[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH 4/9] vtpmmgr: Convert TPM_Seal to use TPM_PCR_INFO_LONG
From: Jason Andryuk <andryuk@xxxxxxxx> Infineon 1.2 TPMs fail TPM_Seal commands with TPM_BAD_PARAMETER when PCRS are specified by a TPM_PCR_INFO structure. Using a TPM_PCR_INFO_LONG structure to specify PCRs succeeds, so update to use that. This also requires changes to use TPM_STORED_DATA12 for the result. Signed-off-by: Jason Andryuk <andryuk@xxxxxxxx> Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> --- stubdom/vtpmmgr/disk_tpm.c | 52 ++++++++++++++++++++--------- stubdom/vtpmmgr/marshal.h | 82 ++++++++++++++++++++++++++++++++++++++++++++++ stubdom/vtpmmgr/tcg.h | 42 ++++++++++++++++++++++++ stubdom/vtpmmgr/tpm.c | 22 +++++++------ stubdom/vtpmmgr/tpm.h | 8 ++--- 5 files changed, 176 insertions(+), 30 deletions(-) diff --git a/stubdom/vtpmmgr/disk_tpm.c b/stubdom/vtpmmgr/disk_tpm.c index 6f5d556..a9f4552 100644 --- a/stubdom/vtpmmgr/disk_tpm.c +++ b/stubdom/vtpmmgr/disk_tpm.c @@ -74,12 +74,15 @@ void TPM_pcr_digest(struct hash160 *buf, le32_t selection) int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) { uint32_t rc; - TPM_PCR_INFO info; - TPM_STORED_DATA out; + uint32_t infoSize; + TPM_PCR_INFO_LONG info; + TPM_STORED_DATA12 out; TPM_AUTH_SESSION osap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA sharedsecret; TPM_AUTHDATA auth; + printk("Calling TPM_disk_seal\n"); + rc = TPM_OSAP(TPM_ET_KEYHANDLE, TPM_SRK_KEYHANDLE, (void*)&vtpm_globals.srk_auth, &sharedsecret, &osap); @@ -94,18 +97,26 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #endif memset(auth, 0, 20); - info.pcrSelection.sizeOfSelect = 3; - info.pcrSelection.pcrSelect = (void*)&dst->pcr_selection; + info.tag = TPM_TAG_PCR_INFO_LONG; + info.localityAtCreation = 1 << vtpm_globals.hw_locality; + info.localityAtRelease = 1 << vtpm_globals.hw_locality; + info.creationPCRSelection.sizeOfSelect = 3; + info.creationPCRSelection.pcrSelect = (void*)&dst->pcr_selection; + info.releasePCRSelection.sizeOfSelect = 3; + info.releasePCRSelection.pcrSelect = (void*)&dst->pcr_selection; memcpy(&info.digestAtCreation, &dst->digest_at_seal, 20); memcpy(&info.digestAtRelease, &dst->digest_release, 20); - rc = TPM_Seal(TPM_SRK_KEYHANDLE, 45, &info, size, src, &out, + infoSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + //infoSize = sizeof_TPM_PCR_INFO_LONG(&info); + + rc = TPM_Seal(TPM_SRK_KEYHANDLE, infoSize, &info, size, src, &out, (void*)&sharedsecret, (void*)&auth, &osap); TPM_TerminateHandle(osap.AuthHandle); #ifdef DEBUG_SEAL_OPS - printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoSize); + printk("TPM_Seal rc=%d encDataSize=%d sealInfoSize=%d\n", rc, out.encDataSize, out.sealInfoLongSize); #endif if (!rc) memcpy(dst->sealed_data, out.encData, 256); @@ -113,7 +124,7 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &out); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &out); printk("stored_data:"); while (start != end) { printk(" %02x", *start); @@ -122,37 +133,46 @@ int TPM_disk_seal(struct disk_seal_entry *dst, const void* src, size_t size) printk("\n"); #endif - free_TPM_STORED_DATA(&out); + free_TPM_STORED_DATA12(&out); return rc; } int TPM_disk_unseal(void *dst, size_t size, const struct disk_seal_entry *src) { uint32_t rc; - TPM_STORED_DATA in; + TPM_STORED_DATA12 in; TPM_AUTH_SESSION oiap = TPM_AUTH_SESSION_INIT; TPM_AUTHDATA auth; uint32_t outSize = 0; uint8_t *out = NULL; + printk("Calling TPM_disk_unseal\n"); + rc = TPM_OIAP(&oiap); if (rc) abort(); memset(auth, 0, 20); - in.ver = TPM_STRUCT_VER_1_1; - in.sealInfoSize = 45; - in.sealInfo.pcrSelection.sizeOfSelect = 3; - in.sealInfo.pcrSelection.pcrSelect = (void*)&src->pcr_selection; - memcpy(&in.sealInfo.digestAtCreation, &src->digest_at_seal, 20); - memcpy(&in.sealInfo.digestAtRelease, &src->digest_release, 20); + in.tag = TPM_TAG_STORED_DATA12; + in.et = 0; + //in.sealInfoLongSize = sizeof_TPM_PCR_INFO_LONG(&in.sealInfoLong); + in.sealInfoLongSize = 2 + 1 + 1 + 2 + 3 + 2 + 3 + 20 + 20; + in.sealInfoLong.tag = TPM_TAG_PCR_INFO_LONG; + in.sealInfoLong.localityAtCreation = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.localityAtRelease = 1 << vtpm_globals.hw_locality; + in.sealInfoLong.creationPCRSelection.sizeOfSelect = 3; + in.sealInfoLong.creationPCRSelection.pcrSelect = (void*)&src->pcr_selection; + in.sealInfoLong.releasePCRSelection.sizeOfSelect = 3; + in.sealInfoLong.releasePCRSelection.pcrSelect = (void*)&src->pcr_selection; + memcpy(&in.sealInfoLong.digestAtCreation, &src->digest_at_seal, 20); + memcpy(&in.sealInfoLong.digestAtRelease, &src->digest_release, 20); in.encDataSize = 256; in.encData = (void*)src->sealed_data; #ifdef DEBUG_SEAL_OPS uint8_t buf[512]; uint8_t *start = buf; - uint8_t *end = pack_TPM_STORED_DATA(buf, &in); + uint8_t *end = pack_TPM_STORED_DATA12(buf, &in); printk("stored_data:"); while (start != end) { printk(" %02x", *start); diff --git a/stubdom/vtpmmgr/marshal.h b/stubdom/vtpmmgr/marshal.h index ef54272..bcc7c46 100644 --- a/stubdom/vtpmmgr/marshal.h +++ b/stubdom/vtpmmgr/marshal.h @@ -142,6 +142,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define pack_TPM_MIGRATE_SCHEME(p, t) pack_UINT16(p, t) #define pack_TPM_PHYSICAL_PRESENCE(p, t) pack_UINT16(p, t) #define pack_TPM_KEY_FLAGS(p, t) pack_UINT32(p, t) +#define pack_TPM_LOCALITY_SELECTION(p, t) pack_BYTE(p, t) #define unpack_TPM_RESULT(p, t) unpack_UINT32(p, t) #define unpack_TPM_PCRINDEX(p, t) unpack_UINT32(p, t) @@ -167,6 +168,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack_TPM_MIGRATE_SCHEME(p, t) unpack_UINT16(p, t) #define unpack_TPM_PHYSICAL_PRESENCE(p, t) unpack_UINT16(p, t) #define unpack_TPM_KEY_FLAGS(p, t) unpack_UINT32(p, t) +#define unpack_TPM_LOCALITY_SELECTION(p, t) unpack_BYTE(p, t) #define unpack3_TPM_RESULT(p, l, m, t) unpack3_UINT32(p, l, m, t) #define unpack3_TPM_PCRINDEX(p, l, m, t) unpack3_UINT32(p, l, m, t) @@ -192,6 +194,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define unpack3_TPM_MIGRATE_SCHEME(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_PHYSICAL_PRESENCE(p, l, m, t) unpack3_UINT16(p, l, m, t) #define unpack3_TPM_KEY_FLAGS(p, l, m, t) unpack3_UINT32(p, l, m, t) +#define unpack3_TPM_LOCALITY_SELECTION(p, l, m, t) unpack3_BYTE(p, l, m, t) #define sizeof_TPM_RESULT(t) sizeof_UINT32(t) #define sizeof_TPM_PCRINDEX(t) sizeof_UINT32(t) @@ -217,6 +220,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t) #define sizeof_TPM_MIGRATE_SCHEME(t) sizeof_UINT16(t) #define sizeof_TPM_PHYSICAL_PRESENCE(t) sizeof_UINT16(t) #define sizeof_TPM_KEY_FLAGS(t) sizeof_UINT32(t) +#define sizeof_TPM_LOCALITY_SELECTION(t) sizeof_BYTE(t) #define pack_TPM_AUTH_HANDLE(p, t) pack_UINT32(p, t) #define pack_TCS_CONTEXT_HANDLE(p, t) pack_UINT32(p, t) @@ -312,6 +316,7 @@ inline int unpack3_TPM_AUTHDATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_AUTHDATA #define unpack_TPM_PAYLOAD_TYPE(p, t) unpack_BYTE(p, t) #define unpack_TPM_TAG(p, t) unpack_UINT16(p, t) #define unpack_TPM_STRUCTURE_TAG(p, t) unpack_UINT16(p, t) +#define unpack3_TPM_STRUCTURE_TAG(p, l, m, t) unpack3_UINT16(p, l, m, t) #define sizeof_TPM_SECRET(t) sizeof_TPM_AUTHDATA(t) #define sizeof_TPM_ENCAUTH(t) sizeof_TPM_AUTHDATA(t) @@ -593,6 +598,43 @@ inline int sizeof_TPM_PCR_INFO(const TPM_PCR_INFO* p) { return rc; } +inline BYTE* pack_TPM_PCR_INFO_LONG(BYTE* ptr, const TPM_PCR_INFO_LONG* p) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, p->tag); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtCreation); + ptr = pack_TPM_LOCALITY_SELECTION(ptr, p->localityAtRelease); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->creationPCRSelection); + ptr = pack_TPM_PCR_SELECTION(ptr, &p->releasePCRSelection); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtCreation); + ptr = pack_TPM_COMPOSITE_HASH(ptr, &p->digestAtRelease); + return ptr; +} + +inline int sizeof_TPM_PCR_INFO_LONG(const TPM_PCR_INFO_LONG* p) { + int rc = 0; + rc += sizeof_TPM_STRUCTURE_TAG(p->tag); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtCreation); + rc += sizeof_TPM_LOCALITY_SELECTION(p->localityAtRelease); + rc += sizeof_TPM_PCR_SELECTION(&p->creationPCRSelection); + rc += sizeof_TPM_PCR_SELECTION(&p->releasePCRSelection); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtCreation); + rc += sizeof_TPM_COMPOSITE_HASH(&p->digestAtRelease); + return rc; +} + +inline int unpack3_TPM_PCR_INFO_LONG(BYTE* ptr, UINT32* pos, UINT32 max, TPM_PCR_INFO_LONG* p, UnpackPtr alloc) { + return unpack3_TPM_STRUCTURE_TAG(ptr, pos, max, &p->tag) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtCreation) || + unpack3_TPM_LOCALITY_SELECTION(ptr, pos, max, + &p->localityAtRelease) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->creationPCRSelection, alloc) || + unpack3_TPM_PCR_SELECTION(ptr, pos, max, + &p->releasePCRSelection, alloc) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, + &p->digestAtCreation) || + unpack3_TPM_COMPOSITE_HASH(ptr, pos, max, &p->digestAtRelease); +} inline BYTE* pack_TPM_PCR_COMPOSITE(BYTE* ptr, const TPM_PCR_COMPOSITE* p) { ptr = pack_TPM_PCR_SELECTION(ptr, &p->select); @@ -703,6 +745,46 @@ inline int unpack3_TPM_STORED_DATA(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORE return rc; } +inline BYTE* pack_TPM_STORED_DATA12(BYTE* ptr, const TPM_STORED_DATA12* d) { + ptr = pack_TPM_STRUCTURE_TAG(ptr, d->tag); + ptr = pack_TPM_ENTITY_TYPE(ptr, d->et); + ptr = pack_UINT32(ptr, d->sealInfoLongSize); + if(d->sealInfoLongSize) { + ptr = pack_TPM_PCR_INFO_LONG(ptr, &d->sealInfoLong); + } + ptr = pack_UINT32(ptr, d->encDataSize); + ptr = pack_BUFFER(ptr, d->encData, d->encDataSize); + return ptr; +} + +inline int sizeof_TPM_STORED_DATA12(const TPM_STORED_DATA12* d) { + int rv = sizeof_TPM_STRUCTURE_TAG(&d->ver) + + sizeof_TPM_ENTITY_TYPE(&d->et) + + sizeof_UINT32(d->sealInfoLongSize); + if (d->sealInfoLongSize) { + rv += sizeof_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + rv += sizeof_UINT32(d->encDataSize); + rv += sizeof_BUFFER(d->encData, d->encDataSize); + return rv; +} + +inline int unpack3_TPM_STORED_DATA12(BYTE* ptr, UINT32* pos, UINT32 len, TPM_STORED_DATA12* d, UnpackPtr alloc) { + int rc = unpack3_TPM_STRUCTURE_TAG(ptr, pos, len, &d->tag) || + unpack3_TPM_ENTITY_TYPE(ptr, pos, len, &d->et) || + unpack3_UINT32(ptr, pos, len, &d->sealInfoLongSize); + if (rc) + return rc; + if (d->sealInfoLongSize) + rc = unpack3_TPM_PCR_INFO_LONG(ptr, pos, len, &d->sealInfoLong, + alloc); + if (rc) + return rc; + rc = unpack3_UINT32(ptr, pos, len, &d->encDataSize) || + unpack3_PTR(ptr, pos, len, &d->encData, d->encDataSize, alloc); + return rc; +} + inline BYTE* pack_TPM_AUTH_SESSION(BYTE* ptr, const TPM_AUTH_SESSION* auth) { ptr = pack_TPM_AUTH_HANDLE(ptr, auth->AuthHandle); ptr = pack_TPM_NONCE(ptr, &auth->NonceOdd); diff --git a/stubdom/vtpmmgr/tcg.h b/stubdom/vtpmmgr/tcg.h index f4c8bc0..7321ec6 100644 --- a/stubdom/vtpmmgr/tcg.h +++ b/stubdom/vtpmmgr/tcg.h @@ -259,6 +259,8 @@ #define TPM_ST_DEACTIVATED 0x003 // TPM_TAG values +#define TPM_TAG_PCR_INFO_LONG 0x0006 +#define TPM_TAG_STORED_DATA12 0x0016 #define TPM_TAG_RQU_COMMAND 0x00c1 #define TPM_TAG_RQU_AUTH1_COMMAND 0x00c2 #define TPM_TAG_RQU_AUTH2_COMMAND 0x00c3 @@ -582,6 +584,26 @@ inline void free_TPM_PCR_SELECTION(TPM_PCR_SELECTION* p) { p->pcrSelect = NULL; } +#define TPM_LOCALITY_SELECTION BYTE + +typedef struct TPM_PCR_INFO_LONG { + TPM_STRUCTURE_TAG tag; + TPM_LOCALITY_SELECTION localityAtCreation; + TPM_LOCALITY_SELECTION localityAtRelease; + TPM_PCR_SELECTION creationPCRSelection; + TPM_PCR_SELECTION releasePCRSelection; + TPM_COMPOSITE_HASH digestAtCreation; + TPM_COMPOSITE_HASH digestAtRelease; +} TPM_PCR_INFO_LONG; + +#define TPM_PCR_INFO_LONG_INIT { 0, 0, 0, TPM_PCR_SELECTION_INIT, \ + TPM_PCR_SELECTION_INIT } + +inline void free_TPM_PCR_INFO_LONG(TPM_PCR_INFO_LONG* p) { + free_TPM_PCR_SELECTION(&p->creationPCRSelection); + free_TPM_PCR_SELECTION(&p->releasePCRSelection); +} + typedef struct TPM_PCR_INFO { TPM_PCR_SELECTION pcrSelection; TPM_COMPOSITE_HASH digestAtRelease; @@ -667,6 +689,26 @@ inline void free_TPM_STORED_DATA(TPM_STORED_DATA* d) { d->encData = NULL; } +typedef struct TPM_STORED_DATA12 { + TPM_STRUCTURE_TAG tag; + TPM_ENTITY_TYPE et; + UINT32 sealInfoLongSize; + TPM_PCR_INFO_LONG sealInfoLong; + UINT32 encDataSize; + BYTE* encData; +} TPM_STORED_DATA12; + +#define TPM_STORED_DATA12_INIT { .sealInfoLongSize = 0, \ + sealInfoLong = TPM_PCR_INFO_INIT, .encDataSize = 0, .encData = NULL } + +inline void free_TPM_STORED_DATA12(TPM_STORED_DATA12* d) { + if(d->sealInfoLongSize) { + free_TPM_PCR_INFO_LONG(&d->sealInfoLong); + } + free(d->encData); + d->encData = NULL; +} + typedef struct TPM_AUTH_SESSION { TPM_AUTHHANDLE AuthHandle; TPM_NONCE NonceOdd; // system diff --git a/stubdom/vtpmmgr/tpm.c b/stubdom/vtpmmgr/tpm.c index 0548e5c..779cddd 100644 --- a/stubdom/vtpmmgr/tpm.c +++ b/stubdom/vtpmmgr/tpm.c @@ -492,11 +492,11 @@ abort_egress: TPM_RESULT TPM_Seal( TPM_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealedDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -509,28 +509,30 @@ TPM_RESULT TPM_Seal( xorEncrypt(osapSharedSecret, &pubAuth->NonceEven, sealedDataAuth, IN_PTR, NULL, NULL); in_pos += sizeof(TPM_ENCAUTH); - PACK_IN(UINT32, pcrInfoSize); - if (pcrInfoSize) - PACK_IN(TPM_PCR_INFO, pcrInfo); + + PACK_IN(UINT32, pcrInfoLongSize); + if (pcrInfoLongSize) { + PACK_IN(TPM_PCR_INFO_LONG, pcrInfoLong); + } PACK_IN(UINT32, inDataSize); PACK_IN(BUFFER, inData, inDataSize); TPM_XMIT_AUTH1(osapSharedSecret, pubAuth); - UNPACK_OUT(TPM_STORED_DATA, sealedData, UNPACK_ALLOC); + UNPACK_OUT(TPM_STORED_DATA12, sealedData, UNPACK_ALLOC); TPM_END_AUTH1(osapSharedSecret, pubAuth); abort_egress: if (status) - free_TPM_STORED_DATA(sealedData); + free_TPM_STORED_DATA12(sealedData); TPM_AUTH_ERR_CHECK(pubAuth); return status; } TPM_RESULT TPM_Unseal( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in @@ -544,7 +546,7 @@ TPM_RESULT TPM_Unseal( PACK_IN(TPM_KEY_HANDLE, parentHandle); TPM_HASH_IN_BEGIN; - PACK_IN(TPM_STORED_DATA, sealedData); + PACK_IN(TPM_STORED_DATA12, sealedData); TPM_XMIT_AUTH2(key_usage_auth, keyAuth, data_usage_auth, dataAuth); diff --git a/stubdom/vtpmmgr/tpm.h b/stubdom/vtpmmgr/tpm.h index 2161976..d613eb3 100644 --- a/stubdom/vtpmmgr/tpm.h +++ b/stubdom/vtpmmgr/tpm.h @@ -88,11 +88,11 @@ TPM_RESULT TPM_Reset(TPM_PCR_SELECTION *sel); TPM_RESULT TPM_Seal( TCS_KEY_HANDLE keyHandle, // in - UINT32 pcrInfoSize, // in - TPM_PCR_INFO* pcrInfo, // in + UINT32 pcrInfoLongSize, // in + TPM_PCR_INFO_LONG* pcrInfoLong, // in UINT32 inDataSize, // in const BYTE* inData, // in - TPM_STORED_DATA* sealedData, //out + TPM_STORED_DATA12* sealedData, //out const TPM_SECRET* osapSharedSecret, //in const TPM_AUTHDATA* sealDataAuth, //in TPM_AUTH_SESSION* pubAuth // in, out @@ -100,7 +100,7 @@ TPM_RESULT TPM_Seal( TPM_RESULT TPM_Unseal ( TPM_KEY_HANDLE parentHandle, // in - const TPM_STORED_DATA* sealedData, + const TPM_STORED_DATA12* sealedData, UINT32* outSize, // out BYTE** out, //out const TPM_AUTHDATA* key_usage_auth, //in -- 1.9.0 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |