1 /* SPDX-License-Identifier: GPL-2.0+ */
3 * Copyright (c) 2018 Bootlin
4 * Author: Miquel Raynal <miquel.raynal@bootlin.com>
10 #include <tpm-common.h>
12 #define TPM2_DIGEST_LEN 32
15 * TPM2 Structure Tags for command/response buffers.
17 * @TPM2_ST_NO_SESSIONS: the command does not need an authentication.
18 * @TPM2_ST_SESSIONS: the command needs an authentication.
20 enum tpm2_structures
{
21 TPM2_ST_NO_SESSIONS
= 0x8001,
22 TPM2_ST_SESSIONS
= 0x8002,
26 * TPM2 type of boolean.
34 * TPM2 startup values.
36 * @TPM2_SU_CLEAR: reset the internal state.
37 * @TPM2_SU_STATE: restore saved state (if any).
39 enum tpm2_startup_types
{
40 TPM2_SU_CLEAR
= 0x0000,
41 TPM2_SU_STATE
= 0x0001,
45 * TPM2 permanent handles.
47 * @TPM2_RH_OWNER: refers to the 'owner' hierarchy.
48 * @TPM2_RS_PW: indicates a password.
49 * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy.
50 * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy.
51 * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy.
54 TPM2_RH_OWNER
= 0x40000001,
55 TPM2_RS_PW
= 0x40000009,
56 TPM2_RH_LOCKOUT
= 0x4000000A,
57 TPM2_RH_ENDORSEMENT
= 0x4000000B,
58 TPM2_RH_PLATFORM
= 0x4000000C,
62 * TPM2 command codes used at the beginning of a buffer, gives the command.
64 * @TPM2_CC_STARTUP: TPM2_Startup().
65 * @TPM2_CC_SELF_TEST: TPM2_SelfTest().
66 * @TPM2_CC_CLEAR: TPM2_Clear().
67 * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl().
68 * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth().
69 * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy().
70 * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset().
71 * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters().
72 * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility().
73 * @TPM2_CC_PCR_READ: TPM2_PCR_Read().
74 * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend().
75 * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue().
77 enum tpm2_command_codes
{
78 TPM2_CC_STARTUP
= 0x0144,
79 TPM2_CC_SELF_TEST
= 0x0143,
80 TPM2_CC_CLEAR
= 0x0126,
81 TPM2_CC_CLEARCONTROL
= 0x0127,
82 TPM2_CC_HIERCHANGEAUTH
= 0x0129,
83 TPM2_CC_PCR_SETAUTHPOL
= 0x012C,
84 TPM2_CC_DAM_RESET
= 0x0139,
85 TPM2_CC_DAM_PARAMETERS
= 0x013A,
86 TPM2_CC_NV_READ
= 0x014E,
87 TPM2_CC_GET_CAPABILITY
= 0x017A,
88 TPM2_CC_PCR_READ
= 0x017E,
89 TPM2_CC_PCR_EXTEND
= 0x0182,
90 TPM2_CC_PCR_SETAUTHVAL
= 0x0183,
96 enum tpm2_return_codes
{
97 TPM2_RC_SUCCESS
= 0x0000,
98 TPM2_RC_BAD_TAG
= 0x001E,
99 TPM2_RC_FMT1
= 0x0080,
100 TPM2_RC_HASH
= TPM2_RC_FMT1
+ 0x0003,
101 TPM2_RC_VALUE
= TPM2_RC_FMT1
+ 0x0004,
102 TPM2_RC_SIZE
= TPM2_RC_FMT1
+ 0x0015,
103 TPM2_RC_BAD_AUTH
= TPM2_RC_FMT1
+ 0x0022,
104 TPM2_RC_HANDLE
= TPM2_RC_FMT1
+ 0x000B,
105 TPM2_RC_VER1
= 0x0100,
106 TPM2_RC_INITIALIZE
= TPM2_RC_VER1
+ 0x0000,
107 TPM2_RC_FAILURE
= TPM2_RC_VER1
+ 0x0001,
108 TPM2_RC_DISABLED
= TPM2_RC_VER1
+ 0x0020,
109 TPM2_RC_AUTH_MISSING
= TPM2_RC_VER1
+ 0x0025,
110 TPM2_RC_COMMAND_CODE
= TPM2_RC_VER1
+ 0x0043,
111 TPM2_RC_AUTHSIZE
= TPM2_RC_VER1
+ 0x0044,
112 TPM2_RC_AUTH_CONTEXT
= TPM2_RC_VER1
+ 0x0045,
113 TPM2_RC_NEEDS_TEST
= TPM2_RC_VER1
+ 0x0053,
114 TPM2_RC_WARN
= 0x0900,
115 TPM2_RC_TESTING
= TPM2_RC_WARN
+ 0x000A,
116 TPM2_RC_REFERENCE_H0
= TPM2_RC_WARN
+ 0x0010,
117 TPM2_RC_LOCKOUT
= TPM2_RC_WARN
+ 0x0021,
123 enum tpm2_algorithms
{
125 TPM2_ALG_SHA256
= 0x0B,
126 TPM2_ALG_SHA384
= 0x0C,
127 TPM2_ALG_SHA512
= 0x0D,
128 TPM2_ALG_NULL
= 0x10,
131 /* NV index attributes */
132 enum tpm_index_attrs
{
133 TPMA_NV_PPWRITE
= 1UL << 0,
134 TPMA_NV_OWNERWRITE
= 1UL << 1,
135 TPMA_NV_AUTHWRITE
= 1UL << 2,
136 TPMA_NV_POLICYWRITE
= 1UL << 3,
137 TPMA_NV_COUNTER
= 1UL << 4,
138 TPMA_NV_BITS
= 1UL << 5,
139 TPMA_NV_EXTEND
= 1UL << 6,
140 TPMA_NV_POLICY_DELETE
= 1UL << 10,
141 TPMA_NV_WRITELOCKED
= 1UL << 11,
142 TPMA_NV_WRITEALL
= 1UL << 12,
143 TPMA_NV_WRITEDEFINE
= 1UL << 13,
144 TPMA_NV_WRITE_STCLEAR
= 1UL << 14,
145 TPMA_NV_GLOBALLOCK
= 1UL << 15,
146 TPMA_NV_PPREAD
= 1UL << 16,
147 TPMA_NV_OWNERREAD
= 1UL << 17,
148 TPMA_NV_AUTHREAD
= 1UL << 18,
149 TPMA_NV_POLICYREAD
= 1UL << 19,
150 TPMA_NV_NO_DA
= 1UL << 25,
151 TPMA_NV_ORDERLY
= 1UL << 26,
152 TPMA_NV_CLEAR_STCLEAR
= 1UL << 27,
153 TPMA_NV_READLOCKED
= 1UL << 28,
154 TPMA_NV_WRITTEN
= 1UL << 29,
155 TPMA_NV_PLATFORMCREATE
= 1UL << 30,
156 TPMA_NV_READ_STCLEAR
= 1UL << 31,
158 TPMA_NV_MASK_READ
= TPMA_NV_PPREAD
| TPMA_NV_OWNERREAD
|
159 TPMA_NV_AUTHREAD
| TPMA_NV_POLICYREAD
,
160 TPMA_NV_MASK_WRITE
= TPMA_NV_PPWRITE
| TPMA_NV_OWNERWRITE
|
161 TPMA_NV_AUTHWRITE
| TPMA_NV_POLICYWRITE
,
165 TPM_ACCESS_VALID
= 1 << 7,
166 TPM_ACCESS_ACTIVE_LOCALITY
= 1 << 5,
167 TPM_ACCESS_REQUEST_PENDING
= 1 << 2,
168 TPM_ACCESS_REQUEST_USE
= 1 << 1,
169 TPM_ACCESS_ESTABLISHMENT
= 1 << 0,
173 TPM_STS_FAMILY_SHIFT
= 26,
174 TPM_STS_FAMILY_MASK
= 0x3 << TPM_STS_FAMILY_SHIFT
,
175 TPM_STS_FAMILY_TPM2
= 1 << TPM_STS_FAMILY_SHIFT
,
176 TPM_STS_RESE_TESTABLISMENT_BIT
= 1 << 25,
177 TPM_STS_COMMAND_CANCEL
= 1 << 24,
178 TPM_STS_BURST_COUNT_SHIFT
= 8,
179 TPM_STS_BURST_COUNT_MASK
= 0xffff << TPM_STS_BURST_COUNT_SHIFT
,
180 TPM_STS_VALID
= 1 << 7,
181 TPM_STS_COMMAND_READY
= 1 << 6,
183 TPM_STS_DATA_AVAIL
= 1 << 4,
184 TPM_STS_DATA_EXPECT
= 1 << 3,
185 TPM_STS_SELF_TEST_DONE
= 1 << 2,
186 TPM_STS_RESPONSE_RETRY
= 1 << 1,
190 TPM_CMD_COUNT_OFFSET
= 2,
191 TPM_CMD_ORDINAL_OFFSET
= 6,
192 TPM_MAX_BUF_SIZE
= 1260,
196 * Issue a TPM2_Startup command.
199 * @mode TPM startup mode
201 * @return code of the operation
203 u32
tpm2_startup(struct udevice
*dev
, enum tpm2_startup_types mode
);
206 * Issue a TPM2_SelfTest command.
209 * @full_test Asking to perform all tests or only the untested ones
211 * @return code of the operation
213 u32
tpm2_self_test(struct udevice
*dev
, enum tpm2_yes_no full_test
);
216 * Issue a TPM2_Clear command.
221 * @pw_sz Length of the password
223 * @return code of the operation
225 u32
tpm2_clear(struct udevice
*dev
, u32 handle
, const char *pw
,
226 const ssize_t pw_sz
);
229 * Issue a TPM2_PCR_Extend command.
232 * @index Index of the PCR
233 * @digest Value representing the event to be recorded
235 * @return code of the operation
237 u32
tpm2_pcr_extend(struct udevice
*dev
, u32 index
, const uint8_t *digest
);
240 * Issue a TPM2_PCR_Read command.
243 * @idx Index of the PCR
244 * @idx_min_sz Minimum size in bytes of the pcrSelect array
245 * @data Output buffer for contents of the named PCR
246 * @updates Optional out parameter: number of updates for this PCR
248 * @return code of the operation
250 u32
tpm2_pcr_read(struct udevice
*dev
, u32 idx
, unsigned int idx_min_sz
,
251 void *data
, unsigned int *updates
);
254 * Issue a TPM2_GetCapability command. This implementation is limited
255 * to query property index that is 4-byte wide.
258 * @capability Partition of capabilities
259 * @property Further definition of capability, limited to be 4 bytes wide
260 * @buf Output buffer for capability information
261 * @prop_count Size of output buffer
263 * @return code of the operation
265 u32
tpm2_get_capability(struct udevice
*dev
, u32 capability
, u32 property
,
266 void *buf
, size_t prop_count
);
269 * Issue a TPM2_DictionaryAttackLockReset command.
273 * @pw_sz Length of the password
275 * @return code of the operation
277 u32
tpm2_dam_reset(struct udevice
*dev
, const char *pw
, const ssize_t pw_sz
);
280 * Issue a TPM2_DictionaryAttackParameters command.
284 * @pw_sz Length of the password
285 * @max_tries Count of authorizations before lockout
286 * @recovery_time Time before decrementation of the failure count
287 * @lockout_recovery Time to wait after a lockout
289 * @return code of the operation
291 u32
tpm2_dam_parameters(struct udevice
*dev
, const char *pw
,
292 const ssize_t pw_sz
, unsigned int max_tries
,
293 unsigned int recovery_time
,
294 unsigned int lockout_recovery
);
297 * Issue a TPM2_HierarchyChangeAuth command.
301 * @newpw New password
302 * @newpw_sz Length of the new password
303 * @oldpw Old password
304 * @oldpw_sz Length of the old password
306 * @return code of the operation
308 int tpm2_change_auth(struct udevice
*dev
, u32 handle
, const char *newpw
,
309 const ssize_t newpw_sz
, const char *oldpw
,
310 const ssize_t oldpw_sz
);
313 * Issue a TPM_PCR_SetAuthPolicy command.
316 * @pw Platform password
317 * @pw_sz Length of the password
318 * @index Index of the PCR
319 * @digest New key to access the PCR
321 * @return code of the operation
323 u32
tpm2_pcr_setauthpolicy(struct udevice
*dev
, const char *pw
,
324 const ssize_t pw_sz
, u32 index
, const char *key
);
327 * Issue a TPM_PCR_SetAuthValue command.
330 * @pw Platform password
331 * @pw_sz Length of the password
332 * @index Index of the PCR
333 * @digest New key to access the PCR
334 * @key_sz Length of the new key
336 * @return code of the operation
338 u32
tpm2_pcr_setauthvalue(struct udevice
*dev
, const char *pw
,
339 const ssize_t pw_sz
, u32 index
, const char *key
,
340 const ssize_t key_sz
);
342 #endif /* __TPM_V2_H */