[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / char / tpm / tpm.c

/*
 * Copyright (C) 2004 IBM Corporation
 *
 * Authors:
 * Leendert van Doorn <leendert@watson.ibm.com>
 * Dave Safford <safford@watson.ibm.com>
 * Reiner Sailer <sailer@watson.ibm.com>
 * Kylene Hall <kjhall@us.ibm.com>
 *
 * Maintained by: <tpmdd_devel@lists.sourceforge.net>
 *
 * Device driver for TCG/TCPA TPM (trusted platform module).
 * Specifications at www.trustedcomputinggroup.org	 
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 * 
 * Note, the TPM chip is not interrupt driven (only polling)
 * and can have very long timeouts (minutes!). Hence the unusual
 * calls to msleep.
 *
 */

#include <linux/sched.h>
#include <linux/poll.h>
#include <linux/spinlock.h>
#include "tpm.h"

enum tpm_const {
	TPM_MINOR = 224,	/* officially assigned */
	TPM_BUFSIZE = 2048,
	TPM_NUM_DEVICES = 256,
	TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
};

  /* PCI configuration addresses */
enum tpm_pci_config_addr {
	PCI_GEN_PMCON_1 = 0xA0,
	PCI_GEN1_DEC = 0xE4,
	PCI_LPC_EN = 0xE6,
	PCI_GEN2_DEC = 0xEC
};

enum tpm_config {
	TPM_LOCK_REG = 0x0D,
	TPM_INTERUPT_REG = 0x0A,
	TPM_BASE_ADDR_LO = 0x08,
	TPM_BASE_ADDR_HI = 0x09,
	TPM_UNLOCK_VALUE = 0x55,
	TPM_LOCK_VALUE = 0xAA,
	TPM_DISABLE_INTERUPT_VALUE = 0x00
};


static LIST_HEAD(tpm_chip_list);
static DEFINE_SPINLOCK(driver_lock);
static int dev_mask[TPM_NUM_MASK_ENTRIES];

static void user_reader_timeout(unsigned long ptr)
{
	struct tpm_chip *chip = (struct tpm_chip *) ptr;

	down(&chip->buffer_mutex);
	atomic_set(&chip->data_pending, 0);
	memset(chip->data_buffer, 0, TPM_BUFSIZE);
	up(&chip->buffer_mutex);
}

/*
 * Initialize the LPC bus and enable the TPM ports
 */
int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
{
	u32 lpcenable, tmp;
	int is_lpcm = 0;

	switch (pci_dev->vendor) {
	case PCI_VENDOR_ID_INTEL:
		switch (pci_dev->device) {
		case PCI_DEVICE_ID_INTEL_82801CA_12:
		case PCI_DEVICE_ID_INTEL_82801DB_12:
			is_lpcm = 1;
			break;
		}
		/* init ICH (enable LPC) */
		pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
		lpcenable |= 0x20000000;
		pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);

		if (is_lpcm) {
			pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
					      &lpcenable);
			if ((lpcenable & 0x20000000) == 0) {
				dev_err(&pci_dev->dev,
					"cannot enable LPC\n");
				return -ENODEV;
			}
		}

		/* initialize TPM registers */
		pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);

		if (!is_lpcm)
			tmp = (tmp & 0xFFFF0000) | (base & 0xFFF0);
		else
			tmp =
			    (tmp & 0xFFFF0000) | (base & 0xFFF0) |
			    0x00000001;

		pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);

		if (is_lpcm) {
			pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
					      &tmp);
			tmp |= 0x00000004;	/* enable CLKRUN */
			pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
					       tmp);
		}
		break;
	case PCI_VENDOR_ID_AMD:
		/* nothing yet */
		break;
	}

	tpm_write_index(TPM_LOCK_REG, TPM_UNLOCK_VALUE);
	tpm_write_index(TPM_INTERUPT_REG, TPM_DISABLE_INTERUPT_VALUE);
	tpm_write_index(TPM_BASE_ADDR_LO, base);
	tpm_write_index(TPM_BASE_ADDR_HI, (base & 0xFF00) >> 8);
	tpm_write_index(TPM_LOCK_REG, TPM_LOCK_VALUE);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);

/*
 * Internal kernel interface to transmit TPM commands
 */
static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
			    size_t bufsiz)
{
	ssize_t len;
	u32 count;
	__be32 *native_size;
	unsigned long stop;

	native_size = (__force __be32 *) (buf + 2);
	count = be32_to_cpu(*native_size);

	if (count == 0)
		return -ENODATA;
	if (count > bufsiz) {
		dev_err(&chip->pci_dev->dev,
			"invalid count value %x %zx \n", count, bufsiz);
		return -E2BIG;
	}

	down(&chip->tpm_mutex);

	if ((len = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
		dev_err(&chip->pci_dev->dev,
			"tpm_transmit: tpm_send: error %zd\n", len);
		return len;
	}

	stop = jiffies + 2 * 60 * HZ;
	do {
		u8 status = inb(chip->vendor->base + 1);
		if ((status & chip->vendor->req_complete_mask) ==
		    chip->vendor->req_complete_val) {
			goto out_recv;
		}
		msleep(TPM_TIMEOUT); /* CHECK */
		rmb();
	} while (time_before(jiffies, stop));


	chip->vendor->cancel(chip);
	dev_err(&chip->pci_dev->dev, "Time expired\n");
	up(&chip->tpm_mutex);
	return -EIO;

out_recv:
	len = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
	if (len < 0)
		dev_err(&chip->pci_dev->dev,
			"tpm_transmit: tpm_recv: error %zd\n", len);
	up(&chip->tpm_mutex);
	return len;
}

#define TPM_DIGEST_SIZE 20
#define CAP_PCR_RESULT_SIZE 18
static const u8 cap_pcr[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 22,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 5,
	0, 0, 0, 4,
	0, 0, 1, 1
};

#define READ_PCR_RESULT_SIZE 30
static const u8 pcrread[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 14,		/* length */
	0, 0, 0, 21,		/* TPM_ORD_PcrRead */
	0, 0, 0, 0		/* PCR index */
};

static ssize_t show_pcrs(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 data[READ_PCR_RESULT_SIZE];
	ssize_t len;
	int i, j, index, num_pcrs;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	memcpy(data, cap_pcr, sizeof(cap_pcr));
	if ((len = tpm_transmit(chip, data, sizeof(data)))
	    < CAP_PCR_RESULT_SIZE)
		return len;

	num_pcrs = be32_to_cpu(*((__force __be32 *) (data + 14)));

	for (i = 0; i < num_pcrs; i++) {
		memcpy(data, pcrread, sizeof(pcrread));
		index = cpu_to_be32(i);
		memcpy(data + 10, &index, 4);
		if ((len = tpm_transmit(chip, data, sizeof(data)))
		    < READ_PCR_RESULT_SIZE)
			return len;
		str += sprintf(str, "PCR-%02d: ", i);
		for (j = 0; j < TPM_DIGEST_SIZE; j++)
			str += sprintf(str, "%02X ", *(data + 10 + j));
		str += sprintf(str, "\n");
	}
	return str - buf;
}

static DEVICE_ATTR(pcrs, S_IRUGO, show_pcrs, NULL);

#define  READ_PUBEK_RESULT_SIZE 314
static const u8 readpubek[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 30,		/* length */
	0, 0, 0, 124,		/* TPM_ORD_ReadPubek */
};

static ssize_t show_pubek(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 data[READ_PUBEK_RESULT_SIZE];
	ssize_t len;
	__be32 *native_val;
	int i;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	memcpy(data, readpubek, sizeof(readpubek));
	memset(data + sizeof(readpubek), 0, 20);	/* zero nonce */

	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	    READ_PUBEK_RESULT_SIZE)
		return len;

	/* 
	   ignore header 10 bytes
	   algorithm 32 bits (1 == RSA )
	   encscheme 16 bits
	   sigscheme 16 bits
	   parameters (RSA 12->bytes: keybit, #primes, expbit)  
	   keylenbytes 32 bits
	   256 byte modulus
	   ignore checksum 20 bytes
	 */

	native_val = (__force __be32 *) (data + 34);

	str +=
	    sprintf(str,
		    "Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
		    "Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
		    " %02X %02X %02X %02X %02X %02X %02X %02X\n"
		    "Modulus length: %d\nModulus: \n",
		    data[10], data[11], data[12], data[13], data[14],
		    data[15], data[16], data[17], data[22], data[23],
		    data[24], data[25], data[26], data[27], data[28],
		    data[29], data[30], data[31], data[32], data[33],
		    be32_to_cpu(*native_val)
	    );

	for (i = 0; i < 256; i++) {
		str += sprintf(str, "%02X ", data[i + 39]);
		if ((i + 1) % 16 == 0)
			str += sprintf(str, "\n");
	}
	return str - buf;
}

static DEVICE_ATTR(pubek, S_IRUGO, show_pubek, NULL);

#define CAP_VER_RESULT_SIZE 18
static const u8 cap_version[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 18,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 6,
	0, 0, 0, 0
};

#define CAP_MANUFACTURER_RESULT_SIZE 18
static const u8 cap_manufacturer[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 22,		/* length */
	0, 0, 0, 101,		/* TPM_ORD_GetCapability */
	0, 0, 0, 5,
	0, 0, 0, 4,
	0, 0, 1, 3
};

static ssize_t show_caps(struct device *dev, struct device_attribute *attr, char *buf)
{
	u8 data[READ_PUBEK_RESULT_SIZE];
	ssize_t len;
	char *str = buf;

	struct tpm_chip *chip =
	    pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	if (chip == NULL)
		return -ENODEV;

	memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));

	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	    CAP_MANUFACTURER_RESULT_SIZE)
		return len;

	str += sprintf(str, "Manufacturer: 0x%x\n",
		       be32_to_cpu(*(data + 14)));

	memcpy(data, cap_version, sizeof(cap_version));

	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	    CAP_VER_RESULT_SIZE)
		return len;

	str +=
	    sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
		    (int) data[14], (int) data[15], (int) data[16],
		    (int) data[17]);

	return str - buf;
}

static DEVICE_ATTR(caps, S_IRUGO, show_caps, NULL);

/*
 * Device file system interface to the TPM
 */
int tpm_open(struct inode *inode, struct file *file)
{
	int rc = 0, minor = iminor(inode);
	struct tpm_chip *chip = NULL, *pos;

	spin_lock(&driver_lock);

	list_for_each_entry(pos, &tpm_chip_list, list) {
		if (pos->vendor->miscdev.minor == minor) {
			chip = pos;
			break;
		}
	}

	if (chip == NULL) {
		rc = -ENODEV;
		goto err_out;
	}

	if (chip->num_opens) {
		dev_dbg(&chip->pci_dev->dev,
			"Another process owns this TPM\n");
		rc = -EBUSY;
		goto err_out;
	}

	chip->num_opens++;
	pci_dev_get(chip->pci_dev);

	spin_unlock(&driver_lock);

	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
	if (chip->data_buffer == NULL) {
		chip->num_opens--;
		pci_dev_put(chip->pci_dev);
		return -ENOMEM;
	}

	atomic_set(&chip->data_pending, 0);

	file->private_data = chip;
	return 0;

err_out:
	spin_unlock(&driver_lock);
	return rc;
}

EXPORT_SYMBOL_GPL(tpm_open);

int tpm_release(struct inode *inode, struct file *file)
{
	struct tpm_chip *chip = file->private_data;
	
	file->private_data = NULL;

	spin_lock(&driver_lock);
	chip->num_opens--;
	spin_unlock(&driver_lock);

	down(&chip->timer_manipulation_mutex);
	if (timer_pending(&chip->user_read_timer))
		del_singleshot_timer_sync(&chip->user_read_timer);
	else if (timer_pending(&chip->device_timer))
		del_singleshot_timer_sync(&chip->device_timer);
	up(&chip->timer_manipulation_mutex);

	kfree(chip->data_buffer);
	atomic_set(&chip->data_pending, 0);

	pci_dev_put(chip->pci_dev);
	return 0;
}

EXPORT_SYMBOL_GPL(tpm_release);

ssize_t tpm_write(struct file * file, const char __user * buf,
		  size_t size, loff_t * off)
{
	struct tpm_chip *chip = file->private_data;
	int in_size = size, out_size;

	/* cannot perform a write until the read has cleared
	   either via tpm_read or a user_read_timer timeout */
	while (atomic_read(&chip->data_pending) != 0)
		msleep(TPM_TIMEOUT);

	down(&chip->buffer_mutex);

	if (in_size > TPM_BUFSIZE)
		in_size = TPM_BUFSIZE;

	if (copy_from_user
	    (chip->data_buffer, (void __user *) buf, in_size)) {
		up(&chip->buffer_mutex);
		return -EFAULT;
	}

	/* atomic tpm command send and result receive */
	out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);

	atomic_set(&chip->data_pending, out_size);
	up(&chip->buffer_mutex);

	/* Set a timeout by which the reader must come claim the result */
	down(&chip->timer_manipulation_mutex);
	init_timer(&chip->user_read_timer);
	chip->user_read_timer.function = user_reader_timeout;
	chip->user_read_timer.data = (unsigned long) chip;
	chip->user_read_timer.expires = jiffies + (60 * HZ);
	add_timer(&chip->user_read_timer);
	up(&chip->timer_manipulation_mutex);

	return in_size;
}

EXPORT_SYMBOL_GPL(tpm_write);

ssize_t tpm_read(struct file * file, char __user * buf,
		 size_t size, loff_t * off)
{
	struct tpm_chip *chip = file->private_data;
	int ret_size;

	del_singleshot_timer_sync(&chip->user_read_timer);
	ret_size = atomic_read(&chip->data_pending);
	atomic_set(&chip->data_pending, 0);
	if (ret_size > 0) {	/* relay data */
		if (size < ret_size)
			ret_size = size;

		down(&chip->buffer_mutex);
		if (copy_to_user
		    ((void __user *) buf, chip->data_buffer, ret_size))
			ret_size = -EFAULT;
		up(&chip->buffer_mutex);
	}

	return ret_size;
}

EXPORT_SYMBOL_GPL(tpm_read);

void __devexit tpm_remove(struct pci_dev *pci_dev)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);

	if (chip == NULL) {
		dev_err(&pci_dev->dev, "No device data found\n");
		return;
	}

	spin_lock(&driver_lock);

	list_del(&chip->list);

	spin_unlock(&driver_lock);

	pci_set_drvdata(pci_dev, NULL);
	misc_deregister(&chip->vendor->miscdev);

	device_remove_file(&pci_dev->dev, &dev_attr_pubek);
	device_remove_file(&pci_dev->dev, &dev_attr_pcrs);
	device_remove_file(&pci_dev->dev, &dev_attr_caps);

	pci_disable_device(pci_dev);

	dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));

	kfree(chip);

	pci_dev_put(pci_dev);
}

EXPORT_SYMBOL_GPL(tpm_remove);

static u8 savestate[] = {
	0, 193,			/* TPM_TAG_RQU_COMMAND */
	0, 0, 0, 10,		/* blob length (in bytes) */
	0, 0, 0, 152		/* TPM_ORD_SaveState */
};

/*
 * We are about to suspend. Save the TPM state
 * so that it can be restored.
 */
int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	if (chip == NULL)
		return -ENODEV;

	tpm_transmit(chip, savestate, sizeof(savestate));
	return 0;
}

EXPORT_SYMBOL_GPL(tpm_pm_suspend);

/*
 * Resume from a power safe. The BIOS already restored
 * the TPM state.
 */
int tpm_pm_resume(struct pci_dev *pci_dev)
{
	struct tpm_chip *chip = pci_get_drvdata(pci_dev);

	if (chip == NULL)
		return -ENODEV;

	spin_lock(&driver_lock);
	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
	spin_unlock(&driver_lock);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_pm_resume);

/*
 * Called from tpm_<specific>.c probe function only for devices 
 * the driver has determined it should claim.  Prior to calling
 * this function the specific probe function has called pci_enable_device
 * upon errant exit from this function specific probe function should call
 * pci_disable_device
 */
int tpm_register_hardware(struct pci_dev *pci_dev,
			  struct tpm_vendor_specific *entry)
{
	char devname[7];
	struct tpm_chip *chip;
	int i, j;

	/* Driver specific per-device data */
	chip = kmalloc(sizeof(*chip), GFP_KERNEL);
	if (chip == NULL)
		return -ENOMEM;

	memset(chip, 0, sizeof(struct tpm_chip));

	init_MUTEX(&chip->buffer_mutex);
	init_MUTEX(&chip->tpm_mutex);
	init_MUTEX(&chip->timer_manipulation_mutex);
	INIT_LIST_HEAD(&chip->list);

	chip->vendor = entry;

	chip->dev_num = -1;

	for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
		for (j = 0; j < 8 * sizeof(int); j++)
			if ((dev_mask[i] & (1 << j)) == 0) {
				chip->dev_num =
				    i * TPM_NUM_MASK_ENTRIES + j;
				dev_mask[i] |= 1 << j;
				goto dev_num_search_complete;
			}

dev_num_search_complete:
	if (chip->dev_num < 0) {
		dev_err(&pci_dev->dev,
			"No available tpm device numbers\n");
		kfree(chip);
		return -ENODEV;
	} else if (chip->dev_num == 0)
		chip->vendor->miscdev.minor = TPM_MINOR;
	else
		chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;

	snprintf(devname, sizeof(devname), "%s%d", "tpm", chip->dev_num);
	chip->vendor->miscdev.name = devname;

	chip->vendor->miscdev.dev = &(pci_dev->dev);
	chip->pci_dev = pci_dev_get(pci_dev);

	if (misc_register(&chip->vendor->miscdev)) {
		dev_err(&chip->pci_dev->dev,
			"unable to misc_register %s, minor %d\n",
			chip->vendor->miscdev.name,
			chip->vendor->miscdev.minor);
		pci_dev_put(pci_dev);
		kfree(chip);
		dev_mask[i] &= !(1 << j);
		return -ENODEV;
	}

	pci_set_drvdata(pci_dev, chip);

	list_add(&chip->list, &tpm_chip_list);

	device_create_file(&pci_dev->dev, &dev_attr_pubek);
	device_create_file(&pci_dev->dev, &dev_attr_pcrs);
	device_create_file(&pci_dev->dev, &dev_attr_caps);

	return 0;
}

EXPORT_SYMBOL_GPL(tpm_register_hardware);

MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
MODULE_DESCRIPTION("TPM Driver");
MODULE_VERSION("2.0");
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Copyright (C) 2004 IBM Corporation
	3	*
	4	* Authors:
	5	* Leendert van Doorn <leendert@watson.ibm.com>
	6	* Dave Safford <safford@watson.ibm.com>
	7	* Reiner Sailer <sailer@watson.ibm.com>
	8	* Kylene Hall <kjhall@us.ibm.com>
	9	*
	10	* Maintained by: <tpmdd_devel@lists.sourceforge.net>
	11	*
	12	* Device driver for TCG/TCPA TPM (trusted platform module).
	13	* Specifications at www.trustedcomputinggroup.org
	14	*
	15	* This program is free software; you can redistribute it and/or
	16	* modify it under the terms of the GNU General Public License as
	17	* published by the Free Software Foundation, version 2 of the
	18	* License.
	19	*
	20	* Note, the TPM chip is not interrupt driven (only polling)
	21	* and can have very long timeouts (minutes!). Hence the unusual
700d8bdc	22	* calls to msleep.
1da177e4 LT	23	*
	24	*/
	25
	26	#include <linux/sched.h>
	27	#include <linux/poll.h>
	28	#include <linux/spinlock.h>
	29	#include "tpm.h"
	30
3122a88a KH	31	enum tpm_const {
	32	TPM_MINOR = 224, /* officially assigned */
	33	TPM_BUFSIZE = 2048,
	34	TPM_NUM_DEVICES = 256,
	35	TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
	36	};
1da177e4	37
3122a88a KH	38	/* PCI configuration addresses */
	39	enum tpm_pci_config_addr {
	40	PCI_GEN_PMCON_1 = 0xA0,
	41	PCI_GEN1_DEC = 0xE4,
	42	PCI_LPC_EN = 0xE6,
	43	PCI_GEN2_DEC = 0xEC
	44	};
	45
	46	enum tpm_config {
	47	TPM_LOCK_REG = 0x0D,
	48	TPM_INTERUPT_REG = 0x0A,
	49	TPM_BASE_ADDR_LO = 0x08,
	50	TPM_BASE_ADDR_HI = 0x09,
	51	TPM_UNLOCK_VALUE = 0x55,
	52	TPM_LOCK_VALUE = 0xAA,
	53	TPM_DISABLE_INTERUPT_VALUE = 0x00
	54	};
1da177e4	55
1da177e4 LT	56
	57	static LIST_HEAD(tpm_chip_list);
	58	static DEFINE_SPINLOCK(driver_lock);
3122a88a	59	static int dev_mask[TPM_NUM_MASK_ENTRIES];
1da177e4 LT	60
	61	static void user_reader_timeout(unsigned long ptr)
	62	{
	63	struct tpm_chip chip = (struct tpm_chip ) ptr;
	64
	65	down(&chip->buffer_mutex);
	66	atomic_set(&chip->data_pending, 0);
	67	memset(chip->data_buffer, 0, TPM_BUFSIZE);
	68	up(&chip->buffer_mutex);
	69	}
	70
1da177e4 LT	71	/*
	72	* Initialize the LPC bus and enable the TPM ports
	73	*/
	74	int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
	75	{
	76	u32 lpcenable, tmp;
	77	int is_lpcm = 0;
	78
	79	switch (pci_dev->vendor) {
	80	case PCI_VENDOR_ID_INTEL:
	81	switch (pci_dev->device) {
	82	case PCI_DEVICE_ID_INTEL_82801CA_12:
	83	case PCI_DEVICE_ID_INTEL_82801DB_12:
	84	is_lpcm = 1;
	85	break;
	86	}
	87	/* init ICH (enable LPC) */
	88	pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
	89	lpcenable \|= 0x20000000;
	90	pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);
	91
	92	if (is_lpcm) {
	93	pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
	94	&lpcenable);
	95	if ((lpcenable & 0x20000000) == 0) {
	96	dev_err(&pci_dev->dev,
	97	"cannot enable LPC\n");
	98	return -ENODEV;
	99	}
	100	}
	101
	102	/* initialize TPM registers */
	103	pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);
	104
	105	if (!is_lpcm)
	106	tmp = (tmp & 0xFFFF0000) \| (base & 0xFFF0);
	107	else
	108	tmp =
	109	(tmp & 0xFFFF0000) \| (base & 0xFFF0) \|
	110	0x00000001;
	111
	112	pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);
	113
	114	if (is_lpcm) {
	115	pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
	116	&tmp);
	117	tmp \|= 0x00000004; /* enable CLKRUN */
	118	pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
	119	tmp);
	120	}
1da177e4 LT	121	break;
	122	case PCI_VENDOR_ID_AMD:
	123	/* nothing yet */
	124	break;
	125	}
	126
3122a88a KH	127	tpm_write_index(TPM_LOCK_REG, TPM_UNLOCK_VALUE);
	128	tpm_write_index(TPM_INTERUPT_REG, TPM_DISABLE_INTERUPT_VALUE);
	129	tpm_write_index(TPM_BASE_ADDR_LO, base);
	130	tpm_write_index(TPM_BASE_ADDR_HI, (base & 0xFF00) >> 8);
	131	tpm_write_index(TPM_LOCK_REG, TPM_LOCK_VALUE);
	132
1da177e4 LT	133	return 0;
	134	}
	135
	136	EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);
	137
	138	/*
	139	* Internal kernel interface to transmit TPM commands
	140	*/
	141	static ssize_t tpm_transmit(struct tpm_chip chip, const char buf,
	142	size_t bufsiz)
	143	{
	144	ssize_t len;
	145	u32 count;
	146	__be32 *native_size;
700d8bdc	147	unsigned long stop;
1da177e4 LT	148
	149	native_size = (__force __be32 *) (buf + 2);
	150	count = be32_to_cpu(*native_size);
	151
	152	if (count == 0)
	153	return -ENODATA;
	154	if (count > bufsiz) {
	155	dev_err(&chip->pci_dev->dev,
b76be681	156	"invalid count value %x %zx \n", count, bufsiz);
1da177e4 LT	157	return -E2BIG;
	158	}
	159
	160	down(&chip->tpm_mutex);
	161
	162	if ((len = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
	163	dev_err(&chip->pci_dev->dev,
b76be681	164	"tpm_transmit: tpm_send: error %zd\n", len);
1da177e4 LT	165	return len;
	166	}
	167
700d8bdc	168	stop = jiffies + 2 * 60 * HZ;
1da177e4 LT	169	do {
	170	u8 status = inb(chip->vendor->base + 1);
	171	if ((status & chip->vendor->req_complete_mask) ==
	172	chip->vendor->req_complete_val) {
1da177e4 LT	173	goto out_recv;
1da177e4 LT	174	}
700d8bdc	175	msleep(TPM_TIMEOUT); /* CHECK */
1da177e4	176	rmb();
700d8bdc	177	} while (time_before(jiffies, stop));
1da177e4 LT	178
	179
	180	chip->vendor->cancel(chip);
	181	dev_err(&chip->pci_dev->dev, "Time expired\n");
	182	up(&chip->tpm_mutex);
	183	return -EIO;
	184
	185	out_recv:
	186	len = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
	187	if (len < 0)
	188	dev_err(&chip->pci_dev->dev,
b76be681	189	"tpm_transmit: tpm_recv: error %zd\n", len);
1da177e4 LT	190	up(&chip->tpm_mutex);
	191	return len;
	192	}
	193
	194	#define TPM_DIGEST_SIZE 20
	195	#define CAP_PCR_RESULT_SIZE 18
dff37e4b	196	static const u8 cap_pcr[] = {
1da177e4 LT	197	0, 193, /* TPM_TAG_RQU_COMMAND */
	198	0, 0, 0, 22, /* length */
	199	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	200	0, 0, 0, 5,
	201	0, 0, 0, 4,
	202	0, 0, 1, 1
	203	};
	204
	205	#define READ_PCR_RESULT_SIZE 30
dff37e4b	206	static const u8 pcrread[] = {
1da177e4 LT	207	0, 193, /* TPM_TAG_RQU_COMMAND */
	208	0, 0, 0, 14, /* length */
	209	0, 0, 0, 21, /* TPM_ORD_PcrRead */
	210	0, 0, 0, 0 /* PCR index */
	211	};
	212
74880c06	213	static ssize_t show_pcrs(struct device dev, struct device_attribute attr, char *buf)
1da177e4 LT	214	{
	215	u8 data[READ_PCR_RESULT_SIZE];
	216	ssize_t len;
	217	int i, j, index, num_pcrs;
	218	char *str = buf;
	219
	220	struct tpm_chip *chip =
	221	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	222	if (chip == NULL)
	223	return -ENODEV;
	224
	225	memcpy(data, cap_pcr, sizeof(cap_pcr));
	226	if ((len = tpm_transmit(chip, data, sizeof(data)))
	227	< CAP_PCR_RESULT_SIZE)
	228	return len;
	229
	230	num_pcrs = be32_to_cpu(((__force __be32 ) (data + 14)));
	231
	232	for (i = 0; i < num_pcrs; i++) {
	233	memcpy(data, pcrread, sizeof(pcrread));
	234	index = cpu_to_be32(i);
	235	memcpy(data + 10, &index, 4);
	236	if ((len = tpm_transmit(chip, data, sizeof(data)))
	237	< READ_PCR_RESULT_SIZE)
	238	return len;
	239	str += sprintf(str, "PCR-%02d: ", i);
	240	for (j = 0; j < TPM_DIGEST_SIZE; j++)
	241	str += sprintf(str, "%02X ", *(data + 10 + j));
	242	str += sprintf(str, "\n");
	243	}
	244	return str - buf;
	245	}
	246
	247	static DEVICE_ATTR(pcrs, S_IRUGO, show_pcrs, NULL);
	248
	249	#define READ_PUBEK_RESULT_SIZE 314
dff37e4b	250	static const u8 readpubek[] = {
1da177e4 LT	251	0, 193, /* TPM_TAG_RQU_COMMAND */
	252	0, 0, 0, 30, /* length */
	253	0, 0, 0, 124, /* TPM_ORD_ReadPubek */
	254	};
	255
74880c06	256	static ssize_t show_pubek(struct device dev, struct device_attribute attr, char *buf)
1da177e4 LT	257	{
	258	u8 data[READ_PUBEK_RESULT_SIZE];
	259	ssize_t len;
	260	__be32 *native_val;
	261	int i;
	262	char *str = buf;
	263
	264	struct tpm_chip *chip =
	265	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	266	if (chip == NULL)
	267	return -ENODEV;
	268
	269	memcpy(data, readpubek, sizeof(readpubek));
	270	memset(data + sizeof(readpubek), 0, 20); /* zero nonce */
	271
	272	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	273	READ_PUBEK_RESULT_SIZE)
	274	return len;
	275
	276	/*
	277	ignore header 10 bytes
	278	algorithm 32 bits (1 == RSA )
	279	encscheme 16 bits
	280	sigscheme 16 bits
	281	parameters (RSA 12->bytes: keybit, #primes, expbit)
	282	keylenbytes 32 bits
	283	256 byte modulus
	284	ignore checksum 20 bytes
	285	*/
	286
	287	native_val = (__force __be32 *) (data + 34);
	288
	289	str +=
	290	sprintf(str,
	291	"Algorithm: %02X %02X %02X %02X\nEncscheme: %02X %02X\n"
	292	"Sigscheme: %02X %02X\nParameters: %02X %02X %02X %02X"
	293	" %02X %02X %02X %02X %02X %02X %02X %02X\n"
	294	"Modulus length: %d\nModulus: \n",
	295	data[10], data[11], data[12], data[13], data[14],
	296	data[15], data[16], data[17], data[22], data[23],
	297	data[24], data[25], data[26], data[27], data[28],
	298	data[29], data[30], data[31], data[32], data[33],
	299	be32_to_cpu(*native_val)
	300	);
	301
	302	for (i = 0; i < 256; i++) {
	303	str += sprintf(str, "%02X ", data[i + 39]);
	304	if ((i + 1) % 16 == 0)
	305	str += sprintf(str, "\n");
	306	}
	307	return str - buf;
	308	}
	309
	310	static DEVICE_ATTR(pubek, S_IRUGO, show_pubek, NULL);
	311
	312	#define CAP_VER_RESULT_SIZE 18
dff37e4b	313	static const u8 cap_version[] = {
1da177e4 LT	314	0, 193, /* TPM_TAG_RQU_COMMAND */
	315	0, 0, 0, 18, /* length */
	316	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	317	0, 0, 0, 6,
	318	0, 0, 0, 0
	319	};
	320
	321	#define CAP_MANUFACTURER_RESULT_SIZE 18
dff37e4b	322	static const u8 cap_manufacturer[] = {
1da177e4 LT	323	0, 193, /* TPM_TAG_RQU_COMMAND */
	324	0, 0, 0, 22, /* length */
	325	0, 0, 0, 101, /* TPM_ORD_GetCapability */
	326	0, 0, 0, 5,
	327	0, 0, 0, 4,
	328	0, 0, 1, 3
	329	};
	330
74880c06	331	static ssize_t show_caps(struct device dev, struct device_attribute attr, char *buf)
1da177e4 LT	332	{
	333	u8 data[READ_PUBEK_RESULT_SIZE];
	334	ssize_t len;
	335	char *str = buf;
	336
	337	struct tpm_chip *chip =
	338	pci_get_drvdata(container_of(dev, struct pci_dev, dev));
	339	if (chip == NULL)
	340	return -ENODEV;
	341
	342	memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
	343
	344	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	345	CAP_MANUFACTURER_RESULT_SIZE)
	346	return len;
	347
	348	str += sprintf(str, "Manufacturer: 0x%x\n",
	349	be32_to_cpu(*(data + 14)));
	350
	351	memcpy(data, cap_version, sizeof(cap_version));
	352
	353	if ((len = tpm_transmit(chip, data, sizeof(data))) <
	354	CAP_VER_RESULT_SIZE)
	355	return len;
	356
	357	str +=
	358	sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
	359	(int) data[14], (int) data[15], (int) data[16],
	360	(int) data[17]);
	361
	362	return str - buf;
	363	}
	364
	365	static DEVICE_ATTR(caps, S_IRUGO, show_caps, NULL);
	366
	367	/*
	368	* Device file system interface to the TPM
	369	*/
	370	int tpm_open(struct inode inode, struct file file)
	371	{
	372	int rc = 0, minor = iminor(inode);
	373	struct tpm_chip chip = NULL, pos;
	374
	375	spin_lock(&driver_lock);
	376
	377	list_for_each_entry(pos, &tpm_chip_list, list) {
	378	if (pos->vendor->miscdev.minor == minor) {
	379	chip = pos;
	380	break;
	381	}
	382	}
	383
	384	if (chip == NULL) {
	385	rc = -ENODEV;
	386	goto err_out;
	387	}
	388
	389	if (chip->num_opens) {
	390	dev_dbg(&chip->pci_dev->dev,
	391	"Another process owns this TPM\n");
	392	rc = -EBUSY;
	393	goto err_out;
	394	}
	395
396	chip->num_opens++;
397	pci_dev_get(chip->pci_dev);
398
399	spin_unlock(&driver_lock);
400
401	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
402	if (chip->data_buffer == NULL) {
403	chip->num_opens--;
404	pci_dev_put(chip->pci_dev);
405	return -ENOMEM;
406	}
407
408	atomic_set(&chip->data_pending, 0);
409
410	file->private_data = chip;
411	return 0;
412
413	err_out:
414	spin_unlock(&driver_lock);
415	return rc;
416	}
417
418	EXPORT_SYMBOL_GPL(tpm_open);
419
420	int tpm_release(struct inode inode, struct file file)
421	{
422	struct tpm_chip *chip = file->private_data;
423
424	file->private_data = NULL;
425
426	spin_lock(&driver_lock);
427	chip->num_opens--;
428	spin_unlock(&driver_lock);
429
430	down(&chip->timer_manipulation_mutex);
431	if (timer_pending(&chip->user_read_timer))
432	del_singleshot_timer_sync(&chip->user_read_timer);
433	else if (timer_pending(&chip->device_timer))
434	del_singleshot_timer_sync(&chip->device_timer);
435	up(&chip->timer_manipulation_mutex);
436
437	kfree(chip->data_buffer);
438	atomic_set(&chip->data_pending, 0);
439
440	pci_dev_put(chip->pci_dev);
441	return 0;
442	}
443
444	EXPORT_SYMBOL_GPL(tpm_release);
445
446	ssize_t tpm_write(struct file * file, const char __user * buf,
447	size_t size, loff_t * off)
448	{
449	struct tpm_chip *chip = file->private_data;
450	int in_size = size, out_size;
451
452	/* cannot perform a write until the read has cleared
453	either via tpm_read or a user_read_timer timeout */
700d8bdc NA	454	while (atomic_read(&chip->data_pending) != 0)
700d8bdc NA	455	msleep(TPM_TIMEOUT);
1da177e4 LT	456
	457	down(&chip->buffer_mutex);
	458
	459	if (in_size > TPM_BUFSIZE)
	460	in_size = TPM_BUFSIZE;
	461
	462	if (copy_from_user
	463	(chip->data_buffer, (void __user *) buf, in_size)) {
	464	up(&chip->buffer_mutex);
	465	return -EFAULT;
	466	}
	467
	468	/* atomic tpm command send and result receive */
	469	out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
	470
	471	atomic_set(&chip->data_pending, out_size);
	472	up(&chip->buffer_mutex);
	473
	474	/* Set a timeout by which the reader must come claim the result */
	475	down(&chip->timer_manipulation_mutex);
	476	init_timer(&chip->user_read_timer);
	477	chip->user_read_timer.function = user_reader_timeout;
	478	chip->user_read_timer.data = (unsigned long) chip;
	479	chip->user_read_timer.expires = jiffies + (60 * HZ);
	480	add_timer(&chip->user_read_timer);
	481	up(&chip->timer_manipulation_mutex);
	482
	483	return in_size;
	484	}
	485
	486	EXPORT_SYMBOL_GPL(tpm_write);
	487
	488	ssize_t tpm_read(struct file * file, char __user * buf,
	489	size_t size, loff_t * off)
	490	{
	491	struct tpm_chip *chip = file->private_data;
5b44bd58	492	int ret_size;
1da177e4	493
5b44bd58 KH	494	del_singleshot_timer_sync(&chip->user_read_timer);
	495	ret_size = atomic_read(&chip->data_pending);
	496	atomic_set(&chip->data_pending, 0);
	497	if (ret_size > 0) { /* relay data */
	498	if (size < ret_size)
	499	ret_size = size;
1da177e4 LT	500
1da177e4 LT	501	down(&chip->buffer_mutex);
5b44bd58 KH	502	if (copy_to_user
	503	((void __user *) buf, chip->data_buffer, ret_size))
	504	ret_size = -EFAULT;
1da177e4 LT	505	up(&chip->buffer_mutex);
	506	}
	507
	508	return ret_size;
	509	}
	510
	511	EXPORT_SYMBOL_GPL(tpm_read);
	512
	513	void __devexit tpm_remove(struct pci_dev *pci_dev)
	514	{
	515	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	516
	517	if (chip == NULL) {
	518	dev_err(&pci_dev->dev, "No device data found\n");
	519	return;
	520	}
	521
	522	spin_lock(&driver_lock);
	523
	524	list_del(&chip->list);
	525
	526	spin_unlock(&driver_lock);
	527
	528	pci_set_drvdata(pci_dev, NULL);
	529	misc_deregister(&chip->vendor->miscdev);
	530
	531	device_remove_file(&pci_dev->dev, &dev_attr_pubek);
	532	device_remove_file(&pci_dev->dev, &dev_attr_pcrs);
	533	device_remove_file(&pci_dev->dev, &dev_attr_caps);
	534
	535	pci_disable_device(pci_dev);
	536
3122a88a	537	dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &= !(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
1da177e4 LT	538
	539	kfree(chip);
	540
	541	pci_dev_put(pci_dev);
	542	}
	543
	544	EXPORT_SYMBOL_GPL(tpm_remove);
	545
	546	static u8 savestate[] = {
	547	0, 193, /* TPM_TAG_RQU_COMMAND */
	548	0, 0, 0, 10, /* blob length (in bytes) */
	549	0, 0, 0, 152 /* TPM_ORD_SaveState */
	550	};
	551
	552	/*
	553	* We are about to suspend. Save the TPM state
	554	* so that it can be restored.
	555	*/
4fd416c1	556	int tpm_pm_suspend(struct pci_dev *pci_dev, pm_message_t pm_state)
1da177e4 LT	557	{
	558	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	559	if (chip == NULL)
	560	return -ENODEV;
	561
	562	tpm_transmit(chip, savestate, sizeof(savestate));
	563	return 0;
	564	}
	565
	566	EXPORT_SYMBOL_GPL(tpm_pm_suspend);
	567
	568	/*
	569	* Resume from a power safe. The BIOS already restored
	570	* the TPM state.
	571	*/
	572	int tpm_pm_resume(struct pci_dev *pci_dev)
	573	{
	574	struct tpm_chip *chip = pci_get_drvdata(pci_dev);
	575
	576	if (chip == NULL)
	577	return -ENODEV;
	578
	579	spin_lock(&driver_lock);
	580	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
	581	spin_unlock(&driver_lock);
	582
	583	return 0;
	584	}
	585
	586	EXPORT_SYMBOL_GPL(tpm_pm_resume);
	587
	588	/*
	589	* Called from tpm_<specific>.c probe function only for devices
	590	* the driver has determined it should claim. Prior to calling
	591	* this function the specific probe function has called pci_enable_device
	592	* upon errant exit from this function specific probe function should call
	593	* pci_disable_device
	594	*/
	595	int tpm_register_hardware(struct pci_dev *pci_dev,
	596	struct tpm_vendor_specific *entry)
	597	{
	598	char devname[7];
	599	struct tpm_chip *chip;
	600	int i, j;
	601
	602	/* Driver specific per-device data */
	603	chip = kmalloc(sizeof(*chip), GFP_KERNEL);
	604	if (chip == NULL)
	605	return -ENOMEM;
	606
	607	memset(chip, 0, sizeof(struct tpm_chip));
	608
	609	init_MUTEX(&chip->buffer_mutex);
	610	init_MUTEX(&chip->tpm_mutex);
	611	init_MUTEX(&chip->timer_manipulation_mutex);
	612	INIT_LIST_HEAD(&chip->list);
	613
	614	chip->vendor = entry;
	615
	616	chip->dev_num = -1;
	617
3122a88a KH	618	for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
3122a88a KH	619	for (j = 0; j < 8 * sizeof(int); j++)
1da177e4	620	if ((dev_mask[i] & (1 << j)) == 0) {
3122a88a KH	621	chip->dev_num =
3122a88a KH	622	i * TPM_NUM_MASK_ENTRIES + j;
1da177e4 LT	623	dev_mask[i] \|= 1 << j;
	624	goto dev_num_search_complete;
	625	}
	626
	627	dev_num_search_complete:
	628	if (chip->dev_num < 0) {
	629	dev_err(&pci_dev->dev,
	630	"No available tpm device numbers\n");
	631	kfree(chip);
	632	return -ENODEV;
	633	} else if (chip->dev_num == 0)
	634	chip->vendor->miscdev.minor = TPM_MINOR;
	635	else
	636	chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
	637
	638	snprintf(devname, sizeof(devname), "%s%d", "tpm", chip->dev_num);
	639	chip->vendor->miscdev.name = devname;
	640
	641	chip->vendor->miscdev.dev = &(pci_dev->dev);
	642	chip->pci_dev = pci_dev_get(pci_dev);
	643
	644	if (misc_register(&chip->vendor->miscdev)) {
	645	dev_err(&chip->pci_dev->dev,
	646	"unable to misc_register %s, minor %d\n",
	647	chip->vendor->miscdev.name,
	648	chip->vendor->miscdev.minor);
	649	pci_dev_put(pci_dev);
	650	kfree(chip);
	651	dev_mask[i] &= !(1 << j);
	652	return -ENODEV;
	653	}
	654
	655	pci_set_drvdata(pci_dev, chip);
	656
	657	list_add(&chip->list, &tpm_chip_list);
	658
	659	device_create_file(&pci_dev->dev, &dev_attr_pubek);
	660	device_create_file(&pci_dev->dev, &dev_attr_pcrs);
	661	device_create_file(&pci_dev->dev, &dev_attr_caps);
	662
	663	return 0;
	664	}
	665
	666	EXPORT_SYMBOL_GPL(tpm_register_hardware);
	667
1da177e4 LT	668	MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
	669	MODULE_DESCRIPTION("TPM Driver");
	670	MODULE_VERSION("2.0");
	671	MODULE_LICENSE("GPL");