Miquel Raynal | ff32245 | 2018-05-15 11:57:08 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
| 2 | /* |
| 3 | * Copyright (c) 2018 Bootlin |
| 4 | * Author: Miquel Raynal <miquel.raynal@bootlin.com> |
| 5 | */ |
| 6 | |
| 7 | #include <common.h> |
| 8 | #include <dm.h> |
| 9 | #include <tpm-common.h> |
| 10 | #include <tpm-v2.h> |
Simon Glass | cd93d62 | 2020-05-10 11:40:13 -0600 | [diff] [blame] | 11 | #include <linux/bitops.h> |
Miquel Raynal | ff32245 | 2018-05-15 11:57:08 +0200 | [diff] [blame] | 12 | #include "tpm-utils.h" |
Miquel Raynal | 1922df2 | 2018-05-15 11:57:12 +0200 | [diff] [blame] | 13 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 14 | u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode) |
Miquel Raynal | 1922df2 | 2018-05-15 11:57:12 +0200 | [diff] [blame] | 15 | { |
| 16 | const u8 command_v2[12] = { |
| 17 | tpm_u16(TPM2_ST_NO_SESSIONS), |
| 18 | tpm_u32(12), |
| 19 | tpm_u32(TPM2_CC_STARTUP), |
| 20 | tpm_u16(mode), |
| 21 | }; |
| 22 | int ret; |
| 23 | |
| 24 | /* |
| 25 | * Note TPM2_Startup command will return RC_SUCCESS the first time, |
| 26 | * but will return RC_INITIALIZE otherwise. |
| 27 | */ |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 28 | ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | 1922df2 | 2018-05-15 11:57:12 +0200 | [diff] [blame] | 29 | if (ret && ret != TPM2_RC_INITIALIZE) |
| 30 | return ret; |
| 31 | |
| 32 | return 0; |
| 33 | } |
Miquel Raynal | 2dc6d97 | 2018-05-15 11:57:13 +0200 | [diff] [blame] | 34 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 35 | u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test) |
Miquel Raynal | 2dc6d97 | 2018-05-15 11:57:13 +0200 | [diff] [blame] | 36 | { |
| 37 | const u8 command_v2[12] = { |
| 38 | tpm_u16(TPM2_ST_NO_SESSIONS), |
| 39 | tpm_u32(11), |
| 40 | tpm_u32(TPM2_CC_SELF_TEST), |
| 41 | full_test, |
| 42 | }; |
| 43 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 44 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | 2dc6d97 | 2018-05-15 11:57:13 +0200 | [diff] [blame] | 45 | } |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 46 | |
Ilias Apalodimas | a595be3 | 2023-01-25 12:18:36 +0200 | [diff] [blame^] | 47 | u32 tpm2_auto_start(struct udevice *dev) |
| 48 | { |
| 49 | u32 rc; |
| 50 | |
| 51 | /* |
| 52 | * the tpm_init() will return -EBUSY if the init has already happened |
| 53 | * The selftest and startup code can run multiple times with no side |
| 54 | * effects |
| 55 | */ |
| 56 | rc = tpm_init(dev); |
| 57 | if (rc && rc != -EBUSY) |
| 58 | return rc; |
| 59 | rc = tpm2_self_test(dev, TPMI_YES); |
| 60 | |
| 61 | if (rc == TPM2_RC_INITIALIZE) { |
| 62 | rc = tpm2_startup(dev, TPM2_SU_CLEAR); |
| 63 | if (rc) |
| 64 | return rc; |
| 65 | |
| 66 | rc = tpm2_self_test(dev, TPMI_YES); |
| 67 | } |
| 68 | |
| 69 | return rc; |
| 70 | } |
| 71 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 72 | u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw, |
| 73 | const ssize_t pw_sz) |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 74 | { |
Simon Glass | 1bea7cc | 2021-02-06 14:23:38 -0700 | [diff] [blame] | 75 | /* Length of the message header, up to start of password */ |
| 76 | uint offset = 27; |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 77 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 78 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
Simon Glass | 1bea7cc | 2021-02-06 14:23:38 -0700 | [diff] [blame] | 79 | tpm_u32(offset + pw_sz), /* Length */ |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 80 | tpm_u32(TPM2_CC_CLEAR), /* Command code */ |
| 81 | |
| 82 | /* HANDLE */ |
| 83 | tpm_u32(handle), /* TPM resource handle */ |
| 84 | |
| 85 | /* AUTH_SESSION */ |
| 86 | tpm_u32(9 + pw_sz), /* Authorization size */ |
| 87 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 88 | tpm_u16(0), /* Size of <nonce> */ |
| 89 | /* <nonce> (if any) */ |
| 90 | 0, /* Attributes: Cont/Excl/Rst */ |
| 91 | tpm_u16(pw_sz), /* Size of <hmac/password> */ |
| 92 | /* STRING(pw) <hmac/password> (if any) */ |
| 93 | }; |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 94 | int ret; |
| 95 | |
| 96 | /* |
| 97 | * Fill the command structure starting from the first buffer: |
| 98 | * - the password (if any) |
| 99 | */ |
| 100 | ret = pack_byte_string(command_v2, sizeof(command_v2), "s", |
| 101 | offset, pw, pw_sz); |
| 102 | offset += pw_sz; |
| 103 | if (ret) |
| 104 | return TPM_LIB_ERROR; |
| 105 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 106 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | bad8ff5 | 2018-05-15 11:57:14 +0200 | [diff] [blame] | 107 | } |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 108 | |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 109 | u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index, |
| 110 | size_t space_size, u32 nv_attributes, |
| 111 | const u8 *nv_policy, size_t nv_policy_size) |
| 112 | { |
| 113 | /* |
| 114 | * Calculate the offset of the nv_policy piece by adding each of the |
| 115 | * chunks below. |
| 116 | */ |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 117 | const int platform_len = sizeof(u32); |
| 118 | const int session_hdr_len = 13; |
| 119 | const int message_len = 14; |
| 120 | uint offset = TPM2_HDR_LEN + platform_len + session_hdr_len + |
| 121 | message_len; |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 122 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 123 | /* header 10 bytes */ |
| 124 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 125 | tpm_u32(offset + nv_policy_size + 2),/* Length */ |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 126 | tpm_u32(TPM2_CC_NV_DEFINE_SPACE),/* Command code */ |
| 127 | |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 128 | /* handles 4 bytes */ |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 129 | tpm_u32(TPM2_RH_PLATFORM), /* Primary platform seed */ |
| 130 | |
| 131 | /* session header 13 bytes */ |
| 132 | tpm_u32(9), /* Header size */ |
| 133 | tpm_u32(TPM2_RS_PW), /* Password authorisation */ |
| 134 | tpm_u16(0), /* nonce_size */ |
| 135 | 0, /* session_attrs */ |
| 136 | tpm_u16(0), /* auth_size */ |
| 137 | |
| 138 | /* message 14 bytes + policy */ |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 139 | tpm_u16(message_len + nv_policy_size), /* size */ |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 140 | tpm_u32(space_index), |
| 141 | tpm_u16(TPM2_ALG_SHA256), |
| 142 | tpm_u32(nv_attributes), |
| 143 | tpm_u16(nv_policy_size), |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 144 | /* |
| 145 | * nv_policy |
| 146 | * space_size |
| 147 | */ |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 148 | }; |
| 149 | int ret; |
| 150 | |
| 151 | /* |
| 152 | * Fill the command structure starting from the first buffer: |
| 153 | * - the password (if any) |
| 154 | */ |
Simon Glass | 1c32eee | 2022-08-30 21:05:34 -0600 | [diff] [blame] | 155 | ret = pack_byte_string(command_v2, sizeof(command_v2), "sw", |
| 156 | offset, nv_policy, nv_policy_size, |
| 157 | offset + nv_policy_size, space_size); |
Simon Glass | eadcbc7 | 2021-02-06 14:23:39 -0700 | [diff] [blame] | 158 | if (ret) |
| 159 | return TPM_LIB_ERROR; |
| 160 | |
| 161 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
| 162 | } |
| 163 | |
Ilias Apalodimas | e926136 | 2020-11-26 23:07:22 +0200 | [diff] [blame] | 164 | u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm, |
| 165 | const u8 *digest, u32 digest_len) |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 166 | { |
Simon Glass | 1bea7cc | 2021-02-06 14:23:38 -0700 | [diff] [blame] | 167 | /* Length of the message header, up to start of digest */ |
| 168 | uint offset = 33; |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 169 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 170 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
Simon Glass | 1bea7cc | 2021-02-06 14:23:38 -0700 | [diff] [blame] | 171 | tpm_u32(offset + digest_len), /* Length */ |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 172 | tpm_u32(TPM2_CC_PCR_EXTEND), /* Command code */ |
| 173 | |
| 174 | /* HANDLE */ |
| 175 | tpm_u32(index), /* Handle (PCR Index) */ |
| 176 | |
| 177 | /* AUTH_SESSION */ |
| 178 | tpm_u32(9), /* Authorization size */ |
| 179 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 180 | tpm_u16(0), /* Size of <nonce> */ |
| 181 | /* <nonce> (if any) */ |
| 182 | 0, /* Attributes: Cont/Excl/Rst */ |
| 183 | tpm_u16(0), /* Size of <hmac/password> */ |
| 184 | /* <hmac/password> (if any) */ |
Simon Glass | 1bea7cc | 2021-02-06 14:23:38 -0700 | [diff] [blame] | 185 | |
| 186 | /* hashes */ |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 187 | tpm_u32(1), /* Count (number of hashes) */ |
Ilias Apalodimas | e926136 | 2020-11-26 23:07:22 +0200 | [diff] [blame] | 188 | tpm_u16(algorithm), /* Algorithm of the hash */ |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 189 | /* STRING(digest) Digest */ |
| 190 | }; |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 191 | int ret; |
| 192 | |
Simon Glass | a557d25 | 2022-08-30 21:05:32 -0600 | [diff] [blame] | 193 | if (!digest) |
| 194 | return -EINVAL; |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 195 | /* |
| 196 | * Fill the command structure starting from the first buffer: |
| 197 | * - the digest |
| 198 | */ |
| 199 | ret = pack_byte_string(command_v2, sizeof(command_v2), "s", |
Ilias Apalodimas | e926136 | 2020-11-26 23:07:22 +0200 | [diff] [blame] | 200 | offset, digest, digest_len); |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 201 | if (ret) |
| 202 | return TPM_LIB_ERROR; |
| 203 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 204 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | 6284be5 | 2018-05-15 11:57:15 +0200 | [diff] [blame] | 205 | } |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 206 | |
Simon Glass | 6719cbe | 2021-02-06 14:23:40 -0700 | [diff] [blame] | 207 | u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count) |
| 208 | { |
| 209 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 210 | /* header 10 bytes */ |
| 211 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 212 | tpm_u32(10 + 8 + 4 + 9 + 4), /* Length */ |
| 213 | tpm_u32(TPM2_CC_NV_READ), /* Command code */ |
| 214 | |
| 215 | /* handles 8 bytes */ |
| 216 | tpm_u32(TPM2_RH_PLATFORM), /* Primary platform seed */ |
| 217 | tpm_u32(HR_NV_INDEX + index), /* Password authorisation */ |
| 218 | |
| 219 | /* AUTH_SESSION */ |
| 220 | tpm_u32(9), /* Authorization size */ |
| 221 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 222 | tpm_u16(0), /* Size of <nonce> */ |
| 223 | /* <nonce> (if any) */ |
| 224 | 0, /* Attributes: Cont/Excl/Rst */ |
| 225 | tpm_u16(0), /* Size of <hmac/password> */ |
| 226 | /* <hmac/password> (if any) */ |
| 227 | |
| 228 | tpm_u16(count), /* Number of bytes */ |
| 229 | tpm_u16(0), /* Offset */ |
| 230 | }; |
| 231 | size_t response_len = COMMAND_BUFFER_SIZE; |
| 232 | u8 response[COMMAND_BUFFER_SIZE]; |
| 233 | int ret; |
| 234 | u16 tag; |
| 235 | u32 size, code; |
| 236 | |
| 237 | ret = tpm_sendrecv_command(dev, command_v2, response, &response_len); |
| 238 | if (ret) |
| 239 | return log_msg_ret("read", ret); |
| 240 | if (unpack_byte_string(response, response_len, "wdds", |
| 241 | 0, &tag, 2, &size, 6, &code, |
| 242 | 16, data, count)) |
| 243 | return TPM_LIB_ERROR; |
| 244 | |
| 245 | return 0; |
| 246 | } |
| 247 | |
| 248 | u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data, |
| 249 | u32 count) |
| 250 | { |
| 251 | struct tpm_chip_priv *priv = dev_get_uclass_priv(dev); |
| 252 | uint offset = 10 + 8 + 4 + 9 + 2; |
| 253 | uint len = offset + count + 2; |
| 254 | /* Use empty password auth if platform hierarchy is disabled */ |
| 255 | u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index : |
| 256 | TPM2_RH_PLATFORM; |
| 257 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 258 | /* header 10 bytes */ |
| 259 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 260 | tpm_u32(len), /* Length */ |
| 261 | tpm_u32(TPM2_CC_NV_WRITE), /* Command code */ |
| 262 | |
| 263 | /* handles 8 bytes */ |
| 264 | tpm_u32(auth), /* Primary platform seed */ |
| 265 | tpm_u32(HR_NV_INDEX + index), /* Password authorisation */ |
| 266 | |
| 267 | /* AUTH_SESSION */ |
| 268 | tpm_u32(9), /* Authorization size */ |
| 269 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 270 | tpm_u16(0), /* Size of <nonce> */ |
| 271 | /* <nonce> (if any) */ |
| 272 | 0, /* Attributes: Cont/Excl/Rst */ |
| 273 | tpm_u16(0), /* Size of <hmac/password> */ |
| 274 | /* <hmac/password> (if any) */ |
| 275 | |
| 276 | tpm_u16(count), |
| 277 | }; |
| 278 | size_t response_len = COMMAND_BUFFER_SIZE; |
| 279 | u8 response[COMMAND_BUFFER_SIZE]; |
| 280 | int ret; |
| 281 | |
| 282 | ret = pack_byte_string(command_v2, sizeof(command_v2), "sw", |
| 283 | offset, data, count, |
| 284 | offset + count, 0); |
| 285 | if (ret) |
| 286 | return TPM_LIB_ERROR; |
| 287 | |
| 288 | return tpm_sendrecv_command(dev, command_v2, response, &response_len); |
| 289 | } |
| 290 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 291 | u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, |
Ruchika Gupta | 2957a1e | 2021-11-29 13:09:45 +0530 | [diff] [blame] | 292 | u16 algorithm, void *data, u32 digest_len, |
| 293 | unsigned int *updates) |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 294 | { |
| 295 | u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8)); |
| 296 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 297 | tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */ |
| 298 | tpm_u32(17 + idx_array_sz), /* Length */ |
| 299 | tpm_u32(TPM2_CC_PCR_READ), /* Command code */ |
| 300 | |
| 301 | /* TPML_PCR_SELECTION */ |
| 302 | tpm_u32(1), /* Number of selections */ |
Ruchika Gupta | 2957a1e | 2021-11-29 13:09:45 +0530 | [diff] [blame] | 303 | tpm_u16(algorithm), /* Algorithm of the hash */ |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 304 | idx_array_sz, /* Array size for selection */ |
| 305 | /* bitmap(idx) Selected PCR bitmap */ |
| 306 | }; |
| 307 | size_t response_len = COMMAND_BUFFER_SIZE; |
| 308 | u8 response[COMMAND_BUFFER_SIZE]; |
| 309 | unsigned int pcr_sel_idx = idx / 8; |
| 310 | u8 pcr_sel_bit = BIT(idx % 8); |
| 311 | unsigned int counter = 0; |
| 312 | int ret; |
| 313 | |
| 314 | if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b", |
| 315 | 17 + pcr_sel_idx, pcr_sel_bit)) |
| 316 | return TPM_LIB_ERROR; |
| 317 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 318 | ret = tpm_sendrecv_command(dev, command_v2, response, &response_len); |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 319 | if (ret) |
| 320 | return ret; |
| 321 | |
Ruchika Gupta | 2957a1e | 2021-11-29 13:09:45 +0530 | [diff] [blame] | 322 | if (digest_len > response_len) |
| 323 | return TPM_LIB_ERROR; |
| 324 | |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 325 | if (unpack_byte_string(response, response_len, "ds", |
| 326 | 10, &counter, |
Ruchika Gupta | 2957a1e | 2021-11-29 13:09:45 +0530 | [diff] [blame] | 327 | response_len - digest_len, data, |
| 328 | digest_len)) |
Miquel Raynal | 1c4ea8f | 2018-05-15 11:57:16 +0200 | [diff] [blame] | 329 | return TPM_LIB_ERROR; |
| 330 | |
| 331 | if (updates) |
| 332 | *updates = counter; |
| 333 | |
| 334 | return 0; |
| 335 | } |
Miquel Raynal | 69cd8f0 | 2018-05-15 11:57:17 +0200 | [diff] [blame] | 336 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 337 | u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property, |
| 338 | void *buf, size_t prop_count) |
Miquel Raynal | 69cd8f0 | 2018-05-15 11:57:17 +0200 | [diff] [blame] | 339 | { |
| 340 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 341 | tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */ |
| 342 | tpm_u32(22), /* Length */ |
| 343 | tpm_u32(TPM2_CC_GET_CAPABILITY), /* Command code */ |
| 344 | |
| 345 | tpm_u32(capability), /* Capability */ |
| 346 | tpm_u32(property), /* Property */ |
| 347 | tpm_u32(prop_count), /* Property count */ |
| 348 | }; |
| 349 | u8 response[COMMAND_BUFFER_SIZE]; |
| 350 | size_t response_len = COMMAND_BUFFER_SIZE; |
| 351 | unsigned int properties_off; |
| 352 | int ret; |
| 353 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 354 | ret = tpm_sendrecv_command(dev, command_v2, response, &response_len); |
Miquel Raynal | 69cd8f0 | 2018-05-15 11:57:17 +0200 | [diff] [blame] | 355 | if (ret) |
| 356 | return ret; |
| 357 | |
| 358 | /* |
| 359 | * In the response buffer, the properties are located after the: |
| 360 | * tag (u16), response size (u32), response code (u32), |
Ilias Apalodimas | a322f54 | 2020-11-05 23:58:43 +0200 | [diff] [blame] | 361 | * YES/NO flag (u8), TPM_CAP (u32). |
Miquel Raynal | 69cd8f0 | 2018-05-15 11:57:17 +0200 | [diff] [blame] | 362 | */ |
| 363 | properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) + |
Ilias Apalodimas | a322f54 | 2020-11-05 23:58:43 +0200 | [diff] [blame] | 364 | sizeof(u8) + sizeof(u32); |
Miquel Raynal | 69cd8f0 | 2018-05-15 11:57:17 +0200 | [diff] [blame] | 365 | memcpy(buf, &response[properties_off], response_len - properties_off); |
| 366 | |
| 367 | return 0; |
| 368 | } |
Miquel Raynal | da9c339 | 2018-05-15 11:57:18 +0200 | [diff] [blame] | 369 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 370 | u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz) |
Miquel Raynal | da9c339 | 2018-05-15 11:57:18 +0200 | [diff] [blame] | 371 | { |
| 372 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 373 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 374 | tpm_u32(27 + pw_sz), /* Length */ |
| 375 | tpm_u32(TPM2_CC_DAM_RESET), /* Command code */ |
| 376 | |
| 377 | /* HANDLE */ |
| 378 | tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */ |
| 379 | |
| 380 | /* AUTH_SESSION */ |
| 381 | tpm_u32(9 + pw_sz), /* Authorization size */ |
| 382 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 383 | tpm_u16(0), /* Size of <nonce> */ |
| 384 | /* <nonce> (if any) */ |
| 385 | 0, /* Attributes: Cont/Excl/Rst */ |
| 386 | tpm_u16(pw_sz), /* Size of <hmac/password> */ |
| 387 | /* STRING(pw) <hmac/password> (if any) */ |
| 388 | }; |
| 389 | unsigned int offset = 27; |
| 390 | int ret; |
| 391 | |
| 392 | /* |
| 393 | * Fill the command structure starting from the first buffer: |
| 394 | * - the password (if any) |
| 395 | */ |
| 396 | ret = pack_byte_string(command_v2, sizeof(command_v2), "s", |
| 397 | offset, pw, pw_sz); |
| 398 | offset += pw_sz; |
| 399 | if (ret) |
| 400 | return TPM_LIB_ERROR; |
| 401 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 402 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | da9c339 | 2018-05-15 11:57:18 +0200 | [diff] [blame] | 403 | } |
| 404 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 405 | u32 tpm2_dam_parameters(struct udevice *dev, const char *pw, |
| 406 | const ssize_t pw_sz, unsigned int max_tries, |
| 407 | unsigned int recovery_time, |
Miquel Raynal | da9c339 | 2018-05-15 11:57:18 +0200 | [diff] [blame] | 408 | unsigned int lockout_recovery) |
| 409 | { |
| 410 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 411 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 412 | tpm_u32(27 + pw_sz + 12), /* Length */ |
| 413 | tpm_u32(TPM2_CC_DAM_PARAMETERS), /* Command code */ |
| 414 | |
| 415 | /* HANDLE */ |
| 416 | tpm_u32(TPM2_RH_LOCKOUT), /* TPM resource handle */ |
| 417 | |
| 418 | /* AUTH_SESSION */ |
| 419 | tpm_u32(9 + pw_sz), /* Authorization size */ |
| 420 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 421 | tpm_u16(0), /* Size of <nonce> */ |
| 422 | /* <nonce> (if any) */ |
| 423 | 0, /* Attributes: Cont/Excl/Rst */ |
| 424 | tpm_u16(pw_sz), /* Size of <hmac/password> */ |
| 425 | /* STRING(pw) <hmac/password> (if any) */ |
| 426 | |
| 427 | /* LOCKOUT PARAMETERS */ |
| 428 | /* tpm_u32(max_tries) Max tries (0, always lock) */ |
| 429 | /* tpm_u32(recovery_time) Recovery time (0, no lock) */ |
| 430 | /* tpm_u32(lockout_recovery) Lockout recovery */ |
| 431 | }; |
| 432 | unsigned int offset = 27; |
| 433 | int ret; |
| 434 | |
| 435 | /* |
| 436 | * Fill the command structure starting from the first buffer: |
| 437 | * - the password (if any) |
| 438 | * - max tries |
| 439 | * - recovery time |
| 440 | * - lockout recovery |
| 441 | */ |
| 442 | ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd", |
| 443 | offset, pw, pw_sz, |
| 444 | offset + pw_sz, max_tries, |
| 445 | offset + pw_sz + 4, recovery_time, |
| 446 | offset + pw_sz + 8, lockout_recovery); |
| 447 | offset += pw_sz + 12; |
| 448 | if (ret) |
| 449 | return TPM_LIB_ERROR; |
| 450 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 451 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | da9c339 | 2018-05-15 11:57:18 +0200 | [diff] [blame] | 452 | } |
Miquel Raynal | dc26e91 | 2018-05-15 11:57:19 +0200 | [diff] [blame] | 453 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 454 | int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw, |
| 455 | const ssize_t newpw_sz, const char *oldpw, |
| 456 | const ssize_t oldpw_sz) |
Miquel Raynal | dc26e91 | 2018-05-15 11:57:19 +0200 | [diff] [blame] | 457 | { |
| 458 | unsigned int offset = 27; |
| 459 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 460 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 461 | tpm_u32(offset + oldpw_sz + 2 + newpw_sz), /* Length */ |
| 462 | tpm_u32(TPM2_CC_HIERCHANGEAUTH), /* Command code */ |
| 463 | |
| 464 | /* HANDLE */ |
| 465 | tpm_u32(handle), /* TPM resource handle */ |
| 466 | |
| 467 | /* AUTH_SESSION */ |
| 468 | tpm_u32(9 + oldpw_sz), /* Authorization size */ |
| 469 | tpm_u32(TPM2_RS_PW), /* Session handle */ |
| 470 | tpm_u16(0), /* Size of <nonce> */ |
| 471 | /* <nonce> (if any) */ |
| 472 | 0, /* Attributes: Cont/Excl/Rst */ |
| 473 | tpm_u16(oldpw_sz) /* Size of <hmac/password> */ |
| 474 | /* STRING(oldpw) <hmac/password> (if any) */ |
| 475 | |
| 476 | /* TPM2B_AUTH (TPM2B_DIGEST) */ |
| 477 | /* tpm_u16(newpw_sz) Digest size, new pw length */ |
| 478 | /* STRING(newpw) Digest buffer, new pw */ |
| 479 | }; |
| 480 | int ret; |
| 481 | |
| 482 | /* |
| 483 | * Fill the command structure starting from the first buffer: |
| 484 | * - the old password (if any) |
| 485 | * - size of the new password |
| 486 | * - new password |
| 487 | */ |
| 488 | ret = pack_byte_string(command_v2, sizeof(command_v2), "sws", |
| 489 | offset, oldpw, oldpw_sz, |
| 490 | offset + oldpw_sz, newpw_sz, |
| 491 | offset + oldpw_sz + 2, newpw, newpw_sz); |
| 492 | offset += oldpw_sz + 2 + newpw_sz; |
| 493 | if (ret) |
| 494 | return TPM_LIB_ERROR; |
| 495 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 496 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | dc26e91 | 2018-05-15 11:57:19 +0200 | [diff] [blame] | 497 | } |
Miquel Raynal | b9dd4fab | 2018-05-15 11:57:20 +0200 | [diff] [blame] | 498 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 499 | u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw, |
| 500 | const ssize_t pw_sz, u32 index, const char *key) |
Miquel Raynal | b9dd4fab | 2018-05-15 11:57:20 +0200 | [diff] [blame] | 501 | { |
| 502 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 503 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 504 | tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN), /* Length */ |
| 505 | tpm_u32(TPM2_CC_PCR_SETAUTHPOL), /* Command code */ |
| 506 | |
| 507 | /* HANDLE */ |
| 508 | tpm_u32(TPM2_RH_PLATFORM), /* TPM resource handle */ |
| 509 | |
| 510 | /* AUTH_SESSION */ |
| 511 | tpm_u32(9 + pw_sz), /* Authorization size */ |
| 512 | tpm_u32(TPM2_RS_PW), /* session handle */ |
| 513 | tpm_u16(0), /* Size of <nonce> */ |
| 514 | /* <nonce> (if any) */ |
| 515 | 0, /* Attributes: Cont/Excl/Rst */ |
| 516 | tpm_u16(pw_sz) /* Size of <hmac/password> */ |
| 517 | /* STRING(pw) <hmac/password> (if any) */ |
| 518 | |
| 519 | /* TPM2B_AUTH (TPM2B_DIGEST) */ |
| 520 | /* tpm_u16(TPM2_DIGEST_LEN) Digest size length */ |
| 521 | /* STRING(key) Digest buffer (PCR key) */ |
| 522 | |
| 523 | /* TPMI_ALG_HASH */ |
| 524 | /* tpm_u16(TPM2_ALG_SHA256) Algorithm of the hash */ |
| 525 | |
| 526 | /* TPMI_DH_PCR */ |
| 527 | /* tpm_u32(index), PCR Index */ |
| 528 | }; |
| 529 | unsigned int offset = 27; |
| 530 | int ret; |
| 531 | |
| 532 | /* |
| 533 | * Fill the command structure starting from the first buffer: |
| 534 | * - the password (if any) |
| 535 | * - the PCR key length |
| 536 | * - the PCR key |
| 537 | * - the hash algorithm |
| 538 | * - the PCR index |
| 539 | */ |
| 540 | ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd", |
| 541 | offset, pw, pw_sz, |
| 542 | offset + pw_sz, TPM2_DIGEST_LEN, |
| 543 | offset + pw_sz + 2, key, TPM2_DIGEST_LEN, |
| 544 | offset + pw_sz + 2 + TPM2_DIGEST_LEN, |
| 545 | TPM2_ALG_SHA256, |
| 546 | offset + pw_sz + 4 + TPM2_DIGEST_LEN, index); |
| 547 | offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4; |
| 548 | if (ret) |
| 549 | return TPM_LIB_ERROR; |
| 550 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 551 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | b9dd4fab | 2018-05-15 11:57:20 +0200 | [diff] [blame] | 552 | } |
| 553 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 554 | u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw, |
| 555 | const ssize_t pw_sz, u32 index, const char *key, |
| 556 | const ssize_t key_sz) |
Miquel Raynal | b9dd4fab | 2018-05-15 11:57:20 +0200 | [diff] [blame] | 557 | { |
| 558 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 559 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 560 | tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN), /* Length */ |
| 561 | tpm_u32(TPM2_CC_PCR_SETAUTHVAL), /* Command code */ |
| 562 | |
| 563 | /* HANDLE */ |
| 564 | tpm_u32(index), /* Handle (PCR Index) */ |
| 565 | |
| 566 | /* AUTH_SESSION */ |
| 567 | tpm_u32(9 + pw_sz), /* Authorization size */ |
| 568 | tpm_u32(TPM2_RS_PW), /* session handle */ |
| 569 | tpm_u16(0), /* Size of <nonce> */ |
| 570 | /* <nonce> (if any) */ |
| 571 | 0, /* Attributes: Cont/Excl/Rst */ |
| 572 | tpm_u16(pw_sz), /* Size of <hmac/password> */ |
| 573 | /* STRING(pw) <hmac/password> (if any) */ |
| 574 | |
| 575 | /* TPM2B_DIGEST */ |
| 576 | /* tpm_u16(key_sz) Key length */ |
| 577 | /* STRING(key) Key */ |
| 578 | }; |
| 579 | unsigned int offset = 27; |
| 580 | int ret; |
| 581 | |
| 582 | /* |
| 583 | * Fill the command structure starting from the first buffer: |
| 584 | * - the password (if any) |
| 585 | * - the number of digests, 1 in our case |
| 586 | * - the algorithm, sha256 in our case |
| 587 | * - the digest (64 bytes) |
| 588 | */ |
| 589 | ret = pack_byte_string(command_v2, sizeof(command_v2), "sws", |
| 590 | offset, pw, pw_sz, |
| 591 | offset + pw_sz, key_sz, |
| 592 | offset + pw_sz + 2, key, key_sz); |
| 593 | offset += pw_sz + 2 + key_sz; |
| 594 | if (ret) |
| 595 | return TPM_LIB_ERROR; |
| 596 | |
Simon Glass | abdc7b8 | 2018-11-18 14:22:27 -0700 | [diff] [blame] | 597 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
Miquel Raynal | b9dd4fab | 2018-05-15 11:57:20 +0200 | [diff] [blame] | 598 | } |
Dhananjay Phadke | 06bea49 | 2020-06-04 16:43:59 -0700 | [diff] [blame] | 599 | |
| 600 | u32 tpm2_get_random(struct udevice *dev, void *data, u32 count) |
| 601 | { |
| 602 | const u8 command_v2[10] = { |
| 603 | tpm_u16(TPM2_ST_NO_SESSIONS), |
| 604 | tpm_u32(12), |
| 605 | tpm_u32(TPM2_CC_GET_RANDOM), |
| 606 | }; |
| 607 | u8 buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE]; |
| 608 | |
| 609 | const size_t data_size_offset = 10; |
| 610 | const size_t data_offset = 12; |
| 611 | size_t response_length = sizeof(response); |
| 612 | u32 data_size; |
| 613 | u8 *out = data; |
| 614 | |
| 615 | while (count > 0) { |
| 616 | u32 this_bytes = min((size_t)count, |
| 617 | sizeof(response) - data_offset); |
| 618 | u32 err; |
| 619 | |
| 620 | if (pack_byte_string(buf, sizeof(buf), "sw", |
| 621 | 0, command_v2, sizeof(command_v2), |
| 622 | sizeof(command_v2), this_bytes)) |
| 623 | return TPM_LIB_ERROR; |
| 624 | err = tpm_sendrecv_command(dev, buf, response, |
| 625 | &response_length); |
| 626 | if (err) |
| 627 | return err; |
| 628 | if (unpack_byte_string(response, response_length, "w", |
| 629 | data_size_offset, &data_size)) |
| 630 | return TPM_LIB_ERROR; |
| 631 | if (data_size > this_bytes) |
| 632 | return TPM_LIB_ERROR; |
| 633 | if (unpack_byte_string(response, response_length, "s", |
| 634 | data_offset, out, data_size)) |
| 635 | return TPM_LIB_ERROR; |
| 636 | |
| 637 | count -= data_size; |
| 638 | out += data_size; |
| 639 | } |
| 640 | |
| 641 | return 0; |
| 642 | } |
Simon Glass | 7785bc1 | 2021-02-06 14:23:41 -0700 | [diff] [blame] | 643 | |
| 644 | u32 tpm2_write_lock(struct udevice *dev, u32 index) |
| 645 | { |
| 646 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 647 | /* header 10 bytes */ |
| 648 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 649 | tpm_u32(10 + 8 + 13), /* Length */ |
| 650 | tpm_u32(TPM2_CC_NV_WRITELOCK), /* Command code */ |
| 651 | |
| 652 | /* handles 8 bytes */ |
| 653 | tpm_u32(TPM2_RH_PLATFORM), /* Primary platform seed */ |
| 654 | tpm_u32(HR_NV_INDEX + index), /* Password authorisation */ |
| 655 | |
| 656 | /* session header 9 bytes */ |
| 657 | tpm_u32(9), /* Header size */ |
| 658 | tpm_u32(TPM2_RS_PW), /* Password authorisation */ |
| 659 | tpm_u16(0), /* nonce_size */ |
| 660 | 0, /* session_attrs */ |
| 661 | tpm_u16(0), /* auth_size */ |
| 662 | }; |
| 663 | |
| 664 | return tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
| 665 | } |
Simon Glass | 63af92e | 2021-02-06 14:23:42 -0700 | [diff] [blame] | 666 | |
| 667 | u32 tpm2_disable_platform_hierarchy(struct udevice *dev) |
| 668 | { |
| 669 | struct tpm_chip_priv *priv = dev_get_uclass_priv(dev); |
| 670 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 671 | /* header 10 bytes */ |
| 672 | tpm_u16(TPM2_ST_SESSIONS), /* TAG */ |
| 673 | tpm_u32(10 + 4 + 13 + 5), /* Length */ |
| 674 | tpm_u32(TPM2_CC_HIER_CONTROL), /* Command code */ |
| 675 | |
| 676 | /* 4 bytes */ |
| 677 | tpm_u32(TPM2_RH_PLATFORM), /* Primary platform seed */ |
| 678 | |
| 679 | /* session header 9 bytes */ |
| 680 | tpm_u32(9), /* Header size */ |
| 681 | tpm_u32(TPM2_RS_PW), /* Password authorisation */ |
| 682 | tpm_u16(0), /* nonce_size */ |
| 683 | 0, /* session_attrs */ |
| 684 | tpm_u16(0), /* auth_size */ |
| 685 | |
| 686 | /* payload 5 bytes */ |
| 687 | tpm_u32(TPM2_RH_PLATFORM), /* Hierarchy to disable */ |
| 688 | 0, /* 0=disable */ |
| 689 | }; |
| 690 | int ret; |
| 691 | |
| 692 | ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
| 693 | log_info("ret=%s, %x\n", dev->name, ret); |
| 694 | if (ret) |
| 695 | return ret; |
| 696 | |
| 697 | priv->plat_hier_disabled = true; |
| 698 | |
| 699 | return 0; |
| 700 | } |
Masahisa Kojima | 7fc93ca | 2021-11-04 22:59:16 +0900 | [diff] [blame] | 701 | |
| 702 | u32 tpm2_submit_command(struct udevice *dev, const u8 *sendbuf, |
| 703 | u8 *recvbuf, size_t *recv_size) |
| 704 | { |
| 705 | return tpm_sendrecv_command(dev, sendbuf, recvbuf, recv_size); |
| 706 | } |
Simon Glass | 4c57ec7 | 2022-08-30 21:05:37 -0600 | [diff] [blame] | 707 | |
| 708 | u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd, |
| 709 | u8 *recvbuf, size_t *recv_size) |
| 710 | { |
| 711 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 712 | /* header 10 bytes */ |
| 713 | tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */ |
| 714 | tpm_u32(10 + 2), /* Length */ |
| 715 | tpm_u32(vendor_cmd), /* Command code */ |
| 716 | |
| 717 | tpm_u16(vendor_subcmd), |
| 718 | }; |
| 719 | int ret; |
| 720 | |
| 721 | ret = tpm_sendrecv_command(dev, command_v2, recvbuf, recv_size); |
| 722 | log_debug("ret=%s, %x\n", dev->name, ret); |
| 723 | if (ret) |
| 724 | return ret; |
| 725 | if (*recv_size < 12) |
| 726 | return -ENODATA; |
| 727 | *recv_size -= 12; |
| 728 | memcpy(recvbuf, recvbuf + 12, *recv_size); |
| 729 | |
| 730 | return 0; |
| 731 | } |
Simon Glass | 5208ed1 | 2022-08-30 21:05:38 -0600 | [diff] [blame] | 732 | |
| 733 | u32 tpm2_enable_nvcommits(struct udevice *dev, uint vendor_cmd, |
| 734 | uint vendor_subcmd) |
| 735 | { |
| 736 | u8 command_v2[COMMAND_BUFFER_SIZE] = { |
| 737 | /* header 10 bytes */ |
| 738 | tpm_u16(TPM2_ST_NO_SESSIONS), /* TAG */ |
| 739 | tpm_u32(10 + 2), /* Length */ |
| 740 | tpm_u32(vendor_cmd), /* Command code */ |
| 741 | |
| 742 | tpm_u16(vendor_subcmd), |
| 743 | }; |
| 744 | int ret; |
| 745 | |
| 746 | ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL); |
| 747 | log_debug("ret=%s, %x\n", dev->name, ret); |
| 748 | if (ret) |
| 749 | return ret; |
| 750 | |
| 751 | return 0; |
| 752 | } |