lib/tpm-v2.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright (c) 2018 Bootlin
   4  * Author: Miquel Raynal <miquel.raynal@bootlin.com>
   5  */
   6
   7 #include <common.h>
   8 #include <dm.h>
   9 #include <tpm-common.h>
  10 #include <tpm-v2.h>
  11 #include <linux/bitops.h>
  12 #include "tpm-utils.h"
  13
  14 u32 tpm2_startup(struct udevice *dev, enum tpm2_startup_types mode)
  15 {
  16         const u8 command_v2[12] = {
  17                 tpm_u16(TPM2_ST_NO_SESSIONS),
  18                 tpm_u32(12),
  19                 tpm_u32(TPM2_CC_STARTUP),
  20                 tpm_u16(mode),
  21         };
  22         int ret;
  23
  24         /*
  25          * Note TPM2_Startup command will return RC_SUCCESS the first time,
  26          * but will return RC_INITIALIZE otherwise.
  27          */
  28         ret = tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  29         if (ret && ret != TPM2_RC_INITIALIZE)
  30                 return ret;
  31
  32         return 0;
  33 }
  34
  35 u32 tpm2_self_test(struct udevice *dev, enum tpm2_yes_no full_test)
  36 {
  37         const u8 command_v2[12] = {
  38                 tpm_u16(TPM2_ST_NO_SESSIONS),
  39                 tpm_u32(11),
  40                 tpm_u32(TPM2_CC_SELF_TEST),
  41                 full_test,
  42         };
  43
  44         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  45 }
  46
  47 u32 tpm2_clear(struct udevice *dev, u32 handle, const char *pw,
  48                const ssize_t pw_sz)
  49 {
  50         /* Length of the message header, up to start of password */
  51         uint offset = 27;
  52         u8 command_v2[COMMAND_BUFFER_SIZE] = {
  53                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
  54                 tpm_u32(offset + pw_sz),        /* Length */
  55                 tpm_u32(TPM2_CC_CLEAR),         /* Command code */
  56
  57                 /* HANDLE */
  58                 tpm_u32(handle),                /* TPM resource handle */
  59
  60                 /* AUTH_SESSION */
  61                 tpm_u32(9 + pw_sz),             /* Authorization size */
  62                 tpm_u32(TPM2_RS_PW),            /* Session handle */
  63                 tpm_u16(0),                     /* Size of <nonce> */
  64                                                 /* <nonce> (if any) */
  65                 0,                              /* Attributes: Cont/Excl/Rst */
  66                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
  67                 /* STRING(pw)                      <hmac/password> (if any) */
  68         };
  69         int ret;
  70
  71         /*
  72          * Fill the command structure starting from the first buffer:
  73          *     - the password (if any)
  74          */
  75         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
  76                                offset, pw, pw_sz);
  77         offset += pw_sz;
  78         if (ret)
  79                 return TPM_LIB_ERROR;
  80
  81         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
  82 }
  83
  84 u32 tpm2_pcr_extend(struct udevice *dev, u32 index, u32 algorithm,
  85                     const u8 *digest, u32 digest_len)
  86 {
  87         /* Length of the message header, up to start of digest */
  88         uint offset = 33;
  89         u8 command_v2[COMMAND_BUFFER_SIZE] = {
  90                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
  91                 tpm_u32(offset + digest_len),   /* Length */
  92                 tpm_u32(TPM2_CC_PCR_EXTEND),    /* Command code */
  93
  94                 /* HANDLE */
  95                 tpm_u32(index),                 /* Handle (PCR Index) */
  96
  97                 /* AUTH_SESSION */
  98                 tpm_u32(9),                     /* Authorization size */
  99                 tpm_u32(TPM2_RS_PW),            /* Session handle */
 100                 tpm_u16(0),                     /* Size of <nonce> */
 101                                                 /* <nonce> (if any) */
 102                 0,                              /* Attributes: Cont/Excl/Rst */
 103                 tpm_u16(0),                     /* Size of <hmac/password> */
 104                                                 /* <hmac/password> (if any) */
 105
 106                 /* hashes */
 107                 tpm_u32(1),                     /* Count (number of hashes) */
 108                 tpm_u16(algorithm),     /* Algorithm of the hash */
 109                 /* STRING(digest)                  Digest */
 110         };
 111         int ret;
 112
 113         /*
 114          * Fill the command structure starting from the first buffer:
 115          *     - the digest
 116          */
 117         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
 118                                offset, digest, digest_len);
 119         if (ret)
 120                 return TPM_LIB_ERROR;
 121
 122         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 123 }
 124
 125 u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
 126                   void *data, unsigned int *updates)
 127 {
 128         u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
 129         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 130                 tpm_u16(TPM2_ST_NO_SESSIONS),   /* TAG */
 131                 tpm_u32(17 + idx_array_sz),     /* Length */
 132                 tpm_u32(TPM2_CC_PCR_READ),      /* Command code */
 133
 134                 /* TPML_PCR_SELECTION */
 135                 tpm_u32(1),                     /* Number of selections */
 136                 tpm_u16(TPM2_ALG_SHA256),       /* Algorithm of the hash */
 137                 idx_array_sz,                   /* Array size for selection */
 138                 /* bitmap(idx)                     Selected PCR bitmap */
 139         };
 140         size_t response_len = COMMAND_BUFFER_SIZE;
 141         u8 response[COMMAND_BUFFER_SIZE];
 142         unsigned int pcr_sel_idx = idx / 8;
 143         u8 pcr_sel_bit = BIT(idx % 8);
 144         unsigned int counter = 0;
 145         int ret;
 146
 147         if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b",
 148                              17 + pcr_sel_idx, pcr_sel_bit))
 149                 return TPM_LIB_ERROR;
 150
 151         ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
 152         if (ret)
 153                 return ret;
 154
 155         if (unpack_byte_string(response, response_len, "ds",
 156                                10, &counter,
 157                                response_len - TPM2_DIGEST_LEN, data,
 158                                TPM2_DIGEST_LEN))
 159                 return TPM_LIB_ERROR;
 160
 161         if (updates)
 162                 *updates = counter;
 163
 164         return 0;
 165 }
 166
 167 u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
 168                         void *buf, size_t prop_count)
 169 {
 170         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 171                 tpm_u16(TPM2_ST_NO_SESSIONS),           /* TAG */
 172                 tpm_u32(22),                            /* Length */
 173                 tpm_u32(TPM2_CC_GET_CAPABILITY),        /* Command code */
 174
 175                 tpm_u32(capability),                    /* Capability */
 176                 tpm_u32(property),                      /* Property */
 177                 tpm_u32(prop_count),                    /* Property count */
 178         };
 179         u8 response[COMMAND_BUFFER_SIZE];
 180         size_t response_len = COMMAND_BUFFER_SIZE;
 181         unsigned int properties_off;
 182         int ret;
 183
 184         ret = tpm_sendrecv_command(dev, command_v2, response, &response_len);
 185         if (ret)
 186                 return ret;
 187
 188         /*
 189          * In the response buffer, the properties are located after the:
 190          * tag (u16), response size (u32), response code (u32),
 191          * YES/NO flag (u8), TPM_CAP (u32).
 192          */
 193         properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
 194                          sizeof(u8) + sizeof(u32);
 195         memcpy(buf, &response[properties_off], response_len - properties_off);
 196
 197         return 0;
 198 }
 199
 200 u32 tpm2_dam_reset(struct udevice *dev, const char *pw, const ssize_t pw_sz)
 201 {
 202         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 203                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
 204                 tpm_u32(27 + pw_sz),            /* Length */
 205                 tpm_u32(TPM2_CC_DAM_RESET),     /* Command code */
 206
 207                 /* HANDLE */
 208                 tpm_u32(TPM2_RH_LOCKOUT),       /* TPM resource handle */
 209
 210                 /* AUTH_SESSION */
 211                 tpm_u32(9 + pw_sz),             /* Authorization size */
 212                 tpm_u32(TPM2_RS_PW),            /* Session handle */
 213                 tpm_u16(0),                     /* Size of <nonce> */
 214                                                 /* <nonce> (if any) */
 215                 0,                              /* Attributes: Cont/Excl/Rst */
 216                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
 217                 /* STRING(pw)                      <hmac/password> (if any) */
 218         };
 219         unsigned int offset = 27;
 220         int ret;
 221
 222         /*
 223          * Fill the command structure starting from the first buffer:
 224          *     - the password (if any)
 225          */
 226         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
 227                                offset, pw, pw_sz);
 228         offset += pw_sz;
 229         if (ret)
 230                 return TPM_LIB_ERROR;
 231
 232         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 233 }
 234
 235 u32 tpm2_dam_parameters(struct udevice *dev, const char *pw,
 236                         const ssize_t pw_sz, unsigned int max_tries,
 237                         unsigned int recovery_time,
 238                         unsigned int lockout_recovery)
 239 {
 240         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 241                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
 242                 tpm_u32(27 + pw_sz + 12),       /* Length */
 243                 tpm_u32(TPM2_CC_DAM_PARAMETERS), /* Command code */
 244
 245                 /* HANDLE */
 246                 tpm_u32(TPM2_RH_LOCKOUT),       /* TPM resource handle */
 247
 248                 /* AUTH_SESSION */
 249                 tpm_u32(9 + pw_sz),             /* Authorization size */
 250                 tpm_u32(TPM2_RS_PW),            /* Session handle */
 251                 tpm_u16(0),                     /* Size of <nonce> */
 252                                                 /* <nonce> (if any) */
 253                 0,                              /* Attributes: Cont/Excl/Rst */
 254                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
 255                 /* STRING(pw)                      <hmac/password> (if any) */
 256
 257                 /* LOCKOUT PARAMETERS */
 258                 /* tpm_u32(max_tries)              Max tries (0, always lock) */
 259                 /* tpm_u32(recovery_time)          Recovery time (0, no lock) */
 260                 /* tpm_u32(lockout_recovery)       Lockout recovery */
 261         };
 262         unsigned int offset = 27;
 263         int ret;
 264
 265         /*
 266          * Fill the command structure starting from the first buffer:
 267          *     - the password (if any)
 268          *     - max tries
 269          *     - recovery time
 270          *     - lockout recovery
 271          */
 272         ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd",
 273                                offset, pw, pw_sz,
 274                                offset + pw_sz, max_tries,
 275                                offset + pw_sz + 4, recovery_time,
 276                                offset + pw_sz + 8, lockout_recovery);
 277         offset += pw_sz + 12;
 278         if (ret)
 279                 return TPM_LIB_ERROR;
 280
 281         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 282 }
 283
 284 int tpm2_change_auth(struct udevice *dev, u32 handle, const char *newpw,
 285                      const ssize_t newpw_sz, const char *oldpw,
 286                      const ssize_t oldpw_sz)
 287 {
 288         unsigned int offset = 27;
 289         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 290                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
 291                 tpm_u32(offset + oldpw_sz + 2 + newpw_sz), /* Length */
 292                 tpm_u32(TPM2_CC_HIERCHANGEAUTH), /* Command code */
 293
 294                 /* HANDLE */
 295                 tpm_u32(handle),                /* TPM resource handle */
 296
 297                 /* AUTH_SESSION */
 298                 tpm_u32(9 + oldpw_sz),          /* Authorization size */
 299                 tpm_u32(TPM2_RS_PW),            /* Session handle */
 300                 tpm_u16(0),                     /* Size of <nonce> */
 301                                                 /* <nonce> (if any) */
 302                 0,                              /* Attributes: Cont/Excl/Rst */
 303                 tpm_u16(oldpw_sz)               /* Size of <hmac/password> */
 304                 /* STRING(oldpw)                   <hmac/password> (if any) */
 305
 306                 /* TPM2B_AUTH (TPM2B_DIGEST) */
 307                 /* tpm_u16(newpw_sz)               Digest size, new pw length */
 308                 /* STRING(newpw)                   Digest buffer, new pw */
 309         };
 310         int ret;
 311
 312         /*
 313          * Fill the command structure starting from the first buffer:
 314          *     - the old password (if any)
 315          *     - size of the new password
 316          *     - new password
 317          */
 318         ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
 319                                offset, oldpw, oldpw_sz,
 320                                offset + oldpw_sz, newpw_sz,
 321                                offset + oldpw_sz + 2, newpw, newpw_sz);
 322         offset += oldpw_sz + 2 + newpw_sz;
 323         if (ret)
 324                 return TPM_LIB_ERROR;
 325
 326         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 327 }
 328
 329 u32 tpm2_pcr_setauthpolicy(struct udevice *dev, const char *pw,
 330                            const ssize_t pw_sz, u32 index, const char *key)
 331 {
 332         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 333                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
 334                 tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN), /* Length */
 335                 tpm_u32(TPM2_CC_PCR_SETAUTHPOL), /* Command code */
 336
 337                 /* HANDLE */
 338                 tpm_u32(TPM2_RH_PLATFORM),      /* TPM resource handle */
 339
 340                 /* AUTH_SESSION */
 341                 tpm_u32(9 + pw_sz),             /* Authorization size */
 342                 tpm_u32(TPM2_RS_PW),            /* session handle */
 343                 tpm_u16(0),                     /* Size of <nonce> */
 344                                                 /* <nonce> (if any) */
 345                 0,                              /* Attributes: Cont/Excl/Rst */
 346                 tpm_u16(pw_sz)                  /* Size of <hmac/password> */
 347                 /* STRING(pw)                      <hmac/password> (if any) */
 348
 349                 /* TPM2B_AUTH (TPM2B_DIGEST) */
 350                 /* tpm_u16(TPM2_DIGEST_LEN)        Digest size length */
 351                 /* STRING(key)                     Digest buffer (PCR key) */
 352
 353                 /* TPMI_ALG_HASH */
 354                 /* tpm_u16(TPM2_ALG_SHA256)   Algorithm of the hash */
 355
 356                 /* TPMI_DH_PCR */
 357                 /* tpm_u32(index),                 PCR Index */
 358         };
 359         unsigned int offset = 27;
 360         int ret;
 361
 362         /*
 363          * Fill the command structure starting from the first buffer:
 364          *     - the password (if any)
 365          *     - the PCR key length
 366          *     - the PCR key
 367          *     - the hash algorithm
 368          *     - the PCR index
 369          */
 370         ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd",
 371                                offset, pw, pw_sz,
 372                                offset + pw_sz, TPM2_DIGEST_LEN,
 373                                offset + pw_sz + 2, key, TPM2_DIGEST_LEN,
 374                                offset + pw_sz + 2 + TPM2_DIGEST_LEN,
 375                                TPM2_ALG_SHA256,
 376                                offset + pw_sz + 4 + TPM2_DIGEST_LEN, index);
 377         offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4;
 378         if (ret)
 379                 return TPM_LIB_ERROR;
 380
 381         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 382 }
 383
 384 u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw,
 385                           const ssize_t pw_sz, u32 index, const char *key,
 386                           const ssize_t key_sz)
 387 {
 388         u8 command_v2[COMMAND_BUFFER_SIZE] = {
 389                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
 390                 tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN), /* Length */
 391                 tpm_u32(TPM2_CC_PCR_SETAUTHVAL), /* Command code */
 392
 393                 /* HANDLE */
 394                 tpm_u32(index),                 /* Handle (PCR Index) */
 395
 396                 /* AUTH_SESSION */
 397                 tpm_u32(9 + pw_sz),             /* Authorization size */
 398                 tpm_u32(TPM2_RS_PW),            /* session handle */
 399                 tpm_u16(0),                     /* Size of <nonce> */
 400                                                 /* <nonce> (if any) */
 401                 0,                              /* Attributes: Cont/Excl/Rst */
 402                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
 403                 /* STRING(pw)                      <hmac/password> (if any) */
 404
 405                 /* TPM2B_DIGEST */
 406                 /* tpm_u16(key_sz)                 Key length */
 407                 /* STRING(key)                     Key */
 408         };
 409         unsigned int offset = 27;
 410         int ret;
 411
 412         /*
 413          * Fill the command structure starting from the first buffer:
 414          *     - the password (if any)
 415          *     - the number of digests, 1 in our case
 416          *     - the algorithm, sha256 in our case
 417          *     - the digest (64 bytes)
 418          */
 419         ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
 420                                offset, pw, pw_sz,
 421                                offset + pw_sz, key_sz,
 422                                offset + pw_sz + 2, key, key_sz);
 423         offset += pw_sz + 2 + key_sz;
 424         if (ret)
 425                 return TPM_LIB_ERROR;
 426
 427         return tpm_sendrecv_command(dev, command_v2, NULL, NULL);
 428 }
 429
 430 u32 tpm2_get_random(struct udevice *dev, void *data, u32 count)
 431 {
 432         const u8 command_v2[10] = {
 433                 tpm_u16(TPM2_ST_NO_SESSIONS),
 434                 tpm_u32(12),
 435                 tpm_u32(TPM2_CC_GET_RANDOM),
 436         };
 437         u8 buf[COMMAND_BUFFER_SIZE], response[COMMAND_BUFFER_SIZE];
 438
 439         const size_t data_size_offset = 10;
 440         const size_t data_offset = 12;
 441         size_t response_length = sizeof(response);
 442         u32 data_size;
 443         u8 *out = data;
 444
 445         while (count > 0) {
 446                 u32 this_bytes = min((size_t)count,
 447                                      sizeof(response) - data_offset);
 448                 u32 err;
 449
 450                 if (pack_byte_string(buf, sizeof(buf), "sw",
 451                                      0, command_v2, sizeof(command_v2),
 452                                      sizeof(command_v2), this_bytes))
 453                         return TPM_LIB_ERROR;
 454                 err = tpm_sendrecv_command(dev, buf, response,
 455                                            &response_length);
 456                 if (err)
 457                         return err;
 458                 if (unpack_byte_string(response, response_length, "w",
 459                                        data_size_offset, &data_size))
 460                         return TPM_LIB_ERROR;
 461                 if (data_size > this_bytes)
 462                         return TPM_LIB_ERROR;
 463                 if (unpack_byte_string(response, response_length, "s",
 464                                        data_offset, out, data_size))
 465                         return TPM_LIB_ERROR;
 466
 467                 count -= data_size;
 468                 out += data_size;
 469         }
 470
 471         return 0;
 472 }