tpm-v2.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Bootlin
  4. * Author: Miquel Raynal <miquel.raynal@bootlin.com>
  5. */
  6. #include <common.h>
  7. #include <dm.h>
  8. #include <tpm-common.h>
  9. #include <tpm-v2.h>
  10. #include "tpm-utils.h"
  11. u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode)
  12. {
  13. const u8 command_v2[12] = {
  14. tpm_u16(TPM2_ST_NO_SESSIONS),
  15. tpm_u32(12),
  16. tpm_u32(TPM2_CC_STARTUP),
  17. tpm_u16(mode),
  18. };
  19. int ret;
  20. /*
  21. * Note TPM2_Startup command will return RC_SUCCESS the first time,
  22. * but will return RC_INITIALIZE otherwise.
  23. */
  24. ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  25. if (ret && ret != TPM2_RC_INITIALIZE)
  26. return ret;
  27. return 0;
  28. }
  29. u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test)
  30. {
  31. const u8 command_v2[12] = {
  32. tpm_u16(TPM2_ST_NO_SESSIONS),
  33. tpm_u32(11),
  34. tpm_u32(TPM2_CC_SELF_TEST),
  35. full_test,
  36. };
  37. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  38. }
  39. u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
  40. const ssize_t pw_sz)
  41. {
  42. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  43. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  44. tpm_u32(27 + pw_sz), /* Length */
  45. tpm_u32(TPM2_CC_CLEAR), /* Command code */
  46. /* HANDLE */
  47. tpm_u32(handle), /* TPM resource handle */
  48. /* AUTH_SESSION */
  49. tpm_u32(9 + pw_sz), /* Authorization size */
  50. tpm_u32(TPM2_RS_PW), /* Session handle */
  51. tpm_u16(0), /* Size of <nonce> */
  52. /* <nonce> (if any) */
  53. 0, /* Attributes: Cont/Excl/Rst */
  54. tpm_u16(pw_sz), /* Size of <hmac/password> */
  55. /* STRING(pw) <hmac/password> (if any) */
  56. };
  57. unsigned int offset = 27;
  58. int ret;
  59. /*
  60. * Fill the command structure starting from the first buffer:
  61. * - the password (if any)
  62. */
  63. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  64. offset, pw, pw_sz);
  65. offset += pw_sz;
  66. if (ret)
  67. return TPM_LIB_ERROR;
  68. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  69. }
  70. u32 tpm2_pcr_extend(struct udevice *dev, u32 index, const uint8_t *digest)
  71. {
  72. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  73. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  74. tpm_u32(33 + TPM2_DIGEST_LEN), /* Length */
  75. tpm_u32(TPM2_CC_PCR_EXTEND), /* Command code */
  76. /* HANDLE */
  77. tpm_u32(index), /* Handle (PCR Index) */
  78. /* AUTH_SESSION */
  79. tpm_u32(9), /* Authorization size */
  80. tpm_u32(TPM2_RS_PW), /* Session handle */
  81. tpm_u16(0), /* Size of <nonce> */
  82. /* <nonce> (if any) */
  83. 0, /* Attributes: Cont/Excl/Rst */
  84. tpm_u16(0), /* Size of <hmac/password> */
  85. /* <hmac/password> (if any) */
  86. tpm_u32(1), /* Count (number of hashes) */
  87. tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */
  88. /* STRING(digest) Digest */
  89. };
  90. unsigned int offset = 33;
  91. int ret;
  92. /*
  93. * Fill the command structure starting from the first buffer:
  94. * - the digest
  95. */
  96. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  97. offset, digest, TPM2_DIGEST_LEN);
  98. offset += TPM2_DIGEST_LEN;
  99. if (ret)
  100. return TPM_LIB_ERROR;
  101. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  102. }
  103. u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
  104. void *data, unsigned int *updates)
  105. {
  106. u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
  107. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  108. tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */
  109. tpm_u32(17 + idx_array_sz), /* Length */
  110. tpm_u32(TPM2_CC_PCR_READ), /* Command code */
  111. /* TPML_PCR_SELECTION */
  112. tpm_u32(1), /* Number of selections */
  113. tpm_u16(TPM2_ALG_SHA256), /* Algorithm of the hash */
  114. idx_array_sz, /* Array size for selection */
  115. /* bitmap(idx) Selected PCR bitmap */
  116. };
  117. size_t response_len = COMMAND_BUFFER_SIZE;
  118. u8 response[COMMAND_BUFFER_SIZE];
  119. unsigned int pcr_sel_idx = idx / 8;
  120. u8 pcr_sel_bit = BIT(idx % 8);
  121. unsigned int counter = 0;
  122. int ret;
  123. if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b",
  124. 17 + pcr_sel_idx, pcr_sel_bit))
  125. return TPM_LIB_ERROR;
  126. ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
  127. if (ret)
  128. return ret;
  129. if (unpack_byte_string(response, response_len, "ds",
  130. 10, &counter,
  131. response_len - TPM2_DIGEST_LEN, data,
  132. TPM2_DIGEST_LEN))
  133. return TPM_LIB_ERROR;
  134. if (updates)
  135. *updates = counter;
  136. return 0;
  137. }
  138. u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
  139. void *buf, size_t prop_count)
  140. {
  141. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  142. tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */
  143. tpm_u32(22), /* Length */
  144. tpm_u32(TPM2_CC_GET_CAPABILITY), /* Command code */
  145. tpm_u32(capability), /* Capability */
  146. tpm_u32(property), /* Property */
  147. tpm_u32(prop_count), /* Property count */
  148. };
  149. u8 response[COMMAND_BUFFER_SIZE];
  150. size_t response_len = COMMAND_BUFFER_SIZE;
  151. unsigned int properties_off;
  152. int ret;
  153. ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
  154. if (ret)
  155. return ret;
  156. /*
  157. * In the response buffer, the properties are located after the:
  158. * tag (u16), response size (u32), response code (u32),
  159. * YES/NO flag (u8), TPM_CAP (u32) and TPMU_CAPABILITIES (u32).
  160. */
  161. properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
  162. sizeof(u8) + sizeof(u32) + sizeof(u32);
  163. memcpy(buf, &response[properties_off], response_len - properties_off);
  164. return 0;
  165. }
  166. u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz)
  167. {
  168. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  169. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  170. tpm_u32(27 + pw_sz), /* Length */
  171. tpm_u32(TPM2_CC_DAM_RESET), /* Command code */
  172. /* HANDLE */
  173. tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */
  174. /* AUTH_SESSION */
  175. tpm_u32(9 + pw_sz), /* Authorization size */
  176. tpm_u32(TPM2_RS_PW), /* Session handle */
  177. tpm_u16(0), /* Size of <nonce> */
  178. /* <nonce> (if any) */
  179. 0, /* Attributes: Cont/Excl/Rst */
  180. tpm_u16(pw_sz), /* Size of <hmac/password> */
  181. /* STRING(pw) <hmac/password> (if any) */
  182. };
  183. unsigned int offset = 27;
  184. int ret;
  185. /*
  186. * Fill the command structure starting from the first buffer:
  187. * - the password (if any)
  188. */
  189. ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  190. offset, pw, pw_sz);
  191. offset += pw_sz;
  192. if (ret)
  193. return TPM_LIB_ERROR;
  194. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  195. }
  196. u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
  197. const ssize_t pw_sz, unsigned int max_tries,
  198. unsigned int recovery_time,
  199. unsigned int lockout_recovery)
  200. {
  201. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  202. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  203. tpm_u32(27 + pw_sz + 12), /* Length */
  204. tpm_u32(TPM2_CC_DAM_PARAMETERS), /* Command code */
  205. /* HANDLE */
  206. tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */
  207. /* AUTH_SESSION */
  208. tpm_u32(9 + pw_sz), /* Authorization size */
  209. tpm_u32(TPM2_RS_PW), /* Session handle */
  210. tpm_u16(0), /* Size of <nonce> */
  211. /* <nonce> (if any) */
  212. 0, /* Attributes: Cont/Excl/Rst */
  213. tpm_u16(pw_sz), /* Size of <hmac/password> */
  214. /* STRING(pw) <hmac/password> (if any) */
  215. /* LOCKOUT PARAMETERS */
  216. /* tpm_u32(max_tries) Max tries (0, always lock) */
  217. /* tpm_u32(recovery_time) Recovery time (0, no lock) */
  218. /* tpm_u32(lockout_recovery) Lockout recovery */
  219. };
  220. unsigned int offset = 27;
  221. int ret;
  222. /*
  223. * Fill the command structure starting from the first buffer:
  224. * - the password (if any)
  225. * - max tries
  226. * - recovery time
  227. * - lockout recovery
  228. */
  229. ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd",
  230. offset, pw, pw_sz,
  231. offset + pw_sz, max_tries,
  232. offset + pw_sz + 4, recovery_time,
  233. offset + pw_sz + 8, lockout_recovery);
  234. offset += pw_sz + 12;
  235. if (ret)
  236. return TPM_LIB_ERROR;
  237. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  238. }
  239. int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
  240. const ssize_t newpw_sz, const char *oldpw,
  241. const ssize_t oldpw_sz)
  242. {
  243. unsigned int offset = 27;
  244. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  245. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  246. tpm_u32(offset + oldpw_sz + 2 + newpw_sz), /* Length */
  247. tpm_u32(TPM2_CC_HIERCHANGEAUTH), /* Command code */
  248. /* HANDLE */
  249. tpm_u32(handle), /* TPM resource handle */
  250. /* AUTH_SESSION */
  251. tpm_u32(9 + oldpw_sz), /* Authorization size */
  252. tpm_u32(TPM2_RS_PW), /* Session handle */
  253. tpm_u16(0), /* Size of <nonce> */
  254. /* <nonce> (if any) */
  255. 0, /* Attributes: Cont/Excl/Rst */
  256. tpm_u16(oldpw_sz) /* Size of <hmac/password> */
  257. /* STRING(oldpw) <hmac/password> (if any) */
  258. /* TPM2B_AUTH (TPM2B_DIGEST) */
  259. /* tpm_u16(newpw_sz) Digest size, new pw length */
  260. /* STRING(newpw) Digest buffer, new pw */
  261. };
  262. int ret;
  263. /*
  264. * Fill the command structure starting from the first buffer:
  265. * - the old password (if any)
  266. * - size of the new password
  267. * - new password
  268. */
  269. ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
  270. offset, oldpw, oldpw_sz,
  271. offset + oldpw_sz, newpw_sz,
  272. offset + oldpw_sz + 2, newpw, newpw_sz);
  273. offset += oldpw_sz + 2 + newpw_sz;
  274. if (ret)
  275. return TPM_LIB_ERROR;
  276. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  277. }
  278. u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
  279. const ssize_t pw_sz, u32 index, const char *key)
  280. {
  281. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  282. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  283. tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN), /* Length */
  284. tpm_u32(TPM2_CC_PCR_SETAUTHPOL), /* Command code */
  285. /* HANDLE */
  286. tpm_u32(TPM2_RH_PLATFORM), /* TPM resource handle */
  287. /* AUTH_SESSION */
  288. tpm_u32(9 + pw_sz), /* Authorization size */
  289. tpm_u32(TPM2_RS_PW), /* session handle */
  290. tpm_u16(0), /* Size of <nonce> */
  291. /* <nonce> (if any) */
  292. 0, /* Attributes: Cont/Excl/Rst */
  293. tpm_u16(pw_sz) /* Size of <hmac/password> */
  294. /* STRING(pw) <hmac/password> (if any) */
  295. /* TPM2B_AUTH (TPM2B_DIGEST) */
  296. /* tpm_u16(TPM2_DIGEST_LEN) Digest size length */
  297. /* STRING(key) Digest buffer (PCR key) */
  298. /* TPMI_ALG_HASH */
  299. /* tpm_u16(TPM2_ALG_SHA256) Algorithm of the hash */
  300. /* TPMI_DH_PCR */
  301. /* tpm_u32(index), PCR Index */
  302. };
  303. unsigned int offset = 27;
  304. int ret;
  305. /*
  306. * Fill the command structure starting from the first buffer:
  307. * - the password (if any)
  308. * - the PCR key length
  309. * - the PCR key
  310. * - the hash algorithm
  311. * - the PCR index
  312. */
  313. ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd",
  314. offset, pw, pw_sz,
  315. offset + pw_sz, TPM2_DIGEST_LEN,
  316. offset + pw_sz + 2, key, TPM2_DIGEST_LEN,
  317. offset + pw_sz + 2 + TPM2_DIGEST_LEN,
  318. TPM2_ALG_SHA256,
  319. offset + pw_sz + 4 + TPM2_DIGEST_LEN, index);
  320. offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4;
  321. if (ret)
  322. return TPM_LIB_ERROR;
  323. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  324. }
  325. u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
  326. const ssize_t pw_sz, u32 index, const char *key,
  327. const ssize_t key_sz)
  328. {
  329. u8 command_v2[COMMAND_BUFFER_SIZE] = {
  330. tpm_u16(TPM2_ST_SESSIONS), /* TAG */
  331. tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN), /* Length */
  332. tpm_u32(TPM2_CC_PCR_SETAUTHVAL), /* Command code */
  333. /* HANDLE */
  334. tpm_u32(index), /* Handle (PCR Index) */
  335. /* AUTH_SESSION */
  336. tpm_u32(9 + pw_sz), /* Authorization size */
  337. tpm_u32(TPM2_RS_PW), /* session handle */
  338. tpm_u16(0), /* Size of <nonce> */
  339. /* <nonce> (if any) */
  340. 0, /* Attributes: Cont/Excl/Rst */
  341. tpm_u16(pw_sz), /* Size of <hmac/password> */
  342. /* STRING(pw) <hmac/password> (if any) */
  343. /* TPM2B_DIGEST */
  344. /* tpm_u16(key_sz) Key length */
  345. /* STRING(key) Key */
  346. };
  347. unsigned int offset = 27;
  348. int ret;
  349. /*
  350. * Fill the command structure starting from the first buffer:
  351. * - the password (if any)
  352. * - the number of digests, 1 in our case
  353. * - the algorithm, sha256 in our case
  354. * - the digest (64 bytes)
  355. */
  356. ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
  357. offset, pw, pw_sz,
  358. offset + pw_sz, key_sz,
  359. offset + pw_sz + 2, key, key_sz);
  360. offset += pw_sz + 2 + key_sz;
  361. if (ret)
  362. return TPM_LIB_ERROR;
  363. return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  364. }