-+ &ctx->nextData);
1243-+ }
1244-+
1245-+ if (rval)
1246-+ return rval;
1247-+
1248-+#if 0
1249-+ rval = Tss2_MU_TPMT_ECC_DECRYPT_Marshal(inScheme, ctx->cmdBuffer,
1250-+ ctx->maxCmdSize,
1251-+ &ctx->nextData);
1252-+ if (rval)
1253-+ return rval;
1254-+#endif
1255-+
1256-+ if (!sharedData1) {
1257-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1258-+ ctx->maxCmdSize,
1259-+ &ctx->nextData);
1260-+
1261-+ } else {
1262-+
1263-+ rval = Tss2_MU_TPM2B_DATA_Marshal(sharedData1, ctx->cmdBuffer,
1264-+ ctx->maxCmdSize,
1265-+ &ctx->nextData);
1266-+ }
1267-+ if (rval)
1268-+ return rval;
1269-+
1270-+ if (!sharedData2) {
1271-+ rval = Tss2_MU_UINT16_Marshal(0, ctx->cmdBuffer,
1272-+ ctx->maxCmdSize,
1273-+ &ctx->nextData);
1274-+
1275-+ } else {
1276-+
1277-+ rval = Tss2_MU_TPM2B_DATA_Marshal(sharedData2, ctx->cmdBuffer,
1278-+ ctx->maxCmdSize,
1279-+ &ctx->nextData);
1280-+ }
1281-+ if (rval)
1282-+ return rval;
1283-+
1284-+ //ctx->decryptAllowed = 1;
1285-+ ctx->decryptAllowed = 0;
1286-+ ctx->encryptAllowed = 1;
1287-+ ctx->authAllowed = 1;
1288-+
1289-+ return CommonPrepareEpilogue(ctx);
1290-+}
1291-+
1292-+TSS2_RC Tss2_Sys_ECC_Encrypt_Complete(
1293-+ TSS2_SYS_CONTEXT *sysContext,
1294-+ TPM2B_MAX_BUFFER *outData)
1295-+{
1296-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1297-+ TSS2_RC rval;
1298-+
1299-+ if (!ctx)
1300-+ return TSS2_SYS_RC_BAD_REFERENCE;
1301-+
1302-+ rval = CommonComplete(ctx);
1303-+ if (rval)
1304-+ return rval;
1305-+
1306-+ return Tss2_MU_TPM2B_MAX_BUFFER_Unmarshal(ctx->cmdBuffer,
1307-+ ctx->maxCmdSize,
1308-+ &ctx->nextData, outData);
1309-+}
1310-+
1311-+TSS2_RC Tss2_Sys_ECC_Encrypt(
1312-+ TSS2_SYS_CONTEXT *sysContext,
1313-+ TPMI_DH_OBJECT keyHandle,
1314-+ TSS2L_SYS_AUTH_COMMAND const *cmdAuthsArray,
1315-+ const TPMT_ECC_DECRYPT *inScheme,
1316-+ const TPM2B_MAX_BUFFER *message,
1317-+ const TPM2B_DATA *sharedData1,
1318-+ const TPM2B_DATA *sharedData2,
1319-+ TPM2B_MAX_BUFFER *outData,
1320-+ TSS2L_SYS_AUTH_RESPONSE *rspAuthsArray)
1321-+{
1322-+ _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1323-+ TSS2_RC rval;
1324-+
1325-+ if (!inScheme)
1326-+ return TSS2_SYS_RC_BAD_REFERENCE;
1327-+
1328-+ rval = Tss2_Sys_ECC_Encrypt_Prepare(sysContext, keyHandle, inScheme, message, sharedData1, sharedData2);
1329-+ if (rval)
1330-+ return rval;
1331-+
1332-+ rval = CommonOneCall(ctx, cmdAuthsArray, rspAuthsArray);
1333-+ if (rval)
1334-+ return rval;
1335-+
1336-+ return Tss2_Sys_ECC_Encrypt_Complete(sysContext, outData);
1337-+}
1338-diff --git a/src/tss2-sys/sysapi_util.c b/src/tss2-sys/sysapi_util.c
1339-index 6e59da0..9824824 100644
1340---- a/src/tss2-sys/sysapi_util.c
1341-+++ b/src/tss2-sys/sysapi_util.c
1342-@@ -288,7 +288,9 @@ static int GetNumHandles(TPM2_CC commandCode, bool req)
1343- { TPM2_CC_AC_Send, 3, 0 },
1344- { TPM2_CC_Policy_AC_SendSelect, 1, 0 },
1345- { TPM2_CC_ACT_SetTimeout, 1, 0 },
1346-- { TPM2_CC_CertifyX509, 2, 0 }
1347-+ { TPM2_CC_CertifyX509, 2, 0 },
1348-+ { TPM2_CC_ECC_Encrypt, 1, 0 },
1349-+ { TPM2_CC_ECC_Decrypt, 1, 0 }
1350- };
1351-
1352- uint8_t i;
1353---
1354-2.17.1
1355- 
Dbackport-FAPI-Skip-test-fapi-fix-provisioning-with-template-i.patch+0-91
@@ -1,91 +0,0 @@
1-From 218c0da8d9f675766b1de502a52e23a3aa52648e Mon Sep 17 00:00:00 2001
2-From: Juergen Repp <juergen_repp@web.de>
3-Date: Wed, 22 Mar 2023 10:54:59 +0100
4-Subject: [PATCH] FAPI: Skip test fapi-fix-provisioning-with template if no
5- certificate is available.
6- 
7-If the configure option --enable-self-generated-certificate is not used this
8-test can't be executed because no certificate will be stored in NV ram. The
9-test will be skipped if no certificate is available.
10-Fixes: #2558
11- 
12-Signed-off-by: Juergen Repp <juergen_repp@web.de>
13----
14- .../fapi-provisioning-with-template.int.c | 40 ++++++++++++++++++-
15- 1 file changed, 39 insertions(+), 1 deletion(-)
16- 
17-diff --git a/test/integration/fapi-provisioning-with-template.int.c b/test/integration/fapi-provisioning-with-template.int.c
18-index 54c724f5..74184cdc 100644
19---- a/test/integration/fapi-provisioning-with-template.int.c
20-+++ b/test/integration/fapi-provisioning-with-template.int.c
21-@@ -4,6 +4,8 @@
22- #endif
23-
24- #include <stdlib.h>
25-+#include <stdio.h>
26-+#include <unistd.h>
27-
28- #include "tss2_esys.h"
29- #include "tss2_fapi.h"
30-@@ -31,6 +33,39 @@
31- * @retval EXIT_SKIP
32- *
33- */
34-+static bool
35-+fapi_ek_certless()
36-+{
37-+ FILE *stream = NULL;
38-+ long config_size;
39-+ char *config = NULL;
40-+ char *fapi_config_file = getenv("TSS2_FAPICONF");
41-+
42-+ stream = fopen(fapi_config_file, "r");
43-+ if (!stream) {
44-+ LOG_ERROR("File %s does not exist", fapi_config_file);
45-+ return NULL;
46-+ }
47-+ fseek(stream, 0L, SEEK_END);
48-+ config_size = ftell(stream);
49-+ fclose(stream);
50-+ config = malloc(config_size + 1);
51-+ stream = fopen(fapi_config_file, "r");
52-+ ssize_t ret = read(fileno(stream), config, config_size);
53-+ if (ret != config_size) {
54-+ LOG_ERROR("IO error %s.", fapi_config_file);
55-+ return NULL;
56-+ }
57-+ config[config_size] = '\0';
58-+ if (strstr(config, "\"ek_cert_less\": \"yes\"") == NULL) {
59-+ SAFE_FREE(config);
60-+ return false;
61-+ } else {
62-+ SAFE_FREE(config);
63-+ return true;
64-+ }
65-+}
66-+
67- int
68- test_fapi_provision_template(FAPI_CONTEXT *context)
69- {
70-@@ -151,6 +186,9 @@ test_fapi_provision_template(FAPI_CONTEXT *context)
71- TPM2B_AUTH auth = { .size = 0, .buffer = {} };
72- TPM2B_MAX_NV_BUFFER nv_data;
73-
74-+ if (fapi_ek_certless())
75-+ return EXIT_SKIP;
76-+
77- if (strcmp(FAPI_PROFILE, "P_ECC") == 0) {
78- nv_template_idx = ecc_nv_template_idx;
79- nv_nonce_idx = ecc_nv_nonce_idx;
80-@@ -169,7 +207,7 @@ test_fapi_provision_template(FAPI_CONTEXT *context)
81- r = Esys_Initialize(&esys_ctx, tcti, NULL);
82- goto_if_error(r, "Error Esys_Initialize", error);
83-
84-- /*
85-+ /*
86- * Store template (marshaled TPMT_PUBLIC) in NV ram.
87- */
88- r = Tss2_MU_TPMT_PUBLIC_Marshal(&in_public, &nv_data.buffer[0],
89---
90-2.33.0
91- 
Dbackport-Fix-missing-scanf-checks.patch+0-40
@@ -1,40 +0,0 @@
1-From 8bd9af15a7be65c45545242076fc603e1f6c0bf6 Mon Sep 17 00:00:00 2001
2-From: Juergen Repp <juergen_repp@web.de>
3-Date: Sat, 19 Oct 2024 13:21:20 +0200
4-Subject: [PATCH] FAPI: Fix missing scanf checks.
5- 
6-In several cases the return value of scanf was not checked.
7-Thus afterwards acces to variables not initialized was possible.
8- 
9-Signed-off-by: Juergen Repp <juergen_repp@web.de>
10----
11- src/tss2-fapi/ifapi_helpers.c | 8 ++++----
12- 1 file changed, 4 insertions(+), 4 deletions(-)
13- 
14-diff --git a/src/tss2-fapi/ifapi_helpers.c b/src/tss2-fapi/ifapi_helpers.c
15-index e7f6eeeb7..0b5ec7113 100644
16---- a/src/tss2-fapi/ifapi_helpers.c
17-+++ b/src/tss2-fapi/ifapi_helpers.c
18-@@ -85,8 +85,8 @@ ifapi_set_key_flags(const char *type, bool policy, IFAPI_KEY_TEMPLATE *template)
19- } else if (strcasecmp(flag, "noda") == 0) {
20- attributes |= TPMA_OBJECT_NODA;
21- } else if (strncmp(flag, "0x", 2) == 0) {
22-- sscanf(&flag[2], "%"SCNx32 "%n", &handle, &pos);
23-- if ((size_t)pos != strlen(flag) - 2) {
24-+ if (sscanf(&flag[2], "%"SCNx32 "%n", &handle, &pos) < 1 ||
25-+ (size_t)pos != strlen(flag) - 2) {
26- goto_error(r, TSS2_FAPI_RC_BAD_VALUE, "Invalid flag: %s",
27- error, flag);
28- }
29-@@ -182,8 +182,8 @@ ifapi_set_nv_flags(const char *type, IFAPI_NV_TEMPLATE *template,
30- } else if (strcasecmp(flag, "noda") == 0) {
31- attributes |= TPMA_NV_NO_DA;
32- } else if (strncmp(flag, "0x", 2) == 0) {
33-- sscanf(&flag[2], "%"SCNx32 "%n", &handle, &pos);
34-- if ((size_t)pos != strlen(flag) - 2) {
35-+ if (sscanf(&flag[2], "%"SCNx32 "%n", &handle, &pos) < 1 ||
36-+ (size_t)pos != strlen(flag) - 2) {
37- goto_error(r, TSS2_FAPI_RC_BAD_VALUE, "Invalid flag: %s",
38- error, flag);
39- }
40- 
Dbackport-TCTI-Device-Fix-using-of-C-string-for-byte-array.patch+0-29
@@ -1,29 +0,0 @@
1-From e2de1a9c9edb0d385758c5ed4c8d18008c9ea905 Mon Sep 17 00:00:00 2001
2-From: Juergen Repp <juergen_repp@web.de>
3-Date: Fri, 7 Nov 2025 21:21:59 +0100
4-Subject: [PATCH] TCTI Device: Fix using of C string for byte array.
5- 
6-On arch linux gcc did produce an error because a null terminator
7-was added.
8- 
9-Signed-off-by: Juergen Repp <juergen_repp@web.de>
10----
11- src/tss2-tcti/tcti-device.c | 2 +-
12- 1 file changed, 1 insertion(+), 1 deletion(-)
13- 
14-diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c
15-index 87e365e..586f593 100644
16---- a/src/tss2-tcti/tcti-device.c
17-+++ b/src/tss2-tcti/tcti-device.c
18-@@ -458,7 +458,7 @@ Tss2_Tcti_Device_Init (
19- }
20- /* probe if the device support partial response read */
21- LOG_DEBUG ("Probe device for partial response read support");
22-- uint8_t cmd[12] = { "\x80\x01\x00\x00\x00\x0c\x00\x00\x01\x7b\x00\x08" };
23-+ uint8_t cmd[12] = { 0x80, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x01, 0x7b, 0x00, 0x08 };
24- uint8_t rsp[20] = {0};
25- struct pollfd fds;
26- int rc_poll, nfds = 1;
27---
28-2.33.0
29- 
Dbackport-esys-add-SM4-algorithm-support.patch+0-689
@@ -1,689 +0,0 @@
1-From 0288dda4cec03e39a89f48333702a9301fb1ce80 Mon Sep 17 00:00:00 2001
2-From: mayuanchen <94815698+mayuanchenma@users.noreply.github.com>
3-Date: Fri, 25 Nov 2022 18:59:26 +0800
4-Subject: [PATCH] esys: add SM4 algorithm support.
5- 
6-commit 75e68b77b5c2ddce424ae41f859616b4e8d2b240 upstream.
7- 
8-Signed-off-by: mayuanchen <94815698+mayuanchenma@users.noreply.github.com>
9-Change-Id: I63f61888b92dcf06fb921aec08b40ca00c40ecdf
10----
11- configure.ac | 3 +
12- include/tss2/tss2_esys.h | 54 ++++++++++
13- src/tss2-esys/esys_crypto.c | 53 ++++++++++
14- src/tss2-esys/esys_crypto.h | 23 +++++
15- src/tss2-esys/esys_crypto_mbed.h | 2 +
16- src/tss2-esys/esys_crypto_ossl.c | 158 +++++++++++++++++++++++++++++
17- src/tss2-esys/esys_crypto_ossl.h | 29 ++++++
18- src/tss2-esys/esys_iutil.c | 66 +++++++++++-
19- test/integration/esys-crypto.int.c | 6 ++
20- test/unit/esys-crypto.c | 62 +++++++++++
21- 10 files changed, 454 insertions(+), 2 deletions(-)
22- 
23-diff --git a/configure.ac b/configure.ac
24-index b655027..f6c254a 100644
25---- a/configure.ac
26-+++ b/configure.ac
27-@@ -191,6 +191,9 @@ AS_IF([test "x$enable_esys" = xyes],
28- AC_CHECK_LIB(crypto,[EVP_sm3], [
29- AC_DEFINE([HAVE_EVP_SM3], [1], [Support EVP_sm3 in openssl])],
30- [])
31-+ AC_CHECK_LIB(crypto, [EVP_sm4_cfb128], [
32-+ AC_DEFINE([HAVE_EVP_SM4_CFB], [1], [Support EVP_sm4_cfb in openssl])],
33-+ [])
34- TSS2_ESYS_CFLAGS_CRYPTO="$CRYPTO_CFLAGS"
35- TSS2_ESYS_LDFLAGS_CRYPTO="$CRYPTO_LIBS"
36- ], [test "x$with_crypto" = xmbed], [
37-diff --git a/include/tss2/tss2_esys.h b/include/tss2/tss2_esys.h
38-index 6ef910e..6641f8d 100644
39---- a/include/tss2/tss2_esys.h
40-+++ b/include/tss2/tss2_esys.h
41-@@ -315,6 +315,58 @@ typedef TSS2_RC
42- uint8_t *iv,
43- void *userdata);
44-
45-+/** Encrypt data with SM4.
46-+ *
47-+ * @param[in] key key used for SM4.
48-+ * @param[in] tpm_sym_alg SM4 type in TSS2 notation (must be TPM2_ALG_SM4).
49-+ * @param[in] key_bits Key size in bits.
50-+ * @param[in] tpm_mode Block cipher mode of opertion in TSS2 notation (CFB).
51-+ * For parameter encryption only CFB can be used.
52-+ * @param[in,out] buffer Data to be encrypted. The encrypted date will be stored
53-+ * in this buffer.
54-+ * @param[in] buffer_size size of data to be encrypted.
55-+ * @param[in] iv The initialization vector.
56-+ * @param[in/out] userdata information.
57-+ * @retval TSS2_RC_SUCCESS on success
58-+ * @retval USER_DEFINED user defined errors on failure.
59-+ */
60-+typedef TSS2_RC
61-+ (*ESYS_CRYPTO_SM4_ENCRYPT_FNP)(
62-+ uint8_t *key,
63-+ TPM2_ALG_ID tpm_sym_alg,
64-+ TPMI_SM4_KEY_BITS key_bits,
65-+ TPM2_ALG_ID tpm_mode,
66-+ uint8_t *buffer,
67-+ size_t buffer_size,
68-+ uint8_t *iv,
69-+ void *userdata);
70-+
71-+/** Decrypt data with SM4.
72-+ *
73-+ * @param[in] key key used for SM4.
74-+ * @param[in] tpm_sym_alg SM4 type in TSS2 notation (must be TPM2_ALG_SM4).
75-+ * @param[in] key_bits Key size in bits.
76-+ * @param[in] tpm_mode Block cipher mode of opertion in TSS2 notation (CFB).
77-+ * For parameter encryption only CFB can be used.
78-+ * @param[in,out] buffer Data to be decrypted. The decrypted date will be stored
79-+ * in this buffer.
80-+ * @param[in] buffer_size size of data to be encrypted.
81-+ * @param[in] iv The initialization vector.
82-+ * @param[in/out] userdata information.
83-+ * @retval TSS2_RC_SUCCESS on success
84-+ * @retval USER_DEFINED user defined errors on failure.
85-+ */
86-+typedef TSS2_RC
87-+ (*ESYS_CRYPTO_SM4_DECRYPT_FNP)(
88-+ uint8_t *key,
89-+ TPM2_ALG_ID tpm_sym_alg,
90-+ TPMI_SM4_KEY_BITS key_bits,
91-+ TPM2_ALG_ID tpm_mode,
92-+ uint8_t *buffer,
93-+ size_t buffer_size,
94-+ uint8_t *iv,
95-+ void *userdata);
96-+
97- /** Encryption of a buffer using a public (RSA) key.
98- *
99- * Encrypting a buffer using a public key is used for example during
100-@@ -367,6 +419,8 @@ struct ESYS_CRYPTO_CALLBACKS {
101- ESYS_CRYPTO_GET_ECDH_POINT_FNP get_ecdh_point;
102- ESYS_CRYPTO_AES_ENCRYPT_FNP aes_encrypt;
103- ESYS_CRYPTO_AES_DECRYPT_FNP aes_decrypt;
104-+ ESYS_CRYPTO_SM4_ENCRYPT_FNP sm4_encrypt;
105-+ ESYS_CRYPTO_SM4_DECRYPT_FNP sm4_decrypt;
106- ESYS_CRYPTO_INIT_FNP init;
107- void *userdata;
108- };
109-diff --git a/src/tss2-esys/esys_crypto.c b/src/tss2-esys/esys_crypto.c
110-index e54c95c..8cfc97a 100644
111---- a/src/tss2-esys/esys_crypto.c
112-+++ b/src/tss2-esys/esys_crypto.c
113-@@ -280,6 +280,46 @@ TSS2_RC iesys_crypto_aes_decrypt(
114- iv);
115- }
116-
117-+TSS2_RC iesys_crypto_sm4_encrypt(
118-+ ESYS_CRYPTO_CALLBACKS *crypto_cb,
119-+ uint8_t *key,
120-+ TPM2_ALG_ID tpm_sym_alg,
121-+ TPMI_SM4_KEY_BITS key_bits,
122-+ TPM2_ALG_ID tpm_mode,
123-+ uint8_t *buffer,
124-+ size_t buffer_size,
125-+ uint8_t *iv)
126-+{
127-+ DO_CALLBACK(sm4_encrypt,
128-+ key,
129-+ tpm_sym_alg,
130-+ key_bits,
131-+ tpm_mode,
132-+ buffer,
133-+ buffer_size,
134-+ iv);
135-+}
136-+
137-+TSS2_RC iesys_crypto_sm4_decrypt(
138-+ ESYS_CRYPTO_CALLBACKS *crypto_cb,
139-+ uint8_t *key,
140-+ TPM2_ALG_ID tpm_sym_alg,
141-+ TPMI_SM4_KEY_BITS key_bits,
142-+ TPM2_ALG_ID tpm_mode,
143-+ uint8_t *buffer,
144-+ size_t buffer_size,
145-+ uint8_t *iv)
146-+{
147-+ DO_CALLBACK(sm4_decrypt,
148-+ key,
149-+ tpm_sym_alg,
150-+ key_bits,
151-+ tpm_mode,
152-+ buffer,
153-+ buffer_size,
154-+ iv);
155-+}
156-+
157- /** Compute the command or response parameter hash.
158- *
159- * These hashes are needed for the computation of the HMAC used for the
160-@@ -782,6 +822,8 @@ TSS2_RC
161- crypto_cb->userdata = NULL;
162- crypto_cb->aes_decrypt = _iesys_crypto_aes_decrypt;
163- crypto_cb->aes_encrypt = _iesys_crypto_aes_encrypt;
164-+ crypto_cb->sm4_decrypt = _iesys_crypto_sm4_decrypt;
165-+ crypto_cb->sm4_encrypt = _iesys_crypto_sm4_encrypt;
166- crypto_cb->get_ecdh_point = _iesys_crypto_get_ecdh_point;
167- crypto_cb->hash_abort = _iesys_crypto_hash_abort;
168- crypto_cb->hash_finish = _iesys_crypto_hash_finish;
169-@@ -799,6 +841,17 @@ TSS2_RC
170-
171- TEST_AND_SET_CALLBACK(crypto_cb, user_cb, aes_decrypt);
172- TEST_AND_SET_CALLBACK(crypto_cb, user_cb, aes_encrypt);
173-+ // sm4 is optional
174-+ if (user_cb->sm4_encrypt) {
175-+ crypto_cb->sm4_encrypt = user_cb->sm4_encrypt;
176-+ } else {
177-+ crypto_cb->sm4_encrypt = _iesys_crypto_sm4_encrypt;
178-+ }
179-+ if (user_cb->sm4_decrypt) {
180-+ crypto_cb->sm4_decrypt = user_cb->sm4_decrypt;
181-+ } else {
182-+ crypto_cb->sm4_decrypt = _iesys_crypto_sm4_decrypt;
183-+ }
184- TEST_AND_SET_CALLBACK(crypto_cb, user_cb, get_ecdh_point);
185- TEST_AND_SET_CALLBACK(crypto_cb, user_cb, get_random2b);
186- TEST_AND_SET_CALLBACK(crypto_cb, user_cb, rsa_pk_encrypt);
187-diff --git a/src/tss2-esys/esys_crypto.h b/src/tss2-esys/esys_crypto.h
188-index 8798bc6..c6efac1 100644
189---- a/src/tss2-esys/esys_crypto.h
190-+++ b/src/tss2-esys/esys_crypto.h
191-@@ -16,6 +16,8 @@
192- #else
193- #define _iesys_crypto_aes_decrypt NULL;
194- #define _iesys_crypto_aes_encrypt NULL;
195-+#define _iesys_crypto_sm4_decrypt NULL;
196-+#define _iesys_crypto_sm4_encrypt NULL;
197- #define _iesys_crypto_get_ecdh_point NULL;
198- #define _iesys_crypto_hash_abort NULL;
199- #define _iesys_crypto_hash_finish NULL;
200-@@ -35,6 +37,7 @@ extern "C" {
201- #endif
202-
203- #define AES_BLOCK_SIZE_IN_BYTES 16
204-+#define SM4_BLOCK_SIZE_IN_BYTES 16
205-
206- TSS2_RC iesys_crypto_hash_get_digest_size(TPM2_ALG_ID hashAlg, size_t *size);
207-
208-@@ -163,6 +166,26 @@ TSS2_RC iesys_crypto_aes_decrypt(
209- size_t buffer_size,
210- uint8_t *iv);
211-
212-+TSS2_RC iesys_crypto_sm4_encrypt(
213-+ ESYS_CRYPTO_CALLBACKS *crypto_cb,
214-+ uint8_t *key,
215-+ TPM2_ALG_ID tpm_sym_alg,
216-+ TPMI_SM4_KEY_BITS key_bits,
217-+ TPM2_ALG_ID tpm_mode,
218-+ uint8_t *buffer,
219-+ size_t buffer_size,
220-+ uint8_t *iv);
221-+
222-+TSS2_RC iesys_crypto_sm4_decrypt(
223-+ ESYS_CRYPTO_CALLBACKS *crypto_cb,
224-+ uint8_t *key,
225-+ TPM2_ALG_ID tpm_sym_alg,
226-+ TPMI_SM4_KEY_BITS key_bits,
227-+ TPM2_ALG_ID tpm_mode,
228-+ uint8_t *buffer,
229-+ size_t buffer_size,
230-+ uint8_t *iv);
231-+
232- TSS2_RC iesys_crypto_authHmac(
233- ESYS_CRYPTO_CALLBACKS *crypto_cb,
234- TPM2_ALG_ID alg,
235-diff --git a/src/tss2-esys/esys_crypto_mbed.h b/src/tss2-esys/esys_crypto_mbed.h
236-index 24b1d8e..40a976b 100644
237---- a/src/tss2-esys/esys_crypto_mbed.h
238-+++ b/src/tss2-esys/esys_crypto_mbed.h
239-@@ -120,6 +120,8 @@ TSS2_RC iesys_cryptmbed_init(void *userdata);
240- #define _iesys_crypto_get_ecdh_point iesys_cryptmbed_get_ecdh_point
241- #define _iesys_crypto_aes_encrypt iesys_cryptmbed_sym_aes_encrypt
242- #define _iesys_crypto_aes_decrypt iesys_cryptmbed_sym_aes_decrypt
243-+#define _iesys_crypto_sm4_encrypt NULL
244-+#define _iesys_crypto_sm4_decrypt NULL
245-
246- #define _iesys_crypto_init iesys_cryptmbed_init
247-
248-diff --git a/src/tss2-esys/esys_crypto_ossl.c b/src/tss2-esys/esys_crypto_ossl.c
249-index 89d312f..a92ecc4 100644
250---- a/src/tss2-esys/esys_crypto_ossl.c
251-+++ b/src/tss2-esys/esys_crypto_ossl.c
252-@@ -1212,6 +1212,164 @@ iesys_cryptossl_sym_aes_decrypt(uint8_t * key,
253- return r;
254- }
255-
256-+#if HAVE_EVP_SM4_CFB && !defined(OPENSSL_NO_SM4)
257-+/** Encrypt data with SM4.
258-+ *
259-+ * @param[in] key key used for SM4.
260-+ * @param[in] tpm_sym_alg SM4 type in TSS2 notation (must be TPM2_ALG_SM4).
261-+ * @param[in] key_bits Key size in bits.
262-+ * @param[in] tpm_mode Block cipher mode of opertion in TSS2 notation (CFB).
263-+ * For parameter encryption only CFB can be used.
264-+ * @param[in,out] buffer Data to be encrypted. The encrypted date will be stored
265-+ * in this buffer.
266-+ * @param[in] buffer_size size of data to be encrypted.
267-+ * @param[in] iv The initialization vector.
268-+ * @retval TSS2_RC_SUCCESS on success, or TSS2_ESYS_RC_BAD_VALUE and
269-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE for invalid parameters,
270-+ * @retval TSS2_ESYS_RC_GENERAL_FAILURE for errors of the crypto library.
271-+ */
272-+TSS2_RC
273-+iesys_cryptossl_sym_sm4_encrypt(uint8_t * key,
274-+ TPM2_ALG_ID tpm_sym_alg,
275-+ TPMI_SM4_KEY_BITS key_bits,
276-+ TPM2_ALG_ID tpm_mode,
277-+ uint8_t * buffer,
278-+ size_t buffer_size,
279-+ uint8_t * iv,
280-+ void *userdata)
281-+{
282-+ UNUSED(userdata);
283-+
284-+ TSS2_RC r = TSS2_RC_SUCCESS;
285-+ const EVP_CIPHER *cipher_alg = NULL;
286-+ EVP_CIPHER_CTX *ctx = NULL;
287-+ int cipher_len;
288-+
289-+ if (key == NULL || buffer == NULL) {
290-+ return_error(TSS2_ESYS_RC_BAD_REFERENCE, "Bad reference");
291-+ }
292-+
293-+ LOGBLOB_TRACE(buffer, buffer_size, "IESYS SM4 input");
294-+
295-+ if (key_bits == 128 && tpm_mode == TPM2_ALG_CFB)
296-+ cipher_alg = EVP_sm4_cfb128();
297-+ else {
298-+ goto_error(r, TSS2_ESYS_RC_BAD_VALUE,
299-+ "SM4 algorithm not implemented or illegal mode (CFB expected).",
300-+ cleanup);
301-+ }
302-+
303-+ if (tpm_sym_alg != TPM2_ALG_SM4) {
304-+ goto_error(r, TSS2_ESYS_RC_BAD_VALUE,
305-+ "SM4 encrypt called with wrong algorithm.", cleanup);
306-+ }
307-+
308-+ /* Create and initialize the context */
309-+ if(!(ctx = EVP_CIPHER_CTX_new())) {
310-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE,
311-+ "Initialize cipher context", cleanup);
312-+ }
313-+
314-+ if (1 != EVP_EncryptInit(ctx, cipher_alg, key, iv)) {
315-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE,
316-+ "Initialize cipher operation", cleanup);
317-+ }
318-+
319-+ /* Perform the encryption */
320-+ if (1 != EVP_EncryptUpdate(ctx, buffer, &cipher_len, buffer, buffer_size)) {
321-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE, "Encrypt update", cleanup);
322-+ }
323-+
324-+ if (1 != EVP_EncryptFinal(ctx, buffer, &cipher_len)) {
325-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE, "Encrypt final", cleanup);
326-+ }
327-+ LOGBLOB_TRACE(buffer, buffer_size, "IESYS SM4 output");
328-+
329-+cleanup:
330-+
331-+ OSSL_FREE(ctx,EVP_CIPHER_CTX);
332-+
333-+ return r;
334-+}
335-+
336-+/** Decrypt data with SM4.
337-+ *
338-+ * @param[in] key key used for SM4.
339-+ * @param[in] tpm_sym_alg SM4 type in TSS2 notation (must be TPM2_ALG_SM4).
340-+ * @param[in] key_bits Key size in bits.
341-+ * @param[in] tpm_mode Block cipher mode of opertion in TSS2 notation (CFB).
342-+ * For parameter encryption only CFB can be used.
343-+ * @param[in,out] buffer Data to be decrypted. The decrypted date will be stored
344-+ * in this buffer.
345-+ * @param[in] buffer_size size of data to be encrypted.
346-+ * @param[in] iv The initialization vector.
347-+ * @retval TSS2_RC_SUCCESS on success, or TSS2_ESYS_RC_BAD_VALUE and
348-+ * @retval TSS2_ESYS_RC_BAD_REFERENCE for invalid parameters,
349-+ * @retval TSS2_ESYS_RC_GENERAL_FAILURE for errors of the crypto library.
350-+ */
351-+TSS2_RC
352-+iesys_cryptossl_sym_sm4_decrypt(uint8_t * key,
353-+ TPM2_ALG_ID tpm_sym_alg,
354-+ TPMI_SM4_KEY_BITS key_bits,
355-+ TPM2_ALG_ID tpm_mode,
356-+ uint8_t * buffer,
357-+ size_t buffer_size,
358-+ uint8_t * iv,
359-+ void *userdata)
360-+{
361-+ UNUSED(userdata);
362-+
363-+ TSS2_RC r = TSS2_RC_SUCCESS;
364-+ const EVP_CIPHER *cipher_alg = NULL;
365-+ EVP_CIPHER_CTX *ctx = NULL;
366-+ int cipher_len = 0;
367-+
368-+ if (key == NULL || buffer == NULL) {
369-+ return_error(TSS2_ESYS_RC_BAD_REFERENCE, "Bad reference");
370-+ }
371-+
372-+ if (tpm_sym_alg != TPM2_ALG_SM4) {
373-+ goto_error(r, TSS2_ESYS_RC_BAD_VALUE,
374-+ "SM4 decrypt called with wrong algorithm.", cleanup);
375-+ }
376-+
377-+ if (key_bits == 128 && tpm_mode == TPM2_ALG_CFB)
378-+ cipher_alg = EVP_sm4_cfb128();
379-+ else {
380-+ goto_error(r, TSS2_ESYS_RC_BAD_VALUE,
381-+ "SM4 algorithm not implemented or illegal mode (CFB expected).",
382-+ cleanup);
383-+ }
384-+
385-+ /* Create and initialize the context */
386-+ if(!(ctx = EVP_CIPHER_CTX_new())) {
387-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE,
388-+ "Initialize cipher context", cleanup);
389-+ }
390-+
391-+ LOGBLOB_TRACE(buffer, buffer_size, "IESYS SM4 input");
392-+
393-+ if (1 != EVP_DecryptInit(ctx, cipher_alg, key, iv)) {
394-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE,
395-+ "Initialize cipher operation", cleanup);
396-+ }
397-+
398-+ /* Perform the decryption */
399-+ if (1 != EVP_DecryptUpdate(ctx, buffer, &cipher_len, buffer, buffer_size)) {
400-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE, "Encrypt update", cleanup);
401-+ }
402-+
403-+ if (1 != EVP_DecryptFinal(ctx, buffer, &cipher_len)) {
404-+ goto_error(r, TSS2_ESYS_RC_GENERAL_FAILURE, "Encrypt final", cleanup);
405-+ }
406-+ LOGBLOB_TRACE(buffer, buffer_size, "IESYS SM4 output");
407-+
408-+cleanup:
409-+
410-+ OSSL_FREE(ctx,EVP_CIPHER_CTX);
411-+ return r;
412-+}
413-+#endif
414-
415- /** Initialize OpenSSL crypto backend.
416- *
417-diff --git a/src/tss2-esys/esys_crypto_ossl.h b/src/tss2-esys/esys_crypto_ossl.h
418-index ae3c33a..d8e84d6 100644
419---- a/src/tss2-esys/esys_crypto_ossl.h
420-+++ b/src/tss2-esys/esys_crypto_ossl.h
421-@@ -109,6 +109,28 @@ TSS2_RC iesys_cryptossl_sym_aes_decrypt(
422- uint8_t *iv,
423- void *userdata);
424-
425-+#if HAVE_EVP_SM4_CFB && !defined(OPENSSL_NO_SM4)
426-+TSS2_RC iesys_cryptossl_sym_sm4_encrypt(
427-+ uint8_t *key,
428-+ TPM2_ALG_ID tpm_sym_alg,
429-+ TPMI_SM4_KEY_BITS key_bits,
430-+ TPM2_ALG_ID tpm_mode,
431-+ uint8_t *dst,
432-+ size_t dst_size,
433-+ uint8_t *iv,
434-+ void *userdata);
435-+
436-+TSS2_RC iesys_cryptossl_sym_sm4_decrypt(
437-+ uint8_t *key,
438-+ TPM2_ALG_ID tpm_sym_alg,
439-+ TPMI_SM4_KEY_BITS key_bits,
440-+ TPM2_ALG_ID tpm_mode,
441-+ uint8_t *dst,
442-+ size_t dst_size,
443-+ uint8_t *iv,
444-+ void *userdata);
445-+#endif
446-+
447- TSS2_RC iesys_cryptossl_get_ecdh_point(
448- TPM2B_PUBLIC *key,
449- size_t max_out_size,
450-@@ -122,6 +144,13 @@ TSS2_RC iesys_cryptossl_get_ecdh_point(
451- #define _iesys_crypto_get_ecdh_point iesys_cryptossl_get_ecdh_point
452- #define _iesys_crypto_aes_encrypt iesys_cryptossl_sym_aes_encrypt
453- #define _iesys_crypto_aes_decrypt iesys_cryptossl_sym_aes_decrypt
454-+#if HAVE_EVP_SM4_CFB && !defined(OPENSSL_NO_SM4)
455-+#define _iesys_crypto_sm4_encrypt iesys_cryptossl_sym_sm4_encrypt
456-+#define _iesys_crypto_sm4_decrypt iesys_cryptossl_sym_sm4_decrypt
457-+#else
458-+#define _iesys_crypto_sm4_encrypt NULL
459-+#define _iesys_crypto_sm4_decrypt NULL
460-+#endif
461-
462- TSS2_RC iesys_cryptossl_init(void *userdata);
463-
464-diff --git a/src/tss2-esys/esys_iutil.c b/src/tss2-esys/esys_iutil.c
465-index c8346b3..79e6143 100644
466---- a/src/tss2-esys/esys_iutil.c
467-+++ b/src/tss2-esys/esys_iutil.c
468-@@ -745,6 +745,31 @@ iesys_encrypt_param(ESYS_CONTEXT * esys_context,
469- &encrypt_buffer[0], paramSize,
470- &symKey[aes_off]);
471- return_if_error(r, "AES encryption not possible");
472-+ } else if (symDef->algorithm == TPM2_ALG_SM4) {
473-+ /* SM4 encryption with key derived with KDFa */
474-+ if (symDef->mode.sm4 != TPM2_ALG_CFB) {
475-+ return_error(TSS2_ESYS_RC_BAD_VALUE,
476-+ "Invalid symmetric mode (must be CFB)");
477-+ }
478-+ r = iesys_crypto_KDFa(&esys_context->crypto_backend, rsrc_session->authHash,
479-+ &rsrc_session->sessionValue[0],
480-+ rsrc_session->sizeSessionValue, "CFB",
481-+ &rsrc_session->nonceCaller,
482-+ &rsrc_session->nonceTPM,
483-+ symDef->keyBits.sm4 + SM4_BLOCK_SIZE_IN_BYTES * 8,
484-+ NULL, &symKey[0], FALSE);
485-+ return_if_error(r, "while computing KDFa");
486-+
487-+ size_t sm4_off = ( symDef->keyBits.sm4 + 7) / 8;
488-+ r = iesys_crypto_sm4_encrypt(
489-+ &esys_context->crypto_backend,
490-+ &symKey[0],
491-+ symDef->algorithm,
492-+ symDef->keyBits.sm4,
493-+ symDef->mode.sm4,
494-+ &encrypt_buffer[0], paramSize,
495-+ &symKey[sm4_off]);
496-+ return_if_error(r, "SM4 encryption not possible");
497- }
498- /* XOR obfuscation of parameter */
499- else if (symDef->algorithm == TPM2_ALG_XOR) {
500-@@ -760,7 +785,7 @@ iesys_encrypt_param(ESYS_CONTEXT * esys_context,
501-
502- } else {
503- return_error(TSS2_ESYS_RC_BAD_VALUE,
504-- "Invalid symmetric algorithm (should be XOR or AES)");
505-+ "Invalid symmetric algorithm (should be XOR, AES, or SM4)");
506- }
507- r = Tss2_Sys_SetDecryptParam(esys_context->sys, paramSize,
508- &encrypt_buffer[0]);
509-@@ -848,6 +873,43 @@ iesys_decrypt_param(ESYS_CONTEXT * esys_context)
510- &symKey[aes_off]);
511- return_if_error(r, "Decryption error");
512-
513-+ r = Tss2_Sys_SetEncryptParam(esys_context->sys, p2BSize, &plaintext[0]);
514-+ return_if_error(r, "Setting plaintext");
515-+ } else if (symDef->algorithm == TPM2_ALG_SM4) {
516-+ /* Parameter decryption with a symmetric SM4 key derived by KDFa */
517-+ if (symDef->mode.sm4 != TPM2_ALG_CFB) {
518-+ return_error(TSS2_ESYS_RC_BAD_VALUE,
519-+ "Invalid symmetric mode (must be CFB)");
520-+ }
521-+ LOGBLOB_DEBUG(&rsrc_session->sessionKey.buffer[0],
522-+ rsrc_session->sessionKey.size,
523-+ "IESYS encrypt session key");
524-+
525-+ r = iesys_crypto_KDFa(&esys_context->crypto_backend, rsrc_session->authHash,
526-+ &rsrc_session->sessionValue[0],
527-+ rsrc_session->sizeSessionValue,
528-+ "CFB", &rsrc_session->nonceTPM,
529-+ &rsrc_session->nonceCaller,
530-+ symDef->keyBits.sm4
531-+ + SM4_BLOCK_SIZE_IN_BYTES * 8, NULL,
532-+ &symKey[0], FALSE);
533-+ return_if_error(r, "KDFa error");
534-+ LOGBLOB_DEBUG(&symKey[0],
535-+ ((symDef->keyBits.sm4 +
536-+ SM4_BLOCK_SIZE_IN_BYTES * 8) + 7) / 8,
537-+ "IESYS encrypt KDFa key");
538-+
539-+ size_t sm4_off = ( symDef->keyBits.sm4 + 7) / 8;
540-+ r = iesys_crypto_sm4_decrypt(
541-+ &esys_context->crypto_backend,
542-+ &symKey[0],
543-+ symDef->algorithm,
544-+ symDef->keyBits.sm4,
545-+ symDef->mode.sm4,
546-+ &plaintext[0], p2BSize,
547-+ &symKey[sm4_off]);
548-+ return_if_error(r, "Decryption error");
549-+
550- r = Tss2_Sys_SetEncryptParam(esys_context->sys, p2BSize, &plaintext[0]);
551- return_if_error(r, "Setting plaintext");
552- } else if (symDef->algorithm == TPM2_ALG_XOR) {
553-@@ -866,7 +928,7 @@ iesys_decrypt_param(ESYS_CONTEXT * esys_context)
554- return_if_error(r, "Setting plaintext");
555- } else {
556- return_error(TSS2_ESYS_RC_BAD_VALUE,
557-- "Invalid symmetric algorithm (should be XOR or AES)");
558-+ "Invalid symmetric algorithm (should be XOR, AES, or SM4)");
559- }
560- return TSS2_RC_SUCCESS;
561- }
562-diff --git a/test/integration/esys-crypto.int.c b/test/integration/esys-crypto.int.c
563-index 1618e9c..7969f54 100644
564---- a/test/integration/esys-crypto.int.c
565-+++ b/test/integration/esys-crypto.int.c
566-@@ -61,6 +61,8 @@ test_invoke_esys(ESYS_CONTEXT *esys_context)
567-
568- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, aes_decrypt);
569- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, aes_encrypt);
570-+ CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, sm4_decrypt);
571-+ CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, sm4_encrypt);
572- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, get_ecdh_point);
573- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, get_random2b);
574- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, rsa_pk_encrypt);
575-@@ -68,6 +70,8 @@ test_invoke_esys(ESYS_CONTEXT *esys_context)
576- ESYS_CRYPTO_CALLBACKS callbacks = {
577- .aes_decrypt = TEST_FN_PTR,
578- .aes_encrypt = TEST_FN_PTR,
579-+ .sm4_decrypt = TEST_FN_PTR,
580-+ .sm4_encrypt = TEST_FN_PTR,
581- .get_ecdh_point = TEST_FN_PTR,
582- .get_random2b = TEST_FN_PTR,
583- .rsa_pk_encrypt = TEST_FN_PTR,
584-@@ -123,6 +127,8 @@ test_invoke_esys(ESYS_CONTEXT *esys_context)
585-
586- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, aes_decrypt);
587- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, aes_encrypt);
588-+ CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, sm4_decrypt);
589-+ CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, sm4_encrypt);
590- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, get_ecdh_point);
591- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, get_random2b);
592- CHECK_BACKEND_FN_NOT_TEST(esys_context->crypto_backend, rsa_pk_encrypt);
593-diff --git a/test/unit/esys-crypto.c b/test/unit/esys-crypto.c
594-index b47cfdd..4901b91 100644
595---- a/test/unit/esys-crypto.c
596-+++ b/test/unit/esys-crypto.c
597-@@ -258,6 +258,61 @@ check_aes_encrypt(void **state)
598- assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
599- }
600-
601-+#if HAVE_EVP_SM4_CFB && !defined(OPENSSL_NO_SM4)
602-+static void
603-+check_sm4_encrypt(void **state)
604-+{
605-+ TSS2_RC rc;
606-+ uint8_t key[16] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
607-+ uint8_t buffer[5] = { 1, 2, 3, 4, 5 };
608-+ size_t size = sizeof(buffer);
609-+
610-+ ESYS_CRYPTO_CALLBACKS crypto_cb = { 0 };
611-+ rc = iesys_initialize_crypto_backend(&crypto_cb, NULL);
612-+ assert_int_equal (rc, TSS2_RC_SUCCESS);
613-+
614-+ rc = iesys_crypto_sm4_encrypt(&crypto_cb, NULL, TPM2_ALG_SM4, 128, TPM2_ALG_CFB,
615-+ &buffer[0], size, &key[0]);
616-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_REFERENCE);
617-+
618-+ rc = iesys_crypto_sm4_encrypt(&crypto_cb, &key[0], 0, 128, TPM2_ALG_CFB,
619-+ &buffer[0], size, &key[0]);
620-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
621-+
622-+ rc = iesys_crypto_sm4_encrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 128, 0,
623-+ &buffer[0], size, &key[0]);
624-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
625-+
626-+ rc = iesys_crypto_sm4_encrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 999, TPM2_ALG_CFB,
627-+ &buffer[0], size, &key[0]);
628-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
629-+
630-+ rc = iesys_crypto_sm4_encrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 128, TPM2_ALG_CFB,
631-+ &buffer[0], size, &key[0]);
632-+ assert_int_equal (rc, TSS2_RC_SUCCESS);
633-+
634-+ rc = iesys_crypto_sm4_decrypt(&crypto_cb, NULL, TPM2_ALG_SM4, 128, TPM2_ALG_CFB,
635-+ &buffer[0], size, &key[0]);
636-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_REFERENCE);
637-+
638-+ rc = iesys_crypto_sm4_decrypt(&crypto_cb, &key[0], 0, 128, TPM2_ALG_CFB,
639-+ &buffer[0], size, &key[0]);
640-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
641-+
642-+ rc = iesys_crypto_sm4_decrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 128, 0,
643-+ &buffer[0], size, &key[0]);
644-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
645-+
646-+ rc = iesys_crypto_sm4_decrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 999, TPM2_ALG_CFB,
647-+ &buffer[0], size, &key[0]);
648-+ assert_int_equal (rc, TSS2_ESYS_RC_BAD_VALUE);
649-+
650-+ rc = iesys_crypto_sm4_decrypt(&crypto_cb, &key[0], TPM2_ALG_SM4, 128, TPM2_ALG_CFB,
651-+ &buffer[0], size, &key[0]);
652-+ assert_int_equal (rc, TSS2_RC_SUCCESS);
653-+}
654-+#endif
655-+
656- static void
657- check_free(void **state)
658- {
659-@@ -320,6 +375,8 @@ static void test_backend_set(void **state) {
660-
661- CHECK_BACKEND_FN(crypto_cb, aes_decrypt);
662- CHECK_BACKEND_FN(crypto_cb, aes_encrypt);
663-+ CHECK_BACKEND_FN(crypto_cb, sm4_decrypt);
664-+ CHECK_BACKEND_FN(crypto_cb, sm4_encrypt);
665- CHECK_BACKEND_FN(crypto_cb, get_ecdh_point);
666- CHECK_BACKEND_FN(crypto_cb, get_random2b);
667- CHECK_BACKEND_FN(crypto_cb, rsa_pk_encrypt);
668-@@ -328,6 +385,8 @@ static void test_backend_set(void **state) {
669- ESYS_CRYPTO_CALLBACKS user_cb = {
670- .aes_decrypt = (void *)0xBADCC0DE,
671- .aes_encrypt = (void *)0xBADCC0DE,
672-+ .sm4_decrypt = (void *)0xBADCC0DE,
673-+ .sm4_encrypt = (void *)0xBADCC0DE,
674- .get_ecdh_point = (void *)0xBADCC0DE,
675- .get_random2b = (void *)0xBADCC0DE,
676- .rsa_pk_encrypt = (void *)0xBADCC0DE,
677-@@ -377,6 +436,9 @@ main(int argc, char *argv[])
678- cmocka_unit_test(check_random),
679- cmocka_unit_test(check_pk_encrypt),
680- cmocka_unit_test(check_aes_encrypt),
681-+#if HAVE_EVP_SM4_CFB && !defined(OPENSSL_NO_SM4)
682-+ cmocka_unit_test(check_sm4_encrypt),
683-+#endif
684- cmocka_unit_test(check_free),
685- cmocka_unit_test(check_get_sys_context),
686- cmocka_unit_test(test_backend_set)
687---
688-2.17.1
689- 
Dtpm2-tss-4.0.2.tar.gz+0-0
Binary files do not support preview
Atpm2-tss-4.2.0.tar.gz+3-0
@@ -0,0 +1,3 @@
1+version https://git-lfs.github.com/spec/v1
2+oid sha256:b53f0c5c8c4ce17f05701a410ca9688f725ca380c9bc4640eacd0eadb1fea124
3+size 2023505
Mtpm2-tss.spec+10-10
@@ -1,20 +1,14 @@
1%bcond_with tests1%bcond_with tests
2 2 
3Name: tpm2-tss3Name: tpm2-tss
4-Version: 4.0.24+Version: 4.2.0
5-Release: 45+Release: 1
6Summary: TPM2.0 Software Stack6Summary: TPM2.0 Software Stack
7License: BSD-2-Clause7License: BSD-2-Clause
8URL: https://github.com/tpm2-software/tpm2-tss8URL: https://github.com/tpm2-software/tpm2-tss
9Source0: https://github.com/tpm2-software/tpm2-tss/releases/download/%{version}/%{name}-%{version}.tar.gz9Source0: https://github.com/tpm2-software/tpm2-tss/releases/download/%{version}/%{name}-%{version}.tar.gz
10 10 
11-Patch0001: backport-FAPI-Skip-test-fapi-fix-provisioning-with-template-i.patch11+Patch0001: add-bootstrap-file-from-upstream.patch
12-Patch0002: backport-esys-add-SM4-algorithm-support.patch
13-Patch0003: Hygon-Add-support-for-udev-to-create-tcm-de.patch
14-Patch0004: Hygon-add-ecc-encrypt-decrypt-support.patch
15-Patch0005: add-bootstrap-file-from-upstream.patch
16-Patch0006: backport-Fix-missing-scanf-checks.patch
17-Patch0007: backport-TCTI-Device-Fix-using-of-C-string-for-byte-array.patch
18 12 
19BuildRequires: gcc-c++ make libtool13BuildRequires: gcc-c++ make libtool
20BuildRequires: pkgconfig(cmocka) >= 1.014BuildRequires: pkgconfig(cmocka) >= 1.0
@@ -46,7 +40,6 @@ It contains headers and static libraries for tpm2-tss.
46%autosetup -n %{name}-%{version} -p140%autosetup -n %{name}-%{version} -p1
47 41 
48%build42%build
49-./bootstrap
50%configure --disable-static --disable-silent-rules --with-udevrulesdir=%{_udevrulesdir} --with-udevrulesprefix=80- \43%configure --disable-static --disable-silent-rules --with-udevrulesdir=%{_udevrulesdir} --with-udevrulesprefix=80- \
51 --with-runstatedir=%{_rundir} --with-tmpfilesdir=%{_tmpfilesdir} --with-sysusersdir=%{_sysusersdir} \44 --with-runstatedir=%{_rundir} --with-tmpfilesdir=%{_tmpfilesdir} --with-sysusersdir=%{_sysusersdir} \
52 %{?with_tests:--enable-unit --enable-integration}45 %{?with_tests:--enable-unit --enable-integration}
@@ -67,6 +60,7 @@ It contains headers and static libraries for tpm2-tss.
67%{_sysusersdir}/tpm2-tss.conf60%{_sysusersdir}/tpm2-tss.conf
68%{_tmpfilesdir}/tpm2-tss-fapi.conf61%{_tmpfilesdir}/tpm2-tss-fapi.conf
69%{_libdir}/*.so.*62%{_libdir}/*.so.*
63+%{_udevrulesdir}/80-ltt2go-udev.rules
70%{_udevrulesdir}/80-tpm-udev.rules64%{_udevrulesdir}/80-tpm-udev.rules
71 65 
72%files devel66%files devel
@@ -78,6 +72,12 @@ It contains headers and static libraries for tpm2-tss.
78%{_mandir}/man*/*72%{_mandir}/man*/*
79 73 
80%changelog74%changelog
75+* Sun Jul 19 2026 Funda Wang <fundawang@yeah.net> - 4.2.0-1
76+- update to 4.2.0
77+ 
78+* Sat Jul 11 2026 Funda Wang <fundawang@yeah.net> - 4.1.3-1
79+- update to 4.1.3
80+ 
81* Fri Apr 03 2026 markeryang <747675909@qq.com> - 4.0.2-481* Fri Apr 03 2026 markeryang <747675909@qq.com> - 4.0.2-4
82- Type:bugfix82- Type:bugfix
83- ID:NA83- ID:NA