2 * Copyright (C) 2004 IBM Corporation
5 * Leendert van Doorn <leendert@watson.ibm.com>
6 * Dave Safford <safford@watson.ibm.com>
7 * Reiner Sailer <sailer@watson.ibm.com>
8 * Kylene Hall <kjhall@us.ibm.com>
10 * Maintained by: <tpmdd_devel@lists.sourceforge.net>
12 * Device driver for TCG/TCPA TPM (trusted platform module).
13 * Specifications at www.trustedcomputinggroup.org
15 * This program is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU General Public License as
17 * published by the Free Software Foundation, version 2 of the
20 * Note, the TPM chip is not interrupt driven (only polling)
21 * and can have very long timeouts (minutes!). Hence the unusual
26 #include <linux/sched.h>
27 #include <linux/poll.h>
28 #include <linux/spinlock.h>
32 TPM_MINOR
= 224, /* officially assigned */
34 TPM_NUM_DEVICES
= 256,
35 TPM_NUM_MASK_ENTRIES
= TPM_NUM_DEVICES
/ (8 * sizeof(int))
38 static LIST_HEAD(tpm_chip_list
);
39 static DEFINE_SPINLOCK(driver_lock
);
40 static int dev_mask
[TPM_NUM_MASK_ENTRIES
];
42 static void user_reader_timeout(unsigned long ptr
)
44 struct tpm_chip
*chip
= (struct tpm_chip
*) ptr
;
46 schedule_work(&chip
->work
);
49 static void timeout_work(void *ptr
)
51 struct tpm_chip
*chip
= ptr
;
53 down(&chip
->buffer_mutex
);
54 atomic_set(&chip
->data_pending
, 0);
55 memset(chip
->data_buffer
, 0, TPM_BUFSIZE
);
56 up(&chip
->buffer_mutex
);
60 * Internal kernel interface to transmit TPM commands
62 static ssize_t
tpm_transmit(struct tpm_chip
*chip
, const char *buf
,
69 count
= be32_to_cpu(*((__be32
*) (buf
+ 2)));
75 "invalid count value %x %zx \n", count
, bufsiz
);
79 down(&chip
->tpm_mutex
);
81 if ((rc
= chip
->vendor
.send(chip
, (u8
*) buf
, count
)) < 0) {
83 "tpm_transmit: tpm_send: error %zd\n", rc
);
87 stop
= jiffies
+ 2 * 60 * HZ
;
89 u8 status
= chip
->vendor
.status(chip
);
90 if ((status
& chip
->vendor
.req_complete_mask
) ==
91 chip
->vendor
.req_complete_val
)
94 if ((status
== chip
->vendor
.req_canceled
)) {
95 dev_err(chip
->dev
, "Operation Canceled\n");
100 msleep(TPM_TIMEOUT
); /* CHECK */
102 } while (time_before(jiffies
, stop
));
104 chip
->vendor
.cancel(chip
);
105 dev_err(chip
->dev
, "Operation Timed out\n");
110 rc
= chip
->vendor
.recv(chip
, (u8
*) buf
, bufsiz
);
113 "tpm_transmit: tpm_recv: error %zd\n", rc
);
115 up(&chip
->tpm_mutex
);
119 #define TPM_DIGEST_SIZE 20
120 #define TPM_ERROR_SIZE 10
121 #define TPM_RET_CODE_IDX 6
122 #define TPM_GET_CAP_RET_SIZE_IDX 10
123 #define TPM_GET_CAP_RET_UINT32_1_IDX 14
124 #define TPM_GET_CAP_RET_UINT32_2_IDX 18
125 #define TPM_GET_CAP_RET_UINT32_3_IDX 22
126 #define TPM_GET_CAP_RET_UINT32_4_IDX 26
128 #define TPM_CAP_IDX 13
129 #define TPM_CAP_SUBCAP_IDX 21
131 enum tpm_capabilities
{
135 enum tpm_sub_capabilities
{
136 TPM_CAP_PROP_PCR
= 0x1,
137 TPM_CAP_PROP_MANUFACTURER
= 0x3,
141 * This is a semi generic GetCapability command for use
142 * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
143 * and their associated sub_capabilities.
146 static const u8 tpm_cap
[] = {
147 0, 193, /* TPM_TAG_RQU_COMMAND */
148 0, 0, 0, 22, /* length */
149 0, 0, 0, 101, /* TPM_ORD_GetCapability */
150 0, 0, 0, 0, /* TPM_CAP_<TYPE> */
151 0, 0, 0, 4, /* TPM_CAP_SUB_<TYPE> size */
152 0, 0, 1, 0 /* TPM_CAP_SUB_<TYPE> */
155 static ssize_t
transmit_cmd(struct tpm_chip
*chip
, u8
*data
, int len
,
160 len
= tpm_transmit(chip
, data
, len
);
163 if (len
== TPM_ERROR_SIZE
) {
164 err
= be32_to_cpu(*((__be32
*) (data
+ TPM_RET_CODE_IDX
)));
165 dev_dbg(chip
->dev
, "A TPM error (%d) occurred %s\n", err
, desc
);
171 static const u8 pcrread
[] = {
172 0, 193, /* TPM_TAG_RQU_COMMAND */
173 0, 0, 0, 14, /* length */
174 0, 0, 0, 21, /* TPM_ORD_PcrRead */
175 0, 0, 0, 0 /* PCR index */
178 ssize_t
tpm_show_pcrs(struct device
*dev
, struct device_attribute
*attr
,
187 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
191 memcpy(data
, tpm_cap
, sizeof(tpm_cap
));
192 data
[TPM_CAP_IDX
] = TPM_CAP_PROP
;
193 data
[TPM_CAP_SUBCAP_IDX
] = TPM_CAP_PROP_PCR
;
195 rc
= transmit_cmd(chip
, data
, sizeof(data
),
196 "attempting to determine the number of PCRS");
200 num_pcrs
= be32_to_cpu(*((__be32
*) (data
+ 14)));
201 for (i
= 0; i
< num_pcrs
; i
++) {
202 memcpy(data
, pcrread
, sizeof(pcrread
));
203 index
= cpu_to_be32(i
);
204 memcpy(data
+ 10, &index
, 4);
205 rc
= transmit_cmd(chip
, data
, sizeof(data
),
206 "attempting to read a PCR");
209 str
+= sprintf(str
, "PCR-%02d: ", i
);
210 for (j
= 0; j
< TPM_DIGEST_SIZE
; j
++)
211 str
+= sprintf(str
, "%02X ", *(data
+ 10 + j
));
212 str
+= sprintf(str
, "\n");
217 EXPORT_SYMBOL_GPL(tpm_show_pcrs
);
219 #define READ_PUBEK_RESULT_SIZE 314
220 static const u8 readpubek
[] = {
221 0, 193, /* TPM_TAG_RQU_COMMAND */
222 0, 0, 0, 30, /* length */
223 0, 0, 0, 124, /* TPM_ORD_ReadPubek */
226 ssize_t
tpm_show_pubek(struct device
*dev
, struct device_attribute
*attr
,
234 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
238 data
= kzalloc(READ_PUBEK_RESULT_SIZE
, GFP_KERNEL
);
242 memcpy(data
, readpubek
, sizeof(readpubek
));
244 err
= transmit_cmd(chip
, data
, READ_PUBEK_RESULT_SIZE
,
245 "attempting to read the PUBEK");
250 ignore header 10 bytes
251 algorithm 32 bits (1 == RSA )
254 parameters (RSA 12->bytes: keybit, #primes, expbit)
257 ignore checksum 20 bytes
262 "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
263 "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
264 " %02X %02X %02X %02X %02X %02X %02X %02X\n"
265 "Modulus length: %d\nModulus: \n",
266 data
[10], data
[11], data
[12], data
[13], data
[14],
267 data
[15], data
[16], data
[17], data
[22], data
[23],
268 data
[24], data
[25], data
[26], data
[27], data
[28],
269 data
[29], data
[30], data
[31], data
[32], data
[33],
270 be32_to_cpu(*((__be32
*) (data
+ 34))));
272 for (i
= 0; i
< 256; i
++) {
273 str
+= sprintf(str
, "%02X ", data
[i
+ 38]);
274 if ((i
+ 1) % 16 == 0)
275 str
+= sprintf(str
, "\n");
282 EXPORT_SYMBOL_GPL(tpm_show_pubek
);
284 #define CAP_VERSION_1_1 6
285 #define CAP_VERSION_IDX 13
286 static const u8 cap_version
[] = {
287 0, 193, /* TPM_TAG_RQU_COMMAND */
288 0, 0, 0, 18, /* length */
289 0, 0, 0, 101, /* TPM_ORD_GetCapability */
294 ssize_t
tpm_show_caps(struct device
*dev
, struct device_attribute
*attr
,
301 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
305 memcpy(data
, tpm_cap
, sizeof(tpm_cap
));
306 data
[TPM_CAP_IDX
] = TPM_CAP_PROP
;
307 data
[TPM_CAP_SUBCAP_IDX
] = TPM_CAP_PROP_MANUFACTURER
;
309 rc
= transmit_cmd(chip
, data
, sizeof(data
),
310 "attempting to determine the manufacturer");
314 str
+= sprintf(str
, "Manufacturer: 0x%x\n",
315 be32_to_cpu(*((__be32
*) (data
+ TPM_GET_CAP_RET_UINT32_1_IDX
))));
317 memcpy(data
, cap_version
, sizeof(cap_version
));
318 data
[CAP_VERSION_IDX
] = CAP_VERSION_1_1
;
319 rc
= transmit_cmd(chip
, data
, sizeof(data
),
320 "attempting to determine the 1.1 version");
325 "TCG version: %d.%d\nFirmware version: %d.%d\n",
326 (int) data
[14], (int) data
[15], (int) data
[16],
332 EXPORT_SYMBOL_GPL(tpm_show_caps
);
334 ssize_t
tpm_store_cancel(struct device
*dev
, struct device_attribute
*attr
,
335 const char *buf
, size_t count
)
337 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
341 chip
->vendor
.cancel(chip
);
344 EXPORT_SYMBOL_GPL(tpm_store_cancel
);
347 * Device file system interface to the TPM
349 int tpm_open(struct inode
*inode
, struct file
*file
)
351 int rc
= 0, minor
= iminor(inode
);
352 struct tpm_chip
*chip
= NULL
, *pos
;
354 spin_lock(&driver_lock
);
356 list_for_each_entry(pos
, &tpm_chip_list
, list
) {
357 if (pos
->vendor
.miscdev
.minor
== minor
) {
368 if (chip
->num_opens
) {
369 dev_dbg(chip
->dev
, "Another process owns this TPM\n");
375 get_device(chip
->dev
);
377 spin_unlock(&driver_lock
);
379 chip
->data_buffer
= kmalloc(TPM_BUFSIZE
* sizeof(u8
), GFP_KERNEL
);
380 if (chip
->data_buffer
== NULL
) {
382 put_device(chip
->dev
);
386 atomic_set(&chip
->data_pending
, 0);
388 file
->private_data
= chip
;
392 spin_unlock(&driver_lock
);
395 EXPORT_SYMBOL_GPL(tpm_open
);
397 int tpm_release(struct inode
*inode
, struct file
*file
)
399 struct tpm_chip
*chip
= file
->private_data
;
401 spin_lock(&driver_lock
);
402 file
->private_data
= NULL
;
404 del_singleshot_timer_sync(&chip
->user_read_timer
);
405 flush_scheduled_work();
406 atomic_set(&chip
->data_pending
, 0);
407 put_device(chip
->dev
);
408 kfree(chip
->data_buffer
);
409 spin_unlock(&driver_lock
);
412 EXPORT_SYMBOL_GPL(tpm_release
);
414 ssize_t
tpm_write(struct file
*file
, const char __user
*buf
,
415 size_t size
, loff_t
*off
)
417 struct tpm_chip
*chip
= file
->private_data
;
418 int in_size
= size
, out_size
;
420 /* cannot perform a write until the read has cleared
421 either via tpm_read or a user_read_timer timeout */
422 while (atomic_read(&chip
->data_pending
) != 0)
425 down(&chip
->buffer_mutex
);
427 if (in_size
> TPM_BUFSIZE
)
428 in_size
= TPM_BUFSIZE
;
431 (chip
->data_buffer
, (void __user
*) buf
, in_size
)) {
432 up(&chip
->buffer_mutex
);
436 /* atomic tpm command send and result receive */
437 out_size
= tpm_transmit(chip
, chip
->data_buffer
, TPM_BUFSIZE
);
439 atomic_set(&chip
->data_pending
, out_size
);
440 up(&chip
->buffer_mutex
);
442 /* Set a timeout by which the reader must come claim the result */
443 mod_timer(&chip
->user_read_timer
, jiffies
+ (60 * HZ
));
447 EXPORT_SYMBOL_GPL(tpm_write
);
449 ssize_t
tpm_read(struct file
*file
, char __user
*buf
,
450 size_t size
, loff_t
*off
)
452 struct tpm_chip
*chip
= file
->private_data
;
455 del_singleshot_timer_sync(&chip
->user_read_timer
);
456 flush_scheduled_work();
457 ret_size
= atomic_read(&chip
->data_pending
);
458 atomic_set(&chip
->data_pending
, 0);
459 if (ret_size
> 0) { /* relay data */
463 down(&chip
->buffer_mutex
);
464 if (copy_to_user(buf
, chip
->data_buffer
, ret_size
))
466 up(&chip
->buffer_mutex
);
471 EXPORT_SYMBOL_GPL(tpm_read
);
473 void tpm_remove_hardware(struct device
*dev
)
475 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
478 dev_err(dev
, "No device data found\n");
482 spin_lock(&driver_lock
);
484 list_del(&chip
->list
);
486 spin_unlock(&driver_lock
);
488 dev_set_drvdata(dev
, NULL
);
489 misc_deregister(&chip
->vendor
.miscdev
);
490 kfree(chip
->vendor
.miscdev
.name
);
492 sysfs_remove_group(&dev
->kobj
, chip
->vendor
.attr_group
);
493 tpm_bios_log_teardown(chip
->bios_dir
);
495 dev_mask
[chip
->dev_num
/ TPM_NUM_MASK_ENTRIES
] &=
496 ~(1 << (chip
->dev_num
% TPM_NUM_MASK_ENTRIES
));
502 EXPORT_SYMBOL_GPL(tpm_remove_hardware
);
504 static u8 savestate
[] = {
505 0, 193, /* TPM_TAG_RQU_COMMAND */
506 0, 0, 0, 10, /* blob length (in bytes) */
507 0, 0, 0, 152 /* TPM_ORD_SaveState */
511 * We are about to suspend. Save the TPM state
512 * so that it can be restored.
514 int tpm_pm_suspend(struct device
*dev
, pm_message_t pm_state
)
516 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
520 tpm_transmit(chip
, savestate
, sizeof(savestate
));
523 EXPORT_SYMBOL_GPL(tpm_pm_suspend
);
526 * Resume from a power safe. The BIOS already restored
529 int tpm_pm_resume(struct device
*dev
)
531 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
538 EXPORT_SYMBOL_GPL(tpm_pm_resume
);
541 * Called from tpm_<specific>.c probe function only for devices
542 * the driver has determined it should claim. Prior to calling
543 * this function the specific probe function has called pci_enable_device
544 * upon errant exit from this function specific probe function should call
547 struct tpm_chip
*tpm_register_hardware(struct device
*dev
, const struct tpm_vendor_specific
550 #define DEVNAME_SIZE 7
553 struct tpm_chip
*chip
;
556 /* Driver specific per-device data */
557 chip
= kzalloc(sizeof(*chip
), GFP_KERNEL
);
561 init_MUTEX(&chip
->buffer_mutex
);
562 init_MUTEX(&chip
->tpm_mutex
);
563 INIT_LIST_HEAD(&chip
->list
);
565 INIT_WORK(&chip
->work
, timeout_work
, chip
);
567 init_timer(&chip
->user_read_timer
);
568 chip
->user_read_timer
.function
= user_reader_timeout
;
569 chip
->user_read_timer
.data
= (unsigned long) chip
;
571 memcpy(&chip
->vendor
, entry
, sizeof(struct tpm_vendor_specific
));
575 for (i
= 0; i
< TPM_NUM_MASK_ENTRIES
; i
++)
576 for (j
= 0; j
< 8 * sizeof(int); j
++)
577 if ((dev_mask
[i
] & (1 << j
)) == 0) {
579 i
* TPM_NUM_MASK_ENTRIES
+ j
;
580 dev_mask
[i
] |= 1 << j
;
581 goto dev_num_search_complete
;
584 dev_num_search_complete
:
585 if (chip
->dev_num
< 0) {
586 dev_err(dev
, "No available tpm device numbers\n");
589 } else if (chip
->dev_num
== 0)
590 chip
->vendor
.miscdev
.minor
= TPM_MINOR
;
592 chip
->vendor
.miscdev
.minor
= MISC_DYNAMIC_MINOR
;
594 devname
= kmalloc(DEVNAME_SIZE
, GFP_KERNEL
);
595 scnprintf(devname
, DEVNAME_SIZE
, "%s%d", "tpm", chip
->dev_num
);
596 chip
->vendor
.miscdev
.name
= devname
;
598 chip
->vendor
.miscdev
.dev
= dev
;
599 chip
->dev
= get_device(dev
);
601 if (misc_register(&chip
->vendor
.miscdev
)) {
603 "unable to misc_register %s, minor %d\n",
604 chip
->vendor
.miscdev
.name
,
605 chip
->vendor
.miscdev
.minor
);
608 dev_mask
[i
] &= !(1 << j
);
612 spin_lock(&driver_lock
);
614 dev_set_drvdata(dev
, chip
);
616 list_add(&chip
->list
, &tpm_chip_list
);
618 spin_unlock(&driver_lock
);
620 sysfs_create_group(&dev
->kobj
, chip
->vendor
.attr_group
);
622 chip
->bios_dir
= tpm_bios_log_setup(devname
);
626 EXPORT_SYMBOL_GPL(tpm_register_hardware
);
628 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
629 MODULE_DESCRIPTION("TPM Driver");
630 MODULE_VERSION("2.0");
631 MODULE_LICENSE("GPL");