120 lines
4.5 KiB
C
120 lines
4.5 KiB
C
// This file was extracted from the TCG Published
|
|
// Trusted Platform Module Library
|
|
// Part 4: Supporting Routines
|
|
// Family "2.0"
|
|
// Level 00 Revision 01.16
|
|
// October 30, 2014
|
|
|
|
#include "InternalRoutines.h"
|
|
#include "NV_spt_fp.h"
|
|
//
|
|
//
|
|
// Fuctions
|
|
//
|
|
// NvReadAccessChecks()
|
|
//
|
|
// Common routine for validating a read Used by TPM2_NV_Read(), TPM2_NV_ReadLock() and
|
|
// TPM2_PolicyNV()
|
|
//
|
|
// Error Returns Meaning
|
|
//
|
|
// TPM_RC_NV_AUTHORIZATION autHandle is not allowed to authorize read of the index
|
|
// TPM_RC_NV_LOCKED Read locked
|
|
// TPM_RC_NV_UNINITIALIZED Try to read an uninitialized index
|
|
//
|
|
TPM_RC
|
|
NvReadAccessChecks(
|
|
TPM_HANDLE authHandle, // IN: the handle that provided the
|
|
// authorization
|
|
TPM_HANDLE nvHandle // IN: the handle of the NV index to be written
|
|
)
|
|
{
|
|
NV_INDEX nvIndex;
|
|
// Get NV index info
|
|
NvGetIndexInfo(nvHandle, &nvIndex);
|
|
// This check may be done before doing authorization checks as is done in this
|
|
// version of the reference code. If not done there, then uncomment the next
|
|
// three lines.
|
|
// // If data is read locked, returns an error
|
|
// if(nvIndex.publicArea.attributes.TPMA_NV_READLOCKED == SET)
|
|
// return TPM_RC_NV_LOCKED;
|
|
// If the authorization was provided by the owner or platform, then check
|
|
// that the attributes allow the read. If the authorization handle
|
|
// is the same as the index, then the checks were made when the authorization
|
|
// was checked..
|
|
if(authHandle == TPM_RH_OWNER)
|
|
{
|
|
// If Owner provided auth then ONWERWRITE must be SET
|
|
if(! nvIndex.publicArea.attributes.TPMA_NV_OWNERREAD)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
}
|
|
else if(authHandle == TPM_RH_PLATFORM)
|
|
{
|
|
// If Platform provided auth then PPWRITE must be SET
|
|
if(!nvIndex.publicArea.attributes.TPMA_NV_PPREAD)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
}
|
|
// If neither Owner nor Platform provided auth, make sure that it was
|
|
// provided by this index.
|
|
else if(authHandle != nvHandle)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
// If the index has not been written, then the value cannot be read
|
|
// NOTE: This has to come after other access checks to make sure that
|
|
// the proper authorization is given to TPM2_NV_ReadLock()
|
|
if(nvIndex.publicArea.attributes.TPMA_NV_WRITTEN == CLEAR)
|
|
return TPM_RC_NV_UNINITIALIZED;
|
|
return TPM_RC_SUCCESS;
|
|
}
|
|
//
|
|
//
|
|
// NvWriteAccessChecks()
|
|
//
|
|
// Common routine for validating a write Used by TPM2_NV_Write(), TPM2_NV_Increment(),
|
|
// TPM2_SetBits(), and TPM2_NV_WriteLock()
|
|
//
|
|
//
|
|
//
|
|
//
|
|
// Error Returns Meaning
|
|
//
|
|
// TPM_RC_NV_AUTHORIZATION Authorization fails
|
|
// TPM_RC_NV_LOCKED Write locked
|
|
//
|
|
TPM_RC
|
|
NvWriteAccessChecks(
|
|
TPM_HANDLE authHandle, // IN: the handle that provided the
|
|
// authorization
|
|
TPM_HANDLE nvHandle // IN: the handle of the NV index to be written
|
|
)
|
|
{
|
|
NV_INDEX nvIndex;
|
|
// Get NV index info
|
|
NvGetIndexInfo(nvHandle, &nvIndex);
|
|
// This check may be done before doing authorization checks as is done in this
|
|
// version of the reference code. If not done there, then uncomment the next
|
|
// three lines.
|
|
// // If data is write locked, returns an error
|
|
// if(nvIndex.publicArea.attributes.TPMA_NV_WRITELOCKED == SET)
|
|
// return TPM_RC_NV_LOCKED;
|
|
// If the authorization was provided by the owner or platform, then check
|
|
// that the attributes allow the write. If the authorization handle
|
|
// is the same as the index, then the checks were made when the authorization
|
|
// was checked..
|
|
if(authHandle == TPM_RH_OWNER)
|
|
{
|
|
// If Owner provided auth then ONWERWRITE must be SET
|
|
if(! nvIndex.publicArea.attributes.TPMA_NV_OWNERWRITE)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
}
|
|
else if(authHandle == TPM_RH_PLATFORM)
|
|
{
|
|
// If Platform provided auth then PPWRITE must be SET
|
|
if(!nvIndex.publicArea.attributes.TPMA_NV_PPWRITE)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
}
|
|
// If neither Owner nor Platform provided auth, make sure that it was
|
|
// provided by this index.
|
|
else if(authHandle != nvHandle)
|
|
return TPM_RC_NV_AUTHORIZATION;
|
|
return TPM_RC_SUCCESS;
|
|
}
|