// This file was extracted from the TCG Published

// Trusted Platform Module Library

// Part 4: Supporting Routines

// Family "2.0"

// Level 00 Revision 01.16

// October 30, 2014

#include     "InternalRoutines.h"

#include     "ExecCommand_fp.h"

#include     "HandleProcess_fp.h"

#include     "SessionProcess_fp.h"

#include     "CommandDispatcher_fp.h"

//

//     Uncomment this next #include if doing static command/response buffer sizing

//

// #include "CommandResponseSizes_fp.h"

//

//

//           ExecuteCommand()

//

//     The function performs the following steps.

//     a) Parses the command header from input buffer.

//     b) Calls ParseHandleBuffer() to parse the handle area of the command.

//     c) Validates that each of the handles references a loaded entity.

//

//     d) Calls ParseSessionBuffer() () to:

//          1) unmarshal and parse the session area;

//          2) check the authorizations; and

//          3) when necessary, decrypt a parameter.

//     e) Calls CommandDispatcher() to:

//          1) unmarshal the command parameters from the command buffer;

//          2) call the routine that performs the command actions; and

//          3) marshal the responses into the response buffer.

//     f)   If any error occurs in any of the steps above create the error response and return.

//     g) Calls BuildResponseSession() to:

//          1) when necessary, encrypt a parameter

//          2) build the response authorization sessions

//          3) update the audit sessions and nonces

//     h) Assembles handle, parameter and session buffers for response and return.

//

LIB_EXPORT void

ExecuteCommand(

    unsigned    int      requestSize,       //   IN: command buffer size

    unsigned    char    *request,           //   IN: command buffer

    unsigned    int     *responseSize,      //   OUT: response buffer size

    unsigned    char    **response          //   OUT: response buffer

    )

{

    // Command local variables

    TPM_ST               tag;                         // these first three variables are the

    UINT32               commandSize;

    TPM_CC               commandCode = 0;

    BYTE                     *parmBufferStart;        // pointer to the first byte of an

                                                      // optional parameter buffer

    UINT32                    parmBufferSize = 0;// number of bytes in parameter area

    UINT32                    handleNum = 0;          // number of handles unmarshaled into

                                                      // the handles array

    TPM_HANDLE                handles[MAX_HANDLE_NUM];// array to hold handles in the

                                                 // command. Only handles in the handle

                                                 // area are stored here, not handles

                                                 // passed as parameters.

    // Response local variables

    TPM_RC               result;                      // return code for the command

    TPM_ST                    resTag;                 // tag for the response

    UINT32                    resHandleSize = 0; //       size of the handle area in the

                                                 //       response. This is needed so that the

                                                 //       handle area can be skipped when

                                                 //       generating the rpHash.

    UINT32                    resParmSize = 0;        // the size of the response parameters

                                                      // These values go in the rpHash.

    UINT32                    resAuthSize = 0;        // size of authorization area in the

//

                                                   // response

   INT32                      size;                // remaining data to be unmarshaled

                                                   // or remaining space in the marshaling

                                                   // buffer

   BYTE                      *buffer;              // pointer into the buffer being used

                                                   // for marshaling or unmarshaling

   INT32                      bufferSize;          // size of buffer being used for

                                                   // marshaling or unmarshaling

   UINT32                     i;                    // local temp

// This next function call is used in development to size the command and response

// buffers. The values printed are the sizes of the internal structures and

// not the sizes of the canonical forms of the command response structures. Also,

// the sizes do not include the tag, commandCode, requestSize, or the authorization

// fields.

//CommandResponseSizes();

   // Set flags for NV access state. This should happen before any other

   // operation that may require a NV write. Note, that this needs to be done

   // even when in failure mode. Otherwise, g_updateNV would stay SET while in

   // Failure mode and the NB would be written on each call.

   g_updateNV = FALSE;

   g_clearOrderly = FALSE;

   // As of Sept 25, 2013, the failure mode handling has been incorporated in the

   // reference code. This implementation requires that the system support

   // setjmp/longjmp. This code is put here because of the complexity being

   // added to the platform and simulator code to deal with all the variations

   // of errors.

   if(g_inFailureMode)

   {

       // Do failure mode processing

       TpmFailureMode (requestSize, request, responseSize, response);

       return;

   }

#ifndef EMBEDDED_MODE

   if(setjmp(g_jumpBuffer) != 0)

   {

       // Get here if we got a longjump putting us into failure mode

       g_inFailureMode = TRUE;

       result = TPM_RC_FAILURE;

       goto Fail;

   }

#endif  // EMBEDDED_MODE   ^^^ not defined

   // Assume that everything is going to work.

   result = TPM_RC_SUCCESS;

   // Query platform to get the NV state. The result state is saved internally

   // and will be reported by NvIsAvailable(). The reference code requires that

   // accessibility of NV does not change during the execution of a command.

   // Specifically, if NV is available when the command execution starts and then

   // is not available later when it is necessary to write to NV, then the TPM

   // will go into failure mode.

   NvCheckState();

   // Due to the limitations of the simulation, TPM clock must be explicitly

   // synchronized with the system clock whenever a command is received.

   // This function call is not necessary in a hardware TPM. However, taking

   // a snapshot of the hardware timer at the beginning of the command allows

   // the time value to be consistent for the duration of the command execution.

   TimeUpdateToCurrent();

   // Any command through this function will unceremoniously end the

   // _TPM_Hash_Data/_TPM_Hash_End sequence.

   if(g_DRTMHandle != TPM_RH_UNASSIGNED)

       ObjectTerminateEvent();

     // Get command buffer size and command buffer.

     size = requestSize;

     buffer = request;

     // Parse command header: tag, commandSize and commandCode.

     // First parse the tag. The unmarshaling routine will validate

     // that it is either TPM_ST_SESSIONS or TPM_ST_NO_SESSIONS.

     result = TPMI_ST_COMMAND_TAG_Unmarshal(&tag, &buffer, &size);

     if(result != TPM_RC_SUCCESS)

         goto Cleanup;

     // Unmarshal the commandSize indicator.

     result = UINT32_Unmarshal(&commandSize, &buffer, &size);

     if(result != TPM_RC_SUCCESS)

         goto Cleanup;

     // On a TPM that receives bytes on a port, the number of bytes that were

     // received on that port is requestSize it must be identical to commandSize.

     // In addition, commandSize must not be larger than MAX_COMMAND_SIZE allowed

     // by the implementation. The check against MAX_COMMAND_SIZE may be redundant

     // as the input processing (the function that receives the command bytes and

     // places them in the input buffer) would likely have the input truncated when

     // it reaches MAX_COMMAND_SIZE, and requestSize would not equal commandSize.

     if(commandSize != requestSize || commandSize > MAX_COMMAND_SIZE)

     {

         result = TPM_RC_COMMAND_SIZE;

         goto Cleanup;

     }

     // Unmarshal the command code.

     result = TPM_CC_Unmarshal(&commandCode, &buffer, &size);

     if(result != TPM_RC_SUCCESS)

         goto Cleanup;

     // Check to see if the command is implemented.

     if(!CommandIsImplemented(commandCode))

     {

         result = TPM_RC_COMMAND_CODE;

         goto Cleanup;

     }

#if   FIELD_UPGRADE_IMPLEMENTED == YES

   // If the TPM is in FUM, then the only allowed command is

   // TPM_CC_FieldUpgradeData.

   if(IsFieldUgradeMode() && (commandCode != TPM_CC_FieldUpgradeData))

   {

        result = TPM_RC_UPGRADE;

        goto Cleanup;

   }

   else

#endif

        // Excepting FUM, the TPM only accepts TPM2_Startup() after

        // _TPM_Init. After getting a TPM2_Startup(), TPM2_Startup()

        // is no longer allowed.

        if((    !TPMIsStarted() && commandCode != TPM_CC_Startup)

             || (TPMIsStarted() && commandCode == TPM_CC_Startup))

        {

             result = TPM_RC_INITIALIZE;

             goto Cleanup;

        }

     // Start regular command process.

     // Parse Handle buffer.

     result = ParseHandleBuffer(commandCode, &buffer, &size, handles, &handleNum);

     if(result != TPM_RC_SUCCESS)

        goto Cleanup;

   // Number of handles retrieved from handle area should be less than

   // MAX_HANDLE_NUM.

   pAssert(handleNum <= MAX_HANDLE_NUM);

   // All handles in the handle area are required to reference TPM-resident

   // entities.

   for(i = 0; i < handleNum; i++)

   {

       result = EntityGetLoadStatus(&handles[i], commandCode);

       if(result != TPM_RC_SUCCESS)

       {

           if(result == TPM_RC_REFERENCE_H0)

               result = result + i;

           else

               result = RcSafeAddToResult(result, TPM_RC_H + g_rcIndex[i]);

           goto Cleanup;

       }

   }

   // Authorization session handling for the command.

   if(tag == TPM_ST_SESSIONS)

   {

       BYTE        *sessionBufferStart;// address of the session area first byte

                                       // in the input buffer

        UINT32        authorizationSize;   // number of bytes in the session area

        // Find out session buffer size.

        result = UINT32_Unmarshal(&authorizationSize, &buffer, &size);

        if(result != TPM_RC_SUCCESS)

            goto Cleanup;

        // Perform sanity check on the unmarshaled    value. If it is smaller than

        // the smallest possible session or larger    than the remaining size of

        // the command, then it is an error. NOTE:    This check could pass but the

        // session size could still be wrong. That    will be determined after the

        // sessions are unmarshaled.

        if(    authorizationSize < 9

            || authorizationSize > (UINT32) size)

        {

             result = TPM_RC_SIZE;

             goto Cleanup;

        }

        // The sessions, if any, follows authorizationSize.

        sessionBufferStart = buffer;

        // The parameters follow the session area.

        parmBufferStart = sessionBufferStart + authorizationSize;

        // Any data left over after removing the authorization sessions is

        // parameter data. If the command does not have parameters, then an

        // error will be returned if the remaining size is not zero. This is

        // checked later.

        parmBufferSize = size - authorizationSize;

        // The actions of ParseSessionBuffer() are described in the introduction.

        result = ParseSessionBuffer(commandCode,

                                    handleNum,

                                    handles,

                                    sessionBufferStart,

                                    authorizationSize,

                                    parmBufferStart,

                                    parmBufferSize);

         if(result != TPM_RC_SUCCESS)

             goto Cleanup;

   }

   else

   {

       // Whatever remains in the input buffer is used for the parameters of the

       // command.

       parmBufferStart = buffer;

       parmBufferSize = size;

         // The command has no authorization sessions.

         // If the command requires authorizations, then CheckAuthNoSession() will

         // return an error.

         result = CheckAuthNoSession(commandCode, handleNum, handles,

                                      parmBufferStart, parmBufferSize);

         if(result != TPM_RC_SUCCESS)

             goto Cleanup;

   }

   // CommandDispatcher returns a response handle buffer and a response parameter

   // buffer if it succeeds. It will also set the parameterSize field in the

   // buffer if the tag is TPM_RC_SESSIONS.

   result = CommandDispatcher(tag,

                              commandCode,

                              (INT32 *) &parmBufferSize,

                              parmBufferStart,

                              handles,

                              &resHandleSize,

                              &resParmSize);

   if(result != TPM_RC_SUCCESS)

       goto Cleanup;

   // Build the session area at the end of the parameter area.

   BuildResponseSession(tag,

                        commandCode,

                        resHandleSize,

                        resParmSize,

                        &resAuthSize);

Cleanup:

   // This implementation loads an "evict" object to a transient object slot in

   // RAM whenever an "evict" object handle is used in a command so that the

   // access to any object is the same. These temporary objects need to be

   // cleared from RAM whether the command succeeds or fails.

   ObjectCleanupEvict();

#ifndef EMBEDDED_MODE

Fail:

#endif  // EMBEDDED_MODE  ^^^ not defined

   // The response will contain at least a response header.

   *responseSize = sizeof(TPM_ST) + sizeof(UINT32) + sizeof(TPM_RC);

   // If the command completed successfully, then build the rest of the response.

   if(result == TPM_RC_SUCCESS)

   {

       // Outgoing tag will be the same as the incoming tag.

       resTag = tag;

       // The overall response will include the handles, parameters,

       // and authorizations.

       *responseSize += resHandleSize + resParmSize + resAuthSize;

         // Adding parameter size field.

         if(tag == TPM_ST_SESSIONS)

             *responseSize += sizeof(UINT32);

         if(      g_clearOrderly == TRUE

               && gp.orderlyState != SHUTDOWN_NONE)

         {

                gp.orderlyState = SHUTDOWN_NONE;

                NvWriteReserved(NV_ORDERLY, &gp.orderlyState);

                g_updateNV = TRUE;

         }

     }

     else

     {

         // The command failed.

         // If this was a failure due to a bad command tag, then need to return

         // a TPM 1.2 compatible response

         if(result == TPM_RC_BAD_TAG)

              resTag = TPM_ST_RSP_COMMAND;

         else

              // return 2.0 compatible response

              resTag = TPM_ST_NO_SESSIONS;

     }

     // Try to commit all the writes to NV if any NV write happened during this

     // command execution. This check should be made for both succeeded and failed

     // commands, because a failed one may trigger a NV write in DA logic as well.

     // This is the only place in the command execution path that may call the NV

     // commit. If the NV commit fails, the TPM should be put in failure mode.

     if(g_updateNV && !g_inFailureMode)

     {

         g_updateNV = FALSE;

         if(!NvCommit()) {

              FAIL(FATAL_ERROR_INTERNAL);

#ifdef EMBEDDED_MODE

        // Make sure we pass errors along

        result = TPM_RC_FAILURE;

        resTag = TPM_ST_NO_SESSIONS;

#endif

   }

     }

     // Marshal the response header.

     buffer = MemoryGetResponseBuffer(commandCode);

     bufferSize = 10;

     TPM_ST_Marshal(&resTag, &buffer, &bufferSize);

     UINT32_Marshal((UINT32 *)responseSize, &buffer, &bufferSize);

     pAssert(*responseSize <= MAX_RESPONSE_SIZE);

     TPM_RC_Marshal(&result, &buffer, &bufferSize);

     *response = MemoryGetResponseBuffer(commandCode);

     // Clear unused bit in response buffer.

     MemorySet(*response + *responseSize, 0, MAX_RESPONSE_SIZE - *responseSize);

     return;

}