tpm-v2.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Bootlin
  4. * Author: Miquel Raynal <miquel.raynal@bootlin.com>
  5. */
  6. #include <common.h>
  7. #include <dm.h>
  8. #include <tpm-common.h>
  9. #include <tpm-v2.h>
  10. #include "tpm-utils.h"
  11. u32 tpm2_startup(enum tpm2_startup_types mode)
  12. {
  13. const u8 command_v2[12] = {
  14. tpm_u16(TPM2_ST_NO_SESSIONS),
  15. tpm_u32(12),
  16. tpm_u32(TPM2_CC_STARTUP),
  17. tpm_u16(mode),
  18. };
  19. int ret;
  20. /*
  21. * Note TPM2_Startup command will return RC_SUCCESS the first time,
  22. * but will return RC_INITIALIZE otherwise.
  23. */
  24. ret = tpm_sendrecv_command(command_v2, NULL, NULL);
  25. if (ret && ret != TPM2_RC_INITIALIZE)
  26. return ret;
  27. return 0;
  28. }
  29. u32 tpm2_self_test(enum tpm2_yes_no full_test)
  30. {
  31. const u8 command_v2[12] = {
  32. tpm_u16(TPM2_ST_NO_SESSIONS),
  33. tpm_u32(11),
  34. tpm_u32(TPM2_CC_SELF_TEST),
  35. full_test,
  36. };
  37. return tpm_sendrecv_command(command_v2, NULL, NULL);
  38. }
  39. u32 tpm2_clear(u32 handle, const char *pw, const ssize_t pw_sz)
  40. {
  41. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  42. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  43. tpm_u32(27 + pw_sz), /* Length */
  44. tpm_u32(TPM2_CC_CLEAR), /* Command code */
  45. /* HANDLE */
  46. tpm_u32(handle), /* TPM resource handle */
  47. /* AUTH_SESSION */
  48. tpm_u32(9 + pw_sz), /* Authorization size */
  49. tpm_u32(TPM2_RS_PW), /* Session handle */
  50. tpm_u16(0), /* Size of <nonce> */
  51. /* <nonce> (if any) */
  52. 0, /* Attributes: Cont/Excl/Rst */
  53. tpm_u16(pw_sz), /* Size of <hmac/password> */
  54. /* STRING(pw) <hmac/password> (if any) */
  55. };
  56. unsigned int offset = 27;
  57. int ret;
  58. /*
  59. * Fill the command structure starting from the first buffer:
  60. * - the password (if any)
  61. */
  62. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  63. offset, pw, pw_sz);
  64. offset += pw_sz;
  65. if (ret)
  66. return TPM_LIB_ERROR;
  67. return tpm_sendrecv_command(command_v2, NULL, NULL);
  68. }
  69. u32 tpm2_pcr_extend(u32 index, const uint8_t *digest)
  70. {
  71. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  72. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  73. tpm_u32(33 + TPM2_DIGEST_LEN), /* Length */
  74. tpm_u32(TPM2_CC_PCR_EXTEND), /* Command code */
  75. /* HANDLE */
  76. tpm_u32(index), /* Handle (PCR Index) */
  77. /* AUTH_SESSION */
  78. tpm_u32(9), /* Authorization size */
  79. tpm_u32(TPM2_RS_PW), /* Session handle */
  80. tpm_u16(0), /* Size of <nonce> */
  81. /* <nonce> (if any) */
  82. 0, /* Attributes: Cont/Excl/Rst */
  83. tpm_u16(0), /* Size of <hmac/password> */
  84. /* <hmac/password> (if any) */
  85. tpm_u32(1), /* Count (number of hashes) */
  86. tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */
  87. /* STRING(digest) Digest */
  88. };
  89. unsigned int offset = 33;
  90. int ret;
  91. /*
  92. * Fill the command structure starting from the first buffer:
  93. * - the digest
  94. */
  95. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  96. offset, digest, TPM2_DIGEST_LEN);
  97. offset += TPM2_DIGEST_LEN;
  98. if (ret)
  99. return TPM_LIB_ERROR;
  100. return tpm_sendrecv_command(command_v2, NULL, NULL);
  101. }
  102. u32 tpm2_pcr_read(u32 idx, unsigned int idx_min_sz, void *data,
  103. unsigned int *updates)
  104. {
  105. u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
  106. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  107. tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */
  108. tpm_u32(17 + idx_array_sz), /* Length */
  109. tpm_u32(TPM2_CC_PCR_READ), /* Command code */
  110. /* TPML_PCR_SELECTION */
  111. tpm_u32(1), /* Number of selections */
  112. tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */
  113. idx_array_sz, /* Array size for selection */
  114. /* bitmap(idx) Selected PCR bitmap */
  115. };
  116. size_t response_len = COMMAND_BUFFER_SIZE;
  117. u8 response[COMMAND_BUFFER_SIZE];
  118. unsigned int pcr_sel_idx = idx / 8;
  119. u8 pcr_sel_bit = BIT(idx % 8);
  120. unsigned int counter = 0;
  121. int ret;
  122. if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b",
  123. 17 + pcr_sel_idx, pcr_sel_bit))
  124. return TPM_LIB_ERROR;
  125. ret = tpm_sendrecv_command(command_v2, response, &response_len);
  126. if (ret)
  127. return ret;
  128. if (unpack_byte_string(response, response_len, "ds",
  129. 10, &counter,
  130. response_len - TPM2_DIGEST_LEN, data,
  131. TPM2_DIGEST_LEN))
  132. return TPM_LIB_ERROR;
  133. if (updates)
  134. *updates = counter;
  135. return 0;
  136. }
  137. u32 tpm2_get_capability(u32 capability, u32 property, void *buf,
  138. size_t prop_count)
  139. {
  140. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  141. tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */
  142. tpm_u32(22), /* Length */
  143. tpm_u32(TPM2_CC_GET_CAPABILITY), /* Command code */
  144. tpm_u32(capability), /* Capability */
  145. tpm_u32(property), /* Property */
  146. tpm_u32(prop_count), /* Property count */
  147. };
  148. u8 response[COMMAND_BUFFER_SIZE];
  149. size_t response_len = COMMAND_BUFFER_SIZE;
  150. unsigned int properties_off;
  151. int ret;
  152. ret = tpm_sendrecv_command(command_v2, response, &response_len);
  153. if (ret)
  154. return ret;
  155. /*
  156. * In the response buffer, the properties are located after the:
  157. * tag (u16), response size (u32), response code (u32),
  158. * YES/NO flag (u8), TPM_CAP (u32) and TPMU_CAPABILITIES (u32).
  159. */
  160. properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
  161. sizeof(u8) + sizeof(u32) + sizeof(u32);
  162. memcpy(buf, &response[properties_off], response_len - properties_off);
  163. return 0;
  164. }
  165. u32 tpm2_dam_reset(const char *pw, const ssize_t pw_sz)
  166. {
  167. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  168. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  169. tpm_u32(27 + pw_sz), /* Length */
  170. tpm_u32(TPM2_CC_DAM_RESET), /* Command code */
  171. /* HANDLE */
  172. tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */
  173. /* AUTH_SESSION */
  174. tpm_u32(9 + pw_sz), /* Authorization size */
  175. tpm_u32(TPM2_RS_PW), /* Session handle */
  176. tpm_u16(0), /* Size of <nonce> */
  177. /* <nonce> (if any) */
  178. 0, /* Attributes: Cont/Excl/Rst */
  179. tpm_u16(pw_sz), /* Size of <hmac/password> */
  180. /* STRING(pw) <hmac/password> (if any) */
  181. };
  182. unsigned int offset = 27;
  183. int ret;
  184. /*
  185. * Fill the command structure starting from the first buffer:
  186. * - the password (if any)
  187. */
  188. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  189. offset, pw, pw_sz);
  190. offset += pw_sz;
  191. if (ret)
  192. return TPM_LIB_ERROR;
  193. return tpm_sendrecv_command(command_v2, NULL, NULL);
  194. }
  195. u32 tpm2_dam_parameters(const char *pw, const ssize_t pw_sz,
  196. unsigned int max_tries, unsigned int recovery_time,
  197. unsigned int lockout_recovery)
  198. {
  199. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  200. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  201. tpm_u32(27 + pw_sz + 12), /* Length */
  202. tpm_u32(TPM2_CC_DAM_PARAMETERS), /* Command code */
  203. /* HANDLE */
  204. tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */
  205. /* AUTH_SESSION */
  206. tpm_u32(9 + pw_sz), /* Authorization size */
  207. tpm_u32(TPM2_RS_PW), /* Session handle */
  208. tpm_u16(0), /* Size of <nonce> */
  209. /* <nonce> (if any) */
  210. 0, /* Attributes: Cont/Excl/Rst */
  211. tpm_u16(pw_sz), /* Size of <hmac/password> */
  212. /* STRING(pw) <hmac/password> (if any) */
  213. /* LOCKOUT PARAMETERS */
  214. /* tpm_u32(max_tries) Max tries (0, always lock) */
  215. /* tpm_u32(recovery_time) Recovery time (0, no lock) */
  216. /* tpm_u32(lockout_recovery) Lockout recovery */
  217. };
  218. unsigned int offset = 27;
  219. int ret;
  220. /*
  221. * Fill the command structure starting from the first buffer:
  222. * - the password (if any)
  223. * - max tries
  224. * - recovery time
  225. * - lockout recovery
  226. */
  227. ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd",
  228. offset, pw, pw_sz,
  229. offset + pw_sz, max_tries,
  230. offset + pw_sz + 4, recovery_time,
  231. offset + pw_sz + 8, lockout_recovery);
  232. offset += pw_sz + 12;
  233. if (ret)
  234. return TPM_LIB_ERROR;
  235. return tpm_sendrecv_command(command_v2, NULL, NULL);
  236. }
  237. int tpm2_change_auth(u32 handle, const char *newpw, const ssize_t newpw_sz,
  238. const char *oldpw, const ssize_t oldpw_sz)
  239. {
  240. unsigned int offset = 27;
  241. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  242. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  243. tpm_u32(offset + oldpw_sz + 2 + newpw_sz), /* Length */
  244. tpm_u32(TPM2_CC_HIERCHANGEAUTH), /* Command code */
  245. /* HANDLE */
  246. tpm_u32(handle), /* TPM resource handle */
  247. /* AUTH_SESSION */
  248. tpm_u32(9 + oldpw_sz), /* Authorization size */
  249. tpm_u32(TPM2_RS_PW), /* Session handle */
  250. tpm_u16(0), /* Size of <nonce> */
  251. /* <nonce> (if any) */
  252. 0, /* Attributes: Cont/Excl/Rst */
  253. tpm_u16(oldpw_sz) /* Size of <hmac/password> */
  254. /* STRING(oldpw) <hmac/password> (if any) */
  255. /* TPM2B_AUTH (TPM2B_DIGEST) */
  256. /* tpm_u16(newpw_sz) Digest size, new pw length */
  257. /* STRING(newpw) Digest buffer, new pw */
  258. };
  259. int ret;
  260. /*
  261. * Fill the command structure starting from the first buffer:
  262. * - the old password (if any)
  263. * - size of the new password
  264. * - new password
  265. */
  266. ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
  267. offset, oldpw, oldpw_sz,
  268. offset + oldpw_sz, newpw_sz,
  269. offset + oldpw_sz + 2, newpw, newpw_sz);
  270. offset += oldpw_sz + 2 + newpw_sz;
  271. if (ret)
  272. return TPM_LIB_ERROR;
  273. return tpm_sendrecv_command(command_v2, NULL, NULL);
  274. }
  275. u32 tpm2_pcr_setauthpolicy(const char *pw, const ssize_t pw_sz, u32 index,
  276. const char *key)
  277. {
  278. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  279. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  280. tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN), /* Length */
  281. tpm_u32(TPM2_CC_PCR_SETAUTHPOL), /* Command code */
  282. /* HANDLE */
  283. tpm_u32(TPM2_RH_PLATFORM), /* TPM resource handle */
  284. /* AUTH_SESSION */
  285. tpm_u32(9 + pw_sz), /* Authorization size */
  286. tpm_u32(TPM2_RS_PW), /* session handle */
  287. tpm_u16(0), /* Size of <nonce> */
  288. /* <nonce> (if any) */
  289. 0, /* Attributes: Cont/Excl/Rst */
  290. tpm_u16(pw_sz) /* Size of <hmac/password> */
  291. /* STRING(pw) <hmac/password> (if any) */
  292. /* TPM2B_AUTH (TPM2B_DIGEST) */
  293. /* tpm_u16(TPM2_DIGEST_LEN) Digest size length */
  294. /* STRING(key) Digest buffer (PCR key) */
  295. /* TPMI_ALG_HASH */
  296. /* tpm_u16(TPM2_ALG_SHA256) Algorithm of the hash */
  297. /* TPMI_DH_PCR */
  298. /* tpm_u32(index), PCR Index */
  299. };
  300. unsigned int offset = 27;
  301. int ret;
  302. /*
  303. * Fill the command structure starting from the first buffer:
  304. * - the password (if any)
  305. * - the PCR key length
  306. * - the PCR key
  307. * - the hash algorithm
  308. * - the PCR index
  309. */
  310. ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd",
  311. offset, pw, pw_sz,
  312. offset + pw_sz, TPM2_DIGEST_LEN,
  313. offset + pw_sz + 2, key, TPM2_DIGEST_LEN,
  314. offset + pw_sz + 2 + TPM2_DIGEST_LEN,
  315. TPM2_ALG_SHA256,
  316. offset + pw_sz + 4 + TPM2_DIGEST_LEN, index);
  317. offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4;
  318. if (ret)
  319. return TPM_LIB_ERROR;
  320. return tpm_sendrecv_command(command_v2, NULL, NULL);
  321. }
  322. u32 tpm2_pcr_setauthvalue(const char *pw, const ssize_t pw_sz, u32 index,
  323. const char *key, const ssize_t key_sz)
  324. {
  325. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  326. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  327. tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN), /* Length */
  328. tpm_u32(TPM2_CC_PCR_SETAUTHVAL), /* Command code */
  329. /* HANDLE */
  330. tpm_u32(index), /* Handle (PCR Index) */
  331. /* AUTH_SESSION */
  332. tpm_u32(9 + pw_sz), /* Authorization size */
  333. tpm_u32(TPM2_RS_PW), /* session handle */
  334. tpm_u16(0), /* Size of <nonce> */
  335. /* <nonce> (if any) */
  336. 0, /* Attributes: Cont/Excl/Rst */
  337. tpm_u16(pw_sz), /* Size of <hmac/password> */
  338. /* STRING(pw) <hmac/password> (if any) */
  339. /* TPM2B_DIGEST */
  340. /* tpm_u16(key_sz) Key length */
  341. /* STRING(key) Key */
  342. };
  343. unsigned int offset = 27;
  344. int ret;
  345. /*
  346. * Fill the command structure starting from the first buffer:
  347. * - the password (if any)
  348. * - the number of digests, 1 in our case
  349. * - the algorithm, sha256 in our case
  350. * - the digest (64 bytes)
  351. */
  352. ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
  353. offset, pw, pw_sz,
  354. offset + pw_sz, key_sz,
  355. offset + pw_sz + 2, key, key_sz);
  356. offset += pw_sz + 2 + key_sz;
  357. if (ret)
  358. return TPM_LIB_ERROR;
  359. return tpm_sendrecv_command(command_v2, NULL, NULL);
  360. }