You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
120 lines
4.5 KiB
120 lines
4.5 KiB
// This file was extracted from the TCG Published |
|
// Trusted Platform Module Library |
|
// Part 4: Supporting Routines |
|
// Family "2.0" |
|
// Level 00 Revision 01.16 |
|
// October 30, 2014 |
|
|
|
#include "InternalRoutines.h" |
|
#include "NV_spt_fp.h" |
|
// |
|
// |
|
// Fuctions |
|
// |
|
// NvReadAccessChecks() |
|
// |
|
// Common routine for validating a read Used by TPM2_NV_Read(), TPM2_NV_ReadLock() and |
|
// TPM2_PolicyNV() |
|
// |
|
// Error Returns Meaning |
|
// |
|
// TPM_RC_NV_AUTHORIZATION autHandle is not allowed to authorize read of the index |
|
// TPM_RC_NV_LOCKED Read locked |
|
// TPM_RC_NV_UNINITIALIZED Try to read an uninitialized index |
|
// |
|
TPM_RC |
|
NvReadAccessChecks( |
|
TPM_HANDLE authHandle, // IN: the handle that provided the |
|
// authorization |
|
TPM_HANDLE nvHandle // IN: the handle of the NV index to be written |
|
) |
|
{ |
|
NV_INDEX nvIndex; |
|
// Get NV index info |
|
NvGetIndexInfo(nvHandle, &nvIndex); |
|
// This check may be done before doing authorization checks as is done in this |
|
// version of the reference code. If not done there, then uncomment the next |
|
// three lines. |
|
// // If data is read locked, returns an error |
|
// if(nvIndex.publicArea.attributes.TPMA_NV_READLOCKED == SET) |
|
// return TPM_RC_NV_LOCKED; |
|
// If the authorization was provided by the owner or platform, then check |
|
// that the attributes allow the read. If the authorization handle |
|
// is the same as the index, then the checks were made when the authorization |
|
// was checked.. |
|
if(authHandle == TPM_RH_OWNER) |
|
{ |
|
// If Owner provided auth then ONWERWRITE must be SET |
|
if(! nvIndex.publicArea.attributes.TPMA_NV_OWNERREAD) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
} |
|
else if(authHandle == TPM_RH_PLATFORM) |
|
{ |
|
// If Platform provided auth then PPWRITE must be SET |
|
if(!nvIndex.publicArea.attributes.TPMA_NV_PPREAD) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
} |
|
// If neither Owner nor Platform provided auth, make sure that it was |
|
// provided by this index. |
|
else if(authHandle != nvHandle) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
// If the index has not been written, then the value cannot be read |
|
// NOTE: This has to come after other access checks to make sure that |
|
// the proper authorization is given to TPM2_NV_ReadLock() |
|
if(nvIndex.publicArea.attributes.TPMA_NV_WRITTEN == CLEAR) |
|
return TPM_RC_NV_UNINITIALIZED; |
|
return TPM_RC_SUCCESS; |
|
} |
|
// |
|
// |
|
// NvWriteAccessChecks() |
|
// |
|
// Common routine for validating a write Used by TPM2_NV_Write(), TPM2_NV_Increment(), |
|
// TPM2_SetBits(), and TPM2_NV_WriteLock() |
|
// |
|
// |
|
// |
|
// |
|
// Error Returns Meaning |
|
// |
|
// TPM_RC_NV_AUTHORIZATION Authorization fails |
|
// TPM_RC_NV_LOCKED Write locked |
|
// |
|
TPM_RC |
|
NvWriteAccessChecks( |
|
TPM_HANDLE authHandle, // IN: the handle that provided the |
|
// authorization |
|
TPM_HANDLE nvHandle // IN: the handle of the NV index to be written |
|
) |
|
{ |
|
NV_INDEX nvIndex; |
|
// Get NV index info |
|
NvGetIndexInfo(nvHandle, &nvIndex); |
|
// This check may be done before doing authorization checks as is done in this |
|
// version of the reference code. If not done there, then uncomment the next |
|
// three lines. |
|
// // If data is write locked, returns an error |
|
// if(nvIndex.publicArea.attributes.TPMA_NV_WRITELOCKED == SET) |
|
// return TPM_RC_NV_LOCKED; |
|
// If the authorization was provided by the owner or platform, then check |
|
// that the attributes allow the write. If the authorization handle |
|
// is the same as the index, then the checks were made when the authorization |
|
// was checked.. |
|
if(authHandle == TPM_RH_OWNER) |
|
{ |
|
// If Owner provided auth then ONWERWRITE must be SET |
|
if(! nvIndex.publicArea.attributes.TPMA_NV_OWNERWRITE) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
} |
|
else if(authHandle == TPM_RH_PLATFORM) |
|
{ |
|
// If Platform provided auth then PPWRITE must be SET |
|
if(!nvIndex.publicArea.attributes.TPMA_NV_PPWRITE) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
} |
|
// If neither Owner nor Platform provided auth, make sure that it was |
|
// provided by this index. |
|
else if(authHandle != nvHandle) |
|
return TPM_RC_NV_AUTHORIZATION; |
|
return TPM_RC_SUCCESS; |
|
}
|
|
|