1
2
3
4
5
6
7#include <common.h>
8#include <dm.h>
9#include <tpm-common.h>
10#include <tpm-v2.h>
11#include <linux/bitops.h>
12#include "tpm-utils.h"
13
14u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode)
15{
16 const u8 command_v2[12] = {
17 tpm_u16(TPM2_ST_NO_SESSIONS),
18 tpm_u32(12),
19 tpm_u32(TPM2_CC_STARTUP),
20 tpm_u16(mode),
21 };
22 int ret;
23
24
25
26
27
28 ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
29 if (ret && ret != TPM2_RC_INITIALIZE)
30 return ret;
31
32 return 0;
33}
34
35u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test)
36{
37 const u8 command_v2[12] = {
38 tpm_u16(TPM2_ST_NO_SESSIONS),
39 tpm_u32(11),
40 tpm_u32(TPM2_CC_SELF_TEST),
41 full_test,
42 };
43
44 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
45}
46
47u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
48 const ssize_t pw_sz)
49{
50
51 uint offset = 27;
52 u8 command_v2[COMMAND_BUFFER_SIZE] = {
53 tpm_u16(TPM2_ST_SESSIONS),
54 tpm_u32(offset + pw_sz),
55 tpm_u32(TPM2_CC_CLEAR),
56
57
58 tpm_u32(handle),
59
60
61 tpm_u32(9 + pw_sz),
62 tpm_u32(TPM2_RS_PW),
63 tpm_u16(0),
64
65 0,
66 tpm_u16(pw_sz),
67
68 };
69 int ret;
70
71
72
73
74
75 ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
76 offset, pw, pw_sz);
77 offset += pw_sz;
78 if (ret)
79 return TPM_LIB_ERROR;
80
81 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
82}
83
84u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
85 size_t space_size, u32 nv_attributes,
86 const u8 *nv_policy, size_t nv_policy_size)
87{
88
89
90
91
92 uint offset = 10 + 8 + 13 + 14;
93 u8 command_v2[COMMAND_BUFFER_SIZE] = {
94
95 tpm_u16(TPM2_ST_SESSIONS),
96 tpm_u32(offset + nv_policy_size),
97 tpm_u32(TPM2_CC_NV_DEFINE_SPACE),
98
99
100 tpm_u32(TPM2_RH_PLATFORM),
101
102
103 tpm_u32(9),
104 tpm_u32(TPM2_RS_PW),
105 tpm_u16(0),
106 0,
107 tpm_u16(0),
108
109
110 tpm_u16(12 + nv_policy_size),
111 tpm_u32(space_index),
112 tpm_u16(TPM2_ALG_SHA256),
113 tpm_u32(nv_attributes),
114 tpm_u16(nv_policy_size),
115
116 };
117 int ret;
118
119
120
121
122
123 ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
124 offset, nv_policy, nv_policy_size);
125 if (ret)
126 return TPM_LIB_ERROR;
127
128 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
129}
130
131u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
132 const u8 *digest, u32 digest_len)
133{
134
135 uint offset = 33;
136 u8 command_v2[COMMAND_BUFFER_SIZE] = {
137 tpm_u16(TPM2_ST_SESSIONS),
138 tpm_u32(offset + digest_len),
139 tpm_u32(TPM2_CC_PCR_EXTEND),
140
141
142 tpm_u32(index),
143
144
145 tpm_u32(9),
146 tpm_u32(TPM2_RS_PW),
147 tpm_u16(0),
148
149 0,
150 tpm_u16(0),
151
152
153
154 tpm_u32(1),
155 tpm_u16(algorithm),
156
157 };
158 int ret;
159
160
161
162
163
164 ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
165 offset, digest, digest_len);
166 if (ret)
167 return TPM_LIB_ERROR;
168
169 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
170}
171
172u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count)
173{
174 u8 command_v2[COMMAND_BUFFER_SIZE] = {
175
176 tpm_u16(TPM2_ST_SESSIONS),
177 tpm_u32(10 + 8 + 4 + 9 + 4),
178 tpm_u32(TPM2_CC_NV_READ),
179
180
181 tpm_u32(TPM2_RH_PLATFORM),
182 tpm_u32(HR_NV_INDEX + index),
183
184
185 tpm_u32(9),
186 tpm_u32(TPM2_RS_PW),
187 tpm_u16(0),
188
189 0,
190 tpm_u16(0),
191
192
193 tpm_u16(count),
194 tpm_u16(0),
195 };
196 size_t response_len = COMMAND_BUFFER_SIZE;
197 u8 response[COMMAND_BUFFER_SIZE];
198 int ret;
199 u16 tag;
200 u32 size, code;
201
202 ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
203 if (ret)
204 return log_msg_ret("read", ret);
205 if (unpack_byte_string(response, response_len, "wdds",
206 0, &tag, 2, &size, 6, &code,
207 16, data, count))
208 return TPM_LIB_ERROR;
209
210 return 0;
211}
212
213u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
214 u32 count)
215{
216 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
217 uint offset = 10 + 8 + 4 + 9 + 2;
218 uint len = offset + count + 2;
219
220 u32 auth = priv->plat_hier_disabled ? HR_NV_INDEX + index :
221 TPM2_RH_PLATFORM;
222 u8 command_v2[COMMAND_BUFFER_SIZE] = {
223
224 tpm_u16(TPM2_ST_SESSIONS),
225 tpm_u32(len),
226 tpm_u32(TPM2_CC_NV_WRITE),
227
228
229 tpm_u32(auth),
230 tpm_u32(HR_NV_INDEX + index),
231
232
233 tpm_u32(9),
234 tpm_u32(TPM2_RS_PW),
235 tpm_u16(0),
236
237 0,
238 tpm_u16(0),
239
240
241 tpm_u16(count),
242 };
243 size_t response_len = COMMAND_BUFFER_SIZE;
244 u8 response[COMMAND_BUFFER_SIZE];
245 int ret;
246
247 ret = pack_byte_string(command_v2, sizeof(command_v2), "sw",
248 offset, data, count,
249 offset + count, 0);
250 if (ret)
251 return TPM_LIB_ERROR;
252
253 return tpm_sendrecv_command(dev, command_v2, response, &response_len);
254}
255
256u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
257 void *data, unsigned int *updates)
258{
259 u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
260 u8 command_v2[COMMAND_BUFFER_SIZE] = {
261 tpm_u16(TPM2_ST_NO_SESSIONS),
262 tpm_u32(17 + idx_array_sz),
263 tpm_u32(TPM2_CC_PCR_READ),
264
265
266 tpm_u32(1),
267 tpm_u16(TPM2_ALG_SHA256),
268 idx_array_sz,
269
270 };
271 size_t response_len = COMMAND_BUFFER_SIZE;
272 u8 response[COMMAND_BUFFER_SIZE];
273 unsigned int pcr_sel_idx = idx / 8;
274 u8 pcr_sel_bit = BIT(idx % 8);
275 unsigned int counter = 0;
276 int ret;
277
278 if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b",
279 17 + pcr_sel_idx, pcr_sel_bit))
280 return TPM_LIB_ERROR;
281
282 ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
283 if (ret)
284 return ret;
285
286 if (unpack_byte_string(response, response_len, "ds",
287 10, &counter,
288 response_len - TPM2_DIGEST_LEN, data,
289 TPM2_DIGEST_LEN))
290 return TPM_LIB_ERROR;
291
292 if (updates)
293 *updates = counter;
294
295 return 0;
296}
297
298u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
299 void *buf, size_t prop_count)
300{
301 u8 command_v2[COMMAND_BUFFER_SIZE] = {
302 tpm_u16(TPM2_ST_NO_SESSIONS),
303 tpm_u32(22),
304 tpm_u32(TPM2_CC_GET_CAPABILITY),
305
306 tpm_u32(capability),
307 tpm_u32(property),
308 tpm_u32(prop_count),
309 };
310 u8 response[COMMAND_BUFFER_SIZE];
311 size_t response_len = COMMAND_BUFFER_SIZE;
312 unsigned int properties_off;
313 int ret;
314
315 ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
316 if (ret)
317 return ret;
318
319
320
321
322
323
324 properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
325 sizeof(u8) + sizeof(u32);
326 memcpy(buf, &response[properties_off], response_len - properties_off);
327
328 return 0;
329}
330
331u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz)
332{
333 u8 command_v2[COMMAND_BUFFER_SIZE] = {
334 tpm_u16(TPM2_ST_SESSIONS),
335 tpm_u32(27 + pw_sz),
336 tpm_u32(TPM2_CC_DAM_RESET),
337
338
339 tpm_u32(TPM2_RH_LOCKOUT),
340
341
342 tpm_u32(9 + pw_sz),
343 tpm_u32(TPM2_RS_PW),
344 tpm_u16(0),
345
346 0,
347 tpm_u16(pw_sz),
348
349 };
350 unsigned int offset = 27;
351 int ret;
352
353
354
355
356
357 ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
358 offset, pw, pw_sz);
359 offset += pw_sz;
360 if (ret)
361 return TPM_LIB_ERROR;
362
363 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
364}
365
366u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
367 const ssize_t pw_sz, unsigned int max_tries,
368 unsigned int recovery_time,
369 unsigned int lockout_recovery)
370{
371 u8 command_v2[COMMAND_BUFFER_SIZE] = {
372 tpm_u16(TPM2_ST_SESSIONS),
373 tpm_u32(27 + pw_sz + 12),
374 tpm_u32(TPM2_CC_DAM_PARAMETERS),
375
376
377 tpm_u32(TPM2_RH_LOCKOUT),
378
379
380 tpm_u32(9 + pw_sz),
381 tpm_u32(TPM2_RS_PW),
382 tpm_u16(0),
383
384 0,
385 tpm_u16(pw_sz),
386
387
388
389
390
391
392 };
393 unsigned int offset = 27;
394 int ret;
395
396
397
398
399
400
401
402
403 ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd",
404 offset, pw, pw_sz,
405 offset + pw_sz, max_tries,
406 offset + pw_sz + 4, recovery_time,
407 offset + pw_sz + 8, lockout_recovery);
408 offset += pw_sz + 12;
409 if (ret)
410 return TPM_LIB_ERROR;
411
412 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
413}
414
415int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
416 const ssize_t newpw_sz, const char *oldpw,
417 const ssize_t oldpw_sz)
418{
419 unsigned int offset = 27;
420 u8 command_v2[COMMAND_BUFFER_SIZE] = {
421 tpm_u16(TPM2_ST_SESSIONS),
422 tpm_u32(offset + oldpw_sz + 2 + newpw_sz),
423 tpm_u32(TPM2_CC_HIERCHANGEAUTH),
424
425
426 tpm_u32(handle),
427
428
429 tpm_u32(9 + oldpw_sz),
430 tpm_u32(TPM2_RS_PW),
431 tpm_u16(0),
432
433 0,
434 tpm_u16(oldpw_sz)
435
436
437
438
439
440 };
441 int ret;
442
443
444
445
446
447
448
449 ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
450 offset, oldpw, oldpw_sz,
451 offset + oldpw_sz, newpw_sz,
452 offset + oldpw_sz + 2, newpw, newpw_sz);
453 offset += oldpw_sz + 2 + newpw_sz;
454 if (ret)
455 return TPM_LIB_ERROR;
456
457 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
458}
459
460u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
461 const ssize_t pw_sz, u32 index, const char *key)
462{
463 u8 command_v2[COMMAND_BUFFER_SIZE] = {
464 tpm_u16(TPM2_ST_SESSIONS),
465 tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN),
466 tpm_u32(TPM2_CC_PCR_SETAUTHPOL),
467
468
469 tpm_u32(TPM2_RH_PLATFORM),
470
471
472 tpm_u32(9 + pw_sz),
473 tpm_u32(TPM2_RS_PW),
474 tpm_u16(0),
475
476 0,
477 tpm_u16(pw_sz)
478
479
480
481
482
483
484
485
486
487
488
489 };
490 unsigned int offset = 27;
491 int ret;
492
493
494
495
496
497
498
499
500
501 ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd",
502 offset, pw, pw_sz,
503 offset + pw_sz, TPM2_DIGEST_LEN,
504 offset + pw_sz + 2, key, TPM2_DIGEST_LEN,
505 offset + pw_sz + 2 + TPM2_DIGEST_LEN,
506 TPM2_ALG_SHA256,
507 offset + pw_sz + 4 + TPM2_DIGEST_LEN, index);
508 offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4;
509 if (ret)
510 return TPM_LIB_ERROR;
511
512 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
513}
514
515u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
516 const ssize_t pw_sz, u32 index, const char *key,
517 const ssize_t key_sz)
518{
519 u8 command_v2[COMMAND_BUFFER_SIZE] = {
520 tpm_u16(TPM2_ST_SESSIONS),
521 tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN),
522 tpm_u32(TPM2_CC_PCR_SETAUTHVAL),
523
524
525 tpm_u32(index),
526
527
528 tpm_u32(9 + pw_sz),
529 tpm_u32(TPM2_RS_PW),
530 tpm_u16(0),
531
532 0,
533 tpm_u16(pw_sz),
534
535
536
537
538
539 };
540 unsigned int offset = 27;
541 int ret;
542
543
544
545
546
547
548
549
550 ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
551 offset, pw, pw_sz,
552 offset + pw_sz, key_sz,
553 offset + pw_sz + 2, key, key_sz);
554 offset += pw_sz + 2 + key_sz;
555 if (ret)
556 return TPM_LIB_ERROR;
557
558 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
559}
560
561u32 tpm2_get_random(struct udevice *dev, void *data, u32 count)
562{
563 const u8 command_v2[10] = {
564 tpm_u16(TPM2_ST_NO_SESSIONS),
565 tpm_u32(12),
566 tpm_u32(TPM2_CC_GET_RANDOM),
567 };
568 u8 buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];
569
570 const size_t data_size_offset = 10;
571 const size_t data_offset = 12;
572 size_t response_length = sizeof(response);
573 u32 data_size;
574 u8 *out = data;
575
576 while (count > 0) {
577 u32 this_bytes = min((size_t)count,
578 sizeof(response) - data_offset);
579 u32 err;
580
581 if (pack_byte_string(buf, sizeof(buf), "sw",
582 0, command_v2, sizeof(command_v2),
583 sizeof(command_v2), this_bytes))
584 return TPM_LIB_ERROR;
585 err = tpm_sendrecv_command(dev, buf, response,
586 &response_length);
587 if (err)
588 return err;
589 if (unpack_byte_string(response, response_length, "w",
590 data_size_offset, &data_size))
591 return TPM_LIB_ERROR;
592 if (data_size > this_bytes)
593 return TPM_LIB_ERROR;
594 if (unpack_byte_string(response, response_length, "s",
595 data_offset, out, data_size))
596 return TPM_LIB_ERROR;
597
598 count -= data_size;
599 out += data_size;
600 }
601
602 return 0;
603}
604
605u32 tpm2_write_lock(struct udevice *dev, u32 index)
606{
607 u8 command_v2[COMMAND_BUFFER_SIZE] = {
608
609 tpm_u16(TPM2_ST_SESSIONS),
610 tpm_u32(10 + 8 + 13),
611 tpm_u32(TPM2_CC_NV_WRITELOCK),
612
613
614 tpm_u32(TPM2_RH_PLATFORM),
615 tpm_u32(HR_NV_INDEX + index),
616
617
618 tpm_u32(9),
619 tpm_u32(TPM2_RS_PW),
620 tpm_u16(0),
621 0,
622 tpm_u16(0),
623 };
624
625 return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
626}
627
628u32 tpm2_disable_platform_hierarchy(struct udevice *dev)
629{
630 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
631 u8 command_v2[COMMAND_BUFFER_SIZE] = {
632
633 tpm_u16(TPM2_ST_SESSIONS),
634 tpm_u32(10 + 4 + 13 + 5),
635 tpm_u32(TPM2_CC_HIER_CONTROL),
636
637
638 tpm_u32(TPM2_RH_PLATFORM),
639
640
641 tpm_u32(9),
642 tpm_u32(TPM2_RS_PW),
643 tpm_u16(0),
644 0,
645 tpm_u16(0),
646
647
648 tpm_u32(TPM2_RH_PLATFORM),
649 0,
650 };
651 int ret;
652
653 ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
654 log_info("ret=%s, %x\n", dev->name, ret);
655 if (ret)
656 return ret;
657
658 priv->plat_hier_disabled = true;
659
660 return 0;
661}
662