Stefan Berger [Wed, 5 Sep 2018 22:27:53 +0000 (22:27 +0000)]
build-sys: Make 'make check' work on FreeBSD
On FreeBSD we need to set the SHELL explicitly to /bin/bash since csh
is used otherwise and wouldn't allow us to run the check-local rule.
Besides that we need -shared for the check to pass. However, the FreeBSD
compiler doesn't allow us to recognize undefined symbols, which seem
to get suppressed with the -shared parameter. If the -shared is not passed
we get error messages due to undefined symbols _progname and environ from
libc.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 30 Aug 2018 21:44:18 +0000 (21:44 +0000)]
build-sys: work around broken linker when testing --version-script support
The linker on FreeBSD seems to be broken and fails for other reasons
when testing for support of the --version-script flag. The error
that is reported is:
local symbol 'environ' in /usr/lib/crt1.o is referenced by DSO.
Also __progname is needed.
To work around this problem we add a test.syms file that only has
these two symbols in it, which is enough for the test in
configure.ac and gives version script support in case of the
broken linker.
On FreeBSD TPM 1.2 related tests were failing due to test case 6
failures in case no linker script was used. (Very odd.) This patch
fixes this problem.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Wed, 8 Aug 2018 22:16:59 +0000 (18:16 -0400)]
tpm2: Do padding of bytes for i386 via additional bytes in array
Instead of adding padding bytes to the end of the structure
extend the d array with 3 additional entries that are not going
to be used but provide the padding so that the structure has the
same size on 32 bit and 64 bit machines.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 27 Jul 2018 21:17:18 +0000 (17:17 -0400)]
Fix regression from 'Recalculate the entrysize in front of ...'
The patch 'Recalculate the entrysize in front of every USER_NVRAM blob'
did not properly account for the TPM_HANDLE when recalculating the
entry size of an OBJECT in NVRAM. As a consequence all OBJECTS and NVRAM
indices following the first OBJECT got lost.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 17 Jul 2018 02:31:16 +0000 (22:31 -0400)]
tpm2: Determine which PCR banks need to be restored
Determine which PCR banks need to be restored by determining which PCR banks
are active. We only expect data for active PCR banks and the other ones do
not need data.
The tricky part here is that the TPM 2 maintains a variable that indicates
which PCR banks are active in gp.pcrAllocated and another variable in NVRAM
indicating which ones will become active after a reboot. So far we only saved
the one from NVRAM when marshalling the state but now we have to save the one
holding the current active PCR banks also. The restauration of this variable
needs to happen when we resume the VM with volatile state.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 17 Jul 2018 14:32:20 +0000 (10:32 -0400)]
tpm2: Recalculate the entrysize in front of every USER_NVRAM blob
Since the sizeof(TPM_NV_INDEX) and sizeof(OBJECT) may expand when new hash
algorithms are enabled, the size of each entry in the USER_NVRAM may also
expand. We have to account for this when writing the entry size into the
NVRAM and cannot use the one from the unmarshalled state unless it is 0
or the sizes were the same. So the best is to calculate the entry size and
write it again.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 5 Jun 2018 20:25:34 +0000 (16:25 -0400)]
library: use __attribute__((format,...) to check printf format and args
Introduce ATTRIBUTE_FORMAT for gcc and clang and use it to check the format
of the printf type function TPMLIB_LogTPM2Error() and the parameters. Fix
several places with errors.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 5 Jun 2018 18:00:43 +0000 (14:00 -0400)]
tpm2: Add comments to unmarshalling of user NVRAM
The unmarshalling of the user NVRAM checks whether the NVRAM size allows us
to write the data into it. Since this function is called before writing the
other data into it (PERSISTENT DATA, etc. at lower offsets in the NVRAM),
we can be sure that the NVRAM is large enough to fit everything. Following
this logic, we should be able to loosen the restriction on the NVRAM size and
need not check what size the NVRAM was on the originating side. Since we will
test the unmarshalling of all the data we should be able to detect if the
local NVRAM size is too small and refuse to take the blob based on the failure
to unmarshal completely.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 2 Jun 2018 13:54:49 +0000 (09:54 -0400)]
tpm2: adapt NVRAM offsets and check structure sizes
Make sure that the NVRAM offsets and structure sizes are the same
on all architectures so that we can fill up the NVRAM on one system
and migrate the state to another architecture and it will fit into
the NVRAM space there.
We leave some space for the first few data structures in the NVRAM to
grow. We do this by rounding up the NV_INDEX_RAM_DATA location to the
next kb boundary. This moves it from offset 4356 to 5120 on x86_64 and
from offset 4332 to 5120 on i386. This now leaves us with the same
amount of space for user dynamic NVRAM, which starts beyond offset 5120.
We also pad the OBJECT structure with 4 bytes so that it is the same
size on 32 and 64 bit architectures. This is a data structure that
is used in user dynamic NVRAM and should be the same size on all
architectures so that a full NVRAM always fits.
Also test the size of the NV_INDEX structure, which already has the
same size on all tested architectures (x86_64, i386, arm32, ppc64).
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add an initial fuzz test corpus for execute-command
This commit introduces a minimized corpus for
the test in fuzz/execute-command.cc.
The corpus was generated by parsing the TCG test
suite log for messages sent to the TPM. The corpus
includes test cases that produced crashes reported
in chrome-os-partner:56767 and chrome-os-partner:56825.
Future work includes defining a dictionary for the
protocol so that mutations can be more effective,
and also generating test-cases that improve coverage
(e.g. create & store primary key, followed by test case).
BUG=chrome-os-partner:50646
BRANCH=none
TEST=follow instructions in fuzz/README
Stefan Berger [Tue, 22 May 2018 13:11:45 +0000 (09:11 -0400)]
tpm2: enable sha512 (breaks compatiblity)
Enable SHA512. Since the TPM 2 expects to see PCR values for
the SHA512 bank in some of its structures, this breaks
compatibility with existing state files.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Wed, 16 May 2018 17:22:44 +0000 (13:22 -0400)]
tpm2: tie volatile state of TPM to persistent state
Write the persistent state's EP,SP, and PPSeed values into the
volatile state and check them when reading. This way we can
prevent that arbitrary volatile and persistent state blobs are
used.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Wed, 16 May 2018 15:04:02 +0000 (11:04 -0400)]
Write different header for SHA384 and SHA512 in shared function
SHA512 is currently not enabled since until a short while ago the test
data was missing. So before we enable it, we should differentiate between
writing adn reading of SHA384 and SHA512 data by using a different magic
in the header. We assign the existing value of the magic for the SHA384
that we currently use and assign SHA512 a new value.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Wed, 16 May 2018 13:13:41 +0000 (09:13 -0400)]
Increase MIN_EVICT_OBJECTS to 7 for value of TPM_PT_HR_PERSISTENT_MIN
Adapt the MIN_EVICT_OBJETCS #define value to 7 so that it meeds to
TPM Profile (PTP) Specification and TPM_PT_HR_PERSISTENT_MIN returns
the proper value.
We allow to read the state from a TPM that had a lesser value before.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sun, 18 Mar 2018 23:23:59 +0000 (19:23 -0400)]
tpm2: TPM_MainInit write permanent state blob if SetState() blob was used
If the permanent state was set using SetState() write the permanent
state once we successfully read the volatile state and can use it.
This way we have the state in a file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 29 Mar 2018 02:02:46 +0000 (22:02 -0400)]
tpm2: return TPM_RC_FAILURE in case of blockSize == 0
Coverity is complaining about the case of blockSize == 0. Later on in
CryptSymmetricDecrypt() this case is intercepted as well and
TPM_RC_FAILURE is returned. We just do this a little earlier.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 27 Mar 2018 22:09:52 +0000 (18:09 -0400)]
tpm2: initialize a couple of variable to make coverity happy
Coverity complains that a couple of variables read from the
stream may not be initialized. It shouldn't be possible to
have them not initialized since we would otherwise have an
error value in rc. Nevertheless, initialize them.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 27 Mar 2018 22:07:46 +0000 (18:07 -0400)]
tpm2: Check against unreasonably large datasize value from stream
Check the read datasize against an unreasonably large value and
log in case we encounter a bad value. This particular value cannot
be larger than 64k and a few bytes.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sun, 25 Mar 2018 15:57:41 +0000 (11:57 -0400)]
tpm2: Enable a few more algorithms
Enable a few more algorithm for the TPM2. We have to adapt NVMarshal.c
to allow the enablement of these algorithms without rejecting existing
state. We do this through the 'LE' comparison operator that allows us
to read state from an implementation that didn't have it enabled while
we now have it enabled.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sun, 25 Mar 2018 14:39:17 +0000 (10:39 -0400)]
tpm2: Write comments about comparison operators
Write comments about the comparison operators used for comparing
compile time options/switches of the state that's being read from
another implementation versus the ones used in the current
implementation.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sun, 25 Mar 2018 00:26:58 +0000 (20:26 -0400)]
tpm2: Allow state downgrading starting with version 2 headers
Write version 2 headers for all versioned structures and append
a trailer that can hold future version data and that can be
skipped. The skipping allows us to downgrade state, meaning if
version 3 appended some data but we read it with version 2,
we don't need the version 3 data but can skip it. We loose data
this way, but can keep the TPM 2 running.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 24 Mar 2018 21:33:59 +0000 (17:33 -0400)]
tpm2: Prepare header for v2 including min. necessary version to parse
Prepare the header we are using for writing out the state blobs
for version 2 where we will including the minimum version necessary
to read a particular structure.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Wed, 14 Mar 2018 18:41:14 +0000 (14:41 -0400)]
tpm2: Implement TPM2_PersistentAllStore and use it
Implement TPM2_PersistentAllStore that allocates a buffer big
enough to store all the persistent state and returns that buffer
along with the number of valid bytes.
In this patch we move code from _plat__NvCommit() into this new
function and call this new function now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 23 Feb 2018 22:32:37 +0000 (17:32 -0500)]
tpm2: Write marshalled NvChip into file and read it
When storing, marshalled the NvChip memory's contents and write the byte
stream into the file rather than the NvChip directly. When reading, assume
we get a marshalled NvChip file and we now need to unmarshal the byte
stream and reconstruct the NvChip.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 24 Feb 2018 20:01:58 +0000 (15:01 -0500)]
tpm2: Enable skipping of compile-time optional variables when unmarshalling
Some variables are compile-time optional and can be skipped if they are
contained in the byte stream but the implementation does not need them.
We enable this with a few simple macros that we use to replace those parts
where the has_block variables are written into the byte stream. On the
unmarshalling side we check whether the block is in the byte stream and
whether the implementation needs the block and react appropriately
including skipping over the block in the byte stream or skipping over the
code unmarshalling the data.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 20 Feb 2018 19:28:55 +0000 (14:28 -0500)]
tpm2: Push nvOffset and structure size parameters into functions
Push the nvOffset parameter where either one of the 4 state blobs
found in the NVRAM file can be found. Also push the size parameter
into the functions.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 17 Feb 2018 03:17:33 +0000 (22:17 -0500)]
tpm2: Activate failure mode if any blobs could not be handled
When any of the NVRAM blobs could not be handled properly we put
the TPM into failure mode. This should only happen if someone
corrupts the state or if the state blobs are more recent than
what the TPM supports.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 17 Feb 2018 02:19:11 +0000 (21:19 -0500)]
tpm2: extract header init and check from SWAP functions
Extract the initialization of the header fom the SWAP functions
and initialize the header by the appropriat callers of the SWAP
functions.
Version and magic can be 0 when first read after NVRAM was
initialized. So we initialize it then.
Add skeleton code where the upgrade of the data structure would
have to happen later on.
Refuse to accept newer versions of structures than what is supported
at the moment. In particular, return error codes in case the blobs
that were read are not supported.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 9 Feb 2018 18:11:29 +0000 (13:11 -0500)]
tpm2: Enforce version of volatile state blob
Enforce the version of the volatile state blob. Do not accept a more
recent version than what we support at this point, so downgrading of
state is prevented this way.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 14 Nov 2017 00:28:12 +0000 (19:28 -0500)]
tpm2: NVRAM file does exist if we get TPM_DECRYPT_ERROR
In case the NVRAM file cannot be decrypted we get a TPM_DECRYPT_ERROR
error which also indicates that the file exists. So do not return FALSE
in this case, which would delete the existing file and start over with
a blank file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sat, 11 Nov 2017 04:02:28 +0000 (23:02 -0500)]
tpm2: Handle failures better
The current TpmFail() implementation invokes longjmp() at the end
and crashes with a segmentation fault if setjmp() wasn't called before.
To avoid this we implement TpmSetFailureMode() that logs the failure and
sets the TPM into failure mode. Since NVRAM may set failure mode before
the CryptInit() is called, we need to make sure we don't reset the failure
mode variable in case CryptInit() succeeds. In this case we now call the
FAIL_NOCMD() macro.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
projects / libtpms.git / log