[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / char / tpm / tpm.c

/*
 * Copyright (C) 2004 IBM Corporation
 *
 * Authors:
 * Leendert van Doorn <leendert@watson.ibm.com>
 * Dave Safford <safford@watson.ibm.com>
 * Reiner Sailer <sailer@watson.ibm.com>
 * Kylene Hall <kjhall@us.ibm.com>
 *
 * Maintained by: <tpmdd_devel@lists.sourceforge.net>
 *
 * Device driver for TCG/TCPA TPM (trusted platform module).
 * Specifications at www.trustedcomputinggroup.org	 
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 * 
 * Note, the TPM chip is not interrupt driven (only polling)
 * and can have very long timeouts (minutes!). Hence the unusual
 * calls to msleep.
 *
 */

#include <linux/sched.h>
#include <linux/poll.h>
#include <linux/spinlock.h>
#include "tpm.h"

enum tpm_const {
	TPM_MINOR = 224,	/* officially assigned */
	TPM_BUFSIZE = 2048,
	TPM_NUM_DEVICES = 256,
	TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
};

  /* PCI configuration addresses */
enum tpm_pci_config_addr {
	PCI_GEN_PMCON_1 = 0xA0,
	PCI_GEN1_DEC = 0xE4,
	PCI_LPC_EN = 0xE6,
	PCI_GEN2_DEC = 0xEC
};

enum tpm_config {
	TPM_LOCK_REG = 0x0D,
	TPM_INTERUPT_REG = 0x0A,
	TPM_BASE_ADDR_LO = 0x08,
	TPM_BASE_ADDR_HI = 0x09,
	TPM_UNLOCK_VALUE = 0x55,
	TPM_LOCK_VALUE = 0xAA,
	TPM_DISABLE_INTERUPT_VALUE = 0x00
};


static LIST_HEAD(tpm_chip_list);
static DEFINE_SPINLOCK(driver_lock);
static int dev_mask[TPM_NUM_MASK_ENTRIES];

static void user_reader_timeout(unsigned long ptr)
{
	struct tpm_chip *chip = (struct tpm_chip *) ptr;

	down(&chip->buffer_mutex);
	atomic_set(&chip->data_pending, 0);
	memset(chip->data_buffer, 0, TPM_BUFSIZE);
	up(&chip->buffer_mutex);
}

/*
 * Initialize the LPC bus and enable the TPM ports
 */
int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
{
	u32 lpcenable, tmp;
	int is_lpcm = 0;

	switch (pci_dev->vendor) {
	case PCI_VENDOR_ID_INTEL:
		switch (pci_dev->device) {
		case PCI_DEVICE_ID_INTEL_82801CA_12:
		case PCI_DEVICE_ID_INTEL_82801DB_12:
			is_lpcm = 1;
			break;
		}
		/* init ICH (enable LPC) */
		pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
		lpcenable |= 0x20000000;
		pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);

		if (is_lpcm) {
			pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
					      &lpcenable);
			if ((lpcenable & 0x20000000) == 0) {
				dev_err(&pci_dev->dev,
					"cannot enable LPC\n");
				return -ENODEV;
			}
		}

		/* initialize TPM registers */
		pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);

		if (!is_lpcm)
			tmp = (tmp & 0xFFFF0000) | (base & 0xFFF0);
		else
			tmp =
			    (tmp & 0xFFFF0000) | (base & 0xFFF0) |
			    0x00000001;

		pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);

		if (is_lpcm) {
			pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
					      &tmp);
			tmp |= 0x00000004;	/* enable CLKRUN */
			pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
					       tmp);
		}
		break;
	case PCI_VENDOR_ID_AMD:
		/* nothing yet */
		break;
	}

	tpm_write_index(TPM_LOCK_REG, TPM_UNLOCK_VALUE);
	tpm_write_index(TPM_INTERUPT_REG, TPM_DISABLE_INTERUPT_VALUE);
	tpm_write_index(TPM_BASE_ADDR_LO, base);
	tpm_write_index(TPM_BASE_ADDR_HI, (base & 0xFF00) >> 8);
	tpm_write_index(TPM_LOCK_REG, TPM_LOCK_VALUE);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);

/*
 * Internal kernel interface to transmit TPM commands
 */
static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
			    size_t bufsiz)
{
	ssize_t len;
	u32 count;
	__be32 *native_size;
	unsigned long stop;

	native_size = (__force __be32 *) (buf + 2);
	count = be32_to_cpu(*native_size);

	if (count == 0)
		return -ENODATA;
	if (count > bufsiz) {
		dev_err(&chip->pci_dev->dev,
			"invalid count value %x %zx \n", count, bufsiz);
		return -E2BIG;
	}

	down(&chip->tpm_mutex);

	if ((len = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
		dev_err(&chip->pci_dev->dev,
			"tpm_transmit: tpm_send: error %zd\n", len);
		return len;
	}

	stop = jiffies + 2 * 60 * HZ;
	do {
		u8 status = inb(chip->vendor->base + 1);
		if ((status & chip->vendor->req_complete_mask) ==
		    chip->vendor->req_complete_val) {
			goto out_recv;
		}
		msleep(TPM_TIMEOUT); /* CHECK */
		rmb();
	} while (time_before(jiffies, stop));


	chip->vendor->cancel(chip);
	dev_err(&chip->pci_dev->dev, "Time expired\n");
	up(&chip->tpm_mutex);
	return -EIO;

out_recv:
	len = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
	if (len < 0)
		dev_err(&chip->pci_dev->dev,
			"tpm_transmit: tpm_recv: error %zd\n", len);
	up(&chip->tpm_mutex);
	return len;
}

#define TPM_DIGEST_SIZE 20
#define CAP_PCR_RESULT_SIZE 18
static const u8 cap_pcr[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 22,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 5,
	0, 0, 0, 4,
	0, 0, 1, 1
};

#define READ_PCR_RESULT_SIZE 30
static const u8 pcrread[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 14,		/* length */
	0, 0, 0, 21,		/* TPM_ORD_PcrRead */
	0, 0, 0, 0		/* PCR index */
};

static ssize_t show_pcrs(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 data[READ_PCR_RESULT_SIZE];
	ssize_t len;
	int i, j, index, num_pcrs;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	memcpy(data, cap_pcr, sizeof(cap_pcr));
	if ((len = tpm_transmit(chip, data, sizeof(data)))
	    < CAP_PCR_RESULT_SIZE)
		return len;

	num_pcrs = be32_to_cpu(*((__force __be32 *) (data + 14)));

	for (i = 0; i < num_pcrs; i++) {
		memcpy(data, pcrread, sizeof(pcrread));
		index = cpu_to_be32(i);
		memcpy(data + 10, &index, 4);
		if ((len = tpm_transmit(chip, data, sizeof(data)))
		    < READ_PCR_RESULT_SIZE)
			return len;
		str += sprintf(str, "PCR-%02d: ", i);
		for (j = 0; j < TPM_DIGEST_SIZE; j++)
			str += sprintf(str, "%02X ", *(data + 10 + j));
		str += sprintf(str, "\n");
	}
	return str - buf;
}

static DEVICE_ATTR(pcrs, S_IRUGO, show_pcrs, NULL);

#define  READ_PUBEK_RESULT_SIZE 314
static const u8 readpubek[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 30,		/* length */
	0, 0, 0, 124,		/* TPM_ORD_ReadPubek */
};

static ssize_t show_pubek(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 *data;
	ssize_t len;
	__be32 *native_val;
	int i;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	data = kmalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
	if (!data)
		return -ENOMEM;

	memcpy(data, readpubek, sizeof(readpubek));
	memset(data + sizeof(readpubek), 0, 20);	/* zero nonce */

	if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
	    READ_PUBEK_RESULT_SIZE) {
		rc = len;
		goto out;
	}

	/* 
	   ignore header 10 bytes
	   algorithm 32 bits (1 == RSA )
	   encscheme 16 bits
	   sigscheme 16 bits
	   parameters (RSA 12->bytes: keybit, #primes, expbit)  
	   keylenbytes 32 bits
	   256 byte modulus
	   ignore checksum 20 bytes
	 */

	native_val = (__force __be32 *) (data + 34);

	str +=
	    sprintf(str,
		    "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
		    "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
		    " %02X %02X %02X %02X %02X %02X %02X %02X\n"
		    "Modulus length: %d\nModulus: \n",
		    data[10], data[11], data[12], data[13], data[14],
		    data[15], data[16], data[17], data[22], data[23],
		    data[24], data[25], data[26], data[27], data[28],
		    data[29], data[30], data[31], data[32], data[33],
		    be32_to_cpu(*native_val)
	    );

	for (i = 0; i < 256; i++) {
		str += sprintf(str, "%02X ", data[i + 39]);
		if ((i + 1) % 16 == 0)
			str += sprintf(str, "\n");
	}
	rc = str - buf;
out:
	kfree(data);
	return rc;
}

static DEVICE_ATTR(pubek, S_IRUGO, show_pubek, NULL);

#define CAP_VER_RESULT_SIZE 18
static const u8 cap_version[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 18,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 6,
	0, 0, 0, 0
};

#define CAP_MANUFACTURER_RESULT_SIZE 18
static const u8 cap_manufacturer[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 22,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 5,
	0, 0, 0, 4,
	0, 0, 1, 3
};

static ssize_t show_caps(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 data[sizeof(cap_manufacturer)];
	ssize_t len;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));

	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	    CAP_MANUFACTURER_RESULT_SIZE)
		return len;

	str += sprintf(str, "Manufacturer: 0x%x\n",
		       be32_to_cpu(*(data + 14)));

	memcpy(data, cap_version, sizeof(cap_version));

	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	    CAP_VER_RESULT_SIZE)
		return len;

	str +=
	    sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
		    (int) data[14], (int) data[15], (int) data[16],
		    (int) data[17]);

	return str - buf;
}

static DEVICE_ATTR(caps, S_IRUGO, show_caps, NULL);

/*
 * Device file system interface to the TPM
 */
int tpm_open(struct inode *inode, struct file *file)
{
	int rc = 0, minor = iminor(inode);
	struct tpm_chip *chip = NULL, *pos;

	spin_lock(&driver_lock);

	list_for_each_entry(pos, &tpm_chip_list, list) {
		if (pos->vendor->miscdev.minor == minor) {
			chip = pos;
			break;
		}
	}

	if (chip == NULL) {
		rc = -ENODEV;
		goto err_out;
	}

	if (chip->num_opens) {
		dev_dbg(&chip->pci_dev->dev,
			"Another process owns this TPM\n");
		rc = -EBUSY;
		goto err_out;
	}

	chip->num_opens++;
	pci_dev_get(chip->pci_dev);

	spin_unlock(&driver_lock);

	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
	if (chip->data_buffer == NULL) {
		chip->num_opens--;
		pci_dev_put(chip->pci_dev);
		return -ENOMEM;
	}

	atomic_set(&chip->data_pending, 0);

	file->private_data = chip;
	return 0;

err_out:
	spin_unlock(&driver_lock);
	return rc;
}

EXPORT_SYMBOL_GPL(tpm_open);

int tpm_release(struct inode *inode, struct file *file)
{
	struct tpm_chip *chip = file->private_data;
	
	file->private_data = NULL;

	spin_lock(&driver_lock);
	chip->num_opens--;
	spin_unlock(&driver_lock);

	down(&chip->timer_manipulation_mutex);
	if (timer_pending(&chip->user_read_timer))
		del_singleshot_timer_sync(&chip->user_read_timer);
	else if (timer_pending(&chip->device_timer))
		del_singleshot_timer_sync(&chip->device_timer);
	up(&chip->timer_manipulation_mutex);

	kfree(chip->data_buffer);
	atomic_set(&chip->data_pending, 0);

	pci_dev_put(chip->pci_dev);
	return 0;
}

EXPORT_SYMBOL_GPL(tpm_release);

ssize_t tpm_write(struct file * file, const char __user * buf,
		  size_t size, loff_t * off)
{
	struct tpm_chip *chip = file->private_data;
	int in_size = size, out_size;

	/* cannot perform a write until the read has cleared
	   either via tpm_read or a user_read_timer timeout */
	while (atomic_read(&chip->data_pending) != 0)
		msleep(TPM_TIMEOUT);

	down(&chip->buffer_mutex);

	if (in_size > TPM_BUFSIZE)
		in_size = TPM_BUFSIZE;

	if (copy_from_user
	    (chip->data_buffer, (void __user *) buf, in_size)) {
		up(&chip->buffer_mutex);
		return -EFAULT;
	}

	/* atomic tpm command send and result receive */
	out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);

	atomic_set(&chip->data_pending, out_size);
	up(&chip->buffer_mutex);

	/* Set a timeout by which the reader must come claim the result */
	down(&chip->timer_manipulation_mutex);
	init_timer(&chip->user_read_timer);
	chip->user_read_timer.function = user_reader_timeout;
	chip->user_read_timer.data = (unsigned long) chip;
	chip->user_read_timer.expires = jiffies + (60 * HZ);
	add_timer(&chip->user_read_timer);
	up(&chip->timer_manipulation_mutex);

	return in_size;
}

EXPORT_SYMBOL_GPL(tpm_write);

ssize_t tpm_read(struct file * file, char __user * buf,
		 size_t size, loff_t * off)
{
	struct tpm_chip *chip = file->private_data;
	int ret_size;

	del_singleshot_timer_sync(&chip->user_read_timer);
	ret_size = atomic_read(&chip->data_pending);
	atomic_set(&chip->data_pending, 0);
	if (ret_size > 0) {	/* relay data */
		if (size < ret_size)
			ret_size = size;

		down(&chip->buffer_mutex);
		if (copy_to_user
		    ((void __user *) buf, chip->data_buffer, ret_size))
			ret_size = -EFAULT;
		up(&chip->buffer_mutex);
	}

	return ret_size;
}

EXPORT_SYMBOL_GPL(tpm_read);

void __devexit tpm_remove(struct pci_dev *pci_dev)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);

	if (chip == NULL) {
		dev_err(&pci_dev->dev, "No device data found\n");
		return;
	}

	spin_lock(&driver_lock);

	list_del(&chip->list);

	spin_unlock(&driver_lock);

	pci_set_drvdata(pci_dev, NULL);
	misc_deregister(&chip->vendor->miscdev);

	device_remove_file(&pci_dev->dev, &dev_attr_pubek);
	device_remove_file(&pci_dev->dev, &dev_attr_pcrs);
	device_remove_file(&pci_dev->dev, &dev_attr_caps);

	pci_disable_device(pci_dev);

	dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));

	kfree(chip);

	pci_dev_put(pci_dev);
}

EXPORT_SYMBOL_GPL(tpm_remove);

static u8 savestate[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 10,		/* blob length (in bytes) */
	0, 0, 0, 152		/* TPM_ORD_SaveState */
};

/*
 * We are about to suspend. Save the TPM state
 * so that it can be restored.
 */
int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	if (chip == NULL)
		return -ENODEV;

	tpm_transmit(chip, savestate, sizeof(savestate));
	return 0;
}

EXPORT_SYMBOL_GPL(tpm_pm_suspend);

/*
 * Resume from a power safe. The BIOS already restored
 * the TPM state.
 */
int tpm_pm_resume(struct pci_dev *pci_dev)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);

	if (chip == NULL)
		return -ENODEV;

	spin_lock(&driver_lock);
	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
	spin_unlock(&driver_lock);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_pm_resume);

/*
 * Called from tpm_<specific>.c probe function only for devices 
 * the driver has determined it should claim.  Prior to calling
 * this function the specific probe function has called pci_enable_device
 * upon errant exit from this function specific probe function should call
 * pci_disable_device
 */
int tpm_register_hardware(struct pci_dev *pci_dev,
			  struct tpm_vendor_specific *entry)
{
	char devname[7];
	struct tpm_chip *chip;
	int i, j;

	/* Driver specific per-device data */
	chip = kmalloc(sizeof(*chip), GFP_KERNEL);
	if (chip == NULL)
		return -ENOMEM;

	memset(chip, 0, sizeof(struct tpm_chip));

	init_MUTEX(&chip->buffer_mutex);
	init_MUTEX(&chip->tpm_mutex);
	init_MUTEX(&chip->timer_manipulation_mutex);
	INIT_LIST_HEAD(&chip->list);

	chip->vendor = entry;

	chip->dev_num = -1;

	for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
		for (j = 0; j < 8 * sizeof(int); j++)
			if ((dev_mask[i] & (1 << j)) == 0) {
				chip->dev_num =
				    i * TPM_NUM_MASK_ENTRIES + j;
				dev_mask[i] |= 1 << j;
				goto dev_num_search_complete;
			}

dev_num_search_complete:
	if (chip->dev_num < 0) {
		dev_err(&pci_dev->dev,
			"No available tpm device numbers\n");
		kfree(chip);
		return -ENODEV;
	} else if (chip->dev_num == 0)
		chip->vendor->miscdev.minor = TPM_MINOR;
	else
		chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;

	snprintf(devname, sizeof(devname), "%s%d", "tpm", chip->dev_num);
	chip->vendor->miscdev.name = devname;

	chip->vendor->miscdev.dev = &(pci_dev->dev);
	chip->pci_dev = pci_dev_get(pci_dev);

	if (misc_register(&chip->vendor->miscdev)) {
		dev_err(&chip->pci_dev->dev,
			"unable to misc_register %s, minor %d\n",
			chip->vendor->miscdev.name,
			chip->vendor->miscdev.minor);
		pci_dev_put(pci_dev);
		kfree(chip);
		dev_mask[i] &= !(1 << j);
		return -ENODEV;
	}

	pci_set_drvdata(pci_dev, chip);

	list_add(&chip->list, &tpm_chip_list);

	device_create_file(&pci_dev->dev, &dev_attr_pubek);
	device_create_file(&pci_dev->dev, &dev_attr_pcrs);
	device_create_file(&pci_dev->dev, &dev_attr_caps);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_register_hardware);

MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
MODULE_DESCRIPTION("TPM Driver");
MODULE_VERSION("2.0");
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Copyright (C) 2004 IBM Corporation
	3	*
	4	* Authors:
	5	* Leendert van Doorn <leendert@watson.ibm.com>
	6	* Dave Safford <safford@watson.ibm.com>
	7	* Reiner Sailer <sailer@watson.ibm.com>
	8	* Kylene Hall <kjhall@us.ibm.com>
	9	*
	10	* Maintained by: <tpmdd_devel@lists.sourceforge.net>
	11	*
	12	* Device driver for TCG/TCPA TPM (trusted platform module).
	13	* Specifications at www.trustedcomputinggroup.org
	14	*
	15	* This program is free software; you can redistribute it and/or
	16	* modify it under the terms of the GNU General Public License as
	17	* published by the Free Software Foundation, version 2 of the
	18	* License.
	19	*
	20	* Note, the TPM chip is not interrupt driven (only polling)
	21	* and can have very long timeouts (minutes!). Hence the unusual
700d8bdc	22	* calls to msleep.
1da177e4 LT	23	*
	24	*/
	25
	26	#include <linux/sched.h>
	27	#include <linux/poll.h>
	28	#include <linux/spinlock.h>
	29	#include "tpm.h"
	30
3122a88a KH	31	enum tpm_const {
	32	TPM_MINOR = 224, /* officially assigned */
	33	TPM_BUFSIZE = 2048,
	34	TPM_NUM_DEVICES = 256,
	35	TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
	36	};
1da177e4	37
3122a88a KH	38	/* PCI configuration addresses */
	39	enum tpm_pci_config_addr {
	40	PCI_GEN_PMCON_1 = 0xA0,
	41	PCI_GEN1_DEC = 0xE4,
	42	PCI_LPC_EN = 0xE6,
	43	PCI_GEN2_DEC = 0xEC
	44	};
	45
	46	enum tpm_config {
	47	TPM_LOCK_REG = 0x0D,
	48	TPM_INTERUPT_REG = 0x0A,
	49	TPM_BASE_ADDR_LO = 0x08,
	50	TPM_BASE_ADDR_HI = 0x09,
	51	TPM_UNLOCK_VALUE = 0x55,
	52	TPM_LOCK_VALUE = 0xAA,
	53	TPM_DISABLE_INTERUPT_VALUE = 0x00
	54	};
1da177e4	55
1da177e4 LT	56
	57	static LIST_HEAD(tpm_chip_list);
	58	static DEFINE_SPINLOCK(driver_lock);
3122a88a	59	static int dev_mask[TPM_NUM_MASK_ENTRIES];
1da177e4 LT	60
	61	static void user_reader_timeout(unsigned long ptr)
	62	{
	63	struct tpm_chip chip = (struct tpm_chip ) ptr;
	64
	65	down(&chip->buffer_mutex);
	66	atomic_set(&chip->data_pending, 0);
	67	memset(chip->data_buffer, 0, TPM_BUFSIZE);
	68	up(&chip->buffer_mutex);
	69	}
	70
1da177e4 LT	71	/*
	72	* Initialize the LPC bus and enable the TPM ports
	73	*/
	74	int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
	75	{
	76	u32 lpcenable, tmp;
	77	int is_lpcm = 0;
	78
	79	switch (pci_dev->vendor) {
	80	case PCI_VENDOR_ID_INTEL:
	81	switch (pci_dev->device) {
	82	case PCI_DEVICE_ID_INTEL_82801CA_12:
	83	case PCI_DEVICE_ID_INTEL_82801DB_12:
	84	is_lpcm = 1;
	85	break;
	86	}
	87	/* init ICH (enable LPC) */
	88	pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
	89	lpcenable \|= 0x20000000;
	90	pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);
	91
	92	if (is_lpcm) {
	93	pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
	94	&lpcenable);
	95	if ((lpcenable & 0x20000000) == 0) {
	96	dev_err(&pci_dev->dev,
	97	"cannot enable LPC\n");
	98	return -ENODEV;
	99	}
	100	}
	101
	102	/* initialize TPM registers */
	103	pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);
	104
	105	if (!is_lpcm)
	106	tmp = (tmp & 0xFFFF0000) \| (base & 0xFFF0);
	107	else
	108	tmp =
	109	(tmp & 0xFFFF0000) \| (base & 0xFFF0) \|
	110	0x00000001;
	111
	112	pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);
	113
	114	if (is_lpcm) {
	115	pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
	116	&tmp);
	117	tmp \|= 0x00000004; /* enable CLKRUN */
	118	pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
	119	tmp);
	120	}
1da177e4 LT	121	break;
	122	case PCI_VENDOR_ID_AMD:
	123	/* nothing yet */
	124	break;
	125	}
	126
3122a88a KH	127	tpm_write_index(TPM_LOCK_REG, TPM_UNLOCK_VALUE);
	128	tpm_write_index(TPM_INTERUPT_REG, TPM_DISABLE_INTERUPT_VALUE);
	129	tpm_write_index(TPM_BASE_ADDR_LO, base);
	130	tpm_write_index(TPM_BASE_ADDR_HI, (base & 0xFF00) >> 8);
	131	tpm_write_index(TPM_LOCK_REG, TPM_LOCK_VALUE);
	132
1da177e4 LT	133	return 0;
	134	}
	135
	136	EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);
	137
	138	/*
	139	* Internal kernel interface to transmit TPM commands
	140	*/
	141	static ssize_t tpm_transmit(struct tpm_chip chip, const char buf,
	142	size_t bufsiz)
	143	{
	144	ssize_t len;
	145	u32 count;
	146	__be32 *native_size;
700d8bdc	147	unsigned long stop;
1da177e4 LT	148
	149	native_size = (__force __be32 *) (buf + 2);
	150	count = be32_to_cpu(*native_size);
	151
	152	if (count == 0)
	153	return -ENODATA;
	154	if (count > bufsiz) {
	155	dev_err(&chip->pci_dev->dev,
b76be681	156	"invalid count value %x %zx \n", count, bufsiz);
1da177e4 LT	157	return -E2BIG;
	158	}
	159
	160	down(&chip->tpm_mutex);
	161
	162	if ((len = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
	163	dev_err(&chip->pci_dev->dev,
b76be681	164	"tpm_transmit: tpm_send: error %zd\n", len);
1da177e4 LT	165	return len;
	166	}
	167
700d8bdc	168	stop = jiffies + 2 * 60 * HZ;
1da177e4 LT	169	do {
	170	u8 status = inb(chip->vendor->base + 1);
	171	if ((status & chip->vendor->req_complete_mask) ==
	172	chip->vendor->req_complete_val) {
1da177e4 LT	173	goto out_recv;
1da177e4 LT	174	}
700d8bdc	175	msleep(TPM_TIMEOUT); /* CHECK */
1da177e4	176	rmb();
700d8bdc	177	} while (time_before(jiffies, stop));
1da177e4 LT	178
	179
	180	chip->vendor->cancel(chip);
	181	dev_err(&chip->pci_dev->dev, "Time expired\n");
	182	up(&chip->tpm_mutex);
	183	return -EIO;
	184
	185	out_recv:
	186	len = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
	187	if (len < 0)
	188	dev_err(&chip->pci_dev->dev,
b76be681	189	"tpm_transmit: tpm_recv: error %zd\n", len);
1da177e4 LT	190	up(&chip->tpm_mutex);
	191	return len;
	192	}
	193
	194	#define TPM_DIGEST_SIZE 20
	195	#define CAP_PCR_RESULT_SIZE 18
dff37e4b	196	static const u8 cap_pcr[] = {
1da177e4 LT	197	0, 193, /* TPM_TAG_RQU_COMMAND */
	198	0, 0, 0, 22, /* length */
	199	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	200	0, 0, 0, 5,
	201	0, 0, 0, 4,
	202	0, 0, 1, 1
	203	};
	204
	205	#define READ_PCR_RESULT_SIZE 30
dff37e4b	206	static const u8 pcrread[] = {
1da177e4 LT	207	0, 193, /* TPM_TAG_RQU_COMMAND */
	208	0, 0, 0, 14, /* length */
	209	0, 0, 0, 21, /* TPM_ORD_PcrRead */
	210	0, 0, 0, 0 /* PCR index */
	211	};
	212
74880c06	213	static ssize_t show_pcrs(struct device dev, struct device_attribute attr, char *buf)
1da177e4 LT	214	{
	215	u8 data[READ_PCR_RESULT_SIZE];
	216	ssize_t len;
	217	int i, j, index, num_pcrs;
	218	char *str = buf;
	219
	220	struct tpm_chip *chip =
	221	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	222	if (chip == NULL)
	223	return -ENODEV;
	224
	225	memcpy(data, cap_pcr, sizeof(cap_pcr));
	226	if ((len = tpm_transmit(chip, data, sizeof(data)))
	227	< CAP_PCR_RESULT_SIZE)
	228	return len;
	229
	230	num_pcrs = be32_to_cpu(((__force __be32 ) (data + 14)));
	231
	232	for (i = 0; i < num_pcrs; i++) {
	233	memcpy(data, pcrread, sizeof(pcrread));
	234	index = cpu_to_be32(i);
	235	memcpy(data + 10, &index, 4);
	236	if ((len = tpm_transmit(chip, data, sizeof(data)))
	237	< READ_PCR_RESULT_SIZE)
	238	return len;
	239	str += sprintf(str, "PCR-%02d: ", i);
	240	for (j = 0; j < TPM_DIGEST_SIZE; j++)
	241	str += sprintf(str, "%02X ", *(data + 10 + j));
	242	str += sprintf(str, "\n");
	243	}
	244	return str - buf;
	245	}
	246
	247	static DEVICE_ATTR(pcrs, S_IRUGO, show_pcrs, NULL);
	248
	249	#define READ_PUBEK_RESULT_SIZE 314
dff37e4b	250	static const u8 readpubek[] = {
1da177e4 LT	251	0, 193, /* TPM_TAG_RQU_COMMAND */
	252	0, 0, 0, 30, /* length */
	253	0, 0, 0, 124, /* TPM_ORD_ReadPubek */
	254	};
	255
74880c06	256	static ssize_t show_pubek(struct device dev, struct device_attribute attr, char *buf)
1da177e4	257	{
2df7111f	258	u8 *data;
1da177e4 LT	259	ssize_t len;
	260	__be32 *native_val;
	261	int i;
	262	char *str = buf;
	263
	264	struct tpm_chip *chip =
	265	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	266	if (chip == NULL)
	267	return -ENODEV;
	268
2df7111f KH	269	data = kmalloc(READ_PUBEK_RESULT_SIZE, GFP_KERNEL);
	270	if (!data)
	271	return -ENOMEM;
	272
1da177e4 LT	273	memcpy(data, readpubek, sizeof(readpubek));
	274	memset(data + sizeof(readpubek), 0, 20); /* zero nonce */
	275
2df7111f KH	276	if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
	277	READ_PUBEK_RESULT_SIZE) {
	278	rc = len;
	279	goto out;
	280	}
1da177e4 LT	281
	282	/*
	283	ignore header 10 bytes
	284	algorithm 32 bits (1 == RSA )
	285	encscheme 16 bits
	286	sigscheme 16 bits
	287	parameters (RSA 12->bytes: keybit, #primes, expbit)
	288	keylenbytes 32 bits
	289	256 byte modulus
	290	ignore checksum 20 bytes
	291	*/
	292
	293	native_val = (__force __be32 *) (data + 34);
	294
	295	str +=
	296	sprintf(str,
	297	"Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
	298	"Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
	299	" %02X %02X %02X %02X %02X %02X %02X %02X\n"
	300	"Modulus length: %d\nModulus: \n",
	301	data[10], data[11], data[12], data[13], data[14],
	302	data[15], data[16], data[17], data[22], data[23],
	303	data[24], data[25], data[26], data[27], data[28],
	304	data[29], data[30], data[31], data[32], data[33],
	305	be32_to_cpu(*native_val)
	306	);
	307
	308	for (i = 0; i < 256; i++) {
	309	str += sprintf(str, "%02X ", data[i + 39]);
	310	if ((i + 1) % 16 == 0)
	311	str += sprintf(str, "\n");
	312	}
2df7111f KH	313	rc = str - buf;
	314	out:
	315	kfree(data);
	316	return rc;
1da177e4 LT	317	}
	318
	319	static DEVICE_ATTR(pubek, S_IRUGO, show_pubek, NULL);
	320
	321	#define CAP_VER_RESULT_SIZE 18
dff37e4b	322	static const u8 cap_version[] = {
1da177e4 LT	323	0, 193, /* TPM_TAG_RQU_COMMAND */
	324	0, 0, 0, 18, /* length */
	325	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	326	0, 0, 0, 6,
	327	0, 0, 0, 0
	328	};
	329
	330	#define CAP_MANUFACTURER_RESULT_SIZE 18
dff37e4b	331	static const u8 cap_manufacturer[] = {
1da177e4 LT	332	0, 193, /* TPM_TAG_RQU_COMMAND */
	333	0, 0, 0, 22, /* length */
	334	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	335	0, 0, 0, 5,
	336	0, 0, 0, 4,
	337	0, 0, 1, 3
	338	};
	339
74880c06	340	static ssize_t show_caps(struct device dev, struct device_attribute attr, char *buf)
1da177e4	341	{
2df7111f	342	u8 data[sizeof(cap_manufacturer)];
1da177e4 LT	343	ssize_t len;
	344	char *str = buf;
	345
	346	struct tpm_chip *chip =
	347	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	348	if (chip == NULL)
	349	return -ENODEV;
	350
	351	memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
	352
	353	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	354	CAP_MANUFACTURER_RESULT_SIZE)
	355	return len;
	356
	357	str += sprintf(str, "Manufacturer: 0x%x\n",
	358	be32_to_cpu(*(data + 14)));
	359
	360	memcpy(data, cap_version, sizeof(cap_version));
	361
	362	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	363	CAP_VER_RESULT_SIZE)
	364	return len;
	365
	366	str +=
	367	sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
	368	(int) data[14], (int) data[15], (int) data[16],
	369	(int) data[17]);
	370
	371	return str - buf;
	372	}
	373
	374	static DEVICE_ATTR(caps, S_IRUGO, show_caps, NULL);
	375
	376	/*
	377	* Device file system interface to the TPM
	378	*/
	379	int tpm_open(struct inode inode, struct file file)
	380	{
	381	int rc = 0, minor = iminor(inode);
	382	struct tpm_chip chip = NULL, pos;
	383
	384	spin_lock(&driver_lock);
	385
	386	list_for_each_entry(pos, &tpm_chip_list, list) {
	387	if (pos->vendor->miscdev.minor == minor) {
	388	chip = pos;
	389	break;
	390	}
	391	}
	392
	393	if (chip == NULL) {
	394	rc = -ENODEV;
	395	goto err_out;
	396	}
	397
	398	if (chip->num_opens) {
	399	dev_dbg(&chip->pci_dev->dev,
	400	"Another process owns this TPM\n");
	401	rc = -EBUSY;
	402	goto err_out;
	403	}
	404
	405	chip->num_opens++;
	406	pci_dev_get(chip->pci_dev);
407
408	spin_unlock(&driver_lock);
409
410	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
411	if (chip->data_buffer == NULL) {
412	chip->num_opens--;
413	pci_dev_put(chip->pci_dev);
414	return -ENOMEM;
415	}
416
417	atomic_set(&chip->data_pending, 0);
418
419	file->private_data = chip;
420	return 0;
421
422	err_out:
423	spin_unlock(&driver_lock);
424	return rc;
425	}
426
427	EXPORT_SYMBOL_GPL(tpm_open);
428
429	int tpm_release(struct inode inode, struct file file)
430	{
431	struct tpm_chip *chip = file->private_data;
432
433	file->private_data = NULL;
434
435	spin_lock(&driver_lock);
436	chip->num_opens--;
437	spin_unlock(&driver_lock);
438
439	down(&chip->timer_manipulation_mutex);
440	if (timer_pending(&chip->user_read_timer))
441	del_singleshot_timer_sync(&chip->user_read_timer);
442	else if (timer_pending(&chip->device_timer))
443	del_singleshot_timer_sync(&chip->device_timer);
444	up(&chip->timer_manipulation_mutex);
445
446	kfree(chip->data_buffer);
447	atomic_set(&chip->data_pending, 0);
448
449	pci_dev_put(chip->pci_dev);
450	return 0;
451	}
452
453	EXPORT_SYMBOL_GPL(tpm_release);
454
455	ssize_t tpm_write(struct file * file, const char __user * buf,
456	size_t size, loff_t * off)
457	{
458	struct tpm_chip *chip = file->private_data;
459	int in_size = size, out_size;
460
461	/* cannot perform a write until the read has cleared
462	either via tpm_read or a user_read_timer timeout */
700d8bdc NA	463	while (atomic_read(&chip->data_pending) != 0)
700d8bdc NA	464	msleep(TPM_TIMEOUT);
1da177e4 LT	465
	466	down(&chip->buffer_mutex);
	467
	468	if (in_size > TPM_BUFSIZE)
	469	in_size = TPM_BUFSIZE;
	470
	471	if (copy_from_user
	472	(chip->data_buffer, (void __user *) buf, in_size)) {
	473	up(&chip->buffer_mutex);
	474	return -EFAULT;
	475	}
	476
	477	/* atomic tpm command send and result receive */
	478	out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
	479
	480	atomic_set(&chip->data_pending, out_size);
	481	up(&chip->buffer_mutex);
	482
	483	/* Set a timeout by which the reader must come claim the result */
	484	down(&chip->timer_manipulation_mutex);
	485	init_timer(&chip->user_read_timer);
	486	chip->user_read_timer.function = user_reader_timeout;
	487	chip->user_read_timer.data = (unsigned long) chip;
	488	chip->user_read_timer.expires = jiffies + (60 * HZ);
	489	add_timer(&chip->user_read_timer);
	490	up(&chip->timer_manipulation_mutex);
	491
	492	return in_size;
	493	}
	494
	495	EXPORT_SYMBOL_GPL(tpm_write);
	496
	497	ssize_t tpm_read(struct file * file, char __user * buf,
	498	size_t size, loff_t * off)
	499	{
	500	struct tpm_chip *chip = file->private_data;
5b44bd58	501	int ret_size;
1da177e4	502
5b44bd58 KH	503	del_singleshot_timer_sync(&chip->user_read_timer);
	504	ret_size = atomic_read(&chip->data_pending);
	505	atomic_set(&chip->data_pending, 0);
	506	if (ret_size > 0) { /* relay data */
	507	if (size < ret_size)
	508	ret_size = size;
1da177e4 LT	509
1da177e4 LT	510	down(&chip->buffer_mutex);
5b44bd58 KH	511	if (copy_to_user
	512	((void __user *) buf, chip->data_buffer, ret_size))
	513	ret_size = -EFAULT;
1da177e4 LT	514	up(&chip->buffer_mutex);
	515	}
	516
	517	return ret_size;
	518	}
	519
	520	EXPORT_SYMBOL_GPL(tpm_read);
	521
	522	void __devexit tpm_remove(struct pci_dev *pci_dev)
	523	{
	524	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	525
	526	if (chip == NULL) {
	527	dev_err(&pci_dev->dev, "No device data found\n");
	528	return;
	529	}
	530
	531	spin_lock(&driver_lock);
	532
	533	list_del(&chip->list);
	534
	535	spin_unlock(&driver_lock);
	536
	537	pci_set_drvdata(pci_dev, NULL);
	538	misc_deregister(&chip->vendor->miscdev);
	539
	540	device_remove_file(&pci_dev->dev, &dev_attr_pubek);
	541	device_remove_file(&pci_dev->dev, &dev_attr_pcrs);
	542	device_remove_file(&pci_dev->dev, &dev_attr_caps);
	543
	544	pci_disable_device(pci_dev);
	545
3122a88a	546	dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
1da177e4 LT	547
	548	kfree(chip);
	549
	550	pci_dev_put(pci_dev);
	551	}
	552
	553	EXPORT_SYMBOL_GPL(tpm_remove);
	554
	555	static u8 savestate[] = {
	556	0, 193, /* TPM_TAG_RQU_COMMAND */
	557	0, 0, 0, 10, /* blob length (in bytes) */
	558	0, 0, 0, 152 /* TPM_ORD_SaveState */
	559	};
	560
	561	/*
	562	* We are about to suspend. Save the TPM state
	563	* so that it can be restored.
	564	*/
4fd416c1	565	int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
1da177e4 LT	566	{
	567	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	568	if (chip == NULL)
	569	return -ENODEV;
	570
	571	tpm_transmit(chip, savestate, sizeof(savestate));
	572	return 0;
	573	}
	574
	575	EXPORT_SYMBOL_GPL(tpm_pm_suspend);
	576
	577	/*
	578	* Resume from a power safe. The BIOS already restored
	579	* the TPM state.
	580	*/
	581	int tpm_pm_resume(struct pci_dev *pci_dev)
	582	{
	583	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	584
	585	if (chip == NULL)
	586	return -ENODEV;
	587
	588	spin_lock(&driver_lock);
	589	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
	590	spin_unlock(&driver_lock);
	591
	592	return 0;
	593	}
	594
	595	EXPORT_SYMBOL_GPL(tpm_pm_resume);
	596
	597	/*
	598	* Called from tpm_<specific>.c probe function only for devices
	599	* the driver has determined it should claim. Prior to calling
	600	* this function the specific probe function has called pci_enable_device
	601	* upon errant exit from this function specific probe function should call
	602	* pci_disable_device
	603	*/
	604	int tpm_register_hardware(struct pci_dev *pci_dev,
	605	struct tpm_vendor_specific *entry)
	606	{
	607	char devname[7];
	608	struct tpm_chip *chip;
	609	int i, j;
	610
	611	/* Driver specific per-device data */
	612	chip = kmalloc(sizeof(*chip), GFP_KERNEL);
	613	if (chip == NULL)
	614	return -ENOMEM;
	615
	616	memset(chip, 0, sizeof(struct tpm_chip));
	617
	618	init_MUTEX(&chip->buffer_mutex);
	619	init_MUTEX(&chip->tpm_mutex);
	620	init_MUTEX(&chip->timer_manipulation_mutex);
	621	INIT_LIST_HEAD(&chip->list);
	622
	623	chip->vendor = entry;
	624
	625	chip->dev_num = -1;
	626
3122a88a KH	627	for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
3122a88a KH	628	for (j = 0; j < 8 * sizeof(int); j++)
1da177e4	629	if ((dev_mask[i] & (1 << j)) == 0) {
3122a88a KH	630	chip->dev_num =
3122a88a KH	631	i * TPM_NUM_MASK_ENTRIES + j;
1da177e4 LT	632	dev_mask[i] \|= 1 << j;
	633	goto dev_num_search_complete;
	634	}
	635
	636	dev_num_search_complete:
	637	if (chip->dev_num < 0) {
	638	dev_err(&pci_dev->dev,
	639	"No available tpm device numbers\n");
	640	kfree(chip);
	641	return -ENODEV;
	642	} else if (chip->dev_num == 0)
	643	chip->vendor->miscdev.minor = TPM_MINOR;
	644	else
	645	chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
	646
	647	snprintf(devname, sizeof(devname), "%s%d", "tpm", chip->dev_num);
	648	chip->vendor->miscdev.name = devname;
	649
	650	chip->vendor->miscdev.dev = &(pci_dev->dev);
	651	chip->pci_dev = pci_dev_get(pci_dev);
	652
	653	if (misc_register(&chip->vendor->miscdev)) {
	654	dev_err(&chip->pci_dev->dev,
	655	"unable to misc_register %s, minor %d\n",
	656	chip->vendor->miscdev.name,
	657	chip->vendor->miscdev.minor);
	658	pci_dev_put(pci_dev);
	659	kfree(chip);
	660	dev_mask[i] &= !(1 << j);
	661	return -ENODEV;
	662	}
	663
	664	pci_set_drvdata(pci_dev, chip);
	665
	666	list_add(&chip->list, &tpm_chip_list);
	667
	668	device_create_file(&pci_dev->dev, &dev_attr_pubek);
	669	device_create_file(&pci_dev->dev, &dev_attr_pcrs);
	670	device_create_file(&pci_dev->dev, &dev_attr_caps);
	671
	672	return 0;
	673	}
	674
	675	EXPORT_SYMBOL_GPL(tpm_register_hardware);
	676
1da177e4 LT	677	MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
	678	MODULE_DESCRIPTION("TPM Driver");
	679	MODULE_VERSION("2.0");
	680	MODULE_LICENSE("GPL");