Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FFA] [TPM] CrbControlResponseSize is not set to the correct value in the TpmServiceLib #1093

Open
1 task done
eran-c opened this issue Jan 7, 2025 · 0 comments · Fixed by #1095
Open
1 task done
Labels
state:needs-owner Needs an issue owner to be assigned state:needs-triage Needs to triaged to determine next steps type:bug Something isn't working urgency:medium Important with a moderate impact

Comments

@eran-c
Copy link

eran-c commented Jan 7, 2025

Is there an existing issue for this?

  • I have searched existing issues

Current Behavior

According to the TCG spec (https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-TPM-Profile-for-TPM-2p0-v1p05p_r14_pub.pdf) at offset 64h from the beginning of each locality address space, there is a CRB register called TPM_CRB_CTRL_RSP_SIZE_x.

This register represents the "size of the response buffer" according to the spec. Note that this is not the size of the response, but the response buffer size that should not change during the lifetime of a system.

In the TpmServiceLib, in the PtpCrbTpmCommand function, this register is initialized properly:
MmioWrite32 ((UINTN)&CrbReg->CrbControlResponseSize, sizeof (CrbReg->CrbDataBuffer));

However, whenever a Start command is received, a HandleCommand function is called which then takes the pointer to an internal copy of this register and sends it to the Tpm2SubmitCommand which, on a normal flow, changes this register's value to the size of the response, which is usually smaller than the expected response buffer size.

Expected Behavior

The CrbControlResponseSize value should not change and should be left equal to sizeof (CrbReg->CrbDataBuffer), which is 0xf80.
Specifically, when calling Tpm2SubmitCommand, we suggest passing InternalTpmCrb->CrbControlResponseSize by value like the other parameters and not returning the response size as an output parameter.
The software side does not look for the response size in this register, it reads the response size from the CRB buffer itself by reading a fixed sized header that includes the current response actual size.

In fact, we recommend changing the name of the field CrbControlResponseSize as well as the field CrbControlCommandSize to
CrbControlResponseBufferSize and CrbControlCommandBufferSize respectively.

Steps To Reproduce

This can be reproduced from the software side, looking at the register value after each call to a Start command and making sure it does not change from the expected value of 0xf80.

Build Environment

- OS(s): Win3
- Tool Chain(s):
- Targets Impacted:

Version Information

Commit: f604a01d2f9a24e744a217d77ff871c505e3c3e3

Urgency

Medium

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

No maintainer feedback needed

Anything else?

No response

@eran-c eran-c added state:needs-triage Needs to triaged to determine next steps type:bug Something isn't working labels Jan 7, 2025
@github-actions github-actions bot added urgency:medium Important with a moderate impact state:needs-owner Needs an issue owner to be assigned labels Jan 7, 2025
@Raymond-MS Raymond-MS linked a pull request Jan 9, 2025 that will close this issue
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
state:needs-owner Needs an issue owner to be assigned state:needs-triage Needs to triaged to determine next steps type:bug Something isn't working urgency:medium Important with a moderate impact
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant