security/tpm: Move tpm TSS and TSPI layer to security section

* Move code from src/lib and src/include into src/security/tpm
* Split TPM TSS 1.2 and 2.0
* Fix header includes
* Add a new directory structure with kconfig and makefile includes

Change-Id: Id15a9aa6bd367560318dfcfd450bf5626ea0ec2b
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/22103
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>

4 files changed, 0 insertions, 460 deletions

diff --git a/src/include/antirollback.h b/src/include/antirollback.h
deleted file mode 100644
index f61aa858ff..0000000000
--- a/src/include/antirollback.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- *
- * Functions for querying, manipulating and locking rollback indices
- * stored in the TPM NVRAM.
- */
-
-#ifndef ANTIROLLBACK_H_
-#define ANTIROLLBACK_H_
-
-#include "tpm_lite/tss_constants.h"
-
-struct vb2_context;
-enum vb2_pcr_digest;
-
-/* TPM NVRAM location indices. */
-#define FIRMWARE_NV_INDEX               0x1007
-#define KERNEL_NV_INDEX                 0x1008
-/* 0x1009 used to be used as a backup space. Think of conflicts if you
- * want to use 0x1009 for something else. */
-#define BACKUP_NV_INDEX                 0x1009
-#define FWMP_NV_INDEX                   0x100a
-#define REC_HASH_NV_INDEX               0x100b
-#define REC_HASH_NV_SIZE                VB2_SHA256_DIGEST_SIZE
-
-/* Structure definitions for TPM spaces */
-
-/* Flags for firmware space */
-
-/*
- * Last boot was developer mode.  TPM ownership is cleared when transitioning
- * to/from developer mode.
- */
-#define FLAG_LAST_BOOT_DEVELOPER 0x01
-
-/* All functions return TPM_SUCCESS (zero) if successful, non-zero if error */
-
-uint32_t antirollback_read_space_firmware(struct vb2_context *ctx);
-
-/**
- * Write may be called if the versions change.
- */
-uint32_t antirollback_write_space_firmware(struct vb2_context *ctx);
-
-/**
- * Lock must be called.
- */
-uint32_t antirollback_lock_space_firmware(void);
-
-/* Read recovery hash data from TPM. */
-uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size);
-/* Write new hash data to recovery space in TPM. */
-uint32_t antirollback_write_space_rec_hash(const uint8_t *data, uint32_t size);
-/* Lock down recovery hash space in TPM. */
-uint32_t antirollback_lock_space_rec_hash(void);
-
-/****************************************************************************/
-
-/*
- * The following functions are internal apis, listed here for use by unit tests
- * only.
- */
-
-/**
- * Ask vboot for a digest and extend a TPM PCR with it.
- */
-uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
-			enum vb2_pcr_digest which_digest);
-
-/**
- * Issue a TPM_Clear and reenable/reactivate the TPM.
- */
-uint32_t tpm_clear_and_reenable(void);
-
-/**
- * Start the TPM and establish the root of trust for the antirollback mechanism.
- */
-uint32_t setup_tpm(struct vb2_context *ctx);
-
-#endif  /* ANTIROLLBACK_H_ */
diff --git a/src/include/tpm.h b/src/include/tpm.h
deleted file mode 100644
index 32a44c17eb..0000000000
--- a/src/include/tpm.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * This file is part of the coreboot project.
- *
- * Copyright 2011 Google Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; version 2 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#ifndef TPM_H_
-#define TPM_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-enum tis_access {
-	TPM_ACCESS_VALID = (1 << 7),
-	TPM_ACCESS_ACTIVE_LOCALITY = (1 << 5),
-	TPM_ACCESS_REQUEST_PENDING = (1 << 2),
-	TPM_ACCESS_REQUEST_USE = (1 << 1),
-	TPM_ACCESS_ESTABLISHMENT = (1 << 0),
-};
-
-enum tis_status {
-	TPM_STS_FAMILY_SHIFT = 26,
-	TPM_STS_FAMILY_MASK = (0x3 << TPM_STS_FAMILY_SHIFT),
-	TPM_STS_FAMILY_TPM_2_0 = (1 << TPM_STS_FAMILY_SHIFT),
-	TPM_STS_FAMILY_TPM_1_2 = (0 << TPM_STS_FAMILY_SHIFT),
-	TPM_STS_RESET_ESTABLISHMENT = (1 << 25),
-	TPM_STS_COMMAND_CANCEL = (1 << 24),
-	TPM_STS_BURST_COUNT_SHIFT = 8,
-	TPM_STS_BURST_COUNT_MASK = (0xFFFF << TPM_STS_BURST_COUNT_SHIFT),
-	TPM_STS_VALID = (1 << 7),
-	TPM_STS_COMMAND_READY = (1 << 6),
-	TPM_STS_GO = (1 << 5),
-	TPM_STS_DATA_AVAIL = (1 << 4),
-	TPM_STS_DATA_EXPECT = (1 << 3),
-	TPM_STS_SELF_TEST_DONE = (1 << 2),
-	TPM_STS_RESPONSE_RETRY = (1 << 1),
-};
-
-/*
- * tis_init()
- *
- * Initialize the TPM device. Returns 0 on success or -1 on
- * failure (in case device probing did not succeed).
- */
-int tis_init(void);
-
-/*
- * tis_open()
- *
- * Requests access to locality 0 for the caller. After all commands have been
- * completed the caller is supposed to call tis_close().
- *
- * Returns 0 on success, -1 on failure.
- */
-int tis_open(void);
-
-/*
- * tis_close()
- *
- * terminate the currect session with the TPM by releasing the locked
- * locality. Returns 0 on success of -1 on failure (in case lock
- * removal did not succeed).
- */
-int tis_close(void);
-
-/*
- * tis_sendrecv()
- *
- * Send the requested data to the TPM and then try to get its response
- *
- * @sendbuf - buffer of the data to send
- * @send_size size of the data to send
- * @recvbuf - memory to save the response to
- * @recv_len - pointer to the size of the response buffer
- *
- * Returns 0 on success (and places the number of response bytes at recv_len)
- * or -1 on failure.
- */
-int tis_sendrecv(const u8 *sendbuf, size_t send_size, u8 *recvbuf,
-			size_t *recv_len);
-
-void init_tpm(int s3resume);
-
-/*
- * tis_plat_irq_status()
- *
- * Check tpm irq and clear it.
- *
- * Returns 1 when irq pending or 0 when not.
- */
-int tis_plat_irq_status(void);
-
-#endif /* TPM_H_ */
diff --git a/src/include/tpm_lite/tlcl.h b/src/include/tpm_lite/tlcl.h
deleted file mode 100644
index 8dd5d80685..0000000000
--- a/src/include/tpm_lite/tlcl.h
+++ /dev/null
@@ -1,177 +0,0 @@
-/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-/*
- * TPM Lightweight Command Library.
- *
- * A low-level library for interfacing to TPM hardware or an emulator.
- */
-
-#ifndef TPM_LITE_TLCL_H_
-#define TPM_LITE_TLCL_H_
-#include <stdint.h>
-#include <types.h>
-
-#include "tss_constants.h"
-
-/*****************************************************************************/
-/* Functions implemented in tlcl.c */
-
-/**
- * Call this first.  Returns 0 if success, nonzero if error.
- */
-uint32_t tlcl_lib_init(void);
-
-/**
- * Perform a raw TPM request/response transaction.
- */
-uint32_t tlcl_send_receive(const uint8_t *request, uint8_t *response,
-			   int max_length);
-
-/* Commands */
-
-/**
- * Send a TPM_Startup(ST_CLEAR).  The TPM error code is returned (0 for
- * success).
- */
-uint32_t tlcl_startup(void);
-
-/**
- * Resume by sending a TPM_Startup(ST_STATE).  The TPM error code is returned
- * (0 for success).
- */
-uint32_t tlcl_resume(void);
-
-/**
- * Run the self test.
- *
- * Note---this is synchronous.  To run this in parallel with other firmware,
- * use ContinueSelfTest().  The TPM error code is returned.
- */
-uint32_t tlcl_self_test_full(void);
-
-/**
- * Run the self test in the background.
- */
-uint32_t tlcl_continue_self_test(void);
-
-#if IS_ENABLED(CONFIG_TPM)
-/**
- * Define a space with permission [perm].  [index] is the index for the space,
- * [size] the usable data size.  The TPM error code is returned.
- */
-uint32_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size);
-
-#elif IS_ENABLED(CONFIG_TPM2)
-
-/*
- * Define a TPM space. The define space command TPM command used by the tlcl
- * layer is enforcing the policy which would not allow to delete the created
- * space after any PCR0 change from its initial value.
- */
-uint32_t tlcl_define_space(uint32_t space_index, size_t space_size);
-#endif
-
-/**
- * Write [length] bytes of [data] to space at [index].  The TPM error code is
- * returned.
- */
-uint32_t tlcl_write(uint32_t index, const void *data, uint32_t length);
-
-/**
- * Read [length] bytes from space at [index] into [data].  The TPM error code
- * is returned.
- */
-uint32_t tlcl_read(uint32_t index, void *data, uint32_t length);
-
-/**
- * Assert physical presence in software.  The TPM error code is returned.
- */
-uint32_t tlcl_assert_physical_presence(void);
-
-/**
- * Enable the physical presence command.  The TPM error code is returned.
- */
-uint32_t tlcl_physical_presence_cmd_enable(void);
-
-/**
- * Finalize the physical presence settings: sofware PP is enabled, hardware PP
- * is disabled, and the lifetime lock is set.  The TPM error code is returned.
- */
-uint32_t tlcl_finalize_physical_presence(void);
-
-/**
- * Set the nvLocked bit.  The TPM error code is returned.
- */
-uint32_t tlcl_set_nv_locked(void);
-
-/**
- * Issue a ForceClear.  The TPM error code is returned.
- */
-uint32_t tlcl_force_clear(void);
-
-/**
- * Issue a PhysicalEnable.  The TPM error code is returned.
- */
-uint32_t tlcl_set_enable(void);
-
-/**
- * Issue a SetDeactivated.  Pass 0 to activate.  Returns result code.
- */
-uint32_t tlcl_set_deactivated(uint8_t flag);
-
-/**
- * Get flags of interest.  Pointers for flags you aren't interested in may
- * be NULL.  The TPM error code is returned.
- */
-uint32_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated,
-			uint8_t *nvlocked);
-
-/**
- * Set the bGlobalLock flag, which only a reboot can clear.  The TPM error
- * code is returned.
- */
-uint32_t tlcl_set_global_lock(void);
-
-/**
- * Make an NV Ram location read_only.  The TPM error code is returned.
- */
-uint32_t tlcl_lock_nv_write(uint32_t index);
-
-/**
- * Perform a TPM_Extend.
- */
-uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
-		     uint8_t *out_digest);
-
-/**
- * Get the entire set of permanent flags.
- */
-uint32_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags);
-
-/**
- * Disable platform hierarchy. Specific to TPM2. The TPM error code is returned.
- */
-uint32_t tlcl_disable_platform_hierarchy(void);
-
-/**
- * CR50 specific tpm command to enable nvmem commits before internal timeout
- * expires.
- */
-uint32_t tlcl_cr50_enable_nvcommits(void);
-
-/**
- * CR50 specific tpm command to restore header(s) of the dormant RO/RW
- * image(s) and in case there indeed was a dormant image, trigger reboot after
- * the timeout milliseconds. Note that timeout of zero means "NO REBOOT", not
- * "IMMEDIATE REBOOT".
- *
- * Return value indicates success or failure of accessing the TPM; in case of
- * success the number of restored headers is saved in num_restored_headers.
- */
-uint32_t tlcl_cr50_enable_update(uint16_t timeout_ms,
-				 uint8_t *num_restored_headers);
-
-#endif  /* TPM_LITE_TLCL_H_ */
diff --git a/src/include/tpm_lite/tss_constants.h b/src/include/tpm_lite/tss_constants.h
deleted file mode 100644
index 937e553969..0000000000
--- a/src/include/tpm_lite/tss_constants.h
+++ /dev/null
@@ -1,100 +0,0 @@
-/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- *
- * Some TPM constants and type definitions for standalone compilation for use
- * in the firmware
- */
-#ifndef VBOOT_REFERENCE_TSS_CONSTANTS_H_
-#define VBOOT_REFERENCE_TSS_CONSTANTS_H_
-#include <stdint.h>
-
-#define TPM_MAX_COMMAND_SIZE 4096
-#define TPM_LARGE_ENOUGH_COMMAND_SIZE 256  /* saves space in the firmware */
-#define TPM_PUBEK_SIZE 256
-#define TPM_PCR_DIGEST 20
-
-#define TPM_E_NON_FATAL 0x800
-
-#define TPM_SUCCESS ((uint32_t)0x00000000)
-
-#define TPM_E_AREA_LOCKED           ((uint32_t)0x0000003c)
-#define TPM_E_BADINDEX              ((uint32_t)0x00000002)
-#define TPM_E_BAD_PRESENCE          ((uint32_t)0x0000002d)
-#define TPM_E_IOERROR               ((uint32_t)0x0000001f)
-#define TPM_E_INVALID_POSTINIT      ((uint32_t)0x00000026)
-#define TPM_E_MAXNVWRITES           ((uint32_t)0x00000048)
-#define TPM_E_OWNER_SET             ((uint32_t)0x00000014)
-
-#define TPM_E_NEEDS_SELFTEST ((uint32_t)(TPM_E_NON_FATAL + 1))
-#define TPM_E_DOING_SELFTEST ((uint32_t)(TPM_E_NON_FATAL + 2))
-
-#define TPM_E_ALREADY_INITIALIZED    ((uint32_t)0x00005000)  /* vboot local */
-#define TPM_E_INTERNAL_INCONSISTENCY ((uint32_t)0x00005001)  /* vboot local */
-#define TPM_E_MUST_REBOOT            ((uint32_t)0x00005002)  /* vboot local */
-#define TPM_E_CORRUPTED_STATE        ((uint32_t)0x00005003)  /* vboot local */
-#define TPM_E_COMMUNICATION_ERROR    ((uint32_t)0x00005004)  /* vboot local */
-#define TPM_E_RESPONSE_TOO_LARGE     ((uint32_t)0x00005005)  /* vboot local */
-#define TPM_E_NO_DEVICE              ((uint32_t)0x00005006)  /* vboot local */
-#define TPM_E_INPUT_TOO_SMALL        ((uint32_t)0x00005007)  /* vboot local */
-#define TPM_E_WRITE_FAILURE          ((uint32_t)0x00005008)  /* vboot local */
-#define TPM_E_READ_EMPTY             ((uint32_t)0x00005009)  /* vboot local */
-#define TPM_E_READ_FAILURE           ((uint32_t)0x0000500a)  /* vboot local */
-#define TPM_E_NV_DEFINED             ((uint32_t)0x0000500b)  /* vboot local */
-
-#define TPM_NV_INDEX0 ((uint32_t)0x00000000)
-#define TPM_NV_INDEX_LOCK ((uint32_t)0xffffffff)
-#define TPM_NV_PER_GLOBALLOCK (((uint32_t)1)<<15)
-#define TPM_NV_PER_PPWRITE (((uint32_t)1)<<0)
-#define TPM_NV_PER_READ_STCLEAR (((uint32_t)1)<<31)
-#define TPM_NV_PER_WRITE_STCLEAR (((uint32_t)1)<<14)
-
-#define TPM_TAG_RQU_COMMAND       ((uint16_t) 0xc1)
-#define TPM_TAG_RQU_AUTH1_COMMAND ((uint16_t) 0xc2)
-#define TPM_TAG_RQU_AUTH2_COMMAND ((uint16_t) 0xc3)
-
-#define TPM_TAG_RSP_COMMAND       ((uint16_t) 0xc4)
-#define TPM_TAG_RSP_AUTH1_COMMAND ((uint16_t) 0xc5)
-#define TPM_TAG_RSP_AUTH2_COMMAND ((uint16_t) 0xc6)
-
-/* Some TPM2 return codes used in this library. */
-#define TPM2_RC_SUCCESS    0
-#define TPM2_RC_NV_DEFINED 0x14c
-
-typedef uint8_t TSS_BOOL;
-typedef uint16_t TPM_STRUCTURE_TAG;
-
-typedef struct tdTPM_PERMANENT_FLAGS {
-	TPM_STRUCTURE_TAG tag;
-	TSS_BOOL disable;
-	TSS_BOOL ownership;
-	TSS_BOOL deactivated;
-	TSS_BOOL readPubek;
-	TSS_BOOL disableOwnerClear;
-	TSS_BOOL allowMaintenance;
-	TSS_BOOL physicalPresenceLifetimeLock;
-	TSS_BOOL physicalPresenceHWEnable;
-	TSS_BOOL physicalPresenceCMDEnable;
-	TSS_BOOL CEKPUsed;
-	TSS_BOOL TPMpost;
-	TSS_BOOL TPMpostLock;
-	TSS_BOOL FIPS;
-	TSS_BOOL Operator;
-	TSS_BOOL enableRevokeEK;
-	TSS_BOOL nvLocked;
-	TSS_BOOL readSRKPub;
-	TSS_BOOL tpmEstablished;
-	TSS_BOOL maintenanceDone;
-	TSS_BOOL disableFullDALogicInfo;
-} TPM_PERMANENT_FLAGS;
-
-typedef struct tdTPM_STCLEAR_FLAGS {
-	TPM_STRUCTURE_TAG tag;
-	TSS_BOOL deactivated;
-	TSS_BOOL disableForceClear;
-	TSS_BOOL physicalPresence;
-	TSS_BOOL physicalPresenceLock;
-	TSS_BOOL bGlobalLock;
-} TPM_STCLEAR_FLAGS;
-
-#endif  /* VBOOT_REFERENCE_TSS_CONSTANTS_H_ */