1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * Defines APIs and structures that allow software to interact with a 4 * TPM2 device 5 * 6 * Copyright (c) 2020 Linaro 7 * Copyright (c) 2018 Bootlin 8 * 9 * https://trustedcomputinggroup.org/resource/tss-overview-common-structures-specification/ 10 * 11 * Author: Miquel Raynal <miquel.raynal@bootlin.com> 12 */ 13 14 #ifndef __TPM_V2_H 15 #define __TPM_V2_H 16 17 #include <tpm-common.h> 18 19 struct udevice; 20 21 #define TPM2_DIGEST_LEN 32 22 23 #define TPM2_SHA1_DIGEST_SIZE 20 24 #define TPM2_SHA256_DIGEST_SIZE 32 25 #define TPM2_SHA384_DIGEST_SIZE 48 26 #define TPM2_SHA512_DIGEST_SIZE 64 27 #define TPM2_SM3_256_DIGEST_SIZE 32 28 29 #define TPM2_MAX_PCRS 32 30 #define TPM2_PCR_SELECT_MAX ((TPM2_MAX_PCRS + 7) / 8) 31 #define TPM2_MAX_CAP_BUFFER 1024 32 #define TPM2_MAX_TPM_PROPERTIES ((TPM2_MAX_CAP_BUFFER - sizeof(u32) /* TPM2_CAP */ - \ 33 sizeof(u32)) / sizeof(struct tpms_tagged_property)) 34 35 #define TPM2_HDR_LEN 10 36 37 /* 38 * We deviate from this draft of the specification by increasing the value of 39 * TPM2_NUM_PCR_BANKS from 3 to 16 to ensure compatibility with TPM2 40 * implementations that have enabled a larger than typical number of PCR 41 * banks. This larger value for TPM2_NUM_PCR_BANKS is expected to be included 42 * in a future revision of the specification. 43 */ 44 #define TPM2_NUM_PCR_BANKS 16 45 46 /* Definition of (UINT32) TPM2_CAP Constants */ 47 #define TPM2_CAP_PCRS 0x00000005U 48 #define TPM2_CAP_TPM_PROPERTIES 0x00000006U 49 50 /* Definition of (UINT32) TPM2_PT Constants */ 51 #define TPM2_PT_GROUP (u32)(0x00000100) 52 #define TPM2_PT_FIXED (u32)(TPM2_PT_GROUP * 1) 53 #define TPM2_PT_MANUFACTURER (u32)(TPM2_PT_FIXED + 5) 54 #define TPM2_PT_PCR_COUNT (u32)(TPM2_PT_FIXED + 18) 55 #define TPM2_PT_MAX_COMMAND_SIZE (u32)(TPM2_PT_FIXED + 30) 56 #define TPM2_PT_MAX_RESPONSE_SIZE (u32)(TPM2_PT_FIXED + 31) 57 58 /* 59 * event types, cf. 60 * "TCG Server Management Domain Firmware Profile Specification", 61 * rev 1.00, 2020-05-01 62 */ 63 #define EV_POST_CODE ((u32)0x00000001) 64 #define EV_NO_ACTION ((u32)0x00000003) 65 #define EV_SEPARATOR ((u32)0x00000004) 66 #define EV_ACTION ((u32)0x00000005) 67 #define EV_TAG ((u32)0x00000006) 68 #define EV_S_CRTM_CONTENTS ((u32)0x00000007) 69 #define EV_S_CRTM_VERSION ((u32)0x00000008) 70 #define EV_CPU_MICROCODE ((u32)0x00000009) 71 #define EV_PLATFORM_CONFIG_FLAGS ((u32)0x0000000A) 72 #define EV_TABLE_OF_DEVICES ((u32)0x0000000B) 73 #define EV_COMPACT_HASH ((u32)0x0000000C) 74 75 /* 76 * event types, cf. 77 * "TCG PC Client Platform Firmware Profile Specification", Family "2.0" 78 * Level 00 Version 1.05 Revision 23, May 7, 2021 79 */ 80 #define EV_EFI_EVENT_BASE ((u32)0x80000000) 81 #define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001) 82 #define EV_EFI_VARIABLE_BOOT ((u32)0x80000002) 83 #define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003) 84 #define EV_EFI_BOOT_SERVICES_DRIVER ((u32)0x80000004) 85 #define EV_EFI_RUNTIME_SERVICES_DRIVER ((u32)0x80000005) 86 #define EV_EFI_GPT_EVENT ((u32)0x80000006) 87 #define EV_EFI_ACTION ((u32)0x80000007) 88 #define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008) 89 #define EV_EFI_HANDOFF_TABLES ((u32)0x80000009) 90 #define EV_EFI_PLATFORM_FIRMWARE_BLOB2 ((u32)0x8000000A) 91 #define EV_EFI_HANDOFF_TABLES2 ((u32)0x8000000B) 92 #define EV_EFI_VARIABLE_BOOT2 ((u32)0x8000000C) 93 #define EV_EFI_HCRTM_EVENT ((u32)0x80000010) 94 #define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0) 95 #define EV_EFI_SPDM_FIRMWARE_BLOB ((u32)0x800000E1) 96 #define EV_EFI_SPDM_FIRMWARE_CONFIG ((u32)0x800000E2) 97 98 #define EFI_CALLING_EFI_APPLICATION \ 99 "Calling EFI Application from Boot Option" 100 #define EFI_RETURNING_FROM_EFI_APPLICATION \ 101 "Returning from EFI Application from Boot Option" 102 #define EFI_EXIT_BOOT_SERVICES_INVOCATION \ 103 "Exit Boot Services Invocation" 104 #define EFI_EXIT_BOOT_SERVICES_FAILED \ 105 "Exit Boot Services Returned with Failure" 106 #define EFI_EXIT_BOOT_SERVICES_SUCCEEDED \ 107 "Exit Boot Services Returned with Success" 108 #define EFI_DTB_EVENT_STRING \ 109 "DTB DATA" 110 111 /* TPMS_TAGGED_PROPERTY Structure */ 112 struct tpms_tagged_property { 113 u32 property; 114 u32 value; 115 } __packed; 116 117 /* TPMS_PCR_SELECTION Structure */ 118 struct tpms_pcr_selection { 119 u16 hash; 120 u8 size_of_select; 121 u8 pcr_select[TPM2_PCR_SELECT_MAX]; 122 } __packed; 123 124 /* TPML_PCR_SELECTION Structure */ 125 struct tpml_pcr_selection { 126 u32 count; 127 struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS]; 128 } __packed; 129 130 /* TPML_TAGGED_TPM_PROPERTY Structure */ 131 struct tpml_tagged_tpm_property { 132 u32 count; 133 struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES]; 134 } __packed; 135 136 /* TPMU_CAPABILITIES Union */ 137 union tpmu_capabilities { 138 /* 139 * Non exhaustive. Only added the structs needed for our 140 * current code 141 */ 142 struct tpml_pcr_selection assigned_pcr; 143 struct tpml_tagged_tpm_property tpm_properties; 144 } __packed; 145 146 /* TPMS_CAPABILITY_DATA Structure */ 147 struct tpms_capability_data { 148 u32 capability; 149 union tpmu_capabilities data; 150 } __packed; 151 152 /** 153 * SHA1 Event Log Entry Format 154 * 155 * @pcr_index: PCRIndex event extended to 156 * @event_type: Type of event (see EFI specs) 157 * @digest: Value extended into PCR index 158 * @event_size: Size of event 159 * @event: Event data 160 */ 161 struct tcg_pcr_event { 162 u32 pcr_index; 163 u32 event_type; 164 u8 digest[TPM2_SHA1_DIGEST_SIZE]; 165 u32 event_size; 166 u8 event[]; 167 } __packed; 168 169 /** 170 * Definition of TPMU_HA Union 171 */ 172 union tmpu_ha { 173 u8 sha1[TPM2_SHA1_DIGEST_SIZE]; 174 u8 sha256[TPM2_SHA256_DIGEST_SIZE]; 175 u8 sm3_256[TPM2_SM3_256_DIGEST_SIZE]; 176 u8 sha384[TPM2_SHA384_DIGEST_SIZE]; 177 u8 sha512[TPM2_SHA512_DIGEST_SIZE]; 178 } __packed; 179 180 /** 181 * Definition of TPMT_HA Structure 182 * 183 * @hash_alg: Hash algorithm defined in enum tpm2_algorithms 184 * @digest: Digest value for a given algorithm 185 */ 186 struct tpmt_ha { 187 u16 hash_alg; 188 union tmpu_ha digest; 189 } __packed; 190 191 /** 192 * Definition of TPML_DIGEST_VALUES Structure 193 * 194 * @count: Number of algorithms supported by hardware 195 * @digests: struct for algorithm id and hash value 196 */ 197 struct tpml_digest_values { 198 u32 count; 199 struct tpmt_ha digests[TPM2_NUM_PCR_BANKS]; 200 } __packed; 201 202 /** 203 * Crypto Agile Log Entry Format 204 * 205 * @pcr_index: PCRIndex event extended to 206 * @event_type: Type of event 207 * @digests: List of digestsextended to PCR index 208 * @event_size: Size of the event data 209 * @event: Event data 210 */ 211 struct tcg_pcr_event2 { 212 u32 pcr_index; 213 u32 event_type; 214 struct tpml_digest_values digests; 215 u32 event_size; 216 u8 event[]; 217 } __packed; 218 219 /** 220 * TPM2 Structure Tags for command/response buffers. 221 * 222 * @TPM2_ST_NO_SESSIONS: the command does not need an authentication. 223 * @TPM2_ST_SESSIONS: the command needs an authentication. 224 */ 225 enum tpm2_structures { 226 TPM2_ST_NO_SESSIONS = 0x8001, 227 TPM2_ST_SESSIONS = 0x8002, 228 }; 229 230 /** 231 * TPM2 type of boolean. 232 */ 233 enum tpm2_yes_no { 234 TPMI_YES = 1, 235 TPMI_NO = 0, 236 }; 237 238 /** 239 * TPM2 startup values. 240 * 241 * @TPM2_SU_CLEAR: reset the internal state. 242 * @TPM2_SU_STATE: restore saved state (if any). 243 */ 244 enum tpm2_startup_types { 245 TPM2_SU_CLEAR = 0x0000, 246 TPM2_SU_STATE = 0x0001, 247 }; 248 249 /** 250 * TPM2 permanent handles. 251 * 252 * @TPM2_RH_OWNER: refers to the 'owner' hierarchy. 253 * @TPM2_RS_PW: indicates a password. 254 * @TPM2_RH_LOCKOUT: refers to the 'lockout' hierarchy. 255 * @TPM2_RH_ENDORSEMENT: refers to the 'endorsement' hierarchy. 256 * @TPM2_RH_PLATFORM: refers to the 'platform' hierarchy. 257 */ 258 enum tpm2_handles { 259 TPM2_RH_OWNER = 0x40000001, 260 TPM2_RS_PW = 0x40000009, 261 TPM2_RH_LOCKOUT = 0x4000000A, 262 TPM2_RH_ENDORSEMENT = 0x4000000B, 263 TPM2_RH_PLATFORM = 0x4000000C, 264 }; 265 266 /** 267 * TPM2 command codes used at the beginning of a buffer, gives the command. 268 * 269 * @TPM2_CC_STARTUP: TPM2_Startup(). 270 * @TPM2_CC_SELF_TEST: TPM2_SelfTest(). 271 * @TPM2_CC_CLEAR: TPM2_Clear(). 272 * @TPM2_CC_CLEARCONTROL: TPM2_ClearControl(). 273 * @TPM2_CC_HIERCHANGEAUTH: TPM2_HierarchyChangeAuth(). 274 * @TPM2_CC_PCR_SETAUTHPOL: TPM2_PCR_SetAuthPolicy(). 275 * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset(). 276 * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters(). 277 * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility(). 278 * @TPM2_CC_GET_RANDOM: TPM2_GetRandom(). 279 * @TPM2_CC_PCR_READ: TPM2_PCR_Read(). 280 * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend(). 281 * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue(). 282 */ 283 enum tpm2_command_codes { 284 TPM2_CC_STARTUP = 0x0144, 285 TPM2_CC_SELF_TEST = 0x0143, 286 TPM2_CC_HIER_CONTROL = 0x0121, 287 TPM2_CC_CLEAR = 0x0126, 288 TPM2_CC_CLEARCONTROL = 0x0127, 289 TPM2_CC_HIERCHANGEAUTH = 0x0129, 290 TPM2_CC_NV_DEFINE_SPACE = 0x012a, 291 TPM2_CC_PCR_SETAUTHPOL = 0x012C, 292 TPM2_CC_NV_WRITE = 0x0137, 293 TPM2_CC_NV_WRITELOCK = 0x0138, 294 TPM2_CC_DAM_RESET = 0x0139, 295 TPM2_CC_DAM_PARAMETERS = 0x013A, 296 TPM2_CC_NV_READ = 0x014E, 297 TPM2_CC_GET_CAPABILITY = 0x017A, 298 TPM2_CC_GET_RANDOM = 0x017B, 299 TPM2_CC_PCR_READ = 0x017E, 300 TPM2_CC_PCR_EXTEND = 0x0182, 301 TPM2_CC_PCR_SETAUTHVAL = 0x0183, 302 }; 303 304 /** 305 * TPM2 return codes. 306 */ 307 enum tpm2_return_codes { 308 TPM2_RC_SUCCESS = 0x0000, 309 TPM2_RC_BAD_TAG = 0x001E, 310 TPM2_RC_FMT1 = 0x0080, 311 TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003, 312 TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004, 313 TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015, 314 TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022, 315 TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B, 316 TPM2_RC_VER1 = 0x0100, 317 TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000, 318 TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001, 319 TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020, 320 TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025, 321 TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043, 322 TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044, 323 TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045, 324 TPM2_RC_NV_DEFINED = TPM2_RC_VER1 + 0x004c, 325 TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053, 326 TPM2_RC_WARN = 0x0900, 327 TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A, 328 TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010, 329 TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021, 330 }; 331 332 /** 333 * TPM2 algorithms. 334 */ 335 enum tpm2_algorithms { 336 TPM2_ALG_SHA1 = 0x04, 337 TPM2_ALG_XOR = 0x0A, 338 TPM2_ALG_SHA256 = 0x0B, 339 TPM2_ALG_SHA384 = 0x0C, 340 TPM2_ALG_SHA512 = 0x0D, 341 TPM2_ALG_NULL = 0x10, 342 TPM2_ALG_SM3_256 = 0x12, 343 }; 344 345 /* NV index attributes */ 346 enum tpm_index_attrs { 347 TPMA_NV_PPWRITE = 1UL << 0, 348 TPMA_NV_OWNERWRITE = 1UL << 1, 349 TPMA_NV_AUTHWRITE = 1UL << 2, 350 TPMA_NV_POLICYWRITE = 1UL << 3, 351 TPMA_NV_COUNTER = 1UL << 4, 352 TPMA_NV_BITS = 1UL << 5, 353 TPMA_NV_EXTEND = 1UL << 6, 354 TPMA_NV_POLICY_DELETE = 1UL << 10, 355 TPMA_NV_WRITELOCKED = 1UL << 11, 356 TPMA_NV_WRITEALL = 1UL << 12, 357 TPMA_NV_WRITEDEFINE = 1UL << 13, 358 TPMA_NV_WRITE_STCLEAR = 1UL << 14, 359 TPMA_NV_GLOBALLOCK = 1UL << 15, 360 TPMA_NV_PPREAD = 1UL << 16, 361 TPMA_NV_OWNERREAD = 1UL << 17, 362 TPMA_NV_AUTHREAD = 1UL << 18, 363 TPMA_NV_POLICYREAD = 1UL << 19, 364 TPMA_NV_NO_DA = 1UL << 25, 365 TPMA_NV_ORDERLY = 1UL << 26, 366 TPMA_NV_CLEAR_STCLEAR = 1UL << 27, 367 TPMA_NV_READLOCKED = 1UL << 28, 368 TPMA_NV_WRITTEN = 1UL << 29, 369 TPMA_NV_PLATFORMCREATE = 1UL << 30, 370 TPMA_NV_READ_STCLEAR = 1UL << 31, 371 372 TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD | 373 TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD, 374 TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE | 375 TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE, 376 }; 377 378 enum { 379 TPM_ACCESS_VALID = 1 << 7, 380 TPM_ACCESS_ACTIVE_LOCALITY = 1 << 5, 381 TPM_ACCESS_REQUEST_PENDING = 1 << 2, 382 TPM_ACCESS_REQUEST_USE = 1 << 1, 383 TPM_ACCESS_ESTABLISHMENT = 1 << 0, 384 }; 385 386 enum { 387 TPM_STS_FAMILY_SHIFT = 26, 388 TPM_STS_FAMILY_MASK = 0x3 << TPM_STS_FAMILY_SHIFT, 389 TPM_STS_FAMILY_TPM2 = 1 << TPM_STS_FAMILY_SHIFT, 390 TPM_STS_RESE_TESTABLISMENT_BIT = 1 << 25, 391 TPM_STS_COMMAND_CANCEL = 1 << 24, 392 TPM_STS_BURST_COUNT_SHIFT = 8, 393 TPM_STS_BURST_COUNT_MASK = 0xffff << TPM_STS_BURST_COUNT_SHIFT, 394 TPM_STS_VALID = 1 << 7, 395 TPM_STS_COMMAND_READY = 1 << 6, 396 TPM_STS_GO = 1 << 5, 397 TPM_STS_DATA_AVAIL = 1 << 4, 398 TPM_STS_DATA_EXPECT = 1 << 3, 399 TPM_STS_SELF_TEST_DONE = 1 << 2, 400 TPM_STS_RESPONSE_RETRY = 1 << 1, 401 TPM_STS_READ_ZERO = 0x23 402 }; 403 404 enum { 405 TPM_CMD_COUNT_OFFSET = 2, 406 TPM_CMD_ORDINAL_OFFSET = 6, 407 TPM_MAX_BUF_SIZE = 1260, 408 }; 409 410 enum { 411 /* Secure storage for firmware settings */ 412 TPM_HT_PCR = 0, 413 TPM_HT_NV_INDEX, 414 TPM_HT_HMAC_SESSION, 415 TPM_HT_POLICY_SESSION, 416 417 HR_SHIFT = 24, 418 HR_PCR = TPM_HT_PCR << HR_SHIFT, 419 HR_HMAC_SESSION = TPM_HT_HMAC_SESSION << HR_SHIFT, 420 HR_POLICY_SESSION = TPM_HT_POLICY_SESSION << HR_SHIFT, 421 HR_NV_INDEX = TPM_HT_NV_INDEX << HR_SHIFT, 422 }; 423 424 /** 425 * Issue a TPM2_Startup command. 426 * 427 * @dev TPM device 428 * @mode TPM startup mode 429 * 430 * Return: code of the operation 431 */ 432 u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode); 433 434 /** 435 * Issue a TPM2_SelfTest command. 436 * 437 * @dev TPM device 438 * @full_test Asking to perform all tests or only the untested ones 439 * 440 * Return: code of the operation 441 */ 442 u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test); 443 444 /** 445 * Issue a TPM2_Clear command. 446 * 447 * @dev TPM device 448 * @handle Handle 449 * @pw Password 450 * @pw_sz Length of the password 451 * 452 * Return: code of the operation 453 */ 454 u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw, 455 const ssize_t pw_sz); 456 457 /** 458 * Issue a TPM_NV_DefineSpace command 459 * 460 * This allows a space to be defined with given attributes and policy 461 * 462 * @dev TPM device 463 * @space_index index of the area 464 * @space_size size of area in bytes 465 * @nv_attributes TPM_NV_ATTRIBUTES of the area 466 * @nv_policy policy to use 467 * @nv_policy_size size of the policy 468 * Return: return code of the operation 469 */ 470 u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index, 471 size_t space_size, u32 nv_attributes, 472 const u8 *nv_policy, size_t nv_policy_size); 473 474 /** 475 * Issue a TPM2_PCR_Extend command. 476 * 477 * @dev TPM device 478 * @index Index of the PCR 479 * @algorithm Algorithm used, defined in 'enum tpm2_algorithms' 480 * @digest Value representing the event to be recorded 481 * @digest_len len of the hash 482 * 483 * Return: code of the operation 484 */ 485 u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm, 486 const u8 *digest, u32 digest_len); 487 488 /** 489 * Read data from the secure storage 490 * 491 * @dev TPM device 492 * @index Index of data to read 493 * @data Place to put data 494 * @count Number of bytes of data 495 * Return: code of the operation 496 */ 497 u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count); 498 499 /** 500 * Write data to the secure storage 501 * 502 * @dev TPM device 503 * @index Index of data to write 504 * @data Data to write 505 * @count Number of bytes of data 506 * Return: code of the operation 507 */ 508 u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data, 509 u32 count); 510 511 /** 512 * Issue a TPM2_PCR_Read command. 513 * 514 * @dev TPM device 515 * @idx Index of the PCR 516 * @idx_min_sz Minimum size in bytes of the pcrSelect array 517 * @algorithm Algorithm used, defined in 'enum tpm2_algorithms' 518 * @data Output buffer for contents of the named PCR 519 * @digest_len len of the data 520 * @updates Optional out parameter: number of updates for this PCR 521 * 522 * Return: code of the operation 523 */ 524 u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz, 525 u16 algorithm, void *data, u32 digest_len, 526 unsigned int *updates); 527 528 /** 529 * Issue a TPM2_GetCapability command. This implementation is limited 530 * to query property index that is 4-byte wide. 531 * 532 * @dev TPM device 533 * @capability Partition of capabilities 534 * @property Further definition of capability, limited to be 4 bytes wide 535 * @buf Output buffer for capability information 536 * @prop_count Size of output buffer 537 * 538 * Return: code of the operation 539 */ 540 u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property, 541 void *buf, size_t prop_count); 542 543 /** 544 * Issue a TPM2_DictionaryAttackLockReset command. 545 * 546 * @dev TPM device 547 * @pw Password 548 * @pw_sz Length of the password 549 * 550 * Return: code of the operation 551 */ 552 u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz); 553 554 /** 555 * Issue a TPM2_DictionaryAttackParameters command. 556 * 557 * @dev TPM device 558 * @pw Password 559 * @pw_sz Length of the password 560 * @max_tries Count of authorizations before lockout 561 * @recovery_time Time before decrementation of the failure count 562 * @lockout_recovery Time to wait after a lockout 563 * 564 * Return: code of the operation 565 */ 566 u32 tpm2_dam_parameters(struct udevice *dev, const char *pw, 567 const ssize_t pw_sz, unsigned int max_tries, 568 unsigned int recovery_time, 569 unsigned int lockout_recovery); 570 571 /** 572 * Issue a TPM2_HierarchyChangeAuth command. 573 * 574 * @dev TPM device 575 * @handle Handle 576 * @newpw New password 577 * @newpw_sz Length of the new password 578 * @oldpw Old password 579 * @oldpw_sz Length of the old password 580 * 581 * Return: code of the operation 582 */ 583 int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw, 584 const ssize_t newpw_sz, const char *oldpw, 585 const ssize_t oldpw_sz); 586 587 /** 588 * Issue a TPM_PCR_SetAuthPolicy command. 589 * 590 * @dev TPM device 591 * @pw Platform password 592 * @pw_sz Length of the password 593 * @index Index of the PCR 594 * @digest New key to access the PCR 595 * 596 * Return: code of the operation 597 */ 598 u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw, 599 const ssize_t pw_sz, u32 index, const char *key); 600 601 /** 602 * Issue a TPM_PCR_SetAuthValue command. 603 * 604 * @dev TPM device 605 * @pw Platform password 606 * @pw_sz Length of the password 607 * @index Index of the PCR 608 * @digest New key to access the PCR 609 * @key_sz Length of the new key 610 * 611 * Return: code of the operation 612 */ 613 u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw, 614 const ssize_t pw_sz, u32 index, const char *key, 615 const ssize_t key_sz); 616 617 /** 618 * Issue a TPM2_GetRandom command. 619 * 620 * @dev TPM device 621 * @param data output buffer for the random bytes 622 * @param count size of output buffer 623 * 624 * Return: return code of the operation 625 */ 626 u32 tpm2_get_random(struct udevice *dev, void *data, u32 count); 627 628 /** 629 * Lock data in the TPM 630 * 631 * Once locked the data cannot be written until after a reboot 632 * 633 * @dev TPM device 634 * @index Index of data to lock 635 * Return: code of the operation 636 */ 637 u32 tpm2_write_lock(struct udevice *dev, u32 index); 638 639 /** 640 * Disable access to any platform data 641 * 642 * This can be called to close off access to the firmware data in the data, 643 * before calling the kernel. 644 * 645 * @dev TPM device 646 * Return: code of the operation 647 */ 648 u32 tpm2_disable_platform_hierarchy(struct udevice *dev); 649 650 /** 651 * submit user specified data to the TPM and get response 652 * 653 * @dev TPM device 654 * @sendbuf: Buffer of the data to send 655 * @recvbuf: Buffer to save the response to 656 * @recv_size: Pointer to the size of the response buffer 657 * 658 * Return: code of the operation 659 */ 660 u32 tpm2_submit_command(struct udevice *dev, const u8 *sendbuf, 661 u8 *recvbuf, size_t *recv_size); 662 663 /** 664 * tpm_cr50_report_state() - Report the Cr50 internal state 665 * 666 * @dev: TPM device 667 * @vendor_cmd: Vendor command number to send 668 * @vendor_subcmd: Vendor sub-command number to send 669 * @recvbuf: Buffer to save the response to 670 * @recv_size: Pointer to the size of the response buffer 671 * Return: result of the operation 672 */ 673 u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd, 674 u8 *recvbuf, size_t *recv_size); 675 676 /** 677 * tpm2_enable_nvcommits() - Tell TPM to commit NV data immediately 678 * 679 * For Chromium OS verified boot, we may reboot or reset at different times, 680 * possibly leaving non-volatile data unwritten by the TPM. 681 * 682 * This vendor command is used to indicate that non-volatile data should be 683 * written to its store immediately. 684 * 685 * @dev TPM device 686 * @vendor_cmd: Vendor command number to send 687 * @vendor_subcmd: Vendor sub-command number to send 688 * Return: result of the operation 689 */ 690 u32 tpm2_enable_nvcommits(struct udevice *dev, uint vendor_cmd, 691 uint vendor_subcmd); 692 693 /** 694 * tpm2_auto_start() - start up the TPM and perform selftests. 695 * If a testable function has not been tested and is 696 * requested the TPM2 will return TPM_RC_NEEDS_TEST. 697 * 698 * @param dev TPM device 699 * Return: TPM2_RC_TESTING, if TPM2 self-test is in progress. 700 * TPM2_RC_SUCCESS, if testing of all functions is complete without 701 * functional failures. 702 * TPM2_RC_FAILURE, if any test failed. 703 * TPM2_RC_INITIALIZE, if the TPM has not gone through the Startup 704 * sequence 705 706 */ 707 u32 tpm2_auto_start(struct udevice *dev); 708 709 #endif /* __TPM_V2_H */ 710