SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/char/tpm/tpm.c

   1 /*
   2  * Copyright (C) 2004 IBM Corporation
   3  *
   4  * Authors:
   5  * Leendert van Doorn <leendert@watson.ibm.com>
   6  * Dave Safford <safford@watson.ibm.com>
   7  * Reiner Sailer <sailer@watson.ibm.com>
   8  * Kylene Hall <kjhall@us.ibm.com>
   9  *
  10  * Maintained by: <tpmdd_devel@lists.sourceforge.net>
  11  *
  12  * Device driver for TCG/TCPA TPM (trusted platform module).
  13  * Specifications at www.trustedcomputinggroup.org
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License as
  17  * published by the Free Software Foundation, version 2 of the
  18  * License.
  19  *
  20  * Note, the TPM chip is not interrupt driven (only polling)
  21  * and can have very long timeouts (minutes!). Hence the unusual
  22  * calls to msleep.
  23  *
  24  */
  25
  26 #include <linux/sched.h>
  27 #include <linux/poll.h>
  28 #include <linux/spinlock.h>
  29 #include "tpm.h"
  30
  31 enum tpm_const {
  32         TPM_MINOR = 224,        /* officially assigned */
  33         TPM_BUFSIZE = 2048,
  34         TPM_NUM_DEVICES = 256,
  35         TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
  36 };
  37
  38 static LIST_HEAD(tpm_chip_list);
  39 static DEFINE_SPINLOCK(driver_lock);
  40 static int dev_mask[TPM_NUM_MASK_ENTRIES];
  41
  42 static void user_reader_timeout(unsigned long ptr)
  43 {
  44         struct tpm_chip *chip = (struct tpm_chip *) ptr;
  45
  46         down(&chip->buffer_mutex);
  47         atomic_set(&chip->data_pending, 0);
  48         memset(chip->data_buffer, 0, TPM_BUFSIZE);
  49         up(&chip->buffer_mutex);
  50 }
  51
  52 /*
  53  * Internal kernel interface to transmit TPM commands
  54  */
  55 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
  56                             size_t bufsiz)
  57 {
  58         ssize_t rc;
  59         u32 count;
  60         unsigned long stop;
  61
  62         count = be32_to_cpu(*((__be32 *) (buf + 2)));
  63
  64         if (count == 0)
  65                 return -ENODATA;
  66         if (count > bufsiz) {
  67                 dev_err(&chip->pci_dev->dev,
  68                         "invalid count value %x %zx \n", count, bufsiz);
  69                 return -E2BIG;
  70         }
  71
  72         down(&chip->tpm_mutex);
  73
  74         if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
  75                 dev_err(&chip->pci_dev->dev,
  76                         "tpm_transmit: tpm_send: error %zd\n", rc);
  77                 goto out;
  78         }
  79
  80         stop = jiffies + 2 * 60 * HZ;
  81         do {
  82                 u8 status = inb(chip->vendor->base + 1);
  83                 if ((status & chip->vendor->req_complete_mask) ==
  84                     chip->vendor->req_complete_val) {
  85                         goto out_recv;
  86                 }
  87
  88                 if ((status == chip->vendor->req_canceled)) {
  89                         dev_err(&chip->pci_dev->dev, "Operation Canceled\n");
  90                         rc = -ECANCELED;
  91                         goto out;
  92                 }
  93
  94                 msleep(TPM_TIMEOUT);    /* CHECK */
  95                 rmb();
  96         } while (time_before(jiffies, stop));
  97
  98
  99         chip->vendor->cancel(chip);
 100         dev_err(&chip->pci_dev->dev, "Operation Timed out\n");
 101         rc = -ETIME;
 102         goto out;
 103
 104 out_recv:
 105         rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
 106         if (rc < 0)
 107                 dev_err(&chip->pci_dev->dev,
 108                         "tpm_transmit: tpm_recv: error %zd\n", rc);
 109 out:
 110         up(&chip->tpm_mutex);
 111         return rc;
 112 }
 113
 114 #define TPM_DIGEST_SIZE 20
 115 #define CAP_PCR_RESULT_SIZE 18
 116 static const u8 cap_pcr[] = {
 117         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 118         0, 0, 0, 22,            /* length */
 119         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 120         0, 0, 0, 5,
 121         0, 0, 0, 4,
 122         0, 0, 1, 1
 123 };
 124
 125 #define READ_PCR_RESULT_SIZE 30
 126 static const u8 pcrread[] = {
 127         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 128         0, 0, 0, 14,            /* length */
 129         0, 0, 0, 21,            /* TPM_ORD_PcrRead */
 130         0, 0, 0, 0              /* PCR index */
 131 };
 132
 133 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 134                       char *buf)
 135 {
 136         u8 data[READ_PCR_RESULT_SIZE];
 137         ssize_t len;
 138         int i, j, num_pcrs;
 139         __be32 index;
 140         char *str = buf;
 141
 142         struct tpm_chip *chip =
 143             pci_get_drvdata(to_pci_dev(dev));
 144         if (chip == NULL)
 145                 return -ENODEV;
 146
 147         memcpy(data, cap_pcr, sizeof(cap_pcr));
 148         if ((len = tpm_transmit(chip, data, sizeof(data)))
 149             < CAP_PCR_RESULT_SIZE) {
 150                 dev_err(&chip->pci_dev->dev, "A TPM error (%d) occurred "
 151                                 "attempting to determine the number of PCRS\n",
 152                         be32_to_cpu(*((__be32 *) (data + 6))));
 153                 return 0;
 154         }
 155
 156         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
 157
 158         for (i = 0; i < num_pcrs; i++) {
 159                 memcpy(data, pcrread, sizeof(pcrread));
 160                 index = cpu_to_be32(i);
 161                 memcpy(data + 10, &index, 4);
 162                 if ((len = tpm_transmit(chip, data, sizeof(data)))
 163                     < READ_PCR_RESULT_SIZE){
 164                         dev_err(&chip->pci_dev->dev, "A TPM error (%d) occurred"
 165                                 " attempting to read PCR %d of %d\n",
 166                                 be32_to_cpu(*((__be32 *) (data + 6))), i, num_pcrs);
 167                         goto out;
 168                 }
 169                 str += sprintf(str, "PCR-%02d: ", i);
 170                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
 171                         str += sprintf(str, "%02X ", *(data + 10 + j));
 172                 str += sprintf(str, "\n");
 173         }
 174 out:
 175         return str - buf;
 176 }
 177 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
 178
 179 #define  READ_PUBEK_RESULT_SIZE 314
 180 static const u8 readpubek[] = {
 181         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 182         0, 0, 0, 30,            /* length */
 183         0, 0, 0, 124,           /* TPM_ORD_ReadPubek */
 184 };
 185
 186 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 187                        char *buf)
 188 {
 189         u8 *data;
 190         ssize_t len;
 191         int i, rc;
 192         char *str = buf;
 193
 194         struct tpm_chip *chip =
 195             pci_get_drvdata(to_pci_dev(dev));
 196         if (chip == NULL)
 197                 return -ENODEV;
 198
 199         data = kmalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
 200         if (!data)
 201                 return -ENOMEM;
 202
 203         memcpy(data, readpubek, sizeof(readpubek));
 204         memset(data + sizeof(readpubek), 0, 20);        /* zero nonce */
 205
 206         if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
 207             READ_PUBEK_RESULT_SIZE) {
 208                 dev_err(&chip->pci_dev->dev, "A TPM error (%d) occurred "
 209                                 "attempting to read the PUBEK\n",
 210                             be32_to_cpu(*((__be32 *) (data + 6))));
 211                 return 0;
 212         }
 213
 214         /*
 215            ignore header 10 bytes
 216            algorithm 32 bits (1 == RSA )
 217            encscheme 16 bits
 218            sigscheme 16 bits
 219            parameters (RSA 12->bytes: keybit, #primes, expbit)
 220            keylenbytes 32 bits
 221            256 byte modulus
 222            ignore checksum 20 bytes
 223          */
 224
 225         str +=
 226             sprintf(str,
 227                     "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
 228                     "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
 229                     " %02X %02X %02X %02X %02X %02X %02X %02X\n"
 230                     "Modulus length: %d\nModulus: \n",
 231                     data[10], data[11], data[12], data[13], data[14],
 232                     data[15], data[16], data[17], data[22], data[23],
 233                     data[24], data[25], data[26], data[27], data[28],
 234                     data[29], data[30], data[31], data[32], data[33],
 235                     be32_to_cpu(*((__be32 *) (data + 32))));
 236
 237         for (i = 0; i < 256; i++) {
 238                 str += sprintf(str, "%02X ", data[i + 39]);
 239                 if ((i + 1) % 16 == 0)
 240                         str += sprintf(str, "\n");
 241         }
 242         rc = str - buf;
 243         kfree(data);
 244         return rc;
 245 }
 246
 247 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 248
 249 #define CAP_VER_RESULT_SIZE 18
 250 static const u8 cap_version[] = {
 251         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 252         0, 0, 0, 18,            /* length */
 253         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 254         0, 0, 0, 6,
 255         0, 0, 0, 0
 256 };
 257
 258 #define CAP_MANUFACTURER_RESULT_SIZE 18
 259 static const u8 cap_manufacturer[] = {
 260         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 261         0, 0, 0, 22,            /* length */
 262         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 263         0, 0, 0, 5,
 264         0, 0, 0, 4,
 265         0, 0, 1, 3
 266 };
 267
 268 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
 269                       char *buf)
 270 {
 271         u8 data[sizeof(cap_manufacturer)];
 272         ssize_t len;
 273         char *str = buf;
 274
 275         struct tpm_chip *chip =
 276             pci_get_drvdata(to_pci_dev(dev));
 277         if (chip == NULL)
 278                 return -ENODEV;
 279
 280         memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
 281
 282         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 283             CAP_MANUFACTURER_RESULT_SIZE)
 284                 return len;
 285
 286         str += sprintf(str, "Manufacturer: 0x%x\n",
 287                        be32_to_cpu(*((__be32 *) (data + 14))));
 288
 289         memcpy(data, cap_version, sizeof(cap_version));
 290
 291         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 292             CAP_VER_RESULT_SIZE)
 293                 return len;
 294
 295         str +=
 296             sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
 297                     (int) data[14], (int) data[15], (int) data[16],
 298                     (int) data[17]);
 299
 300         return str - buf;
 301 }
 302 EXPORT_SYMBOL_GPL(tpm_show_caps);
 303
 304 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
 305                         const char *buf, size_t count)
 306 {
 307         struct tpm_chip *chip = dev_get_drvdata(dev);
 308         if (chip == NULL)
 309                 return 0;
 310
 311         chip->vendor->cancel(chip);
 312         return count;
 313 }
 314 EXPORT_SYMBOL_GPL(tpm_store_cancel);
 315
 316
 317 /*
 318  * Device file system interface to the TPM
 319  */
 320 int tpm_open(struct inode *inode, struct file *file)
 321 {
 322         int rc = 0, minor = iminor(inode);
 323         struct tpm_chip *chip = NULL, *pos;
 324
 325         spin_lock(&driver_lock);
 326
 327         list_for_each_entry(pos, &tpm_chip_list, list) {
 328                 if (pos->vendor->miscdev.minor == minor) {
 329                         chip = pos;
 330                         break;
 331                 }
 332         }
 333
 334         if (chip == NULL) {
 335                 rc = -ENODEV;
 336                 goto err_out;
 337         }
 338
 339         if (chip->num_opens) {
 340                 dev_dbg(&chip->pci_dev->dev,
 341                         "Another process owns this TPM\n");
 342                 rc = -EBUSY;
 343                 goto err_out;
 344         }
 345
 346         chip->num_opens++;
 347         pci_dev_get(chip->pci_dev);
 348
 349         spin_unlock(&driver_lock);
 350
 351         chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
 352         if (chip->data_buffer == NULL) {
 353                 chip->num_opens--;
 354                 pci_dev_put(chip->pci_dev);
 355                 return -ENOMEM;
 356         }
 357
 358         atomic_set(&chip->data_pending, 0);
 359
 360         file->private_data = chip;
 361         return 0;
 362
 363 err_out:
 364         spin_unlock(&driver_lock);
 365         return rc;
 366 }
 367
 368 EXPORT_SYMBOL_GPL(tpm_open);
 369
 370 int tpm_release(struct inode *inode, struct file *file)
 371 {
 372         struct tpm_chip *chip = file->private_data;
 373
 374         spin_lock(&driver_lock);
 375         file->private_data = NULL;
 376         chip->num_opens--;
 377         del_singleshot_timer_sync(&chip->user_read_timer);
 378         atomic_set(&chip->data_pending, 0);
 379         pci_dev_put(chip->pci_dev);
 380         kfree(chip->data_buffer);
 381         spin_unlock(&driver_lock);
 382         return 0;
 383 }
 384
 385 EXPORT_SYMBOL_GPL(tpm_release);
 386
 387 ssize_t tpm_write(struct file * file, const char __user * buf,
 388                   size_t size, loff_t * off)
 389 {
 390         struct tpm_chip *chip = file->private_data;
 391         int in_size = size, out_size;
 392
 393         /* cannot perform a write until the read has cleared
 394            either via tpm_read or a user_read_timer timeout */
 395         while (atomic_read(&chip->data_pending) != 0)
 396                 msleep(TPM_TIMEOUT);
 397
 398         down(&chip->buffer_mutex);
 399
 400         if (in_size > TPM_BUFSIZE)
 401                 in_size = TPM_BUFSIZE;
 402
 403         if (copy_from_user
 404             (chip->data_buffer, (void __user *) buf, in_size)) {
 405                 up(&chip->buffer_mutex);
 406                 return -EFAULT;
 407         }
 408
 409         /* atomic tpm command send and result receive */
 410         out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
 411
 412         atomic_set(&chip->data_pending, out_size);
 413         up(&chip->buffer_mutex);
 414
 415         /* Set a timeout by which the reader must come claim the result */
 416         mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
 417
 418         return in_size;
 419 }
 420
 421 EXPORT_SYMBOL_GPL(tpm_write);
 422
 423 ssize_t tpm_read(struct file * file, char __user * buf,
 424                  size_t size, loff_t * off)
 425 {
 426         struct tpm_chip *chip = file->private_data;
 427         int ret_size;
 428
 429         del_singleshot_timer_sync(&chip->user_read_timer);
 430         ret_size = atomic_read(&chip->data_pending);
 431         atomic_set(&chip->data_pending, 0);
 432         if (ret_size > 0) {     /* relay data */
 433                 if (size < ret_size)
 434                         ret_size = size;
 435
 436                 down(&chip->buffer_mutex);
 437                 if (copy_to_user
 438                     ((void __user *) buf, chip->data_buffer, ret_size))
 439                         ret_size = -EFAULT;
 440                 up(&chip->buffer_mutex);
 441         }
 442
 443         return ret_size;
 444 }
 445
 446 EXPORT_SYMBOL_GPL(tpm_read);
 447
 448 void __devexit tpm_remove(struct pci_dev *pci_dev)
 449 {
 450         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 451
 452         if (chip == NULL) {
 453                 dev_err(&pci_dev->dev, "No device data found\n");
 454                 return;
 455         }
 456
 457         spin_lock(&driver_lock);
 458
 459         list_del(&chip->list);
 460
 461         spin_unlock(&driver_lock);
 462
 463         pci_set_drvdata(pci_dev, NULL);
 464         misc_deregister(&chip->vendor->miscdev);
 465
 466         sysfs_remove_group(&pci_dev->dev.kobj, chip->vendor->attr_group);
 467
 468         pci_disable_device(pci_dev);
 469
 470         dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
 471
 472         kfree(chip);
 473
 474         pci_dev_put(pci_dev);
 475 }
 476
 477 EXPORT_SYMBOL_GPL(tpm_remove);
 478
 479 static u8 savestate[] = {
 480         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 481         0, 0, 0, 10,            /* blob length (in bytes) */
 482         0, 0, 0, 152            /* TPM_ORD_SaveState */
 483 };
 484
 485 /*
 486  * We are about to suspend. Save the TPM state
 487  * so that it can be restored.
 488  */
 489 int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
 490 {
 491         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 492         if (chip == NULL)
 493                 return -ENODEV;
 494
 495         tpm_transmit(chip, savestate, sizeof(savestate));
 496         return 0;
 497 }
 498
 499 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 500
 501 /*
 502  * Resume from a power safe. The BIOS already restored
 503  * the TPM state.
 504  */
 505 int tpm_pm_resume(struct pci_dev *pci_dev)
 506 {
 507         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 508
 509         if (chip == NULL)
 510                 return -ENODEV;
 511
 512         return 0;
 513 }
 514
 515 EXPORT_SYMBOL_GPL(tpm_pm_resume);
 516
 517 /*
 518  * Called from tpm_<specific>.c probe function only for devices
 519  * the driver has determined it should claim.  Prior to calling
 520  * this function the specific probe function has called pci_enable_device
 521  * upon errant exit from this function specific probe function should call
 522  * pci_disable_device
 523  */
 524 int tpm_register_hardware(struct pci_dev *pci_dev,
 525                           struct tpm_vendor_specific *entry)
 526 {
 527         char devname[7];
 528         struct tpm_chip *chip;
 529         int i, j;
 530
 531         /* Driver specific per-device data */
 532         chip = kmalloc(sizeof(*chip), GFP_KERNEL);
 533         if (chip == NULL)
 534                 return -ENOMEM;
 535
 536         memset(chip, 0, sizeof(struct tpm_chip));
 537
 538         init_MUTEX(&chip->buffer_mutex);
 539         init_MUTEX(&chip->tpm_mutex);
 540         INIT_LIST_HEAD(&chip->list);
 541
 542         init_timer(&chip->user_read_timer);
 543         chip->user_read_timer.function = user_reader_timeout;
 544         chip->user_read_timer.data = (unsigned long) chip;
 545
 546         chip->vendor = entry;
 547
 548         chip->dev_num = -1;
 549
 550         for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
 551                 for (j = 0; j < 8 * sizeof(int); j++)
 552                         if ((dev_mask[i] & (1 << j)) == 0) {
 553                                 chip->dev_num =
 554                                     i * TPM_NUM_MASK_ENTRIES + j;
 555                                 dev_mask[i] |= 1 << j;
 556                                 goto dev_num_search_complete;
 557                         }
 558
 559 dev_num_search_complete:
 560         if (chip->dev_num < 0) {
 561                 dev_err(&pci_dev->dev,
 562                         "No available tpm device numbers\n");
 563                 kfree(chip);
 564                 return -ENODEV;
 565         } else if (chip->dev_num == 0)
 566                 chip->vendor->miscdev.minor = TPM_MINOR;
 567         else
 568                 chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
 569
 570         snprintf(devname, sizeof(devname), "%s%d", "tpm", chip->dev_num);
 571         chip->vendor->miscdev.name = devname;
 572
 573         chip->vendor->miscdev.dev = &(pci_dev->dev);
 574         chip->pci_dev = pci_dev_get(pci_dev);
 575
 576         if (misc_register(&chip->vendor->miscdev)) {
 577                 dev_err(&chip->pci_dev->dev,
 578                         "unable to misc_register %s, minor %d\n",
 579                         chip->vendor->miscdev.name,
 580                         chip->vendor->miscdev.minor);
 581                 pci_dev_put(pci_dev);
 582                 kfree(chip);
 583                 dev_mask[i] &= !(1 << j);
 584                 return -ENODEV;
 585         }
 586
 587         spin_lock(&driver_lock);
 588
 589         pci_set_drvdata(pci_dev, chip);
 590
 591         list_add(&chip->list, &tpm_chip_list);
 592
 593         spin_unlock(&driver_lock);
 594
 595         sysfs_create_group(&pci_dev->dev.kobj, chip->vendor->attr_group);
 596
 597         return 0;
 598 }
 599
 600 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 601
 602 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
 603 MODULE_DESCRIPTION("TPM Driver");
 604 MODULE_VERSION("2.0");
 605 MODULE_LICENSE("GPL");