path: root/Entity.c

// This file was extracted from the TCG Published
// Trusted Platform Module Library
// Part 4: Supporting Routines
// Family "2.0"
// Level 00 Revision 01.16
// October 30, 2014

#include "InternalRoutines.h"
//
//
//
//          Functions
//
//          EntityGetLoadStatus()
//
//     This function will indicate if the entity associated with a handle is present in TPM memory. If the handle is
//     a persistent object handle, and the object exists, the persistent object is moved from NV memory into a
//     RAM object slot and the persistent handle is replaced with the transient object handle for the slot.
//
//     Error Returns                     Meaning
//
//     TPM_RC_HANDLE                     handle type does not match
//     TPM_RC_REFERENCE_H0               entity is not present
//     TPM_RC_HIERARCHY                  entity belongs to a disabled hierarchy
//     TPM_RC_OBJECT_MEMORY              handle is an evict object but there is no space to load it to RAM
//
TPM_RC
EntityGetLoadStatus(
    TPM_HANDLE          *handle,              // IN/OUT: handle of the entity
    TPM_CC               commandCode          // IN: the commmandCode
    )
{
    TPM_RC              result = TPM_RC_SUCCESS;
    switch(HandleGetType(*handle))
    {
        // For handles associated with hierarchies, the entity is present
        // only if the associated enable is SET.
        case TPM_HT_PERMANENT:
            switch(*handle)
            {
                case TPM_RH_OWNER:
                    if(!gc.shEnable)
                        result = TPM_RC_HIERARCHY;
                    break;
#ifdef    VENDOR_PERMANENT
                 case VENDOR_PERMANENT:
#endif
                   case TPM_RH_ENDORSEMENT:
                       if(!gc.ehEnable)
                            result = TPM_RC_HIERARCHY;
                       break;
                   case TPM_RH_PLATFORM:
                       if(!g_phEnable)
                            result = TPM_RC_HIERARCHY;
                       break;
                       // null handle, PW session handle and lockout
                       // handle are always available
                   case TPM_RH_NULL:
                   case TPM_RS_PW:
                   case TPM_RH_LOCKOUT:
                       break;
                   default:
                       // handling of the manufacture_specific handles
                       if(      ((TPM_RH)*handle >= TPM_RH_FIRST)
                            && ((TPM_RH)*handle <= TPM_RH_LAST))
                            // use the value that would have been returned from
                            // unmarshaling if it did the handle filtering
                                result = TPM_RC_VALUE;
                       else
                            pAssert(FALSE);
                       break;
            }
            break;
        case TPM_HT_TRANSIENT:
            // For a transient object, check if the handle is associated
            // with a loaded object.
            if(!ObjectIsPresent(*handle))
                 result = TPM_RC_REFERENCE_H0;
            break;
        case TPM_HT_PERSISTENT:
            // Persistent object
            // Copy the persistent object to RAM and replace the handle with the
            // handle of the assigned slot. A TPM_RC_OBJECT_MEMORY,
            // TPM_RC_HIERARCHY or TPM_RC_REFERENCE_H0 error may be returned by
            // ObjectLoadEvict()
            result = ObjectLoadEvict(handle, commandCode);
            break;
        case TPM_HT_HMAC_SESSION:
            // For an HMAC session, see if the session is loaded
            // and if the session in the session slot is actually
            // an HMAC session.
            if(SessionIsLoaded(*handle))
            {
                 SESSION             *session;
                 session = SessionGet(*handle);
                 // Check if the session is a HMAC session
                 if(session->attributes.isPolicy == SET)
                     result = TPM_RC_HANDLE;
            }
            else
                 result = TPM_RC_REFERENCE_H0;
            break;
        case TPM_HT_POLICY_SESSION:
            // For a policy session, see if the session is loaded
            // and if the session in the session slot is actually
            // a policy session.
            if(SessionIsLoaded(*handle))
            {
                 SESSION             *session;
                 session = SessionGet(*handle);
                 // Check if the session is a policy session
                 if(session->attributes.isPolicy == CLEAR)
                     result = TPM_RC_HANDLE;
            }
            else
                 result = TPM_RC_REFERENCE_H0;
            break;
        case TPM_HT_NV_INDEX:
            // For an NV Index, use the platform-specific routine
            // to search the IN Index space.
            result = NvIndexIsAccessible(*handle, commandCode);
            break;
        case TPM_HT_PCR:
            // Any PCR handle that is unmarshaled successfully referenced
            // a PCR that is defined.
            break;
        default:
            // Any other handle type is a defect in the unmarshaling code.
            pAssert(FALSE);
            break;
   }
   return result;
}
//
//
//
//           EntityGetAuthValue()
//
//      This function is used to access the authValue associated with a handle. This function assumes that the
//      handle references an entity that is accessible and the handle is not for a persistent objects. That is
//      EntityGetLoadStatus() should have been called. Also, the accessibility of the authValue should have been
//      verified by IsAuthValueAvailable().
//      This function copies the authorization value of the entity to auth.
//      Return value is the number of octets copied to auth.
//
UINT16
EntityGetAuthValue(
    TPMI_DH_ENTITY       handle,             // IN: handle of entity
    AUTH_VALUE          *auth                // OUT: authValue of the entity
    )
{
    TPM2B_AUTH           authValue = {};
   switch(HandleGetType(handle))
   {
       case TPM_HT_PERMANENT:
           switch(handle)
           {
               case TPM_RH_OWNER:
                   // ownerAuth for TPM_RH_OWNER
                   authValue = gp.ownerAuth;
                   break;
               case TPM_RH_ENDORSEMENT:
                   // endorsementAuth for TPM_RH_ENDORSEMENT
                   authValue = gp.endorsementAuth;
                   break;
               case TPM_RH_PLATFORM:
                   // platformAuth for TPM_RH_PLATFORM
                   authValue = gc.platformAuth;
                   break;
               case TPM_RH_LOCKOUT:
                   // lockoutAuth for TPM_RH_LOCKOUT
                   authValue = gp.lockoutAuth;
                   break;
               case TPM_RH_NULL:
                   // nullAuth for TPM_RH_NULL. Return 0 directly here
                   return 0;
                   break;
#ifdef VENDOR_PERMANENT
               case VENDOR_PERMANENT:
                   // vendor auth value
                   authValue = g_platformUniqueDetails;
#endif
               default:
                   // If any other permanent handle is present it is
                   // a code defect.
                   pAssert(FALSE);
                   break;
           }
           break;
       case TPM_HT_TRANSIENT:
           // authValue for an object
           // A persistent object would have been copied into RAM
           // and would have an transient object handle here.
           {
               OBJECT          *object;
               object = ObjectGet(handle);
               // special handling if this is a sequence object
               if(ObjectIsSequence(object))
                   {
                       authValue = ((HASH_OBJECT *)object)->auth;
                   }
                   else
                   {
                       // Auth value is available only when the private portion of
                       // the object is loaded. The check should be made before
                       // this function is called
                       pAssert(object->attributes.publicOnly == CLEAR);
                       authValue = object->sensitive.authValue;
                   }
             }
             break;
         case TPM_HT_NV_INDEX:
             // authValue for an NV index
             {
                  NV_INDEX        nvIndex;
                  NvGetIndexInfo(handle, &nvIndex);
                  authValue = nvIndex.authValue;
             }
             break;
         case TPM_HT_PCR:
             // authValue for PCR
             PCRGetAuthValue(handle, &authValue);
             break;
         default:
             // If any other handle type is present here, then there is a defect
             // in the unmarshaling code.
             pAssert(FALSE);
             break;
    }
    // Copy the authValue
    pAssert(authValue.t.size <= sizeof(authValue.t.buffer));
    MemoryCopy(auth, authValue.t.buffer, authValue.t.size, sizeof(TPMU_HA));
    return authValue.t.size;
}
//
//
//           EntityGetAuthPolicy()
//
//      This function is used to access the authPolicy associated with a handle. This function assumes that the
//      handle references an entity that is accessible and the handle is not for a persistent objects. That is
//      EntityGetLoadStatus() should have been called. Also, the accessibility of the authPolicy should have
//      been verified by IsAuthPolicyAvailable().
//      This function copies the authorization policy of the entity to authPolicy.
//      The return value is the hash algorithm for the policy.
//
TPMI_ALG_HASH
EntityGetAuthPolicy(
    TPMI_DH_ENTITY       handle,             // IN: handle of entity
    TPM2B_DIGEST        *authPolicy          // OUT: authPolicy of the entity
    )
{
    TPMI_ALG_HASH            hashAlg = TPM_ALG_NULL;
    switch(HandleGetType(handle))
    {
        case TPM_HT_PERMANENT:
            switch(handle)
            {
                case TPM_RH_OWNER:
//
                      // ownerPolicy for TPM_RH_OWNER
                      *authPolicy = gp.ownerPolicy;
                      hashAlg = gp.ownerAlg;
                      break;
                  case TPM_RH_ENDORSEMENT:
                      // endorsementPolicy for TPM_RH_ENDORSEMENT
                      *authPolicy = gp.endorsementPolicy;
                      hashAlg = gp.endorsementAlg;
                      break;
                  case TPM_RH_PLATFORM:
                      // platformPolicy for TPM_RH_PLATFORM
                      *authPolicy = gc.platformPolicy;
                      hashAlg = gc.platformAlg;
                      break;
                  case TPM_RH_LOCKOUT:
                      // lockoutPolicy for TPM_RH_LOCKOUT
                      *authPolicy = gp.lockoutPolicy;
                      hashAlg = gp.lockoutAlg;
                      break;
                  default:
                      // If any other permanent handle is present it is
                      // a code defect.
                      pAssert(FALSE);
                      break;
             }
             break;
         case TPM_HT_TRANSIENT:
             // authPolicy for an object
             {
                  OBJECT *object = ObjectGet(handle);
                  *authPolicy = object->publicArea.authPolicy;
                  hashAlg = object->publicArea.nameAlg;
             }
             break;
         case TPM_HT_NV_INDEX:
             // authPolicy for a NV index
             {
                  NV_INDEX        nvIndex;
                  NvGetIndexInfo(handle, &nvIndex);
                  *authPolicy = nvIndex.publicArea.authPolicy;
                  hashAlg = nvIndex.publicArea.nameAlg;
             }
             break;
         case TPM_HT_PCR:
             // authPolicy for a PCR
             hashAlg = PCRGetAuthPolicy(handle, authPolicy);
             break;
         default:
             // If any other handle type is present it is a code defect.
             pAssert(FALSE);
             break;
   }
   return hashAlg;
}
//
//
//           EntityGetName()
//
//      This function returns the Name associated with a handle. It will set name to the Name and return the size
//      of the Name string.
//
UINT16
EntityGetName(
   TPMI_DH_ENTITY       handle,           // IN: handle of entity
   NAME                *name              // OUT: name of entity
    )
{
    UINT16              nameSize;
    INT32 bufferSize = sizeof(TPM_HANDLE);
    switch(HandleGetType(handle))
    {
        case TPM_HT_TRANSIENT:
            // Name for an object
            nameSize = ObjectGetName(handle, name);
            break;
        case TPM_HT_NV_INDEX:
            // Name for a NV index
            nameSize = NvGetName(handle, name);
            break;
        default:
            // For all other types, the handle is the Name
            nameSize = TPM_HANDLE_Marshal(&handle, (BYTE **)&name, &bufferSize);
            break;
    }
    return nameSize;
}
//
//
//           EntityGetHierarchy()
//
//      This function returns the hierarchy handle associated with an entity.
//      a) A handle that is a hierarchy handle is associated with itself.
//      b) An NV index belongs to TPM_RH_PLATFORM if TPMA_NV_PLATFORMCREATE, is SET,
//         otherwise it belongs to TPM_RH_OWNER
//      c) An object handle belongs to its hierarchy. All other handles belong to the platform hierarchy. or an NV
//         Index.
//
TPMI_RH_HIERARCHY
EntityGetHierarchy(
    TPMI_DH_ENTITY       handle             // IN :handle of entity
    )
{
    TPMI_RH_HIERARCHY             hierarcy = TPM_RH_NULL;
    switch(HandleGetType(handle))
    {
        case TPM_HT_PERMANENT:
            // hierarchy for a permanent handle
            switch(handle)
            {
                case TPM_RH_PLATFORM:
                case TPM_RH_ENDORSEMENT:
                case TPM_RH_NULL:
                    hierarcy = handle;
                    break;
                // all other permanent handles are associated with the owner
                // hierarchy. (should only be TPM_RH_OWNER and TPM_RH_LOCKOUT)
                default:
                    hierarcy = TPM_RH_OWNER;
                    break;
            }
            break;
        case TPM_HT_NV_INDEX:
            // hierarchy for NV index
            {
                NV_INDEX        nvIndex;
                NvGetIndexInfo(handle, &nvIndex);
                // If only the platform can delete the index, then it is
                  // considered to be in the platform hierarchy, otherwise it
                  // is in the owner hierarchy.
                  if(nvIndex.publicArea.attributes.TPMA_NV_PLATFORMCREATE == SET)
                      hierarcy = TPM_RH_PLATFORM;
                  else
                      hierarcy = TPM_RH_OWNER;
             }
             break;
         case TPM_HT_TRANSIENT:
             // hierarchy for an object
             {
                 OBJECT          *object;
                 object = ObjectGet(handle);
                 if(object->attributes.ppsHierarchy)
                 {
                     hierarcy = TPM_RH_PLATFORM;
                 }
                 else if(object->attributes.epsHierarchy)
                 {
                     hierarcy = TPM_RH_ENDORSEMENT;
                 }
                 else if(object->attributes.spsHierarchy)
                 {
                     hierarcy = TPM_RH_OWNER;
                 }
             }
             break;
         case TPM_HT_PCR:
             hierarcy = TPM_RH_OWNER;
             break;
         default:
             pAssert(0);
             break;
     }
     // this is unreachable but it provides a return value for the default
     // case which makes the complier happy
     return hierarcy;
}