src/lib/tpm2_marshaling.c

   1 /*
   2  * Copyright 2016 The Chromium OS Authors. All rights reserved.
   3  * Use of this source code is governed by a BSD-style license that can be
   4  * found in the LICENSE file.
   5  */
   6
   7 #include <arch/early_variables.h>
   8 #include <commonlib/endian.h>
   9 #include <console/console.h>
  10 #include <stdlib.h>
  11 #include <string.h>
  12
  13 #include "tpm2_marshaling.h"
  14
  15 static uint16_t tpm_tag CAR_GLOBAL;  /* Depends on the command type. */
  16
  17 /*
  18  * Each unmarshaling function receives a pointer to the buffer pointer and a
  19  * pointer to the size of data still in the buffer. The function extracts data
  20  * from the buffer and adjusts both buffer pointer and remaining data size.
  21  *
  22  * Should there be not enough data in the buffer to unmarshal the required
  23  * object, the remaining data size is set to -1 to indicate the error. The
  24  * remaining data size is expected to be set to zero once the last data item
  25  * has been extracted from the receive buffer.
  26  */
  27 static uint16_t unmarshal_u16(void **buffer, int *buffer_space)
  28 {
  29         uint16_t value;
  30
  31         if (*buffer_space < 0)
  32                 return 0;
  33
  34         if (*buffer_space < sizeof(value)) {
  35                 *buffer_space = -1; /* Indicate a failure. */
  36                 return 0;
  37         }
  38
  39         value = read_be16(*buffer);
  40         *buffer = (void *) ((uintptr_t) (*buffer) + sizeof(value));
  41         *buffer_space -= sizeof(value);
  42
  43         return value;
  44 }
  45
  46 static uint16_t unmarshal_u32(void **buffer, int *buffer_space)
  47 {
  48         uint32_t value;
  49
  50         if (*buffer_space < 0)
  51                 return 0;
  52
  53         if (*buffer_space < sizeof(value)) {
  54                 *buffer_space = -1; /* Indicate a failure. */
  55                 return 0;
  56         }
  57
  58         value = read_be32(*buffer);
  59         *buffer = (void *) ((uintptr_t) (*buffer) + sizeof(value));
  60         *buffer_space -= sizeof(value);
  61
  62         return value;
  63 }
  64
  65 static uint8_t unmarshal_u8(void **buffer, int *buffer_space)
  66 {
  67         uint8_t value;
  68
  69         if (*buffer_space < 0)
  70                 return 0;
  71
  72         if (*buffer_space < sizeof(value)) {
  73                 *buffer_space = -1; /* Indicate a failure. */
  74                 return 0;
  75         }
  76
  77         value = ((uint8_t *)(*buffer))[0];
  78         *buffer = (void *) ((uintptr_t) (*buffer) + sizeof(value));
  79         *buffer_space -= sizeof(value);
  80
  81         return value;
  82 }
  83
  84 #define unmarshal_TPM_CAP(a, b) unmarshal_u32(a, b)
  85 #define unmarshal_TPM_CC(a, b) unmarshal_u32(a, b)
  86 #define unmarshal_TPM_PT(a, b) unmarshal_u32(a, b)
  87 #define unmarshal_TPM_HANDLE(a, b) unmarshal_u32(a, b)
  88
  89 /*
  90  * Each marshaling function receives a pointer to the buffer to marshal into,
  91  * a pointer to the data item to be marshaled, and a pointer to the remaining
  92  * room in the buffer.
  93  */
  94
  95  /*
  96   * Marshaling an arbitrary blob requires its size in addition to common
  97   * parameter set.
  98   */
  99 static void marshal_blob(void **buffer, void *blob,
 100                          size_t blob_size, size_t *buffer_space)
 101 {
 102         if (*buffer_space < blob_size) {
 103                 *buffer_space = -1;
 104                 return;
 105         }
 106
 107         memcpy(*buffer, blob, blob_size);
 108         *buffer_space -= blob_size;
 109         *buffer = (void *)((uintptr_t)(*buffer) + blob_size);
 110 }
 111
 112 static void marshal_u8(void **buffer, uint8_t value, size_t *buffer_space)
 113 {
 114         uint8_t *bp = *buffer;
 115
 116         if (*buffer_space < sizeof(value)) {
 117                 *buffer_space = 0;
 118                 return;
 119         }
 120
 121         *bp++ = value;
 122         *buffer = bp;
 123         *buffer_space -= sizeof(value);
 124 }
 125
 126 static void marshal_u16(void **buffer, uint16_t value, size_t *buffer_space)
 127 {
 128         if (*buffer_space < sizeof(value)) {
 129                 *buffer_space = 0;
 130                 return;
 131         }
 132         write_be16(*buffer, value);
 133         *buffer = (void *)((uintptr_t)(*buffer) + sizeof(value));
 134         *buffer_space -= sizeof(value);
 135 }
 136
 137 static void marshal_u32(void **buffer, uint32_t value, size_t *buffer_space)
 138 {
 139         if (*buffer_space < sizeof(value)) {
 140                 *buffer_space = 0;
 141                 return;
 142         }
 143
 144         write_be32(*buffer, value);
 145         *buffer = (void *)((uintptr_t)(*buffer) + sizeof(value));
 146         *buffer_space -= sizeof(value);
 147 }
 148
 149 #define marshal_TPM_HANDLE(a, b, c) marshal_u32(a, b, c)
 150 #define marshal_TPMI_RH_NV_AUTH(a, b, c) marshal_TPM_HANDLE(a, b, c)
 151 #define marshal_TPMI_RH_NV_INDEX(a, b, c) marshal_TPM_HANDLE(a, b, c)
 152 #define marshal_TPMI_SH_AUTH_SESSION(a, b, c) marshal_TPM_HANDLE(a, b, c)
 153 #define marshal_TPMI_ALG_HASH(a, b, c) marshal_u16(a, b, c)
 154
 155 static void marshal_startup(void **buffer,
 156                            struct tpm2_startup *cmd_body,
 157                            size_t *buffer_space)
 158 {
 159         marshal_u16(buffer, cmd_body->startup_type, buffer_space);
 160 }
 161
 162 static void marshal_get_capability(void **buffer,
 163                                    struct tpm2_get_capability *cmd_body,
 164                                    size_t *buffer_space)
 165 {
 166         marshal_u32(buffer, cmd_body->capability, buffer_space);
 167         marshal_u32(buffer, cmd_body->property, buffer_space);
 168         marshal_u32(buffer, cmd_body->propertyCount, buffer_space);
 169 }
 170
 171 static void marshal_TPM2B(void **buffer,
 172                           TPM2B *data,
 173                           size_t *buffer_space)
 174 {
 175         size_t total_size = data->size + sizeof(data->size);
 176
 177         if (total_size > *buffer_space) {
 178                 *buffer_space = 0;
 179                 return;
 180         }
 181         marshal_u16(buffer, data->size, buffer_space);
 182         memcpy(*buffer, data->buffer, data->size);
 183         *buffer = ((uint8_t *)(*buffer)) + data->size;
 184         *buffer_space -= data->size;
 185 }
 186
 187 static void marshal_TPMA_NV(void **buffer,
 188                             TPMA_NV *nv,
 189                             size_t *buffer_space)
 190 {
 191         marshal_u32(buffer, *((uint32_t *)nv), buffer_space);
 192 }
 193
 194 static void marshal_TPMS_NV_PUBLIC(void **buffer,
 195                                    TPMS_NV_PUBLIC *nvpub,
 196                                    size_t *buffer_space)
 197 {
 198         marshal_TPM_HANDLE(buffer, nvpub->nvIndex, buffer_space);
 199         marshal_TPMI_ALG_HASH(buffer, nvpub->nameAlg, buffer_space);
 200         marshal_TPMA_NV(buffer, &nvpub->attributes, buffer_space);
 201         marshal_TPM2B(buffer, &nvpub->authPolicy.b, buffer_space);
 202         marshal_u16(buffer, nvpub->dataSize, buffer_space);
 203 }
 204
 205 static void marshal_TPMT_HA(void **buffer,
 206                             TPMT_HA *tpmtha,
 207                             size_t *buffer_space)
 208 {
 209         marshal_TPMI_ALG_HASH(buffer, tpmtha->hashAlg, buffer_space);
 210         marshal_blob(buffer, tpmtha->digest.sha256,
 211                      sizeof(tpmtha->digest.sha256),
 212                      buffer_space);
 213 }
 214
 215 static void marshal_TPML_DIGEST_VALUES(void **buffer,
 216                                        TPML_DIGEST_VALUES *dvalues,
 217                                        size_t *buffer_space)
 218 {
 219         int i;
 220
 221         marshal_u32(buffer, dvalues->count, buffer_space);
 222         for (i = 0; i < dvalues->count; i++)
 223                 marshal_TPMT_HA(buffer, &dvalues->digests[i], buffer_space);
 224 }
 225
 226 static void marshal_session_header(void **buffer,
 227                                    struct tpm2_session_header *session_header,
 228                                    size_t *buffer_space)
 229 {
 230         size_t base_size;
 231         void *size_location = *buffer;
 232
 233         /* Skip room for the session header size. */
 234         if (*buffer_space < sizeof(uint32_t)) {
 235                 *buffer_space = 0;
 236                 return;
 237         }
 238
 239         *buffer_space -= sizeof(uint32_t);
 240         *buffer = (void *)(((uintptr_t) *buffer) + sizeof(uint32_t));
 241
 242         base_size = *buffer_space;
 243
 244         marshal_u32(buffer, session_header->session_handle, buffer_space);
 245         marshal_u16(buffer, session_header->nonce_size, buffer_space);
 246         marshal_blob(buffer, session_header->nonce,
 247                      session_header->nonce_size, buffer_space);
 248         marshal_u8(buffer, session_header->session_attrs, buffer_space);
 249         marshal_u16(buffer, session_header->auth_size, buffer_space);
 250         marshal_blob(buffer, session_header->auth,
 251                      session_header->auth_size, buffer_space);
 252
 253         if (!*buffer_space)
 254                 return;  /* The structure did not fit. */
 255
 256         /* Paste in the session size. */
 257         marshal_u32(&size_location, base_size - *buffer_space, &base_size);
 258 }
 259
 260 /*
 261  * Common session header can include one or two handles and an empty
 262  * session_header structure.
 263  */
 264 static void marshal_common_session_header(void **buffer,
 265                                           const uint32_t *handles,
 266                                           size_t handle_count,
 267                                           size_t *buffer_space)
 268 {
 269         int i;
 270         struct tpm2_session_header session_header;
 271
 272         car_set_var(tpm_tag, TPM_ST_SESSIONS);
 273
 274         for (i = 0; i < handle_count; i++)
 275                 marshal_TPM_HANDLE(buffer, handles[i], buffer_space);
 276
 277         memset(&session_header, 0, sizeof(session_header));
 278         session_header.session_handle = TPM_RS_PW;
 279         marshal_session_header(buffer, &session_header, buffer_space);
 280 }
 281
 282 static void marshal_nv_define_space(void **buffer,
 283                                     struct tpm2_nv_define_space_cmd *nvd_in,
 284                                     size_t *buffer_space)
 285 {
 286         void *size_location;
 287         size_t base_size;
 288         size_t sizeof_nv_public_size = sizeof(uint16_t);
 289         const uint32_t handle[] = { TPM_RH_PLATFORM };
 290
 291         marshal_common_session_header(buffer, handle,
 292                                       ARRAY_SIZE(handle), buffer_space);
 293         marshal_TPM2B(buffer, &nvd_in->auth.b, buffer_space);
 294
 295         /* This is where the TPMS_NV_PUBLIC size will be stored. */
 296         size_location = *buffer;
 297
 298         /* Allocate room for the size. */
 299         *buffer = ((uint8_t *)(*buffer)) + sizeof(uint16_t);
 300
 301         if (*buffer_space < sizeof_nv_public_size) {
 302                 *buffer_space = 0;
 303                 return;
 304         }
 305         *buffer_space -= sizeof_nv_public_size;
 306         base_size = *buffer_space;
 307
 308         marshal_TPMS_NV_PUBLIC(buffer, &nvd_in->publicInfo, buffer_space);
 309         if (!*buffer_space)
 310                 return;
 311
 312         base_size = base_size - *buffer_space;
 313         marshal_u16(&size_location, base_size, &sizeof_nv_public_size);
 314 }
 315
 316 static void marshal_nv_write(void **buffer,
 317                              struct tpm2_nv_write_cmd *command_body,
 318                              size_t *buffer_space)
 319 {
 320         uint32_t handles[] = { TPM_RH_PLATFORM, command_body->nvIndex };
 321
 322         marshal_common_session_header(buffer, handles,
 323                                       ARRAY_SIZE(handles), buffer_space);
 324         marshal_TPM2B(buffer, &command_body->data.b, buffer_space);
 325         marshal_u16(buffer, command_body->offset, buffer_space);
 326 }
 327
 328 static void marshal_nv_write_lock(void **buffer,
 329                                   struct tpm2_nv_write_lock_cmd *command_body,
 330                                   size_t *buffer_space)
 331 {
 332         uint32_t handles[] = { TPM_RH_PLATFORM, command_body->nvIndex };
 333         marshal_common_session_header(buffer, handles,
 334                                       ARRAY_SIZE(handles), buffer_space);
 335 }
 336
 337 static void marshal_pcr_extend(void **buffer,
 338                                struct tpm2_pcr_extend_cmd *command_body,
 339                                size_t *buffer_space)
 340 {
 341         uint32_t handle = command_body->pcrHandle;
 342
 343         marshal_common_session_header(buffer, &handle, 1, buffer_space);
 344         marshal_TPML_DIGEST_VALUES(buffer,
 345                                    &command_body->digests, buffer_space);
 346 }
 347
 348 static void marshal_nv_read(void **buffer,
 349                             struct tpm2_nv_read_cmd *command_body,
 350                             size_t *buffer_space)
 351 {
 352         uint32_t handles[] = { TPM_RH_PLATFORM, command_body->nvIndex };
 353
 354         marshal_common_session_header(buffer, handles,
 355                                       ARRAY_SIZE(handles), buffer_space);
 356         marshal_u16(buffer, command_body->size, buffer_space);
 357         marshal_u16(buffer, command_body->offset, buffer_space);
 358 }
 359
 360 /* TPM2_Clear command does not require paramaters. */
 361 static void marshal_clear(void **buffer, size_t *buffer_space)
 362 {
 363         const uint32_t handle[] = { TPM_RH_PLATFORM };
 364
 365         marshal_common_session_header(buffer, handle,
 366                                       ARRAY_SIZE(handle), buffer_space);
 367 }
 368
 369 static void marshal_selftest(void **buffer,
 370                              struct tpm2_self_test *command_body,
 371                              size_t *buffer_space)
 372 {
 373         marshal_u8(buffer, command_body->yes_no, buffer_space);
 374 }
 375
 376 int tpm_marshal_command(TPM_CC command, void *tpm_command_body,
 377                         void *buffer, size_t buffer_size)
 378 {
 379         void *cmd_body = (uint8_t *)buffer + sizeof(struct tpm_header);
 380         size_t max_body_size = buffer_size - sizeof(struct tpm_header);
 381         size_t body_size = max_body_size;
 382
 383         /* Will be modified when marshaling some commands. */
 384         car_set_var(tpm_tag, TPM_ST_NO_SESSIONS);
 385
 386         switch (command) {
 387         case TPM2_Startup:
 388                 marshal_startup(&cmd_body, tpm_command_body, &body_size);
 389                 break;
 390
 391         case TPM2_GetCapability:
 392                 marshal_get_capability(&cmd_body, tpm_command_body,
 393                                        &body_size);
 394                 break;
 395
 396         case TPM2_NV_Read:
 397                 marshal_nv_read(&cmd_body, tpm_command_body, &body_size);
 398                 break;
 399
 400         case TPM2_NV_DefineSpace:
 401                 marshal_nv_define_space(&cmd_body,
 402                                         tpm_command_body, &body_size);
 403                 break;
 404
 405         case TPM2_NV_Write:
 406                 marshal_nv_write(&cmd_body, tpm_command_body, &body_size);
 407                 break;
 408
 409         case TPM2_NV_WriteLock:
 410                 marshal_nv_write_lock(&cmd_body, tpm_command_body, &body_size);
 411                 break;
 412
 413         case TPM2_SelfTest:
 414                 marshal_selftest(&cmd_body, tpm_command_body, &body_size);
 415                 break;
 416
 417         case TPM2_Clear:
 418                 marshal_clear(&cmd_body, &body_size);
 419                 break;
 420
 421         case TPM2_PCR_Extend:
 422                 marshal_pcr_extend(&cmd_body, tpm_command_body, &body_size);
 423                 break;
 424
 425         default:
 426                 body_size = 0;
 427                 printk(BIOS_INFO, "%s:%d:Request to marshal unsupported command %#x\n",
 428                        __FILE__, __LINE__, command);
 429         }
 430
 431         if (body_size > 0) {
 432                 size_t marshaled_size;
 433                 size_t header_room = sizeof(struct tpm_header);
 434
 435                 /* See how much room was taken by marshaling. */
 436                 marshaled_size = max_body_size - body_size;
 437
 438                 /* Total size includes the header size. */
 439                 marshaled_size += sizeof(struct tpm_header);
 440
 441                 uint16_t tpm_tag_value = car_get_var(tpm_tag);
 442
 443                 marshal_u16(&buffer, tpm_tag_value, &header_room);
 444                 marshal_u32(&buffer, marshaled_size, &header_room);
 445                 marshal_u32(&buffer, command, &header_room);
 446                 return marshaled_size;
 447         }
 448
 449         return -1;
 450 }
 451
 452 static void unmarshal_get_capability(void **buffer, int *size,
 453                                      struct get_cap_response *gcr)
 454 {
 455         int i;
 456
 457         gcr->more_data = unmarshal_u8(buffer, size);
 458
 459         gcr->cd.capability = unmarshal_TPM_CAP(buffer, size);
 460         if (*size < 0)
 461                 return;
 462
 463         switch (gcr->cd.capability) {
 464         case TPM_CAP_TPM_PROPERTIES:
 465                 gcr->cd.data.tpmProperties.count =
 466                         unmarshal_u32(buffer, size);
 467                 if (*size < 0)
 468                         return;
 469                 if (gcr->cd.data.tpmProperties.count > ARRAY_SIZE
 470                     (gcr->cd.data.tpmProperties.tpmProperty)) {
 471                         printk(BIOS_INFO, "%s:%s:%d - %d - too many properties\n",
 472                                __FILE__, __func__, __LINE__,
 473                                gcr->cd.data.tpmProperties.count);
 474                         *size = -1;
 475                         return;
 476                 }
 477                 for (i = 0; i < gcr->cd.data.tpmProperties.count; i++) {
 478                         TPMS_TAGGED_PROPERTY *pp;
 479
 480                         pp = gcr->cd.data.tpmProperties.tpmProperty + i;
 481                         pp->property = unmarshal_TPM_PT(buffer, size);
 482                         pp->value = unmarshal_u32(buffer, size);
 483                 }
 484                 break;
 485         default:
 486                 printk(BIOS_ERR,
 487                        "%s:%d - unable to unmarshal capability response",
 488                        __func__, __LINE__);
 489                 printk(BIOS_ERR, " for %d\n", gcr->cd.capability);
 490                 *size = -1;
 491                 break;
 492         }
 493 }
 494
 495 static void unmarshal_TPM2B_MAX_NV_BUFFER(void **buffer,
 496                                           int *size,
 497                                           TPM2B_MAX_NV_BUFFER *nv_buffer)
 498 {
 499         nv_buffer->t.size = unmarshal_u16(buffer, size);
 500         if ((*size < 0) || (nv_buffer->t.size > *size)) {
 501                 printk(BIOS_ERR, "%s:%d - "
 502                        "size mismatch: expected %d, remaining %d\n",
 503                        __func__, __LINE__, nv_buffer->t.size, *size);
 504                 *size = -1;
 505                 return;
 506         }
 507
 508         nv_buffer->t.buffer = *buffer;
 509
 510         *buffer = ((uint8_t *)(*buffer)) + nv_buffer->t.size;
 511         *size -= nv_buffer->t.size;
 512 }
 513
 514 static void unmarshal_nv_read(void **buffer, int *size,
 515                               struct nv_read_response *nvr)
 516 {
 517         /* Total size of the parameter field. */
 518         nvr->params_size = unmarshal_u32(buffer, size);
 519         unmarshal_TPM2B_MAX_NV_BUFFER(buffer, size, &nvr->buffer);
 520
 521         if (nvr->params_size !=
 522             (nvr->buffer.t.size + sizeof(nvr->buffer.t.size))) {
 523                 printk(BIOS_ERR,
 524                        "%s:%d - parameter/buffer %d/%d size mismatch",
 525                        __func__, __LINE__, nvr->params_size,
 526                        nvr->buffer.t.size);
 527                 return;
 528         }
 529
 530         if (*size < 0)
 531                 return;
 532         /*
 533          * Let's ignore the authorisation section. It should be 5 bytes total,
 534          * just confirm that this is the case and report any discrepancy.
 535          */
 536         if (*size != 5)
 537                 printk(BIOS_ERR,
 538                        "%s:%d - unexpected authorisation seciton size %d\n",
 539                        __func__, __LINE__, *size);
 540
 541         *buffer = ((uint8_t *)(*buffer)) + *size;
 542         *size = 0;
 543 }
 544
 545 struct tpm2_response *tpm_unmarshal_response(TPM_CC command,
 546                                              void *response_body,
 547                                              size_t in_size)
 548 {
 549         static struct tpm2_response tpm2_static_resp CAR_GLOBAL;
 550         struct tpm2_response *tpm2_resp = car_get_var_ptr(&tpm2_static_resp);
 551         /*
 552          * Should be 0 when done, positive and negaitive values indicate
 553          * unmarshaling errors.
 554          */
 555         int cr_size = in_size;
 556
 557         if ((cr_size < 0) || (in_size < sizeof(struct tpm_header)))
 558                 return NULL;
 559
 560         tpm2_resp->hdr.tpm_tag = unmarshal_u16(&response_body, &cr_size);
 561         tpm2_resp->hdr.tpm_size = unmarshal_u32(&response_body, &cr_size);
 562         tpm2_resp->hdr.tpm_code = unmarshal_TPM_CC(&response_body, &cr_size);
 563
 564         if (!cr_size) {
 565                 if (tpm2_resp->hdr.tpm_size != sizeof(tpm2_resp->hdr))
 566                         printk(BIOS_ERR,
 567                                "%s: size mismatch in response to command %#x\n",
 568                                __func__, command);
 569                 return tpm2_resp;
 570         }
 571
 572         switch (command) {
 573         case TPM2_Startup:
 574                 break;
 575
 576         case TPM2_GetCapability:
 577                 unmarshal_get_capability(&response_body, &cr_size,
 578                                          &tpm2_resp->gc);
 579                 break;
 580
 581         case TPM2_NV_Read:
 582                 unmarshal_nv_read(&response_body, &cr_size,
 583                                   &tpm2_resp->nvr);
 584                 break;
 585
 586         case TPM2_Clear:
 587         case TPM2_NV_DefineSpace:
 588         case TPM2_NV_Write:
 589         case TPM2_NV_WriteLock:
 590         case TPM2_PCR_Extend:
 591                 /* Session data included in response can be safely ignored. */
 592                 cr_size = 0;
 593                 break;
 594
 595         default:
 596                 {
 597                         int i;
 598
 599                         printk(BIOS_INFO, "%s:%d:"
 600                                "Request to unmarshal unexpected command %#x,"
 601                                " code %#x",
 602                                __func__, __LINE__, command,
 603                                tpm2_resp->hdr.tpm_code);
 604
 605                         for (i = 0; i < cr_size; i++) {
 606                                 if (!(i % 16))
 607                                         printk(BIOS_INFO, "\n");
 608                                 printk(BIOS_INFO, "%2.2x ",
 609                                        ((uint8_t *)response_body)[i]);
 610                         }
 611                 }
 612                 printk(BIOS_INFO, "\n");
 613                 return NULL;
 614         }
 615
 616         if (cr_size) {
 617                 printk(BIOS_INFO,
 618                        "%s:%d got %d bytes back in response to %#x,"
 619                        " failed to parse (%d)\n",
 620                        __func__, __LINE__, tpm2_resp->hdr.tpm_size,
 621                        command, cr_size);
 622                 return NULL;
 623         }
 624
 625         /* The entire message have been parsed. */
 626         return tpm2_resp;
 627 }