diff --git a/.github/workflows/make-test-swtpm.yml b/.github/workflows/make-test-swtpm.yml index a8a4d679..afe107dc 100644 --- a/.github/workflows/make-test-swtpm.yml +++ b/.github/workflows/make-test-swtpm.yml @@ -183,7 +183,7 @@ jobs: # capture logs on failure - name: Upload failure logs if: failure() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: wolftpm-test-logs path: | diff --git a/IDE/QNX/README.md b/IDE/QNX/README.md index eef90c6d..4413feba 100644 --- a/IDE/QNX/README.md +++ b/IDE/QNX/README.md @@ -41,9 +41,8 @@ Here is a template: /* Reduce stack use */ #define MAX_COMMAND_SIZE 1024 -#define MAX_RESPONSE_SIZE 1024 -#define WOLFTPM2_MAX_BUFFER 1500 -#define MAX_DIGEST_BUFFER 973 +#define MAX_RESPONSE_SIZE 1350 +#define MAX_DIGEST_BUFFER 896 /* Debugging */ #if 1 @@ -113,7 +112,7 @@ Edit the following QNX BSP files: @@ -442,7 +442,7 @@ static void xzynq_setup(xzynq_spi_t *dev, uint32_t device) spi_debug1("%s: CONFIG_SPI_REG = 0x%x", __func__, dev->ctrl[id]); #endif - + - if(dev->fcs) { + if(dev->fcs || (devlist[id].cfg.mode & SPI_MODE_MAN_CS)) { out32(base + XZYNQ_SPI_CR_OFFSET, dev->ctrl[id] | XZYNQ_SPI_CR_MAN_CS); @@ -122,7 +121,7 @@ Edit the following QNX BSP files: @@ -621,7 +621,7 @@ void *xzynq_xfer(void *hdl, uint32_t device, uint8_t *buf, int *len) reset = 1; } - + - if(!dev->fcs) { + if(!dev->fcs && !(devlist[id].cfg.mode & SPI_MODE_MAN_CS)) { xzynq_spi_slave_select(dev, id, 0); @@ -135,12 +134,12 @@ Edit the following QNX BSP files: @@ -72,6 +73,16 @@ int xzynq_cfg(void *hdl, spi_cfg_t *cfg, int cs) /* Enable ModeFail generation */ ctrl |= XZYNQ_SPI_CR_MFAIL_EN; - + + if (cfg->mode & SPI_MODE_MAN_CS) + ctrl |= XZYNQ_SPI_CR_MAN_CS; /* enable manual CS mode */ + + if (cfg->mode & SPI_MODE_CLEAR_CS) { -+ /* make sure all chip selects are de-asserted */ ++ /* make sure all chip selects are de-asserted */ + /* set all CS bits high to de-assert */ + out32(base + XZYNQ_SPI_CR_OFFSET, + in32(base + XZYNQ_SPI_CR_OFFSET) | XZYNQ_SPI_CR_CS); @@ -156,7 +155,7 @@ Edit the following QNX BSP files: #define SPI_MODE_IDLE_INSERT (1 << 16) +#define SPI_MODE_MAN_CS (1 << 17) /* Manual Chip select */ +#define SPI_MODE_CLEAR_CS (1 << 18) /* Clear all chip selects (used with SPI_MODE_MAN_CS) */ - + #define SPI_MODE_LOCKED (1 << 31) /* The device is locked by another client */ ``` diff --git a/configure.ac b/configure.ac index 803c1d2d..4980ecc4 100644 --- a/configure.ac +++ b/configure.ac @@ -355,7 +355,7 @@ then # Reduces max packet and buffer sizes to 1024 bytes # RSA KeyGen AES response is 1329 MAX_RESPONSE_SIZE - AM_CFLAGS="$AM_CFLAGS -DMAX_COMMAND_SIZE=1024 -DMAX_RESPONSE_SIZE=1350 -DWOLFTPM2_MAX_BUFFER=1500 -DMAX_DIGEST_BUFFER=973" + AM_CFLAGS="$AM_CFLAGS -DMAX_COMMAND_SIZE=1024 -DMAX_RESPONSE_SIZE=1350 -DMAX_DIGEST_BUFFER=896" # If parameter encryption is not used then maximum session count is one if test "x$ENABLED_WOLFCRYPT" = "xno" diff --git a/examples/endorsement/get_ek_certs.c b/examples/endorsement/get_ek_certs.c index ae9475f8..9d575d75 100644 --- a/examples/endorsement/get_ek_certs.c +++ b/examples/endorsement/get_ek_certs.c @@ -208,12 +208,13 @@ int TPM2_EndorsementCert_Example(void* userCtx, int argc, char *argv[]) WOLFSSL_FILETYPE_PEM); if (rc == WOLFSSL_SUCCESS) { certSz++; - rc = 0; } else { - printf("Warning: Failed to load trusted PEM at index %d\n", i); + printf("Warning: Failed to load trusted PEM at index %d. " + "Error %s (rc %d)\n", i, TPM2_GetRCString(rc), rc); /* not fatal, continue loading trusted certs */ } + rc = 0; /* reset return code */ } printf("Loaded %d trusted certificates\n", certSz); } diff --git a/examples/nvram/store.c b/examples/nvram/store.c index 8ed544b1..980b8df4 100644 --- a/examples/nvram/store.c +++ b/examples/nvram/store.c @@ -79,6 +79,7 @@ int TPM2_NVRAM_Store_Example(void* userCtx, int argc, char *argv[]) word32 nvIndex = TPM2_DEMO_NVRAM_STORE_INDEX; byte* auth = (byte*)gNvAuth; word32 authSz = (word32)sizeof(gNvAuth)-1; + word32 nvSize; if (argc >= 2) { if (XSTRCMP(argv[1], "-?") == 0 || @@ -171,12 +172,17 @@ int TPM2_NVRAM_Store_Example(void* userCtx, int argc, char *argv[]) rc = wolfTPM2_GetNvAttributesTemplate(parent.hndl, &nvAttributes); if (rc != 0) goto exit; + /* Estimate size of NV */ + nvSize = + keyBlob.pub.size + sizeof(keyBlob.pub.size) + sizeof(UINT16) + + keyBlob.priv.size + sizeof(keyBlob.priv.size) + sizeof(UINT16); + /* Try and open existing NV */ rc = wolfTPM2_NVOpen(&dev, &nv, nvIndex, auth, authSz); if (rc != 0) { /* In not found try create using wolfTPM2 wrapper for NV_Define */ rc = wolfTPM2_NVCreateAuth(&dev, &parent, &nv, nvIndex, - nvAttributes, TPM2_DEMO_NV_TEST_SIZE, auth, authSz); + nvAttributes, nvSize, auth, authSz); if (rc != 0 && rc != TPM_RC_NV_DEFINED) goto exit; } diff --git a/examples/pkcs7/pkcs7.c b/examples/pkcs7/pkcs7.c index 451252b9..34f1807e 100644 --- a/examples/pkcs7/pkcs7.c +++ b/examples/pkcs7/pkcs7.c @@ -62,7 +62,7 @@ #ifdef ENABLE_PKCS7EX_EXAMPLE /* Dummy Function to Get Data */ -#define MY_DATA_CHUNKS WOLFTPM2_MAX_BUFFER +#define MY_DATA_CHUNKS MAX_DIGEST_BUFFER #define MY_DATA_TOTAL (1024 * 1024) + 12 /* odd remainder for test */ static int GetMyData(byte* buffer, word32 bufSz, word32 offset) { @@ -92,8 +92,9 @@ static int GetMyData(byte* buffer, word32 bufSz, word32 offset) /* The wc_PKCS7_EncodeSignedData_ex and wc_PKCS7_VerifySignedData_ex functions were added in this PR https://github.com/wolfSSL/wolfssl/pull/1780. */ -static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* derCert, - WOLFTPM2_BUFFER* derPubKey, int alg, enum wc_HashType hashType, const char* outFile) +static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, + byte* derCert, word32 derCertSz, byte* derPubKey, word32 derPubKeySz, + int alg, enum wc_HashType hashType, const char* outFile) { int rc; PKCS7 pkcs7; @@ -139,7 +140,7 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* /* Generate and verify PKCS#7 files containing data using TPM key */ rc = wc_PKCS7_Init(&pkcs7, NULL, tpmDevId); if (rc != 0) goto exit; - rc = wc_PKCS7_InitWithCert(&pkcs7, derCert->buffer, derCert->size); + rc = wc_PKCS7_InitWithCert(&pkcs7, derCert, derCertSz); if (rc != 0) goto exit; pkcs7.content = NULL; /* not used */ @@ -149,8 +150,8 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* pkcs7.rng = wolfTPM2_GetRng(dev); /* pass public key instead of private here. The PKCS7 will try a public * key decode if using crypto callbacks */ - pkcs7.privateKey = derPubKey->buffer; - pkcs7.privateKeySz = derPubKey->size; + pkcs7.privateKey = derPubKey; + pkcs7.privateKeySz = derPubKeySz; outputHeadSz = (int)sizeof(outputHead); outputFootSz = (int)sizeof(outputFoot); @@ -241,8 +242,9 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* } #endif /* ENABLE_PKCS7EX_EXAMPLE */ -static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* derCert, - WOLFTPM2_BUFFER* derPubKey, int alg, enum wc_HashType hashType, const char* outFile) +static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId, + byte* derCert, word32 derCertSz, byte* derPubKey, word32 derPubKeySz, + int alg, enum wc_HashType hashType, const char* outFile) { int rc; PKCS7 pkcs7; @@ -258,7 +260,7 @@ static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* de /* Generate and verify PKCS#7 files containing data using TPM key */ rc = wc_PKCS7_Init(&pkcs7, NULL, tpmDevId); if (rc != 0) goto exit; - rc = wc_PKCS7_InitWithCert(&pkcs7, derCert->buffer, derCert->size); + rc = wc_PKCS7_InitWithCert(&pkcs7, derCert, derCertSz); if (rc != 0) goto exit; pkcs7.content = data; @@ -268,8 +270,8 @@ static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId, WOLFTPM2_BUFFER* de pkcs7.rng = wolfTPM2_GetRng(dev); /* pass public key instead of private here. The PKCS7 will try a public * key decode if using crypto callbacks */ - pkcs7.privateKey = derPubKey->buffer; - pkcs7.privateKeySz = derPubKey->size; + pkcs7.privateKey = derPubKey; + pkcs7.privateKeySz = derPubKeySz; rc = wc_PKCS7_EncodeSignedData(&pkcs7, output, sizeof(output)); if (rc <= 0) goto exit; @@ -339,8 +341,10 @@ int TPM2_PKCS7_ExampleArgs(void* userCtx, int argc, char *argv[]) TPMT_PUBLIC publicTemplate; TpmCryptoDevCtx tpmCtx; int tpmDevId; - WOLFTPM2_BUFFER derCert; - WOLFTPM2_BUFFER derPubKey; + byte derCert[MAX_PKCS7_SIZE]; + word32 derCertSz; + byte derPubKey[MAX_PKCS7_SIZE]; + word32 derPubKeySz; #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) XFILE derFile; const char* inCert = NULL; @@ -475,35 +479,38 @@ int TPM2_PKCS7_ExampleArgs(void* userCtx, int argc, char *argv[]) derFile = XFOPEN(inCert, "rb"); if (derFile != XBADFILE) { XFSEEK(derFile, 0, XSEEK_END); - derCert.size = (int)XFTELL(derFile); + derCertSz = (int)XFTELL(derFile); XREWIND(derFile); - if (derCert.size > (int)sizeof(derCert.buffer)) { + if (derCertSz > (int)sizeof(derCert)) { rc = BUFFER_E; } else { - rc = (int)XFREAD(derCert.buffer, 1, derCert.size, derFile); - rc = (rc == derCert.size) ? 0 : -1; + rc = (int)XFREAD(derCert, 1, derCertSz, derFile); + rc = (rc == (int)derCertSz) ? 0 : -1; } XFCLOSE(derFile); if (rc != 0) goto exit; } +#else + rc = NOT_COMPILED_IN; + goto exit; #endif /* Export TPM public key as DER/ASN.1 (should match certificate) */ - derPubKey.size = (int)sizeof(derPubKey.buffer); + derPubKeySz = (int)sizeof(derPubKey); rc = wolfTPM2_ExportPublicKeyBuffer(&dev, &tpmKey, - ENCODING_TYPE_ASN1, derPubKey.buffer, (word32*)&derPubKey.size); + ENCODING_TYPE_ASN1, derPubKey, (word32*)&derPubKeySz); if (rc != 0) goto exit; /* PKCS 7 sign/verify example */ - rc = PKCS7_SignVerify(&dev, tpmDevId, &derCert, &derPubKey, alg, hashType, - outFile); + rc = PKCS7_SignVerify(&dev, tpmDevId, derCert, derCertSz, derPubKey, + derPubKeySz, alg, hashType, outFile); if (rc != 0) goto exit; #ifdef ENABLE_PKCS7EX_EXAMPLE /* PKCS 7 large data sign/verify example */ - rc = PKCS7_SignVerifyEx(&dev, tpmDevId, &derCert, &derPubKey, alg, hashType, - outFileEx); + rc = PKCS7_SignVerifyEx(&dev, tpmDevId, derCert, derCertSz, derPubKey, + derPubKeySz, alg, hashType, outFileEx); if (rc != 0) goto exit; #endif diff --git a/examples/tpm_test.h b/examples/tpm_test.h index c6316e88..32526865 100644 --- a/examples/tpm_test.h +++ b/examples/tpm_test.h @@ -44,7 +44,7 @@ #define TPM2_DEMO_NV_TEST_INDEX 0x01800200 #define TPM2_DEMO_NV_TEST_AUTH_INDEX 0x01800201 #define TPM2_DEMO_NVRAM_STORE_INDEX 0x01800202 -#define TPM2_DEMO_NV_TEST_SIZE 1024 /* max size on Infineon SLB9670 is 1664 */ +#define TPM2_DEMO_NV_TEST_SIZE MAX_DIGEST_BUFFER /* max size on Infineon SLB9670 is 1664 */ #define TPM2_DEMO_NV_COUNTER_INDEX 0x01800300 #define TPM2_DEMO_NV_SECURE_ROT_INDEX 0x01400200 diff --git a/src/tpm2_linux.c b/src/tpm2_linux.c index 5c597cd4..6f7e8c1c 100644 --- a/src/tpm2_linux.c +++ b/src/tpm2_linux.c @@ -28,7 +28,6 @@ #ifdef WOLFTPM_LINUX_DEV #include #include -#include /* Needed only for WOLFTPM2_MAX_BUFFER */ #include #include #include @@ -48,11 +47,7 @@ * partial reads. The only way to receive a complete response is to read * the maximum allowed TPM response from the kernel, which is 4K. And most * of the ARM systems use older kernels, such as the RPI that uses v4.12 - * - * The caller knows what the expected outcome of the operation is. Therefore, - * the response size is limited only by the WOLFTPM2_MAX_BUFFER used to limit - * the WOLFTPM2_BUFFER in wolfTPM wrappers */ - + */ /* Talk to a TPM device exposed by the Linux tpm_tis driver */ int TPM2_LINUX_SendCommand(TPM2_CTX* ctx, TPM2_Packet* packet) diff --git a/src/tpm2_wrap.c b/src/tpm2_wrap.c index b9c30aa2..f07d41c0 100644 --- a/src/tpm2_wrap.c +++ b/src/tpm2_wrap.c @@ -3013,16 +3013,15 @@ int wolfTPM2_ExportPublicKeyBuffer(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* tpmKey, /* Optionally convert to PEM */ if (rc == 0 && encodingType == ENCODING_TYPE_PEM) { #ifdef WOLFSSL_DER_TO_PEM - WOLFTPM2_BUFFER tmp; - if (derSz > (word32)sizeof(tmp.buffer)) { + byte tmp[MAX_CONTEXT_SIZE]; + if (derSz > (word32)sizeof(tmp)) { rc = BUFFER_E; } else { /* move DER to temp variable */ - tmp.size = derSz; - XMEMCPY(tmp.buffer, out, derSz); + XMEMCPY(tmp, out, derSz); XMEMSET(out, 0, *outSz); - rc = wc_DerToPem(tmp.buffer, tmp.size, out, *outSz, PUBLICKEY_TYPE); + rc = wc_DerToPem(tmp, derSz, out, *outSz, PUBLICKEY_TYPE); if (rc > 0) { *outSz = rc; rc = 0; @@ -6726,15 +6725,14 @@ static int CSR_MakeAndSign(WOLFTPM2_DEV* dev, WOLFTPM2_CSR* csr, CSRKey* key, /* Optionally convert to PEM */ if (rc >= 0 && outFormat == CTC_FILETYPE_PEM) { #ifdef WOLFSSL_DER_TO_PEM - WOLFTPM2_BUFFER tmp; - tmp.size = rc; - if (rc > (int)sizeof(tmp.buffer)) { + byte tmp[MAX_CONTEXT_SIZE]; + if (rc > (int)sizeof(tmp)) { rc = BUFFER_E; } else { - XMEMCPY(tmp.buffer, out, rc); + XMEMCPY(tmp, out, rc); XMEMSET(out, 0, outSz); - rc = wc_DerToPem(tmp.buffer, tmp.size, out, outSz, + rc = wc_DerToPem(tmp, (word32)rc, out, outSz, selfSignCert ? CERT_TYPE : CERTREQ_TYPE); } #else diff --git a/wolftpm/tpm2_wrap.h b/wolftpm/tpm2_wrap.h index 84bbc28a..9aa96e0c 100644 --- a/wolftpm/tpm2_wrap.h +++ b/wolftpm/tpm2_wrap.h @@ -95,13 +95,10 @@ typedef struct WOLFTPM2_CSR { } WOLFTPM2_CSR; #endif -#ifndef WOLFTPM2_MAX_BUFFER - #define WOLFTPM2_MAX_BUFFER 2048 -#endif - +/* buffer similar to TPM2B_MAX_BUFFER that can be used */ typedef struct WOLFTPM2_BUFFER { int size; - byte buffer[WOLFTPM2_MAX_BUFFER]; + byte buffer[MAX_DIGEST_BUFFER]; } WOLFTPM2_BUFFER; typedef enum WOLFTPM2_MFG {