2 * Copyright (C) 2004 IBM Corporation
5 * Leendert van Doorn <leendert@watson.ibm.com>
6 * Dave Safford <safford@watson.ibm.com>
7 * Reiner Sailer <sailer@watson.ibm.com>
8 * Kylene Hall <kjhall@us.ibm.com>
10 * Maintained by: <tpmdd_devel@lists.sourceforge.net>
12 * Device driver for TCG/TCPA TPM (trusted platform module).
13 * Specifications at www.trustedcomputinggroup.org
15 * This program is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU General Public License as
17 * published by the Free Software Foundation, version 2 of the
20 * Note, the TPM chip is not interrupt driven (only polling)
21 * and can have very long timeouts (minutes!). Hence the unusual
26 #include <linux/sched.h>
27 #include <linux/poll.h>
28 #include <linux/spinlock.h>
32 TPM_MINOR
= 224, /* officially assigned */
34 TPM_NUM_DEVICES
= 256,
35 TPM_NUM_MASK_ENTRIES
= TPM_NUM_DEVICES
/ (8 * sizeof(int))
38 /* PCI configuration addresses */
39 enum tpm_pci_config_addr
{
40 PCI_GEN_PMCON_1
= 0xA0,
48 TPM_INTERUPT_REG
= 0x0A,
49 TPM_BASE_ADDR_LO
= 0x08,
50 TPM_BASE_ADDR_HI
= 0x09,
51 TPM_UNLOCK_VALUE
= 0x55,
52 TPM_LOCK_VALUE
= 0xAA,
53 TPM_DISABLE_INTERUPT_VALUE
= 0x00
57 static LIST_HEAD(tpm_chip_list
);
58 static DEFINE_SPINLOCK(driver_lock
);
59 static int dev_mask
[TPM_NUM_MASK_ENTRIES
];
61 static void user_reader_timeout(unsigned long ptr
)
63 struct tpm_chip
*chip
= (struct tpm_chip
*) ptr
;
65 down(&chip
->buffer_mutex
);
66 atomic_set(&chip
->data_pending
, 0);
67 memset(chip
->data_buffer
, 0, TPM_BUFSIZE
);
68 up(&chip
->buffer_mutex
);
72 * Initialize the LPC bus and enable the TPM ports
74 int tpm_lpc_bus_init(struct pci_dev
*pci_dev
, u16 base
)
79 switch (pci_dev
->vendor
) {
80 case PCI_VENDOR_ID_INTEL
:
81 switch (pci_dev
->device
) {
82 case PCI_DEVICE_ID_INTEL_82801CA_12
:
83 case PCI_DEVICE_ID_INTEL_82801DB_12
:
87 /* init ICH (enable LPC) */
88 pci_read_config_dword(pci_dev
, PCI_GEN1_DEC
, &lpcenable
);
89 lpcenable
|= 0x20000000;
90 pci_write_config_dword(pci_dev
, PCI_GEN1_DEC
, lpcenable
);
93 pci_read_config_dword(pci_dev
, PCI_GEN1_DEC
,
95 if ((lpcenable
& 0x20000000) == 0) {
96 dev_err(&pci_dev
->dev
,
97 "cannot enable LPC\n");
102 /* initialize TPM registers */
103 pci_read_config_dword(pci_dev
, PCI_GEN2_DEC
, &tmp
);
106 tmp
= (tmp
& 0xFFFF0000) | (base
& 0xFFF0);
109 (tmp
& 0xFFFF0000) | (base
& 0xFFF0) |
112 pci_write_config_dword(pci_dev
, PCI_GEN2_DEC
, tmp
);
115 pci_read_config_dword(pci_dev
, PCI_GEN_PMCON_1
,
117 tmp
|= 0x00000004; /* enable CLKRUN */
118 pci_write_config_dword(pci_dev
, PCI_GEN_PMCON_1
,
122 case PCI_VENDOR_ID_AMD
:
127 tpm_write_index(TPM_LOCK_REG
, TPM_UNLOCK_VALUE
);
128 tpm_write_index(TPM_INTERUPT_REG
, TPM_DISABLE_INTERUPT_VALUE
);
129 tpm_write_index(TPM_BASE_ADDR_LO
, base
);
130 tpm_write_index(TPM_BASE_ADDR_HI
, (base
& 0xFF00) >> 8);
131 tpm_write_index(TPM_LOCK_REG
, TPM_LOCK_VALUE
);
136 EXPORT_SYMBOL_GPL(tpm_lpc_bus_init
);
139 * Internal kernel interface to transmit TPM commands
141 static ssize_t
tpm_transmit(struct tpm_chip
*chip
, const char *buf
,
148 count
= be32_to_cpu(*((__be32
*) (buf
+ 2)));
152 if (count
> bufsiz
) {
153 dev_err(&chip
->pci_dev
->dev
,
154 "invalid count value %x %zx \n", count
, bufsiz
);
158 down(&chip
->tpm_mutex
);
160 if ((len
= chip
->vendor
->send(chip
, (u8
*) buf
, count
)) < 0) {
161 dev_err(&chip
->pci_dev
->dev
,
162 "tpm_transmit: tpm_send: error %zd\n", len
);
166 stop
= jiffies
+ 2 * 60 * HZ
;
168 u8 status
= inb(chip
->vendor
->base
+ 1);
169 if ((status
& chip
->vendor
->req_complete_mask
) ==
170 chip
->vendor
->req_complete_val
) {
173 msleep(TPM_TIMEOUT
); /* CHECK */
175 } while (time_before(jiffies
, stop
));
178 chip
->vendor
->cancel(chip
);
179 dev_err(&chip
->pci_dev
->dev
, "Time expired\n");
180 up(&chip
->tpm_mutex
);
184 len
= chip
->vendor
->recv(chip
, (u8
*) buf
, bufsiz
);
186 dev_err(&chip
->pci_dev
->dev
,
187 "tpm_transmit: tpm_recv: error %zd\n", len
);
188 up(&chip
->tpm_mutex
);
192 #define TPM_DIGEST_SIZE 20
193 #define CAP_PCR_RESULT_SIZE 18
194 static const u8 cap_pcr
[] = {
195 0, 193, /* TPM_TAG_RQU_COMMAND */
196 0, 0, 0, 22, /* length */
197 0, 0, 0, 101, /* TPM_ORD_GetCapability */
203 #define READ_PCR_RESULT_SIZE 30
204 static const u8 pcrread
[] = {
205 0, 193, /* TPM_TAG_RQU_COMMAND */
206 0, 0, 0, 14, /* length */
207 0, 0, 0, 21, /* TPM_ORD_PcrRead */
208 0, 0, 0, 0 /* PCR index */
211 ssize_t
tpm_show_pcrs(struct device
*dev
, struct device_attribute
*attr
,
214 u8 data
[READ_PCR_RESULT_SIZE
];
220 struct tpm_chip
*chip
=
221 pci_get_drvdata(to_pci_dev(dev
));
225 memcpy(data
, cap_pcr
, sizeof(cap_pcr
));
226 if ((len
= tpm_transmit(chip
, data
, sizeof(data
)))
227 < CAP_PCR_RESULT_SIZE
)
230 num_pcrs
= be32_to_cpu(*((__be32
*) (data
+ 14)));
232 for (i
= 0; i
< num_pcrs
; i
++) {
233 memcpy(data
, pcrread
, sizeof(pcrread
));
234 index
= cpu_to_be32(i
);
235 memcpy(data
+ 10, &index
, 4);
236 if ((len
= tpm_transmit(chip
, data
, sizeof(data
)))
237 < READ_PCR_RESULT_SIZE
)
239 str
+= sprintf(str
, "PCR-%02d: ", i
);
240 for (j
= 0; j
< TPM_DIGEST_SIZE
; j
++)
241 str
+= sprintf(str
, "%02X ", *(data
+ 10 + j
));
242 str
+= sprintf(str
, "\n");
247 EXPORT_SYMBOL_GPL(tpm_show_pcrs
);
249 #define READ_PUBEK_RESULT_SIZE 314
250 static const u8 readpubek
[] = {
251 0, 193, /* TPM_TAG_RQU_COMMAND */
252 0, 0, 0, 30, /* length */
253 0, 0, 0, 124, /* TPM_ORD_ReadPubek */
256 ssize_t
tpm_show_pubek(struct device
*dev
, struct device_attribute
*attr
,
264 struct tpm_chip
*chip
=
265 pci_get_drvdata(to_pci_dev(dev
));
269 data
= kmalloc(READ_PUBEK_RESULT_SIZE
, GFP_KERNEL
);
273 memcpy(data
, readpubek
, sizeof(readpubek
));
274 memset(data
+ sizeof(readpubek
), 0, 20); /* zero nonce */
276 if ((len
= tpm_transmit(chip
, data
, READ_PUBEK_RESULT_SIZE
)) <
277 READ_PUBEK_RESULT_SIZE
) {
283 ignore header 10 bytes
284 algorithm 32 bits (1 == RSA )
287 parameters (RSA 12->bytes: keybit, #primes, expbit)
290 ignore checksum 20 bytes
295 "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
296 "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
297 " %02X %02X %02X %02X %02X %02X %02X %02X\n"
298 "Modulus length: %d\nModulus: \n",
299 data
[10], data
[11], data
[12], data
[13], data
[14],
300 data
[15], data
[16], data
[17], data
[22], data
[23],
301 data
[24], data
[25], data
[26], data
[27], data
[28],
302 data
[29], data
[30], data
[31], data
[32], data
[33],
303 be32_to_cpu(*((__be32
*) (data
+ 32))));
305 for (i
= 0; i
< 256; i
++) {
306 str
+= sprintf(str
, "%02X ", data
[i
+ 39]);
307 if ((i
+ 1) % 16 == 0)
308 str
+= sprintf(str
, "\n");
316 EXPORT_SYMBOL_GPL(tpm_show_pubek
);
318 #define CAP_VER_RESULT_SIZE 18
319 static const u8 cap_version
[] = {
320 0, 193, /* TPM_TAG_RQU_COMMAND */
321 0, 0, 0, 18, /* length */
322 0, 0, 0, 101, /* TPM_ORD_GetCapability */
327 #define CAP_MANUFACTURER_RESULT_SIZE 18
328 static const u8 cap_manufacturer
[] = {
329 0, 193, /* TPM_TAG_RQU_COMMAND */
330 0, 0, 0, 22, /* length */
331 0, 0, 0, 101, /* TPM_ORD_GetCapability */
337 ssize_t
tpm_show_caps(struct device
*dev
, struct device_attribute
*attr
,
340 u8 data
[sizeof(cap_manufacturer
)];
344 struct tpm_chip
*chip
=
345 pci_get_drvdata(to_pci_dev(dev
));
349 memcpy(data
, cap_manufacturer
, sizeof(cap_manufacturer
));
351 if ((len
= tpm_transmit(chip
, data
, sizeof(data
))) <
352 CAP_MANUFACTURER_RESULT_SIZE
)
355 str
+= sprintf(str
, "Manufacturer: 0x%x\n",
356 be32_to_cpu(*((__be32
*) (data
+ 14))));
358 memcpy(data
, cap_version
, sizeof(cap_version
));
360 if ((len
= tpm_transmit(chip
, data
, sizeof(data
))) <
365 sprintf(str
, "TCG version: %d.%d\nFirmware version: %d.%d\n",
366 (int) data
[14], (int) data
[15], (int) data
[16],
371 EXPORT_SYMBOL_GPL(tpm_show_caps
);
373 ssize_t
tpm_store_cancel(struct device
*dev
, struct device_attribute
*attr
,
374 const char *buf
, size_t count
)
376 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
380 chip
->vendor
->cancel(chip
);
383 EXPORT_SYMBOL_GPL(tpm_store_cancel
);
387 * Device file system interface to the TPM
389 int tpm_open(struct inode
*inode
, struct file
*file
)
391 int rc
= 0, minor
= iminor(inode
);
392 struct tpm_chip
*chip
= NULL
, *pos
;
394 spin_lock(&driver_lock
);
396 list_for_each_entry(pos
, &tpm_chip_list
, list
) {
397 if (pos
->vendor
->miscdev
.minor
== minor
) {
408 if (chip
->num_opens
) {
409 dev_dbg(&chip
->pci_dev
->dev
,
410 "Another process owns this TPM\n");
416 pci_dev_get(chip
->pci_dev
);
418 spin_unlock(&driver_lock
);
420 chip
->data_buffer
= kmalloc(TPM_BUFSIZE
* sizeof(u8
), GFP_KERNEL
);
421 if (chip
->data_buffer
== NULL
) {
423 pci_dev_put(chip
->pci_dev
);
427 atomic_set(&chip
->data_pending
, 0);
429 file
->private_data
= chip
;
433 spin_unlock(&driver_lock
);
437 EXPORT_SYMBOL_GPL(tpm_open
);
439 int tpm_release(struct inode
*inode
, struct file
*file
)
441 struct tpm_chip
*chip
= file
->private_data
;
443 file
->private_data
= NULL
;
445 spin_lock(&driver_lock
);
447 del_singleshot_timer_sync(&chip
->user_read_timer
);
448 atomic_set(&chip
->data_pending
, 0);
450 pci_dev_put(chip
->pci_dev
);
454 EXPORT_SYMBOL_GPL(tpm_release
);
456 ssize_t
tpm_write(struct file
* file
, const char __user
* buf
,
457 size_t size
, loff_t
* off
)
459 struct tpm_chip
*chip
= file
->private_data
;
460 int in_size
= size
, out_size
;
462 /* cannot perform a write until the read has cleared
463 either via tpm_read or a user_read_timer timeout */
464 while (atomic_read(&chip
->data_pending
) != 0)
467 down(&chip
->buffer_mutex
);
469 if (in_size
> TPM_BUFSIZE
)
470 in_size
= TPM_BUFSIZE
;
473 (chip
->data_buffer
, (void __user
*) buf
, in_size
)) {
474 up(&chip
->buffer_mutex
);
478 /* atomic tpm command send and result receive */
479 out_size
= tpm_transmit(chip
, chip
->data_buffer
, TPM_BUFSIZE
);
481 atomic_set(&chip
->data_pending
, out_size
);
482 up(&chip
->buffer_mutex
);
484 /* Set a timeout by which the reader must come claim the result */
485 mod_timer(&chip
->user_read_timer
, jiffies
+ (60 * HZ
));
490 EXPORT_SYMBOL_GPL(tpm_write
);
492 ssize_t
tpm_read(struct file
* file
, char __user
* buf
,
493 size_t size
, loff_t
* off
)
495 struct tpm_chip
*chip
= file
->private_data
;
498 del_singleshot_timer_sync(&chip
->user_read_timer
);
499 ret_size
= atomic_read(&chip
->data_pending
);
500 atomic_set(&chip
->data_pending
, 0);
501 if (ret_size
> 0) { /* relay data */
505 down(&chip
->buffer_mutex
);
507 ((void __user
*) buf
, chip
->data_buffer
, ret_size
))
509 up(&chip
->buffer_mutex
);
515 EXPORT_SYMBOL_GPL(tpm_read
);
517 void __devexit
tpm_remove(struct pci_dev
*pci_dev
)
519 struct tpm_chip
*chip
= pci_get_drvdata(pci_dev
);
522 dev_err(&pci_dev
->dev
, "No device data found\n");
526 spin_lock(&driver_lock
);
528 list_del(&chip
->list
);
530 spin_unlock(&driver_lock
);
532 pci_set_drvdata(pci_dev
, NULL
);
533 misc_deregister(&chip
->vendor
->miscdev
);
535 sysfs_remove_group(&pci_dev
->dev
.kobj
, chip
->vendor
->attr_group
);
537 pci_disable_device(pci_dev
);
539 dev_mask
[chip
->dev_num
/ TPM_NUM_MASK_ENTRIES
] &= !(1 << (chip
->dev_num
% TPM_NUM_MASK_ENTRIES
));
543 pci_dev_put(pci_dev
);
546 EXPORT_SYMBOL_GPL(tpm_remove
);
548 static u8 savestate
[] = {
549 0, 193, /* TPM_TAG_RQU_COMMAND */
550 0, 0, 0, 10, /* blob length (in bytes) */
551 0, 0, 0, 152 /* TPM_ORD_SaveState */
555 * We are about to suspend. Save the TPM state
556 * so that it can be restored.
558 int tpm_pm_suspend(struct pci_dev
*pci_dev
, pm_message_t pm_state
)
560 struct tpm_chip
*chip
= pci_get_drvdata(pci_dev
);
564 tpm_transmit(chip
, savestate
, sizeof(savestate
));
568 EXPORT_SYMBOL_GPL(tpm_pm_suspend
);
571 * Resume from a power safe. The BIOS already restored
574 int tpm_pm_resume(struct pci_dev
*pci_dev
)
576 struct tpm_chip
*chip
= pci_get_drvdata(pci_dev
);
581 spin_lock(&driver_lock
);
582 tpm_lpc_bus_init(pci_dev
, chip
->vendor
->base
);
583 spin_unlock(&driver_lock
);
588 EXPORT_SYMBOL_GPL(tpm_pm_resume
);
591 * Called from tpm_<specific>.c probe function only for devices
592 * the driver has determined it should claim. Prior to calling
593 * this function the specific probe function has called pci_enable_device
594 * upon errant exit from this function specific probe function should call
597 int tpm_register_hardware(struct pci_dev
*pci_dev
,
598 struct tpm_vendor_specific
*entry
)
601 struct tpm_chip
*chip
;
604 /* Driver specific per-device data */
605 chip
= kmalloc(sizeof(*chip
), GFP_KERNEL
);
609 memset(chip
, 0, sizeof(struct tpm_chip
));
611 init_MUTEX(&chip
->buffer_mutex
);
612 init_MUTEX(&chip
->tpm_mutex
);
613 INIT_LIST_HEAD(&chip
->list
);
615 init_timer(&chip
->user_read_timer
);
616 chip
->user_read_timer
.function
= user_reader_timeout
;
617 chip
->user_read_timer
.data
= (unsigned long) chip
;
619 chip
->vendor
= entry
;
623 for (i
= 0; i
< TPM_NUM_MASK_ENTRIES
; i
++)
624 for (j
= 0; j
< 8 * sizeof(int); j
++)
625 if ((dev_mask
[i
] & (1 << j
)) == 0) {
627 i
* TPM_NUM_MASK_ENTRIES
+ j
;
628 dev_mask
[i
] |= 1 << j
;
629 goto dev_num_search_complete
;
632 dev_num_search_complete
:
633 if (chip
->dev_num
< 0) {
634 dev_err(&pci_dev
->dev
,
635 "No available tpm device numbers\n");
638 } else if (chip
->dev_num
== 0)
639 chip
->vendor
->miscdev
.minor
= TPM_MINOR
;
641 chip
->vendor
->miscdev
.minor
= MISC_DYNAMIC_MINOR
;
643 snprintf(devname
, sizeof(devname
), "%s%d", "tpm", chip
->dev_num
);
644 chip
->vendor
->miscdev
.name
= devname
;
646 chip
->vendor
->miscdev
.dev
= &(pci_dev
->dev
);
647 chip
->pci_dev
= pci_dev_get(pci_dev
);
649 if (misc_register(&chip
->vendor
->miscdev
)) {
650 dev_err(&chip
->pci_dev
->dev
,
651 "unable to misc_register %s, minor %d\n",
652 chip
->vendor
->miscdev
.name
,
653 chip
->vendor
->miscdev
.minor
);
654 pci_dev_put(pci_dev
);
656 dev_mask
[i
] &= !(1 << j
);
660 pci_set_drvdata(pci_dev
, chip
);
662 list_add(&chip
->list
, &tpm_chip_list
);
664 sysfs_create_group(&pci_dev
->dev
.kobj
, chip
->vendor
->attr_group
);
669 EXPORT_SYMBOL_GPL(tpm_register_hardware
);
671 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
672 MODULE_DESCRIPTION("TPM Driver");
673 MODULE_VERSION("2.0");
674 MODULE_LICENSE("GPL");