|
|
// This file was extracted from the TCG Published |
|
|
// Trusted Platform Module Library |
|
|
// Part 4: Supporting Routines |
|
|
// Family "2.0" |
|
|
// Level 00 Revision 01.16 |
|
|
// October 30, 2014 |
|
|
|
|
|
#define PCR_C |
|
|
#include "InternalRoutines.h" |
|
|
#include "Platform.h" |
|
|
// |
|
|
// The initial value of PCR attributes. The value of these fields should be consistent with PC Client |
|
|
// specification In this implementation, we assume the total number of implemented PCR is 24. |
|
|
// |
|
|
static const PCR_Attributes s_initAttributes[] = |
|
|
{ |
|
|
// PCR 0 - 15, static RTM |
|
|
{1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, |
|
|
{1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, |
|
|
{1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, |
|
|
{1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, {1, 0, 0x1F}, |
|
|
{0, 0x0F, 0x1F}, // PCR 16, Debug |
|
|
{0, 0x10, 0x1C}, // PCR 17, Locality 4 |
|
|
{0, 0x10, 0x1C}, // PCR 18, Locality 3 |
|
|
{0, 0x10, 0x0C}, // PCR 19, Locality 2 |
|
|
{0, 0x1C, 0x0E}, // PCR 20, Locality 1 |
|
|
{0, 0x1C, 0x04}, // PCR 21, Dynamic OS |
|
|
{0, 0x1C, 0x04}, // PCR 22, Dynamic OS |
|
|
{0, 0x0F, 0x1F}, // PCR 23, App specific |
|
|
{0, 0x0F, 0x1F} // PCR 24, testing policy |
|
|
}; |
|
|
// |
|
|
// |
|
|
// Functions |
|
|
// |
|
|
// PCRBelongsAuthGroup() |
|
|
// |
|
|
// This function indicates if a PCR belongs to a group that requires an authValue in order to modify the |
|
|
// PCR. If it does, groupIndex is set to value of the group index. This feature of PCR is decided by the |
|
|
// platform specification. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE: PCR belongs an auth group |
|
|
// FALSE: PCR does not belong an auth group |
|
|
// |
|
|
BOOL |
|
|
PCRBelongsAuthGroup( |
|
|
TPMI_DH_PCR handle, // IN: handle of PCR |
|
|
UINT32 *groupIndex // OUT: group index if PCR belongs a |
|
|
// group that allows authValue. If PCR |
|
|
// does not belong to an auth group, |
|
|
// the value in this parameter is |
|
|
// invalid |
|
|
) |
|
|
{ |
|
|
// None of the PCRs belong to a group requiring an authValue, as defined in |
|
|
// Table 4 "PCR Attributes" of the "TCG PC Client Platform TPM Profile (TPT) |
|
|
// Specification Level 00 Revision 00.43". |
|
|
return FALSE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRBelongsPolicyGroup() |
|
|
// |
|
|
// This function indicates if a PCR belongs to a group that requires a policy authorization in order to modify |
|
|
// the PCR. If it does, groupIndex is set to value of the group index. This feature of PCR is decided by the |
|
|
// platform specification. |
|
|
// Family "2.0" TCG Published Page 169 |
|
|
// Level 00 Revision 01.16 Copyright © TCG 2006-2014 October 30, 2014 |
|
|
// Trusted Platform Module Library Part 4: Supporting Routines |
|
|
// |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE: PCR belongs a policy group |
|
|
// FALSE: PCR does not belong a policy group |
|
|
// |
|
|
BOOL |
|
|
PCRBelongsPolicyGroup( |
|
|
TPMI_DH_PCR handle, // IN: handle of PCR |
|
|
UINT32 *groupIndex // OUT: group index if PCR belongs a group that |
|
|
// allows policy. If PCR does not belong to |
|
|
// a policy group, the value in this |
|
|
// parameter is invalid |
|
|
) |
|
|
{ |
|
|
// None of the PCRs belong to the policy group, as defined in Table 4 |
|
|
// "PCR Attributes" of the "TCG PC Client Platform TPM Profile (TPT) |
|
|
// Specification Level 00 Revision 00.43". |
|
|
return FALSE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRBelongsTCBGroup() |
|
|
// |
|
|
// This function indicates if a PCR belongs to the TCB group. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE: PCR belongs to TCB group |
|
|
// FALSE: PCR does not belong to TCB group |
|
|
// |
|
|
static BOOL |
|
|
PCRBelongsTCBGroup( |
|
|
TPMI_DH_PCR handle // IN: handle of PCR |
|
|
) |
|
|
{ |
|
|
#if ENABLE_PCR_NO_INCREMENT == YES |
|
|
// Platform specification decides if a PCR belongs to a TCB group. In this |
|
|
// implementation, we assume PCR[16, 21-23] belong to TCB group as defined |
|
|
// in Table 4. If the platform specification requires differently, the |
|
|
// implementation should be changed accordingly |
|
|
if(handle == 16 || (handle >= 21 && handle <= 23)) |
|
|
return TRUE; |
|
|
#endif |
|
|
return FALSE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRPolicyIsAvailable() |
|
|
// |
|
|
// This function indicates if a policy is available for a PCR. |
|
|
// |
|
|
// |
|
|
// |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE the PCR should be authorized by policy |
|
|
// FALSE the PCR does not allow policy |
|
|
// |
|
|
BOOL |
|
|
PCRPolicyIsAvailable( |
|
|
TPMI_DH_PCR handle // IN: PCR handle |
|
|
) |
|
|
{ |
|
|
UINT32 groupIndex; |
|
|
return PCRBelongsPolicyGroup(handle, &groupIndex); |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRGetAuthValue() |
|
|
// |
|
|
// This function is used to access the authValue of a PCR. If PCR does not belong to an authValue group, |
|
|
// an Empty Auth will be returned. |
|
|
// |
|
|
void |
|
|
PCRGetAuthValue( |
|
|
TPMI_DH_PCR handle, // IN: PCR handle |
|
|
TPM2B_AUTH *auth // OUT: authValue of PCR |
|
|
) |
|
|
{ |
|
|
UINT32 groupIndex; |
|
|
if(PCRBelongsAuthGroup(handle, &groupIndex)) |
|
|
{ |
|
|
*auth = gc.pcrAuthValues.auth[groupIndex]; |
|
|
} |
|
|
else |
|
|
{ |
|
|
auth->t.size = 0; |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRGetAuthPolicy() |
|
|
// |
|
|
// This function is used to access the authorization policy of a PCR. It sets policy to the authorization policy |
|
|
// and returns the hash algorithm for policy If the PCR does not allow a policy, TPM_ALG_NULL is returned. |
|
|
// |
|
|
TPMI_ALG_HASH |
|
|
PCRGetAuthPolicy( |
|
|
TPMI_DH_PCR handle, // IN: PCR handle |
|
|
TPM2B_DIGEST *policy // OUT: policy of PCR |
|
|
) |
|
|
{ |
|
|
UINT32 groupIndex; |
|
|
if(PCRBelongsPolicyGroup(handle, &groupIndex)) |
|
|
{ |
|
|
*policy = gp.pcrPolicies.policy[groupIndex]; |
|
|
return gp.pcrPolicies.hashAlg[groupIndex]; |
|
|
} |
|
|
else |
|
|
{ |
|
|
policy->t.size = 0; |
|
|
return TPM_ALG_NULL; |
|
|
} |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRSimStart() |
|
|
// |
|
|
// This function is used to initialize the policies when a TPM is manufactured. This function would only be |
|
|
// called in a manufacturing environment or in a TPM simulator. |
|
|
// |
|
|
void |
|
|
PCRSimStart( |
|
|
void |
|
|
) |
|
|
{ |
|
|
UINT32 i; |
|
|
for(i = 0; i < NUM_POLICY_PCR_GROUP; i++) |
|
|
{ |
|
|
gp.pcrPolicies.hashAlg[i] = TPM_ALG_NULL; |
|
|
gp.pcrPolicies.policy[i].t.size = 0; |
|
|
} |
|
|
for(i = 0; i < NUM_AUTHVALUE_PCR_GROUP; i++) |
|
|
{ |
|
|
gc.pcrAuthValues.auth[i].t.size = 0; |
|
|
} |
|
|
// We need to give an initial configuration on allocated PCR before |
|
|
// receiving any TPM2_PCR_Allocate command to change this configuration |
|
|
// When the simulation environment starts, we allocate all the PCRs |
|
|
for(gp.pcrAllocated.count = 0; gp.pcrAllocated.count < HASH_COUNT; |
|
|
gp.pcrAllocated.count++) |
|
|
{ |
|
|
gp.pcrAllocated.pcrSelections[gp.pcrAllocated.count].hash |
|
|
= CryptGetHashAlgByIndex(gp.pcrAllocated.count); |
|
|
gp.pcrAllocated.pcrSelections[gp.pcrAllocated.count].sizeofSelect |
|
|
= PCR_SELECT_MAX; |
|
|
for(i = 0; i < PCR_SELECT_MAX; i++) |
|
|
gp.pcrAllocated.pcrSelections[gp.pcrAllocated.count].pcrSelect[i] |
|
|
= 0xFF; |
|
|
} |
|
|
// Store the initial configuration to NV |
|
|
NvWriteReserved(NV_PCR_POLICIES, &gp.pcrPolicies); |
|
|
NvWriteReserved(NV_PCR_ALLOCATED, &gp.pcrAllocated); |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// GetSavedPcrPointer() |
|
|
// |
|
|
// This function returns the address of an array of state saved PCR based on the hash algorithm. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// NULL no such algorithm |
|
|
// not NULL pointer to the 0th byte of the 0th PCR |
|
|
// |
|
|
static BYTE * |
|
|
GetSavedPcrPointer ( |
|
|
TPM_ALG_ID alg, // IN: algorithm for bank |
|
|
UINT32 pcrIndex // IN: PCR index in PCR_SAVE |
|
|
) |
|
|
{ |
|
|
switch(alg) |
|
|
{ |
|
|
#ifdef TPM_ALG_SHA1 |
|
|
case TPM_ALG_SHA1: |
|
|
return gc.pcrSave.sha1[pcrIndex]; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA256 |
|
|
case TPM_ALG_SHA256: |
|
|
return gc.pcrSave.sha256[pcrIndex]; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA384 |
|
|
case TPM_ALG_SHA384: |
|
|
return gc.pcrSave.sha384[pcrIndex]; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA512 |
|
|
case TPM_ALG_SHA512: |
|
|
return gc.pcrSave.sha512[pcrIndex]; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SM3_256 |
|
|
case TPM_ALG_SM3_256: |
|
|
return gc.pcrSave.sm3_256[pcrIndex]; |
|
|
break; |
|
|
#endif |
|
|
default: |
|
|
FAIL(FATAL_ERROR_INTERNAL); |
|
|
} |
|
|
return NULL; // Never reached. |
|
|
} |
|
|
// |
|
|
// |
|
|
// PcrIsAllocated() |
|
|
// |
|
|
// This function indicates if a PCR number for the particular hash algorithm is allocated. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// FALSE PCR is not allocated |
|
|
// TRUE PCR is allocated |
|
|
// |
|
|
BOOL |
|
|
PcrIsAllocated ( |
|
|
UINT32 pcr, // IN: The number of the PCR |
|
|
TPMI_ALG_HASH hashAlg // IN: The PCR algorithm |
|
|
) |
|
|
{ |
|
|
UINT32 i; |
|
|
BOOL allocated = FALSE; |
|
|
if(pcr < IMPLEMENTATION_PCR) |
|
|
{ |
|
|
for(i = 0; i < gp.pcrAllocated.count; i++) |
|
|
{ |
|
|
if(gp.pcrAllocated.pcrSelections[i].hash == hashAlg) |
|
|
{ |
|
|
if(((gp.pcrAllocated.pcrSelections[i].pcrSelect[pcr/8]) |
|
|
& (1 << (pcr % 8))) != 0) |
|
|
// |
|
|
allocated = TRUE; |
|
|
else |
|
|
allocated = FALSE; |
|
|
break; |
|
|
} |
|
|
} |
|
|
} |
|
|
return allocated; |
|
|
} |
|
|
// |
|
|
// |
|
|
// GetPcrPointer() |
|
|
// |
|
|
// This function returns the address of an array of PCR based on the hash algorithm. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// NULL no such algorithm |
|
|
// not NULL pointer to the 0th byte of the 0th PCR |
|
|
// |
|
|
static BYTE * |
|
|
GetPcrPointer ( |
|
|
TPM_ALG_ID alg, // IN: algorithm for bank |
|
|
UINT32 pcrNumber // IN: PCR number |
|
|
) |
|
|
{ |
|
|
static BYTE *pcr = NULL; |
|
|
if(!PcrIsAllocated(pcrNumber, alg)) |
|
|
return NULL; |
|
|
switch(alg) |
|
|
{ |
|
|
#ifdef TPM_ALG_SHA1 |
|
|
case TPM_ALG_SHA1: |
|
|
pcr = s_pcrs[pcrNumber].sha1Pcr; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA256 |
|
|
case TPM_ALG_SHA256: |
|
|
pcr = s_pcrs[pcrNumber].sha256Pcr; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA384 |
|
|
case TPM_ALG_SHA384: |
|
|
pcr = s_pcrs[pcrNumber].sha384Pcr; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SHA512 |
|
|
case TPM_ALG_SHA512: |
|
|
pcr = s_pcrs[pcrNumber].sha512Pcr; |
|
|
break; |
|
|
#endif |
|
|
#ifdef TPM_ALG_SM3_256 |
|
|
case TPM_ALG_SM3_256: |
|
|
pcr = s_pcrs[pcrNumber].sm3_256Pcr; |
|
|
break; |
|
|
#endif |
|
|
default: |
|
|
pAssert(FALSE); |
|
|
break; |
|
|
} |
|
|
return pcr; |
|
|
// |
|
|
} |
|
|
// |
|
|
// |
|
|
// IsPcrSelected() |
|
|
// |
|
|
// This function indicates if an indicated PCR number is selected by the bit map in selection. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// FALSE PCR is not selected |
|
|
// TRUE PCR is selected |
|
|
// |
|
|
static BOOL |
|
|
IsPcrSelected ( |
|
|
UINT32 pcr, // IN: The number of the PCR |
|
|
TPMS_PCR_SELECTION *selection // IN: The selection structure |
|
|
) |
|
|
{ |
|
|
BOOL selected = FALSE; |
|
|
if( pcr < IMPLEMENTATION_PCR |
|
|
&& ((selection->pcrSelect[pcr/8]) & (1 << (pcr % 8))) != 0) |
|
|
selected = TRUE; |
|
|
return selected; |
|
|
} |
|
|
// |
|
|
// |
|
|
// FilterPcr() |
|
|
// |
|
|
// This function modifies a PCR selection array based on the implemented PCR. |
|
|
// |
|
|
static void |
|
|
FilterPcr( |
|
|
TPMS_PCR_SELECTION *selection // IN: input PCR selection |
|
|
) |
|
|
{ |
|
|
UINT32 i; |
|
|
TPMS_PCR_SELECTION *allocated = NULL; |
|
|
// If size of select is less than PCR_SELECT_MAX, zero the unspecified PCR |
|
|
for(i = selection->sizeofSelect; i < PCR_SELECT_MAX; i++) |
|
|
selection->pcrSelect[i] = 0; |
|
|
// Find the internal configuration for the bank |
|
|
for(i = 0; i < gp.pcrAllocated.count; i++) |
|
|
{ |
|
|
if(gp.pcrAllocated.pcrSelections[i].hash == selection->hash) |
|
|
{ |
|
|
allocated = &gp.pcrAllocated.pcrSelections[i]; |
|
|
break; |
|
|
} |
|
|
} |
|
|
for (i = 0; i < selection->sizeofSelect; i++) |
|
|
{ |
|
|
if(allocated == NULL) |
|
|
{ |
|
|
// If the required bank does not exist, clear input selection |
|
|
selection->pcrSelect[i] = 0; |
|
|
} |
|
|
else |
|
|
selection->pcrSelect[i] &= allocated->pcrSelect[i]; |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PcrDrtm() |
|
|
// |
|
|
// This function does the DRTM and H-CRTM processing it is called from _TPM_Hash_End(). |
|
|
// |
|
|
void |
|
|
PcrDrtm( |
|
|
const TPMI_DH_PCR pcrHandle, // IN: the index of the PCR to be |
|
|
// modified |
|
|
const TPMI_ALG_HASH hash, // IN: the bank identifier |
|
|
const TPM2B_DIGEST *digest // IN: the digest to modify the PCR |
|
|
) |
|
|
{ |
|
|
BYTE *pcrData = GetPcrPointer(hash, pcrHandle); |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
// Rest the PCR to zeros |
|
|
MemorySet(pcrData, 0, digest->t.size); |
|
|
// if the TPM has not started, then set the PCR to 0...04 and then extend |
|
|
if(!TPMIsStarted()) |
|
|
{ |
|
|
pcrData[digest->t.size - 1] = 4; |
|
|
} |
|
|
// Now, extend the value |
|
|
PCRExtend(pcrHandle, hash, digest->t.size, (BYTE *)digest->t.buffer); |
|
|
} |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRStartup() |
|
|
// |
|
|
// This function initializes the PCR subsystem at TPM2_Startup(). |
|
|
// |
|
|
void |
|
|
PCRStartup( |
|
|
STARTUP_TYPE type, // IN: startup type |
|
|
BYTE locality // IN: startup locality |
|
|
) |
|
|
{ |
|
|
UINT32 pcr, j; |
|
|
UINT32 saveIndex = 0; |
|
|
g_pcrReConfig = FALSE; |
|
|
if(type != SU_RESUME) |
|
|
{ |
|
|
// PCR generation counter is cleared at TPM_RESET and TPM_RESTART |
|
|
gr.pcrCounter = 0; |
|
|
} |
|
|
// Initialize/Restore PCR values |
|
|
for(pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
// On resume, need to know if this PCR had its state saved or not |
|
|
UINT32 stateSaved = |
|
|
(type == SU_RESUME && s_initAttributes[pcr].stateSave == SET) ? 1 : 0; |
|
|
// If this is the H-CRTM PCR and we are not doing a resume and we |
|
|
// had an H-CRTM event, then we don't change this PCR |
|
|
if(pcr == HCRTM_PCR && type != SU_RESUME && g_DrtmPreStartup == TRUE) |
|
|
continue; |
|
|
// Iterate each hash algorithm bank |
|
|
for(j = 0; j < gp.pcrAllocated.count; j++) |
|
|
{ |
|
|
TPMI_ALG_HASH hash = gp.pcrAllocated.pcrSelections[j].hash; |
|
|
BYTE *pcrData = GetPcrPointer(hash, pcr); |
|
|
UINT16 pcrSize = CryptGetHashDigestSize(hash); |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
// if state was saved |
|
|
if(stateSaved == 1) |
|
|
{ |
|
|
// Restore saved PCR value |
|
|
BYTE *pcrSavedData; |
|
|
pcrSavedData = GetSavedPcrPointer( |
|
|
gp.pcrAllocated.pcrSelections[j].hash, |
|
|
saveIndex); |
|
|
MemoryCopy(pcrData, pcrSavedData, pcrSize, pcrSize); |
|
|
} |
|
|
else |
|
|
// PCR was not restored by state save |
|
|
{ |
|
|
// If the reset locality of the PCR is 4, then |
|
|
// the reset value is all one's, otherwise it is |
|
|
// all zero. |
|
|
if((s_initAttributes[pcr].resetLocality & 0x10) != 0) |
|
|
MemorySet(pcrData, 0xFF, pcrSize); |
|
|
else |
|
|
{ |
|
|
MemorySet(pcrData, 0, pcrSize); |
|
|
if(pcr == HCRTM_PCR) |
|
|
pcrData[pcrSize-1] = locality; |
|
|
} |
|
|
} |
|
|
} |
|
|
} |
|
|
saveIndex += stateSaved; |
|
|
} |
|
|
// Reset authValues |
|
|
if(type != SU_RESUME) |
|
|
{ |
|
|
for(j = 0; j < NUM_AUTHVALUE_PCR_GROUP; j++) |
|
|
{ |
|
|
gc.pcrAuthValues.auth[j].t.size = 0; |
|
|
} |
|
|
} |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRStateSave() |
|
|
// |
|
|
// This function is used to save the PCR values that will be restored on TPM Resume. |
|
|
// |
|
|
void |
|
|
PCRStateSave( |
|
|
TPM_SU type // IN: startup type |
|
|
) |
|
|
{ |
|
|
UINT32 pcr, j; |
|
|
UINT32 saveIndex = 0; |
|
|
// |
|
|
// if state save CLEAR, nothing to be done. Return here |
|
|
if(type == TPM_SU_CLEAR) return; |
|
|
// Copy PCR values to the structure that should be saved to NV |
|
|
for(pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
UINT32 stateSaved = (s_initAttributes[pcr].stateSave == SET) ? 1 : 0; |
|
|
// Iterate each hash algorithm bank |
|
|
for(j = 0; j < gp.pcrAllocated.count; j++) |
|
|
{ |
|
|
BYTE *pcrData; |
|
|
UINT32 pcrSize; |
|
|
pcrData = GetPcrPointer(gp.pcrAllocated.pcrSelections[j].hash, pcr); |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
pcrSize |
|
|
= CryptGetHashDigestSize(gp.pcrAllocated.pcrSelections[j].hash); |
|
|
if(stateSaved == 1) |
|
|
{ |
|
|
// Restore saved PCR value |
|
|
BYTE *pcrSavedData; |
|
|
pcrSavedData |
|
|
= GetSavedPcrPointer(gp.pcrAllocated.pcrSelections[j].hash, |
|
|
saveIndex); |
|
|
MemoryCopy(pcrSavedData, pcrData, pcrSize, pcrSize); |
|
|
} |
|
|
} |
|
|
} |
|
|
saveIndex += stateSaved; |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRIsStateSaved() |
|
|
// |
|
|
// This function indicates if the selected PCR is a PCR that is state saved on TPM2_Shutdown(STATE). The |
|
|
// return value is based on PCR attributes. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE PCR is state saved |
|
|
// FALSE PCR is not state saved |
|
|
// |
|
|
BOOL |
|
|
PCRIsStateSaved( |
|
|
TPMI_DH_PCR handle // IN: PCR handle to be extended |
|
|
) |
|
|
{ |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
if(s_initAttributes[pcr].stateSave == SET) |
|
|
return TRUE; |
|
|
else |
|
|
return FALSE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// |
|
|
// PCRIsResetAllowed() |
|
|
// |
|
|
// This function indicates if a PCR may be reset by the current command locality. The return value is based |
|
|
// on PCR attributes, and not the PCR allocation. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE TPM2_PCR_Reset() is allowed |
|
|
// FALSE TPM2_PCR_Reset() is not allowed |
|
|
// |
|
|
BOOL |
|
|
PCRIsResetAllowed( |
|
|
TPMI_DH_PCR handle // IN: PCR handle to be extended |
|
|
) |
|
|
{ |
|
|
UINT8 commandLocality; |
|
|
UINT8 localityBits = 1; |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
// Check for the locality |
|
|
commandLocality = _plat__LocalityGet(); |
|
|
#ifdef DRTM_PCR |
|
|
// For a TPM that does DRTM, Reset is not allowed at locality 4 |
|
|
if(commandLocality == 4) |
|
|
return FALSE; |
|
|
#endif |
|
|
localityBits = localityBits << commandLocality; |
|
|
if((localityBits & s_initAttributes[pcr].resetLocality) == 0) |
|
|
return FALSE; |
|
|
else |
|
|
return TRUE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRChanged() |
|
|
// |
|
|
// This function checks a PCR handle to see if the attributes for the PCR are set so that any change to the |
|
|
// PCR causes an increment of the pcrCounter. If it does, then the function increments the counter. |
|
|
// |
|
|
void |
|
|
PCRChanged( |
|
|
TPM_HANDLE pcrHandle // IN: the handle of the PCR that changed. |
|
|
) |
|
|
{ |
|
|
// For the reference implementation, the only change that does not cause |
|
|
// increment is a change to a PCR in the TCB group. |
|
|
if(!PCRBelongsTCBGroup(pcrHandle)) |
|
|
gr.pcrCounter++; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRIsExtendAllowed() |
|
|
// |
|
|
// This function indicates a PCR may be extended at the current command locality. The return value is |
|
|
// based on PCR attributes, and not the PCR allocation. |
|
|
// |
|
|
// |
|
|
// |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE extend is allowed |
|
|
// FALSE extend is not allowed |
|
|
// |
|
|
BOOL |
|
|
PCRIsExtendAllowed( |
|
|
TPMI_DH_PCR handle // IN: PCR handle to be extended |
|
|
) |
|
|
{ |
|
|
UINT8 commandLocality; |
|
|
UINT8 localityBits = 1; |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
// Check for the locality |
|
|
commandLocality = _plat__LocalityGet(); |
|
|
localityBits = localityBits << commandLocality; |
|
|
if((localityBits & s_initAttributes[pcr].extendLocality) == 0) |
|
|
return FALSE; |
|
|
else |
|
|
return TRUE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRExtend() |
|
|
// |
|
|
// This function is used to extend a PCR in a specific bank. |
|
|
// |
|
|
void |
|
|
PCRExtend( |
|
|
TPMI_DH_PCR handle, // IN: PCR handle to be extended |
|
|
TPMI_ALG_HASH hash, // IN: hash algorithm of PCR |
|
|
UINT32 size, // IN: size of data to be extended |
|
|
BYTE *data // IN: data to be extended |
|
|
) |
|
|
{ |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
BYTE *pcrData; |
|
|
HASH_STATE hashState; |
|
|
UINT16 pcrSize; |
|
|
pcrData = GetPcrPointer(hash, pcr); |
|
|
// Extend PCR if it is allocated |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
pcrSize = CryptGetHashDigestSize(hash); |
|
|
CryptStartHash(hash, &hashState); |
|
|
CryptUpdateDigest(&hashState, pcrSize, pcrData); |
|
|
CryptUpdateDigest(&hashState, size, data); |
|
|
CryptCompleteHash(&hashState, pcrSize, pcrData); |
|
|
// If PCR does not belong to TCB group, increment PCR counter |
|
|
if(!PCRBelongsTCBGroup(handle)) |
|
|
gr.pcrCounter++; |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// |
|
|
// PCRComputeCurrentDigest() |
|
|
// |
|
|
// This function computes the digest of the selected PCR. |
|
|
// As a side-effect, selection is modified so that only the implemented PCR will have their bits still set. |
|
|
// |
|
|
void |
|
|
PCRComputeCurrentDigest( |
|
|
TPMI_ALG_HASH hashAlg, // IN: hash algorithm to compute digest |
|
|
TPML_PCR_SELECTION *selection, // IN/OUT: PCR selection (filtered on |
|
|
// output) |
|
|
TPM2B_DIGEST *digest // OUT: digest |
|
|
) |
|
|
{ |
|
|
HASH_STATE hashState; |
|
|
TPMS_PCR_SELECTION *select; |
|
|
BYTE *pcrData; // will point to a digest |
|
|
UINT32 pcrSize; |
|
|
UINT32 pcr; |
|
|
UINT32 i; |
|
|
// Initialize the hash |
|
|
digest->t.size = CryptStartHash(hashAlg, &hashState); |
|
|
pAssert(digest->t.size > 0 && digest->t.size < UINT16_MAX); |
|
|
// Iterate through the list of PCR selection structures |
|
|
for(i = 0; i < selection->count; i++) |
|
|
{ |
|
|
// Point to the current selection |
|
|
select = &selection->pcrSelections[i]; // Point to the current selection |
|
|
FilterPcr(select); // Clear out the bits for unimplemented PCR |
|
|
// Need the size of each digest |
|
|
pcrSize = CryptGetHashDigestSize(selection->pcrSelections[i].hash); |
|
|
// Iterate through the selection |
|
|
for(pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
if(IsPcrSelected(pcr, select)) // Is this PCR selected |
|
|
{ |
|
|
// Get pointer to the digest data for the bank |
|
|
pcrData = GetPcrPointer(selection->pcrSelections[i].hash, pcr); |
|
|
pAssert(pcrData != NULL); |
|
|
CryptUpdateDigest(&hashState, pcrSize, pcrData); // add to digest |
|
|
} |
|
|
} |
|
|
} |
|
|
// Complete hash stack |
|
|
CryptCompleteHash2B(&hashState, &digest->b); |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRRead() |
|
|
// |
|
|
// This function is used to read a list of selected PCR. If the requested PCR number exceeds the maximum |
|
|
// number that can be output, the selection is adjusted to reflect the actual output PCR. |
|
|
// |
|
|
void |
|
|
PCRRead( |
|
|
TPML_PCR_SELECTION *selection, // IN/OUT: PCR selection (filtered on |
|
|
// output) |
|
|
TPML_DIGEST *digest, // OUT: digest |
|
|
UINT32 *pcrCounter // OUT: the current value of PCR generation |
|
|
// number |
|
|
) |
|
|
{ |
|
|
TPMS_PCR_SELECTION *select; |
|
|
BYTE *pcrData; // will point to a digest |
|
|
UINT32 pcr; |
|
|
UINT32 i; |
|
|
digest->count = 0; |
|
|
// Iterate through the list of PCR selection structures |
|
|
for(i = 0; i < selection->count; i++) |
|
|
{ |
|
|
// Point to the current selection |
|
|
select = &selection->pcrSelections[i]; // Point to the current selection |
|
|
FilterPcr(select); // Clear out the bits for unimplemented PCR |
|
|
// Iterate through the selection |
|
|
for (pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
if(IsPcrSelected(pcr, select)) // Is this PCR selected |
|
|
{ |
|
|
// Check if number of digest exceed upper bound |
|
|
if(digest->count > 7) |
|
|
{ |
|
|
// Clear rest of the current select bitmap |
|
|
while( pcr < IMPLEMENTATION_PCR |
|
|
// do not round up! |
|
|
&& (pcr / 8) < select->sizeofSelect) |
|
|
{ |
|
|
// do not round up! |
|
|
select->pcrSelect[pcr/8] &= (BYTE) ~(1 << (pcr % 8)); |
|
|
pcr++; |
|
|
} |
|
|
// Exit inner loop |
|
|
break;; |
|
|
} |
|
|
// Need the size of each digest |
|
|
digest->digests[digest->count].t.size = |
|
|
CryptGetHashDigestSize(selection->pcrSelections[i].hash); |
|
|
// Get pointer to the digest data for the bank |
|
|
pcrData = GetPcrPointer(selection->pcrSelections[i].hash, pcr); |
|
|
pAssert(pcrData != NULL); |
|
|
// Add to the data to digest |
|
|
MemoryCopy(digest->digests[digest->count].t.buffer, |
|
|
pcrData, |
|
|
digest->digests[digest->count].t.size, |
|
|
digest->digests[digest->count].t.size); |
|
|
digest->count++; |
|
|
} |
|
|
} |
|
|
// If we exit inner loop because we have exceed the output upper bound |
|
|
if(digest->count > 7 && pcr < IMPLEMENTATION_PCR) |
|
|
{ |
|
|
// Clear rest of the selection |
|
|
while(i < selection->count) |
|
|
{ |
|
|
MemorySet(selection->pcrSelections[i].pcrSelect, 0, |
|
|
selection->pcrSelections[i].sizeofSelect); |
|
|
i++; |
|
|
} |
|
|
// exit outer loop |
|
|
break; |
|
|
} |
|
|
} |
|
|
*pcrCounter = gr.pcrCounter; |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PcrWrite() |
|
|
// |
|
|
// This function is used by _TPM_Hash_End() to set a PCR to the computed hash of the H-CRTM event. |
|
|
// |
|
|
void |
|
|
PcrWrite( |
|
|
TPMI_DH_PCR handle, // IN: PCR handle to be extended |
|
|
TPMI_ALG_HASH hash, // IN: hash algorithm of PCR |
|
|
TPM2B_DIGEST *digest // IN: the new value |
|
|
) |
|
|
{ |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
BYTE *pcrData; |
|
|
// Copy value to the PCR if it is allocated |
|
|
pcrData = GetPcrPointer(hash, pcr); |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
MemoryCopy(pcrData, digest->t.buffer, digest->t.size, digest->t.size); ; |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRAllocate() |
|
|
// |
|
|
// This function is used to change the PCR allocation. |
|
|
// |
|
|
// Error Returns Meaning |
|
|
// |
|
|
// TPM_RC_SUCCESS allocate success |
|
|
// TPM_RC_NO_RESULTS allocate failed |
|
|
// TPM_RC_PCR improper allocation |
|
|
// |
|
|
TPM_RC |
|
|
PCRAllocate( |
|
|
TPML_PCR_SELECTION *allocate, // IN: required allocation |
|
|
UINT32 *maxPCR, // OUT: Maximum number of PCR |
|
|
UINT32 *sizeNeeded, // OUT: required space |
|
|
UINT32 *sizeAvailable // OUT: available space |
|
|
) |
|
|
{ |
|
|
UINT32 i, j, k; |
|
|
TPML_PCR_SELECTION newAllocate; |
|
|
// Initialize the flags to indicate if HCRTM PCR and DRTM PCR are allocated. |
|
|
BOOL pcrHcrtm = FALSE; |
|
|
BOOL pcrDrtm = FALSE; |
|
|
// Create the expected new PCR allocation based on the existing allocation |
|
|
// and the new input: |
|
|
// 1. if a PCR bank does not appear in the new allocation, the existing |
|
|
// allocation of this PCR bank will be preserved. |
|
|
// 2. if a PCR bank appears multiple times in the new allocation, only the |
|
|
// last one will be in effect. |
|
|
newAllocate = gp.pcrAllocated; |
|
|
for(i = 0; i < allocate->count; i++) |
|
|
{ |
|
|
for(j = 0; j < newAllocate.count; j++) |
|
|
{ |
|
|
// If hash matches, the new allocation covers the old allocation |
|
|
// for this particular bank. |
|
|
// The assumption is the initial PCR allocation (from manufacture) |
|
|
// has all the supported hash algorithms with an assigned bank |
|
|
// (possibly empty). So there must be a match for any new bank |
|
|
// allocation from the input. |
|
|
if(newAllocate.pcrSelections[j].hash == |
|
|
allocate->pcrSelections[i].hash) |
|
|
{ |
|
|
newAllocate.pcrSelections[j] = allocate->pcrSelections[i]; |
|
|
break; |
|
|
} |
|
|
} |
|
|
// The j loop must exit with a match. |
|
|
pAssert(j < newAllocate.count); |
|
|
} |
|
|
// Max PCR in a bank is MIN(implemented PCR, PCR with attributes defined) |
|
|
*maxPCR = sizeof(s_initAttributes) / sizeof(PCR_Attributes); |
|
|
if(*maxPCR > IMPLEMENTATION_PCR) |
|
|
*maxPCR = IMPLEMENTATION_PCR; |
|
|
// Compute required size for allocation |
|
|
*sizeNeeded = 0; |
|
|
for(i = 0; i < newAllocate.count; i++) |
|
|
{ |
|
|
UINT32 digestSize |
|
|
= CryptGetHashDigestSize(newAllocate.pcrSelections[i].hash); |
|
|
#if defined(DRTM_PCR) |
|
|
// Make sure that we end up with at least one DRTM PCR |
|
|
# define PCR_DRTM (PCR_FIRST + DRTM_PCR) // for cosmetics |
|
|
pcrDrtm = pcrDrtm || TEST_BIT(PCR_DRTM, newAllocate.pcrSelections[i]); |
|
|
#else // if DRTM PCR is not required, indicate that the allocation is OK |
|
|
pcrDrtm = TRUE; |
|
|
#endif |
|
|
#if defined(HCRTM_PCR) |
|
|
// and one HCRTM PCR (since this is usually PCR 0...) |
|
|
# define PCR_HCRTM (PCR_FIRST + HCRTM_PCR) |
|
|
pcrHcrtm = pcrDrtm || TEST_BIT(PCR_HCRTM, newAllocate.pcrSelections[i]); |
|
|
#else |
|
|
pcrHcrtm = TRUE; |
|
|
#endif |
|
|
for(j = 0; j < newAllocate.pcrSelections[i].sizeofSelect; j++) |
|
|
{ |
|
|
BYTE mask = 1; |
|
|
for(k = 0; k < 8; k++) |
|
|
{ |
|
|
if((newAllocate.pcrSelections[i].pcrSelect[j] & mask) != 0) |
|
|
*sizeNeeded += digestSize; |
|
|
mask = mask << 1; |
|
|
} |
|
|
} |
|
|
} |
|
|
if(!pcrDrtm || !pcrHcrtm) |
|
|
return TPM_RC_PCR; |
|
|
// In this particular implementation, we always have enough space to |
|
|
// allocate PCR. Different implementation may return a sizeAvailable less |
|
|
// than the sizeNeed. |
|
|
*sizeAvailable = sizeof(s_pcrs); |
|
|
// Save the required allocation to NV. Note that after NV is written, the |
|
|
// PCR allocation in NV is no longer consistent with the RAM data |
|
|
// gp.pcrAllocated. The NV version reflect the allocate after next |
|
|
// TPM_RESET, while the RAM version reflects the current allocation |
|
|
NvWriteReserved(NV_PCR_ALLOCATED, &newAllocate); |
|
|
return TPM_RC_SUCCESS; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRSetValue() |
|
|
// |
|
|
// This function is used to set the designated PCR in all banks to an initial value. The initial value is signed |
|
|
// and will be sign extended into the entire PCR. |
|
|
// |
|
|
void |
|
|
PCRSetValue( |
|
|
TPM_HANDLE handle, // IN: the handle of the PCR to set |
|
|
INT8 initialValue // IN: the value to set |
|
|
) |
|
|
{ |
|
|
int i; |
|
|
UINT32 pcr = handle - PCR_FIRST; |
|
|
TPMI_ALG_HASH hash; |
|
|
UINT16 digestSize; |
|
|
BYTE *pcrData; |
|
|
// Iterate supported PCR bank algorithms to reset |
|
|
for(i = 0; i < HASH_COUNT; i++) |
|
|
{ |
|
|
hash = CryptGetHashAlgByIndex(i); |
|
|
// Prevent runaway |
|
|
if(hash == TPM_ALG_NULL) |
|
|
break; |
|
|
// Get a pointer to the data |
|
|
pcrData = GetPcrPointer(gp.pcrAllocated.pcrSelections[i].hash, pcr); |
|
|
// If the PCR is allocated |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
// And the size of the digest |
|
|
digestSize = CryptGetHashDigestSize(hash); |
|
|
// Set the LSO to the input value |
|
|
pcrData[digestSize - 1] = initialValue; |
|
|
// Sign extend |
|
|
if(initialValue >= 0) |
|
|
MemorySet(pcrData, 0, digestSize - 1); |
|
|
else |
|
|
MemorySet(pcrData, -1, digestSize - 1); |
|
|
} |
|
|
} |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRResetDynamics |
|
|
// |
|
|
// This function is used to reset a dynamic PCR to 0. This function is used in DRTM sequence. |
|
|
// |
|
|
void |
|
|
PCRResetDynamics( |
|
|
void |
|
|
) |
|
|
{ |
|
|
UINT32 pcr, i; |
|
|
// Initialize PCR values |
|
|
for(pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
// Iterate each hash algorithm bank |
|
|
for(i = 0; i < gp.pcrAllocated.count; i++) |
|
|
{ |
|
|
BYTE *pcrData; |
|
|
UINT32 pcrSize; |
|
|
pcrData = GetPcrPointer(gp.pcrAllocated.pcrSelections[i].hash, pcr); |
|
|
if(pcrData != NULL) |
|
|
{ |
|
|
pcrSize = |
|
|
CryptGetHashDigestSize(gp.pcrAllocated.pcrSelections[i].hash); |
|
|
// Reset PCR |
|
|
// Any PCR can be reset by locality 4 should be reset to 0 |
|
|
if((s_initAttributes[pcr].resetLocality & 0x10) != 0) |
|
|
MemorySet(pcrData, 0, pcrSize); |
|
|
} |
|
|
} |
|
|
} |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRCapGetAllocation() |
|
|
// |
|
|
// This function is used to get the current allocation of PCR banks. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// YES: if the return count is 0 |
|
|
// NO: if the return count is not 0 |
|
|
// |
|
|
TPMI_YES_NO |
|
|
PCRCapGetAllocation( |
|
|
UINT32 count, // IN: count of return |
|
|
TPML_PCR_SELECTION *pcrSelection // OUT: PCR allocation list |
|
|
) |
|
|
{ |
|
|
if(count == 0) |
|
|
{ |
|
|
pcrSelection->count = 0; |
|
|
return YES; |
|
|
} |
|
|
else |
|
|
{ |
|
|
*pcrSelection = gp.pcrAllocated; |
|
|
return NO; |
|
|
} |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRSetSelectBit() |
|
|
// |
|
|
// This function sets a bit in a bitmap array. |
|
|
// |
|
|
static void |
|
|
PCRSetSelectBit( |
|
|
UINT32 pcr, // IN: PCR number |
|
|
BYTE *bitmap // OUT: bit map to be set |
|
|
) |
|
|
{ |
|
|
bitmap[pcr / 8] |= (1 << (pcr % 8)); |
|
|
return; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRGetProperty() |
|
|
// |
|
|
// This function returns the selected PCR property. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// TRUE the property type is implemented |
|
|
// FALSE the property type is not implemented |
|
|
// |
|
|
static BOOL |
|
|
PCRGetProperty( |
|
|
TPM_PT_PCR property, |
|
|
TPMS_TAGGED_PCR_SELECT *select |
|
|
) |
|
|
{ |
|
|
UINT32 pcr; |
|
|
UINT32 groupIndex; |
|
|
select->tag = property; |
|
|
// Always set the bitmap to be the size of all PCR |
|
|
select->sizeofSelect = (IMPLEMENTATION_PCR + 7) / 8; |
|
|
// Initialize bitmap |
|
|
MemorySet(select->pcrSelect, 0, select->sizeofSelect); |
|
|
// Collecting properties |
|
|
for(pcr = 0; pcr < IMPLEMENTATION_PCR; pcr++) |
|
|
{ |
|
|
switch(property) |
|
|
{ |
|
|
case TPM_PT_PCR_SAVE: |
|
|
if(s_initAttributes[pcr].stateSave == SET) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_EXTEND_L0: |
|
|
if((s_initAttributes[pcr].extendLocality & 0x01) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_RESET_L0: |
|
|
if((s_initAttributes[pcr].resetLocality & 0x01) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_EXTEND_L1: |
|
|
if((s_initAttributes[pcr].extendLocality & 0x02) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_RESET_L1: |
|
|
if((s_initAttributes[pcr].resetLocality & 0x02) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_EXTEND_L2: |
|
|
if((s_initAttributes[pcr].extendLocality & 0x04) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
// |
|
|
break; |
|
|
case TPM_PT_PCR_RESET_L2: |
|
|
if((s_initAttributes[pcr].resetLocality & 0x04) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_EXTEND_L3: |
|
|
if((s_initAttributes[pcr].extendLocality & 0x08) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_RESET_L3: |
|
|
if((s_initAttributes[pcr].resetLocality & 0x08) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_EXTEND_L4: |
|
|
if((s_initAttributes[pcr].extendLocality & 0x10) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_RESET_L4: |
|
|
if((s_initAttributes[pcr].resetLocality & 0x10) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
case TPM_PT_PCR_DRTM_RESET: |
|
|
// DRTM reset PCRs are the PCR reset by locality 4 |
|
|
if((s_initAttributes[pcr].resetLocality & 0x10) != 0) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
#if NUM_POLICY_PCR_GROUP > 0 |
|
|
case TPM_PT_PCR_POLICY: |
|
|
if(PCRBelongsPolicyGroup(pcr + PCR_FIRST, &groupIndex)) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
#endif |
|
|
#if NUM_AUTHVALUE_PCR_GROUP > 0 |
|
|
case TPM_PT_PCR_AUTH: |
|
|
if(PCRBelongsAuthGroup(pcr + PCR_FIRST, &groupIndex)) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
#endif |
|
|
#if ENABLE_PCR_NO_INCREMENT == YES |
|
|
case TPM_PT_PCR_NO_INCREMENT: |
|
|
if(PCRBelongsTCBGroup(pcr + PCR_FIRST)) |
|
|
PCRSetSelectBit(pcr, select->pcrSelect); |
|
|
break; |
|
|
#endif |
|
|
default: |
|
|
// If property is not supported, stop scanning PCR attributes |
|
|
// and return. |
|
|
return FALSE; |
|
|
break; |
|
|
} |
|
|
} |
|
|
return TRUE; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRCapGetProperties() |
|
|
// |
|
|
// This function returns a list of PCR properties starting at property. |
|
|
// |
|
|
// |
|
|
// |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// YES: if no more property is available |
|
|
// NO: if there are more properties not reported |
|
|
// |
|
|
TPMI_YES_NO |
|
|
PCRCapGetProperties( |
|
|
TPM_PT_PCR property, // IN: the starting PCR property |
|
|
UINT32 count, // IN: count of returned propertie |
|
|
TPML_TAGGED_PCR_PROPERTY *select // OUT: PCR select |
|
|
) |
|
|
{ |
|
|
TPMI_YES_NO more = NO; |
|
|
UINT32 i; |
|
|
// Initialize output property list |
|
|
select->count = 0; |
|
|
// The maximum count of properties we may return is MAX_PCR_PROPERTIES |
|
|
if(count > MAX_PCR_PROPERTIES) count = MAX_PCR_PROPERTIES; |
|
|
// TPM_PT_PCR_FIRST is defined as 0 in spec. It ensures that property |
|
|
// value would never be less than TPM_PT_PCR_FIRST |
|
|
pAssert(TPM_PT_PCR_FIRST == 0); |
|
|
// Iterate PCR properties. TPM_PT_PCR_LAST is the index of the last property |
|
|
// implemented on the TPM. |
|
|
for(i = property; i <= TPM_PT_PCR_LAST; i++) |
|
|
{ |
|
|
if(select->count < count) |
|
|
{ |
|
|
// If we have not filled up the return list, add more properties to it |
|
|
if(PCRGetProperty(i, &select->pcrProperty[select->count])) |
|
|
// only increment if the property is implemented |
|
|
select->count++; |
|
|
} |
|
|
else |
|
|
{ |
|
|
// If the return list is full but we still have properties |
|
|
// available, report this and stop iterating. |
|
|
more = YES; |
|
|
break; |
|
|
} |
|
|
} |
|
|
return more; |
|
|
} |
|
|
// |
|
|
// |
|
|
// PCRCapGetHandles() |
|
|
// |
|
|
// This function is used to get a list of handles of PCR, started from handle. If handle exceeds the maximum |
|
|
// PCR handle range, an empty list will be returned and the return value will be NO. |
|
|
// |
|
|
// Return Value Meaning |
|
|
// |
|
|
// YES if there are more handles available |
|
|
// NO all the available handles has been returned |
|
|
// |
|
|
TPMI_YES_NO |
|
|
PCRCapGetHandles( |
|
|
TPMI_DH_PCR handle, // IN: start handle |
|
|
UINT32 count, // IN: count of returned handle |
|
|
TPML_HANDLE *handleList // OUT: list of handle |
|
|
) |
|
|
{ |
|
|
TPMI_YES_NO more = NO; |
|
|
UINT32 i; |
|
|
pAssert(HandleGetType(handle) == TPM_HT_PCR); |
|
|
// Initialize output handle list |
|
|
handleList->count = 0; |
|
|
// The maximum count of handles we may return is MAX_CAP_HANDLES |
|
|
if(count > MAX_CAP_HANDLES) count = MAX_CAP_HANDLES; |
|
|
// Iterate PCR handle range |
|
|
for(i = handle & HR_HANDLE_MASK; i <= PCR_LAST; i++) |
|
|
{ |
|
|
if(handleList->count < count) |
|
|
{ |
|
|
// If we have not filled up the return list, add this PCR |
|
|
// handle to it |
|
|
handleList->handle[handleList->count] = i + PCR_FIRST; |
|
|
handleList->count++; |
|
|
} |
|
|
else |
|
|
{ |
|
|
// If the return list is full but we still have PCR handle |
|
|
// available, report this and stop iterating |
|
|
more = YES; |
|
|
break; |
|
|
} |
|
|
} |
|
|
return more; |
|
|
}
|
|
|
|
