drivers/char/tpm/tpm.c

   1 /*
   2  * Copyright (C) 2004 IBM Corporation
   3  *
   4  * Authors:
   5  * Leendert van Doorn <leendert@watson.ibm.com>
   6  * Dave Safford <safford@watson.ibm.com>
   7  * Reiner Sailer <sailer@watson.ibm.com>
   8  * Kylene Hall <kjhall@us.ibm.com>
   9  *
  10  * Maintained by: <tpmdd_devel@lists.sourceforge.net>
  11  *
  12  * Device driver for TCG/TCPA TPM (trusted platform module).
  13  * Specifications at www.trustedcomputinggroup.org
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License as
  17  * published by the Free Software Foundation, version 2 of the
  18  * License.
  19  *
  20  * Note, the TPM chip is not interrupt driven (only polling)
  21  * and can have very long timeouts (minutes!). Hence the unusual
  22  * calls to msleep.
  23  *
  24  */
  25
  26 #include <linux/sched.h>
  27 #include <linux/poll.h>
  28 #include <linux/spinlock.h>
  29 #include "tpm.h"
  30
  31 enum tpm_const {
  32         TPM_MINOR = 224,        /* officially assigned */
  33         TPM_BUFSIZE = 2048,
  34         TPM_NUM_DEVICES = 256,
  35         TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
  36 };
  37
  38 static LIST_HEAD(tpm_chip_list);
  39 static DEFINE_SPINLOCK(driver_lock);
  40 static int dev_mask[TPM_NUM_MASK_ENTRIES];
  41
  42 static void user_reader_timeout(unsigned long ptr)
  43 {
  44         struct tpm_chip *chip = (struct tpm_chip *) ptr;
  45
  46         down(&chip->buffer_mutex);
  47         atomic_set(&chip->data_pending, 0);
  48         memset(chip->data_buffer, 0, TPM_BUFSIZE);
  49         up(&chip->buffer_mutex);
  50 }
  51
  52 /*
  53  * Internal kernel interface to transmit TPM commands
  54  */
  55 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
  56                             size_t bufsiz)
  57 {
  58         ssize_t rc;
  59         u32 count;
  60         unsigned long stop;
  61
  62         count = be32_to_cpu(*((__be32 *) (buf + 2)));
  63
  64         if (count == 0)
  65                 return -ENODATA;
  66         if (count > bufsiz) {
  67                 dev_err(&chip->pci_dev->dev,
  68                         "invalid count value %x %zx \n", count, bufsiz);
  69                 return -E2BIG;
  70         }
  71
  72         down(&chip->tpm_mutex);
  73
  74         if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
  75                 dev_err(&chip->pci_dev->dev,
  76                         "tpm_transmit: tpm_send: error %zd\n", rc);
  77                 goto out;
  78         }
  79
  80         stop = jiffies + 2 * 60 * HZ;
  81         do {
  82                 u8 status = inb(chip->vendor->base + 1);
  83                 if ((status & chip->vendor->req_complete_mask) ==
  84                     chip->vendor->req_complete_val) {
  85                         goto out_recv;
  86                 }
  87
  88                 if ((status == chip->vendor->req_canceled)) {
  89                         dev_err(&chip->pci_dev->dev, "Operation Canceled\n");
  90                         rc = -ECANCELED;
  91                         goto out;
  92                 }
  93
  94                 msleep(TPM_TIMEOUT);    /* CHECK */
  95                 rmb();
  96         } while (time_before(jiffies, stop));
  97
  98
  99         chip->vendor->cancel(chip);
 100         dev_err(&chip->pci_dev->dev, "Operation Timed out\n");
 101         rc = -ETIME;
 102         goto out;
 103
 104 out_recv:
 105         rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
 106         if (rc < 0)
 107                 dev_err(&chip->pci_dev->dev,
 108                         "tpm_transmit: tpm_recv: error %zd\n", rc);
 109 out:
 110         up(&chip->tpm_mutex);
 111         return rc;
 112 }
 113
 114 #define TPM_DIGEST_SIZE 20
 115 #define CAP_PCR_RESULT_SIZE 18
 116 static const u8 cap_pcr[] = {
 117         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 118         0, 0, 0, 22,            /* length */
 119         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 120         0, 0, 0, 5,
 121         0, 0, 0, 4,
 122         0, 0, 1, 1
 123 };
 124
 125 #define READ_PCR_RESULT_SIZE 30
 126 static const u8 pcrread[] = {
 127         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 128         0, 0, 0, 14,            /* length */
 129         0, 0, 0, 21,            /* TPM_ORD_PcrRead */
 130         0, 0, 0, 0              /* PCR index */
 131 };
 132
 133 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 134                       char *buf)
 135 {
 136         u8 data[READ_PCR_RESULT_SIZE];
 137         ssize_t len;
 138         int i, j, num_pcrs;
 139         __be32 index;
 140         char *str = buf;
 141
 142         struct tpm_chip *chip =
 143             pci_get_drvdata(to_pci_dev(dev));
 144         if (chip == NULL)
 145                 return -ENODEV;
 146
 147         memcpy(data, cap_pcr, sizeof(cap_pcr));
 148         if ((len = tpm_transmit(chip, data, sizeof(data)))
 149             < CAP_PCR_RESULT_SIZE) {
 150                 dev_dbg(&chip->pci_dev->dev, "A TPM error (%d) occurred "
 151                                 "attempting to determine the number of PCRS\n",
 152                         be32_to_cpu(*((__be32 *) (data + 6))));
 153                 return 0;
 154         }
 155
 156         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
 157
 158         for (i = 0; i < num_pcrs; i++) {
 159                 memcpy(data, pcrread, sizeof(pcrread));
 160                 index = cpu_to_be32(i);
 161                 memcpy(data + 10, &index, 4);
 162                 if ((len = tpm_transmit(chip, data, sizeof(data)))
 163                     < READ_PCR_RESULT_SIZE){
 164                         dev_dbg(&chip->pci_dev->dev, "A TPM error (%d) occurred"
 165                                 " attempting to read PCR %d of %d\n",
 166                                 be32_to_cpu(*((__be32 *) (data + 6))), i, num_pcrs);
 167                         goto out;
 168                 }
 169                 str += sprintf(str, "PCR-%02d: ", i);
 170                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
 171                         str += sprintf(str, "%02X ", *(data + 10 + j));
 172                 str += sprintf(str, "\n");
 173         }
 174 out:
 175         return str - buf;
 176 }
 177 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
 178
 179 #define  READ_PUBEK_RESULT_SIZE 314
 180 static const u8 readpubek[] = {
 181         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 182         0, 0, 0, 30,            /* length */
 183         0, 0, 0, 124,           /* TPM_ORD_ReadPubek */
 184 };
 185
 186 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 187                        char *buf)
 188 {
 189         u8 *data;
 190         ssize_t len;
 191         int i, rc;
 192         char *str = buf;
 193
 194         struct tpm_chip *chip =
 195             pci_get_drvdata(to_pci_dev(dev));
 196         if (chip == NULL)
 197                 return -ENODEV;
 198
 199         data = kmalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
 200         if (!data)
 201                 return -ENOMEM;
 202
 203         memcpy(data, readpubek, sizeof(readpubek));
 204         memset(data + sizeof(readpubek), 0, 20);        /* zero nonce */
 205
 206         if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
 207             READ_PUBEK_RESULT_SIZE) {
 208                 dev_dbg(&chip->pci_dev->dev, "A TPM error (%d) occurred "
 209                                 "attempting to read the PUBEK\n",
 210                             be32_to_cpu(*((__be32 *) (data + 6))));
 211                 rc = 0;
 212                 goto out;
 213         }
 214
 215         /*
 216            ignore header 10 bytes
 217            algorithm 32 bits (1 == RSA )
 218            encscheme 16 bits
 219            sigscheme 16 bits
 220            parameters (RSA 12->bytes: keybit, #primes, expbit)
 221            keylenbytes 32 bits
 222            256 byte modulus
 223            ignore checksum 20 bytes
 224          */
 225
 226         str +=
 227             sprintf(str,
 228                     "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
 229                     "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
 230                     " %02X %02X %02X %02X %02X %02X %02X %02X\n"
 231                     "Modulus length: %d\nModulus: \n",
 232                     data[10], data[11], data[12], data[13], data[14],
 233                     data[15], data[16], data[17], data[22], data[23],
 234                     data[24], data[25], data[26], data[27], data[28],
 235                     data[29], data[30], data[31], data[32], data[33],
 236                     be32_to_cpu(*((__be32 *) (data + 34))));
 237
 238         for (i = 0; i < 256; i++) {
 239                 str += sprintf(str, "%02X ", data[i + 38]);
 240                 if ((i + 1) % 16 == 0)
 241                         str += sprintf(str, "\n");
 242         }
 243         rc = str - buf;
 244 out:
 245         kfree(data);
 246         return rc;
 247 }
 248
 249 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 250
 251 #define CAP_VER_RESULT_SIZE 18
 252 static const u8 cap_version[] = {
 253         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 254         0, 0, 0, 18,            /* length */
 255         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 256         0, 0, 0, 6,
 257         0, 0, 0, 0
 258 };
 259
 260 #define CAP_MANUFACTURER_RESULT_SIZE 18
 261 static const u8 cap_manufacturer[] = {
 262         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 263         0, 0, 0, 22,            /* length */
 264         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 265         0, 0, 0, 5,
 266         0, 0, 0, 4,
 267         0, 0, 1, 3
 268 };
 269
 270 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
 271                       char *buf)
 272 {
 273         u8 data[sizeof(cap_manufacturer)];
 274         ssize_t len;
 275         char *str = buf;
 276
 277         struct tpm_chip *chip =
 278             pci_get_drvdata(to_pci_dev(dev));
 279         if (chip == NULL)
 280                 return -ENODEV;
 281
 282         memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
 283
 284         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 285             CAP_MANUFACTURER_RESULT_SIZE)
 286                 return len;
 287
 288         str += sprintf(str, "Manufacturer: 0x%x\n",
 289                        be32_to_cpu(*((__be32 *) (data + 14))));
 290
 291         memcpy(data, cap_version, sizeof(cap_version));
 292
 293         if ((len = tpm_transmit(chip, data, sizeof(data))) <
 294             CAP_VER_RESULT_SIZE)
 295                 return len;
 296
 297         str +=
 298             sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
 299                     (int) data[14], (int) data[15], (int) data[16],
 300                     (int) data[17]);
 301
 302         return str - buf;
 303 }
 304 EXPORT_SYMBOL_GPL(tpm_show_caps);
 305
 306 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
 307                         const char *buf, size_t count)
 308 {
 309         struct tpm_chip *chip = dev_get_drvdata(dev);
 310         if (chip == NULL)
 311                 return 0;
 312
 313         chip->vendor->cancel(chip);
 314         return count;
 315 }
 316 EXPORT_SYMBOL_GPL(tpm_store_cancel);
 317
 318
 319 /*
 320  * Device file system interface to the TPM
 321  */
 322 int tpm_open(struct inode *inode, struct file *file)
 323 {
 324         int rc = 0, minor = iminor(inode);
 325         struct tpm_chip *chip = NULL, *pos;
 326
 327         spin_lock(&driver_lock);
 328
 329         list_for_each_entry(pos, &tpm_chip_list, list) {
 330                 if (pos->vendor->miscdev.minor == minor) {
 331                         chip = pos;
 332                         break;
 333                 }
 334         }
 335
 336         if (chip == NULL) {
 337                 rc = -ENODEV;
 338                 goto err_out;
 339         }
 340
 341         if (chip->num_opens) {
 342                 dev_dbg(&chip->pci_dev->dev,
 343                         "Another process owns this TPM\n");
 344                 rc = -EBUSY;
 345                 goto err_out;
 346         }
 347
 348         chip->num_opens++;
 349         pci_dev_get(chip->pci_dev);
 350
 351         spin_unlock(&driver_lock);
 352
 353         chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
 354         if (chip->data_buffer == NULL) {
 355                 chip->num_opens--;
 356                 pci_dev_put(chip->pci_dev);
 357                 return -ENOMEM;
 358         }
 359
 360         atomic_set(&chip->data_pending, 0);
 361
 362         file->private_data = chip;
 363         return 0;
 364
 365 err_out:
 366         spin_unlock(&driver_lock);
 367         return rc;
 368 }
 369
 370 EXPORT_SYMBOL_GPL(tpm_open);
 371
 372 int tpm_release(struct inode *inode, struct file *file)
 373 {
 374         struct tpm_chip *chip = file->private_data;
 375
 376         spin_lock(&driver_lock);
 377         file->private_data = NULL;
 378         chip->num_opens--;
 379         del_singleshot_timer_sync(&chip->user_read_timer);
 380         atomic_set(&chip->data_pending, 0);
 381         pci_dev_put(chip->pci_dev);
 382         kfree(chip->data_buffer);
 383         spin_unlock(&driver_lock);
 384         return 0;
 385 }
 386
 387 EXPORT_SYMBOL_GPL(tpm_release);
 388
 389 ssize_t tpm_write(struct file * file, const char __user * buf,
 390                   size_t size, loff_t * off)
 391 {
 392         struct tpm_chip *chip = file->private_data;
 393         int in_size = size, out_size;
 394
 395         /* cannot perform a write until the read has cleared
 396            either via tpm_read or a user_read_timer timeout */
 397         while (atomic_read(&chip->data_pending) != 0)
 398                 msleep(TPM_TIMEOUT);
 399
 400         down(&chip->buffer_mutex);
 401
 402         if (in_size > TPM_BUFSIZE)
 403                 in_size = TPM_BUFSIZE;
 404
 405         if (copy_from_user
 406             (chip->data_buffer, (void __user *) buf, in_size)) {
 407                 up(&chip->buffer_mutex);
 408                 return -EFAULT;
 409         }
 410
 411         /* atomic tpm command send and result receive */
 412         out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
 413
 414         atomic_set(&chip->data_pending, out_size);
 415         up(&chip->buffer_mutex);
 416
 417         /* Set a timeout by which the reader must come claim the result */
 418         mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
 419
 420         return in_size;
 421 }
 422
 423 EXPORT_SYMBOL_GPL(tpm_write);
 424
 425 ssize_t tpm_read(struct file * file, char __user * buf,
 426                  size_t size, loff_t * off)
 427 {
 428         struct tpm_chip *chip = file->private_data;
 429         int ret_size;
 430
 431         del_singleshot_timer_sync(&chip->user_read_timer);
 432         ret_size = atomic_read(&chip->data_pending);
 433         atomic_set(&chip->data_pending, 0);
 434         if (ret_size > 0) {     /* relay data */
 435                 if (size < ret_size)
 436                         ret_size = size;
 437
 438                 down(&chip->buffer_mutex);
 439                 if (copy_to_user
 440                     ((void __user *) buf, chip->data_buffer, ret_size))
 441                         ret_size = -EFAULT;
 442                 up(&chip->buffer_mutex);
 443         }
 444
 445         return ret_size;
 446 }
 447
 448 EXPORT_SYMBOL_GPL(tpm_read);
 449
 450 void __devexit tpm_remove(struct pci_dev *pci_dev)
 451 {
 452         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 453
 454         if (chip == NULL) {
 455                 dev_err(&pci_dev->dev, "No device data found\n");
 456                 return;
 457         }
 458
 459         spin_lock(&driver_lock);
 460
 461         list_del(&chip->list);
 462
 463         spin_unlock(&driver_lock);
 464
 465         pci_set_drvdata(pci_dev, NULL);
 466         misc_deregister(&chip->vendor->miscdev);
 467         kfree(&chip->vendor->miscdev.name);
 468
 469         sysfs_remove_group(&pci_dev->dev.kobj, chip->vendor->attr_group);
 470
 471         pci_disable_device(pci_dev);
 472
 473         dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
 474
 475         kfree(chip);
 476
 477         pci_dev_put(pci_dev);
 478 }
 479
 480 EXPORT_SYMBOL_GPL(tpm_remove);
 481
 482 static u8 savestate[] = {
 483         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 484         0, 0, 0, 10,            /* blob length (in bytes) */
 485         0, 0, 0, 152            /* TPM_ORD_SaveState */
 486 };
 487
 488 /*
 489  * We are about to suspend. Save the TPM state
 490  * so that it can be restored.
 491  */
 492 int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
 493 {
 494         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 495         if (chip == NULL)
 496                 return -ENODEV;
 497
 498         tpm_transmit(chip, savestate, sizeof(savestate));
 499         return 0;
 500 }
 501
 502 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 503
 504 /*
 505  * Resume from a power safe. The BIOS already restored
 506  * the TPM state.
 507  */
 508 int tpm_pm_resume(struct pci_dev *pci_dev)
 509 {
 510         struct tpm_chip *chip = pci_get_drvdata(pci_dev);
 511
 512         if (chip == NULL)
 513                 return -ENODEV;
 514
 515         return 0;
 516 }
 517
 518 EXPORT_SYMBOL_GPL(tpm_pm_resume);
 519
 520 /*
 521  * Called from tpm_<specific>.c probe function only for devices
 522  * the driver has determined it should claim.  Prior to calling
 523  * this function the specific probe function has called pci_enable_device
 524  * upon errant exit from this function specific probe function should call
 525  * pci_disable_device
 526  */
 527 int tpm_register_hardware(struct pci_dev *pci_dev,
 528                           struct tpm_vendor_specific *entry)
 529 {
 530 #define DEVNAME_SIZE 7
 531
 532         char *devname;
 533         struct tpm_chip *chip;
 534         int i, j;
 535
 536         /* Driver specific per-device data */
 537         chip = kmalloc(sizeof(*chip), GFP_KERNEL);
 538         if (chip == NULL)
 539                 return -ENOMEM;
 540
 541         memset(chip, 0, sizeof(struct tpm_chip));
 542
 543         init_MUTEX(&chip->buffer_mutex);
 544         init_MUTEX(&chip->tpm_mutex);
 545         INIT_LIST_HEAD(&chip->list);
 546
 547         init_timer(&chip->user_read_timer);
 548         chip->user_read_timer.function = user_reader_timeout;
 549         chip->user_read_timer.data = (unsigned long) chip;
 550
 551         chip->vendor = entry;
 552
 553         chip->dev_num = -1;
 554
 555         for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
 556                 for (j = 0; j < 8 * sizeof(int); j++)
 557                         if ((dev_mask[i] & (1 << j)) == 0) {
 558                                 chip->dev_num =
 559                                     i * TPM_NUM_MASK_ENTRIES + j;
 560                                 dev_mask[i] |= 1 << j;
 561                                 goto dev_num_search_complete;
 562                         }
 563
 564 dev_num_search_complete:
 565         if (chip->dev_num < 0) {
 566                 dev_err(&pci_dev->dev,
 567                         "No available tpm device numbers\n");
 568                 kfree(chip);
 569                 return -ENODEV;
 570         } else if (chip->dev_num == 0)
 571                 chip->vendor->miscdev.minor = TPM_MINOR;
 572         else
 573                 chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
 574
 575         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
 576         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
 577         chip->vendor->miscdev.name = devname;
 578
 579         chip->vendor->miscdev.dev = &(pci_dev->dev);
 580         chip->pci_dev = pci_dev_get(pci_dev);
 581
 582         if (misc_register(&chip->vendor->miscdev)) {
 583                 dev_err(&chip->pci_dev->dev,
 584                         "unable to misc_register %s, minor %d\n",
 585                         chip->vendor->miscdev.name,
 586                         chip->vendor->miscdev.minor);
 587                 pci_dev_put(pci_dev);
 588                 kfree(chip);
 589                 dev_mask[i] &= !(1 << j);
 590                 return -ENODEV;
 591         }
 592
 593         spin_lock(&driver_lock);
 594
 595         pci_set_drvdata(pci_dev, chip);
 596
 597         list_add(&chip->list, &tpm_chip_list);
 598
 599         spin_unlock(&driver_lock);
 600
 601         sysfs_create_group(&pci_dev->dev.kobj, chip->vendor->attr_group);
 602
 603         return 0;
 604 }
 605
 606 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 607
 608 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
 609 MODULE_DESCRIPTION("TPM Driver");
 610 MODULE_VERSION("2.0");
 611 MODULE_LICENSE("GPL");