SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/char/tpm/tpm.c

   1 /*
   2  * Copyright (C) 2004 IBM Corporation
   3  *
   4  * Authors:
   5  * Leendert van Doorn <leendert@watson.ibm.com>
   6  * Dave Safford <safford@watson.ibm.com>
   7  * Reiner Sailer <sailer@watson.ibm.com>
   8  * Kylene Hall <kjhall@us.ibm.com>
   9  *
  10  * Maintained by: <tpmdd_devel@lists.sourceforge.net>
  11  *
  12  * Device driver for TCG/TCPA TPM (trusted platform module).
  13  * Specifications at www.trustedcomputinggroup.org
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License as
  17  * published by the Free Software Foundation, version 2 of the
  18  * License.
  19  *
  20  * Note, the TPM chip is not interrupt driven (only polling)
  21  * and can have very long timeouts (minutes!). Hence the unusual
  22  * calls to msleep.
  23  *
  24  */
  25
  26 #include <linux/sched.h>
  27 #include <linux/poll.h>
  28 #include <linux/spinlock.h>
  29 #include "tpm.h"
  30
  31 enum tpm_const {
  32         TPM_MINOR = 224,        /* officially assigned */
  33         TPM_BUFSIZE = 2048,
  34         TPM_NUM_DEVICES = 256,
  35         TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
  36 };
  37
  38 static LIST_HEAD(tpm_chip_list);
  39 static DEFINE_SPINLOCK(driver_lock);
  40 static int dev_mask[TPM_NUM_MASK_ENTRIES];
  41
  42 static void user_reader_timeout(unsigned long ptr)
  43 {
  44         struct tpm_chip *chip = (struct tpm_chip *) ptr;
  45
  46         down(&chip->buffer_mutex);
  47         atomic_set(&chip->data_pending, 0);
  48         memset(chip->data_buffer, 0, TPM_BUFSIZE);
  49         up(&chip->buffer_mutex);
  50 }
  51
  52 /*
  53  * Internal kernel interface to transmit TPM commands
  54  */
  55 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
  56                             size_t bufsiz)
  57 {
  58         ssize_t rc;
  59         u32 count;
  60         unsigned long stop;
  61
  62         count = be32_to_cpu(*((__be32 *) (buf + 2)));
  63
  64         if (count == 0)
  65                 return -ENODATA;
  66         if (count > bufsiz) {
  67                 dev_err(chip->dev,
  68                         "invalid count value %x %zx \n", count, bufsiz);
  69                 return -E2BIG;
  70         }
  71
  72         down(&chip->tpm_mutex);
  73
  74         if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
  75                 dev_err(chip->dev,
  76                         "tpm_transmit: tpm_send: error %zd\n", rc);
  77                 goto out;
  78         }
  79
  80         stop = jiffies + 2 * 60 * HZ;
  81         do {
  82                 u8 status = chip->vendor->status(chip);
  83                 if ((status & chip->vendor->req_complete_mask) ==
  84                     chip->vendor->req_complete_val) {
  85                         goto out_recv;
  86                 }
  87
  88                 if ((status == chip->vendor->req_canceled)) {
  89                         dev_err(chip->dev, "Operation Canceled\n");
  90                         rc = -ECANCELED;
  91                         goto out;
  92                 }
  93
  94                 msleep(TPM_TIMEOUT);    /* CHECK */
  95                 rmb();
  96         } while (time_before(jiffies, stop));
  97
  98
  99         chip->vendor->cancel(chip);
 100         dev_err(chip->dev, "Operation Timed out\n");
 101         rc = -ETIME;
 102         goto out;
 103
 104 out_recv:
 105         rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
 106         if (rc < 0)
 107                 dev_err(chip->dev,
 108                         "tpm_transmit: tpm_recv: error %zd\n", rc);
 109 out:
 110         up(&chip->tpm_mutex);
 111         return rc;
 112 }
 113
 114 #define TPM_DIGEST_SIZE 20
 115 #define CAP_PCR_RESULT_SIZE 18
 116 static const u8 cap_pcr[] = {
 117         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 118         0, 0, 0, 22,            /* length */
 119         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 120         0, 0, 0, 5,
 121         0, 0, 0, 4,
 122         0, 0, 1, 1
 123 };
 124
 125 #define READ_PCR_RESULT_SIZE 30
 126 static const u8 pcrread[] = {
 127         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 128         0, 0, 0, 14,            /* length */
 129         0, 0, 0, 21,            /* TPM_ORD_PcrRead */
 130         0, 0, 0, 0              /* PCR index */
 131 };
 132
 133 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 134                       char *buf)
 135 {
 136         u8 data[READ_PCR_RESULT_SIZE];
 137         ssize_t len;
 138         int i, j, num_pcrs;
 139         __be32 index;
 140         char *str = buf;
 141
 142         struct tpm_chip *chip = dev_get_drvdata(dev);
 143         if (chip == NULL)
 144                 return -ENODEV;
 145
 146         memcpy(data, cap_pcr, sizeof(cap_pcr));
 147         if ((len = tpm_transmit(chip, data, sizeof(data)))
 148             < CAP_PCR_RESULT_SIZE) {
 149                 dev_dbg(chip->dev, "A TPM error (%d) occurred "
 150                                 "attempting to determine the number of PCRS\n",
 151                         be32_to_cpu(*((__be32 *) (data + 6))));
 152                 return 0;
 153         }
 154
 155         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
 156
 157         for (i = 0; i < num_pcrs; i++) {
 158                 memcpy(data, pcrread, sizeof(pcrread));
 159                 index = cpu_to_be32(i);
 160                 memcpy(data + 10, &index, 4);
 161                 if ((len = tpm_transmit(chip, data, sizeof(data)))
 162                     < READ_PCR_RESULT_SIZE){
 163                         dev_dbg(chip->dev, "A TPM error (%d) occurred"
 164                                 " attempting to read PCR %d of %d\n",
 165                                 be32_to_cpu(*((__be32 *) (data + 6))), i, num_pcrs);
 166                         goto out;
 167                 }
 168                 str += sprintf(str, "PCR-%02d: ", i);
 169                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
 170                         str += sprintf(str, "%02X ", *(data + 10 + j));
 171                 str += sprintf(str, "\n");
 172         }
 173 out:
 174         return str - buf;
 175 }
 176 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
 177
 178 #define  READ_PUBEK_RESULT_SIZE 314
 179 static const u8 readpubek[] = {
 180         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 181         0, 0, 0, 30,            /* length */
 182         0, 0, 0, 124,           /* TPM_ORD_ReadPubek */
 183 };
 184
 185 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 186                        char *buf)
 187 {
 188         u8 *data;
 189         ssize_t len;
 190         int i, rc;
 191         char *str = buf;
 192
 193         struct tpm_chip *chip = dev_get_drvdata(dev);
 194         if (chip == NULL)
 195                 return -ENODEV;
 196
 197         data = kmalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
 198         if (!data)
 199                 return -ENOMEM;
 200
 201         memcpy(data, readpubek, sizeof(readpubek));
 202         memset(data + sizeof(readpubek), 0, 20);        /* zero nonce */
 203
 204         if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
 205             READ_PUBEK_RESULT_SIZE) {
 206                 dev_dbg(chip->dev, "A TPM error (%d) occurred "
 207                                 "attempting to read the PUBEK\n",
 208                             be32_to_cpu(*((__be32 *) (data + 6))));
 209                 rc = 0;
 210                 goto out;
 211         }
 212
 213         /*
 214            ignore header 10 bytes
 215            algorithm 32 bits (1 == RSA )
 216            encscheme 16 bits
 217            sigscheme 16 bits
 218            parameters (RSA 12->bytes: keybit, #primes, expbit)
 219            keylenbytes 32 bits
 220            256 byte modulus
 221            ignore checksum 20 bytes
 222          */
 223
 224         str +=
 225             sprintf(str,
 226                     "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
 227                     "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
 228                     " %02X %02X %02X %02X %02X %02X %02X %02X\n"
 229                     "Modulus length: %d\nModulus: \n",
 230                     data[10], data[11], data[12], data[13], data[14],
 231                     data[15], data[16], data[17], data[22], data[23],
 232                     data[24], data[25], data[26], data[27], data[28],
 233                     data[29], data[30], data[31], data[32], data[33],
 234                     be32_to_cpu(*((__be32 *) (data + 34))));
 235
 236         for (i = 0; i < 256; i++) {
 237                 str += sprintf(str, "%02X ", data[i + 38]);
 238                 if ((i + 1) % 16 == 0)
 239                         str += sprintf(str, "\n");
 240         }
 241         rc = str - buf;
 242 out:
 243         kfree(data);
 244         return rc;
 245 }
 246
 247 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 248
 249 #define CAP_VER_RESULT_SIZE 18
 250 static const u8 cap_version[] = {
 251         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 252         0, 0, 0, 18,            /* length */
 253         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 254         0, 0, 0, 6,
 255         0, 0, 0, 0
 256 };
 257
 258 #define CAP_MANUFACTURER_RESULT_SIZE 18
 259 static const u8 cap_manufacturer[] = {
 260         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 261         0, 0, 0, 22,            /* length */
 262         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 263         0, 0, 0, 5,
 264         0, 0, 0, 4,
 265         0, 0, 1, 3
 266 };
 267
 268 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
 269                       char *buf)
 270 {
 271         u8 data[sizeof(cap_manufacturer)];
 272         ssize_t len;
 273         char *str = buf;
 274
 275         struct tpm_chip *chip = dev_get_drvdata(dev);
 276         if (chip == NULL)
 277                 return -ENODEV;
 278
 279         memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
 280
 281         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 282             CAP_MANUFACTURER_RESULT_SIZE)
 283                 return len;
 284
 285         str += sprintf(str, "Manufacturer: 0x%x\n",
 286                        be32_to_cpu(*((__be32 *) (data + 14))));
 287
 288         memcpy(data, cap_version, sizeof(cap_version));
 289
 290         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 291             CAP_VER_RESULT_SIZE)
 292                 return len;
 293
 294         str +=
 295             sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
 296                     (int) data[14], (int) data[15], (int) data[16],
 297                     (int) data[17]);
 298
 299         return str - buf;
 300 }
 301 EXPORT_SYMBOL_GPL(tpm_show_caps);
 302
 303 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
 304                         const char *buf, size_t count)
 305 {
 306         struct tpm_chip *chip = dev_get_drvdata(dev);
 307         if (chip == NULL)
 308                 return 0;
 309
 310         chip->vendor->cancel(chip);
 311         return count;
 312 }
 313 EXPORT_SYMBOL_GPL(tpm_store_cancel);
 314
 315
 316 /*
 317  * Device file system interface to the TPM
 318  */
 319 int tpm_open(struct inode *inode, struct file *file)
 320 {
 321         int rc = 0, minor = iminor(inode);
 322         struct tpm_chip *chip = NULL, *pos;
 323
 324         spin_lock(&driver_lock);
 325
 326         list_for_each_entry(pos, &tpm_chip_list, list) {
 327                 if (pos->vendor->miscdev.minor == minor) {
 328                         chip = pos;
 329                         break;
 330                 }
 331         }
 332
 333         if (chip == NULL) {
 334                 rc = -ENODEV;
 335                 goto err_out;
 336         }
 337
 338         if (chip->num_opens) {
 339                 dev_dbg(chip->dev,
 340                         "Another process owns this TPM\n");
 341                 rc = -EBUSY;
 342                 goto err_out;
 343         }
 344
 345         chip->num_opens++;
 346         get_device(chip->dev);
 347
 348         spin_unlock(&driver_lock);
 349
 350         chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
 351         if (chip->data_buffer == NULL) {
 352                 chip->num_opens--;
 353                 put_device(chip->dev);
 354                 return -ENOMEM;
 355         }
 356
 357         atomic_set(&chip->data_pending, 0);
 358
 359         file->private_data = chip;
 360         return 0;
 361
 362 err_out:
 363         spin_unlock(&driver_lock);
 364         return rc;
 365 }
 366
 367 EXPORT_SYMBOL_GPL(tpm_open);
 368
 369 int tpm_release(struct inode *inode, struct file *file)
 370 {
 371         struct tpm_chip *chip = file->private_data;
 372
 373         spin_lock(&driver_lock);
 374         file->private_data = NULL;
 375         chip->num_opens--;
 376         del_singleshot_timer_sync(&chip->user_read_timer);
 377         atomic_set(&chip->data_pending, 0);
 378         put_device(chip->dev);
 379         kfree(chip->data_buffer);
 380         spin_unlock(&driver_lock);
 381         return 0;
 382 }
 383
 384 EXPORT_SYMBOL_GPL(tpm_release);
 385
 386 ssize_t tpm_write(struct file * file, const char __user * buf,
 387                   size_t size, loff_t * off)
 388 {
 389         struct tpm_chip *chip = file->private_data;
 390         int in_size = size, out_size;
 391
 392         /* cannot perform a write until the read has cleared
 393            either via tpm_read or a user_read_timer timeout */
 394         while (atomic_read(&chip->data_pending) != 0)
 395                 msleep(TPM_TIMEOUT);
 396
 397         down(&chip->buffer_mutex);
 398
 399         if (in_size > TPM_BUFSIZE)
 400                 in_size = TPM_BUFSIZE;
 401
 402         if (copy_from_user
 403             (chip->data_buffer, (void __user *) buf, in_size)) {
 404                 up(&chip->buffer_mutex);
 405                 return -EFAULT;
 406         }
 407
 408         /* atomic tpm command send and result receive */
 409         out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
 410
 411         atomic_set(&chip->data_pending, out_size);
 412         up(&chip->buffer_mutex);
 413
 414         /* Set a timeout by which the reader must come claim the result */
 415         mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
 416
 417         return in_size;
 418 }
 419
 420 EXPORT_SYMBOL_GPL(tpm_write);
 421
 422 ssize_t tpm_read(struct file * file, char __user * buf,
 423                  size_t size, loff_t * off)
 424 {
 425         struct tpm_chip *chip = file->private_data;
 426         int ret_size;
 427
 428         del_singleshot_timer_sync(&chip->user_read_timer);
 429         ret_size = atomic_read(&chip->data_pending);
 430         atomic_set(&chip->data_pending, 0);
 431         if (ret_size > 0) {     /* relay data */
 432                 if (size < ret_size)
 433                         ret_size = size;
 434
 435                 down(&chip->buffer_mutex);
 436                 if (copy_to_user
 437                     ((void __user *) buf, chip->data_buffer, ret_size))
 438                         ret_size = -EFAULT;
 439                 up(&chip->buffer_mutex);
 440         }
 441
 442         return ret_size;
 443 }
 444
 445 EXPORT_SYMBOL_GPL(tpm_read);
 446
 447 void tpm_remove_hardware(struct device *dev)
 448 {
 449         struct tpm_chip *chip = dev_get_drvdata(dev);
 450
 451         if (chip == NULL) {
 452                 dev_err(dev, "No device data found\n");
 453                 return;
 454         }
 455
 456         spin_lock(&driver_lock);
 457
 458         list_del(&chip->list);
 459
 460         spin_unlock(&driver_lock);
 461
 462         dev_set_drvdata(dev, NULL);
 463         misc_deregister(&chip->vendor->miscdev);
 464         kfree(chip->vendor->miscdev.name);
 465
 466         sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
 467
 468         dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
 469
 470         kfree(chip);
 471
 472         put_device(dev);
 473 }
 474
 475 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 476
 477 static u8 savestate[] = {
 478         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 479         0, 0, 0, 10,            /* blob length (in bytes) */
 480         0, 0, 0, 152            /* TPM_ORD_SaveState */
 481 };
 482
 483 /*
 484  * We are about to suspend. Save the TPM state
 485  * so that it can be restored.
 486  */
 487 int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
 488 {
 489         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 490         if (chip == NULL)
 491                 return -ENODEV;
 492
 493         tpm_transmit(chip, savestate, sizeof(savestate));
 494         return 0;
 495 }
 496
 497 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 498
 499 /*
 500  * Resume from a power safe. The BIOS already restored
 501  * the TPM state.
 502  */
 503 int tpm_pm_resume(struct pci_dev *pci_dev)
 504 {
 505         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 506
 507         if (chip == NULL)
 508                 return -ENODEV;
 509
 510         return 0;
 511 }
 512
 513 EXPORT_SYMBOL_GPL(tpm_pm_resume);
 514
 515 /*
 516  * Called from tpm_<specific>.c probe function only for devices
 517  * the driver has determined it should claim.  Prior to calling
 518  * this function the specific probe function has called pci_enable_device
 519  * upon errant exit from this function specific probe function should call
 520  * pci_disable_device
 521  */
 522 int tpm_register_hardware(struct device *dev,
 523                           struct tpm_vendor_specific *entry)
 524 {
 525 #define DEVNAME_SIZE 7
 526
 527         char *devname;
 528         struct tpm_chip *chip;
 529         int i, j;
 530
 531         /* Driver specific per-device data */
 532         chip = kmalloc(sizeof(*chip), GFP_KERNEL);
 533         if (chip == NULL)
 534                 return -ENOMEM;
 535
 536         memset(chip, 0, sizeof(struct tpm_chip));
 537
 538         init_MUTEX(&chip->buffer_mutex);
 539         init_MUTEX(&chip->tpm_mutex);
 540         INIT_LIST_HEAD(&chip->list);
 541
 542         init_timer(&chip->user_read_timer);
 543         chip->user_read_timer.function = user_reader_timeout;
 544         chip->user_read_timer.data = (unsigned long) chip;
 545
 546         chip->vendor = entry;
 547
 548         chip->dev_num = -1;
 549
 550         for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
 551                 for (j = 0; j < 8 * sizeof(int); j++)
 552                         if ((dev_mask[i] & (1 << j)) == 0) {
 553                                 chip->dev_num =
 554                                     i * TPM_NUM_MASK_ENTRIES + j;
 555                                 dev_mask[i] |= 1 << j;
 556                                 goto dev_num_search_complete;
 557                         }
 558
 559 dev_num_search_complete:
 560         if (chip->dev_num < 0) {
 561                 dev_err(dev,
 562                         "No available tpm device numbers\n");
 563                 kfree(chip);
 564                 return -ENODEV;
 565         } else if (chip->dev_num == 0)
 566                 chip->vendor->miscdev.minor = TPM_MINOR;
 567         else
 568                 chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
 569
 570         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
 571         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
 572         chip->vendor->miscdev.name = devname;
 573
 574         chip->vendor->miscdev.dev = dev;
 575         chip->dev = get_device(dev);
 576
 577         if (misc_register(&chip->vendor->miscdev)) {
 578                 dev_err(chip->dev,
 579                         "unable to misc_register %s, minor %d\n",
 580                         chip->vendor->miscdev.name,
 581                         chip->vendor->miscdev.minor);
 582                 put_device(dev);
 583                 kfree(chip);
 584                 dev_mask[i] &= !(1 << j);
 585                 return -ENODEV;
 586         }
 587
 588         spin_lock(&driver_lock);
 589
 590         dev_set_drvdata(dev, chip);
 591
 592         list_add(&chip->list, &tpm_chip_list);
 593
 594         spin_unlock(&driver_lock);
 595
 596         sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
 597
 598         return 0;
 599 }
 600
 601 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 602
 603 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
 604 MODULE_DESCRIPTION("TPM Driver");
 605 MODULE_VERSION("2.0");
 606 MODULE_LICENSE("GPL");