blob: d53d2e402390ae84f4eab9e4ef6e42a1ee84a52a [file] [log] [blame]
Miquel Raynalff322452018-05-15 11:57:08 +02001/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * Copyright (c) 2018 Bootlin
4 * Author: Miquel Raynal <miquel.raynal@bootlin.com>
5 */
6
7#ifndef __TPM_V2_H
8#define __TPM_V2_H
9
10#include <tpm-common.h>
11
12#define TPM2_DIGEST_LEN 32
13
14/**
15 * TPM2 Structure Tags for command/response buffers.
16 *
17 * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
18 * @TPM2_ST_SESSIONS: the command needs an authentication.
19 */
20enum tpm2_structures {
21 TPM2_ST_NO_SESSIONS = 0x8001,
22 TPM2_ST_SESSIONS = 0x8002,
23};
24
25/**
26 * TPM2 type of boolean.
27 */
28enum tpm2_yes_no {
29 TPMI_YES = 1,
30 TPMI_NO = 0,
31};
32
33/**
34 * TPM2 startup values.
35 *
36 * @TPM2_SU_CLEAR: reset the internal state.
37 * @TPM2_SU_STATE: restore saved state (if any).
38 */
39enum tpm2_startup_types {
40 TPM2_SU_CLEAR = 0x0000,
41 TPM2_SU_STATE = 0x0001,
42};
43
44/**
45 * TPM2 permanent handles.
46 *
47 * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
48 * @TPM2_RS_PW: indicates a password.
49 * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
50 * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
51 * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
52 */
53enum tpm2_handles {
54 TPM2_RH_OWNER = 0x40000001,
55 TPM2_RS_PW = 0x40000009,
56 TPM2_RH_LOCKOUT = 0x4000000A,
57 TPM2_RH_ENDORSEMENT = 0x4000000B,
58 TPM2_RH_PLATFORM = 0x4000000C,
59};
60
61/**
62 * TPM2 command codes used at the beginning of a buffer, gives the command.
63 *
64 * @TPM2_CC_STARTUP: TPM2_Startup().
65 * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
66 * @TPM2_CC_CLEAR: TPM2_Clear().
67 * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
68 * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
69 * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
70 * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
71 * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
72 * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
73 * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
74 * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
75 * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
76 */
77enum tpm2_command_codes {
78 TPM2_CC_STARTUP = 0x0144,
79 TPM2_CC_SELF_TEST = 0x0143,
80 TPM2_CC_CLEAR = 0x0126,
81 TPM2_CC_CLEARCONTROL = 0x0127,
82 TPM2_CC_HIERCHANGEAUTH = 0x0129,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020083 TPM2_CC_PCR_SETAUTHPOL = 0x012C,
Miquel Raynalff322452018-05-15 11:57:08 +020084 TPM2_CC_DAM_RESET = 0x0139,
85 TPM2_CC_DAM_PARAMETERS = 0x013A,
Simon Glass998af312018-10-01 11:55:17 -060086 TPM2_CC_NV_READ = 0x014E,
Miquel Raynalff322452018-05-15 11:57:08 +020087 TPM2_CC_GET_CAPABILITY = 0x017A,
88 TPM2_CC_PCR_READ = 0x017E,
89 TPM2_CC_PCR_EXTEND = 0x0182,
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +020090 TPM2_CC_PCR_SETAUTHVAL = 0x0183,
Miquel Raynalff322452018-05-15 11:57:08 +020091};
92
93/**
94 * TPM2 return codes.
95 */
96enum tpm2_return_codes {
97 TPM2_RC_SUCCESS = 0x0000,
98 TPM2_RC_BAD_TAG = 0x001E,
99 TPM2_RC_FMT1 = 0x0080,
100 TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
101 TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
102 TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
103 TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
104 TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
105 TPM2_RC_VER1 = 0x0100,
106 TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
107 TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
108 TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
109 TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
110 TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
111 TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
112 TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
113 TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
114 TPM2_RC_WARN = 0x0900,
115 TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
116 TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
117 TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
118};
119
120/**
121 * TPM2 algorithms.
122 */
123enum tpm2_algorithms {
124 TPM2_ALG_XOR = 0x0A,
125 TPM2_ALG_SHA256 = 0x0B,
126 TPM2_ALG_SHA384 = 0x0C,
127 TPM2_ALG_SHA512 = 0x0D,
128 TPM2_ALG_NULL = 0x10,
129};
130
Simon Glassbe8a0252018-11-23 21:29:34 -0700131/* NV index attributes */
132enum tpm_index_attrs {
133 TPMA_NV_PPWRITE = 1UL << 0,
134 TPMA_NV_OWNERWRITE = 1UL << 1,
135 TPMA_NV_AUTHWRITE = 1UL << 2,
136 TPMA_NV_POLICYWRITE = 1UL << 3,
137 TPMA_NV_COUNTER = 1UL << 4,
138 TPMA_NV_BITS = 1UL << 5,
139 TPMA_NV_EXTEND = 1UL << 6,
140 TPMA_NV_POLICY_DELETE = 1UL << 10,
141 TPMA_NV_WRITELOCKED = 1UL << 11,
142 TPMA_NV_WRITEALL = 1UL << 12,
143 TPMA_NV_WRITEDEFINE = 1UL << 13,
144 TPMA_NV_WRITE_STCLEAR = 1UL << 14,
145 TPMA_NV_GLOBALLOCK = 1UL << 15,
146 TPMA_NV_PPREAD = 1UL << 16,
147 TPMA_NV_OWNERREAD = 1UL << 17,
148 TPMA_NV_AUTHREAD = 1UL << 18,
149 TPMA_NV_POLICYREAD = 1UL << 19,
150 TPMA_NV_NO_DA = 1UL << 25,
151 TPMA_NV_ORDERLY = 1UL << 26,
152 TPMA_NV_CLEAR_STCLEAR = 1UL << 27,
153 TPMA_NV_READLOCKED = 1UL << 28,
154 TPMA_NV_WRITTEN = 1UL << 29,
155 TPMA_NV_PLATFORMCREATE = 1UL << 30,
156 TPMA_NV_READ_STCLEAR = 1UL << 31,
157
158 TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD |
159 TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD,
160 TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE |
161 TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE,
162};
163
Simon Glass1400a7f2020-02-06 09:55:03 -0700164enum {
165 TPM_ACCESS_VALID = 1 << 7,
166 TPM_ACCESS_ACTIVE_LOCALITY = 1 << 5,
167 TPM_ACCESS_REQUEST_PENDING = 1 << 2,
168 TPM_ACCESS_REQUEST_USE = 1 << 1,
169 TPM_ACCESS_ESTABLISHMENT = 1 << 0,
170};
171
172enum {
173 TPM_STS_FAMILY_SHIFT = 26,
174 TPM_STS_FAMILY_MASK = 0x3 << TPM_STS_FAMILY_SHIFT,
175 TPM_STS_FAMILY_TPM2 = 1 << TPM_STS_FAMILY_SHIFT,
176 TPM_STS_RESE_TESTABLISMENT_BIT = 1 << 25,
177 TPM_STS_COMMAND_CANCEL = 1 << 24,
178 TPM_STS_BURST_COUNT_SHIFT = 8,
179 TPM_STS_BURST_COUNT_MASK = 0xffff << TPM_STS_BURST_COUNT_SHIFT,
180 TPM_STS_VALID = 1 << 7,
181 TPM_STS_COMMAND_READY = 1 << 6,
182 TPM_STS_GO = 1 << 5,
183 TPM_STS_DATA_AVAIL = 1 << 4,
184 TPM_STS_DATA_EXPECT = 1 << 3,
185 TPM_STS_SELF_TEST_DONE = 1 << 2,
186 TPM_STS_RESPONSE_RETRY = 1 << 1,
187};
188
189enum {
190 TPM_CMD_COUNT_OFFSET = 2,
191 TPM_CMD_ORDINAL_OFFSET = 6,
192 TPM_MAX_BUF_SIZE = 1260,
193};
194
Miquel Raynal1922df22018-05-15 11:57:12 +0200195/**
196 * Issue a TPM2_Startup command.
197 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700198 * @dev TPM device
Miquel Raynal1922df22018-05-15 11:57:12 +0200199 * @mode TPM startup mode
200 *
201 * @return code of the operation
202 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700203u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode);
Miquel Raynal1922df22018-05-15 11:57:12 +0200204
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200205/**
206 * Issue a TPM2_SelfTest command.
207 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700208 * @dev TPM device
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200209 * @full_test Asking to perform all tests or only the untested ones
210 *
211 * @return code of the operation
212 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700213u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test);
Miquel Raynal2dc6d972018-05-15 11:57:13 +0200214
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200215/**
216 * Issue a TPM2_Clear command.
217 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700218 * @dev TPM device
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200219 * @handle Handle
220 * @pw Password
221 * @pw_sz Length of the password
222 *
223 * @return code of the operation
224 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700225u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
226 const ssize_t pw_sz);
Miquel Raynalbad8ff52018-05-15 11:57:14 +0200227
Miquel Raynal6284be52018-05-15 11:57:15 +0200228/**
229 * Issue a TPM2_PCR_Extend command.
230 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700231 * @dev TPM device
Miquel Raynal6284be52018-05-15 11:57:15 +0200232 * @index Index of the PCR
233 * @digest Value representing the event to be recorded
234 *
235 * @return code of the operation
236 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700237u32 tpm2_pcr_extend(struct udevice *dev, u32 index, const uint8_t *digest);
Miquel Raynal6284be52018-05-15 11:57:15 +0200238
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200239/**
240 * Issue a TPM2_PCR_Read command.
241 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700242 * @dev TPM device
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200243 * @idx Index of the PCR
244 * @idx_min_sz Minimum size in bytes of the pcrSelect array
245 * @data Output buffer for contents of the named PCR
246 * @updates Optional out parameter: number of updates for this PCR
247 *
248 * @return code of the operation
249 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700250u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
251 void *data, unsigned int *updates);
Miquel Raynal1c4ea8f2018-05-15 11:57:16 +0200252
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200253/**
254 * Issue a TPM2_GetCapability command. This implementation is limited
255 * to query property index that is 4-byte wide.
256 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700257 * @dev TPM device
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200258 * @capability Partition of capabilities
259 * @property Further definition of capability, limited to be 4 bytes wide
260 * @buf Output buffer for capability information
261 * @prop_count Size of output buffer
262 *
263 * @return code of the operation
264 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700265u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
266 void *buf, size_t prop_count);
Miquel Raynal69cd8f02018-05-15 11:57:17 +0200267
Miquel Raynalda9c3392018-05-15 11:57:18 +0200268/**
269 * Issue a TPM2_DictionaryAttackLockReset command.
270 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700271 * @dev TPM device
Miquel Raynalda9c3392018-05-15 11:57:18 +0200272 * @pw Password
273 * @pw_sz Length of the password
274 *
275 * @return code of the operation
276 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700277u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz);
Miquel Raynalda9c3392018-05-15 11:57:18 +0200278
279/**
280 * Issue a TPM2_DictionaryAttackParameters command.
281 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700282 * @dev TPM device
Miquel Raynalda9c3392018-05-15 11:57:18 +0200283 * @pw Password
284 * @pw_sz Length of the password
285 * @max_tries Count of authorizations before lockout
286 * @recovery_time Time before decrementation of the failure count
287 * @lockout_recovery Time to wait after a lockout
288 *
289 * @return code of the operation
290 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700291u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
292 const ssize_t pw_sz, unsigned int max_tries,
293 unsigned int recovery_time,
Miquel Raynalda9c3392018-05-15 11:57:18 +0200294 unsigned int lockout_recovery);
295
Miquel Raynaldc26e912018-05-15 11:57:19 +0200296/**
297 * Issue a TPM2_HierarchyChangeAuth command.
298 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700299 * @dev TPM device
Miquel Raynaldc26e912018-05-15 11:57:19 +0200300 * @handle Handle
301 * @newpw New password
302 * @newpw_sz Length of the new password
303 * @oldpw Old password
304 * @oldpw_sz Length of the old password
305 *
306 * @return code of the operation
307 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700308int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
309 const ssize_t newpw_sz, const char *oldpw,
310 const ssize_t oldpw_sz);
Miquel Raynaldc26e912018-05-15 11:57:19 +0200311
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200312/**
313 * Issue a TPM_PCR_SetAuthPolicy command.
314 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700315 * @dev TPM device
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200316 * @pw Platform password
317 * @pw_sz Length of the password
318 * @index Index of the PCR
319 * @digest New key to access the PCR
320 *
321 * @return code of the operation
322 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700323u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
324 const ssize_t pw_sz, u32 index, const char *key);
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200325
326/**
327 * Issue a TPM_PCR_SetAuthValue command.
328 *
Simon Glassabdc7b82018-11-18 14:22:27 -0700329 * @dev TPM device
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200330 * @pw Platform password
331 * @pw_sz Length of the password
332 * @index Index of the PCR
333 * @digest New key to access the PCR
334 * @key_sz Length of the new key
335 *
336 * @return code of the operation
337 */
Simon Glassabdc7b82018-11-18 14:22:27 -0700338u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
339 const ssize_t pw_sz, u32 index, const char *key,
340 const ssize_t key_sz);
Miquel Raynalb9dd4fab2018-05-15 11:57:20 +0200341
Miquel Raynalff322452018-05-15 11:57:08 +0200342#endif /* __TPM_V2_H */