Modify tpm2 scripts/recipes to align with tools/tss uprev

These changes align with the uprev to tpm2-tools v5.7 and tpm2-tss v3.2.3, iincluding command line utilities updates and changes in output formats

Author: shahs-ais

recipes-core/initrdscripts/initramfs-framework/tpm2

@@ -28,10 +28,9 @@
 pcr_bank_exists () {
     local alg_in=$1
 
-    banks=$(tpm2_pcrlist -s | cut -d ':' -f 2)
+    banks=$(tpm2_pcrread | cut -d ':' -f 1 | grep -i "sha")
     for bank in $banks; do
-        alg=$(echo $bank | cut -d '(' -f 1)
-        if [ "$alg" = $alg_in ]; then
+        if [ "$bank" = $alg_in ]; then
             return 0
         fi
     done
@@ -75,15 +74,15 @@ tpm2_run() {
     info -n "Measuring rootfs device..."
     if pcr_bank_exists "sha256"; then
         local digest="$(sha256sum $bootparam_root | head -c64)"
-        local algid="0xB"
+        local algid="sha256"
     else
         local digest="$(sha1sum $bootparam_root | head -c40)"
-        local algid="0x4"
+        local algid="sha1"
     fi
     info "done"
 
     info -n "Extending TPM PCR..."
-    tpm2_extendpcr -c 15 -g ${algid} -s ${digest}
+    tpm2_pcrextend 15:${algid}=${digest}
     if [ $? -ne 0 ]; then
         info "PCR-15 extend failed"
         return

recipes-core/initrdscripts/initramfs-framework_%.bbappend

@@ -57,7 +57,7 @@ RDEPENDS_initramfs-module-tpm = "${PN}-base initramfs-module-bootfs tpm-tools-sa
 FILES_initramfs-module-tpm = "/init.d/92-tpm"
 
 SUMMARY_initramfs-module-tpm2 = "initramfs support for tpm2"
-RDEPENDS_initramfs-module-tpm2 = "${PN}-base initramfs-module-bootfs tpm2-tools-initrd"
+RDEPENDS_initramfs-module-tpm2 = "${PN}-base initramfs-module-bootfs tpm2-tools tpm2-tss"
 FILES_initramfs-module-tpm2 = "/init.d/92-tpm2"
 
 SUMMARY_initramfs-module-selinux = "initramfs support for selinux"

recipes-openxt/openxt-measuredlaunch/openxt-measuredlaunch/ml-functions

@@ -681,7 +681,7 @@ write_config_pcrs() {
 }
 
 # Function to configure measured launch on platform.  The next boot will cause
-#   init-root.ro to perform first sealing operation.
+#   init.root-ro to perform first sealing operation.
 # parameter 0: mount point for rootfs
 # parameter 1: key to unlock partition
 # parameter 2: device path for partition

recipes-openxt/xenclient-root-ro/xenclient-root-ro/init.root-ro

@@ -287,7 +287,7 @@ unlock_config()
     local sig=$(dd if="${lv_path}" bs=4 count=1 2>/dev/null)
     case "${sig}" in
     LUKS)
-        if [ -e /boot/system/tpm/enabled ]; then
+        if [ -e ${SYS_TPM_DIR}/enabled ]; then
             # This will seal/reboot or fail/halt
             if [ -e ${SYS_TPM_DIR}/setup ]; then
                 # create a small tmpfs to use for sealing, then remove
@@ -432,8 +432,8 @@ then
     #cap pcr 15 in all available banks. This is a cheap operation and works for all cases
     sha256cap=$(echo -n "MEASUREDLAUNCHCLOSED"|sha256sum|cut -f1 -d\ |tr -d "\n")
     sha1cap=$(echo -n "MEASUREDLAUNCHCLOSED"|sha1sum|cut -f1 -d\ |tr -d "\n")
-    pcr_bank_exists "sha256" && tpm2_extendpcr -c 15 -g 0xB -s "${sha256cap}"
-    pcr_bank_exists "sha1" && tpm2_extendpcr -c 15 -g 0x4 -s "${sha1cap}"
+    pcr_bank_exists "sha256" && tpm2_pcrextend -Q 15:sha256="${sha256cap}"
+    pcr_bank_exists "sha1"   && tpm2_pcrextend -Q 15:sha1="${sha1cap}"
 else
     echo -n "MEASUREDLAUNCHCLOSED" | TCSD_LOG_OFF=yes tpm_extendpcr_sa -p 15
 fi