The length of a TPM reply is set by the device: tpm_sendrecv_command()
stores the number of bytes received, caps it only at the command buffer
size, and reports success whenever the reply's return code is 0. Callers
then use that length unchecked. The clearest damage is in the parsers that
compute response_length - <header> and index the result (the TPM1 OIAP
helpers and tpm2_get_capability): a reply shorter than the header
underflows the subtraction into a huge memcpy.
Rather than guard each caller, check the length once at the choke point.
tpm_sendrecv_command() gains a min_response_len argument and rejects a
reply shorter than the caller says it needs, before the caller parses it;
every command that reads a response now declares its minimum.
tpm2_get_capability() additionally copies response_len - 15 bytes into the
caller's prop_count-sized buffer, so a reply longer than that buffer
overruns it. Keep a local upper-bound check there for the properties
query; other capabilities read variable-length data into a full-size
buffer, so only the lower bound applies to them.
A TPM sits on a discrete SPI/I2C/LPC bus that is physically accessible, so
a reply this malformed is reachable by a bus interposer or a faulty part;
on the TPM2 path this parsing runs during measured boot.
Fixes: 69cd8f0681f4 ("tpm: add TPM2_GetCapability command support")
Fixes: be6c1529c1ce ("tpm: add AUTH1 cmds for LoadKey2 and GetPubKey")
Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
lib/tpm-common.c | 16 ++++++++++++---
lib/tpm-utils.h | 8 +++++++-
lib/tpm-v1.c | 59 +++++++++++++++++++++++++++++++++-----------------------
lib/tpm-v2.c | 52 +++++++++++++++++++++++++++++--------------------
4 files changed, 86 insertions(+), 49 deletions(-)
diff --git a/lib/tpm-common.c b/lib/tpm-common.c
index b592c22bfc1..e4a620990fa 100644
--- a/lib/tpm-common.c
+++ b/lib/tpm-common.c
@@ -159,7 +159,8 @@ u32 tpm_return_code(const void *response)
}
u32 tpm_sendrecv_command(struct udevice *dev, const void *command,
- void *response, size_t *size_ptr)
+ void *response, size_t *size_ptr,
+ size_t min_response_len)
{
int err, ret;
u8 response_buffer[COMMAND_BUFFER_SIZE];
@@ -190,11 +191,20 @@ u32 tpm_sendrecv_command(struct udevice *dev, const void
*command,
if (err < 0)
return err;
+ ret = tpm_return_code(response);
+
+ /*
+ * The response length is reported by the (untrusted) TPM. Reject a
+ * successful reply too short to hold what the caller will parse, so it
+ * cannot read past the end of a truncated response. A TPM error reply
+ * is a bare header with no body; let its return code reach the caller.
+ */
+ if (!ret && size_ptr && response_length < min_response_len)
+ return TPM_LIB_ERROR;
+
if (size_ptr)
*size_ptr = response_length;
- ret = tpm_return_code(response);
-
log_debug("TPM response [ret:%d]: ", ret);
for (i = 0; i < response_length; i++)
log_debug("%02x ", ((u8 *)response)[i]);
diff --git a/lib/tpm-utils.h b/lib/tpm-utils.h
index a519e182353..fcff8b8beef 100644
--- a/lib/tpm-utils.h
+++ b/lib/tpm-utils.h
@@ -76,9 +76,15 @@ u32 tpm_return_code(const void *response);
* @param size_ptr output buffer size (input parameter) and TPM
* response length (output parameter); this parameter
* is a bidirectional
+ * @param min_response_len minimum acceptable response length in bytes,
+ * including the 10-byte header. When @size_ptr is not NULL
+ * and the TPM returns fewer bytes, the command fails
rather
+ * than let the caller parse a truncated reply. Pass 0 when
+ * the response body is not parsed.
* Return: return code of the TPM response
*/
u32 tpm_sendrecv_command(struct udevice *dev, const void *command,
- void *response, size_t *size_ptr);
+ void *response, size_t *size_ptr,
+ size_t min_response_len);
#endif /* __TPM_UTILS_H */
diff --git a/lib/tpm-v1.c b/lib/tpm-v1.c
index a6727c575fd..d629ba40ff5 100644
--- a/lib/tpm-v1.c
+++ b/lib/tpm-v1.c
@@ -44,7 +44,7 @@ u32 tpm1_startup(struct udevice *dev, enum tpm_startup_type
mode)
mode_offset, mode))
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, buf, NULL, NULL);
+ return tpm_sendrecv_command(dev, buf, NULL, NULL, 0);
}
u32 tpm1_resume(struct udevice *dev)
@@ -57,7 +57,7 @@ u32 tpm1_self_test_full(struct udevice *dev)
const u8 command[10] = {
0x0, 0xc1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x50,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_continue_self_test(struct udevice *dev)
@@ -65,7 +65,7 @@ u32 tpm1_continue_self_test(struct udevice *dev)
const u8 command[10] = {
0x0, 0xc1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x53,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_auto_start(struct udevice *dev)
@@ -148,7 +148,7 @@ u32 tpm1_nv_define_space(struct udevice *dev, u32 index,
u32 perm, u32 size)
size_offset, size))
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, buf, NULL, NULL);
+ return tpm_sendrecv_command(dev, buf, NULL, NULL, 0);
}
u32 tpm1_nv_set_locked(struct udevice *dev)
@@ -175,7 +175,8 @@ u32 tpm1_nv_read_value(struct udevice *dev, u32 index, void
*data, u32 count)
index_offset, index,
length_offset, count))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + dataSize(4) */
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 14);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
@@ -214,7 +215,7 @@ u32 tpm1_nv_write_value(struct udevice *dev, u32 index,
const void *data,
length_offset, length,
data_offset, data, length))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 0);
if (err)
return err;
@@ -241,7 +242,8 @@ u32 tpm1_extend(struct udevice *dev, u32 index, const void
*in_digest,
in_digest_offset, in_digest,
PCR_DIGEST_LENGTH))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + digest(20) */
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 30);
if (err)
return err;
@@ -271,7 +273,8 @@ u32 tpm1_pcr_read(struct udevice *dev, u32 index, void
*data, size_t count)
0, command, sizeof(command),
index_offset, index))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + digest(20) */
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 30);
if (err)
return err;
if (unpack_byte_string(response, response_length, "s",
@@ -294,7 +297,7 @@ u32 tpm1_tsc_physical_presence(struct udevice *dev, u16
presence)
presence_offset, presence))
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, buf, NULL, NULL);
+ return tpm_sendrecv_command(dev, buf, NULL, NULL, 0);
}
u32 tpm1_finalise_physical_presence(struct udevice *dev)
@@ -303,7 +306,7 @@ u32 tpm1_finalise_physical_presence(struct udevice *dev)
0x0, 0xc1, 0x0, 0x0, 0x0, 0xc, 0x40, 0x0, 0x0, 0xa, 0x2, 0xa0,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_read_pubek(struct udevice *dev, void *data, size_t count)
@@ -319,7 +322,8 @@ u32 tpm1_read_pubek(struct udevice *dev, void *data, size_t
count)
u32 data_size;
u32 err;
- err = tpm_sendrecv_command(dev, command, response, &response_length);
+ /* tag(2) + size(4) + rc(4) */
+ err = tpm_sendrecv_command(dev, command, response, &response_length,
10);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
@@ -343,7 +347,7 @@ u32 tpm1_force_clear(struct udevice *dev)
0x0, 0xc1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x5d,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_physical_enable(struct udevice *dev)
@@ -352,7 +356,7 @@ u32 tpm1_physical_enable(struct udevice *dev)
0x0, 0xc1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x6f,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_physical_disable(struct udevice *dev)
@@ -361,7 +365,7 @@ u32 tpm1_physical_disable(struct udevice *dev)
0x0, 0xc1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x70,
};
- return tpm_sendrecv_command(dev, command, NULL, NULL);
+ return tpm_sendrecv_command(dev, command, NULL, NULL, 0);
}
u32 tpm1_physical_set_deactivated(struct udevice *dev, u8 state)
@@ -377,7 +381,7 @@ u32 tpm1_physical_set_deactivated(struct udevice *dev, u8
state)
state_offset, state))
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, buf, NULL, NULL);
+ return tpm_sendrecv_command(dev, buf, NULL, NULL, 0);
}
u32 tpm1_get_capability(struct udevice *dev, u32 cap_area, u32 sub_cap,
@@ -405,7 +409,8 @@ u32 tpm1_get_capability(struct udevice *dev, u32 cap_area,
u32 sub_cap,
cap_area_offset, cap_area,
sub_cap_offset, sub_cap))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + capSize(4) */
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 14);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
@@ -438,7 +443,8 @@ u32 tpm1_get_permanent_flags(struct udevice *dev,
u32 err;
u32 data_size;
- err = tpm_sendrecv_command(dev, command, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + dataSize(4) */
+ err = tpm_sendrecv_command(dev, command, response, &response_length,
14);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
@@ -478,7 +484,8 @@ u32 tpm1_get_permissions(struct udevice *dev, u32 index,
u32 *perm)
0, command, sizeof(command),
index_offset, index))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + respSize(4) + nvPublic(60) +
attributes(4) */
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 78);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
@@ -510,7 +517,7 @@ u32 tpm1_flush_specific(struct udevice *dev, u32
key_handle, u32 resource_type)
resource_type_offset, resource_type))
return TPM_LIB_ERROR;
- err = tpm_sendrecv_command(dev, buf, response, &response_length);
+ err = tpm_sendrecv_command(dev, buf, response, &response_length, 0);
if (err)
return err;
return 0;
@@ -667,7 +674,7 @@ u32 tpm1_terminate_auth_session(struct udevice *dev, u32
auth_handle)
if (oiap_session.valid && oiap_session.handle == auth_handle)
oiap_session.valid = 0;
- return tpm_sendrecv_command(dev, request, NULL, NULL);
+ return tpm_sendrecv_command(dev, request, NULL, NULL, 0);
}
u32 tpm1_end_oiap(struct udevice *dev)
@@ -695,7 +702,8 @@ u32 tpm1_oiap(struct udevice *dev, u32 *auth_handle)
if (oiap_session.valid)
tpm1_terminate_auth_session(dev, oiap_session.handle);
- err = tpm_sendrecv_command(dev, command, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + authHandle(4) + nonceEven(20) */
+ err = tpm_sendrecv_command(dev, command, response, &response_length,
34);
if (err)
return err;
if (unpack_byte_string(response, response_length, "ds",
@@ -750,7 +758,8 @@ u32 tpm1_load_key2_oiap(struct udevice *dev, u32
parent_handle, const void *key,
parent_key_usage_auth);
if (err)
return err;
- err = tpm_sendrecv_command(dev, request, response, &response_length);
+ /* nonceEven(20) + continueAuthSession(1) + resAuth(20) */
+ err = tpm_sendrecv_command(dev, request, response, &response_length,
41);
if (err) {
if (err == TPM_AUTHFAIL)
oiap_session.valid = 0;
@@ -811,7 +820,8 @@ u32 tpm1_get_pub_key_oiap(struct udevice *dev, u32
key_handle,
request + sizeof(command), usage_auth);
if (err)
return err;
- err = tpm_sendrecv_command(dev, request, response, &response_length);
+ /* tag(2) + size(4) + rc(4) + nonceEven(20) + continueAuthSession(1) +
resAuth(20) */
+ err = tpm_sendrecv_command(dev, request, response, &response_length,
51);
if (err) {
if (err == TPM_AUTHFAIL)
oiap_session.valid = 0;
@@ -907,8 +917,9 @@ u32 tpm1_get_random(struct udevice *dev, void *data, u32
count)
0, command, sizeof(command),
length_offset, this_bytes))
return TPM_LIB_ERROR;
+ /* tag(2) + size(4) + rc(4) + randomSize(4) */
err = tpm_sendrecv_command(dev, buf, response,
- &response_length);
+ &response_length, 14);
if (err)
return err;
if (unpack_byte_string(response, response_length, "d",
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index f443b738f82..6aea58a9d8a 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -180,7 +180,7 @@ u32 tpm2_startup(struct udevice *dev, bool bon, enum
tpm2_startup_types mode)
* Note TPM2_Startup command will return RC_SUCCESS the first time,
* but will return RC_INITIALIZE otherwise.
*/
- ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
if ((ret && ret != TPM2_RC_INITIALIZE) || !bon)
return ret;
@@ -196,7 +196,7 @@ u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no
full_test)
full_test,
};
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_auto_start(struct udevice *dev)
@@ -252,7 +252,7 @@ u32 tpm2_clear(struct udevice *dev, u32 handle, const char
*pw,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
@@ -307,7 +307,7 @@ u32 tpm2_nv_define_space(struct udevice *dev, u32
space_index,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
@@ -358,7 +358,7 @@ u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32
algorithm,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
@@ -391,7 +391,8 @@ u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void
*data, u32 count)
u16 tag;
u32 size, code;
- ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ /* tag(2) + size(4) + rc(4) + paramSize(4) + nvSize(2) */
+ ret = tpm_sendrecv_command(dev, command_v2, response, &response_len,
16);
if (ret)
return log_msg_ret("read", ret);
if (unpack_byte_string(response, response_len, "wdds",
@@ -442,7 +443,7 @@ u32 tpm2_nv_write_value(struct udevice *dev, u32 index,
const void *data,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ return tpm_sendrecv_command(dev, command_v2, response, &response_len,
0);
}
u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
@@ -472,7 +473,8 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned
int idx_min_sz,
17 + pcr_sel_idx, pcr_sel_bit))
return TPM_LIB_ERROR;
- ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ /* tag(2) + size(4) + rc(4) + pcrUpdateCounter(4) */
+ ret = tpm_sendrecv_command(dev, command_v2, response, &response_len,
14);
if (ret)
return ret;
@@ -508,7 +510,8 @@ u32 tpm2_get_capability(struct udevice *dev, u32
capability, u32 property,
unsigned int properties_off;
int ret;
- ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ /* tag(2) + size(4) + rc(4) + moreData(1) + cap(4) */
+ ret = tpm_sendrecv_command(dev, command_v2, response, &response_len,
15);
if (ret)
return ret;
@@ -519,6 +522,11 @@ u32 tpm2_get_capability(struct udevice *dev, u32
capability, u32 property,
*/
properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
sizeof(u8) + sizeof(u32);
+ if (capability == TPM2_CAP_TPM_PROPERTIES &&
+ response_len - properties_off >
+ sizeof(u32) + prop_count * sizeof(struct tpms_tagged_property))
+ return TPM_LIB_ERROR;
+
memcpy(buf, &response[properties_off], response_len - properties_off);
return 0;
@@ -641,7 +649,7 @@ u32 tpm2_send_pcr_allocate(struct udevice *dev, const char
*pw,
offset += sel->size_of_select;
}
- ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
+ ret = tpm_sendrecv_command(dev, command_v2, response, &response_len, 0);
if (!ret)
tpm_init(dev);
@@ -767,7 +775,7 @@ u32 tpm2_dam_reset(struct udevice *dev, const char *pw,
const ssize_t pw_sz)
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
@@ -816,7 +824,7 @@ u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
@@ -861,7 +869,7 @@ int tpm2_change_auth(struct udevice *dev, u32 handle, const
char *newpw,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
@@ -916,7 +924,7 @@ u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char
*pw,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
@@ -962,7 +970,7 @@ u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char
*pw,
if (ret)
return TPM_LIB_ERROR;
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_get_random(struct udevice *dev, void *data, u32 count)
@@ -989,8 +997,9 @@ u32 tpm2_get_random(struct udevice *dev, void *data, u32
count)
0, command_v2, sizeof(command_v2),
sizeof(command_v2), this_bytes))
return TPM_LIB_ERROR;
+ /* tag(2) + size(4) + rc(4) + randomSize(2) */
err = tpm_sendrecv_command(dev, buf, response,
- &response_length);
+ &response_length, 12);
if (err)
return err;
if (unpack_byte_string(response, response_length, "w",
@@ -1029,7 +1038,7 @@ u32 tpm2_write_lock(struct udevice *dev, u32 index)
tpm_u16(0), /* auth_size */
};
- return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ return tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
}
u32 tpm2_disable_platform_hierarchy(struct udevice *dev)
@@ -1057,7 +1066,7 @@ u32 tpm2_disable_platform_hierarchy(struct udevice *dev)
};
int ret;
- ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
log_info("ret=%s, %x\n", dev->name, ret);
if (ret)
return ret;
@@ -1070,7 +1079,7 @@ u32 tpm2_disable_platform_hierarchy(struct udevice *dev)
u32 tpm2_submit_command(struct udevice *dev, const u8 *sendbuf,
u8 *recvbuf, size_t *recv_size)
{
- return tpm_sendrecv_command(dev, sendbuf, recvbuf, recv_size);
+ return tpm_sendrecv_command(dev, sendbuf, recvbuf, recv_size, 0);
}
u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd,
@@ -1086,7 +1095,8 @@ u32 tpm2_report_state(struct udevice *dev, uint
vendor_cmd, uint vendor_subcmd,
};
int ret;
- ret = tpm_sendrecv_command(dev, command_v2, recvbuf, recv_size);
+ /* tag(2) + size(4) + rc(4) + subCmd(2) */
+ ret = tpm_sendrecv_command(dev, command_v2, recvbuf, recv_size, 12);
log_debug("ret=%s, %x\n", dev->name, ret);
if (ret)
return ret;
@@ -1111,7 +1121,7 @@ u32 tpm2_enable_nvcommits(struct udevice *dev, uint
vendor_cmd,
};
int ret;
- ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
+ ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL, 0);
log_debug("ret=%s, %x\n", dev->name, ret);
if (ret)
return ret;
--
2.43.0
