SecurityPkg/Library/Tpm2CommandLib/Tpm2EnhancedAuthorization.c

   1 /** @file
   2   Implement TPM2 EnhancedAuthorization related command.
   3
   4 Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved. <BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include <IndustryStandard/UefiTcgPlatform.h>
  16 #include <Library/Tpm2CommandLib.h>
  17 #include <Library/Tpm2DeviceLib.h>
  18 #include <Library/BaseMemoryLib.h>
  19 #include <Library/BaseLib.h>
  20 #include <Library/DebugLib.h>
  21
  22 #pragma pack(1)
  23
  24 typedef struct {
  25   TPM2_COMMAND_HEADER       Header;
  26   TPMI_DH_ENTITY            AuthHandle;
  27   TPMI_SH_POLICY            PolicySession;
  28   UINT32                    AuthSessionSize;
  29   TPMS_AUTH_COMMAND         AuthSession;
  30   TPM2B_NONCE               NonceTPM;
  31   TPM2B_DIGEST              CpHashA;
  32   TPM2B_NONCE               PolicyRef;
  33   INT32                     Expiration;
  34 } TPM2_POLICY_SECRET_COMMAND;
  35
  36 typedef struct {
  37   TPM2_RESPONSE_HEADER      Header;
  38   UINT32                    AuthSessionSize;
  39   TPM2B_TIMEOUT             Timeout;
  40   TPMT_TK_AUTH              PolicyTicket;
  41   TPMS_AUTH_RESPONSE        AuthSession;
  42 } TPM2_POLICY_SECRET_RESPONSE;
  43
  44 typedef struct {
  45   TPM2_COMMAND_HEADER       Header;
  46   TPMI_SH_POLICY            PolicySession;
  47   TPML_DIGEST               HashList;
  48 } TPM2_POLICY_OR_COMMAND;
  49
  50 typedef struct {
  51   TPM2_RESPONSE_HEADER      Header;
  52 } TPM2_POLICY_OR_RESPONSE;
  53
  54 typedef struct {
  55   TPM2_COMMAND_HEADER       Header;
  56   TPMI_SH_POLICY            PolicySession;
  57   TPM_CC                    Code;
  58 } TPM2_POLICY_COMMAND_CODE_COMMAND;
  59
  60 typedef struct {
  61   TPM2_RESPONSE_HEADER      Header;
  62 } TPM2_POLICY_COMMAND_CODE_RESPONSE;
  63
  64 typedef struct {
  65   TPM2_COMMAND_HEADER       Header;
  66   TPMI_SH_POLICY            PolicySession;
  67 } TPM2_POLICY_GET_DIGEST_COMMAND;
  68
  69 typedef struct {
  70   TPM2_RESPONSE_HEADER      Header;
  71   TPM2B_DIGEST              PolicyHash;
  72 } TPM2_POLICY_GET_DIGEST_RESPONSE;
  73
  74 #pragma pack()
  75
  76 /**
  77   This command includes a secret-based authorization to a policy.
  78   The caller proves knowledge of the secret value using an authorization
  79   session using the authValue associated with authHandle.
  80
  81   @param[in]  AuthHandle         Handle for an entity providing the authorization
  82   @param[in]  PolicySession      Handle for the policy session being extended.
  83   @param[in]  AuthSession        Auth Session context
  84   @param[in]  NonceTPM           The policy nonce for the session.
  85   @param[in]  CpHashA            Digest of the command parameters to which this authorization is limited.
  86   @param[in]  PolicyRef          A reference to a policy relating to the authorization.
  87   @param[in]  Expiration         Time when authorization will expire, measured in seconds from the time that nonceTPM was generated.
  88   @param[out] Timeout            Time value used to indicate to the TPM when the ticket expires.
  89   @param[out] PolicyTicket       A ticket that includes a value indicating when the authorization expires.
  90
  91   @retval EFI_SUCCESS            Operation completed successfully.
  92   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
  93 **/
  94 EFI_STATUS
  95 EFIAPI
  96 Tpm2PolicySecret (
  97   IN      TPMI_DH_ENTITY            AuthHandle,
  98   IN      TPMI_SH_POLICY            PolicySession,
  99   IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 100   IN      TPM2B_NONCE               *NonceTPM,
 101   IN      TPM2B_DIGEST              *CpHashA,
 102   IN      TPM2B_NONCE               *PolicyRef,
 103   IN      INT32                     Expiration,
 104   OUT     TPM2B_TIMEOUT             *Timeout,
 105   OUT     TPMT_TK_AUTH              *PolicyTicket
 106   )
 107 {
 108   EFI_STATUS                        Status;
 109   TPM2_POLICY_SECRET_COMMAND        SendBuffer;
 110   TPM2_POLICY_SECRET_RESPONSE       RecvBuffer;
 111   UINT32                            SendBufferSize;
 112   UINT32                            RecvBufferSize;
 113   UINT8                             *Buffer;
 114   UINT32                            SessionInfoSize;
 115
 116   //
 117   // Construct command
 118   //
 119   SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
 120   SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_PolicySecret);
 121   SendBuffer.AuthHandle = SwapBytes32 (AuthHandle);
 122   SendBuffer.PolicySession = SwapBytes32 (PolicySession);
 123
 124   //
 125   // Add in Auth session
 126   //
 127   Buffer = (UINT8 *)&SendBuffer.AuthSession;
 128
 129   // sessionInfoSize
 130   SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
 131   Buffer += SessionInfoSize;
 132   SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);
 133
 134   //
 135   // Real data
 136   //
 137   WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(NonceTPM->size));
 138   Buffer += sizeof(UINT16);
 139   CopyMem (Buffer, NonceTPM->buffer, NonceTPM->size);
 140   Buffer += NonceTPM->size;
 141
 142   WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(CpHashA->size));
 143   Buffer += sizeof(UINT16);
 144   CopyMem (Buffer, CpHashA->buffer, CpHashA->size);
 145   Buffer += CpHashA->size;
 146
 147   WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(PolicyRef->size));
 148   Buffer += sizeof(UINT16);
 149   CopyMem (Buffer, PolicyRef->buffer, PolicyRef->size);
 150   Buffer += PolicyRef->size;
 151
 152   WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32((UINT32)Expiration));
 153   Buffer += sizeof(UINT32);
 154
 155   SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);
 156   SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
 157
 158   //
 159   // send Tpm command
 160   //
 161   RecvBufferSize = sizeof (RecvBuffer);
 162   Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
 163   if (EFI_ERROR (Status)) {
 164     goto Done;
 165   }
 166
 167   if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
 168     DEBUG ((EFI_D_ERROR, "Tpm2PolicySecret - RecvBufferSize Error - %x\n", RecvBufferSize));
 169     Status = EFI_DEVICE_ERROR;
 170     goto Done;
 171   }
 172   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
 173     DEBUG ((EFI_D_ERROR, "Tpm2PolicySecret - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
 174     Status = EFI_DEVICE_ERROR;
 175     goto Done;
 176   }
 177
 178   //
 179   // Return the response
 180   //
 181   Buffer = (UINT8 *)&RecvBuffer.Timeout;
 182   Timeout->size = SwapBytes16(ReadUnaligned16 ((UINT16 *)Buffer));
 183   Buffer += sizeof(UINT16);
 184   CopyMem (Timeout->buffer, Buffer, Timeout->size);
 185
 186   PolicyTicket->tag = SwapBytes16(ReadUnaligned16 ((UINT16 *)Buffer));
 187   Buffer += sizeof(UINT16);
 188   PolicyTicket->hierarchy = SwapBytes32(ReadUnaligned32 ((UINT32 *)Buffer));
 189   Buffer += sizeof(UINT32);
 190   PolicyTicket->digest.size = SwapBytes16(ReadUnaligned16 ((UINT16 *)Buffer));
 191   Buffer += sizeof(UINT16);
 192   CopyMem (PolicyTicket->digest.buffer, Buffer, PolicyTicket->digest.size);
 193
 194 Done:
 195   //
 196   // Clear AuthSession Content
 197   //
 198   ZeroMem (&SendBuffer, sizeof(SendBuffer));
 199   ZeroMem (&RecvBuffer, sizeof(RecvBuffer));
 200   return Status;
 201 }
 202
 203 /**
 204   This command allows options in authorizations without requiring that the TPM evaluate all of the options.
 205   If a policy may be satisfied by different sets of conditions, the TPM need only evaluate one set that
 206   satisfies the policy. This command will indicate that one of the required sets of conditions has been
 207   satisfied.
 208
 209   @param[in] PolicySession      Handle for the policy session being extended.
 210   @param[in] HashList           the list of hashes to check for a match.
 211
 212   @retval EFI_SUCCESS            Operation completed successfully.
 213   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 214 **/
 215 EFI_STATUS
 216 EFIAPI
 217 Tpm2PolicyOR (
 218   IN TPMI_SH_POLICY           PolicySession,
 219   IN TPML_DIGEST              *HashList
 220   )
 221 {
 222   EFI_STATUS                        Status;
 223   TPM2_POLICY_OR_COMMAND            SendBuffer;
 224   TPM2_POLICY_OR_RESPONSE           RecvBuffer;
 225   UINT32                            SendBufferSize;
 226   UINT32                            RecvBufferSize;
 227   UINT8                             *Buffer;
 228   UINTN                             Index;
 229
 230   //
 231   // Construct command
 232   //
 233   SendBuffer.Header.tag = SwapBytes16(TPM_ST_NO_SESSIONS);
 234   SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_PolicyOR);
 235
 236   SendBuffer.PolicySession = SwapBytes32 (PolicySession);
 237   Buffer = (UINT8 *)&SendBuffer.HashList;
 238   WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32 (HashList->count));
 239   Buffer += sizeof(UINT32);
 240   for (Index = 0; Index < HashList->count; Index++) {
 241     WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (HashList->digests[Index].size));
 242     Buffer += sizeof(UINT16);
 243     CopyMem (Buffer, HashList->digests[Index].buffer, HashList->digests[Index].size);
 244     Buffer += HashList->digests[Index].size;
 245   }
 246
 247   SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);
 248   SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
 249
 250   //
 251   // send Tpm command
 252   //
 253   RecvBufferSize = sizeof (RecvBuffer);
 254   Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
 255   if (EFI_ERROR (Status)) {
 256     return Status;
 257   }
 258
 259   if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
 260     DEBUG ((EFI_D_ERROR, "Tpm2PolicyOR - RecvBufferSize Error - %x\n", RecvBufferSize));
 261     return EFI_DEVICE_ERROR;
 262   }
 263   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
 264     DEBUG ((EFI_D_ERROR, "Tpm2PolicyOR - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
 265     return EFI_DEVICE_ERROR;
 266   }
 267
 268   return EFI_SUCCESS;
 269 }
 270
 271 /**
 272   This command indicates that the authorization will be limited to a specific command code.
 273
 274   @param[in]  PolicySession      Handle for the policy session being extended.
 275   @param[in]  Code               The allowed commandCode.
 276
 277   @retval EFI_SUCCESS            Operation completed successfully.
 278   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 279 **/
 280 EFI_STATUS
 281 EFIAPI
 282 Tpm2PolicyCommandCode (
 283   IN      TPMI_SH_POLICY            PolicySession,
 284   IN      TPM_CC                    Code
 285   )
 286 {
 287   EFI_STATUS                        Status;
 288   TPM2_POLICY_COMMAND_CODE_COMMAND  SendBuffer;
 289   TPM2_POLICY_COMMAND_CODE_RESPONSE RecvBuffer;
 290   UINT32                            SendBufferSize;
 291   UINT32                            RecvBufferSize;
 292
 293   //
 294   // Construct command
 295   //
 296   SendBuffer.Header.tag = SwapBytes16(TPM_ST_NO_SESSIONS);
 297   SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_PolicyCommandCode);
 298
 299   SendBuffer.PolicySession = SwapBytes32 (PolicySession);
 300   SendBuffer.Code = SwapBytes32 (Code);
 301
 302   SendBufferSize = (UINT32) sizeof (SendBuffer);
 303   SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
 304
 305   //
 306   // send Tpm command
 307   //
 308   RecvBufferSize = sizeof (RecvBuffer);
 309   Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
 310   if (EFI_ERROR (Status)) {
 311     return Status;
 312   }
 313
 314   if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
 315     DEBUG ((EFI_D_ERROR, "Tpm2PolicyCommandCode - RecvBufferSize Error - %x\n", RecvBufferSize));
 316     return EFI_DEVICE_ERROR;
 317   }
 318   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
 319     DEBUG ((EFI_D_ERROR, "Tpm2PolicyCommandCode - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
 320     return EFI_DEVICE_ERROR;
 321   }
 322
 323   return EFI_SUCCESS;
 324 }
 325
 326 /**
 327   This command returns the current policyDigest of the session. This command allows the TPM
 328   to be used to perform the actions required to precompute the authPolicy for an object.
 329
 330   @param[in]  PolicySession      Handle for the policy session.
 331   @param[out] PolicyHash         the current value of the policyHash of policySession.
 332
 333   @retval EFI_SUCCESS            Operation completed successfully.
 334   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 335 **/
 336 EFI_STATUS
 337 EFIAPI
 338 Tpm2PolicyGetDigest (
 339   IN      TPMI_SH_POLICY            PolicySession,
 340      OUT  TPM2B_DIGEST              *PolicyHash
 341   )
 342 {
 343   EFI_STATUS                        Status;
 344   TPM2_POLICY_GET_DIGEST_COMMAND    SendBuffer;
 345   TPM2_POLICY_GET_DIGEST_RESPONSE   RecvBuffer;
 346   UINT32                            SendBufferSize;
 347   UINT32                            RecvBufferSize;
 348
 349   //
 350   // Construct command
 351   //
 352   SendBuffer.Header.tag = SwapBytes16(TPM_ST_NO_SESSIONS);
 353   SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_PolicyGetDigest);
 354
 355   SendBuffer.PolicySession = SwapBytes32 (PolicySession);
 356
 357   SendBufferSize = (UINT32) sizeof (SendBuffer);
 358   SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
 359
 360   //
 361   // send Tpm command
 362   //
 363   RecvBufferSize = sizeof (RecvBuffer);
 364   Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
 365   if (EFI_ERROR (Status)) {
 366     return Status;
 367   }
 368
 369   if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
 370     DEBUG ((EFI_D_ERROR, "Tpm2PolicyGetDigest - RecvBufferSize Error - %x\n", RecvBufferSize));
 371     return EFI_DEVICE_ERROR;
 372   }
 373   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
 374     DEBUG ((EFI_D_ERROR, "Tpm2PolicyGetDigest - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
 375     return EFI_DEVICE_ERROR;
 376   }
 377
 378   //
 379   // Return the response
 380   //
 381   PolicyHash->size = SwapBytes16 (RecvBuffer.PolicyHash.size);
 382   CopyMem (PolicyHash->buffer, &RecvBuffer.PolicyHash.buffer, PolicyHash->size);
 383
 384   return EFI_SUCCESS;
 385 }