fwTPM: TPM2_TestParms errors carry no parameter number #653

TPM2_TestParms answers an unsupported parameter set with a bare format-one code, such as TPM_RC_KEY_SIZE (0x087), TPM_RC_PARMS, TPM_RC_VALUE or TPM_RC_HASH. It doesn't say which parameter is at fault (TPM_RC_P | TPM_RC_1, for the parameters argument), whereas libtpms and the TCG reference implementation return TPM_RC_xxx + RC_TestParms_parameters (e.g. 0x1c4 for an RSA key size of 1000).

Clients that tell a refused parameter apart from a failure by checking the parameter bits treat these answers as errors. tpm2-pkcs11 probes RSA key sizes and ECC curves this way, so it failed to initialize its token on fwTPM.

Reproduction. Call Esys_TestParms with { .type = TPM2_ALG_RSA, .parameters.rsaDetail.keyBits = 1000 }:

fwTPM master:  0x087  (TPM_RC_KEY_SIZE, no parameter number)
swtpm 0.10.2:  0x1c4  (TPM_RC_VALUE + TPM_RC_P + TPM_RC_1)

Suggested fix. Add TPM_RC_P | TPM_RC_1 to the parameter-related codes FwCmd_TestParms returns, as other handlers in fwtpm_command.c already do for their handles (TPM_RC_HANDLE | TPM_RC_1). This is low priority.

Environment

• wolfTPM master at d7f73b5 (also seen in v4.2.0), fwTPM built with ./configure --enable-fwtpm-only --enable-swtpm on wolfSSL v5.9.4-stable (--enable-wolftpm --enable-pkcallbacks --enable-keygen).
• fwtpm_server --port 2341 --platform-port 2342, reached through the tpm2-tss 4.2.0 swtpm TCTI (swtpm:host=127.0.0.1,port=2341).
• For comparison, the same program against swtpm 0.10.2 (libtpms).
• Found while running tpm2-pkcs11 on fwTPM.