sandbox: tpm: Fix nvwrite command

The original codes misused recvbuf in source buffer instead of sendbuf,
and read from incorrect offset 14 instead of 22.

Signed-off-by: Che-Liang Chiou <clchiou@chromium.org>

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Che-Liang Chiou <clchiou@chromium.org>

drivers/tpm/tpm_tis_sandbox.c

@@ -190,9 +190,7 @@ int tis_sendrecv(const u8 *sendbuf, size_t send_size,
 		if (seq < 0)
 			return -1;
 		printf("tpm: nvwrite index=%#02x, len=%#02x\n", index, length);
-		memcpy(&tpm->nvdata[seq],
-		       recvbuf + TPM_RESPONSE_HEADER_LENGTH + sizeof(uint32_t),
-		       length);
+		memcpy(&tpm->nvdata[seq], sendbuf + 22, length);
 		*recv_len = 12;
 		memset(recvbuf, '\0', *recv_len);
 		break;