blob: 780e0619750cef4c6c8ea6c2144b2de9196b1e3b [file] [log] [blame]
Miquel Raynalff322452018-05-15 11:57:08 +02001/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * Copyright (c) 2018 Bootlin
4 * Author: Miquel Raynal <miquel.raynal@bootlin.com>
5 */
6
7#ifndef __TPM_V2_H
8#define __TPM_V2_H
9
10#include <tpm-common.h>
11
12#define TPM2_DIGEST_LEN 32
13
14/**
15 * TPM2 Structure Tags for command/response buffers.
16 *
17 * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
18 * @TPM2_ST_SESSIONS: the command needs an authentication.
19 */
20enum tpm2_structures {
21 TPM2_ST_NO_SESSIONS = 0x8001,
22 TPM2_ST_SESSIONS = 0x8002,
23};
24
25/**
26 * TPM2 type of boolean.
27 */
28enum tpm2_yes_no {
29 TPMI_YES = 1,
30 TPMI_NO = 0,
31};
32
33/**
34 * TPM2 startup values.
35 *
36 * @TPM2_SU_CLEAR: reset the internal state.
37 * @TPM2_SU_STATE: restore saved state (if any).
38 */
39enum tpm2_startup_types {
40 TPM2_SU_CLEAR = 0x0000,
41 TPM2_SU_STATE = 0x0001,
42};
43
44/**
45 * TPM2 permanent handles.
46 *
47 * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
48 * @TPM2_RS_PW: indicates a password.
49 * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
50 * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
51 * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
52 */
53enum tpm2_handles {
54 TPM2_RH_OWNER = 0x40000001,
55 TPM2_RS_PW = 0x40000009,
56 TPM2_RH_LOCKOUT = 0x4000000A,
57 TPM2_RH_ENDORSEMENT = 0x4000000B,
58 TPM2_RH_PLATFORM = 0x4000000C,
59};
60
61/**
62 * TPM2 command codes used at the beginning of a buffer, gives the command.
63 *
64 * @TPM2_CC_STARTUP: TPM2_Startup().
65 * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
66 * @TPM2_CC_CLEAR: TPM2_Clear().
67 * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
68 * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
69 * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
70 * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
71 * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
72 * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
73 * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
74 * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
75 * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
76 */
77enum tpm2_command_codes {
78 TPM2_CC_STARTUP = 0x0144,
79 TPM2_CC_SELF_TEST = 0x0143,
80 TPM2_CC_CLEAR = 0x0126,
81 TPM2_CC_CLEARCONTROL = 0x0127,
82 TPM2_CC_HIERCHANGEAUTH = 0x0129,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020083 TPM2_CC_PCR_SETAUTHPOL = 0x012C,
Miquel Raynalff322452018-05-15 11:57:08 +020084 TPM2_CC_DAM_RESET = 0x0139,
85 TPM2_CC_DAM_PARAMETERS = 0x013A,
86 TPM2_CC_GET_CAPABILITY = 0x017A,
87 TPM2_CC_PCR_READ = 0x017E,
88 TPM2_CC_PCR_EXTEND = 0x0182,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020089 TPM2_CC_PCR_SETAUTHVAL = 0x0183,
Miquel Raynalff322452018-05-15 11:57:08 +020090};
91
92/**
93 * TPM2 return codes.
94 */
95enum tpm2_return_codes {
96 TPM2_RC_SUCCESS = 0x0000,
97 TPM2_RC_BAD_TAG = 0x001E,
98 TPM2_RC_FMT1 = 0x0080,
99 TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
100 TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
101 TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
102 TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
103 TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
104 TPM2_RC_VER1 = 0x0100,
105 TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
106 TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
107 TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
108 TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
109 TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
110 TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
111 TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
112 TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
113 TPM2_RC_WARN = 0x0900,
114 TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
115 TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
116 TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
117};
118
119/**
120 * TPM2 algorithms.
121 */
122enum tpm2_algorithms {
123 TPM2_ALG_XOR = 0x0A,
124 TPM2_ALG_SHA256 = 0x0B,
125 TPM2_ALG_SHA384 = 0x0C,
126 TPM2_ALG_SHA512 = 0x0D,
127 TPM2_ALG_NULL = 0x10,
128};
129
Miquel Raynal1922df22018-05-15 11:57:12 +0200130/**
131 * Issue a TPM2_Startup command.
132 *
133 * @mode TPM startup mode
134 *
135 * @return code of the operation
136 */
137u32 tpm2_startup(enum tpm2_startup_types mode);
138
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200139/**
140 * Issue a TPM2_SelfTest command.
141 *
142 * @full_test Asking to perform all tests or only the untested ones
143 *
144 * @return code of the operation
145 */
146u32 tpm2_self_test(enum tpm2_yes_no full_test);
147
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200148/**
149 * Issue a TPM2_Clear command.
150 *
151 * @handle Handle
152 * @pw Password
153 * @pw_sz Length of the password
154 *
155 * @return code of the operation
156 */
157u32 tpm2_clear(u32 handle, const char *pw, const ssize_t pw_sz);
158
Miquel Raynal6284be52018-05-15 11:57:15 +0200159/**
160 * Issue a TPM2_PCR_Extend command.
161 *
162 * @index Index of the PCR
163 * @digest Value representing the event to be recorded
164 *
165 * @return code of the operation
166 */
167u32 tpm2_pcr_extend(u32 index, const uint8_t *digest);
168
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200169/**
170 * Issue a TPM2_PCR_Read command.
171 *
172 * @idx Index of the PCR
173 * @idx_min_sz Minimum size in bytes of the pcrSelect array
174 * @data Output buffer for contents of the named PCR
175 * @updates Optional out parameter: number of updates for this PCR
176 *
177 * @return code of the operation
178 */
179u32 tpm2_pcr_read(u32 idx, unsigned int idx_min_sz, void *data,
180 unsigned int *updates);
181
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200182/**
183 * Issue a TPM2_GetCapability command. This implementation is limited
184 * to query property index that is 4-byte wide.
185 *
186 * @capability Partition of capabilities
187 * @property Further definition of capability, limited to be 4 bytes wide
188 * @buf Output buffer for capability information
189 * @prop_count Size of output buffer
190 *
191 * @return code of the operation
192 */
193u32 tpm2_get_capability(u32 capability, u32 property, void *buf,
194 size_t prop_count);
195
Miquel Raynalda9c3392018-05-15 11:57:18 +0200196/**
197 * Issue a TPM2_DictionaryAttackLockReset command.
198 *
199 * @pw Password
200 * @pw_sz Length of the password
201 *
202 * @return code of the operation
203 */
204u32 tpm2_dam_reset(const char *pw, const ssize_t pw_sz);
205
206/**
207 * Issue a TPM2_DictionaryAttackParameters command.
208 *
209 * @pw Password
210 * @pw_sz Length of the password
211 * @max_tries Count of authorizations before lockout
212 * @recovery_time Time before decrementation of the failure count
213 * @lockout_recovery Time to wait after a lockout
214 *
215 * @return code of the operation
216 */
217u32 tpm2_dam_parameters(const char *pw, const ssize_t pw_sz,
218 unsigned int max_tries, unsigned int recovery_time,
219 unsigned int lockout_recovery);
220
Miquel Raynaldc26e912018-05-15 11:57:19 +0200221/**
222 * Issue a TPM2_HierarchyChangeAuth command.
223 *
224 * @handle Handle
225 * @newpw New password
226 * @newpw_sz Length of the new password
227 * @oldpw Old password
228 * @oldpw_sz Length of the old password
229 *
230 * @return code of the operation
231 */
232int tpm2_change_auth(u32 handle, const char *newpw, const ssize_t newpw_sz,
233 const char *oldpw, const ssize_t oldpw_sz);
234
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200235/**
236 * Issue a TPM_PCR_SetAuthPolicy command.
237 *
238 * @pw Platform password
239 * @pw_sz Length of the password
240 * @index Index of the PCR
241 * @digest New key to access the PCR
242 *
243 * @return code of the operation
244 */
245u32 tpm2_pcr_setauthpolicy(const char *pw, const ssize_t pw_sz, u32 index,
246 const char *key);
247
248/**
249 * Issue a TPM_PCR_SetAuthValue command.
250 *
251 * @pw Platform password
252 * @pw_sz Length of the password
253 * @index Index of the PCR
254 * @digest New key to access the PCR
255 * @key_sz Length of the new key
256 *
257 * @return code of the operation
258 */
259u32 tpm2_pcr_setauthvalue(const char *pw, const ssize_t pw_sz, u32 index,
260 const char *key, const ssize_t key_sz);
261
Miquel Raynalff322452018-05-15 11:57:08 +0200262#endif /* __TPM_V2_H */