4c0851cc37
TPM1.2 is using the somewhat misnamed tlcl_set_global_lock() command
function to lock the hardware rollback counter. For TPM2 let's
implement and use the TPM2 command to lock an NV Ram location
(TPM2_NV_WriteLock).
BRANCH=none
BUG=chrome-os-partner:50645
TEST=verified that TPM2_NV_WriteLock command is invoked before RO
firmware starts RW, and succeeds.
Change-Id: I52aa8db95b908488ec4cf0843afeb6310dc7f38b
Signed-off-by: Martin Roth <martinroth@chromium.org>
Original-Commit-Id: 2f859335dfccfeea900f15bbb8c6cb3fd5ec8c77
Original-Change-Id: I62f22b9991522d4309cccc44180a5ebd4dca488d
Original-Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/358097
Original-Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Original-Reviewed-by: Darren Krahn <dkrahn@chromium.org>
Reviewed-on: https://review.coreboot.org/15638
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
155 lines
3.9 KiB
C
155 lines
3.9 KiB
C
/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
* found in the LICENSE file.
|
|
*/
|
|
|
|
/*
|
|
* TPM Lightweight Command Library.
|
|
*
|
|
* A low-level library for interfacing to TPM hardware or an emulator.
|
|
*/
|
|
|
|
#ifndef TPM_LITE_TLCL_H_
|
|
#define TPM_LITE_TLCL_H_
|
|
#include <stdint.h>
|
|
#include <types.h>
|
|
|
|
#include "tss_constants.h"
|
|
|
|
/*****************************************************************************/
|
|
/* Functions implemented in tlcl.c */
|
|
|
|
/**
|
|
* Call this first. Returns 0 if success, nonzero if error.
|
|
*/
|
|
uint32_t tlcl_lib_init(void);
|
|
|
|
/**
|
|
* Perform a raw TPM request/response transaction.
|
|
*/
|
|
uint32_t tlcl_send_receive(const uint8_t *request, uint8_t *response,
|
|
int max_length);
|
|
|
|
/* Commands */
|
|
|
|
/**
|
|
* Send a TPM_Startup(ST_CLEAR). The TPM error code is returned (0 for
|
|
* success).
|
|
*/
|
|
uint32_t tlcl_startup(void);
|
|
|
|
/**
|
|
* Resume by sending a TPM_Startup(ST_STATE). The TPM error code is returned
|
|
* (0 for success).
|
|
*/
|
|
uint32_t tlcl_resume(void);
|
|
|
|
/**
|
|
* Run the self test.
|
|
*
|
|
* Note---this is synchronous. To run this in parallel with other firmware,
|
|
* use ContinueSelfTest(). The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_self_test_full(void);
|
|
|
|
/**
|
|
* Run the self test in the background.
|
|
*/
|
|
uint32_t tlcl_continue_self_test(void);
|
|
|
|
#if IS_ENABLED(CONFIG_TPM)
|
|
/**
|
|
* Define a space with permission [perm]. [index] is the index for the space,
|
|
* [size] the usable data size. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size);
|
|
|
|
#elif IS_ENABLED(CONFIG_TPM2)
|
|
|
|
/*
|
|
* Define a TPM space. The define space command TPM command used by the tlcl
|
|
* layer is enforcing the policy which would not allow to delete the created
|
|
* space after any PCR0 change from its initial value.
|
|
*/
|
|
uint32_t tlcl_define_space(uint32_t space_index, size_t space_size);
|
|
#endif
|
|
|
|
/**
|
|
* Write [length] bytes of [data] to space at [index]. The TPM error code is
|
|
* returned.
|
|
*/
|
|
uint32_t tlcl_write(uint32_t index, const void *data, uint32_t length);
|
|
|
|
/**
|
|
* Read [length] bytes from space at [index] into [data]. The TPM error code
|
|
* is returned.
|
|
*/
|
|
uint32_t tlcl_read(uint32_t index, void *data, uint32_t length);
|
|
|
|
/**
|
|
* Assert physical presence in software. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_assert_physical_presence(void);
|
|
|
|
/**
|
|
* Enable the physical presence command. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_physical_presence_cmd_enable(void);
|
|
|
|
/**
|
|
* Finalize the physical presence settings: sofware PP is enabled, hardware PP
|
|
* is disabled, and the lifetime lock is set. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_finalize_physical_presence(void);
|
|
|
|
/**
|
|
* Set the nvLocked bit. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_set_nv_locked(void);
|
|
|
|
/**
|
|
* Issue a ForceClear. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_force_clear(void);
|
|
|
|
/**
|
|
* Issue a PhysicalEnable. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_set_enable(void);
|
|
|
|
/**
|
|
* Issue a SetDeactivated. Pass 0 to activate. Returns result code.
|
|
*/
|
|
uint32_t tlcl_set_deactivated(uint8_t flag);
|
|
|
|
/**
|
|
* Get flags of interest. Pointers for flags you aren't interested in may
|
|
* be NULL. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated,
|
|
uint8_t *nvlocked);
|
|
|
|
/**
|
|
* Set the bGlobalLock flag, which only a reboot can clear. The TPM error
|
|
* code is returned.
|
|
*/
|
|
uint32_t tlcl_set_global_lock(void);
|
|
|
|
/**
|
|
* Make an NV Ram location read_only. The TPM error code is returned.
|
|
*/
|
|
uint32_t tlcl_lock_nv_write(uint32_t index);
|
|
|
|
/**
|
|
* Perform a TPM_Extend.
|
|
*/
|
|
uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
|
|
uint8_t *out_digest);
|
|
|
|
/**
|
|
* Get the entire set of permanent flags.
|
|
*/
|
|
uint32_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags);
|
|
|
|
#endif /* TPM_LITE_TLCL_H_ */
|