drivers/char/tpm/tpm.c

   1 /*
   2  * Copyright (C) 2004 IBM Corporation
   3  *
   4  * Authors:
   5  * Leendert van Doorn <leendert@watson.ibm.com>
   6  * Dave Safford <safford@watson.ibm.com>
   7  * Reiner Sailer <sailer@watson.ibm.com>
   8  * Kylene Hall <kjhall@us.ibm.com>
   9  *
  10  * Maintained by: <tpmdd_devel@lists.sourceforge.net>
  11  *
  12  * Device driver for TCG/TCPA TPM (trusted platform module).
  13  * Specifications at www.trustedcomputinggroup.org
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License as
  17  * published by the Free Software Foundation, version 2 of the
  18  * License.
  19  *
  20  * Note, the TPM chip is not interrupt driven (only polling)
  21  * and can have very long timeouts (minutes!). Hence the unusual
  22  * calls to msleep.
  23  *
  24  */
  25
  26 #include <linux/sched.h>
  27 #include <linux/poll.h>
  28 #include <linux/spinlock.h>
  29 #include "tpm.h"
  30
  31 enum tpm_const {
  32         TPM_MINOR = 224,        /* officially assigned */
  33         TPM_BUFSIZE = 2048,
  34         TPM_NUM_DEVICES = 256,
  35         TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
  36 };
  37
  38 static LIST_HEAD(tpm_chip_list);
  39 static DEFINE_SPINLOCK(driver_lock);
  40 static int dev_mask[TPM_NUM_MASK_ENTRIES];
  41
  42 static void user_reader_timeout(unsigned long ptr)
  43 {
  44         struct tpm_chip *chip = (struct tpm_chip *) ptr;
  45
  46         schedule_work(&chip->work);
  47 }
  48
  49 static void timeout_work(void *ptr)
  50 {
  51         struct tpm_chip *chip = ptr;
  52
  53         down(&chip->buffer_mutex);
  54         atomic_set(&chip->data_pending, 0);
  55         memset(chip->data_buffer, 0, TPM_BUFSIZE);
  56         up(&chip->buffer_mutex);
  57 }
  58
  59 /*
  60  * Internal kernel interface to transmit TPM commands
  61  */
  62 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
  63                             size_t bufsiz)
  64 {
  65         ssize_t rc;
  66         u32 count;
  67         unsigned long stop;
  68
  69         count = be32_to_cpu(*((__be32 *) (buf + 2)));
  70
  71         if (count == 0)
  72                 return -ENODATA;
  73         if (count > bufsiz) {
  74                 dev_err(chip->dev,
  75                         "invalid count value %x %zx \n", count, bufsiz);
  76                 return -E2BIG;
  77         }
  78
  79         down(&chip->tpm_mutex);
  80
  81         if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
  82                 dev_err(chip->dev,
  83                         "tpm_transmit: tpm_send: error %zd\n", rc);
  84                 goto out;
  85         }
  86
  87         stop = jiffies + 2 * 60 * HZ;
  88         do {
  89                 u8 status = chip->vendor.status(chip);
  90                 if ((status & chip->vendor.req_complete_mask) ==
  91                     chip->vendor.req_complete_val)
  92                         goto out_recv;
  93
  94                 if ((status == chip->vendor.req_canceled)) {
  95                         dev_err(chip->dev, "Operation Canceled\n");
  96                         rc = -ECANCELED;
  97                         goto out;
  98                 }
  99
 100                 msleep(TPM_TIMEOUT);    /* CHECK */
 101                 rmb();
 102         } while (time_before(jiffies, stop));
 103
 104         chip->vendor.cancel(chip);
 105         dev_err(chip->dev, "Operation Timed out\n");
 106         rc = -ETIME;
 107         goto out;
 108
 109 out_recv:
 110         rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
 111         if (rc < 0)
 112                 dev_err(chip->dev,
 113                         "tpm_transmit: tpm_recv: error %zd\n", rc);
 114 out:
 115         up(&chip->tpm_mutex);
 116         return rc;
 117 }
 118
 119 #define TPM_DIGEST_SIZE 20
 120 #define TPM_ERROR_SIZE 10
 121 #define TPM_RET_CODE_IDX 6
 122 #define TPM_GET_CAP_RET_SIZE_IDX 10
 123 #define TPM_GET_CAP_RET_UINT32_1_IDX 14
 124 #define TPM_GET_CAP_RET_UINT32_2_IDX 18
 125 #define TPM_GET_CAP_RET_UINT32_3_IDX 22
 126 #define TPM_GET_CAP_RET_UINT32_4_IDX 26
 127
 128 #define TPM_CAP_IDX 13
 129 #define TPM_CAP_SUBCAP_IDX 21
 130
 131 enum tpm_capabilities {
 132         TPM_CAP_PROP = 5,
 133 };
 134
 135 enum tpm_sub_capabilities {
 136         TPM_CAP_PROP_PCR = 0x1,
 137         TPM_CAP_PROP_MANUFACTURER = 0x3,
 138 };
 139
 140 /*
 141  * This is a semi generic GetCapability command for use
 142  * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
 143  * and their associated sub_capabilities.
 144  */
 145
 146 static const u8 tpm_cap[] = {
 147         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 148         0, 0, 0, 22,            /* length */
 149         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 150         0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
 151         0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
 152         0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 153 };
 154
 155 static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
 156                             char *desc)
 157 {
 158         int err;
 159
 160         len = tpm_transmit(chip, data, len);
 161         if (len <  0)
 162                 return len;
 163         if (len == TPM_ERROR_SIZE) {
 164                 err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
 165                 dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
 166                 return err;
 167         }
 168         return 0;
 169 }
 170
 171 static const u8 pcrread[] = {
 172         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 173         0, 0, 0, 14,            /* length */
 174         0, 0, 0, 21,            /* TPM_ORD_PcrRead */
 175         0, 0, 0, 0              /* PCR index */
 176 };
 177
 178 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 179                       char *buf)
 180 {
 181         u8 data[30];
 182         ssize_t rc;
 183         int i, j, num_pcrs;
 184         __be32 index;
 185         char *str = buf;
 186
 187         struct tpm_chip *chip = dev_get_drvdata(dev);
 188         if (chip == NULL)
 189                 return -ENODEV;
 190
 191         memcpy(data, tpm_cap, sizeof(tpm_cap));
 192         data[TPM_CAP_IDX] = TPM_CAP_PROP;
 193         data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
 194
 195         rc = transmit_cmd(chip, data, sizeof(data),
 196                         "attempting to determine the number of PCRS");
 197         if (rc)
 198                 return 0;
 199
 200         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
 201         for (i = 0; i < num_pcrs; i++) {
 202                 memcpy(data, pcrread, sizeof(pcrread));
 203                 index = cpu_to_be32(i);
 204                 memcpy(data + 10, &index, 4);
 205                 rc = transmit_cmd(chip, data, sizeof(data),
 206                                 "attempting to read a PCR");
 207                 if (rc)
 208                         goto out;
 209                 str += sprintf(str, "PCR-%02d: ", i);
 210                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
 211                         str += sprintf(str, "%02X ", *(data + 10 + j));
 212                 str += sprintf(str, "\n");
 213         }
 214 out:
 215         return str - buf;
 216 }
 217 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
 218
 219 #define  READ_PUBEK_RESULT_SIZE 314
 220 static const u8 readpubek[] = {
 221         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 222         0, 0, 0, 30,            /* length */
 223         0, 0, 0, 124,           /* TPM_ORD_ReadPubek */
 224 };
 225
 226 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 227                        char *buf)
 228 {
 229         u8 *data;
 230         ssize_t err;
 231         int i, rc;
 232         char *str = buf;
 233
 234         struct tpm_chip *chip = dev_get_drvdata(dev);
 235         if (chip == NULL)
 236                 return -ENODEV;
 237
 238         data = kzalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
 239         if (!data)
 240                 return -ENOMEM;
 241
 242         memcpy(data, readpubek, sizeof(readpubek));
 243
 244         err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
 245                         "attempting to read the PUBEK");
 246         if (err)
 247                 goto out;
 248
 249         /*
 250            ignore header 10 bytes
 251            algorithm 32 bits (1 == RSA )
 252            encscheme 16 bits
 253            sigscheme 16 bits
 254            parameters (RSA 12->bytes: keybit, #primes, expbit)
 255            keylenbytes 32 bits
 256            256 byte modulus
 257            ignore checksum 20 bytes
 258          */
 259
 260         str +=
 261             sprintf(str,
 262                     "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
 263                     "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
 264                     " %02X %02X %02X %02X %02X %02X %02X %02X\n"
 265                     "Modulus length: %d\nModulus: \n",
 266                     data[10], data[11], data[12], data[13], data[14],
 267                     data[15], data[16], data[17], data[22], data[23],
 268                     data[24], data[25], data[26], data[27], data[28],
 269                     data[29], data[30], data[31], data[32], data[33],
 270                     be32_to_cpu(*((__be32 *) (data + 34))));
 271
 272         for (i = 0; i < 256; i++) {
 273                 str += sprintf(str, "%02X ", data[i + 38]);
 274                 if ((i + 1) % 16 == 0)
 275                         str += sprintf(str, "\n");
 276         }
 277 out:
 278         rc = str - buf;
 279         kfree(data);
 280         return rc;
 281 }
 282 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 283
 284 #define CAP_VERSION_1_1 6
 285 #define CAP_VERSION_IDX 13
 286 static const u8 cap_version[] = {
 287         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 288         0, 0, 0, 18,            /* length */
 289         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
 290         0, 0, 0, 0,
 291         0, 0, 0, 0
 292 };
 293
 294 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
 295                       char *buf)
 296 {
 297         u8 data[30];
 298         ssize_t rc;
 299         char *str = buf;
 300
 301         struct tpm_chip *chip = dev_get_drvdata(dev);
 302         if (chip == NULL)
 303                 return -ENODEV;
 304
 305         memcpy(data, tpm_cap, sizeof(tpm_cap));
 306         data[TPM_CAP_IDX] = TPM_CAP_PROP;
 307         data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 308
 309         rc = transmit_cmd(chip, data, sizeof(data),
 310                         "attempting to determine the manufacturer");
 311         if (rc)
 312                 return 0;
 313
 314         str += sprintf(str, "Manufacturer: 0x%x\n",
 315                        be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 316
 317         memcpy(data, cap_version, sizeof(cap_version));
 318         data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
 319         rc = transmit_cmd(chip, data, sizeof(data),
 320                         "attempting to determine the 1.1 version");
 321         if (rc)
 322                 goto out;
 323
 324         str += sprintf(str,
 325                        "TCG version: %d.%d\nFirmware version: %d.%d\n",
 326                        (int) data[14], (int) data[15], (int) data[16],
 327                        (int) data[17]);
 328
 329 out:
 330         return str - buf;
 331 }
 332 EXPORT_SYMBOL_GPL(tpm_show_caps);
 333
 334 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
 335                         const char *buf, size_t count)
 336 {
 337         struct tpm_chip *chip = dev_get_drvdata(dev);
 338         if (chip == NULL)
 339                 return 0;
 340
 341         chip->vendor.cancel(chip);
 342         return count;
 343 }
 344 EXPORT_SYMBOL_GPL(tpm_store_cancel);
 345
 346 /*
 347  * Device file system interface to the TPM
 348  */
 349 int tpm_open(struct inode *inode, struct file *file)
 350 {
 351         int rc = 0, minor = iminor(inode);
 352         struct tpm_chip *chip = NULL, *pos;
 353
 354         spin_lock(&driver_lock);
 355
 356         list_for_each_entry(pos, &tpm_chip_list, list) {
 357                 if (pos->vendor.miscdev.minor == minor) {
 358                         chip = pos;
 359                         break;
 360                 }
 361         }
 362
 363         if (chip == NULL) {
 364                 rc = -ENODEV;
 365                 goto err_out;
 366         }
 367
 368         if (chip->num_opens) {
 369                 dev_dbg(chip->dev, "Another process owns this TPM\n");
 370                 rc = -EBUSY;
 371                 goto err_out;
 372         }
 373
 374         chip->num_opens++;
 375         get_device(chip->dev);
 376
 377         spin_unlock(&driver_lock);
 378
 379         chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
 380         if (chip->data_buffer == NULL) {
 381                 chip->num_opens--;
 382                 put_device(chip->dev);
 383                 return -ENOMEM;
 384         }
 385
 386         atomic_set(&chip->data_pending, 0);
 387
 388         file->private_data = chip;
 389         return 0;
 390
 391 err_out:
 392         spin_unlock(&driver_lock);
 393         return rc;
 394 }
 395 EXPORT_SYMBOL_GPL(tpm_open);
 396
 397 int tpm_release(struct inode *inode, struct file *file)
 398 {
 399         struct tpm_chip *chip = file->private_data;
 400
 401         spin_lock(&driver_lock);
 402         file->private_data = NULL;
 403         chip->num_opens--;
 404         del_singleshot_timer_sync(&chip->user_read_timer);
 405         flush_scheduled_work();
 406         atomic_set(&chip->data_pending, 0);
 407         put_device(chip->dev);
 408         kfree(chip->data_buffer);
 409         spin_unlock(&driver_lock);
 410         return 0;
 411 }
 412 EXPORT_SYMBOL_GPL(tpm_release);
 413
 414 ssize_t tpm_write(struct file *file, const char __user *buf,
 415                   size_t size, loff_t *off)
 416 {
 417         struct tpm_chip *chip = file->private_data;
 418         int in_size = size, out_size;
 419
 420         /* cannot perform a write until the read has cleared
 421            either via tpm_read or a user_read_timer timeout */
 422         while (atomic_read(&chip->data_pending) != 0)
 423                 msleep(TPM_TIMEOUT);
 424
 425         down(&chip->buffer_mutex);
 426
 427         if (in_size > TPM_BUFSIZE)
 428                 in_size = TPM_BUFSIZE;
 429
 430         if (copy_from_user
 431             (chip->data_buffer, (void __user *) buf, in_size)) {
 432                 up(&chip->buffer_mutex);
 433                 return -EFAULT;
 434         }
 435
 436         /* atomic tpm command send and result receive */
 437         out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
 438
 439         atomic_set(&chip->data_pending, out_size);
 440         up(&chip->buffer_mutex);
 441
 442         /* Set a timeout by which the reader must come claim the result */
 443         mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
 444
 445         return in_size;
 446 }
 447 EXPORT_SYMBOL_GPL(tpm_write);
 448
 449 ssize_t tpm_read(struct file *file, char __user *buf,
 450                  size_t size, loff_t *off)
 451 {
 452         struct tpm_chip *chip = file->private_data;
 453         int ret_size;
 454
 455         del_singleshot_timer_sync(&chip->user_read_timer);
 456         flush_scheduled_work();
 457         ret_size = atomic_read(&chip->data_pending);
 458         atomic_set(&chip->data_pending, 0);
 459         if (ret_size > 0) {     /* relay data */
 460                 if (size < ret_size)
 461                         ret_size = size;
 462
 463                 down(&chip->buffer_mutex);
 464                 if (copy_to_user(buf, chip->data_buffer, ret_size))
 465                         ret_size = -EFAULT;
 466                 up(&chip->buffer_mutex);
 467         }
 468
 469         return ret_size;
 470 }
 471 EXPORT_SYMBOL_GPL(tpm_read);
 472
 473 void tpm_remove_hardware(struct device *dev)
 474 {
 475         struct tpm_chip *chip = dev_get_drvdata(dev);
 476
 477         if (chip == NULL) {
 478                 dev_err(dev, "No device data found\n");
 479                 return;
 480         }
 481
 482         spin_lock(&driver_lock);
 483
 484         list_del(&chip->list);
 485
 486         spin_unlock(&driver_lock);
 487
 488         dev_set_drvdata(dev, NULL);
 489         misc_deregister(&chip->vendor.miscdev);
 490         kfree(chip->vendor.miscdev.name);
 491
 492         sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
 493         tpm_bios_log_teardown(chip->bios_dir);
 494
 495         dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES] &=
 496             ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
 497
 498         kfree(chip);
 499
 500         put_device(dev);
 501 }
 502 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 503
 504 static u8 savestate[] = {
 505         0, 193,                 /* TPM_TAG_RQU_COMMAND */
 506         0, 0, 0, 10,            /* blob length (in bytes) */
 507         0, 0, 0, 152            /* TPM_ORD_SaveState */
 508 };
 509
 510 /*
 511  * We are about to suspend. Save the TPM state
 512  * so that it can be restored.
 513  */
 514 int tpm_pm_suspend(struct device *dev, pm_message_t pm_state)
 515 {
 516         struct tpm_chip *chip = dev_get_drvdata(dev);
 517         if (chip == NULL)
 518                 return -ENODEV;
 519
 520         tpm_transmit(chip, savestate, sizeof(savestate));
 521         return 0;
 522 }
 523 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 524
 525 /*
 526  * Resume from a power safe. The BIOS already restored
 527  * the TPM state.
 528  */
 529 int tpm_pm_resume(struct device *dev)
 530 {
 531         struct tpm_chip *chip = dev_get_drvdata(dev);
 532
 533         if (chip == NULL)
 534                 return -ENODEV;
 535
 536         return 0;
 537 }
 538 EXPORT_SYMBOL_GPL(tpm_pm_resume);
 539
 540 /*
 541  * Called from tpm_<specific>.c probe function only for devices
 542  * the driver has determined it should claim.  Prior to calling
 543  * this function the specific probe function has called pci_enable_device
 544  * upon errant exit from this function specific probe function should call
 545  * pci_disable_device
 546  */
 547 int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
 548 {
 549 #define DEVNAME_SIZE 7
 550
 551         char *devname;
 552         struct tpm_chip *chip;
 553         int i, j;
 554
 555         /* Driver specific per-device data */
 556         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
 557         if (chip == NULL)
 558                 return -ENOMEM;
 559
 560         init_MUTEX(&chip->buffer_mutex);
 561         init_MUTEX(&chip->tpm_mutex);
 562         INIT_LIST_HEAD(&chip->list);
 563
 564         INIT_WORK(&chip->work, timeout_work, chip);
 565
 566         init_timer(&chip->user_read_timer);
 567         chip->user_read_timer.function = user_reader_timeout;
 568         chip->user_read_timer.data = (unsigned long) chip;
 569
 570         memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 571
 572         chip->dev_num = -1;
 573
 574         for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
 575                 for (j = 0; j < 8 * sizeof(int); j++)
 576                         if ((dev_mask[i] & (1 << j)) == 0) {
 577                                 chip->dev_num =
 578                                     i * TPM_NUM_MASK_ENTRIES + j;
 579                                 dev_mask[i] |= 1 << j;
 580                                 goto dev_num_search_complete;
 581                         }
 582
 583 dev_num_search_complete:
 584         if (chip->dev_num < 0) {
 585                 dev_err(dev, "No available tpm device numbers\n");
 586                 kfree(chip);
 587                 return -ENODEV;
 588         } else if (chip->dev_num == 0)
 589                 chip->vendor.miscdev.minor = TPM_MINOR;
 590         else
 591                 chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
 592
 593         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
 594         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
 595         chip->vendor.miscdev.name = devname;
 596
 597         chip->vendor.miscdev.dev = dev;
 598         chip->dev = get_device(dev);
 599
 600         if (misc_register(&chip->vendor.miscdev)) {
 601                 dev_err(chip->dev,
 602                         "unable to misc_register %s, minor %d\n",
 603                         chip->vendor.miscdev.name,
 604                         chip->vendor.miscdev.minor);
 605                 put_device(dev);
 606                 kfree(chip);
 607                 dev_mask[i] &= !(1 << j);
 608                 return -ENODEV;
 609         }
 610
 611         spin_lock(&driver_lock);
 612
 613         dev_set_drvdata(dev, chip);
 614
 615         list_add(&chip->list, &tpm_chip_list);
 616
 617         spin_unlock(&driver_lock);
 618
 619         sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 620
 621         chip->bios_dir = tpm_bios_log_setup(devname);
 622
 623         return 0;
 624 }
 625 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 626
 627 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
 628 MODULE_DESCRIPTION("TPM Driver");
 629 MODULE_VERSION("2.0");
 630 MODULE_LICENSE("GPL");