1 /* 2 * tpm_ioctl.h 3 * 4 * (c) Copyright IBM Corporation 2014, 2015. 5 * 6 * This file is licensed under the terms of the 3-clause BSD license 7 */ 8 #ifndef _TPM_IOCTL_H_ 9 #define _TPM_IOCTL_H_ 10 11 #if defined(__CYGWIN__) 12 # define __USE_LINUX_IOCTL_DEFS 13 #endif 14 15 #include <stdint.h> 16 #include <sys/types.h> 17 #ifndef _WIN32 18 #include <sys/uio.h> 19 #include <sys/ioctl.h> 20 #endif 21 22 #ifdef HAVE_SYS_IOCCOM_H 23 #include <sys/ioccom.h> 24 #endif 25 26 /* 27 * Every response from a command involving a TPM command execution must hold 28 * the ptm_res as the first element. 29 * ptm_res corresponds to the error code of a command executed by the TPM. 30 */ 31 32 typedef uint32_t ptm_res; 33 34 /* PTM_GET_TPMESTABLISHED: get the establishment bit */ 35 struct ptm_est { 36 union { 37 struct { 38 ptm_res tpm_result; 39 unsigned char bit; /* TPM established bit */ 40 } resp; /* response */ 41 } u; 42 }; 43 44 /* PTM_RESET_TPMESTABLISHED: reset establishment bit */ 45 struct ptm_reset_est { 46 union { 47 struct { 48 uint8_t loc; /* locality to use */ 49 } req; /* request */ 50 struct { 51 ptm_res tpm_result; 52 } resp; /* response */ 53 } u; 54 }; 55 56 /* PTM_INIT */ 57 struct ptm_init { 58 union { 59 struct { 60 uint32_t init_flags; /* see definitions below */ 61 } req; /* request */ 62 struct { 63 ptm_res tpm_result; 64 } resp; /* response */ 65 } u; 66 }; 67 68 /* above init_flags */ 69 #define PTM_INIT_FLAG_DELETE_VOLATILE (1 << 0) 70 /* delete volatile state file after reading it */ 71 72 /* PTM_SET_LOCALITY */ 73 struct ptm_loc { 74 union { 75 struct { 76 uint8_t loc; /* locality to set */ 77 } req; /* request */ 78 struct { 79 ptm_res tpm_result; 80 } resp; /* response */ 81 } u; 82 }; 83 84 /* PTM_HASH_DATA: hash given data */ 85 struct ptm_hdata { 86 union { 87 struct { 88 uint32_t length; 89 uint8_t data[4096]; 90 } req; /* request */ 91 struct { 92 ptm_res tpm_result; 93 } resp; /* response */ 94 } u; 95 }; 96 97 /* 98 * size of the TPM state blob to transfer; x86_64 can handle 8k, 99 * ppc64le only ~7k; keep the response below a 4k page size 100 */ 101 #define PTM_STATE_BLOB_SIZE (3 * 1024) 102 103 /* 104 * The following is the data structure to get state blobs from the TPM. 105 * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple reads 106 * with this ioctl and with adjusted offset are necessary. All bytes 107 * must be transferred and the transfer is done once the last byte has been 108 * returned. 109 * It is possible to use the read() interface for reading the data; however, the 110 * first bytes of the state blob will be part of the response to the ioctl(); a 111 * subsequent read() is only necessary if the total length (totlength) exceeds 112 * the number of received bytes. seek() is not supported. 113 */ 114 struct ptm_getstate { 115 union { 116 struct { 117 uint32_t state_flags; /* may be: PTM_STATE_FLAG_DECRYPTED */ 118 uint32_t type; /* which blob to pull */ 119 uint32_t offset; /* offset from where to read */ 120 } req; /* request */ 121 struct { 122 ptm_res tpm_result; 123 uint32_t state_flags; /* may be: PTM_STATE_FLAG_ENCRYPTED */ 124 uint32_t totlength; /* total length that will be transferred */ 125 uint32_t length; /* number of bytes in following buffer */ 126 uint8_t data[PTM_STATE_BLOB_SIZE]; 127 } resp; /* response */ 128 } u; 129 }; 130 131 /* TPM state blob types */ 132 #define PTM_BLOB_TYPE_PERMANENT 1 133 #define PTM_BLOB_TYPE_VOLATILE 2 134 #define PTM_BLOB_TYPE_SAVESTATE 3 135 136 /* state_flags above : */ 137 #define PTM_STATE_FLAG_DECRYPTED 1 /* on input: get decrypted state */ 138 #define PTM_STATE_FLAG_ENCRYPTED 2 /* on output: state is encrypted */ 139 140 /* 141 * The following is the data structure to set state blobs in the TPM. 142 * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple 143 * 'writes' using this ioctl are necessary. The last packet is indicated 144 * by the length being smaller than the PTM_STATE_BLOB_SIZE. 145 * The very first packet may have a length indicator of '0' enabling 146 * a write() with all the bytes from a buffer. If the write() interface 147 * is used, a final ioctl with a non-full buffer must be made to indicate 148 * that all data were transferred (a write with 0 bytes would not work). 149 */ 150 struct ptm_setstate { 151 union { 152 struct { 153 uint32_t state_flags; /* may be PTM_STATE_FLAG_ENCRYPTED */ 154 uint32_t type; /* which blob to set */ 155 uint32_t length; /* length of the data; 156 use 0 on the first packet to 157 transfer using write() */ 158 uint8_t data[PTM_STATE_BLOB_SIZE]; 159 } req; /* request */ 160 struct { 161 ptm_res tpm_result; 162 } resp; /* response */ 163 } u; 164 }; 165 166 /* 167 * PTM_GET_CONFIG: Data structure to get runtime configuration information 168 * such as which keys are applied. 169 */ 170 struct ptm_getconfig { 171 union { 172 struct { 173 ptm_res tpm_result; 174 uint32_t flags; 175 } resp; /* response */ 176 } u; 177 }; 178 179 #define PTM_CONFIG_FLAG_FILE_KEY 0x1 180 #define PTM_CONFIG_FLAG_MIGRATION_KEY 0x2 181 182 /* 183 * PTM_SET_BUFFERSIZE: Set the buffer size to be used by the TPM. 184 * A 0 on input queries for the current buffer size. Any other 185 * number will try to set the buffer size. The returned number is 186 * the buffer size that will be used, which can be larger than the 187 * requested one, if it was below the minimum, or smaller than the 188 * requested one, if it was above the maximum. 189 */ 190 struct ptm_setbuffersize { 191 union { 192 struct { 193 uint32_t buffersize; /* 0 to query for current buffer size */ 194 } req; /* request */ 195 struct { 196 ptm_res tpm_result; 197 uint32_t buffersize; /* buffer size in use */ 198 uint32_t minsize; /* min. supported buffer size */ 199 uint32_t maxsize; /* max. supported buffer size */ 200 } resp; /* response */ 201 } u; 202 }; 203 204 #define PTM_GETINFO_SIZE (3 * 1024) 205 /* 206 * PTM_GET_INFO: Get info about the TPM implementation (from libtpms) 207 * 208 * This request allows to indirectly call TPMLIB_GetInfo(flags) and 209 * retrieve information from libtpms. 210 * Only one transaction is currently necessary for returning results 211 * to a client. Therefore, totlength and length will be the same if 212 * offset is 0. 213 */ 214 struct ptm_getinfo { 215 union { 216 struct { 217 uint64_t flags; 218 uint32_t offset; /* offset from where to read */ 219 uint32_t pad; /* 32 bit arch */ 220 } req; /* request */ 221 struct { 222 ptm_res tpm_result; 223 uint32_t totlength; 224 uint32_t length; 225 char buffer[PTM_GETINFO_SIZE]; 226 } resp; /* response */ 227 } u; 228 }; 229 230 #define SWTPM_INFO_TPMSPECIFICATION ((uint64_t)1 << 0) 231 #define SWTPM_INFO_TPMATTRIBUTES ((uint64_t)1 << 1) 232 233 /* 234 * PTM_LOCK_STORAGE: Lock the storage and retry n times 235 */ 236 struct ptm_lockstorage { 237 union { 238 struct { 239 uint32_t retries; /* number of retries */ 240 } req; /* request */ 241 struct { 242 ptm_res tpm_result; 243 } resp; /* reponse */ 244 } u; 245 }; 246 247 typedef uint64_t ptm_cap; 248 typedef struct ptm_est ptm_est; 249 typedef struct ptm_reset_est ptm_reset_est; 250 typedef struct ptm_loc ptm_loc; 251 typedef struct ptm_hdata ptm_hdata; 252 typedef struct ptm_init ptm_init; 253 typedef struct ptm_getstate ptm_getstate; 254 typedef struct ptm_setstate ptm_setstate; 255 typedef struct ptm_getconfig ptm_getconfig; 256 typedef struct ptm_setbuffersize ptm_setbuffersize; 257 typedef struct ptm_getinfo ptm_getinfo; 258 typedef struct ptm_lockstorage ptm_lockstorage; 259 260 /* capability flags returned by PTM_GET_CAPABILITY */ 261 #define PTM_CAP_INIT (1) 262 #define PTM_CAP_SHUTDOWN (1 << 1) 263 #define PTM_CAP_GET_TPMESTABLISHED (1 << 2) 264 #define PTM_CAP_SET_LOCALITY (1 << 3) 265 #define PTM_CAP_HASHING (1 << 4) 266 #define PTM_CAP_CANCEL_TPM_CMD (1 << 5) 267 #define PTM_CAP_STORE_VOLATILE (1 << 6) 268 #define PTM_CAP_RESET_TPMESTABLISHED (1 << 7) 269 #define PTM_CAP_GET_STATEBLOB (1 << 8) 270 #define PTM_CAP_SET_STATEBLOB (1 << 9) 271 #define PTM_CAP_STOP (1 << 10) 272 #define PTM_CAP_GET_CONFIG (1 << 11) 273 #define PTM_CAP_SET_DATAFD (1 << 12) 274 #define PTM_CAP_SET_BUFFERSIZE (1 << 13) 275 #define PTM_CAP_GET_INFO (1 << 14) 276 #define PTM_CAP_SEND_COMMAND_HEADER (1 << 15) 277 #define PTM_CAP_LOCK_STORAGE (1 << 16) 278 279 #ifndef _WIN32 280 enum { 281 PTM_GET_CAPABILITY = _IOR('P', 0, ptm_cap), 282 PTM_INIT = _IOWR('P', 1, ptm_init), 283 PTM_SHUTDOWN = _IOR('P', 2, ptm_res), 284 PTM_GET_TPMESTABLISHED = _IOR('P', 3, ptm_est), 285 PTM_SET_LOCALITY = _IOWR('P', 4, ptm_loc), 286 PTM_HASH_START = _IOR('P', 5, ptm_res), 287 PTM_HASH_DATA = _IOWR('P', 6, ptm_hdata), 288 PTM_HASH_END = _IOR('P', 7, ptm_res), 289 PTM_CANCEL_TPM_CMD = _IOR('P', 8, ptm_res), 290 PTM_STORE_VOLATILE = _IOR('P', 9, ptm_res), 291 PTM_RESET_TPMESTABLISHED = _IOWR('P', 10, ptm_reset_est), 292 PTM_GET_STATEBLOB = _IOWR('P', 11, ptm_getstate), 293 PTM_SET_STATEBLOB = _IOWR('P', 12, ptm_setstate), 294 PTM_STOP = _IOR('P', 13, ptm_res), 295 PTM_GET_CONFIG = _IOR('P', 14, ptm_getconfig), 296 PTM_SET_DATAFD = _IOR('P', 15, ptm_res), 297 PTM_SET_BUFFERSIZE = _IOWR('P', 16, ptm_setbuffersize), 298 PTM_GET_INFO = _IOWR('P', 17, ptm_getinfo), 299 PTM_LOCK_STORAGE = _IOWR('P', 18, ptm_lockstorage), 300 }; 301 #endif 302 303 /* 304 * Commands used by the non-CUSE TPMs 305 * 306 * All messages container big-endian data. 307 * 308 * The return messages only contain the 'resp' part of the unions 309 * in the data structures above. Besides that the limits in the 310 * buffers above (ptm_hdata:u.req.data and ptm_get_state:u.resp.data 311 * and ptm_set_state:u.req.data) are 0xffffffff. 312 */ 313 enum { 314 CMD_GET_CAPABILITY = 1, /* 0x01 */ 315 CMD_INIT, /* 0x02 */ 316 CMD_SHUTDOWN, /* 0x03 */ 317 CMD_GET_TPMESTABLISHED, /* 0x04 */ 318 CMD_SET_LOCALITY, /* 0x05 */ 319 CMD_HASH_START, /* 0x06 */ 320 CMD_HASH_DATA, /* 0x07 */ 321 CMD_HASH_END, /* 0x08 */ 322 CMD_CANCEL_TPM_CMD, /* 0x09 */ 323 CMD_STORE_VOLATILE, /* 0x0a */ 324 CMD_RESET_TPMESTABLISHED, /* 0x0b */ 325 CMD_GET_STATEBLOB, /* 0x0c */ 326 CMD_SET_STATEBLOB, /* 0x0d */ 327 CMD_STOP, /* 0x0e */ 328 CMD_GET_CONFIG, /* 0x0f */ 329 CMD_SET_DATAFD, /* 0x10 */ 330 CMD_SET_BUFFERSIZE, /* 0x11 */ 331 CMD_GET_INFO, /* 0x12 */ 332 CMD_LOCK_STORAGE, /* 0x13 */ 333 }; 334 335 #endif /* _TPM_IOCTL_H_ */ 336