Add read cert TPM API

Author: dgarske

include/tpm.h

@@ -63,6 +63,7 @@ const char* CSME_NSE_API wolfBoot_tpm2_get_rc_string(int rc,
     char* error, int error_sz);
 TPM_RC CSME_NSE_API wolfBoot_tpm2_get_capability(GetCapability_In* in, GetCapability_Out* out);
 int CSME_NSE_API wolfBoot_tpm2_read_pcr(uint8_t pcrIndex, uint8_t* digest, int* digestSz);
+int CSME_NSE_API wolfBoot_tpm2_read_cert(uint32_t handle, uint8_t* cert, uint32_t* certSz);
 
 #if defined(WOLFBOOT_TPM_VERIFY) || defined(WOLFBOOT_TPM_SEAL)
 int wolfBoot_load_pubkey(const uint8_t* pubkey_hint, WOLFTPM2_KEY* pubKey,

src/tpm.c

@@ -1193,7 +1193,10 @@ int CSME_NSE_API wolfBoot_tpm2_read_pcr(uint8_t pcrIndex, uint8_t* digest, int*
         digest, digestSz);
 }
 
-
+int CSME_NSE_API wolfBoot_tpm2_read_cert(uint32_t handle, uint8_t* cert, uint32_t* certSz)
+{
+    return wolfTPM2_NVReadCert(&wolftpm_dev, handle, cert, certSz);
+}
 
 
 

test-app/app_stm32h5.c

@@ -166,6 +166,8 @@ static int cmd_update_xmodem(const char *args);
 static int cmd_reboot(const char *args);
 #ifdef WOLFBOOT_TPM
 static int cmd_tpm_info(const char *args);
+static int cmd_tpm_idevid(const char *args);
+static int cmd_tpm_iak(const char *args);
 #endif
 
 
@@ -195,6 +197,8 @@ struct console_command COMMANDS[] =
     {cmd_reboot, "reboot", "reboot the system"},
 #ifdef WOLFBOOT_TPM
     {cmd_tpm_info, "tpm", "get TPM capabilities"},
+    {cmd_tpm_idevid, "idevid", "show Initial Device Identification (IDevID) certificate"},
+    {cmd_tpm_iak, "iak", "show Initial Attestation Identification (IAK) certificate"},
 #endif
     {NULL, "", ""}
 };
@@ -431,9 +435,47 @@ static const char *part_state_name(uint8_t state)
     }
 }
 
+#define LINE_LEN 16
+void print_hex(const uint8_t* buffer, uint32_t length, int dumpChars)
+{
+    word32 i, sz;
+
+    if (!buffer) {
+        printf("\tNULL\n");
+        return;
+    }
+
+    while (length > 0) {
+        sz = length;
+        if (sz > LINE_LEN)
+            sz = LINE_LEN;
+
+        printf("\t");
+        for (i = 0; i < LINE_LEN; i++) {
+            if (i < length)
+                printf("%02x ", buffer[i]);
+            else
+                printf("   ");
+        }
+        if (dumpChars) {
+            printf("| ");
+            for (i = 0; i < sz; i++) {
+                if (buffer[i] > 31 && buffer[i] < 127)
+                    printf("%c", buffer[i]);
+                else
+                    printf(".");
+            }
+        }
+        printf("\r\n");
+
+        buffer += sz;
+        length -= sz;
+    }
+}
+
 static int cmd_info(const char *args)
 {
-    int i, j;
+    int i;
     uint32_t cur_fw_version, update_fw_version;
     uint32_t n_keys;
     uint16_t hdrSz;
@@ -489,13 +531,7 @@ static int cmd_info(const char *args)
         printf("  Public Key #%d: size %lu, type %lx, mask %08lx\r\n", i,
                 size, type, mask);
         printf("  ====================================\r\n  ");
-        for (j = 0; j < size; j++) {
-            printf("%02X ", keybuf[j]);
-            if (j % 16 == 15) {
-                printf("\r\n  ");
-            }
-        }
-        printf("\r\n");
+        print_hex(keybuf, size, 0);
     }
     return 0;
 }
@@ -770,7 +806,37 @@ static int cmd_tpm_info(const char *args)
 
     return rc;
 }
-#endif
+
+static int cmd_tpm_idevid(const char *args)
+{
+    int rc;
+    uint8_t cert[1024];
+    uint32_t certSz = (uint32_t)sizeof(cert);
+    uint32_t handle = TPM2_IDEVID_CERT_HANDLE;
+
+    rc = wolfBoot_tpm2_read_cert(handle, cert, &certSz);
+    if (rc == 0) {
+        printf("IDevID Handle 0x%x\r\n", (unsigned int)handle);
+        print_hex(cert, certSz, 1);
+    }
+    return rc;
+}
+
+static int cmd_tpm_iak(const char *args)
+{
+    int rc;
+    uint8_t cert[1024];
+    uint32_t certSz = (uint32_t)sizeof(cert);
+    uint32_t handle = TPM2_IAK_CERT_HANDLE;
+
+    rc = wolfBoot_tpm2_read_cert(handle, cert, &certSz);
+    if (rc == 0) {
+        printf("IAK Handle 0x%x\r\n", (unsigned int)handle);
+        print_hex(cert, certSz, 1);
+    }
+    return rc;
+}
+#endif /* WOLFBOOT_TPM */
 
 
 static int parse_cmd(const char *cmd)