]>
Commit | Line | Data |
---|---|---|
ff32245b MR |
1 | /* SPDX-License-Identifier: GPL-2.0+ */ |
2 | /* | |
3 | * Copyright (c) 2018 Bootlin | |
4 | * Author: Miquel Raynal <miquel.raynal@bootlin.com> | |
5 | */ | |
6 | ||
7 | #ifndef __TPM_V2_H | |
8 | #define __TPM_V2_H | |
9 | ||
10 | #include <tpm-common.h> | |
11 | ||
12 | #define TPM2_DIGEST_LEN 32 | |
13 | ||
14 | /** | |
15 | * TPM2 Structure Tags for command/response buffers. | |
16 | * | |
17 | * @TPM2_ST_NO_SESSIONS: the command does not need an authentication. | |
18 | * @TPM2_ST_SESSIONS: the command needs an authentication. | |
19 | */ | |
20 | enum tpm2_structures { | |
21 | TPM2_ST_NO_SESSIONS = 0x8001, | |
22 | TPM2_ST_SESSIONS = 0x8002, | |
23 | }; | |
24 | ||
25 | /** | |
26 | * TPM2 type of boolean. | |
27 | */ | |
28 | enum tpm2_yes_no { | |
29 | TPMI_YES = 1, | |
30 | TPMI_NO = 0, | |
31 | }; | |
32 | ||
33 | /** | |
34 | * TPM2 startup values. | |
35 | * | |
36 | * @TPM2_SU_CLEAR: reset the internal state. | |
37 | * @TPM2_SU_STATE: restore saved state (if any). | |
38 | */ | |
39 | enum tpm2_startup_types { | |
40 | TPM2_SU_CLEAR = 0x0000, | |
41 | TPM2_SU_STATE = 0x0001, | |
42 | }; | |
43 | ||
44 | /** | |
45 | * TPM2 permanent handles. | |
46 | * | |
47 | * @TPM2_RH_OWNER: refers to the 'owner' hierarchy. | |
48 | * @TPM2_RS_PW: indicates a password. | |
49 | * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy. | |
50 | * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy. | |
51 | * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy. | |
52 | */ | |
53 | enum tpm2_handles { | |
54 | TPM2_RH_OWNER = 0x40000001, | |
55 | TPM2_RS_PW = 0x40000009, | |
56 | TPM2_RH_LOCKOUT = 0x4000000A, | |
57 | TPM2_RH_ENDORSEMENT = 0x4000000B, | |
58 | TPM2_RH_PLATFORM = 0x4000000C, | |
59 | }; | |
60 | ||
61 | /** | |
62 | * TPM2 command codes used at the beginning of a buffer, gives the command. | |
63 | * | |
64 | * @TPM2_CC_STARTUP: TPM2_Startup(). | |
65 | * @TPM2_CC_SELF_TEST: TPM2_SelfTest(). | |
66 | * @TPM2_CC_CLEAR: TPM2_Clear(). | |
67 | * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl(). | |
68 | * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth(). | |
69 | * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy(). | |
70 | * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset(). | |
71 | * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters(). | |
72 | * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility(). | |
73 | * @TPM2_CC_PCR_READ: TPM2_PCR_Read(). | |
74 | * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend(). | |
75 | * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue(). | |
76 | */ | |
77 | enum tpm2_command_codes { | |
78 | TPM2_CC_STARTUP = 0x0144, | |
79 | TPM2_CC_SELF_TEST = 0x0143, | |
80 | TPM2_CC_CLEAR = 0x0126, | |
81 | TPM2_CC_CLEARCONTROL = 0x0127, | |
82 | TPM2_CC_HIERCHANGEAUTH = 0x0129, | |
b9dd4fab | 83 | TPM2_CC_PCR_SETAUTHPOL = 0x012C, |
ff32245b MR |
84 | TPM2_CC_DAM_RESET = 0x0139, |
85 | TPM2_CC_DAM_PARAMETERS = 0x013A, | |
86 | TPM2_CC_GET_CAPABILITY = 0x017A, | |
87 | TPM2_CC_PCR_READ = 0x017E, | |
88 | TPM2_CC_PCR_EXTEND = 0x0182, | |
b9dd4fab | 89 | TPM2_CC_PCR_SETAUTHVAL = 0x0183, |
ff32245b MR |
90 | }; |
91 | ||
92 | /** | |
93 | * TPM2 return codes. | |
94 | */ | |
95 | enum tpm2_return_codes { | |
96 | TPM2_RC_SUCCESS = 0x0000, | |
97 | TPM2_RC_BAD_TAG = 0x001E, | |
98 | TPM2_RC_FMT1 = 0x0080, | |
99 | TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003, | |
100 | TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004, | |
101 | TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015, | |
102 | TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022, | |
103 | TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B, | |
104 | TPM2_RC_VER1 = 0x0100, | |
105 | TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000, | |
106 | TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001, | |
107 | TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020, | |
108 | TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025, | |
109 | TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043, | |
110 | TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044, | |
111 | TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045, | |
112 | TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053, | |
113 | TPM2_RC_WARN = 0x0900, | |
114 | TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A, | |
115 | TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010, | |
116 | TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021, | |
117 | }; | |
118 | ||
119 | /** | |
120 | * TPM2 algorithms. | |
121 | */ | |
122 | enum tpm2_algorithms { | |
123 | TPM2_ALG_XOR = 0x0A, | |
124 | TPM2_ALG_SHA256 = 0x0B, | |
125 | TPM2_ALG_SHA384 = 0x0C, | |
126 | TPM2_ALG_SHA512 = 0x0D, | |
127 | TPM2_ALG_NULL = 0x10, | |
128 | }; | |
129 | ||
1922df20 MR |
130 | /** |
131 | * Issue a TPM2_Startup command. | |
132 | * | |
133 | * @mode TPM startup mode | |
134 | * | |
135 | * @return code of the operation | |
136 | */ | |
137 | u32 tpm2_startup(enum tpm2_startup_types mode); | |
138 | ||
2dc6d97e MR |
139 | /** |
140 | * Issue a TPM2_SelfTest command. | |
141 | * | |
142 | * @full_test Asking to perform all tests or only the untested ones | |
143 | * | |
144 | * @return code of the operation | |
145 | */ | |
146 | u32 tpm2_self_test(enum tpm2_yes_no full_test); | |
147 | ||
bad8ff56 MR |
148 | /** |
149 | * Issue a TPM2_Clear command. | |
150 | * | |
151 | * @handle Handle | |
152 | * @pw Password | |
153 | * @pw_sz Length of the password | |
154 | * | |
155 | * @return code of the operation | |
156 | */ | |
157 | u32 tpm2_clear(u32 handle, const char *pw, const ssize_t pw_sz); | |
158 | ||
6284be5a MR |
159 | /** |
160 | * Issue a TPM2_PCR_Extend command. | |
161 | * | |
162 | * @index Index of the PCR | |
163 | * @digest Value representing the event to be recorded | |
164 | * | |
165 | * @return code of the operation | |
166 | */ | |
167 | u32 tpm2_pcr_extend(u32 index, const uint8_t *digest); | |
168 | ||
1c4ea8f4 MR |
169 | /** |
170 | * Issue a TPM2_PCR_Read command. | |
171 | * | |
172 | * @idx Index of the PCR | |
173 | * @idx_min_sz Minimum size in bytes of the pcrSelect array | |
174 | * @data Output buffer for contents of the named PCR | |
175 | * @updates Optional out parameter: number of updates for this PCR | |
176 | * | |
177 | * @return code of the operation | |
178 | */ | |
179 | u32 tpm2_pcr_read(u32 idx, unsigned int idx_min_sz, void *data, | |
180 | unsigned int *updates); | |
181 | ||
69cd8f06 MR |
182 | /** |
183 | * Issue a TPM2_GetCapability command. This implementation is limited | |
184 | * to query property index that is 4-byte wide. | |
185 | * | |
186 | * @capability Partition of capabilities | |
187 | * @property Further definition of capability, limited to be 4 bytes wide | |
188 | * @buf Output buffer for capability information | |
189 | * @prop_count Size of output buffer | |
190 | * | |
191 | * @return code of the operation | |
192 | */ | |
193 | u32 tpm2_get_capability(u32 capability, u32 property, void *buf, | |
194 | size_t prop_count); | |
195 | ||
da9c3392 MR |
196 | /** |
197 | * Issue a TPM2_DictionaryAttackLockReset command. | |
198 | * | |
199 | * @pw Password | |
200 | * @pw_sz Length of the password | |
201 | * | |
202 | * @return code of the operation | |
203 | */ | |
204 | u32 tpm2_dam_reset(const char *pw, const ssize_t pw_sz); | |
205 | ||
206 | /** | |
207 | * Issue a TPM2_DictionaryAttackParameters command. | |
208 | * | |
209 | * @pw Password | |
210 | * @pw_sz Length of the password | |
211 | * @max_tries Count of authorizations before lockout | |
212 | * @recovery_time Time before decrementation of the failure count | |
213 | * @lockout_recovery Time to wait after a lockout | |
214 | * | |
215 | * @return code of the operation | |
216 | */ | |
217 | u32 tpm2_dam_parameters(const char *pw, const ssize_t pw_sz, | |
218 | unsigned int max_tries, unsigned int recovery_time, | |
219 | unsigned int lockout_recovery); | |
220 | ||
dc26e913 MR |
221 | /** |
222 | * Issue a TPM2_HierarchyChangeAuth command. | |
223 | * | |
224 | * @handle Handle | |
225 | * @newpw New password | |
226 | * @newpw_sz Length of the new password | |
227 | * @oldpw Old password | |
228 | * @oldpw_sz Length of the old password | |
229 | * | |
230 | * @return code of the operation | |
231 | */ | |
232 | int tpm2_change_auth(u32 handle, const char *newpw, const ssize_t newpw_sz, | |
233 | const char *oldpw, const ssize_t oldpw_sz); | |
234 | ||
b9dd4fab MR |
235 | /** |
236 | * Issue a TPM_PCR_SetAuthPolicy command. | |
237 | * | |
238 | * @pw Platform password | |
239 | * @pw_sz Length of the password | |
240 | * @index Index of the PCR | |
241 | * @digest New key to access the PCR | |
242 | * | |
243 | * @return code of the operation | |
244 | */ | |
245 | u32 tpm2_pcr_setauthpolicy(const char *pw, const ssize_t pw_sz, u32 index, | |
246 | const char *key); | |
247 | ||
248 | /** | |
249 | * Issue a TPM_PCR_SetAuthValue command. | |
250 | * | |
251 | * @pw Platform password | |
252 | * @pw_sz Length of the password | |
253 | * @index Index of the PCR | |
254 | * @digest New key to access the PCR | |
255 | * @key_sz Length of the new key | |
256 | * | |
257 | * @return code of the operation | |
258 | */ | |
259 | u32 tpm2_pcr_setauthvalue(const char *pw, const ssize_t pw_sz, u32 index, | |
260 | const char *key, const ssize_t key_sz); | |
261 | ||
ff32245b | 262 | #endif /* __TPM_V2_H */ |