1
2
3
4
5
6
7
8
9
10
11
12
13
14#ifndef __TPM_V2_H
15#define __TPM_V2_H
16
17#include <tpm-common.h>
18
19struct udevice;
20
21#define TPM2_DIGEST_LEN 32
22
23#define TPM2_SHA1_DIGEST_SIZE 20
24#define TPM2_SHA256_DIGEST_SIZE 32
25#define TPM2_SHA384_DIGEST_SIZE 48
26#define TPM2_SHA512_DIGEST_SIZE 64
27#define TPM2_SM3_256_DIGEST_SIZE 32
28
29#define TPM2_MAX_PCRS 32
30#define TPM2_PCR_SELECT_MAX ((TPM2_MAX_PCRS + 7) / 8)
31#define TPM2_MAX_CAP_BUFFER 1024
32#define TPM2_MAX_TPM_PROPERTIES ((TPM2_MAX_CAP_BUFFER - sizeof(u32) - \
33 sizeof(u32)) / sizeof(struct tpms_tagged_property))
34
35#define TPM2_HDR_LEN 10
36
37
38
39
40
41
42
43
44#define TPM2_NUM_PCR_BANKS 16
45
46
47#define TPM2_CAP_PCRS 0x00000005U
48#define TPM2_CAP_TPM_PROPERTIES 0x00000006U
49
50
51#define TPM2_PT_GROUP (u32)(0x00000100)
52#define TPM2_PT_FIXED (u32)(TPM2_PT_GROUP * 1)
53#define TPM2_PT_MANUFACTURER (u32)(TPM2_PT_FIXED + 5)
54#define TPM2_PT_PCR_COUNT (u32)(TPM2_PT_FIXED + 18)
55#define TPM2_PT_MAX_COMMAND_SIZE (u32)(TPM2_PT_FIXED + 30)
56#define TPM2_PT_MAX_RESPONSE_SIZE (u32)(TPM2_PT_FIXED + 31)
57
58
59
60
61
62
63#define EV_POST_CODE ((u32)0x00000001)
64#define EV_NO_ACTION ((u32)0x00000003)
65#define EV_SEPARATOR ((u32)0x00000004)
66#define EV_ACTION ((u32)0x00000005)
67#define EV_TAG ((u32)0x00000006)
68#define EV_S_CRTM_CONTENTS ((u32)0x00000007)
69#define EV_S_CRTM_VERSION ((u32)0x00000008)
70#define EV_CPU_MICROCODE ((u32)0x00000009)
71#define EV_PLATFORM_CONFIG_FLAGS ((u32)0x0000000A)
72#define EV_TABLE_OF_DEVICES ((u32)0x0000000B)
73#define EV_COMPACT_HASH ((u32)0x0000000C)
74
75
76
77
78
79
80#define EV_EFI_EVENT_BASE ((u32)0x80000000)
81#define EV_EFI_VARIABLE_DRIVER_CONFIG ((u32)0x80000001)
82#define EV_EFI_VARIABLE_BOOT ((u32)0x80000002)
83#define EV_EFI_BOOT_SERVICES_APPLICATION ((u32)0x80000003)
84#define EV_EFI_BOOT_SERVICES_DRIVER ((u32)0x80000004)
85#define EV_EFI_RUNTIME_SERVICES_DRIVER ((u32)0x80000005)
86#define EV_EFI_GPT_EVENT ((u32)0x80000006)
87#define EV_EFI_ACTION ((u32)0x80000007)
88#define EV_EFI_PLATFORM_FIRMWARE_BLOB ((u32)0x80000008)
89#define EV_EFI_HANDOFF_TABLES ((u32)0x80000009)
90#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 ((u32)0x8000000A)
91#define EV_EFI_HANDOFF_TABLES2 ((u32)0x8000000B)
92#define EV_EFI_VARIABLE_BOOT2 ((u32)0x8000000C)
93#define EV_EFI_HCRTM_EVENT ((u32)0x80000010)
94#define EV_EFI_VARIABLE_AUTHORITY ((u32)0x800000E0)
95#define EV_EFI_SPDM_FIRMWARE_BLOB ((u32)0x800000E1)
96#define EV_EFI_SPDM_FIRMWARE_CONFIG ((u32)0x800000E2)
97
98#define EFI_CALLING_EFI_APPLICATION \
99 "Calling EFI Application from Boot Option"
100#define EFI_RETURNING_FROM_EFI_APPLICATION \
101 "Returning from EFI Application from Boot Option"
102#define EFI_EXIT_BOOT_SERVICES_INVOCATION \
103 "Exit Boot Services Invocation"
104#define EFI_EXIT_BOOT_SERVICES_FAILED \
105 "Exit Boot Services Returned with Failure"
106#define EFI_EXIT_BOOT_SERVICES_SUCCEEDED \
107 "Exit Boot Services Returned with Success"
108
109
110struct tpms_tagged_property {
111 u32 property;
112 u32 value;
113} __packed;
114
115
116struct tpms_pcr_selection {
117 u16 hash;
118 u8 size_of_select;
119 u8 pcr_select[TPM2_PCR_SELECT_MAX];
120} __packed;
121
122
123struct tpml_pcr_selection {
124 u32 count;
125 struct tpms_pcr_selection selection[TPM2_NUM_PCR_BANKS];
126} __packed;
127
128
129struct tpml_tagged_tpm_property {
130 u32 count;
131 struct tpms_tagged_property tpm_property[TPM2_MAX_TPM_PROPERTIES];
132} __packed;
133
134
135union tpmu_capabilities {
136
137
138
139
140 struct tpml_pcr_selection assigned_pcr;
141 struct tpml_tagged_tpm_property tpm_properties;
142} __packed;
143
144
145struct tpms_capability_data {
146 u32 capability;
147 union tpmu_capabilities data;
148} __packed;
149
150
151
152
153
154
155
156
157
158
159struct tcg_pcr_event {
160 u32 pcr_index;
161 u32 event_type;
162 u8 digest[TPM2_SHA1_DIGEST_SIZE];
163 u32 event_size;
164 u8 event[];
165} __packed;
166
167
168
169
170union tmpu_ha {
171 u8 sha1[TPM2_SHA1_DIGEST_SIZE];
172 u8 sha256[TPM2_SHA256_DIGEST_SIZE];
173 u8 sm3_256[TPM2_SM3_256_DIGEST_SIZE];
174 u8 sha384[TPM2_SHA384_DIGEST_SIZE];
175 u8 sha512[TPM2_SHA512_DIGEST_SIZE];
176} __packed;
177
178
179
180
181
182
183
184struct tpmt_ha {
185 u16 hash_alg;
186 union tmpu_ha digest;
187} __packed;
188
189
190
191
192
193
194
195struct tpml_digest_values {
196 u32 count;
197 struct tpmt_ha digests[TPM2_NUM_PCR_BANKS];
198} __packed;
199
200
201
202
203
204
205
206
207
208
209struct tcg_pcr_event2 {
210 u32 pcr_index;
211 u32 event_type;
212 struct tpml_digest_values digests;
213 u32 event_size;
214 u8 event[];
215} __packed;
216
217
218
219
220
221
222
223enum tpm2_structures {
224 TPM2_ST_NO_SESSIONS = 0x8001,
225 TPM2_ST_SESSIONS = 0x8002,
226};
227
228
229
230
231enum tpm2_yes_no {
232 TPMI_YES = 1,
233 TPMI_NO = 0,
234};
235
236
237
238
239
240
241
242enum tpm2_startup_types {
243 TPM2_SU_CLEAR = 0x0000,
244 TPM2_SU_STATE = 0x0001,
245};
246
247
248
249
250
251
252
253
254
255
256enum tpm2_handles {
257 TPM2_RH_OWNER = 0x40000001,
258 TPM2_RS_PW = 0x40000009,
259 TPM2_RH_LOCKOUT = 0x4000000A,
260 TPM2_RH_ENDORSEMENT = 0x4000000B,
261 TPM2_RH_PLATFORM = 0x4000000C,
262};
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281enum tpm2_command_codes {
282 TPM2_CC_STARTUP = 0x0144,
283 TPM2_CC_SELF_TEST = 0x0143,
284 TPM2_CC_HIER_CONTROL = 0x0121,
285 TPM2_CC_CLEAR = 0x0126,
286 TPM2_CC_CLEARCONTROL = 0x0127,
287 TPM2_CC_HIERCHANGEAUTH = 0x0129,
288 TPM2_CC_NV_DEFINE_SPACE = 0x012a,
289 TPM2_CC_PCR_SETAUTHPOL = 0x012C,
290 TPM2_CC_NV_WRITE = 0x0137,
291 TPM2_CC_NV_WRITELOCK = 0x0138,
292 TPM2_CC_DAM_RESET = 0x0139,
293 TPM2_CC_DAM_PARAMETERS = 0x013A,
294 TPM2_CC_NV_READ = 0x014E,
295 TPM2_CC_GET_CAPABILITY = 0x017A,
296 TPM2_CC_GET_RANDOM = 0x017B,
297 TPM2_CC_PCR_READ = 0x017E,
298 TPM2_CC_PCR_EXTEND = 0x0182,
299 TPM2_CC_PCR_SETAUTHVAL = 0x0183,
300};
301
302
303
304
305enum tpm2_return_codes {
306 TPM2_RC_SUCCESS = 0x0000,
307 TPM2_RC_BAD_TAG = 0x001E,
308 TPM2_RC_FMT1 = 0x0080,
309 TPM2_RC_HASH = TPM2_RC_FMT1 + 0x0003,
310 TPM2_RC_VALUE = TPM2_RC_FMT1 + 0x0004,
311 TPM2_RC_SIZE = TPM2_RC_FMT1 + 0x0015,
312 TPM2_RC_BAD_AUTH = TPM2_RC_FMT1 + 0x0022,
313 TPM2_RC_HANDLE = TPM2_RC_FMT1 + 0x000B,
314 TPM2_RC_VER1 = 0x0100,
315 TPM2_RC_INITIALIZE = TPM2_RC_VER1 + 0x0000,
316 TPM2_RC_FAILURE = TPM2_RC_VER1 + 0x0001,
317 TPM2_RC_DISABLED = TPM2_RC_VER1 + 0x0020,
318 TPM2_RC_AUTH_MISSING = TPM2_RC_VER1 + 0x0025,
319 TPM2_RC_COMMAND_CODE = TPM2_RC_VER1 + 0x0043,
320 TPM2_RC_AUTHSIZE = TPM2_RC_VER1 + 0x0044,
321 TPM2_RC_AUTH_CONTEXT = TPM2_RC_VER1 + 0x0045,
322 TPM2_RC_NV_DEFINED = TPM2_RC_VER1 + 0x004c,
323 TPM2_RC_NEEDS_TEST = TPM2_RC_VER1 + 0x0053,
324 TPM2_RC_WARN = 0x0900,
325 TPM2_RC_TESTING = TPM2_RC_WARN + 0x000A,
326 TPM2_RC_REFERENCE_H0 = TPM2_RC_WARN + 0x0010,
327 TPM2_RC_LOCKOUT = TPM2_RC_WARN + 0x0021,
328};
329
330
331
332
333enum tpm2_algorithms {
334 TPM2_ALG_SHA1 = 0x04,
335 TPM2_ALG_XOR = 0x0A,
336 TPM2_ALG_SHA256 = 0x0B,
337 TPM2_ALG_SHA384 = 0x0C,
338 TPM2_ALG_SHA512 = 0x0D,
339 TPM2_ALG_NULL = 0x10,
340 TPM2_ALG_SM3_256 = 0x12,
341};
342
343
344enum tpm_index_attrs {
345 TPMA_NV_PPWRITE = 1UL << 0,
346 TPMA_NV_OWNERWRITE = 1UL << 1,
347 TPMA_NV_AUTHWRITE = 1UL << 2,
348 TPMA_NV_POLICYWRITE = 1UL << 3,
349 TPMA_NV_COUNTER = 1UL << 4,
350 TPMA_NV_BITS = 1UL << 5,
351 TPMA_NV_EXTEND = 1UL << 6,
352 TPMA_NV_POLICY_DELETE = 1UL << 10,
353 TPMA_NV_WRITELOCKED = 1UL << 11,
354 TPMA_NV_WRITEALL = 1UL << 12,
355 TPMA_NV_WRITEDEFINE = 1UL << 13,
356 TPMA_NV_WRITE_STCLEAR = 1UL << 14,
357 TPMA_NV_GLOBALLOCK = 1UL << 15,
358 TPMA_NV_PPREAD = 1UL << 16,
359 TPMA_NV_OWNERREAD = 1UL << 17,
360 TPMA_NV_AUTHREAD = 1UL << 18,
361 TPMA_NV_POLICYREAD = 1UL << 19,
362 TPMA_NV_NO_DA = 1UL << 25,
363 TPMA_NV_ORDERLY = 1UL << 26,
364 TPMA_NV_CLEAR_STCLEAR = 1UL << 27,
365 TPMA_NV_READLOCKED = 1UL << 28,
366 TPMA_NV_WRITTEN = 1UL << 29,
367 TPMA_NV_PLATFORMCREATE = 1UL << 30,
368 TPMA_NV_READ_STCLEAR = 1UL << 31,
369
370 TPMA_NV_MASK_READ = TPMA_NV_PPREAD | TPMA_NV_OWNERREAD |
371 TPMA_NV_AUTHREAD | TPMA_NV_POLICYREAD,
372 TPMA_NV_MASK_WRITE = TPMA_NV_PPWRITE | TPMA_NV_OWNERWRITE |
373 TPMA_NV_AUTHWRITE | TPMA_NV_POLICYWRITE,
374};
375
376enum {
377 TPM_ACCESS_VALID = 1 << 7,
378 TPM_ACCESS_ACTIVE_LOCALITY = 1 << 5,
379 TPM_ACCESS_REQUEST_PENDING = 1 << 2,
380 TPM_ACCESS_REQUEST_USE = 1 << 1,
381 TPM_ACCESS_ESTABLISHMENT = 1 << 0,
382};
383
384enum {
385 TPM_STS_FAMILY_SHIFT = 26,
386 TPM_STS_FAMILY_MASK = 0x3 << TPM_STS_FAMILY_SHIFT,
387 TPM_STS_FAMILY_TPM2 = 1 << TPM_STS_FAMILY_SHIFT,
388 TPM_STS_RESE_TESTABLISMENT_BIT = 1 << 25,
389 TPM_STS_COMMAND_CANCEL = 1 << 24,
390 TPM_STS_BURST_COUNT_SHIFT = 8,
391 TPM_STS_BURST_COUNT_MASK = 0xffff << TPM_STS_BURST_COUNT_SHIFT,
392 TPM_STS_VALID = 1 << 7,
393 TPM_STS_COMMAND_READY = 1 << 6,
394 TPM_STS_GO = 1 << 5,
395 TPM_STS_DATA_AVAIL = 1 << 4,
396 TPM_STS_DATA_EXPECT = 1 << 3,
397 TPM_STS_SELF_TEST_DONE = 1 << 2,
398 TPM_STS_RESPONSE_RETRY = 1 << 1,
399 TPM_STS_READ_ZERO = 0x23
400};
401
402enum {
403 TPM_CMD_COUNT_OFFSET = 2,
404 TPM_CMD_ORDINAL_OFFSET = 6,
405 TPM_MAX_BUF_SIZE = 1260,
406};
407
408enum {
409
410 TPM_HT_PCR = 0,
411 TPM_HT_NV_INDEX,
412 TPM_HT_HMAC_SESSION,
413 TPM_HT_POLICY_SESSION,
414
415 HR_SHIFT = 24,
416 HR_PCR = TPM_HT_PCR << HR_SHIFT,
417 HR_HMAC_SESSION = TPM_HT_HMAC_SESSION << HR_SHIFT,
418 HR_POLICY_SESSION = TPM_HT_POLICY_SESSION << HR_SHIFT,
419 HR_NV_INDEX = TPM_HT_NV_INDEX << HR_SHIFT,
420};
421
422
423
424
425
426
427
428
429
430u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode);
431
432
433
434
435
436
437
438
439
440u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test);
441
442
443
444
445
446
447
448
449
450
451
452u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
453 const ssize_t pw_sz);
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468u32 tpm2_nv_define_space(struct udevice *dev, u32 space_index,
469 size_t space_size, u32 nv_attributes,
470 const u8 *nv_policy, size_t nv_policy_size);
471
472
473
474
475
476
477
478
479
480
481
482
483u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
484 const u8 *digest, u32 digest_len);
485
486
487
488
489
490
491
492
493
494
495u32 tpm2_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);
496
497
498
499
500
501
502
503
504
505
506u32 tpm2_nv_write_value(struct udevice *dev, u32 index, const void *data,
507 u32 count);
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
523 u16 algorithm, void *data, u32 digest_len,
524 unsigned int *updates);
525
526
527
528
529
530
531
532
533
534
535
536
537
538u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
539 void *buf, size_t prop_count);
540
541
542
543
544
545
546
547
548
549
550u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz);
551
552
553
554
555
556
557
558
559
560
561
562
563
564u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
565 const ssize_t pw_sz, unsigned int max_tries,
566 unsigned int recovery_time,
567 unsigned int lockout_recovery);
568
569
570
571
572
573
574
575
576
577
578
579
580
581int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
582 const ssize_t newpw_sz, const char *oldpw,
583 const ssize_t oldpw_sz);
584
585
586
587
588
589
590
591
592
593
594
595
596u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
597 const ssize_t pw_sz, u32 index, const char *key);
598
599
600
601
602
603
604
605
606
607
608
609
610
611u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
612 const ssize_t pw_sz, u32 index, const char *key,
613 const ssize_t key_sz);
614
615
616
617
618
619
620
621
622
623
624u32 tpm2_get_random(struct udevice *dev, void *data, u32 count);
625
626
627
628
629
630
631
632
633
634
635u32 tpm2_write_lock(struct udevice *dev, u32 index);
636
637
638
639
640
641
642
643
644
645
646u32 tpm2_disable_platform_hierarchy(struct udevice *dev);
647
648
649
650
651
652
653
654
655
656
657
658u32 tpm2_submit_command(struct udevice *dev, const u8 *sendbuf,
659 u8 *recvbuf, size_t *recv_size);
660
661
662
663
664
665
666
667
668
669
670
671u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd,
672 u8 *recvbuf, size_t *recv_size);
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688u32 tpm2_enable_nvcommits(struct udevice *dev, uint vendor_cmd,
689 uint vendor_subcmd);
690
691#endif
692