blob: ae00803f6d951f47c1bd7d507d2db4af632b49e7 [file] [log] [blame]
Miquel Raynalff322452018-05-15 11:57:08 +02001/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * Copyright (c) 2018 Bootlin
4 * Author: Miquel Raynal <miquel.raynal@bootlin.com>
5 */
6
7#ifndef __TPM_V2_H
8#define __TPM_V2_H
9
10#include <tpm-common.h>
11
12#define TPM2_DIGEST_LEN 32
13
14/**
15 * TPM2 Structure Tags for command/response buffers.
16 *
17 * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
18 * @TPM2_ST_SESSIONS: the command needs an authentication.
19 */
20enum tpm2_structures {
21 TPM2_ST_NO_SESSIONS = 0x8001,
22 TPM2_ST_SESSIONS = 0x8002,
23};
24
25/**
26 * TPM2 type of boolean.
27 */
28enum tpm2_yes_no {
29 TPMI_YES = 1,
30 TPMI_NO = 0,
31};
32
33/**
34 * TPM2 startup values.
35 *
36 * @TPM2_SU_CLEAR: reset the internal state.
37 * @TPM2_SU_STATE: restore saved state (if any).
38 */
39enum tpm2_startup_types {
40 TPM2_SU_CLEAR = 0x0000,
41 TPM2_SU_STATE = 0x0001,
42};
43
44/**
45 * TPM2 permanent handles.
46 *
47 * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
48 * @TPM2_RS_PW: indicates a password.
49 * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
50 * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
51 * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
52 */
53enum tpm2_handles {
54 TPM2_RH_OWNER = 0x40000001,
55 TPM2_RS_PW = 0x40000009,
56 TPM2_RH_LOCKOUT = 0x4000000A,
57 TPM2_RH_ENDORSEMENT = 0x4000000B,
58 TPM2_RH_PLATFORM = 0x4000000C,
59};
60
61/**
62 * TPM2 command codes used at the beginning of a buffer, gives the command.
63 *
64 * @TPM2_CC_STARTUP: TPM2_Startup().
65 * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
66 * @TPM2_CC_CLEAR: TPM2_Clear().
67 * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
68 * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
69 * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
70 * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
71 * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
72 * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
73 * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
74 * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
75 * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
76 */
77enum tpm2_command_codes {
78 TPM2_CC_STARTUP = 0x0144,
79 TPM2_CC_SELF_TEST = 0x0143,
80 TPM2_CC_CLEAR = 0x0126,
81 TPM2_CC_CLEARCONTROL = 0x0127,
82 TPM2_CC_HIERCHANGEAUTH = 0x0129,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020083 TPM2_CC_PCR_SETAUTHPOL = 0x012C,
Miquel Raynalff322452018-05-15 11:57:08 +020084 TPM2_CC_DAM_RESET = 0x0139,
85 TPM2_CC_DAM_PARAMETERS = 0x013A,
Simon Glass998af312018-10-01 11:55:17 -060086 TPM2_CC_NV_READ = 0x014E,
Miquel Raynalff322452018-05-15 11:57:08 +020087 TPM2_CC_GET_CAPABILITY = 0x017A,
88 TPM2_CC_PCR_READ = 0x017E,
89 TPM2_CC_PCR_EXTEND = 0x0182,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020090 TPM2_CC_PCR_SETAUTHVAL = 0x0183,
Miquel Raynalff322452018-05-15 11:57:08 +020091};
92
93/**
94 * TPM2 return codes.
95 */
96enum tpm2_return_codes {
97 TPM2_RC_SUCCESS = 0x0000,
98 TPM2_RC_BAD_TAG = 0x001E,
99 TPM2_RC_FMT1 = 0x0080,
100 TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
101 TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
102 TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
103 TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
104 TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
105 TPM2_RC_VER1 = 0x0100,
106 TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
107 TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
108 TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
109 TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
110 TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
111 TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
112 TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
113 TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
114 TPM2_RC_WARN = 0x0900,
115 TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
116 TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
117 TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
118};
119
120/**
121 * TPM2 algorithms.
122 */
123enum tpm2_algorithms {
124 TPM2_ALG_XOR = 0x0A,
125 TPM2_ALG_SHA256 = 0x0B,
126 TPM2_ALG_SHA384 = 0x0C,
127 TPM2_ALG_SHA512 = 0x0D,
128 TPM2_ALG_NULL = 0x10,
129};
130
Simon Glassbe8a0252018-11-23 21:29:34 -0700131/* NV index attributes */
132enum tpm_index_attrs {
133 TPMA_NV_PPWRITE = 1UL << 0,
134 TPMA_NV_OWNERWRITE = 1UL << 1,
135 TPMA_NV_AUTHWRITE = 1UL << 2,
136 TPMA_NV_POLICYWRITE = 1UL << 3,
137 TPMA_NV_COUNTER = 1UL << 4,
138 TPMA_NV_BITS = 1UL << 5,
139 TPMA_NV_EXTEND = 1UL << 6,
140 TPMA_NV_POLICY_DELETE = 1UL << 10,
141 TPMA_NV_WRITELOCKED = 1UL << 11,
142 TPMA_NV_WRITEALL = 1UL << 12,
143 TPMA_NV_WRITEDEFINE = 1UL << 13,
144 TPMA_NV_WRITE_STCLEAR = 1UL << 14,
145 TPMA_NV_GLOBALLOCK = 1UL << 15,
146 TPMA_NV_PPREAD = 1UL << 16,
147 TPMA_NV_OWNERREAD = 1UL << 17,
148 TPMA_NV_AUTHREAD = 1UL << 18,
149 TPMA_NV_POLICYREAD = 1UL << 19,
150 TPMA_NV_NO_DA = 1UL << 25,
151 TPMA_NV_ORDERLY = 1UL << 26,
152 TPMA_NV_CLEAR_STCLEAR = 1UL << 27,
153 TPMA_NV_READLOCKED = 1UL << 28,
154 TPMA_NV_WRITTEN = 1UL << 29,
155 TPMA_NV_PLATFORMCREATE = 1UL << 30,
156 TPMA_NV_READ_STCLEAR = 1UL << 31,
157
158 TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD |
159 TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD,
160 TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE |
161 TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE,
162};
163
Miquel Raynal1922df22018-05-15 11:57:12 +0200164/**
165 * Issue a TPM2_Startup command.
166 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700167 * @dev TPM device
Miquel Raynal1922df22018-05-15 11:57:12 +0200168 * @mode TPM startup mode
169 *
170 * @return code of the operation
171 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700172u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode);
Miquel Raynal1922df22018-05-15 11:57:12 +0200173
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200174/**
175 * Issue a TPM2_SelfTest command.
176 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700177 * @dev TPM device
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200178 * @full_test Asking to perform all tests or only the untested ones
179 *
180 * @return code of the operation
181 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700182u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test);
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200183
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200184/**
185 * Issue a TPM2_Clear command.
186 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700187 * @dev TPM device
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200188 * @handle Handle
189 * @pw Password
190 * @pw_sz Length of the password
191 *
192 * @return code of the operation
193 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700194u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
195 const ssize_t pw_sz);
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200196
Miquel Raynal6284be52018-05-15 11:57:15 +0200197/**
198 * Issue a TPM2_PCR_Extend command.
199 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700200 * @dev TPM device
Miquel Raynal6284be52018-05-15 11:57:15 +0200201 * @index Index of the PCR
202 * @digest Value representing the event to be recorded
203 *
204 * @return code of the operation
205 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700206u32 tpm2_pcr_extend(struct udevice *dev, u32 index, const uint8_t *digest);
Miquel Raynal6284be52018-05-15 11:57:15 +0200207
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200208/**
209 * Issue a TPM2_PCR_Read command.
210 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700211 * @dev TPM device
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200212 * @idx Index of the PCR
213 * @idx_min_sz Minimum size in bytes of the pcrSelect array
214 * @data Output buffer for contents of the named PCR
215 * @updates Optional out parameter: number of updates for this PCR
216 *
217 * @return code of the operation
218 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700219u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
220 void *data, unsigned int *updates);
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200221
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200222/**
223 * Issue a TPM2_GetCapability command. This implementation is limited
224 * to query property index that is 4-byte wide.
225 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700226 * @dev TPM device
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200227 * @capability Partition of capabilities
228 * @property Further definition of capability, limited to be 4 bytes wide
229 * @buf Output buffer for capability information
230 * @prop_count Size of output buffer
231 *
232 * @return code of the operation
233 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700234u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
235 void *buf, size_t prop_count);
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200236
Miquel Raynalda9c3392018-05-15 11:57:18 +0200237/**
238 * Issue a TPM2_DictionaryAttackLockReset command.
239 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700240 * @dev TPM device
Miquel Raynalda9c3392018-05-15 11:57:18 +0200241 * @pw Password
242 * @pw_sz Length of the password
243 *
244 * @return code of the operation
245 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700246u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz);
Miquel Raynalda9c3392018-05-15 11:57:18 +0200247
248/**
249 * Issue a TPM2_DictionaryAttackParameters command.
250 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700251 * @dev TPM device
Miquel Raynalda9c3392018-05-15 11:57:18 +0200252 * @pw Password
253 * @pw_sz Length of the password
254 * @max_tries Count of authorizations before lockout
255 * @recovery_time Time before decrementation of the failure count
256 * @lockout_recovery Time to wait after a lockout
257 *
258 * @return code of the operation
259 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700260u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
261 const ssize_t pw_sz, unsigned int max_tries,
262 unsigned int recovery_time,
Miquel Raynalda9c3392018-05-15 11:57:18 +0200263 unsigned int lockout_recovery);
264
Miquel Raynaldc26e912018-05-15 11:57:19 +0200265/**
266 * Issue a TPM2_HierarchyChangeAuth command.
267 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700268 * @dev TPM device
Miquel Raynaldc26e912018-05-15 11:57:19 +0200269 * @handle Handle
270 * @newpw New password
271 * @newpw_sz Length of the new password
272 * @oldpw Old password
273 * @oldpw_sz Length of the old password
274 *
275 * @return code of the operation
276 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700277int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
278 const ssize_t newpw_sz, const char *oldpw,
279 const ssize_t oldpw_sz);
Miquel Raynaldc26e912018-05-15 11:57:19 +0200280
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200281/**
282 * Issue a TPM_PCR_SetAuthPolicy command.
283 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700284 * @dev TPM device
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200285 * @pw Platform password
286 * @pw_sz Length of the password
287 * @index Index of the PCR
288 * @digest New key to access the PCR
289 *
290 * @return code of the operation
291 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700292u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
293 const ssize_t pw_sz, u32 index, const char *key);
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200294
295/**
296 * Issue a TPM_PCR_SetAuthValue command.
297 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700298 * @dev TPM device
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200299 * @pw Platform password
300 * @pw_sz Length of the password
301 * @index Index of the PCR
302 * @digest New key to access the PCR
303 * @key_sz Length of the new key
304 *
305 * @return code of the operation
306 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700307u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
308 const ssize_t pw_sz, u32 index, const char *key,
309 const ssize_t key_sz);
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200310
Miquel Raynalff322452018-05-15 11:57:08 +0200311#endif /* __TPM_V2_H */