]>
Commit | Line | Data |
---|---|---|
5e124724 | 1 | /* |
8732b070 | 2 | * Copyright (c) 2013 The Chromium OS Authors. |
be6c1529 | 3 | * Coypright (c) 2013 Guntermann & Drunck GmbH |
5e124724 | 4 | * |
1a459660 | 5 | * SPDX-License-Identifier: GPL-2.0+ |
5e124724 VB |
6 | */ |
7 | ||
8732b070 CC |
8 | #ifndef __TPM_H |
9 | #define __TPM_H | |
5e124724 | 10 | |
8732b070 | 11 | #include <tis.h> |
5e124724 VB |
12 | |
13 | /* | |
8732b070 CC |
14 | * Here is a partial implementation of TPM commands. Please consult TCG Main |
15 | * Specification for definitions of TPM commands. | |
16 | */ | |
17 | ||
f255d31f SG |
18 | #define TPM_HEADER_SIZE 10 |
19 | ||
20 | enum tpm_duration { | |
21 | TPM_SHORT = 0, | |
22 | TPM_MEDIUM = 1, | |
23 | TPM_LONG = 2, | |
24 | TPM_UNDEFINED, | |
25 | ||
26 | TPM_DURATION_COUNT, | |
27 | }; | |
28 | ||
8732b070 CC |
29 | enum tpm_startup_type { |
30 | TPM_ST_CLEAR = 0x0001, | |
31 | TPM_ST_STATE = 0x0002, | |
32 | TPM_ST_DEACTIVATED = 0x0003, | |
33 | }; | |
34 | ||
35 | enum tpm_physical_presence { | |
36 | TPM_PHYSICAL_PRESENCE_HW_DISABLE = 0x0200, | |
37 | TPM_PHYSICAL_PRESENCE_CMD_DISABLE = 0x0100, | |
38 | TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK = 0x0080, | |
39 | TPM_PHYSICAL_PRESENCE_HW_ENABLE = 0x0040, | |
40 | TPM_PHYSICAL_PRESENCE_CMD_ENABLE = 0x0020, | |
41 | TPM_PHYSICAL_PRESENCE_NOTPRESENT = 0x0010, | |
42 | TPM_PHYSICAL_PRESENCE_PRESENT = 0x0008, | |
43 | TPM_PHYSICAL_PRESENCE_LOCK = 0x0004, | |
44 | }; | |
45 | ||
46 | enum tpm_nv_index { | |
47 | TPM_NV_INDEX_LOCK = 0xffffffff, | |
48 | TPM_NV_INDEX_0 = 0x00000000, | |
49 | TPM_NV_INDEX_DIR = 0x10000001, | |
50 | }; | |
51 | ||
2132f971 SG |
52 | #define TPM_NV_PER_GLOBALLOCK (1U << 15) |
53 | #define TPM_NV_PER_PPWRITE (1U << 0) | |
54 | #define TPM_NV_PER_READ_STCLEAR (1U << 31) | |
55 | #define TPM_NV_PER_WRITE_STCLEAR (1U << 14) | |
56 | ||
57 | enum { | |
58 | TPM_PUBEK_SIZE = 256, | |
59 | }; | |
60 | ||
be6c1529 RP |
61 | /** |
62 | * TPM return codes as defined in the TCG Main specification | |
63 | * (TPM Main Part 2 Structures; Specification version 1.2) | |
64 | */ | |
65 | enum tpm_return_code { | |
66 | TPM_BASE = 0x00000000, | |
67 | TPM_NON_FATAL = 0x00000800, | |
68 | TPM_SUCCESS = TPM_BASE, | |
69 | /* TPM-defined fatal error codes */ | |
70 | TPM_AUTHFAIL = TPM_BASE + 1, | |
71 | TPM_BADINDEX = TPM_BASE + 2, | |
72 | TPM_BAD_PARAMETER = TPM_BASE + 3, | |
73 | TPM_AUDITFAILURE = TPM_BASE + 4, | |
74 | TPM_CLEAR_DISABLED = TPM_BASE + 5, | |
75 | TPM_DEACTIVATED = TPM_BASE + 6, | |
76 | TPM_DISABLED = TPM_BASE + 7, | |
77 | TPM_DISABLED_CMD = TPM_BASE + 8, | |
78 | TPM_FAIL = TPM_BASE + 9, | |
79 | TPM_BAD_ORDINAL = TPM_BASE + 10, | |
80 | TPM_INSTALL_DISABLED = TPM_BASE + 11, | |
81 | TPM_INVALID_KEYHANDLE = TPM_BASE + 12, | |
82 | TPM_KEYNOTFOUND = TPM_BASE + 13, | |
83 | TPM_INAPPROPRIATE_ENC = TPM_BASE + 14, | |
84 | TPM_MIGRATE_FAIL = TPM_BASE + 15, | |
85 | TPM_INVALID_PCR_INFO = TPM_BASE + 16, | |
86 | TPM_NOSPACE = TPM_BASE + 17, | |
87 | TPM_NOSRK = TPM_BASE + 18, | |
88 | TPM_NOTSEALED_BLOB = TPM_BASE + 19, | |
89 | TPM_OWNER_SET = TPM_BASE + 20, | |
90 | TPM_RESOURCES = TPM_BASE + 21, | |
91 | TPM_SHORTRANDOM = TPM_BASE + 22, | |
92 | TPM_SIZE = TPM_BASE + 23, | |
93 | TPM_WRONGPCRVAL = TPM_BASE + 24, | |
94 | TPM_BAD_PARAM_SIZE = TPM_BASE + 25, | |
95 | TPM_SHA_THREAD = TPM_BASE + 26, | |
96 | TPM_SHA_ERROR = TPM_BASE + 27, | |
97 | TPM_FAILEDSELFTEST = TPM_BASE + 28, | |
98 | TPM_AUTH2FAIL = TPM_BASE + 29, | |
99 | TPM_BADTAG = TPM_BASE + 30, | |
100 | TPM_IOERROR = TPM_BASE + 31, | |
101 | TPM_ENCRYPT_ERROR = TPM_BASE + 32, | |
102 | TPM_DECRYPT_ERROR = TPM_BASE + 33, | |
103 | TPM_INVALID_AUTHHANDLE = TPM_BASE + 34, | |
104 | TPM_NO_ENDORSEMENT = TPM_BASE + 35, | |
105 | TPM_INVALID_KEYUSAGE = TPM_BASE + 36, | |
106 | TPM_WRONG_ENTITYTYPE = TPM_BASE + 37, | |
107 | TPM_INVALID_POSTINIT = TPM_BASE + 38, | |
108 | TPM_INAPPROPRIATE_SIG = TPM_BASE + 39, | |
109 | TPM_BAD_KEY_PROPERTY = TPM_BASE + 40, | |
110 | TPM_BAD_MIGRATION = TPM_BASE + 41, | |
111 | TPM_BAD_SCHEME = TPM_BASE + 42, | |
112 | TPM_BAD_DATASIZE = TPM_BASE + 43, | |
113 | TPM_BAD_MODE = TPM_BASE + 44, | |
114 | TPM_BAD_PRESENCE = TPM_BASE + 45, | |
115 | TPM_BAD_VERSION = TPM_BASE + 46, | |
116 | TPM_NO_WRAP_TRANSPORT = TPM_BASE + 47, | |
117 | TPM_AUDITFAIL_UNSUCCESSFUL = TPM_BASE + 48, | |
118 | TPM_AUDITFAIL_SUCCESSFUL = TPM_BASE + 49, | |
119 | TPM_NOTRESETABLE = TPM_BASE + 50, | |
120 | TPM_NOTLOCAL = TPM_BASE + 51, | |
121 | TPM_BAD_TYPE = TPM_BASE + 52, | |
122 | TPM_INVALID_RESOURCE = TPM_BASE + 53, | |
123 | TPM_NOTFIPS = TPM_BASE + 54, | |
124 | TPM_INVALID_FAMILY = TPM_BASE + 55, | |
125 | TPM_NO_NV_PERMISSION = TPM_BASE + 56, | |
126 | TPM_REQUIRES_SIGN = TPM_BASE + 57, | |
127 | TPM_KEY_NOTSUPPORTED = TPM_BASE + 58, | |
128 | TPM_AUTH_CONFLICT = TPM_BASE + 59, | |
129 | TPM_AREA_LOCKED = TPM_BASE + 60, | |
130 | TPM_BAD_LOCALITY = TPM_BASE + 61, | |
131 | TPM_READ_ONLY = TPM_BASE + 62, | |
132 | TPM_PER_NOWRITE = TPM_BASE + 63, | |
133 | TPM_FAMILY_COUNT = TPM_BASE + 64, | |
134 | TPM_WRITE_LOCKED = TPM_BASE + 65, | |
135 | TPM_BAD_ATTRIBUTES = TPM_BASE + 66, | |
136 | TPM_INVALID_STRUCTURE = TPM_BASE + 67, | |
137 | TPM_KEY_OWNER_CONTROL = TPM_BASE + 68, | |
138 | TPM_BAD_COUNTER = TPM_BASE + 69, | |
139 | TPM_NOT_FULLWRITE = TPM_BASE + 70, | |
140 | TPM_CONTEXT_GAP = TPM_BASE + 71, | |
141 | TPM_MAXNVWRITES = TPM_BASE + 72, | |
142 | TPM_NOOPERATOR = TPM_BASE + 73, | |
143 | TPM_RESOURCEMISSING = TPM_BASE + 74, | |
144 | TPM_DELEGATE_LOCK = TPM_BASE + 75, | |
145 | TPM_DELEGATE_FAMILY = TPM_BASE + 76, | |
146 | TPM_DELEGATE_ADMIN = TPM_BASE + 77, | |
147 | TPM_TRANSPORT_NOTEXCLUSIVE = TPM_BASE + 78, | |
148 | TPM_OWNER_CONTROL = TPM_BASE + 79, | |
149 | TPM_DAA_RESOURCES = TPM_BASE + 80, | |
150 | TPM_DAA_INPUT_DATA0 = TPM_BASE + 81, | |
151 | TPM_DAA_INPUT_DATA1 = TPM_BASE + 82, | |
152 | TPM_DAA_ISSUER_SETTINGS = TPM_BASE + 83, | |
153 | TPM_DAA_TPM_SETTINGS = TPM_BASE + 84, | |
154 | TPM_DAA_STAGE = TPM_BASE + 85, | |
155 | TPM_DAA_ISSUER_VALIDITY = TPM_BASE + 86, | |
156 | TPM_DAA_WRONG_W = TPM_BASE + 87, | |
157 | TPM_BAD_HANDLE = TPM_BASE + 88, | |
158 | TPM_BAD_DELEGATE = TPM_BASE + 89, | |
159 | TPM_BADCONTEXT = TPM_BASE + 90, | |
160 | TPM_TOOMANYCONTEXTS = TPM_BASE + 91, | |
161 | TPM_MA_TICKET_SIGNATURE = TPM_BASE + 92, | |
162 | TPM_MA_DESTINATION = TPM_BASE + 93, | |
163 | TPM_MA_SOURCE = TPM_BASE + 94, | |
164 | TPM_MA_AUTHORITY = TPM_BASE + 95, | |
165 | TPM_PERMANENTEK = TPM_BASE + 97, | |
166 | TPM_BAD_SIGNATURE = TPM_BASE + 98, | |
167 | TPM_NOCONTEXTSPACE = TPM_BASE + 99, | |
168 | /* TPM-defined non-fatal errors */ | |
169 | TPM_RETRY = TPM_BASE + TPM_NON_FATAL, | |
170 | TPM_NEEDS_SELFTEST = TPM_BASE + TPM_NON_FATAL + 1, | |
171 | TPM_DOING_SELFTEST = TPM_BASE + TPM_NON_FATAL + 2, | |
172 | TPM_DEFEND_LOCK_RUNNING = TPM_BASE + TPM_NON_FATAL + 3, | |
173 | }; | |
f255d31f | 174 | |
2132f971 SG |
175 | struct tpm_permanent_flags { |
176 | __be16 tag; | |
177 | u8 disable; | |
178 | u8 ownership; | |
179 | u8 deactivated; | |
180 | u8 read_pubek; | |
181 | u8 disable_owner_clear; | |
182 | u8 allow_maintenance; | |
183 | u8 physical_presence_lifetime_lock; | |
184 | u8 physical_presence_hw_enable; | |
185 | u8 physical_presence_cmd_enable; | |
186 | u8 cekp_used; | |
187 | u8 tpm_post; | |
188 | u8 tpm_post_lock; | |
189 | u8 fips; | |
190 | u8 operator; | |
191 | u8 enable_revoke_ek; | |
192 | u8 nv_locked; | |
193 | u8 read_srk_pub; | |
194 | u8 tpm_established; | |
195 | u8 maintenance_done; | |
196 | u8 disable_full_da_logic_info; | |
197 | } __packed; | |
198 | ||
f255d31f SG |
199 | #ifdef CONFIG_DM_TPM |
200 | ||
201 | /* Max buffer size supported by our tpm */ | |
202 | #define TPM_DEV_BUFSIZE 1260 | |
203 | ||
204 | /** | |
205 | * struct tpm_chip_priv - Information about a TPM, stored by the uclass | |
206 | * | |
207 | * These values must be set up by the device's probe() method before | |
208 | * communcation is attempted. If the device has an xfer() method, this is | |
209 | * not needed. There is no need to set up @buf. | |
210 | * | |
211 | * @duration_ms: Length of each duration type in milliseconds | |
212 | * @retry_time_ms: Time to wait before retrying receive | |
213 | */ | |
214 | struct tpm_chip_priv { | |
215 | uint duration_ms[TPM_DURATION_COUNT]; | |
216 | uint retry_time_ms; | |
217 | u8 buf[TPM_DEV_BUFSIZE + sizeof(u8)]; /* Max buffer size + addr */ | |
218 | }; | |
219 | ||
220 | /** | |
221 | * struct tpm_ops - low-level TPM operations | |
222 | * | |
223 | * These are designed to avoid loops and delays in the driver itself. These | |
224 | * should be handled in the uclass. | |
225 | * | |
226 | * In gneral you should implement everything except xfer(). Where you need | |
227 | * complete control of the transfer, then xfer() can be provided and will | |
228 | * override the other methods. | |
229 | * | |
230 | * This interface is for low-level TPM access. It does not understand the | |
231 | * concept of localities or the various TPM messages. That interface is | |
232 | * defined in the functions later on in this file, but they all translate | |
233 | * to bytes which are sent and received. | |
234 | */ | |
235 | struct tpm_ops { | |
236 | /** | |
237 | * open() - Request access to locality 0 for the caller | |
238 | * | |
239 | * After all commands have been completed the caller should call | |
240 | * close(). | |
241 | * | |
242 | * @dev: Device to close | |
243 | * @return 0 ok OK, -ve on error | |
244 | */ | |
245 | int (*open)(struct udevice *dev); | |
246 | ||
247 | /** | |
248 | * close() - Close the current session | |
249 | * | |
250 | * Releasing the locked locality. Returns 0 on success, -ve 1 on | |
251 | * failure (in case lock removal did not succeed). | |
252 | * | |
253 | * @dev: Device to close | |
254 | * @return 0 ok OK, -ve on error | |
255 | */ | |
256 | int (*close)(struct udevice *dev); | |
257 | ||
258 | /** | |
259 | * get_desc() - Get a text description of the TPM | |
260 | * | |
261 | * @dev: Device to check | |
262 | * @buf: Buffer to put the string | |
263 | * @size: Maximum size of buffer | |
264 | * @return length of string, or -ENOSPC it no space | |
265 | */ | |
266 | int (*get_desc)(struct udevice *dev, char *buf, int size); | |
267 | ||
268 | /** | |
269 | * send() - send data to the TPM | |
270 | * | |
271 | * @dev: Device to talk to | |
272 | * @sendbuf: Buffer of the data to send | |
273 | * @send_size: Size of the data to send | |
274 | * | |
275 | * Returns 0 on success or -ve on failure. | |
276 | */ | |
277 | int (*send)(struct udevice *dev, const uint8_t *sendbuf, | |
278 | size_t send_size); | |
279 | ||
280 | /** | |
281 | * recv() - receive a response from the TPM | |
282 | * | |
283 | * @dev: Device to talk to | |
284 | * @recvbuf: Buffer to save the response to | |
285 | * @max_size: Maximum number of bytes to receive | |
286 | * | |
287 | * Returns number of bytes received on success, -EAGAIN if the TPM | |
288 | * response is not ready, -EINTR if cancelled, or other -ve value on | |
289 | * failure. | |
290 | */ | |
291 | int (*recv)(struct udevice *dev, uint8_t *recvbuf, size_t max_size); | |
292 | ||
293 | /** | |
294 | * cleanup() - clean up after an operation in progress | |
295 | * | |
296 | * This is called if receiving times out. The TPM may need to abort | |
297 | * the current transaction if it did not complete, and make itself | |
298 | * ready for another. | |
299 | * | |
300 | * @dev: Device to talk to | |
301 | */ | |
302 | int (*cleanup)(struct udevice *dev); | |
303 | ||
304 | /** | |
305 | * xfer() - send data to the TPM and get response | |
306 | * | |
307 | * This method is optional. If it exists it is used in preference | |
308 | * to send(), recv() and cleanup(). It should handle all aspects of | |
309 | * TPM communication for a single transfer. | |
310 | * | |
311 | * @dev: Device to talk to | |
312 | * @sendbuf: Buffer of the data to send | |
313 | * @send_size: Size of the data to send | |
314 | * @recvbuf: Buffer to save the response to | |
315 | * @recv_size: Pointer to the size of the response buffer | |
316 | * | |
317 | * Returns 0 on success (and places the number of response bytes at | |
318 | * recv_size) or -ve on failure. | |
319 | */ | |
320 | int (*xfer)(struct udevice *dev, const uint8_t *sendbuf, | |
321 | size_t send_size, uint8_t *recvbuf, size_t *recv_size); | |
322 | }; | |
323 | ||
324 | #define tpm_get_ops(dev) ((struct tpm_ops *)device_get_ops(dev)) | |
325 | ||
326 | /** | |
327 | * tpm_open() - Request access to locality 0 for the caller | |
328 | * | |
329 | * After all commands have been completed the caller is supposed to | |
330 | * call tpm_close(). | |
331 | * | |
332 | * Returns 0 on success, -ve on failure. | |
333 | */ | |
334 | int tpm_open(struct udevice *dev); | |
335 | ||
336 | /** | |
337 | * tpm_close() - Close the current session | |
338 | * | |
339 | * Releasing the locked locality. Returns 0 on success, -ve 1 on | |
340 | * failure (in case lock removal did not succeed). | |
341 | */ | |
342 | int tpm_close(struct udevice *dev); | |
343 | ||
344 | /** | |
345 | * tpm_get_desc() - Get a text description of the TPM | |
346 | * | |
347 | * @dev: Device to check | |
348 | * @buf: Buffer to put the string | |
349 | * @size: Maximum size of buffer | |
350 | * @return length of string, or -ENOSPC it no space | |
351 | */ | |
352 | int tpm_get_desc(struct udevice *dev, char *buf, int size); | |
353 | ||
354 | /** | |
355 | * tpm_xfer() - send data to the TPM and get response | |
356 | * | |
357 | * This first uses the device's send() method to send the bytes. Then it calls | |
358 | * recv() to get the reply. If recv() returns -EAGAIN then it will delay a | |
359 | * short time and then call recv() again. | |
360 | * | |
361 | * Regardless of whether recv() completes successfully, it will then call | |
362 | * cleanup() to finish the transaction. | |
363 | * | |
364 | * Note that the outgoing data is inspected to determine command type | |
365 | * (ordinal) and a timeout is used for that command type. | |
366 | * | |
367 | * @sendbuf - buffer of the data to send | |
368 | * @send_size size of the data to send | |
369 | * @recvbuf - memory to save the response to | |
370 | * @recv_len - pointer to the size of the response buffer | |
371 | * | |
372 | * Returns 0 on success (and places the number of response bytes at | |
373 | * recv_len) or -ve on failure. | |
374 | */ | |
375 | int tpm_xfer(struct udevice *dev, const uint8_t *sendbuf, size_t send_size, | |
376 | uint8_t *recvbuf, size_t *recv_size); | |
377 | ||
378 | #endif /* CONFIG_DM_TPM */ | |
be6c1529 | 379 | |
8732b070 CC |
380 | /** |
381 | * Initialize TPM device. It must be called before any TPM commands. | |
5e124724 | 382 | * |
8732b070 | 383 | * @return 0 on success, non-0 on error. |
5e124724 | 384 | */ |
c8a8c510 | 385 | int tpm_init(void); |
5e124724 | 386 | |
8732b070 CC |
387 | /** |
388 | * Issue a TPM_Startup command. | |
5e124724 | 389 | * |
8732b070 CC |
390 | * @param mode TPM startup mode |
391 | * @return return code of the operation | |
392 | */ | |
393 | uint32_t tpm_startup(enum tpm_startup_type mode); | |
394 | ||
395 | /** | |
396 | * Issue a TPM_SelfTestFull command. | |
5e124724 | 397 | * |
8732b070 | 398 | * @return return code of the operation |
5e124724 | 399 | */ |
8732b070 | 400 | uint32_t tpm_self_test_full(void); |
5e124724 | 401 | |
8732b070 CC |
402 | /** |
403 | * Issue a TPM_ContinueSelfTest command. | |
5e124724 | 404 | * |
8732b070 | 405 | * @return return code of the operation |
5e124724 | 406 | */ |
8732b070 | 407 | uint32_t tpm_continue_self_test(void); |
5e124724 | 408 | |
8732b070 CC |
409 | /** |
410 | * Issue a TPM_NV_DefineSpace command. The implementation is limited | |
411 | * to specify TPM_NV_ATTRIBUTES and size of the area. The area index | |
412 | * could be one of the special value listed in enum tpm_nv_index. | |
5e124724 | 413 | * |
8732b070 CC |
414 | * @param index index of the area |
415 | * @param perm TPM_NV_ATTRIBUTES of the area | |
416 | * @param size size of the area | |
417 | * @return return code of the operation | |
418 | */ | |
419 | uint32_t tpm_nv_define_space(uint32_t index, uint32_t perm, uint32_t size); | |
420 | ||
421 | /** | |
422 | * Issue a TPM_NV_ReadValue command. This implementation is limited | |
423 | * to read the area from offset 0. The area index could be one of | |
424 | * the special value listed in enum tpm_nv_index. | |
425 | * | |
426 | * @param index index of the area | |
427 | * @param data output buffer of the area contents | |
428 | * @param count size of output buffer | |
429 | * @return return code of the operation | |
430 | */ | |
431 | uint32_t tpm_nv_read_value(uint32_t index, void *data, uint32_t count); | |
432 | ||
433 | /** | |
434 | * Issue a TPM_NV_WriteValue command. This implementation is limited | |
435 | * to write the area from offset 0. The area index could be one of | |
436 | * the special value listed in enum tpm_nv_index. | |
437 | * | |
438 | * @param index index of the area | |
439 | * @param data input buffer to be wrote to the area | |
440 | * @param length length of data bytes of input buffer | |
441 | * @return return code of the operation | |
442 | */ | |
443 | uint32_t tpm_nv_write_value(uint32_t index, const void *data, uint32_t length); | |
444 | ||
445 | /** | |
446 | * Issue a TPM_Extend command. | |
447 | * | |
448 | * @param index index of the PCR | |
449 | * @param in_digest 160-bit value representing the event to be | |
450 | * recorded | |
451 | * @param out_digest 160-bit PCR value after execution of the | |
452 | * command | |
453 | * @return return code of the operation | |
454 | */ | |
455 | uint32_t tpm_extend(uint32_t index, const void *in_digest, void *out_digest); | |
456 | ||
457 | /** | |
458 | * Issue a TPM_PCRRead command. | |
5e124724 | 459 | * |
8732b070 CC |
460 | * @param index index of the PCR |
461 | * @param data output buffer for contents of the named PCR | |
462 | * @param count size of output buffer | |
463 | * @return return code of the operation | |
464 | */ | |
465 | uint32_t tpm_pcr_read(uint32_t index, void *data, size_t count); | |
466 | ||
467 | /** | |
468 | * Issue a TSC_PhysicalPresence command. TPM physical presence flag | |
469 | * is bit-wise OR'ed of flags listed in enum tpm_physical_presence. | |
470 | * | |
471 | * @param presence TPM physical presence flag | |
472 | * @return return code of the operation | |
473 | */ | |
474 | uint32_t tpm_tsc_physical_presence(uint16_t presence); | |
475 | ||
476 | /** | |
477 | * Issue a TPM_ReadPubek command. | |
478 | * | |
479 | * @param data output buffer for the public endorsement key | |
480 | * @param count size of ouput buffer | |
481 | * @return return code of the operation | |
482 | */ | |
483 | uint32_t tpm_read_pubek(void *data, size_t count); | |
484 | ||
485 | /** | |
486 | * Issue a TPM_ForceClear command. | |
487 | * | |
488 | * @return return code of the operation | |
489 | */ | |
490 | uint32_t tpm_force_clear(void); | |
491 | ||
492 | /** | |
493 | * Issue a TPM_PhysicalEnable command. | |
494 | * | |
495 | * @return return code of the operation | |
496 | */ | |
497 | uint32_t tpm_physical_enable(void); | |
498 | ||
499 | /** | |
500 | * Issue a TPM_PhysicalDisable command. | |
501 | * | |
502 | * @return return code of the operation | |
503 | */ | |
504 | uint32_t tpm_physical_disable(void); | |
505 | ||
506 | /** | |
507 | * Issue a TPM_PhysicalSetDeactivated command. | |
508 | * | |
509 | * @param state boolean state of the deactivated flag | |
510 | * @return return code of the operation | |
511 | */ | |
512 | uint32_t tpm_physical_set_deactivated(uint8_t state); | |
513 | ||
514 | /** | |
515 | * Issue a TPM_GetCapability command. This implementation is limited | |
516 | * to query sub_cap index that is 4-byte wide. | |
5e124724 | 517 | * |
8732b070 CC |
518 | * @param cap_area partition of capabilities |
519 | * @param sub_cap further definition of capability, which is | |
520 | * limited to be 4-byte wide | |
521 | * @param cap output buffer for capability information | |
522 | * @param count size of ouput buffer | |
523 | * @return return code of the operation | |
5e124724 | 524 | */ |
8732b070 CC |
525 | uint32_t tpm_get_capability(uint32_t cap_area, uint32_t sub_cap, |
526 | void *cap, size_t count); | |
5e124724 | 527 | |
be6c1529 RP |
528 | /** |
529 | * Issue a TPM_FlushSpecific command for a AUTH ressource. | |
530 | * | |
531 | * @param auth_handle handle of the auth session | |
532 | * @return return code of the operation | |
533 | */ | |
534 | uint32_t tpm_terminate_auth_session(uint32_t auth_handle); | |
535 | ||
536 | /** | |
537 | * Issue a TPM_OIAP command to setup an object independant authorization | |
538 | * session. | |
539 | * Information about the session is stored internally. | |
540 | * If there was already an OIAP session active it is terminated and a new | |
541 | * session is set up. | |
542 | * | |
543 | * @param auth_handle pointer to the (new) auth handle or NULL. | |
544 | * @return return code of the operation | |
545 | */ | |
546 | uint32_t tpm_oiap(uint32_t *auth_handle); | |
547 | ||
548 | /** | |
549 | * Ends an active OIAP session. | |
550 | * | |
551 | * @return return code of the operation | |
552 | */ | |
553 | uint32_t tpm_end_oiap(void); | |
554 | ||
555 | /** | |
556 | * Issue a TPM_LoadKey2 (Auth1) command using an OIAP session for authenticating | |
557 | * the usage of the parent key. | |
558 | * | |
559 | * @param parent_handle handle of the parent key. | |
560 | * @param key pointer to the key structure (TPM_KEY or TPM_KEY12). | |
561 | * @param key_length size of the key structure | |
562 | * @param parent_key_usage_auth usage auth for the parent key | |
563 | * @param key_handle pointer to the key handle | |
564 | * @return return code of the operation | |
565 | */ | |
566 | uint32_t tpm_load_key2_oiap(uint32_t parent_handle, | |
567 | const void *key, size_t key_length, | |
568 | const void *parent_key_usage_auth, | |
569 | uint32_t *key_handle); | |
570 | ||
571 | /** | |
572 | * Issue a TPM_GetPubKey (Auth1) command using an OIAP session for | |
573 | * authenticating the usage of the key. | |
574 | * | |
575 | * @param key_handle handle of the key | |
576 | * @param usage_auth usage auth for the key | |
577 | * @param pubkey pointer to the pub key buffer; may be NULL if the pubkey | |
578 | * should not be stored. | |
579 | * @param pubkey_len pointer to the pub key buffer len. On entry: the size of | |
580 | * the provided pubkey buffer. On successful exit: the size | |
581 | * of the stored TPM_PUBKEY structure (iff pubkey != NULL). | |
582 | * @return return code of the operation | |
583 | */ | |
584 | uint32_t tpm_get_pub_key_oiap(uint32_t key_handle, const void *usage_auth, | |
585 | void *pubkey, size_t *pubkey_len); | |
586 | ||
2132f971 SG |
587 | /** |
588 | * Get the TPM permanent flags value | |
589 | * | |
590 | * @param pflags Place to put permanent flags | |
591 | * @return return code of the operation | |
592 | */ | |
593 | uint32_t tpm_get_permanent_flags(struct tpm_permanent_flags *pflags); | |
594 | ||
595 | /** | |
596 | * Get the TPM permissions | |
597 | * | |
598 | * @param perm Returns permissions value | |
599 | * @return return code of the operation | |
600 | */ | |
601 | uint32_t tpm_get_permissions(uint32_t index, uint32_t *perm); | |
602 | ||
8732b070 | 603 | #endif /* __TPM_H */ |