tpm-v2.h 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355
  1. /* SPDX-License-Identifier: GPL-2.0+ */
  2. /*
  3. * Copyright (c) 2018 Bootlin
  4. * Author: Miquel Raynal <miquel.raynal@bootlin.com>
  5. */
  6. #ifndef __TPM_V2_H
  7. #define __TPM_V2_H
  8. #include <tpm-common.h>
  9. #define TPM2_DIGEST_LEN 32
  10. /**
  11. * TPM2 Structure Tags for command/response buffers.
  12. *
  13. * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
  14. * @TPM2_ST_SESSIONS: the command needs an authentication.
  15. */
  16. enum tpm2_structures {
  17. TPM2_ST_NO_SESSIONS = 0x8001,
  18. TPM2_ST_SESSIONS = 0x8002,
  19. };
  20. /**
  21. * TPM2 type of boolean.
  22. */
  23. enum tpm2_yes_no {
  24. TPMI_YES = 1,
  25. TPMI_NO = 0,
  26. };
  27. /**
  28. * TPM2 startup values.
  29. *
  30. * @TPM2_SU_CLEAR: reset the internal state.
  31. * @TPM2_SU_STATE: restore saved state (if any).
  32. */
  33. enum tpm2_startup_types {
  34. TPM2_SU_CLEAR = 0x0000,
  35. TPM2_SU_STATE = 0x0001,
  36. };
  37. /**
  38. * TPM2 permanent handles.
  39. *
  40. * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
  41. * @TPM2_RS_PW: indicates a password.
  42. * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
  43. * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
  44. * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
  45. */
  46. enum tpm2_handles {
  47. TPM2_RH_OWNER = 0x40000001,
  48. TPM2_RS_PW = 0x40000009,
  49. TPM2_RH_LOCKOUT = 0x4000000A,
  50. TPM2_RH_ENDORSEMENT = 0x4000000B,
  51. TPM2_RH_PLATFORM = 0x4000000C,
  52. };
  53. /**
  54. * TPM2 command codes used at the beginning of a buffer, gives the command.
  55. *
  56. * @TPM2_CC_STARTUP: TPM2_Startup().
  57. * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
  58. * @TPM2_CC_CLEAR: TPM2_Clear().
  59. * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
  60. * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
  61. * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
  62. * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
  63. * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
  64. * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
  65. * @TPM2_CC_GET_RANDOM: TPM2_GetRandom().
  66. * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
  67. * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
  68. * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
  69. */
  70. enum tpm2_command_codes {
  71. TPM2_CC_STARTUP = 0x0144,
  72. TPM2_CC_SELF_TEST = 0x0143,
  73. TPM2_CC_CLEAR = 0x0126,
  74. TPM2_CC_CLEARCONTROL = 0x0127,
  75. TPM2_CC_HIERCHANGEAUTH = 0x0129,
  76. TPM2_CC_PCR_SETAUTHPOL = 0x012C,
  77. TPM2_CC_DAM_RESET = 0x0139,
  78. TPM2_CC_DAM_PARAMETERS = 0x013A,
  79. TPM2_CC_NV_READ = 0x014E,
  80. TPM2_CC_GET_CAPABILITY = 0x017A,
  81. TPM2_CC_GET_RANDOM = 0x017B,
  82. TPM2_CC_PCR_READ = 0x017E,
  83. TPM2_CC_PCR_EXTEND = 0x0182,
  84. TPM2_CC_PCR_SETAUTHVAL = 0x0183,
  85. };
  86. /**
  87. * TPM2 return codes.
  88. */
  89. enum tpm2_return_codes {
  90. TPM2_RC_SUCCESS = 0x0000,
  91. TPM2_RC_BAD_TAG = 0x001E,
  92. TPM2_RC_FMT1 = 0x0080,
  93. TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
  94. TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
  95. TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
  96. TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
  97. TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
  98. TPM2_RC_VER1 = 0x0100,
  99. TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
  100. TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
  101. TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
  102. TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
  103. TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
  104. TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
  105. TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
  106. TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
  107. TPM2_RC_WARN = 0x0900,
  108. TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
  109. TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
  110. TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
  111. };
  112. /**
  113. * TPM2 algorithms.
  114. */
  115. enum tpm2_algorithms {
  116. TPM2_ALG_XOR = 0x0A,
  117. TPM2_ALG_SHA256 = 0x0B,
  118. TPM2_ALG_SHA384 = 0x0C,
  119. TPM2_ALG_SHA512 = 0x0D,
  120. TPM2_ALG_NULL = 0x10,
  121. };
  122. /* NV index attributes */
  123. enum tpm_index_attrs {
  124. TPMA_NV_PPWRITE = 1UL << 0,
  125. TPMA_NV_OWNERWRITE = 1UL << 1,
  126. TPMA_NV_AUTHWRITE = 1UL << 2,
  127. TPMA_NV_POLICYWRITE = 1UL << 3,
  128. TPMA_NV_COUNTER = 1UL << 4,
  129. TPMA_NV_BITS = 1UL << 5,
  130. TPMA_NV_EXTEND = 1UL << 6,
  131. TPMA_NV_POLICY_DELETE = 1UL << 10,
  132. TPMA_NV_WRITELOCKED = 1UL << 11,
  133. TPMA_NV_WRITEALL = 1UL << 12,
  134. TPMA_NV_WRITEDEFINE = 1UL << 13,
  135. TPMA_NV_WRITE_STCLEAR = 1UL << 14,
  136. TPMA_NV_GLOBALLOCK = 1UL << 15,
  137. TPMA_NV_PPREAD = 1UL << 16,
  138. TPMA_NV_OWNERREAD = 1UL << 17,
  139. TPMA_NV_AUTHREAD = 1UL << 18,
  140. TPMA_NV_POLICYREAD = 1UL << 19,
  141. TPMA_NV_NO_DA = 1UL << 25,
  142. TPMA_NV_ORDERLY = 1UL << 26,
  143. TPMA_NV_CLEAR_STCLEAR = 1UL << 27,
  144. TPMA_NV_READLOCKED = 1UL << 28,
  145. TPMA_NV_WRITTEN = 1UL << 29,
  146. TPMA_NV_PLATFORMCREATE = 1UL << 30,
  147. TPMA_NV_READ_STCLEAR = 1UL << 31,
  148. TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD |
  149. TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD,
  150. TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE |
  151. TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE,
  152. };
  153. enum {
  154. TPM_ACCESS_VALID = 1 << 7,
  155. TPM_ACCESS_ACTIVE_LOCALITY = 1 << 5,
  156. TPM_ACCESS_REQUEST_PENDING = 1 << 2,
  157. TPM_ACCESS_REQUEST_USE = 1 << 1,
  158. TPM_ACCESS_ESTABLISHMENT = 1 << 0,
  159. };
  160. enum {
  161. TPM_STS_FAMILY_SHIFT = 26,
  162. TPM_STS_FAMILY_MASK = 0x3 << TPM_STS_FAMILY_SHIFT,
  163. TPM_STS_FAMILY_TPM2 = 1 << TPM_STS_FAMILY_SHIFT,
  164. TPM_STS_RESE_TESTABLISMENT_BIT = 1 << 25,
  165. TPM_STS_COMMAND_CANCEL = 1 << 24,
  166. TPM_STS_BURST_COUNT_SHIFT = 8,
  167. TPM_STS_BURST_COUNT_MASK = 0xffff << TPM_STS_BURST_COUNT_SHIFT,
  168. TPM_STS_VALID = 1 << 7,
  169. TPM_STS_COMMAND_READY = 1 << 6,
  170. TPM_STS_GO = 1 << 5,
  171. TPM_STS_DATA_AVAIL = 1 << 4,
  172. TPM_STS_DATA_EXPECT = 1 << 3,
  173. TPM_STS_SELF_TEST_DONE = 1 << 2,
  174. TPM_STS_RESPONSE_RETRY = 1 << 1,
  175. };
  176. enum {
  177. TPM_CMD_COUNT_OFFSET = 2,
  178. TPM_CMD_ORDINAL_OFFSET = 6,
  179. TPM_MAX_BUF_SIZE = 1260,
  180. };
  181. /**
  182. * Issue a TPM2_Startup command.
  183. *
  184. * @dev TPM device
  185. * @mode TPM startup mode
  186. *
  187. * @return code of the operation
  188. */
  189. u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode);
  190. /**
  191. * Issue a TPM2_SelfTest command.
  192. *
  193. * @dev TPM device
  194. * @full_test Asking to perform all tests or only the untested ones
  195. *
  196. * @return code of the operation
  197. */
  198. u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test);
  199. /**
  200. * Issue a TPM2_Clear command.
  201. *
  202. * @dev TPM device
  203. * @handle Handle
  204. * @pw Password
  205. * @pw_sz Length of the password
  206. *
  207. * @return code of the operation
  208. */
  209. u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
  210. const ssize_t pw_sz);
  211. /**
  212. * Issue a TPM2_PCR_Extend command.
  213. *
  214. * @dev TPM device
  215. * @index Index of the PCR
  216. * @digest Value representing the event to be recorded
  217. *
  218. * @return code of the operation
  219. */
  220. u32 tpm2_pcr_extend(struct udevice *dev, u32 index, const uint8_t *digest);
  221. /**
  222. * Issue a TPM2_PCR_Read command.
  223. *
  224. * @dev TPM device
  225. * @idx Index of the PCR
  226. * @idx_min_sz Minimum size in bytes of the pcrSelect array
  227. * @data Output buffer for contents of the named PCR
  228. * @updates Optional out parameter: number of updates for this PCR
  229. *
  230. * @return code of the operation
  231. */
  232. u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
  233. void *data, unsigned int *updates);
  234. /**
  235. * Issue a TPM2_GetCapability command. This implementation is limited
  236. * to query property index that is 4-byte wide.
  237. *
  238. * @dev TPM device
  239. * @capability Partition of capabilities
  240. * @property Further definition of capability, limited to be 4 bytes wide
  241. * @buf Output buffer for capability information
  242. * @prop_count Size of output buffer
  243. *
  244. * @return code of the operation
  245. */
  246. u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
  247. void *buf, size_t prop_count);
  248. /**
  249. * Issue a TPM2_DictionaryAttackLockReset command.
  250. *
  251. * @dev TPM device
  252. * @pw Password
  253. * @pw_sz Length of the password
  254. *
  255. * @return code of the operation
  256. */
  257. u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz);
  258. /**
  259. * Issue a TPM2_DictionaryAttackParameters command.
  260. *
  261. * @dev TPM device
  262. * @pw Password
  263. * @pw_sz Length of the password
  264. * @max_tries Count of authorizations before lockout
  265. * @recovery_time Time before decrementation of the failure count
  266. * @lockout_recovery Time to wait after a lockout
  267. *
  268. * @return code of the operation
  269. */
  270. u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
  271. const ssize_t pw_sz, unsigned int max_tries,
  272. unsigned int recovery_time,
  273. unsigned int lockout_recovery);
  274. /**
  275. * Issue a TPM2_HierarchyChangeAuth command.
  276. *
  277. * @dev TPM device
  278. * @handle Handle
  279. * @newpw New password
  280. * @newpw_sz Length of the new password
  281. * @oldpw Old password
  282. * @oldpw_sz Length of the old password
  283. *
  284. * @return code of the operation
  285. */
  286. int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
  287. const ssize_t newpw_sz, const char *oldpw,
  288. const ssize_t oldpw_sz);
  289. /**
  290. * Issue a TPM_PCR_SetAuthPolicy command.
  291. *
  292. * @dev TPM device
  293. * @pw Platform password
  294. * @pw_sz Length of the password
  295. * @index Index of the PCR
  296. * @digest New key to access the PCR
  297. *
  298. * @return code of the operation
  299. */
  300. u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
  301. const ssize_t pw_sz, u32 index, const char *key);
  302. /**
  303. * Issue a TPM_PCR_SetAuthValue command.
  304. *
  305. * @dev TPM device
  306. * @pw Platform password
  307. * @pw_sz Length of the password
  308. * @index Index of the PCR
  309. * @digest New key to access the PCR
  310. * @key_sz Length of the new key
  311. *
  312. * @return code of the operation
  313. */
  314. u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
  315. const ssize_t pw_sz, u32 index, const char *key,
  316. const ssize_t key_sz);
  317. /**
  318. * Issue a TPM2_GetRandom command.
  319. *
  320. * @dev TPM device
  321. * @param data output buffer for the random bytes
  322. * @param count size of output buffer
  323. *
  324. * @return return code of the operation
  325. */
  326. u32 tpm2_get_random(struct udevice *dev, void *data, u32 count);
  327. #endif /* __TPM_V2_H */