]>
Commit | Line | Data |
---|---|---|
f4ede81e AV |
1 | /* |
2 | * tpm_ioctl.h | |
3 | * | |
4 | * (c) Copyright IBM Corporation 2014, 2015. | |
5 | * | |
6 | * This file is licensed under the terms of the 3-clause BSD license | |
7 | */ | |
efef4756 SB |
8 | #ifndef _TPM_IOCTL_H_ |
9 | #define _TPM_IOCTL_H_ | |
a8b991b5 | 10 | |
efef4756 SB |
11 | #if defined(__CYGWIN__) |
12 | # define __USE_LINUX_IOCTL_DEFS | |
13 | #endif | |
f4ede81e | 14 | |
d1c637ec | 15 | #ifndef _WIN32 |
f4ede81e | 16 | #include <sys/uio.h> |
f4ede81e | 17 | #include <sys/ioctl.h> |
d1c637ec | 18 | #endif |
f4ede81e | 19 | |
ded5d78c TH |
20 | #ifdef HAVE_SYS_IOCCOM_H |
21 | #include <sys/ioccom.h> | |
22 | #endif | |
23 | ||
f4ede81e AV |
24 | /* |
25 | * Every response from a command involving a TPM command execution must hold | |
26 | * the ptm_res as the first element. | |
27 | * ptm_res corresponds to the error code of a command executed by the TPM. | |
28 | */ | |
29 | ||
30 | typedef uint32_t ptm_res; | |
31 | ||
32 | /* PTM_GET_TPMESTABLISHED: get the establishment bit */ | |
33 | struct ptm_est { | |
34 | union { | |
35 | struct { | |
36 | ptm_res tpm_result; | |
37 | unsigned char bit; /* TPM established bit */ | |
38 | } resp; /* response */ | |
39 | } u; | |
40 | }; | |
41 | ||
42 | /* PTM_RESET_TPMESTABLISHED: reset establishment bit */ | |
43 | struct ptm_reset_est { | |
44 | union { | |
45 | struct { | |
46 | uint8_t loc; /* locality to use */ | |
47 | } req; /* request */ | |
48 | struct { | |
49 | ptm_res tpm_result; | |
50 | } resp; /* response */ | |
51 | } u; | |
52 | }; | |
53 | ||
54 | /* PTM_INIT */ | |
55 | struct ptm_init { | |
56 | union { | |
57 | struct { | |
58 | uint32_t init_flags; /* see definitions below */ | |
59 | } req; /* request */ | |
60 | struct { | |
61 | ptm_res tpm_result; | |
62 | } resp; /* response */ | |
63 | } u; | |
64 | }; | |
65 | ||
66 | /* above init_flags */ | |
67 | #define PTM_INIT_FLAG_DELETE_VOLATILE (1 << 0) | |
68 | /* delete volatile state file after reading it */ | |
69 | ||
70 | /* PTM_SET_LOCALITY */ | |
71 | struct ptm_loc { | |
72 | union { | |
73 | struct { | |
74 | uint8_t loc; /* locality to set */ | |
75 | } req; /* request */ | |
76 | struct { | |
77 | ptm_res tpm_result; | |
78 | } resp; /* response */ | |
79 | } u; | |
80 | }; | |
81 | ||
82 | /* PTM_HASH_DATA: hash given data */ | |
83 | struct ptm_hdata { | |
84 | union { | |
85 | struct { | |
86 | uint32_t length; | |
87 | uint8_t data[4096]; | |
88 | } req; /* request */ | |
89 | struct { | |
90 | ptm_res tpm_result; | |
91 | } resp; /* response */ | |
92 | } u; | |
93 | }; | |
94 | ||
95 | /* | |
96 | * size of the TPM state blob to transfer; x86_64 can handle 8k, | |
97 | * ppc64le only ~7k; keep the response below a 4k page size | |
98 | */ | |
99 | #define PTM_STATE_BLOB_SIZE (3 * 1024) | |
100 | ||
101 | /* | |
102 | * The following is the data structure to get state blobs from the TPM. | |
103 | * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple reads | |
104 | * with this ioctl and with adjusted offset are necessary. All bytes | |
105 | * must be transferred and the transfer is done once the last byte has been | |
106 | * returned. | |
107 | * It is possible to use the read() interface for reading the data; however, the | |
108 | * first bytes of the state blob will be part of the response to the ioctl(); a | |
109 | * subsequent read() is only necessary if the total length (totlength) exceeds | |
110 | * the number of received bytes. seek() is not supported. | |
111 | */ | |
112 | struct ptm_getstate { | |
113 | union { | |
114 | struct { | |
115 | uint32_t state_flags; /* may be: PTM_STATE_FLAG_DECRYPTED */ | |
116 | uint32_t type; /* which blob to pull */ | |
117 | uint32_t offset; /* offset from where to read */ | |
118 | } req; /* request */ | |
119 | struct { | |
120 | ptm_res tpm_result; | |
121 | uint32_t state_flags; /* may be: PTM_STATE_FLAG_ENCRYPTED */ | |
122 | uint32_t totlength; /* total length that will be transferred */ | |
123 | uint32_t length; /* number of bytes in following buffer */ | |
124 | uint8_t data[PTM_STATE_BLOB_SIZE]; | |
125 | } resp; /* response */ | |
126 | } u; | |
127 | }; | |
128 | ||
129 | /* TPM state blob types */ | |
130 | #define PTM_BLOB_TYPE_PERMANENT 1 | |
131 | #define PTM_BLOB_TYPE_VOLATILE 2 | |
132 | #define PTM_BLOB_TYPE_SAVESTATE 3 | |
133 | ||
134 | /* state_flags above : */ | |
135 | #define PTM_STATE_FLAG_DECRYPTED 1 /* on input: get decrypted state */ | |
136 | #define PTM_STATE_FLAG_ENCRYPTED 2 /* on output: state is encrypted */ | |
137 | ||
138 | /* | |
139 | * The following is the data structure to set state blobs in the TPM. | |
140 | * If the size of the state blob exceeds the PTM_STATE_BLOB_SIZE, multiple | |
141 | * 'writes' using this ioctl are necessary. The last packet is indicated | |
142 | * by the length being smaller than the PTM_STATE_BLOB_SIZE. | |
143 | * The very first packet may have a length indicator of '0' enabling | |
144 | * a write() with all the bytes from a buffer. If the write() interface | |
145 | * is used, a final ioctl with a non-full buffer must be made to indicate | |
146 | * that all data were transferred (a write with 0 bytes would not work). | |
147 | */ | |
148 | struct ptm_setstate { | |
149 | union { | |
150 | struct { | |
151 | uint32_t state_flags; /* may be PTM_STATE_FLAG_ENCRYPTED */ | |
152 | uint32_t type; /* which blob to set */ | |
153 | uint32_t length; /* length of the data; | |
154 | use 0 on the first packet to | |
155 | transfer using write() */ | |
156 | uint8_t data[PTM_STATE_BLOB_SIZE]; | |
157 | } req; /* request */ | |
158 | struct { | |
159 | ptm_res tpm_result; | |
160 | } resp; /* response */ | |
161 | } u; | |
162 | }; | |
163 | ||
164 | /* | |
165 | * PTM_GET_CONFIG: Data structure to get runtime configuration information | |
166 | * such as which keys are applied. | |
167 | */ | |
168 | struct ptm_getconfig { | |
169 | union { | |
170 | struct { | |
171 | ptm_res tpm_result; | |
172 | uint32_t flags; | |
173 | } resp; /* response */ | |
174 | } u; | |
175 | }; | |
176 | ||
177 | #define PTM_CONFIG_FLAG_FILE_KEY 0x1 | |
178 | #define PTM_CONFIG_FLAG_MIGRATION_KEY 0x2 | |
179 | ||
9375c44f SB |
180 | /* |
181 | * PTM_SET_BUFFERSIZE: Set the buffer size to be used by the TPM. | |
182 | * A 0 on input queries for the current buffer size. Any other | |
183 | * number will try to set the buffer size. The returned number is | |
184 | * the buffer size that will be used, which can be larger than the | |
185 | * requested one, if it was below the minimum, or smaller than the | |
186 | * requested one, if it was above the maximum. | |
187 | */ | |
188 | struct ptm_setbuffersize { | |
189 | union { | |
190 | struct { | |
191 | uint32_t buffersize; /* 0 to query for current buffer size */ | |
192 | } req; /* request */ | |
193 | struct { | |
194 | ptm_res tpm_result; | |
195 | uint32_t buffersize; /* buffer size in use */ | |
196 | uint32_t minsize; /* min. supported buffer size */ | |
197 | uint32_t maxsize; /* max. supported buffer size */ | |
198 | } resp; /* response */ | |
199 | } u; | |
200 | }; | |
201 | ||
efef4756 SB |
202 | #define PTM_GETINFO_SIZE (3 * 1024) |
203 | /* | |
204 | * PTM_GET_INFO: Get info about the TPM implementation (from libtpms) | |
205 | * | |
206 | * This request allows to indirectly call TPMLIB_GetInfo(flags) and | |
207 | * retrieve information from libtpms. | |
208 | * Only one transaction is currently necessary for returning results | |
209 | * to a client. Therefore, totlength and length will be the same if | |
210 | * offset is 0. | |
211 | */ | |
212 | struct ptm_getinfo { | |
213 | union { | |
214 | struct { | |
215 | uint64_t flags; | |
216 | uint32_t offset; /* offset from where to read */ | |
217 | uint32_t pad; /* 32 bit arch */ | |
218 | } req; /* request */ | |
219 | struct { | |
220 | ptm_res tpm_result; | |
221 | uint32_t totlength; | |
222 | uint32_t length; | |
223 | char buffer[PTM_GETINFO_SIZE]; | |
224 | } resp; /* response */ | |
225 | } u; | |
226 | }; | |
227 | ||
228 | #define SWTPM_INFO_TPMSPECIFICATION ((uint64_t)1 << 0) | |
229 | #define SWTPM_INFO_TPMATTRIBUTES ((uint64_t)1 << 1) | |
230 | ||
231 | /* | |
232 | * PTM_LOCK_STORAGE: Lock the storage and retry n times | |
233 | */ | |
234 | struct ptm_lockstorage { | |
235 | union { | |
236 | struct { | |
237 | uint32_t retries; /* number of retries */ | |
238 | } req; /* request */ | |
239 | struct { | |
240 | ptm_res tpm_result; | |
0a19d879 | 241 | } resp; /* response */ |
efef4756 SB |
242 | } u; |
243 | }; | |
f4ede81e AV |
244 | |
245 | typedef uint64_t ptm_cap; | |
246 | typedef struct ptm_est ptm_est; | |
247 | typedef struct ptm_reset_est ptm_reset_est; | |
248 | typedef struct ptm_loc ptm_loc; | |
249 | typedef struct ptm_hdata ptm_hdata; | |
250 | typedef struct ptm_init ptm_init; | |
251 | typedef struct ptm_getstate ptm_getstate; | |
252 | typedef struct ptm_setstate ptm_setstate; | |
253 | typedef struct ptm_getconfig ptm_getconfig; | |
9375c44f | 254 | typedef struct ptm_setbuffersize ptm_setbuffersize; |
efef4756 SB |
255 | typedef struct ptm_getinfo ptm_getinfo; |
256 | typedef struct ptm_lockstorage ptm_lockstorage; | |
f4ede81e AV |
257 | |
258 | /* capability flags returned by PTM_GET_CAPABILITY */ | |
259 | #define PTM_CAP_INIT (1) | |
260 | #define PTM_CAP_SHUTDOWN (1 << 1) | |
261 | #define PTM_CAP_GET_TPMESTABLISHED (1 << 2) | |
262 | #define PTM_CAP_SET_LOCALITY (1 << 3) | |
263 | #define PTM_CAP_HASHING (1 << 4) | |
264 | #define PTM_CAP_CANCEL_TPM_CMD (1 << 5) | |
265 | #define PTM_CAP_STORE_VOLATILE (1 << 6) | |
266 | #define PTM_CAP_RESET_TPMESTABLISHED (1 << 7) | |
267 | #define PTM_CAP_GET_STATEBLOB (1 << 8) | |
268 | #define PTM_CAP_SET_STATEBLOB (1 << 9) | |
269 | #define PTM_CAP_STOP (1 << 10) | |
270 | #define PTM_CAP_GET_CONFIG (1 << 11) | |
271 | #define PTM_CAP_SET_DATAFD (1 << 12) | |
9375c44f | 272 | #define PTM_CAP_SET_BUFFERSIZE (1 << 13) |
efef4756 SB |
273 | #define PTM_CAP_GET_INFO (1 << 14) |
274 | #define PTM_CAP_SEND_COMMAND_HEADER (1 << 15) | |
275 | #define PTM_CAP_LOCK_STORAGE (1 << 16) | |
f4ede81e | 276 | |
d1c637ec | 277 | #ifndef _WIN32 |
f4ede81e AV |
278 | enum { |
279 | PTM_GET_CAPABILITY = _IOR('P', 0, ptm_cap), | |
280 | PTM_INIT = _IOWR('P', 1, ptm_init), | |
281 | PTM_SHUTDOWN = _IOR('P', 2, ptm_res), | |
282 | PTM_GET_TPMESTABLISHED = _IOR('P', 3, ptm_est), | |
283 | PTM_SET_LOCALITY = _IOWR('P', 4, ptm_loc), | |
284 | PTM_HASH_START = _IOR('P', 5, ptm_res), | |
285 | PTM_HASH_DATA = _IOWR('P', 6, ptm_hdata), | |
286 | PTM_HASH_END = _IOR('P', 7, ptm_res), | |
287 | PTM_CANCEL_TPM_CMD = _IOR('P', 8, ptm_res), | |
288 | PTM_STORE_VOLATILE = _IOR('P', 9, ptm_res), | |
289 | PTM_RESET_TPMESTABLISHED = _IOWR('P', 10, ptm_reset_est), | |
290 | PTM_GET_STATEBLOB = _IOWR('P', 11, ptm_getstate), | |
291 | PTM_SET_STATEBLOB = _IOWR('P', 12, ptm_setstate), | |
292 | PTM_STOP = _IOR('P', 13, ptm_res), | |
293 | PTM_GET_CONFIG = _IOR('P', 14, ptm_getconfig), | |
294 | PTM_SET_DATAFD = _IOR('P', 15, ptm_res), | |
9375c44f | 295 | PTM_SET_BUFFERSIZE = _IOWR('P', 16, ptm_setbuffersize), |
efef4756 SB |
296 | PTM_GET_INFO = _IOWR('P', 17, ptm_getinfo), |
297 | PTM_LOCK_STORAGE = _IOWR('P', 18, ptm_lockstorage), | |
f4ede81e | 298 | }; |
d1c637ec | 299 | #endif |
f4ede81e AV |
300 | |
301 | /* | |
302 | * Commands used by the non-CUSE TPMs | |
303 | * | |
304 | * All messages container big-endian data. | |
305 | * | |
306 | * The return messages only contain the 'resp' part of the unions | |
307 | * in the data structures above. Besides that the limits in the | |
308 | * buffers above (ptm_hdata:u.req.data and ptm_get_state:u.resp.data | |
309 | * and ptm_set_state:u.req.data) are 0xffffffff. | |
310 | */ | |
311 | enum { | |
efef4756 SB |
312 | CMD_GET_CAPABILITY = 1, /* 0x01 */ |
313 | CMD_INIT, /* 0x02 */ | |
314 | CMD_SHUTDOWN, /* 0x03 */ | |
315 | CMD_GET_TPMESTABLISHED, /* 0x04 */ | |
316 | CMD_SET_LOCALITY, /* 0x05 */ | |
317 | CMD_HASH_START, /* 0x06 */ | |
318 | CMD_HASH_DATA, /* 0x07 */ | |
319 | CMD_HASH_END, /* 0x08 */ | |
320 | CMD_CANCEL_TPM_CMD, /* 0x09 */ | |
321 | CMD_STORE_VOLATILE, /* 0x0a */ | |
322 | CMD_RESET_TPMESTABLISHED, /* 0x0b */ | |
323 | CMD_GET_STATEBLOB, /* 0x0c */ | |
324 | CMD_SET_STATEBLOB, /* 0x0d */ | |
325 | CMD_STOP, /* 0x0e */ | |
326 | CMD_GET_CONFIG, /* 0x0f */ | |
327 | CMD_SET_DATAFD, /* 0x10 */ | |
328 | CMD_SET_BUFFERSIZE, /* 0x11 */ | |
329 | CMD_GET_INFO, /* 0x12 */ | |
330 | CMD_LOCK_STORAGE, /* 0x13 */ | |
f4ede81e AV |
331 | }; |
332 | ||
efef4756 | 333 | #endif /* _TPM_IOCTL_H_ */ |