Merge branch 'master' of git://git.denx.de/u-boot-sunxi
[platform/kernel/u-boot.git] / lib / tpm-v2.c
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Copyright (c) 2018 Bootlin
4  * Author: Miquel Raynal <miquel.raynal@bootlin.com>
5  */
6
7 #include <common.h>
8 #include <dm.h>
9 #include <tpm-common.h>
10 #include <tpm-v2.h>
11 #include "tpm-utils.h"
12
13 u32 tpm2_startup(enum tpm2_startup_types mode)
14 {
15         const u8 command_v2[12] = {
16                 tpm_u16(TPM2_ST_NO_SESSIONS),
17                 tpm_u32(12),
18                 tpm_u32(TPM2_CC_STARTUP),
19                 tpm_u16(mode),
20         };
21         int ret;
22
23         /*
24          * Note TPM2_Startup command will return RC_SUCCESS the first time,
25          * but will return RC_INITIALIZE otherwise.
26          */
27         ret = tpm_sendrecv_command(command_v2, NULL, NULL);
28         if (ret && ret != TPM2_RC_INITIALIZE)
29                 return ret;
30
31         return 0;
32 }
33
34 u32 tpm2_self_test(enum tpm2_yes_no full_test)
35 {
36         const u8 command_v2[12] = {
37                 tpm_u16(TPM2_ST_NO_SESSIONS),
38                 tpm_u32(11),
39                 tpm_u32(TPM2_CC_SELF_TEST),
40                 full_test,
41         };
42
43         return tpm_sendrecv_command(command_v2, NULL, NULL);
44 }
45
46 u32 tpm2_clear(u32 handle, const char *pw, const ssize_t pw_sz)
47 {
48         u8 command_v2[COMMAND_BUFFER_SIZE] = {
49                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
50                 tpm_u32(27 + pw_sz),            /* Length */
51                 tpm_u32(TPM2_CC_CLEAR),         /* Command code */
52
53                 /* HANDLE */
54                 tpm_u32(handle),                /* TPM resource handle */
55
56                 /* AUTH_SESSION */
57                 tpm_u32(9 + pw_sz),             /* Authorization size */
58                 tpm_u32(TPM2_RS_PW),            /* Session handle */
59                 tpm_u16(0),                     /* Size of <nonce> */
60                                                 /* <nonce> (if any) */
61                 0,                              /* Attributes: Cont/Excl/Rst */
62                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
63                 /* STRING(pw)                      <hmac/password> (if any) */
64         };
65         unsigned int offset = 27;
66         int ret;
67
68         /*
69          * Fill the command structure starting from the first buffer:
70          *     - the password (if any)
71          */
72         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
73                                offset, pw, pw_sz);
74         offset += pw_sz;
75         if (ret)
76                 return TPM_LIB_ERROR;
77
78         return tpm_sendrecv_command(command_v2, NULL, NULL);
79 }
80
81 u32 tpm2_pcr_extend(u32 index, const uint8_t *digest)
82 {
83         u8 command_v2[COMMAND_BUFFER_SIZE] = {
84                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
85                 tpm_u32(33 + TPM2_DIGEST_LEN),  /* Length */
86                 tpm_u32(TPM2_CC_PCR_EXTEND),    /* Command code */
87
88                 /* HANDLE */
89                 tpm_u32(index),                 /* Handle (PCR Index) */
90
91                 /* AUTH_SESSION */
92                 tpm_u32(9),                     /* Authorization size */
93                 tpm_u32(TPM2_RS_PW),            /* Session handle */
94                 tpm_u16(0),                     /* Size of <nonce> */
95                                                 /* <nonce> (if any) */
96                 0,                              /* Attributes: Cont/Excl/Rst */
97                 tpm_u16(0),                     /* Size of <hmac/password> */
98                                                 /* <hmac/password> (if any) */
99                 tpm_u32(1),                     /* Count (number of hashes) */
100                 tpm_u16(TPM2_ALG_SHA256),       /* Algorithm of the hash */
101                 /* STRING(digest)                  Digest */
102         };
103         unsigned int offset = 33;
104         int ret;
105
106         /*
107          * Fill the command structure starting from the first buffer:
108          *     - the digest
109          */
110         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
111                                offset, digest, TPM2_DIGEST_LEN);
112         offset += TPM2_DIGEST_LEN;
113         if (ret)
114                 return TPM_LIB_ERROR;
115
116         return tpm_sendrecv_command(command_v2, NULL, NULL);
117 }
118
119 u32 tpm2_pcr_read(u32 idx, unsigned int idx_min_sz, void *data,
120                   unsigned int *updates)
121 {
122         u8 idx_array_sz = max(idx_min_sz, DIV_ROUND_UP(idx, 8));
123         u8 command_v2[COMMAND_BUFFER_SIZE] = {
124                 tpm_u16(TPM2_ST_NO_SESSIONS),   /* TAG */
125                 tpm_u32(17 + idx_array_sz),     /* Length */
126                 tpm_u32(TPM2_CC_PCR_READ),      /* Command code */
127
128                 /* TPML_PCR_SELECTION */
129                 tpm_u32(1),                     /* Number of selections */
130                 tpm_u16(TPM2_ALG_SHA256),       /* Algorithm of the hash */
131                 idx_array_sz,                   /* Array size for selection */
132                 /* bitmap(idx)                     Selected PCR bitmap */
133         };
134         size_t response_len = COMMAND_BUFFER_SIZE;
135         u8 response[COMMAND_BUFFER_SIZE];
136         unsigned int pcr_sel_idx = idx / 8;
137         u8 pcr_sel_bit = BIT(idx % 8);
138         unsigned int counter = 0;
139         int ret;
140
141         if (pack_byte_string(command_v2, COMMAND_BUFFER_SIZE, "b",
142                              17 + pcr_sel_idx, pcr_sel_bit))
143                 return TPM_LIB_ERROR;
144
145         ret = tpm_sendrecv_command(command_v2, response, &response_len);
146         if (ret)
147                 return ret;
148
149         if (unpack_byte_string(response, response_len, "ds",
150                                10, &counter,
151                                response_len - TPM2_DIGEST_LEN, data,
152                                TPM2_DIGEST_LEN))
153                 return TPM_LIB_ERROR;
154
155         if (updates)
156                 *updates = counter;
157
158         return 0;
159 }
160
161 u32 tpm2_get_capability(u32 capability, u32 property, void *buf,
162                         size_t prop_count)
163 {
164         u8 command_v2[COMMAND_BUFFER_SIZE] = {
165                 tpm_u16(TPM2_ST_NO_SESSIONS),           /* TAG */
166                 tpm_u32(22),                            /* Length */
167                 tpm_u32(TPM2_CC_GET_CAPABILITY),        /* Command code */
168
169                 tpm_u32(capability),                    /* Capability */
170                 tpm_u32(property),                      /* Property */
171                 tpm_u32(prop_count),                    /* Property count */
172         };
173         u8 response[COMMAND_BUFFER_SIZE];
174         size_t response_len = COMMAND_BUFFER_SIZE;
175         unsigned int properties_off;
176         int ret;
177
178         ret = tpm_sendrecv_command(command_v2, response, &response_len);
179         if (ret)
180                 return ret;
181
182         /*
183          * In the response buffer, the properties are located after the:
184          * tag (u16), response size (u32), response code (u32),
185          * YES/NO flag (u8), TPM_CAP (u32) and TPMU_CAPABILITIES (u32).
186          */
187         properties_off = sizeof(u16) + sizeof(u32) + sizeof(u32) +
188                          sizeof(u8) + sizeof(u32) + sizeof(u32);
189         memcpy(buf, &response[properties_off], response_len - properties_off);
190
191         return 0;
192 }
193
194 u32 tpm2_dam_reset(const char *pw, const ssize_t pw_sz)
195 {
196         u8 command_v2[COMMAND_BUFFER_SIZE] = {
197                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
198                 tpm_u32(27 + pw_sz),            /* Length */
199                 tpm_u32(TPM2_CC_DAM_RESET),     /* Command code */
200
201                 /* HANDLE */
202                 tpm_u32(TPM2_RH_LOCKOUT),       /* TPM resource handle */
203
204                 /* AUTH_SESSION */
205                 tpm_u32(9 + pw_sz),             /* Authorization size */
206                 tpm_u32(TPM2_RS_PW),            /* Session handle */
207                 tpm_u16(0),                     /* Size of <nonce> */
208                                                 /* <nonce> (if any) */
209                 0,                              /* Attributes: Cont/Excl/Rst */
210                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
211                 /* STRING(pw)                      <hmac/password> (if any) */
212         };
213         unsigned int offset = 27;
214         int ret;
215
216         /*
217          * Fill the command structure starting from the first buffer:
218          *     - the password (if any)
219          */
220         ret = pack_byte_string(command_v2, sizeof(command_v2), "s",
221                                offset, pw, pw_sz);
222         offset += pw_sz;
223         if (ret)
224                 return TPM_LIB_ERROR;
225
226         return tpm_sendrecv_command(command_v2, NULL, NULL);
227 }
228
229 u32 tpm2_dam_parameters(const char *pw, const ssize_t pw_sz,
230                         unsigned int max_tries, unsigned int recovery_time,
231                         unsigned int lockout_recovery)
232 {
233         u8 command_v2[COMMAND_BUFFER_SIZE] = {
234                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
235                 tpm_u32(27 + pw_sz + 12),       /* Length */
236                 tpm_u32(TPM2_CC_DAM_PARAMETERS), /* Command code */
237
238                 /* HANDLE */
239                 tpm_u32(TPM2_RH_LOCKOUT),       /* TPM resource handle */
240
241                 /* AUTH_SESSION */
242                 tpm_u32(9 + pw_sz),             /* Authorization size */
243                 tpm_u32(TPM2_RS_PW),            /* Session handle */
244                 tpm_u16(0),                     /* Size of <nonce> */
245                                                 /* <nonce> (if any) */
246                 0,                              /* Attributes: Cont/Excl/Rst */
247                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
248                 /* STRING(pw)                      <hmac/password> (if any) */
249
250                 /* LOCKOUT PARAMETERS */
251                 /* tpm_u32(max_tries)              Max tries (0, always lock) */
252                 /* tpm_u32(recovery_time)          Recovery time (0, no lock) */
253                 /* tpm_u32(lockout_recovery)       Lockout recovery */
254         };
255         unsigned int offset = 27;
256         int ret;
257
258         /*
259          * Fill the command structure starting from the first buffer:
260          *     - the password (if any)
261          *     - max tries
262          *     - recovery time
263          *     - lockout recovery
264          */
265         ret = pack_byte_string(command_v2, sizeof(command_v2), "sddd",
266                                offset, pw, pw_sz,
267                                offset + pw_sz, max_tries,
268                                offset + pw_sz + 4, recovery_time,
269                                offset + pw_sz + 8, lockout_recovery);
270         offset += pw_sz + 12;
271         if (ret)
272                 return TPM_LIB_ERROR;
273
274         return tpm_sendrecv_command(command_v2, NULL, NULL);
275 }
276
277 int tpm2_change_auth(u32 handle, const char *newpw, const ssize_t newpw_sz,
278                      const char *oldpw, const ssize_t oldpw_sz)
279 {
280         unsigned int offset = 27;
281         u8 command_v2[COMMAND_BUFFER_SIZE] = {
282                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
283                 tpm_u32(offset + oldpw_sz + 2 + newpw_sz), /* Length */
284                 tpm_u32(TPM2_CC_HIERCHANGEAUTH), /* Command code */
285
286                 /* HANDLE */
287                 tpm_u32(handle),                /* TPM resource handle */
288
289                 /* AUTH_SESSION */
290                 tpm_u32(9 + oldpw_sz),          /* Authorization size */
291                 tpm_u32(TPM2_RS_PW),            /* Session handle */
292                 tpm_u16(0),                     /* Size of <nonce> */
293                                                 /* <nonce> (if any) */
294                 0,                              /* Attributes: Cont/Excl/Rst */
295                 tpm_u16(oldpw_sz)               /* Size of <hmac/password> */
296                 /* STRING(oldpw)                   <hmac/password> (if any) */
297
298                 /* TPM2B_AUTH (TPM2B_DIGEST) */
299                 /* tpm_u16(newpw_sz)               Digest size, new pw length */
300                 /* STRING(newpw)                   Digest buffer, new pw */
301         };
302         int ret;
303
304         /*
305          * Fill the command structure starting from the first buffer:
306          *     - the old password (if any)
307          *     - size of the new password
308          *     - new password
309          */
310         ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
311                                offset, oldpw, oldpw_sz,
312                                offset + oldpw_sz, newpw_sz,
313                                offset + oldpw_sz + 2, newpw, newpw_sz);
314         offset += oldpw_sz + 2 + newpw_sz;
315         if (ret)
316                 return TPM_LIB_ERROR;
317
318         return tpm_sendrecv_command(command_v2, NULL, NULL);
319 }
320
321 u32 tpm2_pcr_setauthpolicy(const char *pw, const ssize_t pw_sz, u32 index,
322                            const char *key)
323 {
324         u8 command_v2[COMMAND_BUFFER_SIZE] = {
325                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
326                 tpm_u32(35 + pw_sz + TPM2_DIGEST_LEN), /* Length */
327                 tpm_u32(TPM2_CC_PCR_SETAUTHPOL), /* Command code */
328
329                 /* HANDLE */
330                 tpm_u32(TPM2_RH_PLATFORM),      /* TPM resource handle */
331
332                 /* AUTH_SESSION */
333                 tpm_u32(9 + pw_sz),             /* Authorization size */
334                 tpm_u32(TPM2_RS_PW),            /* session handle */
335                 tpm_u16(0),                     /* Size of <nonce> */
336                                                 /* <nonce> (if any) */
337                 0,                              /* Attributes: Cont/Excl/Rst */
338                 tpm_u16(pw_sz)                  /* Size of <hmac/password> */
339                 /* STRING(pw)                      <hmac/password> (if any) */
340
341                 /* TPM2B_AUTH (TPM2B_DIGEST) */
342                 /* tpm_u16(TPM2_DIGEST_LEN)        Digest size length */
343                 /* STRING(key)                     Digest buffer (PCR key) */
344
345                 /* TPMI_ALG_HASH */
346                 /* tpm_u16(TPM2_ALG_SHA256)   Algorithm of the hash */
347
348                 /* TPMI_DH_PCR */
349                 /* tpm_u32(index),                 PCR Index */
350         };
351         unsigned int offset = 27;
352         int ret;
353
354         /*
355          * Fill the command structure starting from the first buffer:
356          *     - the password (if any)
357          *     - the PCR key length
358          *     - the PCR key
359          *     - the hash algorithm
360          *     - the PCR index
361          */
362         ret = pack_byte_string(command_v2, sizeof(command_v2), "swswd",
363                                offset, pw, pw_sz,
364                                offset + pw_sz, TPM2_DIGEST_LEN,
365                                offset + pw_sz + 2, key, TPM2_DIGEST_LEN,
366                                offset + pw_sz + 2 + TPM2_DIGEST_LEN,
367                                TPM2_ALG_SHA256,
368                                offset + pw_sz + 4 + TPM2_DIGEST_LEN, index);
369         offset += pw_sz + 2 + TPM2_DIGEST_LEN + 2 + 4;
370         if (ret)
371                 return TPM_LIB_ERROR;
372
373         return tpm_sendrecv_command(command_v2, NULL, NULL);
374 }
375
376 u32 tpm2_pcr_setauthvalue(const char *pw, const ssize_t pw_sz, u32 index,
377                           const char *key, const ssize_t key_sz)
378 {
379         u8 command_v2[COMMAND_BUFFER_SIZE] = {
380                 tpm_u16(TPM2_ST_SESSIONS),      /* TAG */
381                 tpm_u32(33 + pw_sz + TPM2_DIGEST_LEN), /* Length */
382                 tpm_u32(TPM2_CC_PCR_SETAUTHVAL), /* Command code */
383
384                 /* HANDLE */
385                 tpm_u32(index),                 /* Handle (PCR Index) */
386
387                 /* AUTH_SESSION */
388                 tpm_u32(9 + pw_sz),             /* Authorization size */
389                 tpm_u32(TPM2_RS_PW),            /* session handle */
390                 tpm_u16(0),                     /* Size of <nonce> */
391                                                 /* <nonce> (if any) */
392                 0,                              /* Attributes: Cont/Excl/Rst */
393                 tpm_u16(pw_sz),                 /* Size of <hmac/password> */
394                 /* STRING(pw)                      <hmac/password> (if any) */
395
396                 /* TPM2B_DIGEST */
397                 /* tpm_u16(key_sz)                 Key length */
398                 /* STRING(key)                     Key */
399         };
400         unsigned int offset = 27;
401         int ret;
402
403         /*
404          * Fill the command structure starting from the first buffer:
405          *     - the password (if any)
406          *     - the number of digests, 1 in our case
407          *     - the algorithm, sha256 in our case
408          *     - the digest (64 bytes)
409          */
410         ret = pack_byte_string(command_v2, sizeof(command_v2), "sws",
411                                offset, pw, pw_sz,
412                                offset + pw_sz, key_sz,
413                                offset + pw_sz + 2, key, key_sz);
414         offset += pw_sz + 2 + key_sz;
415         if (ret)
416                 return TPM_LIB_ERROR;
417
418         return tpm_sendrecv_command(command_v2, NULL, NULL);
419 }