]>
Commit | Line | Data |
---|---|---|
f4ede81e AV |
1 | /* |
2 | * tpm_ioctl.h | |
3 | * | |
4 | * (c) Copyright IBM Corporation 2014, 2015. | |
5 | * | |
6 | * This file is licensed under the terms of the 3-clause BSD license | |
7 | */ | |
8 | #ifndef _TPM_IOCTL_H_ | |
9 | #define _TPM_IOCTL_H_ | |
10 | ||
11 | #include <stdint.h> | |
12 | #include <sys/uio.h> | |
13 | #include <sys/types.h> | |
14 | #include <sys/ioctl.h> | |
15 | ||
16 | /* | |
17 | * Every response from a command involving a TPM command execution must hold | |
18 | * the ptm_res as the first element. | |
19 | * ptm_res corresponds to the error code of a command executed by the TPM. | |
20 | */ | |
21 | ||
22 | typedef uint32_t ptm_res; | |
23 | ||
24 | /* PTM_GET_TPMESTABLISHED: get the establishment bit */ | |
25 | struct ptm_est { | |
26 | union { | |
27 | struct { | |
28 | ptm_res tpm_result; | |
29 | unsigned char bit; /* TPM established bit */ | |
30 | } resp; /* response */ | |
31 | } u; | |
32 | }; | |
33 | ||
34 | /* PTM_RESET_TPMESTABLISHED: reset establishment bit */ | |
35 | struct ptm_reset_est { | |
36 | union { | |
37 | struct { | |
38 | uint8_t loc; /* locality to use */ | |
39 | } req; /* request */ | |
40 | struct { | |
41 | ptm_res tpm_result; | |
42 | } resp; /* response */ | |
43 | } u; | |
44 | }; | |
45 | ||
46 | /* PTM_INIT */ | |
47 | struct ptm_init { | |
48 | union { | |
49 | struct { | |
50 | uint32_t init_flags; /* see definitions below */ | |
51 | } req; /* request */ | |
52 | struct { | |
53 | ptm_res tpm_result; | |
54 | } resp; /* response */ | |
55 | } u; | |
56 | }; | |
57 | ||
58 | /* above init_flags */ | |
59 | #define PTM_INIT_FLAG_DELETE_VOLATILE (1 << 0) | |
60 | /* delete volatile state file after reading it */ | |
61 | ||
62 | /* PTM_SET_LOCALITY */ | |
63 | struct ptm_loc { | |
64 | union { | |
65 | struct { | |
66 | uint8_t loc; /* locality to set */ | |
67 | } req; /* request */ | |
68 | struct { | |
69 | ptm_res tpm_result; | |
70 | } resp; /* response */ | |
71 | } u; | |
72 | }; | |
73 | ||
74 | /* PTM_HASH_DATA: hash given data */ | |
75 | struct ptm_hdata { | |
76 | union { | |
77 | struct { | |
78 | uint32_t length; | |
79 | uint8_t data[4096]; | |
80 | } req; /* request */ | |
81 | struct { | |
82 | ptm_res tpm_result; | |
83 | } resp; /* response */ | |
84 | } u; | |
85 | }; | |
86 | ||
87 | /* | |
88 | * size of the TPM state blob to transfer; x86_64 can handle 8k, | |
89 | * ppc64le only ~7k; keep the response below a 4k page size | |
90 | */ | |
91 | #define PTM_STATE_BLOB_SIZE (3 * 1024) | |
92 | ||
93 | /* | |
94 | * The following is the data structure to get state blobs from the TPM. | |
95 | * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple reads | |
96 | * with this ioctl and with adjusted offset are necessary. All bytes | |
97 | * must be transferred and the transfer is done once the last byte has been | |
98 | * returned. | |
99 | * It is possible to use the read() interface for reading the data; however, the | |
100 | * first bytes of the state blob will be part of the response to the ioctl(); a | |
101 | * subsequent read() is only necessary if the total length (totlength) exceeds | |
102 | * the number of received bytes. seek() is not supported. | |
103 | */ | |
104 | struct ptm_getstate { | |
105 | union { | |
106 | struct { | |
107 | uint32_t state_flags; /* may be: PTM_STATE_FLAG_DECRYPTED */ | |
108 | uint32_t type; /* which blob to pull */ | |
109 | uint32_t offset; /* offset from where to read */ | |
110 | } req; /* request */ | |
111 | struct { | |
112 | ptm_res tpm_result; | |
113 | uint32_t state_flags; /* may be: PTM_STATE_FLAG_ENCRYPTED */ | |
114 | uint32_t totlength; /* total length that will be transferred */ | |
115 | uint32_t length; /* number of bytes in following buffer */ | |
116 | uint8_t data[PTM_STATE_BLOB_SIZE]; | |
117 | } resp; /* response */ | |
118 | } u; | |
119 | }; | |
120 | ||
121 | /* TPM state blob types */ | |
122 | #define PTM_BLOB_TYPE_PERMANENT 1 | |
123 | #define PTM_BLOB_TYPE_VOLATILE 2 | |
124 | #define PTM_BLOB_TYPE_SAVESTATE 3 | |
125 | ||
126 | /* state_flags above : */ | |
127 | #define PTM_STATE_FLAG_DECRYPTED 1 /* on input: get decrypted state */ | |
128 | #define PTM_STATE_FLAG_ENCRYPTED 2 /* on output: state is encrypted */ | |
129 | ||
130 | /* | |
131 | * The following is the data structure to set state blobs in the TPM. | |
132 | * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple | |
133 | * 'writes' using this ioctl are necessary. The last packet is indicated | |
134 | * by the length being smaller than the PTM_STATE_BLOB_SIZE. | |
135 | * The very first packet may have a length indicator of '0' enabling | |
136 | * a write() with all the bytes from a buffer. If the write() interface | |
137 | * is used, a final ioctl with a non-full buffer must be made to indicate | |
138 | * that all data were transferred (a write with 0 bytes would not work). | |
139 | */ | |
140 | struct ptm_setstate { | |
141 | union { | |
142 | struct { | |
143 | uint32_t state_flags; /* may be PTM_STATE_FLAG_ENCRYPTED */ | |
144 | uint32_t type; /* which blob to set */ | |
145 | uint32_t length; /* length of the data; | |
146 | use 0 on the first packet to | |
147 | transfer using write() */ | |
148 | uint8_t data[PTM_STATE_BLOB_SIZE]; | |
149 | } req; /* request */ | |
150 | struct { | |
151 | ptm_res tpm_result; | |
152 | } resp; /* response */ | |
153 | } u; | |
154 | }; | |
155 | ||
156 | /* | |
157 | * PTM_GET_CONFIG: Data structure to get runtime configuration information | |
158 | * such as which keys are applied. | |
159 | */ | |
160 | struct ptm_getconfig { | |
161 | union { | |
162 | struct { | |
163 | ptm_res tpm_result; | |
164 | uint32_t flags; | |
165 | } resp; /* response */ | |
166 | } u; | |
167 | }; | |
168 | ||
169 | #define PTM_CONFIG_FLAG_FILE_KEY 0x1 | |
170 | #define PTM_CONFIG_FLAG_MIGRATION_KEY 0x2 | |
171 | ||
9375c44f SB |
172 | /* |
173 | * PTM_SET_BUFFERSIZE: Set the buffer size to be used by the TPM. | |
174 | * A 0 on input queries for the current buffer size. Any other | |
175 | * number will try to set the buffer size. The returned number is | |
176 | * the buffer size that will be used, which can be larger than the | |
177 | * requested one, if it was below the minimum, or smaller than the | |
178 | * requested one, if it was above the maximum. | |
179 | */ | |
180 | struct ptm_setbuffersize { | |
181 | union { | |
182 | struct { | |
183 | uint32_t buffersize; /* 0 to query for current buffer size */ | |
184 | } req; /* request */ | |
185 | struct { | |
186 | ptm_res tpm_result; | |
187 | uint32_t buffersize; /* buffer size in use */ | |
188 | uint32_t minsize; /* min. supported buffer size */ | |
189 | uint32_t maxsize; /* max. supported buffer size */ | |
190 | } resp; /* response */ | |
191 | } u; | |
192 | }; | |
193 | ||
f4ede81e AV |
194 | |
195 | typedef uint64_t ptm_cap; | |
196 | typedef struct ptm_est ptm_est; | |
197 | typedef struct ptm_reset_est ptm_reset_est; | |
198 | typedef struct ptm_loc ptm_loc; | |
199 | typedef struct ptm_hdata ptm_hdata; | |
200 | typedef struct ptm_init ptm_init; | |
201 | typedef struct ptm_getstate ptm_getstate; | |
202 | typedef struct ptm_setstate ptm_setstate; | |
203 | typedef struct ptm_getconfig ptm_getconfig; | |
9375c44f | 204 | typedef struct ptm_setbuffersize ptm_setbuffersize; |
f4ede81e AV |
205 | |
206 | /* capability flags returned by PTM_GET_CAPABILITY */ | |
207 | #define PTM_CAP_INIT (1) | |
208 | #define PTM_CAP_SHUTDOWN (1 << 1) | |
209 | #define PTM_CAP_GET_TPMESTABLISHED (1 << 2) | |
210 | #define PTM_CAP_SET_LOCALITY (1 << 3) | |
211 | #define PTM_CAP_HASHING (1 << 4) | |
212 | #define PTM_CAP_CANCEL_TPM_CMD (1 << 5) | |
213 | #define PTM_CAP_STORE_VOLATILE (1 << 6) | |
214 | #define PTM_CAP_RESET_TPMESTABLISHED (1 << 7) | |
215 | #define PTM_CAP_GET_STATEBLOB (1 << 8) | |
216 | #define PTM_CAP_SET_STATEBLOB (1 << 9) | |
217 | #define PTM_CAP_STOP (1 << 10) | |
218 | #define PTM_CAP_GET_CONFIG (1 << 11) | |
219 | #define PTM_CAP_SET_DATAFD (1 << 12) | |
9375c44f | 220 | #define PTM_CAP_SET_BUFFERSIZE (1 << 13) |
f4ede81e AV |
221 | |
222 | enum { | |
223 | PTM_GET_CAPABILITY = _IOR('P', 0, ptm_cap), | |
224 | PTM_INIT = _IOWR('P', 1, ptm_init), | |
225 | PTM_SHUTDOWN = _IOR('P', 2, ptm_res), | |
226 | PTM_GET_TPMESTABLISHED = _IOR('P', 3, ptm_est), | |
227 | PTM_SET_LOCALITY = _IOWR('P', 4, ptm_loc), | |
228 | PTM_HASH_START = _IOR('P', 5, ptm_res), | |
229 | PTM_HASH_DATA = _IOWR('P', 6, ptm_hdata), | |
230 | PTM_HASH_END = _IOR('P', 7, ptm_res), | |
231 | PTM_CANCEL_TPM_CMD = _IOR('P', 8, ptm_res), | |
232 | PTM_STORE_VOLATILE = _IOR('P', 9, ptm_res), | |
233 | PTM_RESET_TPMESTABLISHED = _IOWR('P', 10, ptm_reset_est), | |
234 | PTM_GET_STATEBLOB = _IOWR('P', 11, ptm_getstate), | |
235 | PTM_SET_STATEBLOB = _IOWR('P', 12, ptm_setstate), | |
236 | PTM_STOP = _IOR('P', 13, ptm_res), | |
237 | PTM_GET_CONFIG = _IOR('P', 14, ptm_getconfig), | |
238 | PTM_SET_DATAFD = _IOR('P', 15, ptm_res), | |
9375c44f | 239 | PTM_SET_BUFFERSIZE = _IOWR('P', 16, ptm_setbuffersize), |
f4ede81e AV |
240 | }; |
241 | ||
242 | /* | |
243 | * Commands used by the non-CUSE TPMs | |
244 | * | |
245 | * All messages container big-endian data. | |
246 | * | |
247 | * The return messages only contain the 'resp' part of the unions | |
248 | * in the data structures above. Besides that the limits in the | |
249 | * buffers above (ptm_hdata:u.req.data and ptm_get_state:u.resp.data | |
250 | * and ptm_set_state:u.req.data) are 0xffffffff. | |
251 | */ | |
252 | enum { | |
253 | CMD_GET_CAPABILITY = 1, | |
254 | CMD_INIT, | |
255 | CMD_SHUTDOWN, | |
256 | CMD_GET_TPMESTABLISHED, | |
257 | CMD_SET_LOCALITY, | |
258 | CMD_HASH_START, | |
259 | CMD_HASH_DATA, | |
260 | CMD_HASH_END, | |
261 | CMD_CANCEL_TPM_CMD, | |
262 | CMD_STORE_VOLATILE, | |
263 | CMD_RESET_TPMESTABLISHED, | |
264 | CMD_GET_STATEBLOB, | |
265 | CMD_SET_STATEBLOB, | |
266 | CMD_STOP, | |
267 | CMD_GET_CONFIG, | |
9375c44f SB |
268 | CMD_SET_DATAFD, |
269 | CMD_SET_BUFFERSIZE, | |
f4ede81e AV |
270 | }; |
271 | ||
272 | #endif /* _TPM_IOCTL_H */ |