tpm-v2.h 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311
  1. /* SPDX-License-Identifier: GPL-2.0+ */
  2. /*
  3. * Copyright (c) 2018 Bootlin
  4. * Author: Miquel Raynal <miquel.raynal@bootlin.com>
  5. */
  6. #ifndef __TPM_V2_H
  7. #define __TPM_V2_H
  8. #include <tpm-common.h>
  9. #define TPM2_DIGEST_LEN 32
  10. /**
  11. * TPM2 Structure Tags for command/response buffers.
  12. *
  13. * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
  14. * @TPM2_ST_SESSIONS: the command needs an authentication.
  15. */
  16. enum tpm2_structures {
  17. TPM2_ST_NO_SESSIONS = 0x8001,
  18. TPM2_ST_SESSIONS = 0x8002,
  19. };
  20. /**
  21. * TPM2 type of boolean.
  22. */
  23. enum tpm2_yes_no {
  24. TPMI_YES = 1,
  25. TPMI_NO = 0,
  26. };
  27. /**
  28. * TPM2 startup values.
  29. *
  30. * @TPM2_SU_CLEAR: reset the internal state.
  31. * @TPM2_SU_STATE: restore saved state (if any).
  32. */
  33. enum tpm2_startup_types {
  34. TPM2_SU_CLEAR = 0x0000,
  35. TPM2_SU_STATE = 0x0001,
  36. };
  37. /**
  38. * TPM2 permanent handles.
  39. *
  40. * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
  41. * @TPM2_RS_PW: indicates a password.
  42. * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
  43. * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
  44. * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
  45. */
  46. enum tpm2_handles {
  47. TPM2_RH_OWNER = 0x40000001,
  48. TPM2_RS_PW = 0x40000009,
  49. TPM2_RH_LOCKOUT = 0x4000000A,
  50. TPM2_RH_ENDORSEMENT = 0x4000000B,
  51. TPM2_RH_PLATFORM = 0x4000000C,
  52. };
  53. /**
  54. * TPM2 command codes used at the beginning of a buffer, gives the command.
  55. *
  56. * @TPM2_CC_STARTUP: TPM2_Startup().
  57. * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
  58. * @TPM2_CC_CLEAR: TPM2_Clear().
  59. * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
  60. * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
  61. * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
  62. * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
  63. * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
  64. * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
  65. * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
  66. * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
  67. * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
  68. */
  69. enum tpm2_command_codes {
  70. TPM2_CC_STARTUP = 0x0144,
  71. TPM2_CC_SELF_TEST = 0x0143,
  72. TPM2_CC_CLEAR = 0x0126,
  73. TPM2_CC_CLEARCONTROL = 0x0127,
  74. TPM2_CC_HIERCHANGEAUTH = 0x0129,
  75. TPM2_CC_PCR_SETAUTHPOL = 0x012C,
  76. TPM2_CC_DAM_RESET = 0x0139,
  77. TPM2_CC_DAM_PARAMETERS = 0x013A,
  78. TPM2_CC_NV_READ = 0x014E,
  79. TPM2_CC_GET_CAPABILITY = 0x017A,
  80. TPM2_CC_PCR_READ = 0x017E,
  81. TPM2_CC_PCR_EXTEND = 0x0182,
  82. TPM2_CC_PCR_SETAUTHVAL = 0x0183,
  83. };
  84. /**
  85. * TPM2 return codes.
  86. */
  87. enum tpm2_return_codes {
  88. TPM2_RC_SUCCESS = 0x0000,
  89. TPM2_RC_BAD_TAG = 0x001E,
  90. TPM2_RC_FMT1 = 0x0080,
  91. TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
  92. TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
  93. TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
  94. TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
  95. TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
  96. TPM2_RC_VER1 = 0x0100,
  97. TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
  98. TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
  99. TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
  100. TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
  101. TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
  102. TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
  103. TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
  104. TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
  105. TPM2_RC_WARN = 0x0900,
  106. TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
  107. TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
  108. TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
  109. };
  110. /**
  111. * TPM2 algorithms.
  112. */
  113. enum tpm2_algorithms {
  114. TPM2_ALG_XOR = 0x0A,
  115. TPM2_ALG_SHA256 = 0x0B,
  116. TPM2_ALG_SHA384 = 0x0C,
  117. TPM2_ALG_SHA512 = 0x0D,
  118. TPM2_ALG_NULL = 0x10,
  119. };
  120. /* NV index attributes */
  121. enum tpm_index_attrs {
  122. TPMA_NV_PPWRITE = 1UL << 0,
  123. TPMA_NV_OWNERWRITE = 1UL << 1,
  124. TPMA_NV_AUTHWRITE = 1UL << 2,
  125. TPMA_NV_POLICYWRITE = 1UL << 3,
  126. TPMA_NV_COUNTER = 1UL << 4,
  127. TPMA_NV_BITS = 1UL << 5,
  128. TPMA_NV_EXTEND = 1UL << 6,
  129. TPMA_NV_POLICY_DELETE = 1UL << 10,
  130. TPMA_NV_WRITELOCKED = 1UL << 11,
  131. TPMA_NV_WRITEALL = 1UL << 12,
  132. TPMA_NV_WRITEDEFINE = 1UL << 13,
  133. TPMA_NV_WRITE_STCLEAR = 1UL << 14,
  134. TPMA_NV_GLOBALLOCK = 1UL << 15,
  135. TPMA_NV_PPREAD = 1UL << 16,
  136. TPMA_NV_OWNERREAD = 1UL << 17,
  137. TPMA_NV_AUTHREAD = 1UL << 18,
  138. TPMA_NV_POLICYREAD = 1UL << 19,
  139. TPMA_NV_NO_DA = 1UL << 25,
  140. TPMA_NV_ORDERLY = 1UL << 26,
  141. TPMA_NV_CLEAR_STCLEAR = 1UL << 27,
  142. TPMA_NV_READLOCKED = 1UL << 28,
  143. TPMA_NV_WRITTEN = 1UL << 29,
  144. TPMA_NV_PLATFORMCREATE = 1UL << 30,
  145. TPMA_NV_READ_STCLEAR = 1UL << 31,
  146. TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD |
  147. TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD,
  148. TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE |
  149. TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE,
  150. };
  151. /**
  152. * Issue a TPM2_Startup command.
  153. *
  154. * @dev TPM device
  155. * @mode TPM startup mode
  156. *
  157. * @return code of the operation
  158. */
  159. u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode);
  160. /**
  161. * Issue a TPM2_SelfTest command.
  162. *
  163. * @dev TPM device
  164. * @full_test Asking to perform all tests or only the untested ones
  165. *
  166. * @return code of the operation
  167. */
  168. u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test);
  169. /**
  170. * Issue a TPM2_Clear command.
  171. *
  172. * @dev TPM device
  173. * @handle Handle
  174. * @pw Password
  175. * @pw_sz Length of the password
  176. *
  177. * @return code of the operation
  178. */
  179. u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
  180. const ssize_t pw_sz);
  181. /**
  182. * Issue a TPM2_PCR_Extend command.
  183. *
  184. * @dev TPM device
  185. * @index Index of the PCR
  186. * @digest Value representing the event to be recorded
  187. *
  188. * @return code of the operation
  189. */
  190. u32 tpm2_pcr_extend(struct udevice *dev, u32 index, const uint8_t *digest);
  191. /**
  192. * Issue a TPM2_PCR_Read command.
  193. *
  194. * @dev TPM device
  195. * @idx Index of the PCR
  196. * @idx_min_sz Minimum size in bytes of the pcrSelect array
  197. * @data Output buffer for contents of the named PCR
  198. * @updates Optional out parameter: number of updates for this PCR
  199. *
  200. * @return code of the operation
  201. */
  202. u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
  203. void *data, unsigned int *updates);
  204. /**
  205. * Issue a TPM2_GetCapability command. This implementation is limited
  206. * to query property index that is 4-byte wide.
  207. *
  208. * @dev TPM device
  209. * @capability Partition of capabilities
  210. * @property Further definition of capability, limited to be 4 bytes wide
  211. * @buf Output buffer for capability information
  212. * @prop_count Size of output buffer
  213. *
  214. * @return code of the operation
  215. */
  216. u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
  217. void *buf, size_t prop_count);
  218. /**
  219. * Issue a TPM2_DictionaryAttackLockReset command.
  220. *
  221. * @dev TPM device
  222. * @pw Password
  223. * @pw_sz Length of the password
  224. *
  225. * @return code of the operation
  226. */
  227. u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz);
  228. /**
  229. * Issue a TPM2_DictionaryAttackParameters command.
  230. *
  231. * @dev TPM device
  232. * @pw Password
  233. * @pw_sz Length of the password
  234. * @max_tries Count of authorizations before lockout
  235. * @recovery_time Time before decrementation of the failure count
  236. * @lockout_recovery Time to wait after a lockout
  237. *
  238. * @return code of the operation
  239. */
  240. u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
  241. const ssize_t pw_sz, unsigned int max_tries,
  242. unsigned int recovery_time,
  243. unsigned int lockout_recovery);
  244. /**
  245. * Issue a TPM2_HierarchyChangeAuth command.
  246. *
  247. * @dev TPM device
  248. * @handle Handle
  249. * @newpw New password
  250. * @newpw_sz Length of the new password
  251. * @oldpw Old password
  252. * @oldpw_sz Length of the old password
  253. *
  254. * @return code of the operation
  255. */
  256. int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
  257. const ssize_t newpw_sz, const char *oldpw,
  258. const ssize_t oldpw_sz);
  259. /**
  260. * Issue a TPM_PCR_SetAuthPolicy command.
  261. *
  262. * @dev TPM device
  263. * @pw Platform password
  264. * @pw_sz Length of the password
  265. * @index Index of the PCR
  266. * @digest New key to access the PCR
  267. *
  268. * @return code of the operation
  269. */
  270. u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
  271. const ssize_t pw_sz, u32 index, const char *key);
  272. /**
  273. * Issue a TPM_PCR_SetAuthValue command.
  274. *
  275. * @dev TPM device
  276. * @pw Platform password
  277. * @pw_sz Length of the password
  278. * @index Index of the PCR
  279. * @digest New key to access the PCR
  280. * @key_sz Length of the new key
  281. *
  282. * @return code of the operation
  283. */
  284. u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
  285. const ssize_t pw_sz, u32 index, const char *key,
  286. const ssize_t key_sz);
  287. #endif /* __TPM_V2_H */