[J-u-boot.git] / include / tpm-v1.h

/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * Copyright (c) 2013 The Chromium OS Authors.
 * Coypright (c) 2013 Guntermann & Drunck GmbH
 */

#ifndef __TPM_V1_H
#define __TPM_V1_H

#include <tpm-common.h>

/* Useful constants */
enum {
	TPM_REQUEST_HEADER_LENGTH	= 10,
	TPM_RESPONSE_HEADER_LENGTH	= 10,
	PCR_DIGEST_LENGTH		= 20,
	DIGEST_LENGTH			= 20,
	TPM_REQUEST_AUTH_LENGTH		= 45,
	TPM_RESPONSE_AUTH_LENGTH	= 41,
	/* some max lengths, valid for RSA keys <= 2048 bits */
	TPM_KEY12_MAX_LENGTH		= 618,
	TPM_PUBKEY_MAX_LENGTH		= 288,
};

enum tpm_startup_type {
	TPM_ST_CLEAR		= 0x0001,
	TPM_ST_STATE		= 0x0002,
	TPM_ST_DEACTIVATED	= 0x0003,
};

enum tpm_physical_presence {
	TPM_PHYSICAL_PRESENCE_HW_DISABLE	= 0x0200,
	TPM_PHYSICAL_PRESENCE_CMD_DISABLE	= 0x0100,
	TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK	= 0x0080,
	TPM_PHYSICAL_PRESENCE_HW_ENABLE		= 0x0040,
	TPM_PHYSICAL_PRESENCE_CMD_ENABLE	= 0x0020,
	TPM_PHYSICAL_PRESENCE_NOTPRESENT	= 0x0010,
	TPM_PHYSICAL_PRESENCE_PRESENT		= 0x0008,
	TPM_PHYSICAL_PRESENCE_LOCK		= 0x0004,
};

enum tpm_nv_index {
	TPM_NV_INDEX_LOCK	= 0xffffffff,
	TPM_NV_INDEX_0		= 0x00000000,
	TPM_NV_INDEX_DIR	= 0x10000001,
};

enum tpm_resource_type {
	TPM_RT_KEY	= 0x00000001,
	TPM_RT_AUTH	= 0x00000002,
	TPM_RT_HASH	= 0x00000003,
	TPM_RT_TRANS	= 0x00000004,
	TPM_RT_CONTEXT	= 0x00000005,
	TPM_RT_COUNTER	= 0x00000006,
	TPM_RT_DELEGATE	= 0x00000007,
	TPM_RT_DAA_TPM	= 0x00000008,
	TPM_RT_DAA_V0	= 0x00000009,
	TPM_RT_DAA_V1	= 0x0000000A,
};

enum tpm_capability_areas {
	TPM_CAP_ORD		= 0x00000001,
	TPM_CAP_ALG		= 0x00000002,
	TPM_CAP_PID		= 0x00000003,
	TPM_CAP_FLAG		= 0x00000004,
	TPM_CAP_PROPERTY	= 0x00000005,
	TPM_CAP_VERSION		= 0x00000006,
	TPM_CAP_KEY_HANDLE	= 0x00000007,
	TPM_CAP_CHECK_LOADED	= 0x00000008,
	TPM_CAP_SYM_MODE	= 0x00000009,
	TPM_CAP_KEY_STATUS	= 0x0000000C,
	TPM_CAP_NV_LIST		= 0x0000000D,
	TPM_CAP_MFR		= 0x00000010,
	TPM_CAP_NV_INDEX	= 0x00000011,
	TPM_CAP_TRANS_ALG	= 0x00000012,
	TPM_CAP_HANDLE		= 0x00000014,
	TPM_CAP_TRANS_ES	= 0x00000015,
	TPM_CAP_AUTH_ENCRYPT	= 0x00000017,
	TPM_CAP_SELECT_SIZE	= 0x00000018,
	TPM_CAP_DA_LOGIC	= 0x00000019,
	TPM_CAP_VERSION_VAL	= 0x0000001A,
};

enum tmp_cap_flag {
	TPM_CAP_FLAG_PERMANENT	= 0x108,
};

#define TPM_TAG_PERMANENT_FLAGS		0x001f

#define TPM_NV_PER_GLOBALLOCK		BIT(15)
#define TPM_NV_PER_PPREAD		BIT(16)
#define TPM_NV_PER_PPWRITE		BIT(0)
#define TPM_NV_PER_READ_STCLEAR		BIT(31)
#define TPM_NV_PER_WRITE_STCLEAR	BIT(14)
#define TPM_NV_PER_WRITEDEFINE		BIT(13)
#define TPM_NV_PER_WRITEALL		BIT(12)

enum {
	TPM_PUBEK_SIZE			= 256,
};

enum {
	TPM_CMD_EXTEND			= 0x14,
	TPM_CMD_GET_CAPABILITY		= 0x65,
	TPM_CMD_NV_DEFINE_SPACE		= 0xcc,
	TPM_CMD_NV_WRITE_VALUE		= 0xcd,
	TPM_CMD_NV_READ_VALUE		= 0xcf,
};

/**
 * TPM return codes as defined in the TCG Main specification
 * (TPM Main Part 2 Structures; Specification version 1.2)
 */
enum tpm_return_code {
	TPM_BASE	= 0x00000000,
	TPM_NON_FATAL	= 0x00000800,
	TPM_SUCCESS	= TPM_BASE,
	/* TPM-defined fatal error codes */
	TPM_AUTHFAIL			= TPM_BASE +  1,
	TPM_BADINDEX			= TPM_BASE +  2,
	TPM_BAD_PARAMETER		= TPM_BASE +  3,
	TPM_AUDITFAILURE		= TPM_BASE +  4,
	TPM_CLEAR_DISABLED		= TPM_BASE +  5,
	TPM_DEACTIVATED			= TPM_BASE +  6,
	TPM_DISABLED			= TPM_BASE +  7,
	TPM_DISABLED_CMD		= TPM_BASE +  8,
	TPM_FAIL			= TPM_BASE +  9,
	TPM_BAD_ORDINAL			= TPM_BASE + 10,
	TPM_INSTALL_DISABLED		= TPM_BASE + 11,
	TPM_INVALID_KEYHANDLE		= TPM_BASE + 12,
	TPM_KEYNOTFOUND			= TPM_BASE + 13,
	TPM_INAPPROPRIATE_ENC		= TPM_BASE + 14,
	TPM_MIGRATE_FAIL		= TPM_BASE + 15,
	TPM_INVALID_PCR_INFO		= TPM_BASE + 16,
	TPM_NOSPACE			= TPM_BASE + 17,
	TPM_NOSRK			= TPM_BASE + 18,
	TPM_NOTSEALED_BLOB		= TPM_BASE + 19,
	TPM_OWNER_SET			= TPM_BASE + 20,
	TPM_RESOURCES			= TPM_BASE + 21,
	TPM_SHORTRANDOM			= TPM_BASE + 22,
	TPM_SIZE			= TPM_BASE + 23,
	TPM_WRONGPCRVAL			= TPM_BASE + 24,
	TPM_BAD_PARAM_SIZE		= TPM_BASE + 25,
	TPM_SHA_THREAD			= TPM_BASE + 26,
	TPM_SHA_ERROR			= TPM_BASE + 27,
	TPM_FAILEDSELFTEST		= TPM_BASE + 28,
	TPM_AUTH2FAIL			= TPM_BASE + 29,
	TPM_BADTAG			= TPM_BASE + 30,
	TPM_IOERROR			= TPM_BASE + 31,
	TPM_ENCRYPT_ERROR		= TPM_BASE + 32,
	TPM_DECRYPT_ERROR		= TPM_BASE + 33,
	TPM_INVALID_AUTHHANDLE		= TPM_BASE + 34,
	TPM_NO_ENDORSEMENT		= TPM_BASE + 35,
	TPM_INVALID_KEYUSAGE		= TPM_BASE + 36,
	TPM_WRONG_ENTITYTYPE		= TPM_BASE + 37,
	TPM_INVALID_POSTINIT		= TPM_BASE + 38,
	TPM_INAPPROPRIATE_SIG		= TPM_BASE + 39,
	TPM_BAD_KEY_PROPERTY		= TPM_BASE + 40,
	TPM_BAD_MIGRATION		= TPM_BASE + 41,
	TPM_BAD_SCHEME			= TPM_BASE + 42,
	TPM_BAD_DATASIZE		= TPM_BASE + 43,
	TPM_BAD_MODE			= TPM_BASE + 44,
	TPM_BAD_PRESENCE		= TPM_BASE + 45,
	TPM_BAD_VERSION			= TPM_BASE + 46,
	TPM_NO_WRAP_TRANSPORT		= TPM_BASE + 47,
	TPM_AUDITFAIL_UNSUCCESSFUL	= TPM_BASE + 48,
	TPM_AUDITFAIL_SUCCESSFUL	= TPM_BASE + 49,
	TPM_NOTRESETABLE		= TPM_BASE + 50,
	TPM_NOTLOCAL			= TPM_BASE + 51,
	TPM_BAD_TYPE			= TPM_BASE + 52,
	TPM_INVALID_RESOURCE		= TPM_BASE + 53,
	TPM_NOTFIPS			= TPM_BASE + 54,
	TPM_INVALID_FAMILY		= TPM_BASE + 55,
	TPM_NO_NV_PERMISSION		= TPM_BASE + 56,
	TPM_REQUIRES_SIGN		= TPM_BASE + 57,
	TPM_KEY_NOTSUPPORTED		= TPM_BASE + 58,
	TPM_AUTH_CONFLICT		= TPM_BASE + 59,
	TPM_AREA_LOCKED			= TPM_BASE + 60,
	TPM_BAD_LOCALITY		= TPM_BASE + 61,
	TPM_READ_ONLY			= TPM_BASE + 62,
	TPM_PER_NOWRITE			= TPM_BASE + 63,
	TPM_FAMILY_COUNT		= TPM_BASE + 64,
	TPM_WRITE_LOCKED		= TPM_BASE + 65,
	TPM_BAD_ATTRIBUTES		= TPM_BASE + 66,
	TPM_INVALID_STRUCTURE		= TPM_BASE + 67,
	TPM_KEY_OWNER_CONTROL		= TPM_BASE + 68,
	TPM_BAD_COUNTER			= TPM_BASE + 69,
	TPM_NOT_FULLWRITE		= TPM_BASE + 70,
	TPM_CONTEXT_GAP			= TPM_BASE + 71,
	TPM_MAXNVWRITES			= TPM_BASE + 72,
	TPM_NOOPERATOR			= TPM_BASE + 73,
	TPM_RESOURCEMISSING		= TPM_BASE + 74,
	TPM_DELEGATE_LOCK		= TPM_BASE + 75,
	TPM_DELEGATE_FAMILY		= TPM_BASE + 76,
	TPM_DELEGATE_ADMIN		= TPM_BASE + 77,
	TPM_TRANSPORT_NOTEXCLUSIVE	= TPM_BASE + 78,
	TPM_OWNER_CONTROL		= TPM_BASE + 79,
	TPM_DAA_RESOURCES		= TPM_BASE + 80,
	TPM_DAA_INPUT_DATA0		= TPM_BASE + 81,
	TPM_DAA_INPUT_DATA1		= TPM_BASE + 82,
	TPM_DAA_ISSUER_SETTINGS		= TPM_BASE + 83,
	TPM_DAA_TPM_SETTINGS		= TPM_BASE + 84,
	TPM_DAA_STAGE			= TPM_BASE + 85,
	TPM_DAA_ISSUER_VALIDITY		= TPM_BASE + 86,
	TPM_DAA_WRONG_W			= TPM_BASE + 87,
	TPM_BAD_HANDLE			= TPM_BASE + 88,
	TPM_BAD_DELEGATE		= TPM_BASE + 89,
	TPM_BADCONTEXT			= TPM_BASE + 90,
	TPM_TOOMANYCONTEXTS		= TPM_BASE + 91,
	TPM_MA_TICKET_SIGNATURE		= TPM_BASE + 92,
	TPM_MA_DESTINATION		= TPM_BASE + 93,
	TPM_MA_SOURCE			= TPM_BASE + 94,
	TPM_MA_AUTHORITY		= TPM_BASE + 95,
	TPM_PERMANENTEK			= TPM_BASE + 97,
	TPM_BAD_SIGNATURE		= TPM_BASE + 98,
	TPM_NOCONTEXTSPACE		= TPM_BASE + 99,
	/* TPM-defined non-fatal errors */
	TPM_RETRY		= TPM_BASE + TPM_NON_FATAL,
	TPM_NEEDS_SELFTEST	= TPM_BASE + TPM_NON_FATAL + 1,
	TPM_DOING_SELFTEST	= TPM_BASE + TPM_NON_FATAL + 2,
	TPM_DEFEND_LOCK_RUNNING	= TPM_BASE + TPM_NON_FATAL + 3,
};

struct tpm_permanent_flags {
	__be16	tag;
	u8	disable;
	u8	ownership;
	u8	deactivated;
	u8	read_pubek;
	u8	disable_owner_clear;
	u8	allow_maintenance;
	u8	physical_presence_lifetime_lock;
	u8	physical_presence_hw_enable;
	u8	physical_presence_cmd_enable;
	u8	cekp_used;
	u8	tpm_post;
	u8	tpm_post_lock;
	u8	fips;
	u8	operator;
	u8	enable_revoke_ek;
	u8	nv_locked;
	u8	read_srk_pub;
	u8	tpm_established;
	u8	maintenance_done;
	u8	disable_full_da_logic_info;
} __packed;

#define TPM_SHA1_160_HASH_LEN	0x14

struct __packed tpm_composite_hash {
	u8	digest[TPM_SHA1_160_HASH_LEN];
};

struct __packed tpm_pcr_selection {
	__be16	size_of_select;
	u8	pcr_select[3];	/* matches vboot's struct */
};

struct __packed tpm_pcr_info_short {
	struct tpm_pcr_selection pcr_selection;
	u8	locality_at_release;
	struct tpm_composite_hash digest_at_release;
};

struct __packed tpm_nv_attributes {
	__be16	tag;
	__be32	attributes;
};

struct __packed tpm_nv_data_public {
	__be16	tag;
	__be32	nv_index;
	struct tpm_pcr_info_short pcr_info_read;
	struct tpm_pcr_info_short pcr_info_write;
	struct tpm_nv_attributes permission;
	u8	read_st_clear;
	u8	write_st_clear;
	u8	write_define;
	__be32	data_size;
};

/**
 * Issue a TPM_Startup command.
 *
 * @param dev		TPM device
 * @param mode		TPM startup mode
 * @return return code of the operation
 */
u32 tpm_startup(struct udevice *dev, enum tpm_startup_type mode);

/**
 * Issue a TPM_SelfTestFull command.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_self_test_full(struct udevice *dev);

/**
 * Issue a TPM_ContinueSelfTest command.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_continue_self_test(struct udevice *dev);

/**
 * Issue a TPM_NV_DefineSpace command.  The implementation is limited
 * to specify TPM_NV_ATTRIBUTES and size of the area.  The area index
 * could be one of the special value listed in enum tpm_nv_index.
 *
 * @param dev		TPM device
 * @param index		index of the area
 * @param perm		TPM_NV_ATTRIBUTES of the area
 * @param size		size of the area
 * @return return code of the operation
 */
u32 tpm_nv_define_space(struct udevice *dev, u32 index, u32 perm, u32 size);

/**
 * Issue a TPM_NV_ReadValue command.  This implementation is limited
 * to read the area from offset 0.  The area index could be one of
 * the special value listed in enum tpm_nv_index.
 *
 * @param dev		TPM device
 * @param index		index of the area
 * @param data		output buffer of the area contents
 * @param count		size of output buffer
 * @return return code of the operation
 */
u32 tpm_nv_read_value(struct udevice *dev, u32 index, void *data, u32 count);

/**
 * Issue a TPM_NV_WriteValue command.  This implementation is limited
 * to write the area from offset 0.  The area index could be one of
 * the special value listed in enum tpm_nv_index.
 *
 * @param dev		TPM device
 * @param index		index of the area
 * @param data		input buffer to be wrote to the area
 * @param length	length of data bytes of input buffer
 * @return return code of the operation
 */
u32 tpm_nv_write_value(struct udevice *dev, u32 index, const void *data,
		       u32 length);

/**
 * Issue a TPM_Extend command.
 *
 * @param dev		TPM device
 * @param index		index of the PCR
 * @param in_digest	160-bit value representing the event to be
 *			recorded
 * @param out_digest	160-bit PCR value after execution of the
 *			command
 * @return return code of the operation
 */
u32 tpm_extend(struct udevice *dev, u32 index, const void *in_digest,
	       void *out_digest);

/**
 * Issue a TPM_PCRRead command.
 *
 * @param dev		TPM device
 * @param index		index of the PCR
 * @param data		output buffer for contents of the named PCR
 * @param count		size of output buffer
 * @return return code of the operation
 */
u32 tpm_pcr_read(struct udevice *dev, u32 index, void *data, size_t count);

/**
 * Issue a TSC_PhysicalPresence command.  TPM physical presence flag
 * is bit-wise OR'ed of flags listed in enum tpm_physical_presence.
 *
 * @param dev		TPM device
 * @param presence	TPM physical presence flag
 * @return return code of the operation
 */
u32 tpm_tsc_physical_presence(struct udevice *dev, u16 presence);

/**
 * Issue a TPM_ReadPubek command.
 *
 * @param dev		TPM device
 * @param data		output buffer for the public endorsement key
 * @param count		size of output buffer
 * @return return code of the operation
 */
u32 tpm_read_pubek(struct udevice *dev, void *data, size_t count);

/**
 * Issue a TPM_ForceClear command.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_force_clear(struct udevice *dev);

/**
 * Issue a TPM_PhysicalEnable command.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_physical_enable(struct udevice *dev);

/**
 * Issue a TPM_PhysicalDisable command.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_physical_disable(struct udevice *dev);

/**
 * Issue a TPM_PhysicalSetDeactivated command.
 *
 * @param dev		TPM device
 * @param state		boolean state of the deactivated flag
 * @return return code of the operation
 */
u32 tpm_physical_set_deactivated(struct udevice *dev, u8 state);

/**
 * Issue a TPM_GetCapability command.  This implementation is limited
 * to query sub_cap index that is 4-byte wide.
 *
 * @param dev		TPM device
 * @param cap_area	partition of capabilities
 * @param sub_cap	further definition of capability, which is
 *			limited to be 4-byte wide
 * @param cap		output buffer for capability information
 * @param count		size of output buffer
 * @return return code of the operation
 */
u32 tpm_get_capability(struct udevice *dev, u32 cap_area, u32 sub_cap,
		       void *cap, size_t count);

/**
 * Issue a TPM_FlushSpecific command for a AUTH resource.
 *
 * @param dev		TPM device
 * @param auth_handle	handle of the auth session
 * @return return code of the operation
 */
u32 tpm_terminate_auth_session(struct udevice *dev, u32 auth_handle);

/**
 * Issue a TPM_OIAP command to setup an object independent authorization
 * session.
 * Information about the session is stored internally.
 * If there was already an OIAP session active it is terminated and a new
 * session is set up.
 *
 * @param dev		TPM device
 * @param auth_handle	pointer to the (new) auth handle or NULL.
 * @return return code of the operation
 */
u32 tpm_oiap(struct udevice *dev, u32 *auth_handle);

/**
 * Ends an active OIAP session.
 *
 * @param dev		TPM device
 * @return return code of the operation
 */
u32 tpm_end_oiap(struct udevice *dev);

/**
 * Issue a TPM_LoadKey2 (Auth1) command using an OIAP session for authenticating
 * the usage of the parent key.
 *
 * @param dev		TPM device
 * @param parent_handle	handle of the parent key.
 * @param key		pointer to the key structure (TPM_KEY or TPM_KEY12).
 * @param key_length	size of the key structure
 * @param parent_key_usage_auth	usage auth for the parent key
 * @param key_handle	pointer to the key handle
 * @return return code of the operation
 */
u32 tpm_load_key2_oiap(struct udevice *dev, u32 parent_handle, const void *key,
		       size_t key_length, const void *parent_key_usage_auth,
		       u32 *key_handle);

/**
 * Issue a TPM_GetPubKey (Auth1) command using an OIAP session for
 * authenticating the usage of the key.
 *
 * @param dev		TPM device
 * @param key_handle	handle of the key
 * @param usage_auth	usage auth for the key
 * @param pubkey	pointer to the pub key buffer; may be NULL if the pubkey
 *			should not be stored.
 * @param pubkey_len	pointer to the pub key buffer len. On entry: the size of
 *			the provided pubkey buffer. On successful exit: the size
 *			of the stored TPM_PUBKEY structure (iff pubkey != NULL).
 * @return return code of the operation
 */
u32 tpm_get_pub_key_oiap(struct udevice *dev, u32 key_handle,
			 const void *usage_auth, void *pubkey,
			 size_t *pubkey_len);

/**
 * Get the TPM permanent flags value
 *
 * @param dev		TPM device
 * @param pflags	Place to put permanent flags
 * @return return code of the operation
 */
u32 tpm_get_permanent_flags(struct udevice *dev,
			    struct tpm_permanent_flags *pflags);

/**
 * Get the TPM permissions
 *
 * @param dev		TPM device
 * @param perm		Returns permissions value
 * @return return code of the operation
 */
u32 tpm_get_permissions(struct udevice *dev, u32 index, u32 *perm);

/**
 * Flush a resource with a given handle and type from the TPM
 *
 * @param dev		TPM device
 * @param key_handle           handle of the resource
 * @param resource_type                type of the resource
 * @return return code of the operation
 */
u32 tpm_flush_specific(struct udevice *dev, u32 key_handle, u32 resource_type);

#ifdef CONFIG_TPM_LOAD_KEY_BY_SHA1
/**
 * Search for a key by usage AuthData and the hash of the parent's pub key.
 *
 * @param dev		TPM device
 * @param auth	        Usage auth of the key to search for
 * @param pubkey_digest	SHA1 hash of the pub key structure of the key
 * @param[out] handle	The handle of the key (Non-null iff found)
 * @return 0 if key was found in TPM; != 0 if not.
 */
u32 tpm_find_key_sha1(struct udevice *dev, const u8 auth[20],
		      const u8 pubkey_digest[20], u32 *handle);
#endif /* CONFIG_TPM_LOAD_KEY_BY_SHA1 */

/**
 * Read random bytes from the TPM RNG. The implementation deals with the fact
 * that the TPM may legally return fewer bytes than requested by retrying
 * until @p count bytes have been received.
 *
 * @param dev		TPM device
 * @param data		output buffer for the random bytes
 * @param count		size of output buffer
 * @return return code of the operation
 */
u32 tpm_get_random(struct udevice *dev, void *data, u32 count);

/**
 * tpm_finalise_physical_presence() - Finalise physical presence
 *
 * @param dev		TPM device
 * @return return code of the operation (0 = success)
 */
u32 tpm_finalise_physical_presence(struct udevice *dev);

/**
 * tpm_nv_set_locked() - lock the non-volatile space
 *
 * @param dev		TPM device
 * @return return code of the operation (0 = success)
 */
u32 tpm_nv_set_locked(struct udevice *dev);

/**
 * tpm_set_global_lock() - set the global lock
 *
 * @param dev		TPM device
 * @return return code of the operation (0 = success)
 */
u32 tpm_set_global_lock(struct udevice *dev);

/**
 * tpm_resume() - start up the TPM from resume (after suspend)
 *
 * @param dev		TPM device
 * @return return code of the operation (0 = success)
 */
u32 tpm_resume(struct udevice *dev);

#endif /* __TPM_V1_H */
Commit	Line	Data
83d290c5	1	/* SPDX-License-Identifier: GPL-2.0+ */
5e124724	2	/*
8732b070	3	* Copyright (c) 2013 The Chromium OS Authors.
be6c1529	4	* Coypright (c) 2013 Guntermann & Drunck GmbH
5e124724 VB	5	*/
5e124724 VB	6
d677bfe2 MR	7	#ifndef __TPM_V1_H
d677bfe2 MR	8	#define __TPM_V1_H
5e124724	9
d677bfe2	10	#include <tpm-common.h>
f255d31f	11
d677bfe2 MR	12	/* Useful constants */
	13	enum {
	14	TPM_REQUEST_HEADER_LENGTH = 10,
	15	TPM_RESPONSE_HEADER_LENGTH = 10,
	16	PCR_DIGEST_LENGTH = 20,
	17	DIGEST_LENGTH = 20,
	18	TPM_REQUEST_AUTH_LENGTH = 45,
	19	TPM_RESPONSE_AUTH_LENGTH = 41,
	20	/* some max lengths, valid for RSA keys <= 2048 bits */
	21	TPM_KEY12_MAX_LENGTH = 618,
	22	TPM_PUBKEY_MAX_LENGTH = 288,
f255d31f SG	23	};
f255d31f SG	24
8732b070 CC	25	enum tpm_startup_type {
	26	TPM_ST_CLEAR = 0x0001,
	27	TPM_ST_STATE = 0x0002,
	28	TPM_ST_DEACTIVATED = 0x0003,
	29	};
	30
	31	enum tpm_physical_presence {
	32	TPM_PHYSICAL_PRESENCE_HW_DISABLE = 0x0200,
	33	TPM_PHYSICAL_PRESENCE_CMD_DISABLE = 0x0100,
	34	TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK = 0x0080,
	35	TPM_PHYSICAL_PRESENCE_HW_ENABLE = 0x0040,
	36	TPM_PHYSICAL_PRESENCE_CMD_ENABLE = 0x0020,
	37	TPM_PHYSICAL_PRESENCE_NOTPRESENT = 0x0010,
	38	TPM_PHYSICAL_PRESENCE_PRESENT = 0x0008,
	39	TPM_PHYSICAL_PRESENCE_LOCK = 0x0004,
	40	};
	41
	42	enum tpm_nv_index {
	43	TPM_NV_INDEX_LOCK = 0xffffffff,
	44	TPM_NV_INDEX_0 = 0x00000000,
	45	TPM_NV_INDEX_DIR = 0x10000001,
	46	};
	47
7690be35 MS	48	enum tpm_resource_type {
	49	TPM_RT_KEY = 0x00000001,
	50	TPM_RT_AUTH = 0x00000002,
	51	TPM_RT_HASH = 0x00000003,
	52	TPM_RT_TRANS = 0x00000004,
	53	TPM_RT_CONTEXT = 0x00000005,
	54	TPM_RT_COUNTER = 0x00000006,
	55	TPM_RT_DELEGATE = 0x00000007,
	56	TPM_RT_DAA_TPM = 0x00000008,
	57	TPM_RT_DAA_V0 = 0x00000009,
	58	TPM_RT_DAA_V1 = 0x0000000A,
	59	};
	60
	61	enum tpm_capability_areas {
	62	TPM_CAP_ORD = 0x00000001,
	63	TPM_CAP_ALG = 0x00000002,
	64	TPM_CAP_PID = 0x00000003,
	65	TPM_CAP_FLAG = 0x00000004,
	66	TPM_CAP_PROPERTY = 0x00000005,
	67	TPM_CAP_VERSION = 0x00000006,
	68	TPM_CAP_KEY_HANDLE = 0x00000007,
	69	TPM_CAP_CHECK_LOADED = 0x00000008,
	70	TPM_CAP_SYM_MODE = 0x00000009,
	71	TPM_CAP_KEY_STATUS = 0x0000000C,
	72	TPM_CAP_NV_LIST = 0x0000000D,
	73	TPM_CAP_MFR = 0x00000010,
	74	TPM_CAP_NV_INDEX = 0x00000011,
	75	TPM_CAP_TRANS_ALG = 0x00000012,
	76	TPM_CAP_HANDLE = 0x00000014,
	77	TPM_CAP_TRANS_ES = 0x00000015,
	78	TPM_CAP_AUTH_ENCRYPT = 0x00000017,
	79	TPM_CAP_SELECT_SIZE = 0x00000018,
	80	TPM_CAP_DA_LOGIC = 0x00000019,
	81	TPM_CAP_VERSION_VAL = 0x0000001A,
	82	};
	83
998af319 SG	84	enum tmp_cap_flag {
	85	TPM_CAP_FLAG_PERMANENT = 0x108,
	86	};
	87
	88	#define TPM_TAG_PERMANENT_FLAGS 0x001f
	89
fded837f MR	90	#define TPM_NV_PER_GLOBALLOCK BIT(15)
	91	#define TPM_NV_PER_PPREAD BIT(16)
	92	#define TPM_NV_PER_PPWRITE BIT(0)
	93	#define TPM_NV_PER_READ_STCLEAR BIT(31)
	94	#define TPM_NV_PER_WRITE_STCLEAR BIT(14)
	95	#define TPM_NV_PER_WRITEDEFINE BIT(13)
	96	#define TPM_NV_PER_WRITEALL BIT(12)
2132f971 SG	97
	98	enum {
	99	TPM_PUBEK_SIZE = 256,
	100	};
	101
998af319 SG	102	enum {
	103	TPM_CMD_EXTEND = 0x14,
	104	TPM_CMD_GET_CAPABILITY = 0x65,
	105	TPM_CMD_NV_DEFINE_SPACE = 0xcc,
	106	TPM_CMD_NV_WRITE_VALUE = 0xcd,
	107	TPM_CMD_NV_READ_VALUE = 0xcf,
	108	};
	109
be6c1529 RP	110	/**
	111	* TPM return codes as defined in the TCG Main specification
	112	* (TPM Main Part 2 Structures; Specification version 1.2)
	113	*/
	114	enum tpm_return_code {
	115	TPM_BASE = 0x00000000,
	116	TPM_NON_FATAL = 0x00000800,
	117	TPM_SUCCESS = TPM_BASE,
	118	/* TPM-defined fatal error codes */
	119	TPM_AUTHFAIL = TPM_BASE + 1,
	120	TPM_BADINDEX = TPM_BASE + 2,
	121	TPM_BAD_PARAMETER = TPM_BASE + 3,
	122	TPM_AUDITFAILURE = TPM_BASE + 4,
	123	TPM_CLEAR_DISABLED = TPM_BASE + 5,
	124	TPM_DEACTIVATED = TPM_BASE + 6,
	125	TPM_DISABLED = TPM_BASE + 7,
	126	TPM_DISABLED_CMD = TPM_BASE + 8,
	127	TPM_FAIL = TPM_BASE + 9,
	128	TPM_BAD_ORDINAL = TPM_BASE + 10,
	129	TPM_INSTALL_DISABLED = TPM_BASE + 11,
	130	TPM_INVALID_KEYHANDLE = TPM_BASE + 12,
	131	TPM_KEYNOTFOUND = TPM_BASE + 13,
	132	TPM_INAPPROPRIATE_ENC = TPM_BASE + 14,
	133	TPM_MIGRATE_FAIL = TPM_BASE + 15,
	134	TPM_INVALID_PCR_INFO = TPM_BASE + 16,
	135	TPM_NOSPACE = TPM_BASE + 17,
	136	TPM_NOSRK = TPM_BASE + 18,
	137	TPM_NOTSEALED_BLOB = TPM_BASE + 19,
	138	TPM_OWNER_SET = TPM_BASE + 20,
	139	TPM_RESOURCES = TPM_BASE + 21,
	140	TPM_SHORTRANDOM = TPM_BASE + 22,
	141	TPM_SIZE = TPM_BASE + 23,
	142	TPM_WRONGPCRVAL = TPM_BASE + 24,
	143	TPM_BAD_PARAM_SIZE = TPM_BASE + 25,
	144	TPM_SHA_THREAD = TPM_BASE + 26,
	145	TPM_SHA_ERROR = TPM_BASE + 27,
	146	TPM_FAILEDSELFTEST = TPM_BASE + 28,
	147	TPM_AUTH2FAIL = TPM_BASE + 29,
	148	TPM_BADTAG = TPM_BASE + 30,
	149	TPM_IOERROR = TPM_BASE + 31,
	150	TPM_ENCRYPT_ERROR = TPM_BASE + 32,
	151	TPM_DECRYPT_ERROR = TPM_BASE + 33,
	152	TPM_INVALID_AUTHHANDLE = TPM_BASE + 34,
	153	TPM_NO_ENDORSEMENT = TPM_BASE + 35,
	154	TPM_INVALID_KEYUSAGE = TPM_BASE + 36,
	155	TPM_WRONG_ENTITYTYPE = TPM_BASE + 37,
	156	TPM_INVALID_POSTINIT = TPM_BASE + 38,
	157	TPM_INAPPROPRIATE_SIG = TPM_BASE + 39,
	158	TPM_BAD_KEY_PROPERTY = TPM_BASE + 40,
	159	TPM_BAD_MIGRATION = TPM_BASE + 41,
	160	TPM_BAD_SCHEME = TPM_BASE + 42,
	161	TPM_BAD_DATASIZE = TPM_BASE + 43,
	162	TPM_BAD_MODE = TPM_BASE + 44,
	163	TPM_BAD_PRESENCE = TPM_BASE + 45,
	164	TPM_BAD_VERSION = TPM_BASE + 46,
	165	TPM_NO_WRAP_TRANSPORT = TPM_BASE + 47,
	166	TPM_AUDITFAIL_UNSUCCESSFUL = TPM_BASE + 48,
	167	TPM_AUDITFAIL_SUCCESSFUL = TPM_BASE + 49,
	168	TPM_NOTRESETABLE = TPM_BASE + 50,
	169	TPM_NOTLOCAL = TPM_BASE + 51,
	170	TPM_BAD_TYPE = TPM_BASE + 52,
	171	TPM_INVALID_RESOURCE = TPM_BASE + 53,
	172	TPM_NOTFIPS = TPM_BASE + 54,
	173	TPM_INVALID_FAMILY = TPM_BASE + 55,
174	TPM_NO_NV_PERMISSION = TPM_BASE + 56,
175	TPM_REQUIRES_SIGN = TPM_BASE + 57,
176	TPM_KEY_NOTSUPPORTED = TPM_BASE + 58,
177	TPM_AUTH_CONFLICT = TPM_BASE + 59,
178	TPM_AREA_LOCKED = TPM_BASE + 60,
179	TPM_BAD_LOCALITY = TPM_BASE + 61,
180	TPM_READ_ONLY = TPM_BASE + 62,
181	TPM_PER_NOWRITE = TPM_BASE + 63,
182	TPM_FAMILY_COUNT = TPM_BASE + 64,
183	TPM_WRITE_LOCKED = TPM_BASE + 65,
184	TPM_BAD_ATTRIBUTES = TPM_BASE + 66,
185	TPM_INVALID_STRUCTURE = TPM_BASE + 67,
186	TPM_KEY_OWNER_CONTROL = TPM_BASE + 68,
187	TPM_BAD_COUNTER = TPM_BASE + 69,
188	TPM_NOT_FULLWRITE = TPM_BASE + 70,
189	TPM_CONTEXT_GAP = TPM_BASE + 71,
190	TPM_MAXNVWRITES = TPM_BASE + 72,
191	TPM_NOOPERATOR = TPM_BASE + 73,
192	TPM_RESOURCEMISSING = TPM_BASE + 74,
193	TPM_DELEGATE_LOCK = TPM_BASE + 75,
194	TPM_DELEGATE_FAMILY = TPM_BASE + 76,
195	TPM_DELEGATE_ADMIN = TPM_BASE + 77,
196	TPM_TRANSPORT_NOTEXCLUSIVE = TPM_BASE + 78,
197	TPM_OWNER_CONTROL = TPM_BASE + 79,
198	TPM_DAA_RESOURCES = TPM_BASE + 80,
199	TPM_DAA_INPUT_DATA0 = TPM_BASE + 81,
200	TPM_DAA_INPUT_DATA1 = TPM_BASE + 82,
201	TPM_DAA_ISSUER_SETTINGS = TPM_BASE + 83,
202	TPM_DAA_TPM_SETTINGS = TPM_BASE + 84,
203	TPM_DAA_STAGE = TPM_BASE + 85,
204	TPM_DAA_ISSUER_VALIDITY = TPM_BASE + 86,
205	TPM_DAA_WRONG_W = TPM_BASE + 87,
206	TPM_BAD_HANDLE = TPM_BASE + 88,
207	TPM_BAD_DELEGATE = TPM_BASE + 89,
208	TPM_BADCONTEXT = TPM_BASE + 90,
209	TPM_TOOMANYCONTEXTS = TPM_BASE + 91,
210	TPM_MA_TICKET_SIGNATURE = TPM_BASE + 92,
211	TPM_MA_DESTINATION = TPM_BASE + 93,
212	TPM_MA_SOURCE = TPM_BASE + 94,
213	TPM_MA_AUTHORITY = TPM_BASE + 95,
214	TPM_PERMANENTEK = TPM_BASE + 97,
215	TPM_BAD_SIGNATURE = TPM_BASE + 98,
216	TPM_NOCONTEXTSPACE = TPM_BASE + 99,
217	/* TPM-defined non-fatal errors */
218	TPM_RETRY = TPM_BASE + TPM_NON_FATAL,
219	TPM_NEEDS_SELFTEST = TPM_BASE + TPM_NON_FATAL + 1,
220	TPM_DOING_SELFTEST = TPM_BASE + TPM_NON_FATAL + 2,
221	TPM_DEFEND_LOCK_RUNNING = TPM_BASE + TPM_NON_FATAL + 3,
222	};
f255d31f	223
2132f971 SG	224	struct tpm_permanent_flags {
	225	__be16 tag;
	226	u8 disable;
	227	u8 ownership;
	228	u8 deactivated;
	229	u8 read_pubek;
	230	u8 disable_owner_clear;
	231	u8 allow_maintenance;
	232	u8 physical_presence_lifetime_lock;
	233	u8 physical_presence_hw_enable;
	234	u8 physical_presence_cmd_enable;
	235	u8 cekp_used;
	236	u8 tpm_post;
	237	u8 tpm_post_lock;
	238	u8 fips;
	239	u8 operator;
	240	u8 enable_revoke_ek;
	241	u8 nv_locked;
	242	u8 read_srk_pub;
	243	u8 tpm_established;
	244	u8 maintenance_done;
	245	u8 disable_full_da_logic_info;
	246	} __packed;
	247
ef8a2500 SG	248	#define TPM_SHA1_160_HASH_LEN 0x14
	249
	250	struct __packed tpm_composite_hash {
	251	u8 digest[TPM_SHA1_160_HASH_LEN];
	252	};
	253
	254	struct __packed tpm_pcr_selection {
	255	__be16 size_of_select;
	256	u8 pcr_select[3]; /* matches vboot's struct */
	257	};
	258
	259	struct __packed tpm_pcr_info_short {
	260	struct tpm_pcr_selection pcr_selection;
	261	u8 locality_at_release;
	262	struct tpm_composite_hash digest_at_release;
	263	};
	264
	265	struct __packed tpm_nv_attributes {
	266	__be16 tag;
	267	__be32 attributes;
	268	};
	269
	270	struct __packed tpm_nv_data_public {
	271	__be16 tag;
	272	__be32 nv_index;
	273	struct tpm_pcr_info_short pcr_info_read;
	274	struct tpm_pcr_info_short pcr_info_write;
	275	struct tpm_nv_attributes permission;
	276	u8 read_st_clear;
	277	u8 write_st_clear;
	278	u8 write_define;
	279	__be32 data_size;
	280	};
	281
8732b070 CC	282	/**
8732b070 CC	283	* Issue a TPM_Startup command.
5e124724	284	*
abdc7b8a	285	* @param dev TPM device
8732b070 CC	286	* @param mode TPM startup mode
	287	* @return return code of the operation
	288	*/
abdc7b8a	289	u32 tpm_startup(struct udevice *dev, enum tpm_startup_type mode);
8732b070 CC	290
	291	/**
	292	* Issue a TPM_SelfTestFull command.
5e124724	293	*
abdc7b8a	294	* @param dev TPM device
8732b070	295	* @return return code of the operation
5e124724	296	*/
abdc7b8a	297	u32 tpm_self_test_full(struct udevice *dev);
5e124724	298
8732b070 CC	299	/**
8732b070 CC	300	* Issue a TPM_ContinueSelfTest command.
5e124724	301	*
abdc7b8a	302	* @param dev TPM device
8732b070	303	* @return return code of the operation
5e124724	304	*/
abdc7b8a	305	u32 tpm_continue_self_test(struct udevice *dev);
5e124724	306
8732b070 CC	307	/**
	308	* Issue a TPM_NV_DefineSpace command. The implementation is limited
	309	* to specify TPM_NV_ATTRIBUTES and size of the area. The area index
	310	* could be one of the special value listed in enum tpm_nv_index.
5e124724	311	*
abdc7b8a	312	* @param dev TPM device
8732b070 CC	313	* @param index index of the area
	314	* @param perm TPM_NV_ATTRIBUTES of the area
	315	* @param size size of the area
	316	* @return return code of the operation
	317	*/
abdc7b8a	318	u32 tpm_nv_define_space(struct udevice *dev, u32 index, u32 perm, u32 size);
8732b070 CC	319
	320	/**
	321	* Issue a TPM_NV_ReadValue command. This implementation is limited
	322	* to read the area from offset 0. The area index could be one of
	323	* the special value listed in enum tpm_nv_index.
	324	*
abdc7b8a	325	* @param dev TPM device
8732b070 CC	326	* @param index index of the area
	327	* @param data output buffer of the area contents
	328	* @param count size of output buffer
	329	* @return return code of the operation
	330	*/
abdc7b8a	331	u32 tpm_nv_read_value(struct udevice dev, u32 index, void data, u32 count);
8732b070 CC	332
	333	/**
	334	* Issue a TPM_NV_WriteValue command. This implementation is limited
	335	* to write the area from offset 0. The area index could be one of
	336	* the special value listed in enum tpm_nv_index.
	337	*
abdc7b8a	338	* @param dev TPM device
8732b070 CC	339	* @param index index of the area
	340	* @param data input buffer to be wrote to the area
	341	* @param length length of data bytes of input buffer
	342	* @return return code of the operation
	343	*/
abdc7b8a SG	344	u32 tpm_nv_write_value(struct udevice dev, u32 index, const void data,
abdc7b8a SG	345	u32 length);
8732b070 CC	346
	347	/**
	348	* Issue a TPM_Extend command.
	349	*
abdc7b8a	350	* @param dev TPM device
8732b070 CC	351	* @param index index of the PCR
	352	* @param in_digest 160-bit value representing the event to be
	353	* recorded
	354	* @param out_digest 160-bit PCR value after execution of the
	355	* command
	356	* @return return code of the operation
	357	*/
abdc7b8a SG	358	u32 tpm_extend(struct udevice dev, u32 index, const void in_digest,
abdc7b8a SG	359	void *out_digest);
8732b070 CC	360
	361	/**
	362	* Issue a TPM_PCRRead command.
5e124724	363	*
abdc7b8a	364	* @param dev TPM device
8732b070 CC	365	* @param index index of the PCR
	366	* @param data output buffer for contents of the named PCR
	367	* @param count size of output buffer
	368	* @return return code of the operation
	369	*/
abdc7b8a	370	u32 tpm_pcr_read(struct udevice dev, u32 index, void data, size_t count);
8732b070 CC	371
	372	/**
	373	* Issue a TSC_PhysicalPresence command. TPM physical presence flag
	374	* is bit-wise OR'ed of flags listed in enum tpm_physical_presence.
	375	*
abdc7b8a	376	* @param dev TPM device
8732b070 CC	377	* @param presence TPM physical presence flag
	378	* @return return code of the operation
	379	*/
abdc7b8a	380	u32 tpm_tsc_physical_presence(struct udevice *dev, u16 presence);
8732b070 CC	381
	382	/**
	383	* Issue a TPM_ReadPubek command.
	384	*
abdc7b8a	385	* @param dev TPM device
8732b070	386	* @param data output buffer for the public endorsement key
52da18a3	387	* @param count size of output buffer
8732b070 CC	388	* @return return code of the operation
8732b070 CC	389	*/
abdc7b8a	390	u32 tpm_read_pubek(struct udevice dev, void data, size_t count);
8732b070 CC	391
	392	/**
	393	* Issue a TPM_ForceClear command.
	394	*
abdc7b8a	395	* @param dev TPM device
8732b070 CC	396	* @return return code of the operation
8732b070 CC	397	*/
abdc7b8a	398	u32 tpm_force_clear(struct udevice *dev);
8732b070 CC	399
	400	/**
	401	* Issue a TPM_PhysicalEnable command.
	402	*
abdc7b8a	403	* @param dev TPM device
8732b070 CC	404	* @return return code of the operation
8732b070 CC	405	*/
abdc7b8a	406	u32 tpm_physical_enable(struct udevice *dev);
8732b070 CC	407
	408	/**
	409	* Issue a TPM_PhysicalDisable command.
	410	*
abdc7b8a	411	* @param dev TPM device
8732b070 CC	412	* @return return code of the operation
8732b070 CC	413	*/
abdc7b8a	414	u32 tpm_physical_disable(struct udevice *dev);
8732b070 CC	415
	416	/**
	417	* Issue a TPM_PhysicalSetDeactivated command.
	418	*
abdc7b8a	419	* @param dev TPM device
8732b070 CC	420	* @param state boolean state of the deactivated flag
	421	* @return return code of the operation
	422	*/
abdc7b8a	423	u32 tpm_physical_set_deactivated(struct udevice *dev, u8 state);
8732b070 CC	424
	425	/**
	426	* Issue a TPM_GetCapability command. This implementation is limited
	427	* to query sub_cap index that is 4-byte wide.
5e124724	428	*
abdc7b8a	429	* @param dev TPM device
8732b070 CC	430	* @param cap_area partition of capabilities
	431	* @param sub_cap further definition of capability, which is
	432	* limited to be 4-byte wide
	433	* @param cap output buffer for capability information
52da18a3	434	* @param count size of output buffer
8732b070	435	* @return return code of the operation
5e124724	436	*/
abdc7b8a SG	437	u32 tpm_get_capability(struct udevice *dev, u32 cap_area, u32 sub_cap,
abdc7b8a SG	438	void *cap, size_t count);
5e124724	439
be6c1529	440	/**
52da18a3	441	* Issue a TPM_FlushSpecific command for a AUTH resource.
be6c1529	442	*
abdc7b8a	443	* @param dev TPM device
be6c1529 RP	444	* @param auth_handle handle of the auth session
	445	* @return return code of the operation
	446	*/
abdc7b8a	447	u32 tpm_terminate_auth_session(struct udevice *dev, u32 auth_handle);
be6c1529 RP	448
be6c1529 RP	449	/**
52da18a3	450	* Issue a TPM_OIAP command to setup an object independent authorization
be6c1529 RP	451	* session.
	452	* Information about the session is stored internally.
	453	* If there was already an OIAP session active it is terminated and a new
	454	* session is set up.
	455	*
abdc7b8a	456	* @param dev TPM device
be6c1529 RP	457	* @param auth_handle pointer to the (new) auth handle or NULL.
	458	* @return return code of the operation
	459	*/
abdc7b8a	460	u32 tpm_oiap(struct udevice dev, u32 auth_handle);
be6c1529 RP	461
	462	/**
	463	* Ends an active OIAP session.
	464	*
abdc7b8a	465	* @param dev TPM device
be6c1529 RP	466	* @return return code of the operation
be6c1529 RP	467	*/
abdc7b8a	468	u32 tpm_end_oiap(struct udevice *dev);
be6c1529 RP	469
	470	/**
	471	* Issue a TPM_LoadKey2 (Auth1) command using an OIAP session for authenticating
	472	* the usage of the parent key.
	473	*
abdc7b8a	474	* @param dev TPM device
be6c1529 RP	475	* @param parent_handle handle of the parent key.
	476	* @param key pointer to the key structure (TPM_KEY or TPM_KEY12).
	477	* @param key_length size of the key structure
	478	* @param parent_key_usage_auth usage auth for the parent key
	479	* @param key_handle pointer to the key handle
	480	* @return return code of the operation
	481	*/
abdc7b8a SG	482	u32 tpm_load_key2_oiap(struct udevice dev, u32 parent_handle, const void key,
	483	size_t key_length, const void *parent_key_usage_auth,
	484	u32 *key_handle);
be6c1529 RP	485
	486	/**
	487	* Issue a TPM_GetPubKey (Auth1) command using an OIAP session for
	488	* authenticating the usage of the key.
	489	*
abdc7b8a	490	* @param dev TPM device
be6c1529 RP	491	* @param key_handle handle of the key
	492	* @param usage_auth usage auth for the key
	493	* @param pubkey pointer to the pub key buffer; may be NULL if the pubkey
	494	* should not be stored.
	495	* @param pubkey_len pointer to the pub key buffer len. On entry: the size of
	496	* the provided pubkey buffer. On successful exit: the size
	497	* of the stored TPM_PUBKEY structure (iff pubkey != NULL).
	498	* @return return code of the operation
	499	*/
abdc7b8a SG	500	u32 tpm_get_pub_key_oiap(struct udevice *dev, u32 key_handle,
abdc7b8a SG	501	const void usage_auth, void pubkey,
b9804e5b	502	size_t *pubkey_len);
be6c1529	503
2132f971 SG	504	/**
	505	* Get the TPM permanent flags value
	506	*
abdc7b8a	507	* @param dev TPM device
2132f971 SG	508	* @param pflags Place to put permanent flags
	509	* @return return code of the operation
	510	*/
abdc7b8a SG	511	u32 tpm_get_permanent_flags(struct udevice *dev,
abdc7b8a SG	512	struct tpm_permanent_flags *pflags);
2132f971 SG	513
	514	/**
	515	* Get the TPM permissions
	516	*
abdc7b8a	517	* @param dev TPM device
2132f971 SG	518	* @param perm Returns permissions value
	519	* @return return code of the operation
	520	*/
abdc7b8a	521	u32 tpm_get_permissions(struct udevice dev, u32 index, u32 perm);
2132f971	522
7690be35 MS	523	/**
	524	* Flush a resource with a given handle and type from the TPM
	525	*
abdc7b8a	526	* @param dev TPM device
7690be35 MS	527	* @param key_handle handle of the resource
	528	* @param resource_type type of the resource
	529	* @return return code of the operation
	530	*/
abdc7b8a	531	u32 tpm_flush_specific(struct udevice *dev, u32 key_handle, u32 resource_type);
7690be35	532
0f4b2ba1	533	#ifdef CONFIG_TPM_LOAD_KEY_BY_SHA1
	534	/**
	535	* Search for a key by usage AuthData and the hash of the parent's pub key.
	536	*
abdc7b8a	537	* @param dev TPM device
0f4b2ba1	538	* @param auth Usage auth of the key to search for
	539	* @param pubkey_digest SHA1 hash of the pub key structure of the key
	540	* @param[out] handle The handle of the key (Non-null iff found)
	541	* @return 0 if key was found in TPM; != 0 if not.
	542	*/
abdc7b8a SG	543	u32 tpm_find_key_sha1(struct udevice *dev, const u8 auth[20],
abdc7b8a SG	544	const u8 pubkey_digest[20], u32 *handle);
0f4b2ba1	545	#endif /* CONFIG_TPM_LOAD_KEY_BY_SHA1 */
3c605027 AD	546
	547	/**
	548	* Read random bytes from the TPM RNG. The implementation deals with the fact
	549	* that the TPM may legally return fewer bytes than requested by retrying
	550	* until @p count bytes have been received.
	551	*
abdc7b8a	552	* @param dev TPM device
3c605027 AD	553	* @param data output buffer for the random bytes
	554	* @param count size of output buffer
	555	* @return return code of the operation
	556	*/
abdc7b8a	557	u32 tpm_get_random(struct udevice dev, void data, u32 count);
3c605027	558
6e64ec12 SG	559	/**
	560	* tpm_finalise_physical_presence() - Finalise physical presence
	561	*
abdc7b8a	562	* @param dev TPM device
6e64ec12 SG	563	* @return return code of the operation (0 = success)
6e64ec12 SG	564	*/
abdc7b8a	565	u32 tpm_finalise_physical_presence(struct udevice *dev);
6e64ec12 SG	566
	567	/**
	568	* tpm_nv_set_locked() - lock the non-volatile space
	569	*
abdc7b8a	570	* @param dev TPM device
6e64ec12 SG	571	* @return return code of the operation (0 = success)
6e64ec12 SG	572	*/
abdc7b8a	573	u32 tpm_nv_set_locked(struct udevice *dev);
6e64ec12 SG	574
	575	/**
	576	* tpm_set_global_lock() - set the global lock
	577	*
abdc7b8a	578	* @param dev TPM device
6e64ec12 SG	579	* @return return code of the operation (0 = success)
6e64ec12 SG	580	*/
abdc7b8a	581	u32 tpm_set_global_lock(struct udevice *dev);
6e64ec12 SG	582
	583	/**
	584	* tpm_resume() - start up the TPM from resume (after suspend)
	585	*
abdc7b8a	586	* @param dev TPM device
6e64ec12 SG	587	* @return return code of the operation (0 = success)
6e64ec12 SG	588	*/
abdc7b8a	589	u32 tpm_resume(struct udevice *dev);
6e64ec12	590
d677bfe2	591	#endif /* __TPM_V1_H */