diff options
-rw-r--r-- | src/include/usr/secureboot/trustedboot_reasoncodes.H | 1 | ||||
-rw-r--r-- | src/include/usr/secureboot/trustedbootif.H | 3 | ||||
-rw-r--r-- | src/usr/secureboot/trusted/base/trustedTypes_base.C | 2 | ||||
-rwxr-xr-x | src/usr/secureboot/trusted/test/trustedbootTest.H | 160 | ||||
-rw-r--r-- | src/usr/secureboot/trusted/trustedTypes.C | 179 | ||||
-rw-r--r-- | src/usr/secureboot/trusted/trustedTypes.H | 75 | ||||
-rw-r--r-- | src/usr/secureboot/trusted/trustedbootCmds.C | 148 | ||||
-rw-r--r-- | src/usr/secureboot/trusted/trustedbootCmds.H | 17 |
8 files changed, 580 insertions, 5 deletions
diff --git a/src/include/usr/secureboot/trustedboot_reasoncodes.H b/src/include/usr/secureboot/trustedboot_reasoncodes.H index 6cad6ebd7..9f3ad03c5 100644 --- a/src/include/usr/secureboot/trustedboot_reasoncodes.H +++ b/src/include/usr/secureboot/trustedboot_reasoncodes.H @@ -51,6 +51,7 @@ namespace TRUSTEDBOOT MOD_TPM_UNMARSHALRESPDATA = 0x05, MOD_TPM_VERIFYFUNCTIONAL = 0x06, MOD_TPM_CMD_PCREXTEND = 0x07, + MOD_TPM_CMD_PCRREAD = 0x08, MOD_TPMLOGMGR_INITIALIZE = 0x10, MOD_TPMLOGMGR_ADDEVENT = 0x11, diff --git a/src/include/usr/secureboot/trustedbootif.H b/src/include/usr/secureboot/trustedbootif.H index acd9a867f..49b81832c 100644 --- a/src/include/usr/secureboot/trustedbootif.H +++ b/src/include/usr/secureboot/trustedbootif.H @@ -62,7 +62,8 @@ namespace TRUSTEDBOOT PCR_1 = 1, PCR_4 = 4, PCR_DEBUG = 16, - PCR_MAX = 16, + PLATFORM_PCR = 24, ///< The number of PCR required by the platform spec + IMPLEMENTATION_PCR = 24, ///< The number of PCRs implemented by TPM } TPM_Pcr; diff --git a/src/usr/secureboot/trusted/base/trustedTypes_base.C b/src/usr/secureboot/trusted/base/trustedTypes_base.C index 3c3d8d737..bff23a911 100644 --- a/src/usr/secureboot/trusted/base/trustedTypes_base.C +++ b/src/usr/secureboot/trusted/base/trustedTypes_base.C @@ -130,7 +130,7 @@ namespace TRUSTEDBOOT field32 = (uint32_t*)(i_tpmBuf); val->pcrIndex = le32toh(*field32); // Ensure a valid pcr index - if (val->pcrIndex >= PCR_MAX) + if (val->pcrIndex >= IMPLEMENTATION_PCR) { *o_err = true; i_tpmBuf = NULL; diff --git a/src/usr/secureboot/trusted/test/trustedbootTest.H b/src/usr/secureboot/trusted/test/trustedbootTest.H index 476b7e4c0..5fad75145 100755 --- a/src/usr/secureboot/trusted/test/trustedbootTest.H +++ b/src/usr/secureboot/trusted/test/trustedbootTest.H @@ -475,6 +475,67 @@ class TrustedBootTest: public CxxTest::TestSuite } + // Test PcrReadIn + { + TRACUCOMP( g_trac_trustedboot, + "testCommandMarshal - PcrReadIn" ); + memset(dataBufIn, 0, sizeof(dataBufIn)); + memset(dataBufOut, 0, sizeof(dataBufOut)); + TRUSTEDBOOT::TPM2_PcrReadIn* cmdPtr = + reinterpret_cast<TRUSTEDBOOT::TPM2_PcrReadIn*> + (dataBufIn); + cmdPtr->base.commandCode = TRUSTEDBOOT::TPM_CC_PCR_Read; + cmdPtr->pcrSelectionIn.count = 1; + cmdPtr->pcrSelectionIn.pcrSelections[0].algorithmId = + TPM_ALG_SHA256; + cmdPtr->pcrSelectionIn.pcrSelections[0].sizeOfSelect = + PCR_SELECT_MAX; + + runTpmMarshalTest(baseCmd, + dataBufOut, + sizeof(dataBufOut), + cmdSize, + "PcrReadIn", + num_ops, + fails, + sizeof(TPM2_PcrReadIn)); + + // Invalid number of algorithms + memset(dataBufIn, 0, sizeof(dataBufIn)); + memset(dataBufOut, 0, sizeof(dataBufOut)); + cmdPtr->base.commandCode = TRUSTEDBOOT::TPM_CC_PCR_Read; + cmdPtr->pcrSelectionIn.count = HASH_COUNT+1; + cmdPtr->pcrSelectionIn.pcrSelections[0].algorithmId = + TPM_ALG_SHA256; + cmdPtr->pcrSelectionIn.pcrSelections[0].sizeOfSelect = 1; + runTpmMarshalFailTest(baseCmd, + dataBufOut, + sizeof(dataBufOut), + cmdSize, + "PcrReadIn - invalid #algorithms", + num_ops, + fails); + + // Invalid select size + memset(dataBufIn, 0, sizeof(dataBufIn)); + memset(dataBufOut, 0, sizeof(dataBufOut)); + cmdPtr->base.commandCode = TRUSTEDBOOT::TPM_CC_PCR_Read; + cmdPtr->pcrSelectionIn.count = HASH_COUNT+1; + cmdPtr->pcrSelectionIn.pcrSelections[0].algorithmId = + TPM_ALG_SHA256; + cmdPtr->pcrSelectionIn.pcrSelections[0].sizeOfSelect = + PCR_SELECT_MAX+1; + runTpmMarshalFailTest(baseCmd, + dataBufOut, + sizeof(dataBufOut), + cmdSize, + "PcrReadIn - invalid select size", + num_ops, + fails); + + } + + } while( 0 ); TRACFCOMP( g_trac_trustedboot, @@ -567,6 +628,44 @@ class TrustedBootTest: public CxxTest::TestSuite fails); } + // Test PcrReadOut + { + TRACUCOMP( g_trac_trustedboot, + "testCommandUnmarshal - PcrReadOut" ); + memset(dataBufIn, 0, sizeof(dataBufIn)); + memset(dataBufOut, 0, sizeof(dataBufOut)); + + TRUSTEDBOOT::TPM2_PcrReadOut* respPtr = + reinterpret_cast<TRUSTEDBOOT::TPM2_PcrReadOut*> + (dataBufIn); + respPtr->pcrUpdateCounter = 0xAABBCCDD; + respPtr->pcrSelectionOut.count = 1; + respPtr->pcrSelectionOut.pcrSelections[0].sizeOfSelect = + PCR_SELECT_MAX; + respPtr->pcrValues.count = 1; + respPtr->pcrValues.digests[0].size = TPM_ALG_SHA256_SIZE; + + runTpmUnmarshalTest(TRUSTEDBOOT::TPM_CC_PCR_Read, + dataBufIn, + sizeof(dataBufIn), + baseCmd, + sizeof(TPM2_PcrReadOut), + "PcrReadOut", + num_ops, + fails); + + memset(dataBufIn, 0xFF, sizeof(dataBufIn)); + respPtr->base.responseCode = TPM_SUCCESS; + runTpmUnmarshalFailTest(TRUSTEDBOOT::TPM_CC_PCR_Read, + dataBufIn, + sizeof(dataBufIn), + baseCmd, + sizeof(TPM2_PcrReadOut), + "PcrReadOut - xFF buffer", + num_ops, + fails); + + } @@ -689,6 +788,67 @@ class TrustedBootTest: public CxxTest::TestSuite } } + /** + * @brief TPM Read PCR + */ + void testReadPCR ( void ) + { + int64_t fails = 0, num_ops = 0; + uint8_t digest[TPM_ALG_SHA256_SIZE]; + errlHndl_t err = NULL; + + TRACFCOMP( g_trac_trustedboot, + "testReadPCR - Start" ); + TpmTarget target = getTestTarget(); + + do + { + + if (target.failed) + { + TS_FAIL( "testReadPCR - Master TPM not functional" ); + break; + } + + memset(digest, 0, sizeof(digest)); + + num_ops++; + err = tpmCmdPcrRead(&target, + PCR_DEBUG, + TPM_ALG_SHA256, + digest, + sizeof(digest)); + if( NULL != err ) + { + fails++; + TS_FAIL( "testReadPCR - Error detected" ); + errlCommit( err, + SECURE_COMP_ID ); + delete err; + err = NULL; + break; + } + else + { + TRACUCOMP(g_trac_trustedboot, "testReadPCR - " + "Read returned as expected."); + TRACUBIN(g_trac_trustedboot, "PCR Contents", + digest, sizeof(digest)); + } + + + + } while( 0 ); + TRACFCOMP( g_trac_trustedboot, + "testReadPCR - End: %d/%d fails", + fails, num_ops ); + + if (NULL != target.logMgr) + { + delete target.logMgr; + } + } + }; diff --git a/src/usr/secureboot/trusted/trustedTypes.C b/src/usr/secureboot/trusted/trustedTypes.C index 555efc141..331031ade 100644 --- a/src/usr/secureboot/trusted/trustedTypes.C +++ b/src/usr/secureboot/trusted/trustedTypes.C @@ -294,6 +294,185 @@ namespace TRUSTEDBOOT i_tpmBufSize, io_cmdSize)); } + uint8_t* TPMS_PCR_SELECTION_marshal(TPMS_PCR_SELECTION* val, + uint8_t* o_tpmBuf, + size_t i_tpmBufSize, + size_t* io_cmdSize) + { + o_tpmBuf = marshalChunk(o_tpmBuf, i_tpmBufSize, io_cmdSize, + &(val->algorithmId), sizeof(val->algorithmId)); + o_tpmBuf = marshalChunk(o_tpmBuf, i_tpmBufSize, io_cmdSize, + &(val->sizeOfSelect), sizeof(val->sizeOfSelect)); + + if (NULL != o_tpmBuf && + PCR_SELECT_MAX < val->sizeOfSelect) + { + return NULL; + } + + o_tpmBuf = marshalChunk(o_tpmBuf, i_tpmBufSize, io_cmdSize, + val->pcrSelect, val->sizeOfSelect); + return o_tpmBuf; + } + + uint8_t* TPMS_PCR_SELECTION_unmarshal(TPMS_PCR_SELECTION* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize) + { + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &(val->algorithmId), + sizeof(val->algorithmId)); + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &(val->sizeOfSelect), + sizeof(val->sizeOfSelect)); + if (NULL != i_tpmBuf && + PCR_SELECT_MAX < val->sizeOfSelect) + { + return NULL; + } + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + val->pcrSelect, val->sizeOfSelect); + + return i_tpmBuf; + } + + uint8_t* TPM2B_DIGEST_unmarshal(TPM2B_DIGEST* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize) + { + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &val->size, sizeof(val->size)); + if (NULL != i_tpmBuf && + sizeof(TPMU_HA) < val->size) + { + TRACUCOMP( g_trac_trustedboot, + "TPM2B_DIGEST::unmarshal invalid size"); + return NULL; + } + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + val->buffer, val->size); + return i_tpmBuf; + + } + + uint8_t* TPML_DIGEST_unmarshal(TPML_DIGEST* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize) + { + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &(val->count), sizeof(val->count)); + if (NULL != i_tpmBuf && HASH_COUNT < val->count) + { + TRACUCOMP( g_trac_trustedboot, + "TPML_DIGEST::unmarshal invalid count %d", val->count); + i_tpmBuf = NULL; + } + else if (NULL != i_tpmBuf) + { + for (size_t idx = 0; idx < val->count; idx++) + { + i_tpmBuf = TPM2B_DIGEST_unmarshal(&(val->digests[idx]), + i_tpmBuf, + io_tpmBufSize); + if (NULL == i_tpmBuf) + { + break; + } + } + } + return i_tpmBuf; + + } + + uint8_t* TPML_PCR_SELECTION_marshal(TPML_PCR_SELECTION* val, + uint8_t* o_tpmBuf, + size_t i_tpmBufSize, + size_t* io_cmdSize) + { + o_tpmBuf = marshalChunk(o_tpmBuf, i_tpmBufSize, io_cmdSize, + &(val->count), sizeof(val->count)); + if (NULL != o_tpmBuf && HASH_COUNT < val->count) + { + TRACUCOMP( g_trac_trustedboot, + "TPML_PCR_SELECTION::marshal invalid count"); + o_tpmBuf = NULL; + } + else if (NULL != o_tpmBuf) + { + for (size_t idx = 0; idx < val->count; idx++) + { + o_tpmBuf = TPMS_PCR_SELECTION_marshal( + &(val->pcrSelections[idx]), + o_tpmBuf, + i_tpmBufSize, + io_cmdSize); + if (NULL == o_tpmBuf) + { + break; + } + } + } + return o_tpmBuf; + } + + uint8_t* TPML_PCR_SELECTION_unmarshal(TPML_PCR_SELECTION* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize) + { + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &(val->count), sizeof(val->count)); + if (NULL != i_tpmBuf && HASH_COUNT < val->count) + { + TRACUCOMP( g_trac_trustedboot, + "TPML_PCR_SELECTION::unmarshal invalid count"); + i_tpmBuf = NULL; + } + else if (NULL != i_tpmBuf) + { + for (size_t idx = 0; idx < val->count; idx++) + { + i_tpmBuf = TPMS_PCR_SELECTION_unmarshal( + &(val->pcrSelections[idx]), + i_tpmBuf, + io_tpmBufSize); + if (NULL == i_tpmBuf) + { + break; + } + } + } + return i_tpmBuf; + + } + + uint8_t* TPM2_PcrReadIn_marshal(TPM2_PcrReadIn* val, + uint8_t* o_tpmBuf, + size_t i_tpmBufSize, + size_t* io_cmdSize) + { + // Base and handle has already been marshaled + return (TPML_PCR_SELECTION_marshal(&(val->pcrSelectionIn), o_tpmBuf, + i_tpmBufSize, io_cmdSize)); + } + + uint8_t* TPM2_PcrReadOut_unmarshal(TPM2_PcrReadOut* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize, + size_t i_outBufSize) + { + // Base and handle has already been marshaled + if (sizeof(TPM2_PcrReadOut) > i_outBufSize) return NULL; + i_tpmBuf = unmarshalChunk(i_tpmBuf, io_tpmBufSize, + &(val->pcrUpdateCounter), + sizeof(val->pcrUpdateCounter)); + + i_tpmBuf = TPML_PCR_SELECTION_unmarshal(&(val->pcrSelectionOut), + i_tpmBuf, io_tpmBufSize); + i_tpmBuf = TPML_DIGEST_unmarshal(&(val->pcrValues), i_tpmBuf, + io_tpmBufSize); + return i_tpmBuf; + + } uint8_t* TPMS_AUTH_COMMAND_marshal(TPMS_AUTH_COMMAND* val, uint8_t* o_tpmBuf, diff --git a/src/usr/secureboot/trusted/trustedTypes.H b/src/usr/secureboot/trusted/trustedTypes.H index d3f98dec0..b74600652 100644 --- a/src/usr/secureboot/trusted/trustedTypes.H +++ b/src/usr/secureboot/trusted/trustedTypes.H @@ -78,7 +78,9 @@ namespace TRUSTEDBOOT MAX_TPM_LOG_MSG = 128, ///< Maximum log message size HASH_COUNT = 1, ///< Maximum # of digests - PCR_SELECT_MAX = ((PCR_MAX+7)/8), ///< PCR selection octet max + + PCR_SELECT_MAX = (IMPLEMENTATION_PCR+7)/8, ///< PCR selection octet max + }; typedef enum @@ -348,6 +350,77 @@ namespace TRUSTEDBOOT uint8_t* o_tpmBuf, size_t i_tpmBufSize, size_t* io_cmdSize); + struct _TPMS_PCR_SELECTION + { + uint16_t algorithmId; ///< ID of hashing algorithm + uint8_t sizeOfSelect; ///< Byte size of pcrSelect array + uint8_t pcrSelect[PCR_SELECT_MAX]; + } PACKED; + typedef struct _TPMS_PCR_SELECTION TPMS_PCR_SELECTION; + uint8_t* TPMS_PCR_SELECTION_marshal(TPMS_PCR_SELECTION* val, + uint8_t* o_tpmBuf, size_t i_tpmBufSize, + size_t* io_cmdSize); + uint8_t* TPMS_PCR_SELECTION_unmarshal(TPMS_PCR_SELECTION* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize); + + + struct _TPM2B_DIGEST + { + uint16_t size; + uint8_t buffer[sizeof(TPMU_HA)]; + } PACKED; + typedef struct _TPM2B_DIGEST TPM2B_DIGEST; + uint8_t* TPM2B_DIGEST_unmarshal(TPM2B_DIGEST* val, + uint8_t* i_tpmBuf, size_t* io_tpmBufSize); + + struct _TPML_DIGEST + { + uint32_t count; + TPM2B_DIGEST digests[HASH_COUNT]; + } PACKED; + typedef struct _TPML_DIGEST TPML_DIGEST; + uint8_t* TPML_DIGEST_unmarshal(TPML_DIGEST* val, + uint8_t* i_tpmBuf, size_t* io_tpmBufSize); + + struct _TPML_PCR_SELECTION + { + uint32_t count; + TPMS_PCR_SELECTION pcrSelections[HASH_COUNT]; + } PACKED; + typedef struct _TPML_PCR_SELECTION TPML_PCR_SELECTION; + uint8_t* TPML_PCR_SELECTION_marshal(TPML_PCR_SELECTION* val, + uint8_t* o_tpmBuf, size_t i_tpmBufSize, + size_t* io_cmdSize); + uint8_t* TPML_PCR_SELECTION_unmarshal(TPML_PCR_SELECTION* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize); + + /// Incoming PCR_Read structure + struct _TPM2_PcrReadIn + { + TPM2_BaseIn base; + TPML_PCR_SELECTION pcrSelectionIn; + } PACKED; + typedef struct _TPM2_PcrReadIn TPM2_PcrReadIn; + uint8_t* TPM2_PcrReadIn_marshal(TPM2_PcrReadIn* val, + uint8_t* o_tpmBuf, size_t i_tpmBufSize, + size_t* io_cmdSize); + + /// Outgoing Pcr_Read structure + struct _TPM2_PcrReadOut + { + TPM2_BaseOut base; + uint32_t pcrUpdateCounter; + TPML_PCR_SELECTION pcrSelectionOut; + TPML_DIGEST pcrValues; + } PACKED; + typedef struct _TPM2_PcrReadOut TPM2_PcrReadOut; + uint8_t* TPM2_PcrReadOut_unmarshal(TPM2_PcrReadOut* val, + uint8_t* i_tpmBuf, + size_t* io_tpmBufSize, + size_t i_outBufSize); + /// TPM Authorization structure /// This is not the full structure and only works for PW auth with NULL PW struct _TPMS_AUTH_COMMAND diff --git a/src/usr/secureboot/trusted/trustedbootCmds.C b/src/usr/secureboot/trusted/trustedbootCmds.C index 611708c2e..d498af25d 100644 --- a/src/usr/secureboot/trusted/trustedbootCmds.C +++ b/src/usr/secureboot/trusted/trustedbootCmds.C @@ -212,6 +212,15 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd, i_bufsize, o_cmdSize); } break; + case TPM_CC_PCR_Read: + { + TPM2_PcrReadIn* cmdPtr = (TPM2_PcrReadIn*)i_cmd; + sBuf = TPM2_PcrReadIn_marshal(cmdPtr, sBuf, + i_bufsize - (sBuf - o_outbuf), + o_cmdSize); + } + break; + case TPM_CC_PCR_Extend: { TPM2_ExtendIn* cmdPtr = (TPM2_ExtendIn*)i_cmd; @@ -254,7 +263,7 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd, { TRACFCOMP( g_trac_trustedboot, "TPM MARSHAL MARSHAL SIZE MISMATCH : %d %d", - (sBuf - o_outbuf), *o_cmdSize ); + (int)(sBuf - o_outbuf), (int)(*o_cmdSize) ); sBuf = NULL; } @@ -357,6 +366,15 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode, } break; + case TPM_CC_PCR_Read: + { + TPM2_PcrReadOut* respPtr = (TPM2_PcrReadOut*)o_outBuf; + sBuf = TPM2_PcrReadOut_unmarshal(respPtr, sBuf, + &i_respBufSize, + i_outBufSize); + } + break; + default: { // Command code not supported @@ -733,7 +751,7 @@ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target, if (fullDigestSize == 0 || fullDigestSize != i_digestSize || NULL == i_digest || - PCR_MAX < i_pcr + IMPLEMENTATION_PCR < i_pcr ) { TRACFCOMP( g_trac_trustedboot, @@ -815,6 +833,132 @@ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target, } +errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, + TPM_Pcr i_pcr, + TPM_Alg_Id i_algId, + uint8_t* o_digest, + size_t i_digestSize) +{ + errlHndl_t err = NULL; + uint8_t dataBuf[sizeof(TPM2_PcrReadOut)]; + size_t dataSize = sizeof(dataBuf); + size_t fullDigestSize = 0; + TPM2_PcrReadOut* resp = (TPM2_PcrReadOut*)dataBuf; + TPM2_PcrReadIn* cmd = (TPM2_PcrReadIn*)dataBuf; + + + TRACDCOMP( g_trac_trustedboot, + ">>tpmCmdPcrRead()" ); + TRACUCOMP( g_trac_trustedboot, + ">>tpmCmdPcrRead() Pcr(%d) DS(%d)", + i_pcr, (int)i_digestSize); + + do + { + + fullDigestSize = getDigestSize(i_algId); + + // Build our command block + memset(dataBuf, 0, sizeof(dataBuf)); + + // Argument verification + if (fullDigestSize > i_digestSize || + NULL == o_digest || + IMPLEMENTATION_PCR < i_pcr + ) + { + TRACFCOMP( g_trac_trustedboot, + "TPM PCR READ ARG FAILURE FDS(%d) DS(%d) PCR(%d)", + (int)fullDigestSize, (int)i_digestSize, i_pcr); + /*@ + * @errortype + * @reasoncode RC_TPM_INVALID_ARGS + * @severity ERRL_SEV_UNRECOVERABLE + * @moduleid MOD_TPM_CMD_PCRREAD + * @userdata1 Digest Ptr + * @userdata2[0:31] Full Digest Size + * @userdata2[32:63] PCR + * @devdesc Unmarshaling error detected + */ + err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD, + RC_TPM_INVALID_ARGS, + (uint64_t)o_digest, + (fullDigestSize << 32) | + i_pcr); + + break; + } + + cmd->base.tag = TPM_ST_NO_SESSIONS; + cmd->base.commandCode = TPM_CC_PCR_Read; + cmd->pcrSelectionIn.count = 1; // One algorithm + cmd->pcrSelectionIn.pcrSelections[0].algorithmId = i_algId; + cmd->pcrSelectionIn.pcrSelections[0].sizeOfSelect = PCR_SELECT_MAX; + memset(cmd->pcrSelectionIn.pcrSelections[0].pcrSelect, 0, + sizeof(cmd->pcrSelectionIn.pcrSelections[0].pcrSelect)); + cmd->pcrSelectionIn.pcrSelections[0].pcrSelect[i_pcr / 8] = + 0x01 << (i_pcr % 8); + + err = tpmTransmitCommand(io_target, + dataBuf, + sizeof(dataBuf)); + + if (TB_SUCCESS != err) + { + TRACFCOMP( g_trac_trustedboot, + "TPM PCRRead Transmit Fail "); + break; + + } + else if ((sizeof(TPM2_BaseOut) > dataSize) || + (TPM_SUCCESS != resp->base.responseCode) || + (resp->pcrValues.count != 1) || + (resp->pcrValues.digests[0].size != fullDigestSize)) + { + TRACFCOMP( g_trac_trustedboot, + "TPM PCRRead OP Fail Ret(%X) ExSize(%d) " + "Size(%d) Cnt(%d) DSize(%d)", + resp->base.responseCode, + (int)sizeof(TPM2_BaseOut), + (int)dataSize, + resp->pcrValues.count, + resp->pcrValues.digests[0].size); + + /*@ + * @errortype + * @reasoncode RC_TPM_COMMAND_FAIL + * @severity ERRL_SEV_UNRECOVERABLE + * @moduleid MOD_TPM_CMD_PCRREAD + * @userdata1 responseCode + * @userdata2 dataSize + * @devdesc Command failure reading TPM FW version. + */ + err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD, + RC_TPM_COMMAND_FAIL, + resp->base.responseCode, + dataSize); + break; + } + else + { + + memcpy(o_digest, resp->pcrValues.digests[0].buffer, fullDigestSize); + + // Log the PCR value + TRACUBIN(g_trac_trustedboot, "PCR Out", + o_digest, fullDigestSize); + + } + + } while ( 0 ); + + + TRACUCOMP( g_trac_trustedboot, + "<<tpmCmdPcrRead() - %s", + ((TB_SUCCESS == err) ? "No Error" : "With Error") ); + return err; + +} #ifdef __cplusplus diff --git a/src/usr/secureboot/trusted/trustedbootCmds.H b/src/usr/secureboot/trusted/trustedbootCmds.H index 8b68e23c4..53c7f453e 100644 --- a/src/usr/secureboot/trusted/trustedbootCmds.H +++ b/src/usr/secureboot/trusted/trustedbootCmds.H @@ -119,6 +119,8 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target); * @param[in] i_algId Algorithm to use * @param[in] i_digest Digest value to write to PCR, zeros appended as needed * @param[in] i_digestSize Byte size of i_digest array + * @return errlHndl_t NULL if successful, otherwise a pointer to the + * error log. */ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target, TPM_Pcr i_pcr, @@ -126,6 +128,21 @@ errlHndl_t tpmCmdPcrExtend(TpmTarget * io_target, uint8_t* i_digest, size_t i_digestSize); +/** + * @brief Send the TPM_Read command to the targeted TPM and log + * @param[in/out] io_target Current TPM target structure + * @param[in] i_pcr PCR to read from + * @param[in] i_algId Algorithm back to read from + * @param[out] o_digest Array to store PCR contents + * @param[in] i_digestSize Byte size of i_digest array + * @return errlHndl_t NULL if successful, otherwise a pointer to the + * error log. + */ +errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, + TPM_Pcr i_pcr, + TPM_Alg_Id i_algId, + uint8_t* o_digest, + size_t i_digestSize); #ifdef __cplusplus } // end TRUSTEDBOOT namespace |