]> git.kernelconcepts.de Git - karo-tx-linux.git/blob - drivers/char/tpm/tpm.c
char/tpm: Fix unitialized usage of data buffer
[karo-tx-linux.git] / drivers / char / tpm / tpm.c
1 /*
2  * Copyright (C) 2004 IBM Corporation
3  *
4  * Authors:
5  * Leendert van Doorn <leendert@watson.ibm.com>
6  * Dave Safford <safford@watson.ibm.com>
7  * Reiner Sailer <sailer@watson.ibm.com>
8  * Kylene Hall <kjhall@us.ibm.com>
9  *
10  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
11  *
12  * Device driver for TCG/TCPA TPM (trusted platform module).
13  * Specifications at www.trustedcomputinggroup.org       
14  *
15  * This program is free software; you can redistribute it and/or
16  * modify it under the terms of the GNU General Public License as
17  * published by the Free Software Foundation, version 2 of the
18  * License.
19  * 
20  * Note, the TPM chip is not interrupt driven (only polling)
21  * and can have very long timeouts (minutes!). Hence the unusual
22  * calls to msleep.
23  *
24  */
25
26 #include <linux/poll.h>
27 #include <linux/mutex.h>
28 #include <linux/spinlock.h>
29
30 #include "tpm.h"
31
32 enum tpm_const {
33         TPM_MINOR = 224,        /* officially assigned */
34         TPM_BUFSIZE = 2048,
35         TPM_NUM_DEVICES = 256,
36 };
37
38 enum tpm_duration {
39         TPM_SHORT = 0,
40         TPM_MEDIUM = 1,
41         TPM_LONG = 2,
42         TPM_UNDEFINED,
43 };
44
45 #define TPM_MAX_ORDINAL 243
46 #define TPM_MAX_PROTECTED_ORDINAL 12
47 #define TPM_PROTECTED_ORDINAL_MASK 0xFF
48
49 static LIST_HEAD(tpm_chip_list);
50 static DEFINE_SPINLOCK(driver_lock);
51 static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
52
53 /*
54  * Array with one entry per ordinal defining the maximum amount
55  * of time the chip could take to return the result.  The ordinal
56  * designation of short, medium or long is defined in a table in
57  * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
58  * values of the SHORT, MEDIUM, and LONG durations are retrieved
59  * from the chip during initialization with a call to tpm_get_timeouts.
60  */
61 static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
62         TPM_UNDEFINED,          /* 0 */
63         TPM_UNDEFINED,
64         TPM_UNDEFINED,
65         TPM_UNDEFINED,
66         TPM_UNDEFINED,
67         TPM_UNDEFINED,          /* 5 */
68         TPM_UNDEFINED,
69         TPM_UNDEFINED,
70         TPM_UNDEFINED,
71         TPM_UNDEFINED,
72         TPM_SHORT,              /* 10 */
73         TPM_SHORT,
74 };
75
76 static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
77         TPM_UNDEFINED,          /* 0 */
78         TPM_UNDEFINED,
79         TPM_UNDEFINED,
80         TPM_UNDEFINED,
81         TPM_UNDEFINED,
82         TPM_UNDEFINED,          /* 5 */
83         TPM_UNDEFINED,
84         TPM_UNDEFINED,
85         TPM_UNDEFINED,
86         TPM_UNDEFINED,
87         TPM_SHORT,              /* 10 */
88         TPM_SHORT,
89         TPM_MEDIUM,
90         TPM_LONG,
91         TPM_LONG,
92         TPM_MEDIUM,             /* 15 */
93         TPM_SHORT,
94         TPM_SHORT,
95         TPM_MEDIUM,
96         TPM_LONG,
97         TPM_SHORT,              /* 20 */
98         TPM_SHORT,
99         TPM_MEDIUM,
100         TPM_MEDIUM,
101         TPM_MEDIUM,
102         TPM_SHORT,              /* 25 */
103         TPM_SHORT,
104         TPM_MEDIUM,
105         TPM_SHORT,
106         TPM_SHORT,
107         TPM_MEDIUM,             /* 30 */
108         TPM_LONG,
109         TPM_MEDIUM,
110         TPM_SHORT,
111         TPM_SHORT,
112         TPM_SHORT,              /* 35 */
113         TPM_MEDIUM,
114         TPM_MEDIUM,
115         TPM_UNDEFINED,
116         TPM_UNDEFINED,
117         TPM_MEDIUM,             /* 40 */
118         TPM_LONG,
119         TPM_MEDIUM,
120         TPM_SHORT,
121         TPM_SHORT,
122         TPM_SHORT,              /* 45 */
123         TPM_SHORT,
124         TPM_SHORT,
125         TPM_SHORT,
126         TPM_LONG,
127         TPM_MEDIUM,             /* 50 */
128         TPM_MEDIUM,
129         TPM_UNDEFINED,
130         TPM_UNDEFINED,
131         TPM_UNDEFINED,
132         TPM_UNDEFINED,          /* 55 */
133         TPM_UNDEFINED,
134         TPM_UNDEFINED,
135         TPM_UNDEFINED,
136         TPM_UNDEFINED,
137         TPM_MEDIUM,             /* 60 */
138         TPM_MEDIUM,
139         TPM_MEDIUM,
140         TPM_SHORT,
141         TPM_SHORT,
142         TPM_MEDIUM,             /* 65 */
143         TPM_UNDEFINED,
144         TPM_UNDEFINED,
145         TPM_UNDEFINED,
146         TPM_UNDEFINED,
147         TPM_SHORT,              /* 70 */
148         TPM_SHORT,
149         TPM_UNDEFINED,
150         TPM_UNDEFINED,
151         TPM_UNDEFINED,
152         TPM_UNDEFINED,          /* 75 */
153         TPM_UNDEFINED,
154         TPM_UNDEFINED,
155         TPM_UNDEFINED,
156         TPM_UNDEFINED,
157         TPM_LONG,               /* 80 */
158         TPM_UNDEFINED,
159         TPM_MEDIUM,
160         TPM_LONG,
161         TPM_SHORT,
162         TPM_UNDEFINED,          /* 85 */
163         TPM_UNDEFINED,
164         TPM_UNDEFINED,
165         TPM_UNDEFINED,
166         TPM_UNDEFINED,
167         TPM_SHORT,              /* 90 */
168         TPM_SHORT,
169         TPM_SHORT,
170         TPM_SHORT,
171         TPM_SHORT,
172         TPM_UNDEFINED,          /* 95 */
173         TPM_UNDEFINED,
174         TPM_UNDEFINED,
175         TPM_UNDEFINED,
176         TPM_UNDEFINED,
177         TPM_MEDIUM,             /* 100 */
178         TPM_SHORT,
179         TPM_SHORT,
180         TPM_UNDEFINED,
181         TPM_UNDEFINED,
182         TPM_UNDEFINED,          /* 105 */
183         TPM_UNDEFINED,
184         TPM_UNDEFINED,
185         TPM_UNDEFINED,
186         TPM_UNDEFINED,
187         TPM_SHORT,              /* 110 */
188         TPM_SHORT,
189         TPM_SHORT,
190         TPM_SHORT,
191         TPM_SHORT,
192         TPM_SHORT,              /* 115 */
193         TPM_SHORT,
194         TPM_SHORT,
195         TPM_UNDEFINED,
196         TPM_UNDEFINED,
197         TPM_LONG,               /* 120 */
198         TPM_LONG,
199         TPM_MEDIUM,
200         TPM_UNDEFINED,
201         TPM_SHORT,
202         TPM_SHORT,              /* 125 */
203         TPM_SHORT,
204         TPM_LONG,
205         TPM_SHORT,
206         TPM_SHORT,
207         TPM_SHORT,              /* 130 */
208         TPM_MEDIUM,
209         TPM_UNDEFINED,
210         TPM_SHORT,
211         TPM_MEDIUM,
212         TPM_UNDEFINED,          /* 135 */
213         TPM_UNDEFINED,
214         TPM_UNDEFINED,
215         TPM_UNDEFINED,
216         TPM_UNDEFINED,
217         TPM_SHORT,              /* 140 */
218         TPM_SHORT,
219         TPM_UNDEFINED,
220         TPM_UNDEFINED,
221         TPM_UNDEFINED,
222         TPM_UNDEFINED,          /* 145 */
223         TPM_UNDEFINED,
224         TPM_UNDEFINED,
225         TPM_UNDEFINED,
226         TPM_UNDEFINED,
227         TPM_SHORT,              /* 150 */
228         TPM_MEDIUM,
229         TPM_MEDIUM,
230         TPM_SHORT,
231         TPM_SHORT,
232         TPM_UNDEFINED,          /* 155 */
233         TPM_UNDEFINED,
234         TPM_UNDEFINED,
235         TPM_UNDEFINED,
236         TPM_UNDEFINED,
237         TPM_SHORT,              /* 160 */
238         TPM_SHORT,
239         TPM_SHORT,
240         TPM_SHORT,
241         TPM_UNDEFINED,
242         TPM_UNDEFINED,          /* 165 */
243         TPM_UNDEFINED,
244         TPM_UNDEFINED,
245         TPM_UNDEFINED,
246         TPM_UNDEFINED,
247         TPM_LONG,               /* 170 */
248         TPM_UNDEFINED,
249         TPM_UNDEFINED,
250         TPM_UNDEFINED,
251         TPM_UNDEFINED,
252         TPM_UNDEFINED,          /* 175 */
253         TPM_UNDEFINED,
254         TPM_UNDEFINED,
255         TPM_UNDEFINED,
256         TPM_UNDEFINED,
257         TPM_MEDIUM,             /* 180 */
258         TPM_SHORT,
259         TPM_MEDIUM,
260         TPM_MEDIUM,
261         TPM_MEDIUM,
262         TPM_MEDIUM,             /* 185 */
263         TPM_SHORT,
264         TPM_UNDEFINED,
265         TPM_UNDEFINED,
266         TPM_UNDEFINED,
267         TPM_UNDEFINED,          /* 190 */
268         TPM_UNDEFINED,
269         TPM_UNDEFINED,
270         TPM_UNDEFINED,
271         TPM_UNDEFINED,
272         TPM_UNDEFINED,          /* 195 */
273         TPM_UNDEFINED,
274         TPM_UNDEFINED,
275         TPM_UNDEFINED,
276         TPM_UNDEFINED,
277         TPM_SHORT,              /* 200 */
278         TPM_UNDEFINED,
279         TPM_UNDEFINED,
280         TPM_UNDEFINED,
281         TPM_SHORT,
282         TPM_SHORT,              /* 205 */
283         TPM_SHORT,
284         TPM_SHORT,
285         TPM_SHORT,
286         TPM_SHORT,
287         TPM_MEDIUM,             /* 210 */
288         TPM_UNDEFINED,
289         TPM_MEDIUM,
290         TPM_MEDIUM,
291         TPM_MEDIUM,
292         TPM_UNDEFINED,          /* 215 */
293         TPM_MEDIUM,
294         TPM_UNDEFINED,
295         TPM_UNDEFINED,
296         TPM_SHORT,
297         TPM_SHORT,              /* 220 */
298         TPM_SHORT,
299         TPM_SHORT,
300         TPM_SHORT,
301         TPM_SHORT,
302         TPM_UNDEFINED,          /* 225 */
303         TPM_UNDEFINED,
304         TPM_UNDEFINED,
305         TPM_UNDEFINED,
306         TPM_UNDEFINED,
307         TPM_SHORT,              /* 230 */
308         TPM_LONG,
309         TPM_MEDIUM,
310         TPM_UNDEFINED,
311         TPM_UNDEFINED,
312         TPM_UNDEFINED,          /* 235 */
313         TPM_UNDEFINED,
314         TPM_UNDEFINED,
315         TPM_UNDEFINED,
316         TPM_UNDEFINED,
317         TPM_SHORT,              /* 240 */
318         TPM_UNDEFINED,
319         TPM_MEDIUM,
320 };
321
322 static void user_reader_timeout(unsigned long ptr)
323 {
324         struct tpm_chip *chip = (struct tpm_chip *) ptr;
325
326         schedule_work(&chip->work);
327 }
328
329 static void timeout_work(struct work_struct *work)
330 {
331         struct tpm_chip *chip = container_of(work, struct tpm_chip, work);
332
333         mutex_lock(&chip->buffer_mutex);
334         atomic_set(&chip->data_pending, 0);
335         memset(chip->data_buffer, 0, TPM_BUFSIZE);
336         mutex_unlock(&chip->buffer_mutex);
337 }
338
339 /*
340  * Returns max number of jiffies to wait
341  */
342 unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
343                                            u32 ordinal)
344 {
345         int duration_idx = TPM_UNDEFINED;
346         int duration = 0;
347
348         if (ordinal < TPM_MAX_ORDINAL)
349                 duration_idx = tpm_ordinal_duration[ordinal];
350         else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
351                  TPM_MAX_PROTECTED_ORDINAL)
352                 duration_idx =
353                     tpm_protected_ordinal_duration[ordinal &
354                                                    TPM_PROTECTED_ORDINAL_MASK];
355
356         if (duration_idx != TPM_UNDEFINED) {
357                 duration = chip->vendor.duration[duration_idx];
358                 /* if duration is 0, it's because chip->vendor.duration wasn't */
359                 /* filled yet, so we set the lowest timeout just to give enough */
360                 /* time for tpm_get_timeouts() to succeed */
361                 return (duration <= 0 ? HZ : duration);
362         } else
363                 return 2 * 60 * HZ;
364 }
365 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
366
367 /*
368  * Internal kernel interface to transmit TPM commands
369  */
370 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
371                             size_t bufsiz)
372 {
373         ssize_t rc;
374         u32 count, ordinal;
375         unsigned long stop;
376
377         count = be32_to_cpu(*((__be32 *) (buf + 2)));
378         ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
379         if (count == 0)
380                 return -ENODATA;
381         if (count > bufsiz) {
382                 dev_err(chip->dev,
383                         "invalid count value %x %zx \n", count, bufsiz);
384                 return -E2BIG;
385         }
386
387         mutex_lock(&chip->tpm_mutex);
388
389         if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
390                 dev_err(chip->dev,
391                         "tpm_transmit: tpm_send: error %zd\n", rc);
392                 goto out;
393         }
394
395         if (chip->vendor.irq)
396                 goto out_recv;
397
398         stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
399         do {
400                 u8 status = chip->vendor.status(chip);
401                 if ((status & chip->vendor.req_complete_mask) ==
402                     chip->vendor.req_complete_val)
403                         goto out_recv;
404
405                 if ((status == chip->vendor.req_canceled)) {
406                         dev_err(chip->dev, "Operation Canceled\n");
407                         rc = -ECANCELED;
408                         goto out;
409                 }
410
411                 msleep(TPM_TIMEOUT);    /* CHECK */
412                 rmb();
413         } while (time_before(jiffies, stop));
414
415         chip->vendor.cancel(chip);
416         dev_err(chip->dev, "Operation Timed out\n");
417         rc = -ETIME;
418         goto out;
419
420 out_recv:
421         rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
422         if (rc < 0)
423                 dev_err(chip->dev,
424                         "tpm_transmit: tpm_recv: error %zd\n", rc);
425 out:
426         mutex_unlock(&chip->tpm_mutex);
427         return rc;
428 }
429
430 #define TPM_DIGEST_SIZE 20
431 #define TPM_ERROR_SIZE 10
432 #define TPM_RET_CODE_IDX 6
433
434 enum tpm_capabilities {
435         TPM_CAP_FLAG = cpu_to_be32(4),
436         TPM_CAP_PROP = cpu_to_be32(5),
437         CAP_VERSION_1_1 = cpu_to_be32(0x06),
438         CAP_VERSION_1_2 = cpu_to_be32(0x1A)
439 };
440
441 enum tpm_sub_capabilities {
442         TPM_CAP_PROP_PCR = cpu_to_be32(0x101),
443         TPM_CAP_PROP_MANUFACTURER = cpu_to_be32(0x103),
444         TPM_CAP_FLAG_PERM = cpu_to_be32(0x108),
445         TPM_CAP_FLAG_VOL = cpu_to_be32(0x109),
446         TPM_CAP_PROP_OWNER = cpu_to_be32(0x111),
447         TPM_CAP_PROP_TIS_TIMEOUT = cpu_to_be32(0x115),
448         TPM_CAP_PROP_TIS_DURATION = cpu_to_be32(0x120),
449
450 };
451
452 static ssize_t transmit_cmd(struct tpm_chip *chip, struct tpm_cmd_t *cmd,
453                             int len, const char *desc)
454 {
455         int err;
456
457         len = tpm_transmit(chip,(u8 *) cmd, len);
458         if (len <  0)
459                 return len;
460         if (len == TPM_ERROR_SIZE) {
461                 err = be32_to_cpu(cmd->header.out.return_code);
462                 dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
463                 return err;
464         }
465         return 0;
466 }
467
468 #define TPM_INTERNAL_RESULT_SIZE 200
469 #define TPM_TAG_RQU_COMMAND cpu_to_be16(193)
470 #define TPM_ORD_GET_CAP cpu_to_be32(101)
471
472 static const struct tpm_input_header tpm_getcap_header = {
473         .tag = TPM_TAG_RQU_COMMAND,
474         .length = cpu_to_be32(22),
475         .ordinal = TPM_ORD_GET_CAP
476 };
477
478 ssize_t tpm_getcap(struct device *dev, __be32 subcap_id, cap_t *cap,
479                    const char *desc)
480 {
481         struct tpm_cmd_t tpm_cmd;
482         int rc;
483         struct tpm_chip *chip = dev_get_drvdata(dev);
484
485         tpm_cmd.header.in = tpm_getcap_header;
486         if (subcap_id == CAP_VERSION_1_1 || subcap_id == CAP_VERSION_1_2) {
487                 tpm_cmd.params.getcap_in.cap = subcap_id;
488                 /*subcap field not necessary */
489                 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(0);
490                 tpm_cmd.header.in.length -= cpu_to_be32(sizeof(__be32));
491         } else {
492                 if (subcap_id == TPM_CAP_FLAG_PERM ||
493                     subcap_id == TPM_CAP_FLAG_VOL)
494                         tpm_cmd.params.getcap_in.cap = TPM_CAP_FLAG;
495                 else
496                         tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
497                 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
498                 tpm_cmd.params.getcap_in.subcap = subcap_id;
499         }
500         rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);
501         if (!rc)
502                 *cap = tpm_cmd.params.getcap_out.cap;
503         return rc;
504 }
505
506 void tpm_gen_interrupt(struct tpm_chip *chip)
507 {
508         struct  tpm_cmd_t tpm_cmd;
509         ssize_t rc;
510
511         tpm_cmd.header.in = tpm_getcap_header;
512         tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
513         tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
514         tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
515
516         rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
517                         "attempting to determine the timeouts");
518 }
519 EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
520
521 void tpm_get_timeouts(struct tpm_chip *chip)
522 {
523         struct tpm_cmd_t tpm_cmd;
524         struct timeout_t *timeout_cap;
525         struct duration_t *duration_cap;
526         ssize_t rc;
527         u32 timeout;
528
529         tpm_cmd.header.in = tpm_getcap_header;
530         tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
531         tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
532         tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
533
534         rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
535                         "attempting to determine the timeouts");
536         if (rc)
537                 goto duration;
538
539         if (be32_to_cpu(tpm_cmd.header.out.length)
540             != 4 * sizeof(u32))
541                 goto duration;
542
543         timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout;
544         /* Don't overwrite default if value is 0 */
545         timeout = be32_to_cpu(timeout_cap->a);
546         if (timeout)
547                 chip->vendor.timeout_a = usecs_to_jiffies(timeout);
548         timeout = be32_to_cpu(timeout_cap->b);
549         if (timeout)
550                 chip->vendor.timeout_b = usecs_to_jiffies(timeout);
551         timeout = be32_to_cpu(timeout_cap->c);
552         if (timeout)
553                 chip->vendor.timeout_c = usecs_to_jiffies(timeout);
554         timeout = be32_to_cpu(timeout_cap->d);
555         if (timeout)
556                 chip->vendor.timeout_d = usecs_to_jiffies(timeout);
557
558 duration:
559         tpm_cmd.header.in = tpm_getcap_header;
560         tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
561         tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
562         tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
563
564         rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
565                         "attempting to determine the durations");
566         if (rc)
567                 return;
568
569         if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
570             be32_to_cpu(tpm_cmd.header.out.length)
571             != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
572                 return;
573
574         duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
575         chip->vendor.duration[TPM_SHORT] =
576             usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
577         /* The Broadcom BCM0102 chipset in a Dell Latitude D820 gets the above
578          * value wrong and apparently reports msecs rather than usecs. So we
579          * fix up the resulting too-small TPM_SHORT value to make things work.
580          */
581         if (chip->vendor.duration[TPM_SHORT] < (HZ/100))
582                 chip->vendor.duration[TPM_SHORT] = HZ;
583
584         chip->vendor.duration[TPM_MEDIUM] =
585             usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_medium));
586         chip->vendor.duration[TPM_LONG] =
587             usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_long));
588 }
589 EXPORT_SYMBOL_GPL(tpm_get_timeouts);
590
591 void tpm_continue_selftest(struct tpm_chip *chip)
592 {
593         u8 data[] = {
594                 0, 193,                 /* TPM_TAG_RQU_COMMAND */
595                 0, 0, 0, 10,            /* length */
596                 0, 0, 0, 83,            /* TPM_ORD_GetCapability */
597         };
598
599         tpm_transmit(chip, data, sizeof(data));
600 }
601 EXPORT_SYMBOL_GPL(tpm_continue_selftest);
602
603 ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
604                         char *buf)
605 {
606         cap_t cap;
607         ssize_t rc;
608
609         rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
610                          "attempting to determine the permanent enabled state");
611         if (rc)
612                 return 0;
613
614         rc = sprintf(buf, "%d\n", !cap.perm_flags.disable);
615         return rc;
616 }
617 EXPORT_SYMBOL_GPL(tpm_show_enabled);
618
619 ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
620                         char *buf)
621 {
622         cap_t cap;
623         ssize_t rc;
624
625         rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
626                          "attempting to determine the permanent active state");
627         if (rc)
628                 return 0;
629
630         rc = sprintf(buf, "%d\n", !cap.perm_flags.deactivated);
631         return rc;
632 }
633 EXPORT_SYMBOL_GPL(tpm_show_active);
634
635 ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
636                         char *buf)
637 {
638         cap_t cap;
639         ssize_t rc;
640
641         rc = tpm_getcap(dev, TPM_CAP_PROP_OWNER, &cap,
642                          "attempting to determine the owner state");
643         if (rc)
644                 return 0;
645
646         rc = sprintf(buf, "%d\n", cap.owned);
647         return rc;
648 }
649 EXPORT_SYMBOL_GPL(tpm_show_owned);
650
651 ssize_t tpm_show_temp_deactivated(struct device * dev,
652                                 struct device_attribute * attr, char *buf)
653 {
654         cap_t cap;
655         ssize_t rc;
656
657         rc = tpm_getcap(dev, TPM_CAP_FLAG_VOL, &cap,
658                          "attempting to determine the temporary state");
659         if (rc)
660                 return 0;
661
662         rc = sprintf(buf, "%d\n", cap.stclear_flags.deactivated);
663         return rc;
664 }
665 EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
666
667 /*
668  * tpm_chip_find_get - return tpm_chip for given chip number
669  */
670 static struct tpm_chip *tpm_chip_find_get(int chip_num)
671 {
672         struct tpm_chip *pos, *chip = NULL;
673
674         rcu_read_lock();
675         list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
676                 if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num)
677                         continue;
678
679                 if (try_module_get(pos->dev->driver->owner)) {
680                         chip = pos;
681                         break;
682                 }
683         }
684         rcu_read_unlock();
685         return chip;
686 }
687
688 #define TPM_ORDINAL_PCRREAD cpu_to_be32(21)
689 #define READ_PCR_RESULT_SIZE 30
690 static struct tpm_input_header pcrread_header = {
691         .tag = TPM_TAG_RQU_COMMAND,
692         .length = cpu_to_be32(14),
693         .ordinal = TPM_ORDINAL_PCRREAD
694 };
695
696 int __tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
697 {
698         int rc;
699         struct tpm_cmd_t cmd;
700
701         cmd.header.in = pcrread_header;
702         cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
703         rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
704                           "attempting to read a pcr value");
705
706         if (rc == 0)
707                 memcpy(res_buf, cmd.params.pcrread_out.pcr_result,
708                        TPM_DIGEST_SIZE);
709         return rc;
710 }
711
712 /**
713  * tpm_pcr_read - read a pcr value
714  * @chip_num:   tpm idx # or ANY
715  * @pcr_idx:    pcr idx to retrieve
716  * @res_buf:    TPM_PCR value
717  *              size of res_buf is 20 bytes (or NULL if you don't care)
718  *
719  * The TPM driver should be built-in, but for whatever reason it
720  * isn't, protect against the chip disappearing, by incrementing
721  * the module usage count.
722  */
723 int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf)
724 {
725         struct tpm_chip *chip;
726         int rc;
727
728         chip = tpm_chip_find_get(chip_num);
729         if (chip == NULL)
730                 return -ENODEV;
731         rc = __tpm_pcr_read(chip, pcr_idx, res_buf);
732         module_put(chip->dev->driver->owner);
733         return rc;
734 }
735 EXPORT_SYMBOL_GPL(tpm_pcr_read);
736
737 /**
738  * tpm_pcr_extend - extend pcr value with hash
739  * @chip_num:   tpm idx # or AN&
740  * @pcr_idx:    pcr idx to extend
741  * @hash:       hash value used to extend pcr value
742  *
743  * The TPM driver should be built-in, but for whatever reason it
744  * isn't, protect against the chip disappearing, by incrementing
745  * the module usage count.
746  */
747 #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
748 #define EXTEND_PCR_RESULT_SIZE 34
749 static struct tpm_input_header pcrextend_header = {
750         .tag = TPM_TAG_RQU_COMMAND,
751         .length = cpu_to_be32(34),
752         .ordinal = TPM_ORD_PCR_EXTEND
753 };
754
755 int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
756 {
757         struct tpm_cmd_t cmd;
758         int rc;
759         struct tpm_chip *chip;
760
761         chip = tpm_chip_find_get(chip_num);
762         if (chip == NULL)
763                 return -ENODEV;
764
765         cmd.header.in = pcrextend_header;
766         cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
767         memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
768         rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
769                           "attempting extend a PCR value");
770
771         module_put(chip->dev->driver->owner);
772         return rc;
773 }
774 EXPORT_SYMBOL_GPL(tpm_pcr_extend);
775
776 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
777                       char *buf)
778 {
779         cap_t cap;
780         u8 digest[TPM_DIGEST_SIZE];
781         ssize_t rc;
782         int i, j, num_pcrs;
783         char *str = buf;
784         struct tpm_chip *chip = dev_get_drvdata(dev);
785
786         rc = tpm_getcap(dev, TPM_CAP_PROP_PCR, &cap,
787                         "attempting to determine the number of PCRS");
788         if (rc)
789                 return 0;
790
791         num_pcrs = be32_to_cpu(cap.num_pcrs);
792         for (i = 0; i < num_pcrs; i++) {
793                 rc = __tpm_pcr_read(chip, i, digest);
794                 if (rc)
795                         break;
796                 str += sprintf(str, "PCR-%02d: ", i);
797                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
798                         str += sprintf(str, "%02X ", digest[j]);
799                 str += sprintf(str, "\n");
800         }
801         return str - buf;
802 }
803 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
804
805 #define  READ_PUBEK_RESULT_SIZE 314
806 #define TPM_ORD_READPUBEK cpu_to_be32(124)
807 struct tpm_input_header tpm_readpubek_header = {
808         .tag = TPM_TAG_RQU_COMMAND,
809         .length = cpu_to_be32(30),
810         .ordinal = TPM_ORD_READPUBEK
811 };
812
813 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
814                        char *buf)
815 {
816         u8 *data;
817         struct tpm_cmd_t tpm_cmd;
818         ssize_t err;
819         int i, rc;
820         char *str = buf;
821
822         struct tpm_chip *chip = dev_get_drvdata(dev);
823
824         tpm_cmd.header.in = tpm_readpubek_header;
825         err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
826                         "attempting to read the PUBEK");
827         if (err)
828                 goto out;
829
830         /* 
831            ignore header 10 bytes
832            algorithm 32 bits (1 == RSA )
833            encscheme 16 bits
834            sigscheme 16 bits
835            parameters (RSA 12->bytes: keybit, #primes, expbit)  
836            keylenbytes 32 bits
837            256 byte modulus
838            ignore checksum 20 bytes
839          */
840         data = tpm_cmd.params.readpubek_out_buffer;
841         str +=
842             sprintf(str,
843                     "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
844                     "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
845                     " %02X %02X %02X %02X %02X %02X %02X %02X\n"
846                     "Modulus length: %d\nModulus: \n",
847                     data[10], data[11], data[12], data[13], data[14],
848                     data[15], data[16], data[17], data[22], data[23],
849                     data[24], data[25], data[26], data[27], data[28],
850                     data[29], data[30], data[31], data[32], data[33],
851                     be32_to_cpu(*((__be32 *) (data + 34))));
852
853         for (i = 0; i < 256; i++) {
854                 str += sprintf(str, "%02X ", data[i + 38]);
855                 if ((i + 1) % 16 == 0)
856                         str += sprintf(str, "\n");
857         }
858 out:
859         rc = str - buf;
860         return rc;
861 }
862 EXPORT_SYMBOL_GPL(tpm_show_pubek);
863
864
865 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
866                       char *buf)
867 {
868         cap_t cap;
869         ssize_t rc;
870         char *str = buf;
871
872         rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
873                         "attempting to determine the manufacturer");
874         if (rc)
875                 return 0;
876         str += sprintf(str, "Manufacturer: 0x%x\n",
877                        be32_to_cpu(cap.manufacturer_id));
878
879         rc = tpm_getcap(dev, CAP_VERSION_1_1, &cap,
880                         "attempting to determine the 1.1 version");
881         if (rc)
882                 return 0;
883         str += sprintf(str,
884                        "TCG version: %d.%d\nFirmware version: %d.%d\n",
885                        cap.tpm_version.Major, cap.tpm_version.Minor,
886                        cap.tpm_version.revMajor, cap.tpm_version.revMinor);
887         return str - buf;
888 }
889 EXPORT_SYMBOL_GPL(tpm_show_caps);
890
891 ssize_t tpm_show_caps_1_2(struct device * dev,
892                           struct device_attribute * attr, char *buf)
893 {
894         cap_t cap;
895         ssize_t rc;
896         char *str = buf;
897
898         rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
899                         "attempting to determine the manufacturer");
900         if (rc)
901                 return 0;
902         str += sprintf(str, "Manufacturer: 0x%x\n",
903                        be32_to_cpu(cap.manufacturer_id));
904         rc = tpm_getcap(dev, CAP_VERSION_1_2, &cap,
905                          "attempting to determine the 1.2 version");
906         if (rc)
907                 return 0;
908         str += sprintf(str,
909                        "TCG version: %d.%d\nFirmware version: %d.%d\n",
910                        cap.tpm_version_1_2.Major, cap.tpm_version_1_2.Minor,
911                        cap.tpm_version_1_2.revMajor,
912                        cap.tpm_version_1_2.revMinor);
913         return str - buf;
914 }
915 EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
916
917 ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
918                           char *buf)
919 {
920         struct tpm_chip *chip = dev_get_drvdata(dev);
921
922         return sprintf(buf, "%d %d %d\n",
923                        jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
924                        jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
925                        jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
926 }
927 EXPORT_SYMBOL_GPL(tpm_show_timeouts);
928
929 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
930                         const char *buf, size_t count)
931 {
932         struct tpm_chip *chip = dev_get_drvdata(dev);
933         if (chip == NULL)
934                 return 0;
935
936         chip->vendor.cancel(chip);
937         return count;
938 }
939 EXPORT_SYMBOL_GPL(tpm_store_cancel);
940
941 /*
942  * Device file system interface to the TPM
943  *
944  * It's assured that the chip will be opened just once,
945  * by the check of is_open variable, which is protected
946  * by driver_lock.
947  */
948 int tpm_open(struct inode *inode, struct file *file)
949 {
950         int minor = iminor(inode);
951         struct tpm_chip *chip = NULL, *pos;
952
953         rcu_read_lock();
954         list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
955                 if (pos->vendor.miscdev.minor == minor) {
956                         chip = pos;
957                         get_device(chip->dev);
958                         break;
959                 }
960         }
961         rcu_read_unlock();
962
963         if (!chip)
964                 return -ENODEV;
965
966         if (test_and_set_bit(0, &chip->is_open)) {
967                 dev_dbg(chip->dev, "Another process owns this TPM\n");
968                 put_device(chip->dev);
969                 return -EBUSY;
970         }
971
972         chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
973         if (chip->data_buffer == NULL) {
974                 clear_bit(0, &chip->is_open);
975                 put_device(chip->dev);
976                 return -ENOMEM;
977         }
978
979         atomic_set(&chip->data_pending, 0);
980
981         file->private_data = chip;
982         return 0;
983 }
984 EXPORT_SYMBOL_GPL(tpm_open);
985
986 /*
987  * Called on file close
988  */
989 int tpm_release(struct inode *inode, struct file *file)
990 {
991         struct tpm_chip *chip = file->private_data;
992
993         del_singleshot_timer_sync(&chip->user_read_timer);
994         flush_scheduled_work();
995         file->private_data = NULL;
996         atomic_set(&chip->data_pending, 0);
997         kfree(chip->data_buffer);
998         clear_bit(0, &chip->is_open);
999         put_device(chip->dev);
1000         return 0;
1001 }
1002 EXPORT_SYMBOL_GPL(tpm_release);
1003
1004 ssize_t tpm_write(struct file *file, const char __user *buf,
1005                   size_t size, loff_t *off)
1006 {
1007         struct tpm_chip *chip = file->private_data;
1008         size_t in_size = size, out_size;
1009
1010         /* cannot perform a write until the read has cleared
1011            either via tpm_read or a user_read_timer timeout */
1012         while (atomic_read(&chip->data_pending) != 0)
1013                 msleep(TPM_TIMEOUT);
1014
1015         mutex_lock(&chip->buffer_mutex);
1016
1017         if (in_size > TPM_BUFSIZE)
1018                 in_size = TPM_BUFSIZE;
1019
1020         if (copy_from_user
1021             (chip->data_buffer, (void __user *) buf, in_size)) {
1022                 mutex_unlock(&chip->buffer_mutex);
1023                 return -EFAULT;
1024         }
1025
1026         /* atomic tpm command send and result receive */
1027         out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
1028
1029         atomic_set(&chip->data_pending, out_size);
1030         mutex_unlock(&chip->buffer_mutex);
1031
1032         /* Set a timeout by which the reader must come claim the result */
1033         mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
1034
1035         return in_size;
1036 }
1037 EXPORT_SYMBOL_GPL(tpm_write);
1038
1039 ssize_t tpm_read(struct file *file, char __user *buf,
1040                  size_t size, loff_t *off)
1041 {
1042         struct tpm_chip *chip = file->private_data;
1043         ssize_t ret_size;
1044
1045         del_singleshot_timer_sync(&chip->user_read_timer);
1046         flush_scheduled_work();
1047         ret_size = atomic_read(&chip->data_pending);
1048         atomic_set(&chip->data_pending, 0);
1049         if (ret_size > 0) {     /* relay data */
1050                 if (size < ret_size)
1051                         ret_size = size;
1052
1053                 mutex_lock(&chip->buffer_mutex);
1054                 if (copy_to_user(buf, chip->data_buffer, ret_size))
1055                         ret_size = -EFAULT;
1056                 mutex_unlock(&chip->buffer_mutex);
1057         }
1058
1059         return ret_size;
1060 }
1061 EXPORT_SYMBOL_GPL(tpm_read);
1062
1063 void tpm_remove_hardware(struct device *dev)
1064 {
1065         struct tpm_chip *chip = dev_get_drvdata(dev);
1066
1067         if (chip == NULL) {
1068                 dev_err(dev, "No device data found\n");
1069                 return;
1070         }
1071
1072         spin_lock(&driver_lock);
1073         list_del_rcu(&chip->list);
1074         spin_unlock(&driver_lock);
1075         synchronize_rcu();
1076
1077         misc_deregister(&chip->vendor.miscdev);
1078         sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
1079         tpm_bios_log_teardown(chip->bios_dir);
1080
1081         /* write it this way to be explicit (chip->dev == dev) */
1082         put_device(chip->dev);
1083 }
1084 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
1085
1086 /*
1087  * We are about to suspend. Save the TPM state
1088  * so that it can be restored.
1089  */
1090 int tpm_pm_suspend(struct device *dev, pm_message_t pm_state)
1091 {
1092         struct tpm_chip *chip = dev_get_drvdata(dev);
1093         u8 savestate[] = {
1094                 0, 193,         /* TPM_TAG_RQU_COMMAND */
1095                 0, 0, 0, 10,    /* blob length (in bytes) */
1096                 0, 0, 0, 152    /* TPM_ORD_SaveState */
1097         };
1098
1099         if (chip == NULL)
1100                 return -ENODEV;
1101
1102         tpm_transmit(chip, savestate, sizeof(savestate));
1103         return 0;
1104 }
1105 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
1106
1107 /*
1108  * Resume from a power safe. The BIOS already restored
1109  * the TPM state.
1110  */
1111 int tpm_pm_resume(struct device *dev)
1112 {
1113         struct tpm_chip *chip = dev_get_drvdata(dev);
1114
1115         if (chip == NULL)
1116                 return -ENODEV;
1117
1118         return 0;
1119 }
1120 EXPORT_SYMBOL_GPL(tpm_pm_resume);
1121
1122 /* In case vendor provided release function, call it too.*/
1123
1124 void tpm_dev_vendor_release(struct tpm_chip *chip)
1125 {
1126         if (chip->vendor.release)
1127                 chip->vendor.release(chip->dev);
1128
1129         clear_bit(chip->dev_num, dev_mask);
1130         kfree(chip->vendor.miscdev.name);
1131 }
1132 EXPORT_SYMBOL_GPL(tpm_dev_vendor_release);
1133
1134
1135 /*
1136  * Once all references to platform device are down to 0,
1137  * release all allocated structures.
1138  */
1139 void tpm_dev_release(struct device *dev)
1140 {
1141         struct tpm_chip *chip = dev_get_drvdata(dev);
1142
1143         tpm_dev_vendor_release(chip);
1144
1145         chip->release(dev);
1146         kfree(chip);
1147 }
1148 EXPORT_SYMBOL_GPL(tpm_dev_release);
1149
1150 /*
1151  * Called from tpm_<specific>.c probe function only for devices 
1152  * the driver has determined it should claim.  Prior to calling
1153  * this function the specific probe function has called pci_enable_device
1154  * upon errant exit from this function specific probe function should call
1155  * pci_disable_device
1156  */
1157 struct tpm_chip *tpm_register_hardware(struct device *dev,
1158                                         const struct tpm_vendor_specific *entry)
1159 {
1160 #define DEVNAME_SIZE 7
1161
1162         char *devname;
1163         struct tpm_chip *chip;
1164
1165         /* Driver specific per-device data */
1166         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
1167         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
1168
1169         if (chip == NULL || devname == NULL)
1170                 goto out_free;
1171
1172         mutex_init(&chip->buffer_mutex);
1173         mutex_init(&chip->tpm_mutex);
1174         INIT_LIST_HEAD(&chip->list);
1175
1176         INIT_WORK(&chip->work, timeout_work);
1177
1178         setup_timer(&chip->user_read_timer, user_reader_timeout,
1179                         (unsigned long)chip);
1180
1181         memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
1182
1183         chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
1184
1185         if (chip->dev_num >= TPM_NUM_DEVICES) {
1186                 dev_err(dev, "No available tpm device numbers\n");
1187                 goto out_free;
1188         } else if (chip->dev_num == 0)
1189                 chip->vendor.miscdev.minor = TPM_MINOR;
1190         else
1191                 chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
1192
1193         set_bit(chip->dev_num, dev_mask);
1194
1195         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
1196         chip->vendor.miscdev.name = devname;
1197
1198         chip->vendor.miscdev.parent = dev;
1199         chip->dev = get_device(dev);
1200         chip->release = dev->release;
1201         dev->release = tpm_dev_release;
1202         dev_set_drvdata(dev, chip);
1203
1204         if (misc_register(&chip->vendor.miscdev)) {
1205                 dev_err(chip->dev,
1206                         "unable to misc_register %s, minor %d\n",
1207                         chip->vendor.miscdev.name,
1208                         chip->vendor.miscdev.minor);
1209                 put_device(chip->dev);
1210                 return NULL;
1211         }
1212
1213         if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
1214                 misc_deregister(&chip->vendor.miscdev);
1215                 put_device(chip->dev);
1216
1217                 return NULL;
1218         }
1219
1220         chip->bios_dir = tpm_bios_log_setup(devname);
1221
1222         /* Make chip available */
1223         spin_lock(&driver_lock);
1224         list_add_rcu(&chip->list, &tpm_chip_list);
1225         spin_unlock(&driver_lock);
1226
1227         return chip;
1228
1229 out_free:
1230         kfree(chip);
1231         kfree(devname);
1232         return NULL;
1233 }
1234 EXPORT_SYMBOL_GPL(tpm_register_hardware);
1235
1236 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
1237 MODULE_DESCRIPTION("TPM Driver");
1238 MODULE_VERSION("2.0");
1239 MODULE_LICENSE("GPL");